Hard cut connected replicas to certified authoritative HOT state - #1674
Hard cut connected replicas to certified authoritative HOT state#1674samuelstroschein wants to merge 16 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
lix-website | 06d974a | Commit Preview URL Branch Preview URL |
Sep 01 2026, 06:24 AM |
This comment has been minimized.
This comment has been minimized.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 169f023b1b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| crate::sync::SYNC_REPOSITORY_EVENT_SPACE, | ||
| crate::sync::SYNC_REPLICA_STATE_SPACE, | ||
| crate::sync::SYNC_MATERIALIZED_STATE_ALIAS_SPACE, | ||
| crate::sync::SYNC_AUTHORITY_STATE_SPACE, |
There was a problem hiding this comment.
When a snapshot comes from a served repository, authority admission has already written this marker, so including the space here copies it into the restored storage. A normal openLix.fromSnapshot() restore cannot select server mode (packages/js-sdk/src/open-lix.ts rejects that combination), so its adapter never receives authority-writer admission; every subsequent ordinary write adds a KeyAbsent precondition for this restored marker in storage_adapter/context.rs and fails with a transaction conflict. This makes the documented remote-export-to-fresh-local-restore workflow open successfully but remain permanently read-only; omit this process-ownership marker from portable snapshots or explicitly normalize it during restore.
Useful? React with 👍 / 👎.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
4604485 to
06d974a
Compare
2 participants
Summary
Lixhandle instead of a second, partial engine APIlix_filereads and one-argumentlix_diff(relation)local and zero-round-trip after certificationCorrectness contract
A connected replica serves only an atomic authority-published prefix. Its HOT rows, branch coordinates, working-diff epoch, blob payloads, and publication cursor are certified together; it never publishes replica-authored or mixed-epoch state. A remote concurrent write may make the prefix lag the authority, which is unavoidable without a read round trip, but every served local epoch existed atomically on the authority. Writes through the handle are read-your-write because success is not returned until the corresponding publication fence completes.
Cold operations execute against one authority session. If a coherent local HOT read is invalidated repeatedly, the entire batch is retried locally or returned from one authority snapshot; local rows are never combined with authority metadata.
One-argument working diff binds the branch's exact private certified cursor with an O(1) control lookup. The public
lix_latest_checkpoint_commit_id()keeps its existing "latest real checkpoint" meaning.Selective checkpoints remain ordinary semantic member commits during authority event capture; only metadata-only checkpoint boundaries use the authenticated complete-state alias. This keeps server-first history reconstructable without conflating the checkpoint's recovered head with its wire representation.
Browser authority observations use private registration and pull lanes so server-first history is never queued behind an unrelated finite worker operation and remains streaming and backpressured through custom fetch implementations. The pull lane buffers at most one bridge chunk and does not change a public API or HTTP endpoint. Superseding a stream while its browser fetch is still awaiting response headers aborts that fetch; dropping the Rust future cannot leak an SSE request and consume the per-origin connection budget.
Dynamic observation membership is generation-fenced and invalidated atomically under the membership lock. Stream opens, active streams, and retry waits are interruptible by a newer generation. The first multiplex SSE frame is published directly because its rows and mutation sequence were evaluated together in the authoritative session; there is no redundant execute request that can add head-of-line blocking or pair newer rows with an older sequence. Authority observation activation uses a session lifecycle guard plus a narrow branch-selector gate, not the write/publication gate. The selector gate spans both remote and local branch movement, preventing half-switched observations without delaying History behind unrelated publication.
Public interface impact
openLix({ server: { mode: "sync" | "remote", ... } }).open_lix().with_server(ServerOptions::sync(...)).LIX_AUTHORITY_EXECUTION_REQUIREDor construct a protocol client themselves.main.The one behavioral auth constraint is that a connected
open_another_session().with_account(...)cannot override the account authenticated by the authority.Performance and complexity
O(P log P + sum(M_current log M_current) + sum((M_final + U) log(M_final + U)))time andO(P + max(M) + L_current + L_final + R)transient memory.Final scorecard:
The selected 1 MiB file read was 3.76-3.83 ms in the shallow/deep cases.
Validation