Repository navigation
HA/Raft: a replica transaction prepared before it applied a new index is accepted after the DDL and leaves that index without the record on every node #8686
Description
Found while testing #7438.
A replica prepares its transaction against ITS schema. If the leader's CREATE INDEX SCHEMA_ENTRY is committed but the replica has not applied it yet, the replica ships a TX_ENTRY whose WAL carries no page changes for the new index. The leader accepts it (it is after the DDL in the log, page versions are consistent), every node applies the WAL pages as-is, and the record is never added to the new index anywhere. Records and index entries then disagree (records N+1, index N) on all nodes.
#7438 excludes replica entries while the DDL runs; it cannot cover this, because the entry is valid against the page versions and only stale against the schema.
Shape of a fix: carry the schema version the transaction was prepared under in TX_ENTRY (a wire format change, needs capability gating), and refuse it in ArcadeStateMachine.startTransaction with a retryable error when the leader's schema version is newer, so the originator retries after applying the schema entry.
Activity
fix(ha): leader DDL/drop exclusive against replica entries (ArcadeDat…
fix(#7475,#8686): address review: files-only entries do not count as …
fix(#8686): cache the tx-prepared-at capability answer, log when it i…
fix(#8686): document the mixed-version caveat, log a schema-change wa…
fix(#8686): drop the cached tx-prepared-at capability answer when the…
fix(#7475,#8686): publish the capability answer only for the membersh…
fix(#8686): make the capability cache epoch-checked on read, with tes…
fix(#8686): warn (rate-limited) when the prepared-at index is withhel…
1 remaining item
lvca commentedon Sep 30, 2026
Fixed in 26.10.1 (PR #8754).
A write on a replica that started before the replica applied a new
CREATE INDEXcould be accepted and leave the record out of that index on every node. The leader now refuses such a write with a retryable error, and the retry is prepared under the new schema. Expect retryable errors on replicas during schema changes, and set transaction retries accordingly. The check can be turned off witharcadedb.ha.txSchemaCheck=false.❤️ Thanks for helping make ArcadeDB better! ArcadeDB is free and open source, sustained by its community. If it is useful to you or your company, please consider becoming a sponsor to keep development going.
fix(ArcadeData#7475,ArcadeData#8686): exclude a repair on an engine-l…
fix(ha): leader DDL/drop exclusive against replica entries (#7438), a…
fix(#7475,#8686): exclude a repair on an engine-less TimeSeries type …
fix(#7475,#8686): address review: files-only entries do not count as …
fix(#8686): cache the tx-prepared-at capability answer, log when it i…
fix(#8686): document the mixed-version caveat, log a schema-change wa…
fix(#8686): drop the cached tx-prepared-at capability answer when the…
fix(#7475,#8686): publish the capability answer only for the membersh…
fix(#8686): make the capability cache epoch-checked on read, with tes…
fix(#8686): warn (rate-limited) when the prepared-at index is withhel…
fix: ArcadeData#10064 ArcadeData#10066 ArcadeData#10067 ArcadeData#10068
fix: #10064 #10066 #10067 #10068 - one value contract for TIMESERIES …