[Aionw]

Description

Step 6 of #4557: the namespace layer over the object route from step 5 (#4585). Nothing calls it yet; MasterService still serves from its 1024 metadata shards.

The route keeps each key's lock, record and ObjectState, but a tenant's metadata needs more kept in step with every write: the keys that carry work in flight, so the expiry sweep need not walk every object; the order eviction visits objects in, so it need not take a census of every shard; and a place for a policy such as tenant quotas, so it is not booked by hand on each mutating path. This PR adds that layer and replaces the unwired metadata/tenant.h and metadata/tenant_registry.h it grew from.

• Route owner state. Each KeySlot gains a few words for the route's owner (SlotOwnerState: whether the key is on the in-flight list, whether and at what rank the eviction index files it, two policy words) and two intrusive list hooks. The route stores them and never reads them; the owner reaches them through a write guard's or write cursor's owner_state(). The owner links a slot only while it holds an object, so a slot the route drops is never linked, and safe-link hooks assert it.
• metadata::Namespace owns one tenant's ObjectRoute and is its RouteObserver. As each write guard is released, with the key still locked, it lists or unlists the key on a 64-stripe in-flight list, refiles it in the eviction index, and passes the release on to the policy. A sweep reads InFlightKeys() as a snapshot to resolve again. Builds with assertions on check that a key left with no object has its owner state back to the initial value.
• metadata::EvictionIndex is the order eviction visits a namespace's objects in, read through a cursor, lowest rank first. LeaseEvictionIndex files the keys eviction can take memory from (not hard pinned, with a completed memory replica) by lease deadline in 100 ms buckets. A read only ever moves a key's deadline later, so it needs no read hook: the cursor's StillAt, asked under the key's write lock, catches a key that moved on, and that lock's release refiles it.
• NamespacePolicy is the seam a policy plugs into: admit a write, approve growth before allocation, replace, tear down, write release, restore, capacity change and a maintenance tick, each called at a fixed point under fixed locks. StoreControl is what the core offers a policy back. Tenant quota becomes the first policy in step 8.
• metadata::NamespaceTable maps tenant ids to namespaces. A namespace is created atomically through the table's factory and never moves or goes away while the service runs, so a resolved Namespace& needs no ownership, unlike the registry's shared_ptr<Tenant>. The default namespace, the only one when multi-tenancy is off, resolves through an atomic without the map lock.

The table's get-or-create and walk come from the tenant registry of #4215 by @CAICAIIs.

Not in this PR: the eviction::Evictor that merges the namespaces' cursors (step 7), the tenant quota policy (step 8), and anything in MasterService (step 15). The reference design had a NamespaceTable::Clear() for the old snapshot reload; #4406 removed that path, so it is left out.

Behavior is unchanged: no RPC, snapshot or OpLog format changes, and no code path in MasterService reaches the new layer.

Module

• Mooncake Store (mooncake-store)

Type of Change

• New feature
• Refactor

How Has This Been Tested?

Test commands:

make -j12 metadata_namespace_test metadata_namespace_table_test eviction_index_test object_route_test group_index_test master_service_test
ctest -R '^(metadata_namespace_test|metadata_namespace_table_test|eviction_index_test|object_route_test|group_index_test|master_service_test)$'

Test results:

• Unit tests pass

• Integration tests pass (if applicable)

• Manual testing done (describe below)

• Tests: metadata_namespace_test (12 cases), metadata_namespace_table_test (7), eviction_index_test (6), object_route_test (36), group_index_test (7) and master_service_test pass with GCC 16 (Release, assertions on).

• metadata_namespace_test covers the in-flight list (listing on release, replacement, teardown, destruction with listed keys, concurrent writers sharing stripes) and the policy calls with their context and policy words; its concurrency case passes 200 repeated runs. metadata_namespace_table_test covers racing creation for the default and a named namespace, walks that create namespaces, and lookups during creation.

• They replace metadata_tenant_test and metadata_tenant_registry_test, removed with the headers they tested.

• GCC 11.4 (Ubuntu 22.04, the CI floor): every changed translation unit passes -fsyntax-only.

• Formatting: ./scripts/code_format.sh --check --changed-lines --base origin/main is clean with clang-format 20.1.8.

• pre-commit on the changed files: the format and codespell hooks pass; cmake-format rewrites only pre-existing lines of mooncake-store/tests/CMakeLists.txt outside this change, which are left out.

Checklist

• I have performed a self-review of my own code
• I have formatted my code using ./scripts/code_format.sh
• I have run pre-commit on the files changed in this PR and all hooks pass (cmake-format fails on pre-existing lines of mooncake-store/tests/CMakeLists.txt; see above)
• I have updated the documentation (if applicable)
• I have added tests to prove my changes are effective
• For changes >500 LOC: I have filed an RFC issue ([RFC]: Tenant-First Object-Level Metadata Locking #3670, tracked in [Track]: [Store] Land the tenant-first MasterService migration in staged PRs #4557)

AI Assistance Disclosure

• AI tools were used (specify below)

AI assistance was used to port the namespace layer and its tests and to draft this description. The submitter has reviewed every changed line and can defend the change end to end.

[Icedcoco]

LGTM

[CAICAIIs]

lgtm