test(relay): cover the remaining upstream-FETCH failure and shape edges - #79
Merged
Conversation
Finishes the §9.4 stitching path started in #78, generalising its harness so one topology can drive every way an upstream can misbehave and every shape the response has to carry across the hop. Two distinct upstream timeouts, not one. Silence BEFORE the FETCH_OK expires Session.Fetch itself; silence AFTER it leaves the relay waiting on a response body stream that never arrives, having looked entirely healthy a moment earlier. They are separate branches and only the second was even reachable through the old harness. Both must degrade to unknown rather than to an authoritative gap. Both use the subscriber's own FILL_TIMEOUT (§10.2.6), which the relay adopts for the upstream leg — otherwise each case would sit out defaultUpstreamFetchTimeout for 5s. Descending order with a capped upstream FETCH_OK falls back to marking the WHOLE sub-range unknown. Ascending can append one marker for just the uncovered remainder; descending cannot, because that remainder precedes every object in stream order and a leading marker cannot be followed by a same-group object with a lower ID. Asserting the marker merely EXISTS does not test this — the ascending path emits one too. What separates them is where it is anchored, so the test pins the marker's Location: group 0 (the sub-range start) for the whole-range fallback, not the top of the range. The first version of this test checked presence only and passed with the branch deleted. The §11.4.4.1 Datagram bit survives the hop. It records the Forwarding Preference the object was PUBLISHED with, and a FETCH response reports that faithfully even though the response itself always travels on a stream. Dropping it would rewrite history for exactly the objects that came from another relay, so a subscriber comparing a stitched range against a live one would see the same object described two ways. The test also asserts the bit is NOT set on the cached subgroup objects, so it cannot pass by being sprayed everywhere. All four branches confirmed to execute against a coverage profile before being trusted — the acked-but-silent case was found precisely because the first timeout test passed while leaving its intended branch unreached — and each verified red by mutation. pkg/relay 85.6% -> 86.0%; whole-suite holds at 90.1%. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finishes the §9.4 stitching path started in #78 — items 1–3 of the remaining list. Generalises that PR's harness so one topology drives every way an upstream can misbehave, and every shape the response must carry across the hop.
What's covered
Two distinct upstream timeouts, not one. Silence before the FETCH_OK expires
Session.Fetchitself; silence after it leaves the relay waiting on a response body stream that never arrives — from an upstream that looked entirely healthy a moment earlier. Separate branches; only one was reachable through the old harness. Both must degrade to unknown, never to an authoritative gap.Descending + capped FETCH_OK falls back to whole-range unknown. Ascending can append a marker for just the uncovered remainder; descending cannot, because that remainder precedes every object in stream order and a leading marker cannot be followed by a same-group object with a lower ID.
The §11.4.4.1 Datagram bit survives the hop. It records the Forwarding Preference the object was published with, which a FETCH response must report faithfully even though the response always travels on a stream.
Two process notes worth reading
Coverage profiles, not assumptions. I checked each branch actually executes before trusting the test. That is how the acked-but-silent timeout was found at all: the first timeout test passed while leaving its intended branch unreached — it was exercising an earlier timeout on a different line.
Presence is not position. The descending test originally asserted only that an unknown marker exists, and passed with the branch deleted — because the ascending path emits a marker too. What separates the encodings is where it is anchored, so it now pins the marker's Location: group 0 for the whole-range fallback, not the top of the range. Same category of mistake as the alias-idempotency slip in #77; mutation caught both.
The Datagram test likewise asserts the bit is not set on the cached subgroup objects, so it cannot pass by the bit being sprayed onto everything.
All four behaviours verified red by mutation.
pkg/relay85.6% → 86.0%; whole-suite holds at 90.1%.Remaining
Only item 4 from the list: a shared
Connconformance suite forwtconn/quicconn, the documented gap the hermetic suite genuinely does not drive. Different shape of work — a real-transport harness rather than relay topology.🤖 Generated with Claude Code