From 8eeb209a3fe6654abf5bc801095286ae7fc54949 Mon Sep 17 00:00:00 2001 From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com> Date: Fri, 4 Sep 2026 19:51:03 -0400 Subject: [PATCH] Rescope the comments the widening made stale The store-migrate block still called itself "the ONLY step of the collection loop's start that kills collection", which this change is precisely what makes false - the config load and the managed bootstrap are the other two. Attempts and IsRetryable still described themselves in terms of the store interaction alone, though all three sites now share them. --- .../PerformanceMonitor.Darling.Service/DarlingWorker.cs | 9 +++++---- .../StartupFailureTriage.cs | 9 ++++++--- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs index d98399dac..a2ac2aa21 100644 --- a/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs +++ b/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs @@ -1072,10 +1072,11 @@ this is a no-op there. */ instance holding the migration advisory lock both succeed seconds later; a rung that cannot apply against this store never will. StartupFailureTriage decides which arrived and carries the reasoning for where that boundary sits, including why anything it cannot place positively - stays terminal. This block is the ONLY step of the collection loop's start that kills collection, - so the degrade-vs-kill question the next block answers out loud is answered here too: a - transient store failure now degrades to a delayed first cycle, and everything else keeps the - critical line and the stand-down byte for byte. Both caps are load-bearing: an attempt is not + stays terminal. This is the LAST of the three startup steps that can kill collection — the config + load and the managed bootstrap above are the other two, triaged the same way through the same + predicate — so the degrade-vs-kill question the next block answers out loud is answered here + too: a transient store failure now degrades to a delayed first cycle, and everything else keeps + the critical line and the stand-down byte for byte. Both caps are load-bearing: an attempt is not quick just because a refused connect is — one that blocks behind a peer's advisory lock can spend MigrationLockWaitTimeoutSeconds — so the wall-clock budget is what stops 25 attempts from becoming ten hours, and the attempt count is what the warning line reports. diff --git a/Darling/PerformanceMonitor.Darling.Service/StartupFailureTriage.cs b/Darling/PerformanceMonitor.Darling.Service/StartupFailureTriage.cs index fe1ed820c..57ecf7e5c 100644 --- a/Darling/PerformanceMonitor.Darling.Service/StartupFailureTriage.cs +++ b/Darling/PerformanceMonitor.Darling.Service/StartupFailureTriage.cs @@ -157,8 +157,9 @@ namespace PerformanceMonitor.Darling.Service; internal static class StartupFailureTriage { /// - /// How many times the collection loop's first store interaction may be tried before a failure - /// accepts becomes terminal anyway. + /// How many times any ONE of the three triaged startup steps may be tried before a failure + /// accepts becomes terminal anyway. Shared by all three, each of which keeps + /// its own stopwatch, so the count is per site and not a budget they draw down together. /// /// Paired with , which is the real bound — see that constant /// for why an attempt cap alone is not one. Twenty-five tries apart is @@ -260,7 +261,9 @@ internal static class StartupFailureTriage }; /// - /// Whether the collection loop's first store interaction should be tried again after this failure. + /// Whether the triaged startup step that raised this should be tried again. One predicate for all + /// three sites — see the class remarks for why, and for the single typed carve-out that is the only + /// place they differ. /// FALSE for anything not positively recognised, including every whose /// SqlState is not in — see the class remarks for why the /// unclassifiable case is terminal rather than retried.