Follow-up to #1312 (see the review discussion there).
The live AddHttpFrontend fan-out path has a unanimous-rejection rollback since #1301: compute_rollback maps AddHttpFrontend → RemoveHttpFrontend (bin/src/command/requests.rs:2117), applied on unanimous worker failure (:2642), so the main's ConfigState is reverted and no phantom route persists.
The LoadState path has none of it: LoadStateTask carries no rollback field, requests.rs:3319 dispatches each request into ConfigState before scattering, and on_finish (:3392-3446) only tallies successes/failures. A saved state containing an entry every worker rejects (e.g. a malformed frontend hostname, now answered with Failure instead of a panic since #1312) is re-injected into ConfigState on every load, re-persisted by SaveState, and re-rejected by every worker on every replay — a permanent poison with an ERROR line per worker per load.
load_static_config (:890) has the same shape.
Suggested direction: validate before dispatch on the load path (same throwaway-Router idea as the #1301 listener validation, which also covers the DomainRule parse), and/or give LoadStateTask the same rollback the live path has.
Follow-up to #1312 (see the review discussion there).
The live
AddHttpFrontendfan-out path has a unanimous-rejection rollback since #1301:compute_rollbackmapsAddHttpFrontend→RemoveHttpFrontend(bin/src/command/requests.rs:2117), applied on unanimous worker failure (:2642), so the main'sConfigStateis reverted and no phantom route persists.The
LoadStatepath has none of it:LoadStateTaskcarries no rollback field,requests.rs:3319dispatches each request intoConfigStatebefore scattering, andon_finish(:3392-3446) only tallies successes/failures. A saved state containing an entry every worker rejects (e.g. a malformed frontend hostname, now answered withFailureinstead of a panic since #1312) is re-injected intoConfigStateon every load, re-persisted bySaveState, and re-rejected by every worker on every replay — a permanent poison with an ERROR line per worker per load.load_static_config(:890) has the same shape.Suggested direction: validate before dispatch on the load path (same throwaway-
Routeridea as the #1301 listener validation, which also covers theDomainRuleparse), and/or giveLoadStateTaskthe same rollback the live path has.