lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ha-commit-barrier-rollout): config barrier with production ACK ingestion (task 5.2 + r1)

Browse source 
configAck branch: per-push majority (acked_config_lsn >= push_tag,
1+count > n_peers/2 over r->ce->n_peers, n_peers<=1 immediate,
ce==NULL -EINVAL); legacy >0 counting and n_active==0 shortcut dead.
push_config_to_standbys returns the barrier result; upgrade failure ->
send_upgrade_error (rc forwarded), no success ACK, no restart,
committed_config_tag success-only.

Remediation r1 (two CRITICAL review findings):
- F1: wire production config-ACK ingestion — replconfigpushreplymsg
  decode branch in repl_ack_decode_and_dispatch -> repl_on_config_ack
  on the promoted-vote ep; + defensive cluster.c OPCode_reply case.
  Closes the unlanded half of ha-config-bootstrap 8.1; without this the
  barrier would brick every multi-member config upgrade. No schema change.
- F2: keep the barrier off the iomgr thread — export
  push_config_transport_only (non-blocking) for the 5 ha.c + join.c
  streaming sites; barrier path now vtask-only (do_upgrade_config).

Wire-path test drives real capnp ACK bytes through the production decode
branch. 30/30 rollout, 6/6 repl_majority, 46/46 config_repl; census 0
FAIL; pre-existing fixture leak only (less than baseline).
This commit is contained in:
Rongsong Shen 2026-06-13 03:46:29 +00:00
parent 9cdeba5816
commit 5a2fae1d37
12 changed files with 1034 additions and 399 deletions
Download patch file Download diff file Expand all files Collapse all files

863
.wolf/buglog.json
View file

File diff suppressed because it is too large Load diff

1
.wolf/cerebrum.md
View file

@ -9,6 +9,7 @@
<!-- How the user likes things done. Code style, tools, patterns, communication. -->
## Key Learnings
- (2026-06-13, barrier-rollout 5.2) push_config_to_standbys now RETURNS the configAck barrier result (0/-ETIMEDOUT/-EINVAL), push count via acked_out; the configAck branch of repl_wait_majority_ack reads entry_lsn as the push tag and r->ce->n_peers (set-once, lock-free) as the denominator, ce==NULL -> -EINVAL fail-loud. ha.c/join.c streaming pushes discard the return BY DESIGN (log-only); only do_upgrade_config_with_bytes treats it as authoritative.
- [2026-06-12] Census parsing caveat: controller_unit_test logs (tinylog) and Unity result lines BOTH go to stdout and can splice mid-line under the multi-threaded config-push tests — a distinct-Unity-line count silently drops spliced results. Robust census = union of Unity result names AND the `test_x: PASS` printf lines, cross-checked against the per-group `N Tests M Failures` summary blocks (which are splice-immune).
- [2026-06-12] Config-barrier test trick: when a test needs a covering config ACK for a tag only known AFTER conf_save_config hashes the re-encoded blob (upgradeConfig path), pre-ack with acked_config_lsn = UINT64_MAX — covers any push tag under both legacy (>0) and per-push (>= tag) counting.

34
.wolf/memory.md
View file

@ -977,3 +977,37 @@
| 08:51 | Edited src/controller/testsuite/test_commit_barrier_rollout.c | 3→8 lines | ~109 |
| 16:10 | Task 5.1 ha-commit-barrier-rollout: RED tests for configAck per-push arithmetic + upgrade failure path; behavior-preserving push_config_to_standbys signature change (+int *acked_out, return semantics unchanged) | src/controller/{config_repl.c,config_repl.h,ha.c,join.c}, testsuite/{test_commit_barrier_rollout.c,test_repl_majority.c} | 8 new cases (6 RED + 2 pins), isolated group 29 tests/6 fails, full suite: only those 6 fail (summary blocks), repl_majority green, prod controller builds | ~110k |
| 09:31 | Edited .kiro/specs/ha-commit-barrier-rollout/tasks.md | inline fix | ~22 |
| 17:15 | Edited src/controller/repl.c | modified track() | ~202 |
| 17:15 | Edited src/controller/repl.c | added 2 condition(s) | ~323 |
| 17:16 | Edited src/controller/repl.c | quorum() → success() | ~305 |
| 17:16 | Edited src/include/repl.h | wired() → members() | ~127 |
| 17:17 | Edited src/controller/config_repl.c | modified if() | ~942 |
| 17:18 | Edited src/controller/config_repl.c | modified config_push_transport() | ~792 |
| 17:18 | Edited src/controller/config_repl.c | added 1 condition(s) | ~267 |
| 17:19 | Edited src/controller/config_repl.c | standbys() → tool() | ~73 |
| 17:19 | Edited src/controller/config_repl.h | modified acked_out() | ~312 |
| 00:30 | Task 5.2 ha-commit-barrier-rollout: configAck per-push arithmetic (acked_config_lsn>=tag, 1+count>n_peers/2, n_peers<=1 fast path, ce==NULL -EINVAL); push_config_to_standbys returns barrier result (transport split into config_push_transport helper); do_upgrade_config_with_bytes sends send_upgrade_error + skips ACK/restart on barrier failure | repl.c, repl.h, config_repl.c/.h | 29/29 group, 6/6 repl_majority, 46/46 config_repl, full suite 0 FAIL, sanitizers clean | ~60k |
| 01:00 | Adversarial review task 5.2 ha-commit-barrier-rollout: tests green (rollout 29/29, majority 6/6, config_repl 46/46, census 0 FAIL) but REJECTED — repl_on_config_ack has no production caller (config upgrades brick on n_peers>1) + push_config_to_standbys barrier now blocks iomgr thread at ha.c:570/1410 | src/controller/repl.c, config_repl.c, ha.c | REJECTED | ~60k |
| 18:03 | Edited src/controller/testsuite/test_commit_barrier_rollout.c | added 1 condition(s) | ~2006 |
| 18:04 | Edited src/controller/testsuite/test_commit_barrier_rollout.c | 3→6 lines | ~95 |
| 18:10 | Edited src/controller/ha.c | added 3 condition(s) | ~492 |
| 18:10 | Edited src/controller/ha.c | 5→8 lines | ~115 |
| 18:11 | Edited src/controller/cluster.c | added 2 condition(s) | ~441 |
| 18:11 | Edited src/controller/config_repl.c | added 1 condition(s) | ~256 |
| 18:11 | Edited src/controller/config_repl.c | added 1 condition(s) | ~35 |
| 18:12 | Edited src/controller/config_repl.h | modified n_out() | ~635 |
| 18:13 | Edited src/controller/ha.c | modified XCE_TESTING() | ~296 |
| 18:14 | Edited src/controller/join.c | push_config_to_standbys() → push_config_transport_only() | ~125 |
| 18:14 | Edited src/controller/config_repl.c | modified send_upgrade_error() | ~180 |
| 18:15 | Edited src/controller/config_repl.c | modified if() | ~110 |
| 18:15 | Edited src/controller/config_repl.c | modified ONLY() | ~172 |
| 01:35 | Task 5.2 remediation r1: wired production config-ACK ingestion (ha.c+cluster.c), split push_config_transport_only from barrier entry, switched 5 ha.c + 1 join.c sites, barrier rc into upgrade error reply; wire-path test added | ha.c, cluster.c, config_repl.c/.h, join.c, test_commit_barrier_rollout.c | rollout 30/30, repl_majority 6/6, config_repl 46/46, census 0 FAIL | ~95k |
| 18:38 | Edited src/controller/ha.c | inline fix | ~30 |
| 18:38 | Edited src/controller/ha.c | inline fix | ~22 |
## Session: 2026-06-13 20:00
| Time | Action | File(s) | Outcome | ~Tokens |
|------|--------|---------|---------|--------|
| 20:45 | Edited .kiro/specs/ha-commit-barrier-rollout/tasks.md | inline fix | ~37 |
| 20:46 | Edited .kiro/specs/ha-commit-barrier-rollout/tasks.md | 1→2 lines | ~383 |