forked from lei.chen/myxce
Rongsong Shen
13c6e89309
ha-commit-durability: closes the "pending confirmation under simultaneous total outage" caveat. Reproduced cold-restart-all (kill all 3 members + restart) 5 times against a live 3-node cluster on genuine ext4 (not the sandbox's overlayfs) — zero committed-job loss across 40 rolling-failover rounds + 5 cold-restart-all cycles. Confirms bug-795 was an overlayfs fdatasync artifact, not a real durability gap; no production fix needed. Commit Durability is now proven for both rolling single-node failover and simultaneous total-cluster outage (src/controller/CLAUDE.md updated). Live-validated and marked complete against a real 3-node cluster: - controller-status 6.4: off-primary committed fidelity + responder timestamp, confirmed via a real failover - ha-heartbeat-committed-propagation 4.1: standby committedLsn tracks the primary via heartbeat within the 3s interval - ha-wal-replication 5.4: standby WAL replication verified via committedLsn match (job-facing ops are correctly primary-only by design; standbys return E_XCE_STANDBY, not a bug) - libxce-failover 6.2: live 3-node failover E2E, jobsub raced against a primary kill resolves to exactly one job, no duplication Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SDWVNQLKxqTVHh42cH7rV3 |
||
|---|---|---|
| .. | ||
| repro-851 | ||
| brief.md | ||
| design.md | ||
| INVESTIGATION-failover-job-loss.md | ||
| requirements.md | ||
| research.md | ||
| spec.json | ||
| tasks.md | ||