Skip to content

docs: promote TTL-inline cross-leader design to partial #1338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bootjp merged 2 commits into from
Oct 26, 2026
Merged

docs: promote TTL-inline cross-leader design to partial #1338

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd0d6fb
docs: promote ttl_inline_cross_leader_legacy_rows from proposed to pa…
claude Oct 25, 2026
8dcecd8
docs: record landed TTL-inline cross-leader components
claude Oct 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ...ed_ttl_inline_cross_leader_legacy_rows.md → ...al_ttl_inline_cross_leader_legacy_rows.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# TTL-inline migration of legacy-route rows across leaders

Status: Proposed
Status: Partial
Author: bootjp
Date: 2026-10-17

Expand Down Expand Up @@ -322,12 +322,12 @@ For A, A′, B and C, the 16 is ⌈512 / 32⌉, where n_P is the number of a pag

## Implementation progress

This proposal's design review is not implementation acceptance. The runtime changes below are being consolidated in this PR; no complete milestone or operational migration is claimed yet.
This proposal's design review is not implementation acceptance. The components below are on main, merged by bootjp/elastickv#1280; that is why this document is `partial`. No milestone is complete and no operational migration is claimed yet: none of the new protocol is enabled, and both read fallbacks stay on.

| Component | Current implementation evidence | Remaining acceptance |
|---|---|---|
| M1 physical-page reporting | `ShardStore.ScanGroupOwnedPageAt` returns served rows, four legacy base-metadata dispositions, catalog version and the physical resume key without remote owner probes. Delta and migration plans now share one timeout-aware rotation; the regression exhausts every slot's tick and still reaches every migration family. | Production reporting integration, valid completed snapshots, status and one-shot audit. |
| M1b atomic absence | Store apply-lock checks include old committed versions and tombstones on memory/Pebble and entry-scoped batches. Protobuf, coordinator and 1PC preserve the condition, including duplicate-key mutation reduction. Store/KV race suites and scoped lint passed. | Durable replicated capability/activation is not implemented yet, so guarded requests remain refused by default. Retention state, downgrade fencing, drain, read-admission and compaction requirements above remain mandatory. |
| M1b atomic absence | Store apply-lock checks include old committed versions and tombstones on memory/Pebble and entry-scoped batches. Protobuf, coordinator and 1PC preserve the condition, including duplicate-key mutation reduction. `TransactionManager.Commit` refuses any request carrying `require_absent` before proposing it, so the field cannot reach the log while a pre-capability replica would apply the `Put` it ignores; the apply-time refusal stays for entries already in a log. Store/KV race suites and scoped lint passed. | Durable replicated capability/activation is not implemented yet, so guarded requests remain refused before proposal and at apply. M1b's all-member capability fence replaces the unconditional proposal refusal. Retention state, downgrade fencing, drain, read-admission and compaction requirements above remain mandatory. |
| M1b durable generation pins | Implemented deterministic admission, extension, retirement and expected-deadline expiry transitions, including retirement before initial admission and protection of active lower generations. The durable journal saves state with its Raft index, reloads on an already-applied disk index, and does not publish a failed write. Its control-group allocator saves a monotonic counter before returning an identity, rejects unallocated reservations, and never guesses an old lost allocation response. Memory/Pebble snapshot, reopen, ordering, encrypted-state and race tests cover these primitives. No wall clock or user HLC allocation is used. | Activation, allocator fan-out, token format, all renewal/compensation callers, drain proof, snapshot recovery barriers and read-floor/compaction integration remain mandatory. A test-only seeded epoch is not activation evidence. |
| M1b typed FSM integration | Added a strict versioned `0x16` command decoder (moved from `0x0f`, which main assigned to the migration target-readiness opcode), typed allocation responses, durable pin apply, and journal reload at startup/snapshot restore. The highest admitted pin timestamp persists after release/expiry, fences delayed writes after restart, and invalidates timestamp caches without adding a volatile backup pin. Legacy commands reject once an activated epoch exists. New-epoch state cannot use legacy compaction while its quorum/floor protocol is unavailable. | No production producer or activation path emits this format. Both capability and a persisted activated epoch are required. Capability certificates, downgrade fencing, drain/activation, backup APIs and the full per-pass ReadIndex/prepare/drain/raise protocol are not implemented yet; reclamation for such an epoch remains closed rather than approximating them. |
| M2-M4 | Not implemented. | Peer relocation, bounded checkpointing, reserved purge, completed-snapshot gate and seeded Jepsen acceptance. Both read fallbacks stay enabled. |
Expand Down
Loading