refactor(server): split bootstrap.rs into the boot/ tree - #4031
Merged
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #4031 +/- ##
============================================
+ Coverage 84.97% 84.98% +0.01%
Complexity 1402 1402
============================================
Files 1230 1236 +6
Lines 181408 181465 +57
Branches 147703 147761 +58
============================================
+ Hits 154157 154224 +67
+ Misses 23199 23164 -35
- Partials 4052 4077 +25
🚀 New features to boost your workflow:
|
spetz
previously approved these changes
Sep 2, 2026
bootstrap.rs had grown to 5.1k lines holding every boot concern at once: config and credential loading, listener start-up, partition recovery, shard thread handles, the metadata handoff and the cluster topology. None of it could be read or tested in isolation. Move each concern into its own boot/ module and keep the shard_main narrative, with its ordering invariants, whole in boot/mod.rs. Fold three duplications the split exposed. The five-channel stop fan-out was copied between the listener-failure and normal shutdown paths; StopSignals owns it now. The rustls crypto provider was installed at four server-crate sites; bootstrap installs it once before any shard thread exists, and the idempotent installs message_bus keeps for its own embedders become no-ops. The cluster roster carried the config-declared ports while the HTTP state patched in the bound one, so the two disagreed under port-0 binds; shard 0 now publishes the bound ports into the one roster, and current_config.toml gains the bound HTTP address so a harness can discover an ephemeral HTTP port like the other transports. Two boot-order details change with the move. HTTP binds before the replica and client listeners so its port is known when the roster and current_config.toml are written; an http.address colliding with tcp.address therefore fails as a TCP bind error. The replica_io listener path returns an error instead of silently returning when reached off shard 0, a case its only caller gates. The harness readiness gate treats a transport section missing its enabled or address key as a dump still being written and retries, since the dump lands as one truncate plus one write. New integration tests pin the iggy-view header on success, denial, ping, follower redirect and follower relay (three nodes, the smallest cluster that keeps a quorum through a leader change, with the follower's header pinned to the view the primary stamps), and bound-port discovery under port-0 binds.
hubcio
force-pushed
the
server-ng-pr2-boot-tree
branch
from
September 2, 2026 06:50
8add1b5 to
b4e5996
Compare
A second review pass over the boot/ split found no behavior defects but five loose ends worth closing before merge. load_partition was tree-visible with a single in-file caller, and the build_cluster_roster doc still named the roster's self fields by a wildcard. The harness readiness check paired transport labels and address slots by position across two separately ordered arrays, so reordering either would mislabel a mismatch; one array of triples pairs them explicitly. The orchestrator and the port reserver each hand-rolled the loopback address mapping that IpAddrKind::loopback already centralizes. The three-node iggy-view tests sampled the primary's view only after the follower answered, so a view change in between would fail a correct follower; they now bracket the request and accept the range.
numinnex
reviewed
Sep 2, 2026
Hoisting the HTTP bind above the replica start, so the roster and current_config.toml learn its port, left the socket listening with no serve loop behind it for the whole peer dial. That dial has no timeout: a peer dropping SYNs holds it for the kernel retry budget (about 127s at tcp_syn_retries=6), and since the kernel completes handshakes into the backlog, a TCP readiness probe passes and routes traffic to a node that answers nothing. On master the port was still unbound at that point and probes got ECONNREFUSED. Split http::bind into prepare, which validates [http.*] and builds the serve-loop inputs before any listener accepts, and PreparedHttp::bind, which opens the socket right before the port is published. The roster and the config dump still learn the port, and only the publish and the dump write sit between bind and serve.
spetz
approved these changes
Sep 2, 2026
mmodzelewski
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bootstrap.rs had grown to 5.1k lines holding every boot concern at
once: config and credential loading, listener start-up, partition
recovery, shard thread handles, the metadata handoff and the
cluster topology. None of it could be read or tested in isolation.
Move each concern into its own boot/ module and keep the shard_main
narrative, with its ordering invariants, whole in boot/mod.rs. Fold
three duplications the split exposed. The five-channel stop
fan-out was copied between the listener-failure and normal
shutdown paths; StopSignals owns it now. The rustls crypto provider
was installed at four sites; bootstrap installs it once before any
shard thread exists. The cluster roster carried the config-declared
ports while the HTTP state patched in the bound one, so the two
disagreed under port-0 binds; shard 0 now publishes the bound ports
into the one roster, and current_config.toml gains the bound HTTP
address so a harness can discover an ephemeral HTTP port like the
other transports.
New integration tests pin the iggy-view header on success, denial,
ping and follower relay, and bound-port discovery under port-0
binds.