[Task] Preserve atomic BPMN edits in Mongo workflow definitions #8294

Accepted on main — 2026-10-08

Final acceptance verifies the required scope on main 179749636fd4ddce07b186d4fe3456a43fa91162. This issue is closed; earlier checkpoints below retain their historical status and limitations. Parent #8214 and program #8194 remain open for their own outcomes.

Program: #8194
Parent: #8286
Related: #8287

Deliverable

Implement atomic latest-definition compare-and-swap in the MongoDB persistence provider so BPMN document PUT has a real single-row concurrency guard and transactional published-to-draft transition.

Acceptance

• Match the supplied predicate against the latest row in the tenant scope selected by filter.TenantAgnostic, then derive the update from that loaded snapshot.
• Same-ID updates use an atomic conditional replace/update against the loaded snapshot, including persisted metadata, with explicit collation behavior where required; require exactly one matched row.
• Published-to-draft updates conditionally unmark the prior latest row and insert the new draft in a Mongo session transaction on a replica set. Standalone Mongo must fail or be excluded explicitly rather than silently weakening atomicity.
• Preserve the selected row tenant ID on mutation and do not broaden tenant visibility or overwrite it from ambient state.
• Add replica-set integration coverage for winner/loser, stale metadata, not-found, tenant isolation, and published-to-draft rollback/conflict. Record any unavailable environment as unverified.
• Do not publish packages or import upstream publisher workflows.

Scope boundary

This task implements and verifies the MongoDB provider path only. It does not claim every distributed persistence provider is concurrency-safe.

Corrective readiness checkpoint (2026-10-07)

Reopened after lead and independent final-layout audit. The historical preparation and its 12-case replica-set receipt remain valid for their recorded rehearsal source only. At that reopening checkpoint, imported TryUpdateLatestAsync unmarked and inserted outside a transaction, and its selected-field CAS filter omitted persisted metadata. The then-current import's six CAS cases were not the reviewed replica-set suite. The accepted #8654 correction below supersedes those source defects. No matching open corrective PR was found in fresh Core and Extensions intake.

The correction is merged through PR #8654 into the program branch at eccc39fe15d2e525af866bd5a2e59f12821de381, with tree equal to reviewed ce99df5c48de6ae3f5086572bbe48956669fdbf1. All exact-head CI, independent source/runtime APPROVE + HIGH and Greptile 5/5 passed. Focused proof passed 103 Mongo and ten BPMN cases with zero skips, both intended baseline regressions, three fixture compiles, three framework builds and actual write-filter/topology/image guards.

This Task remains OPEN, Todo / Not Ready / Verification Pending, because native sibling blocker #8655 owns final integration and exact-main verification. The program-branch merge does not close this Task or its reopened parent rollups. #8655 is now the sole active delivery Task. No publication or deployment occurred.

Implementation boundary

• Forward-port the reviewed session-aware MongoDbStore read overload and atomic TryUpdateLatestAsync implementation; share current tenant-visibility logic. Session reads must still include visible global * rows and preserve tenant-agnostic/default-empty behavior. Do not reuse strict tenant write scoping as read visibility.
• Use a session transaction with snapshot reads, primary reads and majority writes from the collection's owning client. Match the full raw BSON snapshot with simple collation and require exactly one matched write. Unmark the published row and insert its draft in one transaction, preserving the selected TenantId and logical-definition identity. Keep current new-draft IsLatest=true behavior and public constructor/interface signatures.
• Preserve later tenant-owned upserts/default normalization (c405a11bf3a39700b8afaaf534f4421ac83346c2) and strict update-scope/serializer/key-value fixes (db59d7d1df0d398cfc699d66c3059851c9393c72). Do not mix unrelated Mongo cleanup.
• No callback or transaction retries. Propagate callback failures and ambiguous commit failures; classify only the reviewed known write-conflict error as Conflict. A standalone deployment must fail explicitly without weakening atomicity.
• Extend the existing CAS fixture and current evidence documentation; retain historical receipts unchanged.

Required exact-head proof

Use hosted Linux Docker and the repository's centrally resolved dependencies. Record MongoDB image identity/digest and verify replica set rs1. No heavy local workload while the host remains overloaded.

• Demonstrate omitted-metadata and draft-insertion rollback regressions fail against the unfixed baseline, then pass on the corrected source.
• Cover existing NotFound/false-predicate/no-longer-latest behavior, callbacks once, barrier-synchronized competing writers with one winner, stale StringData/Name/previously omitted metadata, narrow error classification, predicate/update callback errors, tenant visibility and tenant-agnostic owner preservation, logical identity rejection, and unknown BSON fields under the default class map.
• Verify published-to-draft success changes only the prior row's IsLatest and insertion failure rolls that write back. Verify standalone failure leaves state unchanged.
• Run the complete Elsa.MongoDb.UnitTests project on net10 with per-case evidence and zero skips, including later tenant/serializer/key-value regressions. Run BpmnDocumentPutCompareAndSwapTests from Elsa.Bpmn.Interchange.IntegrationTests as separate consumer-contract evidence.
• Compile both fixtures first and build Mongo production for net8.0/net9.0/net10.0; retain the broader consolidated build gate. Record exact source/inputs, sanitized receipts and all failures/skips accurately.
• Require lead review, independent Elsa 3 APPROVE + HIGH, Greptile 5/5 and repository exact-head CI before merging to codex/elsa-integration-program. Reconcile the final main integration requirement explicitly before closing this task and its reopened parent rollups.

No package publication, production database migration or source-publisher cutover is authorized by this correction.

Active final-main verification

#8655 is now the sole active delivery Task in PR #8657, head 0da8146aaeaf35cb06feb1a7c87920cf3bb3df20, base main b38e7523f79297076e51701fd951c426145aa99c. Accepted #8654 is contained in this promotion. This Mongo Task remains open and inactive until combined-head and post-merge exact-main proof are accepted; program-slice acceptance is not final-main acceptance.