Issue #1883 OPFS open-deadline review

Reviewed executable commit: ad6815812e42aa093c3dd7397a948061988e2a7a.
Base: 6e151b0e57d63e2535cdf8e02518690d453214bc.
Owners: packages/browser-db-sqlite-persistence/tests/opfs-page-lifecycle-oracle.test.ts and packages/browser-db-sqlite-persistence/e2e/open-timeout.opfs.spec.ts.

Contract and evidence

An OPFS open must not wait indefinitely when another tab cannot release the database. Opening now has a 30-second default deadline, an override with 0 meaning no deadline, and an optional caller AbortSignal. A rejected pending open terminates its worker. The signal and timer cease to affect the connection after opening settles.

The fixed unit histories drive the public open function with a silent worker. They check default and overridden deadlines, caller abort, pre-abort, disabled deadline, invalid durations, one settlement, listener removal, and a late worker response. Before the production change, deadline assertions failed and the signal API was absent. With the change, the package's full unit and type suite passed: 18 files, 380 runtime tests, and no type errors.

The Chromium fixture holds the exact VFS Web Lock in one tab. The contender's public open queues on that lock, then rejects with TimeoutError. Its queued lock request disappears before the holder releases the lock. A new open then reads successfully. All four configured Chromium OPFS tests passed. A temporary mutant that omitted worker disposal on timeout left the contender's queued lock request present; the test failed at its toBe(false) assertion. The mutant was removed, and the test passed again. Changed-file ESLint, Prettier, TypeScript, and git diff --check passed.

This is a controlled lock-holder history, not a reproduction of the reported Chrome 152 CDP freeze. The fixture ran on local Chrome 153. It does not establish behavior in other browsers, for a frozen contender tab, or for every OPFSCoopSyncVFS failure. The issue's separate VFS-error-naming request remains outside this change.

ORC-001 through ORC-012

Requirement	Outcome
ORC-001: authority and limits	Pass. Issue #1883 requests a bounded open and late-open cleanup. The README states the new public option contract. The limits above and the coverage map bound the claim.
ORC-002: independent judgment	Pass. The unit expectations come from the timeout and abort contract. The browser check reads Chromium's Web Lock inventory, not the implementation's request map.
ORC-003: responsibilities	Pass. The existing lifecycle oracle states the law and fixed histories beside its controlled driver and exact settlement checks. The browser spec states its lock history, real entry point, checkpoints, and limits.
ORC-004: generated grammar	Not triggered by this change. The new histories are fixed; the pre-existing generated pagehide grammar is unchanged.
ORC-005: path and observation	Pass. Both owners invoke openBrowserWASQLiteOPFSDatabase. Unit checks observe exact errors, settlement count, worker termination, and listener ownership. The browser checks the queued native lock before and after rejection, then a successful reopen.
ORC-006: calibration	Pass. Omitting timeout disposal left the real browser's queued lock present and failed the intended assertion. The timeout unit histories were red before the production change.
ORC-007: fixed/random replay	Not triggered by this change. No new important generated property was introduced. The existing lifecycle campaigns retain their replay controls.
ORC-008: model minimality	Not triggered. The change adds no reference-model state.
ORC-009: vocabulary	Pass. Open, settlement, abort, worker disposal, and Web Lock refer to their production or browser boundaries; the fixture's state is only an observation holder.
ORC-010: failure fidelity	Pass for the bounded fixture. It releases the held lock, closes pages, and retains a primary failure as the cause of an AggregateError when cleanup also fails. The unit harness releases held responses and restores globals.
ORC-011: second formulation	Pass. The fake silent worker checks the API and resource ownership. The Chromium fixture separately checks the native queued-lock effect that the fake cannot observe.
ORC-012: review evidence	This record identifies the exact reviewed executable commit, calibration result, applicable requirements, non-applicable triggers, and remaining limits.

The bounded repair claim is: default or overridden deadline × silent-init and held-lock histories × the public browser OPFS open path × rejected open, worker disposal, and absence of a later queued lock. A signal-abort history is also covered by the controlled worker. The coverage map owns the remaining frozen-tab and browser-matrix witness gaps.

Follow-up review at b1c615868974273e1b2dfb9bd5e5e0e45b01fc9d

The external review of PR #1936 raised an untested synchronous-abort cut and a possible false failure in the Chromium lock fixture. This follow-up changes no production code. It adds an abort history to the lifecycle oracle, gives the Chromium fixture a 10-second pending-lock setup window before its 15-second open deadline, and clarifies the previously unbounded default in the changeset.

The new history aborts a real AbortSignal while reading the caller's vfsName option. This happens after the initial signal check and before the abort listener is installed. A silent init response and timeoutMs: 0 make a missed abort observable: the open would remain pending. The oracle checks the exact rejection, one worker termination, listener removal, one init request, and no second settlement after a late response. Removing the post-registration abort check caused an assertion failure at the expected settlement checkpoint ([] instead of the AbortError rejection). Restoring it made the focused test pass.

A controlled Chromium timing probe on the prior fixture queued a lock at 4.6 seconds, before its 5-second open deadline. The 4.5-second pending-lock poll had already failed, even though the open later rejected with TimeoutError. The revised fixture gives worker startup more room without changing the timeout, queued-lock disappearance, or successful-reopen assertions. Its new window reduces this timing risk; it does not establish a maximum worker startup time on every CI host. The native Chromium fixture passed with the revised deadlines. The browser package suite passed with 382 runtime tests and no type errors; changed-file ESLint, Prettier, and git diff --check passed.

Requirement	Follow-up outcome
ORC-001: authority and limits	The README's pending-open cancellation contract remains the authority. The added getter history covers a valid synchronous abort; the lock fixture remains one Chromium history.
ORC-002: independent judgment	The expected abort reason and resource release come from the public abort contract, not the production request map.
ORC-003: responsibilities	The existing lifecycle oracle retains its contract, model, fixed-history grammar, production driver, and settlement/refinement checks.
ORC-004: generated grammar	Not triggered. The generated pagehide grammar is unchanged; the new abort history is fixed.
ORC-005: path and observation	The new history calls the public opener and observes exact settlement, init reach, worker termination, and late-response behavior. The Chromium fixture still observes the native queued Web Lock and reopen.
ORC-006: calibration	Deleting the post-registration abort check failed the new oracle at the intended settlement assertion. The earlier native queued-lock disposal mutant remains recorded above.
ORC-007: fixed/random replay	Not triggered by this fixed history. Existing generated campaigns and replay controls are unchanged.
ORC-008: model minimality	Not triggered. No reference-model state changed.
ORC-009: vocabulary	Abort, open settlement, worker disposal, and queued Web Lock retain their production/browser meanings.
ORC-010: failure fidelity	The oracle's cleanup still releases held responses and restores globals. The Chromium fixture still preserves its primary failure and cleanup diagnostics.
ORC-011: second formulation	The controlled abort history and native lock fixture judge different boundaries; no new shared semantic fault requires another formulation.
ORC-012: review evidence	This addendum ties the focused mutant, suite receipts, and remaining timing limit to the exact executable commit above.