59597e105e
feat: add --peers to controller for HA peer list and priority election
...
- myconf_t gains peers_cfg (xce_cluster_config_t) populated from --peers
- controller/main.c: parse --peers host:port,... via argp; ca_cert_path
auto-derived from workdir/certs/xce.crt (no --ca-cert flag needed)
- cluster_init: derive my_priority from position in peers list (index 0 =
primary); fall back to 0 when --peers not given (single-node mode)
2026-05-08 04:40:27 +00:00
9ed38d4bad
fix: address fifth-round adversarial review findings for persistence-and-ha-design
...
P1 fixes:
- A5-008: Change `in_catch_up` from plain `int` to `_Atomic int` with
documented access patterns and memory ordering
- A5-002: Add missing opcodes to Part 5.10 capnp schema (heartbeat,
steppingDown, replSnapshot, replCatchUpDone)
- A5-004: Add hook list synchronization spec for demotion (RCU-style
removal with disabled flag and deferred memory reclamation)
- A5-005: Change xce_connect_cluster return type from int to SSL*,
add xce_disconnect_cluster(SSL*), update xce_reconnect to SSL**
- A5-006: Add GC use-after-free mitigation section (per-operation READ
lock hold for P0, epoch-based reclamation as P3)
- A5-010: Add OP_steppingDown handler spec to P1-2 milestone
- A5-001: Clarify P0-3 checkpoint timer vs dedicated pthread timers
- A5-003: Clarify WAL_CRC_NONE handling in replication CRC validation
- A5-013: Add repl_remove_standby slot cleanup requirement
- A5-012: Add primary_ep lifecycle documentation (iomgr-owned borrow,
NULL-before-free under mutex)
- A5-014: Add async hook error handling convention
- A5-015: Add aggregate memory budget analysis for concurrent snapshots
- A5-016: Fix ha_check_heartbeat plain role read to use atomic_load_explicit
- A5-017: Fix Appendix A.4 in_catch_up type consistency (_Atomic int)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-30 05:17:56 +00:00
c623e37b84
fix: address fourth-round adversarial review findings for persistence-and-ha-design
...
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-29 14:01:26 +00:00
454b4aa355
fix: address third-round adversarial review findings for persistence-and-ha-design
...
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-29 13:36:43 +00:00
f1641b1fbf
docs: fix 9 P0 and 6 P1 issues from second adversarial review
...
P0 fixes (9):
- R-22: COW vstore find-slot-and-write not atomic
- R-23: vput grow path without mutex during COW
- R-24: Post-growth slot double-claimed by concurrent threads
- R-25: Missing key_snapshot field for checkpoint serialization
- R-26: malloc(0) for WAL_CHECKPOINT entries
- R-27: Fallback to older snapshot with trimmed WAL
- R-28: hdr.term > ha->term + 1 too restrictive
- R-29: _Atomic on enum type (implementation-defined)
- R-30: handle_jobsubmit() ignores hook return value
- R-31: malloc NULL check missing in standby receiver
P1 fixes (5):
- R-32: No heartbeat during persist_recover() on new primary
- R-33: Catch-up from dead primary removed from promotion
- R-34: Added total_wal_bytes field to persist_t
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-29 12:55:47 +00:00
54bbfa5865
docs: fix 6 additional P0/P1 review findings for persistence-and-ha-design
...
P0 fixes (3):
- R-16: vstore COW growth re-check used OOB a->data[old_caps].inuse
- R-17: Standby WAL write return value unchecked before sending ACK
- R-18: Chained CRC validation absent from replication stream
P1 fixes (3):
- R-19: Replicated entry LSN handling unspecified
- R-20: seg_offset in-memory and lost on crash
- R-21: WAL segment rotation prev_crc handling at recovery
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-29 12:28:39 +00:00
bb66b9766d
docs: fix remaining P0/P1 review findings for persistence-and-ha-design
...
- P0: Fix concurrent vstore race under READ lock during COW mode
(add xzarray mutex serialization around grow-and-assign section)
- P0: Array job sync replication latency bound (batch mode for
array submits to avoid O(array_size × sync_timeout_ms) blocking)
- P1: rtti library ABI break documented with two-repo dependency note
2026-04-29 12:02:53 +00:00
8bab418c61
docs: address multi-perspective review findings for persistence-and-ha-design
...
Fixes 15 P0/P1 issues identified by coherence, feasibility, scope, and
security reviewers:
- P0: traversalLimitInWords fixed to constant bound (not file_size / 8)
- P0: Job ID allocator reset added to recovery sequence
- P0: acked_lsn declared _Atomic uint64_t in struct definition
- P0: ha.role declared _Atomic ctrl_role_t with acquire/release semantics
- P0: hooks_registered idempotency guard added to ha_state_t
- P0: MAX_HA_CANDIDATES reduced from 16 to 4 (speculative generality)
- P0: checkpoint_mutex (pthread_mutex_t) added to persist_t
- P1: Split-brain detection condition explicitly specified
- P1: Heartbeat interval minimum standardized to 2000ms
- P1: Degraded-mode restricted state removed from scope
- P1: Config version hash in heartbeat deferred to P3
- P1: WALEntry Cap'n Proto schema clarified as replication-only
- P1: Snapshot backward compatibility path documented
- P1: Snapshot total_size validated BEFORE malloc
- P1: WAL_QUEUE_CTRL/WAL_WORKER_CTRL replay made idempotent
- P1: mTLS gate enforced before replication code (P1-1)
- P1: PENDING reason ambiguity logged at DEBUG during replay
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-29 11:54:11 +00:00
607f9519e1
docs: address 30 adversarial review findings for persistence-and-ha-design
...
Three rounds of adversarial review plus a regression review identified
30 findings across CRITICAL/HIGH/MODERATE/LOW severities. Key fixes:
CRITICAL/HIGH:
- C11 atomics for COW inuse fields (vget, vput, vstore scan + growth)
- kvtab_gc must run inside same write-lock section as thaw
- WAL growth safeguard during in-progress checkpoint
- pthread_mutex_t checkpoint_mutex (not mylock_t) for cond var
- atomic_store_explicit(release) for ha.role demotion write
MODERATE:
- LSN strictly-increasing check (not consecutive) for WAL_CHECKPOINT gaps
- Hook unregistration on demotion + idempotent registration guard
- CLOCK_MONOTONIC recommendation for retention time comparisons
- Cross-kvmgr freeze ordering documented (WAL replay restores consistency)
- pthread_once + rand_r() replacing unsafe rng_seed_once/rand()
- should_retain lock requirement and merge-walk iterator lock doc
- Standby catch-up receive ordering (snapshot-first, then live WAL)
- applied_lsn==0 gap validation clarification
LOW:
- Demotion failure handling (fail-forward as STANDBY, no rollback)
- WAL_CRC_NONE (0xFFFFFFFF) sentinel replacing collision-prone 0
2026-04-29 10:43:02 +00:00
98911a2154
docs: add controller code consistency findings to persistence design
...
Incorporates investigation of vtaskmgr.c, netio.c, cluster.c, job.c,
join.c, and worker.c into the persistence-and-ha-design document:
- Part 2.7: Controller connection context (workers/scheduler/API servers only)
- Part 3.8: COW lock hierarchy (kvmgr rwlock -> xzarray mutex)
- Part 3.9: Checkpoint timer uses delaymgr, not raw pthread
- Part 4.9: Endpoint deferred cleanup (close fd/SSL, defer slot cleanup)
- Part 4.10: mark_worker_unavail() already exists, only needs extending
- Part 6.5: Replication uses endpoint/iomgr/vtask SSL pipeline
- Part 8.3: Lock safety analysis for reply-after-hooks change
- P0-2a, P0-8a, P2-5a: New implementation steps
- Appendix A.3/A.4: standby_conn_t and ha_state_t use endpoint_t*
2026-04-21 04:46:20 +00:00
