Fix issues #188–#193#197
Merged
Merged
Conversation
farhan-syah
marked this pull request as draft
July 21, 2026 04:39
… redo payload structs Undo entries for edge put/delete were pushed before the edge-store write completed, so a rejected insert (e.g. to a soft-deleted node) or a failed store write left a phantom compensation entry that would soft-delete or re-insert an edge that never existed on rollback. Compensation is now recorded inside execute_edge_put_with_undo / execute_edge_delete_with_undo, immediately after the edge-store version is durable and before the fallible CSR mutation. Also replace the positional-tuple encoding of edge put/delete redo payloads with named EdgePutRedo/EdgeDeleteRedo structs (map-encoded via zerompk 0.6) shared by every encode/decode site, removing the hand-maintained fallback-tuple decode that could silently drift out of sync with the encoder.
A fan-out query for a preceding request could leave stale trailing frames on the wire after that request's terminal frame was already returned to its caller. Check the response sequence number against the request that was sent and drop any frame that doesn't match, instead of misattributing another request's rows or status as this request's response.
VectorSearch, TextSearch, SpatialScan, RecursiveScan, MultiVectorSearch, SparseSearch, HybridSearch, and HybridSearchTriple plans fell through catalog_fold's and catalog_plan_validate's wildcard arm, so their filters and projections never had catalog identifiers resolved or validated. Add explicit arms that fold/validate each plan's filters and projection.
…e replay A carried version lower than the persisted prior was always treated as an already-applied stale replay, even when its HLC clock was strictly newer than the persisted record's. Only mark it stale when the clock is not ahead of the persisted one; a regressed version paired with a newer HLC is a genuine anomaly and must still be rejected.
A failed flush/drop response or executor apply left the transaction parked with its locks held instead of completing, wedging every txn queued behind those keys and freezing the vShard's epoch watermark (which anchors cross-shard BEGIN snapshots) with nothing left to re-drive the entry. Since the outcome is already globally durable (the verdict is committed and the resolved redo already WAL-appended), a local failure is an infrastructure event, not an outcome change: surface the infra abort and force completion, matching the forward-progress contract the dispatch-failure path already follows.
…-shard submit submit_calvin_routed failed immediately when no sequencer-group leader was elected yet, which could fail a client's very first write during the brief post-startup election window or a re-election gap. Since a leader_id of 0 also guarantees nothing has been submitted, poll with a bounded backoff schedule and re-read the leader before giving up; only a genuinely leaderless cluster exhausts the schedule and surfaces the typed error.
…trail DROP USER during tenant teardown purged the user's owned objects outright but recorded the same "no owned objects required reassignment" audit detail as a user with nothing owned, misreporting a destructive purge as a no-op. purge_owned_for_tenant_teardown now returns the purged count, and the audit detail distinguishes reassignment, no ownership, and teardown purge outcomes.
… append run_commit resolves a vShard as Local, but a leadership handoff can land during the ResolveTxn await that follows. Without a re-check right before the durable append, the transaction redo could be written to a WAL this node no longer owns, and the later batch dispatch (which re-resolves leadership) would then reject the now-non-local commit, leaving an orphaned durable redo record while the client is told the commit aborted. Abort before any durable write instead, so the failure stays side-effect-free and the client's retry can route through Calvin's replicated barrier.
Replace aggregate_cache_key's nine positional arguments (and its too_many_arguments allow) with an AggregateCacheKeyInputs struct, naming the complete query shape that constitutes the cache identity.
# Conflicts: # nodedb/src/control/server/native/dispatch/transaction.rs
farhan-syah
marked this pull request as ready for review
July 21, 2026 07:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Correctness hardening
PutEdge/DeleteEdgecompensation only after the edge-store write is durable and before the fallible CSR mutation, so a rejected dangling-edge insert (or a failed write) no longer leaves a phantom undo entry that corrupts bitemporal history on rollback.EdgePutRedo/EdgeDeleteRedostructs used at every encode/decode site, so a field addition (e.g.system_from) can no longer silently drift arity across sites. Requireszerompk0.6.DescriptorVersionAnomalyrather than silently accepted as historical.too_many_argumentsallow).Closes #188
Closes #189
Closes #190
Closes #191
Closes #192
Closes #193