shashank created CAMEL-26768:
--------------------------------
Summary: camel-sanitizer - rule R2: each consumer commit runs
exactly once
Key: CAMEL-26768
URL: https://issues.apache.org/jira/browse/CAMEL-26768
Project: Camel
Issue Type: Improvement
Components: camel-core
Reporter: shashank
Assignee: shashank
Step 3 of the order of work in the exchange sanitizer design
({{design/exchange-sanitizer.adoc}}, CAMEL-26630), second part: rule R2 in
{{camel-sanitizer}} (CAMEL-26714), on the on completion listener SPI of
CAMEL-26742.
*The rule* (as the design and the Javadoc of {{Synchronization}} state it):
each commit of a consumer, the on completion it adds to the exchange before it
routes it (such as the file consumer moving the file), runs {{onComplete}} or
{{onFailure}} exactly once, where it is held at the end; and while it is in a
unit of work it moves only by a handover of the exchange that unit of work was
created for. In the sanitizer the commits of an exchange are the on completions
it holds when it gets the unit of work created for it; on completions added
later are not commits.
*What R2 reports* (new kinds of {{Violation}}):
* {{COMMIT_RUN_TWICE}}: a commit runs again, for one add (such as a unit of
work done twice, or a commit run where it was handed over from and again by the
copy it went to). Reported before the second run, with the thread and stack of
both runs.
* {{COMMIT_HANDED_OVER_BY_OTHER_EXCHANGE}}: a commit handed over through a unit
of work by an exchange it was not created for, such as a part that shares the
unit of work of its parent and is sent to {{seda}} (CAMEL-26576). Reported at
the handover, before the commit runs with the outcome of the copy, with the
step that runs on that thread.
* {{COMMIT_HANDED_OVER_TWICE}}: a commit handed over again from a unit of work
it already left, as when two parts hand over at the same time (CAMEL-26569).
* {{COMMIT_NEVER_RUN}}: the exchange of the unit of work is done and the commit
was neither run, handed over nor taken out; or the context stops while the
commit waits in a copy that was never routed (such as a {{seda}} queue without
a consumer).
The design's third report, two handovers that overlap in time seen with a watch
window, is checked by its outcome instead (a commit handed over twice, run
twice or never): since CAMEL-26569 the unit of work takes each on completion
out under its lock, so an overlap alone is not a violation, and no watch window
(the sampling of R3) is needed. The design text is updated.
*How*
* An {{OnCompletionListener}} that follows each add of a commit by the identity
of its on completion (one on completion can be on many exchanges), in a table
that keeps no exchange: a weak map of the units of work (holding the id of the
exchange each was created for) and a bounded map (10 000) of the commits that
wait in exchanges without a unit of work, such as copies in a {{seda}} queue.
Past the bound the oldest is no longer followed; one WARN and the report say so.
* An {{EventNotifier}} for exchange completed and failed only, for "never ran".
* The step listener of R1 tells R2 which step runs on a thread, so a report
names the step that handed the commit over.
* {{camel.sanitizer.checks}} gets {{commit}}; the default is
{{callback,commit}} (camel-main option).
* A unit of work of a user that does not tell what it hands over (the default
of {{UnitOfWork.handoverSynchronizationWithResult(target, filter)}}) or does
not report its adds is not checked for commits that never run. Commits taken
out as a list ({{handoverCompletions()}}, as {{seda}} does with
{{multipleConsumers}}) are checked for running once only.
*Validation* (as the design asks, before it is proposed): the fixes of
CAMEL-26576 and CAMEL-26569 reverted and R2 reports each at the right point; a
custom consumer whose commit runs twice fails its test with a report that names
its class; the camel-core suite with {{-Psanitizer}} reports nothing from R2
outside the tests that break the rule on purpose; a TLA+ model of the records
(commit run, handover and done on different threads) shows no false report and
no missed violation.
Builds on CAMEL-26742 (the on completion listener SPI, merged).
_Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
