Skip to content

fix(stovepipe): key build-slot ownership by request ID - #966

Open
sbalabanov wants to merge 1 commit into
mainfrom
sergeyb/sp-oct-003-owner-keyed-slots
Open

sbalabanov wants to merge 1 commit into
mainfrom
sergeyb/sp-oct-003-owner-keyed-slots

Conversation

@sbalabanov

@sbalabanov sbalabanov commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Why?

Admission claims a build slot by incrementing an anonymous in_flight_count and then moves the request accepted→processing in a second write. If the second write never lands, the count stays raised and the redelivery is held behind its own claim. Holds never dead-letter, and the DLQ releases only processing requests, so nothing repairs it. Release has the same problem in reverse: after a failed outcome write, the retry releases a second time and takes another request's slot.

  1. Queue at max_concurrent = 1; request R is accepted and becomes the latest head.
  2. process claims the slot (in_flight_count = 1), then crashes before writing processing.
  3. Every redelivery of R finds the gate closed (1 >= 1) and holds; the DLQ never sees it.
  4. The queue stops admitting work for good.

What?

Queue.InFlightCount becomes InFlightRequestIDs, the set of requests holding a slot, stored in MySQL as in_flight_request_ids JSON NOT NULL DEFAULT (JSON_ARRAY()). A claim is idempotent per request ID. A redelivery that finds its own ID resumes the processing write. If a newer head arrived meanwhile, it releases the slot before being superseded, so no slot is spent on a stale head and no sweeper is needed. Release removes by ID and writes nothing when the ID is absent. That makes the buildsignal and DLQ retries safe and lets the DLQ release for any nonterminal request. A claim left by a failed admit stays for the redelivery to resume or the DLQ to release. process releases it only when it loses the admit to a terminal transition; a duplicate admission keeps the slot. The process RFC, related step docs and the storage README (with an upgrade note) describe the owner set.

Test Plan

make fmt && make lint && make check-tidy && make check-gazelle && make check-mocks
./tool/bazel test //stovepipe/... //service/stovepipe/... //test/integration/stovepipe/extension/storage/... --test_output=errors

Audit: SP-OCT-003 and SP-OCT-005 in doc/audit/stovepipe-fable-v2.md (Sol v2 #1/#2, Opus v2 #1/#8).

🤖 Generated with Claude Code

@sbalabanov
sbalabanov force-pushed the sergeyb/sp-oct-003-owner-keyed-slots branch from 0ef6b68 to c404a3a Compare October 27, 2026 23:36
Replace the queue's anonymous in_flight_count with in_flight_request_ids,
the set of requests holding a build slot. A redelivery that finds its own
claim resumes the admit instead of holding behind it, or, when a newer
head arrived, releases the slot before being superseded, so a crash
between the claim and the processing write no longer wedges the queue.
Release removes by ID and is a no-op when absent, so a retried outcome
write cannot free another request's slot, and the DLQ releases for any
nonterminal request.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@sbalabanov
sbalabanov force-pushed the sergeyb/sp-oct-003-owner-keyed-slots branch from c404a3a to beeea87 Compare October 27, 2026 23:39
@sbalabanov
sbalabanov marked this pull request as ready for review October 27, 2026 23:41
@sbalabanov
sbalabanov requested review from a team and behinddwalls as code owners October 27, 2026 23:41

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants