docs: consigner deux défauts vivants, dont une absence qui masque un échec

2026-08-20 11:05:34 +02:00
parent c61b181ed8
commit 0e57f20ca4
3 changed files with 49 additions and 7 deletions
@@ -0,0 +1,28 @@
+---
+type: bug
+severity: major
+summary: An inbox watch that failed to open is re-opened only by a narrow set of later events, so a session whose activity does not produce one stays unwatched and never converges
+opened: 2026-08-17
+last_checked: 2026-08-17
+---
+
+# A lost inbox watch is never retried
+
+While an identity is connected, every inbox it may read is watched, and a deposit is applied as it lands. When opening one of those watches **fails** — a broker hiccup at sign-in is enough — the failure is reported and the watch is dropped. It is then re-opened only by a later event, and the list of events that qualify is narrower than it looks:
+
+- creating a document,
+- opening an inbox on one,
+- a `ReadCap` arriving through an inbox **still** being watched,
+- the first read of a document in a public store.
+
+**An ordinary write does not qualify.** A `sparqlUpdate` on a document the identity already owns fires none of these. So it is not only a read-only session that stays blind — it is any session whose activity stays inside what it already holds.
+
+There is deliberately no polling: the deferred inbox processing states that as a design choice, and a timer here would be the wrong repair. What is missing is a recovery signal that does not depend on the identity performing a capability-bearing act.
+
+**The visible consequence.** A document is shared with the affected identity while it sits connected, and nothing arrives. No error is raised, and the application sees an empty result rather than a failure — the same shape as having been given nothing at all.
+
+**Workaround today:** a fresh `ensureIdentity()` re-enters and re-establishes the watches.
+
+**Verifying it:** drive an identity to a state where one inbox watch fails to open, let the broker recover, deposit for that identity, and observe that nothing converges while it stays connected. A reproduction existed as a scratchpad probe during the work that found this and did not survive the session; rebuilding it from this description is the honest cost of that.
+
+Predates the continuous-observation work — the earlier behaviour processed inboxes only at connection, so the same hiccup produced the same silence by a shorter route.