Skip to content

docs(roadmap): task #49 atomic-write sweep — audit closes it, no code change needed #347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pilotspacex-byte merged 1 commit into from
Jul 16, 2026
Merged

docs(roadmap): task #49 atomic-write sweep — audit closes it, no code change needed #347

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
Kernel GA** (close-out of tasks #49/#56, spill-file batching, crash-matrix CI,
10×-RAM benchmark publication), cluster hardening + multi-shard replicas moved
to v0.9, enterprise foundation to v0.10; debt register refreshed.
- **Task #49 v0.8 close-out audit: no code change needed, roadmap corrected
instead.** Re-verified every bare-write persistence site named in the kernel
review (ACL SAVE, cluster `nodes.conf`, CONFIG REWRITE, replication state,
native BGSAVE/RDB, `clog`, `kv_page`) against current `HEAD`: all 7 already
route through `atomic_write_durable` (temp file → `sync_all` → `rename` →
dir-fsync), shipped in PR #304 (merged 2026-07-13) and released as part of
v0.7.0 — `git log 4e0688e6..HEAD` on every touched file confirms none of the
9 converted call sites (ACL SAVE has two: `acl::io::acl_save` + the command
handler routing through it; native BGSAVE has three: `rdb::save`,
`rdb::save_from_snapshot`, `redis_rdb::save`) were reverted or bypassed
since. The Rev 2 roadmap pass (task #68, above) had re-listed task #49 as an
open v0.8 gap without checking it against the already-shipped v0.7.0
CHANGELOG entry; `docs/roadmap/ROADMAP.md` §1 gap table, §4 v0.8.0 item 1,
and §5 debt register are corrected to reflect this (struck through /
removed, not deleted from history). Also audited adjacent hand-rolled
writers for regression risk: `storage/tiered/warm_tier.rs`'s staging-dir →
final-dir rename (own documented atomicity protocol, per-file `.mpf` writes
inside the staging dir are covered by the directory-level rename, not a
bare-write gap) and `storage/tiered/kv_spill.rs::write_kv_spill_batch`
(already hand-rolled tmp+fsync+rename+dir-fsync correctly; not one of the 7
named sites) both remain correctly out of scope — no change made.

### Changed
- **TLS: migrated off the unmaintained `rustls-pemfile` onto `rustls-pki-types`'s
Expand Down
19 changes: 14 additions & 5 deletions docs/roadmap/ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,11 +35,18 @@ architecture with a unified WAL v3 log and 6-phase crash recovery.
real WAIT/ACK, cold-tier TTL leak, ACL early-intercept hole, shardslice waiver (retired at
v0.7.0), and the hygiene ledger. Remaining gaps below.)*

*(2026-07-16 correction: this Rev 2 pass had re-listed "atomic-write stragglers (task #49)" as
an open v0.8 gap below and as v0.8 item 1 in §4. Verified against the code during v0.8 close-out
work: all 7 sites (ACL SAVE, nodes.conf, CONFIG REWRITE, replication state, native BGSAVE,
clog, kv_page) were already converted to `atomic_write_durable` in PR #304 — merged 2026-07-13,
*before* this Rev 2 pass, and its CHANGELOG entry landed under the v0.7.0 release section, not
Unreleased. Task #49 was never actually an open v0.8 item; the row below and the item in §4 have
been removed/struck accordingly.)*
Comment on lines +38 to +44

@coderabbitai coderabbitai Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Correct the CHANGELOG section referenced here.

CHANGELOG.md places the new Task #49 audit under [Unreleased], but this text says it landed under the v0.7.0 release section. Update one side so the release history is consistent.

Proposed fix 
- its CHANGELOG entry landed under the v0.7.0 release section, not
- Unreleased.
+ its CHANGELOG entry is recorded under the current Unreleased section.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
*(2026-07-16 correction: this Rev 2 pass had re-listed "atomic-write stragglers (task #49)" as
an open v0.8 gap below and as v0.8 item 1 in §4. Verified against the code during v0.8 close-out
work: all 7 sites (ACL SAVE, nodes.conf, CONFIG REWRITE, replication state, native BGSAVE,
clog, kv_page) were already converted to `atomic_write_durable` in PR #304 — merged 2026-07-13,
*before* this Rev 2 pass, and its CHANGELOG entry landed under the v0.7.0 release section, not
Unreleased. Task #49 was never actually an open v0.8 item; the row below and the item in §4 have
been removed/struck accordingly.)*
*(2026-07-16 correction: this Rev 2 pass had re-listed "atomic-write stragglers (task `#49`)" as
an open v0.8 gap below and as v0.8 item 1 in §4. Verified against the code during v0.8 close-out
work: all 7 sites (ACL SAVE, nodes.conf, CONFIG REWRITE, replication state, native BGSAVE,
clog, kv_page) were already converted to `atomic_write_durable` in PR `#304` — merged 2026-07-13,
*before* this Rev 2 pass, and its CHANGELOG entry is recorded under the current Unreleased section.
Task `#49` was never actually an open v0.8 item; the row below and the item in §4 have
been removed/struck accordingly.)*
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/roadmap/ROADMAP.md` around lines 38 - 44, Update the roadmap correction
note to accurately reference the CHANGELOG section containing Task `#49`’s audit
entry, aligning it with the actual section used in CHANGELOG.md. Preserve the
surrounding correction details and removal/striking context.


| Gap | Detail | Impact |
|---|---|---|
| **Streaming replica is single-shard only** | Multi-shard work in v0.7 is master-side (merged N-shard PSYNC feed); replicas run `--shards 1` | Disclosed v0.7 limitation; replica can't use thread-per-core — slotted v0.9 |
| **Cluster mode is alpha, tokio-only** | Bus/gossip spawn only in the tokio startup block; monoio (production) startup omits it (`main.rs`) | Cluster mode does not run on the production runtime — slotted v0.9 |
| Atomic-write stragglers (task #49) | 7 bare-write sites remain: **ACL SAVE has no atomicity**, nodes.conf, CONFIG REWRITE, repl state, native BGSAVE, clog/kv_page | Torn-file windows outside the kernel contract — v0.8 close-out |
| `used_memory` accounting under offload (task #56) | Reports 406–762MB against a 256MB cap during 10×-RAM runs (worse post-restart) | Undermines the 10×-RAM claim's operator story — v0.8 close-out |
| Spill format scale | One-file-per-key heap spill → O(keys) file counts; sweep/manifest scale with it | v0.8 close-out (batch into segments) |
| No encryption at rest | WAL/AOF/RDB plaintext | Blocks regulated buyers — v0.10 |
Expand Down Expand Up @@ -202,9 +209,11 @@ shard configs; the 10×-RAM acceptance re-passes on real disk with truthful `use
benchmark report and PRODUCTION-CONTRACT rows are published.* The kernel itself is built — this
release converts it into a verifiable public claim.

1. **Task #49 — atomic-write straggler sweep**: adopt `atomic_write_durable` at the 7 remaining
bare-write sites (ACL SAVE — worst, no atomicity today —, nodes.conf, CONFIG REWRITE,
replication state, native BGSAVE, clog/kv_page).
1. ~~**Task #49 — atomic-write straggler sweep**~~: ✅ already shipped (PR #304, merged
2026-07-13, released as part of v0.7.0) — all 7 bare-write sites (ACL SAVE, nodes.conf,
CONFIG REWRITE, replication state, native BGSAVE, clog, kv_page) route through
`atomic_write_durable`. Verified against HEAD during v0.8 close-out (2026-07-16): no
regression, no new bare-write site introduced since. No v0.8 action needed.
2. **Task #56 — `used_memory` truth under offload**: reconcile accounting so a 256MB-cap
10×-RAM run reports ≤ cap (or documents exactly what the overage is); fix the post-restart
regression.
Expand Down Expand Up @@ -269,7 +278,7 @@ Exit criterion: *a security-conscious enterprise can run Moon and pass an infose
|---|---|---|
| ~~shardslice cross-shard-read waiver~~ | ✅ retired at v0.7.0 (L4 validated, PR #325) | done |
| ~~v0.6.0 tag + RELEASES.md · PRODUCTION-CONTRACT refresh · cold-tier TTL leak · ACL registry bypass · doc contradictions~~ | ✅ closed in the v0.6.1/v0.7.0 cycle | done |
| Task #49 bare-write sites (ACL SAVE et al.) | v0.8 | atomic-write sweep (v0.8 item 1) |
| ~~Task #49 bare-write sites (ACL SAVE et al.)~~ | ✅ shipped v0.7.0 (PR #304, merged 2026-07-13) | done — mis-listed as open in Rev 2, corrected 2026-07-16 |
| Task #56 `used_memory` under offload | v0.8 | accounting reconcile (v0.8 item 2) |
| Spill one-file-per-key scale | v0.8 | segment batching (v0.8 item 3) |
| rustls-pemfile → rustls-pki-types (task #66, RUSTSEC ignore) | in flight 2026-07-15 | Wave-0 PR |
Expand Down