The patient reconnect gives up on permanent failures (058 review) #11

2026-09-20T11:41:31Z

jschoubben commented

2026-09-20 11:41:31 +00:00

From the review: the serve-mode retry loop treated everything but a cert-pin mismatch as transient, so a refused login (revoked/mis-sealed credential) or a malformed broker URL retried forever as "not reachable yet" — the silent non-progress the fix was meant to remove, and a contradiction of its own docstring.

fatalBrokerReason now classifies pin mismatch, malformed URL, and refused login as fatal (thrown at once) and everything else (connection refused, timeout, DNS) as retryable. The pin case is a typed PinMismatchError caught by instanceof, not a prose substring a reword could silently downgrade to an infinite retry against an impostor. Added jitter so modules don't stampede a recovering broker in lockstep.

A unit test covers the classifier — the honest proof of the 058 logic, which the bed cannot give (it starts the consumer only after the broker is up). Build + tests green.

From the review: the serve-mode retry loop treated everything but a cert-pin mismatch as transient, so a refused login (revoked/mis-sealed credential) or a malformed broker URL retried forever as "not reachable yet" — the silent non-progress the fix was meant to remove, and a contradiction of its own docstring. `fatalBrokerReason` now classifies pin mismatch, malformed URL, and refused login as fatal (thrown at once) and everything else (connection refused, timeout, DNS) as retryable. The pin case is a typed `PinMismatchError` caught by `instanceof`, not a prose substring a reword could silently downgrade to an infinite retry against an impostor. Added jitter so modules don't stampede a recovering broker in lockstep. A unit test covers the classifier — the honest proof of the 058 logic, which the bed cannot give (it starts the consumer only after the broker is up). Build + tests green.

jschoubben added 1 commit 2026-09-20 11:41:31 +00:00

The patient reconnect gives up on permanent failures (issue 058 review) 5b111da4a9

The retry loop treated everything but a cert-pin mismatch as transient,
so a refused login (revoked/mis-sealed credential) or a malformed broker
URL retried for ever logging 'not reachable yet' — the silent
non-progress the fix set out to remove, and a contradiction of its own
docstring. fatalBrokerReason now classifies those three as fatal and
everything else (connection refused, timeout, DNS) as retryable, with a
unit test covering the split — the honest proof the bed cannot give,
since it only ever starts the consumer after the broker is up.

The pin case is now a typed PinMismatchError caught by instanceof, not a
prose substring a reword could silently downgrade to an infinite retry
against an impostor. Added a little jitter so modules do not stampede a
recovering broker in lockstep.

jschoubben merged commit bca504b521 into main

2026-09-20 11:41:58 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-tools#11