fix: preserve loop results under SQLite contention - #690

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
compozy-site	Ready	Preview	Oct 4, 2026 5:31am UTC

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

Walkthrough

The change adds bounded retries for scheduled-job dispatch and daemon persistence. Action settlement reserves leases while writing results, and lease recovery excludes reserved runs. Loop reconciliation uses updated queries and transactions. Heartbeat-wake sweeps skip writes when no events have expired.

Changes

Scheduled job dispatch

Daemon persistence and lease settlement

Loop reconciliation and heartbeat sweeps

Priority: ⬆️ High

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant LoopActionRuntime
  participant TaskService
  participant TaskRunRepo
  LoopActionRuntime->>TaskService: reserve run lease settlement
  TaskService->>TaskRunRepo: reserve run lease
  LoopActionRuntime->>TaskRunRepo: retry result persistence
  LoopActionRuntime->>TaskService: release run lease settlement

Merge Risk: ⚪ Minimal · up to 4cdd2

The claimed lease-reservation race is not reachable. No remaining issue from this review prevents merging after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 4cdd2

The change improves protection against repeated tool execution during database contention and preserves existing ownership checks. However, repeated persistence failures can keep completed work awaiting settlement indefinitely while the application remains running, preventing normal expired-lease recovery. No privilege escalation or externally reachable attack path was established.

Retained concerns

• Medium · reliability · inferred: Settlement has bounded attempts but no overall lifetime while the daemon remains active. Repeated retryable persistence failures can leave a returned tool outcome awaiting terminal persistence while its reservation excludes expired-lease recovery. Action timeout does not end this settlement context; success, a nonretryable error, or daemon cancellation is needed to release it. This is an introduced failure-containment tradeoff, not a verified authorization bypass.

• Fix all pre-merge checks with AI

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Confidence Score: 5/5

[High risk] Adds database schema migration and retry logic for task persistence.

The PR appears safe to merge; no new actionable finding remains.

sequenceDiagram
  participant A as Loop action
  participant T as Task service
  participant D as SQLite
  participant R as Lease recovery
  A->>T: Reserve completed result's lease
  T->>T: Record token-fenced reservation
  A->>D: Retry terminal write
  R->>T: Check expired leases
  T-->>R: Exclude reserved lease
  D-->>A: Commit terminal result
  A->>T: Release reservation

_{Reviews (2) · Last reviewed commit: "fix: fence pending loop settlement throu..."}

All three actionable review threads are addressed in 4cdd27d. The additional CodeRabbit heartbeat-test nitpick is also fixed: parent t.Parallel runs before its subtests.

Real-SQLite regression coverage now includes shutdown grace, settlement beyond the lease deadline, recovery already waiting on the writer, reservation release, and deterministic provenance. The pre-commit checks passed. Further delivery validation uses the current-head CI without additional heavy local suites.

@coderabbitai review

Current-head review disposition (4cdd27d88a6fb5407461f56efbca645a6e7b6bc3):

• CodeRabbit approved with no actionable comments; its provenance finding and heartbeat-test ordering nitpick are fixed.
• Greptile reports confidence 5/5 and no remaining actionable finding; both terminal-persistence P1 findings are fixed.
• All three inline review threads are resolved.
• The architecture note about retaining a completed result during repeated transient write failures describes the intended behavior required by [Loops] Reconciliation cycle blocks SQLite writes for ~20 s; tool results that land inside it are lost #689. Releasing its reservation on an arbitrary total timeout would permit replay of side effects. Each attempt and backoff remain cancellable, and daemon shutdown starts bounded settlement grace. A durable outcome handoff is a separate design, not required for this repair.
• The automatic docstring-percentage warning is advisory; no missing behavioral documentation was identified. Existing source-comment conventions and the updated QA/impact documentation are retained without adding boilerplate to meet a generic percentage.

CI remains in progress. Merge will wait for the current head to pass.

Final delivery evidence for 4cdd27d88a6fb5407461f56efbca645a6e7b6bc3:

• CI run 37180015411 completed successfully on this exact head. All 33 reported checks pass; 17 release/conditional checks are skipped, with no pending or failed checks.
• Desktop E2E: 30 tests passed, including the full sixty-minute native catalog scenario.
• CodeRabbit approved the current head with no actionable findings. Greptile reports confidence 5/5 with no actionable findings. All three inline review threads are resolved; the separate heartbeat-test nitpick is fixed. Advisory dispositions are recorded above.
• The PR is mergeable with a clean merge state. CI is the delivery gate; no further heavy local validation was run after the requested stop.