Run index_repository in a supervised worker subprocess with skip-and-continue * (Stage 3c). Returns the response string (caller frees): * - the worker's own response on a clean first run (the common path); * - after a crash/hang, the response from a clean single-threaded RECOVERY run * that quarantines the culprit file(s) — status="indexed" with them listed in * skipped[] as phase
| 7628 | * A physical CBM host never falls back to its in-process pipeline: an initial |
| 7629 | * start/protocol failure is returned as an explicit error response. */ |
| 7630 | static char *index_run_supervised(cbm_mcp_server_t *srv, const char *args) { |
| 7631 | invalidate_cached_store(srv); |
| 7632 | |
| 7633 | /* First attempt: normal parallel run. */ |
| 7634 | cbm_index_worker_result_t wr; |
| 7635 | int rc = cbm_index_spawn_worker_with_log_cancel( |
| 7636 | args, false, NULL, NULL, srv ? srv->index_log_callback : NULL, |
| 7637 | srv ? srv->index_log_context : NULL, srv ? &srv->pipeline_cancel_requested : NULL, &wr); |
| 7638 | cbm_mcp_supervised_result_disposition_t disposition = |
| 7639 | cbm_mcp_supervised_result_disposition(rc, &wr); |
| 7640 | |
| 7641 | if (disposition == CBM_MCP_SUPERVISED_RESULT_FALLBACK) { |
| 7642 | cbm_proc_outcome_t outcome = wr.outcome; |
| 7643 | cbm_index_worker_result_free(&wr); |
| 7644 | invalidate_cached_store(srv); |
| 7645 | return build_worker_failure_response(args, outcome); |
| 7646 | } |
| 7647 | if (disposition == CBM_MCP_SUPERVISED_RESULT_UNSAFE_TERMINAL) { |
| 7648 | char *failure = |
| 7649 | build_worker_unsafe_terminal_response(args, wr.outcome, wr.cancellation_requested); |
| 7650 | cbm_index_worker_result_free(&wr); |
| 7651 | invalidate_cached_store(srv); |
| 7652 | return failure; |
| 7653 | } |
| 7654 | if (disposition == CBM_MCP_SUPERVISED_RESULT_SUCCESS) { |
| 7655 | /* Clean exit → transfer the worker's response (the common path). */ |
| 7656 | char *resp = wr.response; /* transfer ownership to caller (may be NULL) */ |
| 7657 | wr.response = NULL; |
| 7658 | cbm_index_worker_result_free(&wr); |
| 7659 | invalidate_cached_store(srv); |
| 7660 | return resp; |
| 7661 | } |
| 7662 | |
| 7663 | /* Crash / hang / nonzero exit → skip-and-continue recovery. Re-run the |
| 7664 | * worker PARALLEL (there are no sequential production runs) with the |
| 7665 | * per-file marker JOURNAL armed; after each failed run the journal's |
| 7666 | * open-S set is the in-flight SUSPECT set. A file is quarantined only |
| 7667 | * when it appears in the suspect sets of TWO CONSECUTIVE failed runs |
| 7668 | * (intersection — a stale or merely unlucky in-flight file rotates out), |
| 7669 | * and only ONE file per round: the OLDEST open S in the intersection |
| 7670 | * (for a hang the oldest still-open file IS the stuck one; for a crash |
| 7671 | * it is the longest-running suspect — the best single deterministic |
| 7672 | * pick). A clean run then indexes the good files and reports the |
| 7673 | * quarantined ones as phase="crash"/"hang" skips via the ordinary |
| 7674 | * Stage-2 skip plumbing. The old design re-ran SINGLE-THREADED to keep |
| 7675 | * one exact marker; at scale that fell into the sequential crawl, went |
| 7676 | * quiet, was killed as a hang mid-pass, and the stale marker got FOUR |
| 7677 | * innocent ms-typescript fixtures quarantined one 15-minute retry at a |
| 7678 | * time. */ |
| 7679 | cbm_proc_outcome_t last_outcome = wr.outcome; |
| 7680 | cbm_index_worker_result_free(&wr); |
| 7681 | |
| 7682 | char marker_path[CBM_SZ_1K]; |
| 7683 | char quarantine_path[CBM_SZ_1K]; |
| 7684 | supervisor_tmp_path(marker_path, sizeof(marker_path), ".marker"); |
| 7685 | supervisor_tmp_path(quarantine_path, sizeof(quarantine_path), ".quarantine"); |
| 7686 | (void)remove(marker_path); |
| 7687 | /* Start the quarantine list empty (truncate any stale file). */ |
no test coverage detected