mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-08-29 07:27:16 +00:00
Fix the retire↔reconnect oscillation: redundant-link survivor is the newest connection (#1566)
* Cohere per-link Noise auth and rebind containment into BLELinkAuthState The authenticated-link owners, the reconnect revalidation policy, and the two rebind-containment cooldowns were four loose bleQueue-owned maps whose invariants lived in call-site discipline: every teardown path had to remember to retire the proof AND close the revalidation epoch (the pair appeared seven times), and both cooldowns hand-rolled the same prune-check-record dance. BLELinkAuthState owns them as whole transitions — retireLink, retireLinks(ownedBy:), permitRebind, permitRedundantRetirement — with the ownership question (bleQueue today, engine after the option-B flip) answered in one place. No behavior change; the one call-site reordering (redundant retirement computes the survivor before the cooldown check instead of after) is outcome-equivalent since the cooldown only ever recorded when a survivor existed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Split identity-link bindings out of the physical link store BLELinkStateStore owned two different kinds of truth: what physical links exist (CB handles, connect lifecycles, characteristics, stream assemblers) and who each link belongs to (peer bindings in both roles plus the preferred-peripheral reverse map for directed sends and fanout collapse). The bindings now live on BLELinkBindings — same bleQueue ownership, whole-transition methods, direct tests for the rotation reverse-map cleanup and the preferred-link survivor repair that were previously only exercised end to end. Composed operations that need both truths (remove-with-repair, direct link state, the subscribed- central snapshot, bind-only-live-links) live on the transport as explicitly bleQueue-confined helpers. This is the structural half of the option-B boundary flip (docs/BLE-ARCHITECTURE-V3.md): ownership of the bindings can now move to the engine without touching what-links-exist. An audit of every physical clear/remove found three sites (emergency clear, both unauthorized branches) that needed explicit binding-clear pairing under the split — each now clears both. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix iOS-gated constructors and preserve containment cooldowns on reset CI caught what the macOS SwiftPM build cannot see: two #if os(iOS) sites still passed the peerID field that slice B1 removed from BLEPeripheralLinkState (willRestoreState in BLEService and armPendingBackgroundConnects in BLERadioController). Both fixed and verified with a local iOS simulator xcodebuild. Codex also caught a real regression: BLELinkAuthState.removeAll() cleared the rebind/retirement cooldown maps, which the original panic and emergency reset paths deliberately left alive. A stable CoreBluetooth UUID must not earn a fresh rebind allowance just because the session state around it was wiped. removeAll() now clears only the proofs and revalidation epochs, and BLELinkAuthStateTests pins the survival invariant along with the other auth-state transitions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Link layer slice 3: the option-B domain flip — bindings and link-auth move to the engine The identity domain (BLELinkBindings + BLELinkAuthState) is now owned by the engine queue, with a DEBUG dispatchPrecondition trapping any access from another queue. bleQueue keeps only physical link state. What changed shape: - Receive path is sans-I/O: bleQueue decodes frames and hands (packet, linkID) up through ingestDecodedPacket (panic lifecycle captured at the handoff); attributeAndHandlePacket resolves the sender binding, rejects spoofed senders, applies raw-announce binding, and records ingress on the engine. Per-link frame order is preserved end to end (both queues serial), which supersedes the old batch-local TOCTOU binding in the notification path. - The rotation rebind is one engine slot: containment checks, proof retirement, binding flip, reconnect decision, and rotated-identity retirement run straight-line; only CoreBluetooth cancels hop to bleQueue. The engine->bleQueue->engine ping-pong is gone, along with the _test_afterVerifiedDirectRebindEnqueued pause hook — the test that used it now asserts the atomicity directly (a paused engine wedged the old gate design into a three-queue deadlock). - Authenticated-send eligibility (notifyOrEnqueueIfAccepted, writeOrEnqueueIfAccepted) is checked on the engine, serialized against rebinds by construction; only physical admission (updateValue/write/backpressure) runs on bleQueue. - Teardown splits into discardPeripheralLinkPhysical (bleQueue, inline in the delegates) + retirePeripheralLinkIdentity (engine hop with survivor repair reading liveness via readLinkState). A binding can briefly outlive its physical link; liveness queries join against the physical store and the queued retirement converges the two. - Gossip delegate sends enter the engine via onEngine — safe because mesh.sync sits above the engine in the sync order (production engine code only async-dispatches into the manager). - checkPeerConnectivity rides an engine slot from the bleQueue maintenance tick. No wire changes. 1,974 tests green (parallel and serial), iOS simulator build clean, Periphery clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Link layer slice 4: deterministic multi-node mesh simulation — and the panic-announce bug it caught SimulatedMesh wires real CoreBluetooth-free BLEService engines edge-to-edge through the outbound packet tap and _test_ingestFrame (the production attribution path the B2 flip created), with per-edge synthetic link IDs and manual-scheduler time. Five multi-node tests run in ~40ms with no wall-clock waits: - announce exchange binds simulated links and connects peers - Noise sessions establish end-to-end (real crypto, both directions) - a public message relays across a line topology inside a TTL/frame budget (storm bound asserted) - an 8x duplicate flood delivers exactly once - a panic rotation rebinds the survivor's link exactly once and stays — the scenario that previously needed two phones and log archaeology Fidelity boundary (documented in the harness): no physical links, so fanout planning and backpressure are not exercised; attribution, binding, dedup, TTL, relay decisions, and sessions are the real engine code. The simulator found a real bug on its first run: the forced-announce throttle's lastSent survived a panic, so a rotation within bleForceAnnounceMinIntervalSeconds of the last announce silently swallowed the new identity's announce — leaving it invisible to the mesh until the next maintenance cycle. Today's device test only passed because the previous announce happened to be minutes old. BLEAnnounceThrottle gains reset(), called from the panic slot so the rotated identity owes no throttle debt; pinned by a unit test and the mesh rotation test. New DEBUG seams: _test_ingestFrame (production ingress attribution), _test_forceAnnounce, _test_fenceEngine. 1,980 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Link layer slice 5: name the port — BLELinkEvent, one engine entry, delegates in their own files The upward half of the link-layer port is now a type. BLELinkEvent enumerates everything the bleQueue link layer tells the engine: frameDecoded plus the four physical lifecycle transitions (peripheralLinkEnded, centralLinkEnded, allPeripheralLinksEnded, allCentralLinksEnded). Every bleQueue→engine crossing goes through emitLinkEvent into one engine consumer (handleLinkEvent) — the scattered messageQueue.async identity hops in the delegates collapse into event emission, and the engine-side retirement/bookkeeping logic now lives in one switch. The CoreBluetooth delegate extensions move to their own files as physical bookkeeping plus event emission: - BLEService+LinkLayerCentralRole.swift (CBCentralManagerDelegate + CBPeripheralDelegate) - BLEService+LinkLayerPeripheralRole.swift (CBPeripheralManagerDelegate + write accumulation) BLEService.swift drops from 7,836 to ~7,100 lines. The physical-domain members the role files share flip private→internal; the queue contract is enforced by the existing DEBUG traps and grep guards, not access control. (Two of the flips — isAppActive, logBluetoothStatus — only surfaced on the iOS build; macOS SwiftPM cannot see #if os(iOS) code. Verified with a local iOS simulator build.) The simulated mesh now drives lifecycle events through the identical enum a radio does: linkDropEventRetiresBindingAndReconnectHeals covers drop → identity retirement → last-link peer bookkeeping → re-announce heal, entirely through the port. New seam _test_resetAnnounceThrottle models elapsed wall-clock for the throttle (deliberately separate from _test_forceAnnounce so the panic-rotation test keeps its regression value: the production panic path must do its own reset). The panic test's containment re-announces reset throttles explicitly so those assertions exercise real delivered announces instead of silently throttled ones. noiseSessionEstablishesEndToEnd gains a bounded scheduler-time settle loop after a one-in-many parallel-suite flake (no wall-clock waits). Deliberately not done (recorded in docs/BLE-ARCHITECTURE-V3.md): a formal handle(event)->[Effect] system and further engine-domain file splits — both would flip the engine's private state to internal for cosmetic file counts; the effect formalization rides future feature- module extractions instead. 1,981 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Baseline logBluetoothStatus for the macOS Periphery scan Its callers are all inside #if os(iOS) (willRestoreState in both role files plus the app-state handlers), so the macOS-scheme scan sees the now-internal declaration with zero callers — the same class as the baselined candidateCount. Verified 1-USR diff; the previously private mangled variant was already baselined, which is why the pre-split scan never flagged it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix #1538: release stale bindings on rotation instead of leaving a ghost With two live links to one phone, a panic rotation healed only the link the verified announce arrived on. The second link kept its binding to the retired identity, so that dead ID stayed in the peer list — and was kept alive by the NEW identity's own traffic, since a bound link attributes non-announce frames to its bound peer. It only healed when the stale link physically dropped. The issue proposed exempting the containment rule via retiredBy[X] = Y so the second link could rebind. Two problems: the exemption's stated precondition (X removed by retireRotatedPeer) can never hold in this scenario — the retire is gated on X having no remaining links, which is false precisely because the stale link exists — and it would loosen a security rule to fix a liveness bug. Instead the rotation now RELEASES every link still bound to the rotated-away identity (unbind + retire that link's Noise proof) and retires the identity. No containment rule changes: unbinding is strictly less trusting than any binding, and it is correct under both readings of a second link bound to the retired ID — same physical device (the field case), or one link is a spoofer holding a forged binding, since a peer ID is a Noise-key fingerprint and two devices cannot both legitimately own it. Released links reconverge through the ordinary unbound-link path: the next raw direct announce binds them to whoever they actually carry. Reproduced and fixed under the slice-4 simulator, which is why this lands as tests rather than another two-phone session: - duplicateLinkPanicRotationLeavesNoGhostAndHealsBothLinks fails without the fix (ghost in both knownPeers and getConnectedPeers, duplicate link still bound to the dead ID) - replayedVerifiedAnnounceCannotStealALinkOrEvictTheVictim pins the #1401 containment rule against exactly the attack this fix had to avoid re-opening, with a positive control proving the refusal is the containment check and not duplicate suppression Harness gains connectDuplicateLinks (two links to one peer, modelled in the central role — the links we cannot cancel, and the only role whose bindings a CB-free harness can form), silence (range loss without a link event, so a packet can be captured that the far side never saw), and emittedPackets (the attacker's capture buffer). Residual, documented at the fix: an attacker who binds their own link to X by replaying X's raw announce can drive a rebind there and so evict X's registry entry; X's next announce restores it, and the per-link rebind cooldown bounds the rate. This is the same class of capability the containment already accepts, not a new one. 1,983 tests green, Periphery clean, iOS simulator build clean. Closes #1538 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix the retire↔reconnect oscillation: redundant-link survivor is the newest connection Field-observed July 31 on main: with a restored old-address link and a fresh-address duplicate to the same phone, redundant-link consolidation kept choosing the restored link as survivor (it carried the announce ingress and the binding) and cancelling the fresh one — which the radio promptly rediscovered and reconnected, because the fresh link sits on the BLE address the peer still advertises. Retire, reconnect, repeat at the retirement cooldown (~1/min) until the ingress happened to flip. Battery and airtime noise on every restore-with-duplicates. BLERedundantLinkPolicy now prefers the most recently CONNECTED candidate. Only the newest connection lives on the currently advertised address; the older-address link cannot return once cancelled, so consolidation converges on the first pass. BLEPeripheralLinkState gains lastConnectedAt (set by markConnected; nil for restored links, whose connect predates the process — exactly the 'stale address' signal). Security note: physical connect recency is a signal an announce replay cannot nominate, unlike the previous ingress-link preference — the announce anchors (ingress, then most recently bound) are demoted to tie-breakers and the fallback for all-restored links. Writability still trumps everything: a newest link mid-service-rediscovery is never kept over a writable duplicate. Containment (bound-links-only, one retirement per peer per cooldown, peer keeps a live link) unchanged. Six policy tests pin the new order, including the field scenario (restored link holding both announce anchors loses to the fresh connection) and the legacy fallback. 1,988 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Defer consolidation while the newest connection is still mid-discovery Codex P2 on #1566: a fresh duplicate that has connected but not yet finished service discovery was excluded from the writable candidate set, so the policy kept the older writable (restored) link and cancelled the freshly advertised connection — recreating the retire↔reconnect oscillation inside the discovery window. Now, when the physically newest connection is not writable yet while a writable duplicate exists, consolidation defers to a later announce instead of guessing. Also documents that RSSI is deliberately not a policy input (Chessing234's rule-pinning ask) and pins the defer window, the restored-anchor variant, the co-newest writable tie, and the all-unwritable recency path with tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: jack <jackjackbits@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
jack
GitHub
parent
5780405dce
commit
f269617004
@ -8,6 +8,12 @@ struct BLEPeripheralLinkState {
|
||||
var isConnecting: Bool
|
||||
var isConnected: Bool
|
||||
var lastConnectionAttempt: Date?
|
||||
/// When didConnect last fired for this link. Nil for links restored
|
||||
/// already-connected (their connect predates this process), which is
|
||||
/// exactly the signal redundant-link consolidation needs: a restored
|
||||
/// link lives on an old BLE address the peer no longer advertises,
|
||||
/// so it must never be kept over a freshly connected duplicate.
|
||||
var lastConnectedAt: Date? = nil
|
||||
var assembler: NotificationStreamAssembler
|
||||
}
|
||||
|
||||
@ -112,11 +118,12 @@ final class BLELinkStateStore {
|
||||
)
|
||||
}
|
||||
|
||||
func markConnected(_ peripheral: CBPeripheral) {
|
||||
func markConnected(_ peripheral: CBPeripheral, at now: Date = Date()) {
|
||||
let peripheralID = peripheral.identifier.uuidString
|
||||
if updatePeripheral(peripheralID, {
|
||||
$0.isConnecting = false
|
||||
$0.isConnected = true
|
||||
$0.lastConnectedAt = now
|
||||
}) == nil {
|
||||
setPeripheralState(
|
||||
BLEPeripheralLinkState(
|
||||
@ -125,6 +132,7 @@ final class BLELinkStateStore {
|
||||
isConnecting: false,
|
||||
isConnected: true,
|
||||
lastConnectionAttempt: nil,
|
||||
lastConnectedAt: now,
|
||||
assembler: NotificationStreamAssembler()
|
||||
),
|
||||
for: peripheralID
|
||||
|
||||
@ -21,24 +21,53 @@ enum BLERedundantLinkPolicy {
|
||||
/// A link mid-service-rediscovery (didModifyServices cleared it)
|
||||
/// must never be kept over a writable duplicate.
|
||||
let hasCharacteristic: Bool
|
||||
/// When didConnect last fired for this link in this process. Nil
|
||||
/// for restored links, whose connect predates the relaunch.
|
||||
let lastConnectedAt: Date?
|
||||
|
||||
init(uuid: String, peerID: PeerID?, isConnected: Bool, hasCharacteristic: Bool) {
|
||||
init(
|
||||
uuid: String,
|
||||
peerID: PeerID?,
|
||||
isConnected: Bool,
|
||||
hasCharacteristic: Bool,
|
||||
lastConnectedAt: Date? = nil
|
||||
) {
|
||||
self.uuid = uuid
|
||||
self.peerID = peerID
|
||||
self.isConnected = isConnected
|
||||
self.hasCharacteristic = hasCharacteristic
|
||||
self.lastConnectedAt = lastConnectedAt
|
||||
}
|
||||
}
|
||||
|
||||
/// The link to keep when a peer has several connected bound peripheral
|
||||
/// links, or nil when there is nothing to consolidate. Prefers the
|
||||
/// ingress link of the verified direct announce that triggered the check
|
||||
/// (the strongest liveness proof available), falling back to the peer's
|
||||
/// most recently bound link — but only among writable links while any
|
||||
/// exist: keeping a characteristic-less link and cancelling the writable
|
||||
/// links, or nil when there is nothing to consolidate.
|
||||
///
|
||||
/// Prefers the most recently CONNECTED candidate. Duplicates arise when
|
||||
/// the peer reappears under a fresh BLE address (privacy address
|
||||
/// rotation) while an older connection — typically state-restored —
|
||||
/// lives on: only the newest connection sits on the address the peer
|
||||
/// still advertises. Cancelling that one instead just gets it
|
||||
/// rediscovered and reconnected, a retire↔reconnect oscillation at the
|
||||
/// retirement cooldown (field-observed July 31); the older-address link
|
||||
/// cannot return once cancelled, so consolidation converges immediately.
|
||||
/// Physical connect recency is also a signal an announce replay cannot
|
||||
/// nominate, unlike the previous ingress-link preference — announce
|
||||
/// anchors (ingress, then most recently bound) now only break ties and
|
||||
/// serve links with no connect timestamp at all. Link "health" signals
|
||||
/// like RSSI are deliberately not inputs: they are transient and the
|
||||
/// stale-address link often reads stronger; connect recency is the only
|
||||
/// signal that tracks address currency.
|
||||
///
|
||||
/// The survivor must be writable while any writable candidate exists:
|
||||
/// keeping a characteristic-less link and cancelling the writable
|
||||
/// duplicate would strand outbound traffic on the central link until
|
||||
/// rediscovery finishes. When neither anchor is a viable candidate,
|
||||
/// consolidation waits for a later announce rather than guessing.
|
||||
/// rediscovery finishes. But when the physically NEWEST connection is
|
||||
/// the one that is not writable yet (service discovery still running),
|
||||
/// consolidation defers entirely — selecting an older writable link
|
||||
/// would cancel the freshly advertised connection and recreate the
|
||||
/// oscillation. When no candidate is identifiable, consolidation waits
|
||||
/// for a later announce rather than guessing.
|
||||
static func keptPeripheralUUID(
|
||||
ingressPeripheralUUID: String?,
|
||||
mostRecentlyBoundUUID: String?,
|
||||
@ -51,6 +80,42 @@ enum BLERedundantLinkPolicy {
|
||||
let writable = bound.filter(\.hasCharacteristic)
|
||||
let candidates = writable.isEmpty ? bound : writable
|
||||
|
||||
// The newest connection is still mid-service-discovery while a
|
||||
// writable (typically restored, stale-address) duplicate exists:
|
||||
// defer to a later announce instead of keeping the older link and
|
||||
// cancelling the one connection on the currently advertised address.
|
||||
if !writable.isEmpty,
|
||||
let newestBoundDate = bound.compactMap(\.lastConnectedAt).max(),
|
||||
!writable.contains(where: { $0.lastConnectedAt == newestBoundDate }) {
|
||||
return nil
|
||||
}
|
||||
|
||||
if let newestDate = candidates.compactMap(\.lastConnectedAt).max() {
|
||||
let newest = candidates.filter { $0.lastConnectedAt == newestDate }
|
||||
if newest.count == 1 {
|
||||
return newest[0].uuid
|
||||
}
|
||||
return anchoredChoice(
|
||||
among: newest,
|
||||
ingressPeripheralUUID: ingressPeripheralUUID,
|
||||
mostRecentlyBoundUUID: mostRecentlyBoundUUID
|
||||
) ?? newest.map(\.uuid).min()
|
||||
}
|
||||
|
||||
return anchoredChoice(
|
||||
among: candidates,
|
||||
ingressPeripheralUUID: ingressPeripheralUUID,
|
||||
mostRecentlyBoundUUID: mostRecentlyBoundUUID
|
||||
)
|
||||
}
|
||||
|
||||
/// The pre-timestamp anchors: the verified announce's ingress link,
|
||||
/// then the peer's most recently bound link.
|
||||
private static func anchoredChoice(
|
||||
among candidates: [PeripheralLink],
|
||||
ingressPeripheralUUID: String?,
|
||||
mostRecentlyBoundUUID: String?
|
||||
) -> String? {
|
||||
if let ingressPeripheralUUID, candidates.contains(where: { $0.uuid == ingressPeripheralUUID }) {
|
||||
return ingressPeripheralUUID
|
||||
}
|
||||
|
||||
@ -6376,7 +6376,8 @@ extension BLEService {
|
||||
store.peripheralStates.map {
|
||||
(uuid: $0.peripheral.identifier.uuidString,
|
||||
isConnected: $0.isConnected,
|
||||
hasCharacteristic: $0.characteristic != nil)
|
||||
hasCharacteristic: $0.characteristic != nil,
|
||||
lastConnectedAt: $0.lastConnectedAt)
|
||||
}
|
||||
}
|
||||
return physical.map {
|
||||
@ -6384,7 +6385,8 @@ extension BLEService {
|
||||
uuid: $0.uuid,
|
||||
peerID: linkBindings.peer(forPeripheralID: $0.uuid),
|
||||
isConnected: $0.isConnected,
|
||||
hasCharacteristic: $0.hasCharacteristic
|
||||
hasCharacteristic: $0.hasCharacteristic,
|
||||
lastConnectedAt: $0.lastConnectedAt
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@ -7,8 +7,8 @@ struct BLERedundantLinkPolicyTests {
|
||||
private let peer = PeerID(str: "1122334455667788")
|
||||
private let otherPeer = PeerID(str: "8877665544332211")
|
||||
|
||||
private func link(_ uuid: String, _ peerID: PeerID?, connected: Bool = true, writable: Bool = true) -> BLERedundantLinkPolicy.PeripheralLink {
|
||||
BLERedundantLinkPolicy.PeripheralLink(uuid: uuid, peerID: peerID, isConnected: connected, hasCharacteristic: writable)
|
||||
private func link(_ uuid: String, _ peerID: PeerID?, connected: Bool = true, writable: Bool = true, connectedAt: Date? = nil) -> BLERedundantLinkPolicy.PeripheralLink {
|
||||
BLERedundantLinkPolicy.PeripheralLink(uuid: uuid, peerID: peerID, isConnected: connected, hasCharacteristic: writable, lastConnectedAt: connectedAt)
|
||||
}
|
||||
|
||||
@Test
|
||||
@ -131,4 +131,144 @@ struct BLERedundantLinkPolicyTests {
|
||||
)
|
||||
#expect(Set(retiring) == Set(["p-stale-1", "p-stale-2"]))
|
||||
}
|
||||
|
||||
// MARK: Connect-recency preference (the July 31 retire↔reconnect fix)
|
||||
|
||||
@Test
|
||||
func newestConnectionWinsOverIngressAndBindingAnchors() {
|
||||
// Field oscillation: the restored old-address link (no connect
|
||||
// timestamp) carried the announce ingress AND the binding, so it
|
||||
// kept winning — and the cancelled fresh-address link kept getting
|
||||
// rediscovered and reconnected. Physical connect recency must beat
|
||||
// both announce anchors.
|
||||
let now = Date()
|
||||
let kept = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: "p-restored",
|
||||
mostRecentlyBoundUUID: "p-restored",
|
||||
links: [
|
||||
link("p-restored", peer),
|
||||
link("p-fresh", peer, connectedAt: now)
|
||||
],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(kept == "p-fresh")
|
||||
}
|
||||
|
||||
@Test
|
||||
func amongTimestampedLinksTheNewestWins() {
|
||||
let now = Date()
|
||||
let kept = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: "p-older",
|
||||
mostRecentlyBoundUUID: "p-older",
|
||||
links: [
|
||||
link("p-older", peer, connectedAt: now.addingTimeInterval(-30)),
|
||||
link("p-newer", peer, connectedAt: now)
|
||||
],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(kept == "p-newer")
|
||||
}
|
||||
|
||||
@Test
|
||||
func newestLinkMidDiscoveryDefersInsteadOfKeepingOlderWritable() {
|
||||
// The fresh connection hasn't finished service discovery, so it is
|
||||
// not writable yet. Keeping the older writable (restored) link now
|
||||
// would cancel the one connection on the currently advertised
|
||||
// address and recreate the oscillation — defer to a later announce.
|
||||
let now = Date()
|
||||
let kept = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: "p-writable",
|
||||
mostRecentlyBoundUUID: "p-writable",
|
||||
links: [
|
||||
link("p-writable", peer, connectedAt: now.addingTimeInterval(-30)),
|
||||
link("p-fresh-bare", peer, writable: false, connectedAt: now)
|
||||
],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(kept == nil)
|
||||
}
|
||||
|
||||
@Test
|
||||
func restoredWritableAnchorAlsoDefersToFreshUnwritableLink() {
|
||||
// Same discovery window as above, but the writable duplicate is a
|
||||
// restored link with no connect timestamp at all — the exact field
|
||||
// topology. It must not win just because the fresh link is bare.
|
||||
let kept = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: "p-restored",
|
||||
mostRecentlyBoundUUID: "p-restored",
|
||||
links: [
|
||||
link("p-restored", peer),
|
||||
link("p-fresh-bare", peer, writable: false, connectedAt: Date())
|
||||
],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(kept == nil)
|
||||
}
|
||||
|
||||
@Test
|
||||
func coNewestWritableLinkStillWinsOverBareTwin() {
|
||||
// Two links share the newest timestamp and one is writable: no
|
||||
// discovery window to wait out — the writable co-newest survives.
|
||||
let now = Date()
|
||||
let kept = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: nil,
|
||||
mostRecentlyBoundUUID: nil,
|
||||
links: [
|
||||
link("p-bare", peer, writable: false, connectedAt: now),
|
||||
link("p-writable", peer, connectedAt: now)
|
||||
],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(kept == "p-writable")
|
||||
}
|
||||
|
||||
@Test
|
||||
func allUnwritableDuplicatesConsolidateByConnectRecency() {
|
||||
// No writable link exists at all: nothing can be stranded, so the
|
||||
// newest connection consolidates immediately.
|
||||
let now = Date()
|
||||
let kept = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: "p-older",
|
||||
mostRecentlyBoundUUID: "p-older",
|
||||
links: [
|
||||
link("p-older", peer, writable: false, connectedAt: now.addingTimeInterval(-30)),
|
||||
link("p-newer", peer, writable: false, connectedAt: now)
|
||||
],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(kept == "p-newer")
|
||||
}
|
||||
|
||||
@Test
|
||||
func allRestoredLinksFallBackToAnnounceAnchors() {
|
||||
// No connect timestamps at all (every link restored): the legacy
|
||||
// ingress-then-binding preference still decides.
|
||||
let kept = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: "p-ingress",
|
||||
mostRecentlyBoundUUID: "p-bound",
|
||||
links: [link("p-ingress", peer), link("p-bound", peer)],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(kept == "p-ingress")
|
||||
}
|
||||
|
||||
@Test
|
||||
func timestampTiesBreakByAnchorsThenDeterministically() {
|
||||
let now = Date()
|
||||
let anchored = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: "p-b",
|
||||
mostRecentlyBoundUUID: nil,
|
||||
links: [link("p-a", peer, connectedAt: now), link("p-b", peer, connectedAt: now)],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(anchored == "p-b")
|
||||
|
||||
let unanchored = BLERedundantLinkPolicy.keptPeripheralUUID(
|
||||
ingressPeripheralUUID: nil,
|
||||
mostRecentlyBoundUUID: nil,
|
||||
links: [link("p-b", peer, connectedAt: now), link("p-a", peer, connectedAt: now)],
|
||||
peerID: peer
|
||||
)
|
||||
#expect(unanchored == "p-a")
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user