cross-tab-worker-databus 0.21.16 → 0.21.17

package/CHANGELOG.md

@@ -1,4 +1,21 @@
-## [Unreleased]
+## [0.21.17] - 2026-09-24
+
+### Fixed
+
+- **A durable route confirmed to a Worker that no longer holds the assignment no longer orphans its Topic permanently.** `pause()` clears `assignedTopics` unconditionally but rewrites only the routes it can hand off, and a handoff whose final storage flush is cut short leaves the queued rest to be discarded when the teardown ends — so the record on disk still names the departing owner, confirmed, with the generation it had before. When that worker id registers again (a BFCache restore, or a runtime rebuilt with an explicit `workerId`), the route names a live Worker that holds nothing, and both reconcile passes miss the combination by construction: `reconcileSubscriptions()` walks `subscribedTopics` and stands down for a live owner, `reconcileAssignedTopics()` walks `assignedTopics`, and the phantom is in neither. The result is a topic nobody's transport subscribes — inbound messages stop arriving in **every** tab while outbound publishing keeps working, and `isAssigned()` still answers `true` for the phantom owner through its durable-route fallback, so nothing reports it.
+- The named Worker now repairs it, and only it can: reclaim through the same self-assignment `subscribe()` performs when it still has a local handler for the topic (the record and its generation stay byte-identical, so peers see no churn on a route that already named it), or release the record and let a remaining subscriber elect an owner it can act on. Two gates make this safe to run every heartbeat. `confirmedAt` must be present, because that is what distinguishes a settled record from an election or handoff in flight — `confirmRoute()` has exactly three call sites and each sits in the same task as the `assignedTopics.set` before it, so a confirmed route with no assignment can only mean the assignment was taken away afterwards; and the assignment map is consulted first, which is what leaves the *legitimate* case alone: a Worker elected on a peer's behalf owns a route for a topic it never subscribed locally, and a sweep keyed on `subscribedTopics` would delete that record on every pass.
+- The release **flushes the deletion before broadcasting `REGISTRY`**. A peer reconciling on the nudge reads storage through its own batching writer, so without the flush it reads the route that is still queued for deletion in the releasing Worker, stands down again, and the repair waits a full heartbeat. This is the rule `pause()` and `handoffAssignedTopics()` already follow, and the pin is a synchronous post-pass read that fails when the flush is removed.
+- Corrected the premise of one pre-existing test, which hand-wrote a takeover route by copying the real one and changing `workerId`/`tabId`/`generation` — leaving the *previous* owner's `confirmedAt` on a record that names a different worker. No Worker writes that state, and it is exactly what the new sweep releases, so the test's assertion would have gone green by way of a different mechanism than the one it names. It now stages an unconfirmed takeover, which is what a real one looks like from a peer's seat.
+
+### Tests
+
+- `MemoryStorage` gained `failNextWrites(n)`, which makes the next `n` `setItem` calls throw the error a quota-full `localStorage` throws. Only writes fail — `removeItem` cannot — which is what makes the knob usable for its one purpose: the state above is produced by a lost **write**, and a test that asserted "storage failed" through a lost delete would be asserting a mechanism the browser does not have.
+- Three pins, one per leg, and each dies separately: reclaiming a stranded self-route (`generation` and owner asserted unchanged alongside the restored assignment), releasing one for a peer to re-elect, and leaving a route alone while its holder still has the assignment. Mutating the new code leg by leg, with the whole suite run each time: dropping the confirmation gate fails **6**, dropping the addressee gate fails **28**, dropping the assignment gate fails **7** (including the sticky-route pin above), dropping the reclaim fails exactly **1**, dropping the route delete exactly **1**, dropping the nudge exactly **1**, dropping the flush exactly **1** — the last three are disjoint, so none of the three legs is decoration.
+- The `storage-fail` interleaving that found this is **not** shipped in the coordination sweep, and the reason is measured rather than assumed. Adding it as a band in the seed's roll (2.5% of steps) makes the sweep fail on the pre-fix code with five violating seeds — `414`, `467`, `1557`, `2074`, `2969`, every one opening with a `storage-fail` and ending in `1 subscriber(s) need one owner that holds the transport, got owners=[] transportSubscriptions=[]` — and pass with the fix (`0` violations over the `4,701` seeds that run before the fuse). But the first kill sits at seed **414**, four times above the sweep's 100-seed floor, so on a starved runner the band would not catch a regression of this class, while the unit pins catch it deterministically. It stays a finder: the recipe is in `docs/progress.md`, and the `failNextWrites` knob it needs is now committed.
+
+### Documentation
+
+- `docs/architecture.md` and its Chinese mirror gained a "Stranded-self-route repair" invariant bullet next to the "Assignment drift repair" one it is the inverse of, and the heartbeat/reconcile summary now lists the pass in the order it runs (after the orphan prune, before the subscription pass, so a released route is re-elected inside the same cycle rather than one heartbeat later).
 
 ## [0.21.16] - 2026-09-24
 

package/dist/centrifuge.js

@@ -7,7 +7,7 @@ import {
   publicationMetadata,
   selectWorkerBackend,
   serializeError
-} from "./chunk-GQ6NYWQL.js";
+} from "./chunk-EZYCSJRS.js";
 import {
   CENTRIFUGE_INPUT_TYPE,
   CENTRIFUGE_OUTPUT_TYPE,

package/dist/{chunk-GQ6NYWQL.js → chunk-EZYCSJRS.js}

@@ -1284,6 +1284,7 @@ var WorkerClusterRuntime = class {
   reconcile() {
     if (!this.started) return;
     const workers = this.reconcileWorkers();
+    this.reconcileStrandedSelfRoutes();
     const activeWorkers = selectActiveWorkers(workers, this.maxActiveWorkers);
     this.reconcileSubscriptions(workers, activeWorkers);
     this.reconcileAssignedTopics();
@@ -1348,6 +1349,52 @@ var WorkerClusterRuntime = class {
       }
     }
   }
+  /**
+   * Repair a confirmed route that names this Worker while its assignment is gone.
+   *
+   * Every write that settles ownership stamps the new owner's assignment in the
+   * same task as the confirmation (`confirmRoute()` has exactly three call sites,
+   * each directly after an `assignedTopics.set`), so a route carrying
+   * `confirmedAt` while this map has no entry can only mean the assignment was
+   * taken *after* the route settled. That is what `pause()` does: it clears the
+   * map unconditionally but rewrites only the routes it can hand off, so a
+   * handoff whose final flush is cut short by a storage failure — and the
+   * `discardPending()` that ends the teardown throws the rest away — leaves a
+   * durable route naming this worker. If the same worker id registers again (a
+   * BFCache restore, or a runtime rebuilt with an explicit `workerId`), every
+   * peer reads that route as a live, confirmed owner and stands down, while no
+   * worker holds a transport subscription for the topic any more. Both reconcile
+   * passes miss it by construction: one walks `subscribedTopics`, the other
+   * `assignedTopics`, and the phantom is in neither.
+   *
+   * Acting here is this worker's alone — a peer that elected it is still waiting
+   * for its own CONTROL/SUBSCRIBE to be accepted, and the single-writer rule
+   * recorded in `reconcileSubscriptions()` forbids anyone else rewriting the
+   * record. Reclaim when the local subscription is still live, which restores the
+   * assignment and the transport subscription without touching the route, so the
+   * owner and its generation stay exactly as peers recorded them; release
+   * otherwise, since an owner that has no handler for the topic and never will is
+   * a record nothing can act on.
+   */
+  reconcileStrandedSelfRoutes() {
+    if (!this.storage) return;
+    let released = false;
+    for (const { key, value: route } of readAllByPrefix(this.storage, this.routePrefix)) {
+      if (route.confirmedAt === void 0 || route.workerId !== this.workerId) continue;
+      if (this.assignedTopics.has(route.topicKey)) continue;
+      const topic = this.knownTopics.get(route.topicKey);
+      if (topic !== void 0 && this.subscribedTopics.has(topic)) {
+        this.sendControl(this.workerId, CONTROL_ACTION.SUBSCRIBE, topic, route.topicKey);
+        continue;
+      }
+      this.removeStorage(key);
+      released = true;
+    }
+    if (released) {
+      this.flushStorage();
+      this.notifyRegistry();
+    }
+  }
   /** Drop assignments where the route no longer points to this worker. */
   reconcileAssignedTopics() {
     for (const [topicKey, topic] of [...this.assignedTopics]) {
@@ -2410,7 +2457,7 @@ var DedupManager = class {
 };
 
 // src/core/version.ts
-var SDK_VERSION = true ? "0.21.16" : "";
+var SDK_VERSION = true ? "0.21.17" : "";
 
 // src/core/data-bus.ts
 var DEFAULT_REPLAY_MAX_PER_TOPIC = 100;
@@ -3641,4 +3688,4 @@ export {
   parseDataBusPublication,
   selectWorkerBackend
 };
-//# sourceMappingURL=chunk-GQ6NYWQL.js.map
+//# sourceMappingURL=chunk-EZYCSJRS.js.map