Update actor-sqlite-test with abandonAlarm

Author: jqmmes

src/workerd/io/BUILD.bazel

@@ -426,6 +426,7 @@ kj_test(
     deps = [
         ":actor",
         ":io-gate",
+        "//src/workerd/util:autogate",
         "//src/workerd/util:test",
         "//src/workerd/util:test-util",
         "@sqlite3",

src/workerd/io/actor-sqlite-test.c++

@@ -2899,5 +2899,100 @@ KJ_TEST("explicit transaction: commit failure breaks output gate even for unconf
   KJ_EXPECT_THROW_MESSAGE("commit failed", promise.wait(test.ws));
 }
 
+KJ_TEST("ActorSqlite alarm state is stale after max counted retry failures without fix") {
+  // Regression test for STOR-3654 -- demonstrates the BUG (gate OFF).
+
+  util::Autogate::deinitAutogate();
+
+  ActorSqliteTest test;
+
+  test.setAlarm(oneMs);
+  test.pollAndExpectCalls({"scheduleRun(1ms)"})[0]->fulfill();
+  test.pollAndExpectCalls({"commit"})[0]->fulfill();
+  test.pollAndExpectCalls({});
+  KJ_ASSERT(expectSync(test.getAlarm()) == oneMs);
+
+  for (auto i = 0; i < 6 /* WorkerInterface::ALARM_RETRY_MAX_TRIES */; i++) {
+    auto armResult = test.actor.armAlarmHandler(oneMs, nullptr, testCurrentTime);
+    KJ_ASSERT(armResult.is<ActorSqlite::RunAlarmHandler>());
+    test.actor.cancelDeferredAlarmDeletion();
+    test.pollAndExpectCalls({});
+  }
+
+  // Without fix: getAlarm() still returns oneMs (alarm is still in SQLite).
+  // abandonAlarm is a no-op with gate OFF.
+  KJ_ASSERT(expectSync(test.getAlarm()) == oneMs);
+}
+
+KJ_TEST("ActorSqlite alarm cleared by abandonAlarm after max counted retry failures") {
+  // Regression test for STOR-3654 -- demonstrates the FIX (gate ON).
+
+  util::Autogate::initAutogateNamesForTest({"actor-alarm-abandoned-cleanup"_kj});
+  KJ_DEFER(util::Autogate::deinitAutogate());
+
+  ActorSqliteTest test;
+
+  test.setAlarm(oneMs);
+  test.pollAndExpectCalls({"scheduleRun(1ms)"})[0]->fulfill();
+  test.pollAndExpectCalls({"commit"})[0]->fulfill();
+  test.pollAndExpectCalls({});
+  KJ_ASSERT(expectSync(test.getAlarm()) == oneMs);
+
+  // Simulate ALARM_RETRY_MAX_TRIES (= 6) counted handler failures.
+  for (auto i = 0; i < 6 /* WorkerInterface::ALARM_RETRY_MAX_TRIES */; i++) {
+    auto armResult = test.actor.armAlarmHandler(oneMs, nullptr, testCurrentTime);
+    KJ_ASSERT(armResult.is<ActorSqlite::RunAlarmHandler>());
+    test.actor.cancelDeferredAlarmDeletion();
+    // Each failure leaves alarm in SQLite (correct for retries 1-5).
+    test.pollAndExpectCalls({});
+  }
+
+  // AlarmManager has decided to give up. It calls abandonAlarm() on the actor.
+  // With gate ON: setAlarm(null) is called -> commit -> scheduleRun(none) (move-later path).
+  test.actor.abandonAlarm(oneMs).wait(test.ws);
+  test.pollAndExpectCalls({"commit"})[0]->fulfill();
+  test.pollAndExpectCalls({"scheduleRun(none)"})[0]->fulfill();
+  test.pollAndExpectCalls({});
+
+  // getAlarm() now returns null (alarm deleted from SQLite).
+  KJ_ASSERT(expectSync(test.getAlarm()) == kj::none);
+}
+
+KJ_TEST("ActorSqlite alarm preserved after ALARM_RETRY_MAX_TRIES uncounted (internal) failures") {
+  // Regression test for STOR-3654 -- ensures the fix doesn't over-fire for internal errors.
+  //
+  // When all ALARM_RETRY_MAX_TRIES failures are uncounted (retryCountsAgainstLimit=false,
+  // i.e. infrastructure errors), AlarmManager's countedRetry never reaches the limit and
+  // abandonAlarm is NEVER called.  The alarm must remain set in SQLite throughout so that
+  // AlarmManager can keep retrying indefinitely.
+
+  util::Autogate::initAutogateNamesForTest({"actor-alarm-abandoned-cleanup"_kj});
+  KJ_DEFER(util::Autogate::deinitAutogate());
+
+  ActorSqliteTest test;
+
+  test.setAlarm(oneMs);
+  test.pollAndExpectCalls({"scheduleRun(1ms)"})[0]->fulfill();
+  test.pollAndExpectCalls({"commit"})[0]->fulfill();
+  test.pollAndExpectCalls({});
+  KJ_ASSERT(expectSync(test.getAlarm()) == oneMs);
+
+  // Simulate uncounted failures well past ALARM_RETRY_MAX_TRIES (= 6).
+  // countedRetry stays at 0; AlarmManager never gives up; abandonAlarm is never called.
+  // We've seen alarms fail hundreds of times due to infrastructure errors in production,
+  // so we check both at the boundary (6) and well beyond it (100).
+  for (auto i = 0; i < 100; i++) {
+    auto armResult = test.actor.armAlarmHandler(oneMs, nullptr, testCurrentTime);
+    KJ_ASSERT(armResult.is<ActorSqlite::RunAlarmHandler>());
+    test.actor.cancelDeferredAlarmDeletion();
+    test.pollAndExpectCalls({});
+
+    // Check at the ALARM_RETRY_MAX_TRIES boundary and at the end.
+    if (i == 5 || i == 99) {
+      KJ_ASSERT(expectSync(test.getAlarm()) == oneMs);
+    }
+  }
+}
+
 }  // namespace
 }  // namespace workerd