fix(sw): do not let a busy worker's silence cancel the reload that repairs a torn page

[chaxus]

The failure

sw-silent-update.spec.ts (the @serial batch) failed once on main with a completely white page. It passed on rerun, so it is intermittent — but the trace says what happened, and it is not a test problem.

From the trace:

• Creating new editor instance appears three times, Document loaded twice. After the third boot, not one of the twelve [OO] … guard lines appears — it died before onAppReady, i.e. before any of our patch code ran.
• The test's own wait for vendorVersion === 'e2e-next' passed (the failure is on the next line, settleEditor). So the controller did change, and the new worker did answer a three-second question.
• No fourth boot ever started. The reload that repairs a page torn in half by the swap never happened, and the tab stayed blank for the full 90 s.

What cancelled the reload

shouldReloadOnControllerChange needs isNewBuild, which comes from isUnseenBuild, which opens with:

const version = await askVersion(waiting);           // 1000 ms
if (!vendorVersion || !cacheStorage) return false;   // cannot tell -- do nothing

A worker answers VERSION from its message handler, which it cannot run while it is busy — and it is busiest in precisely that moment: just activated, terminating the worker it replaced, with the page refetching a vendor tree that is not in its cache. One second of silence became "nothing new to tell you", so the page did not reload.

This file already learned that lesson once ("a worker under load does not answer within a timeout, silence got read as 'it is old'") — but on the promotion side, which was then moved to cache evidence. The controllerchange side kept asking. The asymmetry matters: there, a wrong answer costs a wasted reload; here it costs a white page with no way out but a manual reload.

The change

askVersionPatiently() — three tries of two seconds — used by isUnseenBuild. Silence still decides; it just cannot decide early.

Deliberately not:

• the judgement conditions. "Is a document open" is already documented as the wrong one, and "unsaved changes" was not the cause here: the boot that died was a fresh page load, dirty flag false.
• cache evidence. A page torn mid-boot may not have completed a single vendor request, so the incoming build has no runtime cache yet to be recognised by.

Tests

Three new cases in test/unit/sw-update.test.ts, on fake timers so they cost no wall clock: a busy worker that drops the first question is still identified as a new build; a worker that never answers still falls back to doing nothing; and the default budget is at least three seconds. The existing "does not answer" case moves to fake timers too — giving up now takes six seconds and would blow the 5 s per-test default.

Reverse-verified: with askVersion put back, exactly one case (keeps asking a worker that was too busy…) fails and the other 52 pass; restored, 53 pass. Locally: 2700 unit tests, and sw-silent-update + sw-warm E2E green.

Known gap

The CI failure was intermittent, so there is no E2E that reproduces it on demand — pinning it would need a hook to make a worker too busy to answer, which does not exist. The unit cases pin the decision logic; the white-page path itself is still guarded only by sw-silent-update.

Write-up: docs/explorations/2026-08-24-sw-version-question-timeout.md.

[cloudflare-workers-and-pages]

Deploying document with    Cloudflare Pages

Latest commit:	68a2426
Status:	✅  Deploy successful!
Preview URL:	https://d00b0333.document-7hm.pages.dev
Branch Preview URL:	https://sw-version-patience.document-7hm.pages.dev

View logs