cameri / nostream / 42849543615

78%

main: 78%

push

github

fix(relay): read the clock at the expiry check, not before the stored read (#1108)

Closes nothing by keyword: `base` is `rewrite/main`, not the
repository's default branch. #953 is closed by hand after the merge.

A stored read could deliver an event that had already expired.
`handlers/subscribe.rs` captured `now` **once**, before the loop that
walks the stored records, and passed that value to every record's expiry
check. The per-event authorization beside it is genuinely per event —
the guard is rebuilt for each record, which is what the comment there
promises — so the clock was the only thing held across the read. With
LMDB values read lazily in batches, the gap is real work, not a
theoretical window: a record that expired while earlier records were
still streaming went to the client anyway. The TypeScript capture reads
`Date.now()` inside the predicate.

## The change

Two hunks in `crates/nostream-relay/src/handlers/subscribe.rs`, 75 lines
apart:

```
-    let now = context.now_secs();
```
before the loop, and at the check

```
-                if expiration::is_expired_event(&event, now) {
+                // The clock is asked when the record is judged, not once before the loop, so a
+                // record that expires while earlier ones are still being read is not delivered.
+                if expiration::is_expired_event(&event, context.now_secs()) {
```

The clock seam already existed (`HandlerContext.clock`), so this is a
call site moving, not a new abstraction.

## The oracle, and the two ways it could have been fake

The test drives a stored read where the **second** record's expiry falls
between the first record's frame and the second record's own check: two
stored events, a `TestClock` advanced 10 s between two fixture permits
(`gate_reads_per_item()`), no `sleep` anywhere. Red at `2c151f2a`, with
the fix present and the base production file restored:

```
running 1 test
assertion `left == right` failed at crates/nostream-relay/te... (continued)

4502 of 6342 branches covered (70.99%)

Branch coverage included in aggregate %.

9792 of 12081 relevant lines covered (81.05%)

759.02 hits per line