P2: Mail proxy hides the live mailbox during a UIDVALIDITY rebuild #898

Open
opened 2026-10-02 17:37:52 +00:00 by kayg · 0 comments
Owner

Review target: job/mailproxy-486 at 7f796c4ca. Static evidence only; no tests run.

P2: a UIDVALIDITY reset hides the committed live view during backfill

  • Evidence: crates/plugins/mail/src/proxy.rs:30 requires both
    m.generation=f.live_generation and m.uid_validity=f.uid_validity.
    cache::ensure_generation changes f.uid_validity to the new provider epoch
    but keeps live_generation at the old generation during a non-empty rebuild
    (crates/plugins/mail/src/cache/store.rs:796).
  • Result: the old committed memberships fail the second join condition. The
    next snapshot is empty for that folder. An IDLE refresh emits EXPUNGE for
    all its messages before the new generation is ready. A failed backfill can
    keep this false empty state for its full retry period.
  • Rule: DESIGN §§45 and 53 require generation-safe cached mail. An unfinished
    generation must not replace the committed view.
  • Fix: get the committed epoch from the live generation record. For body
    reads, allow an already cached exact body of that live revision. Refuse a
    remote fetch when its epoch differs. Switch the visible memberships only
    when the replacement generation commits.
  • Test idea: use ensure_generation to start a non-empty epoch reset. Before
    activation, assert that SELECT and IDLE keep the old view. After activation,
    assert that new virtual UIDs replace it. The current reset test changes both
    generation fields at once, so it does not cover this state.
Review target: job/mailproxy-486 at 7f796c4ca. Static evidence only; no tests run. ## P2: a UIDVALIDITY reset hides the committed live view during backfill - Evidence: `crates/plugins/mail/src/proxy.rs:30` requires both `m.generation=f.live_generation` and `m.uid_validity=f.uid_validity`. `cache::ensure_generation` changes `f.uid_validity` to the new provider epoch but keeps `live_generation` at the old generation during a non-empty rebuild (`crates/plugins/mail/src/cache/store.rs:796`). - Result: the old committed memberships fail the second join condition. The next snapshot is empty for that folder. An IDLE refresh emits EXPUNGE for all its messages before the new generation is ready. A failed backfill can keep this false empty state for its full retry period. - Rule: DESIGN §§45 and 53 require generation-safe cached mail. An unfinished generation must not replace the committed view. - Fix: get the committed epoch from the live generation record. For body reads, allow an already cached exact body of that live revision. Refuse a remote fetch when its epoch differs. Switch the visible memberships only when the replacement generation commits. - Test idea: use `ensure_generation` to start a non-empty epoch reset. Before activation, assert that SELECT and IDLE keep the old view. After activation, assert that new virtual UIDs replace it. The current reset test changes both generation fields at once, so it does not cover this state.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#898
No description provided.