bedrock-kv / bedrock / e2dd803db1a7f390633bba764a1d3e740e1050ce

82%

Build Type

push

github

Committed by web-flow

Commit Message

The system shard is looked up, never discovered or invented (#203)

Recovery found tag 0 by **roll call**: it locked every advertised
materializer in the cluster, asked each which shard it served, and ran a
most-advanced-durable **contest** to pick one. If none answered, it
**created an empty materializer and read the cluster's shard layout out
of it**.

Both halves are gone. `CoreState` now carries the system shard's
members, so recovery looks them up.

## FDB has the same indirection — and a stricter discipline

FDB's coordinated state names the tlogs that hold the `txnStateStore`.
Recovery builds its log system from exactly those servers and locks
exactly those (`TagPartitionedLogSystem.actor.cpp:2549-2585`), then
waits for a quorum of **them**:

```cpp
// W + (N - R) < F, and optimally (N-W)+(N-R)=F-1.  Thus R=N+1-F+W.
int requiredCount = logSet->logServers.size() + 1 - tLogReplicationFactor + tLogWriteAntiQuorum;
```

Derived in the source so no replica set can be entirely
out-of-date-or-unavailable (`:2076-2082`). It never substitutes another
server and never fabricates one. **An unavailable named member is a
wait, not a fallback.**

So an existing cluster that cannot reach its named members now
**stalls**. The director retries; an operator can see why. Recovery
manufacturing the store its own metadata lives in would come up
"successfully" on an empty layout and orphan the cluster's data — the
failure mode most worth refusing.

Creation survives in exactly one place: a **fresh** cluster seeding tag
0, where there is no prior data and nothing is invented.

## The contest was asking the wrong question twice

- The strays it existed to filter out were made by **recovery's own
invent path**.
- `durable_version` measures **stream position**, not data completeness
— a worker that started empty and pulled the log tail can rank at or
above one holding the whole shard.

The fallback for tags the family doesn't name is now the **lowest worker
id** — the s... (continued)

Coverage Stats

21 of 26 new or added lines in 5 files covered. (80.77%)

254 existing lines in 20 files now uncovered.

6699 of 8592 relevant lines covered (77.97%)

1031.84 hits per line