address feedback: forbid migrating mz_cluster_replica_frontiers

Author: mtabebe

src/adapter/src/catalog/open/builtin_schema_migration.rs

@@ -37,8 +37,9 @@ use futures::future::BoxFuture;
 use mz_build_info::{BuildInfo, DUMMY_BUILD_INFO};
 use mz_catalog::builtin::{
     BUILTIN_LOOKUP, Builtin, Fingerprint, MZ_CATALOG_RAW, MZ_CATALOG_RAW_DESCRIPTION,
-    MZ_OBJECT_ARRANGEMENT_SIZE_HISTORY_DESCRIPTION, MZ_STORAGE_USAGE_BY_SHARD,
-    MZ_STORAGE_USAGE_BY_SHARD_DESCRIPTION, RUNTIME_ALTERABLE_FINGERPRINT_SENTINEL,
+    MZ_CLUSTER_REPLICA_FRONTIERS_DESCRIPTION, MZ_OBJECT_ARRANGEMENT_SIZE_HISTORY_DESCRIPTION,
+    MZ_STORAGE_USAGE_BY_SHARD, MZ_STORAGE_USAGE_BY_SHARD_DESCRIPTION,
+    RUNTIME_ALTERABLE_FINGERPRINT_SENTINEL,
 };
 use mz_catalog::config::BuiltinItemMigrationConfig;
 use mz_catalog::durable::objects::SystemObjectUniqueIdentifier;
@@ -758,6 +759,15 @@ impl Migration {
                 "mz_catalog_raw cannot be migrated"
             );
 
+            // The 0dt caught-up gate reads the leader's `mz_cluster_replica_frontiers` shard for
+            // the live frontiers it checks every collection against. Migrating it via `Replacement`
+            // hands us a fresh shard we write ourselves, so the gate would compare us against
+            // ourselves instead of against the leader.
+            assert_ne!(
+                &*MZ_CLUSTER_REPLICA_FRONTIERS_DESCRIPTION, object,
+                "mz_cluster_replica_frontiers cannot be migrated or else the 0dt caught-up gate loses its live-frontier reference"
+            );
+
             let Some(object_info) = self.system_objects.get(object) else {
                 panic!("migration step for non-existent builtin: {object:?}");
             };

src/adapter/src/coord/caught_up.rs

@@ -272,10 +272,11 @@ impl Coordinator {
         // set. `mz_cluster_replica_frontiers` is a controller-managed builtin
         // written with ±1 diffs, so it satisfies that invariant.
         //
-        // NOTE: these are the leader's frontiers only because we read the leader's shard. A
-        // release that `Replacement`-migrates `mz_cluster_replica_frontiers` itself, or a test
-        // forcing replacement across all builtins, hands us a shard we write ourselves, and the
-        // lag check below then compares this deployment against itself.
+        // NOTE: these are the leader's frontiers only because we read the leader's shard.
+        // `validate_migration_steps` forbids migrating `mz_cluster_replica_frontiers` for this
+        // reason, so a declared migration can't reach here. A test forcing replacement across all
+        // builtins bypasses that guard, hands us a shard we write ourselves, and the lag check
+        // below then compares this deployment against itself.
         let live_frontiers = self
             .controller
             .storage_collections

src/catalog/src/builtin.rs

@@ -836,6 +836,16 @@ pub static MZ_OBJECT_ARRANGEMENT_SIZE_HISTORY_DESCRIPTION: LazyLock<SystemObject
         object_type: CatalogItemType::Table,
         object_name: MZ_OBJECT_ARRANGEMENT_SIZE_HISTORY.name.to_string(),
     });
+
+/// Identifies [`MZ_CLUSTER_REPLICA_FRONTIERS`] for the schema-migration guard in
+/// `builtin_schema_migration.rs`, which forbids migrating this source because the 0dt
+/// caught-up gate reads the leader's shard for it to learn the live frontiers.
+pub static MZ_CLUSTER_REPLICA_FRONTIERS_DESCRIPTION: LazyLock<SystemObjectDescription> =
+    LazyLock::new(|| SystemObjectDescription {
+        schema_name: MZ_CLUSTER_REPLICA_FRONTIERS.schema.to_string(),
+        object_type: CatalogItemType::Source,
+        object_name: MZ_CLUSTER_REPLICA_FRONTIERS.name.to_string(),
+    });
 pub const MZ_SYSTEM_ROLE: BuiltinRole = BuiltinRole {
     id: MZ_SYSTEM_ROLE_ID,
     name: SYSTEM_USER_NAME,