No description
Rongsong Shen
ac46bfa649
Found via the mandatory live HA chaotic soak for this session's controller audit campaign -- unrelated to any of the 9 audit fixes (bug-1684/1687/ 1689/1690/1691/1692/1693/1694), all in ha.c/persist.c/job.c/cluster.c/ sched.c/worker.c; this is in myapp.c, untouched by any of them. myapp_run()'s bootstrap "is a leader already known" check had a fallback `c.ha.raft.term > 0` meant to detect genuine new raft activity processed during the startup-stagger nap. But ha_restore_term() loads ha->term from disk BEFORE this check runs, on every boot -- and Raft terms only ever increase, never reset. So `raft.term > 0` is trivially true on every restart for the rest of the cluster's on-disk lifetime, once it has ever held one election, regardless of whether any leader is currently reachable. Live-reproduced: every node, on every restart after the cluster's first election, unconditionally skipped ha_start_election_async forever -- no node could ever re-assert leadership through a real election again. bug-1477's existing cluster_init_phase2 retry loop kept firing correctly (confirmed in the reproduction logs) but could never succeed, since the deeper cause -- no election ever runs to produce a live primary to push config from -- was never addressed by that fix. Fixed by snapshotting `term_at_boot` right after ha_restore_term()/ ha_init_raft() seed the term, strictly before the stagger nap, and comparing `raft.term > term_at_boot` instead of `raft.term > 0` -- only a term that has genuinely ADVANCED during this boot cycle (real vote/ heartbeat traffic processed) counts as evidence a leader is known. The decision was extracted into a new, unit-testable myapp_leader_already_known() (startup_validation.c, since controller_unit_test deliberately excludes myapp.c/main.c). voted_for_name/vft==cur and primary_ctrl_fd>=0 checks are unchanged. 7 new tests in test_ha_startup.c; RED/GREEN independently verified. Rigorous A/B live-soak proof (identical 6-round --chaotic run, fixed vs git-stashed-back-to-original): baseline showed term frozen for the whole run and zero election activity on any non-primary node; fixed run showed term genuinely progressing and ctrl-2 achieving a real, log-verified CTRL_PRIMARY transition via a won PreVote round -- proof a node other than the original primary can now take over, which was structurally impossible before. Full controller suite: 1191 tests, 2 failures -- both the pre-existing, unrelated bug-1561 overlayfs sandbox flake. Residual, NOT independently verified yet (flagged honestly, not fixed here): the fixed run's chaotic verdict showed committed_job_loss=6 (baseline 0) -- traced via waldump to one jobid missing from every node's WAL, at the cold-boot window before round 1. Resembles the already-fixed bug-1487 false-positive class (apply-pump-lag racing verify_classify's expect-job check) but the reported mechanism doesn't perfectly match (bug-1487's job was present-in-WAL/not-yet-visible; this one is described as absent from every WAL entirely) -- needs independent re-verification before being dismissed, tracked as a follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AgYRU3zDTqNGV5Jk8aiKLg |
||
|---|---|---|
| .claude | ||
| .kiro | ||
| .wolf | ||
| docs/superpowers/plans | ||
| raft | ||
| reports | ||
| scripts | ||
| src | ||
| .clang-format | ||
| .gitignore | ||
| .mcp.json | ||
| .opencode.json | ||
| CLAUDE.md | ||
| README.md | ||
1. commit 规则
- 每个人 fork 自己的 branch， 从自己的 branch 做 PR，review 完再 commit
2. code format
2.1. C
推荐使用 clang-format，公共配置放在源码里面 xce/.clang-format
（理论上直接使用源码里面 xce/.clang-format 文件格式不会变）
2.1.1. vscode 可以在配置中加上如下内容
"C_Cpp.clang_format_style": "WebKit",
"C_Cpp.clang_format_fallbackStyle": "WebKit",
2.1.2. vim & emacs
clang-format -style="{BasedOnStyle: webkit}" -i XX.c
2.2. golang
使用默认 gofmt
3. build environment and build (example of ubuntu)
3.1 build environment
- Install nix package management tool
sh <(curl -L https://nixos.org/nix/install) --daemon
- Edit /etc/nix/nix.conf to make sure
experimental-features = nix-command flakes
sandbox = true
sandbox-fallback = false
substituters = https://mirrors.ustc.edu.cn/nix-channels/store https://cache.nixos.org https://cache.nixos.org/
trusted-users = root <your account>
make sure that you have restarted nix-daemon service after you have changed /etc/nix/nix.conf
- Install socat and config ssh (for clone by ssh protocol)
nix profile add nixpkgs#socat
.ssh/config
Host gitea.shenrs.eu
HostName gitea.shenrs.eu
IdentityFile ~/.ssh/id_ed25519
ProxyCommand socat - openssl-connect:gitea.shenrs.eu:2022,snihost=gitea.shenrs.eu,verify=0
3.2 checkout source code
3.3 build (for package and release)
cd xce/src
# for build debug version
nix build --option sandbox false .#xcecore_debug
# for normal build
nix build --option sandbox false .#xcecore
You can find the generated binaries at =result= directory
3.4 build (for daily develop)
cd xce/src
nix develop
# using meson to generated build configuration (debug and address sanitize)
meson setup build --buildtype=debug -Db_sanitize=address
# run meson to build
meson compile -C build
# The generated files will be in build/
3.5 build AppImage package
cd xce/src
nix bundle --bundler github:ralismark/nix-appimage --option sandbox false .#xce
This will create all in one AppImage file which contains everything for package delivery.
4. misc
4.1. Windows remap ctrl and alt key
create a reg file, e.g. remapkey.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout]
"Scancode Map"=hex:00,00,00,00,00,00,00,00,05,00,00,00,38,00,1d,00,1d,00,38,00,38,e0,1d,e0,1d,e0,38,e0,00,00,00,00
then double click remapkey.reg to import it. Restart OS.