prisma-risk / tsoracle / 26381549307

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(server): stop leader-watch task cooperatively via WatchGuard (#392)

`into_router` spawned `run_leader_watch` holding `Arc<Server>` and returned
a bare `JoinHandle`. A piggyback embedder who mounted the `Routes` and
dropped or merely stored the handle could not stop the task at their own
shutdown: it kept `Arc<Server>` (and the consensus driver) alive until the
leadership stream happened to close. The only other stop, `abort()`, is a
hard cancel that can drop the task mid-fence while it holds
`extension_gate.write()`.

Thread a cooperative cancel future into `run_leader_watch`, observed via a
biased arm in both `select!` boundaries (the event wait and the
transient-retry backoff) but never inside a fence attempt, so an in-flight
fence always runs to completion. On cancel the task publishes `NotServing`
and returns `Ok(())`.

`into_router` now returns a `WatchGuard` that owns the task: dropping it (or
calling `shutdown().await`) cancels cooperatively, tying task lifetime to
guard lifetime. The guard also exposes `abort()` and a read-only
`is_finished()` liveness probe. The cancel signal is a `oneshot`, so no new
dependency is added.

`serve_with_*` no longer abort the watch task on user shutdown; they drop
its cancel sender and await a clean drain. The spawn body is extracted into
a private `into_router_parts` so that path stays free of the guard's
`Option` fields. `join_to_server_result`'s `Ok(Ok(()))` arm is now reachable
as cooperative cancellation rather than an unreachable production case.

Coverage Stats

60 of 66 new or added lines in 2 files covered. (90.91%)

1 existing line in 1 file now uncovered.

12647 of 13337 relevant lines covered (94.83%)

409709.86 hits per line