---
title: "Does any Tier 1-2 source in concurrent-systems or fault-tolerant-systems literature prescribe optimistic concurrency control or event sourcing as the standard fix for a periodic-sweep-vs-in-flight-write TOCTOU race?"
type: "question"
status: "open"
date_raised: "2026-10-31T00:00:00.000Z"
writer_model: "claude-sonnet-5"
tags: ["concurrent-systems","toctou","optimistic-concurrency-control","event-sourcing","verification"]
---


[[claim-no-primary-source-prescribes-occ-event-sourcing-for-sweep-vs-write-toctou]]
carries an `[unverified -- could not confirm or deny after search]` flag.
CWE-367/362 — the one taxonomy that formally names this exact
check-then-act shape — prescribes atomicity and locking, not optimistic
concurrency control (OCC) or event sourcing
([[claim-cwe-367-362-prescribe-atomicity-locking-not-occ-or-event-sourcing]]).
That doesn't settle whether some *other* body of literature nonetheless
treats OCC or event sourcing as the standard answer for this specific
shape, as opposed to the related-but-distinct database "lost update"
problem OCC was actually built for
([[claim-occ-kung-robinson-1981-detects-conflicts-after-the-fact]],
[[claim-lost-update-p4-distinct-from-toctou]]).

## Why it matters

The originating capture's own question assumed OCC/event sourcing might
be literature's preferred upgrade over the practitioner response actually
taken for the 2026-07-07 04:05 uncommanded-deletion incident ("revert
forward and flag it"). One search pass through the CWE taxonomy found the
opposite — but a single pass through one taxonomy is not the same as
checking the TOCTOU-mitigation research literature directly.

## What would answer it

- Tsafrir, Hertz, Wagner & Da Silva, "Portably Solving File TOCTTOU Races
  with Hardness Amplification" (USENIX FAST 2008) — cited directly in
  CWE-367's own references [REF-367] as prior TOCTOU-mitigation research;
  not yet read by this vault. Read it directly and check whether it
  discusses OCC or event-sourcing-style designs as alternatives to
  locking.
- Gray & Reuter, *Transaction Processing: Concepts and Techniques* (1993)
  — a primary textbook treatment of forward-recovery vs. backward-recovery
  vocabulary, which may be the more precise academic category for "revert
  forward and flag it" than OCC is. Not yet read by this vault on this
  question.
- A targeted search (not yet run) specifically for "event sourcing" +
  "TOCTOU" or "check-then-act" in primary software-architecture or
  distributed-systems sources, rather than the general "event sourcing +
  lost update" search this capture ran, which surfaced only secondary
  engineering-blog commentary (DEV Community, Confluent) below the
  sourcing floor for a technical-mechanism claim.

## Candidate next moves

Start with the Tsafrir et al. 2008 paper, since it is already a named,
primary candidate sitting one hop away in CWE-367's own reference list.