fix(inkless:controller): skip switched partitions in unfence ISR expansion - #754
Open
jeqo wants to merge 1 commit into
Open
fix(inkless:controller): skip switched partitions in unfence ISR expansion#754jeqo wants to merge 1 commit into
jeqo wants to merge 1 commit into
Conversation
…nsion expandIsrForDisklessManagedPartitions re-admitted a returning broker to the ISR of every diskless.enable=true partition, selecting on the topic config alone. That is correct for born-diskless partitions, the case #643 targeted: all their data is in object storage, so any live replica is current. A partition switched from classic breaks that premise. Its records below classicToDisklessStartOffset exist only in the replicas' local logs, so a returning replica could hold an incomplete prefix and was still placed in ISR and made electable. Skip any partition whose seal is not NO_CLASSIC_TO_DISKLESS_START_OFFSET, which covers both a committed seal and a switch still PENDING. Those partitions earn ISR through AlterPartition once the leader observes follower fetch state at the seal -- the path #697 added. Removing this shortcut before that path existed would have left switched partitions with no ISR-recovery route at all. The test drives one unfence across three topics -- born-diskless, switched with a committed seal, and switch-pending. Asserting only that switched partitions stay out would also pass against a guard that skipped everything, so the born-diskless leg is what makes it discriminating. Verified red-then-green: with the guard reverted, the switched assertion fails with expected <false> but was <true>.
jeqo
marked this pull request as ready for review
August 18, 2026 05:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
expandIsrForDisklessManagedPartitionsre-admitted a returning broker to the ISR of everydiskless.enable=truepartition, selecting on the topic config alone. That is correct for born-diskless partitions, the case #643 targeted: all their data is in object storage, so any live replica is current.A partition switched from classic breaks that premise. Its records below
classicToDisklessStartOffsetexist only in the replicas' local logs, so a returning replica could hold an incomplete prefix and was still placed in ISR and made electable.Skip any partition whose seal is not
NO_CLASSIC_TO_DISKLESS_START_OFFSET, which covers both a committed seal and a switch still PENDING. Those partitions earn ISR through AlterPartition once the leader observes follower fetch state at the seal -- the path #697 added. Removing this shortcut before that path existed would have left switched partitions with no ISR-recovery route at all.The test drives one unfence across three topics -- born-diskless, switched with a committed seal, and switch-pending. Asserting only that switched partitions stay out would also pass against a guard that skipped everything, so the born-diskless leg is what makes it discriminating. Verified red-then-green: with the guard reverted, the switched assertion fails with expected but was .