Prevent Single-Account Starvation with Round-Robin Queue Fairness

[grantfox-oss]

Prevent Single-Account Starvation with Round-Robin Queue Fairness

Labels: hard reliability Official Campaign Maybe Rewarded
Component: src/queue/priority.rs

---

Problem

OutboundTxQueue dispatches purely by TxPriority then FIFO — it has no concept of which account an envelope belongs to. A device acting as a shared payment terminal (e.g. a market trader's phone used by multiple family members' accounts, or a merchant relaying payments for several customers) can have one account's burst of Normal payments completely dominate the queue, starving other accounts' payments at the same tier even though none of them are individually higher priority.

Requirements

• Introduce account-aware fairness within a priority tier: when multiple distinct source accounts have entries at the same effective priority, dispatch should rotate fairly across accounts (e.g. round-robin) rather than strictly FIFO by global insertion order.
• OutboundTxQueue currently has no notion of "source account" at all (that information lives in storage::db and gets passed around separately) — you'll need to either thread source_account into QueuedTx/the public push API, or provide a wrapper that groups entries by account before applying the existing priority ordering.
• Preserve strict priority ordering across tiers (an Emergency entry always dispatches before Normal, fairness only applies to ties within the same effective tier).
• Document the fairness algorithm choice (e.g. simple round-robin cursor vs. deficit round-robin) and why.

Acceptance Criteria

• Given N accounts each with several Normal entries, dispatch order rotates across accounts rather than exhausting one account's entries before moving to the next.
• Priority ordering across tiers is unaffected — an Emergency entry from any account still dispatches before any Normal entry.
• cargo fmt, cargo clippy -D warnings, and cargo test all pass, and all pre-existing tests in src/queue/priority.rs still pass (adjust their setup to supply a source_account if you change the public API, but don't change their asserted behavior).

Required Tests

• test_round_robin_across_accounts_same_tier
• test_single_account_does_not_starve_others — one account pushes 100 entries, another pushes 2; the second account's entries are not stuck behind all 100 of the first.
• test_priority_tier_ordering_unaffected_by_fairness

Notes

• This issue and Implement Priority Aging to Prevent Starvation in OutboundTxQueue #6 (priority aging) both touch OutboundTxQueue's internal ordering — coordinate in the issue thread if both are picked up concurrently to avoid a merge conflict, but neither blocks the other from starting.
• Estimated effort: medium.