Function metadata is not scoped to the JobHost, allowing placeholder triggers to leak through SyncTriggers during host restarts

[brettsam]

Background

PR #11874 added a guard in FunctionsSyncManager.TrySyncTriggersAsync that skips syncing when the active host is still running the standby/placeholder configuration. This closes the common race where a SyncTriggers call during the specialization window publishes the placeholder WarmUp payload to the platform.

That guard significantly reduces exposure, but it does not fully close the window. This issue tracks the remaining gap that Fabio flagged during review (approved, but noted a follow-up is required).

The remaining gap

There is still a narrow window where TrySyncTriggersAsync can run without a properly running JobHost and publish placeholder metadata:

• During a host restart, resolving the active JobHost services may fail.
• Meanwhile, the metadata manager still holds cached metadata from the placeholder host.
• In that state the new standby-host guard is bypassed, and the cached placeholder function metadata can still be published to the platform.

Root cause

The underlying problem is that function metadata is not scoped to the JobHost. Because the cached metadata isn't tied to the specific JobHost/configuration that produced it, there's no reliable way to detect that the metadata currently in hand belongs to a placeholder host that is no longer the active one.

Possible follow-up directions

• Clear cached function metadata during host restarts, so stale placeholder metadata cannot be served after the placeholder host goes away.
• Record which JobHost / configuration produced the metadata (scope/tag it), so SyncTriggers can detect placeholder-origin metadata and refuse to publish it regardless of the restart timing.
• Longer term, scope function metadata to the JobHost so this class of "wrong host's metadata gets published" bug is structurally prevented.

Notes

• Not a blocker for preventing SyncTriggers on placeholder hosts #11874 — that change already protects against the common scenario. This issue tracks closing the residual window.

Related

• Apps get stuck showing only the placeholder WarmUp function after a deploy (SyncTriggers race during specialization) #11873 (root cause / stuck placeholder WarmUp state)
• preventing SyncTriggers on placeholder hosts #11874 (initial fix — skip sync when active host is in standby configuration)

Originally posted by @fabiocav in #11874 (comment)