Skip to content

Reject proxy votes when pending admission is full - #1678

Closed
BenCodez wants to merge 4 commits into
masterfrom
fix/reject-proxy-votes-when-pending-full-20260928
Closed

BenCodez wants to merge 4 commits into
masterfrom
fix/reject-proxy-votes-when-pending-full-20260928

Conversation

@BenCodez

@BenCodez BenCodez commented Sep 29, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • make the 4,096 pending Votifier admission limit a hard bound on both Bungee/Waterfall and Velocity
  • reject additional votes once that bound is reached instead of creating a new random ID and spilling them into the separate timed-vote durable cache
  • preserve the existing shutdown rejection path
  • add platform-specific regressions proving a full queue does not call retainIncomingVoteForRestart() or schedule durable replay

Why

The durability fallback added for lifecycle safety bypassed the only bounded admission limit. Once PendingIncomingVoteQueue filled, each additional accepted event could create a fresh durable timed-vote row, allowing memory/database/disk growth to continue without a shared cap.

Failing closed is preferable here: under extreme overload, newly arriving votes may be lost, but the proxy cannot turn the bounded queue into an unbounded durable resource-exhaustion path.

Security

  • removes the unbounded durable overflow described by the validated pending-vote overflow finding
  • no new persistence path is introduced
  • no change to already-admitted pending votes or normal shutdown/reload durability

Compatibility

  • no config/data migration
  • Bungee and Velocity remain equivalent
  • only behavior at the 4,096-entry saturation boundary changes
  • existing admitted work continues to use the same stable-ID/recovery lifecycle

Validation

Source-level review completed against current master. GitHub Actions run #1435 passed the full Maven build.

@coderabbitai

coderabbitai Bot commented Sep 29, 2026 •

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

Next included review available in 46 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 40feadd0-4188-4aef-be0d-40e7963e18e2

📥 Commits

Reviewing files that changed from the base of the PR and between d6005b6 and ba8e49a.

📒 Files selected for processing (4)
  • VotingPlugin/src/main/java/com/bencodez/votingplugin/proxy/bungee/VotingPluginBungee.java
  • VotingPlugin/src/main/java/com/bencodez/votingplugin/proxy/velocity/VotingPluginVelocity.java
  • VotingPlugin/src/test/java/com/bencodez/votingplugin/proxy/bungee/VotingPluginBungeeInitializationTest.java
  • VotingPlugin/src/test/java/com/bencodez/votingplugin/proxy/velocity/VotingPluginVelocityInitializationTest.java

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@BenCodez
BenCodez marked this pull request as ready for review September 29, 2026 02:29
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 29, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-29T02:31:26.868308Z ba8e49a Draft marked ready
🔒 Security Review ✅ Completed 2026-09-29T02:33:42.877112Z ba8e49a Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba8e49a87c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +618 to +622
} else {
getLogger().severe("Pending vote admission is full; vote was rejected instead of expanding durable recovery for "
+ MinecraftUsernameValidator.sanitizeForLog(player));
}
return;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Retain overflow votes instead of discarding them

When 4,096 votes remain pending—for example, while scheduler callbacks are being rejected—VoteEventBungee.onVote has already received the next Votifier event, but this branch returns without processing or persisting it and cannot signal backpressure to the sender. The vote and its rewards are therefore permanently lost; the identical Velocity branch has the same regression. Keep overflow within a bounded ownership mechanism that durably retains admitted events rather than merely logging and discarding them.

AGENTS.md reference: AGENTS.md:L183-L189

Useful? React with 👍 / 👎.

@BenCodez

Copy link
Copy Markdown
Owner Author

Closing because rejecting at this callback cannot provide sender backpressure: Votifier has already accepted the event, so queue saturation would silently lose the vote. A future fix needs bounded durable ownership with stable vote IDs, and any true refusal/retry guarantee requires an acknowledgement-capable ingress contract.

@BenCodez BenCodez closed this Sep 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant