Skip to content

feat(cluster): undo-block resource identity + owner-as-master routing#23

Open
sqlrush wants to merge 1 commit into
mainfrom
spec-5.22a-undo-resid
Open

feat(cluster): undo-block resource identity + owner-as-master routing#23
sqlrush wants to merge 1 commit into
mainfrom
spec-5.22a-undo-resid

Conversation

@sqlrush

@sqlrush sqlrush commented Jul 8, 2026

Copy link
Copy Markdown
Owner

Summary

  • Name an undo block (including the segment TT header block) as a first-class cluster resource: (owner_node, undo_segment, block_no, generation) encoded into the 16-byte ClusterResId wire format as new class byte 0xF9.
  • First owner-as-master resid class: cluster_undo_resid_master() returns the encoded owner directly — never a GRD shard-hash node. The GRD hash-master lookup fails closed (Assert + new SQLSTATE 53R9Q) if an undo resid reaches it.
  • Anti-ABA: cluster_undo_resid_generation_matches() (generation = segment reuse wrap_count); mismatch means a stale reference and callers must fail closed.
  • Pure identity layer only: no grant/PI/serving data plane, no write-path change, no on-disk or wire ABI change (ClusterResId stays 16 bytes).

Files

  • new src/include/cluster/cluster_undo_resid.h — class byte + collision StaticAssert net (9 header-visible classes + LOCKTAG_LAST_TYPE) + field mapping
  • new src/backend/cluster/cluster_undo_resid.c — encode/decode/is_undo/master/generation_matches (standalone-linkable pure layer)
  • src/backend/cluster/cluster_grd.c — fail-closed undo-class guard at cluster_grd_lookup_master entry
  • src/backend/utils/errcodes.txt53R9Q ERRCODE_CLUSTER_UNDO_RESID_HASH_ROUTED
  • tests: new test_cluster_undo_resid (8 cases), guard-fire leg in test_cluster_grd (ereport trampoline), t/006 SQLSTATE spot-check

Test plan

  • cluster_unit: 158/158 binaries pass (new: test_cluster_undo_resid 8/8; test_cluster_grd 81/81 incl. guard-fire)
  • PG 219: 219/219 (cassert, enable mode)
  • cluster_regress: 13/13
  • cluster_tap t/001 + t/006 (incl. new 53R9Q spot-check): PASS
  • clang-format 18 + comment-header checks: 0 violations
  • fast-gate CI (this PR)

Spec: spec-5.22a-undo-block-resource-identity.md

Name an undo block (including the segment TT header block) as a
first-class cluster resource: (owner_node, undo_segment, block_no,
generation) encoded into the 16-byte ClusterResId wire format as
class 0xF9.  Undo is the first owner-as-master resid class: the
resource master IS the owning instance (cluster_undo_resid_master),
never a GRD shard-hash node.  The GRD hash-master lookup now fails
closed (Assert + new SQLSTATE 53R9Q) if an undo resid reaches it,
and the generation predicate (segment wrap_count) lets callers fail
closed on recycled-segment stale references.

Pure identity layer only: no grant/PI/serving data plane, no write
path change, no on-disk format or wire ABI change (ClusterResId
stays 16 bytes; new class byte value only).

- new cluster_undo_resid.h: class byte 0xF9 + collision StaticAssert
  net (9 header-visible classes + LOCKTAG_LAST_TYPE) + field mapping
- new cluster_undo_resid.c: encode/decode/is_undo/master/
  generation_matches pure layer (standalone-linkable)
- cluster_grd.c: fail-closed undo-class guard at
  cluster_grd_lookup_master entry
- errcodes.txt: 53R9Q ERRCODE_CLUSTER_UNDO_RESID_HASH_ROUTED
- tests: test_cluster_undo_resid (8 cases: round-trip, class byte,
  discriminator, 16B wire lock, owner bounds, owner-as-master,
  generation); guard-fire leg in test_cluster_grd via an ereport
  trampoline; t/006 SQLSTATE spot-check line

Spec: spec-5.22a-undo-block-resource-identity.md
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant