Add ChangeFeed AllVersionsAndDeletes mode

[yumnahussain]

Adds the AllVersionsAndDeletes change feed mode.

What it adds

• Driver — CosmosOperation::change_feed_all_versions_and_deletes factory and an all_versions_and_deletes header flag that emit A-IM: Full-Fidelity Feed (instead of Incremental Feed). Everything else on the wire is identical to LatestVersion. This mode always routes through Gateway 1.0 so the header is never dropped by a Gateway 2.0 downgrade.
• SDK — ChangeFeedMode::AllVersionsAndDeletes. query_change_feed stays the single entry point and dispatches on the mode to pick the factory. In this mode the service returns every intermediate version plus deletes, so the ChangeFeedItem<T> envelope's previous() and metadata() (operation type, LSN, commit timestamp, previous-image LSN, TTL-expiry flag) are populated.
• Start gating — Beginning and PointInTime are not supported for this mode; intermediate versions and deletes only exist within the container's retention window. The request is issued and the service returns 400 BadRequest. Use Now or resume from a continuation token.
• Continuation token — the feed mode is now recorded in the token and validated on resume. Resuming a LatestVersion token as AllVersionsAndDeletes (or vice versa) is rejected with a 400. Only the marker is stored, so LatestVersion and query tokens keep their exact existing payload and legacy tokens are treated as LatestVersion.

Known limitations

• Now is re-evaluated per range on first poll and is not converted to a concrete PointInTime; a range never polled before a checkpoint can miss changes between the original start and resume. Lossless per-range Now is a follow-up.

Tests

Iterator create/replace/delete envelope decoding; continuation-token mode encode/accept/reject unit tests; in-memory emulator end-to-end coverage (latest-version, envelope decoding, Beginning/PointInTime rejection); live emulator create/replace/delete, split/fan-out, and PointInTime rejection tests.

[yumnahussain]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved. I merged yumnahussain/cosmos-changefeed-envelope into this branch and fixed the conflict in sdk/cosmos/azure_data_cosmos/CHANGELOG.md in commit 5e3c326 (with a follow-up changelog readability tweak in c69739e).

[yumnahussain]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the new merge conflicts and merged the updated stacked base branch into this PR in commit 4e30d25.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (3)

sdk/cosmos/azure_data_cosmos/src/models/container_properties.rs:470

• This constructor can silently disable the mode it promises to enable: Duration::from_secs(59) becomes retentionDuration: 0, while 90 seconds is shortened to 60 seconds. Since the wire format only supports whole minutes, make this boundary fallible and reject zero or non-whole-minute durations instead of changing the caller's requested policy.

    pub fn all_versions_and_deletes(retention: Duration) -> Self {
        Self {
            retention_duration_minutes: (retention.as_secs() / 60).min(i32::MAX as u64) as i32,

sdk/cosmos/azure_data_cosmos/src/clients/container_client.rs:897

• This contradicts the PR description, which tells users to use an in-retention PointInTime for this mode. The implementation and new emulator tests reject that start instead. Please resolve which contract is intended and align the code, tests, changelog, API docs, and PR description so reviewers and users are not given opposite behavior.

    /// * Only [`ChangeFeedStartFrom::Now`] or resuming from a continuation token
    ///   is supported. [`ChangeFeedStartFrom::Beginning`] and
    ///   [`ChangeFeedStartFrom::PointInTime`] are **not** supported, because
    ///   intermediate versions and deletes are only retained within the
    ///   container's retention / continuous-backup window. The service gates
    ///   this and rejects such a request with `400 Bad Request`.

sdk/cosmos/azure_data_cosmos/tests/split_tests/cosmos_change_feed_split.rs:435

• These lines are not rustfmt-formatted, so the repository's mandatory formatting check will fail. Run cargo fmt -p azure_data_cosmos over the complete change; the same formatter will also wrap the other newly added long expressions in this test.

got_creates.sort();
expected_creates.sort();

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (3)

sdk/cosmos/azure_data_cosmos/tests/emulator_tests/cosmos_change_feed.rs:895

• A single next() only polls one physical range: UnorderedMerge::next_page advances one child per page (unordered_merge.rs:24-26,78-104). Since this test deliberately creates 2+ ranges, writes routed to unpolled ranges establish their Now position only after the writes and can be omitted, making the fan-out test time out/fail. Poll once per current feed range before writing.

            // Prime the per-range `Now` positions before writing.
            let primed = iterator
                .next()
                .await
                .expect("change feed stream always yields a page")?;

sdk/cosmos/azure_data_cosmos/src/models/container_properties.rs:446

• The stated 1-hour minimum is inaccurate: the official Azure Cosmos DB .NET ChangeFeedPolicy documentation configures a 5-minute full-fidelity retention window, and the wire setting has minute granularity. This public documentation would incorrectly discourage supported shorter windows; avoid hard-coding an unverified range since validation is intentionally delegated to the service.

/// The retention window has minute granularity. On the service it must fall
/// within the supported range (currently 1 hour to 30 days) when this mode
/// is enabled; this type does not enforce that range, leaving the service as the
/// source of truth.

sdk/cosmos/azure_data_cosmos/tests/split_tests/cosmos_change_feed_split.rs:435

• These added statements are not rustfmt-indented, so the repository's mandatory cargo fmt --check will fail. Run cargo fmt -p azure_data_cosmos before merging.

got_creates.sort();
expected_creates.sort();

[NaluTripician]

Local deep review of the AllVersionsAndDeletes change feed mode. Overall this is a high-quality, unusually well-tested PR — the two dangerous wire paths (Gateway 2.0 A-IM downgrade protection, and continuation-token mode binding) are both handled correctly and tested. No blocking wire/correctness bugs.

The inline notes below are, in priority order: one High (lossy Now resume undercuts AVAD's core delete guarantee), three Medium (client-side fail-fast, sub-minute retention truncation, preview-gating), two Low, and a fmt nit. The top ask before "done" is the lossy Now resume.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

sdk/cosmos/azure_data_cosmos/src/models/container_properties.rs:489

• Duration::as_secs() truncates sub-second values, so a nonzero retention such as Duration::from_nanos(1) serializes as 0 and disables AllVersionsAndDeletes, contrary to this method's stated round-up contract. Include subsec_nanos() when deciding whether a partial minute remains.

            retention_duration_minutes: retention.as_secs().div_ceil(60).min(i32::MAX as u64)
                as i32,

[NaluTripician]

Re-review of the fixup commit ("Address AVAD change-feed review comments"). Approving with nits.

I traced the H1 priming fix end-to-end against the source (plan_operation -> build_unordered_merge -> prime_children -> snapshot_state -> planner is_resume) and it genuinely closes the lossy-Now resume for the documented usage pattern (pull >=1 page, then checkpoint). The new integration test proves the never-served range is pinned and re-sends its ETag on resume, and latest_version_does_not_prime_ranges locks the mode gate. The other fixes all check out too: div_ceil round-up (overflow-safe, 0->0), the private retention field + serialize_with clamp on every read path (no direct field reads left in the crate), and the added crts assertion.

One residual Medium is worth a fast-follow (inline on planner.rs): a checkpoint taken before the first page still resumes from a stale Now. It's a narrow-but-legal, silent, untested path. Plus two minor nits. None are blocking, hence approve-with-nits — but I'd genuinely like to see the pre-first-page case closed before this is leaned on as fully stable (it's the last sliver of the exact guarantee this PR set out to provide).

[NaluTripician]

[Medium — residual H1 gap] A checkpoint taken before the first page still resumes from a stale Now and silently drops the gap.

Priming is gated full_fidelity_feed && !is_resume, and upstream is_resume = saved_tokens.is_some() (planner.rs:258). I traced the pre-first-page path:

1. query_change_feed().await eagerly builds the UnorderedMerge with all N children (cosmos_driver.rs:2704), and to_continuation_token() is callable before the first poll (plan is Some at construction — it only errors mid-fetch).
2. A snapshot taken before .next() skips every never-polled child because server_continuation is None (unordered_merge.rs:274), yielding active_tokens: [] + start_from: Now.
3. On resume, Some([]).is_some() == true → prime_on_first_drain = false → priming is disabled → every range falls back to the persisted Now marker and reads from resume-time Now, dropping exactly the versions/deletes in the gap — the same failure H1 fixes, relocated to the pre-first-page window.

This is legal API usage (checkpoint an iterator before pulling a page) and is currently untested.

Suggested fix: treat an empty-token resume as still-needs-priming, e.g.

let prime_on_first_drain = operation.request_headers().full_fidelity_feed
    && saved_tokens.as_ref().map_or(true, |t| t.is_empty());

A fully-drained resume arrives as PipelineNodeState::Drained (handled earlier), not an empty UnorderedMerge, so this stays safe. Please also add a test that snapshots a fresh AVAD pipeline before the first page and asserts resume still pins every range.

[NaluTripician]

[Low — defensive] The priming Page arm advances unconditionally without confirming the primed page was item-less.

This is correct under the AVAD invariant that a fresh feed's first start-from-Now poll is a 304 carrying only an ETag. But if a range's first poll ever returns a 304 with no ETag, the child stays Initial, priming still treats it as success (idx += 1), and that range contributes None to the snapshot — so it silently resumes from Now (the H1 gap, for that one range). Unlikely against the real service, but silent rather than an error, and the mock always supplies an ETag so it's untested. Consider a debug_assert! that the primed page is empty, or explicitly handling the no-ETag case.

[NaluTripician]

[Nit — resiliency + latency] Priming is sequential and fail-all-or-nothing.

This ? propagates a hard error on any single range and aborts the entire first page, even for ranges that would have served data — priming front-loads and serializes every range's first poll, so it strictly widens the window where one bad/slow partition stalls feed startup. It also adds N sequential round-trips (and N RUs) before the first page on a wide fan-out AVAD feed. Functionally fine, but worth (a) confirming the request layer retries transient errors beneath this point, (b) considering priming ranges concurrently, and (c) documenting the extra first-page latency/RU cost, which the comments don't mention.

[tvaron3]

LGTM

[tvaron3]

/azp run rust - cosmos - weekly

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).