test(authority): keep the crash worker alive until SIGKILL

The restore crash worker awaited a bare promise after its durable boundary.
A pending promise does not hold the event loop, so the child could exit 13
("unfinished top-level await") before the parent delivered SIGKILL, and the
File case then asserted null instead of a signal.

Pin the IPC channel with the same message-listener barrier the task-lease
crash worker uses, assert that SIGKILL was actually delivered, and hold the
parent 250ms past the durable message so the late-signal race stays covered.

Signed-off-by: huangruiteng <14976749+huangruiteng@users.noreply.github.com>

Author: huangruiteng

tests/control_plane_ts/authority_archive_crash.test.ts

@@ -10,6 +10,11 @@ import {SqliteAuthorityStore} from "../../loopx/control_plane/coordination/sqlit
 import {exportAuthorityArchive, restoreAuthorityArchive} from "../../loopx/control_plane/coordination/authority_archive.ts";
 import {auditAuthorityArchive} from "../../loopx/control_plane/coordination/authority_archive_audit.ts";
 
+// The worker must survive the durable boundary until this late SIGKILL. An
+// immediate signal hides a worker that already exited 13 ("unfinished
+// top-level await") because its IPC channel stopped holding the event loop.
+const crashSignalDelayMs = 250;
+
 for (const provider of ["file", "sqlite"] as const) {
   test(`${provider}: killed after checkpoint commit; reopen, resume, audit and continue CAS`, {timeout: 60000}, async () => {
     const root = await mkdtemp(join(tmpdir(), "archive-crash-"));
@@ -38,7 +43,8 @@ for (const provider of ["file", "sqlite"] as const) {
       const ended = once(worker, "exit");
       const notification = await Promise.race([boundary, ended.then(() => { throw new Error(`worker exited before crash: ${stderr}`); })]);
       assert.deepEqual(notification[0], {status: "durable", cursor: "65"});
-      worker.kill("SIGKILL");
+      await new Promise(resolve => setTimeout(resolve, crashSignalDelayMs));
+      assert.equal(worker.kill("SIGKILL"), true, "the crash worker was still alive to receive SIGKILL");
       const exit = await ended;
       assert.equal(exit[1], "SIGKILL");
       const reopened = provider === "sqlite" ? new SqliteAuthorityStore(destination, "goal", {existingOnly: true})

tests/control_plane_ts/authority_archive_restore_process.ts

@@ -5,6 +5,13 @@ import {restoreAuthorityArchive} from "../../loopx/control_plane/coordination/au
 import type {AuthorityStore} from "../../loopx/control_plane/coordination/authority_store.ts";
 const [archive, target, digest, kind, stopAt] = process.argv.slice(2);
 const store = kind === "sqlite" ? new SqliteAuthorityStore(target, "goal") : new FileAuthorityStore(target, "goal");
+// Hold the IPC channel across the durable boundary. A pending promise alone
+// leaves the event loop empty, so the child exits 13 ("unfinished top-level
+// await") before the parent can deliver SIGKILL. The message listener pins the
+// channel, the same barrier the task-lease crash worker uses.
+let resume: () => void = () => {};
+const crashBarrier = new Promise<void>(resolve => {resume = resolve;});
+process.on("message", () => resume());
 const interrupted: AuthorityStore = {
   providerKind: store.providerKind,
   storeIdentity: () => store.storeIdentity(), loadAuthority: () => store.loadAuthority(),
@@ -13,8 +20,8 @@ const interrupted: AuthorityStore = {
     const committed = await store.commitAuthority(request);
     if (committed.status === "applied" && committed.cursor === stopAt) {
       process.send!({status: "durable", cursor: committed.cursor});
-      // IPC keeps the worker alive until the parent sends SIGKILL.
-      await new Promise<never>(() => {});
+      // The parent requires the named crash boundary and signals SIGKILL here.
+      await crashBarrier;
     }
     return committed;
   },