[rmcdaniel]

Part of #325: the backup-first in-place upgrade gate. Stacked on #533 (which sits on #532, #529 and #523); review those first. Implements the MySQL and MariaDB part of the design in #517. With this PR, all three backends have a takeover.

Why MySQL is different

MySQL and MariaDB commit DDL implicitly, so the takeover cannot be one transaction. The design also considered LOCK TABLES, but it does not work here: under it, MySQL 8.0 refuses to create or drop any table the session does not hold (ERROR 1100 … was not locked with LOCK TABLES), so the native relations could not be added. The takeover therefore uses the design's other option: a session check plus a step journal.

Takeover

upgrade-takeover now also accepts DB_CONNECTION=mysql or mariadb. It runs under native's bootstrap lock (GET_LOCK('dw-native-bootstrap:'…)), so neither a native node nor a second takeover can run meanwhile.

1. Verify. The takeover refuses with upgrade_source_in_use while any other session uses the database. Seeing other accounts' sessions needs the PROCESS privilege; without it the takeover refuses with upgrade_source_sessions_unverifiable. The inventory and fingerprint are then read in one consistent snapshot, and the takeover refuses unless they match DW_UPGRADE_BACKUP_FINGERPRINT. Service calls and external payloads are refused here, before anything is written.

2. Mark. The first write is native's own marker table, with one row ('rust-takeover:<layout>', <completed steps>, <fingerprint digest>). From then on:

   • PHP refuses the database, since its fence is the table's existence;
   • native startup refuses it with native_takeover_incomplete.

3. Fence. The session check runs again, and the fingerprint is recomputed with the marker set aside, so nothing a PHP session wrote before the marker can be missing from the backup.

4. Convert. Each step records its completion in the row:

   • native relations and the workflow_tasks poll index;
   • incarnation adoption, whose rows commit in the same transaction as the step record;
   • dropping the PHP incarnation table, the registration token, the service-call deadline column with its index, and the queue delivery reference;
   • for Laravel's mariadb driver, the backup-hold owner from uuid to char(36).

   DDL steps check what is left to do, so repeating an interrupted step is harmless.

5. Finish. The migration ledger row and native's final marker ('rust-development', 4, <checksum>) commit together. Native's startup verification (marker, ledger and full catalog) then runs.

A rerun with the same digest resumes after the last recorded step; a different digest is refused. A takeover killed between creating the marker table and writing its row is resumed too: the layout is read again with the marker set aside, and the fence step verifies the fingerprint.

The inventory, fingerprint and catalog read now accept that fenced state (mysql_inventory, mysql_digest, fenced_source_catalog). The layout conversion shares the incarnation adoption with SQLite and PostgreSQL.

Checks

• MySQL qualification tests (runtime::mysql::tests::qualification_takeover_*, run by the mysql-execution jobs on MySQL 8.0 and MariaDB 10.11):
  • A PHP 2.9.7 database, rebuilt from the recorded release deltas, is converted and opened by native, and a second takeover is refused.
  • The frozen layout, and on MariaDB the mariadb-driver layout, are taken over.
  • These are refused before any write, with the catalog and every row unchanged: a wrong digest, a malformed digest, another open session, a write after the backup, a service call, and an external payload.
  • A real takeover process is SIGKILLed at four boundaries: between the marker table and its row, after the fence, after the incarnation rows, and before the final commit. Each time the marker fences PHP, native refuses the database, and a wrong digest is refused on resume. The rerun with the right digest completes, and native opens the result.
• Upgrade source cohort: the MySQL jobs now take over a restored copy of the published-PHP source, start native on it and resume the originals, as the SQLite and PostgreSQL jobs do. The cohort's steps are renamed for what they now do.
• Local results:
  • The 4 new tests pass on MySQL 8.0.46. All 5, including the mariadb-driver case, pass on MariaDB 10.11.19.
  • All 15 MySQL qualification tests, the 11 PostgreSQL qualification tests and the SQLite lib tests (129) pass.
  • The cohort passed with both the default (PHP 2.8.0 layout) and the PHP 2.9.7 sources on MySQL 8.0 and MariaDB 10.11, and with the default source on SQLite and PostgreSQL. In each run, the leased activity completed on its original attempt, the stale task got 409 task_not_leased, the timer fired after its deadline, both workflows completed and PHP refused with php_database_refused.

Cohort fixes in this stack

• Resume order. The resume now accepts the two originals in either order. MySQL's backup and restore outlast the 60 s source timer, so the timer workflow's task can be ready first (fixed in Take over a stopped PHP SQLite database backup-first #532).
• File permissions. The SQLite restored and takeover copies are made writable for the uid 1000 containers, since the runner's own user makes them (Fingerprint a stopped PHP source database for backup proof #523 and Take over a stopped PHP SQLite database backup-first #532).
• MariaDB backend name. The takeover check accepts native reporting mariadb for the cohort's mysql backend.

Not covered yet

• Nested payload columns the inspection does not scan yet.
• Takeover with external payloads or service calls.
• Multi-node qualification.

The report keeps stored_representation_compatibility_verified: false.

🤖 Generated with Claude Code