Rongsong Shen 06135954ff chore: baseline snapshot — prior-session work + ha-consistency-invariants spec family

Pre-existing uncommitted work: ha-repl-hardening payload data plane (7.x),
heartbeat liveness fix (Req 1.3), connection-reuse ASAN fixes, doc cleanup.
New: ha-consistency-invariants umbrella (requirements/design/research) and
its four implementation sub-specs (specs generated via batch, cross-spec
review applied), steering roadmap + product.md Raft+CP decision.

2026-06-11 13:21:50 +00:00

2.4 KiB

Raw Blame History

Brief: ha-single-leader-role

Sub-spec 3 of 4 implementing the ha-consistency-invariants umbrella contract. Authoritative requirements/design/research: .kiro/specs/ha-consistency-invariants/ (design.md §HA Role Lifecycle + role lifecycle diagram). This brief scopes the slice; do not re-derive decisions. HARD ORDERING: must land AFTER ha-commit-barrier-rollout. Removing the transitional state before the universal barrier opens a window where a fresh primary accepts unreplicated writes.

Problem

CTRL_PRIMARY_COMMITTING is a transitional leader state Raft does not have: it causes a redirect loop (ha_should_redirect points clients at a primary that doesn't exist yet), committing_timeout_fn force-promotes after 60s even with zero converged standbys (violating the commit rule outright), and ha_is_primary lies during the window.

Desired Outcome

Raft's three-state model: election winner becomes CTRL_PRIMARY directly; post-election write safety comes from committing a WAL_NOOP entry of the current term (own-term commit rule §5.4.2) via the commit engine's writable_lsn gate; no wall-clock path ever changes leadership or confirms operations.

Scope

In: WAL_NOOP entry type (empty payload, replay no-op); raft_cb_become_leader rewrite (direct PRIMARY, hook registration moved here, append+broadcast no-op, commit_set_writable_lsn); deletions — CTRL_PRIMARY_COMMITTING enum, dispatch-gate COMMITTING branch, committing_timeout_fn + watchdog, ha_check_majority_convergence, repl_ack_count/ha_repl_ack_received; ha_is_primary/ha_should_redirect/vote-deny simplification; legacy ha_elect_evaluate_and_signal (XCE_TESTING path) updated symmetrically; test-fixture sweep (broad — every test referencing COMMITTING); testsuite/test_ha_role_lifecycle.c.
Out: election/vote logic itself (raft-library); demotion behavior (ha-convergence-recovery); barrier mechanics (specs 1–2).

Requirements (umbrella IDs)

1.1, 1.2, 1.3, 1.4, 1.5, 3.1, 3.2, 3.3.

Upstream / Downstream

Upstream: ha-commit-engine (writable_lsn gate), ha-commit-barrier-rollout (universal barrier in force).
Downstream: ha-convergence-recovery E2E relies on the simplified lifecycle; ha-async-io.md steering sync (roadmap item) after this lands.

Constraints

The COMMITTING reference sweep spans ha.c, cluster.c, steering docs, and many test fixtures — mechanical but must be complete; grep-verified zero references at completion.

2.4 KiB Raw Blame History Unescape Escape