Refuse a blank owner, and assemble the claim where the owner lives

[aaylward]

Two layers under #1549. Both queues refuse an empty owner with InvalidArgument before touching the row, and V004 adds CHECK (owner_id <> '') to both request tables, nulling existing blanks on the deploy that adds it. Java only ever writes NULL there. PlatformAdmission::Claim no longer sees the owner; ClaimOne assembles the Claim after the queue's last read of the string. The new gated test drives IndexPool through the gate over the real queue SQL to COMPLETED and kills a mutation that blanks the owner for the duration of the claim.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ast-lol	111139f	Commit Preview URL Branch Preview URL	Sep 14 2026, 07:56 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	1d4-web	111139f	Commit Preview URL Branch Preview URL	Sep 14 2026, 07:55 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	iili	111139f	Commit Preview URL Branch Preview URL	Sep 14 2026, 07:56 PM

[cursor]

Review panel

Four read-only agents, four lenses (correctness/control flow; data access/SQL/resource safety; tests/docs/CI; altitude). Each hunted then tried to refute. Aggregation re-checked survivors against HEAD 1cdcc7fb. CI on that commit: build-and-test green; sanitize (asan) red; ubsan green; tsan still running at review time.

Headline: the change is the right second layer under #1549 — queue refusal + V004 CHECK + assembling Claim only in ClaimOne after the last owner read. Correctness, SQL, and altitude found nothing that survived refute. One fold-in survives: this head's required build-and-test never ran the new suites.

1 finding in the inline comments; soft notes below.

Verified clean (not reported):

• Empty-owner check is local and before SQL on both queues; no TOCTOU with FOR UPDATE SKIP LOCKED
• ClaimOne moves owner only after admission/take returns; removes the Claim under the owner the run will fence on #1549 by-value hazard by API shape, not by a comment on parameter type
• V004 UPDATE-then-CHECK in one DO block; NULL still allowed (NULL <> '' is unknown); both request tables covered; idempotent via IF NOT EXISTS
• RefusesToClaimUnderABlankOwner on both queues pins InvalidArgument (not CHECK → InternalError) and leaves the row PENDING / attempts=0
• Gate e2e ARunTakenThroughTheGateIsFencedAllTheWayToCompleted drives admission + real SQL to COMPLETED, with a 10s bound that bites a blank-owner spin
• Java constraint test: blank refused on both tables; named + NULL accepted; constraint names visible to boot verify; step idempotent
• DESIGN.md “NULL or never blank (V004 CHECK)” matches the constraint
• asan failure is not a memory finding on this change: Resolve target set died on rust-redist 504 Gateway Time-out before any instrumented test ran

Soft notes (not blockers; fold or ignore)

1. rerunningTheMigrationClearsABlankOwnerStoredBeforeTheConstraint plants a blank only on indexing_requests. The FOREACH is shared; same gap V003's platform test has. A one-line twin on reanalysis_requests would close it.
2. Whitespace-only owners (" ") pass both owner.empty() and CHECK (owner_id <> ''). Not the Claim under the owner the run will fence on #1549 failure mode.

The code is ready. The CI receipt for it is not — see the inline comment.

---

Review panel via Cursor

[cursor]

should-fix (CI receipt): these suites — and OwnerNeverBlankConstraintTest — have no execution receipt on this head's required build-and-test.

On run 34859493099, scripts/diff-build reported 533 first-party impacted targets, then:

./scripts/diff-build: line 92: /usr/local/bin/bazel: Argument list too long
--- [diff-build] tests to run: 0
./scripts/diff-build: line 97: /usr/local/bin/bazel: Argument list too long
--- [diff-build] targets to build: 0

The bazel query "… set($TARGET_SET) …" failure is swallowed by | grep … || true, so the job exits 0 having run only //:buildifier_test. Postgres was up; nothing asked it to exercise the blank-owner or gate→COMPLETED paths. (#1549's green run had ~64 impacted → real one_d4_worker suites.)

Not a defect in the tests themselves — they look correctly shaped. Either:

1. fix scripts/diff-build to fail loud (and/or feed targets via --target_pattern_file / query-from-file so ARG_MAX cannot empty the set), or
2. land that fix and re-run, so this PR's claims have a CI receipt before merge.

asan on the same head is a separate infra miss (rust-redist 504 during Resolve target set) — also not a finding on this code, but another required check that never reached the new tests.

[aaylward]

Receipt on the rebased head (https://github.com/muchq/MoonBase/actions/runs/34889778959/job/104129247549): 533 impacted → tests to run: 73, targets to build: 56, executed 73 of 73, all pass — pg_queue_test, reanalysis_queue_test and OwnerNeverBlankConstraintTest among them, against the postgres service.

[cursor]

CI update on 1cdcc7fb: all 24 checks green after asan retry.

asan’s first fail was the rust-redist 504; the retry ran ~45m and passed — confirms it was infra, not a memory finding on this change. Its sanitizer target set also never included pg_queue_test / reanalysis_queue_test (postgres-gated) or the Java constraint suite.

build-and-test is still the same green-with-empty-set run: 533 impacted → ARG_MAX → tests to run: 0. The fold-in stands — these suites still have no CI receipt on this head.

[aaylward]

build-and-test on this head ran nothing — 533 impacted targets blew the inlined query past ARG_MAX and the failure was swallowed. Fix is #1551; I'll rebase this once it lands so the new suites get a real run.

[aaylward]

Rebased onto main with #1551; build-and-test is re-running and should show the new suites this time. Heal test now covers both tables. Not taking the whitespace-only owner: a " " owner is fenceable (its own heartbeat matches it), so it isn't the case that loops — the CHECK is scoped to the one that does.