fix(queue): 防止过期执行占位阻塞与重复提交

队列恢复后，仍在运行标记中的 River job 可能保留 waiting admission，形成全局 FIFO 队头阻塞；同时旧执行在租约被接管后仍可能创建 attempt 或切换到 submitting。新增 stale admission 自动让出机制，并用当前 execution token 对 attempt 创建和上游提交状态切换做 fencing。任务、River job 和结算状态均不在让出流程中改写。验证：go vet ./...；env -u AI_GATEWAY_TEST_DATABASE_URL go test ./... -count=1；真实 PostgreSQL 集成测试覆盖 stale admission 让出与旧 token 提交拦截。
2026-07-30 18:25:00 +08:00
parent fa818e9ebf
commit 38f87b6970
7 changed files with 306 additions and 8 deletions
@@ -226,6 +226,77 @@ WHERE instance_id = $1`, strings.TrimSpace(instanceID))
 	return nil
 }

+// YieldStaleAsyncTaskAdmissions removes waiting FIFO entries whose River job
+// is still marked running even though the task no longer owns a live execution
+// lease. The job and task remain untouched: a surviving worker can recreate
+// the admission, while unrelated queue followers are no longer head-of-line
+// blocked behind stale runtime ownership.
+func (s *Store) YieldStaleAsyncTaskAdmissions(
+	ctx context.Context,
+	staleAfter time.Duration,
+	limit int,
+) (int64, error) {
+	if staleAfter < workerHeartbeatStaleAfter {
+		staleAfter = workerHeartbeatStaleAfter
+	}
+	if limit <= 0 || limit > 1000 {
+		limit = 100
+	}
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return 0, err
+	}
+	defer rollbackTransaction(tx)
+	if _, err := tx.Exec(ctx, `SELECT pg_advisory_xact_lock(hashtextextended('gateway-stale-admission-yield', 0))`); err != nil {
+		return 0, err
+	}
+	var yielded int64
+	if err := tx.QueryRow(ctx, `
+WITH stale AS MATERIALIZED (
+  SELECT admission.task_id
+  FROM gateway_task_admissions admission
+  JOIN gateway_tasks task ON task.id = admission.task_id
+  JOIN river_job job ON job.id = task.river_job_id
+  WHERE admission.status = 'waiting'
+    AND admission.mode = 'async'
+    AND task.async_mode = true
+    AND task.status = 'queued'
+    AND (task.execution_lease_expires_at IS NULL OR task.execution_lease_expires_at <= now())
+    AND job.queue = 'gateway_tasks'
+    AND job.kind = 'gateway_task_run'
+    AND job.state = 'running'
+    AND job.attempted_at <= now() - $1::interval
+  ORDER BY admission.priority ASC, admission.enqueued_at ASC, admission.task_id ASC
+  LIMIT $2
+),
+locked AS MATERIALIZED (
+  SELECT task_id,
+         pg_advisory_xact_lock(hashtextextended('task-admission:' || task_id::text, 0))
+  FROM stale
+),
+deleted AS (
+  DELETE FROM gateway_task_admissions admission
+  USING locked
+  WHERE admission.task_id = locked.task_id
+    AND admission.status = 'waiting'
+    AND admission.mode = 'async'
+  RETURNING admission.task_id
+)
+SELECT count(*)::bigint
+FROM deleted`, staleAfter.String(), limit).Scan(&yielded); err != nil {
+		return 0, err
+	}
+	if yielded > 0 {
+		if _, err := tx.Exec(ctx, `SELECT pg_notify('gateway_task_admission', '*')`); err != nil {
+			return 0, err
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return 0, err
+	}
+	return yielded, nil
+}
+
 // RecoverOrphanedAsyncRiverJobs retries River jobs whose owning worker is no
 // longer alive after the gateway execution lease has already returned the task
 // to queued. Normal long-running jobs remain protected by their running task