prisma-risk / tsoracle / 26413349720

95%

push

github

fix(server): close the serving gate synchronously when the WatchGuard drops (#422)

`WatchGuard::drop` only dropped the cooperative-cancel sender, so the
serving gate was closed asynchronously: the leader-watch task published
`NotServing` later, on its own timeline. Between the guard drop and the
task's next poll there was a sub-scheduler-tick window in which the fast
gate still read `Serving` and the allocator still granted, so a `GetTs`
could be admitted by a server that had already been told to stop serving.
The same gap existed on the serve path, where a watch task aborted on
grace expiry may never reach its own `step_down` at all.

Hold the `ServingCore` behind an `Arc` and hand a clone to both the
`WatchGuard` and `serve_inner`. `Drop` (and thus `shutdown` / `abort`,
which trigger it on return) and the `serve_inner` user-shutdown arm now
call `step_down` synchronously at the teardown site, before any await, so
the gate is closed the instant teardown begins. The watch task's later
`step_down(None, None)` on cooperative cancel republishes the identical
`NotServing` state, making the double-close idempotent and harmless.

All `ServingCore` methods take `&self`, so every existing `.core` call
site reaches through the `Arc` unchanged.

52 of 53 new or added lines in 1 file covered. (98.11%)

10103 of 10459 relevant lines covered (96.6%)

567636.15 hits per line