Description
crates/openab-cp/src/main.rs spawns run_sweeper fire-and-forget; the JoinHandle is only used for the final abort(). If the sweeper panics, the CP keeps accepting connections and delegations while lease expiry and deadline sweeping silently stop — leases never expire, deadlines never fire, and no health/readiness endpoint exposes the failure. (#1469 round-4 F11.)
Same failure class as openab's own session-pool reaper bug fixed in #1457: a background loop whose silent death converts a maintenance function into unbounded state growth.
Steps to Reproduce
- Run
openab-cp and force a panic inside run_sweeper (e.g. via a test-only injection).
- Observe the process stays up,
/health still returns ok, registrations/delegations continue.
- Leases of disconnected agents never expire; deadline-overdue delegations never resolve.
Expected Behavior
Sweeper death is either fatal (process exits, orchestrator restarts it) or recovered (task restarted with backoff), and /health reflects sweeper liveness either way.
Description
crates/openab-cp/src/main.rsspawnsrun_sweeperfire-and-forget; theJoinHandleis only used for the finalabort(). If the sweeper panics, the CP keeps accepting connections and delegations while lease expiry and deadline sweeping silently stop — leases never expire, deadlines never fire, and no health/readiness endpoint exposes the failure. (#1469 round-4 F11.)Same failure class as openab's own session-pool reaper bug fixed in #1457: a background loop whose silent death converts a maintenance function into unbounded state growth.
Steps to Reproduce
openab-cpand force a panic insiderun_sweeper(e.g. via a test-only injection)./healthstill returns ok, registrations/delegations continue.Expected Behavior
Sweeper death is either fatal (process exits, orchestrator restarts it) or recovered (task restarted with backoff), and
/healthreflects sweeper liveness either way.