Scope the fingerprint invariant to the wired syncer and pin lease > scan timeout

internal/database/rpm_metadata.go

@@ -42,7 +42,7 @@ func (db *DB) DeleteRPMMetadata(ctx context.Context, repoName, filePath string)
 
 // RPMMetadataFingerprint is a cheap change detector for a repo's rows: they are
 // only ever inserted or deleted, so (count, max id) moves whenever they change.
-// Sound only while a remote's writers are serialised (github_rpm sync lease), so ids commit in order.
+// For github_rpm remotes it relies on the sync lease serialising scans.
 func (db *DB) RPMMetadataFingerprint(ctx context.Context, repoName string) (count, maxID int64, err error) {
 	err = db.Pool.QueryRow(ctx, `SELECT count(*), coalesce(max(id), 0) FROM rpm_metadata WHERE repo_name = $1`, repoName).Scan(&count, &maxID)
 	return count, maxID, err

internal/provider/rpm/syncer_test.go

@@ -510,3 +510,9 @@ func TestSyncerScheduledPrime(t *testing.T) {
 		t.Fatalf("cold-cache prime: attempts=%d freshness=%v interval=%v, want 1/0/0", store.attempts, store.freshness, store.interval)
 	}
 }
+
+func TestSyncLeaseOutlivesScanTimeout(t *testing.T) {
+	if syncLeaseDuration <= defaultScanTimeout {
+		t.Fatalf("syncLeaseDuration %v must exceed defaultScanTimeout %v so scans stay serialised", syncLeaseDuration, defaultScanTimeout)
+	}
+}