DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
71 lines
3.4 KiB
Plaintext
71 lines
3.4 KiB
Plaintext
Sub-scope 08 (mongo) changestream - execution probes
|
|
revision=a24ece9cf797f7ea647e33bf846b115208ed1ba5
|
|
generatedAt=2026-08-30T00:18:23+00:00
|
|
|
|
Two temporary probe classes were added, run, and removed (both @Tag mongodb-contract,
|
|
hermetic - reactor and the platform's own types only, no server):
|
|
src/test/.../changestream/Ss08PipelineProbe.java
|
|
src/test/.../changestream/Ss08FailoverProbe.java
|
|
No production source was modified. git status after removal is shown at the end.
|
|
|
|
All three probes assemble the consumer exactly as MongoPlatformAutoConfiguration does:
|
|
new ReactiveMongoChangeStreamConsumer(subscription, source, checkpoints, tokens,
|
|
new MongoChangeStreamPipeline(new MongoChangeStreamRunner(projector, dedup, checkpoints)),
|
|
new MongoChangeStreamRecoveryPolicy(), new MongoInvalidateRecovery())
|
|
|
|
=== PROBE C (the decisive one): a failover while an event is still projecting ===
|
|
One worker. Deduplication always grants the claim - no BUSY anywhere.
|
|
Stream 1 delivers E (cluster time 5.1); the projector takes 200ms; at 50ms the stream
|
|
fails with a resumable driver error (errorLabels=[ResumableChangeStreamError], code 133).
|
|
Stream 2 is what the server would resume: E redelivered (the checkpoint never moved past
|
|
it), then F (cluster time 6.1).
|
|
|
|
PROBE-C terminal=COMPLETED opens=2
|
|
PROBE-C projector started=2 completed=1
|
|
PROBE-C results=[MongoChangeProjectionResult[outcome=APPLIED, detail=]]
|
|
PROBE-C checkpoints saved=[token-6]
|
|
PROBE-C highWaterMark=6.1
|
|
PROBE-C state=RUNNING runbook=
|
|
|
|
Reading: E's projection was started and cancelled by the failover. On resume the pipeline
|
|
dropped the redelivered E because its cluster time no longer advances the high-water mark,
|
|
which had been moved to 5.1 on E's FIRST delivery - before any projection ran. F was then
|
|
projected and checkpointed, carrying the stored position past E. E is now unreachable: the
|
|
change stream never replays what the checkpoint has passed. The subscription reports state
|
|
RUNNING with an empty runbook and the caller's Flux completes normally.
|
|
|
|
=== PROBE A: the same loss via a BUSY claim plus a resumable failure ===
|
|
PROBE opens=2
|
|
PROBE claims=[BUSY, CLAIMED]
|
|
PROBE projected events=[token-6]
|
|
PROBE checkpoints saved=[token-6]
|
|
PROBE results=[CLAIMED_ELSEWHERE, APPLIED]
|
|
PROBE pipeline highWaterMark=6.1
|
|
PROBE token-5 projected? false ; checkpoint moved past it? true
|
|
|
|
=== PROBE B: no failure at all - a later event carries the checkpoint past a BUSY one ===
|
|
One healthy stream, no failover, no resume.
|
|
PROBE-B opens=1 claims=[BUSY, CLAIMED]
|
|
PROBE-B results=[CLAIMED_ELSEWHERE, APPLIED]
|
|
PROBE-B checkpoints saved=[token-6]
|
|
PROBE-B busy event token-5 checkpointed? false ; checkpoint now past it? true
|
|
|
|
Reading: MongoChangeProjectionResult.busy() states the invariant - 'The checkpoint must not
|
|
advance past it: the holder may still fail, and a checkpoint that has passed the event is a
|
|
change the stream will never replay.' MongoChangeStreamRunner honours it for that event;
|
|
the next successful event's checkpoint write moves the stored position past it anyway.
|
|
|
|
=== PROBE D: the invalidate guard compares a value with itself ===
|
|
PROBE requireCorrectResumeOption(cp, cp.position()) -> PASSED (the only call shape in production)
|
|
PROBE requireCorrectResumeOption(cp, RESUME_AFTER) -> REJECTED IllegalStateException
|
|
(no production call passes a differing intent)
|
|
|
|
=== source tree after probe removal ===
|
|
$ git status --short | wc -l
|
|
0
|
|
exit=0
|
|
|
|
$ git status --short
|
|
exit=0
|
|
|