lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(controller): release the promotion fence once a truncated-boot node has caught up (bug-1919)

Browse source 
The fence re-check required !persist_recovery_truncated(), a boot-time
verdict nothing cleared, so a node that booted RECOVER_TRUNCATED stayed
fenced (fenced: true, non-promotable) until restart however far it
caught up. And the "progress is possible" branch did not re-arm, so the
fence was never re-evaluated.

persist_t gains a runtime recovery_truncation_healed latch, which
persist_recovery_truncated() honours (the raw boot verdict stays
available). The re-check marks the truncation healed once the durable
floor has advanced past the fence-time baseline (entries replicated from
the live primary) and reached the HWM, and the progress branch re-arms
with the same baseline and HWM.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-04 09:14:48 +00:00
parent 88a8bf8a47
commit 0ab12074f5
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
4 changed files with 197 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/include/persist.h
View file

@ -340,6 +340,15 @@ struct persist_s {
* before the node participates; read by the promotion gate thereafter. */
recover_verdict_t recovery_verdict;
/* Set once a RECOVER_TRUNCATED member has caught up from the live primary
* past the cluster HWM its promotion fence was armed with (bug-1919):
* entries replicated on top of the truncated log prove the lost tail was
* refilled. recovery_verdict keeps the raw boot verdict for diagnostics;
* persist_recovery_truncated() reports false once this is set. Reset by
* persist_recover. Set by the fence re-check timer, read by the
* promotion gate. */
_Atomic bool recovery_truncation_healed;
/* Sticky "unrecoverable, loudly fenced" flag (ha-commit-durability Req 2.4,
* NEVER-SELF-EXIT rework 2026-06-18). Set by
* persist_recover_loud_fence_if_unrecoverable when a member is
@ -789,11 +798,14 @@ uint64_t persist_durable_floor(persist_t* p);
* persist_recovery_verdict returns the RECOVER_CLEAN / RECOVER_TRUNCATED
* verdict computed by the last persist_recover (RECOVER_CLEAN on a fresh
* store before recovery runs). persist_recovery_truncated is the convenience
* flag form (true iff the verdict is RECOVER_TRUNCATED) the promotion gate
* (task 4.3) consumes to mark the member non-promotable. Both are pure reads
* of recovery state established single-threaded at startup. */
* flag form (true iff the verdict is RECOVER_TRUNCATED and the truncation has
* not since been healed by catch-up) the promotion gate (task 4.3) consumes
* to mark the member non-promotable. persist_recovery_verdict is a pure read
* of the boot-time verdict. persist_mark_recovery_truncation_healed records
* that catch-up from the primary refilled the truncated tail (bug-1919). */
recover_verdict_t persist_recovery_verdict(persist_t* p);
bool persist_recovery_truncated(persist_t* p);
void persist_mark_recovery_truncation_healed(persist_t* p);
/* Bounded catch-up RE-ALERT window (ha-commit-durability task 3.3, Req 2.4;
* never-self-exit rework 2026-06-18).