mirror of
https://github.com/versity/versitygw.git
synced 2026-09-22 16:04:15 +00:00
Jihyeon Gim
d3e45fdb41
A teardown callback that arrived while its record was reserved was dropped: if the READY that held the reservation then rolled its claim back, the session had lost both publication paths - no request owner and no callback owner - and the record stayed forever, unpublished. The record now stashes the terminal event; releasing the reservation after a rollback consumes the stash and publishes the expiry, since the native session is gone and no second callback will arrive. A duplicate READY that lost the reservation race still proceeded to claim the native transfer, so the transfer could complete with no publication owner. The READY handler now refuses to claim when the reservation is not granted, answering as a duplicate claim. Publication also validates ownership against the record's emitter, so a stale reservation cannot publish over or consume the current owner's record. The shutdown drain raced its producers: a callback could enqueue a publication after the drain checked the queue but before the worker exited, stranding the record behind a stopped worker. The drain now runs after the RC service close, which quiesces the native reaper before returning, so no producer can enqueue behind the drain; ordering replaces locking. Error paths that published directly bypassed the single-shot guard, letting the deferred panic safety net attempt a second publication of the same record. All outcome publications in the READY completion flow now go through the guarded path.