Skip to content

fix(start): recover retained requests in place - #1040

Draft
sbalabanov wants to merge 2 commits into
wt/sqc009from
wt/sqc011
Draft

sbalabanov wants to merge 2 commits into
wt/sqc009from
wt/sqc011

Conversation

@sbalabanov

@sbalabanov sbalabanov commented Nov 6, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Recover retained start requests in place with their original ID and immutable inputs. Only authoritative Started snapshots replay log/validate work; later stages and cancellation retain ownership, and terminal snapshots replay their stored winning outcome. Builds on #1039.

Repro

  1. Submit a valid land request and let request creation fail until the primary start delivery reaches start_dlq. The gateway receipt is Accepted, but no orchestrator Request exists.
  2. Restore storage and consume the retained delivery. Before, ID-only reconciliation acknowledged the missing row and left Accepted forever. After, start creates or resumes the same request and publishes the normal validate command, without another user submission.

Test Plan

  • TestRetainedStartCreatesRequestAndHandsOffToValidate seeds the full retained payload before the actual service starts, uses durable acknowledgment watermarks to simulate consumed-record GC, then checks the authoritative Request and unconsumed merge-conflict-check payload (ID, queue, ordered URIs, and strategy).
  • TestController_Process_ReplaysFailedHandOff, TestController_Process_AuthoritativeState, and TestController_Process_RejectsInconsistentSnapshot cover dependency failures, lost acknowledgment, stored terminal diagnostics, ownership, and conflicting inputs.
  • ./tool/bazel test //submitqueue/orchestrator/... //test/integration/submitqueue/orchestrator:go_default_test --test_output=errors: 19/19 targets passed, including Docker integration. Format, lint, tidy, Gazelle, and mock checks passed.

Revert Plan

Revert this change while retaining final-DLQ records and existing request rows. Already-admitted work continues under its current owner.

Issue Links

None — repository audit remediation without an external tracker ticket.

Summary:
Intent:
- Resume retained start deliveries whose request creation never completed, without requiring another user submission or inventing a failed outcome.

Changes:
- Reuse start for final recovery and classify the authoritative snapshot after Create or AlreadyExists.
- Preserve immutable inputs and later-stage ownership; replay stored terminal facts through the shared terminal-log publisher.
- Replace the unused start ID-only decoder and cover recovery through the actual pipeline binding and running service.

Test Plan:
- TestRetainedStartCreatesRequestAndHandsOffToValidate seeds a full start_dlq payload before service startup with no request row, then verifies acknowledgment, the original immutable inputs, and the normal validate command.
- TestController_Process_ReplaysFailedHandOff exercises dependency failures and lost acknowledgment on both input topics; TestController_Process_AuthoritativeState proves later/cancelling ownership and stored terminal diagnostics are preserved.

Revert Plan:
Revert this change while retaining final-DLQ records and existing request rows. Already-admitted work continues under its current owner.
@sbalabanov

sbalabanov commented Nov 6, 2026 •

Copy link
Copy Markdown
Contributor Author

[independent-integration-review] test/integration/submitqueue/orchestrator/suite_test.go:155-163: this loop can wait until the test runner times out even after start recovery succeeds. In a full-suite run with earlier cancellation integration cases, request 911's Started/Validating logs and merge-conflict-check hand-off existed, but queue GC had already removed its acked start_dlq delivery state and consumed validate message. sql.ErrNoRows therefore never reaches the loop's only exit; the payload assertion at line 172 is transient for the same reason.

Please replace the ephemeral ack-row poll and consumed-message read with durable recovery/hand-off evidence (for example, await the authoritative Request and the downstream merge-conflict-check payload, which this fixture does not consume, then compare its request identity and original change). Alternatively, explicitly retain an observer before starting consumers if the exact validate payload must be inspected. No sleep or test-order dependency is needed. Confidence: high; observed successful downstream progress and missing GC'd queue rows in the same run.

Summary:
Replace transient queue receipt and validate-message assertions with the authoritative request and unconsumed cross-service hand-off. Complete the consumers using durable acknowledgment watermarks, then explicitly remove consumed evidence to exercise garbage-collected queues without timing or test-order dependencies.

Test Plan:
TestRetainedStartCreatesRequestAndHandsOffToValidate passes with consumed start and validate evidence removed, preserving the request ID, queue, ordered changes, and merge strategy in the downstream request. All 19 orchestrator and service integration targets pass.

Revert Plan:
Revert this test-only change; production recovery behavior is unchanged.
@sbalabanov

Copy link
Copy Markdown
Contributor Author

[agent-response SQC-011] Addressing this review. Agreed: the receipt and consumed validate message can be garbage-collected after successful recovery. Fixed in 0d365e1e.

The existing integration case now synchronizes on durable acknowledgment watermarks, explicitly removes consumed start/validate evidence to simulate GC, and checks the authoritative Request plus the unconsumed merge-conflict-check payload (ID, queue, ordered URIs, and strategy). No sleeps, test-order changes, or additional test cases.

./tool/bazel test //submitqueue/orchestrator/... //test/integration/submitqueue/orchestrator:go_default_test --test_output=errors passed all 19 targets, including the real service integration with GC simulation. Format, lint, tidy, Gazelle, and mock checks also passed.

@sbalabanov

Copy link
Copy Markdown
Contributor Author

[independent-review] Should fix — public PR description boundary (95% confidence).

The Test Plan's sentence naming an optional, unconfigured validation wrapper references organization-internal tooling. This repository's AGENTS.md also applies its public-content rule to PR descriptions. Please remove that sentence or describe the wrapper generically; preserve the native Bazel commands and truthful results. This needs only a body edit, not a code change or new tests.

The complete updated code review read all 12 assigned files and reran all four affected targets, including fresh Docker integration. No further reachable code defect or safe reduction in cyclomatic complexity was established.

Generated with the repository's .agents/skills/autoreview workflow; finding rechecked against PR #1040 at 0d365e1e195f8e6fc0e7f5c35550ec9b0e05082d.

@sbalabanov

Copy link
Copy Markdown
Contributor Author

[agent-response SQC-011] Addressing this review. Agreed: removed only the optional-wrapper sentence from the Test Plan. Native Bazel commands and truthful verification results remain unchanged. This is a description-only correction; no code, commits, or tests changed.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants