- Shipped
- September 23, 2026 at 1:28 AM UTC
- Author
- Kamo
- Commit
- 84746ae
The lead ledgers (securityservice create_lead_ledgers.sql, applied 2026-09-22) replace COUNT(*) over a 796k-lead pool and over lead_credits with maintained totals plus an append-only journal that row triggers write. This service keeps them folded and honest: - LeadLedgerFoldJob (every 30 s): one statement per batch deletes journal rows and adds them to the totals, so a reader sees the figure before or after, never half. Readers already add the journal to the total, so a missed tick costs read time, never correctness. At most 40 batches of 5,000 per tick. - LeadLedgerReconcileJob (03:40 nightly): recounts each org's pool and every member's available credits from the rows and compares them with total + journal in ONE statement (one snapshot). Differences are APPENDED as 'RECONCILE' deltas, never written over a total, so the recount cannot race the triggers or a fold. It also names any journal trigger that is missing or disabled. In a healthy system it finds nothing, so every correction is logged at WARN. Both are @DisallowConcurrentExecution and retry a statement YugabyteDB aborts with 40001 (each is atomic, so a retry cannot double-count). The SQL was replayed against YugabyteDB before this shipped (temp tables: triggers, reads, fold and recount, 60 checks). JobTriggerController: POST /api/daemon/trigger/{job} and GET /status answered anyone. SecurityConfig permits all, and the daemon-route IngressRoute puts this service on the public websecure entrypoint (Host daemon.internal.kamocrm.com; probed 200 anonymously), so any job — now including the recount — could be started from the internet, as many overlapping copies as the Quartz pool holds. Both now require X-Internal-Auth = mlos.internal-auth-secret (constant-time) and refuse everyone when that secret is unset. Nothing in the platform calls this endpoint; an operator still can, from inside the cluster. Tests: LeadLedgerMaintenanceTest (fold loop and cap, recount reporting, missing triggers, the retry rule, and the SQL shapes that make it safe beside live traffic), JobTriggerControllerAuthTest.