Repository navigation
review: event stream cap, billing order, replica interval, silkd session and pty, compat cuts - #469
Merged
Merged
Conversation
cocoon sends every VM record in the sync event's one data line, about 300 bytes a record, so the 1 MiB line cap broke the stream at every connect on a full node and liveness fell back to polling vm list for good.
…ter its teardown The claim is durably gone at the commit; a restart or crash during a slow teardown (volume quiesce, vm rm) left a claim event with no release, which the folding rule bills up to the claim's deadline.
… applies The quota check reads the tenant cache only; an operator fork skipped the lookup that fills it, so after a cache flush or restart the tenant's max_claims read as none and the fork overshot it. A removed tenant still does not stop the operator.
…ts pool, not as a bad fork count
…, and run every benchmark once in go-test Four benchmarks seeded claims around addClaimLocked or without a store row and failed the cleanup invariants; no CI step ran -bench, so nobody saw it.
…thing reads since the SDKs stopped probing
…icate replicateOnce dropped the attempt time whenever a claim was hibernated, archiving or settling, so a claim that idles and wakes inside every interval never came due, had no registry row, and was lost with its node.
…2's exact names, dropping the v1 case-insensitive matching the v2 move kept A case-variant key is now an unknown member: config and strict bodies reject it, other bodies ignore it.
…ell's stdout EOF A background job started in the session holds the stdout pipe past the shell, so an exit, a set -e failure or an OOM kill of the shell left the command hung, its session's io lock held and the session never reaped.
…ts jobs do not inherit them libc openpty leaves both fds inheritable; every pty shell held a spare master, so a job outliving the shell never saw its terminal hang up.
Drops the Python mount row and the pre-proto-2 sentences #457 left, the images trigger path, and the old-template digest note; corrects the data_dir entries, the drain error, the shared-store probe, idle upstream conns, env snapshot reads, lineage markers, secret valuation, exit codes, Ready, the tenant_claims help, Metas, the checkpoint fallback and the Python lookup and keep_alive docs.
…fact the code cannot carry
…test, drop an unreachable preview guard and lint exclusions for directories that do not exist
…ad error, scope table contexts to their subtest, cover every decoder with a fixture, and drop dead or always-true checks The fixture test now ranges the decoder tables instead of a hand list a new verb could miss; the watcher garbage test asserts the error it promises; smoke and bench tools type their 409 check and stop racing the handshake reassignment.
moveBlocker refused an unsettled hibernate intent but not an unsettled save; a move that won the transition over the save's settle carried SaveSnap to the target and left a listed fork snapshot on the source that the startup sweep keeps.
CMGS
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second whole-repo static audit, on
mainat bcca6c8 (after #459-#467): every source file and all 13 flows re-read in full under every lens, with the rules added after #457's misses (every OK window row states its end state, every holder of a shared lock is listed, env-gated tests are checked against CI, tests that assert a loss are checked against the docs, cross-language caps are checked at the boundary). No hardware or E2E run in this round.Bugs fixed (each with a test that fails on the old code)
data:line (~300 bytes each); the 1 MiB line cap broke the stream at every connect on a full node, so liveness fell back to polling for good. Test: a 5,000-VM snapshot (1.26 MB line) synced 0 VMs before.releaseevent was written after the teardown (volume quiesce,vm rm); a restart or crash in that window left a claim event with no end, billed up to the deadline.max_claimsread as none. Move admission already did the lookup.sandboxd_claim_redirects_totalmissed checkpoint redirects.-bench.make go-testnow runs each benchmark once.replicate_secondsnever came due, had no registry row, and was lost with its node.exit,set -e, OOM), its io lock held and the session never reaped.silk-1-mastersbefore,0after).moveBlockerrefused an unsettled hibernate intent but not an unsettled save.Removed (no backward compatibility)
protofield andKeepAliveProtoin Rust, Go, Python and the fixture: nothing reads it since the SDKs stopped probing.Layeregress fallback and thePooledcallback it needed (records older than review: whole-repo round on main 893bf20 #216).Cleanups
Docs and godocs matched to the code, including leftovers #457 itself left (the Python
mountrow, pre-proto-2 sentences, the images trigger path, the secret valuation godoc); restating comments removed; single-caller helpers inlined in the reader router, SDK and silkdtest; an unreachable preview guard and dead lint exclusions removed; test checks that could not fail or could panic on the failure path fixed; the fixture test now ranges the decoder tables.Numbers
Production -55 net (+86 -141), tests +35 net, docs +24 -30. Comment lines in Go and Rust: +11 -25.
Kept without code
DiskAttachSnapshotrefuses a snapshot whose layers and blobs differ from the reader VM's, so the read wakes the claim; no sandboxd mechanism needed.TestS3BackendContractRealEndpointnever runs in CI: MinIO images are no longer publicly pullable; picking a replacement S3 server is an owner decision.Gates
GOWORK=off make go-lint(5 modules x linux/darwin): 10 x0 issues.(golangci cache cleaned first: a warm cache panics SA4023 in e2e)asl -forwarder=false ./...both GOOS, all 5 modules: cleanGOWORK=off make go-test(race, plus one pass of every benchmark): greenmake lint+make teston macOS and inrust:1linux/arm64: green (silkd 165 tests, boot/init 17)