Async oplog hardened: transactions can no longer leak ghost events
Summary: Async oplog hardened: transactions can no longer leak ghost events (v0.6.0b9).
The Rust server's opt-in async oplog (RustServer(oplog_async=True) /
secantusd-rs --oplog-async) closed out its prototype caveats. The
important one was a correctness bug the hardening audit caught: a write
inside a multi-document transaction handed its oplog entry to the
background drainer before the transaction committed, so a rollback
left a persisted entry for data that never existed — a phantom change
event and a wrong PITR row. Entries now buffer on the transaction handle
and reach the drainer only after the commit succeeds; a rolled-back
transaction leaves no oplog trace.
Two smaller async-mode gaps closed with it. Reading local.oplog.rs
now drains the writer's queue first, so a client that just got its
write acknowledged sees the entry in the oplog view — read-your-own-write,
as on mongod. And the opportunistic prune cadence moved from the write
path to the drainers themselves: the old trigger could only prune rows
already persisted, so a lagging drainer queue escaped every sweep and a
burst of writes could leave the oplog over its cap until the next
explicit prune. CI gains an async-oplog lane that runs the whole
storage suite with the drainer pool live.