@mark1russell7/machines 0.3.31 → 0.3.32

package/build/index.js

@@ -3792,10 +3792,19 @@ var linux_tcp_default = {
 				],
 				"unit": "s"
 			},
+			"early": {
+				"model": "linux.syn-giveup-early",
+				"knobs": [
+					"tcp_syn_retries",
+					"tcp_syn_linear_timeouts",
+					"hz"
+				],
+				"unit": "s"
+			},
 			"arms": ["enter:SYN_SENT"],
 			"cancels": ["rx.synack", "rx.rst"],
 			"fires": "timer.syn.exhausted",
-			"note": "6.6: linear 1 s waits for the first tcp_syn_linear_timeouts retransmissions, then doubling; 131 s at the defaults. Each wait is a timer of the wheel, rounded up at its level: up to 6.08 s late in all at HZ 1000, because the wait of 64 s can be 4.096 s late"
+			"note": "6.6: linear 1 s waits for the first tcp_syn_linear_timeouts retransmissions, then doubling; 131 s at the defaults. A firing gives up by count, after tcp_syn_retries + tcp_syn_linear_timeouts retransmissions, or by time, after the budget of tcp_model_timeout for tcp_syn_retries alone: 7 s at tcp_syn_retries 2, before the count of 11 s. Each wait is a timer of the wheel, rounded up at its level: up to 6.08 s late in all at HZ 1000, because the wait of 64 s can be 4.096 s late"
 		},
 		"syn_retransmit": {
 			"duration": {
@@ -5333,6 +5342,720 @@ const KUBELET_READINESS = machineSchema.parse({
 	}]
 });
 //#endregion
+//#region src/kafka/group.ts
+const GROUP = "kafka 4.3.2 group-coordinator/src/main/java/org/apache/kafka/coordinator/group";
+const INTERNALS = "kafka 4.3.2 clients/src/main/java/org/apache/kafka/clients/consumer/internals";
+/**
+* This document is Apache Kafka 4.3.2, for one member of a consumer group that a process stop holds.
+* It gives when the coordinator removes the member, and when another member gets its partition. It
+* also gives the answer to a commit of the old offsets after the stop.
+*
+* In the consumer protocol the session is a setting of the broker. Each heartbeat starts the session
+* timer again. The last heartbeat came up to one interval before the stop, thus the fence comes one
+* session after the stop, less up to one interval. The other member takes the partition at one of its
+* own heartbeats after the fence.
+*
+* A commit of the member after the fence gets UNKNOWN_MEMBER_ID, and the client throws
+* CommitFailedException. The rejoin changes this. A member that polls after the fence joins again at
+* epoch 0 and gets a new epoch. The commit check at the same epoch asks no question about who owns the
+* partition. Thus the broker accepts a commit of the old offsets at the new epoch. That commit moves
+* the committed offset back while another member owns the partition.
+*/
+const KAFKA_CONSUMER_GROUP = machineSchema.parse({
+	format: "mark1russell7.machine/1",
+	id: "kafka-consumer-group",
+	title: "Apache Kafka 4.3.2: one member of a consumer group under a process stop, its fence, the takeover of its partition and its commit after the stop",
+	layer: "server",
+	version: "4.3.2",
+	conditions: {
+		kafka: "4.3.2",
+		mode: "KRaft, with one controller that is not a broker",
+		group: "two members and two partitions, with one partition for each member before the stop",
+		fault: "a stop of the process of one member, for a time, in the processing of one batch"
+	},
+	sources: [
+		{
+			ref: `${GROUP}/GroupCoordinatorConfig.java:184-204 the session of the consumer protocol is 45000, its minimum 45000, its maximum 60000, and the heartbeat interval is 5000`,
+			rung: "implemented"
+		},
+		{
+			ref: `${GROUP}/GroupCoordinatorConfig.java:592-598 the session is at or above its minimum and at or below its maximum, and the interval is below the session`,
+			rung: "implemented"
+		},
+		{
+			ref: `${GROUP}/GroupCoordinatorConfig.java:163-168 the classic session is between 6000 and 1800000, a value that the client sets`,
+			rung: "implemented"
+		},
+		{
+			ref: `${GROUP}/GroupMetadataManager.java:2475 each heartbeat schedules the session again, and :4775-4787 the timer fences the member`,
+			rung: "implemented"
+		},
+		{
+			ref: `${GROUP}/GroupMetadataManager.java:4687 the log line of a fence of the consumer protocol, and :7026 the line of a classic member`,
+			rung: "implemented"
+		},
+		{
+			ref: `${GROUP}/GroupMetadataManager.java:4358 the fence removes the member, raises the group epoch and cancels the timers of the member`,
+			rung: "implemented"
+		},
+		{
+			ref: `${GROUP}/GroupMetadataManager.java:3867 and :3900-3947 the next heartbeat of another member computes the target and reconciles`,
+			rung: "implemented"
+		},
+		{
+			ref: `${GROUP}/modern/consumer/ConsumerGroup.java:649-690 a commit of a member that is gone gets UNKNOWN_MEMBER_ID, and a commit at the epoch of the member passes with no check of who owns the partition`,
+			rung: "implemented"
+		},
+		{
+			ref: `${INTERNALS}/CommitRequestManager.java:826-832 a commit sends the member and the epoch, and :901-905 UNKNOWN_MEMBER_ID becomes CommitFailedException`,
+			rung: "implemented"
+		},
+		{
+			ref: `${INTERNALS}/AbstractHeartbeatRequestManager.java:427-442 a fenced epoch and an unknown member both fence the client`,
+			rung: "implemented"
+		},
+		{
+			ref: `${INTERNALS}/AbstractMembershipManager.java:388 a fenced client resets its epoch, signals the lost partitions, clears its assignment and joins again`,
+			rung: "implemented"
+		},
+		{
+			ref: `${INTERNALS}/ConsumerMembershipManager.java:367-374 with a listener, the lost callback waits for the poll of the application`,
+			rung: "implemented"
+		},
+		{
+			ref: `${INTERNALS}/AsyncKafkaConsumer.java:1006 a poll runs the callbacks, thus the rejoin follows the poll`,
+			rung: "implemented"
+		},
+		{
+			ref: `${INTERNALS}/ConsumerCoordinator.java:1312-1325 and :1433-1448 a classic commit with no generation, or with UNKNOWN_MEMBER_ID, gets CommitFailedException`,
+			rung: "implemented"
+		}
+	],
+	states: {
+		stable: {
+			initial: true,
+			note: "the coordinator holds the member, and the member holds its partition"
+		},
+		fenced: { note: "the coordinator removed the member, and the stopped client does not know" },
+		rejoined: { note: "the client joined again and has a new epoch, and another member can own its old partition" }
+	},
+	events: {
+		"rx.heartbeat": {
+			kind: "rx",
+			note: "a heartbeat of this member reaches the coordinator"
+		},
+		"rx.commit": {
+			kind: "rx",
+			note: "a commit of the old offsets, at the epoch of the member"
+		},
+		"rx.commit-after-fence": {
+			kind: "rx",
+			note: "a commit of the old offsets from a member that the coordinator removed"
+		},
+		"local.poll": {
+			kind: "local",
+			note: "the application polls after the thaw"
+		},
+		"timer.session": {
+			kind: "timer",
+			note: "the session of the member ends in the coordinator"
+		},
+		"timer.takeover": {
+			kind: "timer",
+			note: "a heartbeat of the other member after the fence gives it the partition"
+		}
+	},
+	knobs: {
+		consumer_session_timeout: {
+			key: "group.consumer.session.timeout.ms",
+			scope: "broker",
+			unit: "ms",
+			default: 45e3,
+			note: "GroupCoordinatorConfig.java:184"
+		},
+		consumer_heartbeat_interval: {
+			key: "group.consumer.heartbeat.interval.ms",
+			scope: "broker",
+			unit: "ms",
+			default: 5e3,
+			note: "GroupCoordinatorConfig.java:196"
+		},
+		classic_session_timeout: {
+			key: "session.timeout.ms",
+			scope: "client",
+			unit: "ms",
+			default: 45e3,
+			note: "a value of the client, between the limits at GroupCoordinatorConfig.java:163-168"
+		},
+		classic_heartbeat_interval: {
+			key: "heartbeat.interval.ms",
+			scope: "client",
+			unit: "ms",
+			default: 3e3,
+			note: "a value of the client"
+		},
+		early_slack: {
+			key: "the time from a heartbeat of the client to its arrival at the coordinator",
+			scope: "broker",
+			unit: "ms",
+			default: 100,
+			note: "an assumption of this document, not a value of Kafka"
+		},
+		late_slack: {
+			key: "the time from the end of a session to the line of the fence, and to the takeover",
+			scope: "broker",
+			unit: "ms",
+			default: 1e3,
+			note: "an assumption of this document, not a value of Kafka: the timer wheel and the write of the coordinator"
+		},
+		takeover_slack: {
+			key: "the time from a heartbeat of the other member to its report of the partition",
+			scope: "broker",
+			unit: "ms",
+			default: 500,
+			note: "an assumption of this document, not a value of Kafka: the reconcile and the next poll"
+		}
+	},
+	timers: {
+		fence: {
+			duration: {
+				expr: "consumer_session_timeout",
+				unit: "ms"
+			},
+			early: {
+				expr: "consumer_heartbeat_interval + early_slack",
+				unit: "ms"
+			},
+			lateness: {
+				expr: "late_slack",
+				unit: "ms"
+			},
+			arms: ["enter:stable"],
+			cancels: ["rx.heartbeat"],
+			fires: "timer.session",
+			note: "from the stop. It runs in the coordinator"
+		},
+		takeover: {
+			duration: {
+				expr: "consumer_session_timeout",
+				unit: "ms"
+			},
+			early: {
+				expr: "consumer_heartbeat_interval + early_slack",
+				unit: "ms"
+			},
+			lateness: {
+				expr: "consumer_heartbeat_interval + late_slack + takeover_slack",
+				unit: "ms"
+			},
+			arms: ["enter:stable"],
+			fires: "timer.takeover",
+			note: "from the stop: the fence, then the next heartbeat of the other member and its next poll"
+		},
+		classic_fence: {
+			duration: {
+				expr: "classic_session_timeout",
+				unit: "ms"
+			},
+			early: {
+				expr: "classic_heartbeat_interval + early_slack",
+				unit: "ms"
+			},
+			lateness: {
+				expr: "late_slack",
+				unit: "ms"
+			},
+			arms: ["enter:stable"],
+			cancels: ["rx.heartbeat"],
+			fires: "timer.session",
+			note: "from the stop, for a classic member. It runs in the coordinator"
+		}
+	},
+	transitions: [
+		{
+			id: "group.heartbeat",
+			from: "stable",
+			to: "stable",
+			on: "rx.heartbeat",
+			note: "the session starts again",
+			source: "GroupMetadataManager.java:2475"
+		},
+		{
+			id: "group.commit",
+			from: "stable",
+			to: "stable",
+			on: "rx.commit",
+			emits: ["reply"],
+			note: "a stop below the session: the epoch is the same, and the commit passes",
+			source: "ConsumerGroup.java:649-690"
+		},
+		{
+			id: "group.fence",
+			from: "stable",
+			to: "fenced",
+			on: "timer.session",
+			emits: ["fence line"],
+			note: "the coordinator removes the member and raises the group epoch",
+			source: "GroupMetadataManager.java:4358, :4687, :4775-4787, :7026"
+		},
+		{
+			id: "group.takeover",
+			from: "fenced",
+			to: "fenced",
+			on: "timer.takeover",
+			note: "the other member owns the partition and reads from the last committed offset",
+			source: "GroupMetadataManager.java:3867, :3900-3947"
+		},
+		{
+			id: "group.commit-fails",
+			from: "fenced",
+			to: "fenced",
+			on: "rx.commit-after-fence",
+			emits: ["UNKNOWN_MEMBER_ID"],
+			note: "the client throws CommitFailedException",
+			source: "ConsumerGroup.java:649-690, CommitRequestManager.java:901-905, ConsumerCoordinator.java:1433-1448"
+		},
+		{
+			id: "group.rejoin",
+			from: "fenced",
+			to: "rejoined",
+			on: "local.poll",
+			note: "the client signals the lost partitions, clears its assignment and joins at epoch 0",
+			source: "AbstractMembershipManager.java:388, ConsumerMembershipManager.java:367-374, AsyncKafkaConsumer.java:1006"
+		},
+		{
+			id: "group.stale-commit",
+			from: "rejoined",
+			to: "rejoined",
+			on: "rx.commit",
+			emits: ["reply"],
+			note: "the check at the same epoch asks no question about who owns the partition, thus the committed offset moves back",
+			source: "ConsumerGroup.java:649-690"
+		}
+	]
+});
+//#endregion
+//#region src/kafka/partition.ts
+const CORE = "kafka 4.3.2 core/src/main/scala/kafka";
+const SERVER = "kafka 4.3.2 server/src/main/java/org/apache/kafka/server";
+const STORAGE = "kafka 4.3.2 storage/src/main/java/org/apache/kafka/storage/internals/log";
+const CONTROLLER = "kafka 4.3.2 metadata/src/main/java/org/apache/kafka/controller";
+const RAFT = "kafka 4.3.2 raft/src/main/java/org/apache/kafka/raft";
+const CLIENTS = "kafka 4.3.2 clients/src/main/java/org/apache/kafka/clients";
+/**
+* This document is Apache Kafka 4.3.2, for one broker that leads one partition, in KRaft mode. It
+* gives what the broker answers at each `acks`, and how the high watermark moves. It also gives how
+* the broker loses the leadership when a fault cuts it from the other brokers and the controller.
+*
+* With `acks=1` a broker answers after its own append. With `acks=all` the write waits in a purgatory
+* until the high watermark passes it. The high watermark is the smallest log end of the maximal
+* in-sync replicas. A leader that cannot reach the controller cannot shrink that set, thus its high
+* watermark stays.
+*
+* The controller fences a broker when no heartbeat came for `broker.session.timeout.ms`, and it
+* elects another leader. The cut broker is not told, and it has no timer that stops it. It stays a
+* leader in its own view until the metadata of the change reaches it, after the cut lifts. It then
+* becomes a follower, and it ends each write in the purgatory with NOT_LEADER_OR_FOLLOWER. It fetches
+* from the new leader, which answers with the end of its log at its election. The old leader
+* truncates to that offset, not to the high watermark.
+*/
+const KAFKA_PARTITION = machineSchema.parse({
+	format: "mark1russell7.machine/1",
+	id: "kafka-partition",
+	title: "Apache Kafka 4.3.2: one broker that leads one partition, its answers at each acks, its high watermark and the loss of its leadership",
+	layer: "server",
+	version: "4.3.2",
+	conditions: {
+		kafka: "4.3.2",
+		mode: "KRaft, with one controller that is not a broker",
+		partition: "one partition with a replica on each of three brokers, unclean leader election off",
+		fault: "the leader is cut from the other brokers and the controller, and the client keeps its route to the leader"
+	},
+	sources: [
+		{
+			ref: `${CORE}/server/ReplicaManager.scala:1360-1366 a delayed produce only when requiredAcks is -1, and :911-915 each other write is answered at once`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/server/ReplicaManager.scala:885-910 the delayed produce goes in the purgatory`,
+			rung: "implemented"
+		},
+		{
+			ref: `${SERVER}/purgatory/DelayedProduce.java:139-152 it completes on an error, or when each partition has enough replicas`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/cluster/Partition.scala:947-983 acks=all completes when the high watermark passes the write, with NOT_ENOUGH_REPLICAS_AFTER_APPEND below the minimum, and NOT_LEADER_OR_FOLLOWER off the leader`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/cluster/Partition.scala:1230-1238 an append with acks=all under min.insync.replicas fails, and each other append goes on`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/cluster/Partition.scala:1010-1053 the high watermark is the smallest log end of the maximal in-sync replicas, and it does not move under the minimum`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/cluster/Partition.scala:1089-1127 and :1155-1165 the shrink of the in-sync replicas`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/cluster/Partition.scala:1636-1659 a shrink is pending until the controller commits it, and ${SERVER}/partition/PendingShrinkIsr.java:36-42 the maximal in-sync replicas stay the committed ones`,
+			rung: "implemented"
+		},
+		{
+			ref: `${SERVER}/config/ReplicationConfigs.java:55 replica.lag.time.max.ms is 30000`,
+			rung: "implemented"
+		},
+		{
+			ref: `${RAFT}/KRaftConfigs.java:40 broker.heartbeat.interval.ms is 2000, and :44 broker.session.timeout.ms is 9000`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CONTROLLER}/BrokerHeartbeatTracker.java:99-121 and :131-133 a broker expires when no heartbeat came in the session timeout`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CONTROLLER}/QuorumController.java:1659-1660 the controller looks for one stale broker each max(1 ms, session / 8), and :1672-1675 repeats`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CONTROLLER}/ReplicationControlManager.java:1769-1797 and :2110-2112 it fences the broker and moves each of its leaderships, and PartitionChangeBuilder.java:256-267 takes the first valid replica in replica order`,
+			rung: "implemented"
+		},
+		{
+			ref: `${SERVER}/BrokerLifecycleManager.java:601-604 and :619-624 a broker that gets no heartbeat reply schedules the next heartbeat, and it stops nothing`,
+			rung: "implemented"
+		},
+		{
+			ref: `${RAFT}/QuorumConfig.java:83 the fetch timeout is 2000, and :104 the retry backoff is 20`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/raft/KafkaRaftManager.scala:236-237 the reconnect backoff of the raft client is 50 to 500 ms, and :249-251 its setup timeouts are the settings of the broker`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CLIENTS}/ClusterConnectionStates.java:41 and :43 a backoff and a setup timeout take a jitter of 0.2, and :372-379 a setup that fails doubles the timeout`,
+			rung: "implemented"
+		},
+		{
+			ref: `kafka 4.3.2 server-common/src/main/java/org/apache/kafka/server/config/ServerConfigs.java:71-77 socket.connection.setup.timeout.ms on a broker`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CLIENTS}/CommonClientConfigs.java:139 and :144 socket.connection.setup.timeout.ms is 10000, and its maximum is 30000`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/server/ReplicaManager.scala:2448-2544 the delta of a follower: makeFollower at :2472, a new fetcher at :2535, and each delayed write ends at :2539`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/cluster/Partition.scala:1383-1413 a leader answers a fetch of an older epoch with the diverging epoch, and ${CORE}/server/AbstractFetcherThread.scala:603-641 the follower truncates to the end of that epoch`,
+			rung: "implemented"
+		},
+		{
+			ref: `${CORE}/cluster/Partition.scala:635-649 makeLeader, and :694-743 makeFollower`,
+			rung: "implemented"
+		},
+		{
+			ref: `${STORAGE}/UnifiedLog.java:1411-1421 and :1261-1268 an idempotent batch that repeats is not appended, and the answer gives its first offset`,
+			rung: "implemented"
+		},
+		{
+			ref: `${STORAGE}/ProducerStateEntry.java:35 and :128-135 the broker keeps the last 5 batches of each producer, and a repeat has their exact range of sequence numbers`,
+			rung: "implemented"
+		}
+	],
+	states: {
+		leader: {
+			initial: true,
+			note: "the controller and the broker agree that the broker leads"
+		},
+		deposed: { note: "the controller moved the leadership, and the broker does not know. It appends each write. It answers acks=1, and acks=all waits, because no fetch reaches it and its high watermark stays" },
+		follower: { note: "the broker fetches from the new leader" }
+	},
+	events: {
+		"rx.produce-1": {
+			kind: "rx",
+			note: "a write with acks=1"
+		},
+		"rx.produce-all": {
+			kind: "rx",
+			note: "a write with acks=all, with enough in-sync replicas"
+		},
+		"rx.produce-all-short": {
+			kind: "rx",
+			note: "a write with acks=all, under min.insync.replicas"
+		},
+		"rx.produce-repeat": {
+			kind: "rx",
+			note: "an idempotent batch with the sequence numbers of one of the last 5 batches of its producer"
+		},
+		"rx.fetch": {
+			kind: "rx",
+			note: "a fetch of a follower"
+		},
+		"rx.heartbeat": {
+			kind: "rx",
+			note: "a heartbeat of this broker reaches the controller"
+		},
+		"local.lift": {
+			kind: "local",
+			note: "the cut lifts"
+		},
+		"timer.lag": {
+			kind: "timer",
+			note: "a follower did not catch up in replica.lag.time.max.ms"
+		},
+		"timer.fence": {
+			kind: "timer",
+			note: "the controller finds the session of the broker expired"
+		},
+		"timer.metadata": {
+			kind: "timer",
+			note: "the metadata of the change reaches the broker"
+		},
+		"rx.diverging-epoch": {
+			kind: "rx",
+			note: "the new leader answers a fetch with the end of the old epoch"
+		},
+		"rx.elected": {
+			kind: "rx",
+			note: "the metadata names this broker as the leader again"
+		}
+	},
+	knobs: {
+		broker_heartbeat_interval: {
+			key: "broker.heartbeat.interval.ms",
+			scope: "broker",
+			unit: "ms",
+			default: 2e3,
+			note: "KRaftConfigs.java:40"
+		},
+		broker_session_timeout: {
+			key: "broker.session.timeout.ms",
+			scope: "broker",
+			unit: "ms",
+			default: 9e3,
+			note: "KRaftConfigs.java:44"
+		},
+		replica_lag_time_max: {
+			key: "replica.lag.time.max.ms",
+			scope: "broker",
+			unit: "ms",
+			default: 3e4,
+			note: "ReplicationConfigs.java:55"
+		},
+		socket_connection_setup_timeout: {
+			key: "socket.connection.setup.timeout.ms",
+			scope: "broker",
+			unit: "ms",
+			default: 1e4,
+			note: "CommonClientConfigs.java:139"
+		},
+		raft_reconnect_backoff_max: {
+			key: "the largest reconnect backoff of the raft client",
+			scope: "build",
+			unit: "ms",
+			default: 500,
+			note: "KafkaRaftManager.scala:237"
+		},
+		connection_jitter: {
+			key: "the jitter of a setup timeout and of a backoff",
+			scope: "build",
+			unit: "count",
+			default: .2,
+			note: "ClusterConnectionStates.java:41, :43"
+		},
+		slack: {
+			key: "the round trips and the steps from the first connect to the publish of the metadata",
+			scope: "broker",
+			unit: "ms",
+			default: 100,
+			note: "an assumption of this document, not a value of Kafka: the version request, a fetch, and the publish of the batch"
+		}
+	},
+	timers: {
+		replica_lag: {
+			duration: {
+				expr: "replica_lag_time_max",
+				unit: "ms"
+			},
+			arms: ["enter:leader"],
+			cancels: ["rx.fetch"],
+			fires: "timer.lag",
+			note: "the first follower that lags. The broker asks the controller to shrink, and a cut broker gets no answer"
+		},
+		fence: {
+			duration: {
+				expr: "broker_session_timeout",
+				unit: "ms"
+			},
+			early: {
+				expr: "broker_heartbeat_interval",
+				unit: "ms"
+			},
+			lateness: {
+				expr: "max(1, broker_session_timeout / 8)",
+				unit: "ms"
+			},
+			arms: ["enter:leader"],
+			cancels: ["rx.heartbeat"],
+			fires: "timer.fence",
+			note: "from the fault. It runs in the controller"
+		},
+		step_down: {
+			duration: {
+				const: 0,
+				unit: "ms"
+			},
+			lateness: {
+				expr: "socket_connection_setup_timeout * (1 + connection_jitter) + raft_reconnect_backoff_max * (1 + connection_jitter) + slack",
+				unit: "ms"
+			},
+			arms: ["local.lift"],
+			fires: "timer.metadata",
+			note: "from the lift. No timer of Kafka: the longest wait of the raft client for its next fetch from the controller. A hold above the fetch timeout has no fetch in flight at the lift"
+		}
+	},
+	transitions: [
+		{
+			id: "kafka.append-1",
+			from: "leader",
+			to: "leader",
+			on: "rx.produce-1",
+			emits: ["reply"],
+			note: "the reply follows the local append",
+			source: "ReplicaManager.scala:911-915, :1360-1366"
+		},
+		{
+			id: "kafka.append-all",
+			from: "leader",
+			to: "leader",
+			on: "rx.produce-all",
+			note: "the write waits in the purgatory",
+			source: "ReplicaManager.scala:885-910, DelayedProduce.java:139-152"
+		},
+		{
+			id: "kafka.refuse",
+			from: "leader",
+			to: "leader",
+			on: "rx.produce-all-short",
+			emits: ["NOT_ENOUGH_REPLICAS"],
+			source: "Partition.scala:1230-1238"
+		},
+		{
+			id: "kafka.repeat",
+			from: "leader",
+			to: "leader",
+			on: "rx.produce-repeat",
+			emits: ["reply"],
+			note: "the log does not change, and the reply gives the first offset",
+			source: "UnifiedLog.java:1411-1421, ProducerStateEntry.java:128-135"
+		},
+		{
+			id: "kafka.fetch",
+			from: "leader",
+			to: "leader",
+			on: "rx.fetch",
+			emits: ["reply"],
+			note: "the high watermark moves, and each write that it passes completes",
+			source: "Partition.scala:947-983, :1010-1053"
+		},
+		{
+			id: "kafka.heartbeat",
+			from: "leader",
+			to: "leader",
+			on: "rx.heartbeat",
+			source: "BrokerHeartbeatTracker.java:99-121"
+		},
+		{
+			id: "kafka.lift-early",
+			from: "leader",
+			to: "leader",
+			on: "local.lift",
+			note: "a hold that ends before the fence: the heartbeats go on, and the leadership stays",
+			source: "BrokerLifecycleManager.java:601-604"
+		},
+		{
+			id: "kafka.shrink-pending",
+			from: "leader",
+			to: "leader",
+			on: "timer.lag",
+			note: "the shrink stays pending: the maximal in-sync replicas keep each follower",
+			source: "Partition.scala:1636-1659, PendingShrinkIsr.java:36-42"
+		},
+		{
+			id: "kafka.fenced",
+			from: "leader",
+			to: "deposed",
+			on: "timer.fence",
+			note: "the first valid replica in replica order leads, with the log end that it has",
+			source: "BrokerHeartbeatTracker.java:131-133, QuorumController.java:1659-1660, ReplicationControlManager.java:1769-1797, PartitionChangeBuilder.java:256-267"
+		},
+		{
+			id: "kafka.deposed-append-1",
+			from: "deposed",
+			to: "deposed",
+			on: "rx.produce-1",
+			emits: ["reply"],
+			note: "the broker has no check of its own fence",
+			source: "ReplicaManager.scala:911-915, BrokerLifecycleManager.java:619-624"
+		},
+		{
+			id: "kafka.deposed-append-all",
+			from: "deposed",
+			to: "deposed",
+			on: "rx.produce-all",
+			note: "the write waits: the high watermark stays",
+			source: "Partition.scala:969, :1028-1032"
+		},
+		{
+			id: "kafka.deposed-shrink",
+			from: "deposed",
+			to: "deposed",
+			on: "timer.lag",
+			note: "the shrink stays pending",
+			source: "Partition.scala:1636-1659"
+		},
+		{
+			id: "kafka.deposed-lift",
+			from: "deposed",
+			to: "deposed",
+			on: "local.lift",
+			note: "the wait for the metadata starts",
+			source: "KafkaRaftManager.scala:236-237, :249-251"
+		},
+		{
+			id: "kafka.step-down",
+			from: "deposed",
+			to: "follower",
+			on: "timer.metadata",
+			emits: ["NOT_LEADER_OR_FOLLOWER"],
+			note: "each write in the purgatory ends, and the producer sends it to the new leader",
+			source: "ReplicaManager.scala:2448-2544, Partition.scala:694-743"
+		},
+		{
+			id: "kafka.truncate",
+			from: "follower",
+			to: "follower",
+			on: "rx.diverging-epoch",
+			note: "the log ends at the end of the new leader's log at its election",
+			source: "Partition.scala:1383-1413, AbstractFetcherThread.scala:603-641"
+		},
+		{
+			id: "kafka.elected",
+			from: "follower",
+			to: "leader",
+			on: "rx.elected",
+			source: "Partition.scala:635-649"
+		}
+	]
+});
+//#endregion
 //#region src/mongo/mongod-replication.ts
 const AT$13 = "mongodb r9.0.4 src/mongo/db/repl";
 /**
@@ -9588,6 +10311,18 @@ const PGBOUNCER_SERVER = machineSchema.parse({
 			ref: `${PB} src/objects.c:1876-1897 launch_new_connection: one connect of a pool at a time, and none for server_login_retry from the launch of a failed one`,
 			rung: "implemented"
 		},
+		{
+			ref: `${PB} src/server.c:294-303 pool_pool_size: the pool_size of the user, else the pool_size of the database, else default_pool_size`,
+			rung: "implemented"
+		},
+		{
+			ref: `${PB} src/objects.c:1927-1955 launch_new_connection: a pool with default_pool_size servers starts no more, and the client stays in the queue. reserve_pool_size is 0 at the defaults (src/main.c:317)`,
+			rung: "implemented"
+		},
+		{
+			ref: `${PB} src/janitor.c:166-169 a waiting client with no idle server starts one server. Thus the pool opens each server only when a client needs it, and min_pool_size is 0 at the defaults (src/main.c:308)`,
+			rung: "implemented"
+		},
 		{
 			ref: `${PB} src/objects.c:1990-2008 the launch sets the time of the connect, before the DNS lookup and the TCP connect`,
 			rung: "implemented"
@@ -9770,6 +10505,13 @@ const PGBOUNCER_SERVER = machineSchema.parse({
 		}
 	},
 	knobs: {
+		default_pool_size: {
+			key: "pgbouncer default_pool_size",
+			scope: "proxy",
+			unit: "count",
+			default: 20,
+			note: "src/main.c:284. The most servers of a pool, for one database and one user (src/server.c:294-303, src/objects.c:1927-1955)"
+		},
 		server_connect_timeout: {
 			key: "pgbouncer server_connect_timeout",
 			scope: "proxy",
@@ -9931,9 +10673,9 @@ const PGBOUNCER_SERVER = machineSchema.parse({
 			from: "[none]",
 			to: "connecting",
 			on: "local.launch",
-			guard: "no connect of the pool is in progress",
+			guard: "a client waits, no connect of the pool is in progress, and the pool has fewer servers than default_pool_size",
 			timer: "connect_timeout",
-			source: "src/objects.c:1876-1887, :1990-2008"
+			source: "src/janitor.c:166-169, src/objects.c:1876-1887, :1927-1955, :1990-2008"
 		},
 		{
 			id: "pbs.connected",
@@ -18401,6 +19143,8 @@ const MACHINES = byId([
 	RABBITMQ_CONNECTION,
 	ATEN_DETECTOR,
 	RA_MEMBER,
+	KAFKA_CONSUMER_GROUP,
+	KAFKA_PARTITION,
 	GRPC_JS,
 	GRPC_GO_SERVER,
 	ETCD_SERVER,
@@ -18419,6 +19163,6 @@ const MACHINES = byId([
 	KUBELET_READINESS
 ]);
 //#endregion
-export { AMQPLIB, ATEN_DETECTOR, CADDY_HTTP2, DEADLINE_CALL, DOCKER_PROXY_LINK, ENVOY_HTTP2, ETCD_SERVER, GO_TRANSPORT, GRPC_GO_SERVER, GRPC_JS, HAPROXY_TCP, HIKARICP_PGJDBC, IOREDIS_SENTINEL, IOREDIS_STATUS, ISTIO_SIDECAR_INBOUND, ISTIO_SIDECAR_OUTBOUND, KUBELET_READINESS, LINUX_TCP, MACHINES, MANIFESTATIONS, MONGODB_NODE, MONGOD_REPL, MONGOD_SESSION, NF_CONNTRACK_TCP, NGINX_GRPC, NODE_HTTP_AGENT, NODE_HTTP_SERVER, NODE_POSTGRES, NODE_TIMER_EARLY, PGBOUNCER_CLIENT, PGBOUNCER_SERVER, PGPOOL_SESSION, PILOT_AGENT, POSTGRES_SESSION, PROCEDURES_WS_CLIENT, PROCEDURES_WS_SERVER, RABBITMQ_CONNECTION, RA_MEMBER, REDIS_CLIENT, SENTINEL, SUPAVISOR_CLIENT, SUPAVISOR_SERVER, TOXIPROXY_LINK, TRAEFIK_HTTP2, UNDICI_CLIENT, UNDICI_RETRY, UNDICI_TICK_MS, ZTUNNEL_HBONE, goLateSeconds, goTimerLateness, istioSidecar, nodeEarlySeconds, nodeLateSeconds, nodeTimerLateness, undiciFastEarly, undiciFastLateness };
+export { AMQPLIB, ATEN_DETECTOR, CADDY_HTTP2, DEADLINE_CALL, DOCKER_PROXY_LINK, ENVOY_HTTP2, ETCD_SERVER, GO_TRANSPORT, GRPC_GO_SERVER, GRPC_JS, HAPROXY_TCP, HIKARICP_PGJDBC, IOREDIS_SENTINEL, IOREDIS_STATUS, ISTIO_SIDECAR_INBOUND, ISTIO_SIDECAR_OUTBOUND, KAFKA_CONSUMER_GROUP, KAFKA_PARTITION, KUBELET_READINESS, LINUX_TCP, MACHINES, MANIFESTATIONS, MONGODB_NODE, MONGOD_REPL, MONGOD_SESSION, NF_CONNTRACK_TCP, NGINX_GRPC, NODE_HTTP_AGENT, NODE_HTTP_SERVER, NODE_POSTGRES, NODE_TIMER_EARLY, PGBOUNCER_CLIENT, PGBOUNCER_SERVER, PGPOOL_SESSION, PILOT_AGENT, POSTGRES_SESSION, PROCEDURES_WS_CLIENT, PROCEDURES_WS_SERVER, RABBITMQ_CONNECTION, RA_MEMBER, REDIS_CLIENT, SENTINEL, SUPAVISOR_CLIENT, SUPAVISOR_SERVER, TOXIPROXY_LINK, TRAEFIK_HTTP2, UNDICI_CLIENT, UNDICI_RETRY, UNDICI_TICK_MS, ZTUNNEL_HBONE, goLateSeconds, goTimerLateness, istioSidecar, nodeEarlySeconds, nodeLateSeconds, nodeTimerLateness, undiciFastEarly, undiciFastLateness };
 
 //# sourceMappingURL=index.js.map