@preventive/triage 1.0.0-alpha.13 → 1.0.0-alpha.15

package/server-e2e/objstore/handlers.ts

@@ -48,9 +48,9 @@ export type ObjstoreDeps = {
   // Cross-instance pub/sub for objstore-deleted. Fired alongside the
   // local `broadcast` after a successful delete so peers on OTHER
   // server instances see the version drop in real time. Carries the
-  // full (tag, resourceTag, version) tuple inline — the workspace_object
+  // full (tag, resourceTag, version, incarnation) tuple inline — the workspace_object
   // row is gone post-delete, so the bus payload IS the wire data.
-  publishObjDeleted: (tag: string, resourceTag: string, version: number) => void
+  publishObjDeleted: (tag: string, resourceTag: string, version: number, incarnation: string) => void
   getNonce: (socket: WebSocket) => string | undefined
   debug: boolean
   // Auth gate for the FIRST put-begin against a never-before-seen
@@ -191,13 +191,14 @@ async function handleDelete(deps: ObjstoreDeps, socket: WebSocket, msg: Objstore
   // observes its own PUTs as echo events. The same symmetry on
   // `onDeleted` lets `session.onDeleted` fire for the session's
   // own deletes — pinned by `tests/objstore-client-races.test.js`.
-  deps.broadcast(tag, { type: 'objstore-deleted', workspaceTag: tag, resourceTag, version: result.deletedVersion }, null)
+  // A successful nonempty delete matched this authenticated incarnation.
+  deps.broadcast(tag, { type: 'objstore-deleted', workspaceTag: tag, resourceTag, version: result.deletedVersion, incarnation: prevIncarnation! }, null)
   // Cross-instance fan-out (Neon mode). The workspace_object row is
   // gone post-delete so the bus payload carries (tag, resourceTag,
-  // version) inline; the receiver builds its `objstore-deleted`
+  // version, incarnation) inline; the receiver builds its `objstore-deleted`
   // broadcast directly from the bus envelope. SQLite mode publishes
   // to a no-op.
-  deps.publishObjDeleted(tag, resourceTag, result.deletedVersion)
+  deps.publishObjDeleted(tag, resourceTag, result.deletedVersion, prevIncarnation!)
   if (deps.debug) console.log(`objstore delete → ${debugTag(tag)}/${resourceTag.slice(0, 8)}…`)
 }
 

package/server-e2e/objstore/init.ts

@@ -30,7 +30,7 @@ export type ObjstoreInitDeps = {
   // mode passes Postgres LISTEN/NOTIFY-backed implementations. See
   // server-e2e/pubsub.ts for the bus design.
   publishObjPut: (tag: string, resourceTag: string) => void
-  publishObjDeleted: (tag: string, resourceTag: string, version: number) => void
+  publishObjDeleted: (tag: string, resourceTag: string, version: number, incarnation: string) => void
   getNonce: (socket: WebSocket) => string | undefined
   debug: boolean
   // Auth gate for the FIRST objstore-put-begin against a workspace

package/server-e2e/objstore/rest-mint.ts

@@ -219,6 +219,6 @@ async function handleRestDelete(
   // fans out to subscribers (including the originator, matching the WS path's
   // `except: null`) so peers' `onDeleted` fire.
   if (result.deletedVersion === 0) return
-  deps.broadcast(route.tag, { type: 'objstore-deleted', workspaceTag: route.tag, resourceTag: route.resourceTag, version: result.deletedVersion }, null)
-  deps.publishObjDeleted(route.tag, route.resourceTag, result.deletedVersion)
+  deps.broadcast(route.tag, { type: 'objstore-deleted', workspaceTag: route.tag, resourceTag: route.resourceTag, version: result.deletedVersion, incarnation: prevIncarnation! }, null)
+  deps.publishObjDeleted(route.tag, route.resourceTag, result.deletedVersion, prevIncarnation!)
 }

package/server-e2e/objstore/rest.ts

@@ -71,8 +71,8 @@ export type ObjstoreRestDeps = {
   // Cross-instance pub/sub for objstore-deleted — fired alongside the local
   // `broadcast` after a successful REST delete mint, so peers on OTHER
   // instances drop the resource in real time. Carries (tag, resourceTag,
-  // version) inline (the row is gone post-delete). SQLite mode passes a no-op.
-  publishObjDeleted: (tag: string, resourceTag: string, version: number) => void
+  // version, incarnation) inline (the row is gone post-delete). SQLite mode passes a no-op.
+  publishObjDeleted: (tag: string, resourceTag: string, version: number, incarnation: string) => void
   // New-workspace operator gate for the REST put-begin mint — the
   // connection-independent analog of the WS path's `authGate`. Returns
   // `true` to DENY (a password is configured AND the workspace is

package/server-e2e/pubsub.ts

@@ -57,13 +57,13 @@ function newSenderId(): string {
 //   - 'objput': objstore-put broadcast. `res` is the resource tag; the
 //     receiver SELECTs the live row by (tag, res) for the rest of the
 //     metadata fields.
-//   - 'objdel': objstore-deleted broadcast. `ver` is the deleted version
-//     — inline because the row is gone from workspace_object after the
-//     delete commit.
+//   - 'objdel': objstore-deleted broadcast. `ver` and `incarnation` identify
+//     the deleted row, which is gone from workspace_object after commit.
+//     Incarnation is optional only for messages from older relay instances.
 export type BusMessage =
   | { kind: 'rev'; tag: string; id: string }
   | { kind: 'objput'; tag: string; res: string }
-  | { kind: 'objdel'; tag: string; res: string; ver: number }
+  | { kind: 'objdel'; tag: string; res: string; ver: number; incarnation?: string }
 
 // Receiver wired up by the hub layer (see server-e2e/index.ts). Each handler
 // runs once per remote message; failures are logged but don't crash the
@@ -388,7 +388,10 @@ function parseBusMessage(raw: Record<string, unknown>): BusMessage | null {
     const ver = raw['ver']
     if (typeof res !== 'string') return null
     if (typeof ver !== 'number' || !Number.isSafeInteger(ver)) return null
-    return { kind: 'objdel', tag, res, ver }
+    const incarnation = raw['incarnation']
+    if (incarnation === undefined) return { kind: 'objdel', tag, res, ver }
+    if (typeof incarnation !== 'string' || incarnation.length === 0) return null
+    return { kind: 'objdel', tag, res, ver, incarnation }
   }
   return null
 }

package/server-e2e/sync-handlers.ts

@@ -26,6 +26,8 @@ type WireRevision = {
   signature: string
 }
 
+type SubscriptionLookup = { resume: () => void }
+
 // Structured result of the shared save pipeline (`commitSave`), rendered
 // per transport: WS → protocol frames; REST → JSON + HTTP status.
 type SaveOutcome =
@@ -79,6 +81,7 @@ export type SyncHandlersDeps = {
   // payload budget. Optional: a SQLite deployment passes a no-op.
   publishRevision: (tag: string, revisionId: string) => void
   subscribe: (socket: WebSocket, tag: string) => void
+  pauseBroadcasts: (socket: WebSocket) => () => void
   getNonce: (socket: WebSocket) => string | undefined
   requiresAuth: (socket: WebSocket) => boolean
   // Whether an operator password is configured. The REST save plane's
@@ -112,6 +115,9 @@ export type SyncHandlers = {
 
 export function createSyncHandlers(deps: SyncHandlersDeps): SyncHandlers {
   const { handle, send, broadcast, publishRevision, subscribe, getNonce, requiresAuth, passwordConfigured, sendUnauthorized, workspaceExists, objstoreResources, debug } = deps
+  // Only the newest lookup for a socket/tag may publish a snapshot.
+  // Versions cannot order different object incarnations (or deletions).
+  const subscriptionLookups = new WeakMap<WebSocket, Map<string, SubscriptionLookup>>()
 
   // Typed wrapper for the three `workspace-save-error` emit sites
   // (too-large at handleSave, stale-base after the catch-up, busy at
@@ -348,34 +354,54 @@ export function createSyncHandlers(deps: SyncHandlersDeps): SyncHandlers {
       return
     }
     const tag = msg.workspaceTag
-    subscribe(socket, tag)
-    // Explicit ack — distinguishes "the server processed my subscribe
-    // and registered me as a peer" from "the WebSocket is open". A
-    // client that sent a malformed / bad-sig subscribe never gets this;
-    // a client that did gets one before the chain arrives. Lets the UI
-    // surface a `connecting → online` transition based on real handshake
-    // completion, not just socket state.
-    //
-    // The ack also carries the objstore inventory snapshot: the same
-    // subscribe that registers this socket for objstore-put / -deleted
-    // broadcasts seeds the client's initial inventory in one handshake.
-    // The client keeps it live thereafter from those broadcasts.
-    // Returns [] for a triage-only workspace. A failing inventory
-    // lookup must NOT sink the subscribe — degrade to an empty snapshot
-    // (broadcasts will fill it in) so the ack + chain still go out.
-    let resources: object[] = []
-    try { resources = await objstoreResources(tag) }
-    catch (err) { if (debug) console.warn('subscribe: objstore inventory lookup failed', debugTag(tag), err) }
-    send(socket, { type: 'workspace-subscribed', workspaceTag: tag, resources })
-    // `from` is the last revision id the client claims to have applied —
-    // now a base64url string, not an integer. We send only revisions
-    // after that. Client lying about `from` just means they get a
-    // smaller catch-up — their subsequent saves will reveal stale state
-    // on the usual base-mismatch path. Null / missing → full chain.
-    const fromId = typeof msg.from === 'string' ? msg.from : null
-    const revisions = chainForWire(await chainFrom(handle, tag, fromId))
-    if (debug) console.log(`subscribe ${debugTag(tag)} from=${fromId?.slice(0, 8) ?? 'null'} → chain ${revisions.length}`)
-    send(socket, { type: 'workspace-state', workspaceTag: tag, revisions })
+    const lookups = subscriptionLookups.get(socket) ?? new Map<string, SubscriptionLookup>()
+    subscriptionLookups.set(socket, lookups)
+    const previous = lookups.get(tag)
+    const resume = deps.pauseBroadcasts(socket)
+    const lookup = { resume }
+    lookups.set(tag, lookup)
+    // Acquire the replacement's pause before releasing its predecessor so
+    // buffered broadcasts cannot overtake the replacement snapshot. A hung
+    // obsolete read must not keep the whole socket paused. The hub's release
+    // is idempotent, so the old finally can still call it when the read ends.
+    previous?.resume()
+    try {
+      subscribe(socket, tag)
+      // Explicit ack — distinguishes "the server processed my subscribe
+      // and registered me as a peer" from "the WebSocket is open". A
+      // client that sent a malformed / bad-sig subscribe never gets this;
+      // a client that did gets one before the chain arrives. Lets the UI
+      // surface a `connecting → online` transition based on real handshake
+      // completion, not just socket state.
+      //
+      // The ack also carries the objstore inventory snapshot: the same
+      // subscribe that registers this socket for objstore-put / -deleted
+      // broadcasts seeds the client's initial inventory in one handshake.
+      // The client keeps it live thereafter from those broadcasts.
+      // Returns [] for a triage-only workspace. A lookup failure is NOT an
+      // empty inventory: clients interpret absent resources as deletions.
+      // Reconnect to retry the complete handshake on either transport.
+      const resources = await objstoreResources(tag)
+      if (socket.readyState !== socket.OPEN || lookups.get(tag) !== lookup) return
+      // `from` is the last revision id the client claims to have applied —
+      // now a base64url string, not an integer. We send only revisions
+      // after that. Client lying about `from` just means they get a
+      // smaller catch-up — their subsequent saves will reveal stale state
+      // on the usual base-mismatch path. Null / missing → full chain.
+      const fromId = typeof msg.from === 'string' ? msg.from : null
+      const revisions = chainForWire(await chainFrom(handle, tag, fromId))
+      if (socket.readyState !== socket.OPEN || lookups.get(tag) !== lookup) return
+      if (debug) console.log(`subscribe ${debugTag(tag)} from=${fromId?.slice(0, 8) ?? 'null'} → chain ${revisions.length}`)
+      send(socket, { type: 'workspace-subscribed', workspaceTag: tag, resources })
+      send(socket, { type: 'workspace-state', workspaceTag: tag, revisions })
+    } catch (err) {
+      if (lookups.get(tag) !== lookup) return
+      if (debug) console.warn('subscribe: snapshot lookup failed', debugTag(tag), err)
+      socket.close(1011, 'subscription unavailable')
+    } finally {
+      if (lookups.get(tag) === lookup) lookups.delete(tag)
+      resume()
+    }
   }
 
   return { handleSave, handleSaveRest, handleSubscribe, sendSaveError }