fix(notifications): list sort index + CAS operator Retry/Discard (P5-3, P5-4)

P5-3: add IX_Notifications_Created_NotificationId (CreatedAt DESC, NotificationId DESC) — the Central UI Notification Outbox list page sorts on exactly that pair, but no existing index leads unconditionally on CreatedAt, so an unfiltered/lightly filtered page fell back to a full clustered-index scan + sort on every COUNT + page request. Mirrors the Medium wave's IX_SiteCalls_Created_TrackedOperationId migration + SQL twin pattern faithfully, including the handwritten docs/plans/sql script. P5-4: operator Retry/Discard was read-check-write keyed on NotificationId only — a detached PipeTo task interleaving with the dispatcher's own write (or a second concurrent operator action) could land between the read and the write and get silently clobbered by the unconditional UpdateAsync, stamping a Delivered row Discarded with stale fields. Adds INotificationOutboxRepository.TryUpdateFromParkedAsync, a single-statement compare-and-swap (WHERE Status == Parked) mirroring SecuredWriteRepository.TryMarkApprovedAsync's CAS shape. NotificationOutboxActor's RetryAsync/DiscardAsync now use the CAS write and, on a lost race, re-read to report "notification already progressed to <Status>" instead of silently overwriting whatever is there now. Proof of failure: reverting only the actor's CAS usage while keeping the repository addition reproduces the silent-overwrite bug — 7 tests fail, including two new deterministic (non-sleep) race-proof tests that mock the exact GetByIdAsync -> lost-CAS -> re-read sequence the finding describes. P5-3 is perf-only; verified via migration/SQL-twin parity instead (no runtime proof-of-failure is meaningful for an index).
2026-08-19 16:20:18 -04:00
parent 11675285af
commit 1cea01d924
12 changed files with 2607 additions and 32 deletions
@@ -205,6 +205,48 @@ VALUES
        return rowsAffected > 0;
    }

+    /// <inheritdoc />
+    public async Task<bool> TryUpdateFromParkedAsync(Notification n, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(n);
+
+        // Same seven mutable delivery-state columns as UpdateAsync, but the WHERE
+        // clause below ALSO requires the row's current Status to still be Parked
+        // -- a single-statement compare-and-swap (arch-review 2026-08-19 P5-4).
+        // Two round trips (GetByIdAsync then this write) with a status check in
+        // between is not a correctness guard by itself: a detached PipeTo task
+        // can race the dispatcher's own write (or a second concurrent operator
+        // action) in that window. Mirrors SecuredWriteRepository.TryMarkApprovedAsync's
+        // conditional ExecuteUpdate/ExecuteSql pattern, expressed via LINQ
+        // ExecuteUpdateAsync (like UpdateAsync above) so this stays portable
+        // across the SQL Server production provider and the SQLite provider the
+        // repository tests run against.
+        var status = n.Status;
+        var retryCount = n.RetryCount;
+        var lastError = n.LastError;
+        var resolvedTargets = n.ResolvedTargets;
+        var lastAttemptAt = n.LastAttemptAt;
+        var nextAttemptAt = n.NextAttemptAt;
+        var deliveredAt = n.DeliveredAt;
+
+        var notificationId = n.NotificationId;
+
+        var rowsAffected = await _context.Notifications
+            .Where(row => row.NotificationId == notificationId && row.Status == NotificationStatus.Parked)
+            .ExecuteUpdateAsync(
+                setters => setters
+                    .SetProperty(row => row.Status, status)
+                    .SetProperty(row => row.RetryCount, retryCount)
+                    .SetProperty(row => row.LastError, lastError)
+                    .SetProperty(row => row.ResolvedTargets, resolvedTargets)
+                    .SetProperty(row => row.LastAttemptAt, lastAttemptAt)
+                    .SetProperty(row => row.NextAttemptAt, nextAttemptAt)
+                    .SetProperty(row => row.DeliveredAt, deliveredAt),
+                cancellationToken);
+
+        return rowsAffected > 0;
+    }
+
    /// <inheritdoc />
    public async Task<Notification?> GetByIdAsync(string notificationId, CancellationToken cancellationToken = default)
    {