@rotorsoft/act 1.23.18 → 1.23.20

package/dist/index.js

@@ -1566,6 +1566,15 @@ var CorrelateCycle = class {
   get checkpoint() {
     return this._checkpoint;
   }
+  /**
+   * Whether any reaction uses a dynamic resolver — i.e. whether `correlate`
+   * performs a store scan rather than the static no-op early-return. The
+   * settle loop reads this to avoid recording a fictitious circuit-breaker
+   * success on a static app whose correlate never touches the store (#1329).
+   */
+  get has_dynamic_resolvers() {
+    return this._has_dynamic_resolvers;
+  }
   /**
    * Initialize correlation state on first call.
    * - Reads max(at) from store, then floors the cold-start checkpoint at
@@ -2067,8 +2076,21 @@ async function load(me, target, callback, patch_fn = bare_patch) {
       // a non-time-travel cold load — a bounded load full-scans real events
       // under its `asOf` filter. This is the single floor-eligibility decision
       // for the whole system; the stores apply the floor whenever asked and
-      // never re-derive it (RFC 1274). The warm path resumes from `after`.
-      ...cached ? { after: cached.event_id } : { ...time_travel ? {} : { with_snaps: true }, ...asOf }
+      // never re-derive it (RFC 1274).
+      //
+      // The warm path resumes from `after`, and MUST also carry `with_snaps`
+      // (#1345): `after` and `with_snaps` are independent store conditions —
+      // `after` bounds the scan (id > cached.event_id), `with_snaps` keeps
+      // `__snapshot__` rows in the result. A stale (lagging/cross-process)
+      // cache checkpoint can sit below a newer `__snapshot__` boundary, and a
+      // windowed close (`app.close`/`.autocloses({keep})`) may have pruned the
+      // domain events between the checkpoint and that snapshot. Without
+      // `with_snaps` the rebaselining snapshot is filtered out and the fold
+      // silently applies the surviving tail on top of stale state (wrong
+      // count, yet `version` still reports the true head — the concurrency
+      // guard passes). With it, the snapshot in the after-window rebaselines
+      // the fold; when no snapshot falls in the window it is a no-op.
+      ...cached ? { after: cached.event_id, with_snaps: true } : { ...time_travel ? {} : { with_snaps: true }, ...asOf }
     }
   );
   const head_is_tombstone = event?.name === TOMBSTONE_EVENT;
@@ -2860,7 +2882,7 @@ var SettleLoop = class {
             ...correlate_query,
             after: after_before
           });
-          this._deps.breaker.passed();
+          if (this._deps.correlate_probes_store) this._deps.breaker.passed();
           last_drain = await this._deps.drain(drain_options);
           const made_progress = subscribed > 0 || last_drain.acked.length > 0 || last_drain.blocked.length > 0 || last_id > after_before;
           if (!made_progress) break;
@@ -3125,13 +3147,14 @@ var Act = class {
         on_error: (error, circuit) => this._emit_error(error, circuit),
         // Re-probe the store when the cooldown elapses, so recovery is
         // automatic even on the default lane (which has no periodic poller).
-        // Any polling loop can trip the shared breaker — but a bare `drain()`
-        // only touches the store when the controller is armed, so a trip
-        // from a correlate failure could go unprobed. `settle()` always runs
-        // a correlate (a store query) before draining, so it re-probes
-        // regardless of which loop opened the breaker: one success closes it
-        // and every loop resumes on its own cadence. A failed probe re-opens
-        // the breaker and reschedules the wake.
+        // The wake fires `settle()`, which (in half-open) runs a real store
+        // probe: for a dynamic-resolver app the probe is settle's correlate
+        // (a store scan); for a static-reaction app correlate is a no-op that
+        // records no health, so the probe is settle's DRAIN claim — either
+        // way one success closes the breaker and every loop resumes, a
+        // failure re-opens it and reschedules the wake. Settle does NOT close
+        // the breaker off a no-op correlate (#1329) — only a real store op
+        // (correlate scan or drain claim) records `passed()`.
         on_retry: () => {
           this.settle({ debounceMs: 0 });
         }
@@ -3308,7 +3331,11 @@ var Act = class {
         correlate: (q) => this.correlate(q),
         drain: (o) => this.drain(o),
         on_settled: (drain) => this.emit("settled", drain),
-        breaker: this._breaker
+        breaker: this._breaker,
+        // Static-reaction apps' correlate is a no-op (no store call), so a
+        // settle pass carries no store-health signal — don't let it record a
+        // breaker success (#1329).
+        correlate_probes_store: this._correlate.has_dynamic_resolvers
       },
       options.settleDebounceMs ?? DEFAULT_SETTLE_DEBOUNCE_MS
     );