Apa yang terjadi jika operasi ini terjadi dua kali, bersamaan, terlambat,
terbalik urutannya, sebagian sukses, atau dijalankan oleh dua leader?

System behavior preserves declared invariants under concurrency, retry,
partial failure, stale read, and recovery.

A file cannot be ACCEPTED unless scan result is CLEAN and checksum is verified.

T1 reads file.status = SCANNED
T2 reads file.status = SCANNED
T1 writes ACCEPTED
T2 writes REJECTED
Final status = REJECTED
Accepted audit may already exist

ALTER TABLE evidence_file
ADD COLUMN version BIGINT NOT NULL DEFAULT 0;

UPDATE evidence_file
SET status = ?, version = version + 1, updated_at = now()
WHERE file_id = ? AND version = ?;

public final class EvidenceFileRepository {
    public void updateStatus(FileId fileId, long expectedVersion, FileLifecycleStatus next) {
        int updated = jdbc.update("""
            UPDATE evidence_file
            SET status = ?, version = version + 1, updated_at = now()
            WHERE file_id = ? AND version = ?
        """, next.name(), fileId.value(), expectedVersion);

        if (updated != 1) {
            throw new ConcurrentModificationException(
                "Evidence file was modified concurrently: " + fileId.value()
            );
        }
    }
}

SELECT *
FROM evidence_file
WHERE file_id = ?
FOR UPDATE;

public void transitionTo(FileLifecycleStatus next) {
    if (!this.status.canMoveTo(next)) {
        throw new IllegalStateException("Invalid transition " + this.status + " -> " + next);
    }
    this.status = next;
}

CREATE TABLE processed_event (
  consumer_name TEXT NOT NULL,
  event_id TEXT NOT NULL,
  processed_at TIMESTAMPTZ NOT NULL,
  PRIMARY KEY (consumer_name, event_id)
);

@Transactional
public void onFileAccepted(FileAccepted event) {
    if (processedEventRepository.exists("file-projection", event.eventId())) {
        return;
    }

    projectionRepository.markAccepted(
        event.fileId(),
        event.acceptedAt(),
        event.checksum()
    );

    processedEventRepository.insert("file-projection", event.eventId());
}

Idempotency record and side effect must commit together.

UPDATE evidence_projection
SET status = 'ACCEPTED', accepted_at = ?
WHERE file_id = ? AND status <> 'ACCEPTED';

public record FileLifecycleChanged(
    String eventId,
    String fileId,
    long aggregateVersion,
    String previousStatus,
    String nextStatus,
    Instant occurredAt
) {}

@Transactional
public void apply(FileLifecycleChanged event) {
    Projection projection = repository.get(event.fileId());

    if (event.aggregateVersion() <= projection.lastSeenVersion()) {
        return; // duplicate or old event
    }

    if (event.aggregateVersion() != projection.lastSeenVersion() + 1) {
        throw new MissingEventGapException(event.fileId(), projection.lastSeenVersion(), event.aggregateVersion());
    }

    repository.apply(event);
}

public boolean isTerminal() {
    return this == ACCEPTED || this == REJECTED || this == DELETED;
}

public DownloadTicket createDownloadTicket(UserContext user, FileId fileId) {
    StoredFile file = fileRepository.getRequired(fileId);
    PermissionDecision decision = accessPolicy.evaluateAuthoritatively(user, file);

    if (!decision.allowed()) {
        throw new AccessDeniedException("Not allowed to download file payload");
    }

    return downloadTicketIssuer.issue(file, user, Duration.ofMinutes(5));
}

1. DB metadata created
2. Object uploaded
3. Audit event write failed

1. Secret rotated in manager
2. Some pods reload
3. Some pods keep old connection
4. Old secret revoked too early

Commit point = metadata status moves to UPLOADED/QUARANTINED with verified object pointer.

CREATE TABLE outbox_event (
  event_id TEXT PRIMARY KEY,
  aggregate_type TEXT NOT NULL,
  aggregate_id TEXT NOT NULL,
  event_type TEXT NOT NULL,
  payload JSONB NOT NULL,
  status TEXT NOT NULL,
  created_at TIMESTAMPTZ NOT NULL,
  published_at TIMESTAMPTZ
);

- update evidence_file status
- insert outbox_event FILE_ACCEPTED

If object upload succeeds but metadata commit fails:
- mark object with temporary tag/uploadSessionId
- cleanup job deletes temp object after safety window

Leader A gets token 10
Leader B gets token 11
Storage accepts writes only with token >= current token
Leader A resumes and writes with token 10 -> rejected

CREATE TABLE singleton_job_fence (
  job_name TEXT PRIMARY KEY,
  current_token BIGINT NOT NULL
);

UPDATE repair_job
SET status = 'RUNNING', fencing_token = ?
WHERE job_id = ?
  AND ? >= (
    SELECT current_token FROM singleton_job_fence WHERE job_name = 'repair-worker'
  );

Leader election reduces duplicate execution.
Idempotency makes duplicate execution safe.

Original event at T1:
- max upload size policy v3 allowed 150MB
Replay at T2:
- current policy v5 allows only 100MB
If replay re-evaluates policy, file becomes rejected.

public record FileAccepted(
    String eventId,
    String fileId,
    String checksum,
    long sizeBytes,
    String policyVersion,
    String scanEngineVersion,
    Instant acceptedAt
) {}

evidence-search-projection-v1
evidence-search-projection-v2

Pod A: maxUploadSize=100MB
Pod B: maxUploadSize=200MB

Pod A uses DB credential v1
Pod B uses DB credential v2
Secret manager revoked v1
Pod A starts failing

T1 Client sends finalizeUpload(idempotencyKey=K)
T2 Service verifies object checksum
T3 Service updates metadata to UPLOADED
T4 Network timeout before response
T5 Client retries finalizeUpload(idempotencyKey=K)
T6 Service returns previous result, no new file created

T1 Worker reads FILE_UPLOADED event
T2 Worker starts scan
T3 Worker writes scan result CLEAN
T4 Worker crashes before commit offset
T5 Event redelivered
T6 Worker sees scan result already exists and returns safely

T1 Pod A acquires lease token 10
T2 Pod A pauses for 90s
T3 Pod B acquires lease token 11
T4 Pod B runs repair job
T5 Pod A resumes and tries to write with token 10
T6 DB/storage rejects token 10

if (Instant.now().isAfter(file.retentionUntil())) {
    file.delete();
}

public void requestDeletion(Instant decisionTime, RetentionPolicy policy) {
    if (!policy.canDelete(this, decisionTime)) {
        throw new RetentionViolationException(id.value());
    }
    this.status = FileLifecycleStatus.DELETION_REQUESTED;
}

public record VersionedFileState(
    FileId fileId,
    FileLifecycleStatus status,
    long version
) {}

public record AcceptFileCommand(
    FileId fileId,
    long expectedVersion,
    String scanResultId,
    String actorId
) {}

public record CommandEnvelope<T>(
    String commandId,
    String idempotencyKey,
    String actorId,
    Instant requestedAt,
    T payload
) {}

public record DomainDecision(
    List<StateMutation> mutations,
    List<OutboxEvent> events,
    List<ExternalActionRequest> externalActions
) {}

@Test
void concurrentAcceptAndRejectCannotBothWin() throws Exception {
    FileId fileId = fixture.scannedFile();

    ExecutorService pool = Executors.newFixedThreadPool(2);

    Future<?> accept = pool.submit(() -> service.accept(fileId));
    Future<?> reject = pool.submit(() -> service.reject(fileId, "MALWARE"));

    ignoreConflict(accept);
    ignoreConflict(reject);

    StoredFile file = repository.getRequired(fileId);
    assertTrue(file.status() == ACCEPTED || file.status() == REJECTED);
    assertSingleTerminalAuditEvent(fileId);
}

@Test
void duplicateFileAcceptedEventIsIdempotent() {
    FileAccepted event = fixture.fileAcceptedEvent();

    consumer.onFileAccepted(event);
    consumer.onFileAccepted(event);

    assertEquals(1, projectionRepository.countAcceptedRows(event.fileId()));
    assertEquals(1, processedEventRepository.count(event.eventId()));
}

@Test
void oldLifecycleEventCannotMoveProjectionBackward() {
    consumer.apply(event(version: 5, status: "ACCEPTED"));
    consumer.apply(event(version: 4, status: "SCANNED"));

    Projection p = projectionRepository.get(fileId);
    assertEquals("ACCEPTED", p.status());
    assertEquals(5, p.lastSeenVersion());
}

Given pod A uses config version v1
And pod B uses config version v2
When both process upload finalization
Then audit event records config version
And behavior difference is explainable

Given service has active DB connections using credential v1
When credential v2 is issued
And v1 remains valid during overlap window
Then service refreshes connection pool
And v1 is not revoked until no active v1 use is observed

state_concurrent_modification_total
state_invalid_transition_total
event_duplicate_detected_total
event_gap_detected_total
event_old_version_ignored_total
outbox_publish_lag_seconds
outbox_unpublished_total
reconciliation_finding_total
replay_drift_total
cache_stale_critical_read_total
leader_fencing_rejection_total
config_version_skew_pods
secret_old_version_in_use_total

event_gap_detected_total > 0
outbox_unpublished_total increasing for 15 minutes
replay_drift_total > 0 after replay validation
leader_fencing_rejection_total > 0 after leadership change
accepted_file_without_scan_total > 0
metadata_payload_mismatch_total > 0
secret_old_version_in_use_total > 0 after rotation window

## Consistency Review

### State
- Entity:
- Source of truth:
- Derived states:

### Invariants
- Invariant 1:
- Invariant 2:

### Concurrency
- Possible concurrent commands:
- Conflict detection:
- Conflict resolution:
- Locking strategy:

### Events
- Event identity:
- Ordering key:
- Aggregate version:
- Duplicate handling:
- Missing event detection:

### Partial Failure
- Commit point:
- Side effects:
- Outbox/transaction boundary:
- Compensation:
- Reconciliation:

### Staleness
- Cached data:
- TTL:
- Critical recheck:
- Replica lag tolerance:

### Leadership
- Singleton jobs:
- Lease:
- Fencing token:
- Idempotency:

### Replay
- Replay mode:
- Side effects disabled:
- Projection version:
- Drift detection:

### Observability
- Metrics:
- Alerts:
- Audit events:
- Runbook: