slotlock 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -3,6 +3,19 @@
 All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and semantic
 versioning.
 
+## 0.5.1 - 2026-10-28
+
+### Fixed
+
+- Upgrading from 0.4, a feed cursor 0.4 gave no longer reads past changes 0.4 pruned: 0.4 pruned
+  by age, not in feed order, so the position 0.5.0 starts each tenant at did not cover every one it
+  took. A cursor 0.4 gave expires after 30 days, as it did in 0.4; one this version gives expires
+  only once a change after it is pruned.
+- A reader starting the feed over reads from the pruned position on, so a change another server
+  left before it (pruning out of order) cannot end a page that is expired at once.
+- The trigger that records how far the feed was pruned is replaced in place, never dropped first,
+  and the upgrade locks the feed while it reads where each tenant starts.
+
 ## 0.5.0 - 2026-10-28
 
 ### Documentation

package/ddl.js

@@ -1094,6 +1094,8 @@ CREATE INDEX IF NOT EXISTS slotlock_outbox_tenant_time_idx
 DO $slotlock_outbox_pruned$
 BEGIN
   IF pg_catalog.to_regclass('slotlock.outbox_pruned') IS NULL THEN
+    -- No change is deleted between reading what is kept and the mark it starts at.
+    LOCK TABLE slotlock.outbox IN SHARE ROW EXCLUSIVE MODE;
     CREATE TABLE IF NOT EXISTS slotlock.outbox_pruned (
       tenant_ref text PRIMARY KEY,
       txid xid8 NOT NULL,
@@ -1128,8 +1130,7 @@ BEGIN
   RETURN NULL;
 END
 $slotlock_outbox_mark_pruned$;
-DROP TRIGGER IF EXISTS slotlock_outbox_mark_pruned ON slotlock.outbox;
-CREATE TRIGGER slotlock_outbox_mark_pruned
+CREATE OR REPLACE TRIGGER slotlock_outbox_mark_pruned
   AFTER DELETE ON slotlock.outbox REFERENCING OLD TABLE AS pruned
   FOR EACH STATEMENT EXECUTE FUNCTION slotlock.outbox_mark_pruned();
 

package/event-feed.js

@@ -36,13 +36,18 @@ export const SLOTLOCK_MAX_WEBHOOK_ENDPOINTS = 10;
 /** After this long failing, an endpoint is disabled and the feed says so (`webhook.disabled`). */
 export const SLOTLOCK_WEBHOOK_FAILING_LIMIT_MS = 24 * 60 * 60 * 1_000;
 function encodePosition(position) {
-    return Buffer.from(`1:${position.txid}:${position.id}:${position.at}`).toString('base64url');
+    return Buffer.from(`2:${position.txid}:${position.id}:${position.at}`).toString('base64url');
 }
 function decodePosition(value) {
     if (value.length > 200 || !/^[A-Za-z0-9_-]+$/.test(value))
         return null;
-    const match = /^1:(\d{1,20}):(\d{1,19}):(\d{1,15})$/.exec(Buffer.from(value, 'base64url').toString());
-    return match ? { txid: match[1], id: match[2], at: Number(match[3]) } : null;
+    const match = /^([12]):(\d{1,20}):(\d{1,19}):(\d{1,15})$/.exec(Buffer.from(value, 'base64url').toString());
+    if (!match)
+        return null;
+    const position = { txid: match[2], id: match[3], at: Number(match[4]) };
+    if (match[1] === '1')
+        position.dated = true;
+    return position;
 }
 function toChange(row) {
     return {
@@ -131,6 +136,9 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
                AND txid < pg_snapshot_xmin(pg_current_snapshot())
                AND (${after?.txid ?? null}::xid8 IS NULL
                     OR (txid, id) > (${after?.txid ?? null}::xid8, ${after?.id ?? null}::bigint))
+               -- Starting over: from the mark on. A change kept before it (one another server
+               -- left when it pruned past it) would end a page that is expired at once.
+               AND (mark.txid IS NULL OR (txid, id) > (mark.txid, mark.id))
              ORDER BY txid, id
              LIMIT ${limit}
           ) page ON true
@@ -139,11 +147,15 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
             if (!head)
                 throw new Error('slotlock: change page returned no row');
             // Whichever server pruned it, and however long it keeps changes: reading on could skip one.
+            // A 0.4 cursor also by its date, as 0.4 did: 0.4 pruned by age, not in feed order, so the
+            // mark its changes started at does not cover every one it took.
             if (after &&
-                head.pruned_txid !== null &&
-                (BigInt(head.pruned_txid) > BigInt(after.txid) ||
-                    (BigInt(head.pruned_txid) === BigInt(after.txid) &&
-                        BigInt(head.pruned_id ?? 0) > BigInt(after.id)))) {
+                ((head.pruned_txid !== null &&
+                    (BigInt(head.pruned_txid) > BigInt(after.txid) ||
+                        (BigInt(head.pruned_txid) === BigInt(after.txid) &&
+                            BigInt(head.pruned_id ?? 0) > BigInt(after.id)))) ||
+                    (after.dated === true &&
+                        after.at < Date.now() - SLOTLOCK_CHANGE_RETENTION_DAYS * 86_400_000))) {
                 return { ok: false, code: 'cursor_expired' };
             }
             const changes = rows.flatMap((row) => (row.id === null ? [] : [toChange(row)]));
@@ -154,7 +166,7 @@ export function slotlockEventFeedMethods(sql, retentionDays = SLOTLOCK_CHANGE_RE
             return {
                 ok: true,
                 changes,
-                next: last?.position ?? encodePosition({ ...here, at: Date.now() }),
+                next: last?.position ?? encodePosition({ txid: here.txid, id: here.id, at: Date.now() }),
             };
         },
         async listRecentChanges(params) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slotlock",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "description": "Resource-first, deterministic calendar and availability engine for AI agents.",
   "license": "Apache-2.0",

package/slotlock.manifest.json

@@ -3,7 +3,7 @@
   "schemaVersion": "1.0",
   "name": "Slotlock",
   "package": "slotlock",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Resource-first, deterministic calendar and availability engine for AI agents.",
   "intervalSemantics": {
     "boundary": "[)",