server: fence capture writes with etcd and P2P leases (#6092)

[ti-chi-bot]

This is an automated cherry-pick of #6092

What problem does this PR solve?

Issue Number: close #6045

A network-isolated capture may write after replacement dispatchers start. This overlap can leave a MySQL sink inconsistent after checkpoint advancement.

What is changed and how it works?

Gate capture writes with etcd and coordinator P2P proofs, negotiated through node heartbeats and a remote witness. Enforce admission in transport workers and before DML is sent to downstream. Confirmed session loss exits the capture. Add metrics, deterministic tests, and a 10-second removal grace.

Already-admitted transactions remain outside the guarantee because an accepted COMMIT cannot be revoked.

End-to-end validation

A three-capture/MySQL test-infra gate sustained 20.3k DML/s, exercised lifecycle/network faults, matched ten table CRCs, and found no panic.

Dimension	Previous cdc_network_loss	New synthetic chaos
DML	100 threads; UPDATE only; no rate target	256 threads; ~20k DML/s; UPDATE/DELETE/INSERT = 50%/25%/25%
Stress	1h traffic; 10s fault every 30m	2h15m traffic; 10s fault every 2m (15x frequency)
Coverage	Random capture, network loss only	3 captures; ingress, egress, bidirectional, PD-only, PD-plus-CDC; scale 3→1→3, hang, kill
Validation	Checksum	CRC plus row-level Sync Diff for failed tables

A six-round soak is running: 12 chaos hours, about 360 faults, and up to 972 million DMLs.

Check List

Tests

• Unit test
• Integration test
• Manual E2E test

Questions

Will it cause performance regression or break compatibility?

The check is in memory; 500 ms heartbeats and capability negotiation preserve rolling upgrades.

Do you need to update user documentation, design documentation or monitoring documentation?

No user documentation change; metrics expose write-lease state.

Release note

Fix a bug that may cause data inconsistent while there is a cdc node is network partitioned with other nodes. 

Summary by CodeRabbit

Summary by CodeRabbit

• New Features

  • Added capture-wide write-lease protection for downstream writes.
  • Added P2P witness validation and etcd lease verification.
  • Applied write protection across MySQL, Kafka, Pulsar, cloud storage, and Redo outputs.
  • Added write-lease monitoring metrics and legacy-protocol compatibility.

• Bug Fixes

  • Prevented stale captures from publishing data, checkpoints, metadata, or cleanup changes.
  • Improved recovery after temporary lease loss and rejected stale or duplicate lease responses.

• Documentation

  • Added design documentation covering write-lease behavior, safety guarantees, and failure handling.

[ti-chi-bot]

@asddongmen This PR has conflicts, I have hold it.
Please resolve them or ask others to resolve them, then comment /unhold to remove the hold label.

[ti-chi-bot]

@ti-chi-bot: ## If you want to know how to resolve it, please read the guide in TiDB Dev Guide.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign 3aceshowhand for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 1e34c328-5acd-49ca-bf72-73e538c9b78e

📥 Commits

Reviewing files that changed from the base of the PR and between 578cb65 and cc66ae8.

⛔ Files ignored due to path filters (6)

• docs/media/capture-write-lease-architecture.svg is excluded by !**/*.svg
• docs/media/capture-write-lease-p2p-sequence.svg is excluded by !**/*.svg
• docs/media/capture-write-lease-safety-proof.svg is excluded by !**/*.svg
• docs/media/capture-write-lease-test-coverage.svg is excluded by !**/*.svg
• docs/media/capture-write-lease-write-path.svg is excluded by !**/*.svg
• heartbeatpb/heartbeat.pb.go is excluded by !**/*.pb.go

📒 Files selected for processing (81)

• coordinator/capture_write_lease.go
• coordinator/capture_write_lease_test.go
• coordinator/controller.go
• coordinator/controller_drain_test.go
• docs/design/capture-write-lease-design.md
• docs/design/capture-write-lease-overview.md
• downstreamadapter/dispatcher/redo_dispatcher.go
• downstreamadapter/dispatchermanager/dispatcher_manager.go
• downstreamadapter/dispatchermanager/dispatcher_manager_redo.go
• downstreamadapter/sink/blackhole/sink.go
• downstreamadapter/sink/cloudstorage/dml_writers.go
• downstreamadapter/sink/cloudstorage/sink.go
• downstreamadapter/sink/cloudstorage/writer.go
• downstreamadapter/sink/cloudstorage/writer_test.go
• downstreamadapter/sink/kafka/sink.go
• downstreamadapter/sink/kafka/sink_test.go
• downstreamadapter/sink/mock/sink_mock.go
• downstreamadapter/sink/mysql/sink.go
• downstreamadapter/sink/mysql/sink_test.go
• downstreamadapter/sink/pulsar/sink.go
• downstreamadapter/sink/pulsar/sink_test.go
• downstreamadapter/sink/redo/meta.go
• downstreamadapter/sink/redo/meta_test.go
• downstreamadapter/sink/redo/sink.go
• downstreamadapter/sink/sink.go
• downstreamadapter/sink/write_gate.go
• downstreamadapter/sink/write_gate_test.go
• heartbeatpb/heartbeat.proto
• heartbeatpb/write_lease_protocol.go
• maintainer/maintainer_manager.go
• maintainer/maintainer_manager_maintainers.go
• maintainer/maintainer_manager_node.go
• maintainer/node_liveness_test.go
• pkg/bootstrap/bootstrap.go
• pkg/bootstrap/bootstrap_test.go
• pkg/common/context/app_context.go
• pkg/common/table_info_shared_schema_guard_test.go
• pkg/messaging/message.go
• pkg/messaging/message_write_lease_test.go
• pkg/metrics/init.go
• pkg/metrics/write_lease.go
• pkg/orchestrator/reactor_state.go
• pkg/orchestrator/reactor_state_capture_test.go
• pkg/redo/writer/blackhole/writer.go
• pkg/redo/writer/file/file.go
• pkg/redo/writer/file/file_log_writer.go
• pkg/redo/writer/file/file_log_writer_test.go
• pkg/redo/writer/file/file_mock.go
• pkg/redo/writer/file/file_test.go
• pkg/redo/writer/memory/ddl_writer.go
• pkg/redo/writer/memory/ddl_writer_test.go
• pkg/redo/writer/memory/dml_writer.go
• pkg/redo/writer/memory/file_worker.go
• pkg/redo/writer/writer.go
• pkg/redo/writer/writer_mock.go
• pkg/sink/cloudstorage/path.go
• pkg/sink/kafka/claimcheck/claim_check.go
• pkg/sink/kafka/claimcheck/claim_check_test.go
• pkg/sink/mysql/mysql_writer.go
• pkg/sink/mysql/mysql_writer_dml_exec.go
• pkg/sink/mysql/mysql_writer_dml_session.go
• pkg/sink/mysql/mysql_writer_for_ddl_ts.go
• pkg/sink/mysql/mysql_writer_test.go
• pkg/writelease/write_gate.go
• pkg/writelease/write_gate_test.go
• server/server.go
• server/server_session_watchdog_test.go
• server/watcher/module_node_manager.go
• tests/integration_tests/capture_write_lease/conf/changefeed-main.toml
• tests/integration_tests/capture_write_lease/conf/changefeed-redo.toml
• tests/integration_tests/capture_write_lease/conf/diff_config.toml
• tests/integration_tests/capture_write_lease/conf/workload1
• tests/integration_tests/capture_write_lease/conf/workload2
• tests/integration_tests/capture_write_lease/conf/write_lease_diff_config.toml
• tests/integration_tests/capture_write_lease/conf/write_lease_workload
• tests/integration_tests/capture_write_lease/run.sh
• tests/integration_tests/maintainer_failover_when_operator/run.sh
• tests/integration_tests/multi_capture/run.sh
• tests/integration_tests/run_light_it_in_ci.sh
• tests/integration_tests/synced_status/run.sh
• tests/integration_tests/synced_status_with_redo/run.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}