couchbase 3.8.2 → 3.9.0

data/ext/couchbase/core/io/mcbp_session.cxx

@@ -19,15 +19,16 @@
 
 #include <couchbase/build_config.hxx>
 
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-#include "core/columnar/background_bootstrap_listener.hxx"
-#endif
 #include "configuration_belongs_to_session.hxx"
+#include "opaque_ring_table.hxx"
+
+#include "core/app_telemetry_meter.hxx"
 #include "core/config_listener.hxx"
 #include "core/diagnostics.hxx"
 #include "core/impl/bootstrap_error.hxx"
 #include "core/impl/bootstrap_state_listener.hxx"
 #include "core/logger/logger.hxx"
+#include "core/logger/redaction.hxx"
 #include "core/mcbp/codec.hxx"
 #include "core/mcbp/queue_request.hxx"
 #include "core/meta/version.hxx"
@@ -51,8 +52,10 @@
 #include "core/sasl/error_fmt.h"
 #include "core/topology/capabilities_fmt.hxx"
 #include "core/topology/configuration_fmt.hxx"
+#include "mcbp_buffer_pool.hxx"
 #include "mcbp_context.hxx"
 #include "mcbp_message.hxx"
+#include "mcbp_output_queue.hxx"
 #include "mcbp_parser.hxx"
 #include "retry_orchestrator.hxx"
 #include "streams.hxx"
@@ -110,7 +113,7 @@ struct mcbp_header_layout {
     if (magic == 0x18 || magic == 0x08) {
       return keylen.alt.key;
     }
-    return couchbase::core::utils::byte_swap(keylen.normal);
+    return couchbase::core::utils::network_to_host(keylen.normal);
   }
 
   [[nodiscard]] constexpr auto framing_extras_length() const -> std::uint8_t
@@ -150,10 +153,10 @@ struct fmt::formatter<mcbp_header_view<Container>> {
                      header->extlen,
                      header->datatype,
                      header->specific_name(),
-                     couchbase::core::utils::byte_swap(header->specific),
-                     couchbase::core::utils::byte_swap(header->bodylen),
-                     couchbase::core::utils::byte_swap(header->opaque),
-                     couchbase::core::utils::byte_swap(header->cas));
+                     couchbase::core::utils::network_to_host(header->specific),
+                     couchbase::core::utils::network_to_host(header->bodylen),
+                     couchbase::core::utils::network_to_host(header->opaque),
+                     couchbase::core::utils::network_to_host(header->cas));
   }
 };
 
@@ -270,13 +273,21 @@ class mcbp_session_impl
         hello_req.body().enable_mutation_tokens();
       }
       hello_req.opaque(session_->next_opaque());
-      auto user_agent = meta::user_agent_for_mcbp(
-        session_->client_id_, session_->id_, session_->origin_.options().user_agent_extra, 250);
+      const auto& user_agent_extra = session_->origin_.options().user_agent_extra;
+      auto user_agent =
+        meta::user_agent_for_mcbp(session_->client_id_, session_->id_, user_agent_extra, 250);
       hello_req.body().user_agent(user_agent);
-      CB_LOG_DEBUG("{} user_agent={}, requested_features=[{}]",
-                   session_->log_prefix_,
-                   user_agent,
-                   utils::join_strings_fmt(hello_req.body().features(), ", "));
+      CB_LOG_DEBUG(
+        "{} user_agent={}, requested_features=[{}]",
+        session_->log_prefix_,
+        // The blob folds in the application's user_agent_extra, and that is the only user data it
+        // can hold: the rest is SDK, platform and TLS identity, and its "i" field is the client
+        // and session id that log_prefix_ already prints in the clear on this same line. So it is
+        // tagged only when there is an extra to protect, which keeps the version block readable in
+        // the logs support actually receives.
+        logger::user_data_if(!user_agent_extra.empty(), user_agent),
+        // protocol feature names, not a document body
+        logger::not_sensitive(utils::join_strings_fmt(hello_req.body().features(), ", ")));
       session_->write(hello_req.data());
 
       if (!session_->origin_.credentials().uses_certificate()) {
@@ -371,7 +382,10 @@ class mcbp_session_impl
             case protocol::client_opcode::hello: {
               protocol::client_response<protocol::hello_response_body> resp(std::move(msg));
               if (resp.status() == key_value_status_code::success) {
-                session_->supported_features_ = resp.body().supported_features();
+                {
+                  const std::scoped_lock lock(session_->session_info_mutex_);
+                  session_->supported_features_ = resp.body().supported_features();
+                }
                 CB_LOG_DEBUG("{} supported_features=[{}]",
                              session_->log_prefix_,
                              utils::join_strings_fmt(session_->supported_features_, ", "));
@@ -496,7 +510,7 @@ class mcbp_session_impl
               if (resp.status() == key_value_status_code::success) {
                 CB_LOG_DEBUG("{} selected bucket: {}",
                              session_->log_prefix_,
-                             session_->bucket_name_.value_or(""));
+                             logger::metadata(session_->bucket_name_.value_or("")));
                 session_->bucket_selected_ = true;
               } else if (resp.status() == key_value_status_code::not_found) {
                 auto error_msg =
@@ -544,12 +558,14 @@ class mcbp_session_impl
               if (session_->origin_.options().dump_configuration) {
                 if (const auto& text = resp.body().config_text(); text.has_value()) {
                   CB_LOG_TRACE("{} configuration from get_cluster_config request (bootstrap, "
-                               "size={}, endpoint=\"{}:{}\"), {}",
+                               "size={}, endpoint=\"{}\"), {}",
                                session_->log_prefix_,
                                text.value().size(),
-                               info.endpoint_address,
-                               info.endpoint_port,
-                               text.value());
+                               logger::system_data(
+                                 fmt::format("{}:{}", info.endpoint_address, info.endpoint_port)),
+                               // an opt-in dump, it exists to show the exact bytes. That is the
+                               // "none at all" case of the rule in redaction.hxx.
+                               logger::not_redacted(text.value()));
                 }
               }
               if (resp.status() == key_value_status_code::success) {
@@ -626,12 +642,14 @@ class mcbp_session_impl
               if (session_->origin_.options().dump_configuration) {
                 if (const auto& text = req.body().config_text(); text.has_value()) {
                   CB_LOG_TRACE("{} configuration from cluster_map_change_notification request "
-                               "(size={}, endpoint=\"{}:{}\"), {}",
+                               "(size={}, endpoint=\"{}\"), {}",
                                session_->log_prefix_,
                                text.value().size(),
-                               info.endpoint_address,
-                               info.endpoint_port,
-                               text.value());
+                               logger::system_data(
+                                 fmt::format("{}:{}", info.endpoint_address, info.endpoint_port)),
+                               // an opt-in dump, it exists to show the exact bytes. That is the
+                               // "none at all" case of the rule in redaction.hxx.
+                               logger::not_redacted(text.value()));
                 }
               }
               std::optional<topology::configuration> config = req.body().config();
@@ -641,24 +659,25 @@ class mcbp_session_impl
               }
             } break;
             default:
-              CB_LOG_WARNING("{} unexpected server request: opcode={:x}, opaque={}{:a}{:a}",
+              CB_LOG_WARNING("{} unexpected server request: opcode={:x}, opaque={}{:a}",
                              session_->log_prefix_,
                              msg.header.opcode,
-                             utils::byte_swap(msg.header.opaque),
-                             spdlog::to_hex(msg.header_data()),
-                             spdlog::to_hex(msg.body));
+                             utils::network_to_host(msg.header.opaque),
+                             // No need to dump the body here, CB_LOG_PROTOCOL has the raw bytes.
+                             spdlog::to_hex(msg.header_data()));
           }
           break;
         case protocol::magic::client_request:
         case protocol::magic::alt_client_request:
         case protocol::magic::server_response:
-          CB_LOG_WARNING("{} unexpected magic: {} (opcode={:x}, opaque={}){:a}{:a}",
+        case protocol::magic::invalid:
+          CB_LOG_WARNING("{} unexpected magic: {} (opcode={:x}, opaque={}){:a}",
                          session_->log_prefix_,
                          magic,
                          msg.header.opcode,
-                         utils::byte_swap(msg.header.opaque),
-                         spdlog::to_hex(msg.header_data()),
-                         spdlog::to_hex(msg.body));
+                         utils::network_to_host(msg.header.opaque),
+                         // No need to dump the body here, CB_LOG_PROTOCOL has the raw bytes.
+                         spdlog::to_hex(msg.header_data()));
           break;
       }
     }
@@ -713,12 +732,14 @@ class mcbp_session_impl
               if (session_->origin_.options().dump_configuration) {
                 if (const auto& text = resp.body().config_text(); text.has_value()) {
                   CB_LOG_TRACE("{} configuration from get_cluster_config response (size={}, "
-                               "endpoint=\"{}:{}\"), {}",
+                               "endpoint=\"{}\"), {}",
                                session_->log_prefix_,
                                text.value().size(),
-                               info.endpoint_address,
-                               info.endpoint_port,
-                               text.value());
+                               logger::system_data(
+                                 fmt::format("{}:{}", info.endpoint_address, info.endpoint_port)),
+                               // an opt-in dump, it exists to show the exact bytes. That is the
+                               // "none at all" case of the rule in redaction.hxx.
+                               logger::not_redacted(text.value()));
                 }
               }
               if (resp.status() == key_value_status_code::success) {
@@ -763,7 +784,7 @@ class mcbp_session_impl
             case protocol::client_opcode::subdoc_multi_lookup:
             case protocol::client_opcode::subdoc_multi_mutation:
             case protocol::client_opcode::sasl_auth: {
-              const std::uint16_t status = utils::byte_swap(msg.header.specific);
+              const std::uint16_t status = utils::network_to_host(msg.header.specific);
               if (status == static_cast<std::uint16_t>(key_value_status_code::not_my_vbucket)) {
                 session_->handle_not_my_vbucket(msg);
               }
@@ -771,12 +792,12 @@ class mcbp_session_impl
                 CB_LOG_WARNING("{} received auth stale status for {}, opaque={}",
                                session_->log_prefix_,
                                protocol::client_opcode(msg.header.opcode),
-                               utils::byte_swap(msg.header.opaque));
+                               utils::network_to_host(msg.header.opaque));
                 session_->stop(retry_reason::do_not_retry);
                 return;
               }
 
-              std::uint32_t opaque = utils::byte_swap(msg.header.opaque);
+              std::uint32_t opaque = utils::network_to_host(msg.header.opaque);
               if (session_->handle_request(opcode, status, opaque, std::move(msg))) {
                 CB_LOG_TRACE("{} MCBP invoked operation handler: opcode={}, opaque={}, status={}",
                              session_->log_prefix_,
@@ -792,12 +813,12 @@ class mcbp_session_impl
               }
             } break;
             default:
-              CB_LOG_WARNING("{} unexpected client response: opcode={}, opaque={}{:a}{:a})",
+              CB_LOG_WARNING("{} unexpected client response: opcode={}, opaque={}{:a})",
                              session_->log_prefix_,
                              opcode,
                              msg.header.opaque,
-                             spdlog::to_hex(msg.header_data()),
-                             spdlog::to_hex(msg.body));
+                             // No need to dump the body here, CB_LOG_PROTOCOL has the raw bytes.
+                             spdlog::to_hex(msg.header_data()));
           }
           break;
         case protocol::magic::server_request:
@@ -811,12 +832,14 @@ class mcbp_session_impl
               if (session_->origin_.options().dump_configuration) {
                 if (const auto& text = req.body().config_text(); text.has_value()) {
                   CB_LOG_TRACE("{} configuration from cluster_map_change_notification request "
-                               "(size={}, endpoint=\"{}:{}\"), {}",
+                               "(size={}, endpoint=\"{}\"), {}",
                                session_->log_prefix_,
                                text.value().size(),
-                               info.endpoint_address,
-                               info.endpoint_port,
-                               text.value());
+                               logger::system_data(
+                                 fmt::format("{}:{}", info.endpoint_address, info.endpoint_port)),
+                               // an opt-in dump, it exists to show the exact bytes. That is the
+                               // "none at all" case of the rule in redaction.hxx.
+                               logger::not_redacted(text.value()));
                 }
               }
               std::optional<topology::configuration> config = req.body().config();
@@ -826,24 +849,25 @@ class mcbp_session_impl
               }
             } break;
             default:
-              CB_LOG_WARNING("{} unexpected server request: opcode={:x}, opaque={}{:a}{:a}",
+              CB_LOG_WARNING("{} unexpected server request: opcode={:x}, opaque={}{:a}",
                              session_->log_prefix_,
                              msg.header.opcode,
                              msg.header.opaque,
-                             spdlog::to_hex(msg.header_data()),
-                             spdlog::to_hex(msg.body));
+                             // No need to dump the body here, CB_LOG_PROTOCOL has the raw bytes.
+                             spdlog::to_hex(msg.header_data()));
           }
           break;
         case protocol::magic::client_request:
         case protocol::magic::alt_client_request:
         case protocol::magic::server_response:
-          CB_LOG_WARNING("{} unexpected magic: {} (opcode={:x}, opaque={}){:a}{:a}",
+        case protocol::magic::invalid:
+          CB_LOG_WARNING("{} unexpected magic: {} (opcode={:x}, opaque={}){:a}",
                          session_->log_prefix_,
                          magic,
                          msg.header.opcode,
                          msg.header.opaque,
-                         spdlog::to_hex(msg.header_data()),
-                         spdlog::to_hex(msg.body));
+                         // No need to dump the body here, CB_LOG_PROTOCOL has the raw bytes.
+                         spdlog::to_hex(msg.header_data()));
           break;
       }
     }
@@ -877,7 +901,7 @@ public:
     , codec_{ { supported_features_.begin(), supported_features_.end() } }
   {
     log_prefix_ = fmt::format(
-      "[{}/{}/{}/{}]", client_id_, id_, stream_->log_prefix(), bucket_name_.value_or("-"));
+      "[{}/{}/{}/{}]", client_id_, id_, stream_->log_prefix(), log_prefix_bucket_name());
   }
 
   mcbp_session_impl(std::string_view client_id,
@@ -907,7 +931,7 @@ public:
     , codec_{ { supported_features_.begin(), supported_features_.end() } }
   {
     log_prefix_ = fmt::format(
-      "[{}/{}/{}/{}]", client_id_, id_, stream_->log_prefix(), bucket_name_.value_or("-"));
+      "[{}/{}/{}/{}]", client_id_, id_, stream_->log_prefix(), log_prefix_bucket_name());
   }
 
   mcbp_session_impl(const mcbp_session_impl&) = delete;
@@ -921,8 +945,9 @@ public:
     stop(retry_reason::do_not_retry);
   }
 
-  [[nodiscard]] auto log_prefix() const -> const std::string&
+  [[nodiscard]] auto log_prefix() const -> std::string
   {
+    const std::scoped_lock lock(session_info_mutex_);
     return log_prefix_;
   }
 
@@ -1054,6 +1079,7 @@ public:
 
   [[nodiscard]] auto context() const -> mcbp_context
   {
+    const std::scoped_lock lock(session_info_mutex_);
     return { config_, supported_features_ };
   }
 
@@ -1150,7 +1176,8 @@ public:
         }
 
         if (reason == retry_reason::do_not_retry || reason == retry_reason::unknown) {
-          CB_LOG_WARNING("{} reauthentication failed (code={}, message={}, reason={}, opaque={})",
+          CB_LOG_WARNING("{} reauthentication failed (code={}, message={}, reason={}, opaque={}), "
+                         "closing connection",
                          self->log_prefix_,
                          ec.value(),
                          ec.message(),
@@ -1158,6 +1185,7 @@ public:
                          req.opaque());
           self->reauth_deadline_.cancel();
           self->reauth_in_progress_ = false;
+          self->stop(retry_reason::do_not_retry);
           return;
         }
 
@@ -1199,45 +1227,6 @@ public:
           self->state_listener_->report_bootstrap_error(
             fmt::format("{}:{}", self->bootstrap_hostname_, self->bootstrap_port_), ec);
         }
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-        // an existing background bootstrap listener means we want to infinitely
-        // attempt to connect.
-        if (self->background_bootstrap_listener_) {
-          if (self->last_bootstrap_error_.has_value()) {
-            self->background_bootstrap_listener_->notify_bootstrap_error(
-              self->last_bootstrap_error_.value());
-          } else {
-            self->background_bootstrap_listener_->notify_bootstrap_error(
-              { make_error_code(errc::common::unambiguous_timeout),
-                "Unable to connect in time.",
-                self->bootstrap_hostname_,
-                self->bootstrap_port_ });
-          }
-          auto backoff = std::chrono::milliseconds(500);
-          CB_LOG_DEBUG("{} unable to connect in time, waiting for {}ms before retry",
-                       self->log_prefix_,
-                       backoff.count());
-          self->retry_backoff_.expires_after(backoff);
-          self->retry_backoff_.async_wait([self](std::error_code ec) mutable {
-            if (ec == asio::error::operation_aborted || self->stopped_) {
-              return;
-            }
-            self->origin_.restart();
-            self->initiate_bootstrap();
-          });
-        } else {
-          if (!ec) {
-            ec = errc::common::unambiguous_timeout;
-          }
-          CB_LOG_WARNING("{} unable to bootstrap in time, bootstrap_timeout: {}",
-                         self->log_prefix_,
-                         bootstrap_timeout);
-          if (auto h = std::move(self->bootstrap_callback_); h) {
-            h(ec, {});
-          }
-          self->stop(retry_reason::do_not_retry);
-        }
-#else
         if (!ec) {
           ec = errc::common::unambiguous_timeout;
         }
@@ -1248,7 +1237,6 @@ public:
           h(ec, {});
         }
         self->stop(retry_reason::do_not_retry);
-#endif
       });
     initiate_bootstrap();
   }
@@ -1269,25 +1257,12 @@ public:
                      self->log_prefix_,
                      old_id,
                      self->stream_->id(),
-                     self->bootstrap_hostname_,
-                     self->bootstrap_port_);
+                     logger::system_data(self->bootstrap_hostname_),
+                     logger::system_data(self->bootstrap_port_));
         return self->initiate_bootstrap();
       });
     }
     if (origin_.exhausted()) {
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-      if (background_bootstrap_listener_) {
-        if (last_bootstrap_error_.has_value()) {
-          background_bootstrap_listener_->notify_bootstrap_error(last_bootstrap_error_.value());
-        } else {
-          background_bootstrap_listener_->notify_bootstrap_error(
-            { errc::network::no_endpoints_left,
-              "Reached end of list of bootstrap nodes.",
-              bootstrap_hostname_,
-              bootstrap_port_ });
-        }
-      }
-#endif
       auto backoff = std::chrono::milliseconds(500);
       CB_LOG_DEBUG("{} reached the end of list of bootstrap nodes, waiting for {}ms before restart",
                    log_prefix_,
@@ -1306,12 +1281,15 @@ public:
     bootstrap_port_number_ =
       gsl::narrow_cast<std::uint16_t>(std::stoul(bootstrap_port_, nullptr, 10));
     bootstrap_address_ = fmt::format("{}:{}", bootstrap_hostname_, bootstrap_port_);
-    log_prefix_ = fmt::format("[{}/{}/{}/{}] <{}>",
-                              client_id_,
-                              id_,
-                              stream_->log_prefix(),
-                              bucket_name_.value_or("-"),
-                              bootstrap_address_);
+    {
+      const std::scoped_lock lock(session_info_mutex_);
+      log_prefix_ = fmt::format("[{}/{}/{}/{}] <{}>",
+                                client_id_,
+                                id_,
+                                stream_->log_prefix(),
+                                log_prefix_bucket_name(),
+                                logger::system_data(bootstrap_address_));
+    }
     CB_LOG_DEBUG("{} attempt to establish MCBP connection", log_prefix_);
 
     resolve_deadline_.expires_after(origin_.options().resolve_timeout);
@@ -1340,6 +1318,12 @@ public:
     return node_uuid_;
   }
 
+  auto app_telemetry_recorder(app_telemetry_meter& meter, const std::string& bucket_name)
+    -> std::shared_ptr<app_telemetry_value_recorder>
+  {
+    return app_telemetry_recorder_cache_.value_recorder(meter, node_uuid_, bucket_name);
+  }
+
   [[nodiscard]] auto is_stopped() const -> bool
   {
     return stopped_;
@@ -1362,33 +1346,48 @@ public:
     }
 
     if (reason == retry_reason::socket_closed_while_in_flight && !bootstrapped_) {
-      return stream_->close([self = shared_from_this(), old_id = stream_->id()](std::error_code) {
-        CB_LOG_DEBUG(
-          R"({} reopened socket connection due to IO error, "{}" -> "{}", host="{}", port={})",
-          self->log_prefix_,
-          old_id,
-          self->stream_->id(),
-          self->bootstrap_hostname_,
-          self->bootstrap_port_);
-        return self->initiate_bootstrap();
-      });
+      // Dispatch close through the stream's strand to serialize with any in-flight on_connect
+      // that may be reading plain_stream_impl::stream_ concurrently.
+      return asio::dispatch(
+        stream_->get_executor(),
+        [self = shared_from_this(), old_id = stream_->id()]() mutable -> void {
+          self->stream_->close([self, old_id = std::move(old_id)](std::error_code) mutable -> void {
+            CB_LOG_DEBUG(
+              R"({} reopened socket connection due to IO error, "{}" -> "{}", host="{}", port={})",
+              self->log_prefix_,
+              old_id,
+              self->stream_->id(),
+              logger::system_data(self->bootstrap_hostname_),
+              logger::system_data(self->bootstrap_port_));
+            return self->initiate_bootstrap();
+          });
+        });
     }
 
     state_ = diag::endpoint_state::disconnecting;
-    CB_LOG_DEBUG("{} stop MCBP connection, reason={}", log_prefix_, reason);
+    std::string stop_log_prefix;
+    {
+      const std::scoped_lock lock(session_info_mutex_);
+      stop_log_prefix = log_prefix_;
+    }
+    CB_LOG_DEBUG("{} stop MCBP connection, reason={}", stop_log_prefix, reason);
     stopped_ = true;
-    bootstrap_deadline_.cancel();
-    resolve_deadline_.cancel();
-    connection_deadline_.cancel();
-    reauth_deadline_.cancel();
-    retry_backoff_.cancel();
-    ping_timeout_.cancel();
-    resolver_.cancel();
-    stream_->close([](std::error_code) {
+    // Dispatch timer cancellation and stream close through the strand to avoid
+    // racing with on_connect() and bootstrap_handler which run on the IO thread.
+    asio::dispatch(stream_->get_executor(), [self = shared_from_this()]() -> void {
+      self->bootstrap_deadline_.cancel();
+      self->resolve_deadline_.cancel();
+      self->connection_deadline_.cancel();
+      self->reauth_deadline_.cancel();
+      self->retry_backoff_.cancel();
+      self->ping_timeout_.cancel();
+      self->resolver_.cancel();
+      if (auto h = std::move(self->bootstrap_handler_); h) {
+        h->stop();
+      }
+      self->stream_->close([](std::error_code) -> void {
+      });
     });
-    if (auto h = std::move(bootstrap_handler_); h) {
-      h->stop();
-    }
     if (auto h = std::move(handler_); h) {
       h->stop();
     }
@@ -1399,18 +1398,23 @@ public:
       }
     }
     {
-      const std::scoped_lock lock(command_handlers_mutex_);
-      for (auto& [opaque, handler] : command_handlers_) {
+      // Drain under the lock, then invoke the handlers after releasing it: a command handler may
+      // re-enter the session (as cancel() documents), so running one while holding
+      // command_handlers_mutex_ could deadlock during shutdown.
+      auto cancelled = [this] {
+        const std::scoped_lock lock(command_handlers_mutex_);
+        return command_handlers_.drain();
+      }();
+      for (auto& [opaque, handler] : cancelled) {
         if (handler) {
           CB_LOG_DEBUG("{} MCBP cancel operation during session close, opaque={}, ec={}",
-                       log_prefix_,
+                       stop_log_prefix,
                        opaque,
                        ec.message());
           auto fun = std::move(handler);
           fun(ec, reason, {}, {});
         }
       }
-      command_handlers_.clear();
     }
     {
       const std::scoped_lock lock(operations_mutex_);
@@ -1419,24 +1423,23 @@ public:
         auto& [request, handler] = operation;
         if (handler) {
           CB_LOG_DEBUG("{} MCBP cancel operation during session close, opaque={}, ec={}",
-                       log_prefix_,
+                       stop_log_prefix,
                        opaque,
                        ec.message());
-          handler->handle_response(std::move(request), {}, reason, {}, {});
+          handler->handle_response(
+            std::move(request), io::mcbp_session(shared_from_this()), ec, reason, {}, {});
         }
       }
       operations_.clear();
     }
-    config_listeners_.clear();
+    {
+      const std::scoped_lock lock(session_info_mutex_);
+      config_listeners_.clear();
+    }
     state_ = diag::endpoint_state::disconnected;
     if (auto on_stop = std::move(on_stop_handler_); on_stop) {
       on_stop();
     }
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-    if (background_bootstrap_listener_) {
-      background_bootstrap_listener_ = nullptr;
-    }
-#endif
   }
 
   void write(std::vector<std::byte>&& buf)
@@ -1445,8 +1448,7 @@ public:
       return;
     }
     CB_LOG_TRACE("{} MCBP send {}", log_prefix_, mcbp_header_view(buf));
-    const std::scoped_lock lock(output_buffer_mutex_);
-    output_buffer_.emplace_back(std::move(buf));
+    output_queue_.stage(std::move(buf));
   }
 
   void flush()
@@ -1454,9 +1456,13 @@ public:
     if (stopped_) {
       return;
     }
-    asio::post(asio::bind_executor(ctx_, [self = shared_from_this()]() {
-      self->do_write();
-    }));
+    // Only post when the queue was idle; while a write is scheduled or in flight the completion
+    // handler re-drives do_write, so an extra post would be wasted work on the hot path.
+    if (output_queue_.mark_for_dispatch()) {
+      asio::post(asio::bind_executor(ctx_, [self = shared_from_this()]() {
+        self->do_write();
+      }));
+    }
   }
 
   void write_and_flush(std::vector<std::byte>&& buf)
@@ -1464,8 +1470,13 @@ public:
     if (stopped_) {
       return;
     }
-    write(std::move(buf));
-    flush();
+    CB_LOG_TRACE("{} MCBP send {}", log_prefix_, mcbp_header_view(buf));
+    // Stage the buffer and post do_write only on the idle -> scheduled transition (single lock).
+    if (output_queue_.enqueue(std::move(buf))) {
+      asio::post(asio::bind_executor(ctx_, [self = shared_from_this()]() {
+        self->do_write();
+      }));
+    }
   }
 
   void remove_request(std::shared_ptr<mcbp::queue_request> request) override
@@ -1494,11 +1505,7 @@ public:
     command_handler fun{};
     {
       const std::scoped_lock lock(command_handlers_mutex_);
-      if (auto handler = command_handlers_.find(opaque);
-          handler != command_handlers_.end() && handler->second) {
-        fun = std::move(handler->second);
-        command_handlers_.erase(handler);
-      }
+      fun = command_handlers_.take(opaque);
     }
 
     auto reason = status == static_cast<std::uint16_t>(key_value_status_code::not_my_vbucket)
@@ -1527,6 +1534,7 @@ public:
     }
     if (request) {
       handler->handle_response(std::move(request),
+                               io::mcbp_session(shared_from_this()),
                                protocol::map_status_code(opcode, status),
                                reason,
                                std::move(msg),
@@ -1551,6 +1559,7 @@ public:
       CB_LOG_WARNING("cancel operation while trying to write to closed mcbp session, opaque={}",
                      opaque);
       handler->handle_response(request,
+                               io::mcbp_session(shared_from_this()),
                                errc::common::request_canceled,
                                retry_reason::socket_closed_while_in_flight,
                                {},
@@ -1586,7 +1595,7 @@ public:
     }
     {
       const std::scoped_lock lock(command_handlers_mutex_);
-      command_handlers_.try_emplace(opaque, std::move(handler));
+      command_handlers_.insert(opaque, std::move(handler));
     }
     if (bootstrapped_ && stream_->is_open()) {
       write_and_flush(std::move(data));
@@ -1608,33 +1617,34 @@ public:
     if (stopped_) {
       return false;
     }
-    command_handlers_mutex_.lock();
-    if (auto handler = command_handlers_.find(opaque); handler != command_handlers_.end()) {
-      CB_LOG_DEBUG("{} MCBP cancel operation, opaque={}, ec={} ({})",
-                   log_prefix_,
-                   opaque,
-                   ec.value(),
-                   ec.message());
-      if (handler->second) {
-        auto fun = std::move(handler->second);
-        command_handlers_.erase(handler);
-        command_handlers_mutex_.unlock();
-        fun(ec, reason, {}, {});
-        return true;
-      }
+    std::unique_lock lock(command_handlers_mutex_);
+    auto fun = command_handlers_.take(opaque);
+    if (!fun) {
+      return false;
     }
-    command_handlers_mutex_.unlock();
-    return false;
+    CB_LOG_DEBUG("{} MCBP cancel operation, opaque={}, ec={} ({})",
+                 log_prefix_,
+                 opaque,
+                 ec.value(),
+                 ec.message());
+    // Release before invoking the handler: it must not run while holding the command-handlers
+    // lock (it may re-enter the session), and the unique_lock guarantees the mutex is freed on
+    // every path -- including an early return or an exception before this point.
+    lock.unlock();
+    fun(ec, reason, {}, {});
+    return true;
   }
 
   [[nodiscard]] auto supports_feature(protocol::hello_feature feature) -> bool
   {
+    const std::scoped_lock lock(session_info_mutex_);
     return std::find(supported_features_.begin(), supported_features_.end(), feature) !=
            supported_features_.end();
   }
 
   [[nodiscard]] auto supported_features() const -> std::vector<protocol::hello_feature>
   {
+    const std::scoped_lock lock(session_info_mutex_);
     return supported_features_;
   }
 
@@ -1704,16 +1714,6 @@ public:
     return ++opaque_;
   }
 
-  [[nodiscard]] auto last_bootstrap_error() && -> std::optional<impl::bootstrap_error>
-  {
-    return std::move(last_bootstrap_error_);
-  }
-
-  [[nodiscard]] auto last_bootstrap_error() const& -> const std::optional<impl::bootstrap_error>&
-  {
-    return last_bootstrap_error_;
-  }
-
   auto decode_error_code(std::uint16_t code) -> std::optional<key_value_error_map_info>
   {
     if (error_map_) {
@@ -1727,6 +1727,7 @@ public:
 
   void on_configuration_update(std::shared_ptr<config_listener> handler)
   {
+    const std::scoped_lock lock(session_info_mutex_);
     config_listeners_.emplace_back(std::move(handler));
   }
 
@@ -1790,10 +1791,13 @@ public:
     config_.reset();
     config_.emplace(std::move(config));
     configured_ = true;
-    for (const auto& listener : config_listeners_) {
-      asio::post(asio::bind_executor(ctx_, [listener, c = config_.value()]() mutable {
-        return listener->update_config(std::move(c));
-      }));
+    {
+      const std::scoped_lock listeners_lock(session_info_mutex_);
+      for (const auto& listener : config_listeners_) {
+        asio::post(asio::bind_executor(ctx_, [listener, c = config_.value()]() mutable {
+          return listener->update_config(std::move(c));
+        }));
+      }
     }
   }
 
@@ -1808,25 +1812,27 @@ public:
       auto magic = static_cast<protocol::magic>(msg.header.magic);
       const std::uint8_t extras_size = msg.header.extlen;
       std::uint8_t framing_extras_size = 0;
-      std::uint16_t key_size = utils::byte_swap(msg.header.keylen);
+      std::uint16_t key_size = utils::network_to_host(msg.header.keylen);
       if (magic == protocol::magic::alt_client_response) {
-        framing_extras_size = static_cast<std::uint8_t>(msg.header.keylen >> 8U);
-        key_size = msg.header.keylen & 0xffU;
+        const auto sizes = msg.header.alt_sizes();
+        framing_extras_size = sizes.framing_extras;
+        key_size = sizes.key;
       }
 
       const std::vector<std::uint8_t>::difference_type offset =
         framing_extras_size + key_size + extras_size;
-      if (utils::byte_swap(msg.header.bodylen) - offset > 0) {
-        std::string_view config_text{ reinterpret_cast<const char*>(msg.body.data()) + offset,
-                                      msg.body.size() - static_cast<std::size_t>(offset) };
+      if (utils::network_to_host(msg.header.bodylen) - offset > 0) {
+        const std::string_view config_text{ reinterpret_cast<const char*>(msg.body.data()) + offset,
+                                            msg.body.size() - static_cast<std::size_t>(offset) };
         if (origin_.options().dump_configuration) {
           CB_LOG_TRACE(
-            "{} configuration from not_my_vbucket response (size={}, endpoint=\"{}:{}\"), {}",
+            "{} configuration from not_my_vbucket response (size={}, endpoint=\"{}\"), {}",
             log_prefix_,
             config_text.size(),
-            bootstrap_hostname_,
-            bootstrap_port_number_,
-            config_text);
+            logger::system_data(fmt::format("{}:{}", bootstrap_hostname_, bootstrap_port_number_)),
+            // an opt-in dump, it exists to show the exact bytes. That is the
+            // "none at all" case of the rule in redaction.hxx.
+            logger::not_redacted(config_text));
         }
         auto config =
           protocol::parse_config(config_text, bootstrap_hostname_, bootstrap_port_number_);
@@ -1834,7 +1840,7 @@ public:
           "{} received not_my_vbucket status for {}, opaque={} with config rev={} in the payload",
           log_prefix_,
           protocol::client_opcode(msg.header.opcode),
-          utils::byte_swap(msg.header.opaque),
+          utils::network_to_host(msg.header.opaque),
           config.rev_str());
         update_configuration(std::move(config));
       }
@@ -1854,15 +1860,19 @@ public:
     collection_cache_.update(path, uid);
   }
 
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-  void add_background_bootstrap_listener(
-    std::shared_ptr<columnar::background_bootstrap_listener> listener)
+private:
+  /**
+   * The bucket name for the log prefix, or an untagged "-" when the session is not bound to a
+   * bucket.
+   */
+  [[nodiscard]] auto log_prefix_bucket_name() const -> std::string
   {
-    background_bootstrap_listener_ = std::move(listener);
+    if (!bucket_name_.has_value()) {
+      return "-";
+    }
+    return fmt::format("{}", logger::metadata(bucket_name_.value()));
   }
-#endif
 
-private:
   void invoke_bootstrap_handler(std::error_code ec)
   {
     connection_deadline_.cancel();
@@ -1952,10 +1962,9 @@ private:
       return initiate_bootstrap();
     }
     endpoints_ = endpoints;
-    CB_LOG_TRACE("{} resolved \"{}:{}\" to {} endpoint(s)",
+    CB_LOG_TRACE("{} resolved \"{}\" to {} endpoint(s)",
                  log_prefix_,
-                 bootstrap_hostname_,
-                 bootstrap_port_,
+                 logger::system_data(bootstrap_address_),
                  endpoints_.size());
     do_connect(endpoints_.begin());
   }
@@ -1969,12 +1978,10 @@ private:
     if (it != endpoints_.end()) {
       auto hostname = it->endpoint().address().to_string();
       auto port = it->endpoint().port();
-      CB_LOG_DEBUG("{} connecting to {}:{} (\"{}:{}\"), timeout={}ms",
+      CB_LOG_DEBUG("{} connecting to {} (\"{}\"), timeout={}ms",
                    log_prefix_,
-                   hostname,
-                   port,
-                   bootstrap_hostname_,
-                   bootstrap_port_,
+                   logger::system_data(fmt::format("{}:{}", hostname, port)),
+                   logger::system_data(bootstrap_address_),
                    origin_.options().connect_timeout.count());
       connection_deadline_.expires_after(origin_.options().connect_timeout);
       connection_deadline_.async_wait(
@@ -1982,17 +1989,16 @@ private:
           if (timer_ec == asio::error::operation_aborted || self->stopped_) {
             return;
           }
-          CB_LOG_DEBUG("{} unable to connect to {}:{} (\"{}:{}\") in time, reconnecting",
+          CB_LOG_DEBUG("{} unable to connect to {} (\"{}\") in time, reconnecting",
                        self->log_prefix_,
-                       hostname,
-                       port,
-                       self->bootstrap_hostname_,
-                       self->bootstrap_port_);
+                       logger::system_data(fmt::format("{}:{}", hostname, port)),
+                       logger::system_data(self->bootstrap_address_));
           self->initiate_bootstrap();
         });
-      stream_->async_connect(it->endpoint(), [capture0 = shared_from_this(), it](auto&& PH1) {
-        capture0->on_connect(std::forward<decltype(PH1)>(PH1), it);
-      });
+      stream_->async_connect(
+        it->endpoint(), bootstrap_hostname_, [self = shared_from_this(), it](auto&& ec) {
+          self->on_connect(std::forward<decltype(ec)>(ec), it);
+        });
     } else {
       auto error_msg =
         fmt::format("no more endpoints left to connect to \"{}:{}\", will try another address",
@@ -2028,10 +2034,10 @@ private:
                              ? ERR_error_string(static_cast<unsigned long>(ec.value()), nullptr)
                              : ec.message();
 #endif
-      CB_LOG_WARNING("{} unable to connect to {}:{}: {} ({}){}. is_open={}",
+      CB_LOG_WARNING("{} unable to connect to {}: {} ({}){}. is_open={}",
                      log_prefix_,
-                     it->endpoint().address().to_string(),
-                     it->endpoint().port(),
+                     logger::system_data(fmt::format(
+                       "{}:{}", it->endpoint().address().to_string(), it->endpoint().port())),
                      ec.value(),
                      error_message,
                      (ec == asio::error::connection_refused)
@@ -2042,10 +2048,11 @@ private:
         stream_->close([self = shared_from_this(), next_address = ++it](std::error_code ec) {
           if (ec) {
             CB_LOG_WARNING(
-              "{} unable to close socket, but continue connecting attempt to {}:{}: {}",
+              "{} unable to close socket, but continue connecting attempt to {}: {}",
               self->log_prefix_,
-              next_address->endpoint().address().to_string(),
-              next_address->endpoint().port(),
+              logger::system_data(fmt::format("{}:{}",
+                                              next_address->endpoint().address().to_string(),
+                                              next_address->endpoint().port())),
               ec.value());
           }
           self->do_connect(next_address);
@@ -2056,24 +2063,31 @@ private:
     } else {
       stream_->set_options();
       connection_endpoints_ = { it->endpoint(), stream_->local_endpoint() };
-      CB_LOG_DEBUG("{} connected to {}:{}:{}",
+      CB_LOG_DEBUG("{} connected to {}",
                    log_prefix_,
-                   connection_endpoints_.local.port(),
-                   connection_endpoints_.remote_address,
-                   connection_endpoints_.remote.port());
-      log_prefix_ = fmt::format("[{}/{}/{}/{}] <{}:{}/{}:{}>",
-                                client_id_,
-                                id_,
-                                stream_->log_prefix(),
-                                bucket_name_.value_or("-"),
-                                connection_endpoints_.local.port(),
-                                bootstrap_hostname_,
-                                connection_endpoints_.remote_address,
-                                connection_endpoints_.remote.port());
-      parser_.reset();
+                   logger::system_data(fmt::format("{}:{}:{}",
+                                                   connection_endpoints_.local.port(),
+                                                   connection_endpoints_.remote_address,
+                                                   connection_endpoints_.remote.port())));
       {
-        const std::scoped_lock lock(output_buffer_mutex_);
-        output_buffer_.clear();
+        const std::scoped_lock lock(session_info_mutex_);
+        const auto endpoints = fmt::format("{}:{}/{}:{}",
+                                           connection_endpoints_.local.port(),
+                                           bootstrap_hostname_,
+                                           connection_endpoints_.remote_address,
+                                           connection_endpoints_.remote.port());
+        log_prefix_ = fmt::format("[{}/{}/{}/{}] <{}>",
+                                  client_id_,
+                                  id_,
+                                  stream_->log_prefix(),
+                                  log_prefix_bucket_name(),
+                                  logger::system_data(endpoints));
+      }
+      parser_.reset();
+      output_queue_.reset();
+      // cppcheck-suppress knownConditionTrueFalse
+      if (stopped_) {
+        return;
       }
       bootstrap_handler_ = std::make_shared<bootstrap_handler>(shared_from_this());
 
@@ -2082,14 +2096,13 @@ private:
         if (timer_ec == asio::error::operation_aborted || self->stopped_) {
           return;
         }
-        CB_LOG_DEBUG(
-          "{} unable to boostrap single node at {}:{}:{} (\"{}:{}\") in time, reconnecting",
-          self->log_prefix_,
-          self->connection_endpoints_.local.port(),
-          self->connection_endpoints_.remote_address,
-          self->connection_endpoints_.remote.port(),
-          self->bootstrap_hostname_,
-          self->bootstrap_port_);
+        CB_LOG_DEBUG("{} unable to bootstrap single node at {} (\"{}\") in time, reconnecting",
+                     self->log_prefix_,
+                     logger::system_data(fmt::format("{}:{}:{}",
+                                                     self->connection_endpoints_.local.port(),
+                                                     self->connection_endpoints_.remote_address,
+                                                     self->connection_endpoints_.remote.port())),
+                     logger::system_data(self->bootstrap_address_));
         return self->initiate_bootstrap();
       });
     }
@@ -2151,6 +2164,10 @@ private:
 
         for (;;) {
           mcbp_message msg{};
+          // Start from a recycled buffer (if any) and tag the message with the pool so the frame
+          // buffer is returned when the decoded response is destroyed on this IO thread.
+          msg.body = tls_response_body_pool().acquire();
+          msg.recycle_body = true;
           switch (self->parser_.next(msg)) {
             case mcbp_parser::result::ok: {
               if (self->stopped_) {
@@ -2158,16 +2175,26 @@ private:
               }
               CB_LOG_TRACE(
                 "{} MCBP recv {}", self->log_prefix_, mcbp_header_view(msg.header_data()));
+              // Copy the handler's shared_ptr into a local before dispatching.
+              // handle() can trigger a nested stop() (e.g. reauth failure) that
+              // releases the session's own strong ref to the handler; the local
+              // copy keeps it alive for the duration of the call so it is not
+              // freed mid-dispatch (CXXCBC-842).
               if (self->bootstrapped_) {
-                self->handler_->handle(std::move(msg));
-              } else if (self->bootstrap_handler_) {
-                self->bootstrap_handler_->handle(std::move(msg));
+                if (auto h = self->handler_; h) {
+                  h->handle(std::move(msg));
+                }
+              } else if (auto h = self->bootstrap_handler_; h) {
+                h->handle(std::move(msg));
               }
               if (self->stopped_) {
                 return;
               }
             } break;
             case mcbp_parser::result::need_data:
+              // The frame is incomplete, so next() did not consume the buffer we handed it; return
+              // it to the pool instead of letting this partial-read iteration drain the pool.
+              tls_response_body_pool().release(std::move(msg.body));
               self->reading_ = false;
               if (!self->stopped_ && self->stream_->is_open()) {
                 self->do_read();
@@ -2185,14 +2212,12 @@ private:
     if (stopped_ || !stream_->is_open()) {
       return;
     }
-    const std::scoped_lock lock(writing_buffer_mutex_, output_buffer_mutex_);
-    if (!writing_buffer_.empty() || output_buffer_.empty()) {
+    if (!output_queue_.begin_writing()) {
       return;
     }
-    std::swap(writing_buffer_, output_buffer_);
     std::vector<asio::const_buffer> buffers;
-    buffers.reserve(writing_buffer_.size());
-    for (auto& buf : writing_buffer_) {
+    buffers.reserve(output_queue_.writing().size());
+    for (const auto& buf : output_queue_.writing()) {
       CB_LOG_PROTOCOL("[MCBP, OUT] host=\"{}\", sport={}, dport={}, buffer_size={}{:a}",
                       connection_endpoints_.remote_address,
                       connection_endpoints_.local.port(),
@@ -2222,10 +2247,7 @@ private:
                        ec.message());
           return self->stop(retry_reason::socket_closed_while_in_flight);
         }
-        {
-          const std::scoped_lock inner_lock(self->writing_buffer_mutex_);
-          self->writing_buffer_.clear();
-        }
+        self->output_queue_.finish_writing();
         asio::post(asio::bind_executor(self->ctx_, [self]() {
           self->do_write();
           self->do_read();
@@ -2235,6 +2257,7 @@ private:
 
   const std::string client_id_;
   std::string node_uuid_;
+  app_telemetry_recorder_cache app_telemetry_recorder_cache_{};
   const std::string id_{ uuid::to_string(uuid::random()) };
   asio::io_context& ctx_;
   asio::ip::tcp::resolver resolver_;
@@ -2254,7 +2277,7 @@ private:
   utils::movable_function<void(std::error_code, const topology::configuration&)>
     bootstrap_callback_{};
   std::mutex command_handlers_mutex_{};
-  std::map<std::uint32_t, command_handler> command_handlers_{};
+  opaque_ring_table<command_handler> command_handlers_{};
   std::vector<std::shared_ptr<config_listener>> config_listeners_{};
   utils::movable_function<void()> on_stop_handler_{};
 
@@ -2269,18 +2292,16 @@ private:
   std::atomic<std::uint32_t> opaque_{ 0 };
 
   std::array<std::byte, 16384> input_buffer_{};
-  std::vector<std::vector<std::byte>> output_buffer_{};
+  mcbp_output_queue output_queue_{};
   std::vector<std::vector<std::byte>> pending_buffer_{};
-  std::vector<std::vector<std::byte>> writing_buffer_{};
-  std::mutex output_buffer_mutex_{};
   std::mutex pending_buffer_mutex_{};
-  std::mutex writing_buffer_mutex_{};
   std::string bootstrap_hostname_{};
   std::string bootstrap_port_{};
   std::string bootstrap_address_{};
   std::uint16_t bootstrap_port_number_{};
   connection_endpoints connection_endpoints_{ {}, {} };
   asio::ip::tcp::resolver::results_type endpoints_;
+  mutable std::mutex session_info_mutex_{};
   std::vector<protocol::hello_feature> supported_features_;
   std::optional<topology::configuration> config_;
   mutable std::mutex config_mutex_{};
@@ -2306,11 +2327,6 @@ private:
   std::string log_prefix_{};
   std::chrono::time_point<std::chrono::steady_clock> last_active_{};
   std::atomic<diag::endpoint_state> state_{ diag::endpoint_state::disconnected };
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-  std::shared_ptr<columnar::background_bootstrap_listener> background_bootstrap_listener_{
-    nullptr
-  };
-#endif
 };
 
 mcbp_session::mcbp_session(const std::string& client_id,
@@ -2349,8 +2365,13 @@ mcbp_session::mcbp_session(const std::string& client_id,
 {
 }
 
+mcbp_session::mcbp_session(std::shared_ptr<mcbp_session_impl> impl)
+  : impl_{ std::move(impl) }
+{
+}
+
 auto
-mcbp_session::log_prefix() const -> const std::string&
+mcbp_session::log_prefix() const -> std::string
 {
   return impl_->log_prefix();
 }
@@ -2409,6 +2430,14 @@ mcbp_session::node_uuid() const -> const std::string&
   return impl_->node_uuid();
 }
 
+auto
+mcbp_session::app_telemetry_recorder(app_telemetry_meter& meter,
+                                     const std::string& bucket_name) const
+  -> std::shared_ptr<app_telemetry_value_recorder>
+{
+  return impl_->app_telemetry_recorder(meter, bucket_name);
+}
+
 auto
 mcbp_session::bootstrap_address() const -> const std::string&
 {
@@ -2457,18 +2486,6 @@ mcbp_session::bootstrap_port_number() const -> std::uint16_t
   return impl_->bootstrap_port_number();
 }
 
-auto
-mcbp_session::last_bootstrap_error() && -> std::optional<impl::bootstrap_error>
-{
-  return std::move(impl_)->last_bootstrap_error();
-}
-
-auto
-mcbp_session::last_bootstrap_error() const& -> const std::optional<impl::bootstrap_error>&
-{
-  return impl_->last_bootstrap_error();
-}
-
 auto
 mcbp_session::canonical_hostname() const -> const std::string&
 {
@@ -2601,13 +2618,4 @@ mcbp_session::write_and_flush(std::vector<std::byte>&& buffer)
   return impl_->write_and_flush(std::move(buffer));
 }
 
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-void
-mcbp_session::add_background_bootstrap_listener(
-  std::shared_ptr<columnar::background_bootstrap_listener> listener)
-{
-  return impl_->add_background_bootstrap_listener(std::move(listener));
-}
-#endif
-
 } // namespace couchbase::core::io