[slopfix] fix(universaldb,util,pegboard-envoy): index dedup gc, fix fixed-window acquire, refund rate-limit tokens on cancel

[MasterPtato]

No description provided.

[MasterPtato]

Stack for rivet-dev/rivet

• #5552 [slopfix] fix(universaldb): match fdb conflict semantics in …
• #5551 [slopfix] fix(universaldb,util,pegboard-envoy): index dedup … 👈
• #5398 feat(kitchen-sink): add churnDb actor and seed driver for co …
• #5397 chore: Clean up
• #5382 [slopfix] docs(self-hosting): correct postgres config format …
• #5356 [slopfix] fix(pegboard): decrement kv_storage_used metric on …
• #5354 [slopfix] refactor(universaldb,ups): single/multi-node udb o …
• #5353 [slopfix] perf(universaldb): fold postgres drain_batch into …
• #5342 [SLOP(claude-opus-4-8-high)] perf(universaldb): batch leader …
• #5341 [slopfix] docs(self-hosting): promote postgres from experime …
• #5340 [slopfix] fix(self-host): repair dev compose generation, kit …
• #5337 [SLOP(claude-opus-4-8-high)] feat(universaldb): graceful pos …
• #5336 [slopfix] test(universaldb): postgres leader failover + abor …
• #5335 [SLOP(claude-opus-4-8-high)] feat(ups): table-backed postgre …
• #5329 [SLOP(claude-opus-4-8-high)] feat(universaldb): postgres lea …
• #5327 [SLOP(claude-opus-4-8)] feat(pegboard-envoy): rate-limit env …
• #5326 [SLOP(claude-opus-4-8)] feat(util): add rate limiter primiti …
• #5322 [SLOP(claude-opus-4-8)] feat(rivetkit-core): add serde durat …
• #5321 Add observation for serde_bare
• #5320 Add observation and ser/de metrics for serde calls
• #5314 [SLOP(claude-opus-4-8-medium)] chore: add profiling cargo pr …
• #5306 [SLOP(claude-opus-4-8)] fix(kitchen-sink): serve built front …
• main

Get stack: forklift get 5551
Push local edits: forklift submit
Merge when ready: forklift merge 5551

_{change pklsvwsu}

[claude]

Review

Reviewed the 3 changed files (postgres/database.rs, throttle.rs, tests/throttle.rs). This is a clean, well-scoped fix.

throttle.rs — FixedWindow acquire() fix

Correct bug fix, two real problems addressed:

1. Wrong sleep duration: old code did sleep(*period) instead of sleep_until(*reset_time), so a caller arriving just before the window resets would wait up to an extra full period unnecessarily.
2. Missing debit on wake: old code reset requests_remaining = *requests_limit without decrementing for the caller that just woke up, effectively granting limit + 1 admissions in that window. New code correctly uses requests_limit.saturating_sub(1).

Both are exercised by the two new tests (fixed_window_acquire_waits_only_for_the_remainder_of_the_window, fixed_window_acquire_debits_the_window_it_waited_for), which clearly assert the previously-buggy behavior. Good regression coverage.

Minor/non-blocking: after waking, *reset_time = Instant::now() + *period is based on actual wake time rather than the scheduled *reset_time + *period, so windows can drift slightly long under scheduler delay. This matches the existing behavior in the reset branch of try_acquire/acquire, so its a pre-existing pattern, not a new issue, just flagging in case its worth a follow-up for tightening window bounds.

tests/throttle.rs

Moving the inline #[cfg(test)] mod tests out of src/throttle.rs into tests/throttle.rs matches the repo convention in CLAUDE.md ("Rust tests live under tests/, not inline ... in src/"). All items used (RateLimiter, RateLimitMethod, try_acquire, acquire) are already pub, so no visibility changes were needed. test-util is already a dev-dependency in Cargo.toml, so start_paused = true / tokio::time::advance continue to work as an integration test.

postgres/database.rs — new index

udb_applied_created_at_idx on created_at directly targets the GC query in spawn_gc (DELETE FROM udb_applied WHERE created_at < now() - ...), which previously had no usable index (PK is (client_node_id, client_seq)) and would have been a full table scan every GC_INTERVAL tick. Good performance fix, and CREATE INDEX IF NOT EXISTS keeps init_schema idempotent across restarts.

Minor/non-blocking: this is not CONCURRENTLY, so on the first deploy after this change, index creation will briefly hold a lock that blocks writes to udb_applied while it builds against existing rows. Given the table is continuously GCd down to DEDUP_ROW_MAX_AGE_SECS, it is likely small in practice, so this is probably fine, just noting it in case any deployment has an unusually large backlog.

Other notes

• No security concerns; both changes are internal-only (rate limiter used by trusted engine code, schema migration is IF NOT EXISTS-guarded).
• The commit title also mentions "refund rate-limit tokens on cancel" and pegboard-envoy, but this PR (being a stacked branch) only contains the universaldb/util scope, no pegboard-envoy files are touched here, so that part appears to live in a sibling PR in the stack. Worth double-checking it lands together if there is a dependency between them.

Overall: solid, well-tested fix. No blocking issues found.