| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix(routing): defer plan quota commit until upstream accepts request Plan quota was charged at handler entry (check_plan_or_default_limits), before flow control queuing and before the request reached the upstream provider. When a client disconnected mid-queue or the provider call failed, the quota was already consumed and the rollback path for flow control timeouts was missing — leading to quota burn with no upstream service and no visible log (FlowControlQueueTimeout is dedup'd). Split check_and_record into peek_only (read-only) + commit_record (write). check_plan_limits now returns a PlanCharge that is committed only after provider.chat_stream/chat returns Ok. Dropping PlanCharge without commit consumes zero quota; the ConcurrencyGuard releases via its own Drop. This removes the entire rollback machinery (PlanRollback / rollback_plan_quota / rollback_plan_windows / unrecord_window) since the "charged but failed" window no longer exists. Principle 2 (client disconnect cleanup) is already handled by the existing AcquireCleanup::drop in flow control — added tests to verify the future-drop path actually removes queued requests. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: liqiang <liqiang64@huawei.com> | 1 个月前 |