⚡ perf(ha): bound the ownership snapshot

[gaborbernat]

OwnershipState grew with every move the group applied, not with the authorities it still homed. Each committed RecordTransfer pushed a TransferRecord onto the authority's record and no command removed one, so a repository deleted a year ago still contributed its record, its epoch, and each move it ever made. At the population #1584 describes, 200,000 authorities each moved eight times during rolling restarts, OwnershipState::snapshot() measured 97,800,047 bytes. 73,200,000 of that was move history, 45.75 bytes per transfer. build_snapshot serialized and cloned the whole buffer on every build, and a follower rejoining after a disk replacement downloaded all of it before it could apply a new entry. The same population now measures 24,600,047 bytes, 123 bytes per live authority.

Nothing read the trail. OwnershipState::transfers and TransferRecord had no caller outside this crate's own tests, and no command consulted record.transfers to reach a decision: assign_home reads home and epoch, transfer and advance_epoch read home and writes. A bounded window would have held a partial copy of something that already exists, since commit_transfer persists a TransferAudit carrying the authority, source, target, actor, reason, barrier, epoch, and commit index to the MetaStore, which the planned transfer contract names as the record an operator and reconciliation answer from. Keeping the last N moves in consensus would still charge every follower that downloads a snapshot while leaving the history too incomplete to audit from, so the replicated map now holds live state only: home, epoch, assignment provenance, and outstanding write leases. That is the shape #2023 took rather than the table split in #2011, because a durable record already owns the history.

ControlCommand::ForgetAuthority removes a retired repository from the map. Operators send it to the existing POST /availability/v1/commands endpoint, so there is no new route, and it applies inside the same decision that records its receipt, as transfer_authority and advance_epoch do. It commits as no_change when the state homes nothing under the authority, which makes a retry after a committed forget safe, and consensus refuses it while a write lease is live, because the lease holder still stamps work with the epoch it drops. Publishing to a forgotten authority assigns it again at epoch one.

One copy per snapshot build remains. TypeConfig fixes openraft's SnapshotData to Cursor<Vec<u8>>, so build_snapshot has to hand its caller an owned Vec, and removing that copy would mean changing the openraft contract. Dropping the growth term bounds that copy, which now scales with live authorities instead of with every move the group has applied.

#1584 lists #1451 as a blocker, which this change does not stand on. The durable audit table exists on main today and takes a row on every committed planned transfer, while #1451 covers recovering an audit whose write failed after the ownership commit. The replicated trail could not have served that recovery, because TransferRecord carried none of the actor, reason, barrier, or commit index the audit answers with.

Closes #1584

[read-the-docs-community]

Documentation build overview

📚 peryx | 🛠️ Build #34321509 | 📁 Comparing 24e0112 against latest (68a4b98)

  🔍 Preview build  

4 files changed

± core/availability/listener/index.html
± core/availability/planned-transfer/index.html
± core/repositories/retention/index.html
± ecosystems/pypi/reference/mirroring/index.html

[codspeed-hq]

Merging this PR will not alter performance

✅ 29 untouched benchmarks
⏩ 133 skipped benchmarks¹

---

_{Comparing perf/bound-ownership-snapshot-1584 (24e0112) with main (68a4b98)}

Footnotes

1. 133 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩