Summary
Two regressions from the server-authoritative arbitration rework (documented in doc/implementation/cluster/ARBITRATOR_ROLE.md), to fix post-release:
-
In-memory contest latch must be reverted to DB. The lease-transfer contest window is currently an in-process Go map in the arbitrator. This is not compatible with load-balancing several arbitrator instances over one shared DB: each instance has its own contest map, so instances disagree on whether the window elapsed (non-deterministic lease transfer), and the state resets on any arbitrator restart. Move the contest state into the shared DB (challenger uid + since timestamp, keyed by secret+cluster) so every instance agrees — the same principle the persistent Elected lease row already follows.
-
Restore the "loser/loser" (equal-partition) verdict. In a symmetric split where the two instances are cut from each other but both still reach the arbitrator, the arbitrator is the only component that sees both sides. It should be able to tell both to stand down (no driver) until the split resolves, rather than letting a first-holder + contest race pick a winner under ambiguity. Express this in decideArbitration; ties to the contest-in-DB fix. No regtest covers the equal-partition case yet.
Notes
Post-release follow-up; the branch still improves on the current release (it handles the clear minority/majority split).
Summary
Two regressions from the server-authoritative arbitration rework (documented in
doc/implementation/cluster/ARBITRATOR_ROLE.md), to fix post-release:In-memory contest latch must be reverted to DB. The lease-transfer contest window is currently an in-process Go map in the arbitrator. This is not compatible with load-balancing several arbitrator instances over one shared DB: each instance has its own contest map, so instances disagree on whether the window elapsed (non-deterministic lease transfer), and the state resets on any arbitrator restart. Move the contest state into the shared DB (challenger uid +
sincetimestamp, keyed by secret+cluster) so every instance agrees — the same principle the persistentElectedlease row already follows.Restore the "loser/loser" (equal-partition) verdict. In a symmetric split where the two instances are cut from each other but both still reach the arbitrator, the arbitrator is the only component that sees both sides. It should be able to tell both to stand down (no driver) until the split resolves, rather than letting a first-holder + contest race pick a winner under ambiguity. Express this in
decideArbitration; ties to the contest-in-DB fix. No regtest covers the equal-partition case yet.Notes
Post-release follow-up; the branch still improves on the current release (it handles the clear minority/majority split).