sliftutils 1.7.26 → 1.7.28

package/storage/remoteStorage/spec.md

@@ -2,10 +2,6 @@
 
 This is the reasoning behind the remote storage system (createArchives / storageServer / BlobStore). The code documents the mechanics; this documents the ideas that must survive refactors.
 
-## Configuration updates happen only on startup
-
-A client adopts a routing config once, during initialization, and then runs on it. Configs never automatically upgrade mid-run: the 5-minute poll picks up whatever the sources currently hold (so a developer's change spreads), but the version-gated *upgrade* — writing a newer configured version over an older stored one — happens only at startup. This is deliberate: config changes are made by a developer running code, and that developer is present at startup. It also prevents reversion loops — if a server briefly held a newer version and then went away, running clients don't cling to that phantom version; they follow what the surviving sources actually hold, and only a fresh startup with an explicitly newer configured version moves things forward again.
-
 ## Scanning + tombstones + versions make any two sources mergeable
 
 Every store fully rescans its sources' metadata (on startup and periodically), and every write — including deletions — is ordered by last-write time. Deletions are tombstones: an empty file IS a missing file, kept as a size-0 index entry (for a week) so the deletion itself propagates and reconciles like any other write. Because everything is a timestamped write and scans are bidirectional (pull what they have, push what they're missing), any two sources can be merged in any order and converge to the same state: newest write time wins, per file. There is no operation whose loss corrupts the system — a failed background write, a missed delete, a source that was down for a day — the next scan reconciles it.
@@ -16,6 +12,16 @@ Each bucket stores its complete routing config (the full redundancy list) inside
 
 If the client tries to do a write where the valid state is far enough away or the sharding is wrong, it will re-download the routing config throttled, so it only does this at most once every 30 seconds, and retry the request.
 
+Storage routing JSON is only written to if we have write access and it's only written to on startup, it doesn't propagate. that way things don't revert without the developer intentionally rerunning it. 
+
+## Redundancy, sharding, and deployment
+
+For redundancy, we can just have multiple different configurations that will satisfy the same request. The first one is the one that we write to. If that one's down, we don't do writes.
+
+However, there's also sharding, where we have different route ranges that values can hash to. Values can explicitly try to write to a specific value via a special like hash override key. This allows us to sometimes make our rights hit a server which has less latency. In the case that the client writer will accept the fact that we might change the key.
+
+The valid windows allow us to schedule deployments, so the nodes can switch over gracefully.
+
 ## BulkDatabase2 index + our own disk as just another source
 
 Each bucket's store keeps a BulkDatabase2 index of every file (path, write time, size, holding source), served from memory — existence checks and listings are extremely fast, never touching a source. The trick that keeps the index accurate: our own disk is not special-cased, it is simply the first synchronization source. The same scan/reconcile code that synchronizes remote sources also synchronizes the disk with the index, so the index self-heals from the same machinery instead of needing separate consistency logic.

package/storage/remoteStorage/storageServerState.ts

@@ -8,10 +8,10 @@ import { BlobStore, IBucketStore, DEFAULT_FAST_WRITE_DELAY, WINDOW_END_FLUSH_MAR
 import {
     RemoteConfig, HostedConfig, BackblazeConfig, IArchives, ArchivesSource, ArchiveFileInfo, ArchivesConfig,
     ArchivesSyncStatus,
-    WRITE_PAST_WINDOW_GRACE, STORAGE_WRONG_VALID_WINDOW, STORAGE_WRONG_ROUTE, FULL_ROUTE,
+    STORAGE_WRONG_VALID_WINDOW, STORAGE_WRONG_ROUTE, FULL_ROUTE,
 } from "../IArchives";
 import { ROUTING_FILE, parseRoutingData, parseHostedUrl, buildFileUrl, getConfigVersion, getRoute, routeContains, routeIntersection } from "./remoteConfig";
-import { applyDeployRemap, getTakeoverAltPort, onTakeoverEvent } from "./deployTakeover";
+import { applyDeployRemap, getTakeoverAltPort, getOwnWindowEndClip, onTakeoverEvent } from "./deployTakeover";
 import { createApiArchives } from "./createArchives";
 import type { IStorage } from "../IStorage";
 import type { AccessRequest, TrustRecord } from "./storageController";
@@ -445,9 +445,36 @@ function computeStorePlan(account: string, bucketName: string, routing: RemoteCo
     // Being removed from the config entirely is a valid window of NOTHING ([0, 0]): fast
     // writes flush immediately (nothing may sit in memory on a node that's been cut out),
     // while the disk data and index stay served.
+    // Internally every self entry is the SAME store - one process listening on one or more ports
+    // (a takeover's alternate-port middle window included). So the disk window merges all
+    // contiguous own windows: an options boundary or the port split must never force a pointless
+    // internal flush between two windows that are both us. Only the DYING process of a takeover
+    // clips its end - from the write handoff on, the data belongs to the successor process.
+    let diskWindow: [number, number] = [0, 0];
+    if (self) {
+        let [start, end] = self.validWindow;
+        let merged = true;
+        while (merged) {
+            merged = false;
+            for (let entry of selfEntries) {
+                let [entryStart, entryEnd] = entry.validWindow;
+                if (entryStart > end || entryEnd < start) continue;
+                if (entryStart < start || entryEnd > end) {
+                    start = Math.min(start, entryStart);
+                    end = Math.max(end, entryEnd);
+                    merged = true;
+                }
+            }
+        }
+        let clip = getOwnWindowEndClip();
+        if (clip !== undefined && clip < end) {
+            end = clip;
+        }
+        diskWindow = [start, end];
+    }
     let ownIndexes = new Set(selfIndexes);
     let sourceSpecs: StorePlan["sourceSpecs"] = [{
-        validWindow: self && self.validWindow || [0, 0],
+        validWindow: diskWindow,
     }];
     if (selfIndex !== -1) {
         for (let i = selfIndex + 1; i < effective.sources.length; i++) {
@@ -669,9 +696,9 @@ export async function writeBucketFile(account: string, bucketName: string, fileP
     // target from a stale view - it must re-resolve and retry at the correct source.
     let route = getRoute(filePath);
     if (!config?.lastModified && loaded.selfEntries.length) {
-        let timeValid = loaded.selfEntries.filter(x => writeTime >= x.validWindow[0] - WRITE_PAST_WINDOW_GRACE && writeTime <= x.validWindow[1] + WRITE_PAST_WINDOW_GRACE);
+        let timeValid = loaded.selfEntries.filter(x => writeTime >= x.validWindow[0] && writeTime < x.validWindow[1]);
         if (!timeValid.length) {
-            logWrongTargetRejection(`Rejecting fresh write of ${JSON.stringify(filePath)} to bucket ${account}/${bucketName}: writeTime ${writeTime} (${new Date(writeTime).toISOString()}) is outside all our valid windows ${JSON.stringify(loaded.selfEntries.map(x => x.validWindow))} even with the ${WRITE_PAST_WINDOW_GRACE}ms grace (a switchover moved the write target)`);
+            logWrongTargetRejection(`Rejecting fresh write of ${JSON.stringify(filePath)} to bucket ${account}/${bucketName}: writeTime ${writeTime} (${new Date(writeTime).toISOString()}) is outside all our valid windows ${JSON.stringify(loaded.selfEntries.map(x => x.validWindow))} (a switchover moved the write target)`);
             throw new Error(`${STORAGE_WRONG_VALID_WINDOW} This server is not a valid write target at ${writeTime} for bucket ${account}/${bucketName} (our valid windows: ${JSON.stringify(loaded.selfEntries.map(x => x.validWindow))}). Re-resolve the currently valid source and retry.`);
         }
         if (!timeValid.some(x => routeContains(x.route, route))) {