《后端架构设计·分布式与数据一致性》12.1 多活拓扑：单元化、双活与就近接入

// file: internal/platform/multisite/plan.go
// tier: L1
// verify: go test ./internal/platform/multisite/ -count=1
package multisite

import (
	"fmt"
	"sort"
)

// Mode names the topology being compared.
type Mode string

const (
	// ModeCell pins every tenant to one cell and keeps a cold standby.
	ModeCell Mode = "unitized"
	// ModeDualCity runs two cells in the same metro with synchronous copy.
	ModeDualCity Mode = "same-city-dual"
	// ModeRemote runs cells in different regions with asynchronous copy.
	ModeRemote Mode = "geo-multi-active"
)

// Cell is one failure domain: its racks share power, switch and network fate.
type Cell struct {
	ID       string
	Region   string
	Capacity int
}

// Placement assigns a tenant to a home cell and a standby cell.
type Placement struct {
	Tenant  string
	Home    string
	Standby string
}

// Plan is a topology plus the placement of every tenant.
type Plan struct {
	Mode    Mode
	Cells   []Cell
	Tenants []Placement
}

// Validate rejects plans whose blast radius cannot be computed.
func (p Plan) Validate() error {
	if p.Mode != ModeCell && p.Mode != ModeDualCity && p.Mode != ModeRemote {
		return fmt.Errorf("multisite: unknown mode %q", p.Mode)
	}
	if len(p.Cells) == 0 {
		return fmt.Errorf("multisite: plan has no cells")
	}
	capacity := make(map[string]int, len(p.Cells))
	for _, c := range p.Cells {
		if c.ID == "" {
			return fmt.Errorf("multisite: cell with empty id")
		}
		if _, dup := capacity[c.ID]; dup {
			return fmt.Errorf("multisite: duplicate cell %q", c.ID)
		}
		if c.Capacity < 0 {
			return fmt.Errorf("multisite: cell %q has negative capacity", c.ID)
		}
		capacity[c.ID] = c.Capacity
	}
	seen := make(map[string]struct{}, len(p.Tenants))
	homes := make(map[string]int, len(p.Cells))
	for _, t := range p.Tenants {
		if t.Tenant == "" {
			return fmt.Errorf("multisite: tenant with empty name")
		}
		if _, dup := seen[t.Tenant]; dup {
			return fmt.Errorf("multisite: duplicate tenant %q", t.Tenant)
		}
		seen[t.Tenant] = struct{}{}
		if _, ok := capacity[t.Home]; !ok {
			return fmt.Errorf("multisite: tenant %q has unknown home %q", t.Tenant, t.Home)
		}
		if _, ok := capacity[t.Standby]; !ok {
			return fmt.Errorf("multisite: tenant %q has unknown standby %q", t.Tenant, t.Standby)
		}
		if t.Home == t.Standby {
			return fmt.Errorf("multisite: tenant %q uses %q as its own standby", t.Tenant, t.Home)
		}
		homes[t.Home]++
	}
	ids := make([]string, 0, len(capacity))
	for id := range capacity {
		ids = append(ids, id)
	}
	sort.Strings(ids)
	for _, id := range ids {
		if homes[id] > capacity[id] {
			return fmt.Errorf("multisite: cell %q hosts %d tenants above capacity %d", id, homes[id], capacity[id])
		}
	}
	return nil
}

// Impact is the cost of losing a set of cells.
type Impact struct {
	TenantsAffected int
	WritesBlocked   int
	ReadsServed     int // served by a warm standby with a synchronous copy
	ReadsDegraded   int // served stale from an asynchronous standby
	Unavailable     int // no read path at all
	RedundancyLost  int // standby lost while the home stayed healthy
}

// Impact computes the blast radius of losing the named cells.
func (p Plan) Impact(failedCells ...string) Impact {
	failed := make(map[string]bool, len(failedCells))
	for _, id := range failedCells {
		failed[id] = true
	}
	var out Impact
	for _, t := range p.Tenants {
		homeDown := failed[t.Home]
		standbyDown := failed[t.Standby]
		if !homeDown {
			if standbyDown {
				out.RedundancyLost++
			}
			continue
		}
		out.TenantsAffected++
		out.WritesBlocked++
		switch {
		case standbyDown:
			out.Unavailable++
		case p.Mode == ModeCell:
			out.Unavailable++
		case p.Mode == ModeDualCity:
			out.ReadsServed++
		case p.Mode == ModeRemote:
			out.ReadsDegraded++
		}
	}
	return out
}

$ go test ./internal/platform/multisite/ -v -count=1
=== RUN   TestValidateRejectsBadPlans/duplicate_cell
    plan_test.go:70: rejected duplicate cell: multisite: duplicate cell "sh-a"
=== RUN   TestValidateRejectsBadPlans/capacity_exceeded
    plan_test.go:70: rejected capacity exceeded: multisite: cell "sh-a" hosts 2 tenants above capacity 1
=== RUN   TestImpactByMode/unitized_loses_reads_on_home_failure
    plan_test.go:118: mode=unitized failed=[sh-b] affected=2 writes_blocked=2 reads_served=0 reads_degraded=0 unavailable=2 redundancy_lost=2
=== RUN   TestImpactByMode/same-city_dual_serves_from_warm_standby
    plan_test.go:118: mode=same-city-dual failed=[sh-b] affected=2 writes_blocked=2 reads_served=2 reads_degraded=0 unavailable=0 redundancy_lost=2
=== RUN   TestImpactByMode/geo_multi-active_serves_stale_reads
    plan_test.go:118: mode=geo-multi-active failed=[sh-b] affected=2 writes_blocked=2 reads_served=0 reads_degraded=2 unavailable=0 redundancy_lost=2
=== RUN   TestImpactByMode/two_cells_down_expose_shared_standby
    plan_test.go:118: mode=same-city-dual failed=[sh-b hz-c] affected=4 writes_blocked=4 reads_served=2 unavailable=2 redundancy_lost=2
=== RUN   TestStandbyLossKeepsWrites
    plan_test.go:143: standby_only affected=0 writes_blocked=0 redundancy_lost=1
=== RUN   TestImpactIsDeterministic
    plan_test.go:156: deterministic affected=4 writes_blocked=4 reads_degraded=2
PASS
ok  	archlab/internal/platform/multisite	0.397s