Skip to content

Fix correctness review findings - #35

Draft
RayElg wants to merge 26 commits into
mainfrom
fix-review-findings
Draft

RayElg wants to merge 26 commits into
mainfrom
fix-review-findings

Conversation

@RayElg

@RayElg RayElg commented Nov 5, 2026

Copy link
Copy Markdown
Owner

Crash can reuse a SQL transaction id: Producer ids now include a per-boot number, so a reused xid no longer matches an orphaned batch.
Wire and SQL producer ids can collide: SQL producer ids now carry a bit-62 flag that wire producer ids never reach.
Failover keeps the row but loses the event: Added kafgres_follower_lag() and documented the exception
Retry after kill -9 can store a batch twice: At startup the broker rebuilds missing idempotence window rows from the log tail.
CDC drops changes made before the slot exists: kafgres_add_mapping now creates the slot before it writes anything.
Compacted read_committed fetch can stall forever: Compaction now deletes the markers of batches it removes, and a capped fetch resumes past the cap.
One incompatible member breaks the whole classic group: A joiner whose protocols match none of the group’s is refused on its own, and existing members keep consuming.
kafgres_markers grows without bound: Retention and compaction now delete markers for data they remove.

@RayElg RayElg changed the title Fix review findings Fix correctness review findings Nov 5, 2026
@RayElg
RayElg force-pushed the fix-review-findings branch from ccb0a01 to 2fd4fca Compare November 5, 2026 22:48
…tence window loss, group protocol isolation (I1, I5)
@RayElg
RayElg force-pushed the fix-review-findings branch from 2fd4fca to 66f7455 Compare November 6, 2026 00:05
RayElg added 25 commits November 6, 2026 02:45
…mit, and tolerate xid wrap

The window rebuild moves out of the epoch-raise transaction to the first idempotent produce
per partition, so a bad partition cannot block startup. Slot creation in kafgres_add_mapping
follows validation. A static member's earlier registration no longer counts against its
protocols. Follower lag is cleared when a Fetch is incomplete or the node is promoted.
…apping is added, and bound the startup scans

The rebuild scans only the log's tail. The boot number is taken once per process. Follower lag
is measured against the last stable offset and cleared when a Fetch is incomplete.
kafgres_add_mapping warns and saves the mapping when the slot cannot be created. A
read_committed Fetch resumes at the next batch after an empty marker window.
…ader parse, and bump to 0.3.3

kafgres_add_mapping holds the CDC lock whether or not the slot exists, so a drain that
loaded its mappings earlier cannot pass the slot over the new mapping's first changes.
0.3.3 adds the kafgres_follower_lag() function to existing installs.
…rt the upgrade adds the lag function

A drain re-reads the mappings after its first fetch decodes the WAL and skips the tick if they
changed, so adding a mapping no longer blocks drains or takes a lock that can deadlock.
…rker cleanup after compaction, and name the partition when a rebuild fails
…and have kafgres_slot_ready() answer with text and wait 120 s
…ready() at once in a transaction that wrote, and keep the slot while a mapping is being added
… the slot for disabled mappings and while it is in use, and document that capture starts at the mapping's commit
…sh the boot number, and widen the window rebuild when the log tail is dated ahead
…get markers below a DeleteRecords on compact-only topics, and keep the marker tests clear of the background sweep
…llower lag unread when a Fetch cannot cover every partition, and test a committed read past compaction's stale markers
…orget markers once per retention pass, and leave a full slot limit to Postgres's own error
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant