[messages] extract state transitions

[capcom6]

"## Purpose\n\nExtract message and recipient state transitions from MessagesService into a dedicated MessageStateService -- the single point of control for all message state operations. Centralizes transition validation, persistence, and event emission, and fixes a cancellation race condition where a concurrent send worker could dispatch an SMS after recipients were already marked Cancelled.\n\n## Key Changes\n\n### New files\n- MessageStateService.kt -- Single owner of state-transition logic. Every transition: acquires per-message lock, loads current row, validates against MessageStateTransitions, applies the DAO write, syncs stored state from derived recipient state, and emits MessageStateChangedEvent only on successful writes.\n- MessageStateTransitions.kt -- Pure state-machine table. Cancelled is not terminal (late SMS outcomes supersede cancel). Failed is the only terminal state.\n- PerMessageLock.kt -- Per-key mutex with atomic reference-counted entry lifecycle. Same-key blocks serialize; different keys run in parallel.\n\n### Modified files\n- MessagesDao.kt -- Added updateRecipientsAndMessageState: a single DB transaction that atomically updates recipient and message state, eliminating the two-transaction race window.\n- MessagesService.kt -- Removed ~86 lines of inline state logic; delegates to MessageStateService.\n- GatewayApi.kt -- Added Cancelling to wire-level MessageState, explicitly separated from local ProcessingState.\n- GatewayService.kt -- Resolves cloud Cancelling via the extracted local cancellation path (handleCloudCancel).\n- EventsReceiver.kt -- Handles MessageCancelledEvent by delegating to MessagesService.cancelMessage.\n\n### New tests\n- MessageStateServiceTest.kt -- State-machine validation, cancellation strict-reject, and event emission.\n- MessageStateTransitionsTest.kt -- Transition table correctness.\n- PerMessageLockTest.kt -- Concurrency serialization and entry lifecycle.\n- CancelEntryPointsParityTest.kt -- Parity across all cancellation entry points.\n- GatewayWireStateTest.kt -- Cancelling wire state resolution.\n\n## Cancellation Race Condition Fix\n\nPreviously, cancellation committed recipient and message state in separate transactions. A concurrent send worker could observe Pending between commits and dispatch the SMS. The fix: updateRecipientsAndMessageState atomically updates both in one transaction, and PerMessageLock serializes the full read-validate-write-sync-emit cycle per message.\n\n## Known Limitations\n\n- The send worker's pre-send state check in sendMessage remains outside the lock. Atomic updateRecipientsAndMessageState eliminates the race; the unlocked check is defense-in-depth.\n- DAO mutation methods remain public; visibility cleanup is deferred.\n"

Confidence Score: 5/5

The PR appears safe to merge.

Summary

The PR centralizes message and recipient state transitions behind a per-message lock and separates the gateway’s wire-level cancellation state from local processing states.

• Adds validated, serialized state transitions with atomic recipient/message persistence and event emission.
• Routes cancellation entry points and send-result handling through the new state service.
• Adds concurrency, transition-table, cancellation-parity, and gateway wire-state tests.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[State transition request] --> B[Acquire per-message lock]
    B --> C[Load message and recipients]
    C --> D{Transition valid?}
    D -- No --> E[Reject or no-op]
    D -- Yes --> F[Atomically persist recipient and message state]
    F --> G[Reload persisted state]
    G --> H[Emit MessageStateChangedEvent]
    H --> I[Release lock]

Loading

_{Reviews (26) · Last reviewed commit: "[messages] introduce message state servi..."}

[github-actions]

🤖 Pull request artifacts

file	commit
app-release.apk	487b8e3
app-release.aab	487b8e3
app-insecure.apk	487b8e3
app-insecure.aab	487b8e3

[github-actions]

This PR is stale because it has been open for 7 days with no activity.