fix: pin wire format version at 1 until 1.0

Pre-1.0 there are no deployed clusters and MIN_WIRE_FORMAT_VERSION
equals WIRE_FORMAT_VERSION, so every wire-version feature gate is
unconditionally true or false inside any cluster that can actually
form — bumping the version only invents a fake rolling-upgrade
requirement. Reset WIRE_FORMAT_VERSION and the rolling-upgrade gate
constants to 1, and drop the now-dead TENANT_ADMIN_ATOMIC_VERSION gate
and its check in favor of always allowing the atomic tenant-creation
path.

Author: farhan-syah

nodedb-types/src/wire_version.rs

@@ -10,13 +10,42 @@
 //!   `nodedb_cluster::rpc_codec::header` (a private constant of that
 //!   module).
 //!
-//! Bump this when the SPSC bridge, WAL, or RPC payload schemas change
-//! in a way that requires a coordinated upgrade. Readers MUST reject
-//! messages stamped with a version other than their own.
+//! # DO NOT BUMP THIS BEFORE 1.0
+//!
+//! It stays at `1` until the first stable release. Read this before
+//! changing it — the reflex to bump on any wire-shape change is wrong here:
+//!
+//! - **There is nothing to be compatible with.** Pre-1.0 there are no
+//!   deployed clusters, so there is no older peer a new build must talk to.
+//! - **A bump cannot buy a rolling upgrade.** `MIN_WIRE_FORMAT_VERSION ==
+//!   WIRE_FORMAT_VERSION` (floor == ceiling), so a node rejects *any* peer
+//!   whose version differs. Mixed-version clusters cannot form at all, which
+//!   makes every `wire_version >= V` feature gate dead code: inside a cluster
+//!   that exists, all nodes are provably on this exact version. Adding such a
+//!   gate is unreachable-branch hardening, not safety.
+//! - **This value is NOT persisted.** It is stamped on `NodeInfo` for the
+//!   handshake and drives `ClusterVersionView`, nothing more. The version
+//!   written into stored raft-log and metadata entries is
+//!   `nodedb_cluster::wire_version::WireVersion::CURRENT`, which is separate
+//!   and independent. Changing the constant here therefore cannot orphan or
+//!   corrupt anything already on disk.
+//!
+//! So: adding a new enum variant, RPC, or payload field needs NO bump. Every
+//! node in a working cluster runs the same build by construction. Ratcheting
+//! this pre-1.0 only invents a stop-the-world upgrade requirement that does
+//! not otherwise exist, and would leave 1.0 shipping as "wire version 20" for
+//! no reason.
+//!
+//! After 1.0, when real deployments exist and a genuine compatibility window
+//! is introduced, this becomes meaningful — bump it then, deliberately, and
+//! only alongside an actual `MIN_WIRE_FORMAT_VERSION < WIRE_FORMAT_VERSION`
+//! support window.
 
 /// Cluster-wide wire format version. Stamped on every `NodeInfo` and
 /// returned by `nodedb::version::WIRE_FORMAT_VERSION` (a re-export).
-pub const WIRE_FORMAT_VERSION: u16 = 8;
+///
+/// WARNING: pinned at 1 until 1.0. See the module docs above before changing.
+pub const WIRE_FORMAT_VERSION: u16 = 1;
 
 /// Minimum wire format version this build can read. Equal to
 /// `WIRE_FORMAT_VERSION`: floor == ceiling, no backward compat window.

nodedb/src/control/metadata_proposer.rs

@@ -139,20 +139,6 @@ pub fn propose_catalog_entry_with_timeout(
         return Ok(0);
     };
 
-    if matches!(entry, CatalogEntry::PutTenantWithAdmin { .. }) {
-        let versions = shared.cluster_version_view();
-        let required = crate::control::rolling_upgrade::TENANT_ADMIN_ATOMIC_VERSION;
-        if !versions.can_activate_feature(required) {
-            return Err(Error::VersionCompat {
-                detail: format!(
-                    "CREATE TENANT requires every cluster node at wire version {required} or \
-                     newer (minimum observed {})",
-                    versions.min_version
-                ),
-            });
-        }
-    }
-
     // Rolling-upgrade gate: until every node in the cluster reports
     // at least `DISTRIBUTED_CATALOG_VERSION`, fall back to the legacy
     // direct-write path on the originating node. Mixing the

nodedb/src/control/rolling_upgrade/mod.rs

@@ -23,6 +23,6 @@ pub mod view;
 
 pub use versions::{
     DESCRIPTOR_DRAIN_VERSION, DESCRIPTOR_VERSIONING_VERSION, DISTRIBUTED_CATALOG_VERSION,
-    TENANT_ADMIN_ATOMIC_VERSION, accept_message, should_compat_mode,
+    accept_message, should_compat_mode,
 };
 pub use view::{ClusterVersionView, compute_from_topology};

nodedb/src/control/rolling_upgrade/versions.rs

@@ -9,6 +9,25 @@ use super::view::ClusterVersionView;
 #[cfg(test)]
 use crate::version::WIRE_FORMAT_VERSION;
 
+// PRE-1.0: every gate below is pinned to 1, the value of
+// `WIRE_FORMAT_VERSION`, so each feature is unconditionally active.
+//
+// `MIN_WIRE_FORMAT_VERSION == WIRE_FORMAT_VERSION` (floor == ceiling), so a
+// node rejects any peer whose version differs and a mixed-version cluster can
+// never form. Inside a cluster that exists, every node is therefore on this
+// exact version, which makes `min_version >= V` constant-true for any
+// `V <= WIRE_FORMAT_VERSION` and constant-false above it. These gates cannot
+// discriminate, so a value above 1 does not protect a rolling upgrade — it just
+// switches the feature OFF permanently and silently routes to a legacy
+// fallback.
+//
+// Do NOT raise these while `WIRE_FORMAT_VERSION` is 1 (see
+// `nodedb_types::wire_version` for why it stays there until 1.0). The gate
+// machinery is kept, not deleted, because it becomes meaningful the moment a
+// real support window (`MIN_WIRE_FORMAT_VERSION < WIRE_FORMAT_VERSION`) is
+// introduced post-1.0 — at which point these regain their original meanings,
+// recorded below.
+
 /// Wire-format version that introduced the replicated catalog DDL
 /// path (`CatalogEntry` proposed via the metadata raft group).
 ///
@@ -20,7 +39,7 @@ use crate::version::WIRE_FORMAT_VERSION;
 /// [`ClusterVersionView::can_activate_feature`] and falls back to
 /// the legacy direct-write path until every node in the cluster
 /// has caught up.
-pub const DISTRIBUTED_CATALOG_VERSION: u16 = 2;
+pub const DISTRIBUTED_CATALOG_VERSION: u16 = 1;
 
 /// Wire-format version that introduced monotonic descriptor
 /// versioning (`descriptor_version: u64` + `modification_hlc: Hlc`
@@ -35,18 +54,13 @@ pub const DISTRIBUTED_CATALOG_VERSION: u16 = 2;
 /// `descriptor_version == 0` as "unknown, always re-fetch". Once
 /// every node reports `wire_version >= 3`, the applier transitions
 /// to stamping.
-pub const DESCRIPTOR_VERSIONING_VERSION: u16 = 3;
+pub const DESCRIPTOR_VERSIONING_VERSION: u16 = 1;
 
 /// Wire version that introduced the replicated
 /// `DescriptorDrainStart` / `DescriptorDrainEnd` metadata entries.
 /// Mixed-version clusters below this version skip drain via the
 /// compat-mode fallback in `drain_for_ddl`.
-pub const DESCRIPTOR_DRAIN_VERSION: u16 = 4;
-
-/// Wire version that introduced the atomic `PutTenantWithAdmin` catalog entry.
-/// Older appliers cannot decode this enum variant, so tenant creation must be
-/// rejected rather than sent or downgraded while any node is below this gate.
-pub const TENANT_ADMIN_ATOMIC_VERSION: u16 = 8;
+pub const DESCRIPTOR_DRAIN_VERSION: u16 = 1;
 
 /// Check if a message from a remote node should be accepted.
 ///
@@ -85,15 +99,4 @@ mod tests {
             assert!(accept_message(WIRE_FORMAT_VERSION - 1).is_err());
         }
     }
-
-    #[test]
-    fn atomic_tenant_admin_requires_the_current_cluster_version() {
-        assert_eq!(TENANT_ADMIN_ATOMIC_VERSION, WIRE_FORMAT_VERSION);
-        let mut mixed = ClusterVersionView::single_node();
-        mixed.min_version = WIRE_FORMAT_VERSION - 1;
-        assert!(!mixed.can_activate_feature(TENANT_ADMIN_ATOMIC_VERSION));
-        assert!(
-            ClusterVersionView::single_node().can_activate_feature(TENANT_ADMIN_ATOMIC_VERSION)
-        );
-    }
 }