The transfer service that stalled at month end

import java.util.*;
import java.util.concurrent.*;
import java.util.concurrent.atomic.*;
import java.util.concurrent.locks.ReentrantLock;

/**
 * Solution: the transfer service that stalled at month end.
 *
 * Three defects, and they compound. The lock order caused contention, the slow
 * call under the lock made every contended wait long enough to time out, and
 * the swallowed timeout meant the failures were reported as successes — so the
 * ledger drifted and nothing in the logs said why.
 */
public class Solution {

    static final class Account {
        final String id;
        final ReentrantLock lock = new ReentrantLock();
        volatile long balance;
        Account(String id, long balance) { this.id = id; this.balance = balance; }
    }

    static final AtomicInteger auditsInFlight = new AtomicInteger();
    static final AtomicInteger maxAuditsInFlight = new AtomicInteger();

    static void audit(String message) {
        maxAuditsInFlight.accumulateAndGet(auditsInFlight.incrementAndGet(), Math::max);
        try { Thread.sleep(20); } catch (InterruptedException e) { Thread.currentThread().interrupt(); }
        auditsInFlight.decrementAndGet();
    }

    static final AtomicInteger applied = new AtomicInteger();

    /* ── the service, fixed ─────────────────────────────────────────────── */

    static final class TransferService {

        boolean transfer(Account from, Account to, long amount) {
            /*
             * Defect 1. Locks were taken in argument order, so transfer(a, b)
             * and transfer(b, a) reached for them in opposite orders. Under
             * plain synchronized that is a hard deadlock; with tryLock it is a
             * storm of timeouts, which is what month end looked like.
             *
             * Ordering by a stable, total key means both directions take the
             * same lock first, so a cycle cannot form. The account id is the
             * right key: it is unique and it does not change. identityHashCode
             * would not be — it is not guaranteed unique, and a collision puts
             * you back where you started.
             */
            Account first = from.id.compareTo(to.id) < 0 ? from : to;
            Account second = first == from ? to : from;

            try {
                if (!first.lock.tryLock(30, TimeUnit.MILLISECONDS)) return false;
                try {
                    /*
                     * Defect 2. `return true` on a failed acquisition reported
                     * a transfer that never happened. The caller counted it as
                     * done, so money silently failed to move and the only
                     * evidence was a ledger that stopped balancing.
                     *
                     * A lock you could not take is a failure. Say so and let
                     * the caller decide whether to retry.
                     */
                    if (!second.lock.tryLock(30, TimeUnit.MILLISECONDS)) return false;
                    try {
                        from.balance -= amount;
                        to.balance += amount;
                        applied.incrementAndGet();
                    } finally { second.lock.unlock(); }
                } finally { first.lock.unlock(); }
            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
                return false;
            }

            /*
             * Defect 3. The audit was a slow remote write performed while both
             * account locks were held, so every transfer touching these
             * accounts queued behind it and the 30ms acquisition timeout was
             * guaranteed to expire. Moving it outside the locks shortens the
             * critical section to a few field writes.
             *
             * This is the rule worth generalising: never hold a lock across a
             * call you do not control. It causes more outages than deadlock.
             */
            audit("moved " + amount + " from " + from.id + " to " + to.id);
            return true;
        }
    }

    /* ── checks (unchanged from the starter) ────────────────────────────── */

    static final int ROUNDS = 40;

    public static void main(String[] args) throws Exception {
        List<String> failures = new ArrayList<>();
        var service = new TransferService();

        var a = new Account("account-A", 10_000);
        var b = new Account("account-B", 10_000);
        long before = a.balance + b.balance;

        var pool = Executors.newFixedThreadPool(8);
        var reportedOk = new AtomicInteger();
        var futures = new ArrayList<Future<?>>();
        for (int i = 0; i < ROUNDS; i++) {
            boolean forward = i % 2 == 0;
            futures.add(pool.submit(() -> {
                if (service.transfer(forward ? a : b, forward ? b : a, 10)) reportedOk.incrementAndGet();
            }));
        }
        pool.shutdown();
        boolean finished = pool.awaitTermination(30, TimeUnit.SECONDS);
        for (Future<?> f : futures) f.get();

        if (reportedOk.get() != applied.get())
            failures.add("1. " + reportedOk.get() + " transfers reported success but only "
                       + applied.get() + " moved money — a failed lock acquisition is being "
                       + "reported as a completed transfer");

        long after = a.balance + b.balance;
        if (after != before)
            failures.add("2. ledger does not balance: started with " + before + ", ended with " + after);

        if (!finished)
            failures.add("3. transfers did not finish within 30s");
        else if (applied.get() != ROUNDS)
            failures.add("3. only " + applied.get() + " of " + ROUNDS + " transfers were applied — "
                       + "opposite-direction transfers are contending for locks in opposite order");
        else if (a.balance != 10_000 || b.balance != 10_000)
            failures.add("3. equal transfers both ways left " + a.balance + " and " + b.balance);

        if (maxAuditsInFlight.get() < 2)
            failures.add("4. audits never overlapped (max " + maxAuditsInFlight.get()
                       + " at a time) across " + ROUNDS + " transfers — the slow call is inside "
                       + "the lock, so every transfer on these accounts waits for it");

        if (failures.isEmpty()) {
            System.out.println("PASS");
        } else {
            failures.forEach(f -> System.out.println("  " + f));
            System.out.println("FAIL");
        }
    }
}