service-queue: the publish idempotency window never expires on Postgres/MySQL — `String(row.created_at) >= windowStart` compares a `Date.toString()` against ISO text

[zhuangjianguo]

Found by the driver-materialisation consumer census on #13973 (class (c) — genuinely wrong on one side). That sweep is not addressed by this card and does not close it.

The site

packages/services/service-queue/src/db-queue-adapter.ts:250-263, in DbQueueAdapter#publish:

const windowStart = new Date(now.getTime() - this.opts.idempotencyWindowMs).toISOString();
const existing = await this.engine.find(QUEUE_TABLE, { where: { queue, idempotency_key: opts.idempotencyKey }, ... });
const blocking = (existing ?? []).find((row: any) => {
 if (row.status === 'pending' || row.status === 'running') return true;
 return String(row.created_at ?? '') >= windowStart; // <-- here
});
if (blocking) return String(blocking.id);

windowStart is canonical ISO-8601 text: "2026-08-30T10:19:25.947Z".

Why it is wrong on the production default driver

created_at is a builtin audit column. It is not in datetimeFields, so no declared-field coercion reaches it, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm. Pinned in packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts: the live dialects hand updated_at/created_at out of the record read door as a JS Date; SQLite hands back canonical ISO-Z text.

So on Postgres and MySQL the left side of that comparison is

String(new Date()) === "Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)"

and the comparison is a lexicographic string compare of a value beginning with an ASCII letter against a value beginning with an ASCII digit. 'S' (0x53) >= '2' (0x32) — and the same holds for every weekday name and every ISO year this century. The predicate is unconditionally true.

Effect: on Postgres/MySQL every terminal (completed / dlq) row matching the idempotency key blocks a re-publish forever, instead of only while it is inside idempotencyWindowMs. publish() returns the old message id and silently enqueues nothing. The window the ADR-0057 retention comment at the top of this file is built around (the declared retention ... is measured on the very same created_at axis and is >= this window) does not exist on those dialects.

On SQLite both sides are canonical ISO-Z text, lexicographic order equals chronological order, and the check is correct. Every test this seam has drives SQLite or memory, which is why it has stayed green.

Why this is not a ?? fallback

Per #13973's standing prohibition, the open question is which side owes the canonical spelling, not how to make the consumer tolerant. Two candidate shapes:

• A — normalise at the consumer with an instant compare, the shape rest/OCC: postgres 驱动下乐观锁必现假冲突 409 —— normaliseVersionToken 对 Date 做 String() 丢毫秒后与 ISO 字符串严格比较 #13382 landed at the OCC seam (canonicalVersionInstant): compare instants, not strings. Local, no contract change.
• B — normalise at the producer, i.e. teach the read door to present the builtin audit columns in one shape on every dialect. Fixes this site and every sibling in one place, but it reverses a deliberate driver decision (withPostgresCalendarDayAsText: "timestamptz / timestamp are deliberately untouched: those are instants, a Date is the right materialisation for them") and is therefore a maintainer call, not an implementer's.

A regression pin for either needs a Date on the read side; that discriminating input exists in CI only inside @objectstack/driver-sql today (see #13973's point-4 measurement), so the pin most likely belongs in this package driving a hand-made Date, the same split sql-driver-13567-audit-stamp-materialisation.test.ts documents.

Re-run

rg -n 'String\(row\.created_at' packages/services/service-queue/src/

Backlink: #13973 (census), #13382 (the OCC seam, the same shape). Neither is addressed here.

[os-sam]

本评论来自分诊座位(R+81 集中轮,裸卡 32/40)。⛔ 本座位不认领、不派发、不写码、不合并。

判据:代码面逐字复验,推理逐步复核

packages/services/service-queue/src/db-queue-adapter.ts @ origin/main(fc9ba76a):

const windowStart = new Date(now.getTime() - this.opts.idempotencyWindowMs).toISOString();
…
const blocking = (existing ?? []).find((row: any) => {
 if (row.status === 'pending' || row.status === 'running') return true;
 return String(row.created_at ?? '') >= windowStart;
});

字典序论证独立核过一遍:windowStart 首字符恒为 '2'(0x32,本世纪 ISO 年份);String(new Date()) 首字符是星期名首字母 —— Sun/Mon/Tue/Wed/Thu/Fri/Sat ⇒ S M T W T F S,全部落在 0x41–0x5A。七个取值无一例外大于 0x32。⇒ 该谓词在 Date 侧恒为 true。 卡的结论成立,且不依赖任何时区或时刻。

上方那段 ADR-0057 注释也确在原处 ——「the declared retention … is measured on the very same created_at axis and is ≥ this window … makes "the reaper deleted a row the dedup check needed" unrepresentable」。⇒ 这条注释所依赖的窗口,在 Postgres/MySQL 上根本不存在。它把一个恒真的比较描述成一个有边界的窗口。

后果的形状:静默丢消息,不是慢或错

任何曾经用过某 idempotencyKey 并走到终态(completed/dlq)的行,会永久挡住该键的再次 publish。publish() 返回旧 id、什么都没入队,调用方拿到一个看起来成功的返回值。⇒ 这是丢消息,而且不报错。

而它一直是绿的,原因卡也说清了:这一缝的测试全跑 SQLite/memory,两侧都是 ISO 文本,字典序 = 时序,检查是对的。

A / B:A 有已落地的先例,照 A 走

卡把 A/B 摆出来但没裁。本席按 #13973 的家族先例裁:

• rest/OCC: postgres 驱动下乐观锁必现假冲突 409 —— normaliseVersionToken 对 Date 做 String() 丢毫秒后与 ISO 字符串严格比较 #13382(同缝同机制、同为 class(c))已落地的就是 A —— canonicalVersionInstant,packages/metadata-protocol/src/protocol.ts:1435,并带自己的钉子 protocol.occ-version-token-instant.test.ts。⇒ 「在消费端归一、比 instant 不比字符串」在本仓不是候选形状,是既有先例。
• B(在读门统一表征)是维护者的事 —— 它推翻 withPostgresCalendarDayAsText 里写明的驱动决定,[finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 的「Explicitly NOT part of this」也把它划出去了。⛔ 实施者不得自行走 B;若认定只有 B 能修,报 fork,⛔ 不擅改。

⇒ 裁定:走 A。 不是「二选一未定」,是「A 已有先例、B 在手工地板上」。

回归钉的位置 —— 卡这一段是对的,别改

判别性输入(读侧一个真 Date)今天只在 @objectstack/driver-sql 的 CI 里存在(#13973 第 4 点)。⇒ 钉子多半得落在本包内、手工构造 Date,与 sql-driver-13567-audit-stamp-materialisation.test.ts 记录的那条分界同形。⛔ 不要为了钉这一条去扩任何必需 job 的包集合 —— #13567 已把那定为维护者决定,#13973 重申未变。

路由

pm:queue · priority:p1 · domain:services · bug

• p1:生产默认驱动上的静默消息丢失,且失效方向是「看起来成功」。同机制的 rest/OCC: postgres 驱动下乐观锁必现假冲突 409 —— normaliseVersionToken 对 Date 做 String() 丢毫秒后与 ISO 字符串严格比较 #13382 也是 p1 + bug。父卡 [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 是 p2 —— 那是普查的定级,class(c) 的实例按自身后果定,不随普查。
• domain:services:修复落点 packages/services/service-queue/。

查重

与 #13994(同一普查、同一机制、packages/rest 的另一站点)同父不同站点,⛔ 不合并 —— 不同包、不同后果(那边是线缆契约变形,这边是丢消息)、不同验证面。#13382 已闭(先例),#13973 open 且已派发(普查父卡)。⛔ 无重复。

---

Generated by Claude Code