WAL record 52 changed layout in #417 without a WAL_FORMAT_VERSION bump #418

Build: origin/main @ 0f5304485. Deployment: Origin, single node. Engine: not engine-specific (WAL).

Summary

#417 (a1b95c248) changed the payload of WAL record code 52 | 0x8000 and left WAL_FORMAT_VERSION at 3. A store written before #417 holds the old payload. Startup reads it as the new one and refuses with an error that names no format version.

Cause

RecordType::SurrogateBind became SurrogateBindBatch on the same code. The version in nodedb-wal/src/record/header.rs did not change.

The #412 check judges the format by the version in the record header. The version matches, so it cannot name this mismatch.

Earlier format changes bumped the version: 1d7dd5897 (1 to 2, 26 Sep) and b92a97398 (2 to 3, 2 Oct).

Steps to reproduce

1. Run a build from b92a97398 to a1b95c248^ on an empty data directory. My stores came from 4d7b87939.
2. Create a table and insert rows. Stop the server with SIGTERM.

CREATE DATABASE graph;
CREATE TABLE bench_t (id BIGINT, payload TEXT);
INSERT INTO bench_t (id, payload) VALUES (1, 'a'), (2, 'b');

3. Start main at 0f5304485 on the same data directory.

Result in my runs: 10 of 10 boots exit before Serving. The stores held 1,200 and 3,200 rows, both written by 4d7b87939. A store written by 0f5304485 boots on main. The 1,200-row store boots on a build of b7208babb (before #417) with the #412 commits and a local logging patch on top.

Expected

Startup refuses the store and names both format versions, as #412 does for any other version mismatch.

Actual

StartupError: surrogate WAL replay failed — refusing to start with a partially-recovered surrogate registry error=WAL error: invalid WAL payload: SurrogateBindBatch count 1644167168 exceeds the 11 bytes left

The error appears at phase ClusterCatalogOpen. The operator sees a payload error and no sign that the store came from an older build.

Scope

• v0.5.0 writes WAL format version 1. main refuses those stores by version already.
• The affected stores come from main builds between b92a97398 and a1b95c248^. No release holds them.
• CHANGELOG.md [Unreleased] lists no WAL format change since 0.5.0.

Severity

• Facts: the server fails to start. The stored data is intact. A workaround exists: open the store with a build before fix(sql): SQL correctness across routing, copies, typeguards, aggregates and continuous aggregates #417.
• Proposed: SEV-3. Only stores from unreleased builds are affected. The template lists a failed start under SEV-1, so the maintainers set the level.
• Reproducibility: always.
• Last known-good: b7208babb.

Decision for the maintainers

The WAL format version and the 0.6 breaking list belong to the maintainers. Three choices:

A PR follows once the maintainers pick one.