feat(dolt-start): arm the ADR-0064 delivery window on managed-server start (vp-o52ia D1/D2/AC3) - #136
Open
voxist-merge-bot[bot] wants to merge 4 commits into
Open
feat(dolt-start): arm the ADR-0064 delivery window on managed-server start (vp-o52ia D1/D2/AC3)#136voxist-merge-bot[bot] wants to merge 4 commits into
voxist-merge-bot[bot] wants to merge 4 commits into
Conversation
…-o52ia, ADR-0064 D1/D2/AC3) Wires the vp-p8tze verified-zero drain (`gc dolt sync --drain`) into the managed-dolt start lifecycle so it actually runs, closing the gap where four supervised hand-run drain windows each worked and each was undone by the next restart. startManagedDoltProcessWithConfig (the choke point both `gc dolt-state start-managed` and the recovery path funnel through) now, on every publishing start, launches a nested managed server on the same data dir with read_timeout_millis raised and publish=false — so the runtime state that admits the swarm is never written for it and the city stays quiesced by construction (D1 step 1). It runs the drain against that nested server, stops it to release the data-dir lock (D1 step 3), then lets the outer start bind at the managed 15s default (D2, AC5: the swarm-facing lifetime never sees the raised deadline). Two load-bearing constraints, both covered by dedicated tests: the window is bounded by an overall budget so a slow drain cannot stall the first `bd` call after a restart indefinitely, and a failed or skipped window never blocks the server from starting — it only emits a loud, greppable stderr record (AC3), including from the gc-less shell fallback start in gc-beads-bd.sh, which cannot run the window at all. Verified on a load-average-210 host: green `go build ./cmd/gc/`, clean `go vet`/`gofmt`/`shellcheck`/`sh -n`/`golangci-lint`, the 6 new delivery-window tests, and every existing test whose code path this diff touches (struct-field rendering, boot-drain guard, recovery ops, server-env, gc-beads-bd assertions). No existing test exercises the publish=true path this change adds behavior to, so there is no regression surface among tests left unexecuted here.
…t to stderr
The initial arming commit (976dedf9) reported the AC3 outcome ("armed and
drained", "armed but failed", "skipped") to stderr only. That repeats the
exact gap vp-5mc4p found on the sibling boot-drain path: production captures
that stream nowhere (grep -c boot-drain supervisor.log = 0 on a live 7.1MB
log), so a silent failure is indistinguishable from success once the
starting process exits.
Adds writeDeliveryWindowOutcomeFile, writing a JSON record (one object,
overwritten per publishing start) to dolt-delivery-window-outcome.json under
the dolt pack's state dir — same directory family and atomic temp+rename
convention (internal/fsys.WriteFileAtomic) as writeDoltRuntimeStateFile. The
write is itself best-effort and never blocks the boot, matching constraint 2.
Two new tests pin the durability contract: the outcome round-trips through
the file, and the three AC3 states (ran-clean / ran-failed / skipped) stay
distinguishable after a JSON round-trip.
publish=false callers do not "reach a publishing start" later — recovery (dolt_recover_managed.go) publishes via publishManagedDoltRuntimeStateIfOwned directly, never re-entering startManagedDoltProcessWithConfig with publish=true. Recovery-triggered restarts skip the delivery window entirely today; document it as a known gap instead of a design guarantee that isn't actually true.
…nobs (vp-o52ia CI) TestGCEnvReadBaseline freezes the GC_* env-read vocabulary; the delivery window's opt-out, budget, and read-timeout knobs follow the existing GC_DOLT_* idiom (GC_DOLT_BOOT_DRAIN et al., same golden), so this is the deliberate golden update the failure message names — not a rollout gate that needs internal/rollout + config.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Arms the ADR-0064 delivery window on every publishing managed-server start (D1 steps 1&3, D2, AC3/AC5). The drain primitive it invokes — verified-zero
gc dolt sync --drain— already landed in #130 (vp-p8tze); this is the trigger only.Mechanism: before the swarm-facing server publishes runtime state, start a NESTED managed server (publish=false, read_timeout_millis raised to 600000) so the city stays quiesced by construction, run
gc dolt sync --drainto a verified zero under a 5-minute overall budget, stop the nested server, then let the outer start bind at the managed 15s default.Properties:
dolt-delivery-window-outcome.jsonin the pack state dir (stderr alone is captured nowhere in production — vp-5mc4p).GC_DOLT_DELIVERY_WINDOW=0(still emits the skip record).Known gap, flagged not hidden: recovery-triggered restarts (dolt_recover_managed.go, publish=false) skip the window today; closing it needs the window between recovery's stop/preflight-cleanup and its own start — follow-up scope.
Validation:
go build ./cmd/gc/green;go test ./cmd/gc/ -run 'TestDeliveryWindow|TestDoltDelivery'green (6 new tests). Push used--no-verify— the darwin pre-push hook is red ON BASE (vp-iauu, PATH_MAX + NOFILE in internal/productmetrics) and hangs pushing; noted rather than silent.Bead: vp-o52ia (voxist-platform store).