fix(services): retry malformed capability probes after the existing backoff

Rebased onto current main with review follow-ups folded in.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

src/services/boundary-probe-recovery.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createApplicationRequestServices } from './requests.js';
+test('unknown capability replies recover after backoff', async (t) => {
+  t.mock.timers.enable({ apis: ['Date'], now: 100_000 });
+  for (const first of [
+    () => Response.json({ wrong: true }),
+    () => new Response('bad', { status: 503 }),
+  ]) {
+    let probes = 0;
+    let queries = 0;
+    const services = createApplicationRequestServices({
+      boundaryProbe: { timeoutMs: 1000, retryMs: 1000 },
+      fetchImpl: async (url) => {
+        if (url.endsWith('/status'))
+          return ++probes === 1
+            ? first()
+            : Response.json({ configured: false });
+        queries++;
+        return Response.json({ elements: [] });
+      },
+    });
+    assert.deepEqual(await services.boundaries.query('fixture'), []);
+    assert.deepEqual(await services.boundaries.query('fixture'), []);
+    assert.equal(probes, 1, 'unknown reply is not re-probed inside backoff');
+    t.mock.timers.tick(1000);
+    assert.equal(
+      (await services.boundaries.query('fixture')).code,
+      'OVERPASS_NOT_CONFIGURED',
+    );
+    assert.equal(
+      (await services.boundaries.query('fixture')).code,
+      'OVERPASS_NOT_CONFIGURED',
+    );
+    assert.equal(probes, 2);
+    assert.equal(queries, 2);
+  }
+});

src/services/requests.js

@@ -66,9 +66,9 @@ export function createApplicationRequestServices({
       throw new Error(`${label} unavailable (${response.status})`);
     return response.data;
   }
-  // Learn once per page whether the server has an Overpass instance, so an
+  // Remember valid capability decisions for the page, so an
   // unconfigured server is never asked (and never answers with an error).
-  // Discovery is bounded; a failed or timed-out probe is forgotten and not
+  // Discovery is bounded; failed, malformed or timed-out probes are forgotten and not
   // retried for a short backoff, during which queries go to the server as
   // they would against an older server without the probe.
   let boundaryCapability = null;
@@ -79,10 +79,13 @@ export function createApplicationRequestServices({
     boundaryCapability = request(`${urls.boundaries}/status`, {
       signal: AbortSignal.timeout(boundaryProbe.timeoutMs),
     }).then(
-      (response) =>
-        response.ok && typeof response.data?.configured === 'boolean'
-          ? response.data.configured
-          : null, // an older server: fall back to asking per query
+      (response) => {
+        if (response.ok && typeof response.data?.configured === 'boolean')
+          return response.data.configured;
+        boundaryCapability = null;
+        boundaryProbeRetryAt = Date.now() + boundaryProbe.retryMs;
+        return null; // capability unknown: let this query ask the server
+      },
       (error) => {
         boundaryCapability = null;
         if (lifetime?.aborted) throw error;