Skip to content

Commit 84abb66

Browse files
thymikeethymikee
committed
fix(remote): renew the lease while an artifact upload runs on the caller's side
A remote install uploaded the artifact from the caller before the install request was admitted, so nothing renewed the lease while the bytes moved: the daemon protects a lease while admitted work runs on it (#2509, ADR 0007), and an upload is the mirror image of that. A 449 MB APK that took 1m47s to upload against the one-minute default TTL expired the lease paying for the device it was uploading to, and the install then failed `Lease is not active` (#2946). `sendToDaemon` now brackets the upload phase with beats over the same transport the command uses. A beat names the command's lease scope, its own request id, and nothing else: the scope is what the daemon needs, and reusing the install request would send the upload's own payload once per beat. Each beat gets a fresh id because a beat that times out is canceled under its own. Only a remote daemon uploads and only a remote daemon holds a billed device, so a local command and a command that names no lease get no timer at all, and the interval starts rather than fires immediately, so an install that beats never sends no extra request. A beat that finds the lease gone ends the upload with that lease error rather than finishing bytes to a device nobody owns; a beat that fails for any other reason is reported through diagnostics and survived, since a later beat covers one lost request. ADR 0007 gains the rule this closes: what protects work that happens before admission.
1 parent 004767e commit 84abb66

3 files changed

Lines changed: 744 additions & 1 deletion

File tree

‎docs/adr/0007-remote-device-leases.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,24 @@ one minute, while a cloud WebDriver connection profile asks for ten. A single co
6767
longer than its own lease is therefore ordinary on the default and only reachable through a profile
6868
on the longer one.
6969

70+
## Client-side work that precedes admission
71+
72+
Protecting admitted work covers nothing that happens before a request is admitted. Installing an
73+
artifact uploads it from the caller while the request that will consume it has not been admitted yet,
74+
so an upload slower than the lease's inactivity window expired the lease paying for the device the
75+
bytes were going to (#2946). The caller therefore beats the lease over the ordinary transport for as
76+
long as that phase runs, naming the lease scope exactly as the command named it and no payload of its
77+
own. An install names no window, so its beats renew for the window the lease already carries; a
78+
caller that did name one keeps renewing on it. Resolving an absent window to the registry default
79+
instead — which is what a heartbeat used to do — quietly shortened every lease allocated above that
80+
default, which is the other half of why the upload could not survive.
81+
82+
A beat is a fresh request each time, never the protected request rewritten: a request identity is
83+
what a timed-out beat is canceled under, and beats must not inherit each other's cancellation. A beat
84+
that finds the lease gone ends the phase with that lease error rather than finishing the upload
85+
against a device nobody owns. A beat that fails for any other reason is reported and survived, because
86+
a later beat covers one lost request.
87+
7088
## Human control
7189

7290
Human-control holds coexist with an open remote session. They belong to `LeaseRegistry` and use

0 commit comments

Comments
 (0)