fix(messagequeue): stop unbounded heartbeat row growth - #530
Merged
Conversation
This was referenced Aug 6, 2026
## Summary ### Why? Partition discovery, lease acquisition, and worker reconciliation all run on the message-poll ticker (`PollIntervalMs`, 100ms default). Discovery drives topic-wide work every tick — a `DISTINCT partition_key` scan, an active-subscriber read, self-lease reads, and lease-acquisition probes — whose query volume multiplies with subscribers × topics at 10x/sec, even though its outcome only changes when membership or the partition set changes. Message polling needs 100ms latency; discovery does not. ### What? New `PartitionDiscoveryIntervalMs` subscription config (default 1s) drives the supervisor's discovery ticker; `PollIntervalMs` continues to drive per-partition message polling unchanged. This cuts discovery-driven query volume ~10x at the default settings. The accepted trade-off is that a brand-new partition's first message now waits up to the discovery interval (1s) before a worker picks it up; messages on already-owned partitions are unaffected. Integration test configs pin discovery to 100ms so lease-handoff and rebalance convergence assertions stay fast. ## Test Plan - ✅ Full Docker integration suite (`bazel test //test/integration/extension/messagequeue/...`) — discovery-latency-sensitive tests (empty-topic wake-up, rebalance convergence, crash recovery) pass with the new cadence.
## Summary ### Why? Every discovery tick, `DiscoverAndAcquirePartitions` attempts `TryAcquireLease` on every discovered partition — including partitions this subscriber already owns and partitions validly leased by peers. Each attempt is an `INSERT … ON DUPLICATE KEY UPDATE` (a write that takes a row lock even when the steal condition fails) plus an ownership SELECT. At steady state that is ~2 × P×(N−1)/N queries per subscriber per tick of contended writes that can never win, concentrated on the same lease rows from every node in the group. ### What? `partitionLeaseStore` gains `GetAllLeases` — a single PK-prefix read of every lease row for `(consumer_group, topic)`. `DiscoverAndAcquirePartitions` uses it to classify discovered partitions: self-owned rows count toward the cap but are not re-probed (renewal is the lease tick's job), rows validly held by another subscriber are skipped without any write, and only unleased or stale (stealable) partitions are attempted. The classification is advisory — `TryAcquireLease` remains the atomic arbiter, so races between the read and the write resolve exactly as before. The read also replaces the previous pre-loop `GetLeasedPartitions` query. A `lease_aware_skipped` counter records how many probes each tick avoids. ## Test Plan - ✅ Full Docker integration suite — rebalance, crash-recovery (stale-lease steal), and orphan-sweep tests exercise the new classification against real MySQL.
## Summary ### Why? `queue_subscriber_heartbeats` rows are never removed: `Deregister` only soft-deletes (sets `deregistered_at`), crashed subscribers never deregister at all, and every process registers under a fresh `hostname-pid` subscriber name — so the table grows monotonically with nodes × subscriptions × deploys. `ActiveSubscribers` range-scans all rows for `(consumer_group, topic)`, so the dead rows slowly tax every fair-share computation. ### What? - `Deregister` now hard-deletes the row. Subscriber names are unique per process, so a departed subscriber's row has no further use; re-subscribing re-inserts via the heartbeat upsert. - New `PurgeStale` store method deletes rows whose heartbeat is older than a threshold; the subscriber calls it each lease tick with 10x `LeaseDurationMs` (5min at defaults) as the backstop for subscribers that crashed without deregistering. Purging a live-but-stalled subscriber's row is harmless — its next heartbeat re-inserts it. - The `deregistered_at` column and its query filter are retained (no schema change) for compatibility with rows written by older code. ## Test Plan - ✅ Integration: `TestRebalance_SubscriberLeaves` now also asserts the closed subscriber's heartbeat row is gone from the table.
behinddwalls
force-pushed
the
preetam/mq-lease-aware-acquire
branch
from
August 6, 2026 16:58
474e9c9 to
d27bb4d
Compare
behinddwalls
force-pushed
the
preetam/mq-heartbeat-gc
branch
from
August 6, 2026 16:58
c26d89e to
4b4888f
Compare
behinddwalls
marked this pull request as ready for review
August 6, 2026 16:59
behinddwalls
changed the base branch from
preetam/mq-lease-aware-acquire
to
main
August 6, 2026 20:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why?
queue_subscriber_heartbeatsrows are never removed:Deregisteronly soft-deletes (setsderegistered_at), crashed subscribers never deregister at all, and every process registers under a freshhostname-pidsubscriber name — so the table grows monotonically with nodes × subscriptions × deploys.ActiveSubscribersrange-scans all rows for(consumer_group, topic), so the dead rows slowly tax every fair-share computation.What?
Deregisternow hard-deletes the row. Subscriber names are unique per process, so a departed subscriber's row has no further use; re-subscribing re-inserts via the heartbeat upsert.PurgeStalestore method deletes rows whose heartbeat is older than a threshold; the subscriber calls it each lease tick with 10xLeaseDurationMs(5min at defaults) as the backstop for subscribers that crashed without deregistering. Purging a live-but-stalled subscriber's row is harmless — its next heartbeat re-inserts it.deregistered_atcolumn and its query filter are retained (no schema change) for compatibility with rows written by older code.Test Plan
TestRebalance_SubscriberLeavesnow also asserts the closed subscriber's heartbeat row is gone from the table.Issues