Keep stream discovery live through credentials, cancellation and relays

Merged
VA
5d ago
+803-166

Session reconnects and moved-node RPCs now resolve credentials afresh. Native discovery reports terminal reconnect errors to TypeScript, forwards discovery cancellation into credential renewal, and validates resumed child anchors against accepted visibility through relays.

Decisions

  • Resolve credentials inside each existing bounded physical Session handshake, including retries. Immutable credential configuration is shared; tokens are not cached in the session pool.
  • Delete the N-API retry loop and its 10 ms sleep. The Streams session owns recovery; the native adapter forwards every terminal error.
  • Extend the existing Tail RPC with TailRequest.accepted = 2 and optional TailResponse.durable = 3; response field 2 stays reserved. Accepted observations do not wait for persistence. Ordinary tail calls retain their behavior. Missing accepted-observation support fails explicitly instead of inventing durability.
  • gRPC and HTTP watermarks() use that accepted observation. The held-flush regression checks direct discovery and one-hop and two-hop relay resumes before releasing the device flush.
  • Native TypeScript discovery uses requestClient(signal). The bounded cancellation model runs the real wrapper and credential reducer, substituting only the native binding; the missing-signal negative control must fail.
  • These are platform transport and visibility fixes. They add no harness service, gateway, state store, actor channel, or application message. A volume file cannot substitute for the stream's atomic accepted/durable boundary needed to validate its own resume cursor.
  • Regenerated bindings retain their documentation with the existing compact generation format, keeping the touched Stream declarations below 800 lines.
  • README changes are isolated in #677 for human approval; this PR has no README diff.

Validation

Windows maintenance gate: cargo check -p acyclic-stream -p acyclic-stream-napi --features acyclic-stream/local,acyclic-stream/http --lib --tests passed.

The conflict-only merge from main retains main's generator and regenerates the Streams bindings and descriptor. The contract assertions, compatibility digests, normalization idempotence and whitespace checks pass; runtime source is unchanged by the merge.

Focused native suites: 20 tests passed. Credential properties 0.05 s; rotating-credential TLS retry/reconnect/move 0.93 s; watermark round trip/property 0.07 s; held-flush relay regression 0.34 s; HTTP session 2.94 s; blocked-peer isolation 0.15 s; N-API 10 tests 1.59 s. The production pool Loom model and its negative control passed (2 tests, 0.03 s). TypeScript cancellation/error models passed (5 checks, including the negative control, 1.85 s). Runtime excludes builds and process startup.

The local HTTP session append-to-follow probe reported p50 51.9 µs, p99 80.3 µs, 128 measured records, one physical connection and one Session. This is a current Windows result, not a paired comparison with the earlier Linux measurements.

Live steps

  • Deploy the platform Tail adapter supporting accepted observations; older servers cannot supply a nonblocking accepted/durable cut. The request flag and response presence are part of the published Streams contract.
  • Run the checked-in watermarks cargo-fuzz target with its seed corpus under the Linux sanitizer once maintenance ends. The shrinking request/response round-trip and exact error-code property runs in the native suite now.
  • Deployed-service latency measurements remain pending service rollout. The 10k follow scenario is tracked separately in #644.

Follows #557. Propagates to #579 before #650 and #644.