Does any Tier 1-2 source in concurrent-systems or fault-tolerant-systems literature prescribe optimistic concurrency control or event sourcing as the standard fix for a periodic-sweep-vs-in-flight-write TOCTOU race?

concurrent-systemstoctouoptimistic-concurrency-controlevent-sourcingverification

claim-no-primary-source-prescribes-occ-event-sourcing-for-sweep-vs-write-toctou carries an [unverified -- could not confirm or deny after search] flag. CWE-367/362 — the one taxonomy that formally names this exact check-then-act shape — prescribes atomicity and locking, not optimistic concurrency control (OCC) or event sourcing (claim-cwe-367-362-prescribe-atomicity-locking-not-occ-or-event-sourcing). That doesn't settle whether some other body of literature nonetheless treats OCC or event sourcing as the standard answer for this specific shape, as opposed to the related-but-distinct database "lost update" problem OCC was actually built for (claim-occ-kung-robinson-1981-detects-conflicts-after-the-fact, claim-lost-update-p4-distinct-from-toctou).

Why it matters

The originating capture's own question assumed OCC/event sourcing might be literature's preferred upgrade over the practitioner response actually taken for the 2026-07-07 04:05 uncommanded-deletion incident ("revert forward and flag it"). One search pass through the CWE taxonomy found the opposite — but a single pass through one taxonomy is not the same as checking the TOCTOU-mitigation research literature directly.

What would answer it

• Tsafrir, Hertz, Wagner & Da Silva, "Portably Solving File TOCTTOU Races with Hardness Amplification" (USENIX FAST 2008) — cited directly in CWE-367's own references [REF-367] as prior TOCTOU-mitigation research; not yet read by this vault. Read it directly and check whether it discusses OCC or event-sourcing-style designs as alternatives to locking.
• Gray & Reuter, Transaction Processing: Concepts and Techniques (1993) — a primary textbook treatment of forward-recovery vs. backward-recovery vocabulary, which may be the more precise academic category for "revert forward and flag it" than OCC is. Not yet read by this vault on this question.
• A targeted search (not yet run) specifically for "event sourcing" + "TOCTOU" or "check-then-act" in primary software-architecture or distributed-systems sources, rather than the general "event sourcing + lost update" search this capture ran, which surfaced only secondary engineering-blog commentary (DEV Community, Confluent) below the sourcing floor for a technical-mechanism claim.

Candidate next moves

Start with the Tsafrir et al. 2008 paper, since it is already a named, primary candidate sitting one hop away in CWE-367's own reference list.

Progress

2026-11-02: Pursued all three candidate next moves above. (1) Tsafrir, Hertz, Wagner & Da Silva (2008) was read in full (all 30 pages) — succeeded, and is a second independent Tier 1 root agreeing with CWE-367/362: it surveys TOCTOU-mitigation research into four solution families, none of which is OCC or event sourcing, and independently cites the exact periodic-sweep-vs-in-flight-write shape (claim-tsafrir-2008-cites-tmp-gc-sweep-toctou-example, claim-tsafrir-2008-toctou-survey-excludes-occ-event-sourcing). (2) Gray & Reuter's Transaction Processing full text was not located this session (only publisher listings, a DBLP entry, and course syllabi surfaced) — still open. (3) A targeted search for "event sourcing" + TOCTOU/"check-then-act" surfaced only a non-peer-reviewed 2026 Zenodo preprint addressing a different problem (cross-stream lost-update in event-sourced systems, not this shape) — below the sourcing floor, doesn't move the question. Net: the negative finding is strengthened (two independent Tier 1 roots now agree) but not closed — two sources is corroboration within the literature searched so far, not proof no Tier 1-2 source anywhere makes this prescription. Status stays open. Remaining candidate moves: read Gray & Reuter directly; read Dean & Hu (2004) and Borisov et al. (2005) directly (cited by Tsafrir et al. as responding to/attacking each other, neither independently read by this vault); read McPhee (1974) directly (earliest formal TOCTOU characterization per Tsafrir et al.'s citation).