dohertj2/mxaccessgw
1
0
Fork 0
Code Issues 3 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(sessions): review follow-up — never orphan a late worker, exempt internal subscribers from unattached grace, tolerate lost close races

Browse Source 
- Open path: the attach gate now waits on CancellationToken.None and the
  manager discards (kills + disposes) the late worker client on ANY
  exception out of the attach step, including the caller's own cancellation
  (checked first, so an abandoned open never yields a session). Previously
  an OperationCanceledException from the gate wait escaped before the
  discard and orphaned the x86 worker. The gate Release is guarded against
  ObjectDisposedException.
- Unattached grace: AttachInternalEventSubscriber sets a separate latch so
  the gateway's own alarm-monitor session (internal subscriber only) is
  never reaped; the idle clock starts at Ready (MarkReady stamps
  _readyAtUtc) instead of at open, so a slow worker start does not eat the
  window.
- KillWorkerAsync / CloseSessionCoreAsync: an ObjectDisposedException from
  the close gate on a session that is no longer registered means a
  concurrent close already removed, accounted and disposed it; both now
  return AlreadyClosed with no fault, no second gauge decrement and no sweep
  failure. The general kill catch only decrements the gauge when the
  session is still registered. The sweep no longer counts AlreadyClosed
  results among the sessions it closed.
This commit is contained in:
Joseph Doherty
2026-10-22 06:43:32 -04:00
parent 285ef64160
commit ec9f26400a
6 changed files with 346 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ZB.MOM.WW.MxGateway.Server/Sessions/SessionManager.cs
+44 -12
View File
@@ -157,13 +157,27 @@ public sealed class SessionManager : ISessionManager
.CreateAsync(session, cancellationToken)
.ConfigureAwait(false);
// The session has been registered (and killable / drainable) for the whole worker
// startup. If a kill or the host drain closed it meanwhile, the attach is refused and
// the late worker is discarded here — it must not be returned on a dead session, and
// nothing else would ever stop it.
bool ready = await session
.TryAttachWorkerClientAndMarkReadyAsync(workerClient, _metrics.SessionOpened, cancellationToken)
.ConfigureAwait(false);
// From here on a live worker exists and nothing but this method knows about it: every
// way out of this block other than "attached and Ready" must discard (kill + dispose)
// it, or it is an orphan the gateway cannot reattach. The session has been registered
// (and killable / drainable) for the whole worker startup, so the attach is refused
// if a kill or the host drain closed it meanwhile — it must not be returned on a dead
// session; and a caller that abandoned the open while the worker was starting gets
// no session either.
bool ready;
try
{
cancellationToken.ThrowIfCancellationRequested();
ready = await session
.TryAttachWorkerClientAndMarkReadyAsync(workerClient, _metrics.SessionOpened)
.ConfigureAwait(false);
}
catch
{
await DiscardWorkerClientAsync(session, workerClient).ConfigureAwait(false);
throw;
}
if (!ready)
{
await DiscardWorkerClientAsync(session, workerClient).ConfigureAwait(false);
@@ -317,15 +331,23 @@ public sealed class SessionManager : ISessionManager
{
wasClosed = await session.KillWorkerWithCloseGateAsync(reason, cancellationToken).ConfigureAwait(false);
}
catch (ObjectDisposedException) when (!_registry.TryGet(sessionId, out _))
{
// Lost the race to a concurrent close: between the lookup above and the gate wait, the
// close finished, removed the session, accounted SessionClosed and disposed the gate.
// Nothing is left to kill and nothing to account; report it as already closed.
return new SessionCloseResult(sessionId, SessionState.Closed, AlreadyClosed: true);
}
catch (Exception exception)
{
session.MarkFaulted(exception.Message);
_metrics.Fault(SessionManagerErrorCode.CloseFailed.ToString());
// If the open-session gauge was incremented for this session (it was not when the
// kill landed while the worker was still starting), decrement it here so
// mxgateway.sessions.open does not leak when the kill path throws.
if (session.OpenRecorded)
// kill landed while the worker was still starting) and nobody has removed it yet
// (a removal accounts the gauge itself), decrement it here so mxgateway.sessions.open
// does not leak when the kill path throws.
if (session.OpenRecorded && _registry.TryGet(sessionId, out _))
{
_metrics.SessionRemoved();
}
@@ -428,8 +450,11 @@ public sealed class SessionManager : ISessionManager
{
try
{
await CloseSessionCoreAsync(candidate.Session, candidate.Reason, closeToken).ConfigureAwait(false);
Interlocked.Increment(ref closedCount);
SessionCloseResult result = await CloseSessionCoreAsync(candidate.Session, candidate.Reason, closeToken).ConfigureAwait(false);
if (!result.AlreadyClosed)
{
Interlocked.Increment(ref closedCount);
}
}
catch (Exception exception)
{
@@ -594,6 +619,13 @@ public sealed class SessionManager : ISessionManager
{
throw;
}
catch (ObjectDisposedException) when (!_registry.TryGet(session.SessionId, out _))
{
// Lost the race to a concurrent close that removed, accounted and disposed the
// session after this caller picked it up (a sweep's snapshot, a client close that
// looked it up first). Not a failure and nothing to redo.
return new SessionCloseResult(session.SessionId, SessionState.Closed, AlreadyClosed: true);
}
catch (SessionCloseStartedException exception)
{
session.MarkFaulted(exception.Message);