qqeasonchen opened a new pull request, #5371: URL: https://github.com/apache/eventmesh/pull/5371
## What this PR does Closes #5360 — Phase 1 of the production-HA plan (#5354): **a fenced (stale) partition owner must not produce durable side effects after takeover** (acceptance B3 / C2 / C3). ### 1. The gap this fixes `PartitionOwnership` acquires partitions via Meta CAS + `FencingToken`, but the dispatcher **never consulted the ownership view**. A stale owner whose lease was taken over kept writing offsets and ACKing the broker — the new owner's offset state and the stale owner's writes interleaved (split-brain duplicates). ### 2. Changes | Change | Effect | |---|---| | `ReliableDispatcher.withOwnershipGuard(BiPredicate<topic, partition>)` | Installed by `UniIngressService.withPartitionOwnership` from the live `PartitionOwnership` snapshot | | `ack()` consults the guard **before any durable effect** | A fenced owner drops the delivery (state + live stores), writes **no offset**, fires **no broker ACK**, and raises `StaleOwnerException` (new — carries topic/partition) | | At-least-once preserved | The broker's POP invisibleTime redelivers the message to the new owner; the new owner's offsets stay authoritative | | Pull-loop null window documented | With #5359 the ownership view is always installed at boot in `PARTITION_OWNED_PULL`, so `null` = single-instance (poll-all is the documented mode), not a gap | ### 3. Tests (new `StaleOwnerFencingTest`, 2 cases) - **`fencedOwnerAckWritesNoOffsetAndSkipsBrokerAck`** — partition 1 owned / partition 0 fenced: owned ack writes its offset; fenced ack throws `StaleOwnerException` with **zero** additional offset writes and **zero** broker ACK callbacks; the dropped delivery is no longer pending. - **`noGuardKeepsSingleInstanceBehaviour`** — no guard installed → ack persists the offset (single-instance path unchanged). Local verification (Temurin 21.0.11): runtime tests + checkstyle (maxWarnings=0) all green. ### Relations - Closes #5360 (Phase 1, P0) - Parent: #5354 · Plan: `docs/architecture-review/production-ha-plan.md` (PR #5366) - Builds on #5359 (merged `b3f9f75b4`) — the boot wiring that makes the guard installable - Unblocks #5363 (cross-instance takeover tests exercise this guard end-to-end) Co-authored-by: qqeasonchen <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
