VERIFICATION ONLY — do not merge: route-less seamless-deploy #460 Linux CI repro#464
Draft
kriszyp wants to merge 6 commits into
Draft
VERIFICATION ONLY — do not merge: route-less seamless-deploy #460 Linux CI repro#464kriszyp wants to merge 6 commits into
kriszyp wants to merge 6 commits into
Conversation
…nodes peers (#460) A deploy_component reloads the worker pool, re-invoking startOnMainThread() on the already-resolved main-thread module. Its whenThreadsStarted.then() fires immediately with no base-copy, so the subscription scan runs while a follower's replicated hdb_nodes rows still fail to decode. The scan did `if (!node) continue`, silently skipping every undecodable peer, leaving the follower with zero outbound subscriptions until a full restart. Mirror the #352 auth-path fallback on the outbound path: when an hdb_nodes key is range-visible but its value decodes to null, reconstruct a minimal { name, replicates: true } descriptor and still drive the subscription listener. replicates:true is required (unlike the auth-only { name }) because the subscription path gates on node.replicates; getNodeURL falls back to wss://<name>:9933. Applied to both the startup scan (subscribeToNodeUpdates, via the extracted pure helpers scanNodesForSubscription/resolveScannedNode/ reconstructNodeFromKey) and the put-event path in processNodeUpdateEvent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…eloads (#460) A deploy_component reload re-invokes replicator.startOnMainThread on the same already-resolved main-thread module; its whenThreadsStarted.then() re-fires and re-runs subscribeToNodeUpdates -> runNodeUpdateWatcher, previously stacking a second unbounded watcher loop (and an extra forEachReplicatedDatabase chain) on every deploy. Make the watcher supersede its prior instance via a per-purpose generation token + iterator close, namespaced so the subscription-management and replication- confirmation watchers still run concurrently. Also clear the module-level routes list before repopulating so routes don't accumulate across deploys. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…monitor watcher key) (#460) Codex P1: the subscription scan reconstructed a descriptor for ANY null range value, which would revive a genuine remove_node tombstone (a deleted node leaves a clean-null row). Add probeNodeRow to disambiguate via the point lookup: a throw = present-but-undecodable (#352/#1163) -> reconstruct; a clean null = tombstone -> skip. resolveScannedNode now takes an injected probe and refuses to revive deleted nodes. Codex P2: monitorNodeCAs and the subscription manager both called subscribeToNodeUpdates on the default watcher key, so the new supersede behavior had the subscription-manager watcher stop the CA-monitor watcher (CA rotations would stop updating replication TLS contexts). Give each consumer a distinct key: 'subscription-manager', 'ca-monitor', 'replication-confirmation'. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… hook (harper-pro#460 verification) VERIFICATION-ONLY branch — not for merge. Carries an env-gated HARPER_TEST_HDBNODES_DECODE_FAIL injection in scanNodesForSubscription (no-op in prod) + a 3-node route-less repro. Fails to reconnect post-deploy on local macOS (loopback/self-signed-cert re-handshake 1006 flap — env artifact; existing deploy+replication integration tests are green on Linux CI). Pushed so it can be run on Linux/CI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
Contributor
|
Reviewed; no blockers found. (Verification-only branch per PR description — reviewed through commit |
enableRootCAs defaults to true, so the prior config already exercised it. Add
enableRootCAs=false as the discriminating probe: with the bundled-root-CA safety
net off, C's CA must arrive via the cluster CA-mesh availableCAs channel, not the
hdb_nodes row the decode injection strips. Both variants pass on Linux (6/6 local),
proving the reconstructed {name,replicates:true} descriptor's missing node.ca is
not load-bearing. Header updated: the macOS 1006 flap was environmental.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…or combined seamless check Points the scratch branch's core submodule at harper#1464's branch (kris/start-on-main-thread-once, 2 commits over v5.1.9; the MCP #1404 commit on that branch is incidental) to verify the COMBINED #460 + #1464 stack keeps the route-less seamless-deploy property. Local matrix: 6/6 pass; the #460 reconstruct warn still fires post-deploy with #1464 present, confirming #1464's main-thread once-per-component dedup does not suppress the per-worker CA-monitor reconstruct. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scratch branch verifying the route-less seamless
deploy_componentreplication property for harper-pro#460 on Linux CI. Not a feature PR; do not review for merge, do not treat as a release candidate. Reviewers intentionally unassigned.Topology
3-node route-less repro (
integrationTests/cluster/seamlessDeploy.test.mjs): nodes C, A, hub B. A and C eachadd_nodeB, so A↔C is route-less (mesh/propagation-discovered, no static route). A boots withHARPER_TEST_HDBNODES_DECODE_FAIL=<C>to simulate the persistent #352 decode-miss for C; adeploy_componentreload of A must keep replication from C alive via #460's reconstruct-and-resubscribe.SEAMLESS_NO_INJECT=1is the local control.64dc8a9) — has deploy_component worker-reload leaves followers with zero replication subscriptions #460's reconstruct, not harper#1464.replication/knownNodes.tsadds an env-gated decode-fail injection inscanNodesForSubscription(no-op in prod; mirrors the existingwedgedForTestpattern).Results — PASSES on Linux (local dev box + CI, Node 22/24/26)
Both the first CI run (single config) and local runs are green. Latest commit makes the suite a matrix over
enableRootCAs ∈ {true, false}:enableRootCAs=true— JJill's literal field shape (also the Harper default). ✅enableRootCAs=false— strict probe with the bundled-root-CA safety net OFF. ✅Local matrix: 6/6 pass. After the deploy reload, C's post-deploy write reaches A in ~10s in every variant.
Key findings (see test header for full trace)
*-replicationcert re-handshake artifact.node.cais NOT load-bearing. The outbound peer connection already runsrejectUnauthorized:true, and C's CA reaches A through the cluster CA-meshavailableCAschannel (replicator.ts), independent of the hdb_nodes row the injection strips.enableRootCAs=falsepassing proves the CA-mesh alone carries C's CA across the decode-strip + deploy.startOnMainThread), so #1464 is a main-thread de-dup/noise improvement here, not a separately observable correctness fix.