Rongsong Shen
13c6e89309
ha-commit-durability: closes the "pending confirmation under simultaneous total outage" caveat. Reproduced cold-restart-all (kill all 3 members + restart) 5 times against a live 3-node cluster on genuine ext4 (not the sandbox's overlayfs) — zero committed-job loss across 40 rolling-failover rounds + 5 cold-restart-all cycles. Confirms bug-795 was an overlayfs fdatasync artifact, not a real durability gap; no production fix needed. Commit Durability is now proven for both rolling single-node failover and simultaneous total-cluster outage (src/controller/CLAUDE.md updated). Live-validated and marked complete against a real 3-node cluster: - controller-status 6.4: off-primary committed fidelity + responder timestamp, confirmed via a real failover - ha-heartbeat-committed-propagation 4.1: standby committedLsn tracks the primary via heartbeat within the 3s interval - ha-wal-replication 5.4: standby WAL replication verified via committedLsn match (job-facing ops are correctly primary-only by design; standbys return E_XCE_STANDBY, not a bug) - libxce-failover 6.2: live 3-node failover E2E, jobsub raced against a primary kill resolves to exactly one job, no duplication Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SDWVNQLKxqTVHh42cH7rV3 |
||
|---|---|---|
| .. | ||
| settings | ||
| specs | ||
| steering | ||