feat(cluster): harden naming recovery and bounded transport lifetimes - #736
Draft
wolfy-j wants to merge 2 commits into
Draft
feat(cluster): harden naming recovery and bounded transport lifetimes#736wolfy-j wants to merge 2 commits into
wolfy-j wants to merge 2 commits into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cluster name ownership, participant recovery and transport shutdown need stronger lifetime and resource bounds. This draft preserves the complete local hardening candidate and its research evidence so the remaining work can be reviewed and continued remotely.
Implemented areas include owner-fenced naming/revocation, committed participant inventory and recovery, bounded Strong outcomes, authenticated relay/monitor lifetimes, joined handshake/shutdown cleanup, reliable outbound accounting, lazy queue storage and default protected control admission. The changes are interdependent and are preserved together rather than presented as independently mergeable patches.
The latest completed phase is control admission: reserves are carved from existing peer/node totals, accepted frames stay charged through writer/retry ownership, and ordinary backlog cannot consume every control slot. Defaults reserve 16 entries/1 MiB per peer and 256 entries/16 MiB per node. Ordinary maximum retained frame size is consequently 511 MiB under the default peer budget; explicit zero disables a reserve.
Validation retained in
research/cluster/validation/control-admission/: full internode race suite; configuration and real authenticated TCP/TLS saturation tests; selected Raft tests and native multi-process boot/recovery; negative eligibility-disabled regressions. Earlier 100-manager TLS evidence is one-process localhost transport only, not a 100-machine cluster-service proof. These local results do not constitute whole-candidate CI approval.Draft — do not merge yet. Remaining gates include snapshot/control receive and wire isolation, sustained mixed/toxic-network validation, canonical cross-node Streams, remaining naming/terminal-monitor lifecycle contracts, consumer documentation and review. Snapshot chunks currently share Raft control capacity; this phase does not guarantee control latency behind a blocked receiver. Default capacity sizing is initial policy, not sustained 100-node validation.
Start review at
research/cluster/CONTROL-ADMISSION-CHECKPOINT.md, thenTRAFFIC-ISOLATION.mdand the latest entries ofRECOVERY-20260911.md. The earlier naming journal is archived and superseded by the current integration journal. No existing PRs are merged by this publication.