community: one writer at a time per ledger, and an inbox publish that bumps from what the network really holds

src-tauri/src/ledger.rs

@@ -0,0 +1,75 @@
+//! One writer at a time, per ledger file.
+//!
+//! Every Freenet slice keeps a small JSON ledger beside the node's data and
+//! mutates it in the same shape: load → talk to the network → save. The
+//! network leg takes seconds, so two overlapping operations both read the old
+//! file and whichever finishes last writes its stale copy over the other's
+//! result.
+//!
+//! That is what zeroed the inbox descriptor on 2026-09-02. The Community view
+//! checks the inbox every 90 s; one of those checks loaded `desc_seq: 0` while
+//! a publish was still putting the descriptor contract, and saved that stale
+//! zero two minutes later — silently downgrading every sealed delivery to the
+//! Soulseek fallback.
+//!
+//! `hold(file)` serializes a whole load → save span against any other span on
+//! the same file. Locks are keyed by file name, so a slice may take another
+//! slice's ledger while holding its own — the inbox does exactly that when it
+//! dispatches sealed cargo into friends, shares and Spaces. The one rule: a
+//! path must never re-take the ledger it already holds.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex, OnceLock};
+use tokio::sync::{Mutex as AsyncMutex, OwnedMutexGuard};
+
+static LOCKS: OnceLock<Mutex<HashMap<&'static str, Arc<AsyncMutex<()>>>>> = OnceLock::new();
+
+/// Take the write lock for one ledger file. Hold the guard across the whole
+/// load → mutate → save span, network legs included.
+pub async fn hold(file: &'static str) -> OwnedMutexGuard<()> {
+    let lock = {
+        let mut map = LOCKS.get_or_init(Default::default).lock().unwrap();
+        map.entry(file).or_default().clone()
+    };
+    lock.lock_owned().await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU32, Ordering};
+
+    /// The lost update this module exists to prevent: two tasks read the same
+    /// counter, await, then write. Under the guard the second must observe the
+    /// first one's write.
+    #[tokio::test]
+    async fn a_holder_sees_the_previous_writers_value() {
+        static CELL: AtomicU32 = AtomicU32::new(0);
+        let one = tokio::spawn(async {
+            let _g = hold("test-race.json").await;
+            let seen = CELL.load(Ordering::SeqCst);
+            tokio::time::sleep(std::time::Duration::from_millis(40)).await;
+            CELL.store(seen + 1, Ordering::SeqCst);
+        });
+        // Long enough that the first task is parked on its sleep, still holding.
+        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        let two = tokio::spawn(async {
+            let _g = hold("test-race.json").await;
+            let seen = CELL.load(Ordering::SeqCst);
+            CELL.store(seen + 1, Ordering::SeqCst);
+        });
+        one.await.unwrap();
+        two.await.unwrap();
+        assert_eq!(CELL.load(Ordering::SeqCst), 2, "the second write clobbered the first");
+    }
+
+    /// Different files must not block each other, or dispatching sealed cargo
+    /// out of a held inbox would deadlock.
+    #[tokio::test]
+    async fn different_files_do_not_block() {
+        let _a = hold("test-a.json").await;
+        let _b = tokio::time::timeout(std::time::Duration::from_millis(500), hold("test-b.json"))
+            .await
+            .expect("a second ledger blocked on an unrelated one");
+    }
+}