atproto-bridge / pds / test / watchdog-event-driven.test.js

// The stale-front watchdog is EVENT-INFORMED + PULL-ONLY. A firehose 'append' (a block arriving via the
// standing download) proves the front is live → the watchdog SKIPS the update({wait:true}) poll. Only on
// NO append does it nudge with a bounded pull. It NEVER destroys the connection — recovery is PeerFront's
// standing download (re-attaches direction-free on reconnect) + hyperswarm's keepalive/topic-rejoin.
// Events set the liveness floor; the timer only catches ABSENCE. This unit-drives _refreshFronts.
import test from 'brittle'
import { mkDidRouter } from './mk-did-router.js'

function mkRouter () {
  const swarm = { on () {}, off () {}, join () { return { flushed: async () => {} } }, flush () { return Promise.resolve() }, connections: [], destroy: async () => {} }
  const router = mkDidRouter(swarm, {}, { fronted: [], resolveVerifyKey: async () => null, refreshMs: 1000, refreshTimeoutMs: 100 })
  clearInterval(router._refreshTimer) // drive _refreshFronts manually
  return router
}

test('watchdog SKIPS the poll for a LIVE front (recent append) — event-informed, no false stall', async (t) => {
  const router = mkRouter()
  let updateCalled = false
  let destroyed = false
  // a poll that WOULD fail — so if the watchdog polls, it strikes; if it SKIPS, nothing happens.
  const live = {
    seq: { core: { update: () => { updateCalled = true; return Promise.reject(new Error('would fail if polled')) } } },
    _conn: { destroy: () => { destroyed = true } }
  }
  router._fronts.set('did:plc:live', new Map([['klive', live]]))
  router._lastAppend.set('did:plc:live', Date.now()) // appended just now → demonstrably live

  await router._refreshFronts()

  t.absent(updateCalled, 'live front (recent append) SKIPS the update({wait:true}) poll')
  t.absent(destroyed, 'live front connection is NOT dropped')
})

test('watchdog NUDGES a stalled front but NEVER destroys the connection (pull-only backstop)', async (t) => {
  // Post-audit contract: recovery is PeerFront's STANDING download (flips downloading:true → corestore
  // re-attaches direction-free on reconnect) + hyperswarm's own keepalive/topic-rejoin. The watchdog is a
  // pure staleness ceiling: on no-append it nudges with a bounded update({wait}) pull, and NEVER force-
  // destroys the connection (that fought hyperswarm's connection management and masked the missing download).
  const router = mkRouter()
  let updateCalls = 0
  let destroyed = false
  const stalled = {
    seq: { core: { update: () => { updateCalls++; return new Promise(() => {}) } } }, // never resolves → withTimeout fires
    _conn: { destroy: () => { destroyed = true } }
  }
  router._fronts.set('did:plc:stalled', new Map([['kstalled', stalled]]))
  router._lastAppend.set('did:plc:stalled', Date.now() - 10 * 60 * 1000) // no append for 10 min → suspect stall

  await router._refreshFronts() // nudge 1 (poll times out)
  t.is(updateCalls, 1, 'stalled front (no recent append) IS nudged with a bounded update({wait}) pull')
  t.absent(destroyed, 'connection NOT destroyed after a failed nudge')

  await router._refreshFronts() // nudge 2 — the OLD strike-limit "drop" point
  await router._refreshFronts() // nudge 3 — well past the old limit
  t.absent(destroyed, 'connection is NEVER force-destroyed — recovery is the standing download + hyperswarm reconnect')
})