pkg/tso/keyspace_group_manager.go (1)

915-956: ⚠️ Potential issue | 🟠 Major

NextGen reserve keyspace can be removed/inserted incorrectly.
When getBootstrapKeyspaceID returns SystemKeyspaceID, checkReserveKeyspace assumes the reserved key is at index 0 (newKeyspaces[1:]) and inserts at the front, which can drop the wrong keyspace and leave the list unsorted. Remove by value and keep the list ordered.

🐛 Suggested fix to keep reserved key handling order-safe

func (kgm *KeyspaceGroupManager) checkReserveKeyspace(newGroup *endpoint.KeyspaceGroup, newKeyspaces []uint32, reserveKeyspace uint32) {
	if newGroup.ID == constant.DefaultKeyspaceGroupID {
		if _, ok := newGroup.KeyspaceLookupTable[reserveKeyspace]; !ok {
			log.Warn("this keyspace is not in default keyspace group. add it back", zap.Uint32("keyspace", reserveKeyspace))
			kgm.keyspaceLookupTable[reserveKeyspace] = newGroup.ID
			newGroup.KeyspaceLookupTable[reserveKeyspace] = struct{}{}
-			newGroup.Keyspaces = make([]uint32, 1+len(newKeyspaces))
-			newGroup.Keyspaces[0] = reserveKeyspace
-			copy(newGroup.Keyspaces[1:], newKeyspaces)
+			newGroup.Keyspaces = append(append([]uint32{}, newKeyspaces...), reserveKeyspace)
+			sort.Slice(newGroup.Keyspaces, func(i, j int) bool {
+				return newGroup.Keyspaces[i] < newGroup.Keyspaces[j]
+			})
		}
	} else {
		if _, ok := newGroup.KeyspaceLookupTable[reserveKeyspace]; ok {
			log.Warn("this keyspace is in non-default keyspace group. remove it", zap.Uint32("keyspace", reserveKeyspace))
			kgm.keyspaceLookupTable[reserveKeyspace] = constant.DefaultKeyspaceGroupID
			delete(newGroup.KeyspaceLookupTable, reserveKeyspace)
-			newGroup.Keyspaces = newKeyspaces[1:]
+			filtered := make([]uint32, 0, len(newKeyspaces)-1)
+			for _, ks := range newKeyspaces {
+				if ks != reserveKeyspace {
+					filtered = append(filtered, ks)
+				}
+			}
+			newGroup.Keyspaces = filtered
		}
	}
}

pkg/keyspace/tso_keyspace_group.go (1)

361-372: ⚠️ Potential issue | 🟡 Minor

Defer gauge metric updates until after the transaction commits.

Updating SetKeyspaceGroupKeyspaceCountGauge inside the transaction callback can leave metrics inconsistent with persisted data. If a later iteration's LoadKeyspaceGroup or SaveKeyspaceGroup fails, the transaction rolls back but earlier gauge updates persist, reflecting a state that was never written to storage.

Collect the gauge updates and apply them after RunInTxn succeeds.