replication + endpoint: replication guarantees: guarantee_{resumability,incremental,nothing}

This commit

- adds a configuration in which no step holds, replication cursors, etc. are created
- removes the send.step_holds.disable_incremental setting
- creates a new config option `replication` for active-side jobs
- adds the replication.protection.{initial,incremental} settings, each
  of which can have values
    - `guarantee_resumability`
    - `guarantee_incremental`
    - `guarantee_nothing`
  (refer to docs/configuration/replication.rst for semantics)

The `replication` config from an active side is sent to both endpoint.Sender and endpoint.Receiver
for each replication step. Sender and Receiver then act accordingly.

For `guarantee_incremental`, we add the new `tentative-replication-cursor` abstraction.
The necessity for that abstraction is outlined in https://github.com/zrepl/zrepl/issues/340.

fixes https://github.com/zrepl/zrepl/issues/340

endpoint/endpoint.go

@@ -21,10 +21,9 @@ import (
 )
 
 type SenderConfig struct {
-	FSF                         zfs.DatasetFilter
-	Encrypt                     *zfs.NilBool
-	DisableIncrementalStepHolds bool
-	JobID                       JobID
+	FSF     zfs.DatasetFilter
+	Encrypt *zfs.NilBool
+	JobID   JobID
 }
 
 func (c *SenderConfig) Validate() error {
@@ -40,10 +39,9 @@ func (c *SenderConfig) Validate() error {
 
 // Sender implements replication.ReplicationEndpoint for a sending side
 type Sender struct {
-	FSFilter                    zfs.DatasetFilter
-	encrypt                     *zfs.NilBool
-	disableIncrementalStepHolds bool
-	jobId                       JobID
+	FSFilter zfs.DatasetFilter
+	encrypt  *zfs.NilBool
+	jobId    JobID
 }
 
 func NewSender(conf SenderConfig) *Sender {
@@ -51,10 +49,9 @@ func NewSender(conf SenderConfig) *Sender {
 		panic("invalid config" + err.Error())
 	}
 	return &Sender{
-		FSFilter:                    conf.FSF,
-		encrypt:                     conf.Encrypt,
-		disableIncrementalStepHolds: conf.DisableIncrementalStepHolds,
-		jobId:                       conf.JobID,
+		FSFilter: conf.FSF,
+		encrypt:  conf.Encrypt,
+		jobId:    conf.JobID,
 	}
 }
 
@@ -211,37 +208,27 @@ func (s *Sender) Send(ctx context.Context, r *pdu.SendReq) (*pdu.SendRes, io.Rea
 		return res, nil, nil
 	}
 
-	// create a replication cursor for `From` (usually an idempotent no-op because SendCompleted already created it before)
-	var fromReplicationCursor Abstraction
-	if sendArgs.From != nil {
-		// For all but the first replication, this should always be a no-op because SendCompleted already moved the cursor
-		fromReplicationCursor, err = CreateReplicationCursor(ctx, sendArgs.FS, *sendArgs.FromVersion, s.jobId) // no shadow
-		if err == zfs.ErrBookmarkCloningNotSupported {
-			getLogger(ctx).Debug("not creating replication cursor from bookmark because ZFS does not support it")
-			// fallthrough
-		} else if err != nil {
-			return nil, nil, errors.Wrap(err, "cannot set replication cursor to `from` version before starting send")
-		}
+	// create holds or bookmarks of `From` and `To` to guarantee one of the following:
+	// - that the replication step can always be resumed (`holds`),
+	// - that the replication step can be interrupted and a future replication
+	//   step with same or different `To` but same `From` is still possible (`bookmarks`)
+	// - nothing (`none`)
+	//
+	// ...
+	//
+	// ... actually create the abstractions
+	replicationGuaranteeOptions, err := replicationGuaranteeOptionsFromPDU(r.GetReplicationConfig().Protection)
+	if err != nil {
+		return nil, nil, err
 	}
-
-	takeStepHolds := sendArgs.FromVersion == nil || !s.disableIncrementalStepHolds
-
-	var fromHold, toHold Abstraction
-	// make sure `From` doesn't go away in order to make this step resumable
-	if sendArgs.From != nil && takeStepHolds {
-		fromHold, err = HoldStep(ctx, sendArgs.FS, *sendArgs.FromVersion, s.jobId) // no shadow
-		if err == zfs.ErrBookmarkCloningNotSupported {
-			getLogger(ctx).Debug("not creating step bookmark because ZFS does not support it")
-			// fallthrough
-		} else if err != nil {
-			return nil, nil, errors.Wrapf(err, "cannot hold `from` version %q before starting send", *sendArgs.FromVersion)
-		}
+	replicationGuaranteeStrategy := replicationGuaranteeOptions.Strategy(sendArgs.From != nil)
+	liveAbs, err := replicationGuaranteeStrategy.SenderPreSend(ctx, s.jobId, &sendArgs)
+	if err != nil {
+		return nil, nil, err
 	}
-	if takeStepHolds {
-		// make sure `To` doesn't go away in order to make this step resumable
-		toHold, err = HoldStep(ctx, sendArgs.FS, sendArgs.ToVersion, s.jobId)
-		if err != nil {
-			return nil, nil, errors.Wrapf(err, "cannot hold `to` version %q before starting send", sendArgs.ToVersion)
+	for _, a := range liveAbs {
+		if a != nil {
+			abstractionsCacheSingleton.Put(a)
 		}
 	}
 
@@ -261,7 +248,6 @@ func (s *Sender) Send(ctx context.Context, r *pdu.SendReq) (*pdu.SendRes, io.Rea
 	//
 	// Note further that a resuming send, due to the idempotent nature of func CreateReplicationCursor and HoldStep,
 	// will never lose its step holds because we just (idempotently re-)created them above, before attempting the cleanup.
-	liveAbs := []Abstraction{fromHold, toHold, fromReplicationCursor}
 	func() {
 		ctx, endSpan := trace.WithSpan(ctx, "cleanup-stale-abstractions")
 		defer endSpan()
@@ -283,22 +269,29 @@ func (s *Sender) Send(ctx context.Context, r *pdu.SendReq) (*pdu.SendRes, io.Rea
 			for _, staleVersion := range obsoleteAbs {
 				for _, mustLiveVersion := range mustLiveVersions {
 					isSendArg := zfs.FilesystemVersionEqualIdentity(mustLiveVersion, staleVersion.GetFilesystemVersion())
-					isStepHoldWeMightHaveCreatedWithCurrentValueOf_takeStepHolds :=
-						takeStepHolds && staleVersion.GetType() == AbstractionStepHold
-					if isSendArg && isStepHoldWeMightHaveCreatedWithCurrentValueOf_takeStepHolds {
+					stepHoldBasedGuaranteeStrategy := false
+					k := replicationGuaranteeStrategy.Kind()
+					switch k {
+					case ReplicationGuaranteeKindResumability:
+						stepHoldBasedGuaranteeStrategy = true
+					case ReplicationGuaranteeKindIncremental:
+					case ReplicationGuaranteeKindNone:
+					default:
+						panic(fmt.Sprintf("this is supposed to be an exhaustive match, got %v", k))
+					}
+					isSnapshot := mustLiveVersion.IsSnapshot()
+					if isSendArg && (!isSnapshot || stepHoldBasedGuaranteeStrategy) {
 						panic(fmt.Sprintf("impl error: %q would be destroyed because it is considered stale but it is part of of sendArgs=%s", mustLiveVersion.String(), pretty.Sprint(sendArgs)))
 					}
 				}
 			}
 		}
-		sendAbstractionsCacheSingleton.TryBatchDestroy(ctx, s.jobId, sendArgs.FS, keep, check)
-	}()
-	// now add the newly created abstractions to the cleaned-up cache
-	for _, a := range liveAbs {
-		if a != nil {
-			sendAbstractionsCacheSingleton.Put(a)
+		destroyTypes := AbstractionTypeSet{
+			AbstractionStepHold:                           true,
+			AbstractionTentativeReplicationCursorBookmark: true,
 		}
-	}
+		abstractionsCacheSingleton.TryBatchDestroy(ctx, s.jobId, sendArgs.FS, destroyTypes, keep, check)
+	}()
 
 	sendStream, err := zfs.ZFSSend(ctx, sendArgs)
 	if err != nil {
@@ -332,36 +325,32 @@ func (p *Sender) SendCompleted(ctx context.Context, r *pdu.SendCompletedReq) (*p
 		return nil, errors.Wrap(err, "validate `to` exists")
 	}
 
-	log := func(ctx context.Context) Logger {
-		log := getLogger(ctx).WithField("to_guid", to.Guid).
-			WithField("fs", fs).
-			WithField("to", to.RelName)
-		if from != nil {
-			log = log.WithField("from", from.RelName).WithField("from_guid", from.Guid)
-		}
-		return log
-	}
-
-	toReplicationCursor, err := CreateReplicationCursor(ctx, fs, to, p.jobId)
+	replicationGuaranteeOptions, err := replicationGuaranteeOptionsFromPDU(orig.GetReplicationConfig().Protection)
 	if err != nil {
-		if err == zfs.ErrBookmarkCloningNotSupported {
-			log(ctx).Debug("not setting replication cursor, bookmark cloning not supported")
-		} else {
-			msg := "cannot move replication cursor, keeping hold on `to` until successful"
-			log(ctx).WithError(err).Error(msg)
-			err = errors.Wrap(err, msg)
-			// it is correct to not destroy from and to step holds if we can't move the cursor!
-			return &pdu.SendCompletedRes{}, err
+		return nil, err
+	}
+	liveAbs, err := replicationGuaranteeOptions.Strategy(from != nil).SenderPostRecvConfirmed(ctx, p.jobId, fs, to)
+	if err != nil {
+		return nil, err
+	}
+	for _, a := range liveAbs {
+		if a != nil {
+			abstractionsCacheSingleton.Put(a)
 		}
-	} else {
-		sendAbstractionsCacheSingleton.Put(toReplicationCursor)
-		log(ctx).WithField("to_cursor", toReplicationCursor.String()).Info("successfully created `to` replication cursor")
 	}
-
-	keep := func(a Abstraction) bool {
-		return AbstractionEquals(a, toReplicationCursor)
+	keep := func(a Abstraction) (keep bool) {
+		keep = false
+		for _, k := range liveAbs {
+			keep = keep || AbstractionEquals(a, k)
+		}
+		return keep
 	}
-	sendAbstractionsCacheSingleton.TryBatchDestroy(ctx, p.jobId, fs, keep, nil)
+	destroyTypes := AbstractionTypeSet{
+		AbstractionStepHold:                           true,
+		AbstractionTentativeReplicationCursorBookmark: true,
+		AbstractionReplicationCursorBookmarkV2:        true,
+	}
+	abstractionsCacheSingleton.TryBatchDestroy(ctx, p.jobId, fs, destroyTypes, keep, nil)
 
 	return &pdu.SendCompletedRes{}, nil
 
@@ -437,8 +426,6 @@ type ReceiverConfig struct {
 
 	RootWithoutClientComponent *zfs.DatasetPath // TODO use
 	AppendClientIdentity       bool
-
-	UpdateLastReceivedHold bool
 }
 
 func (c *ReceiverConfig) copyIn() {
@@ -863,12 +850,38 @@ func (s *Receiver) Receive(ctx context.Context, req *pdu.ReceiveReq, receive io.
 		return nil, errors.Wrap(err, msg)
 	}
 
-	if s.conf.UpdateLastReceivedHold {
-		log.Debug("move last-received-hold")
-		if err := MoveLastReceivedHold(ctx, lp.ToString(), toRecvd, s.conf.JobID); err != nil {
-			return nil, errors.Wrap(err, "cannot move last-received-hold")
+	replicationGuaranteeOptions, err := replicationGuaranteeOptionsFromPDU(req.GetReplicationConfig().Protection)
+	if err != nil {
+		return nil, err
+	}
+	replicationGuaranteeStrategy := replicationGuaranteeOptions.Strategy(ph.FSExists)
+	liveAbs, err := replicationGuaranteeStrategy.ReceiverPostRecv(ctx, s.conf.JobID, lp.ToString(), toRecvd)
+	if err != nil {
+		return nil, err
+	}
+	for _, a := range liveAbs {
+		if a != nil {
+			abstractionsCacheSingleton.Put(a)
 		}
 	}
+	keep := func(a Abstraction) (keep bool) {
+		keep = false
+		for _, k := range liveAbs {
+			keep = keep || AbstractionEquals(a, k)
+		}
+		return keep
+	}
+	check := func(obsoleteAbs []Abstraction) {
+		for _, abs := range obsoleteAbs {
+			if zfs.FilesystemVersionEqualIdentity(abs.GetFilesystemVersion(), toRecvd) {
+				panic(fmt.Sprintf("would destroy endpoint abstraction around the filesystem version we just received %s", abs))
+			}
+		}
+	}
+	destroyTypes := AbstractionTypeSet{
+		AbstractionLastReceivedHold: true,
+	}
+	abstractionsCacheSingleton.TryBatchDestroy(ctx, s.conf.JobID, lp.ToString(), destroyTypes, keep, check)
 
 	return &pdu.ReceiveRes{}, nil
 }

endpoint/endpoint_abstractions_cache.go

@@ -10,49 +10,49 @@ import (
 	"github.com/zrepl/zrepl/util/chainlock"
 )
 
-var sendAbstractionsCacheMetrics struct {
+var abstractionsCacheMetrics struct {
 	count prometheus.Gauge
 }
 
 func init() {
-	sendAbstractionsCacheMetrics.count = prometheus.NewGauge(prometheus.GaugeOpts{
+	abstractionsCacheMetrics.count = prometheus.NewGauge(prometheus.GaugeOpts{
 		Namespace: "zrepl",
 		Subsystem: "endpoint",
-		Name:      "send_abstractions_cache_entry_count",
-		Help:      "number of send abstractions tracked in the sendAbstractionsCache data structure",
+		Name:      "abstractions_cache_entry_count",
+		Help:      "number of abstractions tracked in the abstractionsCache data structure",
 	})
 }
 
-var sendAbstractionsCacheSingleton = newSendAbstractionsCache()
+var abstractionsCacheSingleton = newAbstractionsCache()
 
-func SendAbstractionsCacheInvalidate(fs string) {
-	sendAbstractionsCacheSingleton.InvalidateFSCache(fs)
+func AbstractionsCacheInvalidate(fs string) {
+	abstractionsCacheSingleton.InvalidateFSCache(fs)
 }
 
-type sendAbstractionsCacheDidLoadFSState int
+type abstractionsCacheDidLoadFSState int
 
 const (
-	sendAbstractionsCacheDidLoadFSStateNo sendAbstractionsCacheDidLoadFSState = iota // 0-value has meaning
-	sendAbstractionsCacheDidLoadFSStateInProgress
-	sendAbstractionsCacheDidLoadFSStateDone
+	abstractionsCacheDidLoadFSStateNo abstractionsCacheDidLoadFSState = iota // 0-value has meaning
+	abstractionsCacheDidLoadFSStateInProgress
+	abstractionsCacheDidLoadFSStateDone
 )
 
-type sendAbstractionsCache struct {
+type abstractionsCache struct {
 	mtx              chainlock.L
 	abstractions     []Abstraction
-	didLoadFS        map[string]sendAbstractionsCacheDidLoadFSState
+	didLoadFS        map[string]abstractionsCacheDidLoadFSState
 	didLoadFSChanged *sync.Cond
 }
 
-func newSendAbstractionsCache() *sendAbstractionsCache {
-	c := &sendAbstractionsCache{
-		didLoadFS: make(map[string]sendAbstractionsCacheDidLoadFSState),
+func newAbstractionsCache() *abstractionsCache {
+	c := &abstractionsCache{
+		didLoadFS: make(map[string]abstractionsCacheDidLoadFSState),
 	}
 	c.didLoadFSChanged = c.mtx.NewCond()
 	return c
 }
 
-func (s *sendAbstractionsCache) Put(a Abstraction) {
+func (s *abstractionsCache) Put(a Abstraction) {
 	defer s.mtx.Lock().Unlock()
 
 	var zeroJobId JobID
@@ -63,10 +63,10 @@ func (s *sendAbstractionsCache) Put(a Abstraction) {
 	}
 
 	s.abstractions = append(s.abstractions, a)
-	sendAbstractionsCacheMetrics.count.Set(float64(len(s.abstractions)))
+	abstractionsCacheMetrics.count.Set(float64(len(s.abstractions)))
 }
 
-func (s *sendAbstractionsCache) InvalidateFSCache(fs string) {
+func (s *abstractionsCache) InvalidateFSCache(fs string) {
 	// FIXME: O(n)
 	newAbs := make([]Abstraction, 0, len(s.abstractions))
 	for _, a := range s.abstractions {
@@ -75,9 +75,9 @@ func (s *sendAbstractionsCache) InvalidateFSCache(fs string) {
 		}
 	}
 	s.abstractions = newAbs
-	sendAbstractionsCacheMetrics.count.Set(float64(len(s.abstractions)))
+	abstractionsCacheMetrics.count.Set(float64(len(s.abstractions)))
 
-	s.didLoadFS[fs] = sendAbstractionsCacheDidLoadFSStateNo
+	s.didLoadFS[fs] = abstractionsCacheDidLoadFSStateNo
 	s.didLoadFSChanged.Broadcast()
 
 }
@@ -86,7 +86,7 @@ func (s *sendAbstractionsCache) InvalidateFSCache(fs string) {
 // - only fetches on-disk abstractions once, but every time from the in-memory store
 //
 // That means that for precise results, all abstractions created by the endpoint must be .Put into this cache.
-func (s *sendAbstractionsCache) GetAndDeleteByJobIDAndFS(ctx context.Context, jobID JobID, fs string, keep func(a Abstraction) bool) (ret []Abstraction) {
+func (s *abstractionsCache) GetAndDeleteByJobIDAndFS(ctx context.Context, jobID JobID, fs string, types AbstractionTypeSet, keep func(a Abstraction) bool) (ret []Abstraction) {
 	defer s.mtx.Lock().Unlock()
 	defer trace.WithSpanFromStackUpdateCtx(&ctx)()
 	var zeroJobId JobID
@@ -97,50 +97,50 @@ func (s *sendAbstractionsCache) GetAndDeleteByJobIDAndFS(ctx context.Context, jo
 		panic("must not pass zero-value fs")
 	}
 
-	s.tryLoadOnDiskSendAbstractions(ctx, fs)
+	s.tryLoadOnDiskAbstractions(ctx, fs)
 
 	// FIXME O(n)
 	var remaining []Abstraction
 	for _, a := range s.abstractions {
 		aJobId := *a.GetJobID()
 		aFS := a.GetFS()
-		if aJobId == jobID && aFS == fs && !keep(a) {
+		if aJobId == jobID && aFS == fs && types[a.GetType()] && !keep(a) {
 			ret = append(ret, a)
 		} else {
 			remaining = append(remaining, a)
 		}
 	}
 	s.abstractions = remaining
-	sendAbstractionsCacheMetrics.count.Set(float64(len(s.abstractions)))
+	abstractionsCacheMetrics.count.Set(float64(len(s.abstractions)))
 
 	return ret
 }
 
 // caller must hold s.mtx
-func (s *sendAbstractionsCache) tryLoadOnDiskSendAbstractions(ctx context.Context, fs string) {
-	for s.didLoadFS[fs] != sendAbstractionsCacheDidLoadFSStateDone {
-		if s.didLoadFS[fs] == sendAbstractionsCacheDidLoadFSStateInProgress {
+func (s *abstractionsCache) tryLoadOnDiskAbstractions(ctx context.Context, fs string) {
+	for s.didLoadFS[fs] != abstractionsCacheDidLoadFSStateDone {
+		if s.didLoadFS[fs] == abstractionsCacheDidLoadFSStateInProgress {
 			s.didLoadFSChanged.Wait()
 			continue
 		}
-		if s.didLoadFS[fs] != sendAbstractionsCacheDidLoadFSStateNo {
+		if s.didLoadFS[fs] != abstractionsCacheDidLoadFSStateNo {
 			panic(fmt.Sprintf("unreachable: %v", s.didLoadFS[fs]))
 		}
 
-		s.didLoadFS[fs] = sendAbstractionsCacheDidLoadFSStateInProgress
+		s.didLoadFS[fs] = abstractionsCacheDidLoadFSStateInProgress
 		defer s.didLoadFSChanged.Broadcast()
 
 		var onDiskAbs []Abstraction
 		var err error
 		s.mtx.DropWhile(func() {
-			onDiskAbs, err = s.tryLoadOnDiskSendAbstractionsImpl(ctx, fs) // no shadow
+			onDiskAbs, err = s.tryLoadOnDiskAbstractionsImpl(ctx, fs) // no shadow
 		})
 
 		if err != nil {
-			s.didLoadFS[fs] = sendAbstractionsCacheDidLoadFSStateNo
-			getLogger(ctx).WithField("fs", fs).WithError(err).Error("cannot list send step abstractions for filesystem")
+			s.didLoadFS[fs] = abstractionsCacheDidLoadFSStateNo
+			getLogger(ctx).WithField("fs", fs).WithError(err).Error("cannot list abstractions for filesystem")
 		} else {
-			s.didLoadFS[fs] = sendAbstractionsCacheDidLoadFSStateDone
+			s.didLoadFS[fs] = abstractionsCacheDidLoadFSStateDone
 			s.abstractions = append(s.abstractions, onDiskAbs...)
 			getLogger(ctx).WithField("fs", fs).WithField("abstractions", onDiskAbs).Debug("loaded step abstractions for filesystem")
 		}
@@ -149,7 +149,7 @@ func (s *sendAbstractionsCache) tryLoadOnDiskSendAbstractions(ctx context.Contex
 }
 
 // caller should _not hold s.mtx
-func (s *sendAbstractionsCache) tryLoadOnDiskSendAbstractionsImpl(ctx context.Context, fs string) ([]Abstraction, error) {
+func (s *abstractionsCache) tryLoadOnDiskAbstractionsImpl(ctx context.Context, fs string) ([]Abstraction, error) {
 	defer trace.WithSpanFromStackUpdateCtx(&ctx)()
 
 	q := ListZFSHoldsAndBookmarksQuery{
@@ -158,9 +158,10 @@ func (s *sendAbstractionsCache) tryLoadOnDiskSendAbstractionsImpl(ctx context.Co
 		},
 		JobID: nil,
 		What: AbstractionTypeSet{
-			AbstractionStepHold:                    true,
-			AbstractionStepBookmark:                true,
-			AbstractionReplicationCursorBookmarkV2: true,
+			AbstractionStepHold:                           true,
+			AbstractionTentativeReplicationCursorBookmark: true,
+			AbstractionReplicationCursorBookmarkV2:        true,
+			AbstractionLastReceivedHold:                   true,
 		},
 		Concurrency: 1,
 	}
@@ -175,12 +176,12 @@ func (s *sendAbstractionsCache) tryLoadOnDiskSendAbstractionsImpl(ctx context.Co
 	return abs, nil
 }
 
-func (s *sendAbstractionsCache) TryBatchDestroy(ctx context.Context, jobId JobID, fs string, keep func(a Abstraction) bool, check func(willDestroy []Abstraction)) {
+func (s *abstractionsCache) TryBatchDestroy(ctx context.Context, jobId JobID, fs string, types AbstractionTypeSet, keep func(a Abstraction) bool, check func(willDestroy []Abstraction)) {
 	// no s.mtx, we only use the public interface in this function
 
 	defer trace.WithSpanFromStackUpdateCtx(&ctx)()
 
-	obsoleteAbs := s.GetAndDeleteByJobIDAndFS(ctx, jobId, fs, keep)
+	obsoleteAbs := s.GetAndDeleteByJobIDAndFS(ctx, jobId, fs, types, keep)
 
 	if check != nil {
 		check(obsoleteAbs)
@@ -193,11 +194,11 @@ func (s *sendAbstractionsCache) TryBatchDestroy(ctx context.Context, jobId JobID
 			getLogger(ctx).
 				WithField("abstraction", res.Abstraction).
 				WithError(res.DestroyErr).
-				Error("cannot destroy stale send step abstraction")
+				Error("cannot destroy abstraction")
 		} else {
 			getLogger(ctx).
 				WithField("abstraction", res.Abstraction).
-				Info("destroyed stale send step abstraction")
+				Info("destroyed abstraction")
 		}
 	}
 	if hadErr {

endpoint/endpoint_guarantees.go

@@ -0,0 +1,213 @@
+package endpoint
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/pkg/errors"
+	"github.com/zrepl/zrepl/replication/logic/pdu"
+	"github.com/zrepl/zrepl/zfs"
+)
+
+type ReplicationGuaranteeOptions struct {
+	Initial     ReplicationGuaranteeKind
+	Incremental ReplicationGuaranteeKind
+}
+
+func replicationGuaranteeOptionsFromPDU(in *pdu.ReplicationConfigProtection) (o ReplicationGuaranteeOptions, _ error) {
+	if in == nil {
+		return o, errors.New("pdu.ReplicationConfigProtection must not be nil")
+	}
+	initial, err := replicationGuaranteeKindFromPDU(in.GetInitial())
+	if err != nil {
+		return o, errors.Wrap(err, "pdu.ReplicationConfigProtection: field Initial")
+	}
+	incremental, err := replicationGuaranteeKindFromPDU(in.GetIncremental())
+	if err != nil {
+		return o, errors.Wrap(err, "pdu.ReplicationConfigProtection: field Incremental")
+	}
+	o = ReplicationGuaranteeOptions{
+		Initial:     initial,
+		Incremental: incremental,
+	}
+	return o, nil
+}
+
+func replicationGuaranteeKindFromPDU(in pdu.ReplicationGuaranteeKind) (k ReplicationGuaranteeKind, _ error) {
+	switch in {
+	case pdu.ReplicationGuaranteeKind_GuaranteeNothing:
+		return ReplicationGuaranteeKindNone, nil
+	case pdu.ReplicationGuaranteeKind_GuaranteeIncrementalReplication:
+		return ReplicationGuaranteeKindIncremental, nil
+	case pdu.ReplicationGuaranteeKind_GuaranteeResumability:
+		return ReplicationGuaranteeKindResumability, nil
+
+	case pdu.ReplicationGuaranteeKind_GuaranteeInvalid:
+		fallthrough
+	default:
+		return k, errors.Errorf("%q", in.String())
+	}
+}
+
+func (o ReplicationGuaranteeOptions) Strategy(incremental bool) ReplicationGuaranteeStrategy {
+	g := o.Initial
+	if incremental {
+		g = o.Incremental
+	}
+	return ReplicationGuaranteeFromKind(g)
+}
+
+//go:generate enumer -type=ReplicationGuaranteeKind -json -transform=snake -trimprefix=ReplicationGuaranteeKind
+type ReplicationGuaranteeKind int
+
+const (
+	ReplicationGuaranteeKindResumability ReplicationGuaranteeKind = 1 << iota
+	ReplicationGuaranteeKindIncremental
+	ReplicationGuaranteeKindNone
+)
+
+type ReplicationGuaranteeStrategy interface {
+	Kind() ReplicationGuaranteeKind
+	SenderPreSend(ctx context.Context, jid JobID, sendArgs *zfs.ZFSSendArgsValidated) (keep []Abstraction, err error)
+	ReceiverPostRecv(ctx context.Context, jid JobID, fs string, toRecvd zfs.FilesystemVersion) (keep []Abstraction, err error)
+	SenderPostRecvConfirmed(ctx context.Context, jid JobID, fs string, to zfs.FilesystemVersion) (keep []Abstraction, err error)
+}
+
+func ReplicationGuaranteeFromKind(k ReplicationGuaranteeKind) ReplicationGuaranteeStrategy {
+	switch k {
+	case ReplicationGuaranteeKindNone:
+		return ReplicationGuaranteeNone{}
+	case ReplicationGuaranteeKindIncremental:
+		return ReplicationGuaranteeIncremental{}
+	case ReplicationGuaranteeKindResumability:
+		return ReplicationGuaranteeResumability{}
+	default:
+		panic(fmt.Sprintf("unreachable: %q %T", k, k))
+	}
+}
+
+type ReplicationGuaranteeNone struct{}
+
+func (g ReplicationGuaranteeNone) Kind() ReplicationGuaranteeKind {
+	return ReplicationGuaranteeKindNone
+}
+
+func (g ReplicationGuaranteeNone) SenderPreSend(ctx context.Context, jid JobID, sendArgs *zfs.ZFSSendArgsValidated) (keep []Abstraction, err error) {
+	return nil, nil
+}
+
+func (g ReplicationGuaranteeNone) ReceiverPostRecv(ctx context.Context, jid JobID, fs string, toRecvd zfs.FilesystemVersion) (keep []Abstraction, err error) {
+	return nil, nil
+}
+
+func (g ReplicationGuaranteeNone) SenderPostRecvConfirmed(ctx context.Context, jid JobID, fs string, to zfs.FilesystemVersion) (keep []Abstraction, err error) {
+	return nil, nil
+}
+
+type ReplicationGuaranteeIncremental struct{}
+
+func (g ReplicationGuaranteeIncremental) Kind() ReplicationGuaranteeKind {
+	return ReplicationGuaranteeKindIncremental
+}
+
+func (g ReplicationGuaranteeIncremental) SenderPreSend(ctx context.Context, jid JobID, sendArgs *zfs.ZFSSendArgsValidated) (keep []Abstraction, err error) {
+	if sendArgs.FromVersion != nil {
+		from, err := CreateTentativeReplicationCursor(ctx, sendArgs.FS, *sendArgs.FromVersion, jid)
+		if err != nil {
+			if err == zfs.ErrBookmarkCloningNotSupported {
+				getLogger(ctx).WithField("replication_guarantee", g).
+					WithField("bookmark", sendArgs.From.FullPath(sendArgs.FS)).
+					Info("bookmark cloning is not supported, speculating that `from` will not be destroyed until step is done")
+			} else {
+				return nil, err
+			}
+		}
+		keep = append(keep, from)
+	}
+	to, err := CreateTentativeReplicationCursor(ctx, sendArgs.FS, sendArgs.ToVersion, jid)
+	if err != nil {
+		return nil, err
+	}
+	keep = append(keep, to)
+
+	return keep, nil
+}
+
+func (g ReplicationGuaranteeIncremental) ReceiverPostRecv(ctx context.Context, jid JobID, fs string, toRecvd zfs.FilesystemVersion) (keep []Abstraction, err error) {
+	return receiverPostRecvCommon(ctx, jid, fs, toRecvd)
+}
+
+func (g ReplicationGuaranteeIncremental) SenderPostRecvConfirmed(ctx context.Context, jid JobID, fs string, to zfs.FilesystemVersion) (keep []Abstraction, err error) {
+	return senderPostRecvConfirmedCommon(ctx, jid, fs, to)
+}
+
+type ReplicationGuaranteeResumability struct{}
+
+func (g ReplicationGuaranteeResumability) Kind() ReplicationGuaranteeKind {
+	return ReplicationGuaranteeKindResumability
+}
+
+func (g ReplicationGuaranteeResumability) SenderPreSend(ctx context.Context, jid JobID, sendArgs *zfs.ZFSSendArgsValidated) (keep []Abstraction, err error) {
+	// try to hold the FromVersion
+	if sendArgs.FromVersion != nil {
+		if sendArgs.FromVersion.Type == zfs.Bookmark {
+			getLogger(ctx).WithField("replication_guarantee", g).WithField("fromVersion", sendArgs.FromVersion.FullPath(sendArgs.FS)).
+				Debug("cannot hold a bookmark, speculating that `from` will not be destroyed until step is done")
+		} else {
+			from, err := HoldStep(ctx, sendArgs.FS, *sendArgs.FromVersion, jid)
+			if err != nil {
+				return nil, err
+			}
+			keep = append(keep, from)
+		}
+		// fallthrough
+	}
+
+	to, err := HoldStep(ctx, sendArgs.FS, sendArgs.ToVersion, jid)
+	if err != nil {
+		return nil, err
+	}
+	keep = append(keep, to)
+
+	return keep, nil
+}
+
+func (g ReplicationGuaranteeResumability) ReceiverPostRecv(ctx context.Context, jid JobID, fs string, toRecvd zfs.FilesystemVersion) (keep []Abstraction, err error) {
+	return receiverPostRecvCommon(ctx, jid, fs, toRecvd)
+}
+
+func (g ReplicationGuaranteeResumability) SenderPostRecvConfirmed(ctx context.Context, jid JobID, fs string, to zfs.FilesystemVersion) (keep []Abstraction, err error) {
+	return senderPostRecvConfirmedCommon(ctx, jid, fs, to)
+}
+
+// helper function used by multiple strategies
+func senderPostRecvConfirmedCommon(ctx context.Context, jid JobID, fs string, to zfs.FilesystemVersion) (keep []Abstraction, err error) {
+
+	log := getLogger(ctx).WithField("toVersion", to.FullPath(fs))
+
+	toReplicationCursor, err := CreateReplicationCursor(ctx, fs, to, jid)
+	if err != nil {
+		if err == zfs.ErrBookmarkCloningNotSupported {
+			log.Debug("not setting replication cursor, bookmark cloning not supported")
+		} else {
+			msg := "cannot move replication cursor, keeping hold on `to` until successful"
+			log.WithError(err).Error(msg)
+			err = errors.Wrap(err, msg)
+			return nil, err
+		}
+	} else {
+		log.WithField("to_cursor", toReplicationCursor.String()).Info("successfully created `to` replication cursor")
+	}
+
+	return []Abstraction{toReplicationCursor}, nil
+}
+
+// helper function used by multiple strategies
+func receiverPostRecvCommon(ctx context.Context, jid JobID, fs string, toRecvd zfs.FilesystemVersion) (keep []Abstraction, err error) {
+	getLogger(ctx).Debug("create new last-received-hold")
+	lrh, err := CreateLastReceivedHold(ctx, fs, toRecvd, jid)
+	if err != nil {
+		return nil, err
+	}
+	return []Abstraction{lrh}, nil
+}

endpoint/endpoint_metrics.go

@@ -3,5 +3,5 @@ package endpoint
 import "github.com/prometheus/client_golang/prometheus"
 
 func RegisterMetrics(r prometheus.Registerer) {
-	r.MustRegister(sendAbstractionsCacheMetrics.count)
+	r.MustRegister(abstractionsCacheMetrics.count)
 }

endpoint/endpoint_zfs_abstraction.go

@@ -23,19 +23,19 @@ type AbstractionType string
 // There are a lot of exhaustive switches on AbstractionType in the code base.
 // When adding a new abstraction type, make sure to search and update them!
 const (
-	AbstractionStepBookmark                AbstractionType = "step-bookmark"
-	AbstractionStepHold                    AbstractionType = "step-hold"
-	AbstractionLastReceivedHold            AbstractionType = "last-received-hold"
-	AbstractionReplicationCursorBookmarkV1 AbstractionType = "replication-cursor-bookmark-v1"
-	AbstractionReplicationCursorBookmarkV2 AbstractionType = "replication-cursor-bookmark-v2"
+	AbstractionStepHold                           AbstractionType = "step-hold"
+	AbstractionLastReceivedHold                   AbstractionType = "last-received-hold"
+	AbstractionTentativeReplicationCursorBookmark AbstractionType = "tentative-replication-cursor-bookmark-v2"
+	AbstractionReplicationCursorBookmarkV1        AbstractionType = "replication-cursor-bookmark-v1"
+	AbstractionReplicationCursorBookmarkV2        AbstractionType = "replication-cursor-bookmark-v2"
 )
 
 var AbstractionTypesAll = map[AbstractionType]bool{
-	AbstractionStepBookmark:                true,
-	AbstractionStepHold:                    true,
-	AbstractionLastReceivedHold:            true,
-	AbstractionReplicationCursorBookmarkV1: true,
-	AbstractionReplicationCursorBookmarkV2: true,
+	AbstractionStepHold:                           true,
+	AbstractionLastReceivedHold:                   true,
+	AbstractionTentativeReplicationCursorBookmark: true,
+	AbstractionReplicationCursorBookmarkV1:        true,
+	AbstractionReplicationCursorBookmarkV2:        true,
 }
 
 // Implementation Note:
@@ -80,12 +80,12 @@ func AbstractionEquals(a, b Abstraction) bool {
 
 func (t AbstractionType) Validate() error {
 	switch t {
-	case AbstractionStepBookmark:
-		return nil
 	case AbstractionStepHold:
 		return nil
 	case AbstractionLastReceivedHold:
 		return nil
+	case AbstractionTentativeReplicationCursorBookmark:
+		return nil
 	case AbstractionReplicationCursorBookmarkV1:
 		return nil
 	case AbstractionReplicationCursorBookmarkV2:
@@ -185,8 +185,8 @@ type BookmarkExtractor func(fs *zfs.DatasetPath, v zfs.FilesystemVersion) Abstra
 // returns nil if the abstraction type is not bookmark-based
 func (t AbstractionType) BookmarkExtractor() BookmarkExtractor {
 	switch t {
-	case AbstractionStepBookmark:
-		return StepBookmarkExtractor
+	case AbstractionTentativeReplicationCursorBookmark:
+		return TentativeReplicationCursorExtractor
 	case AbstractionReplicationCursorBookmarkV1:
 		return ReplicationCursorV1Extractor
 	case AbstractionReplicationCursorBookmarkV2:
@@ -205,7 +205,7 @@ type HoldExtractor = func(fs *zfs.DatasetPath, v zfs.FilesystemVersion, tag stri
 // returns nil if the abstraction type is not hold-based
 func (t AbstractionType) HoldExtractor() HoldExtractor {
 	switch t {
-	case AbstractionStepBookmark:
+	case AbstractionTentativeReplicationCursorBookmark:
 		return nil
 	case AbstractionReplicationCursorBookmarkV1:
 		return nil
@@ -220,6 +220,23 @@ func (t AbstractionType) HoldExtractor() HoldExtractor {
 	}
 }
 
+func (t AbstractionType) BookmarkNamer() func(fs string, guid uint64, jobId JobID) (string, error) {
+	switch t {
+	case AbstractionTentativeReplicationCursorBookmark:
+		return TentativeReplicationCursorBookmarkName
+	case AbstractionReplicationCursorBookmarkV1:
+		panic("shouldn't be creating new ones")
+	case AbstractionReplicationCursorBookmarkV2:
+		return ReplicationCursorBookmarkName
+	case AbstractionStepHold:
+		return nil
+	case AbstractionLastReceivedHold:
+		return nil
+	default:
+		panic(fmt.Sprintf("unimpl: %q", t))
+	}
+}
+
 type ListZFSHoldsAndBookmarksQuery struct {
 	FS ListZFSHoldsAndBookmarksQueryFilesystemFilter
 	// What abstraction types should match (any contained in the set)
@@ -697,11 +714,9 @@ func ListStale(ctx context.Context, q ListZFSHoldsAndBookmarksQuery) (*Staleness
 		return nil, &ListStaleQueryError{errors.New("ListStale cannot have Until != nil set on query")}
 	}
 
-	// if asking for step holds, must also as for step bookmarks (same kind of abstraction)
-	// as well as replication cursor bookmarks (for firstNotStale)
+	// if asking for step holds must also ask for replication cursor bookmarks (for firstNotStale)
 	ifAnyThenAll := AbstractionTypeSet{
 		AbstractionStepHold:                    true,
-		AbstractionStepBookmark:                true,
 		AbstractionReplicationCursorBookmarkV2: true,
 	}
 	if q.What.ContainsAnyOf(ifAnyThenAll) && !q.What.ContainsAll(ifAnyThenAll) {
@@ -730,7 +745,7 @@ type fsAjobAtype struct {
 }
 
 // For step holds and bookmarks, only those older than the most recent replication cursor
-// of their (filesystem,job) is considered because younger ones cannot be stale by definition
+// of their (filesystem,job) are considered because younger ones cannot be stale by definition
 // (if we destroy them, we might actually lose the hold on the `To` for an ongoing incremental replication)
 //
 // For replication cursors and last-received-holds, only the most recent one is kept.
@@ -772,8 +787,6 @@ func listStaleFiltering(abs []Abstraction, sinceBound *CreateTXGRangeBound) *Sta
 			}
 
 		// stepFirstNotStaleCandidate.step
-		case AbstractionStepBookmark:
-			fallthrough
 		case AbstractionStepHold:
 			if c.step == nil || (*c.step).GetCreateTXG() < a.GetCreateTXG() {
 				a := a
@@ -797,7 +810,7 @@ func listStaleFiltering(abs []Abstraction, sinceBound *CreateTXGRangeBound) *Sta
 	for k := range by {
 		l := by[k]
 
-		if k.Type == AbstractionStepHold || k.Type == AbstractionStepBookmark {
+		if k.Type == AbstractionStepHold {
 			// all older than the most recent cursor are stale, others are always live
 
 			// if we don't have a replication cursor yet, use untilBound = nil

endpoint/endpoint_zfs_abstraction_last_received_hold.go

@@ -0,0 +1,91 @@
+package endpoint
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+
+	"github.com/pkg/errors"
+	"github.com/zrepl/zrepl/zfs"
+)
+
+const (
+	LastReceivedHoldTagNamePrefix = "zrepl_last_received_J_"
+)
+
+var lastReceivedHoldTagRE = regexp.MustCompile("^zrepl_last_received_J_(.+)$")
+
+var _ HoldExtractor = LastReceivedHoldExtractor
+
+func LastReceivedHoldExtractor(fs *zfs.DatasetPath, v zfs.FilesystemVersion, holdTag string) Abstraction {
+	var err error
+
+	if v.Type != zfs.Snapshot {
+		panic("impl error")
+	}
+
+	jobID, err := ParseLastReceivedHoldTag(holdTag)
+	if err == nil {
+		return &holdBasedAbstraction{
+			Type:              AbstractionLastReceivedHold,
+			FS:                fs.ToString(),
+			FilesystemVersion: v,
+			Tag:               holdTag,
+			JobID:             jobID,
+		}
+	}
+	return nil
+}
+
+// err != nil always means that the bookmark is not a step bookmark
+func ParseLastReceivedHoldTag(tag string) (JobID, error) {
+	match := lastReceivedHoldTagRE.FindStringSubmatch(tag)
+	if match == nil {
+		return JobID{}, errors.Errorf("parse last-received-hold tag: does not match regex %s", lastReceivedHoldTagRE.String())
+	}
+	jobId, err := MakeJobID(match[1])
+	if err != nil {
+		return JobID{}, errors.Wrap(err, "parse last-received-hold tag: invalid job id field")
+	}
+	return jobId, nil
+}
+
+func LastReceivedHoldTag(jobID JobID) (string, error) {
+	return lastReceivedHoldImpl(jobID.String())
+}
+
+func lastReceivedHoldImpl(jobid string) (string, error) {
+	tag := fmt.Sprintf("%s%s", LastReceivedHoldTagNamePrefix, jobid)
+	if err := zfs.ValidHoldTag(tag); err != nil {
+		return "", err
+	}
+	return tag, nil
+}
+
+func CreateLastReceivedHold(ctx context.Context, fs string, to zfs.FilesystemVersion, jobID JobID) (Abstraction, error) {
+
+	if !to.IsSnapshot() {
+		return nil, errors.Errorf("last-received-hold: target must be a snapshot: %s", to.FullPath(fs))
+	}
+
+	tag, err := LastReceivedHoldTag(jobID)
+	if err != nil {
+		return nil, errors.Wrap(err, "last-received-hold: hold tag")
+	}
+
+	// we never want to be without a hold
+	// => hold new one before releasing old hold
+
+	err = zfs.ZFSHold(ctx, fs, to, tag)
+	if err != nil {
+		return nil, errors.Wrap(err, "last-received-hold: hold newly received")
+	}
+
+	return &holdBasedAbstraction{
+		Type:              AbstractionLastReceivedHold,
+		FS:                fs,
+		FilesystemVersion: to,
+		JobID:             jobID,
+		Tag:               tag,
+	}, nil
+}

endpoint/endpoint_zfs_abstraction_replication_cursor.go

@@ -4,12 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"regexp"
 	"sort"
 
 	"github.com/pkg/errors"
-
-	"github.com/zrepl/zrepl/util/errorarray"
 	"github.com/zrepl/zrepl/zfs"
 )
 
@@ -53,6 +50,28 @@ func ParseReplicationCursorBookmarkName(fullname string) (uint64, JobID, error)
 	return guid, jobID, err
 }
 
+const tentativeReplicationCursorBookmarkNamePrefix = "zrepl_CURSORTENTATIVE_"
+
+// v must be validated by caller
+func TentativeReplicationCursorBookmarkName(fs string, guid uint64, id JobID) (string, error) {
+	return tentativeReplicationCursorBookmarkNameImpl(fs, guid, id.String())
+}
+
+func tentativeReplicationCursorBookmarkNameImpl(fs string, guid uint64, jobid string) (string, error) {
+	return makeJobAndGuidBookmarkName(tentativeReplicationCursorBookmarkNamePrefix, fs, guid, jobid)
+}
+
+// name is the full bookmark name, including dataset path
+//
+// err != nil always means that the bookmark is not a step bookmark
+func ParseTentativeReplicationCursorBookmarkName(fullname string) (guid uint64, jobID JobID, err error) {
+	guid, jobID, err = parseJobAndGuidBookmarkName(fullname, tentativeReplicationCursorBookmarkNamePrefix)
+	if err != nil {
+		err = errors.Wrap(err, "parse step bookmark name") // no shadow!
+	}
+	return guid, jobID, err
+}
+
 // may return nil for both values, indicating there is no cursor
 func GetMostRecentReplicationCursorOfJob(ctx context.Context, fs string, jobID JobID) (*zfs.FilesystemVersion, error) {
 	fsp, err := zfs.NewDatasetPath(fs)
@@ -122,23 +141,23 @@ func GetReplicationCursors(ctx context.Context, dp *zfs.DatasetPath, jobID JobID
 //
 // returns ErrBookmarkCloningNotSupported if version is a bookmark and bookmarking bookmarks is not supported by ZFS
 func CreateReplicationCursor(ctx context.Context, fs string, target zfs.FilesystemVersion, jobID JobID) (a Abstraction, err error) {
+	return createBookmarkAbstraction(ctx, AbstractionReplicationCursorBookmarkV2, fs, target, jobID)
+}
 
-	bookmarkname, err := ReplicationCursorBookmarkName(fs, target.GetGuid(), jobID)
+func CreateTentativeReplicationCursor(ctx context.Context, fs string, target zfs.FilesystemVersion, jobID JobID) (a Abstraction, err error) {
+	return createBookmarkAbstraction(ctx, AbstractionTentativeReplicationCursorBookmark, fs, target, jobID)
+}
+
+func createBookmarkAbstraction(ctx context.Context, abstractionType AbstractionType, fs string, target zfs.FilesystemVersion, jobID JobID) (a Abstraction, err error) {
+
+	bookmarkNamer := abstractionType.BookmarkNamer()
+	if bookmarkNamer == nil {
+		panic(abstractionType)
+	}
+
+	bookmarkname, err := bookmarkNamer(fs, target.GetGuid(), jobID)
 	if err != nil {
-		return nil, errors.Wrap(err, "determine replication cursor name")
-	}
-
-	if target.IsBookmark() && target.GetName() == bookmarkname {
-		return &bookmarkBasedAbstraction{
-			Type:              AbstractionReplicationCursorBookmarkV2,
-			FS:                fs,
-			FilesystemVersion: target,
-			JobID:             jobID,
-		}, nil
-	}
-
-	if !target.IsSnapshot() {
-		return nil, zfs.ErrBookmarkCloningNotSupported
+		return nil, errors.Wrapf(err, "determine %s name", abstractionType)
 	}
 
 	// idempotently create bookmark (guid is encoded in it)
@@ -152,125 +171,13 @@ func CreateReplicationCursor(ctx context.Context, fs string, target zfs.Filesyst
 	}
 
 	return &bookmarkBasedAbstraction{
-		Type:              AbstractionReplicationCursorBookmarkV2,
+		Type:              abstractionType,
 		FS:                fs,
 		FilesystemVersion: cursorBookmark,
 		JobID:             jobID,
 	}, nil
 }
 
-const (
-	ReplicationCursorBookmarkNamePrefix = "zrepl_last_received_J_"
-)
-
-var lastReceivedHoldTagRE = regexp.MustCompile("^zrepl_last_received_J_(.+)$")
-
-// err != nil always means that the bookmark is not a step bookmark
-func ParseLastReceivedHoldTag(tag string) (JobID, error) {
-	match := lastReceivedHoldTagRE.FindStringSubmatch(tag)
-	if match == nil {
-		return JobID{}, errors.Errorf("parse last-received-hold tag: does not match regex %s", lastReceivedHoldTagRE.String())
-	}
-	jobId, err := MakeJobID(match[1])
-	if err != nil {
-		return JobID{}, errors.Wrap(err, "parse last-received-hold tag: invalid job id field")
-	}
-	return jobId, nil
-}
-
-func LastReceivedHoldTag(jobID JobID) (string, error) {
-	return lastReceivedHoldImpl(jobID.String())
-}
-
-func lastReceivedHoldImpl(jobid string) (string, error) {
-	tag := fmt.Sprintf("%s%s", ReplicationCursorBookmarkNamePrefix, jobid)
-	if err := zfs.ValidHoldTag(tag); err != nil {
-		return "", err
-	}
-	return tag, nil
-}
-
-func CreateLastReceivedHold(ctx context.Context, fs string, to zfs.FilesystemVersion, jobID JobID) (Abstraction, error) {
-
-	if !to.IsSnapshot() {
-		return nil, errors.Errorf("last-received-hold: target must be a snapshot: %s", to.FullPath(fs))
-	}
-
-	tag, err := LastReceivedHoldTag(jobID)
-	if err != nil {
-		return nil, errors.Wrap(err, "last-received-hold: hold tag")
-	}
-
-	// we never want to be without a hold
-	// => hold new one before releasing old hold
-
-	err = zfs.ZFSHold(ctx, fs, to, tag)
-	if err != nil {
-		return nil, errors.Wrap(err, "last-received-hold: hold newly received")
-	}
-
-	return &holdBasedAbstraction{
-		Type:              AbstractionLastReceivedHold,
-		FS:                fs,
-		FilesystemVersion: to,
-		JobID:             jobID,
-		Tag:               tag,
-	}, nil
-}
-
-func MoveLastReceivedHold(ctx context.Context, fs string, to zfs.FilesystemVersion, jobID JobID) error {
-
-	_, err := CreateLastReceivedHold(ctx, fs, to, jobID)
-	if err != nil {
-		return err
-	}
-
-	q := ListZFSHoldsAndBookmarksQuery{
-		What: AbstractionTypeSet{
-			AbstractionLastReceivedHold: true,
-		},
-		FS: ListZFSHoldsAndBookmarksQueryFilesystemFilter{
-			FS: &fs,
-		},
-		JobID: &jobID,
-		CreateTXG: CreateTXGRange{
-			Since: nil,
-			Until: &CreateTXGRangeBound{
-				CreateTXG: to.GetCreateTXG(),
-				Inclusive: &zfs.NilBool{B: false},
-			},
-		},
-		Concurrency: 1,
-	}
-	abs, absErrs, err := ListAbstractions(ctx, q)
-	if err != nil {
-		return errors.Wrap(err, "last-received-hold: list")
-	}
-	if len(absErrs) > 0 {
-		return errors.Wrap(ListAbstractionsErrors(absErrs), "last-received-hold: list")
-	}
-
-	getLogger(ctx).WithField("last-received-holds", fmt.Sprintf("%s", abs)).Debug("releasing last-received-holds")
-
-	var errs []error
-	for res := range BatchDestroy(ctx, abs) {
-		log := getLogger(ctx).
-			WithField("last-received-hold", res.Abstraction)
-		if res.DestroyErr != nil {
-			errs = append(errs, res.DestroyErr)
-			log.WithError(err).
-				Error("cannot release last-received-hold")
-		} else {
-			log.Info("released last-received-hold")
-		}
-	}
-	if len(errs) == 0 {
-		return nil
-	} else {
-		return errorarray.Wrap(errs, "last-received-hold: release")
-	}
-}
-
 func ReplicationCursorV2Extractor(fs *zfs.DatasetPath, v zfs.FilesystemVersion) (_ Abstraction) {
 	if v.Type != zfs.Bookmark {
 		panic("impl error")
@@ -308,24 +215,28 @@ func ReplicationCursorV1Extractor(fs *zfs.DatasetPath, v zfs.FilesystemVersion)
 	return nil
 }
 
-var _ HoldExtractor = LastReceivedHoldExtractor
+var _ BookmarkExtractor = TentativeReplicationCursorExtractor
 
-func LastReceivedHoldExtractor(fs *zfs.DatasetPath, v zfs.FilesystemVersion, holdTag string) Abstraction {
-	var err error
-
-	if v.Type != zfs.Snapshot {
+func TentativeReplicationCursorExtractor(fs *zfs.DatasetPath, v zfs.FilesystemVersion) (_ Abstraction) {
+	if v.Type != zfs.Bookmark {
 		panic("impl error")
 	}
 
-	jobID, err := ParseLastReceivedHoldTag(holdTag)
+	fullname := v.ToAbsPath(fs)
+
+	guid, jobid, err := ParseTentativeReplicationCursorBookmarkName(fullname)
+	if guid != v.Guid {
+		// TODO log this possibly tinkered-with bookmark
+		return nil
+	}
 	if err == nil {
-		return &holdBasedAbstraction{
-			Type:              AbstractionLastReceivedHold,
+		bm := &bookmarkBasedAbstraction{
+			Type:              AbstractionTentativeReplicationCursorBookmark,
 			FS:                fs.ToString(),
 			FilesystemVersion: v,
-			Tag:               holdTag,
-			JobID:             jobID,
+			JobID:             jobid,
 		}
+		return bm
 	}
 	return nil
 }

endpoint/endpoint_zfs_abstraction_step.go

@@ -1,159 +0,0 @@
-package endpoint
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-
-	"github.com/pkg/errors"
-
-	"github.com/zrepl/zrepl/zfs"
-)
-
-var stepHoldTagRE = regexp.MustCompile("^zrepl_STEP_J_(.+)")
-
-func StepHoldTag(jobid JobID) (string, error) {
-	return stepHoldTagImpl(jobid.String())
-}
-
-func stepHoldTagImpl(jobid string) (string, error) {
-	t := fmt.Sprintf("zrepl_STEP_J_%s", jobid)
-	if err := zfs.ValidHoldTag(t); err != nil {
-		return "", err
-	}
-	return t, nil
-}
-
-// err != nil always means that the bookmark is not a step bookmark
-func ParseStepHoldTag(tag string) (JobID, error) {
-	match := stepHoldTagRE.FindStringSubmatch(tag)
-	if match == nil {
-		return JobID{}, fmt.Errorf("parse hold tag: match regex %q", stepHoldTagRE)
-	}
-	jobID, err := MakeJobID(match[1])
-	if err != nil {
-		return JobID{}, errors.Wrap(err, "parse hold tag: invalid job id field")
-	}
-	return jobID, nil
-}
-
-const stepBookmarkNamePrefix = "zrepl_STEP"
-
-// v must be validated by caller
-func StepBookmarkName(fs string, guid uint64, id JobID) (string, error) {
-	return stepBookmarkNameImpl(fs, guid, id.String())
-}
-
-func stepBookmarkNameImpl(fs string, guid uint64, jobid string) (string, error) {
-	return makeJobAndGuidBookmarkName(stepBookmarkNamePrefix, fs, guid, jobid)
-}
-
-// name is the full bookmark name, including dataset path
-//
-// err != nil always means that the bookmark is not a step bookmark
-func ParseStepBookmarkName(fullname string) (guid uint64, jobID JobID, err error) {
-	guid, jobID, err = parseJobAndGuidBookmarkName(fullname, stepBookmarkNamePrefix)
-	if err != nil {
-		err = errors.Wrap(err, "parse step bookmark name") // no shadow!
-	}
-	return guid, jobID, err
-}
-
-// idempotently hold / step-bookmark `version`
-//
-// returns ErrBookmarkCloningNotSupported if version is a bookmark and bookmarking bookmarks is not supported by ZFS
-func HoldStep(ctx context.Context, fs string, v zfs.FilesystemVersion, jobID JobID) (Abstraction, error) {
-	if v.IsSnapshot() {
-
-		tag, err := StepHoldTag(jobID)
-		if err != nil {
-			return nil, errors.Wrap(err, "step hold tag")
-		}
-
-		if err := zfs.ZFSHold(ctx, fs, v, tag); err != nil {
-			return nil, errors.Wrap(err, "step hold: zfs")
-		}
-
-		return &holdBasedAbstraction{
-			Type:              AbstractionStepHold,
-			FS:                fs,
-			Tag:               tag,
-			JobID:             jobID,
-			FilesystemVersion: v,
-		}, nil
-	}
-
-	if !v.IsBookmark() {
-		panic(fmt.Sprintf("version must bei either snapshot or bookmark, got %#v", v))
-	}
-
-	bmname, err := StepBookmarkName(fs, v.Guid, jobID)
-	if err != nil {
-		return nil, errors.Wrap(err, "create step bookmark: determine bookmark name")
-	}
-	// idempotently create bookmark
-	stepBookmark, err := zfs.ZFSBookmark(ctx, fs, v, bmname)
-	if err != nil {
-		if err == zfs.ErrBookmarkCloningNotSupported {
-			// TODO we could actually try to find a local snapshot that has the requested GUID
-			// 		however, the replication algorithm prefers snapshots anyways, so this quest
-			// 		is most likely not going to be successful. Also, there's the possibility that
-			//      the caller might want to filter what snapshots are eligibile, and this would
-			//      complicate things even further.
-			return nil, err // TODO go1.13 use wrapping
-		}
-		return nil, errors.Wrap(err, "create step bookmark: zfs")
-	}
-	return &bookmarkBasedAbstraction{
-		Type:              AbstractionStepBookmark,
-		FS:                fs,
-		FilesystemVersion: stepBookmark,
-		JobID:             jobID,
-	}, nil
-}
-
-var _ BookmarkExtractor = StepBookmarkExtractor
-
-func StepBookmarkExtractor(fs *zfs.DatasetPath, v zfs.FilesystemVersion) (_ Abstraction) {
-	if v.Type != zfs.Bookmark {
-		panic("impl error")
-	}
-
-	fullname := v.ToAbsPath(fs)
-
-	guid, jobid, err := ParseStepBookmarkName(fullname)
-	if guid != v.Guid {
-		// TODO log this possibly tinkered-with bookmark
-		return nil
-	}
-	if err == nil {
-		bm := &bookmarkBasedAbstraction{
-			Type:              AbstractionStepBookmark,
-			FS:                fs.ToString(),
-			FilesystemVersion: v,
-			JobID:             jobid,
-		}
-		return bm
-	}
-	return nil
-}
-
-var _ HoldExtractor = StepHoldExtractor
-
-func StepHoldExtractor(fs *zfs.DatasetPath, v zfs.FilesystemVersion, holdTag string) Abstraction {
-	if v.Type != zfs.Snapshot {
-		panic("impl error")
-	}
-
-	jobID, err := ParseStepHoldTag(holdTag)
-	if err == nil {
-		return &holdBasedAbstraction{
-			Type:              AbstractionStepHold,
-			FS:                fs.ToString(),
-			Tag:               holdTag,
-			FilesystemVersion: v,
-			JobID:             jobID,
-		}
-	}
-	return nil
-}

endpoint/endpoint_zfs_abstraction_step_hold.go

@@ -0,0 +1,83 @@
+package endpoint
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/zfs"
+)
+
+var stepHoldTagRE = regexp.MustCompile("^zrepl_STEP_J_(.+)")
+
+func StepHoldTag(jobid JobID) (string, error) {
+	return stepHoldTagImpl(jobid.String())
+}
+
+func stepHoldTagImpl(jobid string) (string, error) {
+	t := fmt.Sprintf("zrepl_STEP_J_%s", jobid)
+	if err := zfs.ValidHoldTag(t); err != nil {
+		return "", err
+	}
+	return t, nil
+}
+
+// err != nil always means that the bookmark is not a step bookmark
+func ParseStepHoldTag(tag string) (JobID, error) {
+	match := stepHoldTagRE.FindStringSubmatch(tag)
+	if match == nil {
+		return JobID{}, fmt.Errorf("parse hold tag: match regex %q", stepHoldTagRE)
+	}
+	jobID, err := MakeJobID(match[1])
+	if err != nil {
+		return JobID{}, errors.Wrap(err, "parse hold tag: invalid job id field")
+	}
+	return jobID, nil
+}
+
+// idempotently hold `version`
+func HoldStep(ctx context.Context, fs string, v zfs.FilesystemVersion, jobID JobID) (Abstraction, error) {
+	if !v.IsSnapshot() {
+		panic(fmt.Sprintf("version must be a snapshot got %#v", v))
+	}
+
+	tag, err := StepHoldTag(jobID)
+	if err != nil {
+		return nil, errors.Wrap(err, "step hold tag")
+	}
+
+	if err := zfs.ZFSHold(ctx, fs, v, tag); err != nil {
+		return nil, errors.Wrap(err, "step hold: zfs")
+	}
+
+	return &holdBasedAbstraction{
+		Type:              AbstractionStepHold,
+		FS:                fs,
+		Tag:               tag,
+		JobID:             jobID,
+		FilesystemVersion: v,
+	}, nil
+
+}
+
+var _ HoldExtractor = StepHoldExtractor
+
+func StepHoldExtractor(fs *zfs.DatasetPath, v zfs.FilesystemVersion, holdTag string) Abstraction {
+	if v.Type != zfs.Snapshot {
+		panic("impl error")
+	}
+
+	jobID, err := ParseStepHoldTag(holdTag)
+	if err == nil {
+		return &holdBasedAbstraction{
+			Type:              AbstractionStepHold,
+			FS:                fs.ToString(),
+			Tag:               holdTag,
+			FilesystemVersion: v,
+			JobID:             jobID,
+		}
+	}
+	return nil
+}

endpoint/jobid.go

@@ -24,9 +24,9 @@ func MakeJobID(s string) (JobID, error) {
 		return JobID{}, errors.Wrap(err, "must be usable as a dataset path component")
 	}
 
-	if _, err := stepBookmarkNameImpl("pool/ds", 0xface601d, s); err != nil {
+	if _, err := tentativeReplicationCursorBookmarkNameImpl("pool/ds", 0xface601d, s); err != nil {
 		// note that this might still fail due to total maximum name length, but we can't enforce that
-		return JobID{}, errors.Wrap(err, "must be usable for a step bookmark")
+		return JobID{}, errors.Wrap(err, "must be usable for a tentative replication cursor bookmark")
 	}
 
 	if _, err := stepHoldTagImpl(s); err != nil {

endpoint/replicationguaranteekind_enumer.go

@@ -0,0 +1,80 @@
+// Code generated by "enumer -type=ReplicationGuaranteeKind -json -transform=snake -trimprefix=ReplicationGuaranteeKind"; DO NOT EDIT.
+
+//
+package endpoint
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+const (
+	_ReplicationGuaranteeKindName_0 = "resumabilityincremental"
+	_ReplicationGuaranteeKindName_1 = "none"
+)
+
+var (
+	_ReplicationGuaranteeKindIndex_0 = [...]uint8{0, 12, 23}
+	_ReplicationGuaranteeKindIndex_1 = [...]uint8{0, 4}
+)
+
+func (i ReplicationGuaranteeKind) String() string {
+	switch {
+	case 1 <= i && i <= 2:
+		i -= 1
+		return _ReplicationGuaranteeKindName_0[_ReplicationGuaranteeKindIndex_0[i]:_ReplicationGuaranteeKindIndex_0[i+1]]
+	case i == 4:
+		return _ReplicationGuaranteeKindName_1
+	default:
+		return fmt.Sprintf("ReplicationGuaranteeKind(%d)", i)
+	}
+}
+
+var _ReplicationGuaranteeKindValues = []ReplicationGuaranteeKind{1, 2, 4}
+
+var _ReplicationGuaranteeKindNameToValueMap = map[string]ReplicationGuaranteeKind{
+	_ReplicationGuaranteeKindName_0[0:12]:  1,
+	_ReplicationGuaranteeKindName_0[12:23]: 2,
+	_ReplicationGuaranteeKindName_1[0:4]:   4,
+}
+
+// ReplicationGuaranteeKindString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func ReplicationGuaranteeKindString(s string) (ReplicationGuaranteeKind, error) {
+	if val, ok := _ReplicationGuaranteeKindNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to ReplicationGuaranteeKind values", s)
+}
+
+// ReplicationGuaranteeKindValues returns all values of the enum
+func ReplicationGuaranteeKindValues() []ReplicationGuaranteeKind {
+	return _ReplicationGuaranteeKindValues
+}
+
+// IsAReplicationGuaranteeKind returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i ReplicationGuaranteeKind) IsAReplicationGuaranteeKind() bool {
+	for _, v := range _ReplicationGuaranteeKindValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
+
+// MarshalJSON implements the json.Marshaler interface for ReplicationGuaranteeKind
+func (i ReplicationGuaranteeKind) MarshalJSON() ([]byte, error) {
+	return json.Marshal(i.String())
+}
+
+// UnmarshalJSON implements the json.Unmarshaler interface for ReplicationGuaranteeKind
+func (i *ReplicationGuaranteeKind) UnmarshalJSON(data []byte) error {
+	var s string
+	if err := json.Unmarshal(data, &s); err != nil {
+		return fmt.Errorf("ReplicationGuaranteeKind should be a string, got %s", data)
+	}
+
+	var err error
+	*i, err = ReplicationGuaranteeKindString(s)
+	return err
+}