prisma-risk / tsoracle / 26379927360

95%

push

github

fix(client): reject off-list epoch-less leader hint over a fresh known-epoch leader (#381)

`compare_and_set_leader`'s monotone-forward gate collapsed three cases
into one `_ => true` arm. Two are intentional (the cache itself holds no
epoch — the bootstrap / old-server path), but the third let a hint
carrying *no* epoch replace a fresh, known-epoch cached leader. A
mixed-version peer (some nodes emit an epoch, some don't) or a
misbehaving redirect source could thereby regress routing away from a
leader the client had just confirmed at a known epoch.

Split the `(Some cached, None hint)` case out of the catch-all: with no
epoch to rank, accept the hint only when it names a configured endpoint
— one we would dial in round-robin regardless, and that a later
successful RPC could confirm. An off-list epoch-less hint can no longer
downgrade the confirmed leader. The known-vs-known monotone gate and the
unknown-epoch-cache (absent/expired/bootstrap) paths are unchanged, and
`record_success` still seats any endpoint a real RPC confirms.

Matching is exact-string equality against the configured list, the same
identity `iter_round_robin` uses for dedup; when config and hint strings
disagree the carve-out simply does not fire, degrading to the safe
reject rather than the previous accept.

The caller's `StaleLeaderHint` warning is reworded — it previously
claimed the hint's epoch was "behind the cached leader's epoch", which
is inaccurate for the new epoch-less rejection.

Closes #357

46 of 50 new or added lines in 2 files covered. (92.0%)

12345 of 13011 relevant lines covered (94.88%)

417328.4 hits per line