Repository navigation
Repair ZooKeeper snapshot interruption and truncation recovery - #192
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An interrupted SNAP currently leaves temporary history in the ZooKeeper model. A later rejected TRUNC can be discarded while the follower continues through NEWLEADER, leading to inconsistent logs. Recovery can also reuse a snapshot position beyond the replacement history.
Align these paths with ZooKeeper 3.7.0: restore the pre-SNAP history on incomplete synchronization shutdown, model failed truncation through the existing crash transition, allow truncation of provisional history, and refresh the position of a replacement snapshot. The nine safety targets are unchanged. Regenerated dependency files drop the now-unused original timeout helper.
Validation: 27 new TLC regressions passed, including reachable leader/follower/partition interruption paths, completed-sync preservation, recovery-disabled controls, and focused truncation/snapshot handler checks. Existing module-task tests passed (92 passed, 1 skipped); the complete generated suite verifies with 0 errors. Ruff and diff checks pass. Handler edge tests inject explicit local preconditions and do not claim end-to-end reachability of that setup.
Draft for review of the synchronization and persistence abstraction. Finite regressions do not establish the nine unbounded safety theorems or complete disk-format fidelity. No new proof experiment has been launched; earlier experiment artifacts remain untouched.