code wiki / _hdl_build / nx_ha_failover.nx
nx_ha_failover.nx source
↩ module page · 32 lines · 1789 B
1// nx_ha_failover.nx -- CAP-HA-FAILOVER: multi-node failover to KILL THE SPOF (the single NAS the stability census
2// flagged as our AWS-gap). Deterministic failover state machine over two nodes' health: primary down + standby up
3// -> promote standby; both down -> DEGRADED (honest, never a false "up"); recover to the primary when it returns.
4// Conservative (fail back only when the current active is down) -> no flapping. Pure integer, gateable offline;
5// composes the true-health verdict (mc_verdict UP/DOWN). The DATA-PLANE replication + a real standby host are the
6// infra rungs this logic drives. license_tier: ORIGINAL
7import "nx_syscalls.nx"
8
9const HA_PRIMARY: i64 = 0
10const HA_STANDBY: i64 = 1
11const HA_DEGRADED: i64 = 2
12const HA_DOWN: i64 = 0
13const HA_UP: i64 = 1
14
15// decide the active node from the two nodes' health. st[0] = current active (PRIMARY/STANDBY/DEGRADED). Returns the
16// new active. Transitions: primary-down+standby-up => failover; active-down+other-up => switch; both-down => DEGRADED.
17func fo_step(st: *i64, primary_health: i64, standby_health: i64) -> i64 {
18 if st[0] == HA_PRIMARY {
19 if primary_health == HA_UP { return HA_PRIMARY }
20 if standby_health == HA_UP { st[0] = HA_STANDBY; return HA_STANDBY }
21 st[0] = HA_DEGRADED; return HA_DEGRADED
22 }
23 if st[0] == HA_STANDBY {
24 if standby_health == HA_UP { return HA_STANDBY }
25 if primary_health == HA_UP { st[0] = HA_PRIMARY; return HA_PRIMARY }
26 st[0] = HA_DEGRADED; return HA_DEGRADED
27 }
28 // currently DEGRADED -> recover to whichever node is healthy, preferring the primary
29 if primary_health == HA_UP { st[0] = HA_PRIMARY; return HA_PRIMARY }
30 if standby_health == HA_UP { st[0] = HA_STANDBY; return HA_STANDBY }
31 return HA_DEGRADED
32}