mariadb: preserve secondary fence marker while pending

[weicao]

Problem

Fresh focused r18 on addon ccd5c0e81ffaafa9b71c9f38c09b00a46246465c and syncer 7502b58f45efd4fe8f2b06e5313230d9aec69510 showed the primary staying converged, but a healthy secondary's durable remote-root fence marker oscillating between secondary and absent.

The exact cross-script cause is in replication-entrypoint.sh: every configure_replication_from_primary_service_once() iteration begins with mark_replication_pending(), and that generic readiness helper unconditionally removed .remote-root-fence-role. The roleProbe later recreated secondary only after its successful grant/fence tick. A recurring runtime-secondary reconcile therefore exposed an absent-marker window even though the secondary remained read_only=1 and otherwise healthy.

Evidence scope is one focused run (N=1), not a frequency claim:

• official seven-sample window: secondary marker secondary in 6 samples, absent in sample 7;
• independent read-only post-red window: secondary 18 times, absent twice;
• watchdog shows a new runtime-secondary reconcile beginning before the absent observation;
• primary was stable in 7/7 samples with read_only=0, all real ready markers, no pending/master.info/remote marker, and no new repair or authority commit;
• full/Ops/fault were not launched and every product scene remains frozen.

Evidence archive outer SHA-256: f74b470331c40f075f366a59bd9fc0a35a7388ac045a50b9f04ae15a9d6ddd73; inner manifest SHA-256: 7a86cfcdeed8fa9cef2c47fd53fb286f5c70b965592a58c9e446b366c400961a; 93/93 files independently verified.

Fix

Remove .remote-root-fence-role mutation from generic mark_replication_pending().

This keeps ownership aligned with the durable contract introduced by the parent PR:

• secondary means a secondary remote-root fence is active;
• marker absence means committed-primary state;
• generic readiness/pending transitions retract ready markers and publish .replication-pending, but do not rewrite durable fence state;
• role-specific code removes the marker only after a primary transition has repaired grants successfully, and writes secondary only after the secondary fence is actually in place.

No read-only, root-account, listener, authority acquisition/commit, switchover, error rollback, or ready-publication operation is removed or reordered.

TDD and gates

Before the production change, the exact-source test was deterministically RED:

• 74 examples, 2 failures;
• static ownership check proved generic pending still referenced the marker;
• a production-function harness extracted the real mark_replication_pending() and configure_replication_from_primary_service_once() functions, entered with marker=secondary, and observed marker=absent at the first secondary-reconcile step.

After the change:

• focused secondary-marker suite: 74 examples, 0 failures;
• related roleProbe, primary acceptance, linearization, role-race, and recovery suites: 182 examples, 0 failures, 1 historical pending;
• complete MariaDB ShellSpec: 771 examples, 0 failures, 9 historical pendings;
• POSIX sh -n, ShellCheck error severity, Helm dependency/lint/default render, rendered contract, and git diff --check: PASS.

Runtime boundary

This PR has no post-fix runtime result yet (N=0). The r18 product FAIL remains frozen. A new Test round is forbidden until official CI, exact Magnus review, and a fresh manifest containing current main plus every current weicao open MariaDB PR head are all complete.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.00%. Comparing base (ccd5c0e) to head (e32233b).

Files with missing lines	Patch %	Lines
...pts-ut-spec/semisync_rejoin_fence_template_spec.sh	0.00%	36 Missing ⚠️

Additional details and impacted files

@@                                 Coverage Diff                                 @@
##           helen/mariadb-r12-primary-roleprobe-marker-contract   #3216   +/-   ##
===================================================================================
  Coverage                                                 0.00%   0.00%           
===================================================================================
  Files                                                      154     154           
  Lines                                                    24296   24331   +35     
===================================================================================
- Misses                                                   24296   24331   +35     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.