Summary
Bound the RevenueCat entitlement drift-check run so sustained transient failures cannot outlive the job's lock-staleness window and permit overlapping executions.
Rationale
Customer checks run sequentially and each transient failure may use the full retry budget. Under a sustained RevenueCat outage, the cumulative duration can exceed the 10-minute stale-lock threshold in the drift-check handler. A second invocation could then acquire the lock and overlap with the still-running first invocation.
Affected areas
supabase/functions/rc-entitlement-drift-check/rc-client.ts
- Customer retry and profile-classification flow.
supabase/functions/rc-entitlement-drift-check/index.ts
- Drift-check mutex lifetime and reporting of incomplete coverage.
Required changes
- Introduce an overall execution deadline or circuit breaker shorter than the lock staleness lifetime.
- Check the remaining budget before each customer check, before retrying a transient failure, and between profiles.
- Preserve the current per-customer retry behavior when sufficient budget remains.
- When the deadline is reached, stop customer calls and classify every unprocessed profile as failed so the run remains explicitly partial.
- Ensure reporting continues to distinguish entitlement drift from partial-check failures.
Acceptance criteria
- A prolonged sequence of timeouts/retryable RevenueCat failures cannot run beyond the configured deadline.
- The configured deadline is safely below the 10-minute lock-staleness threshold.
- No additional RevenueCat request is made once the budget is exhausted.
- Profiles not processed because the deadline elapsed appear in
driftCheckFailed and contribute to failed_count / the partial-failure signal.
- Existing behavior remains unchanged for successful checks, 404 responses, and non-retryable 4xx responses.
- Tests cover deadline exhaustion during a retry and between profiles.
Backlinks
Requested by @Patchalv.
Summary
Bound the RevenueCat entitlement drift-check run so sustained transient failures cannot outlive the job's lock-staleness window and permit overlapping executions.
Rationale
Customer checks run sequentially and each transient failure may use the full retry budget. Under a sustained RevenueCat outage, the cumulative duration can exceed the 10-minute stale-lock threshold in the drift-check handler. A second invocation could then acquire the lock and overlap with the still-running first invocation.
Affected areas
supabase/functions/rc-entitlement-drift-check/rc-client.tssupabase/functions/rc-entitlement-drift-check/index.tsRequired changes
Acceptance criteria
driftCheckFailedand contribute tofailed_count/ the partial-failure signal.Backlinks
Requested by @Patchalv.