bedrock-kv / bedrock / 20eeacb1a4e5a8e216a4739aa0d266173b731f12-PR-263

81%

develop: 82%

Build Type

Pull #263

github

Committed by jallum

Commit Message

bedrock-q67.21.13: a locked materializer does not serve reads

Second cold-audit finding, and the one that makes the ticket's stated
cost honest. Seeding the data tags from the committed family makes a
member the distributor has not adopted yet routable -- and that member
is LOCKED, which stops its puller and freezes its applied position but
does not roll it back. Only unlock_after_recovery/3 rolls back. So for a
read version between the recovery version and the worker's frozen
position it would answer promptly, from the previous epoch's
semi-committed suffix: the exact silent staleness this ticket's
verification fix argues against, moved to the client.

Reads are now fenced with ingest and transaction application, for a
worker a recovery locked and nobody unlocked. `:locked` is the commit
proxy's own answer in the same situation -- retryable, and it evicts the
caller's routing cache, so the retry lands on whoever the sweep adopted.

The epoch is the discriminator: a cold-started worker was never locked
and loads only durable state, clamped to the known-committed version, so
it has no semi-committed suffix and keeps serving (the direct-ingest
configuration the GenServer integration tests use).

Pull Request Pull Request #263: bedrock-q67.21.13: Recovery stops at tag 0; the distributor owns data-tag materializers

Coverage Stats

19 of 19 new or added lines in 6 files covered. (100.0%)

3 existing lines in 2 files now uncovered.

7123 of 8756 relevant lines covered (81.35%)

1163.5 hits per line