fix(restore): recover a replica's alert when the declaration is disabled (audit M10) - #440
Merged
Merged
Conversation
`update` recovers stale alerts when a declaration's scope moves, and `delete` recovers them too — both because "the overdue sweep only walks current declarations, so a stale key would otherwise never clear". Flipping `enabled` false removes the declaration from that sweep in exactly the same way (`sweep_overdue` filters `enabled = true`), but triggered no recovery. A disabled replica also generates no consumer work, so `record_report` can't clear the alert either. So the ordinary decommissioning move — a verification goes overdue and pages, the operator disables the declaration — leaves the alert and its incident open indefinitely, with nothing left in the system that could ever close them. Disabling now recovers the alert on the same path a scope change does. Re-enabling deliberately doesn't clear anything: the sweep picks the declaration back up and re-raises if it is still overdue. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SGfH1cdFKPnKpM7ytRThft
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes M10 (medium) from the audit in #370.
The bug
RestoreReplica::updaterecovers stale alerts when a declaration's scope moves, anddeleterecovers them too — both with the same reasoning in their doc-comments: "the overdue sweep only walks current declarations, so a stale key would otherwise never clear."Flipping
enabledto false removes the declaration from that sweep in exactly the same way —sweep_overduefiltersenabled = true— but triggered no recovery. And a disabled replica generates no consumer work, sorecord_reportcan't clear the alert either.The result is that the ordinary decommissioning move — a verification goes overdue and pages, the operator disables the declaration — leaves the alert and its incident open indefinitely, with nothing left in the system that could ever close them.
The fix
An enabled→disabled transition takes the same recovery path as a scope change.
Re-enabling deliberately recovers nothing: the sweep picks the declaration back up and re-raises if it's still overdue, so clearing on re-enable would just hide a live problem.
Tests
disabling_recovers_the_stale_alert— raise an alert, disable, assert it's cleared. Confirmed to fail against the unfixed code (alert stays active).re_enabling_does_not_recover_anything— pins the other direction so the fix doesn't turn into "anyenabledwrite clears alerts".The existing 21-test restore suite passes unchanged.
Generated by Claude Code