* refactor(log-store): extract shared WAL reading helpers
Move object indexing, chain traversal, history checks, segment prefetching and object I/O out of the writable store. Preserve local recovery and read policies.
Signed-off-by: WenyXu <wenymedia@gmail.com>
* refactor(log-store): separate read-only WAL object access
Introduce WalObjectRead as the read capability shared by indexing and prefetching. Keep writes and startup listing on WalObjectIo, and adapt writable-store test doubles without changing their behavior.
Signed-off-by: WenyXu <wenymedia@gmail.com>
* feat(log-store): add a read-only object store WAL reader
Validate source identity with NodeWalPrefix and share readers by source. Read known-last-entry or listed ranges using fresh listings and bounded footer concurrency, without holding the cache lock across I/O.
Evict indexes outside the current listing, keep release extraction in startup recovery, and cover bounds, history, cache lifetime, prefix validation and concurrent reads.
Signed-off-by: WenyXu <wenymedia@gmail.com>
* fix(log-store): coalesce remote WAL footer loads with shared cache
Signed-off-by: WenyXu <wenymedia@gmail.com>
* fix(log-store): report missing source WAL history separately
Signed-off-by: WenyXu <wenymedia@gmail.com>
* test(log-store): cover remote WAL chain and listing boundaries
Signed-off-by: WenyXu <wenymedia@gmail.com>
* test(log-store): wait for asynchronous WAL index release
Signed-off-by: WenyXu <wenymedia@gmail.com>
* test(mito2): align WAL recovery assertions with shared history messages
Signed-off-by: WenyXu <wenymedia@gmail.com>
---------
Signed-off-by: WenyXu <wenymedia@gmail.com>
* fix(mito2): publish manifest deltas by conditional create under a lease
A late old leader and the region's new holder can commit the same manifest
version. For a region whose writes require a lease and whose WAL is the object
store WAL, the manifest now behaves as follows. Every other region keeps its
behaviour and issues no extra request.
- Each delta has one fixed name, `{version:020}.json.gz`, written by a
conditional create. Without `compress_manifest` the delta is written at gzip
level 0, so that all writers share the name.
- On an existing object, the writer reads it from storage: identical content is
a retry of a write that landed, anything else is a retryable
`ManifestVersionConflict` that keeps the output files.
- The version advances only after a successful save.
- Recovery loads the highest checkpoint found by LIST and uses the checkpoint
pointer only for its checksum, because a stale writer's checkpoint task can
leave the pointer at an older version.
- Checkpoint cleanup frees names, so a late create can still succeed on a
deleted name. A commit whose save returns after the region's Leader deadline
lists the checkpoints once: a checkpoint at or above its version, or a LIST
error, is a conflict; otherwise it applies but starts no checkpoint. A commit
within the deadline does one conditional PUT and no LIST.
`RegionManifestManager::update` becomes the one commit entry and takes
`allow_checkpoint` and `must_verify` as required parameters. A backend that does
not declare conditional create is refused at open.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
* fix(mito2): treat every LIST error as a conflict when verifying a commit
The listing helper turned a NotFound from lister creation into an empty result,
so the check after a late commit could read a failed LIST as proof that no
checkpoint covers the version. List the checkpoints directly, so that any LIST
error reaches the caller. Recovery still treats a missing directory as having no
checkpoint.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
* fix(mito2): keep the LIST failure in manifest conflicts and follow the style guide
A failed LIST during commit verification was reported as "OpenDAL operator
failed", because the conflict reason used the display of the wrapper error.
Report the root cause through `output_msg` and assert it in the test.
Align the change with docs/style-guide.md: name boolean methods `is_*`, name
the listing helper `list_highest_checkpoint` and move it after the public
methods, qualify `encode_gzip_stored` through its module, and name the mode
setter after the field it sets, which is now `pub(crate)`. Move the shared test
helpers to `crate::test_util` and `manifest/tests/utils.rs` so that the manifest
test modules stay private.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
* fix(mito2): order the manifest test helpers public before private
Move the private `NotFoundReader` and `CheckpointTaskBlocker::block_write`
below the public items next to them, and document
`fail_manifest_delta_reads_layer`.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
* fix(mito2): fail recovery when a listed checkpoint disappears
Recovery treated a checkpoint that LIST found but that cleanup removed before
the read as no checkpoint at all. It then replayed from the first version over
deltas that were already deleted, and could report an empty region or build a
manifest from the surviving tail. Return a retryable version conflict instead.
Record the size of the stored object when a retry finds an identical delta, as
the other writer may have encoded it differently. Reopen the region in the test
of a commit that crosses its deadline, and reduce the AGENTS.md entry to the
invariant.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
* fix(mito2): verify conditional commits from callers without a deadline
Restore `RegionManifestManager::update(action_list, is_staging)`. Without a
Leader deadline a caller cannot show that its commit returned in time, so a
normal commit under conditional publication is now always verified on this
path and starts no checkpoint.
Only `ManifestContext::update_locked` has a deadline, so the variant that takes
`allow_checkpoint` and `must_verify` becomes `update_with_verification` and is
crate private. `sst-replace` and the existing tests return to the two-argument
call.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
* fix(mito2): name the verifying manifest update in the hook docs
`ManifestContext::update_locked` now calls `update_with_verification`, and the
public `update` also calls it, so neither doc can call `update_locked` the sole
caller of `RegionManifestManager::update`.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
* fix(mito2): keep the conditional publication rule in region options
Move the rule that decides which regions publish manifests conditionally
to RegionOptions, so the manifest options only hold the result. Report a
checkpoint that vanished after LIST with its own error instead of a
version conflict, and keep the stored gzip encoder with the other
CompressionType helpers.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
---------
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
A prepared statement keeps its logical plan, and that plan holds the
table as it was at prepare time. The analyzer reads the partition
columns from that table while the regions to scan come from the current
route. After a table's partition columns change, the analyzer can
consider a query safe to push down, so each region runs the whole query
and the frontend concatenates their results. The same happens to the
source of a prepared INSERT ... SELECT, which then stores wrong values.
Before executing a kept plan, compare each scanned table's partition
columns with the current table found by id. Scans of a table whose
columns changed get the current table when the schema is unchanged.
Otherwise they keep their schema, because a scan's projection holds
indices into it, and report the current columns as absent from it, so
the query keeps merging on the frontend.
Signed-off-by: jeremyhi <fengjiachun@gmail.com>
* perf(mito2): reuse static manifest checks for cached readers
Signed-off-by: Dennis Zhuang <killme2008@gmail.com>
* test(mito2): drop redundant pruner test and release entry lock early
Signed-off-by: Dennis Zhuang <killme2008@gmail.com>
* perf(mito2): cache static manifest keep verdicts directly
Signed-off-by: Dennis Zhuang <killme2008@gmail.com>
---------
Signed-off-by: Dennis Zhuang <killme2008@gmail.com>
Expose live compaction tasks through the datanode inspection path with
node pruning, lazy projected batches, and residual SQL filtering. Reuse
inspection request and plan helpers across compaction and SST tables.
Cover routing, projection, predicates, and lifecycle behavior in datanode,
standalone and distributed integration, and SQL tests. Use the production
information extension in the standalone test fixture.
Signed-off-by: WenyXu <wenymedia@gmail.com>
* feat(mito2): schedule compaction units fairly across regions
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* refactor(mito2): simplify compaction admission cost and ready queues
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* refactor(mito2): derive compaction coordinator capacity from its executor
CompactionCoordinator::new accepted the executor concurrency and the
admission capacity as independent values, so the two could drift and admit
work that re-queues behind contenders in the executor's FIFO.
Add CompactionCoordinator::new_local(concurrency), which builds the
LocalScheduler and the capacity from one value, and use it in WorkerGroup.
Tests keep the explicit constructor for injected executors.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(mito2): keep inflight compaction accounting unwind safe
The local unit job incremented the inflight gauge, awaited the task and then
decremented it. A panic escaping the task, or a started job future dropped
before completion, skipped the decrement and leaked the gauge permanently.
Own the gauge through an RAII guard created after the increment so every exit
path decrements exactly once. Cover the unwind path with an isolated gauge.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): pin backlog weight cap and minimum positive cost
The admission policy halves the charge of a region that has more than one
ready unit and charges at least one half-byte. Neither property had a test
that failed when the weight was constant, uncapped, or the minimum charge was
removed.
Add two scripted capacity-1 admission-order regressions: one for the capped
backlog weight with merge-sized units, and one for zero-byte expiration units
that must still accrue service.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): pin the idle service floor against stale credit
A region that goes idle kept its low service value, so it could run a long
burst on wake and starve the regions that served during its sleep. The only
reentry tests left the virtual-time floor below that stale value, so removing
the clamp changed no assertion.
Add a capacity-1 admission-order regression where a busy region advances
virtual time past the sleeping region's service before it returns with a
three-unit batch.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): document compaction admission accounting state
The coordinator's state types carried no explanation of the ordering key, the
service unit, or the coupling between service and virtual time, and the
admission tick reused the crate's write-sequence term without saying so.
Document the coordinator fields, the shared state, and each region queue field
so the ordering contract can be reviewed without reverse-engineering the unit
and the floor update.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): document ReadyUnit ownership and completion ordering
ReadyUnit's fields and constructor were undocumented, and the invariant that
matters lived only in the executor trait and in AdmittedUnit's drop: the
completion must never observe the job's live input leases.
Document the fields and constructor, including that completion runs after the
job is dropped on admission, withdrawal, rejection, panic and shutdown paths.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* chore(mito2): lowercase compaction admission metric help text
The three new compaction admission metrics used sentence case inside a block
whose other help strings are lowercase, so the exported /metrics output was
inconsistent. Lowercase the help text only; names, labels and buckets are
unchanged.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): align compaction test harness concurrency
SchedulerEnv's default compaction scheduler was a single-runner LocalScheduler
while the coordinator used the configured max_background_compactions as its
admission capacity, a pairing production does not have. Up to capacity-1 units
could be counted as running while permanently queued on one runner.
Derive the default compaction executor from the configured concurrency, keep
injected executors, and document that VecScheduler only collects jobs and
cannot serve drain or shutdown assertions.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): describe the widened max_background_compactions scope
The setting now also bounds engine-wide admission of local compaction units
and the number of independent units one automatic per-region pick may prepare,
while manual compaction keeps its request parallelism. Only the pool size was
documented, so raising the value silently widened both.
Extend the field doc and both example TOML comments, then regenerate
config/config.md with make config-docs.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(mito2): make the inflight accounting regression testable
The inflight test wrapped both its gauge assertion and the fixture panic in
one catch_unwind and only checked that a panic happened, so a broken counter
assertion could be mistaken for the expected unwind. It also exercised a copy
of the accounting scope instead of the job wrapper.
Run the production job through InflightCompaction::run so tests and callers
share one accounting scope, assert the gauge outside the catch boundary, and
verify the expected panic payload. Cover completion, unwind, an unpolled drop
and a started drop.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): verify compaction capacity through execution
The harness capacity test only read CompactionCoordinator::capacity(), so it
still passed when the default executor was a single-runner LocalScheduler or
when the injected executor was ignored. Remove that test-only getter and drive
real units instead: one and four configured runners must each start exactly
that many units, hold the rest, and drain; a separate case proves units reach
an injected executor.
Three scheduler tests also assumed a follow-up submission while the previous
batch still held its admission slot. The harness never runs or releases those
units, so they passed only on hosts whose CPU-derived capacity exceeded one.
Pin their capacity to two so they no longer depend on the host.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): clarify the max_background_compactions unit budget
The field described the same limit as the number of independent units one
automatic pick may prepare. In fact it bounds the merge-output budget: merged
groups share inputs, and expired SSTs may add one expiration-only unit outside
that budget while still consuming a slot in the same admission limit.
Correct the rustdoc and both example TOMLs, then regenerate config/config.md
with make config-docs.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): describe ready unit ownership directly
Explain that submission consumes the unit and prevents repeated admission, instead of referring to a nonexistent grant-message protocol.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): link the compaction admission wait metric
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): allow admission capacity to equal runner count
State the non-strict capacity bound used by new_local, rather than implying that one executor slot must remain unused.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): use descriptive wording for region retirement
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): cover queued compaction cancellation and DDL handoff
Keep a prepared unit outside the executor behind another region's sole admission slot. Verify its actual Released notification completes the waiter as cancelled, releases inputs, and hands off truncate or enter-staging instead of failing the DDL.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): cover parallel automatic follow-up planning
Keep two out-of-range windows eligible after a manual pick and assert that the automatic continuation prepares both with the configured parallelism. This detects a regression back to a single-output follow-up budget.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): clarify completion handling for rejected submissions
Document that accepted units dispatch completion after releasing job resources, while submission to a closed coordinator drops both futures unpolled and leaves error bookkeeping to the caller. Keep the existing notification behavior unchanged.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): observe rejected compaction units through release notifications
Upstream now asserts release accounting right after admission, assuming the
executor rejects a unit synchronously. Engine-wide admission queues units in
the coordinator instead, so a rejection surfaces as the asynchronous
`CompactionUnitNotification::Released` notification. Drive those notifications
through the worker path before asserting, and drop a duplicated inflight
accounting helper left behind by the conflict resolution.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* style(mito2): format rejected compaction release matching
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
---------
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* feat(mito2): expose live compaction task state
Expose active and pending compaction tasks through shared region state,
including live phases, request and effective options, progress, and time
ranges. Prune metadata predicates before reading task state without
queueing worker requests or retaining completed-task history.
Share projected inspection batch and plan construction with SST entries,
and cover task lifecycle, admission, pruning, and worker-independent reads.
Signed-off-by: WenyXu <wenymedia@gmail.com>
* fix(mito2): share compaction unit state across publications
Signed-off-by: WenyXu <wenymedia@gmail.com>
---------
Signed-off-by: WenyXu <wenymedia@gmail.com>
* fix: prioritize region ALTER over queued edits
Signed-off-by: evenyag <realevenyag@gmail.com>
* test: use valid edits in ALTER priority regression
Signed-off-by: evenyag <realevenyag@gmail.com>
* refactor: make region edit dispatch outcomes explicit
Signed-off-by: evenyag <realevenyag@gmail.com>
* fix: reject queued alters and edits when dropping regions
Signed-off-by: evenyag <realevenyag@gmail.com>
* test: cover queued ALTER handoff before region edits
Signed-off-by: evenyag <realevenyag@gmail.com>
---------
Signed-off-by: evenyag <realevenyag@gmail.com>
* feat(otlp): add v1 schema for auto-created OTLP log tables
New tables created by direct OTLP logs ingestion get a v1 built-in schema:
service_name tag from resource service.name ahead of scope_name in the
primary key, a skipping index on trace_id, and event_name and
observed_timestamp fields. The table is marked with
table_data_model=greptime_log_v1. Existing tables without the marker keep
the legacy schema.
Signed-off-by: Dennis Zhuang <killme2008@gmail.com>
* refactor(otlp): share resource service.name parsing between logs and traces
Log tables now derive service_name with the same rules as trace spans, so
both signals agree on the value used to correlate them. The integration test
writes twice to cover the existing v1 table path.
Signed-off-by: Dennis Zhuang <killme2008@gmail.com>
---------
Signed-off-by: Dennis Zhuang <killme2008@gmail.com>
UpgradeCandidateRegion acquired RemoteWalLock::Read for each topic on every
retry attempt while keeping the guards from earlier attempts. If a
WalPruneProcedure queued RemoteWalLock::Write on the same topic during the first
attempt, the retry's second read acquire waited behind the writer (the lock is a
fair tokio RwLock), and the writer waited on the first read guard. The region
migration and the WAL prune then hung until metasrv restarted.
Acquire the read guards once before the retry loop and hold them until the
function returns.
Fixes#10204
Each region worker built its own MemtableBuilderProvider, and every
provider created its own CompactDispatcher. The limit on background
bulk memtable compactions was therefore num_workers times
max_background_compactions, while SST compaction uses one
engine-wide pool of max_background_compactions.
Create one dispatcher in WorkerGroup::start (and start_for_test),
pass it to every worker, and make MemtableBuilderProvider::new take
it instead of creating its own. SST and memtable compaction keep
separate budgets of the same size.
Signed-off-by: luckys <190197589+luckysxx@users.noreply.github.com>
Co-authored-by: luckys <190197589+luckysxx@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: dennis zhuang <killme2008@gmail.com>
* fix(datatypes): escape object keys when rendering jsonb as text
Signed-off-by: Yvan Wang <131545713+BootstrapperSBL@users.noreply.github.com>
* fix(datatypes): skip unicode normalization for escaped jsonb keys
Signed-off-by: Yvan Wang <131545713+BootstrapperSBL@users.noreply.github.com>
* refactor(datatypes): serialize jsonb to text directly with serde_json
Serialize the binary jsonb with serde_json::to_string(&RawJsonb) so that
both object keys and string values are escaped by serde_json. This drops
fix_unicode_point, its regex and the hand-written key escaping. Errors are
propagated instead of falling back to lossy raw bytes.
Characters such as U+2028 are now emitted as-is, which is still valid
JSON, so the affected sqlness result lines are regenerated.
Signed-off-by: Yvan Wang <131545713+BootstrapperSBL@users.noreply.github.com>
* fix(datatypes): accept JSON text bytes in jsonb_to_string
Some write paths (COPY FROM csv/json/parquet, JSON bound as text via
MySQL) store JSON text instead of binary jsonb in JSON columns. Re-encode
such bytes as jsonb before serializing with serde_json, so they still
render (properly escaped) instead of failing with InvalidJsonb.
Signed-off-by: Yvan Wang <131545713+BootstrapperSBL@users.noreply.github.com>
---------
Signed-off-by: Yvan Wang <131545713+BootstrapperSBL@users.noreply.github.com>
* feat(mito2): add lossless multi-region compaction executor
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* refactor(mito2): use bounded workers for multi-region compaction
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(mito2): materialize compaction routing fragments on demand
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(index): clean up Tantivy resources on cancellation
Keep temporary directories alive through initialization and in-flight writer finalization. Release writers and remove directories on the shared blocking runtime, and retain the finishing task so abort can join it safely.
Cover creator lifecycle cleanup and multi-region cancellation and sibling failure after Tantivy initialization.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* refactor(mito2): stream single-window multi-region compaction
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): read published multi-region outputs with real metadata
Multi-region output metadata was only inspected field by field; every
successful read cleared the sequence bound and forced the preserve marker,
so partition filtering and sequence override were never exercised with the
metadata a caller publishes.
Read each output again with the returned FileMeta and the target metadata,
and require the same row count and the same reader-visible sequences.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): cover multi-region routing mask rejection
The exclusive-routing guards were unreachable: every fixture used a
partition rule whose masks happened to be disjoint and correctly sized.
An unchecked caller-supplied rule can still violate both invariants, and a
violation would route one physical row to several target regions.
Cover both guards: overlapping predicates from a real rule with
check_exprs=false, and an over-short mask from a minimal rule
implementation. Both must fail before any output is protected.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): cover JSON2 rewrite through multi-region compaction
The multi-region executor wires the shared JSON2 rewrite plan by column
id and target layout, but no fixture carried a JSON2 column, so neither the
per-target mapping nor the materialized values were exercised.
Write a source SST with a narrower JSON2 layout (one key stays in the
remainder), compact it into a wider target layout, and read the output back:
require the target physical layout and the original key values.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): cover every validate_plan rejection
Plan validation is the boundary that keeps malformed inputs away from the
routing and writer stages, but only the happy path was exercised. Mutate a
valid plan for each rejection (budgets, control state, empty targets, window
alignment/overflow, source ownership, duplicates, missing inputs, mismatched
schemas) and require the specific reason under a timeout, with no protected
outputs.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): assert multi-region output bytes and retained groups
output_bytes had no positive assertion, and the peak check was an upper
bound that also holds when the peak is never recorded. Require the reported
bytes to equal the sum of the produced files and the peak equal-key group
storage to be non-zero.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(index): cover retained Tantivy finalization on abort and drop
Cancellation was only exercised after finish_writer returned, so the
retained finalization handle and the directory lease it holds were never
tested. Simulate a commit that is still running, then require abort to join
it before removing the directory and creator drop to clean up after the
lease is released.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* refactor(mito2): share sequence provenance helpers on FileMeta
The multi-region writer duplicated the trust predicate and maximum-bound
fold that read paths and DefaultSstMerger already rely on, so the two could
disagree about whether a file's row sequences are trustworthy.
Move both rules onto FileMeta, delegate from FileHandle, and reuse them from
the multi-region writer and the compactor.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): document the guarded SST write path
write_sst_with_guard is the enterprise seam whose behaviour is not visible
from its signature, and the comment above the non-cache arm still claimed
the cache was unconditionally disabled. Describe the bypass, the single
upload stream and the pre-create guard, and correct the stale comment.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): document multi-region plan budget fields
The public plan left max_output_file_size and window_seconds without units or
semantics, and memory_limit without the multipart-minimum floor implied by
admission. State all three so callers cannot budget against the wrong unit.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): explain the multi-region row-group cap
Capping output row groups at 1024 rows diverged from ordinary compaction
without saying why. Record that the cap bounds the encoder working set that
each resident target admits, and keep the behaviour unchanged.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* style(mito2): separate new error variants consistently
Every other variant in the enum is separated by a blank line; the new
enterprise variants were glued to their neighbours.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): quote the new module identifier in the module map
Every other row of the module map starts with a backticked identifier; the
multi-region row did not.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): prefix multi-region tests with test_
Every other test under compaction/ is named test_*, so name-filtered runs
and IDE grouping silently skipped this module. Rename only the test
functions; assertions are unchanged.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* style(mito2): wrap the multi-region scan stream bodies
rustfmt does not reflow async_stream macro bodies, so the shared scan kept
statements far past the column limit. Split them into one statement per
line; behaviour is unchanged.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): make the table-stage folding cases independent
Both parametrized cases used identical options and differed only by
merge_mode, which the table stage never reads, so the second case re-ran
the first. Keep the ignored-merge-mode case and spend the second on
preserve_row_sequence, asserting the per-file marker as well as the row
count.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): fix partition mask test name
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* style(mito2): wrap multi-region worker macro bodies
Wrap receive and accounting expressions and expand the scan completion arm without changing worker behavior.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* docs(mito2): document multi-region output levels
Document that returned files default to L1 and callers must adjust metadata before publication when another level is intended. Distinguish this convention from changing existing persisted levels.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(mito2): identify invalid multi-region plan fields
Report each invalid source or execution limit separately while preserving validation order and thresholds. Update rejection cases and cover negative window widths.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): consolidate multi-region compaction regressions
Share SST fixtures and complete-row oracles while preserving non-append, JSON2, sequence, and cancellation coverage. Drive Tantivy finalization tests through the real finish path.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
---------
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(catalog): use advertised peer address as process identity
The process manager identified the local frontend by its public gRPC
address, while metasrv discovers peers by the address advertised in the
heartbeat (the internal gRPC address when configured). With separate
public and internal listeners, list_all_processes failed to exclude the
local node, queried its own management service as a remote frontend, and
appended the local registry again, so every local query was listed twice.
The same mismatch broke routing of KILL to other frontends.
Identify a frontend by the address it advertises to metasrv:
- add FrontendOptions::peer_addr, shared by the heartbeat and the process
manager, and FrontendOptions::create_process_manager to wire it once;
- use the advertised address as the process identity, for self-exclusion
in list_all_processes, and for local/remote routing in kill_process.
Process ids now carry the address other frontends use to reach the node.
When no internal gRPC listener is configured this is the public gRPC
address, so the previous behavior is unchanged. The internal listener is
the only one serving the frontend management service, so process ids stay
routable.
The new distributed regression tests exercise separate public and internal
addresses: the local query must be listed exactly once while remote
frontends are still listed, and KILL must route to a remote frontend.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test: keep local peer address reserved in kill-routing test
The test reserved the local frontend address with a temporary listener that
was dropped immediately, then reserved the remote address separately. The
kernel could assign the same port to the remote frontend, so the remote kill
request would take the local branch and fail to find the remote process.
Bind the local address once and keep the listener alive for the whole test so
the local and remote frontend identities cannot collide.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
---------
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(function): require ADMIN statement privileges to execute admin functions
Read-only accounts could execute the admin UDFs (flush_table,
compact_table, flush_flow, gc_regions, migrate_region, reconcile_*,
build_index, ...) through ordinary SELECT statements: SELECT is a
read-only statement so it passes the statement-level privilege check,
and the functions were only guarded by the greptime-catalog scope
check inside the UDF. That let read-only users trigger WAL flushes,
manifest version bumps, compactions, flow-sink writes and, in
distributed mode, region GC/migration and SST deletion.
Wrap the privilege check into the admin_fn macro itself, next to the
existing greptime-catalog check: before executing, every #[admin_fn]
function now requires the same privileges as its ADMIN statement. The
check synthesizes the PermissionReq::SqlStatement request an
ADMIN <fn>(...) statement produces and evaluates it with the same
PermissionCheckerRef plugin the frontend installs, so query invocation
(SELECT <fn>(...), EXPLAIN, views, flows) and the ADMIN statement path
are gated identically — in particular read-only accounts are denied
with PermissionDenied (7006), while write-privileged users keep both
invocation styles. With auth disabled (no permission checker), the
functions stay invocable by everyone, exactly like ADMIN statements.
The denial is wrapped as External(BoxedError) so the 7006 status code
survives both the query execution path and the admin statement
executor.
Regression tests: unit tests for the check (no-checker allows,
read-only denied 7006, read-write allowed), an end-to-end test over
the macro-generated flush_table UDF, and an integration test where a
read-only account is denied 7006 on all 13 functions from SELECT while
a read-write account keeps SELECT and ADMIN FLUSH_TABLE working.
Signed-off-by: Ning Sun <sunning@greptime.com>
* fix(function): expose admin privilege check to downstream macros
Signed-off-by: Ning Sun <sunning@greptime.com>
---------
Signed-off-by: Ning Sun <sunning@greptime.com>
* perf(mito2): read compaction input footers concurrently
Compaction read the parquet metadata of its inputs one file at a time
before merging. It now reads up to 8 footers at once, keeping the input
order. Remote compaction also caches SST metadata now, so the merge
reuses those footers instead of reading each one a second time.
With 20ms object store reads, a remote compaction of 8 inputs issued 57
read requests instead of 65, and one output took 0.51s instead of 0.75s
with `experimental_compaction_output_parallelism` set to 8.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(mito2): stop accounting metadata bytes when caches drop
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* test(mito2): cover compaction with a missing input SST
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
* fix(mito2): skip output metadata warmup for remote compaction
Per-job compaction caches are not reused by readers of newly written SSTs. Keep input footer reuse, but preserve output prewarming only for long-lived engine caches. Cover both cache policies and the unchanged flush path with real SST reads.
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
---------
Signed-off-by: Lei, HUANG <ratuthomm@gmail.com>
When a datanode restarts with a new address, metasrv invalidated cached
table routes only for the tables in that heartbeat's region stats. The
first heartbeat after a restart often reports few or no regions (e.g.
with init_regions_in_background), so frontends kept dialing the old
address until metadata_cache_ttl expired.
Read the previous address via prev_kv when saving it, and when it
changed (or a failed save of the same epoch is retried) invalidate
every table registered for the datanode in __dn_table.
Signed-off-by: Floris Smit <florissmit10@gmail.com>
Co-authored-by: Weny Xu <wenymedia@gmail.com>
* feat(otlp): persist metric exemplars
OTLP metric conversion now emits exemplars through the shared storage contract. It validates timestamps, IDs, values and label budgets, and associates histogram exemplars only with emitted buckets that contain their values. Invalid observations are dropped and counted while valid points and siblings remain ingestible.
Frontend ingestion authorizes the emitted destinations and retains confirmed completions across metric and exemplar writes, including logical-table batching. Includes conversion and schema-failure isolation tests; tests that also query the new Prometheus endpoint land in the final layer.
Signed-off-by: shuiyisong <xixing.sys@gmail.com>
* feat(otlp): bind exemplars to source metric identities
Signed-off-by: shuiyisong <xixing.sys@gmail.com>
* fix(otlp): bound exemplar memory and preserve series
Signed-off-by: shuiyisong <xixing.sys@gmail.com>
* fix(otlp): skip exemplars without metric engine
Signed-off-by: shuiyisong <xixing.sys@gmail.com>
* fix(otlp): skip exemplars for ordinary tables
Signed-off-by: shuiyisong <xixing.sys@gmail.com>
* refactor(exemplar)!: prefix the shared table name
Signed-off-by: shuiyisong <xixing.sys@gmail.com>
* fix(otlp): avoid waiting with body permits held
Signed-off-by: shuiyisong <xixing.sys@gmail.com>
---------
Signed-off-by: shuiyisong <xixing.sys@gmail.com>
sunanddennis zhuang
Arpit JainandClaude
Weny Xu
jeremyhi
Yingwen
shuiyisong
fys
Lei, HUANG
Andrew Mains
Yvan Wang
LFC
Ning Sun
discord9
Floris SmitandWeny Xu