feat: serialize keyed tasks across queues with durable fencing tokens

pulse/service/service.go

@@ -6,6 +6,7 @@ import (
 	"regexp"
 	"strings"
 	"time"
+	"unicode"
 	"unicode/utf8"
 
 	"git.yuntuo.hk/k2safe/orbit/internal/fault"
@@ -51,6 +52,9 @@ func NormalizeSubmit(in SubmitInput) (SubmitInput, error) {
 	if !utf8.ValidString(in.BusinessKey) || utf8.RuneCountInString(in.BusinessKey) > 191 || strings.ContainsAny(in.BusinessKey, "\x00\r\n") {
 		return in, fault.Invalid("business_key must be at most 191 characters without control newlines")
 	}
+	if err := ValidateConcurrencyKey(in.ConcurrencyKey); err != nil {
+		return in, err
+	}
 	if in.TaskTimeoutMS == 0 {
 		in.TaskTimeoutMS = 24 * 60 * 60 * 1000
 	}
@@ -170,3 +174,19 @@ func (s *Service) ConfigureQueue(ctx context.Context, token auth.Token, id core.
 	}
 	return s.store.ConfigureQueue(ctx, token, id, key, in)
 }
+
+// ValidateConcurrencyKey 不归一化资源键，字节精确相等才共享许可。
+func ValidateConcurrencyKey(key string) error {
+	if key == "" {
+		return nil
+	}
+	if !utf8.ValidString(key) || utf8.RuneCountInString(key) > 191 || strings.TrimSpace(key) != key {
+		return fault.Invalid("invalid concurrency_key")
+	}
+	for _, c := range key {
+		if unicode.IsControl(c) {
+			return fault.Invalid("invalid concurrency_key")
+		}
+	}
+	return nil
+}