Sylvain Duchesne
29 lines
2.2 KiB
Markdown
29 lines
2.2 KiB
Markdown
---
|
|
type: bug
|
|
severity: major
|
|
summary: An inbox watch that failed to open is re-opened only by a narrow set of later events, so a session whose activity does not produce one stays unwatched and never converges
|
|
opened: 2026-08-17
|
|
last_checked: 2026-08-17
|
|
---
|
|
|
|
# A lost inbox watch is never retried
|
|
|
|
While an identity is connected, every inbox it may read is watched, and a deposit is applied as it lands. When opening one of those watches **fails** — a broker hiccup at sign-in is enough — the failure is reported and the watch is dropped. It is then re-opened only by a later event, and the list of events that qualify is narrower than it looks:
|
|
|
|
- creating a document,
|
|
- opening an inbox on one,
|
|
- a `ReadCap` arriving through an inbox **still** being watched,
|
|
- the first read of a document in a public store.
|
|
|
|
**An ordinary write does not qualify.** A `sparqlUpdate` on a document the identity already owns fires none of these. So it is not only a read-only session that stays blind — it is any session whose activity stays inside what it already holds.
|
|
|
|
There is deliberately no polling: the deferred inbox processing states that as a design choice, and a timer here would be the wrong repair. What is missing is a recovery signal that does not depend on the identity performing a capability-bearing act.
|
|
|
|
**The visible consequence.** A document is shared with the affected identity while it sits connected, and nothing arrives. No error is raised, and the application sees an empty result rather than a failure — the same shape as having been given nothing at all.
|
|
|
|
**Workaround today:** a fresh `ensureIdentity()` re-enters and re-establishes the watches.
|
|
|
|
**Verifying it:** drive an identity to a state where one inbox watch fails to open, let the broker recover, deposit for that identity, and observe that nothing converges while it stays connected. A reproduction existed as a scratchpad probe during the work that found this and did not survive the session; rebuilding it from this description is the honest cost of that.
|
|
|
|
Predates the continuous-observation work — the earlier behaviour processed inboxes only at connection, so the same hiccup produced the same silence by a shorter route.
|