jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-11-01 23:11:58 +00:00

Files

npub1g8493u0xfsjrvflg4n08ezd7vec99mnwzlv0qgwpr9d7gvjwhuzqx59rhw 58f5feb289 fix(nip-rs): close pass-3 findings — projection-based observer, loadComplete ready gate, evidence retention

CRITICAL 1 (stale-stored + fetched tombstone resurrection):
Replace communityUnreadObserver's stored+fetched componentwise max join with
getProjection(). When loadComplete, projection.overrides is the sole authoritative
override source — no per-field merge with fetched registers that can resurrect
a superseded tombstone. effectiveFrontier() = max(fetched, projection) per channel.

CRITICAL 2 (register evaluated against F=0 instead of real frontier):
effectiveFrontierMap now merges projection.frontiers with fetched frontiers using
max() per channel, so isUnreadExternalEvent always evaluates against the true
committed frontier, not a zero default.

IMPORTANT 1 (isReadStateReady = initialized, not loadComplete):
Add isLoadComplete return from useReadState (manager.getProjection().loadComplete).
Wire overrideApis.isReadStateReady to isLoadComplete — null liveness after an
incomplete load is ambiguous, not known absence. readStateOverride.ts JSDoc updated.

IMPORTANT 2 (markAllChannelsRead unconditionally wipes evidence):
latestByChannelRef.delete and observedUnreadEventsByChannelRef.delete now inside the
overrideCleared branch only — refused marks preserve the channel's observed evidence.

IMPORTANT 3 (adversarial witnesses):
Four tests added:
- adversarial-1: stale live register + fetched tombstone → dark (no resurrection)
- adversarial-2: projection frontier deactivates register → dark
- adversarial-3: incomplete-load null liveness ≠ known absent → fail-closed
- adversarial-4: mark-all refusal keeps per-channel observed evidence

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-08-01 12:56:45 -04:00