Rongsong Shen 06135954ff chore: baseline snapshot — prior-session work + ha-consistency-invariants spec family

Pre-existing uncommitted work: ha-repl-hardening payload data plane (7.x),
heartbeat liveness fix (Req 1.3), connection-reuse ASAN fixes, doc cleanup.
New: ha-consistency-invariants umbrella (requirements/design/research) and
its four implementation sub-specs (specs generated via batch, cross-spec
review applied), steering roadmap + product.md Raft+CP decision.

2026-06-11 13:21:50 +00:00

2.5 KiB

Raw Blame History

Brief: ha-commit-barrier-rollout

Sub-spec 2 of 4 implementing the ha-consistency-invariants umbrella contract. Authoritative requirements/design/research: .kiro/specs/ha-consistency-invariants/ (design.md §Write-Path Classification + §Config Barrier + §Idempotency Guards). This brief scopes the slice; do not re-derive decisions.

Problem

Only WAL_JOB_SUBMIT goes through a commit barrier. Job state changes, queue control, and worker control apply locally with fire-and-forget replication; job/queue control replies before any durability; config push ignores its majority-ACK result; worker-reported facts are silently lost on rejection (bug-396); mark_job_* have no idempotency guards.

Desired Outcome

Every state-changing WAL type routed per the design's classification table: request-shaped → WAIT mode with commit-first-then-reply (validate → mutate provisional → append → commit_submit → reply); fact-shaped → RETAIN mode (log-is-the-queue, appended + retried until committed, no timeout, never dropped while running+leading). Config upgrade fails to the requester on missed majority. mark_job_* transitions are idempotent and ordered.

Scope

In: classification table + dispatch in persist.c (debug assert on unclassified types); reply-ordering sweep of all control handlers in job.c (incl. do_jobcontrol_op), queue and worker join/update paths; handle_jobdispatch classification (per design Reply-Ordering Contract); RETAIN routing for fact WAL types; push_config_to_standbys error propagation + caller failure; mark_job_* state-machine guards; integration tests (no success reply observable before commit; fact retention across quorum loss).
Out: the commit engine itself (ha-commit-engine); promotion/COMMITTING (ha-single-leader-role); egress filter and demotion (ha-convergence-recovery); worker protocol changes (worker-rejoin-resync backlog).

Requirements (umbrella IDs)

2.1 (all operation types), 2.2, 2.8, 5.1, 5.2, 5.3.

Upstream / Downstream

Upstream: ha-commit-engine (WAIT/RETAIN API).
Downstream: ha-single-leader-role (must land after this — barrier before state removal); worker-rejoin-resync (shares idempotency guards).

Constraints

Commit-first-then-reply is non-negotiable for request-shaped ops; a missed handler silently violates umbrella Req 2.1 — the sweep must be exhaustive (grep all xce_reply sites in control paths). Crash-loss of uncommitted facts accepted until worker-rejoin-resync lands.

2.5 KiB Raw Blame History