The fedwiki_sites usage row now holds an absolute figure: a pool's active
site rows plus the slots its in-flight creates and activations hold.
Every writer recounts under the usage row's own lock, with the lock and
the count as separate statements under READ COMMITTED, so each count sees
every change committed before the lock was granted.
- fedwiki.slot_holds keeps one row per request between its slot gate and
its outcome. It has no foreign key to core.lifecycle_requests, because
no integration table references a delivery table; the count joins the
request row.
- The create and status workflows gate on a version marker. Version 1
takes the slot in HoldSiteSlotActivity and drops the compensating
decrement; the recorded histories replay through the default branch.
A status change whose farm call fails for a reason other than a refusal
reads the farm back before releasing its slot.
- Each outcome step removes its hold and recounts in the transaction that
records the outcome; settle finishes through the same function; the
sweep takes no slot before its farm call and reverts a reactivation
that finds the pool full, counting held slots in its headroom; the sync
ends and boot begins with a recount of every pool, which writes only a
figure that changed.
- AtomicIncrementUsage, AtomicDecrementUsage, RaiseNumericUsageTo,
BoundNumericUsage, ListWorkspaceIDsHoldingUsage, CountSiteSlotsByPool
and DeleteSiteReturningStatus are deleted, with the boot repair and the
sync's drift arithmetic. Core keeps LockNumericUsage and
SetNumericUsage.
- docs/database-locks.md gives the usage row's place in the lock order
and the gate's, outcome, sweep and boot paths.
Tests: the six interleavings now find the figure equal to the rows plus
holds, except that the stale farm list still leaves its row active. Four
changed a step besides their expectation: the double take restores
through HoldSiteSlotActivity at a limit of 2, the boot order and settle
then sync hold their slot, the double release's side transaction writes
no decrement, and the unlocked raise waits on LockNumericUsage and
recounts in its side transaction. Settle then sync starts from a figure
of 1. quota_check_db_test.go's failing limit read runs the recorded
branch. TestGrantRevocationBlocksSiteCreation is now
TestGrantRevocationLeavesTheFigureOverTheLimit.
The two server goldens that call World.Use write the same figures from a
zero row, and no golden moved; the suite passed.
cgalo5758
1b2dc773eb