Confine phased sync slots to sync_interval remotes

Unset remotes keep the mutable_ttl freshness predicate. Scheduled remotes
compute their slot in Go, skip the create-time prime and wait for their
first slot; a cold-cache prime still runs at once. Document sync_interval.

internal/database/github_sync.go

@@ -3,7 +3,6 @@ package database
 import (
 	"context"
 	"errors"
-	"hash/fnv"
 	"time"
 
 	"github.com/jackc/pgx/v5"
@@ -35,8 +34,8 @@ func (db *DB) ListGitHubRPMRemotes(ctx context.Context) ([]models.Remote, error)
 
 // ClaimGitHubSyncLease atomically claims the per-remote github_rpm sync lease.
 // See claimSyncLease.
-func (db *DB) ClaimGitHubSyncLease(ctx context.Context, remoteName, owner string, freshness, lease time.Duration) (bool, string, error) {
-	return db.claimSyncLease(ctx, "github_rpm_sync_state", remoteName, owner, freshness, lease)
+func (db *DB) ClaimGitHubSyncLease(ctx context.Context, remoteName, owner string, freshness, lease time.Duration, slot time.Time) (bool, string, error) {
+	return db.claimSyncLease(ctx, "github_rpm_sync_state", remoteName, owner, freshness, lease, slot)
 }
 
 // ReleaseGitHubSyncLease records a github_rpm scan outcome and frees the lease.
@@ -48,14 +47,17 @@ func (db *DB) ReleaseGitHubSyncLease(ctx context.Context, remoteName, owner stri
 // claimSyncLease atomically claims a per-remote sync lease in table. It succeeds
 // (claimed=true) only when the remote is due and no live lease is held by
 // another replica. Due means: a pending retry after a failed scan has reached
-// next_retry_at, or, with no retry pending, the remote was never synced or not
-// since its latest slot boundary. Boundaries recur every freshness, offset by a
-// stable per-remote phase so remotes sharing a TTL are spread across it rather
-// than due together. A zero freshness (prime scans) ignores the recency gate
-// but still honours a pending retry's backoff. The returned etag is
+// next_retry_at, or, with no retry pending, the remote was never synced or was
+// last synced before slot (when set) or longer than freshness ago (otherwise).
+// A zero freshness with no slot (prime scans) ignores the recency gate but
+// still honours a pending retry's backoff. The returned etag is
 // the stored releases-list ETag, shared across replicas so a conditional request
 // can short-circuit an unchanged repo.
-func (db *DB) claimSyncLease(ctx context.Context, table, remoteName, owner string, freshness, lease time.Duration) (bool, string, error) {
+func (db *DB) claimSyncLease(ctx context.Context, table, remoteName, owner string, freshness, lease time.Duration, slot time.Time) (bool, string, error) {
+	var slotArg *time.Time
+	if !slot.IsZero() {
+		slotArg = &slot
+	}
 	row := db.Pool.QueryRow(ctx, `
 		INSERT INTO `+table+` AS s (remote_name, sync_lease_owner, sync_lease_expires)
 		VALUES ($1, $2, now() + make_interval(secs => $4))
@@ -63,11 +65,10 @@ func (db *DB) claimSyncLease(ctx context.Context, table, remoteName, owner strin
 			SET sync_lease_owner   = $2,
 			    sync_lease_expires = now() + make_interval(secs => $4)
 			WHERE (CASE WHEN s.next_retry_at IS NOT NULL THEN s.next_retry_at <= now()
-			            ELSE s.last_synced_at IS NULL OR s.last_synced_at < CASE WHEN $3 <= 0 THEN now()
-			                 ELSE to_timestamp(floor((extract(epoch from now())::float8 - $5) / NULLIF($3, 0)) * $3 + $5) END END)
+			            ELSE s.last_synced_at IS NULL OR s.last_synced_at < COALESCE($5::timestamptz, now() - make_interval(secs => $3)) END)
 			  AND (s.sync_lease_expires IS NULL OR s.sync_lease_expires < now())
 		RETURNING s.etag
-	`, remoteName, owner, freshness.Seconds(), lease.Seconds(), syncPhase(remoteName, freshness).Seconds())
+	`, remoteName, owner, freshness.Seconds(), lease.Seconds(), slotArg)
 
 	var etag string
 	if err := row.Scan(&etag); err != nil {
@@ -79,17 +80,6 @@ func (db *DB) claimSyncLease(ctx context.Context, table, remoteName, owner strin
 	return true, etag, nil
 }
 
-// syncPhase is remoteName's stable offset within period, so every replica
-// agrees on when each remote is due.
-func syncPhase(remoteName string, period time.Duration) time.Duration {
-	if period <= 0 {
-		return 0
-	}
-	h := fnv.New64a()
-	_, _ = h.Write([]byte(remoteName))
-	return time.Duration(h.Sum64() % uint64(period))
-}
-
 // releaseSyncLease records a scan outcome and frees the lease; only the owning
 // replica may release. Success advances last_synced_at, persists the etag and
 // clears any retry. Failure leaves last_synced_at and etag untouched (the last