Skip to content

pool: runtime volume catalog follow-ups to #382 - #395

Merged
CMGS merged 5 commits into
mainfrom
review/runtime-catalog-followup
Oct 29, 2026
Merged

CMGS merged 5 commits into
mainfrom
review/runtime-catalog-followup

Conversation

@CMGS

@CMGS CMGS commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Follow-ups to #382.

  • Fix: ownership transfer dropped a running claim without its volume holds, so they stayed counted after the VM was gone and blocked writers and DELETE /v1/volumes/{name} until restart. forgetClaim now hands the holds to the VM removal, as reap and release do. Regression test: TestOwnershipTransferReleasesRunningVolumeHoldAfterRemoval fails without the fix.
  • Fix: a catalog marshal failure mapped to 503 with Retry-After, but it repeats on every retry. It now returns a plain wrapped error.
  • Cut: the volume_roots check moves into catalog normalization, so register and startup load share one path. Startup load writes straight into the catalog.
  • Docs: the catalog file is always 0600. PUT also returns 409 for a held name. Changes leave an op:"volumes" audit record. Statements repeated across deploy, API and live-volumes docs are dropped.
  • Tests: the two archived-hold tests share their recovery setup. A name check left over from the pending design is gone.

Net: prod -1, test -2, docs -6. No change on the claim path.

Gates: go test -race ./... in sandboxd (19 packages ok); golangci-lint v2.13.2 0 issues. for sandboxd and e2e on linux and darwin; fmt clean; asl reports only the five forwarders main already has.

CMGS added 5 commits October 29, 2026 14:08
…oval

forgetClaim dropped a running claim without its holds, so ownership transfer left them counted after the VM was gone. Carry the holds into the VM removal, the same way reap and release do.
ErrVolumeCatalogUnavailable maps to 503 with Retry-After, but a marshal failure repeats on every retry. Return the wrapped error so it surfaces as a server error.
Register and load ran the same roots check after normalizing. Move it into normalize and let startup load write straight into the catalog, since a failed load discards the manager.
The failed-write test compared two missing names once the pending design was gone. The two archived-hold tests repeated the same recovery setup, and the admission bench rebuilt writeVolumeImage by hand.
The catalog file is always 0600, PUT also returns 409 for a held name, and changes leave an op:volumes audit record. Drop statements repeated across deploy, api and live-volumes docs, and restore the converging sentence.
@CMGS
CMGS merged commit cd692fe into main Oct 29, 2026
1 check passed
@CMGS
CMGS deleted the review/runtime-catalog-followup branch October 29, 2026 07:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant