forked from lei.chen/myxce
Rongsong Shen
d3da3ca8bd
Add explicit test coverage for the DIVERGENT fence's stay-alive and restart-only-clear guarantees (task 5.3), which surfaced a critical, pre-existing safety gap: the sticky recovery_unrecoverable flag is trigger-agnostic, and two pre-existing live call sites in ha.c (promotion_fence_timeout_fn's periodic timer, and raft_cb_become_leader's promotion-eligibility gate) clear it based purely on structural conditions, never checking the apply verdict. A node whose local apply dispatch diverges from the committed log, but whose WAL bytes are otherwise structurally healthy, would have its fence silently released by the live timer, then be eligible for promotion to primary on a later election -- serving genuinely divergent state. Fix: gate both clear-call-sites on persist_apply_verdict(&c->persist) != APPLY_DIVERGENT in addition to their existing structural checks. An apply-divergence-triggered fence can now only clear via a fresh process restart's clean persist_recover() replay. New tests: test_promotion_fence_apply_divergent_survives_structural_catchup (test_commit_durability.c) covers the timer site; and test_promotion_refused_when_apply_divergent_even_if_eligible (test_convergence_verification.c) covers the promotion-gate site, structurally isolated so it cannot pass for the wrong reason. Closes out task-group 5 (restart apply-correctness verification). |
||
|---|---|---|
| .. | ||
| settings | ||
| specs | ||
| steering | ||