feedback creatortrack toctou partial update race 20260715T193334
name: Review 'non-destructive' partial updates for TOCTOU races against full-column writes description: Code-review heuristic: an operation marketed as safe/non-destructive because it only touches one JSON sub-field can still silently clobber a concurrent full-column write if it read the row before the slow work and writes back the whole column at the end type: feedback
During Task 16's correctness review of CreatorTrack's Scripts app voice-profile feature, a reviewer live-reproduced a real bug: regenerateVoiceProfile's "stats-only" mode (advertised in UI/code as non-destructive, no-confirm-needed) read the profile row before slow I/O + CPU work, then wrote the whole profile column back from that stale in-memory copy with no optimistic-concurrency check. A hand-edit save landing during that window got silently overwritten. Reproduced live with two concurrent HTTP requests ~15ms apart.
Why: the bug was exactly the failure mode the feature was built to close (a prior task's hand-edit-protection warning), and it reproduced without any malicious intent, just two normal user actions racing (e.g. click 'Refresh stats' right after 'Save', or two open tabs). The label "non-destructive" in code/UI is not proof of safety, it's a claim to verify.
How to apply: when reviewing any operation described as "safe", "stats-only", "non-destructive", or similarly gated to skip a confirmation dialog, check whether it (a) reads a row, then (b) does slow I/O/CPU work, then (c) writes back a snapshot of a larger structure than it actually needs to change. If so, flag it as a TOCTOU race even without a specific exploit in hand, then try to live-reproduce it with two concurrent requests before calling it a blocker. Fix pattern: use a targeted jsonb_set (or equivalent partial write) that only touches the sub-field actually being changed, never reconstruct-and-overwrite the whole column from a stale in-memory copy.
[auto-memory session 60d132de-4659-485c-8044-427af0ccce7f, confidence 0.72, mode staged]