Merge pull request #45 from sqlrush/fix/native-xid-prehistory

GCS-race round 2/3: joiner native-xid visibility, GCS_BLOCK_DONE completion proof, xid wrap barrier

Author: sqlrush

.github/workflows/nightly.yml

@@ -209,11 +209,12 @@ jobs:
           - { name: stage7-lms-pool, ranges: "364 367", unit: false, regress: false }
           # t/365 spec-7.1a cross-instance write-write MVCC coordination.
           - { name: stage7-write-write, ranges: "365-365", unit: false, regress: false }
-          # t/366 spec-7.2a GCS block dedup capacity + eager reclaim.  Own shard:
-          # 2-node shared_catalog bring-up + cross-node distinct-read dedup
-          # pressure + injected retransmit-dedup correctness needs the wall
-          # clock.
-          - { name: stage7-gcs-dedup-capacity, ranges: "366-366", unit: false, regress: false }
+          # t/366 spec-7.2a GCS block dedup capacity + eager reclaim, plus
+          # t/371 GCS_DONE mixed-version compat (suppressed pre-protocol
+          # binary at the default cap).  Own shard: 2-node shared_catalog
+          # bring-up + cross-node distinct-read dedup pressure + injected
+          # retransmit-dedup correctness needs the wall clock.
+          - { name: stage7-gcs-dedup-capacity, ranges: "366 371", unit: false, regress: false }
           # t/359 mxid-stripe gapwalk + t/368 multixact member-serve refuse
           # (spec-7.1 family; 368 renamed from the double-occupied t/360 per
           # the hub number ledger -- the lms data-plane faults file keeps 360).

src/backend/access/transam/clog.c

@@ -395,6 +395,58 @@ TransactionIdSetPageStatusInternal(TransactionId xid, int nsubxids,
 	XactCtl->shared->page_dirty[slotno] = true;
 }
 
+/*
+ * ClusterClogAdoptNativeStatus
+ *		PGRAC (GCS-race round-2 RC-E): SLRU-coherent repair write of one
+ *		native-era commit status during the post-recovery prehistory verify.
+ *
+ * A pre-seed base-backup joiner adopts the sealed native prehistory into
+ * its pg_xact files before recovery; replaying the backup's WAL window can
+ * then re-zero a CLOG page the adopt had filled (CLOG extend records), so
+ * xids beyond the replay window on that page read IN_PROGRESS again.  The
+ * StartupXLOG-tail verify detects those holes against the CRC-validated
+ * blob and repairs them HERE -- through the SLRU, never behind its back --
+ * before the coverage latch may enable native-era LOCAL routing.
+ *
+ * No WAL: the authoritative WAL for these bits is the seed node's own
+ * native-era history, already durable in the sealed blob; a crash before
+ * the next CLOG flush just re-runs the same idempotent verify+repair on
+ * the following boot.  Runs single-threaded (startup process before
+ * backends are admitted), status must be terminal, and the slot must
+ * currently read IN_PROGRESS (TransactionIdSetStatusBit asserts that).
+ */
+void
+ClusterClogAdoptNativeStatus(TransactionId xid, XidStatus status)
+{
+	int			pageno = TransactionIdToPage(xid);
+	int			slotno;
+
+	Assert(TransactionIdIsNormal(xid));
+
+	/*
+	 * Terminal-only, enforced at RUNTIME (round-2 review F2 / calibration 1):
+	 * a sealed prehistory can legitimately carry SUB_COMMITTED bits (a
+	 * native-era crash mid-subcommit leaves them behind, and the blob has no
+	 * child->parent map to resolve them), and an Assert vanishes in
+	 * production builds.  Materializing a non-terminal status as local truth
+	 * would launder an unprovable state; fail closed instead.
+	 */
+	if (status != TRANSACTION_STATUS_COMMITTED &&
+		status != TRANSACTION_STATUS_ABORTED)
+		ereport(FATAL,
+				(errcode(ERRCODE_DATA_CORRUPTED),
+				 errmsg("cannot adopt non-terminal native-era commit status %d for transaction %u",
+						(int) status, xid),
+				 errhint("The sealed native prehistory carries an unresolvable status; "
+						 "this node must stay fail-closed.")));
+
+	LWLockAcquire(XactSLRULock, LW_EXCLUSIVE);
+	slotno = SimpleLruReadPage(XactCtl, pageno, true, xid);
+	TransactionIdSetStatusBit(xid, status, InvalidXLogRecPtr, slotno);
+	XactCtl->shared->page_dirty[slotno] = true;
+	LWLockRelease(XactSLRULock);
+}
+
 /*
  * When we cannot immediately acquire XactSLRULock in exclusive mode at
  * commit time, add ourselves to a list of processes that need their XIDs

src/backend/access/transam/varsup.c

@@ -184,6 +184,31 @@ GetNewTransactionId(bool isSubXact)
 			}
 		}
 	}
+
+	/*
+	 * PGRAC: GCS-race round-3 P0-1 — xid wrap-barrier allocation gate.
+	 *
+	 * No epoch>=1 xid may be issued until this node holds proof that every
+	 * member's native-prehistory coverage latch is off (durable
+	 * NATIVE_RAW_REUSED stamp + LMON ack round, or the boot shortcut on an
+	 * already-wrapped counter).  A raw 32-bit value below the native
+	 * high-water stops being an alias-free native-era identity the moment
+	 * the first epoch-1 xid exists anywhere; issuing one before the barrier
+	 * completes could feed a still-latched epoch-0 peer a false LOCAL
+	 * visibility verdict (rule 8.A).  Fail-closed and retryable (53RB5,
+	 * mirroring the 53RB2 posture above): the LMON barrier is
+	 * margin-triggered ~16M xids ahead and normally completes within a
+	 * tick, so hitting this gate means the round is still in flight (or a
+	 * member cannot participate — see the barrier's LOG lines).
+	 */
+	if (cluster_enabled && cluster_shared_catalog
+		&& EpochFromFullTransactionId(full_xid) > 0
+		&& !cluster_xid_wrap_barrier_passed())
+		ereport(ERROR,
+				(errcode(ERRCODE_CLUSTER_XID_AUTHORITY_UNAVAILABLE),
+				 errmsg("refusing to assign a new transaction ID: xid epoch rollover barrier is not complete"),
+				 errdetail("The first epoch-1 transaction ID may not be issued until every cluster member has durably disabled native-era prehistory routing."),
+				 errhint("The barrier completes automatically within about a second; retry the transaction. If this persists, check cluster connectivity and that every member runs a barrier-capable binary.")));
 #endif
 
 	/*----------
@@ -293,6 +318,17 @@ GetNewTransactionId(bool isSubXact)
 				xid = XidFromFullTransactionId(full_xid);
 			}
 		}
+
+		/* PGRAC: GCS-race round-3 P0-1 — re-assert the wrap-barrier gate on
+		 * the re-derived candidate (same predicate as the first derivation). */
+		if (cluster_enabled && cluster_shared_catalog
+			&& EpochFromFullTransactionId(full_xid) > 0
+			&& !cluster_xid_wrap_barrier_passed())
+			ereport(ERROR,
+					(errcode(ERRCODE_CLUSTER_XID_AUTHORITY_UNAVAILABLE),
+					 errmsg("refusing to assign a new transaction ID: xid epoch rollover barrier is not complete"),
+					 errdetail("The first epoch-1 transaction ID may not be issued until every cluster member has durably disabled native-era prehistory routing."),
+					 errhint("The barrier completes automatically within about a second; retry the transaction. If this persists, check cluster connectivity and that every member runs a barrier-capable binary.")));
 #endif
 	}
 

src/backend/access/transam/xlog.c

@@ -202,6 +202,7 @@
 #include "cluster/cluster_hw_snapshot.h" /* PGRAC: spec-5.7 D3 HW authority checkpoint snapshot */
 #include "cluster/cluster_xid_stripe_xlog.h" /* PGRAC: spec-6.15 D5d checkpoint re-emit */
 #include "cluster/cluster_xid_authority.h" /* PGRAC: spec-6.15b native-era XID authority */
+#include "cluster/cluster_xid_wrap_barrier.h" /* PGRAC: GCS-race round-3 P0-1 startup mirror */
 #include "cluster/cluster_recovery_anchor.h" /* PGRAC: spec-5.6a per-node recovery anchor */
 #include "cluster/cluster_lms.h" /* PGRAC: spec-5.6 GES-ready boundary for CF X */
 #endif
@@ -6244,6 +6245,28 @@ StartupXLOG(void)
 	 * No-op unless this startup acquired the claim.
 	 */
 	cluster_recovery_merge_claim_release_if_held();
+
+	/*
+	 * PGRAC (GCS-race round-2 RC-E): with redo complete and the CLOG SLRU
+	 * trimmed, prove that local pg_xact matches the sealed native-era
+	 * prehistory over the surviving native range, repairing holes that the
+	 * backup-window replay legitimately re-zeroed.  Only this verify may
+	 * latch the coverage high-water that lets the visibility resolver route
+	 * a provably-native below-floor xid to the local adopted CLOG instead
+	 * of failing closed (53R97).  Skip legs leave the latch unset -- never
+	 * wrong, at worst degraded to today's fail-closed behaviour.
+	 */
+	cluster_xid_prehistory_verify_native_coverage();
+
+	/*
+	 * PGRAC (GCS-race round-3 P0-1): mirror a durable NATIVE_RAW_REUSED
+	 * stamp into shmem BEFORE backends are admitted -- a stamped authority
+	 * disables the coverage latch outright, and an already-wrapped counter
+	 * takes the allocation-gate boot shortcut (the first carry was gated,
+	 * so "every latch off" is a permanent global fact).  Must run after
+	 * the verify above so a same-boot latch can never outlive the mirror.
+	 */
+	cluster_xid_wrap_barrier_startup_init();
 #endif
 
 	/*
@@ -7607,6 +7630,15 @@ CreateCheckPoint(int flags)
 	 *   the refusal still lands fail-closed on every joiner (53RB5,
 	 *   authority unsealed), but the seed itself can shut down cleanly
 	 *   instead of wedging every later shutdown/boot in a FATAL loop.
+	 *
+	 * The seal is also a PROOF (round-2 review F2): the coverage verify
+	 * latches a blob-IN_PROGRESS == local-IN_PROGRESS xid as "crash-aborted
+	 * forever, never resolvable" on the strength of the seal alone.  That
+	 * holds only when the sealing shutdown can prove no in-progress bit has
+	 * a future: a PREPARED transaction survives clean shutdown as an
+	 * in-progress CLOG bit that COMMIT PREPARED may later flip, and any
+	 * still-active xact makes the image non-final.  Either condition skips
+	 * the seal (WARNING, joiners fail closed) instead of publishing a lie.
 	 */
 	if (shutdown && !(flags & CHECKPOINT_END_OF_RECOVERY)
 		&& cluster_shared_catalog && !cluster_enabled)
@@ -7621,6 +7653,23 @@ CreateCheckPoint(int flags)
 							   checkPoint.nextMulti, FirstMultiXactId),
 					 errhint("Joiners will fail closed (53RB5); recreate the seed without "
 							 "MultiXact-producing operations, or move the load in-protocol.")));
+		else if (GetNumberOfPreparedTransactions() > 0)
+			ereport(WARNING,
+					(errmsg("prepared transactions survive this shutdown; "
+							"leaving the shared XID authority unsealed"),
+					 errdetail("A sealed native-era history must prove every in-progress "
+							   "xid crash-aborted, but %d prepared transaction(s) may still "
+							   "commit or abort later.",
+							   GetNumberOfPreparedTransactions()),
+					 errhint("Joiners will fail closed (53RB5); resolve them with "
+							 "COMMIT PREPARED or ROLLBACK PREPARED and shut down cleanly again.")));
+		else if (TransactionIdPrecedes(GetOldestActiveTransactionId(),
+									   XidFromFullTransactionId(checkPoint.nextXid)))
+			ereport(WARNING,
+					(errmsg("active transactions survive this shutdown checkpoint; "
+							"leaving the shared XID authority unsealed"),
+					 errhint("Joiners will fail closed (53RB5); shut the seed down cleanly "
+							 "with no concurrent activity to seal the native era.")));
 		else if (cluster_xid_prehistory_payload_bytes(native_hw) == 0)
 			ereport(WARNING,
 					(errmsg("native-era xid high-water %llu is outside the prehistory publish "

src/backend/cluster/Makefile

@@ -240,6 +240,7 @@ OBJS = \
 	cluster_xid_stripe.o \
 	cluster_xid_stripe_boot.o \
 	cluster_xid_stripe_xlog.o \
+	cluster_xid_wrap_barrier.o \
 	cluster_xnode_lever.o \
 	cluster_xnode_profile.o \
 	storage/cluster_shared_fs.o \

src/backend/cluster/cluster_catalog_bootstrap.c

@@ -181,9 +181,89 @@ cluster_catalog_prepare_xid_authority(const ControlFileData *cf,
 			 errhint(
 				 "Start the seed with cluster.enabled=off, stop it cleanly, then start joiners.")));
 
-	if (cluster_catalog_backup_label_present())
-		elog(LOG, "cluster shared_catalog: skipped XID prehistory adopt on backup_label boot");
-	else {
+	if (cluster_catalog_backup_label_present()) {
+		uint64 own_next = 0;
+
+		/*
+		 * PGRAC (GCS-race round-2 RC-E supply-side fix): a backup_label boot
+		 * used to skip the adopt unconditionally, assuming a post-seed
+		 * backup whose pg_xact already carries the native bits.  A PRE-seed
+		 * base backup (the RACvsRAC S3 bring-up) breaks that assumption:
+		 * the clone's pg_xact predates every native seed xid, recovery
+		 * replays only the clone's own pre-seed WAL window, and the sealed
+		 * blob is the ONLY supply of the native outcomes -- skipping left
+		 * the joiner unable to prove any native xid (155k fail-closed storm
+		 * on xid 815).
+		 *
+		 * Adoption is lineage-safe exactly here: backup_label still present
+		 * means this node has NEVER completed a boot since it was cloned
+		 * (the first recovery renames the label), so its entire local
+		 * history is a subset of the seed lineage by construction -- a
+		 * clone that ran standalone would have consumed the label and takes
+		 * the anchor + prefix-check path below.
+		 *
+		 * Within the same lineage the adopt needs NO horizon comparison --
+		 * overwriting [blob start, native_hw) is idempotent same-lineage
+		 * truth on any clone that already carries (possibly torn) native
+		 * bits, and the post-recovery verify (StartupXLOG tail) re-proves
+		 * the whole range before the resolver may route native xids locally.
+		 *
+		 * One gate stands (round-2 review F3): the clone's OWN xid epoch.  A
+		 * clone taken after an xid epoch rollover reuses the pg_xact
+		 * positions below the native high-water for cluster-era xids;
+		 * adopting native bits over them would corrupt live outcomes.  The
+		 * clone's own pre-adopt nextFullXid comes from the local control
+		 * file when it is still per-node, or from the pre-migration epoch
+		 * witness under cluster.controlfile_shared_authority (the local
+		 * global/pg_control is then a symlink to the SHARED authority whose
+		 * checkpoint fields belong to the last permitted writer, not to
+		 * this clone -- reading it through the symlink would compare the
+		 * seed's own high-water against itself; the B3 trap).
+		 */
+		if (!cluster_controlfile_shared_authority)
+			own_next = U64FromFullTransactionId(cf->checkPointCopy.nextXid);
+		else if (!cluster_xid_epoch_witness_read(DataDir, &own_next))
+			ereport(FATAL,
+					(errcode(ERRCODE_CLUSTER_XID_AUTHORITY_UNAVAILABLE),
+					 errmsg("local xid epoch witness is unavailable for the backup_label "
+							"prehistory adopt"),
+					 errdetail("Under cluster.controlfile_shared_authority the local control "
+							   "file is the shared symlink, and no pre-migration witness "
+							   "\"%s\" passes validation.",
+							   CLUSTER_XID_EPOCH_WITNESS_REL_PATH),
+					 errhint("Re-provision this node from the seed lineage.")));
+
+		if (own_next >= auth.native_hw_full) {
+			/*
+			 * Round-3 review P0-2: the pre-adopt horizon is NOT donor-local
+			 * truth.  pg_basebackup follows the shared-authority symlink
+			 * (basebackup.c Dc6), so the clone's control file -- and the
+			 * witness derived from it -- carries the LAST PERMITTED WRITER's
+			 * checkpointed nextXid, which can lag the actual donor (another
+			 * node may have allocated far past it, even across an epoch
+			 * rollover).  The only value this horizon can PROVE is "the
+			 * authority was last checkpointed strictly before the seal", and
+			 * that is exactly own_next < native_hw_full: no cluster-era xid
+			 * (>= stripe floor >= hw) can exist anywhere under that reading,
+			 * so the clone's lineage is a seed-lineage subset and the adopt
+			 * is idempotent truth.  Anything else -- post-seal backups
+			 * (native bits already carried), epoch rollovers (pg_xact
+			 * positions reused) -- skips: the coverage verify + repair path
+			 * (or 53R97) covers those without ever overwriting live
+			 * outcomes.  Same predicate as the anchor path's adopt gate.
+			 */
+			elog(LOG,
+				 "cluster shared_catalog: skipped XID prehistory adopt on backup_label boot; "
+				 "pre-adopt nextXid %llu is not strictly below the native high-water %llu",
+				 (unsigned long long)own_next, (unsigned long long)auth.native_hw_full);
+		} else {
+			cluster_xid_prehistory_adopt(DataDir, auth.native_hw_full);
+			elog(LOG,
+				 "cluster shared_catalog: adopted XID prehistory through native high-water %llu "
+				 "on backup_label boot",
+				 (unsigned long long)auth.native_hw_full);
+		}
+	} else {
 		ClusterRecoveryAnchor ra;
 		uint64 own_next;
 
@@ -215,8 +295,18 @@ cluster_catalog_prepare_xid_authority(const ControlFileData *cf,
 		 * and truncated away are no alibi for the surviving range, and a
 		 * missing local page inside the comparable range fails closed
 		 * (UNAVAILABLE) instead of passing as a shorter clone.
+		 *
+		 * Epoch gate (round-2 review F3): past an xid epoch rollover the
+		 * node's pg_xact positions below the native high-water belong to
+		 * cluster-era xids, so the byte compare against the native blob is
+		 * meaningless -- it would FATAL a legitimate wrap-era node.  The
+		 * 32-bit oldestXid raw value cannot express the epoch, so gate on
+		 * the anchor's full nextXid instead; post-wrap the prehistory
+		 * machinery is dead anyway (the coverage latch refuses to engage
+		 * and the resolver's widen judge proves nothing native).
 		 */
-		if ((uint64)ra.checkPointCopy.oldestXid <= auth.native_hw_full) {
+		if (own_next <= (uint64)PG_UINT32_MAX
+			&& (uint64)ra.checkPointCopy.oldestXid <= auth.native_hw_full) {
 			ClusterXidPrefixVerdict pv;
 
 			pv = cluster_xid_prehistory_prefix_check(DataDir, auth.native_hw_full,

src/backend/cluster/cluster_cf_storage.c

@@ -34,6 +34,7 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
+#include "access/transam.h" /* U64FromFullTransactionId (epoch witness, review F3) */
 #include "catalog/pg_control.h"
 #include "cluster/cluster_cf_authority.h"
 #include "cluster/cluster_cf_enqueue.h"
@@ -45,6 +46,7 @@
 #include "cluster/cluster_guc.h"
 #include "cluster/cluster_qvotec.h"
 #include "cluster/cluster_recovery_anchor.h"
+#include "cluster/cluster_xid_authority.h" /* cluster_xid_epoch_witness_write (review F3) */
 #include "cluster/storage/cluster_shared_fs.h"
 #include "miscadmin.h"
 #include "port/pg_crc32c.h"
@@ -716,6 +718,22 @@ cluster_cf_migrate_and_link(const char *local_pgdata)
 			}
 		}
 
+		/*
+		 * PGRAC (GCS-race round-2 review F3): persist this node's own
+		 * pre-migration nextFullXid as the local epoch witness BEFORE the
+		 * symlink flip erases the last local copy of that value.  A
+		 * backup_label first boot consumes it to refuse the native-prehistory
+		 * adopt when the clone was taken after an xid epoch rollover (its
+		 * pg_xact positions below the native high-water are reused by
+		 * cluster-era xids; adopting native bits over them would corrupt live
+		 * outcomes).  Written durably before the flip (same R7 ordering as
+		 * the recovery anchor); a crash in between re-runs this arm with the
+		 * local control file still real, so the rewrite is idempotent.
+		 */
+		if (!cluster_xid_epoch_witness_write(
+				local_pgdata, U64FromFullTransactionId(local_cf.checkPointCopy.nextXid)))
+			return false;
+
 		if (!cluster_cf_contract_persist(local_pgdata, CLUSTER_CF_CONTRACT_LOCAL_PROBED,
 										 shared_cf.system_identifier))
 			return false; /* could not record the identity anchor -> fail-closed */