Skip to content

fix(rust_brain): preserve HLC on restore and gossip receive#18

Draft
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-bug-investigation-4c08
Draft

fix(rust_brain): preserve HLC on restore and gossip receive#18
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-bug-investigation-4c08

Conversation

@cursor

@cursor cursor Bot commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

Bug and impact

v0.6.0 (07a1c75) moved monotonic write enforcement from ts_ns to Hybrid Logical Clock (HLC), but two distributed-data paths were not updated:

  1. restore_from_file() dropped HLC — Snapshots include HLC in to_dict(), but restore assigned fresh clocks via MemoryNode defaults. After disaster-recovery restore, legitimate replication writes with causal successor HLCs were rejected (TimestampRegression), breaking cluster sync. Pre-v0.6.0 snapshots that only had ts_ns are handled via a synthetic HLC fallback.

  2. gossip.receive() omitted HLC — Late-arriving gossip events received a fresh local HLC on apply, so stale remote writes could overwrite newer local data on the same key (confirmed with a concrete repro).

Root cause

HLC enforcement was added to remember() without updating snapshot restore or gossip ingestion to propagate timestamps.

Fix

  • restore_from_file() restores HLC from snapshot (list→tuple), falls back to ts_ns-derived HLC for legacy snapshots, and advances the process HLC.
  • gossip.receive() calls update_hlc(), passes hlc/ts_ns to remember(), rejects stale HLC writes, and skips unordered updates to existing keys when no HLC is present.
  • bulk_write() passes through hlc when provided.

Validation

  • Added regression tests in tests/test_enterprise_backup.py and tests/test_gossip.py
  • Manually verified both failure scenarios are fixed
  • 190 tests pass (8 skipped)
Open in Web View Automation 

v0.6.0 switched monotonic enforcement from ts_ns to HLC but two call
paths were not updated:

- restore_from_file() dropped HLC from snapshots, assigning fresh clocks
  that blocked legitimate post-restore replication and broke causal order.
- gossip.receive() omitted HLC, so late-arriving events got a fresh local
  timestamp and could overwrite newer data on the same key.

Restore now round-trips HLC (with ts_ns fallback for legacy snapshots) and
advances the process clock. Gossip applies remote HLCs via update_hlc(),
rejects stale writes, and skips unordered updates to existing keys when
no HLC is present.

Regression tests added for both paths. 190 tests pass.

Co-authored-by: Daniel <DJLougen@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant