External/buzz

Fork 0

mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00

Files

T

History

9128b9389b fix(desktop): preserve failed unread mutations and fence archive session acquisition

Round-2 review found two defects in the previous repair commit.

**The mutation whose ingest failed was dropped.** `enqueueNative`'s recovery
reopened the authoritative snapshot and resolved, so the captured mutation was
never retried or preserved — and the reopened snapshot is the store *without*
that write. A rejected marker un-read the channel; a rejected `removeChannel`
/`clearAll` resurrected rows the user had just cleared, because those delete
their projection optimistically first. The previous test proved the chain
healed, not that the operation survived: it asserted only that the *next*
command landed.

Every captured mutation now gets one retry after `reopen` refreshes sequence
and revision, which is safe because ingest is idempotent — events upsert `DO
NOTHING`, channel latest advances by `MAX`, membership is `INSERT OR IGNORE`,
and a replayed sequence returns a snapshot rather than reapplying. A
`snapshotRequired` response takes the same recovery path instead of being
treated as success. If reopen and retry both fail, native is explicitly
degraded and the equivalent event/marker/latest/clear state is applied to the
JS fallback, so `isNative()` stops reporting healthy. Membership needs no
fallback copy: its renderer-owned sets remain authoritative.

**A superseded archive start could tear down the newer scope's relay session.**
`begin` claimed ownership and released its guards, then `start_archive_sync`
awaited `archive_session`. `ensure_session` shuts down a different scope's
socket and installs its own inside its own lock, and `attach_archive` replaces
the session's archive sender outright — both destructive on entry. So a stale
start B could win `begin`, pause, let newer C claim and install, then resume,
shut C's session down, and attach the archive stream to a task whose token was
already cancelled. B cleared its subscriptions on exit and archive sync stayed
dead until the next lifecycle edge.

Revalidating the mark after the await cannot fix this: by the time B discovers
it lost, C's socket is already gone, and a session is spawned rather than handed
back, so there is nothing to restore it from. The damage is done by the call, so
the fence is around the call. `begin` now returns an `ArchiveOwnership` token
holding both guards, and `archive_session` requires one. The token is
un-constructible outside `archive::sync`, so a stale start cannot reach the call
at all. This is sound because acquisition performs no I/O: both halves await
only mutex acquisitions and the socket connects on a spawned task.

Reverting the token does not compile, so the Rust regression pins the property
its usefulness rests on — while an owner holds the token, no newer start can
claim. That goes red against the mutant this design exists to stop: keeping the
token but releasing the guards inside `begin`, which compiles and restores the
race. The JS regressions assert the originally rejected marker, destructive
clear, and membership delta each survive, and go red when the retry is removed.

Co-authored-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz>
Co-authored-by: Tyler Longwell <tlongwell@squareup.com>
Signed-off-by: Tyler Longwell <tlongwell@squareup.com>

2026-08-17 17:05:11 -04:00