fix: reset failed admission before manual retry

Author: Maksym Shtembuliak

custom_components/eybond_local/connection/admission_transaction.py

@@ -769,6 +769,40 @@ def begin_callback_continuation(self) -> None:
         self._reset_callback_attempt()
         self._state = _STATE_CALLBACK_READY
 
+    def begin_manual_callback_continuation(self) -> None:
+        """Prepare one explicit manual callback attempt after admission failed.
+
+        The failure screen is shared by the passive-inbound verifier and the
+        selected-route callback verifier.  Those authorities end in different
+        private states, but the user's explicit ``configure manually`` action
+        has one meaning: discard every uncommitted attempt capability and start
+        a fresh callback identity transaction with the same durable PN context.
+
+        A failed passive-inbound attempt uses the existing FAILED ->
+        CALLBACK_READY transition.  A selected-route attempt may already be
+        callback-ready or may still hold an unadopted identity/recovery
+        capability; reset it through the transaction's single cleanup boundary.
+        READY is accepted only for an observed request carrying an explicit
+        callback route: this covers a route attempt that failed before its first
+        authority mutation.  Running, adopted, handed-off and closed states
+        remain fail-closed.
+        """
+
+        if self._request is None:
+            raise RuntimeError("collector_admission_request_unavailable")
+        if self._state == _STATE_FAILED:
+            self.begin_callback_continuation()
+            return
+        if self._state == _STATE_READY:
+            if type(self._request.callback_route) is not CallbackRecoveryRoute:
+                raise RuntimeError("admission_transaction_not_callback_ready")
+        elif self._state not in self._CALLBACK_RESETTABLE:
+            raise RuntimeError("admission_transaction_not_callback_ready")
+        if self._close_requested:
+            raise RuntimeError("admission_transaction_closed")
+        self._reset_callback_attempt()
+        self._state = _STATE_CALLBACK_READY
+
     def begin_observed_callback_continuation(self) -> None:
         """Start selected-route verification from one exact observed session.
 

custom_components/eybond_local/connection/recovery/verification_engine.py

@@ -823,7 +823,12 @@ async def _async_reset_phase(self) -> RecoveryVerificationOutcome | None:
             await self._close_channel()
             return self._fail(FAILURE_SESSION_UNAVAILABLE)
         except Exception as exc:
-            logger.info(
+            # This is a user-visible admission/transition failure.  Keep the
+            # exact typed management error in the normal HA log so a support
+            # package can distinguish a rejected command, wrong response,
+            # transport loss, and timeout without enabling debug logging or
+            # guessing from the generic UI reason.
+            logger.warning(
                 "Recovery verification: collector %s restart not confirmed: %s",
                 self._collector_pn,
                 exc,

custom_components/eybond_local/flows/config/admission.py

@@ -743,20 +743,11 @@ async def async_step_verify_connection_manual_callback(
         transaction = self._admission_transaction
         self._admission_task = None
         if transaction is not None:
-            if transaction.request.callback_route is not None:
-                # The automatic recovery released its failed outcome back to
-                # CALLBACK_READY. Keep the SAME transaction/identity context;
-                # the manual submit runs a full new one-trigger attempt through
-                # the shared continuation, with no PN/session hand-across.
-                self._manual_preselected_strategy = (
-                    CONNECTION_STRATEGY_CALLBACK_ON_DEMAND
-                )
-                return await self.async_step_manual()
-            # Clear the completed inbound attempt and enter the callback-ready
-            # lifecycle IN the same transaction (its inbound owner was already
-            # released and channels closed on the failure path). No hand-across,
-            # no transaction close and no owner/PN/session copy.
-            transaction.begin_callback_continuation()
+            # One transaction operation normalizes both failure origins
+            # (passive inbound and selected callback route) into a fresh manual
+            # callback attempt.  The flow never guesses the transaction's
+            # private lifecycle state and never copies its PN/session authority.
+            transaction.begin_manual_callback_continuation()
         # Only a form DEFAULT; the manual step still requires the user to
         # submit, and the transaction's callback identity/recovery path proves it.
         self._manual_preselected_strategy = CONNECTION_STRATEGY_CALLBACK_ON_DEMAND

tests/test_admission_callback_continuation.py

@@ -820,7 +820,7 @@ def test_bridge_does_not_close_the_transaction(self) -> None:
             if isinstance(sub, ast.Call) and isinstance(sub.func, ast.Attribute)
         }
         self.assertNotIn("async_close", calls)
-        self.assertIn("begin_callback_continuation", calls)
+        self.assertIn("begin_manual_callback_continuation", calls)
 
     def test_source_boundary_selects_the_transaction_continuation(self) -> None:
         methods = self._flow_methods()

tests/test_collector_admission_transaction.py

@@ -31,6 +31,7 @@
     HANDOFF_OK,
 )
 from custom_components.eybond_local.connection.recovery.verification import (
+    CallbackRecoveryRoute,
     STATE_INBOUND_VERIFIED,
     InboundRecoveryOutcome,
 )
@@ -59,6 +60,22 @@ def _request(**kw):
     return CollectorAdmissionRequest(observed_session=_observed(**kw), origin="passive_scan")
 
 
+def _route_request(**kw):
+    observed = _observed(**kw)
+    return CollectorAdmissionRequest(
+        observed_session=observed,
+        origin="scan_selected_route",
+        callback_route=CallbackRecoveryRoute(
+            bind_ip="192.0.2.10",
+            trigger_target_ip="203.0.113.10",
+            trigger_udp_port=58899,
+            advertised_ha_host="192.0.2.10",
+            advertised_ha_port=observed.listener_port,
+            listener_port=observed.listener_port,
+        ),
+    )
+
+
 def _verified_outcome(pn=FULL_PN):
     proof = InboundRecoveryProof(
         method="reboot_reconnect_no_trigger",
@@ -663,6 +680,48 @@ async def test_missing_registry_fails_before_channel_or_restart(self):
         self.assertEqual(txn.state, "failed")
         self.assertFalse(txn.holds_claim)
 
+    async def test_manual_callback_bridge_normalizes_both_failure_origins(self):
+        """The failure-menu action always opens one fresh callback lifecycle."""
+
+        # A passive-inbound failure follows the explicit FAILED transition.
+        inbound = _make(_request(), registry=_FakeRegistry())
+        inbound._outcome = InboundRecoveryOutcome(
+            failure_reason="restart_not_confirmed", collector_pn=SHORT_PN
+        )
+        inbound._state = "failed"
+        inbound.begin_manual_callback_continuation()
+        self.assertEqual(inbound.state, "callback_ready")
+        self.assertIsNone(inbound.outcome)
+
+        # A selected route can fail before the first callback authority mutates
+        # READY.  It is still a valid explicit manual continuation and must not
+        # produce admission_transaction_identity_not_runnable on form submit.
+        selected = _make(_route_request(), registry=_FakeRegistry())
+        selected.begin_manual_callback_continuation()
+        self.assertEqual(selected.state, "callback_ready")
+
+        # A held, unadopted callback capability is discarded before the manual
+        # attempt.  Exact owner cleanup remains inside the transaction.
+        held_registry = _FakeRegistry()
+        held = _make(_route_request(), registry=held_registry)
+        held._state = "identity_certified"
+        held._registry = held_registry
+        held._owner = "callback_verification:old"
+        held_registry.claims[held._owner] = S1
+        held.begin_manual_callback_continuation()
+        self.assertEqual(held.state, "callback_ready")
+        self.assertFalse(held.holds_claim)
+        self.assertEqual(held_registry.released, ["callback_verification:old"])
+
+    async def test_manual_callback_bridge_refuses_live_or_committed_authority(self):
+        for state in ("running", "identity_running", "recovery_running", "handed_off", "closed"):
+            with self.subTest(state=state):
+                txn = _make(_route_request(), registry=_FakeRegistry())
+                txn._state = state
+                with self.assertRaises(RuntimeError):
+                    txn.begin_manual_callback_continuation()
+                self.assertEqual(txn.state, state)
+
     async def test_registry_lookup_failure_is_typed_without_wire_io(self):
         reg = _LookupRaisingRegistry()
         txn = _make(_request(), registry=reg)

tests/test_config_flow.py

@@ -12295,6 +12295,74 @@ async def test_D_manual_callback_bridge_keeps_transaction_as_continuation(
             )
         )
 
+    async def test_selected_route_failure_can_enter_manual_without_unknown_error(
+        self,
+    ) -> None:
+        """Regression: route failure -> manual submit never reuses READY state."""
+
+        from custom_components.eybond_local.connection.callback_identity import (
+            CallbackIdentityOutcome,
+        )
+        from custom_components.eybond_local.connection.recovery.verification import (
+            CallbackRecoveryRoute,
+        )
+
+        flow = self._make_flow()
+        observed = ObservedCollectorSession(
+            collector_pn=self.FULL_PN,
+            identity_source="fc2_parameter_2",
+            session_id=self.OLD_SESSION,
+            listener_port=18899,
+            protocol_shape="eybond_framed",
+            peer_hint=self.PEER_IP,
+        )
+        request = CollectorAdmissionRequest(
+            observed_session=observed,
+            origin="scan_selected_route",
+            callback_route=CallbackRecoveryRoute(
+                bind_ip="192.168.1.50",
+                trigger_target_ip=self.PEER_IP,
+                trigger_udp_port=58899,
+                advertised_ha_host="192.168.1.50",
+                advertised_ha_port=18899,
+                listener_port=18899,
+            ),
+        )
+        transaction = admission_transaction_module.CollectorAdmissionTransaction(
+            request,
+            registry_provider=lambda: None,
+            listener_host="0.0.0.0",
+            hass_provider=lambda: flow.hass,
+        )
+        flow._admission_transaction = transaction
+        flow._callback_continuation = transaction
+
+        # Exact production hole: a selected route can reach its failure menu
+        # before READY changed. Choosing manual used to leave READY untouched;
+        # async_run_identity then raised into aiohttp as an unknown error.
+        manual = await flow.async_step_verify_connection_manual_callback()
+        self.assertEqual(manual["step_id"], "manual")
+        self.assertEqual(transaction.state, "callback_ready")
+
+        async def _identity(_hass, _request):
+            return CallbackIdentityOutcome(result="callback_timeout")
+
+        with patch.object(
+            admission_transaction_module,
+            "async_run_callback_identity_transaction",
+            side_effect=_identity,
+        ):
+            result = await flow.async_step_manual(
+                self._manual_input(
+                    self.PEER_IP,
+                    connection_strategy="callback_on_demand",
+                )
+            )
+
+        self.assertEqual(result["type"], "menu")
+        self.assertEqual(result["step_id"], "manual_confirm")
+        self.assertEqual(transaction.state, "callback_ready")
+
     # ---- blocker 1: weak->strong enrichment must retarget a retry onto the
     # ---- replacement full-PN session, not the stale observation.