Persist summary retirement and removal across restart - #633
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Retired, expired, or removed summary instances could reappear after restart because the durable sidecar stored identity but discarded lifecycle state. This preserves retirement and expiry deadlines and records removal tombstones before changing the live inventory.
The flusher and lifecycle operations share one metadata writer. Monotone record merging prevents an older flush snapshot from clearing a newer tombstone or extending an expiry deadline. If the durable write fails, the live instance stays unchanged. Instances whose definition has left the desired catalog retain their existing persisted provenance during cleanup.
Before: removing a durable SID and restarting could register it again from existing disk parts. After: recovery skips its tombstone, even if a stale flush arrives after removal.
Verification: two focused regressions pass: real disk flush → retirement/expiry/removal → stale metadata replay → restart, and a failing sidecar write leaving the live instance unchanged. The parent identity PR supplies the real process restart/readout test. Performance measurements are not applicable.
Stacked on #630. Tombstones are retained; physical part reclamation and tombstone garbage collection are separate work. This does not make the in-memory admission ledger crash-durable or establish cross-generation state reuse.