feat(ha-term-safety): on_commit_advanced barrier trigger + commit-gate ownership (task 2.4)

This commit is contained in:
Rongsong Shen 2026-06-22 07:33:04 +00:00
parent 2c5d298cb5
commit 3470bdfb71
6 changed files with 363 additions and 9 deletions

View file

@ -31,6 +31,15 @@ typedef struct commit_engine {
int n_vcpus;
int inflight_waits; /* <= max(1, n_vcpus - COMMIT_WAIT_RESERVED) */
uint64_t writable_lsn; /* own-term gate; 0 = no gate */
/* ha-term-safety task 2.4: the raft library's current-term-gated commit
* index — the COMMIT SOURCE (replaces the term-blind safe-commit). The
* barrier never advances committed_lsn past this ceiling, so an entry is
* committed only when BOTH a durable majority agrees AND the library's
* Figure-8 current-term commit rule has admitted it. 0 = no library commit
* index yet (nothing committed) — committed_lsn stays at 0. Monotonic
* non-decreasing (the library only fires on_commit_advanced on a strict
* advance), set under ce->lock via commit_set_raft_commit_index. */
uint64_t raft_commit_index;
uint64_t scratch[MAX_STANDBYS]; /* sorted matchIndex scratch array */
} commit_engine_t;
@ -56,6 +65,13 @@ void commit_on_ack(commit_engine_t* ce, int standby_idx, uint64_t acked_lsn);
* (API ships here; no caller in this spec — unset = no gate.) */
void commit_set_writable_lsn(commit_engine_t* ce, uint64_t noop_lsn);
/* ha-term-safety task 2.4: feed the raft library's current-term-gated commit
* index as the commit SOURCE. Records the ceiling (monotonic max() — never
* regresses) and re-evaluates the barrier under the new ceiling, advancing
* committed_lsn and waking satisfied waiters. Called from the on_commit_advanced
* callback after the library admits a strict commit advance. Never blocks. */
void commit_set_raft_commit_index(commit_engine_t* ce, uint64_t commit_index);
/* Quorum-membership change (standby add/remove/catch-up transition):
* re-evaluate pending entries; standbys in catch-up are excluded. */
void commit_on_membership_change(commit_engine_t* ce);