[servicememeai]

Incident and cause

The 2026-10-23 DEV incident showed the transaction-side final ACL query executing as type=index, key=acl_shared_subject over cf_dir_acl: the repo_id=? OR repo_id IN(SELECT origin_repo...) expression caused a broad index scan and lock amplification under REPEATABLE READ. This is independent of Hub's cached per-library ACL rules.

Small, schema-free fix

• Replace the optimizer-dependent OR/IN locking read with an exact repo_id=? check, using the existing primary-key prefix (FORCE INDEX (PRIMARY)).
• Look up a CE VirtualRepo mapping through its existing unique repo_id index; when present, repeat the same exact-key ACL check for its origin.
• Preserve fail-closed behavior on missing/malformed mapping data and SQL errors; keep FOR UPDATE current-read semantics under the Branch transaction.
• No table/index migrations, no cache changes, no global isolation changes. Add a low-cost source regression test.

Design boundary

This reduces scanned/locked ACL index scope; it does not claim to eliminate all gap/next-key locks for empty key ranges. Do not replace the final transaction check with a possibly stale Hub/Redis snapshot. Deeper ACL model/table shrinkage, multi-repo lock hierarchy and batch publication remain separate proposals.

Required validation before merge (disposable MariaDB + native C/Go)

1. EXPLAIN with 0, 17, and 10,000 ACL rows: target key=PRIMARY, no full secondary-index scan.
2. Concurrent A/B libraries with ACL absent/present: inspect performance_schema.data_locks / information_schema.INNODB_LOCK_WAITS (as appropriate) to verify no unrelated-library scan amplification, including empty-range gap locks.
3. VirtualRepo source ACL restriction and concurrent source-rule install/revocation: cannot bypass origin restrictions.
4. Native C/Go final-write verification, transactions and SQL-error fail-closed acceptance.
5. Contract check: python3 -m unittest tests.test_cf_acl_lock_scope tests.test_v2_no_managed_library.

No DEV/PROD access, live testing, schema changes or deployment performed. Independent of PR #27, which fixes infinite retry/error classification.