Follow-up from the #458/#459 review (#456's transition work).
Once routing flips, every external callback-resolution path delegates exclusively to the queue-storage store: complete_external_in_tx_inner, fail_external_in_tx, retry_external_in_tx, heartbeat_callback, and resolve_callback_in_tx (awa-model/src/admin.rs) resolve against {schema}.leases only — there is no canonical fallback.
The #456 reschedule migration deliberately keeps callback-carrying jobs canonical (deferred_jobs has no callback columns), so during mixed_transition a canonical job parked waiting_external cannot be completed, failed, or resumed via the API post-flip — the resolution reports CallbackNotFound. Its only exit is the callback-timeout rescue (restored in #458), which drops the callback's result payload and retries the job as "callback timed out".
That is strictly better than the pre-#458 state (wedged in running forever), but it still loses the callback result for the transition window. Suggested fix: the callback-resolution admin paths fall back to the canonical plane when the queue-storage lookup misses and the storage transition is unfinalized, mirroring how the rescue and promote sweeps now cover both planes.
Affects both lines the same way; like #456's fix, this needs to work without a migration on unfinalized clusters.
Follow-up from the #458/#459 review (#456's transition work).
Once routing flips, every external callback-resolution path delegates exclusively to the queue-storage store:
complete_external_in_tx_inner,fail_external_in_tx,retry_external_in_tx,heartbeat_callback, andresolve_callback_in_tx(awa-model/src/admin.rs) resolve against{schema}.leasesonly — there is no canonical fallback.The #456 reschedule migration deliberately keeps callback-carrying jobs canonical (
deferred_jobshas no callback columns), so duringmixed_transitiona canonical job parkedwaiting_externalcannot be completed, failed, or resumed via the API post-flip — the resolution reportsCallbackNotFound. Its only exit is the callback-timeout rescue (restored in #458), which drops the callback's result payload and retries the job as "callback timed out".That is strictly better than the pre-#458 state (wedged in
runningforever), but it still loses the callback result for the transition window. Suggested fix: the callback-resolution admin paths fall back to the canonical plane when the queue-storage lookup misses and the storage transition is unfinalized, mirroring how the rescue and promote sweeps now cover both planes.Affects both lines the same way; like #456's fix, this needs to work without a migration on unfinalized clusters.