4 Commits

Author	SHA1	Message	Date
houseme	7437f99c45	fix(cache): key the object body cache on data_dir for write-uniqueness (#4703) ... * refactor(object-data-cache): derive Default for ObjectDataCacheGetRequest The GET request literal is hand-listed field-by-field across ~13 test sites in two crates. Adding `mod_time_unix_nanos` in backlog#1111 had to touch every one and still missed a literal, producing a compile error caught only in a later CI lane. Derive `Default` and spread the engine-crate literals so the next field addition is absorbed rather than fanned out. Co-Authored-By: heihutu <heihutu@gmail.com> * fix(cache): key the object body cache on data_dir for write-uniqueness The cache key's correctness rested on being write-unique, but its only write-scoped component was `mod_time` — a wall-clock timestamp that is not monotonic and can be absent. Two writes that collide on MD5 (same etag+size) and land on an equal mod_time (clock skew, same-tick, or absent) derived the same key, so a node that never saw the overwrite could serve the previous body for up to the TTL, and the same collision turned the fill-after-invalidation race into a serving bug. This is the store's strong-read-after-write guarantee leaning on a probabilistic argument. Add `data_dir` — the xl.meta directory UUID ecstore regenerates on every body write — as the primary write-unique anchor: - surface `data_dir: Option<Uuid>` on ObjectInfo, copied from FileInfo in the single GET-path constructor `from_file_info`; - carry it into ObjectDataCacheKey as `data_dir_u128` (held as u128 to keep the engine crate free of a uuid dependency), derived in the one planner site both the ecstore hook and the usecase layer share, so both produce an identical key by construction; - keep `mod_time` as a second anchor and `etag+size` as belt-and-braces; an absent data_dir falls back to the prior behavior — strict improvement, no regression. Two writes distinct only by data_dir now derive different keys even under an MD5 collision with identical mod_time — the case mod_time alone cannot cover. Blast radius is compiler-guarded: ObjectInfo derives Default and every real construction site uses `..Default::default()`, so only from_file_info and one full-literal test needed the field. The three P0 body_cache_hook_e2e regressions, engine (80), and app (36) suites pass unchanged; a mutation that severs the planner wiring fails planner_key_changes_with_data_dir. Refs: backlog#1111, backlog#1118 Co-Authored-By: heihutu <heihutu@gmail.com> * fix(cache): thread data_dir field through the merged mutation-hook test Merging main (which landed the object-mutation-hook work, backlog#1131) brought in a GetRequest test literal that predates the data_dir field. Spread it via `..Default::default()` — the derive(Default) added here means this is the last such hand-listed literal to need touching. Co-Authored-By: heihutu <heihutu@gmail.com> --------- Co-authored-by: heihutu <heihutu@gmail.com>	2026-07-11 08:00:52 +08:00
houseme	6780140318	fix(object-data-cache): make the GET key write-unique and dedup the lookup (#4693) ... fix(object-data-cache): make GET body cache key write-unique and dedup lookups Address four object-data-cache GET-path findings (backlog#1107 batch): ODC-06 (backlog#1111): the cache key was content-unique, not write-unique. Extend ObjectDataCacheKey with the resolved version's modification time (i128 unix nanoseconds, None -> 0), derived once in the shared planner so the ecstore hook and the usecase layer produce an identical key. An unversioned overwrite advances mod_time, so a stale node can no longer serve old bytes for up to the TTL under an MD5 collision; etag + size stay as belt-and-braces. ODC-16 (backlog#1121): every cacheable GET planned and looked up twice (once in the ecstore hook, once in the usecase layer), double-counting hits, hit_bytes and lookups. GetObjectReader now carries a GetObjectBodySource marker (Unprobed / HookMissed / HookServed); the hook stamps it, and build_get_object_body_with_cache serves a hook-served body directly and skips its lookup whenever the hook already probed. One hook-served GET now records exactly one lookup. ODC-19 (backlog#1124): ENABLE=true with no explicit mode defaulted to HitOnly, which never fills and keeps a permanent 0% hit rate. Default to FillBufferedOnly, log the resolved mode at startup, and warn when HitOnly is selected explicitly. ODC-24 (backlog#1129): max_entry_bytes above the in-memory GET fill limits was silently inert. Clamp the planner's size eligibility to min(max_entry_bytes, seek-support threshold, 64 MiB buffer cap) so ineligible sizes plan SkipTooLarge instead of being reported eligible, and warn at startup when the excess is inert. Co-authored-by: heihutu <heihutu@gmail.com>	2026-07-10 18:22:20 +00:00
houseme	b604074217	perf(object-data-cache): take fill off the GET path and fix the metrics (#4678) ... * fix(object-data-cache): make cache metrics one-increment-per-GET Rework the object data cache observability so each counter carries one clear meaning, and drop dead per-entry state. ODC-17 (backlog#1122): split requests_total, which was incremented by both plan_get and lookup_body, into plan_total{decision,reason,size_class} (emitted only by plan_get) and lookup_total{result,size_class} (emitted only by lookup_body). Each is now incremented exactly once per GET per layer; help text states this. ODC-18 (backlog#1123): add a JoinedInflightFill result (label joined_inflight) so a singleflight waiter is no longer counted as an insert. record_fill_result now always counts the outcome but records fill bytes only when non-zero and the duration histogram only when present, so joined_inflight / skipped_by_mode / skipped_size_mismatch no longer inflate fill_bytes_total or add non-fill duration samples. The waiter->JoinedInflightFill mapping lives in MokaBackend (owned by a concurrent branch); cache.rs handles the variant already. ODC-29 (backlog#1134): stop refreshing the cache-state gauge on every lookup, and debounce it on fill/invalidate to at most once per second via an AtomicU64 millis timestamp, since moka's entry_count is a settling approximation. ODC-36 (backlog#1141): give invalidations_total an outcome label (removed|noop) and skip the gauge refresh on the no-op path. Extend ObjectDataCacheInvalidationResult with Removed{keys}/NoOp (Success kept as a transitional variant until MokaBackend reports the removal count); NoopBackend now reports NoOp. ODC-30 (backlog#1141): drop the dead content_length/etag/inserted_at fields (and getters) from ObjectDataCacheEntry, which are redundant with the moka key identity; the constructor keeps its arity so the out-of-scope MokaBackend caller still compiles. Gate is_null_version behind cfg(test). Tests use a thread-local metrics recorder to avoid the global-singleton flakiness. Fill-enabled test configs set min_free_memory_percent=0 so the cgroup gate does not refuse fills in CI pods. Co-Authored-By: heihutu <heihutu@gmail.com> * fix(object-data-cache): move fill off GET path, bound & harden the fill Implements five object-data-cache audit findings. ODC-15 (backlog#1120): the GET response no longer blocks on cache fill. The buffered/materialized body is already in hand, so the fill now runs in a detached task and the response is built immediately. Singleflight is made non-blocking: `try_acquire` returns Leader or Busy, and a non-leader skips its own fill (SkippedSingleflightBusy) instead of waiting on another request's leader. The inner fill spawn is KEPT: once the index key is registered, the recheck/undo must complete even if the enclosing fill future is aborted, so removing it would weaken the cancellation-safety guarantee (ODC-13 test) and the invalidation-race undo. ODC-11 (backlog#1116): enforce the fill-concurrency knobs. MokaBackend now holds a Semaphore sized min(per_cpu * parallelism, max), acquired after winning leadership and before the memory gate. On saturation it rejects (try_acquire_owned) with SkippedFillConcurrency rather than queueing, so the fill path never reintroduces GET-latency coupling. ODC-14 (backlog#1119): the memory gate no longer does a blocking sysinfo refresh under a mutex on the async fill path. A dedicated periodic refresher (tokio interval + spawn_blocking) updates an atomic snapshot every 5s; allows_fill is now lock-free. The min_free_memory_percent == 0 short-circuit still runs before any snapshot read. No runtime at construction (sync unit tests) simply keeps the seed snapshot. ODC-32 (backlog#1137): singleflight no longer emits metrics while holding the map mutex. try_acquire/remove_entry capture the map length under the guard, drop it, then emit the gauge/counter. ODC-07 (backlog#1112): the materialize read is bounded via take(capacity + 1) so an over-long stream cannot grow the buffer past the in-memory GET threshold, and any length mismatch is now a hard error matching the direct-memory GET path, instead of warn-and-serve. cache.rs is owned by a concurrent branch; this commit only appends the SkippedFillConcurrency and SkippedSingleflightBusy variants + label arms. Co-Authored-By: heihutu <heihutu@gmail.com> * fix(object-data-cache): report JoinedInflightFill and invalidation outcome Reconciles the moka_backend half of two metrics-semantics findings after merging fix/odc-metrics-semantics (which landed the cache.rs half). ODC-18 (backlog#1123): the singleflight non-leader path now returns JoinedInflightFill instead of counting as an insert, so N concurrent GETs of one cold key record one insert, not N. This composes with the ODC-15 redesign: the non-leader does NOT wait for the leader (it already owns the body and never re-serves from the fill result), so no blocking wait is reintroduced. Drops the redundant local SkippedSingleflightBusy variant in favor of the canonical JoinedInflightFill (mapped to no bytes / no duration by the facade). SkippedFillConcurrency (ODC-11) is retained. ODC-36 (backlog#1141): MokaBackend::invalidate_object now returns Removed { keys } / NoOp instead of the transitional Success, so the facade labels invalidations_total{outcome=removed|noop} and skips the cache-state gauge refresh on the no-op path. Tests: duplicate-fill test asserts JoinedInflightFill (bites when reverted to Inserted); new no-op invalidation test; matching-identity test asserts Removed { keys: 1 }. Co-Authored-By: heihutu <heihutu@gmail.com> * fix(object-data-cache): drop unused mut on materialize stream binding The ODC-07 change moves `final_stream` into `AsyncReadExt::take`, so the `build_get_object_body_with_cache` parameter is no longer mutated in place. Co-Authored-By: heihutu <heihutu@gmail.com> * refactor(object-data-cache): close the cross-branch coordination seams Merging the metrics and hot-path branches left four transitional shims that only existed because each side could not edit the other's files. With both sides present they are dead weight, and two of them actively misreport. - ObjectDataCacheEntry::new took content_length and etag only to keep the caller in moka_backend.rs compiling, then discarded both. Drop them; the entry is a Bytes wrapper and the caller now passes only the body. - SkippedSingleflightClosed lost its only producer when the waiter model was replaced by Leader/Busy election. Remove the variant. - The fill-accounting match ended in a wildcard that charged fill_bytes and a duration to every non-Inserted outcome, so a fill rejected by the memory gate or the concurrency semaphore — which never touched the backend and wrote nothing — still inflated fill_bytes_total. Enumerate every variant explicitly: only outcomes that wrote the body report bytes and duration. Exhaustiveness also forces a future variant to state its accounting rather than inherit a wrong default. - InvalidationResult::Success mapped a no-op to outcome=removed, the exact lie backlog#1141 set out to fix, and its doc comment claimed MokaBackend still returned it after that backend had been widened. It has no producer left. Remove it, and tighten the app-layer test from "any successful variant" to the real contract: the pre-mutation call reports Removed{keys:1}, the post-delete call NoOp. Refs: backlog#1123, backlog#1141, backlog#1135 Co-Authored-By: heihutu <heihutu@gmail.com> --------- Co-authored-by: heihutu <heihutu@gmail.com>	2026-07-10 12:25:23 +00:00
houseme	eebd16d8a4	feat(cache): add object data cache engine and app flow (#4187) ... * feat(cache): add object data cache engine * feat(cache): wire app-layer object cache flow * refactor(cache): streamline app-layer cache flow * refactor(cache): tighten cache flow internals * refactor: address final clippy cleanup * chore(deps): update quick-xml to 0.41.0 * feat(cache): wire object data cache env config * fix(cache): gate materialize fill by cache plan * chore(cache): add object data cache benchmark gate * fix(cache): guard object cache fill size mismatches * refactor(cache): streamline object cache body planning * fix(cache): align object cache rollout config * test(cache): cover buffered object cache benchmark * test(cache): isolate object cache benchmark metrics * test(cache): mark materialize rollout experimental * test(cache): tighten object cache benchmark gate * fix(cache): address review findings for object data cache - singleflight: clean up leader entry on cancellation (Drop impl) so a dropped GET future can no longer wedge all subsequent fills for the same key; switch the fill map to a std Mutex and add a regression test - adapter: honor RUSTFS_OBJECT_DATA_CACHE_ENABLE=true by defaulting to hit_only when no explicit mode is set (explicit mode still wins) - planner: treat nil version UUIDs as "no value" per repo convention so unversioned objects key under the canonical "null" instead of fragmenting the key space - multipart: invalidate the object cache on the quota-exceeded rollback delete after complete-multipart, closing a stale-cache window - layering: move the disabled-cache fallback into app::context and drop the new infra->app layer-dependency baseline entry * fix(cache): close invalidation races and drop full-cache scan on writes - index: make identity-index insert/remove/prune atomic via starshard compute_if_present/compute_if_absent so concurrent fills can no longer drop each other's keys (lost keys made entries unreachable to invalidation until TTL); add a concurrency regression test - fill: register the key in the identity index before the entry becomes visible in the cache and re-check the index afterwards, undoing the fill when an invalidation raced in between (new skipped_invalidation_race fill result) - invalidate: with the index now authoritative, remove the full-cache iter() fallback that made every PUT/DELETE of a never-cached object O(total cache entries) (two scans per PUT, 2N per batch delete) - materialize-fill: fail the GET instead of falling back to the partially consumed stream after a mid-read error (the fallback would send a body missing its prefix under a full-length Content-Length), and log the same size-mismatch warning as the sibling buffering paths Co-Authored-By: heihutu <heihutu@gmail.com> * test(storage): fix media-dependent buffer clamp expectation test_concurrency_manager_multi_factor_strategy_buffer_clamp asserted media_cap.min(MI_B), but the implementation's final safety clamp is [32KiB, media_cap.max(MI_B)] — deliberately so a media cap above 1MiB (NVMe's 2MiB default) stays effective. The test only passed on machines detected as SSD/Unknown (cap == 1MiB) and failed on NVMe-backed CI runners with 2MiB != 1MiB. Assert the media cap itself, which is what the strategy actually guarantees on every environment. Co-Authored-By: heihutu <heihutu@gmail.com> * test(storage): format buffer clamp assertion * chore(logging): update tier guardrail path --------- Signed-off-by: houseme <housemecn@gmail.com> Co-authored-by: cxymds <cxymds@gmail.com> Co-authored-by: overtrue <anzhengchao@gmail.com> Co-authored-by: heihutu <heihutu@gmail.com>	2026-07-03 18:11:14 +08:00