fix(cluster): exact CANCEL_WAIT with reliable cleanup retry#54
Merged
Conversation
added 2 commits
July 15, 2026 05:12
On REQUEST timeout, send a wait_seq-exact CANCEL_WAIT using the sequence sampled in the original request, retain abandoned wait entries for orphan-GRANT release, and never silently overwrite RELEASE/CANCEL/native-probe cleanup frames. The fixed retry budget remains fail-stop: exhaustion PANICs because abort cleanup cannot wait, ERROR would unwind the cleanup caller, and dropping a frame recreates remote waiter/holder leakage. Capacity 1024 is a burst budget, not an unreachable proof: timeout cleanup can emit two frames per backend per abort wave, 1024 equals one such wave for 512 backends and sixteen 64-frame LMON drain batches, while backend-exit releases plus LMD/native traffic share the pool. Emit lifetime LOG-once warnings and exported counters at 50 and 90 percent before the PANIC cliff. Evidence boundary: unit coverage proves the timeout uses the original wait_seq and the retry FIFO preserves/retries exact frames without overwriting the oldest. It does not prove the remote master removed the waiter, holder, and WFG edge. End-to-end closure is explicitly assigned to the complete S3 rerun: lock-timeout must be zero and the GRD waiter/holder/WFG baselines must return to zero. Tests: make -C src/test/cluster_unit check (178 binaries passed); clang-format-18 dry-run; git diff --check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
CANCEL_WAITwhen a GES request times out, using the sequence captured by the original request.RELEASE, LMD cancel, and native-probe cleanup frames through a bounded FIFO retry queue that never overwrites its oldest entry.Why
The timeout path previously tombstoned the local request without removing the exact remote waiter, and a fire-and-forget release could be dropped when the outbound ring was full. Under contention this leaked remote waiter/holder state and amplified subsequent lock timeouts.
Retry exhaustion intentionally remains fail-stop. Abort cleanup cannot block,
ERRORwould unwind the cleanup caller, and silently dropping a correctness frame recreates the leak. The 1024-frame budget covers one two-frame abort wave for 512 backends and sixteen 64-frame LMON drain batches; 50%/90% lifetime warnings expose pressure before the PANIC boundary.Validation
make -C src/test/cluster_unit check: 178 binaries passed.make -C src/test/cluster_regress check: 13/13 passed.t/017+t/104: 27 tests passed; authoritative GRD key count is 53 and both new counters are asserted.clang-format-18dry-run andgit diff --checkpassed.Unit tests prove exact cancellation and lossless FIFO retry behavior. End-to-end remote waiter/holder/WFG cleanup remains an explicit S3 acceptance item: lock timeouts and residual GRD state must return to zero.