fix: un rejet tardif ne ferme plus un canal vivant, un registre illisible ne perd plus toutes les inbox

packages/polyfill/test/subscribe.test.ts

@@ -1,6 +1,7 @@
 import { test, expect, mock, afterAll } from "bun:test";
 import {
   docChangeType,
+  resubscribeDocs,
   subscribeDoc,
   subscribeDocReportingSetupFailure,
   subscribeDocs,
@@ -40,10 +41,19 @@ const SESSION: RegistrySession = { sessionId: "sid-1", privateStoreId: "PRIV" };
  * exactly the assumption that cost this package a view that never re-read and an inbox that
  * never notified, and a fake that holds it cannot fail on either.
  */
-function makeFakeNg(failFor: Set<string> = new Set()) {
+function makeFakeNg(failFor: Set<string> = new Set(), hangFor: Set<string> = new Set()) {
   const subs = new Map<string, (r: unknown) => void>();
+  // A call the broker has neither answered nor refused yet, so a LATER call can overtake it
+  // and this one can settle afterwards. Held on an object rather than in a `let` so its
+  // type survives being written from one closure and read from another.
+  const hung: { reject: ((error: unknown) => void) | null } = { reject: null };
   const doc_subscribe = mock(async (nuri: string, _sid: unknown, cb: (r: unknown) => void) => {
     if (failFor.has(nuri)) throw new Error(`RepoNotFound: ${nuri}`);
+    if (hangFor.has(nuri)) {
+      return await new Promise((_resolve, reject) => {
+        hung.reject = reject;
+      });
+    }
     subs.set(nuri, cb); // whoever held this branch is dropped, without a word
     // Initial State push, delivered async (as the real RPC does) — and only while this
     // callback still holds the branch.
@@ -58,11 +68,17 @@ function makeFakeNg(failFor: Set<string> = new Set()) {
     subs.get(nuri)?.({ V0: { Patch: { doc: nuri } } });
   };
   const isSubscribed = (nuri: string): boolean => subs.has(nuri);
-  return { doc_subscribe, push, isSubscribed, _subs: subs };
+  /** The call that was left hanging finally answers — with a refusal. */
+  const rejectHung = (): void => {
+    const reject = hung.reject;
+    hung.reject = null;
+    reject?.(new Error("RepoNotFound: late"));
+  };
+  return { doc_subscribe, push, isSubscribed, rejectHung, _subs: subs };
 }
 
-function inject(failFor?: Set<string>) {
-  const ng = makeFakeNg(failFor);
+function inject(failFor?: Set<string>, hangFor?: Set<string>) {
+  const ng = makeFakeNg(failFor, hangFor);
   configure({ ng: ng as any, useShape: (() => {}) as any });
   // Synchronous fake store → no sync lag; disable the anti-fork retry backoff.
   configureStoreRegistry({ getSession: async () => SESSION });
@@ -321,3 +337,80 @@ test("a caller that asks to be told learns its subscription could not be opened"
   expect(String(failures[0])).toContain("RepoNotFound");
   stop();
 });
+
+/**
+ * Two establishes over ONE fan-out, and the first one answering last.
+ *
+ * `resubscribeDocs` re-opens the channel of a fan-out whose first `doc_subscribe` has not
+ * settled yet — that is the whole point of it, since the session it was opened against is
+ * gone — and it re-opens it on the SAME entry so the listeners are kept. The two calls
+ * therefore race, and the broker is under no obligation to answer them in order.
+ */
+async function hangingThenReopened(): Promise<{
+  ng: ReturnType<typeof makeFakeNg>;
+  failures: unknown[];
+  seen: unknown[];
+  stop: Unsubscribe;
+}> {
+  const hangFor = new Set([A]);
+  const ng = inject(new Set(), hangFor);
+  const failures: unknown[] = [];
+  const seen: unknown[] = [];
+  const stop = subscribeDocReportingSetupFailure(
+    A,
+    (r) => seen.push(r),
+    (error) => failures.push(error),
+  );
+  // Awaited before the broker is allowed to answer: `establish` resolves the session id
+  // first, so the call this has to leave hanging has not been placed yet.
+  await tick();
+  hangFor.delete(A);
+  return { ng, failures, seen, stop };
+}
+
+test("a SUPERSEDED setup rejecting late is not reported as this document failing", async () => {
+  const { ng, failures, seen, stop } = await hangingThenReopened();
+  expect(ng.isSubscribed(A)).toBe(false); // the first call has not answered
+
+  resubscribeDocs(); // the session rotated: a second establish, on the same fan-out
+  await tick();
+  expect(ng.isSubscribed(A)).toBe(true);
+  const before = seen.length;
+  expect(before).toBeGreaterThan(0); // …and it is pushing
+
+  ng.rejectHung(); // …and only now does the first call refuse
+  await tick();
+
+  // Nothing failed: the document is subscribed and pushing. Told otherwise, the caller whose
+  // job depends on this subscription (the inbox observation) releases the entry it holds —
+  // which closes the WORKING channel and reports an inbox that is watched as unwatchable.
+  expect(failures).toEqual([]);
+  expect(ng.isSubscribed(A)).toBe(true);
+  ng.push(A);
+  expect(seen.length).toBeGreaterThan(before);
+  stop();
+});
+
+test("a SUPERSEDED setup rejecting late does not let the next joiner evict the live channel", async () => {
+  const { ng, stop } = await hangingThenReopened();
+  resubscribeDocs();
+  await tick();
+  expect(ng.doc_subscribe).toHaveBeenCalledTimes(2);
+
+  ng.rejectHung();
+  await tick();
+
+  // The second establish still stands, so this joiner must join it. Counting the late
+  // rejection as "nothing is running any more" opens a THIRD `doc_subscribe` — and a second
+  // subscribe on a branch evicts the one before it, so the joiner's own call is what silences
+  // everybody already listening.
+  const late: unknown[] = [];
+  const stopLate = subscribeDoc(A, (r) => late.push(r));
+  await tick();
+  expect(ng.doc_subscribe).toHaveBeenCalledTimes(2);
+  expect(late.length).toBeGreaterThan(0); // replayed the barrier, as any late joiner is
+  ng.push(A);
+  expect(late.length).toBeGreaterThan(1);
+  stopLate();
+  stop();
+});