[yeya24]

What this PR does:

blocksStoreReplicationSet declares a subservicesWatcher *services.FailureWatcher and calls WatchManager on it from starting(), but newBlocksStoreReplicationSet never assigns it.

WatchManager registers a manager listener whose callback sends on w.ch. Unlike Chan(), it has no nil receiver guard, so the first subservice failure dereferences a nil *FailureWatcher. Because Manager.AddListener runs each listener on a dedicated goroutine, the panic terminates the process rather than returning an error:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0]
goroutine 10 [running]:
...services.(*FailureWatcher).WatchManager.func1(...)
        pkg/util/services/failure_watcher.go:33
...services.funcBasedManagerListener.Failure(...)
        pkg/util/services/manager.go:321
...services.(*Manager).serviceStateChanged.func1(...)
        pkg/util/services/manager.go:185
...services.(*Manager).AddListener.func1()
        pkg/util/services/manager.go:245
created by ...services.(*Manager).AddListener in goroutine 8
        pkg/util/services/manager.go:243

The subservices here are the store-gateway ring and its client pool, so this path is reachable in practice. We hit it on a querier whose store-gateway ring failed to start: the panic's stack trace buried the error logged for the actual cause on the preceding line (module failed module=store-queryable err="..."), making a routine startup failure look like a crash inside Cortex.

The bug is masked at the other end. Chan() does guard a nil receiver and returns a nil channel, so the select in running() blocks forever on it rather than reporting the failure. A subservice failure is therefore either silently dropped or crashes the process, depending on which path observes it first.

Fixed by assigning services.NewFailureWatcher() in the constructor, matching BlocksStoreQueryable (blocks_store_queryable.go) and parquetQueryableWithFallback (parquet_queryable.go), which already do.

Note: Scheduler (pkg/scheduler) and Frontend (pkg/frontend/v1) have the same un-initialised field. I left them out of this PR because their subservices are requestQueue and activeUsers, both TimerServices whose iteration functions return nil unconditionally, so they have no path into Failed today and the nil watcher is never dereferenced. Happy to fix those here too if you'd prefer the pattern be consistent across the package.

Which issue(s) this PR fixes:

Checklist

• Tests updated — regression test verified to fail before the fix and pass after
• Documentation added — n/a
• CHANGELOG.md updated
• docs/configuration/v1-guarantees.md updated if this PR introduces experimental flags — n/a, no new flags

---

AI assistance: this change was prepared with the help of an AI coding assistant (investigation, patch and test). I have reviewed and verified it, and I take responsibility for its content, per the project's GenAI contribution policy.

[sandy2008]

LGTM. The new test fails without the fix, and with a ring whose KV Get fails at startup, the nil-pointer panic in the listener goroutine turns into a clean unable to start blocks store set subservices: ... error.

The test (arm64) failure is the TestPrometheusMetrics_IncrementedCorrectly flake in pkg/util/queryeviction, unrelated to this change.