{"record":{"id":"19d012c130437145","repo":"Tencent/WeKnora","slug":"create-sandbox-binding-w-19d012","errorCode":null,"errorMessage":"create sandbox binding: %w","messagePattern":"create sandbox binding: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/session_lifecycle.go","lineNumber":387,"sourceCode":"\t\treturn nil, errors.Join(\n\t\t\tfmt.Errorf(\"recheck owning session: %w\", checkErr),\n\t\t\tl.cleanupCreated(ctx, handle),\n\t\t)\n\t}\n\tif !exists {\n\t\treturn nil, errors.Join(ErrSandboxSessionDeleted, l.cleanupCreated(ctx, handle))\n\t}\n\n\tbinding := l.newBinding(\n\t\tkey,\n\t\thandle.ID(),\n\t\trequest.TemplateID,\n\t\tl.now().UTC(),\n\t)\n\tcreated, bindErr := l.bindings.Create(ctx, key, binding)\n\tif bindErr != nil {\n\t\treturn nil, errors.Join(\n\t\t\tfmt.Errorf(\"create sandbox binding: %w\", bindErr),\n\t\t\tl.cleanupCreated(ctx, handle),\n\t\t)\n\t}\n\tif created {\n\t\treturn handle, nil\n\t}\n\n\twinner, winnerErr := l.readBinding(ctx, key)\n\tif winnerErr != nil {\n\t\t// The authoritative winner is unknown, so deleting this sandbox could\n\t\t// destroy the resource another coordinator just bound.\n\t\treturn nil, fmt.Errorf(\"read winning sandbox binding: %w\", winnerErr)\n\t}\n\tif winner != nil &&\n\t\twinner.Provider == l.client.Provider() &&\n\t\twinner.SandboxID == handle.ID() {\n\t\treturn handle, nil\n\t}","sourceCodeStart":369,"sourceCodeEnd":405,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/session_lifecycle.go#L369-L405","documentation":"This error wraps a failure from bindings.Create when persisting the binding for a newly created sandbox. The sandbox was created successfully, but without a durable binding the session could not be re-resolved later, so the lifecycle cleans up the fresh sandbox (cleanupCreated) and returns 'create sandbox binding: %w' joined with any cleanup error via errors.Join.","triggerScenarios":"l.bindings.Create(ctx, key, binding) returns an error during createAndBind, immediately after a successful client.Create and session-existence recheck — binding store unavailability, write conflicts with a concurrent resolver that won the race, permission errors, or invalid binding record fields.","commonSituations":"Two processes resolving the same session concurrently (one binds first; store rejects or errors for the other); binding-store outage; schema migration in progress; quota/size limits on the binding record (e.g. large metadata); revoked write permissions.","solutions":["Inspect the wrapped (joined) error for binding-store detail; note the created sandbox is cleaned up automatically so retrying is safe","Retry the resolve operation — a fresh sandbox will be created and bound","Check for concurrent resolvers of the same session key and add client-side locking/idempotency if your store lacks it","Verify write permissions and record size limits on the binding backend"],"exampleFix":"// before\n// two goroutines resolve the same key concurrently\n// after\ncmu.Lock() // serialize resolution per session key in the host process\nhandle, err := session.Resolve(ctx, key)\nmu.Unlock()","handlingStrategy":"retry","validationCode":"// check binding-store writability before creating sandboxes\nif err := bindings.HealthCheck(ctx); err != nil {\n    return fmt.Errorf(\"skip create; binding store down: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"handle, err := session.Resolve(ctx, key)\nif err != nil && errors.Is(err, context.Canceled) {\n    // joined cleanup error: inspect both halves\n    return err\n} else if err != nil && strings.Contains(err.Error(), \"create sandbox binding:\") {\n    // created sandbox was cleaned up; safe to retry\n    err = retryWithBackoff(ctx, 3, func() error { handle, err = session.Resolve(ctx, key); return err })\n}","preventionTips":["Serialize resolution per session key to avoid bind races","Health-check the binding store before provisioning (saves a create+cleanup cycle)","Keep binding records small and schema-stable","Grant the service account unconditional write access to the binding backend"],"tags":["storage","binding-store","race-condition","cleanup","persistence"],"backgroundTag":"binding-write-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}