Repository navigation
[fence 8/9] libsql-server: replica servers honour the replicated fence - #48
Closed
tszymczyszyn-shopify wants to merge 3 commits into
Closed
tszymczyszyn-shopify wants to merge 3 commits into
tszymczyszyn-shopify wants to merge 3 commits into
Conversation
This was referenced Oct 5, 2026
tszymczyszyn-shopify
force-pushed
the
namespace-fence/6-typed-outcomes
branch
from
October 13, 2026 19:41
daf31f7 to
cdd8e0b
Compare
tszymczyszyn-shopify
force-pushed
the
namespace-fence/7-replicas
branch
from
October 13, 2026 19:41
993abd6 to
08bd3d2
Compare
A replica server whose primary refuses replication of a namespace with a
fence code (a refused `hello`, `log_entries` or `snapshot`, or a stream
the primary ended with the typed status) now refuses local reads and
streams of its copy with the same code, and asks the reads it had already
admitted to stop. The denial is published on the namespace's fence
controller on the replica, so every user protocol reports it as it does
on the primary; writes keep going to the primary, which refuses them
itself. A `hello` the primary answers lifts it.
The refusal is no longer retried every second by the handshake loop: the
replica's replication loop waits 1 s, doubling to 15 s, until the primary
answers again, and counts each refused call in
`libsql_server_replica_fence_refusals_total{code}`.
Co-authored-by: Tomasz Szymczyszyn <tomasz.szymczyszyn@shopify.com>
…refuses A replica server creating a namespace lazily for a name the primary's fence refuses (a quarantined or aborted target, a read-fenced source, a fence state the primary cannot establish) now fails the request at once with the primary's code (Error::NamespaceFence: 423 and the stable code) instead of retrying the handshake, and leaves no local namespace behind: the namespace directory the setup created is removed (a directory that already existed is kept), and NamespaceStore::with forgets the metastore entry handle() added and the controller the attempt created, when neither holds anything durable or is in use by another attempt. A later request, once the primary admits the name, creates it normally. Co-authored-by: Tomasz Szymczyszyn <tomasz.szymczyszyn@shopify.com>
A replica server learns of the primary's read fence through observe_primary, which denies local reads and cancels every read lease held, so that work admitted before it learned does not outlive it. A read counted on the fast path cannot be cancelled. Mark a replica namespace before its first connection so that all its reads take the registered lease, and refresh the fast-path flag when the primary's denial changes.
tszymczyszyn-shopify
force-pushed
the
namespace-fence/6-typed-outcomes
branch
from
October 13, 2026 20:51
cdd8e0b to
6caa89f
Compare
tszymczyszyn-shopify
force-pushed
the
namespace-fence/7-replicas
branch
from
October 13, 2026 20:51
08bd3d2 to
7291705
Compare
Author
|
Closing. This stack is parked; the note at the top of the description explains why. The branch is kept at |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replica servers publish the primary's replicated fence as a local read denial and end replication with a typed status; fence refusals, including those delivered as a stream's terminal status, advance the reconnect backoff. A replica no longer lazily creates a namespace that the primary's fence refused.
Review focus
Replica-side behaviour and backoff.
Since the first version, from review: a replica server's namespaces never use the SQL read fast path from #44, so
observe_primarycan cancel every read it must stop, and the fast-path flag follows the primary's denial.Commits
Stack
Part 8 of 9, based on
namespace-fence/6-typed-outcomes. The stack sits on #53 (tszymczyszyn/atomic-namespace-create), which sits on #51: review and land #51 → #53 → #41 → … → #49 bottom-up, restacking after each squash or rebase merge.The first version of these PRs carried #35's fence diff unchanged on
v0.9.30-shopify-patches. On 2026-10-13 the stack was rebased onto #53 (how the conflicts were resolved is summarised in a comment on #41) and gained the commits marked above.