fix: strengthen import recovery and background processing - #153
Conversation
Release reservations on cancellation, reject duplicate waiting runs, and keep deferred maintenance retries separate from recurring jobs. Keep database persistence outside the admission lock. TDD: reproduced admission and lost-retry failures; 78 focused tests and 7856 unit tests pass.
Preserve strict identities and explicit completion; normalize unknown ETA and clamp display only. All 191 AirDC++ unit tests pass.
Drain existing transactions before maintenance, defer busy jobs, and retain fencing until cancelled worker threads stop. Bound SQLite integrity probes in the engine and purge search history in short retryable batches. TDD: reproduced active-writer admission, cancellation fencing, unbounded health SQL and retention batching failures. 227 focused tests passed, plus the final maintenance and retention regressions.
Persist cursors and retry times, restore interrupted sweeps, commit metadata before provider waits, and share ComicVine throttle state across clients. TDD regressions and 130 metadata/provider/task tests pass.
Honor HTTP and XML rate limits, back off failed requests, preserve account/provider isolation, and prevent concurrent clients bypassing request pacing. TDD regressions and 27 focused provider tests pass.
Keep manual backup and restore compatible with bounded maintenance admission and return actionable busy responses. TDD regression asserts commit and close occur before the worker starts.
Document bounded maintenance admission, cancellation-safe worker fencing, resumable metadata sweeps, and shared provider cooldowns. Full make ci-full passed: 11576 regression tests (91% coverage), 25 accessibility checks, 575 Chromium and 575 Firefox checks, container security, and 7 Docker smoke tests. Existing documented security exceptions remain unchanged.
Preserve exact issue designations, reject corroborated foreign titles, and recover unique local catalog title-and-issue targets with durable checkpoints. Keep ambiguous titles and saved provider identity conflicts in review. Allow filename-based mixed-folder corrections only when a unique exact local title-and-issue target exists. Duplicate-title tests now include competing issue targets because title duplication alone does not establish ambiguity.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6b26e93f65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
The full Python 3.12 run exposed a timing-sensitive test: incremental job progress was required within 0.5 seconds of starting dispatch, including database setup. Commit 7e959bd gives the event wait a bounded 5-second deadline while preserving every progress assertion and explicitly checking that dispatch is still running before the remaining batch is released. All 74 job-queue tests and the normal commit checks pass locally. Full CI is running again; no additional review cycle is requested. |
|
Merged into develop at 7a36815. All four exact-commit development validation workflows passed. Edge publication completed successfully: https://github.com/pullboxapp/pullbox/actions/runs/35309988496 . Both GHCR and Docker Hub now serve 1.3.1-dev for linux/amd64 and linux/arm64 at digest sha256:839221a79ea93631fdef1ba82e728f844deb492679c4260ea47e82b9b9e0e23f. Registry digests and both platform revision labels were verified. Image signing and verification passed in the release workflow. Production latest remains unchanged. The approved exact-package zlib exception retains its October 4 review deadline. |
2 participants
Summary
50-Xand50-O.Why
Real-world imports exposed mixed folders, stale identities, false duplicate groupings, and recovery interruptions that require excessive manual cleanup. These changes reduce avoidable follow-up while retaining conservative matching and source-file protections. Background maintenance and provider retries also need to avoid holding up normal application use.
Validation
make ci-fullpassed, including workflow/secret/dependency checks, formatting/types, migrations and startup, 11,908 main tests with 91% coverage, 25 accessibility tests, 575 Chromium and 575 Firefox E2E tests, production container runtime/security checks, and seven container smoke tests. The main suite reports 13 skips and one expected failure; each browser reports two skips.make validatepasses 11,914 tests, and the focused metadata/restore/scheduler suite passes 58 tests.Security Exception
The container refresh installs
zlib1gversion1:1.3.dfsg+really1.3.1-1+dhi4. With explicit maintainer approval, the existing CVE-2026-85091 exception is extended only to this exact package/version. Debian still lists no fixed package, and Pullbox source has no direct use of the affected non-blockinggzwritefollowed bygzprintf/gzvprintfsequence. This is temporary risk acceptance, not a vulnerability fix. The October 4 review deadline and blocking High-severity gate remain unchanged.Reference: https://security-tracker.debian.org/tracker/CVE-2026-85091
Release Notes
Target:
develop, followed by an edge image after required CI and exact-commit development validation pass. Ambiguous or unsafe files remain in Follow-up; this does not authorize physical library reorganization.