prisma-risk / tsoracle / 26370292007

95%

push

github

fix(server): sample now_ms once per get_ts to close the window-extension race (#303)

get_ts read the wall clock multiple times per request — once in the retry
try_grant and again in extend_window's would_grant recheck and
try_prepare_window_extension. With a small (or zero) window_ahead the committed
bound has no slack above the clock, so if the clock advanced between the
would_grant recheck and the retry try_grant, the retry exhausted the window and
the request failed with Internal "window exhausted". On fast hardware the gap
stays sub-millisecond, so it only surfaced as a rare flake under the slow,
contended CI coverage runner (client_backpressure's first_chunk test).

Sample now_ms once at the top of get_ts and thread that single value through
the retry try_grant and extend_window (would_grant + try_prepare). The
would_grant recheck now predicts the retry try_grant exactly, and the whole
operation is evaluated at one logical instant — also removing the latent
production fragility for any small window_ahead.

Adds a deterministic regression test (tests/dst_window_race.rs) behind an opt-in
`dst` feature: it runs the real gRPC server and a tonic client inside turmoil's
single-threaded simulation with a clock that advances on every read,
reproducing the race 100% in ~0.01s from a fixed seed (the flake was otherwise
unreproducible on developer hardware). Asserts get_ts succeeds: RED before this
fix, GREEN after.

3 of 3 new or added lines in 1 file covered. (100.0%)

11264 of 11868 relevant lines covered (94.91%)

480191.37 hits per line