jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-10-31 22:41:12 +00:00

Files

Duncan 28707c115b fix(sidebar-sync): close three P2a queue-until-bootstrap state-machine defects

Thufir's focused pass (890de2d90) identified three executable loss/overwrite
paths and two test-gate gaps. This commit addresses all five findings.

Production fixes:

1. Absent-bootstrap seed must not clobber a pending edit.
   When bootstrap resolves absent and local state is non-empty, runBootstrap
   calls publishFn(localStore) to seed the relay. If a click was already
   pending (pendingStore !== null), that click IS the seed intent; calling
   publish(localStore) again bumps the generation and overwrites the outbox
   with the stale mount snapshot. Fix: guard the publishFn lambda so
   publish(localStore) is a no-op when a pending edit already exists.

2. releaseDeferred must use the bootstrap-result head, not mutable lastRemoteHead.
   subscribeLive can advance lastRemoteHead with a live peer head while bootstrap
   is in-flight. A live head arriving after the click but before bootstrap
   resolves must remain a genuine remote advance — if releaseDeferred re-freezes
   publishBaseline from lastRemoteHead, the live head folds into the baseline,
   the pre-publish check sees equality, and the edit publishes over the peer.
   Fix: derive bootstrapResultHead from fetchResult directly (not lastRemoteHead),
   and pass it into releaseDeferred. fetchResult carries exactly the head the
   bootstrap operation itself fetched; subscribeLive's passive observations
   are invisible to it.

3. Failed-bootstrap exception must be disarmed once any head is independently
   observed (live or reconnect/periodic fetch).
   bootstrapFailed+empty-baseline correctly identifies the "first unknown base"
   case, but after a transient pre-publish fetch failure and a subsequent live
   peer head arrival, the exception re-fires on retry and treats a genuine peer
   advance as a base-establishment, publishing over it. Fix: add
   bootstrapFailedExternalHeadObserved flag; set it from subscribeLive decode
   completion and from fetchRemoteBlob when it finds a head while
   bootstrapFailed is true. The exception checks !bootstrapFailedExternalHeadObserved.

Test-gate fixes:

- P2a cases moved to a new wholeBlobSyncP2a.shared.test.mjs (449 lines) and
  exported as runWholeBlobP2aSuite; called from both useChannelSections.test.mjs
  and useChannelSortPreference.test.mjs for two-lane coverage. Removes the P2a
  block from wholeBlobSync.shared.test.mjs (841 lines, down from 1080).

- Five causal regressions, each named by its exact production mutation:
  T1: drop bootstrapStarted guard → baseline {0,""} at debounce → adopt fires.
  T2: releaseDeferred uses mutable lastRemoteHead → live head folds into baseline
      → pre-publish sees equality → publish over peer (load-bearing for defect 2).
  T3: drop pendingStore===null guard → seed clobbers edit → stale mount published.
  T4: drop !bootstrapFailedExternalHeadObserved → exception fires after live
      observation → publish over genuine peer advance.
  T5 (Kalvin's original): remove bootstrapFailed exception block → hard-adopt
      against {0,""} → click lost (load-bearing for defect 3).

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-09-02 16:55:18 -04:00