wdgzyjx/myxce
1
0
Fork 0
forked from lei.chen/myxce
Code Pull requests Activity

test(ha-convergence-recovery): close Task 8 — live /xce-test-ha 8-round PASS

Browse source 
Ran the live 3-node E2E (the last open task). Result:
  PASS: 8 rounds, 30 jobs submitted, zero job loss; all 3 nodes led
  (ctrl-1,ctrl-2,ctrl-3)  (exit 0)

Live-covered: kill-primary -> promoted standby owns all confirmed jobs
(zero loss across 8 failovers, jobs 3->30, expect-job ok each round);
restart ex-primary -> converged rejoin, 3-of-3 each round, no phantom jobs;
deterministic leadership coverage (ctrl-3 forced via RequestVote-freshness
fence). The soak also served as the live regression for bug-1077 (~40
failover client round-trips, no SEGV) after rebuilding the controller (the
deployed binaries predated that fix).

Not exercised live (remain unit-covered, tasks 2/4/5): withhold-ACK barrier
single-outcome (test_demotion_convergence) and isolate/heal quorum-WARN
(test_convergence_verification). All 8 tasks now [x]; spec closed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MSxwb2Xt5F84ATgiAZnH8V
This commit is contained in:
Rongsong Shen 2026-06-24 10:17:11 +00:00
parent 05febbc9a7
commit af099dca3e
3 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.wolf/cerebrum.md
View file

@ -305,3 +305,9 @@ Pure library core (no I/O/threads) + controller callback adapters keeps it simul
- Do NOT add "free the prior occupant" guards on an untagged union slot (this is what commit 61e1391 did incidentally, bundled into an unrelated "fix bug-1060 bug-1067" — it caused a CRITICAL ASan crash). If you want leak-safety on such a slot you need a type tag, not a blind free.
- When a request consumer stashes a STACK pointer into a shared ctx field (e.g. `ctx->reply.u.get = &local`), it MUST clear it on ALL exit paths, not just success. Use a single `goto done` cleanup so a new error path can't reintroduce the leak.
- Keep speculative "while I'm here" hardening OUT of bugfix commits — it hid a memory-safety regression behind an unrelated commit title.
## Do-Not-Repeat (2026-06-24) — rebuild controller BEFORE /xce-test-ha
The /xce-test-ha soak deploys whatever `src/xce.build/controller/{xce_controller,xce_test}` currently are. After editing libxce/controller source, those binaries can be STALE (older than your fix) — the soak would then validate the wrong code (or hit the bug you just fixed). ALWAYS `ninja -C src/xce.build controller/xce_controller controller/xce_test` (or /xce-build controller) and confirm binary mtime > your last source edit BEFORE running the soak. (Caught here: deployed binaries were 09:24, bug-1077 fix was 09:32.)
## Key Learning (2026-06-24) — ha-convergence-recovery CLOSED
Task 8 (live 3-node E2E) passed: `/xce-test-ha` 8 rounds, 30 jobs, zero loss, all 3 nodes led (ctrl-3 forced via RequestVote-freshness fence maneuver). bug-1028 (post-failover availability) already fixed 2026-06-23. The soak is ROLLING single-failover only — it does NOT cover cold-restart-all (bug-795/828 gap, separate) nor isolate/heal quorum-WARN (unit-covered in test_convergence_verification). All 8 tasks [x].