Repository navigation
fix: complete standby recovery despite diagnostic status churn - #4704
Conversation
@coderabbitai full review |
User-path evaluation at The stateful completed-join recovery also completes pause, acknowledged cleanup, resume and separated replacement checks after verified pause/resume rejection. Changed source, backup, peer, leader, backing identity, retention or consumer evidence stops at the original write boundary in both phases. As the operator, these outcomes provide the needed liveness without turning an uncertain response into a destructive repeat. Production repair remains a separately approved current-main dispatch, not a claim made by this fixture. Validation: full tagged race suite, tagged Go vet, affected production-path lint (zero findings), and source-freshness behavior/wiring checks pass. The diagnostic-only workflow remains one-shot. The test dependency is isolated from production modules and cannot route this scripts-only repair into a speculative production deployment. |
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 21 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
devantler
left a comment
devantler
left a comment
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer
Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)
Reviewed commit: ff568ae8f68f5a680118203155ed7a74efd107aa
Provider evidence re-read at 2026-10-10 11:39 UTC; current PR reviews, conversation, inline comments, threads and Bugbot checks were read directly. There are no substantive provider reviews or unresolved findings at this head.
- CodeRabbit: this PR's current-head refusal, updated 2026-10-10 11:34:14 UTC, reports exhausted included OSS review capacity. Its 21-minute reset ends at 11:55:14 UTC. No paid review was requested.
- Codex: account code-review usage refusal, updated 2026-10-09 18:11:46 UTC, applies to the authenticated account. It names credits/settings as recovery, with no reset timestamp. Bounded recent checks found no newer completion; this is not a full portfolio census.
- Cursor Bugbot: user/team usage or spend refusal, updated 2026-10-09 17:30:48 UTC, applies to the configured user/team. Admin adjustment is the stated recovery; no reset timestamp is given. No limit increase was performed.
Reviewed correctness and security, including an independent exact-head review. Only a complete typed native rejection proving no commit permits another Cluster request. Every new request retains UID and version tests, re-proves the phase-specific guards, and compares frozen protected state. Diagnostic churn is narrowly normalized; generation, ownership, primary history and other status remain protected. Requests stop after five attempts or one minute per phase. Unknown or lost responses do not retry; diagnostic and storage deletion writes remain one-shot. New confirmation, main-only dispatch, first-attempt execution and the shared production lock remain enforced.
The full tagged race suite, ordinary race suite, tagged vet, production-path lint and source freshness checks pass. Stateful recovery and native transport fixtures cover rejection followed by safe completion, changed guard evidence, exhaustion and uncertain committed outcomes. No production repair is claimed by these fixtures.
Verdict: no P0/P1 findings
User-path evaluation at Ran the complete native-transport and stateful recovery race suite with the actual Go 1.26.6 toolchain: PASS (4.666 seconds). Tagged vet, production-path lint and diff checks pass. The exercised behavior still includes rejected pause/resume requests followed by fully re-proven success, uncertain committed responses without retry, exhausted request bounds and changed protection evidence stopping before another write. No production module dependency or recovery permission changed. This corrects CI execution, not the database itself. Production recovery remains gated on this head's fresh review, CI, merge and the separately approved first main dispatch. |
devantler
left a comment
devantler
left a comment
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer
Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)
Reviewed commit: 9c9b77fd8c50631c4b42d85ef36d11d9b3935d20
Provider evidence re-read at 2026-10-10 11:45 UTC; current PR reviews, conversation, inline comments, threads and Bugbot checks were read directly. There are no substantive provider reviews or unresolved findings at this head. The ongoing applicable service limits are not reset by this test-only head update.
- CodeRabbit: this PR's current-head refusal, updated 2026-10-10 11:34:14 UTC, reports exhausted included OSS review capacity. Its 21-minute reset ends at 11:55:14 UTC. No paid review was requested.
- Codex: account code-review usage refusal, updated 2026-10-09 18:11:46 UTC, applies to the authenticated account. It names credits/settings as recovery, with no reset timestamp. Bounded recent checks found no newer completion; this is not a full portfolio census.
- Cursor Bugbot: user/team usage or spend refusal, updated 2026-10-09 17:30:48 UTC, applies to the configured user/team. Admin adjustment is the stated recovery; no reset timestamp is given. No limit increase was performed.
Reviewed correctness and security, including an independent exact-head review. Only a complete typed native rejection proving no commit permits another Cluster request. Every new request retains UID and version tests, re-proves the phase-specific guards, and compares frozen protected state. Diagnostic churn is narrowly normalized; generation, ownership, primary history and other status remain protected. Requests stop after five attempts or one minute per phase. Unknown or lost responses do not retry; diagnostic and storage deletion writes remain one-shot. New confirmation, main-only dispatch, first-attempt execution and the shared production lock remain enforced.
The complete tagged race suite and tagged vet pass using the actual workflow compiler, Go 1.26.6; production-path lint and diff checks pass. The independent reviewer repeated tagged race and vet at this exact signed head with no P0/P1/P2 findings. Hosted recovery validation run 38049396822 also passes at this head. The added RED/GREEN regression prevents the test-only module demanding a newer compiler than the workflow installs; it compares numeric versions and fails closed on missing or malformed requirements. Stateful recovery and native transport fixtures cover rejection followed by safe completion, changed guard evidence, exhaustion and uncertain committed outcomes. No production dependency or guard changed in the toolchain correction, and no production repair is claimed by these fixtures.
Verdict: no P0/P1 findings
Readiness at
The separately approved production recovery remains a first current-main dispatch only after merge. No production manifests, production dependencies or storage protections are weakened by this PR. The required-gate helper verifies the readable check/workflow gates but reports |
Why
The stalled database replica keeps updating its diagnostic status. A guarded recovery request can be rejected when its observed object version changes, even though the protected database state is unchanged. Stopping after every such rejection prevents the repair from completing.
What
The API-server patch library is pinned in a test-only module. Production dependencies, manifests and permissions are unchanged. Publishing this change does not execute the repair; the approved recovery runs separately from reviewed main.
Fixes #4703
Part of #4673