The seat that came back

FramioCam plans are counted in browsers. A free licence covers one, Team covers two, and the account page lists them so you can hand one back when you move to a new laptop. Press Release, the row disappears, and the next browser can connect.

That was true of the row. It was not true of the browser.

What actually happened

Releasing a device deleted the activation record on the server. Nothing told the extension. So the browser that had just been released still held its licence key and its last signed allowance — it went on showing a plan, went on exporting — and on its next validation the server recognised it as a returning install and gave it the same seat back.

The release looked done and undid itself, quietly, some minutes later. The only way to notice was to release a device, wait, and look again.

Why it looked correct

Every part of it was individually right. The button worked. The row vanished. The server freed the seat. The extension’s validation was doing exactly what it was designed to do: a browser that has been seen before keeps its place, which is the behaviour that stops a daily user being refused because they restarted Chrome.

Two correct halves, and no one had asked what happens when the halves disagree.

The fix

The page now tells the browser it was the one released. It sends the install id of the device it just freed, and the extension compares that against its own — if they match, it lets go of the key and the cached allowance.

The comparison happens inside the extension, deliberately. The web page names an id; it does not give an order. A message that said forget your key and was obeyed would let any page the extension trusts sign somebody out of a browser they were working in. An id it does not already know is an id it cannot name.

What we changed about testing, too

There were already tests for this area, and they passed throughout. They drove the selection from a page that stayed open — which is not what a browser does, because clicking into the page dismisses the popup.

The test that would have caught it closes the caller on purpose, the way Chrome does. It fails on the old code and passes on the new one, which is the only evidence that a regression test is worth keeping.

The general shape

Enforcing something on the server and saying nothing to the client is a class of bug rather than an incident. It looks like success from every angle except the one nobody checks: the state of the machine that was acted upon, a few minutes later.