Scope the fingerprint invariant to the wired syncer and pin lease > scan timeout

docs/rpm/remote-github.md

@@ -93,5 +93,5 @@ Repodata is regenerated from the metadata rows on every request by default. Set
 `primary`/`filelists`/`other` files in memory per replica. Each request checks a
 cheap row fingerprint (count + newest id) in the database and rebuilds only when
 it moved, so every replica picks up a scan's changes on its next request. The
-fingerprint relies on only one scan writing a remote's rows at a time, which the
-sync lease guarantees across replicas.
+fingerprint relies on only one scan writing a remote's rows at a time; in the
+deployed server, the sync lease serialises scans across replicas.

internal/database/rpm_metadata.go

@@ -42,7 +42,7 @@ func (db *DB) DeleteRPMMetadata(ctx context.Context, repoName, filePath string)
 
 // RPMMetadataFingerprint is a cheap change detector for a repo's rows: they are
 // only ever inserted or deleted, so (count, max id) moves whenever they change.
-// Sound only while a remote's writers are serialised (github_rpm sync lease), so ids commit in order.
+// For github_rpm remotes it relies on the sync lease serialising scans.
 func (db *DB) RPMMetadataFingerprint(ctx context.Context, repoName string) (count, maxID int64, err error) {
 	err = db.Pool.QueryRow(ctx, `SELECT count(*), coalesce(max(id), 0) FROM rpm_metadata WHERE repo_name = $1`, repoName).Scan(&count, &maxID)
 	return count, maxID, err

internal/provider/rpm/syncer_test.go

@@ -510,3 +510,9 @@ func TestSyncerScheduledPrime(t *testing.T) {
 		t.Fatalf("cold-cache prime: attempts=%d freshness=%v interval=%v, want 1/0/0", store.attempts, store.freshness, store.interval)
 	}
 }
+
+func TestSyncLeaseOutlivesScanTimeout(t *testing.T) {
+	if syncLeaseDuration <= defaultScanTimeout {
+		t.Fatalf("syncLeaseDuration %v must exceed defaultScanTimeout %v so scans stay serialised", syncLeaseDuration, defaultScanTimeout)
+	}
+}