harn-vm 0.10.161

//! Cross-process session-metadata watch via WAL + `PRAGMA data_version`.
//!
//! One thread per database path. The thread keeps its own reader so it never
//! takes the store mutex, and it only publishes when a metadata snapshot
//! moved. Local writes still go through [`super::session_change`]; the
//! fingerprint cache there drops the duplicate when this thread later sees
//! the same commit.

use std::path::{Path, PathBuf};
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::mpsc::{self, RecvTimeoutError};
use std::sync::{Arc, RwLock};
use std::thread::JoinHandle;
use std::time::Duration;

use harn_session_store::wal_watch::{
    data_version, describe_session, list_title_snapshots, open_watch_reader, wal_sidecar_path,
};
use notify::{RecursiveMode, Watcher};

const POLL: Duration = Duration::from_millis(250);

/// What wakes the watch loop out of its poll wait. The loop never inspects a
/// filesystem event: any wake means "read `data_version` now".
enum WatchSignal {
    /// Filesystem activity near the database, or a stop request.
    Wake,
    /// Test barrier: poll once, then acknowledge. The acknowledgement proves
    /// the loop read `data_version` after every commit made before the
    /// request, and published whatever that read found.
    #[cfg(test)]
    Flush(mpsc::Sender<()>),
}

impl WatchSignal {
    /// Called after the poll that followed this signal.
    fn polled(self) {
        match self {
            Self::Wake => {}
            #[cfg(test)]
            Self::Flush(ack) => {
                let _ = ack.send(());
            }
        }
    }
}

struct WatchState {
    stop: Arc<AtomicBool>,
    /// Wakes the loop out of its poll wait so a stop is observed at once.
    /// Without it, joining costs up to one whole [`POLL`] interval, and a
    /// store handle closing on a hot path would pay that every time.
    wake: mpsc::Sender<WatchSignal>,
    thread: JoinHandle<()>,
}

/// Canonical store paths with at least one open handle in this process, each
/// with the number of handles holding it.
///
/// Counted rather than a plain set, because "which stores may be watched" is a
/// lifetime question and a set has no answer to it. A path that is only ever
/// added accumulates: this process then attaches a reader, a filesystem
/// watcher and a thread to every database it has ever opened, including ones
/// whose handle is long gone. In the test binary that is also how one case
/// reaches into another's temporary directory — a subscription taken by one
/// case starts a watcher over a sibling's store and leaves `-wal` and `-shm`
/// sidecars in a directory the sibling is asserting on (harn#7960).
static REGISTERED: RwLock<Vec<(PathBuf, usize)>> = RwLock::new(Vec::new());
static WATCHERS: RwLock<Vec<(PathBuf, WatchState)>> = RwLock::new(Vec::new());

fn registered() -> std::sync::RwLockWriteGuard<'static, Vec<(PathBuf, usize)>> {
    REGISTERED
        .write()
        .unwrap_or_else(|poisoned| poisoned.into_inner())
}

fn watchers() -> std::sync::RwLockWriteGuard<'static, Vec<(PathBuf, WatchState)>> {
    WATCHERS
        .write()
        .unwrap_or_else(|poisoned| poisoned.into_inner())
}

/// One open handle's claim on watching a canonical store path.
///
/// Held by the store handle itself, so the path stays watchable for exactly as
/// long as something in this process has the store open. The last claim to
/// drop also stops the running watcher, which closes its reader before the
/// caller can observe the directory again.
#[must_use = "dropping the registration stops the path being watched"]
pub(crate) struct StoreWatchRegistration {
    /// `None` for a path that is not watchable at all, such as `:memory:`.
    path: Option<PathBuf>,
}

impl Drop for StoreWatchRegistration {
    fn drop(&mut self) {
        let Some(path) = self.path.take() else {
            return;
        };
        let released = {
            let mut paths = registered();
            match paths.iter().position(|(seen, _)| seen == &path) {
                Some(index) => {
                    paths[index].1 = paths[index].1.saturating_sub(1);
                    if paths[index].1 == 0 {
                        paths.remove(index);
                        true
                    } else {
                        false
                    }
                }
                None => false,
            }
        };
        if released {
            stop_watcher(&path);
        }
    }
}

/// Claim a canonical store path so a subscription may watch it.
pub(super) fn register_store_path(path: &Path) -> StoreWatchRegistration {
    if path == Path::new(":memory:") {
        return StoreWatchRegistration { path: None };
    }
    let path = path.to_path_buf();
    {
        let mut paths = registered();
        match paths.iter_mut().find(|(seen, _)| seen == &path) {
            Some(entry) => entry.1 += 1,
            None => paths.push((path.clone(), 1)),
        }
    }
    StoreWatchRegistration { path: Some(path) }
}

/// Start or stop watchers to match whether anyone is subscribed.
pub(super) fn sync_watchers(subscribers_live: bool) {
    if subscribers_live {
        let paths: Vec<PathBuf> = registered().iter().map(|(path, _)| path.clone()).collect();
        for path in paths {
            if !path.is_file() {
                continue;
            }
            start_watcher(path);
        }
    } else {
        let running = std::mem::take(&mut *watchers());
        for (_path, state) in running {
            stop_and_join(state);
        }
    }
}

/// Stop and join the watcher for one path, if it is running.
///
/// Joining rather than signalling and returning is the point: the reader the
/// thread owns is what creates the SQLite sidecars, so a caller that drops its
/// last handle and then reads the directory must not race the close.
fn stop_watcher(path: &Path) {
    let state = {
        let mut running = watchers();
        running
            .iter()
            .position(|(seen, _)| seen == path)
            .map(|index| running.remove(index).1)
    };
    if let Some(state) = state {
        stop_and_join(state);
    }
}

/// Signal one watcher and wait for its reader to close.
///
/// The wake is a send rather than a channel drop: the loop's own filesystem
/// callback holds the other sender, so closing this one would not disconnect
/// the receiver and the join would still wait out a poll interval.
fn stop_and_join(state: WatchState) {
    state.stop.store(true, Ordering::Relaxed);
    let _ = state.wake.send(WatchSignal::Wake);
    let _ = state.thread.join();
}

/// How many watchers are running for `path`. Test-only: the invariant this
/// module now holds is about the watcher set, so a case should assert on that
/// set rather than on the SQLite sidecars it happens to leave behind.
#[cfg(test)]
pub(super) fn watcher_count_for(path: &Path) -> usize {
    watchers().iter().filter(|(seen, _)| seen == path).count()
}

/// Block until the watcher for `path` has polled after every commit made
/// before this call, and published what that poll found. Test-only: it is
/// the positive barrier that lets a case assert a publish did *not* happen
/// without waiting out a guessed quiet period.
#[cfg(test)]
pub(super) fn flush_watcher(path: &Path) {
    let wake = watchers()
        .iter()
        .find(|(seen, _)| seen == path)
        .map(|(_, state)| state.wake.clone())
        .expect("a watcher is running for this path");
    let (ack, acked) = mpsc::channel();
    wake.send(WatchSignal::Flush(ack))
        .expect("the watch loop is running");
    harn_clock::test_support::recv_within("session WAL watcher flush", &acked);
}

/// Record every current metadata snapshot as already seen, so the first poll
/// publishes only what moves after this point.
fn seed_session_memory(path: &Path, reader: &rusqlite::Connection) {
    if let Ok(snapshots) = list_title_snapshots(reader) {
        for snapshot in snapshots {
            if let Ok(meta) = describe_session(reader, &snapshot.id) {
                super::session_change::remember_snapshot(path, &meta);
            }
        }
    }
}

fn start_watcher(path: PathBuf) {
    let mut running = watchers();
    if running.iter().any(|(seen, _)| seen == &path) {
        return;
    }
    let Ok(reader) = open_watch_reader(&path) else {
        return;
    };
    let Ok(initial_version) = data_version(&reader) else {
        return;
    };
    seed_session_memory(&path, &reader);

    let stop = Arc::new(AtomicBool::new(false));
    let thread_stop = Arc::clone(&stop);
    let thread_path = path.clone();
    let (wake, events) = mpsc::channel();
    let thread_wake = wake.clone();
    let thread = crate::runtime_stack::builder()
        .name("harn-session-wal-watch".to_string())
        .spawn(move || {
            watch_loop(
                thread_path,
                reader,
                initial_version,
                thread_stop,
                thread_wake,
                events,
            );
        })
        .expect("start session WAL watcher");
    running.push((path, WatchState { stop, wake, thread }));
}

fn watch_loop(
    path: PathBuf,
    reader: rusqlite::Connection,
    mut last_version: i64,
    stop: Arc<AtomicBool>,
    tx: mpsc::Sender<WatchSignal>,
    rx: mpsc::Receiver<WatchSignal>,
) {
    let mut watcher = match notify::recommended_watcher(move |_: notify::Result<notify::Event>| {
        let _ = tx.send(WatchSignal::Wake);
    }) {
        Ok(watcher) => watcher,
        Err(_) => return,
    };
    if let Some(parent) = path.parent() {
        let _ = watcher.watch(parent, RecursiveMode::NonRecursive);
    }
    let wal = wal_sidecar_path(&path);
    if wal.exists() {
        let _ = watcher.watch(&wal, RecursiveMode::NonRecursive);
    }

    while !stop.load(Ordering::Relaxed) {
        let signal = match rx.recv_timeout(POLL) {
            Ok(signal) => Some(signal),
            Err(RecvTimeoutError::Timeout) => None,
            Err(RecvTimeoutError::Disconnected) => break,
        };
        poll_once(&path, &reader, &mut last_version);
        if let Some(signal) = signal {
            signal.polled();
        }
    }
}

/// One watch step, with no thread or timer: read `data_version` and, when
/// another connection has committed since `last_version`, publish every
/// metadata snapshot that moved. Returns whether a new commit was observed.
///
/// `data_version` is per connection, so `last_version` is only meaningful
/// against the same `reader`.
fn poll_once(path: &Path, reader: &rusqlite::Connection, last_version: &mut i64) -> bool {
    let Ok(version) = data_version(reader) else {
        return false;
    };
    if version == *last_version {
        return false;
    }
    *last_version = version;
    publish_session_changes(path, reader);
    true
}

fn publish_session_changes(path: &Path, reader: &rusqlite::Connection) {
    let Ok(snapshots) = list_title_snapshots(reader) else {
        return;
    };
    for snapshot in snapshots {
        if let Ok(meta) = describe_session(reader, &snapshot.id) {
            // Keep the store owner's identity. SQLite can return a different
            // spelling for this same file, such as /private/var on macOS.
            super::session_change::dispatch_foreign(path, &meta);
        }
    }
}

#[cfg(test)]
mod tests {
    use std::sync::mpsc;
    use std::sync::Arc;

    use harn_clock::test_support::recv_within;
    use harn_session_store::{
        CreateSession, SessionChangeObserver, SessionMeta, SessionStore, UpdateSession,
    };
    use tempfile::TempDir;

    use crate::{open_canonical_store, subscribe_session_changes};

    struct Recording(mpsc::Sender<String>);

    impl SessionChangeObserver for Recording {
        fn session_updated(&self, meta: &SessionMeta) {
            let _ = self.0.send(meta.title.clone().unwrap_or_default());
        }
    }

    /// Detection without a thread or a clock: a foreign commit is published
    /// by exactly the next poll, and a poll with nothing new publishes
    /// nothing.
    #[tokio::test]
    async fn one_poll_publishes_a_foreign_title_commit() {
        let _bus = crate::stdlib::session_change::test_support::exclusive_bus().await;
        let root = TempDir::new().expect("root");
        let database = {
            let store = open_canonical_store(root.path()).expect("open canonical store");
            store
                .create(CreateSession {
                    id: Some("polled".to_string()),
                    title: Some("before".to_string()),
                    ..CreateSession::default()
                })
                .await
                .expect("create");
            store.path().to_path_buf()
        };

        // No handle is open, so subscribing starts no watcher for this store:
        // the only thing that can publish below is the direct poll.
        let (tx, rx) = mpsc::channel();
        let _subscription = subscribe_session_changes(Arc::new(Recording(tx)));
        assert_eq!(super::watcher_count_for(&database), 0);

        let reader =
            harn_session_store::wal_watch::open_watch_reader(&database).expect("watch reader");
        let mut last_version =
            harn_session_store::wal_watch::data_version(&reader).expect("data version");
        super::seed_session_memory(&database, &reader);
        assert!(
            !super::poll_once(&database, &reader, &mut last_version),
            "no commit since the baseline"
        );

        let foreign = rusqlite::Connection::open(&database).expect("foreign writer");
        foreign
            .execute(
                "UPDATE sessions SET title = ?1 WHERE id = ?2",
                rusqlite::params!["after", "polled"],
            )
            .expect("foreign rename");

        assert!(super::poll_once(&database, &reader, &mut last_version));
        assert_eq!(rx.try_recv().as_deref(), Ok("after"));
        assert!(!super::poll_once(&database, &reader, &mut last_version));
        assert_eq!(
            rx.try_recv(),
            Err(mpsc::TryRecvError::Empty),
            "a quiet poll publishes nothing"
        );
    }

    /// Independent database copies may carry the same session id and metadata.
    #[tokio::test]
    async fn identical_session_ids_in_distinct_databases_publish_independently() {
        let _bus = crate::stdlib::session_change::test_support::exclusive_bus().await;
        let roots = [TempDir::new().unwrap(), TempDir::new().unwrap()];
        let mut readers = Vec::new();
        for root in &roots {
            let store = open_canonical_store(root.path()).expect("canonical store");
            store
                .create(CreateSession {
                    id: Some("shared-id".into()),
                    title: Some("stable".into()),
                    ..Default::default()
                })
                .await
                .expect("create");
            let writer = rusqlite::Connection::open(store.path()).unwrap();
            writer.execute("UPDATE sessions SET created_at_ms = 1, created_at = '1970-01-01T00:00:00.001Z', updated_at_ms = 1, updated_at = '1970-01-01T00:00:00.001Z'", [])
                .expect("equal timestamps in independent databases");
            let reader =
                harn_session_store::wal_watch::open_watch_reader(store.path()).expect("reader");
            let version = harn_session_store::wal_watch::data_version(&reader).unwrap();
            readers.push((store.path().to_owned(), reader, version));
        }
        let (tx, rx) = mpsc::channel();
        let _subscription = subscribe_session_changes(Arc::new(Recording(tx)));
        assert_eq!(
            harn_session_store::wal_watch::describe_session(&readers[0].1, "shared-id").unwrap(),
            harn_session_store::wal_watch::describe_session(&readers[1].1, "shared-id").unwrap(),
            "the metadata must be identical or a full-snapshot cache can pass vacuously"
        );
        for (database, reader, _) in &readers {
            super::seed_session_memory(database, reader);
        }
        for (database, reader, version) in &mut readers {
            let foreign = rusqlite::Connection::open(&*database).expect("foreign writer");
            foreign
                .execute(
                    "UPDATE sessions SET usage_input = 7 WHERE id = 'shared-id'",
                    [],
                )
                .expect("foreign commit");
            assert!(
                super::poll_once(database, reader, version),
                "the database committed"
            );
            assert_eq!(
                rx.try_recv().as_deref(),
                Ok("stable"),
                "each database must publish its own identical metadata change"
            );
            assert!(!super::poll_once(database, reader, version));
            assert_eq!(rx.try_recv(), Err(mpsc::TryRecvError::Empty));
        }
    }

    /// A foreign metadata commit reaches the owning poll without a title change.
    #[tokio::test]
    async fn foreign_usage_change_publishes_once_when_title_is_unchanged() {
        let _bus = crate::stdlib::session_change::test_support::exclusive_bus().await;
        let root = TempDir::new().expect("root");
        let database = {
            let store = open_canonical_store(root.path()).expect("canonical store");
            store
                .create(CreateSession {
                    id: Some("foreign-usage".into()),
                    title: Some("stable".into()),
                    ..Default::default()
                })
                .await
                .expect("create");
            store.path().to_owned()
        };
        struct Metadata(mpsc::Sender<SessionMeta>);
        impl SessionChangeObserver for Metadata {
            fn session_updated(&self, meta: &SessionMeta) {
                let _ = self.0.send(meta.clone());
            }
        }
        let (tx, rx) = mpsc::channel();
        let _subscription = subscribe_session_changes(Arc::new(Metadata(tx)));
        let reader = harn_session_store::wal_watch::open_watch_reader(&database).expect("reader");
        let mut version = harn_session_store::wal_watch::data_version(&reader).expect("version");
        super::seed_session_memory(&database, &reader);
        assert_eq!(rx.try_recv(), Err(mpsc::TryRecvError::Empty));
        let foreign = rusqlite::Connection::open(&database).expect("foreign writer");
        foreign
            .execute(
                "UPDATE sessions SET usage_input = 7 WHERE id = 'foreign-usage'",
                [],
            )
            .expect("foreign metadata commit");
        assert!(super::poll_once(&database, &reader, &mut version));
        let delivered = rx.try_recv().expect("same-title foreign change delivered");
        assert_eq!(delivered.title.as_deref(), Some("stable"));
        assert_eq!(delivered.usage_input, 7);
        assert!(!super::poll_once(&database, &reader, &mut version));
        assert_eq!(rx.try_recv(), Err(mpsc::TryRecvError::Empty));
    }

    /// The same path through the real watcher thread and filesystem watcher.
    #[tokio::test]
    async fn foreign_title_write_reaches_a_subscriber_in_this_process() {
        let _bus = crate::stdlib::session_change::test_support::exclusive_bus().await;
        let root = TempDir::new().expect("root");
        let store = open_canonical_store(root.path()).expect("open canonical store");
        store
            .create(CreateSession {
                id: Some("watched".to_string()),
                title: Some("before".to_string()),
                ..CreateSession::default()
            })
            .await
            .expect("create");

        let (tx, rx) = mpsc::channel();
        let _subscription = subscribe_session_changes(Arc::new(Recording(tx)));

        // A second connection commits the way another process would: no hook.
        let foreign = rusqlite::Connection::open(store.path()).expect("foreign writer");
        foreign
            .execute(
                "UPDATE sessions SET title = ?1 WHERE id = ?2",
                rusqlite::params!["after", "watched"],
            )
            .expect("foreign rename");

        let title = recv_within("watcher publishing the foreign title", &rx);
        assert_eq!(title, "after");
    }

    /// The claim on watching a path belongs to the open handle. Before that
    /// was true, `register_store_path` only ever appended, so this count
    /// stayed at one after the drop and every later subscription reattached a
    /// reader and a thread to a database nobody had open.
    #[tokio::test]
    async fn a_closed_store_stops_being_watched() {
        let _bus = crate::stdlib::session_change::test_support::exclusive_bus().await;
        let root = TempDir::new().expect("root");
        let (tx, _rx) = mpsc::channel();
        let _subscription = subscribe_session_changes(Arc::new(Recording(tx)));

        let store = open_canonical_store(root.path()).expect("open canonical store");
        let database = store.path().to_path_buf();
        assert_eq!(
            super::watcher_count_for(&database),
            1,
            "a store held open under a live subscription is watched",
        );

        drop(store);
        assert_eq!(
            super::watcher_count_for(&database),
            0,
            "the last handle to close takes the watcher with it",
        );
    }

    #[tokio::test]
    async fn watcher_first_local_commit_publishes_once_and_preserves_other_metadata() {
        let _bus = crate::stdlib::session_change::test_support::exclusive_bus().await;
        let root = TempDir::new().expect("root");
        let store = open_canonical_store(root.path()).expect("canonical store");
        store
            .create(CreateSession {
                id: Some("watcher-first".into()),
                title: Some("before".into()),
                ..CreateSession::default()
            })
            .await
            .expect("create");
        let (tx, rx) = mpsc::channel();
        let _subscription = subscribe_session_changes(Arc::new(Recording(tx)));
        super::flush_watcher(store.path());

        struct WatcherFirst {
            path: std::path::PathBuf,
            fanout: harn_session_store::SharedSessionChangeObserver,
        }
        impl SessionChangeObserver for WatcherFirst {
            fn session_updated(&self, meta: &SessionMeta) {
                // Exercise the actual commit-to-hook window deterministically.
                // The writer has released SQLite's lock before this callback.
                super::flush_watcher(&self.path);
                self.fanout.session_updated(meta);
            }
        }
        let writer = harn_session_store::SqliteSessionStore::open_with_hooks(
            store.path(),
            harn_session_store::StoreHooks {
                change_observer: Some(Arc::new(WatcherFirst {
                    path: store.path().to_owned(),
                    fanout: crate::stdlib::session_change::current_observer(Some(store.path()))
                        .expect("live fanout"),
                })),
                ..Default::default()
            },
        )
        .expect("writer sharing canonical database");
        writer
            .update(
                "watcher-first",
                UpdateSession {
                    title: Some("after".into()),
                    ..Default::default()
                },
            )
            .await
            .expect("rename");
        assert_eq!(rx.try_recv().as_deref(), Ok("after"));
        assert_eq!(rx.try_recv(), Err(mpsc::TryRecvError::Empty));

        let updated = writer
            .update(
                "watcher-first",
                UpdateSession {
                    usage_input: Some(7),
                    ..Default::default()
                },
            )
            .await
            .expect("usage update with unchanged title");
        assert_eq!(updated.usage_input, 7);
        assert_eq!(rx.try_recv().as_deref(), Ok("after"));
        assert_eq!(rx.try_recv(), Err(mpsc::TryRecvError::Empty));
    }

    #[tokio::test]
    async fn local_update_does_not_double_publish_through_the_watcher() {
        let _bus = crate::stdlib::session_change::test_support::exclusive_bus().await;
        let root = TempDir::new().expect("root");
        #[cfg(unix)]
        let alias_parent = TempDir::new().expect("alias parent");
        #[cfg(unix)]
        let root_path = {
            let alias = alias_parent.path().join("store-root");
            std::os::unix::fs::symlink(root.path(), &alias).expect("aliased store root");
            alias
        };
        #[cfg(not(unix))]
        let root_path = root.path().to_owned();
        let (tx, rx) = mpsc::channel();
        let _subscription = subscribe_session_changes(Arc::new(Recording(tx)));
        let store = open_canonical_store(&root_path).expect("open canonical store");
        store
            .create(CreateSession {
                id: Some("local".to_string()),
                title: Some("before".to_string()),
                ..CreateSession::default()
            })
            .await
            .expect("create");
        // Make the watcher see "before" on its own. Otherwise it can fold the
        // create and the rename into one poll, meet the session first as
        // "after", and stay silent whether or not the hook deduplicates, which
        // would make the assertion below vacuous.
        super::flush_watcher(store.path());

        store
            .update(
                "local",
                UpdateSession {
                    title: Some("after".to_string()),
                    ..UpdateSession::default()
                },
            )
            .await
            .expect("local rename");

        let first = recv_within("in-process hook publishing the rename", &rx);
        assert_eq!(first, "after");
        // Wait until the watcher has polled past the rename's commit, so a
        // republish would already be on the channel, rather than hoping a
        // quiet period was long enough for it to look.
        super::flush_watcher(store.path());
        assert_eq!(
            rx.try_recv(),
            Err(mpsc::TryRecvError::Empty),
            "watcher must not republish a title the in-process hook already sent"
        );
    }
}