feat(site-runtime): ConnectionQualityChanged(Good) resets tag-subscribe backoff to the floor (Lever 1); lock in superseded-reply drop

Task 4 review fix-ups: RepeatedFailures gaps[1] lower bound 600→500 (two compounding jitter draws bottom out at 512 ms); SubscribeToDcl also clears _tagPathToAttributes and its prune is documented as defensive (PreStart is the only caller).
2026-08-28 14:50:04 -04:00
parent b6b401c879
commit ab08ecd3d3
2 changed files with 81 additions and 3 deletions
@@ -1410,7 +1410,8 @@ public class InstanceActorTests : TestKit, IDisposable

        // Expected nominal gaps: 400, 800(cap), 800(cap) — each ±20 % jitter and scheduler slack.
        Assert.InRange(gaps[0].TotalMilliseconds, 300, 560);
-        Assert.InRange(gaps[1].TotalMilliseconds, 600, 1100);
+        // gaps[1] compounds two jitter draws: 2×(2×200×0.8)×0.8 = 512 ms minimum.
+        Assert.InRange(gaps[1].TotalMilliseconds, 500, 1100);
        Assert.InRange(gaps[2].TotalMilliseconds, 600, 1100);

        // Success resets: no further request follows a confirmed subscription.
@@ -1438,4 +1439,65 @@ public class InstanceActorTests : TestKit, IDisposable
        var retry = dclProbe.ExpectMsg<SubscribeTagsRequest>(TimeSpan.FromSeconds(3));
        Assert.NotEqual(first.CorrelationId, retry.CorrelationId);
    }
+
+    // --- Lever 1 (2026-08-28): Good quality resets the backoff ---
+
+    [Fact]
+    public void ConnectionBackToGood_ResetsBackoff_AndRetriesPromptly()
+    {
+        var options = new SiteRuntimeOptions
+        {
+            TagSubscribeRetryIntervalMs = 200,
+            TagSubscribeRetryMaxIntervalMs = 5000,
+            TagSubscribeInFlightCeilingMs = 60_000,
+        };
+        var (instance, dclProbe) = CreateInstanceWithDataSourcedAttribute(options);
+
+        // Drive the interval up: 3 failures → 400, 800, 1600 (nominal).
+        var req = dclProbe.ExpectMsg<SubscribeTagsRequest>();
+        for (var i = 0; i < 3; i++)
+        {
+            instance.Tell(new SubscribeTagsResponse(req.CorrelationId, req.InstanceUniqueName,
+                false, "busy", DateTimeOffset.UtcNow), dclProbe.Ref);
+            req = dclProbe.ExpectMsg<SubscribeTagsRequest>(TimeSpan.FromSeconds(5));
+        }
+        // One more failure would nominally wait ~3.2 s. Instead the connection recovers:
+        instance.Tell(new SubscribeTagsResponse(req.CorrelationId, req.InstanceUniqueName,
+            false, "busy", DateTimeOffset.UtcNow), dclProbe.Ref);
+        instance.Tell(new ConnectionQualityChanged("conn-1", QualityCode.Good, DateTimeOffset.UtcNow));
+
+        var sw = System.Diagnostics.Stopwatch.StartNew();
+        dclProbe.ExpectMsg<SubscribeTagsRequest>(TimeSpan.FromSeconds(2));
+        Assert.True(sw.Elapsed < TimeSpan.FromMilliseconds(1000), $"retry took {sw.Elapsed} — backoff not reset");
+    }
+
+    [Fact]
+    public void LateReplyForFailedAndReissuedRequest_IsIgnored()
+    {
+        var options = new SiteRuntimeOptions
+        {
+            TagSubscribeRetryIntervalMs = 200,
+            TagSubscribeRetryMaxIntervalMs = 200,
+            // Short ceiling on purpose: the second request stays in flight (nothing ever
+            // answers it), so the in-flight guard is what re-sends. With a 60 s ceiling the
+            // guard would hold for 60 s and the test could not tell "late reply ignored"
+            // apart from "late reply wrongly cleared the slot" — both look like silence.
+            TagSubscribeInFlightCeilingMs = 500,
+        };
+        var (instance, dclProbe) = CreateInstanceWithDataSourcedAttribute(options);
+
+        var first = dclProbe.ExpectMsg<SubscribeTagsRequest>();
+        instance.Tell(new SubscribeTagsResponse(first.CorrelationId, first.InstanceUniqueName,
+            false, "busy", DateTimeOffset.UtcNow), dclProbe.Ref);
+        var second = dclProbe.ExpectMsg<SubscribeTagsRequest>(TimeSpan.FromSeconds(3));
+
+        // Duplicate/late Success for the FIRST id: already removed from the pending map → ignored,
+        // so the watchdog guarding the SECOND is untouched and still re-sends once its
+        // in-flight ceiling expires. Had the late reply been honoured it would have cancelled
+        // that watchdog and cleared the slot, and no third request would ever be sent.
+        instance.Tell(new SubscribeTagsResponse(first.CorrelationId, first.InstanceUniqueName,
+            true, null, DateTimeOffset.UtcNow), dclProbe.Ref);
+        var third = dclProbe.ExpectMsg<SubscribeTagsRequest>(TimeSpan.FromSeconds(3));
+        Assert.NotEqual(second.CorrelationId, third.CorrelationId);
+    }
 }