D 2026-09-26T15:13:04.740
L Concurrency\sreview\s2026-09
N text/x-markdown
U zeitgeist
W 3838
# Concurrency review, September 2026
The work that came out of @danshearer's concurrency review of the forge layer, at trunk [4910c69016e5](/r/dmestas/quarry/checkin/4910c69016e5): https://markdownpastebin.com/?id=ba05d64fb32940588fab39b1827db23e
Every item below is a ticket. Each ticket carries what happens, what should happen, where in the code, and the fix shape. The lists are in priority order.
## Single node
1. [54dc6a4148](/r/dmestas/quarry/ticket/54dc6a4148) Chat presence: a tab opening or closing during a presence change crashes the whole server — Critical, Immediate
2. [508fd44ab0](/r/dmestas/quarry/ticket/508fd44ab0) Live-update streams leak one goroutine per closed tab — Severe, High
3. [61cd995161](/r/dmestas/quarry/ticket/61cd995161) No HTTP timeouts and no limit on anonymous chat streams — Severe, High
4. [c21e27c2d6](/r/dmestas/quarry/ticket/c21e27c2d6) Any error reading the ingest cursor triggers a full reindex that empties the index first — Severe, High
5. [7ae62edbcc](/r/dmestas/quarry/ticket/7ae62edbcc) SQLite pragmas and busy_timeout reach one pooled connection; concurrent writes fail busy — Important, High
6. [fe5069ef76](/r/dmestas/quarry/ticket/fe5069ef76) The login rate limiter trusts X-Forwarded-For — Important, High
7. [e60889c0d7](/r/dmestas/quarry/ticket/e60889c0d7) Landing accept: two accepts both proceed, and a push between check and merge lands an unchecked tip — Severe, Medium
8. [3d2980cf29](/r/dmestas/quarry/ticket/3d2980cf29) Check-then-write outside a transaction: invite redemption, last-admin/owner checks, ticket promotion — Important, Medium
9. [8e6ecbb15c](/r/dmestas/quarry/ticket/8e6ecbb15c) Store writes that bypass the lease guard: attachments, settings, config import, CI pipeline save — Important, Medium
10. [86a22fabef](/r/dmestas/quarry/ticket/86a22fabef) A failed reindex leaves the census goroutine and its zit frames process behind — Important, Medium
11. [b880cb13c8](/r/dmestas/quarry/ticket/b880cb13c8) A node that falls behind the stream's one-hour window is never detected — Important, Medium
12. [2af687e64f](/r/dmestas/quarry/ticket/2af687e64f) A CI result can be lost: run marked complete before its tag is written — Important, Medium
13. [4a9f45bab5](/r/dmestas/quarry/ticket/4a9f45bab5) CI webhook events carry no hash, so their ids collide — Minor, Medium
14. [83b111e004](/r/dmestas/quarry/ticket/83b111e004) HandlerWith sets package-level variables that request goroutines read — Minor, Medium
15. [128ffbf478](/r/dmestas/quarry/ticket/128ffbf478) No graceful shutdown; imgproxy lock map never pruned — Minor, Medium
## Several nodes
Designed in RFC 0001; needed before a second node runs. All Low priority until then.
1. [a598314e3f](/r/dmestas/quarry/ticket/a598314e3f) Node identity comes from --addr, so two nodes can share a lease owner name and a consumer
2. [935f72e648](/r/dmestas/quarry/ticket/935f72e648) The lease is checked once before a zit write; a long write can overlap the next holder's; the grace period depends on process history
3. [1d09827992](/r/dmestas/quarry/ticket/1d09827992) Background jobs run on every node: CI dispatch and polling, mirror pulls, auto-accept, the chat bridge, event publishing
4. [18ca45f20e](/r/dmestas/quarry/ticket/18ca45f20e) The shared OLTP file assumes one host (design)
5. [4116d2f4a2](/r/dmestas/quarry/ticket/4116d2f4a2) Write routing to the lease holder is designed but not built (design)
6. [8af7bf74ca](/r/dmestas/quarry/ticket/8af7bf74ca) The private-repository list is cached per process
## Not ticketed
The review names about 25 lower-severity findings but lists only three, all filed above. Two fixes need zit's cooperation and say so in their tickets: an expected-tip check on merge (landing accept) and a pre-commit lease check for long writes.
Z 562b9dcdd4fc7330a9cc5dd6a92efd4a