mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 05:00:07 +00:00
Oliver Kieselbach
12fe945289
Three Codex-review findings in PR1, all real: * HIGH — Maintenance lease expires after 60 s but the per-run budget is 50 min. Without renewal a parallel worker / timer / restore could enter the same "exclusive" section after one minute, and the watchdog would see a free lease while a job is still running. New MaintenanceLeaseHolder spins a renewal task on a 45 s cadence and cancels the handler's CTS on any renewal failure; the in-flight backup then bails via OperationCanceledException and the worker/timer route the job to a clean Failed state without queue-deleting the message. * HIGH — Retry-rollback resets State=Queued + BackupId=null but left QueuedAtUtc on the original wall-clock value. After a retryable service throw the watchdog's 60 min "Queued without pickup" rule could fire mid retry-cycle and call the job dead. Fix: stamp QueuedAtUtc=now on the rollback so the watchdog respects the fresh retry budget. * MEDIUM — ListBackups returned every top-level prefix including runs that never reached manifest.json. Calling GetBackupManifest on such an id returned 404 — confusing UI signal for incomplete runs. Fix: ListBackupIdsAsync now Exists()-checks manifest.json per prefix. New ListAllBackupPrefixesAsync yields (id, hasManifest) tuples for a future admin UI that wants to surface incomplete runs as their own status. Tests: 1952/1952 backend xUnit still green — no regressions, no new test coverage needed because the hotfix paths are exercised indirectly by the existing happy/partial/budget tests + the production storage SDK semantics. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>