Sylvain Duchesne
2.2 KiB
type, severity, summary, opened, last_checked
| type | severity | summary | opened | last_checked |
|---|---|---|---|---|
| bug | major | An inbox watch that failed to open is re-opened only by a narrow set of later events, so a session whose activity does not produce one stays unwatched and never converges | 2026-08-17 | 2026-08-17 |
A lost inbox watch is never retried
While an identity is connected, every inbox it may read is watched, and a deposit is applied as it lands. When opening one of those watches fails — a broker hiccup at sign-in is enough — the failure is reported and the watch is dropped. It is then re-opened only by a later event, and the list of events that qualify is narrower than it looks:
- creating a document,
- opening an inbox on one,
- a
ReadCaparriving through an inbox still being watched, - the first read of a document in a public store.
An ordinary write does not qualify. A sparqlUpdate on a document the identity already owns fires none of these. So it is not only a read-only session that stays blind — it is any session whose activity stays inside what it already holds.
There is deliberately no polling: the deferred inbox processing states that as a design choice, and a timer here would be the wrong repair. What is missing is a recovery signal that does not depend on the identity performing a capability-bearing act.
The visible consequence. A document is shared with the affected identity while it sits connected, and nothing arrives. No error is raised, and the application sees an empty result rather than a failure — the same shape as having been given nothing at all.
Workaround today: a fresh ensureIdentity() re-enters and re-establishes the watches.
Verifying it: drive an identity to a state where one inbox watch fails to open, let the broker recover, deposit for that identity, and observe that nothing converges while it stays connected. A reproduction existed as a scratchpad probe during the work that found this and did not survive the session; rebuilding it from this description is the honest cost of that.
Predates the continuous-observation work — the earlier behaviour processed inboxes only at connection, so the same hiccup produced the same silence by a shorter route.