Round 4 read the diff as the operator of a running deployment and as the
author of the next change. Five findings were claims my own text made
that the code does not support, which is the failure mode this angle is
for.
1. The degradation list said Redis loss costs "cross-instance activity
events". It costs ALL of them: events.RedisBus.Publish logs its
failure and returns without a local fan-out, so subscribers on the
originating instance stop receiving too. A responder told only about
cross-instance delivery would have looked elsewhere. Corrected in the
health payload, both prober log lines, and the docs.
2. config.go promised that connected clients resync after a namespace
change. True of the watch stream, false of the activity stream, whose
cold replay buffer answers a resume as "caught up" (BUG-2731). The
docs already carried the asymmetry; the comment did not, and the
comment is what the next author reads.
3. Resume-detected gaps were counted nowhere. They are the only gap shape
that is always USER-VISIBLE — the client gets sync_required — so an
incident reading pad_watchevents_sequence_gaps_total would have missed
the failure mode with the clearest symptom. New
pad_watchevents_resume_gaps_total, kept separate rather than folded in
because the two are diagnosed differently: one is a delivery fault,
the other is any cursor this instance cannot vouch for.
4. The presence-failure metric's doc said every failure leaves sessions
unlisted and untargetable. Two of the four ops fail in the OPPOSITE
direction — a failed deregister leaves a dead session listed, so a
push aimed at it is accepted and reaches nobody — and a generic alert
on the total would send a responder the wrong way. Now documented per
op, in the code and in the docs table.
5. The go-redis log bridge levels everything at WARN, and the comment
justified that with "benign reconnect chatter" I had never enumerated.
Enumerated now: the stream carries genuine failures, state changes and
informational fallbacks with no severity attached. WARN stays — INFO
would bury the dropped-message line the bridge exists for, and
classifying by message TEXT would make Pad's log levels depend on
go-redis's prose — and a component=go-redis field makes it routable
instead.
6. internal/redisns centralizes key construction but cannot stop a future
contributor wiring one bus with a different Keys than another: every
package compiles, every unit test passes, and the deployment runs
split across two keyspaces while looking configured. Adds a wiring
drift guard that reads cmd_server.go and fails if the three
constructors do not share one Parse-produced value. The rule was
already written down in a package comment; this is its enforcement
step.
7. The limits are per-process and the startup log, log fields and gauge
Help called them "global". Renamed to per-instance / per-principal
throughout, with the no-shared-counter caveat in the startup line.
Claude-Session: https://claude.ai/code/session_01JVDBKbgn3Xt7ndW1YoYd8X
xarmian
9afedbe1a0