What happened
We ran the kill-the-worker-mid-drain test on a 500-task mixed backlog. 所有已接受的任务在重启后都恰好回来了一次 — no duplicates, no losses. The counter-based lease change from last month is what made this possible.
Why it changed course
For weeks the restore used wall-clock expiry. It looked correct and passed every single-node test. Under two nodes with clock skew it duplicated work. We replaced timestamps with a monotonic counter and the failure mode disappeared.
Current state
- Projects are the durable unit and the queue is disposable.
- Leases are monotonic counters renewed by heartbeat.
- The store remains the single source of truth; the queue can always be rebuilt.
Next steps
Wire the same restore path into the nightly chaos test so a regression here fails loudly instead of surfacing in production.