Fix the OPC ajax race family: per-cart serialization, single-flight autosaves, persist-first client reads

[ThbPS]

Questions	Answers
Description?	Fixes the concurrency defect family behind the nightly inline-billing-no-duplicate.spec.ts:109 failure (addressCount 6-9 instead of 2, and the 15s pollInvoiceIsSeparate timeout): orphan invoice-address inserts from client-only savedraft aborts, invoice-pointer clobbers from stale-state writers, and routine mid-persist pricing. Server serialization + client sequencing; OpcTempAddress is left strictly untouched (the persist-first client makes its branches cold paths).
Type?	bug fix
BC breaks?	one deliberate contract change: a still-valid carrier selection now survives an address round-trip (re-validated server-side each round) instead of being cookie-cleared — see below
Deprecations?	no
Fixed ticket?	Nightly E2E opc-payment-eligibility systematic failure since 2026-07-13 (runs 29263323883 / 29302624359 / 29385661715 on PrestaShopCorp/opc.e2e.tests).
How to test?	Proofs below — deterministic fixtures RED on main, GREEN here; red-first client specs; full e2e CI dispatches.

The race mechanisms (proven from run 29385661715 traces)

1. Orphan inserts (Received: 9) — aborting a superseded savedraft XHR is client-only: the POST keeps executing server-side and inserts a real Invoice address row whose id the client never learns. removeAbandonedInlineInvoiceAddress can only delete the front-known id, so every round inserts anew (trace: 8/16 savedraft POSTs died net::ERR_ABORTED while the invoice-id ladder 27→36→44 shows their inserts landed).
2. Invoice-pointer clobbers (retry-1 timeout) — full-row Cart::save() calls built from request-start snapshots silently revert concurrent pointer commits; the cart can be left pointing at a deleted address.
3. Routine mid-persist pricing — the guest inline flow kept sending raw address fields even once persisted, so option reads priced unconfirmed state and churned temp rows.

The fixes (7 commits, reviewable independently)

Server (mechanisms 1-2):

• Per-cart advisory lock GET_LOCK('opc_<hash>_cart_<id>', 10) around every OPC ajax request (all 17 controllers) — uncontended in sequential flows, degrades to today's behavior on timeout or any error (lock name built inside the guard).
• selectcarrier mirrors invoice onto delivery only on an explicit use_same_address key (aligned on the carriers handler's guard; was: a missing key defaulted to '1' and clobbered a persisted separate billing).

Client (mechanisms 1-3):

• Single-flight autosaves, never abort: at most one savedraft in flight; the pending edit is flushed at settle, built at send time and carrying the ids the response just delivered — no more server-side writes nobody owns.
• Persist-first reads: previews carry the autosave-persisted hidden ids when the form is untouched since its persist (opcDraftPending dirty-flag; a use_same=1 MIRROR response must not lift the billing hold); previews on a dirty form are held and re-run on opcAddressPersisted (inconclusive autosaves keep the hold armed); a carriers fetch racing the FIRST persist holds the loader and re-fetches with the persisted id. The server takes its battle-tested id-branch everywhere — the temp branches become cold fallbacks, untouched in this diff.

The one observable contract change (deliberate)

Routing the carrier click through the id-branch moves the selection onto the CART (instead of the temp-keyed cookie): re-validated against every address round — dropped when unavailable (unchanged protection, still asserted by spe42's no-carrier leg) and restored when still valid (was: silently lost).

Merge pairing required: merge together with PrestaShopCorp/opc.e2e.tests#58 (red-first C1-C3 specs + the spe42 contract update).

Proofs

• RED on pristine main (real classes, real DB): selectcarrier absent-key clobber fixture (invoice_clobbered: true → false), plus the CI traces above for the abort/orphan mechanism.
• Red-first client specs C1/C2/C3 (persisted ids in payloads / fetch-after-persist / dirty defer) — red on main's client, green here; the mirror-save trap and the inconclusive-drop starvation were caught by 6-run stability loops and fixed within the TDD cycle.
• Module suites green; full opc-payment-eligibility lot green locally; A/B baseline shows the residual ~1/6 local flake on two billing specs pre-exists on main-level content.
• Race-fix content alone already validated 11/11 lots in CI (run 29402887480, :109 first-attempt pass on the runners that failed it 3/3 nightly).
• Paired CI dispatch of this exact train: link added when green.

Follow-up (out of scope)

Full temp-machinery retirement (server awaiting contracts + deletion of OpcTempAddress/storages/guard mount, −651 lines) — already TDD-validated 11/11 in CI (run 29418233325), parked for a future refactor PR once this has soaked.

🤖 Generated with Claude Code