fix: release startup migration lease before exit - #103157
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 11e325026c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ### Fixes | ||
|
|
||
| - **Gateway startup migrations:** release the shared migration lease before exiting when the selected config changes during startup, allowing immediate retries instead of blocking readiness until the five-minute lease expires. (#103145) |
There was a problem hiding this comment.
Remove the manual changelog entry
For normal fixes or direct-main commits, root AGENTS.md makes CHANGELOG.md release-only and says release generation owns these entries; adding this Unreleased line manually can leave stale or duplicated release notes when the generator derives the release from merged PRs and direct commits. The commit message already carries the release-note context, so this line should be removed and left to the release-generation flow.
Useful? React with 👍 / 👎.
|
Land-ready proof for exact head
Known proof gaps: none for the touched gateway startup/config-migration surface. |
|
Merged via squash.
|
(cherry picked from commit 5337845)
(cherry picked from commit 5337845)
Closes #103145
What Problem This Solves
Gateway startup config drift can request a controlled process exit while doctor preflight still owns the shared startup-migration lease. A hard runtime exit bypasses the lease cleanup
finally, so immediate retries wait for the five-minute lease expiry.Why This Change Was Made
Defer guarded exits with the existing typed
ExitError, let doctor preflight unwind its heartbeat and lease, then hand the original exit code back to the CLI runtime. Pin lease and checkpoint operations to the accepted environment so a later config reload cannot redirect cleanup to another state database.The preflight also treats a rejected second config guard as a startup failure instead of recording a successful migration checkpoint.
User Impact
When the selected config changes during startup, the gateway exits with the existing status and can be retried immediately. Service-mode future-config rejection keeps exit code 78 and revokes the destructive override as before.
Evidence
pre-bootstrap.tsandfuture-config-guard.ts.tbx_01kx4hyn6qdjpyfpvakgyepk6h: 211 focused tests passed across runtime, config guard, gateway startup, and migration preflight.pnpm check:changedpassed for core, core tests, and docs lanes.pnpm buildpassed, including tsdown, CLI bootstrap import guard, runtime postbuild, and Control UI build.pnpm format:checkpassed for all 8 changed files.AI-assisted implementation and review.