Repository navigation
fix: recovery, boot, and DDL cleanup - #441
Merged
Merged
Conversation
Describing a statement planned its sequence functions against the live counters, so a Describe consumed a value the execution then skipped. Plan a Describe in a describing mode in which sequence functions check that their sequence exists and resolve to a typed placeholder, without advancing a counter or recording a session value.
A descriptor drain has no expiry, so a DDL that failed, timed out, or was cancelled after starting a drain left the descriptor drained. Add a drain hold that owns each drain from before its start is proposed and ends it on any exit short of the applying entry. Abandoning a DDL preparation lease now cancels its pending DDL record before releasing it, including when the proposer never learned the outcome of its own pending propose, and a cancelled pending record ends the drains its reserved alters started. A drain end that cannot be proposed is recorded through diagnostics.
The boot integrity check looked up RLS policy and change stream collections by tenant and name only, so a policy on a collection in a named database reported a dangling reference and refused every boot. Resolve them by database, tenant, and bare name, and treat a qualifier for another database as dangling.
Reclaim after a collection drop left the columnar checkpoint generations on disk. Reclaim them for every collection whose rows live in the columnar engine, resolving the live generation through the same manifest reader the core uses.
…tted writes Data Plane cores drain no request until their WAL replay ends, and a request's deadline runs from its dispatch, so boot steps that dispatched early timed out against a slow replay. Wait for every core's replay, with no time bound, before any boot step that dispatches, and gate metadata post-apply hooks on a new DataPlaneReplay phase. A committed write is never expired by its core, so its Control Plane wait carries no deadline either: array-sync applies and funnel writes wait for the real answer instead of reporting a write the core still applies as not applied.
farhan-syah
added
the
run-ci
Bump the 0.136 series of the pinned dependency family to 0.136.5 and refresh two patch-level dependencies.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes recovery, boot, and DDL cleanup bugs found on
main.Fixes
kill -9: boot waits for every core to finish WAL replay before it dispatches work to the cores. A newDataPlaneReplaystartup phase gates this. Committed Calvin, data-group, and array writes carry no deadline, so a slow replay no longer times them out.(database_id, tenant_id, name).COMMITleaves state behind: the commit ends its drains, cancels its pending record, and releases the lease.DROP ... PURGEleaves the columnar checkpoint file: reclaim removes it from every core's live generation. A droppedcolumnarorspatialcollection no longer comes back at boot.Tests
crash_boot_slow_replay: replay held 8 s past a 5 s statement deadline. The node boots and every row is present once.crash_named_database_catalog_refs: named database with an RLS policy and a change stream survives twokill -9restarts.crash_dropped_collection_reclaim: a dropped columnar collection stays dropped, and a same-name re-create starts empty.txn_guarded_update_with_other_write: regression coverage for [0.6.2] Guarded UPDATE plus another write in one transaction always aborts at COMMIT with 40000 "retry" (possibly fixed on main by #429) #433, fixed in fix: Calvin predicate writes in transactions, fusion primary keys, bitemporal predicate writes #429.Known open defect
A node killed before its first post-restart checkpoint replays a longer WAL tail on each restart. Boot completes, but recovery time grows.
Closes #431
Closes #432
Closes #433
Closes #438
Closes #439
Closes #337