[perfloop]

A delayed CAS delete could replace a newer absent-key fence when its merge arrived later than its stamp. The merge operator now keeps the newer tombstone, so an ordered refill based on the earlier absence token is rejected.

The repair covers CAS-only operations on one Storage instance while the tombstone remains retained. Plain/CAS mixing, owner changes, restarts, and the existing fence-retention sweep remain outside this guarantee. The API and stored schema are unchanged.

The storage test sets a one-hour fence retention in StorageConfig before construction starts the cleaner, pauses the earlier delete before its merge, completes the later invalidation, and attempts an inline refill with the intervening token. Merge tests compare all-at-once and successive-base folding; existing tests retain fresh-token, unordered-refill, and advancing-delete behavior. A package-only metadata hook coordinates the pause; it adds no public surface.

satisfied

violated

07d0dd86ad1fd6d5dbffc694fbdff9ae33c4b449

The runner used for the recorded source comparison is not part of the pull request; the deterministic regression test is. The targeted storage test, full storage suite, targeted race run, CAS integration suite, CAS E2E, lint, and license check passed. The CI's jemalloc-linked CAS E2E variant and the full CI workflow were not run here.

---

Generated by Perfloop.

---

Note

Medium Risk
Changes CAS tombstone merge semantics for concurrent/out-of-order deletes, which is correctness-critical for cache invalidation ordering though scoped to the existing fence model and covered by new tests.

Overview
Fixes a CAS fencing bug where a delete whose stamp was issued earlier but merged later could replace a newer absent-key tombstone and wrongly admit a refill that had observed the gap between the two invalidations.

The merge operator now only advances the fence on a repeat delete over a tombstone when op.Version >= base.Version, so a delayed older delete keeps the newer fence and surfaces a version mismatch instead of lowering it. DeleteIfVersion invokes the existing test-only beforeMetaCommit hook before the metadata merge (same as puts), enabling a storage-level regression that pauses the first delete, commits a second invalidation, then rejects a stale PutIfVersion. Test helpers accept optional StorageConfig tweaks (e.g. fence retention); merge tests assert all-at-once vs split folding still match.

^{Reviewed by Cursor Bugbot for commit dc31114. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; the previous test race is fixed and no new blocking issue was found.

Summary

This PR keeps a newer absent-key fence when an older CAS delete arrives late.

• Delayed CAS deletes keep newer fences in place.

_{Reviews (2) · Last reviewed commit: "test: configure CAS fence retention befo..." · Reviewed by Greptile}