prisma-risk / tsoracle / 26385118621

95%

push

github

fix(driver-paxos): enforce single active leadership stream via Drop-released lease (#403)

PaxosDriver::leadership_events() minted a fresh live stream on every call
with no guard, so two Server instances built from one Arc<PaxosDriver> each
ran the failover fence, seeded independent ServingCore allocators from the
same floor, and could issue duplicate (physical_ms, logical_start, epoch)
tuples to their respective endpoints.

Add a stream_active: Arc<AtomicBool> lease. leadership_events()
compare_exchange-acquires it and returns the live stream wrapped in a
LeasedStream that releases the lease on Drop. A concurrent second call
observes the lease held and fails closed with an empty stream, which the
server's leader-watch loop reads as WatchStreamClosed and poisons serving
state to NotServing, so the second server never seeds an allocator.
Sequential re-subscription (an in-process restart that drops the prior
stream first) still re-acquires the freed lease and mints a live stream,
preserving the behavior fixed by the prior re-subscribe change.

56 of 61 new or added lines in 1 file covered. (91.8%)

9234 of 9654 relevant lines covered (95.65%)

552014.76 hits per line