# Premium DM Cluster Delete Lock Registration

## Analysis

| Area                                                           | Impact                                                                                                                                                                                                                           | Verification                                                                                                                                        |
| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `dataflow-service-ng/app/controllers/premium_dm/premium_dm.go` | Register a mgmt custom status during API create, persist returned `cluster_status_id`, and compensate only when the create transaction fails. Post-commit response-construction errors must not release the cluster delete lock. | Unit tests for create success, registration failure, transaction-failure compensation, and post-commit response-build failure without compensation. |
| `dataflow-service-ng/app/models/premium_dm/worker.go`          | Keep async delete cleanup as the normal deregistration path; add a test seam only if needed.                                                                                                                                     | Unit tests for delete with and without `cluster_status_id`.                                                                                         |
| `dataflow-service-ng/app/repo/entity/premium_dm.go`            | No schema change; existing `cluster_status_id` column becomes actively used.                                                                                                                                                     | Persistence asserted in create-success test.                                                                                                        |
| External mgmt custom status                                    | `CUSTOM_STATUS_TYPE_DATA_MIGRATION` status now blocks `CLUSTER_ACTION_DELETE_CLUSTER` for premium DM tasks from API create time.                                                                          | Mocked mgmt request assertions in controller tests.                                                                                                 |

### Dead Code / Cascade Check

- No protobuf, IDL, or migration changes are required.
- No public API response fields change.
- Existing worker cleanup for `task.ClusterStatusID != 0` stays authoritative and backward compatible with older rows where the field is still zero.
- The controller's compensation scope must stop at transaction persistence; later serialization / response-building failures are not ownership boundaries for the cluster delete lock.

### Symbols Affected

- `(*PremiumDMService).CreatePremiumMigration`
- `(*PremiumDMTaskWorker).OnTaskDeleting`
- `entity.PremiumDMTask.ClusterStatusID`

## Execution Steps

1. Add create-time mgmt custom status registration in premium DM controller.
   - Build the premium DM task first so the generated task ID can be used as `StatusName`.
   - Call `SetClusterCustomStatus` with:
     - `StatusType=CUSTOM_STATUS_TYPE_DATA_MIGRATION`
     - `ClusterAction=[CLUSTER_ACTION_DELETE_CLUSTER]`
     - `StatusName=<premium-dm-task-id>`
   - Persist returned `StatusId` into `task.ClusterStatusID`.
   - Verification:
     - Controller unit test asserts request content and stored `cluster_status_id`.
     - Expected result: task row is created successfully and keeps the returned status id.

2. Add compensation on create failure after status registration.
   - If DB transaction or sink-endpoint usage creation fails after the status is registered, call `DeleteClusterCustomStatus` with the same `cluster_id` and `status_id`.
   - Do not compensate on errors after the transaction has already committed, such as `DMTaskAndStatusToV1beta1PbTask` failures while constructing the API response.
   - Log compensation failures but return the original create failure.
   - Verification:
     - Controller unit test forces transaction failure and asserts cleanup call.
     - Controller unit test forces a post-commit response-build failure and asserts cleanup is not called while the persisted row still keeps `cluster_status_id`.
     - Expected result: create returns the transaction error and the custom status is deleted best-effort.
     - Expected result: create returns the response-build error after commit, and the custom status remains registered.

3. Keep worker delete cleanup unchanged in behavior, with test coverage.
   - Preserve `OnTaskDeleting` as the single normal deregistration path.
   - Keep `ClusterStatusID == 0` as a no-op for backward compatibility.
   - If needed for testing, add a minimal internal seam for proxy creation only.
   - Verification:
     - Worker unit tests cover both `ClusterStatusID != 0` and `ClusterStatusID == 0`.
     - Expected result: nonzero id deletes custom status; zero id skips the mgmt call and still marks task deleted.

4. Format and run verification.
   - Commands:
     - `gofmt -w dataflow-service-ng/app/controllers/premium_dm/premium_dm.go dataflow-service-ng/app/controllers/premium_dm/premium_dm_create_test.go`
     - `go test ./dataflow-service-ng/app/controllers/premium_dm -run '^TestCreatePremiumMigration'`
   - Expected result:
     - `gofmt` exits successfully with no errors.
     - Targeted premium DM controller unit tests pass.

## Risks

- If create-time registration succeeds but compensation fails, a leaked cluster lock can still remain; this is mitigated only by best-effort cleanup plus explicit logging.
- The new logic shifts the lock window earlier, so create requests that previously succeeded while cluster deletion was still possible will now block deletion immediately after task creation.
- Worker tests need to avoid real DM proxy creation; any seam added must stay internal and preserve production behavior.