adapter: let the synchronous cut-over change the replication factor

Changing a cluster's replication factor while a graceful reconfiguration is in
progress is refused, because the record captures a target factor when written
and the controller's cut-over writes it back to the realized config a tick
later. A factor change applied independently in the meantime would be silently
clobbered, with nothing in the ALTER's response to say so.

That reasoning does not reach the synchronous cut-over. It folds the factor into
the target it transacts and retires the record in the same transaction, and no
consumer reads a retired record's target: `desired_replicas`, `target_hydrated`
and the controller's own cut-over all sit behind `is_in_progress()`. There is no
later cut-over left to clobber the write, so exempt it.

The refusal cost the escape hatch its most useful shape. Forcing a wedged resize
through while scaling down had to be two statements, and between them the
cluster ran the old factor at the new size, the most expensive combination
available, exactly while an operator is firefighting. `fold_reconfiguration_target`
already computed the right answer for a re-targeted factor; only the guard made
that branch unreachable.

The escape hatch is the only exemption. A zero-timeout rollback still leaves a
record in flight to settle on a tick, so it keeps the refusal, and the error hint
now points at the cut-over as the third way out.

The cut-over section gains the wedged case: the refusal still fires without a
`WAIT`, and a combined size-and-factor cut-over lands both dimensions, converges
the replica set, and settles the record `cancelled` because the record's own
target factor was abandoned. The existing factor case ran with no record in
flight, which is why this gap held.

Also drops `Op::UpdateClusterReplicaConfig`. Deleting the staged reconfiguration
machine removed its last producer, leaving the variant, its apply arm and its
audit match arm dead.

Author: aljoscha

src/adapter/src/catalog/transact.rs

@@ -242,11 +242,6 @@ pub enum Op {
         /// this write, alongside the record carried in `config`.
         burst_audit: Option<BurstAudit>,
     },
-    UpdateClusterReplicaConfig {
-        cluster_id: ClusterId,
-        replica_id: ReplicaId,
-        config: ReplicaConfig,
-    },
     UpdateItem {
         id: CatalogItemId,
         name: QualifiedItemName,
@@ -2990,24 +2985,6 @@ impl Catalog {
                     )?;
                 }
             }
-            Op::UpdateClusterReplicaConfig {
-                replica_id,
-                cluster_id,
-                config,
-            } => {
-                let replica = state.get_cluster_replica(cluster_id, replica_id).to_owned();
-                info!("update replica {}", replica.name);
-                tx.update_cluster_replica(
-                    replica_id,
-                    mz_catalog::durable::ClusterReplica {
-                        cluster_id,
-                        replica_id,
-                        name: replica.name.clone(),
-                        config: config.clone().into(),
-                        owner_id: replica.owner_id,
-                    },
-                )?;
-            }
             Op::UpdateItem { id, name, to_item } => {
                 // A non-temporary item must not depend on a temporary one.
                 // Temporary objects are session-scoped and never persisted, so

src/adapter/src/coord/ddl.rs

@@ -1374,7 +1374,6 @@ impl Coordinator {
                 | Op::UpdateOwner { .. }
                 | Op::RevokeRole { .. }
                 | Op::UpdateClusterConfig { .. }
-                | Op::UpdateClusterReplicaConfig { .. }
                 | Op::UpdateSourceReferences { .. }
                 | Op::UpdateSystemConfiguration { .. }
                 | Op::ResetSystemConfiguration { .. }

src/adapter/src/coord/sequencer/inner/cluster.rs

@@ -297,7 +297,17 @@ impl Coordinator {
         // flight would be silently clobbered at cut-over. Refused even when the
         // same statement also re-targets the shape, so a record's target
         // replication factor is always the one it started with.
-        if reconfiguration_in_flight && !matches!(options.replication_factor, Unchanged) {
+        //
+        // The synchronous cut-over is exempt: it folds the factor into the
+        // target it transacts and retires the record in the same transaction,
+        // so there is no later cut-over left to clobber the write. Without the
+        // exemption the escape hatch could not force a wedged reshape through
+        // and change the factor in one statement, which is the shape of the
+        // request when a stuck resize is being scaled down to cut cost.
+        if reconfiguration_in_flight
+            && !matches!(options.replication_factor, Unchanged)
+            && !requests_immediate_cut_over(strategy)
+        {
             return Err(AdapterError::AlterClusterReplicationFactorWhileReconfiguring);
         }
 
@@ -2290,11 +2300,11 @@ fn alter_reconfiguration_target(
 /// AZ-only) from silently reverting the in-flight transition along every dimension
 /// it did not mention.
 ///
-/// Replication factor folds the same way, but only matters for the
-/// nothing-in-flight case: a change to it while a reconfiguration is in
-/// flight is refused before an `ALTER` reaches here, so
-/// `unchanged.replication_factor` is always `true` when `in_flight` is
-/// `Some`.
+/// Replication factor folds the same way. A change to it while a reconfiguration
+/// is in flight reaches here only on the synchronous cut-over, which transacts
+/// the folded target and retires the record together. Every other path refuses
+/// such a change, so `unchanged.replication_factor` is `false` under an
+/// `in_flight` target only for a cut-over.
 fn fold_reconfiguration_target(
     in_flight: Option<&ReconfigurationTarget>,
     new_target: ReconfigurationTarget,

src/adapter/src/error.rs

@@ -746,7 +746,9 @@ impl AdapterError {
             ),
             AdapterError::AlterClusterReplicationFactorWhileReconfiguring => Some(
                 "Cancel the reconfiguration by altering the cluster back to its current \
-                configuration, or wait for it to settle, then change the replication factor."
+                configuration, or wait for it to settle, then change the replication factor. \
+                To commit the reconfiguration and change the replication factor in one \
+                statement, add WITH (WAIT FOR '0s')."
                     .to_string(),
             ),
             AdapterError::AlterClusterScheduleWhileReconfiguring => Some(

test/testdrive/cluster-controller.td

@@ -1526,6 +1526,35 @@ scale=1,workers=2 2
 > SELECT r.size, count(*) FROM mz_cluster_replicas r JOIN mz_clusters c ON r.cluster_id = c.id WHERE c.name = 'cc_cutover' GROUP BY r.size
 scale=1,workers=2 2
 
+# A factor change while a record is in flight stays refused on every path that
+# leaves the record in flight: the record's own cut-over would write its target
+# factor a tick later and silently clobber the change.
+> ALTER CLUSTER cc_cutover SET (SIZE 'scale=1,workers=4')
+
+> SELECT recon.status FROM mz_internal.mz_cluster_reconfigurations recon JOIN mz_clusters ON mz_clusters.id = recon.cluster_id WHERE mz_clusters.name = 'cc_cutover'
+in-progress
+> SELECT r.size, count(*) FROM mz_cluster_replicas r JOIN mz_clusters c ON r.cluster_id = c.id WHERE c.name = 'cc_cutover' GROUP BY r.size
+scale=1,workers=2 2
+scale=1,workers=4 2
+
+! ALTER CLUSTER cc_cutover SET (REPLICATION FACTOR 3)
+contains:cannot change replication factor while a reconfiguration is in progress
+
+# The synchronous cut-over is exempt: it folds the factor into the target it
+# transacts and retires the record in the same transaction, so nothing survives
+# to clobber the write. This is the escape hatch forcing a wedged resize through
+# and scaling down in one statement, rather than paying the old factor at the new
+# size until a second ALTER lands. The record wanted factor 2, so its target was
+# abandoned and it settles `cancelled` rather than `finalized`.
+> ALTER CLUSTER cc_cutover SET (SIZE 'scale=1,workers=4', REPLICATION FACTOR 1) WITH (WAIT FOR '0s')
+
+> SELECT size, replication_factor FROM mz_clusters WHERE name = 'cc_cutover'
+scale=1,workers=4 1
+> SELECT r.size, count(*) FROM mz_cluster_replicas r JOIN mz_clusters c ON r.cluster_id = c.id WHERE c.name = 'cc_cutover' GROUP BY r.size
+scale=1,workers=4 1
+> SELECT recon.status FROM mz_internal.mz_cluster_reconfigurations recon JOIN mz_clusters ON mz_clusters.id = recon.cluster_id WHERE mz_clusters.name = 'cc_cutover'
+cancelled
+
 > DROP CLUSTER cc_cutover CASCADE
 > DROP TABLE cc_cutover_t