Numbering Testing, Operations, and Commercial GA

Numbering has pure-algorithm, basic Store, architecture-ownership, and dual-ORM metadata tests. High-risk concurrency, transactions, compensation claims, rule publication, and production consumption do not yet have a complete gate.

1. Existing test evidence

Some BusinessSerialContext tests simulate the formula without invoking the real Store. They are not end-to-end continuation proof.

2. Largest test gap

Add 100+ caller uniqueness, post-conflict transaction usability, advancement past business duplicates, atomic compensation claims, tenant isolation, rule hot changes, provider exceptions, rollback, and gap policy.

3. Runtime metrics

At minimum expose:

• numbering_generate_total{table,field,result};
• unique conflict, retry, and exhausted counts;
• rule-not-found and no-segments;
• business fallback and duplicate counts;
• compensation hit, miss, and conflict;
• facts per partition and MAX-read duration;
• rule version or asset hash;
• fact/business reconciliation mismatch count.

Do not label metrics with full numbers or sensitive business values; that creates cardinality and privacy problems.

4. Current logs

The Store logs FullString, Table, Field, Prefix, and Attempt. A business number can contain branch or business values, so classification and redaction are required.

Logs omit rule Id, tenant, condition match, segment version, and structured provider code, making rule-drift diagnosis harder.

5. Failure diagnosis

RuleNotFound: verify tenant, TableName/Field, IsActive, IsEnabled, soft deletion, and default priority.

NoSegments: compare computed RuleId with Setting.RuleId, tenant/soft-delete filters, and seed 710 execution.

ConcurrencyExhausted: inspect unique-conflict logs, outer isolation, provider error shape, hot prefix, and fact visibility.

BusinessTableConflict: inspect missing history in facts; current retries may recreate the same candidate three times.

6. Integrity scan

Report:

• duplicate tenant Table/Field/RuleName;
• multiple empty conditions or inverted priorities;
• invalid Condition JSON, field, or operator;
• missing settings, duplicate Sort, unknown SectionType;
• invalid date/branch JSON;
• other than exactly one SequenceNumber;
• prefix/full-length overflow risk;
• duplicate Prefix+SequenceNumber facts;
• old inactive allocations;
• missing parent references;
• fact MAX below business MAX.

7. Security boundary

TableName/Field are rule lookup keys only. Business access must use owner callbacks, never dynamic SQL. EntityValues should contain only required fields and avoid sensitive material in logs or numbers.

There is no rule-management permission today. Direct database edits must be a restricted, audited operational process.

8. Release checklist

• Run both seed steps against a shadow database and inspect row counts.
• Lint every condition and segment.
• Use a fixed clock around date/fiscal boundaries.
• Run the same rules on both ORMs.
• Load-test one hot prefix on real databases.
• Verify transaction recovery after uniqueness failure.
• Drill continuation after fact-table loss.
• Race inactive compensation.
• Verify Feature enforcement in the business consumer.
• Prepare rule rollback and fact-repair runbooks.

9. Correct load-test assertions

// ① Allocate the same tenant/rule/prefix concurrently.
var results = await Task.WhenAll(
    Enumerable.Range(0, 200)
        .Select(_ => generator.GenerateAsync(request, cancellationToken)));

// ② Every successful string is unique; failures are known typed errors.
var successful = results.Where(x => x.IsSuccess).Select(x => x.Value!).ToList();
successful.Select(x => x.SequenceNumberStr).Distinct().Count()
    .ShouldBe(successful.Count);

// ③ Gaps are a product policy; do not use continuity to hide retry behavior.

Use real database connections and independent scopes. An in-memory EntitySet cannot reproduce unique-index races.

10. P0 GA work

1. Atomic waterline/compare-and-swap port instead of partition List+MAX.
2. Structured provider uniqueness translation.
3. Atomic compensation claim plus business duplicate check.
4. Strict rule and segment validator.
5. Implement StartValue or remove it.
6. Default-rule, Sort, and segment-count publication constraints.
7. A real production consumer tracer bullet.
8. Feature enforcement at one shared entry.

11. P1 GA work

1. Rule version, draft, approval, preview, and scheduled publication.
2. Idempotency request key and business aggregate association.
3. Atomic fact/business write or explicit saga.
4. Migration waterline import and reconciliation.
5. Metrics, alerts, repair CLI, and runbook.
6. RuleId and parent-reference integrity.
7. Configurable time zone and fiscal start month.
8. Capacity, performance, and archive policy.

Concrete work is mirrored into the Architecture Hub Numbering GA backlog.

12. Deployment judgment

The two demo rules can support technical validation and controlled low-concurrency use. Do not claim a concurrency-safe commercial sequence service before real-database load, a production consumer, rule governance, and recovery drills pass.

13. Test commands

# Pure algorithms and Store units.
dotnet test tests/BitzOrcas.Unit.Tests --filter FullyQualifiedName~Numbering

# Ownership and compile-time metadata.
dotnet test tests/BitzOrcas.Architecture.Tests --filter FullyQualifiedName~NumberingInfrastructureArchitectureTests

# Dual-ORM owner-row parity.
dotnet test tests/BitzOrcas.Integration.Tests --filter FullyQualifiedName~NumberingOwnerRows_Should_Behave_The_Same

14. Global sweeps

# Atomic and governance capabilities not yet implemented.
rg -n "CompareAndSwap|AtomicIncrement|IdempotencyKey|RuleVersion|Approval" src/Platform/Numbering -g '*.cs'

# Existing technical debt: fiscal-year configuration.
rg -n "TODO" src/Framework/BitzOrcas.Application/Numbering src/Platform/Numbering -g '*.cs'

Module overview · Persistence and integration