Skip to content

Cancel disconnected rollout reads and add explicit own-WAL recovery - #387

Draft
beinan wants to merge 2 commits into
mainfrom
codex/explicit-own-wal-replay
Draft

beinan wants to merge 2 commits into
mainfrom
codex/explicit-own-wal-replay

Conversation

@beinan

@beinan beinan commented Oct 19, 2026

Copy link
Copy Markdown
Collaborator

Disconnected rollout reads can retain accepted handlers while recovery of a retired instance's acknowledged WAL currently requires a new append. This change cancels the read phase when the HTTP caller leaves (after protected store opening), and adds an explicit one-shot --replay-own-wal command that replays, seals, drains, and closes an existing table before starting any HTTP listener or sweeper.

The replay command requires an explicit instance identity and propagates fencing, drain, and close failures. Operators must establish ownership and retire the previous owner before using it; the CLI does not implement that retirement protocol.

Validation: 14 drain and 33 rollout tests passed for read cancellation; the crash/replay test recovered the exact 20 acknowledged rows without a post-restart append and verified idempotent replay; 3 replay CLI and 4 config tests passed. The crash test uses local storage. Same-image Azure recovery qualification and production retirement verification remain outstanding.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant