fix(runtime): comms-loss grace is per connection — max(LastSuccessfulRead, connectedSince) (archreview 03/S17)

2026-08-20 09:32:24 -04:00
parent 5fd65d190e
commit a801e2aefb
4 changed files with 141 additions and 3 deletions
@@ -452,3 +452,38 @@ T8 anytime; T9 last (after T3/T5/T6/T7 merge-ready)
 ```

 Overall effort: **~0.75–1 dev-day code+unit, plus the rig session.** The one HIGH-RISK production slice (T3, which changes what every child receives at spawn) lands behind the full 25-suite `DriverHostActor` regression before any new test stacks on it, and behind T2's explicitly behaviour-preserving refactor.
+
+---
+
+## Execution notes
+
+Branch `fix/r3-03-restart-resubscribe-watchdog`, worktree
+`.claude/worktrees/agent-a5bcdd61bfba22e10`, off master `5fd65d19`. TDD throughout: every
+behaviour task's test was written first, RUN, and observed red for the predicted reason before the
+production edit landed. Red observations are recorded per task below.
+
+### T1 — 03/S17 watchdog grace (`??` → max)
+
+**RED observed (as predicted).** With the two new tests in place against unmodified
+`DriverInstanceActor`:
+
+```
+DriverInstanceActorCommsLossWatchdogTests.A_reconnected_driver_gets_a_full_grace_window_before_the_watchdog_trips_again [FAIL]
+  Failed: Expected no messages during 00:00:00.4000000, instead we received
+  <ConnectivityChanged { DriverInstanceId = stub-driver-1, Connected = False }> after 00:00:00.0496590
+Failed! - Failed: 1, Passed: 9, Total: 10
+```
+
+The re-trip landed **49.7 ms** after the reconnect — one health tick (`FastPoll` = 50 ms) — against a
+`Grace` of 1500 ms, i.e. exactly the "churn at health-tick cadence instead of the designed grace"
+the finding describes. `A_half_broken_device_is_still_declared_lost_once_the_grace_elapses` passed
+in the same run, which is what makes it the anti-vacuity control: it cannot distinguish the fix from
+the bug, so the delay assertion is the one carrying the finding.
+
+**GREEN after the one-line max at `:574`** (plus the "grace is per connection" remarks paragraph and
+the reciprocal falsification-partner xmldoc on the existing
+`A_degraded_driver_that_is_still_reading_successfully_is_left_alone`): 10/10 passed, 20 s.
+`A_reconnect_attempt_tears_the_dead_transport_down_before_re_initialising` stayed green — as the plan
+anticipated, each of its trip cycles now costs a full `FastTimeout` (250 ms) instead of one 50 ms
+tick, and its `AwaitCondition(InitializeCount >= 2, 5 s)` still has ample headroom. No budget change
+was needed.
@@ -5,7 +5,7 @@
    {
      "id": "T1",
      "subject": "Comms-loss grace is per connection: ?? -> max(LastSuccessfulRead, _connectedSinceUtc) + falsification pair (03/S17)",
-      "status": "pending",
+      "status": "done",
      "blockedBy": []
    },
    {