transaction fn should not retry for ever

[thomassa]

At present the transaction function retries indefinitely on receiving the Eagain exception.
If some other client of the xenstore instance is constantly making quick writes to a node used by the transaction, then the transaction could keep retrying for ever and the calling thread will be blocked.
https://github.com/mirage/ocaml-xenstore/blob/master/client_unix/xs_client_unix.ml#L389

I'm planning on submitting a pull-request to fix this, but I think first I should check what approach the maintainers of this code will be willing to accept: there are a few ways we could handle it.

Here we specify a number of attempts, and on running out of retries, call an on_conflict function passed in as a parameter to the transaction function:

let rec transaction attempts client f on_conflict =
  let tid = rpc "transaction_start" (Xs_handle.no_transaction client) Request.Transaction_start Unmarshal.int32 in
  let h = Xs_handle.transaction client tid in
  let result = f h in
  try
    let res' = rpc "transaction_end" h (Request.Transaction_end true) Unmarshal.string in
    if res' = "OK" then result else raise (Error (Printf.sprintf "Unexpected transaction result: %s" res'))
  with Eagain ->
    if attempts <= 0
    then on_conflict ()
    else transaction (attempts-1) client f on_conflict

Alternatively, we could do without the on_conflict function and just raise some exception (perhaps Eagain) on running out of retries... but I feel it is a good thing for this function to force the author of code that uses it to consider what action to take if the transaction cannot be made to succeed, whereas if we just raise an exception here then the calling code might not handle it.

As yet another approach, we could do without the attempts parameter, and have

  with Eagain ->
    on_conflict ()

where on_conflict can choose between calling transaction again (possibly after a delay), or giving up (returning an empty value or raising an exception)
or something like

  with Eagain ->
    let new_on_conflict = on_conflict ();
    transaction client f new_on_conflict

where on_conflict can choose to raise an exception to break the otherwise indefinite retry loop.

[thomassa]

As a concrete example of one approach, see the pull-request at
#30