[Bug]: SnowflakeGenerator passes arguments in wrong order to ISequence, causing duplicate IDs in Nextcloud 35

lib/private/Snowflake/SnowflakeGenerator.phpをISequenceインターフェース、およびFileSequenceとAPCuSequenceの実装と合わせて読み、nextId()の引数の順序を宣言と比較してください。Snowflakeシーケンスの生成を対象とする既存のテストがあるか確認し、引数の順序を検証するテストを追加または調整してください。ジェネレーターが宣言された順序で引数を渡し、シーケンスのテストが期待されるIDを検証すれば完了です。

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

Nextcloud Server 35.0.1.1 intermittently generates duplicate Snowflake IDs during background cron execution, resulting in MariaDB primary key constraint violations in the oc_job_runs table.

The following error occurs during execution of cron.php:

SQLSTATE[23000]: Integrity constraint violation: 1062
Duplicate entry '139762654536019968' for key 'PRIMARY'

Investigation revealed an incorrect argument order in lib/private/Snowflake/SnowflakeGenerator.php.

Current implementation:

$sequenceId = $this->sequenceGenerator->nextId($seconds, $milliseconds, $serverId);

However, ISequence.php defines:

public function nextId(int $serverId, int $seconds, int $milliseconds): int|false;

This means the arguments are passed in the wrong order. Both FileSequence.php and APCuSequence.php implement the interface using the declared parameter order.

Since all three arguments are integers, PHP does not detect the mismatch.

This appears to cause incorrect sequence tracking and may explain the observed duplicate Snowflake IDs.

The issue was reproduced in a Docker-based Nextcloud 35.0.1.1 installation using MariaDB and PHP CLI background jobs.

Steps to reproduce

1. Install Nextcloud Server 35.0.1.1 using Docker with MariaDB.

2. Configure background jobs to run through PHP CLI every 5 minutes:

   */5 * * * * root docker exec -u www-data nextcloud php /var/www/html/cron.php
   

3. Allow background jobs to execute normally, including potentially overlapping cron executions.

4. Inspect the Nextcloud logs for database constraint violations involving oc_job_runs.

5. Observe the following error:

   SQLSTATE[23000]: Integrity constraint violation: 1062
   Duplicate entry '139762654536019968' for key 'PRIMARY'
   

6. Query the existing database record:

   SELECT * FROM oc_job_runs
   WHERE run_id = 139762654536019968;
   

   Existing record:

   run_id:   139762654536019968
   class_id: 94867684321841152
   pid:      12947
   status:   1
   

   Failed INSERT:

   run_id:   139762654536019968
   class_id: 94474700178771968
   pid:      12953
   status:   0
   

7. Inspect SnowflakeGenerator.php and compare the nextId() argument order with ISequence.php.

8. Inspect the FileSequence directory:

   /var/www/html/data/tmp/sfi_file_sequence_<instanceid>/
   

   The sequence files contain entries such as:

   {
     "984": {"1": 8, "21": 5, "481": 37},
     "971": {"1": 12, "21": 5, "481": 36},
     "969": {"1": 8, "21": 1, "481": 48}
   }
   

   The outer keys contain millisecond-range values instead of the expected relative seconds.

Note: The duplicate-ID error is intermittent. These steps describe the affected environment and observed behavior rather than a guaranteed deterministic reproduction.

Expected behavior

The Snowflake ID generator should produce unique identifiers across concurrent PHP CLI background job executions.

SnowflakeGenerator::nextId() should pass its arguments in the order defined by the ISequence interface:

$sequenceId = $this->sequenceGenerator->nextId($serverId, $seconds, $milliseconds);

The FileSequence implementation should track sequence counters using the correct timestamp components, without reusing IDs.

Background cron jobs should complete without duplicate primary key errors in oc_job_runs.

Nextcloud Server version

35

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.5

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "filelocking.enabled": true,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.domain.com",
            "nextcloud"
        ],
        "serverid": "nextcloud",
        "overwritehost": "cloud.domain.com",
        "overwrite.cli.url": "https:\/\/cloud.domain.com",
        "overwriteprotocol": "https",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "35.0.1.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "default_phone_region": "PT",
        "trustedproxies": [
            "nextcloud",
            "10.10.10.10"
        ],
        "maintenance_window_start": 1,
        "maintenance": false,
        "preview_max_x": "1024",
        "preview_max_y": "1024",
        "jpeg_quality": "60",
        "preview_max_memory": "1024",
        "preview_max_filesize_image": "50",
        "enabledPreviewProviders": [
            "OC\\Preview\\Image",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\Movie",
            "OC\\Preview\\Krita",
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\MKV",
            "OC\\Preview\\MP4",
            "OC\\Preview\\AVI",
            "OC\\Preview\\PDF",
            "OC\\Preview\\Imaginary"
        ],
        "enable_previews": true,
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "filesystem_check_changes": 0,
        "tempdirectory": "\/var\/www\/html\/data\/tmp",
        "loglevel": 3
    }
}

List of activated Apps

Enabled:
  - activity: 8.0.0
  - appstore: 2.0.0-dev.0
  - bruteforcesettings: 8.0.0
  - circles: 35.0.0
  - cloud_federation_api: 2.0.0-dev.0
  - comments: 2.0.0-dev.0
  - contactsinteraction: 2.0.0-dev.0
  - dashboard: 8.0.0-dev.0
  - dav: 2.0.0-dev.1
  - federatedfilesharing: 2.0.0-dev.1
  - federation: 2.0.0-dev.0
  - files: 3.0.0-dev.0
  - files_downloadlimit: 5.3.0
  - files_lock: 35.0.0
  - files_pdfviewer: 8.0.0
  - files_reminders: 2.0.0-dev.0
  - files_sharing: 2.0.0-dev.1
  - files_trashbin: 2.0.0-dev.0
  - files_versions: 2.0.0-dev.0
  - firstrunwizard: 8.0.0
  - logreader: 8.0.0
  - lookup_server_connector: 2.0.0-dev.0
  - nextcloud_announcements: 7.0.0
  - notifications: 8.0.0
  - oauth2: 2.0.0-dev.0
  - office: 1.1.0
  - password_policy: 7.0.0
  - photos: 8.0.0
  - privacy: 7.0.0
  - profile: 2.0.0-dev.0
  - provisioning_api: 2.0.0-dev.0
  - recommendations: 8.0.0
  - related_resources: 6.0.0
  - serverinfo: 7.0.0
  - settings: 2.0.0-dev.0
  - sharebymail: 2.0.0-dev.0
  - sharing: 1.0.4
  - support: 7.0.0
  - systemtags: 2.0.0-dev.0
  - text: 9.0.0
  - theming: 3.0.0-dev.0
  - twofactor_backupcodes: 2.0.0-dev.0
  - twofactor_nextcloud_notification: 9.0.0
  - twofactor_totp: 17.1.0
  - updatenotification: 2.0.0-dev.0
  - user_status: 2.0.0-dev.0
  - viewer: 8.0.0
  - weather_status: 2.0.0-dev.0
  - webhook_listeners: 2.0.0-dev.0
  - workflowengine: 3.0.0-dev.0
Disabled:
  - admin_audit: 2.0.0-dev.0
  - app_api: 35.0.0 (installed 32.0.0)
  - encryption: 3.0.0-dev.0
  - eurooffice: 11.0.0 (installed 11.0.0)
  - files_external: 2.0.0-dev.0
  - previewgenerator: 5.13.0 (installed 5.13.0)
  - survey_client: 7.0.0 (installed 6.0.0-dev.0)
  - suspicious_login: 13.0.0 (installed 9.0.1)
  - user_ldap: 2.0.0-dev.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{
  "reqId": "Y2X8M7emzmLgCzPt7L9m",
  "level": 3,
  "time": "2026-10-12T15:10:29+00:00",
  "user": "--",
  "app": "cron",
  "message": "An exception occurred while executing a query: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry '139762654536019968' for key 'PRIMARY'",
  "version": "35.0.1.1",
  "exception": {
    "Exception": "OC\\DB\\Exceptions\\DbalException",
    "Code": 1062,
    "Trace": [
      {
        "file": "/var/www/html/lib/private/BackgroundJob/JobRuns.php",
        "line": 46,
        "function": "executeStatement"
      },
      {
        "file": "/var/www/html/core/Service/CronService.php",
        "line": 202,
        "function": "started"
      },
      {
        "file": "/var/www/html/core/Service/CronService.php",
        "line": 107,
        "function": "runCli"
      },
      {
        "file": "/var/www/html/cron.php",
        "line": 52,
        "function": "run"
      }
    ]
  }
}

Additional info

Technical analysis

The issue appears to originate from an argument order mismatch between SnowflakeGenerator and ISequence.

Current code:

$sequenceId = $this->sequenceGenerator->nextId($seconds, $milliseconds, $serverId);

Interface declaration:

public function nextId(int $serverId, int $seconds, int $milliseconds): int|false;

FileSequence behavior

In FileSequence.php, the lock file is selected using:

$filePath = $this->getFilePath($milliseconds % self::NB_FILES);

Due to the argument mismatch, $milliseconds receives the server ID rather than the actual millisecond value.

Consequently, a particular server may repeatedly use the same sequence file.

The active installation shows frequent updates to seq-001.lock, while several other sequence files have not been modified for months.

Sequence cleanup also uses:

$cleanBefore = $seconds - self::SEQUENCE_TTL;

However, $seconds receives the millisecond value, potentially causing incorrect sequence expiration and reuse.

Proposed fix

Change the call in SnowflakeGenerator.php to:

$sequenceId = $this->sequenceGenerator->nextId($serverId, $seconds, $milliseconds);

Environment details

• Nextcloud Server: 35.0.1.1
• Deployment: Docker
• Database: MariaDB / InnoDB
• Background jobs: PHP CLI
• Cron interval: 5 minutes
• Nextcloud temporary directory: /var/www/html/data/tmp
• Sequence implementation: FileSequence (expected for CLI)
• More than 242,000 entries in oc_job_runs
• Database primary key integrity verified

The Nextcloud cron implementation intentionally allows overlapping cron executions, as documented in CronService.php.

The proposed fix has not yet been applied or tested in production.

Please confirm whether this argument order mismatch is already known or addressed in another branch or release.