Move listener recovery to hosted services; fix false-logout teardown

Move auth-change listener recovery out of LexboxProjectService into a dedicated
AuthChangeListenerTrigger hosted service, so the subscription lifecycle no longer
rides on the service's IDisposable. Report connectivity from the OS network-interface
table (NetworkInterfaceNetworkStatus) rather than assuming always-online, and add
NetworkChangeSyncTrigger so web hosts re-ensure listeners when connectivity returns
(the cross-platform counterpart to MAUI's ConnectivitySyncTrigger).

StartLexboxProjectChangeListener now checks the connection cache before any auth call
and gates a new build on IsSignedIn (account presence) instead of GetCurrentToken: a
transient token-refresh failure during a reconnect could otherwise be mistaken for a
logout and tear down a healthy auto-reconnecting connection (the same false-logout trap
HandleReconnecting already avoids). Adds a regression test.

Bumps harmony for the DataModel.Add concurrency fix (adds IChange.commitId).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: myieye

backend/.editorconfig

@@ -96,7 +96,7 @@ csharp_style_deconstructed_variable_declaration = true:suggestion
 csharp_prefer_simple_default_expression = true:suggestion
 csharp_style_prefer_local_over_anonymous_function = true:suggestion
 csharp_style_inlined_variable_declaration = true:suggestion
-# Remove unnecessary using directives 
+# Remove unnecessary using directives
 dotnet_diagnostic.IDE0005.severity = warning
 ###############################
 # C# Formatting Rules         #
@@ -134,6 +134,11 @@ dotnet_diagnostic.VSTHRD200.severity = none
 # "Expression value is never used"
 dotnet_diagnostic.IDE0058.severity = suggestion
 
+# IDE0061: Use block body for local function
+dotnet_diagnostic.IDE0061.severity = silent
+# IDE0022: Use block body for method
+dotnet_diagnostic.IDE0022.severity = silent
+
 [{*Kernel}.cs]
 dotnet_diagnostic.IDE0058.severity = none
 
@@ -146,4 +151,4 @@ indent_size = unset
 indent_style = unset
 insert_final_newline = false
 tab_width = unset
-trim_trailing_whitespace = false
+trim_trailing_whitespace = false

backend/FwLite/FwLiteMaui/App.xaml.cs

@@ -26,7 +26,7 @@ public App(MainPage mainPage, IPreferencesService preferences, LexboxProjectServ
     protected override Window CreateWindow(IActivationState? activationState)
     {
         var window = CreateWindow(_mainPage);
-        // An OS-frozen app (e.g. Android Doze) can come back with its push listener down and no connectivity
+        // An OS-frozen app (e.g. Android Doze/Standby) can come back with its push listener down and no connectivity
         // transition to recover on; resume is when the user is watching, so recover immediately instead of
         // waiting for the periodic backstop.
         window.Resumed += (_, _) => _ = EnsureListenersAfterResume();

backend/FwLite/FwLiteMaui/Services/ConnectivitySyncTrigger.cs

@@ -4,10 +4,7 @@
 
 namespace FwLiteMaui.Services;
 
-// When the device regains internet access, a push listener that failed to start while offline (cold start)
-// won't recover on its own — there's no connection for SignalR's automatic reconnect to retry. This nudges
-// LexboxProjectService to (re)establish listeners for tracked projects when connectivity returns. Recovery
-// is idempotent: a healthy cached connection short-circuits and a logged-out server no-ops on the token check.
+// Primary use case: app started offline should start syncing if the device comes online
 public sealed class ConnectivitySyncTrigger(
     IConnectivity connectivity,
     LexboxProjectService lexboxProjectService,

backend/FwLite/FwLiteShared.Tests/Projects/LexboxProjectServiceTests.cs

@@ -1,3 +1,4 @@
+using FwLiteShared.Auth;
 using FwLiteShared.Projects;
 using Microsoft.AspNetCore.SignalR.Client;
 using Microsoft.Extensions.Caching.Memory;
@@ -10,6 +11,34 @@ public class LexboxProjectServiceTests
     private const string CacheKey = "test-cache-key";
     private readonly MemoryCache _cache = new(new MemoryCacheOptions());
 
+    [Fact]
+    public async Task StartLexboxProjectChangeListener_ReusesCachedConnection_WithoutConsultingAuth()
+    {
+        // Guards the false-logout teardown: an auth check ahead of the cache lookup tore down a healthy,
+        // auto-reconnecting connection whenever GetCurrentToken was transiently null (expired token + flaky
+        // network) while the user was still signed in. Reuse must be independent of auth — encoded here by a
+        // null clientFactory, so any auth access sneaking ahead of the cache lookup throws and fails the test.
+        var server = new LexboxServer(new Uri("https://example.test/"), "Test");
+        var cacheKey = LexboxProjectService.HubConnectionCacheKey(server);
+        await using var connection = new HubConnectionBuilder().WithUrl("http://localhost/test").Build();
+        _cache.Set(cacheKey, connection);
+        var service = new LexboxProjectService(
+            clientFactory: null!,
+            logger: NullLogger<LexboxProjectService>.Instance,
+            loggerFactory: null!,
+            httpMessageHandlerFactory: null!,
+            backgroundSyncService: null!,
+            options: null!,
+            cache: _cache,
+            networkStatus: null!);
+
+        var result = await service.StartLexboxProjectChangeListener(server, CancellationToken.None);
+
+        result.Should().BeSameAs(connection);
+        _cache.TryGetValue(cacheKey, out HubConnection? cached).Should().BeTrue("the connection must not be evicted");
+        cached.Should().BeSameAs(connection);
+    }
+
     [Fact]
     public async Task HandleReconnecting_WhenSignedIn_KeepsCacheAndDoesNotStop()
     {

backend/FwLite/FwLiteShared/FwLiteSharedKernel.cs

@@ -45,10 +45,11 @@ public static IServiceCollection AddFwLiteShared(this IServiceCollection service
         services.AddSingleton<BackgroundSyncService>();
         services.AddSingleton<IHostedService>(s => s.GetRequiredService<BackgroundSyncService>());
         services.AddSingleton<IHostedService, PushListenerRecoveryService>();
+        services.AddSingleton<IHostedService, AuthChangeListenerTrigger>();
         services.AddSingleton<UpdateChecker>();
         services.AddSingleton<IHostedService>(s => s.GetRequiredService<UpdateChecker>());
         services.TryAddSingleton<IPlatformUpdateService, CorePlatformUpdateService>();
-        services.TryAddSingleton<INetworkStatus, AlwaysOnlineNetworkStatus>();
+        services.TryAddSingleton<INetworkStatus, NetworkInterfaceNetworkStatus>();
         services.AddSingleton<UpdateService>();
         services.AddSingleton<TestingService>();
         services.AddOptions<FwLiteConfig>().BindConfiguration("FwLite");

backend/FwLite/FwLiteShared/Projects/AuthChangeListenerTrigger.cs

@@ -0,0 +1,29 @@
+using FwLiteShared.Events;
+using Microsoft.Extensions.Hosting;
+
+namespace FwLiteShared.Projects;
+
+// Re-establishes push listeners when authentication changes (sign-in restores them; sign-out evicts stale
+// connections). Auth is a host-agnostic GlobalEventBus event, so — unlike the host-specific connectivity
+// triggers — this registers once in the shared kernel and runs everywhere. HandleAuthChanged owns the
+// reaction and its own error handling; this owns only the subscription lifecycle.
+public sealed class AuthChangeListenerTrigger(
+    GlobalEventBus globalEventBus,
+    LexboxProjectService lexboxProjectService) : IHostedService
+{
+    private IDisposable? _subscription;
+
+    public Task StartAsync(CancellationToken cancellationToken)
+    {
+        _subscription = globalEventBus.OnAuthenticationChanged
+            .Subscribe(@event => _ = lexboxProjectService.HandleAuthChanged(@event.Server));
+        return Task.CompletedTask;
+    }
+
+    public Task StopAsync(CancellationToken cancellationToken)
+    {
+        _subscription?.Dispose();
+        _subscription = null;
+        return Task.CompletedTask;
+    }
+}

backend/FwLite/FwLiteShared/Projects/LexboxProjectService.cs

@@ -2,7 +2,6 @@
 using System.Net.Http.Json;
 using System.Runtime.CompilerServices;
 using FwLiteShared.Auth;
-using FwLiteShared.Events;
 using FwLiteShared.Services;
 using FwLiteShared.Sync;
 using LcmCrdt;
@@ -19,7 +18,7 @@
 
 namespace FwLiteShared.Projects;
 
-public class LexboxProjectService : IDisposable
+public class LexboxProjectService
 {
     private readonly OAuthClientFactory clientFactory;
     private readonly ILogger<LexboxProjectService> logger;
@@ -28,9 +27,7 @@ public class LexboxProjectService : IDisposable
     private readonly BackgroundSyncService backgroundSyncService;
     private readonly IOptions<AuthConfig> options;
     private readonly IMemoryCache cache;
-    private readonly GlobalEventBus globalEventBus;
     private readonly INetworkStatus networkStatus;
-    private readonly IDisposable onAuthChangedSubscription;
     // Stable record of projects we've been asked to listen for, by project id. Survives connection
     // lifetimes (unlike _reconnectProjects) so we can resubscribe after a hub-connection rebuild.
     private readonly ConcurrentDictionary<Guid, ProjectData> _trackedProjects = new();
@@ -43,7 +40,6 @@ public LexboxProjectService(
         BackgroundSyncService backgroundSyncService,
         IOptions<AuthConfig> options,
         IMemoryCache cache,
-        GlobalEventBus globalEventBus,
         INetworkStatus networkStatus)
     {
         this.clientFactory = clientFactory;
@@ -53,19 +49,14 @@ public LexboxProjectService(
         this.backgroundSyncService = backgroundSyncService;
         this.options = options;
         this.cache = cache;
-        this.globalEventBus = globalEventBus;
         this.networkStatus = networkStatus;
-        onAuthChangedSubscription = globalEventBus.OnAuthenticationChanged.Subscribe(@event =>
-        {
-            InvalidateProjectsCache(@event.Server);
-            _ = OnAuthenticationChangedAsync(@event.Server);
-        });
     }
 
-    private async Task OnAuthenticationChangedAsync(LexboxServer server)
+    public async Task HandleAuthChanged(LexboxServer server)
     {
         try
         {
+            InvalidateProjectsCache(server);
             // Tear down any cached hub connection — it may be holding stale auth, or belong to a
             // previously-signed-in identity. The next ListenForProjectChanges call will rebuild it
             // with the current token (or no-op if the user is now logged out).
@@ -135,11 +126,6 @@ private Dictionary<string, HubConnection> ConnectedServerConnections()
         return connected;
     }
 
-    public void Dispose()
-    {
-        onAuthChangedSubscription.Dispose();
-    }
-
     public LexboxServer[] Servers()
     {
         return options.Value.LexboxServers;
@@ -374,7 +360,8 @@ public async Task ListenForProjectChanges(ProjectData projectData, CancellationT
         }
     }
 
-    private static string HubConnectionCacheKey(LexboxServer server) => $"LexboxProjectChangeListener|{server.Authority.Authority}";
+    // Internal for unit tests.
+    internal static string HubConnectionCacheKey(LexboxServer server) => $"LexboxProjectChangeListener|{server.Authority.Authority}";
 
     // Only for callers with strong evidence the network just returned (connectivity regained, app resume, a
     // successful sync to this server): SignalR has no retry-now API, so stop-and-rebuild is the only way to
@@ -464,7 +451,7 @@ internal static async Task EvictAndStopIfCached(string cacheKey, IMemoryCache ca
     // fetched right now: reconnecting happens precisely when the network is flaky, and fetching a token
     // can require a refresh round-trip that fails transiently — which would be a false logout. Account
     // presence is a local-only read and only flips on a real logout. Once the user signs back in,
-    // OnAuthenticationChangedAsync rebuilds the listener.
+    // HandleAuthChanged rebuilds the listener.
     internal static async Task HandleReconnecting(
         string cacheKey,
         IMemoryCache cache,
@@ -519,20 +506,25 @@ internal class AdaptiveRetryPolicy(INetworkStatus networkStatus) : IRetryPolicy
     public async Task<HubConnection?> StartLexboxProjectChangeListener(LexboxServer server,
         CancellationToken stoppingToken)
     {
-        // A null token means logged out for this server (OAuthClient's failure classifier owns the
-        // transient-vs-logout decision — not us). Drop any stale cached connection and stand down;
-        // sign-in fires AuthenticationChangedEvent and OnAuthenticationChangedAsync rebuilds the listener.
-        if (await clientFactory.GetClient(server).GetCurrentToken() is null)
-        {
-            cache.Remove(HubConnectionCacheKey(server));
-            logger.LogWarning("Unable to create signalR client, user is not authenticated to {OriginDomain}", server.Authority);
-            return null;
-        }
+        // Reuse an existing connection without consulting auth: it may be healthily auto-reconnecting, and a
+        // transient token-refresh failure must not be mistaken for a logout and tear it down — the same
+        // false-logout trap HandleReconnecting avoids. (Removing the cache entry disposes the connection via
+        // the post-eviction callback, killing its retry loop and resubscribe set.)
         if (cache.TryGetValue(HubConnectionCacheKey(server), out HubConnection? connection) && connection is not null)
         {
             return connection;
         }
 
+        // No connection to reuse: build one only if actually signed in. Logged-out is tested by account
+        // presence (IsSignedIn) — a local-only read that flips solely on a real logout — not GetCurrentToken,
+        // which can be null transiently (expired token + flaky network) while the user is still signed in.
+        // Once the user signs back in, HandleAuthChanged rebuilds the listener.
+        if (!await clientFactory.GetClient(server).IsSignedIn())
+        {
+            logger.LogWarning("Unable to create signalR client, user is not authenticated to {OriginDomain}", server.Authority);
+            return null;
+        }
+
         // Serialize creation per server: concurrent callers would otherwise each build a connection, and the
         // cache's last-writer-wins replacement disposes the loser mid-use and discards its resubscribe set.
         var gate = ConnectionGate(server);

backend/FwLite/FwLiteShared/Services/INetworkStatus.cs

@@ -1,15 +1,10 @@
 namespace FwLiteShared.Services;
 
 /// <summary>
-/// What the device believes about its own connectivity. Hosts without a connectivity API
-/// (e.g. FwLiteWeb) use <see cref="AlwaysOnlineNetworkStatus"/>.
+/// What the device believes about its own connectivity. Hosts without a richer connectivity API
+/// (e.g. FwLiteWeb) use <see cref="NetworkInterfaceNetworkStatus"/>.
 /// </summary>
 public interface INetworkStatus
 {
     bool IsOnline { get; }
 }
-
-public class AlwaysOnlineNetworkStatus : INetworkStatus
-{
-    public bool IsOnline => true;
-}

backend/FwLite/FwLiteShared/Services/NetworkInterfaceNetworkStatus.cs

@@ -0,0 +1,15 @@
+using System.Net.NetworkInformation;
+
+namespace FwLiteShared.Services;
+
+/// <summary>
+/// Reports connectivity from the OS network-interface table via
+/// <see cref="NetworkInterface.GetIsNetworkAvailable"/>. The signal is asymmetric: <see cref="IsOnline"/>
+/// false is authoritative (no non-loopback interface is up, so the device is offline), but true only means
+/// an interface is up — not that the internet is reachable. A virtual adapter (VPN, WSL, Hyper-V) or a LAN
+/// with a dead uplink still reads as online. Suitable for hosts without a richer connectivity API.
+/// </summary>
+public class NetworkInterfaceNetworkStatus : INetworkStatus
+{
+    public bool IsOnline => NetworkInterface.GetIsNetworkAvailable();
+}

backend/FwLite/FwLiteShared/Sync/SyncService.cs

@@ -1,4 +1,3 @@
-using System.Diagnostics;
 using FwLiteShared.Auth;
 using FwLiteShared.Events;
 using FwLiteShared.Projects;