[superseded by #475 — recreated on redacted branch] empty-subscription delayed close

[kriszyp]

Fixes #471

Summary

In replicateOverWS, when a connection's wire subscription went 0-length, scheduleClose fired
close(1008, ..., intentional=true) unconditionally. intentional=true makes the
NodeReplicationConnection close handler set isFinished/intentionallyUnsubscribed, emit 'finished'
(removing it from the worker connections map), and never reconnect. That finishes a connection whose
subscription emptied spuriously — notably when the harper-pro#470 self-record gate misread collapses
subscribeToNode's nodes.filter(shouldReplicateFromNode) to [] for a still-desired peer whose
database is still present — permanently stranding the peer at connected:false (the trigger half of the
live 4-node preprod wedge).

Where to look — the discriminator (revised after Codex review)

My first attempt keyed the decision on connection.nodeSubscriptions. Codex correctly flagged that as
a no-op: the wire subscription is a 1:1 .map() of connection.nodeSubscriptions, so at close time
that array is empty in BOTH the genuine and spurious cases (a repopulating subscribe() would have
cleared delayedClose before the timer fired). The only two empty-subscribe([]) sources are:

1. replicator.assignReplicationSource on database removal — the local database is gone. Terminal.
2. subscribeToNode's nodes.filter(shouldReplicateFromNode) collapsing to [] while the database is
   still present — spurious. Must stay retryable.

So the fix discriminates on database presence: shouldFinishEmptySubscriptionClose(databasePresent)
= !databasePresent, with databasePresent = getDatabases()?.[databaseName] != null read at close time.
Please sanity-check this discriminator — in particular that there is no genuine-unsubscribe path that
keeps the local database present (the unsubscribe() user path sets intentionallyUnsubscribed directly
and never reaches this delayed close, so it is unaffected). The database-absent (cleanup) behavior is
strictly unchanged from before.

Relationships (open context for the reviewer)

• Paired with replication: hdb_nodes point lookups assume sync get() but system is RocksDB (MaybePromise) — self-gate/auth read a Promise, disabling recovery #470 / PR [superseded by #474 — recreated on redacted branch] decode-resilient self-record gate #472 (the load-bearing self-record gate) — the most common producer of the
  spurious empty subscription. With replication: hdb_nodes point lookups assume sync get() but system is RocksDB (MaybePromise) — self-gate/auth read a Promise, disabling recovery #470 fixed, the filter no longer empties for still-desired peers; this
  PR is defense-in-depth against any spurious empty while the database is present.
• Sibling to harper-pro#466/replication: recover outbound subscription wedged connected:false after peer restart (#466) #467 (outbound reconnect-recovery) and Replication wedges permanently after simultaneous cluster restart (reconciler skips open-but-idle sockets) → blocks replicated deploys #420 (open-but-idle wedge).

Tests: unitTests/replication/emptySubscriptionClose.test.mjs (database-present ⇒ retryable;
database-gone ⇒ finish); proven red-without/green-with. Full replication unit suite green (181 passing).

Generated by Claude Code (Claude Opus 4.8).

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[claude]

Reviewed; no blockers found.

[kriszyp]

Superseded by #475 (recreated on a renamed, redacted branch). This PR's branch was renamed for redaction, which closed it; the equivalent open draft is #475.