fix(rest): retry on store conflict in read-modify-write handlers

pkg/rest/autoplace.go

@@ -1556,11 +1556,18 @@ func (s *Server) createOneResource(w http.ResponseWriter, r *http.Request, rdNam
 	// Persist onto rd.LayerStack if not already set so the satellite
 	// reconciler sees the right composition.
 	if len(env.LayerList) > 0 {
-		rd, getErr := s.Store.ResourceDefinitions().Get(r.Context(), rdName)
-		if getErr == nil && len(rd.LayerStack) == 0 {
-			rd.LayerStack = append([]string(nil), env.LayerList...)
-			_ = s.Store.ResourceDefinitions().Update(r.Context(), &rd)
-		}
+		// Bug 204b shape: typed-Patch with retry-on-conflict; the
+		// "only if unset" guard re-runs against the live RD on every
+		// retry so a concurrent reconciler write can't surface a 409
+		// (and a concurrent LayerStack set isn't clobbered).
+		_ = s.Store.ResourceDefinitions().PatchResourceDefinitionSpec(r.Context(), rdName,
+			func(rd *apiv1.ResourceDefinition) error {
+				if len(rd.LayerStack) == 0 {
+					rd.LayerStack = append([]string(nil), env.LayerList...)
+				}
+
+				return nil
+			})
 	}
 
 	// Bug 327 (P1, recurring — reported 5×): a bare `linstor r c <node>
@@ -2514,10 +2521,20 @@ func (s *Server) handleResourceMakeAvailable(w http.ResponseWriter, r *http.Requ
 
 	// Pass-through for CSI-supplied layer_list, identical to the
 	// autoplace / explicit-create flows. RD-level LayerStack wins.
+	//
+	// Bug 204b shape: typed-Patch with retry-on-conflict; the "only
+	// if unset" guard re-runs against the live RD on every retry so
+	// a concurrent reconciler write can't surface a 409 to the
+	// make-available caller.
 	if len(req.LayerList) > 0 && len(rd.LayerStack) == 0 {
-		rd.LayerStack = append([]string(nil), req.LayerList...)
+		err = s.Store.ResourceDefinitions().PatchResourceDefinitionSpec(r.Context(), rdName,
+			func(live *apiv1.ResourceDefinition) error {
+				if len(live.LayerStack) == 0 {
+					live.LayerStack = append([]string(nil), req.LayerList...)
+				}
 
-		err = s.Store.ResourceDefinitions().Update(r.Context(), &rd)
+				return nil
+			})
 		if err != nil {
 			writeStoreError(w, err)
 

pkg/rest/drbd_passphrase.go

@@ -55,20 +55,20 @@ func (s *Server) handleDRBDPassphraseSet(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	rd, err := s.Store.ResourceDefinitions().Get(r.Context(), rdName)
-	if err != nil {
-		writeStoreError(w, err)
-
-		return
-	}
-
-	if rd.Props == nil {
-		rd.Props = map[string]string{}
-	}
-
-	rd.Props[drbdSharedSecretKey] = req.Passphrase
-
-	err = s.Store.ResourceDefinitions().Update(r.Context(), &rd)
+	// Bug 204b shape: typed-Patch with retry-on-conflict so a
+	// reconciler write on the RD between the read and the write
+	// re-applies the secret onto fresh state instead of surfacing
+	// a 409 to the operator.
+	err := s.Store.ResourceDefinitions().PatchResourceDefinitionSpec(r.Context(), rdName,
+		func(rd *apiv1.ResourceDefinition) error {
+			if rd.Props == nil {
+				rd.Props = map[string]string{}
+			}
+
+			rd.Props[drbdSharedSecretKey] = req.Passphrase
+
+			return nil
+		})
 	if err != nil {
 		writeStoreError(w, err)
 

pkg/rest/node_lifecycle.go

@@ -620,24 +620,25 @@ func (s *Server) cascadeOrphansForLostNode(ctx context.Context, name string) err
 	return nil
 }
 
-// updateNodeFlags loads the Node, applies each mutator, and persists.
-// Common shape across all three endpoints; lives here so the handler
-// bodies stay one-line.
+// updateNodeFlags applies each mutator to the Node's flag list and
+// persists. Common shape across all three endpoints; lives here so the
+// handler bodies stay one-line.
+//
+// Bug 205 shape: routed through PatchNodeSpec so a satellite Hello /
+// reconciler write landing between the read and the write re-runs the
+// flag mutation against fresh state under RetryOnConflict instead of
+// leaking a 409 to the operator (same conflict class as the
+// activate/deactivate release-gate flake on mutateResourceFlag).
 func updateNodeFlags(w http.ResponseWriter, r *http.Request, s *Server, mutators ...func([]string) []string) {
 	name := r.PathValue("node")
 
-	node, err := s.Store.Nodes().Get(r.Context(), name)
-	if err != nil {
-		writeStoreError(w, err)
-
-		return
-	}
-
-	for _, m := range mutators {
-		node.Flags = m(node.Flags)
-	}
+	err := s.Store.Nodes().PatchNodeSpec(r.Context(), name, func(node *apiv1.Node) error {
+		for _, m := range mutators {
+			node.Flags = m(node.Flags)
+		}
 
-	err = s.Store.Nodes().Update(r.Context(), &node)
+		return nil
+	})
 	if err != nil {
 		writeStoreError(w, err)
 

pkg/rest/nodes.go

@@ -573,7 +573,16 @@ func (s *Server) upsertNodeAndDiskless(w http.ResponseWriter, r *http.Request, n
 	case err == nil:
 		// fresh create — normal path
 	case errors.Is(err, store.ErrAlreadyExists):
-		err = s.Store.Nodes().Update(r.Context(), n)
+		// Bug 205 shape: the re-register replace is routed through
+		// PatchNodeSpec so a satellite Hello / reconciler write
+		// landing between the AlreadyExists probe and the persist
+		// re-applies the wire snapshot under RetryOnConflict
+		// instead of leaking a 409 into the registration loop.
+		err = s.Store.Nodes().PatchNodeSpec(r.Context(), n.Name, func(live *apiv1.Node) error {
+			*live = *n
+
+			return nil
+		})
 		if err != nil {
 			writeStoreError(w, err)
 
@@ -913,9 +922,14 @@ func (s *Server) handleNodeUpdate(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if patch.NodeType != "" && patch.NodeType != existing.Type {
-		existing.Type = patch.NodeType
+		// Bug 205 shape: typed-Patch with retry-on-conflict so a
+		// concurrent satellite Hello / reconciler write can't bounce
+		// the rare node_type toggle with a 409.
+		err = s.Store.Nodes().PatchNodeSpec(r.Context(), name, func(live *apiv1.Node) error {
+			live.Type = patch.NodeType
 
-		err = s.Store.Nodes().Update(r.Context(), &existing)
+			return nil
+		})
 		if err != nil {
 			writeStoreError(w, err)
 

pkg/rest/rd_clone.go

@@ -446,22 +446,24 @@ func (s *Server) applyClonePropEdits(ctx context.Context, req *rdCloneRequest) e
 		return nil
 	}
 
-	rd, err := s.Store.ResourceDefinitions().Get(ctx, req.Name)
-	if err != nil {
-		return err //nolint:wrapcheck // message wrapped by the caller's envelope
-	}
-
-	if rd.Props == nil {
-		rd.Props = make(map[string]string, len(req.OverrideProps))
-	}
-
-	maps.Copy(rd.Props, req.OverrideProps)
-
-	for _, k := range req.DeleteProps {
-		delete(rd.Props, k)
-	}
-
-	return s.Store.ResourceDefinitions().Update(ctx, &rd) //nolint:wrapcheck // message wrapped by the caller's envelope
+	// Bug 204b shape: typed-Patch with retry-on-conflict so the
+	// freshly-materialised clone target's reconciler can't race this
+	// prop fold-in into a 409 (the edits re-apply to fresh state).
+	//nolint:wrapcheck // message wrapped by the caller's envelope
+	return s.Store.ResourceDefinitions().PatchResourceDefinitionSpec(ctx, req.Name,
+		func(rd *apiv1.ResourceDefinition) error {
+			if rd.Props == nil {
+				rd.Props = make(map[string]string, len(req.OverrideProps))
+			}
+
+			maps.Copy(rd.Props, req.OverrideProps)
+
+			for _, k := range req.DeleteProps {
+				delete(rd.Props, k)
+			}
+
+			return nil
+		})
 }
 
 // writeCloneRefused stamps a clone refusal in the CloneStarted OBJECT

pkg/rest/resource_adjust.go

@@ -145,6 +145,16 @@ func (s *Server) handleResourceDeactivate(w http.ResponseWriter, r *http.Request
 // deactivate. set=true adds the flag; set=false removes every
 // occurrence. Idempotent.
 //
+// Routed through PatchResourceSpec (Bug 204b shape) so a controller
+// reconciler writing the same Resource CRD between the read and the
+// write cannot surface a 409 to the operator: the store re-fetches
+// the live object and re-applies the flag mutation under
+// RetryOnConflict with backoff. Upstream LINSTOR never returns 409
+// on activate/deactivate and the Python CLI does not retry it — the
+// pre-fix Get → mutate → Update shape leaked the optimistic-lock
+// conflict straight onto the wire (release-gate
+// TestGroupFRActivateDeactivate flake).
+//
 // Responds with an `[]ApiCallRc` envelope (Bug 45): golinstor's
 // response parser calls `json.Unmarshal` against this shape
 // unconditionally and fails with "Unable to parse REST json data:
@@ -155,16 +165,12 @@ func mutateResourceFlag(w http.ResponseWriter, r *http.Request, s *Server, flag
 	rdName := r.PathValue("rd")
 	node := r.PathValue("node")
 
-	res, err := s.Store.Resources().Get(r.Context(), rdName, node)
-	if err != nil {
-		writeStoreError(w, err)
-
-		return
-	}
-
-	res.Flags = applyFlagMutation(res.Flags, flag, set)
+	err := s.Store.Resources().PatchResourceSpec(r.Context(), rdName, node,
+		func(res *apiv1.Resource) error {
+			res.Flags = applyFlagMutation(res.Flags, flag, set)
 
-	err = s.Store.Resources().Update(r.Context(), &res)
+			return nil
+		})
 	if err != nil {
 		writeStoreError(w, err)