prisma-risk / tsoracle / 26409991118

95%

push

github

fix(client): defend epoch-less leader cache from backward flap (#413)

The client leader cache could flap backward in epoch-less (mixed-version /
old-server) clusters. `record_success` defended the cache against a stale
cross-endpoint write only when the cached epoch was known
(`cached.epoch.is_some_and(|c| epoch < c)`). When the cached entry's epoch
was `None` — seated by an epoch-less leader hint or at bootstrap — that guard
was always false, so any different-endpoint success, including a late stale
completion against a now-deposed leader, fell through to the replace arm.
The result was exactly the backward flap the monotone-forward gate exists to
prevent: a NOT_LEADER redirect stampede until the cache aged out.

The root cause was structural. `record_success` and `compare_and_set_leader`
were two independent implementations of the same monotone-forward rule; one
was hardened against a stale write but the mirror left a gap. A monotone
gate is only as strong as its weakest writer.

Collapse both onto one private `seat_leader(endpoint, epoch, source)` that
owns the single rule table. The source (a confirmed RPC vs. a third-party
NOT_LEADER hint) decides only the ambiguous epoch-less, different-endpoint
case: a hint is a forward-looking claim and still seats over an unknown-epoch
cache, but a success is a past proof whose completion can be arbitrarily
delayed, so it cannot clobber a fresh entry it has no rankable epoch to
outrank. Convergence is preserved — an alive follower redirects via the hint
path, a dead endpoint self-heals at the TTL, and requests keep succeeding via
worklist fall-through.

The hint path's behavior is unchanged (including the configured-endpoint
carve-out for off-list epoch-less hints). Two same-endpoint paths improve as
a side effect of the unification and are pinned by tests: a lower-epoch hint
is no longer reported stale, and an epoch-less hint no longer downgrades a
known cached epoch to unknown.

102 of 108 new or added lines in 1 file covered. (94.44%)

9422 of 9920 relevant lines covered (94.98%)

521413.56 hits per line