From bb709bd10186f85934a78d838a9023283eb0ba08 Mon Sep 17 00:00:00 2001 From: "glm-5.3-flash" Date: Sun, 30 Aug 2026 21:22:04 +0000 Subject: [PATCH] docs(adr 070): note the self-limiting from_wss drop monitor (CON-18) Documents the CON-18 disposition in the v1 session-lifetime section (teardown handle still future work, but a dead import no longer leaves a permanent monitor task) and adds the consequence pair: dead imports self-clean after EOF + bounded grace; registrations landing past the grace window fall back to the 30s sweeper deadline. --- .../070-from-wss-consumer-adapter.md | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/docs/architecture/decisions/070-from-wss-consumer-adapter.md b/docs/architecture/decisions/070-from-wss-consumer-adapter.md index b4cb1e1..c9640a1 100644 --- a/docs/architecture/decisions/070-from-wss-consumer-adapter.md +++ b/docs/architecture/decisions/070-from-wss-consumer-adapter.md @@ -116,8 +116,14 @@ layer is done with the import. Consequences, stated explicitly: surface as live for the process lifetime. A reconnecting assembly layer should tear down its whole registry and re-import, accepting the accumulated server-side sessions until the remote times them out. -- A close/teardown handle (and with it, safe reconnect) is future work; - v1 deliberately does not build a reconnect layer (OQ-03). +- **Close/teardown handle**: future work; there is no + `WssSession::close` in v1 (OQ-03). The connection-drop monitor is + however self-limiting (review-002 CON-18): once WS read EOF is + observed, pending calls fail with retryable `CONNECTION_CLOSED`, + registrations racing the drop are drained by a fast-fail sweep + (50 ms interval) during a bounded post-EOF grace window (8 + consecutive empty drains), and the monitor task then ends — a dead + import leaves no permanent task behind. ## Consequences @@ -129,6 +135,10 @@ layer is done with the import. Consequences, stated explicitly: construction (server upgrade path + consumer path share it). - Same-protocol import means zero translation: the remote node's ops appear in the local registry with their real specs and error schemas. +- A dead import (peer gone) self-cleans: after EOF the drop monitor + fails everything pending, drains drop-racing registrations for a + bounded grace window, and ends — no per-dead-session task leak + scales with import count (review-002 CON-18). **Negative:** @@ -138,6 +148,11 @@ layer is done with the import. Consequences, stated explicitly: keepalive/timeout tuning — deployment concern, but worth documenting. - Reconnection semantics are initially minimal (OQ-03); a consumer wanting hot re-registration must wait for or build the policy. +- Registrations landing in the pending map after the bounded post-EOF + grace window elapses wait for the 30 s sweeper deadline instead of + failing fast — acceptable because registration-vs-EOF races resolve + well within the window in practice, and the mux write-failure path + covers the rest. ## References