Repository navigation
fix(master): preserve legacy merge retry budgets across tasks - #454
Merged
Merged
Conversation
beinan
marked this pull request as ready for review
October 21, 2026 22:00
beinan
force-pushed
the
codex/legacy-merge-failure-budget
branch
from
October 21, 2026 22:23
c2eb4bd to
bb98b42
Compare
beinan
force-pushed
the
codex/retain-legacy-merge-ownership
branch
from
October 21, 2026 22:23
e0f551b to
185315d
Compare
beinan
force-pushed
the
codex/legacy-merge-failure-budget
branch
from
October 21, 2026 22:24
bb98b42 to
5eb42c5
Compare
beinan
force-pushed
the
codex/legacy-merge-failure-budget
branch
from
October 21, 2026 23:20
5eb42c5 to
c39b196
Compare
beinan
changed the base branch from
codex/retain-legacy-merge-ownership
to
main
October 21, 2026 23:21
KaiqiJinWow
pushed a commit
to KaiqiJinWow/lance-context
that referenced
this pull request
Oct 22, 2026
…e-format#458) A hot table discovered early in a stats scan currently waits for every remaining table to finish before the merge sweep can see its pending WAL. On one production master, completed scans averaged about 92 minutes; this is a discovery delay independent of the separate legacy-worker admission blocker. Consume each completed observation immediately and submit eligible targets to the existing durable merge queue. Incremental observations also qualify because they recount pending WAL. Preserve automatic-merge disablement, canonical deduplication, target encoding and all existing execution/ownership rules. Each scan can admit at most 256 new tasks and spend at most 10 seconds on queue admission, with a 2-second individual bound. An ambiguous queue error stops early admission for that round while observation and snapshot publication continue. Validation: formatting and diff checks pass. Three real isolated-etcd regressions cover enqueue before a blocked observation completes, disablement/threshold/deduplication/budgets, and queue failure preserving the entire scan result. The final committed source passed all 18 scanner tests, including the three isolated-etcd regressions (0 failed or ignored); its commit and diff fingerprint stayed unchanged throughout the run. CI is running. This adds no executor pool or rollout mode. It does not resolve historical unfenced requests, authorize replacement of an old writer, or bypass `core_not_ready` in the external recovery controller. It is separate from the already-building lance-format#454/lance-format#456 release. Co-authored-by: Beinan Wang <beinanwang@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Legacy merge tasks currently retry an unreachable worker with a fresh failure budget whenever the canonical task is recreated. In production this produced hundreds of failed connection attempts while healthy endpoints still had useful work.
Reuse the durable per-target, per-endpoint failure ledger before legacy admission. A proven pre-connect failure now releases its execution and persists the failure count atomically; subsequent tasks skip that endpoint until its next probe, while continuing healthy endpoints. Successful responses clear only the responding endpoint’s failure. Ambiguous requests retain the execution protection introduced by #452. Remove request URLs from connection error classification so table names cannot turn a network failure into a permanent configuration failure.
This builds on merged #452 and changes only the master merge path. It does not bound canonical queue churn or all traffic to one failed worker across different tables, and old master binaries do not honor this ledger on the legacy path. Existing unrecorded writers still require a safe migration.
Validation: all 10 legacy connection/ownership tests pass on the rebased final commit against real isolated etcd (0 failed, 0 ignored), including the five-task retry regression, redirect/timeout ambiguity, claim lease loss and successful release. The new regression checks counts persist as 1→2→3, skipped probes do not charge attempts, and the healthy endpoint completes all five passes. Full CI is running on the rebased commit.
Rollout: this adds one failure-key read per visited worker. Validate the fixed image’s private-etcd load and mixed-version behavior in staging before broad deployment.