[mnkiefer]

The in-memory operational adapter could refill a rate-limit bucket twice for the same elapsed interval if its clock moved backwards. The PostgreSQL adapter already avoids this. This PR proposes aligning the memory adapter with it. It is not deployed or accepted.

Action: A server maintainer should review and confirm that go test ./internal/operational/... passes, including the new regression test.

Finding

• Principle: interchangeable implementations (Add create-ops-bundle skill #4). Frozen SHA: caf079a1ed1644fdbb65d20d8f9544a461c5cb83.
• Contract: operational.RequestLimiter.TakeRateLimitTokens in server/internal/operational/store.go.
• Memory adapter: memory/limiter.go set updated = now unconditionally.
• Postgres adapter: postgres/limiter.go advanceTokenBucket only advances the timestamp when now.After(b.At).
• Before: the regression test failed, with a backward then forward clock step refilling the same interval twice.
• After: the test passes.
• Counter-evidence: the clock is injectable and normally time.Now. This only matters for wall-clock steps or injected clocks. No intentional backend limitation covers this.

Validation

• go test -race ./internal/operational/... passed.
• TestAdapters passed against an isolated local PostgreSQL 18 for memory and postgres. The redis subtest was skipped because no Redis was available, so Redis conformance is unreviewed.
• go vet ./... clean, golangci-lint fmt --diff clean, and golangci-lint run ./internal/operational/... reported 0 issues.
• The full golangci-lint run ./... was not run.
• Other principles were not exhaustively reviewed in this bounded pass.

Control Plane

• Correlation ID: 42381390791-3533
• Central repository: githubnext/gh-cao
• Control plane run: https://github.com/githubnext/gh-cao/actions/runs/42381390791

Generated by SelfCare / Calesi Principles · copilot · auto · ~37 AIC · ⌖ ~1 AIC · ⊞ 16.1K · ◷

• expires on Nov 14, 2026, 2:39 PM UTC