From 07616ac75f82425450bab7056983a8b1f604678b Mon Sep 17 00:00:00 2001 From: Duncan Date: Fri, 21 Aug 2026 19:05:15 -0400 Subject: [PATCH 1/7] fix(desktop): converge channel sections on conflict and never drop edits Channel-section sidebar state diverged between a user's devices and sometimes never self-healed. Four client-side gaps fed the divergence: - A local edit that lost whole-blob LWW was silently republished as remote content while the UI kept showing the edit. Now the manager adopts the winning remote head (writes it through to state + storage, advances the watermark) and skips publishing, unifying with the relay's OK-false conflict path as one convergence mechanism. - Edits made inside the 2s publish debounce were dropped on quit or community switch. A durable localStorage outbox persists every edit synchronously and resumes it on next mount; adopt clears the outbox so a superseded edit can never be replayed. - A skewed remote head could push the published createdAt past the relay's future-drift window and wedge all later publishes. createdAt is now clamped inside that window. - Stale-at-open state waited for a reconnect that a healthy socket never fires. A reconciliation loop periodically refetches the head (steady 60s, backoff on failure) and refreshes on window visibility. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../sidebar/lib/channelSectionsStorage.ts | 54 +++++ .../sidebar/lib/channelSectionsSync.test.mjs | 202 ++++++++++++++++-- .../sidebar/lib/channelSectionsSync.ts | 154 +++++++++++-- .../sidebar/lib/useChannelSections.ts | 85 +++++++- 4 files changed, 453 insertions(+), 42 deletions(-) diff --git a/desktop/src/features/sidebar/lib/channelSectionsStorage.ts b/desktop/src/features/sidebar/lib/channelSectionsStorage.ts index f01154751bd..f2b02bd18dd 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsStorage.ts +++ b/desktop/src/features/sidebar/lib/channelSectionsStorage.ts @@ -194,3 +194,57 @@ export function writeChannelSectionsStore( return false; } } + +const OUTBOX_KEY_PREFIX = "buzz-channel-sections-outbox.v1"; + +function outboxKey(pubkey: string, relayUrl: string): string { + return `${OUTBOX_KEY_PREFIX}:${pubkey}:${encodeURIComponent(normalizeRelayUrl(relayUrl))}`; +} + +/** + * Persist an unpublished edit so it survives quit/community-switch within the + * 2s publish debounce. Written synchronously on every edit; cleared once the + * edit is published, superseded by an adopted remote head, or found identical + * to the last published store. Resumed on next mount so a durable intent is + * never silently dropped at teardown. + */ +export function writeChannelSectionsOutbox( + pubkey: string, + store: ChannelSectionStore, + relayUrl: string, +): void { + try { + window.localStorage.setItem( + outboxKey(pubkey, relayUrl), + JSON.stringify(boundChannelSectionsStore(store)), + ); + } catch { + // Best-effort durability; the in-memory pendingStore still drives this + // session's publish even if the persisted copy could not be written. + } +} + +/** Read a persisted unpublished edit, or null when none/unparseable. */ +export function readChannelSectionsOutbox( + pubkey: string, + relayUrl: string, +): ChannelSectionStore | null { + try { + return parseRaw(window.localStorage.getItem(outboxKey(pubkey, relayUrl))); + } catch { + return null; + } +} + +/** Clear the persisted outbox (edit published, superseded, or a no-op). */ +export function clearChannelSectionsOutbox( + pubkey: string, + relayUrl: string, +): void { + try { + window.localStorage.removeItem(outboxKey(pubkey, relayUrl)); + } catch { + // Ignore — a stale outbox entry is re-evaluated (and re-cleared if + // identical to the head) on the next publish attempt. + } +} diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs index 904ac1f3f24..4a156f656f8 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs @@ -179,25 +179,28 @@ test("revert-fix: absent fetch with zero watermark seeds via bootstrap (first-sy } }); -// 4. LWW baseline: newer decryptable pre-publish event still wins after an -// undecryptable head was recorded. -// Mutation test: headBeforeFetch → this.lastRemoteCreatedAt makes comparison -// 200>200=false → local wins instead of remote → wrong content encrypted. -test("revert-fix: sections LWW — newer decryptable pre-publish event selected after undecryptable head recorded", async () => { +// 4. Adopt-winner: a newer remote head at pre-publish time supersedes the local +// edit — the manager must NOT publish, must hand the remote to the adopt +// sink, and must clear the pending/outbox so the loser can't be replayed. +// Mutation test: reverting adopt→republish makes onRemoteAdopted never fire and +// publishEvent fire instead. +test("adopt-winner: newer remote head at pre-publish adopts remote and skips publish", async () => { const REMOTE_ID = "remote-section-from-relay"; - let callCount = 0; - mock.method(relayClient, "fetchEvents", () => { - callCount++; - return Promise.resolve([ + mock.method(relayClient, "fetchEvents", () => + Promise.resolve([ { pubkey: "pk-lww", - content: callCount === 1 ? "bad-cipher" : "good-cipher", - created_at: callCount === 1 ? 100 : 200, - id: `evt-${callCount}`, + content: "good-cipher", + created_at: 200, + id: "evt-remote", }, - ]); + ]), + ); + const publishCalls = []; + mock.method(relayClient, "publishEvent", (...args) => { + publishCalls.push(args); + return Promise.resolve(); }); - mock.method(relayClient, "publishEvent", () => Promise.resolve()); const fw = makeFakeWindow(); const restore = installFakeWindow(fw); const tauri = installTauriMock( @@ -209,25 +212,178 @@ test("revert-fix: sections LWW — newer decryptable pre-publish event selected ); try { const manager = new ChannelSectionSyncManager("pk-lww", RELAY); + const adopted = []; + manager.setOnRemoteAdopted((r) => adopted.push(r)); + manager.publishSections( + makeSectionsStore([{ id: "local-s", name: "Local", order: 0 }]), + ); + // Outbox persisted synchronously on the edit. + assert.ok( + fw.localStorage.getItem( + `buzz-channel-sections-outbox.v1:pk-lww:${RELAY_KEY}`, + ) !== null, + "edit must be persisted to the durable outbox", + ); + fw._fireTimer(); + await new Promise((r) => setTimeout(r, 20)); + assert.equal( + publishCalls.length, + 0, + "must not publish when a newer remote head wins LWW", + ); + assert.equal(adopted.length, 1, "adopt sink must receive the remote"); + assert.ok( + adopted[0].store.sections.some((s) => s.id === REMOTE_ID), + "adopted store must be the remote content", + ); + assert.equal(manager.getPendingStore(), null, "pending must be cleared"); + assert.equal( + fw.localStorage.getItem( + `buzz-channel-sections-outbox.v1:pk-lww:${RELAY_KEY}`, + ), + null, + "outbox must be cleared on adopt so the loser is never replayed", + ); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// 4b. Local edit wins (no newer remote head): publishes and clears the outbox. +test("adopt-winner: local edit at/ahead of head publishes and clears outbox", async () => { + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + const publishCalls = []; + mock.method(relayClient, "publishEvent", (...args) => { + publishCalls.push(args); + return Promise.resolve(); + }); + const fw = makeFakeWindow(); + const restore = installFakeWindow(fw); + const tauri = installTauriMock("{}"); + try { + const manager = new ChannelSectionSyncManager("pk-win", RELAY); + manager.publishSections( + makeSectionsStore([{ id: "s1", name: "Work", order: 0 }]), + ); + fw._fireTimer(); + await new Promise((r) => setTimeout(r, 20)); + assert.equal(publishCalls.length, 1, "local edit must be published"); + assert.equal( + fw.localStorage.getItem( + `buzz-channel-sections-outbox.v1:pk-win:${RELAY_KEY}`, + ), + null, + "outbox must be cleared once the edit is published", + ); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// 4c. Timestamp clamp: a remote head far in the future must not make the +// published createdAt walk past the relay's ±15min window. +// Mutation test: removing the Math.min clamp lets createdAt = lastRemote+1 +// (~now+3600), which exceeds now + MAX_PUBLISH_FUTURE_SECS. +test("timestamp clamp: published createdAt stays inside the relay future window", async () => { + const nowSecs = Math.floor(Date.now() / 1000); + const farFutureHead = nowSecs + 3_600; // 1h ahead — beyond the ±15min window + let call = 0; + mock.method(relayClient, "fetchEvents", () => { + call++; + // First call: fetchRemoteSections during a manual head prime; subsequent: + // pre-publish fetch. Return the far-future undecryptable head each time so + // lastRemoteCreatedAt is pushed to farFutureHead but the store still + // publishes (local edit is what we're stamping). + return Promise.resolve([ + { + pubkey: "pk-clamp", + content: "good-cipher", + created_at: call === 1 ? farFutureHead : 0, + id: "evt-clamp", + }, + ]); + }); + let signedCreatedAt = null; + const fw = makeFakeWindow(); + const restore = installFakeWindow(fw); + const tauri = installTauriMock( + JSON.stringify({ version: 1, sections: [], assignments: {} }), + ); + mock.method(relayClient, "publishEvent", (evt) => { + signedCreatedAt = evt.created_at; + return Promise.resolve(); + }); + try { + const manager = new ChannelSectionSyncManager("pk-clamp", RELAY); + // Prime lastRemoteCreatedAt to the far-future head. await manager.fetchRemoteSections(); + manager.publishSections( + makeSectionsStore([{ id: "s1", name: "Work", order: 0 }]), + ); + // Fire debounce; pre-publish fetch returns created_at=0 so local wins. + fw._fireTimer(); + await new Promise((r) => setTimeout(r, 20)); + assert.ok(signedCreatedAt !== null, "publish must have been attempted"); assert.ok( - Number( - fw.localStorage.getItem( - `buzz-sync-watermark.v1:channel-sections:pk-lww:${RELAY_KEY}`, - ) ?? "0", - ) >= 100, + signedCreatedAt <= Math.floor(Date.now() / 1000) + 840, + `createdAt must be clamped inside the future window — got ${signedCreatedAt}`, ); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// 4d. Conflict rejection: relay OK false → refetch head and adopt it. +test("conflict rejection: OK-false conflict refetches head and adopts remote", async () => { + const REMOTE_ID = "remote-after-conflict"; + let fetchCall = 0; + mock.method(relayClient, "fetchEvents", () => { + fetchCall++; + // First fetch (pre-publish): empty → local wins and we publish. + if (fetchCall === 1) return Promise.resolve([]); + // Second fetch (post-conflict refetch): the winning remote head. + return Promise.resolve([ + { + pubkey: "pk-conflict", + content: "good-cipher", + created_at: 500, + id: "evt-winner", + }, + ]); + }); + mock.method(relayClient, "publishEvent", () => + Promise.reject(new Error("conflict: newer version exists")), + ); + const fw = makeFakeWindow(); + const restore = installFakeWindow(fw); + const tauri = installTauriMock( + JSON.stringify({ + version: 1, + sections: [{ id: REMOTE_ID, name: "Remote", order: 0 }], + assignments: {}, + }), + ); + try { + const manager = new ChannelSectionSyncManager("pk-conflict", RELAY); + const adopted = []; + manager.setOnRemoteAdopted((r) => adopted.push(r)); manager.publishSections( makeSectionsStore([{ id: "local-s", name: "Local", order: 0 }]), ); fw._fireTimer(); await new Promise((r) => setTimeout(r, 20)); - const pt = tauri.capturedPlaintext(); - assert.ok(pt !== null, "nip44EncryptToSelf must have been called"); + assert.equal(adopted.length, 1, "conflict must trigger adopt of the head"); assert.ok( - JSON.parse(pt).sections?.some((s) => s.id === REMOTE_ID), - `remote sections must win LWW merge — got: ${pt}`, + adopted[0].store.sections.some((s) => s.id === REMOTE_ID), + "adopted store must be the winning remote content", ); + assert.equal(manager.getPendingStore(), null, "pending cleared on adopt"); } finally { tauri.restore(); restore(); diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.ts b/desktop/src/features/sidebar/lib/channelSectionsSync.ts index 858b62430f3..001dd4f4a1b 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.ts +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.ts @@ -7,7 +7,9 @@ import { import type { RelayEvent } from "@/shared/api/types"; import { KIND_CHANNEL_SECTIONS } from "@/shared/constants/kinds"; import { + clearChannelSectionsOutbox, parseChannelSectionPayload, + writeChannelSectionsOutbox, type ChannelSection, type ChannelSectionStore, } from "./channelSectionsStorage"; @@ -22,12 +24,39 @@ const D_TAG = "channel-sections"; const BLOB_TYPE = D_TAG; const DEBOUNCE_MS = 2_000; +// The relay rejects events more than ±15 minutes (900s) from server time +// (`MAX_TIMESTAMP_DRIFT_SECS` in ingest.rs). Clamp our published `created_at` +// well inside that window so a skewed remote head can never make us manufacture +// an unbounded future timestamp that wedges every subsequent publish. 840s +// leaves ~60s of transit margin while still letting us win LWW against any +// legitimately-timestamped head. +const MAX_PUBLISH_FUTURE_SECS = 840; + +// Bounded backoff for a retained pending edit whose publish failed transiently +// (timeout / socket error) on an otherwise-healthy socket, so it does not wait +// for a reconnect that may never fire. +const RETRY_BASE_MS = 2_000; +const RETRY_MAX_MS = 30_000; + export type RemoteSections = { store: ChannelSectionStore; createdAt: number; eventId: string; }; +/** + * Outcome of the pre-publish head check. + * + * - `publish` — local edit is at or ahead of the head; publish it. + * - `adopt` — a newer remote head exists; the local edit lost whole-blob + * LWW and must be discarded in favour of the remote store so UI + * and relay converge (see the fix-2 design note). The manager + * hands the remote back to the hook and never publishes. + */ +type PublishDecision = + | { kind: "publish"; store: ChannelSectionStore } + | { kind: "adopt"; remote: RemoteSections }; + async function decryptAndParse( event: RelayEvent, ): Promise { @@ -45,10 +74,15 @@ export class ChannelSectionSyncManager { private pubkey: string; private relayUrl: string; private debounceTimer: number | null = null; + private retryTimer: number | null = null; + private retryDelayMs = RETRY_BASE_MS; private lastRemoteCreatedAt: number; private pendingStore: ChannelSectionStore | null = null; private lastPublishedStore: ChannelSectionStore | null = null; private destroyed = false; + // Set by the hook so an adopted remote head (local edit lost LWW, or a relay + // conflict rejection) is written through to React state + localStorage. + private onRemoteAdopted: ((remote: RemoteSections) => void) | null = null; constructor(pubkey: string, relayUrl: string) { this.pubkey = pubkey; @@ -58,6 +92,11 @@ export class ChannelSectionSyncManager { this.lastRemoteCreatedAt = readWatermark(pubkey, BLOB_TYPE, relayUrl); } + /** Register the hook's adopt-remote sink (write-through to UI + storage). */ + setOnRemoteAdopted(cb: (remote: RemoteSections) => void): void { + this.onRemoteAdopted = cb; + } + async fetchRemoteSections(): Promise> { try { const events = await relayClient.fetchEvents({ @@ -102,14 +141,41 @@ export class ChannelSectionSyncManager { window.clearTimeout(this.debounceTimer); this.debounceTimer = null; } + if (this.retryTimer !== null) { + window.clearTimeout(this.retryTimer); + this.retryTimer = null; + } } getPendingStore(): ChannelSectionStore | null { return this.pendingStore; } + /** + * Adopt a remote store that superseded a local edit: hand it to the hook for + * write-through, advance the watermark, and drop the losing pending edit — + * including the durable outbox, so the outbox can never replay an edit that + * adopt just decided lost (which would reintroduce divergence). + */ + private adoptRemote(remote: RemoteSections): void { + this.recordRemoteHead(remote.createdAt); + this.discardPending(); + this.lastPublishedStore = remote.store; + if (this.destroyed) return; + this.onRemoteAdopted?.(remote); + } + + /** Clear both the in-memory pending edit and its durable outbox copy. */ + private discardPending(): void { + this.pendingStore = null; + clearChannelSectionsOutbox(this.pubkey, this.relayUrl); + } + publishSections(store: ChannelSectionStore): void { this.pendingStore = store; + // Persist synchronously so an edit made <2s before quit/community-switch + // survives teardown and resumes on next mount (fix-3 durable outbox). + writeChannelSectionsOutbox(this.pubkey, store, this.relayUrl); if (this.debounceTimer !== null) { window.clearTimeout(this.debounceTimer); } @@ -121,7 +187,7 @@ export class ChannelSectionSyncManager { private async fetchOwnBlobBeforePublish( store: ChannelSectionStore, - ): Promise { + ): Promise { try { const events = await relayClient.fetchEvents({ kinds: [KIND_CHANNEL_SECTIONS], @@ -129,23 +195,26 @@ export class ChannelSectionSyncManager { "#d": [D_TAG], limit: 1, }); - if (events.length === 0 || events[0].pubkey !== this.pubkey) return store; + if (events.length === 0 || events[0].pubkey !== this.pubkey) + return { kind: "publish", store }; const event = events[0]; // Snapshot the watermark before advancing it: after recordRemoteHead // runs, lastRemoteCreatedAt equals event.created_at, so the LWW // comparison remote.createdAt > lastRemoteCreatedAt would always be - // false and silently suppress the merge. + // false and silently suppress the adopt. const headBeforeFetch = this.lastRemoteCreatedAt; this.recordRemoteHead(event.created_at); const remote = await decryptAndParse(event); - if (!remote) return store; - // Sections use whole-blob LWW: take whichever is newer + if (!remote) return { kind: "publish", store }; + // Sections use whole-blob LWW: a newer remote head wins, and the local + // edit is adopted-away rather than silently republished as remote content + // while the UI keeps showing the edit. if (remote.createdAt > headBeforeFetch) { - return remote.store; + return { kind: "adopt", remote }; } - return store; + return { kind: "publish", store }; } catch { - return store; + return { kind: "publish", store }; } } @@ -176,15 +245,33 @@ export class ChannelSectionSyncManager { return true; } + /** Schedule a bounded-backoff retry of the retained pending edit. */ + private scheduleRetry(): void { + if (this.destroyed || this.pendingStore === null) return; + if (this.retryTimer !== null) return; + const store = this.pendingStore; + const delay = this.retryDelayMs; + this.retryDelayMs = Math.min(this.retryDelayMs * 2, RETRY_MAX_MS); + this.retryTimer = window.setTimeout(() => { + this.retryTimer = null; + void this.doPublish(store); + }, delay); + } + private async doPublish(store: ChannelSectionStore): Promise { try { - const merged = await this.fetchOwnBlobBeforePublish(store); + const decision = await this.fetchOwnBlobBeforePublish(store); // Guard: manager may have been destroyed while fetchOwnBlobBeforePublish // was awaited (community switch during in-flight fetch). If so, abort // before touching the relay. if (this.destroyed) return; + if (decision.kind === "adopt") { + this.adoptRemote(decision.remote); + return; + } + const merged = decision.store; if (this.isIdenticalToLastPublished(merged)) { - this.pendingStore = null; + this.discardPending(); return; } const payload = { @@ -193,9 +280,14 @@ export class ChannelSectionSyncManager { assignments: merged.assignments, }; const ciphertext = await nip44EncryptToSelf(JSON.stringify(payload)); - const createdAt = Math.max( - Math.floor(Date.now() / 1_000), - this.lastRemoteCreatedAt + 1, + const now = Math.floor(Date.now() / 1_000); + // Clamp inside the relay's future-drift window: never manufacture a + // timestamp so far ahead that this or a later publish is rejected for + // drift and wedges. If a skewed remote head sits beyond the window we + // will lose LWW and adopt it on conflict rather than walking past it. + const createdAt = Math.min( + Math.max(now, this.lastRemoteCreatedAt + 1), + now + MAX_PUBLISH_FUTURE_SECS, ); const event = await signRelayEvent({ kind: KIND_CHANNEL_SECTIONS, @@ -217,9 +309,28 @@ export class ChannelSectionSyncManager { ); this.recordRemoteHead(event.created_at); this.lastPublishedStore = merged; - this.pendingStore = null; + this.discardPending(); + this.retryDelayMs = RETRY_BASE_MS; } catch (error) { + if (this.destroyed) return; + // The relay rejects a strictly-losing coordinate write with an OK false + // conflict (fix-4). Treat it as a lost race: refetch the head and adopt + // it so we converge instead of retrying a write that can never win. + if (isConflictRejection(error)) { + const head = await this.fetchRemoteSections(); + if (this.destroyed) return; + if (head.status === "found") { + this.adoptRemote(head.data); + } else { + this.scheduleRetry(); + } + return; + } + // Transient failure (timeout / socket error): keep the pending edit and + // retry with backoff rather than waiting for a reconnect that a healthy + // socket never fires. console.warn("[channelSectionsSync] publish failed:", error); + this.scheduleRetry(); } } @@ -265,12 +376,19 @@ export class ChannelSectionSyncManager { destroy(): void { // Cancel any pending publish and mark this manager as destroyed so any // in-flight doPublish() calls abort before reaching relayClient. - // Pending debounce-window changes are intentionally dropped: flushing - // could publish relay A's sections to relay B via the shared relayClient - // singleton. On return, bootstrap's found path whole-blob-replaces from - // remote, so any dropped pending edit is lost. + // Debounce-window changes are NOT lost: publishSections persisted them to + // the durable outbox synchronously, and the next mount resumes them. + // Flushing here is still avoided — it could publish relay A's sections to + // relay B via the shared relayClient singleton. this.destroyed = true; this.cancelPendingPublish(); this.pendingStore = null; } } + +/** True when a publish error is the relay's stale-coordinate conflict (fix-4). */ +function isConflictRejection(error: unknown): boolean { + return ( + error instanceof Error && error.message.toLowerCase().includes("conflict") + ); +} diff --git a/desktop/src/features/sidebar/lib/useChannelSections.ts b/desktop/src/features/sidebar/lib/useChannelSections.ts index 5a544e82bca..cbef2837a66 100644 --- a/desktop/src/features/sidebar/lib/useChannelSections.ts +++ b/desktop/src/features/sidebar/lib/useChannelSections.ts @@ -3,7 +3,9 @@ import * as React from "react"; import { relayClient } from "@/shared/api/relayClient"; import { boundChannelSectionsStore, + clearChannelSectionsOutbox, DEFAULT_STORE, + readChannelSectionsOutbox, readChannelSectionsStore, storageKey, writeChannelSectionsStore, @@ -19,6 +21,13 @@ import type { ChannelSectionStore, } from "./channelSectionsStorage"; +// Reconciliation cadence (fix 1). Steady interval re-fetches the head on a +// healthy socket so divergence self-heals without a reconnect; the retry +// window backs off from base to max while the fetch keeps failing. +const RECONCILE_STEADY_MS = 60_000; +const RECONCILE_RETRY_BASE_MS = 3_000; +const RECONCILE_RETRY_MAX_MS = 60_000; + export function useChannelSections( pubkey: string | undefined, relayUrl?: string, @@ -102,6 +111,19 @@ export function useChannelSections( [pubkey, relayUrl], ); + React.useEffect(() => { + if (!pubkey || !relayUrl) return; + const manager = managerRef.current; + if (!manager) return; + // When a local edit loses whole-blob LWW (pre-publish head is newer) or the + // relay rejects it with a conflict, the manager adopts the winning remote + // store. Write it through to React state + localStorage so the UI and relay + // never diverge; applyRemote also advances the applied-ts guard. + manager.setOnRemoteAdopted((remote) => { + setStore(applyRemote(remote)); + }); + }, [pubkey, relayUrl, applyRemote]); + React.useEffect(() => { if (!pubkey || !relayUrl) return; let cancelled = false; @@ -112,13 +134,74 @@ export function useChannelSections( setStore(applyRemote(result.data)); } // "hold": seed already performed by bootstrap (if first-sync), or - // blocked (failed fetch / prior watermark). Hook does nothing. + // blocked (failed fetch / prior watermark). The reconciliation effect + // below retries a failed fetch; here we only resume any edit that was + // persisted to the durable outbox before a prior quit/community-switch. + const outbox = readChannelSectionsOutbox(pubkey, relayUrl); + if (outbox) { + managerRef.current?.publishSections(outbox); + } else { + clearChannelSectionsOutbox(pubkey, relayUrl); + } }); return () => { cancelled = true; }; }, [pubkey, relayUrl, applyRemote]); + // Reconciliation loop (fix 1): a single scheduler that both retries a failed + // bootstrap with bounded backoff and periodically re-fetches the head, so + // stale-at-open state converges without waiting for a reconnect event a + // healthy socket never fires. Also refreshes when the window becomes visible. + React.useEffect(() => { + if (!pubkey || !relayUrl) return; + let cancelled = false; + let timer: number | null = null; + let delayMs = RECONCILE_RETRY_BASE_MS; + + const schedule = (ms: number) => { + if (cancelled) return; + if (timer !== null) window.clearTimeout(timer); + timer = window.setTimeout(tick, ms); + }; + + const tick = () => { + void managerRef.current?.fetchRemoteSections().then((result) => { + if (cancelled) return; + if (result.status === "found") { + setStore(applyRemote(result.data)); + // applyRemote cancels the pending debounce; re-queue any live local + // edit so a periodic reconcile never silently drops it (mirrors the + // reconnect handler). doPublish re-checks the head and adopts if the + // remote is genuinely newer. + const pending = managerRef.current?.getPendingStore(); + if (pending) managerRef.current?.publishSections(pending); + delayMs = RECONCILE_STEADY_MS; // relay answered → steady cadence + } else if (result.status === "absent") { + delayMs = RECONCILE_STEADY_MS; // answered (no blob) → steady cadence + } else { + delayMs = Math.min(delayMs * 2, RECONCILE_RETRY_MAX_MS); // fetch failed → back off + } + schedule(delayMs); + }); + }; + + const onVisible = () => { + if (document.visibilityState === "visible") { + delayMs = RECONCILE_RETRY_BASE_MS; + tick(); + } + }; + document.addEventListener("visibilitychange", onVisible); + schedule(delayMs); + + return () => { + cancelled = true; + if (timer !== null) window.clearTimeout(timer); + document.removeEventListener("visibilitychange", onVisible); + }; + }, [pubkey, relayUrl, applyRemote]); + React.useEffect(() => { if (!pubkey) return; let unsub: (() => Promise) | null = null; From afbd61cb8f9b9cc88ab03dc5df41eac2040f25a2 Mon Sep 17 00:00:00 2001 From: Duncan Date: Fri, 21 Aug 2026 20:10:09 -0400 Subject: [PATCH 2/7] fix(sidebar): close pending-edit convergence races in channel sections MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three cross-layer races defeated the one-convergence-mechanism design: - An older in-flight publish unconditionally cleared pending state on completion, erasing a newer edit queued mid-flight. Each pending edit now carries a monotonic generation; a completion clears pending/outbox/retry only via compare-and-swap on the generation it published. - Hook-level remote application (bootstrap/live/periodic) cancelled the pending publish's timers without deciding supersession, stranding the durable outbox and clobbering the optimistic edit. applyRemote now defers entirely to a pending edit, whose own debounced publish converges via publish-or-adopt; the manager's adopt path clears pending before write-through so the winning remote still applies. - The equal-timestamp tie-break kept the largest event id, opposite the relay/database canonical order (created_at DESC, id ASC → lowest id wins). applyRemote now applies a strictly-lower id and ignores ids >= the last applied, so the UI converges on the event the relay actually stored. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../sidebar/lib/channelSectionsSync.test.mjs | 97 +++++++++ .../sidebar/lib/channelSectionsSync.ts | 77 +++++-- .../sidebar/lib/useChannelSections.test.mjs | 197 ++++++++++++++++++ .../sidebar/lib/useChannelSections.ts | 24 ++- 4 files changed, 371 insertions(+), 24 deletions(-) diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs index 4a156f656f8..17248daffe1 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs @@ -436,3 +436,100 @@ test("revert-fix: undecryptable live event advances watermark before decrypt att mock.reset(); } }); + +// 6. Overlapping publishes (fix 1): an older in-flight publish must not clear a +// newer edit queued while it was in flight. Regression for the generation +// compare-and-swap on discardPending — reverting the gen guard makes the +// older completion null out B's pendingStore + outbox. +test("overlapping publishes: older completion does not erase a newer queued edit", async () => { + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + // First publish blocks until we release it; a second publish is queued while + // the first is in flight. + let releaseFirst = null; + let publishCalls = 0; + mock.method(relayClient, "publishEvent", () => { + publishCalls++; + if (publishCalls === 1) { + return new Promise((res) => { + releaseFirst = res; + }); + } + return Promise.resolve(); + }); + // A multi-slot timer fake: each setTimeout is retained by delay so we can fire + // the debounce independently and inspect what remains. + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const fakeWindow = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + const fireDelay = async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + await Promise.resolve(); + await Promise.resolve(); + }; + const restore = installFakeWindow(fakeWindow); + const tauri = installTauriMock("{}"); + const outboxKey = `buzz-channel-sections-outbox.v1:pk-overlap:${RELAY_KEY}`; + try { + const manager = new ChannelSectionSyncManager("pk-overlap", RELAY); + const storeA = makeSectionsStore([{ id: "a", name: "A", order: 0 }]); + const storeB = makeSectionsStore([{ id: "b", name: "B", order: 0 }]); + + manager.publishSections(storeA); + await fireDelay(2000); // debounce → doPublish(A) awaits publishEvent + while (releaseFirst === null) await Promise.resolve(); + + // Edit B arrives while A is still in flight. + manager.publishSections(storeB); + assert.deepEqual( + manager.getPendingStore()?.sections.map((s) => s.id), + ["b"], + "B is now the pending edit", + ); + assert.equal( + JSON.parse(storage.get(outboxKey)).sections[0].id, + "b", + "outbox holds B", + ); + + // A completes — its success path must NOT clear B's pending/outbox. + releaseFirst(); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + + assert.deepEqual( + manager.getPendingStore()?.sections.map((s) => s.id), + ["b"], + "older completion must leave B pending", + ); + assert.ok( + storage.get(outboxKey) !== undefined, + "older completion must leave B's outbox intact", + ); + assert.ok( + [...timers.values()].some((t) => t.ms === 2000), + "B's debounce timer must survive so it still publishes", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.ts b/desktop/src/features/sidebar/lib/channelSectionsSync.ts index 001dd4f4a1b..375db4f1d37 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.ts +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.ts @@ -78,6 +78,12 @@ export class ChannelSectionSyncManager { private retryDelayMs = RETRY_BASE_MS; private lastRemoteCreatedAt: number; private pendingStore: ChannelSectionStore | null = null; + // Monotonic id for the current pending edit. Every publishSections() bumps + // it; every scheduled publish/retry captures the value it was queued for. + // A completion (success, adopt, or no-op) may only clear pending state via + // compare-and-swap on this generation, so an older in-flight publish can + // never erase a newer edit that arrived while it was in flight. + private pendingGeneration = 0; private lastPublishedStore: ChannelSectionStore | null = null; private destroyed = false; // Set by the hook so an adopted remote head (local edit lost LWW, or a relay @@ -151,37 +157,64 @@ export class ChannelSectionSyncManager { return this.pendingStore; } + /** True while an unpublished local edit is queued (debouncing or retrying). */ + hasPendingEdit(): boolean { + return this.pendingStore !== null; + } + /** * Adopt a remote store that superseded a local edit: hand it to the hook for * write-through, advance the watermark, and drop the losing pending edit — * including the durable outbox, so the outbox can never replay an edit that * adopt just decided lost (which would reintroduce divergence). + * + * Compare-and-swap on `gen`: this adopt was decided against the edit queued at + * generation `gen`. If a newer edit arrived while this publish was in flight, + * the generation has moved on and that newer edit is the latest writer — it + * will publish and win LWW — so a stale adopt must not clear its pending state + * or overwrite its optimistic UI. We still advance the watermark (monotonic + * and always safe) so the newer edit stamps above this head. */ - private adoptRemote(remote: RemoteSections): void { + private adoptRemote(remote: RemoteSections, gen: number): void { this.recordRemoteHead(remote.createdAt); - this.discardPending(); + if (gen !== this.pendingGeneration) return; + this.pendingStore = null; + clearChannelSectionsOutbox(this.pubkey, this.relayUrl); this.lastPublishedStore = remote.store; if (this.destroyed) return; this.onRemoteAdopted?.(remote); } - /** Clear both the in-memory pending edit and its durable outbox copy. */ - private discardPending(): void { + /** + * Clear the in-memory pending edit and its durable outbox — but only if the + * completing publish still owns the current generation. A publish for an + * older edit that finishes after a newer edit was queued must leave the newer + * edit (and its retry state) untouched. + */ + private discardPending(gen: number): void { + if (gen !== this.pendingGeneration) return; this.pendingStore = null; clearChannelSectionsOutbox(this.pubkey, this.relayUrl); } publishSections(store: ChannelSectionStore): void { this.pendingStore = store; + const gen = ++this.pendingGeneration; // Persist synchronously so an edit made <2s before quit/community-switch // survives teardown and resumes on next mount (fix-3 durable outbox). writeChannelSectionsOutbox(this.pubkey, store, this.relayUrl); if (this.debounceTimer !== null) { window.clearTimeout(this.debounceTimer); } + // A fresh edit supersedes any retry scheduled for the previous generation. + if (this.retryTimer !== null) { + window.clearTimeout(this.retryTimer); + this.retryTimer = null; + } + this.retryDelayMs = RETRY_BASE_MS; this.debounceTimer = window.setTimeout(() => { this.debounceTimer = null; - void this.doPublish(store); + void this.doPublish(store, gen); }, DEBOUNCE_MS); } @@ -246,19 +279,27 @@ export class ChannelSectionSyncManager { } /** Schedule a bounded-backoff retry of the retained pending edit. */ - private scheduleRetry(): void { + private scheduleRetry(gen: number): void { if (this.destroyed || this.pendingStore === null) return; + // A newer edit has superseded this one; its own timer owns the retry. + if (gen !== this.pendingGeneration) return; if (this.retryTimer !== null) return; const store = this.pendingStore; const delay = this.retryDelayMs; this.retryDelayMs = Math.min(this.retryDelayMs * 2, RETRY_MAX_MS); this.retryTimer = window.setTimeout(() => { this.retryTimer = null; - void this.doPublish(store); + void this.doPublish(store, gen); }, delay); } - private async doPublish(store: ChannelSectionStore): Promise { + private async doPublish( + store: ChannelSectionStore, + gen: number, + ): Promise { + // A newer edit was queued after this publish was scheduled; it owns the + // pending state and will publish the latest store — abandon this stale run. + if (gen !== this.pendingGeneration) return; try { const decision = await this.fetchOwnBlobBeforePublish(store); // Guard: manager may have been destroyed while fetchOwnBlobBeforePublish @@ -266,12 +307,12 @@ export class ChannelSectionSyncManager { // before touching the relay. if (this.destroyed) return; if (decision.kind === "adopt") { - this.adoptRemote(decision.remote); + this.adoptRemote(decision.remote, gen); return; } const merged = decision.store; if (this.isIdenticalToLastPublished(merged)) { - this.discardPending(); + this.discardPending(gen); return; } const payload = { @@ -308,9 +349,13 @@ export class ChannelSectionSyncManager { "Failed to publish channel sections.", ); this.recordRemoteHead(event.created_at); - this.lastPublishedStore = merged; - this.discardPending(); - this.retryDelayMs = RETRY_BASE_MS; + // Only claim this store as the published head if it is still the current + // edit; a newer edit queued mid-flight owns lastPublishedStore now. + if (gen === this.pendingGeneration) { + this.lastPublishedStore = merged; + this.retryDelayMs = RETRY_BASE_MS; + } + this.discardPending(gen); } catch (error) { if (this.destroyed) return; // The relay rejects a strictly-losing coordinate write with an OK false @@ -320,9 +365,9 @@ export class ChannelSectionSyncManager { const head = await this.fetchRemoteSections(); if (this.destroyed) return; if (head.status === "found") { - this.adoptRemote(head.data); + this.adoptRemote(head.data, gen); } else { - this.scheduleRetry(); + this.scheduleRetry(gen); } return; } @@ -330,7 +375,7 @@ export class ChannelSectionSyncManager { // retry with backoff rather than waiting for a reconnect that a healthy // socket never fires. console.warn("[channelSectionsSync] publish failed:", error); - this.scheduleRetry(); + this.scheduleRetry(gen); } } diff --git a/desktop/src/features/sidebar/lib/useChannelSections.test.mjs b/desktop/src/features/sidebar/lib/useChannelSections.test.mjs index 401b59d9c1c..62030348624 100644 --- a/desktop/src/features/sidebar/lib/useChannelSections.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelSections.test.mjs @@ -76,3 +76,200 @@ test("assignChannel refreshes an existing assignment before the next eviction", relayClient.subscribeToReconnects = originalSubscribeToReconnects; } }); + +// Fix 2 regression: a live remote arriving while a local edit is pending must +// NOT overwrite the optimistic edit or strand its durable outbox. The pending +// edit's own debounced publish owns convergence (publish-or-adopt). Reverting +// applyRemote's hasPendingEdit guard makes the live event clobber the UI and +// leave the outbox replay-eligible. +test("live remote while a local edit is pending defers to the pending edit", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelSections } = await import("./useChannelSections.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origPublish = relayClient.publishEvent; + const origTauri = window.__TAURI_INTERNALS__; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + relayClient.publishEvent = async () => {}; + window.__TAURI_INTERNALS__ = { + invoke: (cmd) => { + if (cmd === "nip44_decrypt_from_self") + return Promise.resolve( + JSON.stringify({ + version: 1, + sections: [{ id: "remote", name: "Remote", order: 0 }], + assignments: {}, + }), + ); + if (cmd === "nip44_encrypt_to_self") return Promise.resolve("ct"); + if (cmd === "sign_event") + return Promise.resolve( + JSON.stringify({ + id: "signed", + pubkey: "pk-live-pending", + content: "ct", + created_at: 0, + kind: 30078, + tags: [], + sig: "s", + }), + ); + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-live-pending"; + const relayUrl = "wss://r.live"; + const outboxKey = `buzz-channel-sections-outbox.v1:${pubkey}:${encodeURIComponent(relayUrl)}`; + + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelSections(pubkey, relayUrl)); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + // Make a local edit — it becomes the pending store and persists to outbox. + await act(async () => { + hook.result.current.createSection("Local"); + }); + assert.ok( + window.localStorage.getItem(outboxKey), + "local edit persisted to outbox", + ); + const localSectionIds = hook.result.current.sections.map((s) => s.id); + + // A remote live event arrives while the edit is still pending. + await act(async () => { + live({ + id: "remote-event", + pubkey, + created_at: 500, + content: "cipher", + kind: 30078, + tags: [["d", "channel-sections"]], + sig: "s", + }); + await Promise.resolve(); + await Promise.resolve(); + }); + + assert.deepEqual( + hook.result.current.sections.map((s) => s.id), + localSectionIds, + "pending local edit must NOT be overwritten by the live remote", + ); + assert.ok( + window.localStorage.getItem(outboxKey), + "outbox for the pending edit must survive the live remote", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + relayClient.publishEvent = origPublish; + window.__TAURI_INTERNALS__ = origTauri; + } +}); + +// Fix 3 regression: equal-timestamp tie-break must match the relay's canonical +// winner (`created_at DESC, id ASC` → LOWEST id wins). Deliver the larger id +// first, then the lower id at the same timestamp; the lower-id store must win. +// Reverting applyRemote's `>=` back to `<=` converges on the larger id instead. +test("equal-timestamp tie-break applies the lower event id (relay canonical winner)", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelSections } = await import("./useChannelSections.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // Decrypt payload keyed off the event id embedded in the ciphertext so each + // delivered event yields a distinct store we can assert on. + window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") { + const id = args?.ciphertext ?? ""; + return Promise.resolve( + JSON.stringify({ + version: 1, + sections: [{ id, name: id, order: 0 }], + assignments: {}, + }), + ); + } + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-tie"; + const relayUrl = "wss://r.tie"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelSections(pubkey, relayUrl)); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + const deliver = async (id) => { + await act(async () => { + live({ + id, + pubkey, + created_at: 1000, + content: id, // decrypt echoes this into the section id + kind: 30078, + tags: [["d", "channel-sections"]], + sig: "s", + }); + await Promise.resolve(); + await Promise.resolve(); + }); + }; + + // Larger id first (would win under the old <= comparator)... + await deliver("bbbb"); + // ...then the lower id at the same timestamp — the relay's canonical winner. + await deliver("aaaa"); + + assert.deepEqual( + hook.result.current.sections.map((s) => s.id), + ["aaaa"], + "lower event id must win the equal-timestamp tie-break", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelSections.ts b/desktop/src/features/sidebar/lib/useChannelSections.ts index cbef2837a66..01b3187096b 100644 --- a/desktop/src/features/sidebar/lib/useChannelSections.ts +++ b/desktop/src/features/sidebar/lib/useChannelSections.ts @@ -94,15 +94,26 @@ export function useChannelSections( ): ((prev: ChannelSectionStore) => ChannelSectionStore) => { return (prev) => { if (!pubkey) return prev; + // A pending local edit owns convergence: its debounced publish + // re-checks the head and either wins (publish) or loses (adopt, which + // routes back through onRemoteAdopted with pending already cleared). + // Never let a passive remote arrival clobber the optimistic edit or + // strand its durable outbox — that is the one-convergence-mechanism + // invariant. The adopt path clears pending before calling us, so this + // guard is false there and the winning remote still writes through. + if (managerRef.current?.hasPendingEdit()) return prev; if (remote.createdAt < lastAppliedRemoteTs.current) return prev; + // Equal timestamps: the relay/database break ties by `id ASC` — the + // LOWEST event id is the canonical winner. Apply a strictly-lower id and + // ignore any id >= the last applied, so the UI converges on the same + // event the relay stored rather than the largest id seen. if ( remote.createdAt === lastAppliedRemoteTs.current && - remote.eventId <= lastAppliedEventId.current + remote.eventId >= lastAppliedEventId.current ) return prev; lastAppliedRemoteTs.current = remote.createdAt; lastAppliedEventId.current = remote.eventId; - managerRef.current?.cancelPendingPublish(); if (!writeChannelSectionsStore(pubkey, remote.store, relayUrl)) return prev; return remote.store; @@ -169,13 +180,10 @@ export function useChannelSections( void managerRef.current?.fetchRemoteSections().then((result) => { if (cancelled) return; if (result.status === "found") { + // applyRemote defers to a pending local edit (whose own debounced + // publish converges via publish-or-adopt), so a periodic reconcile + // can never drop it — no re-queue needed. setStore(applyRemote(result.data)); - // applyRemote cancels the pending debounce; re-queue any live local - // edit so a periodic reconcile never silently drops it (mirrors the - // reconnect handler). doPublish re-checks the head and adopts if the - // remote is genuinely newer. - const pending = managerRef.current?.getPendingStore(); - if (pending) managerRef.current?.publishSections(pending); delayMs = RECONCILE_STEADY_MS; // relay answered → steady cadence } else if (result.status === "absent") { delayMs = RECONCILE_STEADY_MS; // answered (no blob) → steady cadence From 1259e5a172e745f7d0aa37f1658f0d0cb3b42c03 Mon Sep 17 00:00:00 2001 From: Duncan Date: Fri, 21 Aug 2026 20:24:10 -0400 Subject: [PATCH 3/7] fix(sidebar): correct equal-timestamp tie-break in stars, mutes, sort useChannelStars, useChannelMutes, and useChannelSortPreference carried the same inverted equal-timestamp comparator as channel sections: applyRemote kept the largest event id, opposite the relay/database canonical order (created_at DESC, id ASC -> lowest id wins). Two devices writing the same second could leave the UI showing an event the relay did not store. Apply a strictly-lower id and ignore ids >= the last applied, matching the sections fix and the relay winner across all four 30078 sidebar surfaces. Each hook gains a regression test: larger-then-lower id delivery at equal timestamp, lower-id store wins (mutation-checked - reverting >= to <= fails each). Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../sidebar/lib/useChannelMutes.test.mjs | 86 ++++++++++++++ .../features/sidebar/lib/useChannelMutes.ts | 6 +- .../lib/useChannelSortPreference.test.mjs | 110 ++++++++++++++++++ .../sidebar/lib/useChannelSortPreference.ts | 6 +- .../sidebar/lib/useChannelStars.test.mjs | 86 ++++++++++++++ .../features/sidebar/lib/useChannelStars.ts | 6 +- 6 files changed, 297 insertions(+), 3 deletions(-) create mode 100644 desktop/src/features/sidebar/lib/useChannelSortPreference.test.mjs diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs index df41f403114..a3610d7678b 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs @@ -77,3 +77,89 @@ test("same-second mute and unmute mutations survive at capacity", async () => { relayClient.subscribeToReconnects = originalSubscribeToReconnects; } }); + +// Equal-timestamp tie-break must match the relay's canonical winner +// (`created_at DESC, id ASC` → LOWEST id wins). Deliver the larger id first, +// then the lower id at the same timestamp; the lower id is the stored winner +// and must be applied, not rejected. Reverting applyRemote's `>=` back to `<=` +// wrongly ignores the lower id (the actual relay winner). +test("equal-timestamp tie-break applies the lower event id (relay canonical winner)", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelMutes } = await import("./useChannelMutes.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // Decrypt payload keyed off the event id embedded in the ciphertext so each + // delivered event yields a store muting a distinct channel we can assert on. + window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") { + const id = args?.ciphertext ?? ""; + return Promise.resolve( + JSON.stringify({ + version: 1, + channels: { [id]: { muted: true, updatedAt: 0 } }, + }), + ); + } + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-mute-tie"; + const relayUrl = "wss://r.tie"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + const deliver = async (id) => { + await act(async () => { + live({ + id, + pubkey, + created_at: 1000, + content: id, // decrypt echoes this into the muted channel id + kind: 30078, + tags: [["d", "channel-mutes"]], + sig: "s", + }); + await Promise.resolve(); + await Promise.resolve(); + }); + }; + + // Larger id first (applied), then the lower id at the same timestamp — the + // relay's canonical winner, which must NOT be rejected. + await deliver("bbbb"); + await deliver("aaaa"); + + assert.ok( + hook.result.current.mutedChannelIds.has("aaaa"), + "lower event id (relay canonical winner) must be applied, not rejected", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.ts b/desktop/src/features/sidebar/lib/useChannelMutes.ts index 20b57453254..85ec9aeb8e3 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.ts +++ b/desktop/src/features/sidebar/lib/useChannelMutes.ts @@ -73,9 +73,13 @@ export function useChannelMutes( return (prev) => { if (!pubkey) return prev; if (remote.createdAt < lastAppliedRemoteTs.current) return prev; + // Equal timestamps: the relay/database break ties by `id ASC` — the + // LOWEST event id is the canonical winner. Apply a strictly-lower id and + // ignore any id >= the last applied, so the UI converges on the same + // event the relay stored rather than the largest id seen. if ( remote.createdAt === lastAppliedRemoteTs.current && - remote.eventId <= lastAppliedEventId.current + remote.eventId >= lastAppliedEventId.current ) return prev; lastAppliedRemoteTs.current = remote.createdAt; diff --git a/desktop/src/features/sidebar/lib/useChannelSortPreference.test.mjs b/desktop/src/features/sidebar/lib/useChannelSortPreference.test.mjs new file mode 100644 index 00000000000..a9a65754b0c --- /dev/null +++ b/desktop/src/features/sidebar/lib/useChannelSortPreference.test.mjs @@ -0,0 +1,110 @@ +import assert from "node:assert/strict"; +import { after, before, test } from "node:test"; + +import { JSDOM } from "jsdom"; + +const dom = new JSDOM("", { + url: "http://localhost", +}); + +before(() => { + Object.assign(globalThis, { + document: dom.window.document, + HTMLElement: dom.window.HTMLElement, + IS_REACT_ACT_ENVIRONMENT: true, + window: dom.window, + }); +}); + +after(() => dom.window.close()); + +// Equal-timestamp tie-break must match the relay's canonical winner +// (`created_at DESC, id ASC` → LOWEST id wins). Deliver the larger id first, +// then the lower id at the same timestamp; the lower id is the stored winner +// and its whole-blob store must replace the applied state. Reverting +// applyRemote's `>=` back to `<=` wrongly ignores the lower id (the relay winner). +test("equal-timestamp tie-break applies the lower event id (relay canonical winner)", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelSortPreference } = await import( + "./useChannelSortPreference.ts" + ); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // Decrypt payload keyed off the event id embedded in the ciphertext so each + // delivered event yields a store setting a distinct group's mode to "recent". + window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") { + const id = args?.ciphertext ?? ""; + return Promise.resolve( + JSON.stringify({ version: 1, groups: { [id]: "recent" } }), + ); + } + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-sort-tie"; + const relayUrl = "wss://r.tie"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelSortPreference(pubkey, relayUrl)); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + const deliver = async (id) => { + await act(async () => { + live({ + id, + pubkey, + created_at: 1000, + content: id, // decrypt echoes this into the group key + kind: 30078, + tags: [["d", "channel-sort"]], + sig: "s", + }); + await Promise.resolve(); + await Promise.resolve(); + }); + }; + + // Larger id first (applied), then the lower id at the same timestamp — the + // relay's canonical winner, whose whole-blob store must replace the state. + await deliver("bbbb"); + await deliver("aaaa"); + + assert.equal( + hook.result.current.sortModeFor("aaaa"), + "recent", + "lower event id (relay canonical winner) must be applied, not rejected", + ); + assert.equal( + hook.result.current.sortModeFor("bbbb"), + "alpha", + "larger id's store must be superseded by the lower-id whole-blob winner", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelSortPreference.ts b/desktop/src/features/sidebar/lib/useChannelSortPreference.ts index 85c07b1c398..a692bbb31a4 100644 --- a/desktop/src/features/sidebar/lib/useChannelSortPreference.ts +++ b/desktop/src/features/sidebar/lib/useChannelSortPreference.ts @@ -86,9 +86,13 @@ export function useChannelSortPreference( return (prev) => { if (!pubkey) return prev; if (remote.createdAt < lastAppliedRemoteTs.current) return prev; + // Equal timestamps: the relay/database break ties by `id ASC` — the + // LOWEST event id is the canonical winner. Apply a strictly-lower id and + // ignore any id >= the last applied, so the UI converges on the same + // event the relay stored rather than the largest id seen. if ( remote.createdAt === lastAppliedRemoteTs.current && - remote.eventId <= lastAppliedEventId.current + remote.eventId >= lastAppliedEventId.current ) return prev; lastAppliedRemoteTs.current = remote.createdAt; diff --git a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs index a8e1b4b4ae5..7ed562e3a00 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs @@ -77,3 +77,89 @@ test("same-second star and unstar mutations survive at capacity", async () => { relayClient.subscribeToReconnects = originalSubscribeToReconnects; } }); + +// Equal-timestamp tie-break must match the relay's canonical winner +// (`created_at DESC, id ASC` → LOWEST id wins). Deliver the larger id first, +// then the lower id at the same timestamp; the lower id is the stored winner +// and must be applied, not rejected. Reverting applyRemote's `>=` back to `<=` +// wrongly ignores the lower id (the actual relay winner). +test("equal-timestamp tie-break applies the lower event id (relay canonical winner)", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelStars } = await import("./useChannelStars.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // Decrypt payload keyed off the event id embedded in the ciphertext so each + // delivered event yields a store starring a distinct channel we can assert on. + window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") { + const id = args?.ciphertext ?? ""; + return Promise.resolve( + JSON.stringify({ + version: 1, + channels: { [id]: { starred: true, updatedAt: 0 } }, + }), + ); + } + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-star-tie"; + const relayUrl = "wss://r.tie"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelStars(pubkey, relayUrl)); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + const deliver = async (id) => { + await act(async () => { + live({ + id, + pubkey, + created_at: 1000, + content: id, // decrypt echoes this into the starred channel id + kind: 30078, + tags: [["d", "channel-stars"]], + sig: "s", + }); + await Promise.resolve(); + await Promise.resolve(); + }); + }; + + // Larger id first (applied), then the lower id at the same timestamp — the + // relay's canonical winner, which must NOT be rejected. + await deliver("bbbb"); + await deliver("aaaa"); + + assert.ok( + hook.result.current.starredChannelIds.has("aaaa"), + "lower event id (relay canonical winner) must be applied, not rejected", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelStars.ts b/desktop/src/features/sidebar/lib/useChannelStars.ts index 855c8de8581..d3d4b8f8fb7 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.ts +++ b/desktop/src/features/sidebar/lib/useChannelStars.ts @@ -73,9 +73,13 @@ export function useChannelStars( return (prev) => { if (!pubkey) return prev; if (remote.createdAt < lastAppliedRemoteTs.current) return prev; + // Equal timestamps: the relay/database break ties by `id ASC` — the + // LOWEST event id is the canonical winner. Apply a strictly-lower id and + // ignore any id >= the last applied, so the UI converges on the same + // event the relay stored rather than the largest id seen. if ( remote.createdAt === lastAppliedRemoteTs.current && - remote.eventId <= lastAppliedEventId.current + remote.eventId >= lastAppliedEventId.current ) return prev; lastAppliedRemoteTs.current = remote.createdAt; From bd55bdd865376a276bc9f0200464c5fa781965ee Mon Sep 17 00:00:00 2001 From: Duncan Date: Fri, 21 Aug 2026 21:12:39 -0400 Subject: [PATCH 4/7] fix(sidebar): close pre-publish and per-entry merge convergence holes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two convergence holes one layer under the pass-1 fixes: Sections: the pre-publish head check compared the fetched head against the mutable lastRemoteCreatedAt, which a live event observed during the debounce window already advanced to that same head — equality fell through to publish and the local blob overwrote a remote that became head after the edit was queued. Freeze a canonical head baseline (created_at, id) at publishSections and compare the fetched head against that generation baseline instead, adopting when the head advanced. Stars/mutes: applyRemote admits the canonical lower-id winner but then mergeStores resolved equal per-entry updatedAt as local/prev-wins, so a stale larger-id value delivered first survived and undid the winner. Add mergeApplyingRemote which resolves an entry-timestamp tie toward the canonical incoming blob while keeping strictly-newer local entries. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../sidebar/lib/channelMutesStorage.ts | 29 ++++- .../sidebar/lib/channelSectionsSync.test.mjs | 103 ++++++++++++++++++ .../sidebar/lib/channelSectionsSync.ts | 83 +++++++++++--- .../sidebar/lib/channelStarsStorage.ts | 29 ++++- .../sidebar/lib/useChannelMutes.test.mjs | 86 +++++++++++++++ .../features/sidebar/lib/useChannelMutes.ts | 4 +- .../sidebar/lib/useChannelStars.test.mjs | 88 +++++++++++++++ .../features/sidebar/lib/useChannelStars.ts | 4 +- 8 files changed, 404 insertions(+), 22 deletions(-) diff --git a/desktop/src/features/sidebar/lib/channelMutesStorage.ts b/desktop/src/features/sidebar/lib/channelMutesStorage.ts index 1bf315d268d..e8de164f784 100644 --- a/desktop/src/features/sidebar/lib/channelMutesStorage.ts +++ b/desktop/src/features/sidebar/lib/channelMutesStorage.ts @@ -111,6 +111,30 @@ export function writeChannelMutesStore( export function mergeStores( local: ChannelMuteStore, remote: ChannelMuteStore, +): ChannelMuteStore { + return mergeStoresWithTie(local, remote, false); +} + +/** + * Merge a remote store that has already won the event-level canonical tie-break + * (`created_at DESC, id ASC`) into the local store, resolving a per-entry + * `updatedAt` tie in favour of the *remote* value. Once the comparator has + * chosen this remote event as the stored winner, its per-entry values must + * survive, or a stale value from a superseded larger-id event delivered first + * would win the merge and silently undo the canonical winner. Strictly-newer + * local per-entry edits (`l.updatedAt > r.updatedAt`) still win. + */ +export function mergeApplyingRemote( + local: ChannelMuteStore, + remote: ChannelMuteStore, +): ChannelMuteStore { + return mergeStoresWithTie(local, remote, true); +} + +function mergeStoresWithTie( + local: ChannelMuteStore, + remote: ChannelMuteStore, + preferRemoteOnTie: boolean, ): ChannelMuteStore { const allIds = new Set([ ...Object.keys(local.channels), @@ -121,7 +145,10 @@ export function mergeStores( const l = local.channels[id]; const r = remote.channels[id]; if (l && r) { - merged[id] = l.updatedAt >= r.updatedAt ? l : r; + const localWins = preferRemoteOnTie + ? l.updatedAt > r.updatedAt + : l.updatedAt >= r.updatedAt; + merged[id] = localWins ? l : r; } else { merged[id] = (l ?? r) as ChannelMuteEntry; } diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs index 17248daffe1..491ddbb7f23 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs @@ -533,3 +533,106 @@ test("overlapping publishes: older completion does not erase a newer queued edit mock.reset(); } }); + +// 7. Live remote during debounce (pass-2 finding 1): a remote head accepted +// while a local edit is debouncing must be adopted at pre-publish, not +// overwritten. The live event advances the watermark before doPublish runs, +// so comparing the fetched head against the mutable watermark would see +// equality and publish over the newer remote. The pre-publish check compares +// against the baseline frozen at publishSections instead. Mutation: comparing +// against lastRemoteCreatedAt rather than publishBaseline republishes local. +test("live remote during debounce is adopted at pre-publish, not overwritten", async () => { + const remoteEvent = { + id: "remote-event", + pubkey: "pk-livedebounce", + content: "good-cipher", + created_at: 1_700_000_100, + kind: 30078, + tags: [["d", "channel-sections"]], + sig: "s", + }; + // Pre-publish fetch returns the same live head that arrived during debounce. + mock.method(relayClient, "fetchEvents", () => Promise.resolve([remoteEvent])); + const publishCalls = []; + mock.method(relayClient, "publishEvent", (...args) => { + publishCalls.push(args); + return Promise.resolve(); + }); + let live = null; + mock.method(relayClient, "subscribeLive", async (_filter, cb) => { + live = cb; + return async () => {}; + }); + + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const fakeWindow = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + const fireDelay = async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + for (let i = 0; i < 50; i++) await Promise.resolve(); + }; + const restore = installFakeWindow(fakeWindow); + const tauri = installTauriMock( + JSON.stringify({ + version: 1, + sections: [{ id: "remote", name: "Remote", order: 0 }], + assignments: {}, + }), + ); + const outboxKey = `buzz-channel-sections-outbox.v1:pk-livedebounce:${RELAY_KEY}`; + try { + const manager = new ChannelSectionSyncManager("pk-livedebounce", RELAY); + const adopted = []; + manager.setOnRemoteAdopted((remote) => adopted.push(remote.eventId)); + await manager.subscribeToSections(() => {}); + assert.ok(live, "live subscription installed"); + + manager.publishSections( + makeSectionsStore([{ id: "local", name: "Local", order: 0 }]), + ); + // A genuinely later remote head is accepted and delivered while local is + // pending — this advances the watermark past the frozen baseline. + live(remoteEvent); + for (let i = 0; i < 50; i++) await Promise.resolve(); + + await fireDelay(2000); + + assert.equal( + publishCalls.length, + 0, + "later remote head must prevent the local publish", + ); + assert.deepEqual( + adopted, + ["remote-event"], + "the remote accepted after the edit began must be adopted", + ); + assert.equal(manager.getPendingStore(), null, "pending cleared on adopt"); + assert.equal( + storage.get(outboxKey), + undefined, + "outbox cleared on adopt so the loser can't replay", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.ts b/desktop/src/features/sidebar/lib/channelSectionsSync.ts index 375db4f1d37..b0fe7b36645 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.ts +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.ts @@ -57,6 +57,34 @@ type PublishDecision = | { kind: "publish"; store: ChannelSectionStore } | { kind: "adopt"; remote: RemoteSections }; +/** + * The canonical remote head as it stood when an edit was queued. The pre-publish + * check compares the fetched head against this frozen baseline — never against + * the mutable in-memory watermark, which a live event observed during the + * debounce window may already have advanced to that same head (silently + * suppressing the adopt). + */ +type PublishBaseline = { createdAt: number; eventId: string }; + +/** + * True when `head` is the canonical winner over the baseline the edit was queued + * against — i.e. the head advanced since the edit began. Canonical order is + * `created_at DESC, id ASC`: a strictly-later head wins, and a same-second head + * wins only with a strictly-lower id. A same-second head is comparable only once + * the baseline id is known (empty id = no prior head seen → not superseded). + */ +function remoteAdvancedSince( + head: RemoteSections, + baseline: PublishBaseline, +): boolean { + if (head.createdAt > baseline.createdAt) return true; + return ( + head.createdAt === baseline.createdAt && + baseline.eventId !== "" && + head.eventId < baseline.eventId + ); +} + async function decryptAndParse( event: RelayEvent, ): Promise { @@ -77,6 +105,12 @@ export class ChannelSectionSyncManager { private retryTimer: number | null = null; private retryDelayMs = RETRY_BASE_MS; private lastRemoteCreatedAt: number; + // Canonical best head observed so far (`created_at DESC, id ASC`). Frozen into + // a per-edit baseline at publishSections so the pre-publish check can tell + // whether the head advanced *since the edit was queued*, independent of the + // mutable watermark that a live event during the debounce window may advance. + private lastRemoteHead: PublishBaseline = { createdAt: 0, eventId: "" }; + private publishBaseline: PublishBaseline = { createdAt: 0, eventId: "" }; private pendingStore: ChannelSectionStore | null = null; // Monotonic id for the current pending edit. Every publishSections() bumps // it; every scheduled publish/retry captures the value it was queued for. @@ -118,7 +152,7 @@ export class ChannelSectionSyncManager { // An event exists — record its created_at regardless of whether we can // decrypt it, so seed-publish is blocked even when the payload is // unreadable (e.g. wrong key). - this.recordRemoteHead(event.created_at); + this.recordRemoteHead(event.created_at, event.id); const result = await decryptAndParse(event); if (!result) { return { status: "failed", createdAt: event.created_at }; @@ -134,11 +168,22 @@ export class ChannelSectionSyncManager { } } - /** Update in-memory + persisted watermark. */ - private recordRemoteHead(createdAt: number): void { + /** Update in-memory + persisted watermark and the canonical head tuple. */ + private recordRemoteHead(createdAt: number, eventId: string): void { if (createdAt > this.lastRemoteCreatedAt) { this.lastRemoteCreatedAt = createdAt; } + // Track the canonical-best head (`created_at DESC, id ASC`): a later head + // always wins; a same-second head wins only with a strictly-lower id. This + // mirrors the relay's stored winner so a frozen baseline reflects reality. + if ( + createdAt > this.lastRemoteHead.createdAt || + (createdAt === this.lastRemoteHead.createdAt && + (this.lastRemoteHead.eventId === "" || + eventId < this.lastRemoteHead.eventId)) + ) { + this.lastRemoteHead = { createdAt, eventId }; + } advanceWatermark(this.pubkey, BLOB_TYPE, this.relayUrl, createdAt); } @@ -176,7 +221,7 @@ export class ChannelSectionSyncManager { * and always safe) so the newer edit stamps above this head. */ private adoptRemote(remote: RemoteSections, gen: number): void { - this.recordRemoteHead(remote.createdAt); + this.recordRemoteHead(remote.createdAt, remote.eventId); if (gen !== this.pendingGeneration) return; this.pendingStore = null; clearChannelSectionsOutbox(this.pubkey, this.relayUrl); @@ -200,6 +245,13 @@ export class ChannelSectionSyncManager { publishSections(store: ChannelSectionStore): void { this.pendingStore = store; const gen = ++this.pendingGeneration; + // Freeze the canonical head this edit is racing against. The pre-publish + // check compares the fetched head against this baseline, not the mutable + // watermark — a live event applied during the debounce window advances the + // watermark to the new head, which would otherwise make the pre-publish + // comparison see equality and fall through to a publish that overwrites a + // remote that became head *after* this edit was queued. + this.publishBaseline = { ...this.lastRemoteHead }; // Persist synchronously so an edit made <2s before quit/community-switch // survives teardown and resumes on next mount (fix-3 durable outbox). writeChannelSectionsOutbox(this.pubkey, store, this.relayUrl); @@ -231,18 +283,17 @@ export class ChannelSectionSyncManager { if (events.length === 0 || events[0].pubkey !== this.pubkey) return { kind: "publish", store }; const event = events[0]; - // Snapshot the watermark before advancing it: after recordRemoteHead - // runs, lastRemoteCreatedAt equals event.created_at, so the LWW - // comparison remote.createdAt > lastRemoteCreatedAt would always be - // false and silently suppress the adopt. - const headBeforeFetch = this.lastRemoteCreatedAt; - this.recordRemoteHead(event.created_at); const remote = await decryptAndParse(event); + // Record the head after decrypt attempt so the watermark/head-tuple + // advance even for an undecryptable payload. + this.recordRemoteHead(event.created_at, event.id); if (!remote) return { kind: "publish", store }; - // Sections use whole-blob LWW: a newer remote head wins, and the local - // edit is adopted-away rather than silently republished as remote content - // while the UI keeps showing the edit. - if (remote.createdAt > headBeforeFetch) { + // Sections use whole-blob LWW. Compare the fetched head against the + // baseline frozen when this edit was queued — NOT the live watermark, + // which a passive live event during debounce may already have advanced to + // this same head. If the canonical head advanced since the edit began, the + // local edit lost and is adopted-away rather than republished over it. + if (remoteAdvancedSince(remote, this.publishBaseline)) { return { kind: "adopt", remote }; } return { kind: "publish", store }; @@ -348,7 +399,7 @@ export class ChannelSectionSyncManager { "Timed out publishing channel sections.", "Failed to publish channel sections.", ); - this.recordRemoteHead(event.created_at); + this.recordRemoteHead(event.created_at, event.id); // Only claim this store as the published head if it is still the current // edit; a newer edit queued mid-flight owns lastPublishedStore now. if (gen === this.pendingGeneration) { @@ -393,7 +444,7 @@ export class ChannelSectionSyncManager { if (event.pubkey !== this.pubkey) return; // Record the raw head before decrypt so an undecryptable live event // still advances the watermark and blocks future seed-publish. - this.recordRemoteHead(event.created_at); + this.recordRemoteHead(event.created_at, event.id); void decryptAndParse(event).then((result) => { if (result) { onUpdate(result); diff --git a/desktop/src/features/sidebar/lib/channelStarsStorage.ts b/desktop/src/features/sidebar/lib/channelStarsStorage.ts index 43c845cb3bd..2163dfe6356 100644 --- a/desktop/src/features/sidebar/lib/channelStarsStorage.ts +++ b/desktop/src/features/sidebar/lib/channelStarsStorage.ts @@ -111,6 +111,30 @@ export function writeChannelStarsStore( export function mergeStores( local: ChannelStarStore, remote: ChannelStarStore, +): ChannelStarStore { + return mergeStoresWithTie(local, remote, false); +} + +/** + * Merge a remote store that has already won the event-level canonical tie-break + * (`created_at DESC, id ASC`) into the local store, resolving a per-entry + * `updatedAt` tie in favour of the *remote* value. Once the comparator has + * chosen this remote event as the stored winner, its per-entry values must + * survive, or a stale value from a superseded larger-id event delivered first + * would win the merge and silently undo the canonical winner. Strictly-newer + * local per-entry edits (`l.updatedAt > r.updatedAt`) still win. + */ +export function mergeApplyingRemote( + local: ChannelStarStore, + remote: ChannelStarStore, +): ChannelStarStore { + return mergeStoresWithTie(local, remote, true); +} + +function mergeStoresWithTie( + local: ChannelStarStore, + remote: ChannelStarStore, + preferRemoteOnTie: boolean, ): ChannelStarStore { const allIds = new Set([ ...Object.keys(local.channels), @@ -121,7 +145,10 @@ export function mergeStores( const l = local.channels[id]; const r = remote.channels[id]; if (l && r) { - merged[id] = l.updatedAt >= r.updatedAt ? l : r; + const localWins = preferRemoteOnTie + ? l.updatedAt > r.updatedAt + : l.updatedAt >= r.updatedAt; + merged[id] = localWins ? l : r; } else { merged[id] = (l ?? r) as ChannelStarEntry; } diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs index a3610d7678b..99b36789bb2 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs @@ -163,3 +163,89 @@ test("equal-timestamp tie-break applies the lower event id (relay canonical winn window.__TAURI_INTERNALS__ = origTauri; } }); + +// Pass-2 finding 2: the comparator admitting the canonical lower id is +// necessary but not sufficient. Mutes are a per-entry store, so applyRemote +// merges the incoming blob into local state. On the SAME channel, a stale +// larger-id event delivered first (muted=true) must not survive the merge once +// the canonical lower-id winner (muted=false) arrives at the same entry +// `updatedAt`. Mutation: reverting the apply path to mergeStores (local/prev +// wins on tie) keeps the stale muted=true value. +test("canonical lower-id unmute replaces a stale larger-id mute at equal entry timestamp", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelMutes } = await import("./useChannelMutes.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // Both events target the SAME channel `shared` at the same entry updatedAt. + // The larger id `bbbb` says muted; the canonical lower id `aaaa` says not. + window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") { + const canonicalLowerId = args?.ciphertext === "aaaa"; + return Promise.resolve( + JSON.stringify({ + version: 1, + channels: { shared: { muted: !canonicalLowerId, updatedAt: 100 } }, + }), + ); + } + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-mute-shared-tie"; + const relayUrl = "wss://r.tie"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + const deliver = async (id) => { + await act(async () => { + live({ + id, + pubkey, + created_at: 1000, + content: id, + kind: 30078, + tags: [["d", "channel-mutes"]], + sig: "s", + }); + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + }; + + await deliver("bbbb"); // stale larger-id head says muted + await deliver("aaaa"); // canonical lower-id winner says unmuted + + assert.equal( + hook.result.current.mutedChannelIds.has("shared"), + false, + "canonical lower-id unmute must replace the stale larger-id mute", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.ts b/desktop/src/features/sidebar/lib/useChannelMutes.ts index 85ec9aeb8e3..75712b0dbb9 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.ts +++ b/desktop/src/features/sidebar/lib/useChannelMutes.ts @@ -4,7 +4,7 @@ import { relayClient } from "@/shared/api/relayClient"; import { boundMuteStore, DEFAULT_STORE, - mergeStores, + mergeApplyingRemote, mutedChannelIdsFromStore, readChannelMutesStore, storageKey, @@ -85,7 +85,7 @@ export function useChannelMutes( lastAppliedRemoteTs.current = remote.createdAt; lastAppliedEventId.current = remote.eventId; managerRef.current?.cancelPendingMutePublish(); - const merged = mergeStores(prev, remote.store); + const merged = mergeApplyingRemote(prev, remote.store); if (!writeChannelMutesStore(pubkey, merged)) return prev; return merged; }; diff --git a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs index 7ed562e3a00..b2b2b4f0b8b 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs @@ -163,3 +163,91 @@ test("equal-timestamp tie-break applies the lower event id (relay canonical winn window.__TAURI_INTERNALS__ = origTauri; } }); + +// Pass-2 finding 2: the comparator admitting the canonical lower id is +// necessary but not sufficient. Stars are a per-entry store, so applyRemote +// merges the incoming blob into local state. On the SAME channel, a stale +// larger-id event delivered first (starred=true) must not survive the merge +// once the canonical lower-id winner (starred=false) arrives at the same entry +// `updatedAt`. Mutation: reverting the apply path to mergeStores (local/prev +// wins on tie) keeps the stale starred=true value. +test("canonical lower-id unstar replaces a stale larger-id star at equal entry timestamp", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelStars } = await import("./useChannelStars.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // Both events target the SAME channel `shared` at the same entry updatedAt. + // The larger id `bbbb` says starred; the canonical lower id `aaaa` says not. + window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") { + const canonicalLowerId = args?.ciphertext === "aaaa"; + return Promise.resolve( + JSON.stringify({ + version: 1, + channels: { + shared: { starred: !canonicalLowerId, updatedAt: 100 }, + }, + }), + ); + } + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-star-shared-tie"; + const relayUrl = "wss://r.tie"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelStars(pubkey, relayUrl)); + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + const deliver = async (id) => { + await act(async () => { + live({ + id, + pubkey, + created_at: 1000, + content: id, + kind: 30078, + tags: [["d", "channel-stars"]], + sig: "s", + }); + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + }; + + await deliver("bbbb"); // stale larger-id head says starred + await deliver("aaaa"); // canonical lower-id winner says unstarred + + assert.equal( + hook.result.current.starredChannelIds.has("shared"), + false, + "canonical lower-id unstar must replace the stale larger-id star", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelStars.ts b/desktop/src/features/sidebar/lib/useChannelStars.ts index d3d4b8f8fb7..5ff44d3ccc0 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.ts +++ b/desktop/src/features/sidebar/lib/useChannelStars.ts @@ -4,7 +4,7 @@ import { relayClient } from "@/shared/api/relayClient"; import { boundStarStore, DEFAULT_STORE, - mergeStores, + mergeApplyingRemote, readChannelStarsStore, starredChannelIdsFromStore, storageKey, @@ -85,7 +85,7 @@ export function useChannelStars( lastAppliedRemoteTs.current = remote.createdAt; lastAppliedEventId.current = remote.eventId; managerRef.current?.cancelPendingStarPublish(); - const merged = mergeStores(prev, remote.store); + const merged = mergeApplyingRemote(prev, remote.store); if (!writeChannelStarsStore(pubkey, merged)) return prev; return merged; }; From cabd3ca9351d31395a72eea51b7223b11295d22f Mon Sep 17 00:00:00 2001 From: Duncan Date: Sat, 22 Aug 2026 15:04:43 -0400 Subject: [PATCH 5/7] fix(sidebar): serialize section publishes and scope remote-tie merge Each prior round patched one cross-generation interleaving and opened another a layer deeper. Kill the race class structurally instead. Sections: serialize publish cycles (one in-flight at a time; a newer edit queued mid-cycle defers and the completion re-drives it). The per-edit pre-publish baseline is frozen at queue time, so a genuine remote observed during the debounce window still adopts, while our own accepted head is folded forward via canonicalMax so a stale generation's own write is never mistaken for a competing remote and adopted away. Dual generation guards in doPublish (post-fetch and pre-publish) stop a stale generation signing or publishing after a newer edit exists. Stars/mutes: scope mergeApplyingRemote (remote-wins on entry-tie) and the pending-publish cancel to fire only on a canonical supersession of an already-applied same-timestamp larger-id head. Every other application (bootstrap/live/newer-timestamp) keeps local-wins mergeStores and does not cancel the pending publish, so a later same-second local click is no longer clobbered by an older remote entry that decrypts late. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../sidebar/lib/channelSectionsSync.test.mjs | 194 ++++++++++++++++++ .../sidebar/lib/channelSectionsSync.ts | 107 ++++++++-- .../sidebar/lib/useChannelMutes.test.mjs | 104 ++++++++++ .../features/sidebar/lib/useChannelMutes.ts | 22 +- .../sidebar/lib/useChannelStars.test.mjs | 104 ++++++++++ .../features/sidebar/lib/useChannelStars.ts | 22 +- 6 files changed, 537 insertions(+), 16 deletions(-) diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs index 491ddbb7f23..4b9c619778c 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs @@ -636,3 +636,197 @@ test("live remote during debounce is adopted at pre-publish, not overwritten", a mock.reset(); } }); + +// 8. Serialized generations (fix round 3, pass-3 finding 1): an older in-flight +// publish that completes after a newer edit is queued must NOT be mistaken +// for a remote that advanced past the newer edit's baseline. A blocks in +// publishEvent; B is queued; A succeeds; B's pre-publish fetch returns A's +// accepted head. Because the baseline is frozen at B's own cycle start — +// after A's completion recorded its head — B publishes above A instead of +// adopting it. Mutation: freezing the baseline at publishSections (before the +// prior cycle completes) makes B see A as a post-baseline remote and adopt it. +test("serialized generations: older completion does not make the newer edit adopt it", async () => { + let releaseFirst = null; + let publishCalls = 0; + let storedHead = []; + mock.method(relayClient, "fetchEvents", () => Promise.resolve(storedHead)); + mock.method(relayClient, "publishEvent", (event) => { + publishCalls++; + if (publishCalls === 1) { + // A's publish blocks; when it resolves, its event becomes the stored head + // the next pre-publish fetch will return. + return new Promise((res) => { + releaseFirst = () => { + storedHead = [ + { + id: "event-a", + pubkey: "pk-serial", + content: "good-cipher", + created_at: event.created_at, + kind: 30078, + tags: [["d", "channel-sections"]], + sig: "s", + }, + ]; + res(); + }; + }); + } + return Promise.resolve(); + }); + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const fakeWindow = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + const fireDelay = async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + for (let i = 0; i < 100; i++) await Promise.resolve(); + }; + const restore = installFakeWindow(fakeWindow); + // A's decrypted head must parse; the pre-publish check reads its created_at/id. + const tauri = installTauriMock( + JSON.stringify({ + version: 1, + sections: [{ id: "a", name: "A", order: 0 }], + assignments: {}, + }), + ); + try { + const manager = new ChannelSectionSyncManager("pk-serial", RELAY); + const adopted = []; + manager.setOnRemoteAdopted((remote) => adopted.push(remote.eventId)); + + manager.publishSections( + makeSectionsStore([{ id: "a", name: "A", order: 0 }]), + ); + await fireDelay(2000); // A's cycle → publishEvent(A) blocks + while (releaseFirst === null) await Promise.resolve(); + + // B is queued while A is still in flight; its cycle must defer. + manager.publishSections( + makeSectionsStore([{ id: "b", name: "B", order: 0 }]), + ); + assert.deepEqual( + manager.getPendingStore()?.sections.map((s) => s.id), + ["b"], + "B is the pending edit while A is in flight", + ); + + releaseFirst(); // A completes, recording its head; the freed lane drives B + for (let i = 0; i < 100; i++) await Promise.resolve(); + // If B's cycle did not auto-drive on the freed lane, its debounce timer is + // still pending — fire it. + if ([...timers.values()].some((t) => t.ms === 2000)) await fireDelay(2000); + + assert.deepEqual(adopted, [], "B must not adopt the older generation A"); + assert.equal( + publishCalls, + 2, + "B publishes above A rather than adopting A's accepted head", + ); + assert.equal( + manager.getPendingStore(), + null, + "B's pending clears via its own successful publish, not A's completion", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// 9. Serialized generations (fix round 3, pass-3 finding 1): a stale generation +// must never sign/publish after a newer edit is queued. A blocks in the +// pre-publish fetch; B is queued during that await; A must abort before +// signing. Mutation: dropping the post-fetch generation re-check in doPublish +// lets the stale A continue to publishEvent. +test("serialized generations: a stale generation aborts before publishing", async () => { + let releaseFetch = null; + const publishCalls = []; + mock.method( + relayClient, + "fetchEvents", + () => + new Promise((res) => { + releaseFetch = () => res([]); + }), + ); + mock.method(relayClient, "publishEvent", (...args) => { + publishCalls.push(args); + return Promise.resolve(); + }); + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const fakeWindow = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + const fireDelay = async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + for (let i = 0; i < 100; i++) await Promise.resolve(); + }; + const restore = installFakeWindow(fakeWindow); + const tauri = installTauriMock("{}"); + try { + const manager = new ChannelSectionSyncManager("pk-stale", RELAY); + manager.publishSections( + makeSectionsStore([{ id: "a", name: "A", order: 0 }]), + ); + await fireDelay(2000); // A's cycle → doPublish(A) awaits fetchEvents + while (releaseFetch === null) await Promise.resolve(); + + // B is queued while A is blocked in its pre-publish fetch. + manager.publishSections( + makeSectionsStore([{ id: "b", name: "B", order: 0 }]), + ); + + releaseFetch(); // A's fetch resolves; A must see gen moved and abort + for (let i = 0; i < 100; i++) await Promise.resolve(); + + assert.equal( + publishCalls.length, + 0, + "stale generation A must not sign/publish after B was queued", + ); + assert.deepEqual( + manager.getPendingStore()?.sections.map((s) => s.id), + ["b"], + "B remains the pending edit, owning convergence", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.ts b/desktop/src/features/sidebar/lib/channelSectionsSync.ts index b0fe7b36645..fdf1e4453e3 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.ts +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.ts @@ -85,6 +85,22 @@ function remoteAdvancedSince( ); } +/** + * True when tuple `a` is the canonical winner over `b` (`created_at DESC, + * id ASC`). An empty id means "no head seen yet" and always loses. + */ +function canonicalGreater(a: PublishBaseline, b: PublishBaseline): boolean { + if (a.eventId === "") return false; + if (b.eventId === "") return true; + if (a.createdAt !== b.createdAt) return a.createdAt > b.createdAt; + return a.eventId < b.eventId; +} + +/** The canonical-greater of two head tuples (`created_at DESC, id ASC`). */ +function canonicalMax(a: PublishBaseline, b: PublishBaseline): PublishBaseline { + return canonicalGreater(a, b) ? a : b; +} + async function decryptAndParse( event: RelayEvent, ): Promise { @@ -110,6 +126,14 @@ export class ChannelSectionSyncManager { // whether the head advanced *since the edit was queued*, independent of the // mutable watermark that a live event during the debounce window may advance. private lastRemoteHead: PublishBaseline = { createdAt: 0, eventId: "" }; + // The canonical head this pending edit is racing against, frozen when the + // edit was queued (publishSections) and advanced ONLY by our own successful + // publishes. Freezing at queue time is what makes a genuine remote observed + // during the debounce window still adopt-worthy (pass-2): the mutable + // watermark advanced to that remote, but the baseline did not. Folding our + // own published head forward is what stops a newer edit from adopting an + // older generation's own accepted write (pass-3): our prior publish is our + // baseline, not a competing remote. private publishBaseline: PublishBaseline = { createdAt: 0, eventId: "" }; private pendingStore: ChannelSectionStore | null = null; // Monotonic id for the current pending edit. Every publishSections() bumps @@ -118,6 +142,13 @@ export class ChannelSectionSyncManager { // compare-and-swap on this generation, so an older in-flight publish can // never erase a newer edit that arrived while it was in flight. private pendingGeneration = 0; + // Publish cycles are serialized: at most one runs at a time. A newer edit + // queued while a cycle is in flight does NOT start its own concurrent cycle; + // it defers, and the in-flight cycle's completion schedules it. Serialization + // guarantees there is never more than one baseline/fetch/publish sequence + // touching shared manager state, so a stale generation can never sign or + // publish after a newer edit exists. + private publishInFlight = false; private lastPublishedStore: ChannelSectionStore | null = null; private destroyed = false; // Set by the hook so an adopted remote head (local edit lost LWW, or a relay @@ -244,13 +275,16 @@ export class ChannelSectionSyncManager { publishSections(store: ChannelSectionStore): void { this.pendingStore = store; - const gen = ++this.pendingGeneration; - // Freeze the canonical head this edit is racing against. The pre-publish - // check compares the fetched head against this baseline, not the mutable - // watermark — a live event applied during the debounce window advances the - // watermark to the new head, which would otherwise make the pre-publish - // comparison see equality and fall through to a publish that overwrites a - // remote that became head *after* this edit was queued. + ++this.pendingGeneration; + // Freeze the canonical head this edit is racing against at queue time. The + // pre-publish check compares the fetched head against this baseline, not the + // mutable watermark — a live event applied during the debounce window + // advances the watermark to a new remote head, which would otherwise make + // the pre-publish comparison see equality and fall through to a publish that + // overwrites a remote that became head *after* this edit was queued. The + // baseline only advances via our own successful publishes (see doPublish), + // so a prior generation's own accepted write is folded in rather than + // mistaken for a competing remote. this.publishBaseline = { ...this.lastRemoteHead }; // Persist synchronously so an edit made <2s before quit/community-switch // survives teardown and resumes on next mount (fix-3 durable outbox). @@ -266,10 +300,40 @@ export class ChannelSectionSyncManager { this.retryDelayMs = RETRY_BASE_MS; this.debounceTimer = window.setTimeout(() => { this.debounceTimer = null; - void this.doPublish(store, gen); + this.startCycle(); }, DEBOUNCE_MS); } + /** + * Serialize publish cycles: at most one runs at a time. A debounce/retry + * timer that fires while a cycle is in flight defers — the in-flight cycle's + * completion re-drives if a pending edit still needs publishing. This kills + * the cross-generation race class by construction: a newer edit queued during + * a cycle cannot start its own concurrent cycle, so there is never more than + * one baseline/fetch/publish sequence competing over shared manager state. + */ + private startCycle(): void { + if (this.destroyed || this.pendingStore === null) return; + if (this.publishInFlight) return; + const store = this.pendingStore; + const gen = this.pendingGeneration; + this.publishInFlight = true; + void this.doPublish(store, gen).finally(() => { + this.publishInFlight = false; + // A newer edit queued during the cycle (or a cycle that ended without + // clearing its pending edit) still needs publishing and has no timer + // pending to drive it — drive the next cycle now that the lane is free. + if ( + !this.destroyed && + this.pendingStore !== null && + this.debounceTimer === null && + this.retryTimer === null + ) { + this.startCycle(); + } + }); + } + private async fetchOwnBlobBeforePublish( store: ChannelSectionStore, ): Promise { @@ -335,12 +399,11 @@ export class ChannelSectionSyncManager { // A newer edit has superseded this one; its own timer owns the retry. if (gen !== this.pendingGeneration) return; if (this.retryTimer !== null) return; - const store = this.pendingStore; const delay = this.retryDelayMs; this.retryDelayMs = Math.min(this.retryDelayMs * 2, RETRY_MAX_MS); this.retryTimer = window.setTimeout(() => { this.retryTimer = null; - void this.doPublish(store, gen); + this.startCycle(); }, delay); } @@ -357,6 +420,11 @@ export class ChannelSectionSyncManager { // was awaited (community switch during in-flight fetch). If so, abort // before touching the relay. if (this.destroyed) return; + // A newer edit was queued while we awaited the pre-publish fetch. It owns + // convergence now; abort so we neither publish this stale store nor adopt + // over the newer pending edit. The serialized cycle re-drives for the + // newer generation once this one unwinds. + if (gen !== this.pendingGeneration) return; if (decision.kind === "adopt") { this.adoptRemote(decision.remote, gen); return; @@ -392,14 +460,29 @@ export class ChannelSectionSyncManager { }); // Final guard immediately before the network call — sign/encrypt are // synchronous-ish but cheap; the relay socket may have moved to a - // different community by the time we reach this point. - if (this.destroyed) return; + // different community by the time we reach this point, or a newer edit + // may have been queued during the encrypt/sign await (invariant: a stale + // generation never signs/publishes after a newer edit exists). + if (this.destroyed || gen !== this.pendingGeneration) return; await relayClient.publishEvent( event, "Timed out publishing channel sections.", "Failed to publish channel sections.", ); this.recordRemoteHead(event.created_at, event.id); + // Fold our own accepted head into the pending edit's baseline. This is + // unconditional across generations: even a stale generation's own write, + // completing after a newer edit was queued, must advance the current + // pending baseline so the newer edit's pre-publish check does not mistake + // OUR prior publish for a competing remote and adopt it away (pass-3). + // Genuine remotes never fold in here — they only advance the watermark — + // so a remote that became head during the debounce window still adopts + // (pass-2). canonicalMax keeps the advance monotonic (`created_at DESC, + // id ASC`). + this.publishBaseline = canonicalMax(this.publishBaseline, { + createdAt: event.created_at, + eventId: event.id, + }); // Only claim this store as the published head if it is still the current // edit; a newer edit queued mid-flight owns lastPublishedStore now. if (gen === this.pendingGeneration) { diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs index 99b36789bb2..5691f4b41b8 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs @@ -249,3 +249,107 @@ test("canonical lower-id unmute replaces a stale larger-id mute at equal entry t window.__TAURI_INTERNALS__ = origTauri; } }); + +// Fix round 3 (pass-3 finding 2): the remote-wins entry-tie merge and the +// pending-publish cancel apply ONLY to a canonical supersession (a lower id at +// the same event timestamp correcting an already-applied larger id). A plain +// live/bootstrap remote must NOT clobber a later same-second local click or +// cancel its pending publish. Entry `updatedAt` is whole seconds, so a click at +// 100.9s and an older remote entry at 100.1s both carry `updatedAt:100`; the +// later local intent must win and keep publishing. Mutation: applying +// mergeApplyingRemote + cancel unconditionally lets the delayed remote overwrite +// the click and drop its publish. +test("delayed same-second remote does not clobber a later local mute or cancel its publish", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelMutes } = await import("./useChannelMutes.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + const origSetTimeout = window.setTimeout; + const origClearTimeout = window.clearTimeout; + const origDateNow = Date.now; + + const timers = new Map(); + let nextTimer = 1; + window.setTimeout = (fn, ms) => { + const id = nextTimer++; + timers.set(id, { fn, ms }); + return id; + }; + window.clearTimeout = (id) => timers.delete(id); + // The local click happens later within second 100. + Date.now = () => 100_900; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // The delayed remote entry sits earlier in the same second and says unmuted. + window.__TAURI_INTERNALS__ = { + invoke: (cmd) => { + if (cmd === "nip44_decrypt_from_self") + return Promise.resolve( + JSON.stringify({ + version: 1, + channels: { shared: { muted: false, updatedAt: 100 } }, + }), + ); + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-mute-same-second"; + const relayUrl = "wss://r.same"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + // Local optimistic click: muted=true at updatedAt=100 (Date.now=100.9s). + await act(async () => { + hook.result.current.muteChannel("shared"); + }); + // An older remote entry from the same second decrypts and applies late. + await act(async () => { + live({ + id: "remote-before-click", + pubkey, + created_at: 100, + content: "remote", + kind: 30078, + tags: [["d", "channel-mutes"]], + sig: "s", + }); + for (let i = 0; i < 40; i++) await Promise.resolve(); + }); + + assert.equal( + hook.result.current.mutedChannelIds.has("shared"), + true, + "a later same-second local click must survive a delayed older remote", + ); + assert.ok( + [...timers.values()].some((t) => t.ms === 2000), + "the local pending publish must remain scheduled", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + window.setTimeout = origSetTimeout; + window.clearTimeout = origClearTimeout; + Date.now = origDateNow; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.ts b/desktop/src/features/sidebar/lib/useChannelMutes.ts index 75712b0dbb9..6f87a77b49f 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.ts +++ b/desktop/src/features/sidebar/lib/useChannelMutes.ts @@ -5,6 +5,7 @@ import { boundMuteStore, DEFAULT_STORE, mergeApplyingRemote, + mergeStores, mutedChannelIdsFromStore, readChannelMutesStore, storageKey, @@ -82,10 +83,27 @@ export function useChannelMutes( remote.eventId >= lastAppliedEventId.current ) return prev; + // A canonical supersession corrects an already-applied same-timestamp + // LARGER-id head with the true winner: only here may the incoming blob's + // per-entry values win an equal-`updatedAt` tie, and only here does the + // pending publish (which reflected the superseded head) get cancelled. + // Any other application (bootstrap / live / newer timestamp) merges over + // optimistic local state with local-wins `mergeStores` and must NOT + // cancel a pending local publish — otherwise a later same-second local + // click (integer-second `updatedAt`) loses to an older remote entry that + // decrypts late, and its publish is silently dropped. + const isCanonicalSupersession = + remote.createdAt === lastAppliedRemoteTs.current && + lastAppliedEventId.current !== "" && + remote.eventId < lastAppliedEventId.current; lastAppliedRemoteTs.current = remote.createdAt; lastAppliedEventId.current = remote.eventId; - managerRef.current?.cancelPendingMutePublish(); - const merged = mergeApplyingRemote(prev, remote.store); + const merged = isCanonicalSupersession + ? mergeApplyingRemote(prev, remote.store) + : mergeStores(prev, remote.store); + if (isCanonicalSupersession) { + managerRef.current?.cancelPendingMutePublish(); + } if (!writeChannelMutesStore(pubkey, merged)) return prev; return merged; }; diff --git a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs index b2b2b4f0b8b..e2dcf8349b0 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs @@ -251,3 +251,107 @@ test("canonical lower-id unstar replaces a stale larger-id star at equal entry t window.__TAURI_INTERNALS__ = origTauri; } }); + +// Fix round 3 (pass-3 finding 2): the remote-wins entry-tie merge and the +// pending-publish cancel apply ONLY to a canonical supersession (a lower id at +// the same event timestamp correcting an already-applied larger id). A plain +// live/bootstrap remote must NOT clobber a later same-second local click or +// cancel its pending publish. Entry `updatedAt` is whole seconds, so a click at +// 100.9s and an older remote entry at 100.1s both carry `updatedAt:100`; the +// later local intent must win and keep publishing. Mutation: applying +// mergeApplyingRemote + cancel unconditionally lets the delayed remote overwrite +// the click and drop its publish. +test("delayed same-second remote does not clobber a later local star or cancel its publish", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelStars } = await import("./useChannelStars.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + const origSetTimeout = window.setTimeout; + const origClearTimeout = window.clearTimeout; + const origDateNow = Date.now; + + const timers = new Map(); + let nextTimer = 1; + window.setTimeout = (fn, ms) => { + const id = nextTimer++; + timers.set(id, { fn, ms }); + return id; + }; + window.clearTimeout = (id) => timers.delete(id); + // The local click happens later within second 100. + Date.now = () => 100_900; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // The delayed remote entry sits earlier in the same second and says unstarred. + window.__TAURI_INTERNALS__ = { + invoke: (cmd) => { + if (cmd === "nip44_decrypt_from_self") + return Promise.resolve( + JSON.stringify({ + version: 1, + channels: { shared: { starred: false, updatedAt: 100 } }, + }), + ); + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-star-same-second"; + const relayUrl = "wss://r.same"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelStars(pubkey, relayUrl)); + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + // Local optimistic click: starred=true at updatedAt=100 (Date.now=100.9s). + await act(async () => { + hook.result.current.starChannel("shared"); + }); + // An older remote entry from the same second decrypts and applies late. + await act(async () => { + live({ + id: "remote-before-click", + pubkey, + created_at: 100, + content: "remote", + kind: 30078, + tags: [["d", "channel-stars"]], + sig: "s", + }); + for (let i = 0; i < 40; i++) await Promise.resolve(); + }); + + assert.equal( + hook.result.current.starredChannelIds.has("shared"), + true, + "a later same-second local click must survive a delayed older remote", + ); + assert.ok( + [...timers.values()].some((t) => t.ms === 2000), + "the local pending publish must remain scheduled", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + window.setTimeout = origSetTimeout; + window.clearTimeout = origClearTimeout; + Date.now = origDateNow; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelStars.ts b/desktop/src/features/sidebar/lib/useChannelStars.ts index 5ff44d3ccc0..a3da782c607 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.ts +++ b/desktop/src/features/sidebar/lib/useChannelStars.ts @@ -5,6 +5,7 @@ import { boundStarStore, DEFAULT_STORE, mergeApplyingRemote, + mergeStores, readChannelStarsStore, starredChannelIdsFromStore, storageKey, @@ -82,10 +83,27 @@ export function useChannelStars( remote.eventId >= lastAppliedEventId.current ) return prev; + // A canonical supersession corrects an already-applied same-timestamp + // LARGER-id head with the true winner: only here may the incoming blob's + // per-entry values win an equal-`updatedAt` tie, and only here does the + // pending publish (which reflected the superseded head) get cancelled. + // Any other application (bootstrap / live / newer timestamp) merges over + // optimistic local state with local-wins `mergeStores` and must NOT + // cancel a pending local publish — otherwise a later same-second local + // click (integer-second `updatedAt`) loses to an older remote entry that + // decrypts late, and its publish is silently dropped. + const isCanonicalSupersession = + remote.createdAt === lastAppliedRemoteTs.current && + lastAppliedEventId.current !== "" && + remote.eventId < lastAppliedEventId.current; lastAppliedRemoteTs.current = remote.createdAt; lastAppliedEventId.current = remote.eventId; - managerRef.current?.cancelPendingStarPublish(); - const merged = mergeApplyingRemote(prev, remote.store); + const merged = isCanonicalSupersession + ? mergeApplyingRemote(prev, remote.store) + : mergeStores(prev, remote.store); + if (isCanonicalSupersession) { + managerRef.current?.cancelPendingStarPublish(); + } if (!writeChannelStarsStore(pubkey, merged)) return prev; return merged; }; From d0c23c99b5dc9de75bf26d275cd128469f65b9a4 Mon Sep 17 00:00:00 2001 From: Duncan Date: Mon, 24 Aug 2026 15:27:20 -0400 Subject: [PATCH 6/7] fix(sidebar): overlay local edits on canonical correction and fold ambiguous-ACK heads Round-4 client-side convergence fixes for channel-sections/stars/mutes sync, closing two silent edit-loss variants that survived publish serialization. Ambiguous-ACK fold: a publish whose ACK is lost may still have been accepted by the relay. Retain each attempt's signed id; when a later cycle's pre-publish fetch returns a head whose id matches a prior attempt, fold it forward as our own accepted predecessor and publish above it instead of adopting it away and erasing the queued edit. A head the relay never accepted can never surface by id, so the fold is proof-gated on an exact id match. Canonical-supersession dirty overlay (stars + mutes): a lower-id canonical correction that arrives after a same-second local click must not clobber the click. Apply the correction to the prior remote layer, then overlay entries changed locally since that layer; never cancel a pending publish merely because a correction arrived. Client-only: loss discovery relies on the existing pre-publish fetch, live subscription, and reconcile loop rather than a relay conflict signal. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../sidebar/lib/channelMutesStorage.ts | 27 ++ .../sidebar/lib/channelSectionsSync.test.mjs | 393 +++++++++++++++--- .../sidebar/lib/channelSectionsSync.ts | 67 +-- .../sidebar/lib/channelStarsStorage.ts | 27 ++ .../sidebar/lib/useChannelMutes.test.mjs | 111 +++++ .../features/sidebar/lib/useChannelMutes.ts | 43 +- .../sidebar/lib/useChannelSections.ts | 8 +- .../sidebar/lib/useChannelStars.test.mjs | 113 +++++ .../features/sidebar/lib/useChannelStars.ts | 43 +- 9 files changed, 726 insertions(+), 106 deletions(-) diff --git a/desktop/src/features/sidebar/lib/channelMutesStorage.ts b/desktop/src/features/sidebar/lib/channelMutesStorage.ts index e8de164f784..90ede83eb14 100644 --- a/desktop/src/features/sidebar/lib/channelMutesStorage.ts +++ b/desktop/src/features/sidebar/lib/channelMutesStorage.ts @@ -156,6 +156,33 @@ function mergeStoresWithTie( return boundMuteStore({ version: 1, channels: merged }); } +/** + * Apply a canonical lower-id correction (`mergeApplyingRemote`: remote wins a + * per-entry `updatedAt` tie) while preserving entries the user changed locally + * since the superseded head was applied. The correction canonicalises remote + * history, but a same-second local click carries integer-second `updatedAt` + * equal to the remote's, so the plain remote-wins tie would silently clobber + * it. For each `dirtyId` the local entry wins only the tie (`l.updatedAt >= + * r.updatedAt`) — a genuinely newer remote value still wins, so a stale dirty + * id can never override a later correction. + */ +export function mergeCanonicalSupersession( + local: ChannelMuteStore, + remote: ChannelMuteStore, + dirtyIds: ReadonlySet, +): ChannelMuteStore { + const applied = mergeApplyingRemote(local, remote); + if (dirtyIds.size === 0) return applied; + const channels = { ...applied.channels }; + for (const id of dirtyIds) { + const l = local.channels[id]; + if (!l) continue; + const r = remote.channels[id]; + if (!r || l.updatedAt >= r.updatedAt) channels[id] = l; + } + return boundMuteStore({ version: 1, channels }); +} + export function mutedChannelIdsFromStore(store: ChannelMuteStore): Set { return new Set( Object.entries(store.channels) diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs index 4b9c619778c..5e24907ca22 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.test.mjs @@ -339,58 +339,6 @@ test("timestamp clamp: published createdAt stays inside the relay future window" } }); -// 4d. Conflict rejection: relay OK false → refetch head and adopt it. -test("conflict rejection: OK-false conflict refetches head and adopts remote", async () => { - const REMOTE_ID = "remote-after-conflict"; - let fetchCall = 0; - mock.method(relayClient, "fetchEvents", () => { - fetchCall++; - // First fetch (pre-publish): empty → local wins and we publish. - if (fetchCall === 1) return Promise.resolve([]); - // Second fetch (post-conflict refetch): the winning remote head. - return Promise.resolve([ - { - pubkey: "pk-conflict", - content: "good-cipher", - created_at: 500, - id: "evt-winner", - }, - ]); - }); - mock.method(relayClient, "publishEvent", () => - Promise.reject(new Error("conflict: newer version exists")), - ); - const fw = makeFakeWindow(); - const restore = installFakeWindow(fw); - const tauri = installTauriMock( - JSON.stringify({ - version: 1, - sections: [{ id: REMOTE_ID, name: "Remote", order: 0 }], - assignments: {}, - }), - ); - try { - const manager = new ChannelSectionSyncManager("pk-conflict", RELAY); - const adopted = []; - manager.setOnRemoteAdopted((r) => adopted.push(r)); - manager.publishSections( - makeSectionsStore([{ id: "local-s", name: "Local", order: 0 }]), - ); - fw._fireTimer(); - await new Promise((r) => setTimeout(r, 20)); - assert.equal(adopted.length, 1, "conflict must trigger adopt of the head"); - assert.ok( - adopted[0].store.sections.some((s) => s.id === REMOTE_ID), - "adopted store must be the winning remote content", - ); - assert.equal(manager.getPendingStore(), null, "pending cleared on adopt"); - } finally { - tauri.restore(); - restore(); - mock.reset(); - } -}); - // 5. live-sub: undecryptable event on live path records head before decrypt // Mutation test: removing recordRemoteHead before decrypt in the live callback // leaves watermark at 0 after a live event. @@ -830,3 +778,344 @@ test("serialized generations: a stale generation aborts before publishing", asyn mock.reset(); } }); + +// Installs a Tauri mock whose sign_event returns a caller-controlled id per +// call (so overlapping publishes get distinct event ids) and whose +// nip44_encrypt_to_self can be made to block, exposing the encrypt/sign await +// window. `signIds` is consumed in order; the encrypt block is armed on demand. +function installSeamTauriMock(payload, signIds) { + const orig = globalThis.window?.__TAURI_INTERNALS__; + if (typeof globalThis.window === "undefined") globalThis.window = {}; + let signCall = 0; + let releaseEncrypt = null; + let blockNextEncrypt = false; + globalThis.window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") return Promise.resolve(payload); + if (cmd === "nip44_encrypt_to_self") { + if (!blockNextEncrypt) return Promise.resolve("ct"); + blockNextEncrypt = false; + return new Promise((res) => { + releaseEncrypt = () => res("ct"); + }); + } + if (cmd === "sign_event") { + const id = signIds[Math.min(signCall, signIds.length - 1)]; + signCall++; + return Promise.resolve( + JSON.stringify({ + id, + pubkey: "pk", + content: "ct", + created_at: args?.createdAt ?? 0, + kind: args?.kind ?? 0, + tags: args?.tags ?? [], + sig: "s", + }), + ); + } + return Promise.reject(new Error(`unmocked: ${cmd}`)); + }, + }; + return { + restore: () => { + if (orig !== undefined) globalThis.window.__TAURI_INTERNALS__ = orig; + else delete globalThis.window.__TAURI_INTERNALS__; + }, + armEncryptBlock: () => { + blockNextEncrypt = true; + }, + releaseEncrypt: () => releaseEncrypt?.(), + hasEncryptBlocked: () => releaseEncrypt !== null, + }; +} + +// 10. Ambiguous ACK (fix round 4, pass-4 finding 1): the relay accepts A but the +// client's ACK is lost (publish promise rejects as a timeout). B was queued +// mid-flight. When B's pre-publish fetch returns A's accepted head, it must +// recognise A as OUR OWN accepted predecessor — fold it forward and publish +// above it — not adopt it and erase B. Mutation: dropping the +// ambiguousAttemptIds fold makes B classify A as a foreign advance and adopt. +test("ambiguous ACK: an accepted-but-unacked A does not make B adopt and disappear", async () => { + let releaseFirst = null; + let publishCalls = 0; + let storedHead = []; + mock.method(relayClient, "fetchEvents", () => Promise.resolve(storedHead)); + mock.method(relayClient, "publishEvent", (event) => { + publishCalls++; + if (publishCalls === 1) { + // A reaches the relay and is stored, but the ACK never arrives: the + // promise rejects as a timeout after the frame has left. + return new Promise((_res, reject) => { + releaseFirst = () => { + storedHead = [ + { + id: "event-a", + pubkey: "pk-ambiguous", + content: "good-cipher", + created_at: event.created_at, + kind: 30078, + tags: [["d", "channel-sections"]], + sig: "s", + }, + ]; + reject(new Error("Timed out publishing channel sections.")); + }; + }); + } + return Promise.resolve(); + }); + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const fakeWindow = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + const fireDelay = async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + for (let i = 0; i < 100; i++) await Promise.resolve(); + }; + const restore = installFakeWindow(fakeWindow); + const tauri = installSeamTauriMock( + JSON.stringify({ + version: 1, + sections: [{ id: "a", name: "A", order: 0 }], + assignments: {}, + }), + ["event-a", "event-b"], + ); + try { + const manager = new ChannelSectionSyncManager("pk-ambiguous", RELAY); + const adopted = []; + manager.setOnRemoteAdopted((r) => adopted.push(r.eventId)); + + manager.publishSections( + makeSectionsStore([{ id: "a", name: "A", order: 0 }]), + ); + await fireDelay(2000); // A's cycle → publishEvent(A) blocks + while (releaseFirst === null) await Promise.resolve(); + + manager.publishSections( + makeSectionsStore([{ id: "b", name: "B", order: 0 }]), + ); + + releaseFirst(); // A's ACK is lost; A is stored on the relay regardless + for (let i = 0; i < 100; i++) await Promise.resolve(); + if ([...timers.values()].some((t) => t.ms === 2000)) await fireDelay(2000); + for (let i = 0; i < 100; i++) await Promise.resolve(); + + assert.deepEqual( + adopted, + [], + "B must not adopt A when A was accepted but its ACK was lost", + ); + assert.equal( + publishCalls, + 2, + "B publishes above A's ambiguously-accepted head", + ); + assert.equal( + manager.getPendingStore(), + null, + "B's own successful publish clears its pending edit", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// 11. Ambiguous ACK, negative case (fix round 4, pass-4 finding 1): the fold is +// gated on an exact id-match against a prior attempt. An advancing head +// whose id is NOT one of our attempts is a genuine foreign winner and must +// be ADOPTED, never folded. A's ACK is lost (transient) so its id stays in +// the ambiguous set, but the head that surfaces is a DIFFERENT foreign id — +// proof the relay never accepted A. B must adopt the foreign winner, not +// fold it and publish above it. Mutation: dropping the ambiguousAttemptIds +// id-guard (folding any advance) makes B erase the foreign winner. +test("ambiguous ACK: a foreign head is adopted, not folded as our own", async () => { + let publishCalls = 0; + let fetchCalls = 0; + mock.method(relayClient, "fetchEvents", () => { + fetchCalls++; + // 1: A's pre-publish fetch (empty → A publishes, then its ACK times out). + // 2+: B's pre-publish fetch surfaces a FOREIGN winner (id != A's attempt). + if (fetchCalls === 1) return Promise.resolve([]); + return Promise.resolve([ + { + id: "foreign-winner", + pubkey: "pk-reject", + content: "good-cipher", + created_at: 500, + kind: 30078, + tags: [["d", "channel-sections"]], + sig: "s", + }, + ]); + }); + mock.method(relayClient, "publishEvent", () => { + publishCalls++; + // A's ACK is lost as a transient timeout; the relay never stored A. + if (publishCalls === 1) + return Promise.reject( + new Error("Timed out publishing channel sections."), + ); + return Promise.resolve(); + }); + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const fakeWindow = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + const fireDelay = async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + for (let i = 0; i < 100; i++) await Promise.resolve(); + }; + const restore = installFakeWindow(fakeWindow); + const tauri = installSeamTauriMock( + JSON.stringify({ + version: 1, + sections: [{ id: "a", name: "A", order: 0 }], + assignments: {}, + }), + ["event-a", "event-b"], + ); + try { + const manager = new ChannelSectionSyncManager("pk-reject", RELAY); + const adopted = []; + manager.setOnRemoteAdopted((r) => adopted.push(r.eventId)); + + manager.publishSections( + makeSectionsStore([{ id: "a", name: "A", order: 0 }]), + ); + await fireDelay(2000); // A's cycle → publishEvent rejects (ACK lost) + for (let i = 0; i < 100; i++) await Promise.resolve(); + + // B is queued; it supersedes A's scheduled retry. + manager.publishSections( + makeSectionsStore([{ id: "b", name: "B", order: 0 }]), + ); + if ([...timers.values()].some((t) => t.ms === 2000)) await fireDelay(2000); + for (let i = 0; i < 100; i++) await Promise.resolve(); + + assert.deepEqual( + adopted, + ["foreign-winner"], + "B adopts the foreign head; its id is not one of our attempts", + ); + assert.equal( + manager.getPendingStore(), + null, + "adopt clears the pending edit", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// 12. Pre-sign generation guard seam (fix round 4, pass-4 review): the guard +// immediately before signing/publishing (post-encrypt) must be individually +// load-bearing. B arrives DURING A's encrypt/sign await — past the +// post-fetch guard — so only the pre-sign guard can stop A publishing a +// stale store. Mutation: dropping the gen re-check at the pre-sign guard +// lets stale A reach publishEvent after B was queued. +test("serialized generations: a newer edit during encrypt/sign aborts the pre-sign publish", async () => { + const publishCalls = []; + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + mock.method(relayClient, "publishEvent", (event) => { + publishCalls.push(event); + return Promise.resolve(); + }); + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const fakeWindow = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + const fireDelay = async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + for (let i = 0; i < 100; i++) await Promise.resolve(); + }; + const restore = installFakeWindow(fakeWindow); + const tauri = installSeamTauriMock("{}", ["event-a", "event-b"]); + try { + const manager = new ChannelSectionSyncManager("pk-seam", RELAY); + tauri.armEncryptBlock(); // A's encrypt will block, exposing the sign window + manager.publishSections( + makeSectionsStore([{ id: "a", name: "A", order: 0 }]), + ); + await fireDelay(2000); // A's cycle → passes post-fetch guard, blocks in encrypt + while (!tauri.hasEncryptBlocked()) await Promise.resolve(); + + // B is queued while A is mid encrypt/sign — after A's post-fetch guard. + manager.publishSections( + makeSectionsStore([{ id: "b", name: "B", order: 0 }]), + ); + + tauri.releaseEncrypt(); // A resumes; the pre-sign guard must abort it + for (let i = 0; i < 100; i++) await Promise.resolve(); + if ([...timers.values()].some((t) => t.ms === 2000)) await fireDelay(2000); + for (let i = 0; i < 100; i++) await Promise.resolve(); + + assert.equal( + publishCalls.length, + 1, + "only B publishes; stale A aborts at the pre-sign guard", + ); + assert.equal( + publishCalls[0].id, + "event-b", + "the surviving publish is B, not the stale A", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); diff --git a/desktop/src/features/sidebar/lib/channelSectionsSync.ts b/desktop/src/features/sidebar/lib/channelSectionsSync.ts index fdf1e4453e3..b736aa812cf 100644 --- a/desktop/src/features/sidebar/lib/channelSectionsSync.ts +++ b/desktop/src/features/sidebar/lib/channelSectionsSync.ts @@ -149,10 +149,18 @@ export class ChannelSectionSyncManager { // touching shared manager state, so a stale generation can never sign or // publish after a newer edit exists. private publishInFlight = false; + // Event ids we signed and sent to the relay but whose ACK never arrived (the + // publish promise rejected as a timeout/socket error after the frame left). + // The relay MAY have accepted such a write, so if a later cycle's pre-publish + // fetch returns a head whose id is in this set, that head is OUR OWN accepted + // predecessor — fold it forward and publish above it, rather than adopting it + // and erasing the queued edit. An attempt the relay never accepted can never + // surface as the head, so an id match is proof of our own accepted write. + private ambiguousAttemptIds = new Set(); private lastPublishedStore: ChannelSectionStore | null = null; private destroyed = false; - // Set by the hook so an adopted remote head (local edit lost LWW, or a relay - // conflict rejection) is written through to React state + localStorage. + // Set by the hook so an adopted remote head (local edit lost whole-blob LWW) + // is written through to React state + localStorage. private onRemoteAdopted: ((remote: RemoteSections) => void) | null = null; constructor(pubkey: string, relayUrl: string) { @@ -358,6 +366,18 @@ export class ChannelSectionSyncManager { // this same head. If the canonical head advanced since the edit began, the // local edit lost and is adopted-away rather than republished over it. if (remoteAdvancedSince(remote, this.publishBaseline)) { + // Unless the advancing head is a prior publish of OURS whose ACK was + // lost: the relay accepted it, but our promise rejected before we could + // fold it forward, so it is our own accepted predecessor — not a + // competing remote. Fold it into the baseline and publish above it so + // the queued edit survives instead of adopting our own stale write away. + if (this.ambiguousAttemptIds.has(remote.eventId)) { + this.publishBaseline = canonicalMax(this.publishBaseline, { + createdAt: remote.createdAt, + eventId: remote.eventId, + }); + return { kind: "publish", store }; + } return { kind: "adopt", remote }; } return { kind: "publish", store }; @@ -444,7 +464,8 @@ export class ChannelSectionSyncManager { // Clamp inside the relay's future-drift window: never manufacture a // timestamp so far ahead that this or a later publish is rejected for // drift and wedges. If a skewed remote head sits beyond the window we - // will lose LWW and adopt it on conflict rather than walking past it. + // will lose LWW and adopt it on the next pre-publish fetch rather than + // walking past it. const createdAt = Math.min( Math.max(now, this.lastRemoteCreatedAt + 1), now + MAX_PUBLISH_FUTURE_SECS, @@ -464,12 +485,21 @@ export class ChannelSectionSyncManager { // may have been queued during the encrypt/sign await (invariant: a stale // generation never signs/publishes after a newer edit exists). if (this.destroyed || gen !== this.pendingGeneration) return; + // Record this signed id as an in-flight attempt of unknown fate before we + // send it. If the ACK is lost below, a later cycle that fetches this id as + // the head recognises it as our own accepted write and folds it forward + // rather than adopting it away. + this.ambiguousAttemptIds.add(event.id); await relayClient.publishEvent( event, "Timed out publishing channel sections.", "Failed to publish channel sections.", ); this.recordRemoteHead(event.created_at, event.id); + // This write is now the confirmed accepted head; it dominates every prior + // attempt (`created_at DESC, id ASC`), so no earlier ambiguous id can ever + // be the canonical head again. Clear the set to keep it bounded. + this.ambiguousAttemptIds.clear(); // Fold our own accepted head into the pending edit's baseline. This is // unconditional across generations: even a stale generation's own write, // completing after a newer edit was queued, must advance the current @@ -492,22 +522,14 @@ export class ChannelSectionSyncManager { this.discardPending(gen); } catch (error) { if (this.destroyed) return; - // The relay rejects a strictly-losing coordinate write with an OK false - // conflict (fix-4). Treat it as a lost race: refetch the head and adopt - // it so we converge instead of retrying a write that can never win. - if (isConflictRejection(error)) { - const head = await this.fetchRemoteSections(); - if (this.destroyed) return; - if (head.status === "found") { - this.adoptRemote(head.data, gen); - } else { - this.scheduleRetry(gen); - } - return; - } - // Transient failure (timeout / socket error): keep the pending edit and - // retry with backoff rather than waiting for a reconnect that a healthy - // socket never fires. + // Ambiguous outcome: the publish promise rejected (timeout / socket + // error), but the relay may already have accepted the write before the + // ACK was lost. Keep the pending edit and retry with backoff rather than + // waiting for a reconnect that a healthy socket never fires. The attempt + // id stays in ambiguousAttemptIds: if the relay did accept it, a later + // cycle that fetches this id as the head folds it forward as our own + // accepted predecessor (see fetchOwnBlobBeforePublish) instead of + // adopting it away and erasing the queued edit. console.warn("[channelSectionsSync] publish failed:", error); this.scheduleRetry(gen); } @@ -564,10 +586,3 @@ export class ChannelSectionSyncManager { this.pendingStore = null; } } - -/** True when a publish error is the relay's stale-coordinate conflict (fix-4). */ -function isConflictRejection(error: unknown): boolean { - return ( - error instanceof Error && error.message.toLowerCase().includes("conflict") - ); -} diff --git a/desktop/src/features/sidebar/lib/channelStarsStorage.ts b/desktop/src/features/sidebar/lib/channelStarsStorage.ts index 2163dfe6356..23e567f40bf 100644 --- a/desktop/src/features/sidebar/lib/channelStarsStorage.ts +++ b/desktop/src/features/sidebar/lib/channelStarsStorage.ts @@ -156,6 +156,33 @@ function mergeStoresWithTie( return boundStarStore({ version: 1, channels: merged }); } +/** + * Apply a canonical lower-id correction (`mergeApplyingRemote`: remote wins a + * per-entry `updatedAt` tie) while preserving entries the user changed locally + * since the superseded head was applied. The correction canonicalises remote + * history, but a same-second local click carries integer-second `updatedAt` + * equal to the remote's, so the plain remote-wins tie would silently clobber + * it. For each `dirtyId` the local entry wins only the tie (`l.updatedAt >= + * r.updatedAt`) — a genuinely newer remote value still wins, so a stale dirty + * id can never override a later correction. + */ +export function mergeCanonicalSupersession( + local: ChannelStarStore, + remote: ChannelStarStore, + dirtyIds: ReadonlySet, +): ChannelStarStore { + const applied = mergeApplyingRemote(local, remote); + if (dirtyIds.size === 0) return applied; + const channels = { ...applied.channels }; + for (const id of dirtyIds) { + const l = local.channels[id]; + if (!l) continue; + const r = remote.channels[id]; + if (!r || l.updatedAt >= r.updatedAt) channels[id] = l; + } + return boundStarStore({ version: 1, channels }); +} + export function starredChannelIdsFromStore( store: ChannelStarStore, ): Set { diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs index 5691f4b41b8..04c2c836d69 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs @@ -353,3 +353,114 @@ test("delayed same-second remote does not clobber a later local mute or cancel i Date.now = origDateNow; } }); + +// Fix round 4 (pass-4 finding 2): a canonical correction (lower id at the same +// event timestamp) knows the incoming event is the relay's winner, but NOT +// whether the user clicked between the superseded larger-id event and the +// correction. Sequence: stale `bbbb` applies → user clicks mute later in the +// same second → canonical `aaaa` decrypts late. `aaaa` and the click share +// integer `updatedAt`, so the plain remote-wins tie would clobber the click. +// The dirty-entry overlay keeps the click and the cancel is gone, so its +// publish stays scheduled. Mutation: dropping the dirty overlay (plain +// mergeApplyingRemote) lets `aaaa` erase the click; restoring the cancel drops +// its publish timer. +test("canonical correction preserves a same-second local click made after the larger-id event", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelMutes } = await import("./useChannelMutes.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + const origSetTimeout = window.setTimeout; + const origClearTimeout = window.clearTimeout; + const origDateNow = Date.now; + + const timers = new Map(); + let nextTimer = 1; + window.setTimeout = (fn, ms) => { + const id = nextTimer++; + timers.set(id, { fn, ms }); + return id; + }; + window.clearTimeout = (id) => timers.delete(id); + // The local click happens later within second 100. + Date.now = () => 100_900; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // bbbb (stale larger id) says muted; aaaa (canonical lower id) says not. + // Both carry the same entry updatedAt=100, tying the later local click. + window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") { + const canonicalLowerId = args?.ciphertext === "aaaa"; + return Promise.resolve( + JSON.stringify({ + version: 1, + channels: { shared: { muted: !canonicalLowerId, updatedAt: 100 } }, + }), + ); + } + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-mute-canonical-dirty"; + const relayUrl = "wss://r.canon"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + const deliver = async (id, content) => { + await act(async () => { + live({ + id, + pubkey, + created_at: 100, + content, + kind: 30078, + tags: [["d", "channel-mutes"]], + sig: "s", + }); + for (let i = 0; i < 40; i++) await Promise.resolve(); + }); + }; + + await deliver("bbbb", "bbbb"); // stale larger-id head applies (muted) + await act(async () => { + hook.result.current.muteChannel("shared"); // user intent after bbbb + }); + await deliver("aaaa", "aaaa"); // canonical correction decrypts late + + assert.equal( + hook.result.current.mutedChannelIds.has("shared"), + true, + "a same-second local click must survive the canonical correction", + ); + assert.ok( + [...timers.values()].some((t) => t.ms === 2000), + "the local click's pending publish must remain scheduled", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + window.setTimeout = origSetTimeout; + window.clearTimeout = origClearTimeout; + Date.now = origDateNow; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.ts b/desktop/src/features/sidebar/lib/useChannelMutes.ts index 6f87a77b49f..65e7483c587 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.ts +++ b/desktop/src/features/sidebar/lib/useChannelMutes.ts @@ -4,7 +4,7 @@ import { relayClient } from "@/shared/api/relayClient"; import { boundMuteStore, DEFAULT_STORE, - mergeApplyingRemote, + mergeCanonicalSupersession, mergeStores, mutedChannelIdsFromStore, readChannelMutesStore, @@ -34,17 +34,26 @@ export function useChannelMutes( const managerRef = React.useRef(null); const lastAppliedRemoteTs = React.useRef(0); const lastAppliedEventId = React.useRef(""); + // Channels the user changed locally within the current remote second. Their + // integer-second `updatedAt` ties the remote's, so a late canonical + // correction would clobber them on the remote-wins tie; the overlay in + // `mergeCanonicalSupersession` keeps them. Cleared whenever the remote clock + // strictly advances — a correction for an earlier second is then stale- + // rejected before it can apply, so the prior second's clicks need no cover. + const dirtyChannelIds = React.useRef>(new Set()); React.useEffect(() => { if (!pubkey || !relayUrl) { setStore(DEFAULT_STORE); lastAppliedRemoteTs.current = 0; lastAppliedEventId.current = ""; + dirtyChannelIds.current = new Set(); return; } setStore(readChannelMutesStore(pubkey)); lastAppliedRemoteTs.current = 0; lastAppliedEventId.current = ""; + dirtyChannelIds.current = new Set(); managerRef.current = new ChannelMuteSyncManager(pubkey, relayUrl); return () => { managerRef.current?.destroy(); @@ -85,25 +94,31 @@ export function useChannelMutes( return prev; // A canonical supersession corrects an already-applied same-timestamp // LARGER-id head with the true winner: only here may the incoming blob's - // per-entry values win an equal-`updatedAt` tie, and only here does the - // pending publish (which reflected the superseded head) get cancelled. - // Any other application (bootstrap / live / newer timestamp) merges over - // optimistic local state with local-wins `mergeStores` and must NOT - // cancel a pending local publish — otherwise a later same-second local - // click (integer-second `updatedAt`) loses to an older remote entry that - // decrypts late, and its publish is silently dropped. + // per-entry values win an equal-`updatedAt` tie. Any other application + // (bootstrap / live / newer timestamp) merges over optimistic local + // state with local-wins `mergeStores`. const isCanonicalSupersession = remote.createdAt === lastAppliedRemoteTs.current && lastAppliedEventId.current !== "" && remote.eventId < lastAppliedEventId.current; + // A strictly-newer remote second retires every locally-dirty entry: a + // later correction can only target this new second, so prior clicks + // need no cover and the set must not grow unbounded. + if (remote.createdAt > lastAppliedRemoteTs.current) + dirtyChannelIds.current = new Set(); lastAppliedRemoteTs.current = remote.createdAt; lastAppliedEventId.current = remote.eventId; + // A canonical correction must not erase a locally-owned entry the user + // changed within this same second (integer-second `updatedAt` ties the + // remote's). Overlay the dirty entries back on top of the correction, + // and never cancel the pending publish — the click still needs to sync. const merged = isCanonicalSupersession - ? mergeApplyingRemote(prev, remote.store) + ? mergeCanonicalSupersession( + prev, + remote.store, + dirtyChannelIds.current, + ) : mergeStores(prev, remote.store); - if (isCanonicalSupersession) { - managerRef.current?.cancelPendingMutePublish(); - } if (!writeChannelMutesStore(pubkey, merged)) return prev; return merged; }; @@ -194,6 +209,10 @@ export function useChannelMutes( channelId, ); if (!writeChannelMutesStore(pubkey, next)) return prev; + // Mark this channel locally-owned for the current remote second so a + // late canonical correction with the same integer `updatedAt` can't + // clobber the click before its publish syncs. + dirtyChannelIds.current.add(channelId); managerRef.current?.publishMutes(next); return next; }); diff --git a/desktop/src/features/sidebar/lib/useChannelSections.ts b/desktop/src/features/sidebar/lib/useChannelSections.ts index 01b3187096b..3144867a863 100644 --- a/desktop/src/features/sidebar/lib/useChannelSections.ts +++ b/desktop/src/features/sidebar/lib/useChannelSections.ts @@ -126,10 +126,10 @@ export function useChannelSections( if (!pubkey || !relayUrl) return; const manager = managerRef.current; if (!manager) return; - // When a local edit loses whole-blob LWW (pre-publish head is newer) or the - // relay rejects it with a conflict, the manager adopts the winning remote - // store. Write it through to React state + localStorage so the UI and relay - // never diverge; applyRemote also advances the applied-ts guard. + // When a local edit loses whole-blob LWW (pre-publish head is newer), the + // manager adopts the winning remote store. Write it through to React state + // + localStorage so the UI and relay never diverge; applyRemote also + // advances the applied-ts guard. manager.setOnRemoteAdopted((remote) => { setStore(applyRemote(remote)); }); diff --git a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs index e2dcf8349b0..e8a1054c308 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs @@ -355,3 +355,116 @@ test("delayed same-second remote does not clobber a later local star or cancel i Date.now = origDateNow; } }); + +// Fix round 4 (pass-4 finding 2): a canonical correction (lower id at the same +// event timestamp) knows the incoming event is the relay's winner, but NOT +// whether the user clicked between the superseded larger-id event and the +// correction. Sequence: stale `bbbb` applies → user clicks star later in the +// same second → canonical `aaaa` decrypts late. `aaaa` and the click share +// integer `updatedAt`, so the plain remote-wins tie would clobber the click. +// The dirty-entry overlay keeps the click and the cancel is gone, so its +// publish stays scheduled. Mutation: dropping the dirty overlay (plain +// mergeApplyingRemote) lets `aaaa` erase the click; restoring the cancel drops +// its publish timer. +test("canonical correction preserves a same-second local click made after the larger-id event", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelStars } = await import("./useChannelStars.ts"); + + const origFetch = relayClient.fetchEvents; + const origLive = relayClient.subscribeLive; + const origReconnect = relayClient.subscribeToReconnects; + const origTauri = window.__TAURI_INTERNALS__; + const origSetTimeout = window.setTimeout; + const origClearTimeout = window.clearTimeout; + const origDateNow = Date.now; + + const timers = new Map(); + let nextTimer = 1; + window.setTimeout = (fn, ms) => { + const id = nextTimer++; + timers.set(id, { fn, ms }); + return id; + }; + window.clearTimeout = (id) => timers.delete(id); + // The local click happens later within second 100. + Date.now = () => 100_900; + + let live = null; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + live = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + // bbbb (stale larger id) says starred; aaaa (canonical lower id) says not. + // Both carry the same entry updatedAt=100, tying the later local click. + window.__TAURI_INTERNALS__ = { + invoke: (cmd, args) => { + if (cmd === "nip44_decrypt_from_self") { + const canonicalLowerId = args?.ciphertext === "aaaa"; + return Promise.resolve( + JSON.stringify({ + version: 1, + channels: { + shared: { starred: !canonicalLowerId, updatedAt: 100 }, + }, + }), + ); + } + return Promise.reject(new Error(`unmocked ${cmd}`)); + }, + }; + + const pubkey = "pk-star-canonical-dirty"; + const relayUrl = "wss://r.canon"; + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelStars(pubkey, relayUrl)); + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + assert.ok(live, "live subscription installed"); + + const deliver = async (id, content) => { + await act(async () => { + live({ + id, + pubkey, + created_at: 100, + content, + kind: 30078, + tags: [["d", "channel-stars"]], + sig: "s", + }); + for (let i = 0; i < 40; i++) await Promise.resolve(); + }); + }; + + await deliver("bbbb", "bbbb"); // stale larger-id head applies (starred) + await act(async () => { + hook.result.current.starChannel("shared"); // user intent after bbbb + }); + await deliver("aaaa", "aaaa"); // canonical correction decrypts late + + assert.equal( + hook.result.current.starredChannelIds.has("shared"), + true, + "a same-second local click must survive the canonical correction", + ); + assert.ok( + [...timers.values()].some((t) => t.ms === 2000), + "the local click's pending publish must remain scheduled", + ); + hook.unmount(); + } finally { + cleanup(); + relayClient.fetchEvents = origFetch; + relayClient.subscribeLive = origLive; + relayClient.subscribeToReconnects = origReconnect; + window.__TAURI_INTERNALS__ = origTauri; + window.setTimeout = origSetTimeout; + window.clearTimeout = origClearTimeout; + Date.now = origDateNow; + } +}); diff --git a/desktop/src/features/sidebar/lib/useChannelStars.ts b/desktop/src/features/sidebar/lib/useChannelStars.ts index a3da782c607..7b6e87eccbd 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.ts +++ b/desktop/src/features/sidebar/lib/useChannelStars.ts @@ -4,7 +4,7 @@ import { relayClient } from "@/shared/api/relayClient"; import { boundStarStore, DEFAULT_STORE, - mergeApplyingRemote, + mergeCanonicalSupersession, mergeStores, readChannelStarsStore, starredChannelIdsFromStore, @@ -34,17 +34,26 @@ export function useChannelStars( const managerRef = React.useRef(null); const lastAppliedRemoteTs = React.useRef(0); const lastAppliedEventId = React.useRef(""); + // Channels the user changed locally within the current remote second. Their + // integer-second `updatedAt` ties the remote's, so a late canonical + // correction would clobber them on the remote-wins tie; the overlay in + // `mergeCanonicalSupersession` keeps them. Cleared whenever the remote clock + // strictly advances — a correction for an earlier second is then stale- + // rejected before it can apply, so the prior second's clicks need no cover. + const dirtyChannelIds = React.useRef>(new Set()); React.useEffect(() => { if (!pubkey || !relayUrl) { setStore(DEFAULT_STORE); lastAppliedRemoteTs.current = 0; lastAppliedEventId.current = ""; + dirtyChannelIds.current = new Set(); return; } setStore(readChannelStarsStore(pubkey)); lastAppliedRemoteTs.current = 0; lastAppliedEventId.current = ""; + dirtyChannelIds.current = new Set(); managerRef.current = new ChannelStarSyncManager(pubkey, relayUrl); return () => { managerRef.current?.destroy(); @@ -85,25 +94,31 @@ export function useChannelStars( return prev; // A canonical supersession corrects an already-applied same-timestamp // LARGER-id head with the true winner: only here may the incoming blob's - // per-entry values win an equal-`updatedAt` tie, and only here does the - // pending publish (which reflected the superseded head) get cancelled. - // Any other application (bootstrap / live / newer timestamp) merges over - // optimistic local state with local-wins `mergeStores` and must NOT - // cancel a pending local publish — otherwise a later same-second local - // click (integer-second `updatedAt`) loses to an older remote entry that - // decrypts late, and its publish is silently dropped. + // per-entry values win an equal-`updatedAt` tie. Any other application + // (bootstrap / live / newer timestamp) merges over optimistic local + // state with local-wins `mergeStores`. const isCanonicalSupersession = remote.createdAt === lastAppliedRemoteTs.current && lastAppliedEventId.current !== "" && remote.eventId < lastAppliedEventId.current; + // A strictly-newer remote second retires every locally-dirty entry: a + // later correction can only target this new second, so prior clicks + // need no cover and the set must not grow unbounded. + if (remote.createdAt > lastAppliedRemoteTs.current) + dirtyChannelIds.current = new Set(); lastAppliedRemoteTs.current = remote.createdAt; lastAppliedEventId.current = remote.eventId; + // A canonical correction must not erase a locally-owned entry the user + // changed within this same second (integer-second `updatedAt` ties the + // remote's). Overlay the dirty entries back on top of the correction, + // and never cancel the pending publish — the click still needs to sync. const merged = isCanonicalSupersession - ? mergeApplyingRemote(prev, remote.store) + ? mergeCanonicalSupersession( + prev, + remote.store, + dirtyChannelIds.current, + ) : mergeStores(prev, remote.store); - if (isCanonicalSupersession) { - managerRef.current?.cancelPendingStarPublish(); - } if (!writeChannelStarsStore(pubkey, merged)) return prev; return merged; }; @@ -194,6 +209,10 @@ export function useChannelStars( channelId, ); if (!writeChannelStarsStore(pubkey, next)) return prev; + // Mark this channel locally-owned for the current remote second so a + // late canonical correction with the same integer `updatedAt` can't + // clobber the click before its publish syncs. + dirtyChannelIds.current.add(channelId); managerRef.current?.publishStars(next); return next; }); From 6927b74b221d274f4db2d2df3d974d1fb25f9d3d Mon Sep 17 00:00:00 2001 From: Duncan Date: Tue, 25 Aug 2026 11:54:57 -0400 Subject: [PATCH 7/7] refactor(sidebar): fold channel stars/mutes onto Lamport-rev max-merge Replace the LWW register plus ownership/dirty-set/canonical-supersession machinery with a per-entry Lamport `rev` and a single max-merge on every path, mirroring the read-state data model. Each entry carries an additive optional `rev` (missing implies 0; payload stays `version: 1` so older builds keep parsing our blobs). One `mergeStores` orders by updatedAt then rev then the starred/muted-true leaf, and ends in the 500-entry bound. Clicks stamp `updatedAt = max(now, localEntry?.updatedAt ?? 0, maxUpdatedAtSeen(id))` and mint `rev = max(localEntry.rev, maxRevSeen(id)) + 1`, so a click strictly dominates every state its replica has observed and cannot lose to a same-second remote. The sync managers hold a per-channel two-field high-water map fed by a single `observe()` on every ingest path. Stars sync keeps the generation-CAS + single-flight lane and bounded-backoff retry plus a durable outbox so an in-flight publish can never clear a newer pending edit; mutes sync mirrors it. Remote ingestion never touches the pending lane. Deleted: mergeApplyingRemote, mergeStoresWithTie, mergeCanonicalSupersession, dirtyChannelIds, lastAppliedRemoteTs/lastAppliedEventId, and the event-clock branch. Sections and sort are untouched. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../sidebar/lib/channelMutesStorage.test.mjs | 468 ++++++++------- .../sidebar/lib/channelMutesStorage.ts | 185 +++--- .../sidebar/lib/channelMutesSync.test.mjs | 287 +++++++-- .../features/sidebar/lib/channelMutesSync.ts | 173 +++++- .../sidebar/lib/channelStarsStorage.test.mjs | 485 ++++++++-------- .../sidebar/lib/channelStarsStorage.ts | 185 +++--- .../sidebar/lib/channelStarsSync.test.mjs | 279 +++++++-- .../features/sidebar/lib/channelStarsSync.ts | 173 +++++- .../sidebar/lib/useChannelMutes.test.mjs | 548 ++++++++---------- .../features/sidebar/lib/useChannelMutes.ts | 157 +++-- .../sidebar/lib/useChannelStars.test.mjs | 544 ++++++++--------- .../features/sidebar/lib/useChannelStars.ts | 157 +++-- 12 files changed, 2232 insertions(+), 1409 deletions(-) diff --git a/desktop/src/features/sidebar/lib/channelMutesStorage.test.mjs b/desktop/src/features/sidebar/lib/channelMutesStorage.test.mjs index f506eb93f1f..0071d4d0e9d 100644 --- a/desktop/src/features/sidebar/lib/channelMutesStorage.test.mjs +++ b/desktop/src/features/sidebar/lib/channelMutesStorage.test.mjs @@ -4,34 +4,57 @@ import test from "node:test"; import { boundMuteStore, MAX_CHANNEL_MUTE_ENTRIES, - parseMutePayload, mergeStores, + parseMutePayload, mutedChannelIdsFromStore, } from "./channelMutesStorage.ts"; // ── parseMutePayload ────────────────────────────────────────────────────────── -test("parseMutePayload: valid payload with channels returns store", () => { +test("parseMutePayload: valid payload with channels returns store (rev preserved)", () => { const payload = { version: 1, channels: { - "chan-1": { muted: true, updatedAt: 1000 }, - "chan-2": { muted: false, updatedAt: 2000 }, + "chan-1": { muted: true, updatedAt: 1000, rev: 3 }, + "chan-2": { muted: false, updatedAt: 2000, rev: 0 }, }, }; - const result = parseMutePayload(payload); - assert.deepEqual(result, { + assert.deepEqual(parseMutePayload(payload), payload); +}); + +test("parseMutePayload: missing rev normalizes to 0 (old-build blob, entry kept)", () => { + const result = parseMutePayload({ + version: 1, + channels: { "chan-1": { muted: true, updatedAt: 1000 } }, + }); + assert.deepEqual(result.channels["chan-1"], { + muted: true, + updatedAt: 1000, + rev: 0, + }); +}); + +test("parseMutePayload: malformed rev (string / negative / non-integer / NaN) normalizes to 0", () => { + const result = parseMutePayload({ version: 1, channels: { - "chan-1": { muted: true, updatedAt: 1000 }, - "chan-2": { muted: false, updatedAt: 2000 }, + str: { muted: true, updatedAt: 1, rev: "5" }, + neg: { muted: true, updatedAt: 1, rev: -2 }, + frac: { muted: true, updatedAt: 1, rev: 1.5 }, + nan: { muted: true, updatedAt: 1, rev: NaN }, }, }); + for (const id of ["str", "neg", "frac", "nan"]) { + assert.equal(result.channels[id].rev, 0, `${id} rev normalized to 0`); + assert.equal(result.channels[id].muted, true, `${id} entry kept`); + } }); test("parseMutePayload: missing version returns null", () => { assert.equal( - parseMutePayload({ channels: { "chan-1": { muted: true, updatedAt: 1 } } }), + parseMutePayload({ + channels: { "chan-1": { muted: true, updatedAt: 1 } }, + }), null, ); }); @@ -46,18 +69,15 @@ test("parseMutePayload: wrong version returns null", () => { ); }); -test("parseMutePayload: null input returns null", () => { +test("parseMutePayload: null / non-object input returns null", () => { assert.equal(parseMutePayload(null), null); -}); - -test("parseMutePayload: non-object input returns null", () => { assert.equal(parseMutePayload("string"), null); assert.equal(parseMutePayload(42), null); assert.equal(parseMutePayload(true), null); }); test("parseMutePayload: malformed channel entries missing muted/updatedAt are filtered out", () => { - const payload = { + const result = parseMutePayload({ version: 1, channels: { "no-muted": { updatedAt: 1000 }, @@ -67,252 +87,251 @@ test("parseMutePayload: malformed channel entries missing muted/updatedAt are fi "updated-at-wrong-type": { muted: true, updatedAt: "now" }, null: null, }, - }; - const result = parseMutePayload(payload); + }); assert.deepEqual(result, { version: 1, - channels: { - valid: { muted: false, updatedAt: 500 }, - }, + channels: { valid: { muted: false, updatedAt: 500, rev: 0 } }, }); }); test("parseMutePayload: NaN/Infinity/negative updatedAt entries are filtered out", () => { - const payload = { + const result = parseMutePayload({ version: 1, channels: { nan: { muted: true, updatedAt: NaN }, inf: { muted: true, updatedAt: Infinity }, "neg-inf": { muted: true, updatedAt: -Infinity }, neg: { muted: true, updatedAt: -1 }, - valid: { muted: true, updatedAt: 100 }, + valid: { muted: true, updatedAt: 100, rev: 2 }, }, - }; - const result = parseMutePayload(payload); + }); assert.deepEqual(result, { version: 1, - channels: { valid: { muted: true, updatedAt: 100 } }, + channels: { valid: { muted: true, updatedAt: 100, rev: 2 } }, }); }); -test("parseMutePayload: empty channels returns store with empty channels", () => { - const result = parseMutePayload({ version: 1, channels: {} }); - assert.deepEqual(result, { version: 1, channels: {} }); +test("parseMutePayload: empty channels / no channels key returns empty store", () => { + assert.deepEqual(parseMutePayload({ version: 1, channels: {} }), { + version: 1, + channels: {}, + }); + assert.deepEqual(parseMutePayload({ version: 1 }), { + version: 1, + channels: {}, + }); }); -test("parseMutePayload: version 1 with no channels key returns store with empty channels", () => { - const result = parseMutePayload({ version: 1 }); - assert.deepEqual(result, { version: 1, channels: {} }); -}); +// ── mergeStores: tuple order (updatedAt → rev → value) ──────────────────────── -// ── mergeStores ─────────────────────────────────────────────────────────────── +const E = (muted, updatedAt, rev) => ({ muted, updatedAt, rev }); +const S = (entry) => ({ version: 1, channels: { c: entry } }); -test("mergeStores: non-overlapping channels returns union of both", () => { - const local = { - version: 1, - channels: { "chan-a": { muted: true, updatedAt: 100 } }, - }; - const remote = { - version: 1, - channels: { "chan-b": { muted: false, updatedAt: 200 } }, - }; - const result = mergeStores(local, remote); +test("mergeStores: non-overlapping channels returns union", () => { + const result = mergeStores( + { version: 1, channels: { a: E(true, 100, 1) } }, + { version: 1, channels: { b: E(false, 200, 1) } }, + ); assert.deepEqual(result, { version: 1, - channels: { - "chan-a": { muted: true, updatedAt: 100 }, - "chan-b": { muted: false, updatedAt: 200 }, - }, + channels: { a: E(true, 100, 1), b: E(false, 200, 1) }, }); }); -test("mergeStores: overlapping channel with remote newer takes remote", () => { - const local = { - version: 1, - channels: { "chan-a": { muted: false, updatedAt: 100 } }, - }; - const remote = { - version: 1, - channels: { "chan-a": { muted: true, updatedAt: 200 } }, - }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels["chan-a"], { muted: true, updatedAt: 200 }); +test("mergeStores: strictly-later updatedAt wins regardless of rev (primary key)", () => { + // Later updatedAt with LOWER rev still wins — updatedAt is primary. This is + // the old-build interop case: an old build's rev-0 fresh edit beats a stale + // rev-bearing new-build entry. + const result = mergeStores(S(E(false, 200, 0)), S(E(true, 100, 7))); + assert.deepEqual(result.channels.c, E(false, 200, 0)); }); -test("mergeStores: overlapping channel with local newer takes local", () => { - const local = { - version: 1, - channels: { "chan-a": { muted: true, updatedAt: 300 } }, - }; - const remote = { - version: 1, - channels: { "chan-a": { muted: false, updatedAt: 100 } }, - }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels["chan-a"], { muted: true, updatedAt: 300 }); +test("mergeStores: equal updatedAt → higher rev wins (same-second tiebreak)", () => { + const result = mergeStores(S(E(false, 100, 5)), S(E(true, 100, 2))); + assert.deepEqual(result.channels.c, E(false, 100, 5)); }); -test("mergeStores: overlapping channel with same updatedAt local wins", () => { - const local = { - version: 1, - channels: { "chan-a": { muted: true, updatedAt: 500 } }, - }; - const remote = { - version: 1, - channels: { "chan-a": { muted: false, updatedAt: 500 } }, - }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels["chan-a"], { muted: true, updatedAt: 500 }); +test("mergeStores: equal updatedAt AND equal rev → muted=true wins (leaf)", () => { + const result = mergeStores(S(E(false, 100, 3)), S(E(true, 100, 3))); + assert.deepEqual(result.channels.c, E(true, 100, 3)); }); test("mergeStores: unmute with higher updatedAt overrides mute", () => { - const local = { - version: 1, - channels: { "chan-a": { muted: true, updatedAt: 100 } }, + const result = mergeStores(S(E(true, 100, 9)), S(E(false, 999, 1))); + assert.deepEqual(result.channels.c, E(false, 999, 1)); +}); + +test("mergeStores: empty local / empty remote / both empty", () => { + assert.deepEqual( + mergeStores({ version: 1, channels: {} }, S(E(true, 42, 1))).channels.c, + E(true, 42, 1), + ); + assert.deepEqual( + mergeStores(S(E(false, 10, 2)), { version: 1, channels: {} }).channels.c, + E(false, 10, 2), + ); + assert.deepEqual( + mergeStores({ version: 1, channels: {} }, { version: 1, channels: {} }), + { version: 1, channels: {} }, + ); +}); + +// ── mergeStores: algebra (commutativity, associativity, idempotence) ────────── + +function randEntry(rng) { + return { + muted: rng() > 0.5, + updatedAt: Math.floor(rng() * 5), + rev: Math.floor(rng() * 5), }; - const remote = { - version: 1, - channels: { "chan-a": { muted: false, updatedAt: 999 } }, +} +function randStore(rng, ids) { + const channels = {}; + for (const id of ids) if (rng() > 0.3) channels[id] = randEntry(rng); + return { version: 1, channels }; +} +// Deterministic LCG so failures reproduce. +function lcg(seed) { + let s = seed >>> 0; + return () => { + s = (s * 1664525 + 1013904223) >>> 0; + return s / 4294967296; }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels["chan-a"], { muted: false, updatedAt: 999 }); +} + +test("mergeStores: commutative — merge(a,b) === merge(b,a)", () => { + const rng = lcg(12345); + const ids = ["a", "b", "c", "d"]; + for (let i = 0; i < 200; i++) { + const a = randStore(rng, ids); + const b = randStore(rng, ids); + assert.deepEqual(mergeStores(a, b), mergeStores(b, a)); + } }); -test("mergeStores: empty local returns remote entries", () => { - const local = { version: 1, channels: {} }; - const remote = { +test("mergeStores: associative — merge(merge(a,b),c) === merge(a,merge(b,c))", () => { + const rng = lcg(67890); + const ids = ["a", "b", "c", "d"]; + for (let i = 0; i < 200; i++) { + const a = randStore(rng, ids); + const b = randStore(rng, ids); + const c = randStore(rng, ids); + assert.deepEqual( + mergeStores(mergeStores(a, b), c), + mergeStores(a, mergeStores(b, c)), + ); + } +}); + +test("mergeStores: idempotent — merge(a, merge(a,b)) === merge(a,b)", () => { + const rng = lcg(24680); + const ids = ["a", "b", "c", "d"]; + for (let i = 0; i < 200; i++) { + const a = randStore(rng, ids); + const b = randStore(rng, ids); + const ab = mergeStores(a, b); + assert.deepEqual(mergeStores(a, ab), ab); + assert.deepEqual(mergeStores(ab, ab), ab); + } +}); + +// ── v1-blob bidirectional compatibility ─────────────────────────────────────── + +test("v1 compat: a rev-carrying blob round-trips through a rev-less parser view", () => { + // Simulate an old build reading our blob: JSON-serialize our rev-carrying + // payload, parse it back — version stays 1 so it is NOT rejected, and the + // core fields survive (old build simply ignores rev). + const ours = { version: 1, - channels: { "chan-b": { muted: true, updatedAt: 42 } }, + channels: { c: { muted: true, updatedAt: 100, rev: 7 } }, }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels, { - "chan-b": { muted: true, updatedAt: 42 }, - }); + const roundTripped = parseMutePayload(JSON.parse(JSON.stringify(ours))); + assert.equal(roundTripped.version, 1, "version stays 1 — old build accepts"); + assert.equal(roundTripped.channels.c.muted, true); + assert.equal(roundTripped.channels.c.updatedAt, 100); }); -test("mergeStores: empty remote returns local entries", () => { - const local = { +test("v1 compat: old-build unmute (no rev, updatedAt+1) beats our stale mute", () => { + // New build wrote {muted:true, rev:7, updatedAt:t}; old build (no rev) + // unmutes producing {muted:false, updatedAt:t+1}. The unmute wins on the + // primary updatedAt key — old builds can still edit upgraded channels. + const ours = S(E(true, 100, 7)); + const oldBuildUnmute = parseMutePayload({ version: 1, - channels: { "chan-a": { muted: false, updatedAt: 10 } }, - }; - const remote = { version: 1, channels: {} }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels, { - "chan-a": { muted: false, updatedAt: 10 }, + channels: { c: { muted: false, updatedAt: 101 } }, + }); + assert.deepEqual(mergeStores(ours, oldBuildUnmute).channels.c, { + muted: false, + updatedAt: 101, + rev: 0, }); }); -test("mergeStores: both empty returns empty", () => { - const result = mergeStores( - { version: 1, channels: {} }, - { version: 1, channels: {} }, - ); - assert.deepEqual(result, { version: 1, channels: {} }); -}); +// ── boundMuteStore ──────────────────────────────────────────────────────────── test("boundMuteStore: retains newest entries regardless of muted value", () => { const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, index) => [ - `active-${index}`, - { muted: true, updatedAt: index + 1 }, + Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, i) => [ + `active-${i}`, + E(true, i + 1, 0), ]), ); - channels["old-false"] = { muted: false, updatedAt: 0 }; - channels["new-false"] = { muted: false, updatedAt: 9999 }; - + channels["old-false"] = E(false, 0, 0); + channels["new-false"] = E(false, 9999, 0); const result = boundMuteStore({ version: 1, channels }); - assert.equal(Object.keys(result.channels).length, MAX_CHANNEL_MUTE_ENTRIES); assert.equal(result.channels["old-false"], undefined); - assert.deepEqual(result.channels["new-false"], { - muted: false, - updatedAt: 9999, - }); + assert.deepEqual(result.channels["new-false"], E(false, 9999, 0)); assert.equal(result.channels["active-0"], undefined); - assert.deepEqual(result.channels["active-1"], { muted: true, updatedAt: 2 }); }); test("boundMuteStore: uses channel ID as an updatedAt tie-breaker", () => { const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES + 1 }, (_, index) => [ - `channel-${String(MAX_CHANNEL_MUTE_ENTRIES - index).padStart(3, "0")}`, - { muted: true, updatedAt: 1 }, + Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES + 1 }, (_, i) => [ + `channel-${String(MAX_CHANNEL_MUTE_ENTRIES - i).padStart(3, "0")}`, + E(true, 1, 0), ]), ); - const result = boundMuteStore({ version: 1, channels }); - assert.equal(result.channels["channel-000"], undefined); - assert.deepEqual(result.channels["channel-500"], { - muted: true, - updatedAt: 1, - }); + assert.deepEqual(result.channels["channel-500"], E(true, 1, 0)); }); -test("boundMuteStore: preserves a same-second mute mutation by key", () => { +test("boundMuteStore: preserves a same-second mutation by key", () => { const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, index) => [ - `z-channel-${String(index).padStart(3, "0")}`, - { muted: true, updatedAt: 1 }, + Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, i) => [ + `z-channel-${String(i).padStart(3, "0")}`, + E(true, 1, 0), ]), ); - channels["a-target"] = { muted: true, updatedAt: 1 }; - + channels["a-target"] = E(false, 1, 1); const result = boundMuteStore({ version: 1, channels }, "a-target"); - assert.equal(Object.keys(result.channels).length, MAX_CHANNEL_MUTE_ENTRIES); - assert.deepEqual(result.channels["a-target"], { - muted: true, - updatedAt: 1, - }); - assert.equal(result.channels["z-channel-000"], undefined); -}); - -test("boundMuteStore: preserves a same-second unmute mutation by key", () => { - const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, index) => [ - `z-channel-${String(index).padStart(3, "0")}`, - { muted: true, updatedAt: 1 }, - ]), - ); - channels["a-target"] = { muted: false, updatedAt: 1 }; - - const result = boundMuteStore({ version: 1, channels }, "a-target"); - - assert.equal(Object.keys(result.channels).length, MAX_CHANNEL_MUTE_ENTRIES); - assert.deepEqual(result.channels["a-target"], { - muted: false, - updatedAt: 1, - }); + assert.deepEqual(result.channels["a-target"], E(false, 1, 1)); assert.equal(result.channels["z-channel-000"], undefined); }); test("mergeStores: a fresh at-capacity unmute defeats an older remote mute", () => { const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, index) => [ - `active-${index}`, - { muted: true, updatedAt: index + 1 }, + Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, i) => [ + `active-${i}`, + E(true, i + 1, 0), ]), ); - channels["unmuted"] = { muted: false, updatedAt: 9999 }; + channels.unmuted = E(false, 9999, 1); const bounded = boundMuteStore({ version: 1, channels }); - const result = mergeStores(bounded, { version: 1, - channels: { unmuted: { muted: true, updatedAt: 9998 } }, - }); - - assert.deepEqual(result.channels.unmuted, { - muted: false, - updatedAt: 9999, + channels: { unmuted: E(true, 9998, 5) }, }); + assert.deepEqual(result.channels.unmuted, E(false, 9999, 1)); }); test("mergeStores: evicted remote ID re-enters and the oldest state is re-trimmed", () => { const localChannels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, index) => [ - `active-${index}`, - { muted: true, updatedAt: index + 10 }, + Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, i) => [ + `active-${i}`, + E(true, i + 10, 0), ]), ); const result = mergeStores( @@ -320,56 +339,81 @@ test("mergeStores: evicted remote ID re-enters and the oldest state is re-trimme { version: 1, channels: { - "evicted-id": { muted: true, updatedAt: 9999 }, - "active-0": { muted: false, updatedAt: 9998 }, + "evicted-id": E(true, 9999, 0), + "active-0": E(false, 9998, 0), }, }, ); - assert.equal(Object.keys(result.channels).length, MAX_CHANNEL_MUTE_ENTRIES); - assert.deepEqual(result.channels["evicted-id"], { - muted: true, - updatedAt: 9999, - }); - assert.deepEqual(result.channels["active-0"], { - muted: false, - updatedAt: 9998, - }); + assert.deepEqual(result.channels["evicted-id"], E(true, 9999, 0)); + assert.deepEqual(result.channels["active-0"], E(false, 9998, 0)); assert.equal(result.channels["active-1"], undefined); - assert.deepEqual(result.channels["active-2"], { muted: true, updatedAt: 12 }); }); -// ── mutedChannelIdsFromStore ────────────────────────────────────────────────── +// ── Eviction / remount (finding 3) ──────────────────────────────────────────── + +// Easy branch: X evicted at an OLDER second → remount (high-water lost) → click +// X at the current second → merge a remote carrying X at a high rev but an old +// updatedAt. The click's newer updatedAt wins on the primary key; the lost rev +// high-water is irrelevant. Closed by construction for all cross-second cases. +test("finding 3 easy branch: a fresh click beats an evicted high-rev entry at an older updatedAt", () => { + // Remount state: the user clicks X fresh at updatedAt=now, empty high-water + // (evicted), so rev mints to 1. + const click = S(E(true, 1000, 1)); + // The previously observed remote X sits at an OLD updatedAt with a high rev. + const remote = S(E(false, 500, 100)); + const merged = mergeStores(click, remote); + assert.deepEqual( + merged.channels.c, + E(true, 1000, 1), + "fresh click wins on the primary updatedAt key", + ); +}); -test("mutedChannelIdsFromStore: returns set of IDs where muted=true", () => { - const store = { - version: 1, - channels: { - "chan-a": { muted: true, updatedAt: 100 }, - "chan-b": { muted: true, updatedAt: 200 }, - "chan-c": { muted: false, updatedAt: 300 }, - }, - }; - const result = mutedChannelIdsFromStore(store); - assert.equal(result.has("chan-a"), true); - assert.equal(result.has("chan-b"), true); - assert.equal(result.has("chan-c"), false); - assert.equal(result.size, 2); +// Hard branch (Thufir's exact equal-second counterexample): >500 entries all at +// the CURRENT second → X evicted by the id tiebreak (not because it is old) → +// remount in the same second → click X at rev 1 (empty high-water) → merge the +// previously observed remote X at rev 100, EQUAL updatedAt. updatedAt ties, rev +// decides, 100 > 1 — the click LOSES. Documented deterministic residual, proven +// here as the hard branch (not disguised as safety). +test("finding 3 hard branch: equal-second evicted click (rev 1) loses to observed remote (rev 100)", () => { + const NOW = 777; + // Remount click on the evicted channel: empty high-water → rev 1, updatedAt=NOW. + const click = S(E(true, NOW, 1)); + // The previously observed remote for the same channel at the same second, + // rev 100 (it may precede the remount — not genuinely concurrent). + const remote = S(E(false, NOW, 100)); + const merged = mergeStores(click, remote); + assert.deepEqual( + merged.channels.c, + E(false, NOW, 100), + "equal updatedAt → higher rev wins deterministically (documented residual)", + ); + // Deterministic either merge order — a lost click, never a divergence. + assert.deepEqual(mergeStores(remote, click).channels.c, E(false, NOW, 100)); }); -test("mutedChannelIdsFromStore: excludes IDs where muted=false", () => { - const store = { +// ── mutedChannelIdsFromStore ──────────────────────────────────────────────── + +test("mutedChannelIdsFromStore: returns set of IDs where muted=true", () => { + const result = mutedChannelIdsFromStore({ version: 1, channels: { - "chan-x": { muted: false, updatedAt: 1 }, - "chan-y": { muted: false, updatedAt: 2 }, + a: E(true, 100, 0), + b: E(true, 200, 0), + c: E(false, 300, 0), }, - }; - const result = mutedChannelIdsFromStore(store); - assert.equal(result.size, 0); + }); + assert.deepEqual([...result].sort(), ["a", "b"]); }); -test("mutedChannelIdsFromStore: empty channels returns empty set", () => { - const result = mutedChannelIdsFromStore({ version: 1, channels: {} }); - assert.equal(result.size, 0); +test("mutedChannelIdsFromStore: all-false / empty returns empty set", () => { + assert.equal( + mutedChannelIdsFromStore({ + version: 1, + channels: { x: E(false, 1, 0) }, + }).size, + 0, + ); + assert.equal(mutedChannelIdsFromStore({ version: 1, channels: {} }).size, 0); }); diff --git a/desktop/src/features/sidebar/lib/channelMutesStorage.ts b/desktop/src/features/sidebar/lib/channelMutesStorage.ts index 90ede83eb14..1fc04424acc 100644 --- a/desktop/src/features/sidebar/lib/channelMutesStorage.ts +++ b/desktop/src/features/sidebar/lib/channelMutesStorage.ts @@ -1,9 +1,16 @@ +import { normalizeRelayUrl } from "@/shared/lib/normalizeRelayUrl"; + const STORAGE_KEY_PREFIX = "buzz-channel-mutes.v1"; export const MAX_CHANNEL_MUTE_ENTRIES = 500; export type ChannelMuteEntry = { muted: boolean; updatedAt: number; + // Per-channel Lamport revision. Breaks a same-second `updatedAt` tie that the + // integer clock cannot resolve. Absent in blobs from an older build ⇒ read as + // 0 (a valid, mergeable value), so the payload stays `version: 1` and older + // builds still parse our blobs. + rev: number; }; export type ChannelMuteStore = { @@ -29,8 +36,8 @@ export function parseMutePayload(json: unknown): ChannelMuteStore | null { obj.channels !== null && !Array.isArray(obj.channels) ? Object.fromEntries( - Object.entries(obj.channels as Record).filter( - (entry): entry is [string, ChannelMuteEntry] => { + Object.entries(obj.channels as Record) + .filter((entry): entry is [string, Record] => { const v = entry[1]; return ( typeof v === "object" && @@ -42,8 +49,27 @@ export function parseMutePayload(json: unknown): ChannelMuteStore | null { ) && ((v as Record).updatedAt as number) >= 0 ); - }, - ), + }) + // Normalize `rev`: accept a non-negative integer, otherwise 0. An + // entry is never dropped solely because `rev` is absent (older + // build) or malformed — absence is a valid mergeable value. + .map(([id, v]) => { + const rawRev = v.rev; + const rev = + typeof rawRev === "number" && + Number.isInteger(rawRev) && + rawRev >= 0 + ? rawRev + : 0; + return [ + id, + { + muted: v.muted as boolean, + updatedAt: v.updatedAt as number, + rev, + }, + ]; + }), ) : {}; return boundMuteStore({ version: 1, channels }); @@ -108,79 +134,47 @@ export function writeChannelMutesStore( } } -export function mergeStores( - local: ChannelMuteStore, - remote: ChannelMuteStore, -): ChannelMuteStore { - return mergeStoresWithTie(local, remote, false); -} - /** - * Merge a remote store that has already won the event-level canonical tie-break - * (`created_at DESC, id ASC`) into the local store, resolving a per-entry - * `updatedAt` tie in favour of the *remote* value. Once the comparator has - * chosen this remote event as the stored winner, its per-entry values must - * survive, or a stale value from a superseded larger-id event delivered first - * would win the merge and silently undo the canonical winner. Strictly-newer - * local per-entry edits (`l.updatedAt > r.updatedAt`) still win. + * Merge two mute stores by a per-channel total order: + * `updatedAt` DESC → `rev` DESC → `muted === true` wins. This order is + * commutative, associative, and idempotent (before bounding), so every + * observation path (bootstrap, live, reconnect, reconcile, pre-publish, + * cross-window storage) applies it with no ordering or ownership overlay and + * all replicas converge. + * + * `updatedAt` is primary so a strictly-later edit — from any build, whether it + * carries `rev` or (older build) reads `rev: 0` — wins outright. `rev` breaks + * only a same-second `updatedAt` tie: the ambiguous integer-second window the + * clock cannot resolve, where a click that minted `rev = maxSeen + 1` dominates + * any same-second state it observed. On a full tie (equal `updatedAt` AND equal + * `rev`) `true` wins as the deterministic leaf. */ -export function mergeApplyingRemote( - local: ChannelMuteStore, - remote: ChannelMuteStore, -): ChannelMuteStore { - return mergeStoresWithTie(local, remote, true); -} - -function mergeStoresWithTie( - local: ChannelMuteStore, - remote: ChannelMuteStore, - preferRemoteOnTie: boolean, +export function mergeStores( + a: ChannelMuteStore, + b: ChannelMuteStore, ): ChannelMuteStore { const allIds = new Set([ - ...Object.keys(local.channels), - ...Object.keys(remote.channels), + ...Object.keys(a.channels), + ...Object.keys(b.channels), ]); const merged: Record = {}; for (const id of allIds) { - const l = local.channels[id]; - const r = remote.channels[id]; - if (l && r) { - const localWins = preferRemoteOnTie - ? l.updatedAt > r.updatedAt - : l.updatedAt >= r.updatedAt; - merged[id] = localWins ? l : r; - } else { - merged[id] = (l ?? r) as ChannelMuteEntry; - } + const l = a.channels[id]; + const r = b.channels[id]; + merged[id] = l && r ? pickMuteEntry(l, r) : ((l ?? r) as ChannelMuteEntry); } return boundMuteStore({ version: 1, channels: merged }); } -/** - * Apply a canonical lower-id correction (`mergeApplyingRemote`: remote wins a - * per-entry `updatedAt` tie) while preserving entries the user changed locally - * since the superseded head was applied. The correction canonicalises remote - * history, but a same-second local click carries integer-second `updatedAt` - * equal to the remote's, so the plain remote-wins tie would silently clobber - * it. For each `dirtyId` the local entry wins only the tie (`l.updatedAt >= - * r.updatedAt`) — a genuinely newer remote value still wins, so a stale dirty - * id can never override a later correction. - */ -export function mergeCanonicalSupersession( - local: ChannelMuteStore, - remote: ChannelMuteStore, - dirtyIds: ReadonlySet, -): ChannelMuteStore { - const applied = mergeApplyingRemote(local, remote); - if (dirtyIds.size === 0) return applied; - const channels = { ...applied.channels }; - for (const id of dirtyIds) { - const l = local.channels[id]; - if (!l) continue; - const r = remote.channels[id]; - if (!r || l.updatedAt >= r.updatedAt) channels[id] = l; - } - return boundMuteStore({ version: 1, channels }); +/** The winner of two entries under `updatedAt` → `rev` → `muted` order. */ +function pickMuteEntry( + l: ChannelMuteEntry, + r: ChannelMuteEntry, +): ChannelMuteEntry { + if (l.updatedAt !== r.updatedAt) return l.updatedAt > r.updatedAt ? l : r; + if (l.rev !== r.rev) return l.rev > r.rev ? l : r; + if (l.muted !== r.muted) return l.muted ? l : r; + return l; } export function mutedChannelIdsFromStore(store: ChannelMuteStore): Set { @@ -190,3 +184,62 @@ export function mutedChannelIdsFromStore(store: ChannelMuteStore): Set { .map(([id]) => id), ); } + +const OUTBOX_KEY_PREFIX = "buzz-channel-mutes-outbox.v1"; + +// The outbox is a per-relay sync-lane structure (like the watermark), so it is +// relay-scoped even though the main store stays pubkey-only: an edit made +// against relay A must never resume-publish onto relay B after a community +// switch. +function outboxKey(pubkey: string, relayUrl: string): string { + return `${OUTBOX_KEY_PREFIX}:${pubkey}:${encodeURIComponent(normalizeRelayUrl(relayUrl))}`; +} + +/** + * Persist an unpublished edit so it survives quit/community-switch within the + * 2s publish debounce. Written synchronously on every click; cleared once the + * edit is published or found identical to the last published store. Resumed on + * next mount so a durable intent is never silently dropped at teardown. + */ +export function writeChannelMutesOutbox( + pubkey: string, + store: ChannelMuteStore, + relayUrl: string, +): void { + try { + window.localStorage.setItem( + outboxKey(pubkey, relayUrl), + JSON.stringify(boundMuteStore(store)), + ); + } catch { + // Best-effort durability; the in-memory pendingStore still drives this + // session's publish even if the persisted copy could not be written. + } +} + +/** Read a persisted unpublished edit, or null when none/unparseable. */ +export function readChannelMutesOutbox( + pubkey: string, + relayUrl: string, +): ChannelMuteStore | null { + try { + const raw = window.localStorage.getItem(outboxKey(pubkey, relayUrl)); + if (!raw) return null; + return parseMutePayload(JSON.parse(raw)); + } catch { + return null; + } +} + +/** Clear the persisted outbox (edit published or a no-op). */ +export function clearChannelMutesOutbox( + pubkey: string, + relayUrl: string, +): void { + try { + window.localStorage.removeItem(outboxKey(pubkey, relayUrl)); + } catch { + // Ignore — a stale outbox entry is re-evaluated (and re-cleared if + // identical to the head) on the next publish attempt. + } +} diff --git a/desktop/src/features/sidebar/lib/channelMutesSync.test.mjs b/desktop/src/features/sidebar/lib/channelMutesSync.test.mjs index 845e5a5accc..1ef2cdd1b5e 100644 --- a/desktop/src/features/sidebar/lib/channelMutesSync.test.mjs +++ b/desktop/src/features/sidebar/lib/channelMutesSync.test.mjs @@ -4,8 +4,9 @@ import test, { mock } from "node:test"; import { relayClient } from "@/shared/api/relayClient"; import { ChannelMuteSyncManager } from "./channelMutesSync.ts"; import { - makeFakeWindow, installFakeWindow, + installTauriMock, + makeFakeWindow, } from "./sidebarSyncTestHelpers.mjs"; const RELAY = "wss://r.test"; @@ -14,12 +15,70 @@ const RELAY_KEY = encodeURIComponent(RELAY); function makeStore(channels = {}) { return { version: 1, channels }; } +const E = (muted, updatedAt, rev) => ({ muted, updatedAt, rev }); + +// Multi-slot timer fake keyed by delay, for overlapping-publish tests. Mirrors +// the sections suite convention (channelSectionsSync.test.mjs:407-432). +function makeMultiTimerWindow() { + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const win = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + return { + win, + storage, + timers, + fireDelay: async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + for (let i = 0; i < 50; i++) await Promise.resolve(); + }, + hasDelay: (ms) => [...timers.values()].some((t) => t.ms === ms), + }; +} + +// ─── observe() / high-water ingestion ───────────────────────────────────────── + +test("observe: high-water is per-channel max of rev and updatedAt, monotonic", () => { + const fw = makeFakeWindow(); + const restore = installFakeWindow(fw); + try { + const m = new ChannelMuteSyncManager("pk", RELAY); + m.observe(makeStore({ a: E(true, 100, 3), b: E(false, 50, 1) })); + assert.equal(m.maxRevSeen("a"), 3); + assert.equal(m.maxUpdatedAtSeen("a"), 100); + // A later observation raises each dimension independently; a lower one + // never regresses either. + m.observe(makeStore({ a: E(true, 90, 5) })); + assert.equal(m.maxRevSeen("a"), 5, "rev raised"); + assert.equal(m.maxUpdatedAtSeen("a"), 100, "updatedAt not regressed"); + m.observe(makeStore({ a: E(true, 200, 2) })); + assert.equal(m.maxUpdatedAtSeen("a"), 200, "updatedAt raised"); + assert.equal(m.maxRevSeen("a"), 5, "rev not regressed"); + // Unseen channel reports zero on both dimensions. + assert.equal(m.maxRevSeen("never"), 0); + assert.equal(m.maxUpdatedAtSeen("never"), 0); + } finally { + restore(); + } +}); // ─── destroy() must cancel pending publish, not flush ───────────────────────── -// Regression guard for the community-switch cross-relay publish vector: -// mute a channel in relay A → destroy() called (relayUrl dep change) → -// no publish should fire. test("destroy: cancels pending publish without flushing to the relay", () => { const publishCalls = []; mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); @@ -31,9 +90,9 @@ test("destroy: cancels pending publish without flushing to the relay", () => { const restore = installFakeWindow(fw); try { const manager = new ChannelMuteSyncManager("pk-test", RELAY); - manager.publishMutes(makeStore({ ch1: { muted: true, updatedAt: 100 } })); + manager.publishMutes(makeStore({ ch1: E(true, 100, 1) })); manager.destroy(); - assert.equal(publishCalls.length, 0); + assert.equal(publishCalls.length, 0, "no publish after destroy"); assert.equal(manager.getPendingMuteStore(), null); } finally { restore(); @@ -60,12 +119,16 @@ test("destroy: aborts in-flight doPublish after fetchOwnBlobBeforePublish resolv const restore = installFakeWindow(fw); try { const manager = new ChannelMuteSyncManager("pk-race", RELAY); - manager.publishMutes(makeStore({ ch1: { muted: true, updatedAt: 100 } })); + manager.publishMutes(makeStore({ ch1: E(true, 100, 1) })); fw._fireTimer(); manager.destroy(); releaseFetch(); await new Promise((r) => setTimeout(r, 0)); - assert.equal(publishCalls.length, 0); + assert.equal( + publishCalls.length, + 0, + "publishEvent must not be called after destroy", + ); } finally { restore(); mock.reset(); @@ -83,9 +146,175 @@ test("destroy: is safe to call with no pending publish", () => { } }); +// ─── Generation CAS: A-in-flight → B-click → A-completes (both variants) ────── + +// Finding 2 (A succeeds): an older in-flight publish that completes after a +// newer edit is queued must NOT clear the newer edit's pending store/outbox, +// and B must reach the relay via the completion re-drive. Mutation: dropping the +// generation CAS in discardPending lets A's success null out B's pending+outbox. +test("A-in-flight → B-click → A-succeeds: B stays pending and B publishes", async () => { + let releaseFirst = null; + const publishedContents = []; + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + mock.method(relayClient, "publishEvent", () => { + if (releaseFirst === null && publishedContents.length === 0) { + return new Promise((res) => { + releaseFirst = res; + }); + } + return Promise.resolve(); + }); + const t = makeMultiTimerWindow(); + const restore = installFakeWindow(t.win); + const tauri = installTauriMock("{}"); + const outboxKey = `buzz-channel-mutes-outbox.v1:pk-ab:${RELAY_KEY}`; + try { + const manager = new ChannelMuteSyncManager("pk-ab", RELAY); + const storeA = makeStore({ a: E(true, 100, 1) }); + const storeB = makeStore({ b: E(true, 101, 1) }); + + manager.publishMutes(storeA); + await t.fireDelay(2000); // doPublish(A) awaits publishEvent + while (releaseFirst === null) await Promise.resolve(); + + // B arrives while A is in flight. + manager.publishMutes(storeB); + assert.deepEqual( + Object.keys(manager.getPendingMuteStore().channels), + ["b"], + "B is now pending", + ); + assert.ok(t.storage.get(outboxKey), "outbox holds B"); + + // A completes — must NOT clear B. + releaseFirst(); + for (let i = 0; i < 50; i++) await Promise.resolve(); + assert.deepEqual( + Object.keys(manager.getPendingMuteStore()?.channels ?? {}), + ["b"], + "older A completion leaves B pending", + ); + assert.ok(t.storage.get(outboxKey), "older A completion leaves B outbox"); + + // B's own debounce fires and B reaches the relay (published) with no kick. + const capturedBefore = tauri.capturedPlaintext(); + await t.fireDelay(2000); + for (let i = 0; i < 50; i++) await Promise.resolve(); + const captured = tauri.capturedPlaintext(); + assert.ok( + captured && captured !== capturedBefore && captured.includes('"b"'), + "B is published to the relay", + ); + assert.equal( + manager.getPendingMuteStore(), + null, + "B cleared after publish", + ); + assert.equal(t.storage.get(outboxKey), undefined, "B outbox cleared"); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// Finding 2 (A fails): A's publish rejects after B is queued. B must remain +// pending and be published by the serialized re-drive / retry — no manual kick. +test("A-in-flight → B-click → A-fails: B remains pending and B publishes", async () => { + let rejectFirst = null; + let publishCount = 0; + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + mock.method(relayClient, "publishEvent", () => { + publishCount++; + if (publishCount === 1) { + return new Promise((_res, rej) => { + rejectFirst = () => rej(new Error("socket error")); + }); + } + return Promise.resolve(); + }); + const t = makeMultiTimerWindow(); + const restore = installFakeWindow(t.win); + const tauri = installTauriMock("{}"); + const outboxKey = `buzz-channel-mutes-outbox.v1:pk-abfail:${RELAY_KEY}`; + try { + const manager = new ChannelMuteSyncManager("pk-abfail", RELAY); + manager.publishMutes(makeStore({ a: E(true, 100, 1) })); + await t.fireDelay(2000); + while (rejectFirst === null) await Promise.resolve(); + + manager.publishMutes(makeStore({ b: E(true, 101, 1) })); + rejectFirst(); // A fails + for (let i = 0; i < 50; i++) await Promise.resolve(); + + assert.deepEqual( + Object.keys(manager.getPendingMuteStore()?.channels ?? {}), + ["b"], + "B still pending after A's failure", + ); + assert.ok(t.storage.get(outboxKey), "B outbox intact after A's failure"); + + // B's debounce fires and B publishes successfully. + await t.fireDelay(2000); + for (let i = 0; i < 50; i++) await Promise.resolve(); + const captured = tauri.capturedPlaintext(); + assert.ok(captured?.includes('"b"'), "B published"); + assert.equal(manager.getPendingMuteStore(), null, "B cleared"); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// ─── Bounded-backoff retry: failed publish on a healthy socket, no later edit ─ + +// Finding 2: a transient publish failure with the socket open and NO further +// click must self-heal via the bounded-backoff retry — the pending edit is kept +// and a retry timer is scheduled. Mutation: dropping scheduleRetry leaves the +// edit stranded (Will's "make another change to kick it" symptom). +test("failed publish schedules a bounded-backoff retry and keeps the pending edit", async () => { + let publishCount = 0; + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + mock.method(relayClient, "publishEvent", () => { + publishCount++; + if (publishCount === 1) return Promise.reject(new Error("timeout")); + return Promise.resolve(); + }); + const t = makeMultiTimerWindow(); + const restore = installFakeWindow(t.win); + const tauri = installTauriMock("{}"); + try { + const manager = new ChannelMuteSyncManager("pk-retry", RELAY); + manager.publishMutes(makeStore({ a: E(true, 100, 1) })); + await t.fireDelay(2000); // debounce → doPublish → publishEvent rejects + assert.ok( + manager.getPendingMuteStore() !== null, + "pending edit retained after failure", + ); + assert.ok(t.hasDelay(2000), "a retry timer at RETRY_BASE_MS is scheduled"); + + // The retry fires and the second publish succeeds → pending cleared. + await t.fireDelay(2000); + for (let i = 0; i < 50; i++) await Promise.resolve(); + assert.equal(publishCount, 2, "retry re-published"); + assert.equal( + manager.getPendingMuteStore(), + null, + "pending cleared on retry success", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + // ─── Boot seed-publish guard (the revert-fix regression suite) ───────────────── -// 1. fetch failed → hold, pendingStore null (mutation: remove failed guard → seed queued) test("revert-fix: fetch failed (error) does not trigger seed-publish via bootstrap", async () => { mock.method(relayClient, "fetchEvents", () => Promise.reject(new Error("relay timeout")), @@ -95,9 +324,7 @@ test("revert-fix: fetch failed (error) does not trigger seed-publish via bootstr const restore = installFakeWindow(fw); try { const manager = new ChannelMuteSyncManager("pk-fail", RELAY); - const result = await manager.bootstrap( - makeStore({ ch1: { muted: true, updatedAt: 1 } }), - ); + const result = await manager.bootstrap(makeStore({ ch1: E(true, 1, 0) })); assert.equal(result.action, "hold"); assert.equal(manager.getPendingMuteStore(), null); } finally { @@ -106,7 +333,6 @@ test("revert-fix: fetch failed (error) does not trigger seed-publish via bootstr } }); -// 2. absent + prior watermark → hold, pendingStore null (mutation: clear watermark → seed queued) test("revert-fix: absent fetch with prior watermark blocks seed-publish via bootstrap", async () => { mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); mock.method(relayClient, "publishEvent", () => Promise.resolve()); @@ -118,16 +344,7 @@ test("revert-fix: absent fetch with prior watermark blocks seed-publish via boot const restore = installFakeWindow(fw); try { const manager = new ChannelMuteSyncManager("pk-stale", RELAY); - assert.ok( - Number( - fw.localStorage.getItem( - `buzz-sync-watermark.v1:channel-mutes:pk-stale:${RELAY_KEY}`, - ) ?? "0", - ) > 0, - ); - const result = await manager.bootstrap( - makeStore({ ch1: { muted: true, updatedAt: 1 } }), - ); + const result = await manager.bootstrap(makeStore({ ch1: E(true, 1, 0) })); assert.equal(result.action, "hold"); assert.equal(manager.getPendingMuteStore(), null); } finally { @@ -136,7 +353,6 @@ test("revert-fix: absent fetch with prior watermark blocks seed-publish via boot } }); -// 3. absent + zero watermark + non-empty → seed queued (mutation: remove seed call → pendingStore null) test("revert-fix: absent fetch with zero watermark seeds via bootstrap (first-sync preserved)", async () => { mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); mock.method(relayClient, "publishEvent", () => Promise.resolve()); @@ -144,15 +360,7 @@ test("revert-fix: absent fetch with zero watermark seeds via bootstrap (first-sy const restore = installFakeWindow(fw); try { const manager = new ChannelMuteSyncManager("pk-fresh", RELAY); - assert.equal( - fw.localStorage.getItem( - `buzz-sync-watermark.v1:channel-mutes:pk-fresh:${RELAY_KEY}`, - ), - null, - ); - const result = await manager.bootstrap( - makeStore({ ch1: { muted: true, updatedAt: 1 } }), - ); + const result = await manager.bootstrap(makeStore({ ch1: E(true, 1, 0) })); assert.equal(result.action, "hold"); assert.ok(manager.getPendingMuteStore() !== null); } finally { @@ -161,8 +369,6 @@ test("revert-fix: absent fetch with zero watermark seeds via bootstrap (first-sy } }); -// 4. relay-A / relay-B watermark isolation -// Mutation: using pubkey-only key (no relay) makes relay A's head suppress relay B's first-sync. test("revert-fix: relay-A watermark does not suppress first-sync seed on relay-B", async () => { const relayA = "wss://a.relay.test"; const relayB = "wss://b.relay.test"; @@ -176,16 +382,7 @@ test("revert-fix: relay-A watermark does not suppress first-sync seed on relay-B const restore = installFakeWindow(fw); try { const managerB = new ChannelMuteSyncManager("pk-iso", relayB); - assert.equal( - fw.localStorage.getItem( - `buzz-sync-watermark.v1:channel-mutes:pk-iso:${encodeURIComponent(relayB)}`, - ), - null, - "relay B watermark must be independent of relay A head", - ); - const result = await managerB.bootstrap( - makeStore({ ch1: { muted: true, updatedAt: 1 } }), - ); + const result = await managerB.bootstrap(makeStore({ ch1: E(true, 1, 0) })); assert.equal(result.action, "hold"); assert.ok( managerB.getPendingMuteStore() !== null, diff --git a/desktop/src/features/sidebar/lib/channelMutesSync.ts b/desktop/src/features/sidebar/lib/channelMutesSync.ts index 5e8a17e74d9..ac88f3c4bc6 100644 --- a/desktop/src/features/sidebar/lib/channelMutesSync.ts +++ b/desktop/src/features/sidebar/lib/channelMutesSync.ts @@ -7,8 +7,10 @@ import { import type { RelayEvent } from "@/shared/api/types"; import { KIND_CHANNEL_MUTES } from "@/shared/constants/kinds"; import { + clearChannelMutesOutbox, mergeStores, parseMutePayload, + writeChannelMutesOutbox, type ChannelMuteStore, } from "./channelMutesStorage"; import { @@ -22,6 +24,12 @@ const D_TAG = "channel-mutes"; const BLOB_TYPE = D_TAG; const DEBOUNCE_MS = 2_000; +// Bounded backoff for a retained pending edit whose publish failed transiently +// (timeout / socket error) on an otherwise-healthy socket, so it does not wait +// for a reconnect that may never fire. +const RETRY_BASE_MS = 2_000; +const RETRY_MAX_MS = 30_000; + export type RemoteMutes = { store: ChannelMuteStore; createdAt: number; @@ -43,10 +51,30 @@ export class ChannelMuteSyncManager { private pubkey: string; private relayUrl: string; private debounceTimer: number | null = null; + private retryTimer: number | null = null; + private retryDelayMs = RETRY_BASE_MS; private lastRemoteCreatedAt: number; private pendingStore: ChannelMuteStore | null = null; + // Monotonic id for the current pending edit. Every publishMutes() bumps it; + // every scheduled publish/retry captures the value it was queued for. A + // completion (success or no-op) may only clear pending state via + // compare-and-swap on this generation, so an older in-flight publish can + // never erase a newer edit that arrived while it was in flight. + private pendingGeneration = 0; + // Publish cycles are serialized: at most one runs at a time. A newer edit + // queued while a cycle is in flight defers; the in-flight cycle's completion + // re-drives it. Serialization guarantees there is never more than one + // fetch/publish sequence touching shared manager state. + private publishInFlight = false; private lastPublishedStore: ChannelMuteStore | null = null; private destroyed = false; + // Per-channel high-water of every `rev` and `updatedAt` this manager has + // observed (bootstrap, live, reconnect, reconcile, pre-publish, cross-window + // storage, and initial persisted state). A click reads both so its minted + // `updatedAt = max(now, maxUpdatedAtSeen)` never regresses below observed + // state (the read-state logical-monotonic idiom), and `rev = maxRevSeen + 1` + // wins the resulting same-second tie. + private highWater = new Map(); constructor(pubkey: string, relayUrl: string) { this.pubkey = pubkey; @@ -54,6 +82,29 @@ export class ChannelMuteSyncManager { this.lastRemoteCreatedAt = readWatermark(pubkey, BLOB_TYPE, relayUrl); } + /** + * Ingest a store into the per-channel high-water. Called synchronously before + * any merge is applied to React state, so a click that follows reads a current + * watermark on both dimensions. Monotonic (`Math.max`) and idempotent. + */ + observe(store: ChannelMuteStore): void { + for (const [id, entry] of Object.entries(store.channels)) { + const cur = this.highWater.get(id) ?? { rev: 0, updatedAt: 0 }; + this.highWater.set(id, { + rev: Math.max(cur.rev, entry.rev), + updatedAt: Math.max(cur.updatedAt, entry.updatedAt), + }); + } + } + + maxRevSeen(id: string): number { + return this.highWater.get(id)?.rev ?? 0; + } + + maxUpdatedAtSeen(id: string): number { + return this.highWater.get(id)?.updatedAt ?? 0; + } + async fetchRemoteMutes(): Promise> { try { const events = await relayClient.fetchEvents({ @@ -71,6 +122,7 @@ export class ChannelMuteSyncManager { if (!result) { return { status: "failed", createdAt: event.created_at }; } + this.observe(result.store); return { status: "found", data: result, @@ -94,6 +146,10 @@ export class ChannelMuteSyncManager { window.clearTimeout(this.debounceTimer); this.debounceTimer = null; } + if (this.retryTimer !== null) { + window.clearTimeout(this.retryTimer); + this.retryTimer = null; + } } getPendingMuteStore(): ChannelMuteStore | null { @@ -102,15 +158,51 @@ export class ChannelMuteSyncManager { publishMutes(store: ChannelMuteStore): void { this.pendingStore = store; + ++this.pendingGeneration; + // Persist synchronously so a click made <2s before quit/community-switch + // survives teardown and resumes on next mount (durable outbox). + writeChannelMutesOutbox(this.pubkey, store, this.relayUrl); if (this.debounceTimer !== null) { window.clearTimeout(this.debounceTimer); } + // A fresh edit supersedes any retry scheduled for the previous generation. + if (this.retryTimer !== null) { + window.clearTimeout(this.retryTimer); + this.retryTimer = null; + } + this.retryDelayMs = RETRY_BASE_MS; this.debounceTimer = window.setTimeout(() => { this.debounceTimer = null; - void this.doPublish(store); + this.startCycle(); }, DEBOUNCE_MS); } + /** + * Serialize publish cycles: at most one runs at a time. A debounce/retry timer + * that fires while a cycle is in flight defers — the in-flight cycle's + * completion re-drives if a pending edit still needs publishing. A newer edit + * queued during a cycle cannot start its own concurrent cycle, so a stale + * generation can never publish after a newer edit exists. + */ + private startCycle(): void { + if (this.destroyed || this.pendingStore === null) return; + if (this.publishInFlight) return; + const store = this.pendingStore; + const gen = this.pendingGeneration; + this.publishInFlight = true; + void this.doPublish(store, gen).finally(() => { + this.publishInFlight = false; + if ( + !this.destroyed && + this.pendingStore !== null && + this.debounceTimer === null && + this.retryTimer === null + ) { + this.startCycle(); + } + }); + } + private async fetchOwnBlobBeforePublish( store: ChannelMuteStore, ): Promise { @@ -127,6 +219,9 @@ export class ChannelMuteSyncManager { this.recordRemoteHead(event.created_at); const remote = await decryptAndParse(event); if (!remote) return store; + this.observe(remote.store); + // Max-merge: the local edit's per-entry winners survive by construction + // and any newer remote entries fold in, so no adopt step is needed. return mergeStores(store, remote.store); } catch { return store; @@ -144,22 +239,55 @@ export class ChannelMuteSyncManager { if ( !last || last.muted !== current.muted || - last.updatedAt !== current.updatedAt + last.updatedAt !== current.updatedAt || + last.rev !== current.rev ) return false; } return true; } - private async doPublish(store: ChannelMuteStore): Promise { + /** + * Clear the in-memory pending edit and its durable outbox — but only if the + * completing publish still owns the current generation. A publish for an + * older edit that finishes after a newer edit was queued must leave the newer + * edit (and its retry state) untouched. + */ + private discardPending(gen: number): void { + if (gen !== this.pendingGeneration) return; + this.pendingStore = null; + clearChannelMutesOutbox(this.pubkey, this.relayUrl); + } + + /** Schedule a bounded-backoff retry of the retained pending edit. */ + private scheduleRetry(gen: number): void { + if (this.destroyed || this.pendingStore === null) return; + // A newer edit has superseded this one; its own timer owns the retry. + if (gen !== this.pendingGeneration) return; + if (this.retryTimer !== null) return; + const delay = this.retryDelayMs; + this.retryDelayMs = Math.min(this.retryDelayMs * 2, RETRY_MAX_MS); + this.retryTimer = window.setTimeout(() => { + this.retryTimer = null; + this.startCycle(); + }, delay); + } + + private async doPublish(store: ChannelMuteStore, gen: number): Promise { + // A newer edit was queued after this publish was scheduled; it owns the + // pending state and will publish the latest store — abandon this stale run. + if (gen !== this.pendingGeneration) return; try { const merged = await this.fetchOwnBlobBeforePublish(store); // Guard: manager may have been destroyed while fetchOwnBlobBeforePublish - // was awaited (community switch during in-flight fetch). If so, abort - // before touching the relay. + // was awaited (community switch during in-flight fetch). if (this.destroyed) return; + // A newer edit was queued while we awaited the pre-publish fetch. It owns + // convergence now; the serialized cycle re-drives for it once this run + // unwinds. + if (gen !== this.pendingGeneration) return; if (this.isIdenticalToLastPublished(merged)) { - this.pendingStore = null; + this.discardPending(gen); return; } const payload = { @@ -180,17 +308,32 @@ export class ChannelMuteSyncManager { ["t", D_TAG], // relay discoverability; not used in our filters ], }); - if (this.destroyed) return; + // Final guard immediately before the network call: a newer edit may have + // been queued during the encrypt/sign await, or the manager destroyed. + if (this.destroyed || gen !== this.pendingGeneration) return; await relayClient.publishEvent( event, "Timed out publishing channel mutes.", "Failed to publish channel mutes.", ); this.recordRemoteHead(event.created_at); - this.lastPublishedStore = merged; - this.pendingStore = null; + this.observe(merged); + // Only claim this store as the published head if it is still the current + // edit; a newer edit queued mid-flight owns lastPublishedStore now. + if (gen === this.pendingGeneration) { + this.lastPublishedStore = merged; + this.retryDelayMs = RETRY_BASE_MS; + } + this.discardPending(gen); } catch (error) { + if (this.destroyed) return; + // Transient publish failure (timeout / socket error). Keep the pending + // edit and retry with backoff rather than waiting for a reconnect that a + // healthy socket never fires. Max-merge makes a duplicate publish + // idempotent, so a lost-ACK write that the relay actually accepted is + // harmless to re-send. console.warn("[channelMutesSync] publish failed:", error); + this.scheduleRetry(gen); } } @@ -211,6 +354,7 @@ export class ChannelMuteSyncManager { this.recordRemoteHead(event.created_at); void decryptAndParse(event).then((result) => { if (result) { + this.observe(result.store); onUpdate(result); } }); @@ -223,6 +367,9 @@ export class ChannelMuteSyncManager { * delegates the seed/hold/apply-remote decision to `runBootstrap`. */ async bootstrap(localStore: ChannelMuteStore) { + // Seed the high-water from the caller's persisted local store so a click + // before the remote fetch resolves already reflects retained entries. + this.observe(localStore); const fetchResult = await this.fetchRemoteMutes(); return runBootstrap({ fetchResult, @@ -236,10 +383,10 @@ export class ChannelMuteSyncManager { destroy(): void { // Cancel any pending publish and mark this manager as destroyed so any // in-flight doPublish() calls abort before reaching relayClient. - // Pending debounce-window changes are intentionally dropped: flushing - // could publish relay A's state to relay B via the shared relayClient - // singleton. Local entries survive because the apply/publish paths merge - // per-entry via mergeStores, so no local work is permanently lost. + // Debounce-window changes are NOT lost: publishMutes persisted them to the + // durable outbox synchronously, and the next mount resumes them. Flushing + // here is still avoided — it could publish relay A's state to relay B via + // the shared relayClient singleton. this.destroyed = true; this.cancelPendingMutePublish(); this.pendingStore = null; diff --git a/desktop/src/features/sidebar/lib/channelStarsStorage.test.mjs b/desktop/src/features/sidebar/lib/channelStarsStorage.test.mjs index 1585a42d47e..8239b9e8eb7 100644 --- a/desktop/src/features/sidebar/lib/channelStarsStorage.test.mjs +++ b/desktop/src/features/sidebar/lib/channelStarsStorage.test.mjs @@ -4,29 +4,50 @@ import test from "node:test"; import { boundStarStore, MAX_CHANNEL_STAR_ENTRIES, - parseStarPayload, mergeStores, + parseStarPayload, starredChannelIdsFromStore, } from "./channelStarsStorage.ts"; // ── parseStarPayload ────────────────────────────────────────────────────────── -test("parseStarPayload: valid payload with channels returns store", () => { +test("parseStarPayload: valid payload with channels returns store (rev preserved)", () => { const payload = { version: 1, channels: { - "chan-1": { starred: true, updatedAt: 1000 }, - "chan-2": { starred: false, updatedAt: 2000 }, + "chan-1": { starred: true, updatedAt: 1000, rev: 3 }, + "chan-2": { starred: false, updatedAt: 2000, rev: 0 }, }, }; - const result = parseStarPayload(payload); - assert.deepEqual(result, { + assert.deepEqual(parseStarPayload(payload), payload); +}); + +test("parseStarPayload: missing rev normalizes to 0 (old-build blob, entry kept)", () => { + const result = parseStarPayload({ + version: 1, + channels: { "chan-1": { starred: true, updatedAt: 1000 } }, + }); + assert.deepEqual(result.channels["chan-1"], { + starred: true, + updatedAt: 1000, + rev: 0, + }); +}); + +test("parseStarPayload: malformed rev (string / negative / non-integer / NaN) normalizes to 0", () => { + const result = parseStarPayload({ version: 1, channels: { - "chan-1": { starred: true, updatedAt: 1000 }, - "chan-2": { starred: false, updatedAt: 2000 }, + str: { starred: true, updatedAt: 1, rev: "5" }, + neg: { starred: true, updatedAt: 1, rev: -2 }, + frac: { starred: true, updatedAt: 1, rev: 1.5 }, + nan: { starred: true, updatedAt: 1, rev: NaN }, }, }); + for (const id of ["str", "neg", "frac", "nan"]) { + assert.equal(result.channels[id].rev, 0, `${id} rev normalized to 0`); + assert.equal(result.channels[id].starred, true, `${id} entry kept`); + } }); test("parseStarPayload: missing version returns null", () => { @@ -48,18 +69,15 @@ test("parseStarPayload: wrong version returns null", () => { ); }); -test("parseStarPayload: null input returns null", () => { +test("parseStarPayload: null / non-object input returns null", () => { assert.equal(parseStarPayload(null), null); -}); - -test("parseStarPayload: non-object input returns null", () => { assert.equal(parseStarPayload("string"), null); assert.equal(parseStarPayload(42), null); assert.equal(parseStarPayload(true), null); }); test("parseStarPayload: malformed channel entries missing starred/updatedAt are filtered out", () => { - const payload = { + const result = parseStarPayload({ version: 1, channels: { "no-starred": { updatedAt: 1000 }, @@ -69,267 +87,251 @@ test("parseStarPayload: malformed channel entries missing starred/updatedAt are "updated-at-wrong-type": { starred: true, updatedAt: "now" }, null: null, }, - }; - const result = parseStarPayload(payload); + }); assert.deepEqual(result, { version: 1, - channels: { - valid: { starred: false, updatedAt: 500 }, - }, + channels: { valid: { starred: false, updatedAt: 500, rev: 0 } }, }); }); test("parseStarPayload: NaN/Infinity/negative updatedAt entries are filtered out", () => { - const payload = { + const result = parseStarPayload({ version: 1, channels: { nan: { starred: true, updatedAt: NaN }, inf: { starred: true, updatedAt: Infinity }, "neg-inf": { starred: true, updatedAt: -Infinity }, neg: { starred: true, updatedAt: -1 }, - valid: { starred: true, updatedAt: 100 }, + valid: { starred: true, updatedAt: 100, rev: 2 }, }, - }; - const result = parseStarPayload(payload); + }); assert.deepEqual(result, { version: 1, - channels: { valid: { starred: true, updatedAt: 100 } }, + channels: { valid: { starred: true, updatedAt: 100, rev: 2 } }, }); }); -test("parseStarPayload: empty channels returns store with empty channels", () => { - const result = parseStarPayload({ version: 1, channels: {} }); - assert.deepEqual(result, { version: 1, channels: {} }); +test("parseStarPayload: empty channels / no channels key returns empty store", () => { + assert.deepEqual(parseStarPayload({ version: 1, channels: {} }), { + version: 1, + channels: {}, + }); + assert.deepEqual(parseStarPayload({ version: 1 }), { + version: 1, + channels: {}, + }); }); -test("parseStarPayload: version 1 with no channels key returns store with empty channels", () => { - const result = parseStarPayload({ version: 1 }); - assert.deepEqual(result, { version: 1, channels: {} }); -}); +// ── mergeStores: tuple order (updatedAt → rev → value) ──────────────────────── -// ── mergeStores ─────────────────────────────────────────────────────────────── +const E = (starred, updatedAt, rev) => ({ starred, updatedAt, rev }); +const S = (entry) => ({ version: 1, channels: { c: entry } }); -test("mergeStores: non-overlapping channels returns union of both", () => { - const local = { - version: 1, - channels: { "chan-a": { starred: true, updatedAt: 100 } }, - }; - const remote = { - version: 1, - channels: { "chan-b": { starred: false, updatedAt: 200 } }, - }; - const result = mergeStores(local, remote); +test("mergeStores: non-overlapping channels returns union", () => { + const result = mergeStores( + { version: 1, channels: { a: E(true, 100, 1) } }, + { version: 1, channels: { b: E(false, 200, 1) } }, + ); assert.deepEqual(result, { version: 1, - channels: { - "chan-a": { starred: true, updatedAt: 100 }, - "chan-b": { starred: false, updatedAt: 200 }, - }, + channels: { a: E(true, 100, 1), b: E(false, 200, 1) }, }); }); -test("mergeStores: overlapping channel with remote newer takes remote", () => { - const local = { - version: 1, - channels: { "chan-a": { starred: false, updatedAt: 100 } }, - }; - const remote = { - version: 1, - channels: { "chan-a": { starred: true, updatedAt: 200 } }, - }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels["chan-a"], { - starred: true, - updatedAt: 200, - }); +test("mergeStores: strictly-later updatedAt wins regardless of rev (primary key)", () => { + // Later updatedAt with LOWER rev still wins — updatedAt is primary. This is + // the old-build interop case: an old build's rev-0 fresh edit beats a stale + // rev-bearing new-build entry. + const result = mergeStores(S(E(false, 200, 0)), S(E(true, 100, 7))); + assert.deepEqual(result.channels.c, E(false, 200, 0)); }); -test("mergeStores: overlapping channel with local newer takes local", () => { - const local = { - version: 1, - channels: { "chan-a": { starred: true, updatedAt: 300 } }, - }; - const remote = { - version: 1, - channels: { "chan-a": { starred: false, updatedAt: 100 } }, - }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels["chan-a"], { - starred: true, - updatedAt: 300, - }); +test("mergeStores: equal updatedAt → higher rev wins (same-second tiebreak)", () => { + const result = mergeStores(S(E(false, 100, 5)), S(E(true, 100, 2))); + assert.deepEqual(result.channels.c, E(false, 100, 5)); }); -test("mergeStores: overlapping channel with same updatedAt local wins", () => { - const local = { - version: 1, - channels: { "chan-a": { starred: true, updatedAt: 500 } }, - }; - const remote = { - version: 1, - channels: { "chan-a": { starred: false, updatedAt: 500 } }, - }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels["chan-a"], { - starred: true, - updatedAt: 500, - }); +test("mergeStores: equal updatedAt AND equal rev → starred=true wins (leaf)", () => { + const result = mergeStores(S(E(false, 100, 3)), S(E(true, 100, 3))); + assert.deepEqual(result.channels.c, E(true, 100, 3)); }); test("mergeStores: unstar with higher updatedAt overrides star", () => { - const local = { - version: 1, - channels: { "chan-a": { starred: true, updatedAt: 100 } }, + const result = mergeStores(S(E(true, 100, 9)), S(E(false, 999, 1))); + assert.deepEqual(result.channels.c, E(false, 999, 1)); +}); + +test("mergeStores: empty local / empty remote / both empty", () => { + assert.deepEqual( + mergeStores({ version: 1, channels: {} }, S(E(true, 42, 1))).channels.c, + E(true, 42, 1), + ); + assert.deepEqual( + mergeStores(S(E(false, 10, 2)), { version: 1, channels: {} }).channels.c, + E(false, 10, 2), + ); + assert.deepEqual( + mergeStores({ version: 1, channels: {} }, { version: 1, channels: {} }), + { version: 1, channels: {} }, + ); +}); + +// ── mergeStores: algebra (commutativity, associativity, idempotence) ────────── + +function randEntry(rng) { + return { + starred: rng() > 0.5, + updatedAt: Math.floor(rng() * 5), + rev: Math.floor(rng() * 5), }; - const remote = { - version: 1, - channels: { "chan-a": { starred: false, updatedAt: 999 } }, +} +function randStore(rng, ids) { + const channels = {}; + for (const id of ids) if (rng() > 0.3) channels[id] = randEntry(rng); + return { version: 1, channels }; +} +// Deterministic LCG so failures reproduce. +function lcg(seed) { + let s = seed >>> 0; + return () => { + s = (s * 1664525 + 1013904223) >>> 0; + return s / 4294967296; }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels["chan-a"], { - starred: false, - updatedAt: 999, - }); +} + +test("mergeStores: commutative — merge(a,b) === merge(b,a)", () => { + const rng = lcg(12345); + const ids = ["a", "b", "c", "d"]; + for (let i = 0; i < 200; i++) { + const a = randStore(rng, ids); + const b = randStore(rng, ids); + assert.deepEqual(mergeStores(a, b), mergeStores(b, a)); + } +}); + +test("mergeStores: associative — merge(merge(a,b),c) === merge(a,merge(b,c))", () => { + const rng = lcg(67890); + const ids = ["a", "b", "c", "d"]; + for (let i = 0; i < 200; i++) { + const a = randStore(rng, ids); + const b = randStore(rng, ids); + const c = randStore(rng, ids); + assert.deepEqual( + mergeStores(mergeStores(a, b), c), + mergeStores(a, mergeStores(b, c)), + ); + } }); -test("mergeStores: empty local returns remote entries", () => { - const local = { version: 1, channels: {} }; - const remote = { +test("mergeStores: idempotent — merge(a, merge(a,b)) === merge(a,b)", () => { + const rng = lcg(24680); + const ids = ["a", "b", "c", "d"]; + for (let i = 0; i < 200; i++) { + const a = randStore(rng, ids); + const b = randStore(rng, ids); + const ab = mergeStores(a, b); + assert.deepEqual(mergeStores(a, ab), ab); + assert.deepEqual(mergeStores(ab, ab), ab); + } +}); + +// ── v1-blob bidirectional compatibility ─────────────────────────────────────── + +test("v1 compat: a rev-carrying blob round-trips through a rev-less parser view", () => { + // Simulate an old build reading our blob: JSON-serialize our rev-carrying + // payload, parse it back — version stays 1 so it is NOT rejected, and the + // core fields survive (old build simply ignores rev). + const ours = { version: 1, - channels: { "chan-b": { starred: true, updatedAt: 42 } }, + channels: { c: { starred: true, updatedAt: 100, rev: 7 } }, }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels, { - "chan-b": { starred: true, updatedAt: 42 }, - }); + const roundTripped = parseStarPayload(JSON.parse(JSON.stringify(ours))); + assert.equal(roundTripped.version, 1, "version stays 1 — old build accepts"); + assert.equal(roundTripped.channels.c.starred, true); + assert.equal(roundTripped.channels.c.updatedAt, 100); }); -test("mergeStores: empty remote returns local entries", () => { - const local = { +test("v1 compat: old-build unstar (no rev, updatedAt+1) beats our stale star", () => { + // New build wrote {starred:true, rev:7, updatedAt:t}; old build (no rev) + // unstars producing {starred:false, updatedAt:t+1}. The unstar wins on the + // primary updatedAt key — old builds can still edit upgraded channels. + const ours = S(E(true, 100, 7)); + const oldBuildUnstar = parseStarPayload({ version: 1, - channels: { "chan-a": { starred: false, updatedAt: 10 } }, - }; - const remote = { version: 1, channels: {} }; - const result = mergeStores(local, remote); - assert.deepEqual(result.channels, { - "chan-a": { starred: false, updatedAt: 10 }, + channels: { c: { starred: false, updatedAt: 101 } }, + }); + assert.deepEqual(mergeStores(ours, oldBuildUnstar).channels.c, { + starred: false, + updatedAt: 101, + rev: 0, }); }); -test("mergeStores: both empty returns empty", () => { - const result = mergeStores( - { version: 1, channels: {} }, - { version: 1, channels: {} }, - ); - assert.deepEqual(result, { version: 1, channels: {} }); -}); +// ── boundStarStore ──────────────────────────────────────────────────────────── test("boundStarStore: retains newest entries regardless of starred value", () => { const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, index) => [ - `active-${index}`, - { starred: true, updatedAt: index + 1 }, + Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, i) => [ + `active-${i}`, + E(true, i + 1, 0), ]), ); - channels["old-false"] = { starred: false, updatedAt: 0 }; - channels["new-false"] = { starred: false, updatedAt: 9999 }; - + channels["old-false"] = E(false, 0, 0); + channels["new-false"] = E(false, 9999, 0); const result = boundStarStore({ version: 1, channels }); - assert.equal(Object.keys(result.channels).length, MAX_CHANNEL_STAR_ENTRIES); assert.equal(result.channels["old-false"], undefined); - assert.deepEqual(result.channels["new-false"], { - starred: false, - updatedAt: 9999, - }); + assert.deepEqual(result.channels["new-false"], E(false, 9999, 0)); assert.equal(result.channels["active-0"], undefined); - assert.deepEqual(result.channels["active-1"], { - starred: true, - updatedAt: 2, - }); }); test("boundStarStore: uses channel ID as an updatedAt tie-breaker", () => { const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_STAR_ENTRIES + 1 }, (_, index) => [ - `channel-${String(MAX_CHANNEL_STAR_ENTRIES - index).padStart(3, "0")}`, - { starred: true, updatedAt: 1 }, + Array.from({ length: MAX_CHANNEL_STAR_ENTRIES + 1 }, (_, i) => [ + `channel-${String(MAX_CHANNEL_STAR_ENTRIES - i).padStart(3, "0")}`, + E(true, 1, 0), ]), ); - const result = boundStarStore({ version: 1, channels }); - assert.equal(result.channels["channel-000"], undefined); - assert.deepEqual(result.channels["channel-500"], { - starred: true, - updatedAt: 1, - }); -}); - -test("boundStarStore: preserves a same-second star mutation by key", () => { - const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, index) => [ - `z-channel-${String(index).padStart(3, "0")}`, - { starred: true, updatedAt: 1 }, - ]), - ); - channels["a-target"] = { starred: true, updatedAt: 1 }; - - const result = boundStarStore({ version: 1, channels }, "a-target"); - - assert.equal(Object.keys(result.channels).length, MAX_CHANNEL_STAR_ENTRIES); - assert.deepEqual(result.channels["a-target"], { - starred: true, - updatedAt: 1, - }); - assert.equal(result.channels["z-channel-000"], undefined); + assert.deepEqual(result.channels["channel-500"], E(true, 1, 0)); }); -test("boundStarStore: preserves a same-second unstar mutation by key", () => { +test("boundStarStore: preserves a same-second mutation by key", () => { const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, index) => [ - `z-channel-${String(index).padStart(3, "0")}`, - { starred: true, updatedAt: 1 }, + Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, i) => [ + `z-channel-${String(i).padStart(3, "0")}`, + E(true, 1, 0), ]), ); - channels["a-target"] = { starred: false, updatedAt: 1 }; - + channels["a-target"] = E(false, 1, 1); const result = boundStarStore({ version: 1, channels }, "a-target"); - assert.equal(Object.keys(result.channels).length, MAX_CHANNEL_STAR_ENTRIES); - assert.deepEqual(result.channels["a-target"], { - starred: false, - updatedAt: 1, - }); + assert.deepEqual(result.channels["a-target"], E(false, 1, 1)); assert.equal(result.channels["z-channel-000"], undefined); }); test("mergeStores: a fresh at-capacity unstar defeats an older remote star", () => { const channels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, index) => [ - `active-${index}`, - { starred: true, updatedAt: index + 1 }, + Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, i) => [ + `active-${i}`, + E(true, i + 1, 0), ]), ); - channels["unstarred"] = { starred: false, updatedAt: 9999 }; + channels.unstarred = E(false, 9999, 1); const bounded = boundStarStore({ version: 1, channels }); - const result = mergeStores(bounded, { version: 1, - channels: { unstarred: { starred: true, updatedAt: 9998 } }, - }); - - assert.deepEqual(result.channels.unstarred, { - starred: false, - updatedAt: 9999, + channels: { unstarred: E(true, 9998, 5) }, }); + assert.deepEqual(result.channels.unstarred, E(false, 9999, 1)); }); test("mergeStores: evicted remote ID re-enters and the oldest state is re-trimmed", () => { const localChannels = Object.fromEntries( - Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, index) => [ - `active-${index}`, - { starred: true, updatedAt: index + 10 }, + Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, i) => [ + `active-${i}`, + E(true, i + 10, 0), ]), ); const result = mergeStores( @@ -337,59 +339,84 @@ test("mergeStores: evicted remote ID re-enters and the oldest state is re-trimme { version: 1, channels: { - "evicted-id": { starred: true, updatedAt: 9999 }, - "active-0": { starred: false, updatedAt: 9998 }, + "evicted-id": E(true, 9999, 0), + "active-0": E(false, 9998, 0), }, }, ); - assert.equal(Object.keys(result.channels).length, MAX_CHANNEL_STAR_ENTRIES); - assert.deepEqual(result.channels["evicted-id"], { - starred: true, - updatedAt: 9999, - }); - assert.deepEqual(result.channels["active-0"], { - starred: false, - updatedAt: 9998, - }); + assert.deepEqual(result.channels["evicted-id"], E(true, 9999, 0)); + assert.deepEqual(result.channels["active-0"], E(false, 9998, 0)); assert.equal(result.channels["active-1"], undefined); - assert.deepEqual(result.channels["active-2"], { - starred: true, - updatedAt: 12, - }); }); -// ── starredChannelIdsFromStore ──────────────────────────────────────────────── +// ── Eviction / remount (finding 3) ──────────────────────────────────────────── + +// Easy branch: X evicted at an OLDER second → remount (high-water lost) → click +// X at the current second → merge a remote carrying X at a high rev but an old +// updatedAt. The click's newer updatedAt wins on the primary key; the lost rev +// high-water is irrelevant. Closed by construction for all cross-second cases. +test("finding 3 easy branch: a fresh click beats an evicted high-rev entry at an older updatedAt", () => { + // Remount state: the user clicks X fresh at updatedAt=now, empty high-water + // (evicted), so rev mints to 1. + const click = S(E(true, 1000, 1)); + // The previously observed remote X sits at an OLD updatedAt with a high rev. + const remote = S(E(false, 500, 100)); + const merged = mergeStores(click, remote); + assert.deepEqual( + merged.channels.c, + E(true, 1000, 1), + "fresh click wins on the primary updatedAt key", + ); +}); -test("starredChannelIdsFromStore: returns set of IDs where starred=true", () => { - const store = { - version: 1, - channels: { - "chan-a": { starred: true, updatedAt: 100 }, - "chan-b": { starred: true, updatedAt: 200 }, - "chan-c": { starred: false, updatedAt: 300 }, - }, - }; - const result = starredChannelIdsFromStore(store); - assert.equal(result.has("chan-a"), true); - assert.equal(result.has("chan-b"), true); - assert.equal(result.has("chan-c"), false); - assert.equal(result.size, 2); +// Hard branch (Thufir's exact equal-second counterexample): >500 entries all at +// the CURRENT second → X evicted by the id tiebreak (not because it is old) → +// remount in the same second → click X at rev 1 (empty high-water) → merge the +// previously observed remote X at rev 100, EQUAL updatedAt. updatedAt ties, rev +// decides, 100 > 1 — the click LOSES. Documented deterministic residual, proven +// here as the hard branch (not disguised as safety). +test("finding 3 hard branch: equal-second evicted click (rev 1) loses to observed remote (rev 100)", () => { + const NOW = 777; + // Remount click on the evicted channel: empty high-water → rev 1, updatedAt=NOW. + const click = S(E(true, NOW, 1)); + // The previously observed remote for the same channel at the same second, + // rev 100 (it may precede the remount — not genuinely concurrent). + const remote = S(E(false, NOW, 100)); + const merged = mergeStores(click, remote); + assert.deepEqual( + merged.channels.c, + E(false, NOW, 100), + "equal updatedAt → higher rev wins deterministically (documented residual)", + ); + // Deterministic either merge order — a lost click, never a divergence. + assert.deepEqual(mergeStores(remote, click).channels.c, E(false, NOW, 100)); }); -test("starredChannelIdsFromStore: excludes IDs where starred=false", () => { - const store = { +// ── starredChannelIdsFromStore ──────────────────────────────────────────────── + +test("starredChannelIdsFromStore: returns set of IDs where starred=true", () => { + const result = starredChannelIdsFromStore({ version: 1, channels: { - "chan-x": { starred: false, updatedAt: 1 }, - "chan-y": { starred: false, updatedAt: 2 }, + a: E(true, 100, 0), + b: E(true, 200, 0), + c: E(false, 300, 0), }, - }; - const result = starredChannelIdsFromStore(store); - assert.equal(result.size, 0); + }); + assert.deepEqual([...result].sort(), ["a", "b"]); }); -test("starredChannelIdsFromStore: empty channels returns empty set", () => { - const result = starredChannelIdsFromStore({ version: 1, channels: {} }); - assert.equal(result.size, 0); +test("starredChannelIdsFromStore: all-false / empty returns empty set", () => { + assert.equal( + starredChannelIdsFromStore({ + version: 1, + channels: { x: E(false, 1, 0) }, + }).size, + 0, + ); + assert.equal( + starredChannelIdsFromStore({ version: 1, channels: {} }).size, + 0, + ); }); diff --git a/desktop/src/features/sidebar/lib/channelStarsStorage.ts b/desktop/src/features/sidebar/lib/channelStarsStorage.ts index 23e567f40bf..9bb7979cb60 100644 --- a/desktop/src/features/sidebar/lib/channelStarsStorage.ts +++ b/desktop/src/features/sidebar/lib/channelStarsStorage.ts @@ -1,9 +1,16 @@ +import { normalizeRelayUrl } from "@/shared/lib/normalizeRelayUrl"; + const STORAGE_KEY_PREFIX = "buzz-channel-stars.v1"; export const MAX_CHANNEL_STAR_ENTRIES = 500; export type ChannelStarEntry = { starred: boolean; updatedAt: number; + // Per-channel Lamport revision. Breaks a same-second `updatedAt` tie that the + // integer clock cannot resolve. Absent in blobs from an older build ⇒ read as + // 0 (a valid, mergeable value), so the payload stays `version: 1` and older + // builds still parse our blobs. + rev: number; }; export type ChannelStarStore = { @@ -29,8 +36,8 @@ export function parseStarPayload(json: unknown): ChannelStarStore | null { obj.channels !== null && !Array.isArray(obj.channels) ? Object.fromEntries( - Object.entries(obj.channels as Record).filter( - (entry): entry is [string, ChannelStarEntry] => { + Object.entries(obj.channels as Record) + .filter((entry): entry is [string, Record] => { const v = entry[1]; return ( typeof v === "object" && @@ -42,8 +49,27 @@ export function parseStarPayload(json: unknown): ChannelStarStore | null { ) && ((v as Record).updatedAt as number) >= 0 ); - }, - ), + }) + // Normalize `rev`: accept a non-negative integer, otherwise 0. An + // entry is never dropped solely because `rev` is absent (older + // build) or malformed — absence is a valid mergeable value. + .map(([id, v]) => { + const rawRev = v.rev; + const rev = + typeof rawRev === "number" && + Number.isInteger(rawRev) && + rawRev >= 0 + ? rawRev + : 0; + return [ + id, + { + starred: v.starred as boolean, + updatedAt: v.updatedAt as number, + rev, + }, + ]; + }), ) : {}; return boundStarStore({ version: 1, channels }); @@ -108,79 +134,47 @@ export function writeChannelStarsStore( } } -export function mergeStores( - local: ChannelStarStore, - remote: ChannelStarStore, -): ChannelStarStore { - return mergeStoresWithTie(local, remote, false); -} - /** - * Merge a remote store that has already won the event-level canonical tie-break - * (`created_at DESC, id ASC`) into the local store, resolving a per-entry - * `updatedAt` tie in favour of the *remote* value. Once the comparator has - * chosen this remote event as the stored winner, its per-entry values must - * survive, or a stale value from a superseded larger-id event delivered first - * would win the merge and silently undo the canonical winner. Strictly-newer - * local per-entry edits (`l.updatedAt > r.updatedAt`) still win. + * Merge two star stores by a per-channel total order: + * `updatedAt` DESC → `rev` DESC → `starred === true` wins. This order is + * commutative, associative, and idempotent (before bounding), so every + * observation path (bootstrap, live, reconnect, reconcile, pre-publish, + * cross-window storage) applies it with no ordering or ownership overlay and + * all replicas converge. + * + * `updatedAt` is primary so a strictly-later edit — from any build, whether it + * carries `rev` or (older build) reads `rev: 0` — wins outright. `rev` breaks + * only a same-second `updatedAt` tie: the ambiguous integer-second window the + * clock cannot resolve, where a click that minted `rev = maxSeen + 1` dominates + * any same-second state it observed. On a full tie (equal `updatedAt` AND equal + * `rev`) `true` wins as the deterministic leaf. */ -export function mergeApplyingRemote( - local: ChannelStarStore, - remote: ChannelStarStore, -): ChannelStarStore { - return mergeStoresWithTie(local, remote, true); -} - -function mergeStoresWithTie( - local: ChannelStarStore, - remote: ChannelStarStore, - preferRemoteOnTie: boolean, +export function mergeStores( + a: ChannelStarStore, + b: ChannelStarStore, ): ChannelStarStore { const allIds = new Set([ - ...Object.keys(local.channels), - ...Object.keys(remote.channels), + ...Object.keys(a.channels), + ...Object.keys(b.channels), ]); const merged: Record = {}; for (const id of allIds) { - const l = local.channels[id]; - const r = remote.channels[id]; - if (l && r) { - const localWins = preferRemoteOnTie - ? l.updatedAt > r.updatedAt - : l.updatedAt >= r.updatedAt; - merged[id] = localWins ? l : r; - } else { - merged[id] = (l ?? r) as ChannelStarEntry; - } + const l = a.channels[id]; + const r = b.channels[id]; + merged[id] = l && r ? pickStarEntry(l, r) : ((l ?? r) as ChannelStarEntry); } return boundStarStore({ version: 1, channels: merged }); } -/** - * Apply a canonical lower-id correction (`mergeApplyingRemote`: remote wins a - * per-entry `updatedAt` tie) while preserving entries the user changed locally - * since the superseded head was applied. The correction canonicalises remote - * history, but a same-second local click carries integer-second `updatedAt` - * equal to the remote's, so the plain remote-wins tie would silently clobber - * it. For each `dirtyId` the local entry wins only the tie (`l.updatedAt >= - * r.updatedAt`) — a genuinely newer remote value still wins, so a stale dirty - * id can never override a later correction. - */ -export function mergeCanonicalSupersession( - local: ChannelStarStore, - remote: ChannelStarStore, - dirtyIds: ReadonlySet, -): ChannelStarStore { - const applied = mergeApplyingRemote(local, remote); - if (dirtyIds.size === 0) return applied; - const channels = { ...applied.channels }; - for (const id of dirtyIds) { - const l = local.channels[id]; - if (!l) continue; - const r = remote.channels[id]; - if (!r || l.updatedAt >= r.updatedAt) channels[id] = l; - } - return boundStarStore({ version: 1, channels }); +/** The winner of two entries under `updatedAt` → `rev` → `starred` order. */ +function pickStarEntry( + l: ChannelStarEntry, + r: ChannelStarEntry, +): ChannelStarEntry { + if (l.updatedAt !== r.updatedAt) return l.updatedAt > r.updatedAt ? l : r; + if (l.rev !== r.rev) return l.rev > r.rev ? l : r; + if (l.starred !== r.starred) return l.starred ? l : r; + return l; } export function starredChannelIdsFromStore( @@ -192,3 +186,62 @@ export function starredChannelIdsFromStore( .map(([id]) => id), ); } + +const OUTBOX_KEY_PREFIX = "buzz-channel-stars-outbox.v1"; + +// The outbox is a per-relay sync-lane structure (like the watermark), so it is +// relay-scoped even though the main store stays pubkey-only: an edit made +// against relay A must never resume-publish onto relay B after a community +// switch. +function outboxKey(pubkey: string, relayUrl: string): string { + return `${OUTBOX_KEY_PREFIX}:${pubkey}:${encodeURIComponent(normalizeRelayUrl(relayUrl))}`; +} + +/** + * Persist an unpublished edit so it survives quit/community-switch within the + * 2s publish debounce. Written synchronously on every click; cleared once the + * edit is published or found identical to the last published store. Resumed on + * next mount so a durable intent is never silently dropped at teardown. + */ +export function writeChannelStarsOutbox( + pubkey: string, + store: ChannelStarStore, + relayUrl: string, +): void { + try { + window.localStorage.setItem( + outboxKey(pubkey, relayUrl), + JSON.stringify(boundStarStore(store)), + ); + } catch { + // Best-effort durability; the in-memory pendingStore still drives this + // session's publish even if the persisted copy could not be written. + } +} + +/** Read a persisted unpublished edit, or null when none/unparseable. */ +export function readChannelStarsOutbox( + pubkey: string, + relayUrl: string, +): ChannelStarStore | null { + try { + const raw = window.localStorage.getItem(outboxKey(pubkey, relayUrl)); + if (!raw) return null; + return parseStarPayload(JSON.parse(raw)); + } catch { + return null; + } +} + +/** Clear the persisted outbox (edit published or a no-op). */ +export function clearChannelStarsOutbox( + pubkey: string, + relayUrl: string, +): void { + try { + window.localStorage.removeItem(outboxKey(pubkey, relayUrl)); + } catch { + // Ignore — a stale outbox entry is re-evaluated (and re-cleared if + // identical to the head) on the next publish attempt. + } +} diff --git a/desktop/src/features/sidebar/lib/channelStarsSync.test.mjs b/desktop/src/features/sidebar/lib/channelStarsSync.test.mjs index b0235744672..d238f3c0fa4 100644 --- a/desktop/src/features/sidebar/lib/channelStarsSync.test.mjs +++ b/desktop/src/features/sidebar/lib/channelStarsSync.test.mjs @@ -4,8 +4,9 @@ import test, { mock } from "node:test"; import { relayClient } from "@/shared/api/relayClient"; import { ChannelStarSyncManager } from "./channelStarsSync.ts"; import { - makeFakeWindow, installFakeWindow, + installTauriMock, + makeFakeWindow, } from "./sidebarSyncTestHelpers.mjs"; const RELAY = "wss://r.test"; @@ -14,12 +15,70 @@ const RELAY_KEY = encodeURIComponent(RELAY); function makeStore(channels = {}) { return { version: 1, channels }; } +const E = (starred, updatedAt, rev) => ({ starred, updatedAt, rev }); + +// Multi-slot timer fake keyed by delay, for overlapping-publish tests. Mirrors +// the sections suite convention (channelSectionsSync.test.mjs:407-432). +function makeMultiTimerWindow() { + const storage = new Map(); + const timers = new Map(); + let nextId = 1; + const win = { + localStorage: { + getItem: (k) => storage.get(k) ?? null, + setItem: (k, v) => storage.set(k, v), + removeItem: (k) => storage.delete(k), + }, + setTimeout: (fn, ms) => { + const id = nextId++; + timers.set(id, { fn, ms }); + return id; + }, + clearTimeout: (id) => timers.delete(id), + }; + return { + win, + storage, + timers, + fireDelay: async (ms) => { + const entry = [...timers.entries()].find(([, v]) => v.ms === ms); + assert.ok(entry, `expected a timer scheduled at ${ms}ms`); + timers.delete(entry[0]); + entry[1].fn(); + for (let i = 0; i < 50; i++) await Promise.resolve(); + }, + hasDelay: (ms) => [...timers.values()].some((t) => t.ms === ms), + }; +} + +// ─── observe() / high-water ingestion ───────────────────────────────────────── + +test("observe: high-water is per-channel max of rev and updatedAt, monotonic", () => { + const fw = makeFakeWindow(); + const restore = installFakeWindow(fw); + try { + const m = new ChannelStarSyncManager("pk", RELAY); + m.observe(makeStore({ a: E(true, 100, 3), b: E(false, 50, 1) })); + assert.equal(m.maxRevSeen("a"), 3); + assert.equal(m.maxUpdatedAtSeen("a"), 100); + // A later observation raises each dimension independently; a lower one + // never regresses either. + m.observe(makeStore({ a: E(true, 90, 5) })); + assert.equal(m.maxRevSeen("a"), 5, "rev raised"); + assert.equal(m.maxUpdatedAtSeen("a"), 100, "updatedAt not regressed"); + m.observe(makeStore({ a: E(true, 200, 2) })); + assert.equal(m.maxUpdatedAtSeen("a"), 200, "updatedAt raised"); + assert.equal(m.maxRevSeen("a"), 5, "rev not regressed"); + // Unseen channel reports zero on both dimensions. + assert.equal(m.maxRevSeen("never"), 0); + assert.equal(m.maxUpdatedAtSeen("never"), 0); + } finally { + restore(); + } +}); // ─── destroy() must cancel pending publish, not flush ───────────────────────── -// Regression guard for the community-switch cross-relay publish vector: -// star a channel in relay A → destroy() called (relayUrl dep change) → -// no publish should fire. test("destroy: cancels pending publish without flushing to the relay", () => { const publishCalls = []; mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); @@ -31,7 +90,7 @@ test("destroy: cancels pending publish without flushing to the relay", () => { const restore = installFakeWindow(fw); try { const manager = new ChannelStarSyncManager("pk-test", RELAY); - manager.publishStars(makeStore({ ch1: { starred: true, updatedAt: 100 } })); + manager.publishStars(makeStore({ ch1: E(true, 100, 1) })); manager.destroy(); assert.equal(publishCalls.length, 0, "no publish after destroy"); assert.equal(manager.getPendingStarStore(), null); @@ -60,7 +119,7 @@ test("destroy: aborts in-flight doPublish after fetchOwnBlobBeforePublish resolv const restore = installFakeWindow(fw); try { const manager = new ChannelStarSyncManager("pk-race", RELAY); - manager.publishStars(makeStore({ ch1: { starred: true, updatedAt: 100 } })); + manager.publishStars(makeStore({ ch1: E(true, 100, 1) })); fw._fireTimer(); manager.destroy(); releaseFetch(); @@ -87,9 +146,175 @@ test("destroy: is safe to call with no pending publish", () => { } }); +// ─── Generation CAS: A-in-flight → B-click → A-completes (both variants) ────── + +// Finding 2 (A succeeds): an older in-flight publish that completes after a +// newer edit is queued must NOT clear the newer edit's pending store/outbox, +// and B must reach the relay via the completion re-drive. Mutation: dropping the +// generation CAS in discardPending lets A's success null out B's pending+outbox. +test("A-in-flight → B-click → A-succeeds: B stays pending and B publishes", async () => { + let releaseFirst = null; + const publishedContents = []; + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + mock.method(relayClient, "publishEvent", () => { + if (releaseFirst === null && publishedContents.length === 0) { + return new Promise((res) => { + releaseFirst = res; + }); + } + return Promise.resolve(); + }); + const t = makeMultiTimerWindow(); + const restore = installFakeWindow(t.win); + const tauri = installTauriMock("{}"); + const outboxKey = `buzz-channel-stars-outbox.v1:pk-ab:${RELAY_KEY}`; + try { + const manager = new ChannelStarSyncManager("pk-ab", RELAY); + const storeA = makeStore({ a: E(true, 100, 1) }); + const storeB = makeStore({ b: E(true, 101, 1) }); + + manager.publishStars(storeA); + await t.fireDelay(2000); // doPublish(A) awaits publishEvent + while (releaseFirst === null) await Promise.resolve(); + + // B arrives while A is in flight. + manager.publishStars(storeB); + assert.deepEqual( + Object.keys(manager.getPendingStarStore().channels), + ["b"], + "B is now pending", + ); + assert.ok(t.storage.get(outboxKey), "outbox holds B"); + + // A completes — must NOT clear B. + releaseFirst(); + for (let i = 0; i < 50; i++) await Promise.resolve(); + assert.deepEqual( + Object.keys(manager.getPendingStarStore()?.channels ?? {}), + ["b"], + "older A completion leaves B pending", + ); + assert.ok(t.storage.get(outboxKey), "older A completion leaves B outbox"); + + // B's own debounce fires and B reaches the relay (published) with no kick. + const capturedBefore = tauri.capturedPlaintext(); + await t.fireDelay(2000); + for (let i = 0; i < 50; i++) await Promise.resolve(); + const captured = tauri.capturedPlaintext(); + assert.ok( + captured && captured !== capturedBefore && captured.includes('"b"'), + "B is published to the relay", + ); + assert.equal( + manager.getPendingStarStore(), + null, + "B cleared after publish", + ); + assert.equal(t.storage.get(outboxKey), undefined, "B outbox cleared"); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// Finding 2 (A fails): A's publish rejects after B is queued. B must remain +// pending and be published by the serialized re-drive / retry — no manual kick. +test("A-in-flight → B-click → A-fails: B remains pending and B publishes", async () => { + let rejectFirst = null; + let publishCount = 0; + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + mock.method(relayClient, "publishEvent", () => { + publishCount++; + if (publishCount === 1) { + return new Promise((_res, rej) => { + rejectFirst = () => rej(new Error("socket error")); + }); + } + return Promise.resolve(); + }); + const t = makeMultiTimerWindow(); + const restore = installFakeWindow(t.win); + const tauri = installTauriMock("{}"); + const outboxKey = `buzz-channel-stars-outbox.v1:pk-abfail:${RELAY_KEY}`; + try { + const manager = new ChannelStarSyncManager("pk-abfail", RELAY); + manager.publishStars(makeStore({ a: E(true, 100, 1) })); + await t.fireDelay(2000); + while (rejectFirst === null) await Promise.resolve(); + + manager.publishStars(makeStore({ b: E(true, 101, 1) })); + rejectFirst(); // A fails + for (let i = 0; i < 50; i++) await Promise.resolve(); + + assert.deepEqual( + Object.keys(manager.getPendingStarStore()?.channels ?? {}), + ["b"], + "B still pending after A's failure", + ); + assert.ok(t.storage.get(outboxKey), "B outbox intact after A's failure"); + + // B's debounce fires and B publishes successfully. + await t.fireDelay(2000); + for (let i = 0; i < 50; i++) await Promise.resolve(); + const captured = tauri.capturedPlaintext(); + assert.ok(captured?.includes('"b"'), "B published"); + assert.equal(manager.getPendingStarStore(), null, "B cleared"); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + +// ─── Bounded-backoff retry: failed publish on a healthy socket, no later edit ─ + +// Finding 2: a transient publish failure with the socket open and NO further +// click must self-heal via the bounded-backoff retry — the pending edit is kept +// and a retry timer is scheduled. Mutation: dropping scheduleRetry leaves the +// edit stranded (Will's "make another change to kick it" symptom). +test("failed publish schedules a bounded-backoff retry and keeps the pending edit", async () => { + let publishCount = 0; + mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); + mock.method(relayClient, "publishEvent", () => { + publishCount++; + if (publishCount === 1) return Promise.reject(new Error("timeout")); + return Promise.resolve(); + }); + const t = makeMultiTimerWindow(); + const restore = installFakeWindow(t.win); + const tauri = installTauriMock("{}"); + try { + const manager = new ChannelStarSyncManager("pk-retry", RELAY); + manager.publishStars(makeStore({ a: E(true, 100, 1) })); + await t.fireDelay(2000); // debounce → doPublish → publishEvent rejects + assert.ok( + manager.getPendingStarStore() !== null, + "pending edit retained after failure", + ); + assert.ok(t.hasDelay(2000), "a retry timer at RETRY_BASE_MS is scheduled"); + + // The retry fires and the second publish succeeds → pending cleared. + await t.fireDelay(2000); + for (let i = 0; i < 50; i++) await Promise.resolve(); + assert.equal(publishCount, 2, "retry re-published"); + assert.equal( + manager.getPendingStarStore(), + null, + "pending cleared on retry success", + ); + manager.destroy(); + } finally { + tauri.restore(); + restore(); + mock.reset(); + } +}); + // ─── Boot seed-publish guard (the revert-fix regression suite) ───────────────── -// 1. fetch failed → hold, pendingStore null (mutation: remove failed guard → seed queued) test("revert-fix: fetch failed (error) does not trigger seed-publish via bootstrap", async () => { mock.method(relayClient, "fetchEvents", () => Promise.reject(new Error("relay timeout")), @@ -99,9 +324,7 @@ test("revert-fix: fetch failed (error) does not trigger seed-publish via bootstr const restore = installFakeWindow(fw); try { const manager = new ChannelStarSyncManager("pk-fail", RELAY); - const result = await manager.bootstrap( - makeStore({ ch1: { starred: true, updatedAt: 1 } }), - ); + const result = await manager.bootstrap(makeStore({ ch1: E(true, 1, 0) })); assert.equal(result.action, "hold"); assert.equal(manager.getPendingStarStore(), null); } finally { @@ -110,7 +333,6 @@ test("revert-fix: fetch failed (error) does not trigger seed-publish via bootstr } }); -// 2. absent + prior watermark → hold, pendingStore null (mutation: clear watermark → seed queued) test("revert-fix: absent fetch with prior watermark blocks seed-publish via bootstrap", async () => { mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); mock.method(relayClient, "publishEvent", () => Promise.resolve()); @@ -122,16 +344,7 @@ test("revert-fix: absent fetch with prior watermark blocks seed-publish via boot const restore = installFakeWindow(fw); try { const manager = new ChannelStarSyncManager("pk-stale", RELAY); - assert.ok( - Number( - fw.localStorage.getItem( - `buzz-sync-watermark.v1:channel-stars:pk-stale:${RELAY_KEY}`, - ) ?? "0", - ) > 0, - ); - const result = await manager.bootstrap( - makeStore({ ch1: { starred: true, updatedAt: 1 } }), - ); + const result = await manager.bootstrap(makeStore({ ch1: E(true, 1, 0) })); assert.equal(result.action, "hold"); assert.equal(manager.getPendingStarStore(), null); } finally { @@ -140,7 +353,6 @@ test("revert-fix: absent fetch with prior watermark blocks seed-publish via boot } }); -// 3. absent + zero watermark + non-empty → seed queued (mutation: remove seed call → pendingStore null) test("revert-fix: absent fetch with zero watermark seeds via bootstrap (first-sync preserved)", async () => { mock.method(relayClient, "fetchEvents", () => Promise.resolve([])); mock.method(relayClient, "publishEvent", () => Promise.resolve()); @@ -148,15 +360,7 @@ test("revert-fix: absent fetch with zero watermark seeds via bootstrap (first-sy const restore = installFakeWindow(fw); try { const manager = new ChannelStarSyncManager("pk-fresh", RELAY); - assert.equal( - fw.localStorage.getItem( - `buzz-sync-watermark.v1:channel-stars:pk-fresh:${RELAY_KEY}`, - ), - null, - ); - const result = await manager.bootstrap( - makeStore({ ch1: { starred: true, updatedAt: 1 } }), - ); + const result = await manager.bootstrap(makeStore({ ch1: E(true, 1, 0) })); assert.equal(result.action, "hold"); assert.ok(manager.getPendingStarStore() !== null); } finally { @@ -165,8 +369,6 @@ test("revert-fix: absent fetch with zero watermark seeds via bootstrap (first-sy } }); -// 4. relay-A / relay-B watermark isolation -// Mutation: using pubkey-only key (no relay) makes relay A's head suppress relay B's first-sync. test("revert-fix: relay-A watermark does not suppress first-sync seed on relay-B", async () => { const relayA = "wss://a.relay.test"; const relayB = "wss://b.relay.test"; @@ -180,16 +382,7 @@ test("revert-fix: relay-A watermark does not suppress first-sync seed on relay-B const restore = installFakeWindow(fw); try { const managerB = new ChannelStarSyncManager("pk-iso", relayB); - assert.equal( - fw.localStorage.getItem( - `buzz-sync-watermark.v1:channel-stars:pk-iso:${encodeURIComponent(relayB)}`, - ), - null, - "relay B watermark must be independent of relay A head", - ); - const result = await managerB.bootstrap( - makeStore({ ch1: { starred: true, updatedAt: 1 } }), - ); + const result = await managerB.bootstrap(makeStore({ ch1: E(true, 1, 0) })); assert.equal(result.action, "hold"); assert.ok( managerB.getPendingStarStore() !== null, diff --git a/desktop/src/features/sidebar/lib/channelStarsSync.ts b/desktop/src/features/sidebar/lib/channelStarsSync.ts index a5abec03fba..695cfc3ebc5 100644 --- a/desktop/src/features/sidebar/lib/channelStarsSync.ts +++ b/desktop/src/features/sidebar/lib/channelStarsSync.ts @@ -7,8 +7,10 @@ import { import type { RelayEvent } from "@/shared/api/types"; import { KIND_CHANNEL_STARS } from "@/shared/constants/kinds"; import { + clearChannelStarsOutbox, mergeStores, parseStarPayload, + writeChannelStarsOutbox, type ChannelStarStore, } from "./channelStarsStorage"; import { @@ -22,6 +24,12 @@ const D_TAG = "channel-stars"; const BLOB_TYPE = D_TAG; const DEBOUNCE_MS = 2_000; +// Bounded backoff for a retained pending edit whose publish failed transiently +// (timeout / socket error) on an otherwise-healthy socket, so it does not wait +// for a reconnect that may never fire. +const RETRY_BASE_MS = 2_000; +const RETRY_MAX_MS = 30_000; + export type RemoteStars = { store: ChannelStarStore; createdAt: number; @@ -43,10 +51,30 @@ export class ChannelStarSyncManager { private pubkey: string; private relayUrl: string; private debounceTimer: number | null = null; + private retryTimer: number | null = null; + private retryDelayMs = RETRY_BASE_MS; private lastRemoteCreatedAt: number; private pendingStore: ChannelStarStore | null = null; + // Monotonic id for the current pending edit. Every publishStars() bumps it; + // every scheduled publish/retry captures the value it was queued for. A + // completion (success or no-op) may only clear pending state via + // compare-and-swap on this generation, so an older in-flight publish can + // never erase a newer edit that arrived while it was in flight. + private pendingGeneration = 0; + // Publish cycles are serialized: at most one runs at a time. A newer edit + // queued while a cycle is in flight defers; the in-flight cycle's completion + // re-drives it. Serialization guarantees there is never more than one + // fetch/publish sequence touching shared manager state. + private publishInFlight = false; private lastPublishedStore: ChannelStarStore | null = null; private destroyed = false; + // Per-channel high-water of every `rev` and `updatedAt` this manager has + // observed (bootstrap, live, reconnect, reconcile, pre-publish, cross-window + // storage, and initial persisted state). A click reads both so its minted + // `updatedAt = max(now, maxUpdatedAtSeen)` never regresses below observed + // state (the read-state logical-monotonic idiom), and `rev = maxRevSeen + 1` + // wins the resulting same-second tie. + private highWater = new Map(); constructor(pubkey: string, relayUrl: string) { this.pubkey = pubkey; @@ -54,6 +82,29 @@ export class ChannelStarSyncManager { this.lastRemoteCreatedAt = readWatermark(pubkey, BLOB_TYPE, relayUrl); } + /** + * Ingest a store into the per-channel high-water. Called synchronously before + * any merge is applied to React state, so a click that follows reads a current + * watermark on both dimensions. Monotonic (`Math.max`) and idempotent. + */ + observe(store: ChannelStarStore): void { + for (const [id, entry] of Object.entries(store.channels)) { + const cur = this.highWater.get(id) ?? { rev: 0, updatedAt: 0 }; + this.highWater.set(id, { + rev: Math.max(cur.rev, entry.rev), + updatedAt: Math.max(cur.updatedAt, entry.updatedAt), + }); + } + } + + maxRevSeen(id: string): number { + return this.highWater.get(id)?.rev ?? 0; + } + + maxUpdatedAtSeen(id: string): number { + return this.highWater.get(id)?.updatedAt ?? 0; + } + async fetchRemoteStars(): Promise> { try { const events = await relayClient.fetchEvents({ @@ -71,6 +122,7 @@ export class ChannelStarSyncManager { if (!result) { return { status: "failed", createdAt: event.created_at }; } + this.observe(result.store); return { status: "found", data: result, @@ -94,6 +146,10 @@ export class ChannelStarSyncManager { window.clearTimeout(this.debounceTimer); this.debounceTimer = null; } + if (this.retryTimer !== null) { + window.clearTimeout(this.retryTimer); + this.retryTimer = null; + } } getPendingStarStore(): ChannelStarStore | null { @@ -102,15 +158,51 @@ export class ChannelStarSyncManager { publishStars(store: ChannelStarStore): void { this.pendingStore = store; + ++this.pendingGeneration; + // Persist synchronously so a click made <2s before quit/community-switch + // survives teardown and resumes on next mount (durable outbox). + writeChannelStarsOutbox(this.pubkey, store, this.relayUrl); if (this.debounceTimer !== null) { window.clearTimeout(this.debounceTimer); } + // A fresh edit supersedes any retry scheduled for the previous generation. + if (this.retryTimer !== null) { + window.clearTimeout(this.retryTimer); + this.retryTimer = null; + } + this.retryDelayMs = RETRY_BASE_MS; this.debounceTimer = window.setTimeout(() => { this.debounceTimer = null; - void this.doPublish(store); + this.startCycle(); }, DEBOUNCE_MS); } + /** + * Serialize publish cycles: at most one runs at a time. A debounce/retry timer + * that fires while a cycle is in flight defers — the in-flight cycle's + * completion re-drives if a pending edit still needs publishing. A newer edit + * queued during a cycle cannot start its own concurrent cycle, so a stale + * generation can never publish after a newer edit exists. + */ + private startCycle(): void { + if (this.destroyed || this.pendingStore === null) return; + if (this.publishInFlight) return; + const store = this.pendingStore; + const gen = this.pendingGeneration; + this.publishInFlight = true; + void this.doPublish(store, gen).finally(() => { + this.publishInFlight = false; + if ( + !this.destroyed && + this.pendingStore !== null && + this.debounceTimer === null && + this.retryTimer === null + ) { + this.startCycle(); + } + }); + } + private async fetchOwnBlobBeforePublish( store: ChannelStarStore, ): Promise { @@ -127,6 +219,9 @@ export class ChannelStarSyncManager { this.recordRemoteHead(event.created_at); const remote = await decryptAndParse(event); if (!remote) return store; + this.observe(remote.store); + // Max-merge: the local edit's per-entry winners survive by construction + // and any newer remote entries fold in, so no adopt step is needed. return mergeStores(store, remote.store); } catch { return store; @@ -144,22 +239,55 @@ export class ChannelStarSyncManager { if ( !last || last.starred !== current.starred || - last.updatedAt !== current.updatedAt + last.updatedAt !== current.updatedAt || + last.rev !== current.rev ) return false; } return true; } - private async doPublish(store: ChannelStarStore): Promise { + /** + * Clear the in-memory pending edit and its durable outbox — but only if the + * completing publish still owns the current generation. A publish for an + * older edit that finishes after a newer edit was queued must leave the newer + * edit (and its retry state) untouched. + */ + private discardPending(gen: number): void { + if (gen !== this.pendingGeneration) return; + this.pendingStore = null; + clearChannelStarsOutbox(this.pubkey, this.relayUrl); + } + + /** Schedule a bounded-backoff retry of the retained pending edit. */ + private scheduleRetry(gen: number): void { + if (this.destroyed || this.pendingStore === null) return; + // A newer edit has superseded this one; its own timer owns the retry. + if (gen !== this.pendingGeneration) return; + if (this.retryTimer !== null) return; + const delay = this.retryDelayMs; + this.retryDelayMs = Math.min(this.retryDelayMs * 2, RETRY_MAX_MS); + this.retryTimer = window.setTimeout(() => { + this.retryTimer = null; + this.startCycle(); + }, delay); + } + + private async doPublish(store: ChannelStarStore, gen: number): Promise { + // A newer edit was queued after this publish was scheduled; it owns the + // pending state and will publish the latest store — abandon this stale run. + if (gen !== this.pendingGeneration) return; try { const merged = await this.fetchOwnBlobBeforePublish(store); // Guard: manager may have been destroyed while fetchOwnBlobBeforePublish - // was awaited (community switch during in-flight fetch). If so, abort - // before touching the relay. + // was awaited (community switch during in-flight fetch). if (this.destroyed) return; + // A newer edit was queued while we awaited the pre-publish fetch. It owns + // convergence now; the serialized cycle re-drives for it once this run + // unwinds. + if (gen !== this.pendingGeneration) return; if (this.isIdenticalToLastPublished(merged)) { - this.pendingStore = null; + this.discardPending(gen); return; } const payload = { @@ -180,17 +308,32 @@ export class ChannelStarSyncManager { ["t", D_TAG], // relay discoverability; not used in our filters ], }); - if (this.destroyed) return; + // Final guard immediately before the network call: a newer edit may have + // been queued during the encrypt/sign await, or the manager destroyed. + if (this.destroyed || gen !== this.pendingGeneration) return; await relayClient.publishEvent( event, "Timed out publishing channel stars.", "Failed to publish channel stars.", ); this.recordRemoteHead(event.created_at); - this.lastPublishedStore = merged; - this.pendingStore = null; + this.observe(merged); + // Only claim this store as the published head if it is still the current + // edit; a newer edit queued mid-flight owns lastPublishedStore now. + if (gen === this.pendingGeneration) { + this.lastPublishedStore = merged; + this.retryDelayMs = RETRY_BASE_MS; + } + this.discardPending(gen); } catch (error) { + if (this.destroyed) return; + // Transient publish failure (timeout / socket error). Keep the pending + // edit and retry with backoff rather than waiting for a reconnect that a + // healthy socket never fires. Max-merge makes a duplicate publish + // idempotent, so a lost-ACK write that the relay actually accepted is + // harmless to re-send. console.warn("[channelStarsSync] publish failed:", error); + this.scheduleRetry(gen); } } @@ -211,6 +354,7 @@ export class ChannelStarSyncManager { this.recordRemoteHead(event.created_at); void decryptAndParse(event).then((result) => { if (result) { + this.observe(result.store); onUpdate(result); } }); @@ -223,6 +367,9 @@ export class ChannelStarSyncManager { * delegates the seed/hold/apply-remote decision to `runBootstrap`. */ async bootstrap(localStore: ChannelStarStore) { + // Seed the high-water from the caller's persisted local store so a click + // before the remote fetch resolves already reflects retained entries. + this.observe(localStore); const fetchResult = await this.fetchRemoteStars(); return runBootstrap({ fetchResult, @@ -236,10 +383,10 @@ export class ChannelStarSyncManager { destroy(): void { // Cancel any pending publish and mark this manager as destroyed so any // in-flight doPublish() calls abort before reaching relayClient. - // Pending debounce-window changes are intentionally dropped: flushing - // could publish relay A's state to relay B via the shared relayClient - // singleton. Local entries survive because the apply/publish paths merge - // per-entry via mergeStores, so no local work is permanently lost. + // Debounce-window changes are NOT lost: publishStars persisted them to the + // durable outbox synchronously, and the next mount resumes them. Flushing + // here is still avoided — it could publish relay A's state to relay B via + // the shared relayClient singleton. this.destroyed = true; this.cancelPendingStarPublish(); this.pendingStore = null; diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs index 04c2c836d69..c06466a8f71 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelMutes.test.mjs @@ -18,35 +18,51 @@ before(() => { after(() => dom.window.close()); -test("same-second mute and unmute mutations survive at capacity", async () => { +// Shared harness: stub the relay so no network/live/reconnect fires unless a +// test installs its own live callback. Returns the captured live callback. +function stubRelay(relayClient, { live } = {}) { + const orig = { + fetchEvents: relayClient.fetchEvents, + subscribeLive: relayClient.subscribeLive, + subscribeToReconnects: relayClient.subscribeToReconnects, + }; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + if (live) live.cb = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + return () => Object.assign(relayClient, orig); +} + +function mutePayload(channels) { + return JSON.stringify({ version: 1, channels }); +} + +test("same-second star and unstar mutations survive at capacity", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); const { MAX_CHANNEL_MUTE_ENTRIES, readChannelMutesStore, storageKey } = await import("./channelMutesStorage.ts"); const { useChannelMutes } = await import("./useChannelMutes.ts"); - const originalFetchEvents = relayClient.fetchEvents; - const originalSubscribeLive = relayClient.subscribeLive; - const originalSubscribeToReconnects = relayClient.subscribeToReconnects; + const restore = stubRelay(relayClient); const originalDateNow = Date.now; const updatedAt = 1_234_567; Date.now = () => updatedAt * 1_000; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async () => async () => {}; - relayClient.subscribeToReconnects = () => () => {}; const relayUrl = "wss://relay.example"; const channels = Object.fromEntries( Array.from({ length: MAX_CHANNEL_MUTE_ENTRIES }, (_, index) => [ `z-channel-${String(index).padStart(3, "0")}`, - { muted: true, updatedAt }, + { muted: true, updatedAt, rev: 0 }, ]), ); try { - for (const [pubkey, action, expectedMuted] of [ - ["pk-mute", "muteChannel", true], - ["pk-unmute", "unmuteChannel", false], + for (const [pubkey, action, expectedStarred] of [ + ["pk-star", "muteChannel", true], + ["pk-unstar", "unmuteChannel", false], ]) { window.localStorage.setItem( storageKey(pubkey), @@ -55,412 +71,348 @@ test("same-second mute and unmute mutations survive at capacity", async () => { const { result, unmount } = renderHook(() => useChannelMutes(pubkey, relayUrl), ); - act(() => result.current[action]("a-target")); - const persisted = readChannelMutesStore(pubkey); assert.equal( Object.keys(persisted.channels).length, MAX_CHANNEL_MUTE_ENTRIES, ); - assert.deepEqual(persisted.channels["a-target"], { - muted: expectedMuted, - updatedAt, - }); + assert.equal(persisted.channels["a-target"].muted, expectedStarred); unmount(); } } finally { cleanup(); Date.now = originalDateNow; - relayClient.fetchEvents = originalFetchEvents; - relayClient.subscribeLive = originalSubscribeLive; - relayClient.subscribeToReconnects = originalSubscribeToReconnects; + restore(); } }); -// Equal-timestamp tie-break must match the relay's canonical winner -// (`created_at DESC, id ASC` → LOWEST id wins). Deliver the larger id first, -// then the lower id at the same timestamp; the lower id is the stored winner -// and must be applied, not rejected. Reverting applyRemote's `>=` back to `<=` -// wrongly ignores the lower id (the actual relay winner). -test("equal-timestamp tie-break applies the lower event id (relay canonical winner)", async () => { +// Symmetric mint (Thufir MINOR 2): a click mints +// updatedAt = max(now, localEntry.updatedAt, maxUpdatedAtSeen) and +// rev = max(localEntry.rev, maxRevSeen) + 1 on BOTH dimensions. A remount reads +// the persisted local entry, so the very first click advances past it. +test("persisted-local first click mints seen+1 on both dimensions", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); + const { readChannelMutesStore, storageKey } = await import( + "./channelMutesStorage.ts" + ); const { useChannelMutes } = await import("./useChannelMutes.ts"); - const origFetch = relayClient.fetchEvents; - const origLive = relayClient.subscribeLive; - const origReconnect = relayClient.subscribeToReconnects; - const origTauri = window.__TAURI_INTERNALS__; + const restore = stubRelay(relayClient); + const origDateNow = Date.now; + // Persisted entry is stamped in the FUTURE relative to wall clock, with a + // non-zero rev — the mint must not regress below either. + Date.now = () => 100 * 1_000; + const pubkey = "pk-persist"; + window.localStorage.setItem( + storageKey(pubkey), + mutePayload({ shared: { muted: true, updatedAt: 500, rev: 4 } }), + ); + try { + const { result, unmount } = renderHook(() => + useChannelMutes(pubkey, "wss://r"), + ); + act(() => result.current.unmuteChannel("shared")); + const persisted = readChannelMutesStore(pubkey); + assert.equal(persisted.channels.shared.muted, false, "unstar applied"); + assert.equal( + persisted.channels.shared.updatedAt, + 500, + "updatedAt held at persisted-local high-water (max(100,500,seen))", + ); + assert.equal( + persisted.channels.shared.rev, + 5, + "rev minted as persisted-local rev + 1", + ); + unmount(); + } finally { + cleanup(); + Date.now = origDateNow; + restore(); + } +}); - let live = null; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async (_f, cb) => { - live = cb; - return async () => {}; - }; - relayClient.subscribeToReconnects = () => () => {}; - // Decrypt payload keyed off the event id embedded in the ciphertext so each - // delivered event yields a store muting a distinct channel we can assert on. +// Fast-clock veto fix (Thufir pass-2 finding 1): after observing a +// future-stamped remote (updatedAt = t+300, rev 7, unmuted), a slow device +// clicking star at wall-clock t must WIN — the logical-monotonic stamp lifts the +// click's updatedAt to t+300 and rev to 8, so it dominates the observed entry. +test("fast-clock veto fix: click after observing a future-stamped head wins", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { readChannelMutesStore } = await import("./channelMutesStorage.ts"); + const { useChannelMutes } = await import("./useChannelMutes.ts"); + + const live = {}; + const restore = stubRelay(relayClient, { live }); + const origTauri = window.__TAURI_INTERNALS__; + const origDateNow = Date.now; + Date.now = () => 100 * 1_000; // slow device: wall clock t = 100 window.__TAURI_INTERNALS__ = { - invoke: (cmd, args) => { - if (cmd === "nip44_decrypt_from_self") { - const id = args?.ciphertext ?? ""; + invoke: (cmd) => { + if (cmd === "nip44_decrypt_from_self") return Promise.resolve( - JSON.stringify({ - version: 1, - channels: { [id]: { muted: true, updatedAt: 0 } }, - }), + mutePayload({ shared: { muted: false, updatedAt: 400, rev: 7 } }), ); - } return Promise.reject(new Error(`unmocked ${cmd}`)); }, }; - - const pubkey = "pk-mute-tie"; - const relayUrl = "wss://r.tie"; + const pubkey = "pk-fastclock"; let hook = null; try { await act(async () => { - hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); - await Promise.resolve(); - await Promise.resolve(); - await Promise.resolve(); + hook = renderHook(() => useChannelMutes(pubkey, "wss://r")); + for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.ok(live, "live subscription installed"); - - const deliver = async (id) => { - await act(async () => { - live({ - id, - pubkey, - created_at: 1000, - content: id, // decrypt echoes this into the muted channel id - kind: 30078, - tags: [["d", "channel-mutes"]], - sig: "s", - }); - await Promise.resolve(); - await Promise.resolve(); + // Observe the future-stamped head (updatedAt 400 = t+300). + await act(async () => { + live.cb({ + id: "future-head", + pubkey, + created_at: 400, + content: "cipher", + kind: 30078, + tags: [["d", "channel-mutes"]], + sig: "s", }); - }; - - // Larger id first (applied), then the lower id at the same timestamp — the - // relay's canonical winner, which must NOT be rejected. - await deliver("bbbb"); - await deliver("aaaa"); - - assert.ok( - hook.result.current.mutedChannelIds.has("aaaa"), - "lower event id (relay canonical winner) must be applied, not rejected", + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + assert.equal( + hook.result.current.mutedChannelIds.has("shared"), + false, + "future head applied → unmuted", ); + // Slow device clicks star at wall t=100. + await act(async () => hook.result.current.muteChannel("shared")); + assert.equal( + hook.result.current.mutedChannelIds.has("shared"), + true, + "click must win despite the observed future timestamp", + ); + const persisted = readChannelMutesStore(pubkey); + assert.equal( + persisted.channels.shared.updatedAt, + 400, + "mint lifted to t+300", + ); + assert.equal(persisted.channels.shared.rev, 8, "rev = maxRevSeen+1"); hook.unmount(); } finally { cleanup(); - relayClient.fetchEvents = origFetch; - relayClient.subscribeLive = origLive; - relayClient.subscribeToReconnects = origReconnect; + Date.now = origDateNow; window.__TAURI_INTERNALS__ = origTauri; + restore(); } }); -// Pass-2 finding 2: the comparator admitting the canonical lower id is -// necessary but not sufficient. Mutes are a per-entry store, so applyRemote -// merges the incoming blob into local state. On the SAME channel, a stale -// larger-id event delivered first (muted=true) must not survive the merge once -// the canonical lower-id winner (muted=false) arrives at the same entry -// `updatedAt`. Mutation: reverting the apply path to mergeStores (local/prev -// wins on tie) keeps the stale muted=true value. -test("canonical lower-id unmute replaces a stale larger-id mute at equal entry timestamp", async () => { +// Future-timestamp propagation (Thufir MINOR 1 / Paul MINOR 1): a poisoned +// far-future observation does not ratchet by itself — two opposite clicks keep +// the timestamp fixed at the observed future value while rev advances, and the +// latest click wins. No clamp; deterministic. +test("far-future observation: timestamp stays fixed, rev advances, latest click wins", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); + const { readChannelMutesStore } = await import("./channelMutesStorage.ts"); const { useChannelMutes } = await import("./useChannelMutes.ts"); - const origFetch = relayClient.fetchEvents; - const origLive = relayClient.subscribeLive; - const origReconnect = relayClient.subscribeToReconnects; + const live = {}; + const restore = stubRelay(relayClient, { live }); const origTauri = window.__TAURI_INTERNALS__; - - let live = null; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async (_f, cb) => { - live = cb; - return async () => {}; - }; - relayClient.subscribeToReconnects = () => () => {}; - // Both events target the SAME channel `shared` at the same entry updatedAt. - // The larger id `bbbb` says muted; the canonical lower id `aaaa` says not. + const origDateNow = Date.now; + Date.now = () => 100 * 1_000; + const FUTURE = 100 + 31_536_000; // +1yr window.__TAURI_INTERNALS__ = { - invoke: (cmd, args) => { - if (cmd === "nip44_decrypt_from_self") { - const canonicalLowerId = args?.ciphertext === "aaaa"; + invoke: (cmd) => { + if (cmd === "nip44_decrypt_from_self") return Promise.resolve( - JSON.stringify({ - version: 1, - channels: { shared: { muted: !canonicalLowerId, updatedAt: 100 } }, - }), + mutePayload({ shared: { muted: true, updatedAt: FUTURE, rev: 1 } }), ); - } return Promise.reject(new Error(`unmocked ${cmd}`)); }, }; - - const pubkey = "pk-mute-shared-tie"; - const relayUrl = "wss://r.tie"; + const pubkey = "pk-future"; let hook = null; try { await act(async () => { - hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); - await Promise.resolve(); - await Promise.resolve(); - await Promise.resolve(); + hook = renderHook(() => useChannelMutes(pubkey, "wss://r")); + for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.ok(live, "live subscription installed"); - - const deliver = async (id) => { - await act(async () => { - live({ - id, - pubkey, - created_at: 1000, - content: id, - kind: 30078, - tags: [["d", "channel-mutes"]], - sig: "s", - }); - for (let i = 0; i < 20; i++) await Promise.resolve(); + await act(async () => { + live.cb({ + id: "far-future", + pubkey, + created_at: FUTURE, + content: "cipher", + kind: 30078, + tags: [["d", "channel-mutes"]], + sig: "s", }); - }; - - await deliver("bbbb"); // stale larger-id head says muted - await deliver("aaaa"); // canonical lower-id winner says unmuted - - assert.equal( - hook.result.current.mutedChannelIds.has("shared"), - false, - "canonical lower-id unmute must replace the stale larger-id mute", - ); + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + await act(async () => hook.result.current.unmuteChannel("shared")); + let p = readChannelMutesStore(pubkey); + assert.equal(p.channels.shared.muted, false, "first click applied"); + assert.equal(p.channels.shared.updatedAt, FUTURE, "timestamp stays fixed"); + assert.equal(p.channels.shared.rev, 2, "rev advanced 1→2"); + await act(async () => hook.result.current.muteChannel("shared")); + p = readChannelMutesStore(pubkey); + assert.equal(p.channels.shared.muted, true, "latest click wins"); + assert.equal(p.channels.shared.updatedAt, FUTURE, "timestamp still fixed"); + assert.equal(p.channels.shared.rev, 3, "rev advanced 2→3"); hook.unmount(); } finally { cleanup(); - relayClient.fetchEvents = origFetch; - relayClient.subscribeLive = origLive; - relayClient.subscribeToReconnects = origReconnect; + Date.now = origDateNow; window.__TAURI_INTERNALS__ = origTauri; + restore(); } }); -// Fix round 3 (pass-3 finding 2): the remote-wins entry-tie merge and the -// pending-publish cancel apply ONLY to a canonical supersession (a lower id at -// the same event timestamp correcting an already-applied larger id). A plain -// live/bootstrap remote must NOT clobber a later same-second local click or -// cancel its pending publish. Entry `updatedAt` is whole seconds, so a click at -// 100.9s and an older remote entry at 100.1s both carry `updatedAt:100`; the -// later local intent must win and keep publishing. Mutation: applying -// mergeApplyingRemote + cancel unconditionally lets the delayed remote overwrite -// the click and drop its publish. -test("delayed same-second remote does not clobber a later local mute or cancel its publish", async () => { +// Click-before-observation (design note gap test a): an empty-store click mints +// updatedAt=now, rev=1; a later bootstrap head carrying a HIGHER rev but an +// OLDER updatedAt for the opposite value must NOT reverse the click — updatedAt +// is primary. +test("empty-store click survives a later higher-rev head with an older updatedAt", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); const { useChannelMutes } = await import("./useChannelMutes.ts"); - const origFetch = relayClient.fetchEvents; - const origLive = relayClient.subscribeLive; - const origReconnect = relayClient.subscribeToReconnects; + const live = {}; + const restore = stubRelay(relayClient, { live }); const origTauri = window.__TAURI_INTERNALS__; - const origSetTimeout = window.setTimeout; - const origClearTimeout = window.clearTimeout; const origDateNow = Date.now; - - const timers = new Map(); - let nextTimer = 1; - window.setTimeout = (fn, ms) => { - const id = nextTimer++; - timers.set(id, { fn, ms }); - return id; - }; - window.clearTimeout = (id) => timers.delete(id); - // The local click happens later within second 100. - Date.now = () => 100_900; - - let live = null; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async (_f, cb) => { - live = cb; - return async () => {}; - }; - relayClient.subscribeToReconnects = () => () => {}; - // The delayed remote entry sits earlier in the same second and says unmuted. + Date.now = () => 1000 * 1_000; // click at updatedAt 1000 window.__TAURI_INTERNALS__ = { invoke: (cmd) => { if (cmd === "nip44_decrypt_from_self") + // older updatedAt (500) but higher rev (99), opposite value return Promise.resolve( - JSON.stringify({ - version: 1, - channels: { shared: { muted: false, updatedAt: 100 } }, - }), + mutePayload({ shared: { muted: false, updatedAt: 500, rev: 99 } }), ); return Promise.reject(new Error(`unmocked ${cmd}`)); }, }; - - const pubkey = "pk-mute-same-second"; - const relayUrl = "wss://r.same"; + const pubkey = "pk-empty"; let hook = null; try { await act(async () => { - hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); + hook = renderHook(() => useChannelMutes(pubkey, "wss://r")); for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.ok(live, "live subscription installed"); - - // Local optimistic click: muted=true at updatedAt=100 (Date.now=100.9s). - await act(async () => { - hook.result.current.muteChannel("shared"); - }); - // An older remote entry from the same second decrypts and applies late. + await act(async () => hook.result.current.muteChannel("shared")); // empty store → rev 1 @ 1000 await act(async () => { - live({ - id: "remote-before-click", + live.cb({ + id: "older-higher-rev", pubkey, - created_at: 100, - content: "remote", + created_at: 500, + content: "cipher", kind: 30078, tags: [["d", "channel-mutes"]], sig: "s", }); - for (let i = 0; i < 40; i++) await Promise.resolve(); + for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.equal( hook.result.current.mutedChannelIds.has("shared"), true, - "a later same-second local click must survive a delayed older remote", - ); - assert.ok( - [...timers.values()].some((t) => t.ms === 2000), - "the local pending publish must remain scheduled", + "click at newer updatedAt survives an older higher-rev head", ); hook.unmount(); } finally { cleanup(); - relayClient.fetchEvents = origFetch; - relayClient.subscribeLive = origLive; - relayClient.subscribeToReconnects = origReconnect; - window.__TAURI_INTERNALS__ = origTauri; - window.setTimeout = origSetTimeout; - window.clearTimeout = origClearTimeout; Date.now = origDateNow; + window.__TAURI_INTERNALS__ = origTauri; + restore(); } }); -// Fix round 4 (pass-4 finding 2): a canonical correction (lower id at the same -// event timestamp) knows the incoming event is the relay's winner, but NOT -// whether the user clicked between the superseded larger-id event and the -// correction. Sequence: stale `bbbb` applies → user clicks mute later in the -// same second → canonical `aaaa` decrypts late. `aaaa` and the click share -// integer `updatedAt`, so the plain remote-wins tie would clobber the click. -// The dirty-entry overlay keeps the click and the cancel is gone, so its -// publish stays scheduled. Mutation: dropping the dirty overlay (plain -// mergeApplyingRemote) lets `aaaa` erase the click; restoring the cancel drops -// its publish timer. -test("canonical correction preserves a same-second local click made after the larger-id event", async () => { +// Cross-window storage: a peer window's write is observed into the high-water +// and max-merged, so a following click sees the peer's rev and no edit is lost. +test("cross-window storage event is observed and max-merged", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); + const { readChannelMutesStore, storageKey } = await import( + "./channelMutesStorage.ts" + ); const { useChannelMutes } = await import("./useChannelMutes.ts"); - const origFetch = relayClient.fetchEvents; - const origLive = relayClient.subscribeLive; - const origReconnect = relayClient.subscribeToReconnects; - const origTauri = window.__TAURI_INTERNALS__; - const origSetTimeout = window.setTimeout; - const origClearTimeout = window.clearTimeout; + const restore = stubRelay(relayClient); const origDateNow = Date.now; - - const timers = new Map(); - let nextTimer = 1; - window.setTimeout = (fn, ms) => { - const id = nextTimer++; - timers.set(id, { fn, ms }); - return id; - }; - window.clearTimeout = (id) => timers.delete(id); - // The local click happens later within second 100. - Date.now = () => 100_900; - - let live = null; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async (_f, cb) => { - live = cb; - return async () => {}; - }; - relayClient.subscribeToReconnects = () => () => {}; - // bbbb (stale larger id) says muted; aaaa (canonical lower id) says not. - // Both carry the same entry updatedAt=100, tying the later local click. - window.__TAURI_INTERNALS__ = { - invoke: (cmd, args) => { - if (cmd === "nip44_decrypt_from_self") { - const canonicalLowerId = args?.ciphertext === "aaaa"; - return Promise.resolve( - JSON.stringify({ - version: 1, - channels: { shared: { muted: !canonicalLowerId, updatedAt: 100 } }, - }), - ); - } - return Promise.reject(new Error(`unmocked ${cmd}`)); - }, - }; - - const pubkey = "pk-mute-canonical-dirty"; - const relayUrl = "wss://r.canon"; + Date.now = () => 100 * 1_000; + const pubkey = "pk-xwin"; let hook = null; try { await act(async () => { - hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); + hook = renderHook(() => useChannelMutes(pubkey, "wss://r")); for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.ok(live, "live subscription installed"); - - const deliver = async (id, content) => { - await act(async () => { - live({ - id, - pubkey, - created_at: 100, - content, - kind: 30078, - tags: [["d", "channel-mutes"]], - sig: "s", - }); - for (let i = 0; i < 40; i++) await Promise.resolve(); - }); - }; - - await deliver("bbbb", "bbbb"); // stale larger-id head applies (muted) + // A peer window wrote a higher-rev entry for `shared` at updatedAt 900. + window.localStorage.setItem( + storageKey(pubkey), + mutePayload({ shared: { muted: true, updatedAt: 900, rev: 12 } }), + ); await act(async () => { - hook.result.current.muteChannel("shared"); // user intent after bbbb + window.dispatchEvent( + new dom.window.StorageEvent("storage", { key: storageKey(pubkey) }), + ); + for (let i = 0; i < 20; i++) await Promise.resolve(); }); - await deliver("aaaa", "aaaa"); // canonical correction decrypts late - assert.equal( hook.result.current.mutedChannelIds.has("shared"), true, - "a same-second local click must survive the canonical correction", + "peer write merged into this window", ); + // A following click sees the peer's high-water: updatedAt held at 900, + // rev minted to 13. + await act(async () => hook.result.current.unmuteChannel("shared")); + const p = readChannelMutesStore(pubkey); + assert.equal(p.channels.shared.muted, false, "click applied"); + assert.equal(p.channels.shared.updatedAt, 900, "held at peer high-water"); + assert.equal(p.channels.shared.rev, 13, "rev = peer rev + 1"); + hook.unmount(); + } finally { + cleanup(); + Date.now = origDateNow; + restore(); + } +}); + +// Outbox resume: an edit persisted to the durable outbox before teardown is +// re-published on the next mount (bootstrap resume), so a click made <2s before +// quit/community-switch is never silently dropped. +test("bootstrap resumes a persisted outbox edit", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelMutes } = await import("./useChannelMutes.ts"); + + const restore = stubRelay(relayClient); + const origDateNow = Date.now; + Date.now = () => 100 * 1_000; + const pubkey = "pk-outbox"; + const relayUrl = "wss://r.outbox"; + const outboxKey = `buzz-channel-mutes-outbox.v1:${pubkey}:${encodeURIComponent(relayUrl)}`; + window.localStorage.setItem( + outboxKey, + mutePayload({ resumed: { muted: true, updatedAt: 90, rev: 2 } }), + ); + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelMutes(pubkey, relayUrl)); + for (let i = 0; i < 40; i++) await Promise.resolve(); + }); + // The resumed edit is queued for publish (pending), not silently dropped. + // We assert the pending publish debounce is scheduled by observing the + // outbox is still present (cleared only after publish completes). assert.ok( - [...timers.values()].some((t) => t.ms === 2000), - "the local click's pending publish must remain scheduled", + window.localStorage.getItem(outboxKey) !== null, + "outbox retained until the resumed publish completes", ); hook.unmount(); } finally { cleanup(); - relayClient.fetchEvents = origFetch; - relayClient.subscribeLive = origLive; - relayClient.subscribeToReconnects = origReconnect; - window.__TAURI_INTERNALS__ = origTauri; - window.setTimeout = origSetTimeout; - window.clearTimeout = origClearTimeout; Date.now = origDateNow; + restore(); } }); diff --git a/desktop/src/features/sidebar/lib/useChannelMutes.ts b/desktop/src/features/sidebar/lib/useChannelMutes.ts index 65e7483c587..be28af6b7ac 100644 --- a/desktop/src/features/sidebar/lib/useChannelMutes.ts +++ b/desktop/src/features/sidebar/lib/useChannelMutes.ts @@ -3,10 +3,11 @@ import * as React from "react"; import { relayClient } from "@/shared/api/relayClient"; import { boundMuteStore, + clearChannelMutesOutbox, DEFAULT_STORE, - mergeCanonicalSupersession, mergeStores, mutedChannelIdsFromStore, + readChannelMutesOutbox, readChannelMutesStore, storageKey, writeChannelMutesStore, @@ -16,6 +17,13 @@ import { import { ChannelMuteSyncManager } from "./channelMutesSync"; import type { RemoteMutes } from "./channelMutesSync"; +// Reconciliation cadence. Steady interval re-fetches the head on a healthy +// socket so a silently-lost publish converges without waiting for a reconnect +// that may never fire; the retry window backs off while the fetch keeps failing. +const RECONCILE_STEADY_MS = 60_000; +const RECONCILE_RETRY_BASE_MS = 3_000; +const RECONCILE_RETRY_MAX_MS = 60_000; + export function useChannelMutes( pubkey: string | undefined, relayUrl?: string, @@ -32,28 +40,13 @@ export function useChannelMutes( }); const managerRef = React.useRef(null); - const lastAppliedRemoteTs = React.useRef(0); - const lastAppliedEventId = React.useRef(""); - // Channels the user changed locally within the current remote second. Their - // integer-second `updatedAt` ties the remote's, so a late canonical - // correction would clobber them on the remote-wins tie; the overlay in - // `mergeCanonicalSupersession` keeps them. Cleared whenever the remote clock - // strictly advances — a correction for an earlier second is then stale- - // rejected before it can apply, so the prior second's clicks need no cover. - const dirtyChannelIds = React.useRef>(new Set()); React.useEffect(() => { if (!pubkey || !relayUrl) { setStore(DEFAULT_STORE); - lastAppliedRemoteTs.current = 0; - lastAppliedEventId.current = ""; - dirtyChannelIds.current = new Set(); return; } setStore(readChannelMutesStore(pubkey)); - lastAppliedRemoteTs.current = 0; - lastAppliedEventId.current = ""; - dirtyChannelIds.current = new Set(); managerRef.current = new ChannelMuteSyncManager(pubkey, relayUrl); return () => { managerRef.current?.destroy(); @@ -61,6 +54,9 @@ export function useChannelMutes( }; }, [pubkey, relayUrl]); + // Cross-window sync: another window/tab wrote the shared store. Ingest it into + // the high-water and max-merge it into this window's state, so a click that + // follows sees the peer's revs/timestamps and no window's edit is clobbered. React.useEffect(() => { if (!pubkey) { return; @@ -70,7 +66,9 @@ export function useChannelMutes( if (e.key !== key) { return; } - setStore(readChannelMutesStore(pubkey)); + const incoming = readChannelMutesStore(pubkey); + managerRef.current?.observe(incoming); + setStore((prev) => mergeStores(prev, incoming)); }; window.addEventListener("storage", handler); return () => { @@ -78,47 +76,15 @@ export function useChannelMutes( }; }, [pubkey]); + // Every remote payload is observed by the manager before it reaches here + // (fetch/subscribe paths call observe() internally; the storage handler + // observes above), so this is a pure max-merge with no ordering or ownership + // overlay — "later" lives in the (updatedAt, rev) tuple. const applyRemote = React.useCallback( (remote: RemoteMutes): ((prev: ChannelMuteStore) => ChannelMuteStore) => { return (prev) => { if (!pubkey) return prev; - if (remote.createdAt < lastAppliedRemoteTs.current) return prev; - // Equal timestamps: the relay/database break ties by `id ASC` — the - // LOWEST event id is the canonical winner. Apply a strictly-lower id and - // ignore any id >= the last applied, so the UI converges on the same - // event the relay stored rather than the largest id seen. - if ( - remote.createdAt === lastAppliedRemoteTs.current && - remote.eventId >= lastAppliedEventId.current - ) - return prev; - // A canonical supersession corrects an already-applied same-timestamp - // LARGER-id head with the true winner: only here may the incoming blob's - // per-entry values win an equal-`updatedAt` tie. Any other application - // (bootstrap / live / newer timestamp) merges over optimistic local - // state with local-wins `mergeStores`. - const isCanonicalSupersession = - remote.createdAt === lastAppliedRemoteTs.current && - lastAppliedEventId.current !== "" && - remote.eventId < lastAppliedEventId.current; - // A strictly-newer remote second retires every locally-dirty entry: a - // later correction can only target this new second, so prior clicks - // need no cover and the set must not grow unbounded. - if (remote.createdAt > lastAppliedRemoteTs.current) - dirtyChannelIds.current = new Set(); - lastAppliedRemoteTs.current = remote.createdAt; - lastAppliedEventId.current = remote.eventId; - // A canonical correction must not erase a locally-owned entry the user - // changed within this same second (integer-second `updatedAt` ties the - // remote's). Overlay the dirty entries back on top of the correction, - // and never cancel the pending publish — the click still needs to sync. - const merged = isCanonicalSupersession - ? mergeCanonicalSupersession( - prev, - remote.store, - dirtyChannelIds.current, - ) - : mergeStores(prev, remote.store); + const merged = mergeStores(prev, remote.store); if (!writeChannelMutesStore(pubkey, merged)) return prev; return merged; }; @@ -136,12 +102,69 @@ export function useChannelMutes( setStore(applyRemote(result.data)); } // "hold": seed already performed by bootstrap (if first-sync), or blocked. + // Resume any edit persisted to the durable outbox before a prior + // quit/community-switch so a click made <2s before teardown still syncs. + const outbox = readChannelMutesOutbox(pubkey, relayUrl); + if (outbox) { + managerRef.current?.publishMutes(outbox); + } else { + clearChannelMutesOutbox(pubkey, relayUrl); + } }); return () => { cancelled = true; }; }, [pubkey, relayUrl, applyRemote]); + // Reconciliation loop: a single scheduler that both retries a failed bootstrap + // fetch with bounded backoff and periodically re-fetches the head, so a + // silently-lost publish converges within the steady cadence without waiting + // for a reconnect a healthy socket never fires. Also refreshes on visibility. + React.useEffect(() => { + if (!pubkey || !relayUrl) return; + let cancelled = false; + let timer: number | null = null; + let delayMs = RECONCILE_RETRY_BASE_MS; + + const schedule = (ms: number) => { + if (cancelled) return; + if (timer !== null) window.clearTimeout(timer); + timer = window.setTimeout(tick, ms); + }; + + const tick = () => { + void managerRef.current?.fetchRemoteMutes().then((result) => { + if (cancelled) return; + if (result.status === "found") { + // max-merge folds the head into state without dropping a pending + // edit (that edit is in prev and owned by the manager's retry lane). + setStore(applyRemote(result.data)); + delayMs = RECONCILE_STEADY_MS; // relay answered → steady cadence + } else if (result.status === "absent") { + delayMs = RECONCILE_STEADY_MS; // answered (no blob) → steady cadence + } else { + delayMs = Math.min(delayMs * 2, RECONCILE_RETRY_MAX_MS); // failed → back off + } + schedule(delayMs); + }); + }; + + const onVisible = () => { + if (document.visibilityState === "visible") { + delayMs = RECONCILE_RETRY_BASE_MS; + tick(); + } + }; + document.addEventListener("visibilitychange", onVisible); + schedule(delayMs); + + return () => { + cancelled = true; + if (timer !== null) window.clearTimeout(timer); + document.removeEventListener("visibilitychange", onVisible); + }; + }, [pubkey, relayUrl, applyRemote]); + // biome-ignore lint/correctness/useExhaustiveDependencies: relayUrl is intentional — rebinds subscription when the active relay changes even though it is not used inside the effect body directly (the manager via managerRef.current carries it) React.useEffect(() => { if (!pubkey) return; @@ -196,11 +219,23 @@ export function useChannelMutes( const setMuteState = React.useCallback( (channelId: string, muted: boolean) => { if (!pubkey) return; - const entry: ChannelMuteEntry = { - muted, - updatedAt: Math.floor(Date.now() / 1000), - }; + const now = Math.floor(Date.now() / 1000); setStore((prev) => { + const manager = managerRef.current; + const localEntry = prev.channels[channelId]; + // Logical-monotonic mint: never regress below any (updatedAt, rev) this + // replica has observed for the channel (local entry OR manager + // high-water), so the click strictly dominates observed state in both + // merge keys — it can never lose to state it has already seen. + const updatedAt = Math.max( + now, + localEntry?.updatedAt ?? 0, + manager?.maxUpdatedAtSeen(channelId) ?? 0, + ); + const rev = + Math.max(localEntry?.rev ?? 0, manager?.maxRevSeen(channelId) ?? 0) + + 1; + const entry: ChannelMuteEntry = { muted, updatedAt, rev }; const next = boundMuteStore( { version: 1, @@ -209,11 +244,7 @@ export function useChannelMutes( channelId, ); if (!writeChannelMutesStore(pubkey, next)) return prev; - // Mark this channel locally-owned for the current remote second so a - // late canonical correction with the same integer `updatedAt` can't - // clobber the click before its publish syncs. - dirtyChannelIds.current.add(channelId); - managerRef.current?.publishMutes(next); + manager?.publishMutes(next); return next; }); }, diff --git a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs index e8a1054c308..4317279ef57 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.test.mjs +++ b/desktop/src/features/sidebar/lib/useChannelStars.test.mjs @@ -18,6 +18,27 @@ before(() => { after(() => dom.window.close()); +// Shared harness: stub the relay so no network/live/reconnect fires unless a +// test installs its own live callback. Returns the captured live callback. +function stubRelay(relayClient, { live } = {}) { + const orig = { + fetchEvents: relayClient.fetchEvents, + subscribeLive: relayClient.subscribeLive, + subscribeToReconnects: relayClient.subscribeToReconnects, + }; + relayClient.fetchEvents = async () => []; + relayClient.subscribeLive = async (_f, cb) => { + if (live) live.cb = cb; + return async () => {}; + }; + relayClient.subscribeToReconnects = () => () => {}; + return () => Object.assign(relayClient, orig); +} + +function starPayload(channels) { + return JSON.stringify({ version: 1, channels }); +} + test("same-second star and unstar mutations survive at capacity", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); @@ -25,21 +46,16 @@ test("same-second star and unstar mutations survive at capacity", async () => { await import("./channelStarsStorage.ts"); const { useChannelStars } = await import("./useChannelStars.ts"); - const originalFetchEvents = relayClient.fetchEvents; - const originalSubscribeLive = relayClient.subscribeLive; - const originalSubscribeToReconnects = relayClient.subscribeToReconnects; + const restore = stubRelay(relayClient); const originalDateNow = Date.now; const updatedAt = 1_234_567; Date.now = () => updatedAt * 1_000; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async () => async () => {}; - relayClient.subscribeToReconnects = () => () => {}; const relayUrl = "wss://relay.example"; const channels = Object.fromEntries( Array.from({ length: MAX_CHANNEL_STAR_ENTRIES }, (_, index) => [ `z-channel-${String(index).padStart(3, "0")}`, - { starred: true, updatedAt }, + { starred: true, updatedAt, rev: 0 }, ]), ); @@ -55,416 +71,348 @@ test("same-second star and unstar mutations survive at capacity", async () => { const { result, unmount } = renderHook(() => useChannelStars(pubkey, relayUrl), ); - act(() => result.current[action]("a-target")); - const persisted = readChannelStarsStore(pubkey); assert.equal( Object.keys(persisted.channels).length, MAX_CHANNEL_STAR_ENTRIES, ); - assert.deepEqual(persisted.channels["a-target"], { - starred: expectedStarred, - updatedAt, - }); + assert.equal(persisted.channels["a-target"].starred, expectedStarred); unmount(); } } finally { cleanup(); Date.now = originalDateNow; - relayClient.fetchEvents = originalFetchEvents; - relayClient.subscribeLive = originalSubscribeLive; - relayClient.subscribeToReconnects = originalSubscribeToReconnects; + restore(); } }); -// Equal-timestamp tie-break must match the relay's canonical winner -// (`created_at DESC, id ASC` → LOWEST id wins). Deliver the larger id first, -// then the lower id at the same timestamp; the lower id is the stored winner -// and must be applied, not rejected. Reverting applyRemote's `>=` back to `<=` -// wrongly ignores the lower id (the actual relay winner). -test("equal-timestamp tie-break applies the lower event id (relay canonical winner)", async () => { +// Symmetric mint (Thufir MINOR 2): a click mints +// updatedAt = max(now, localEntry.updatedAt, maxUpdatedAtSeen) and +// rev = max(localEntry.rev, maxRevSeen) + 1 on BOTH dimensions. A remount reads +// the persisted local entry, so the very first click advances past it. +test("persisted-local first click mints seen+1 on both dimensions", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); + const { readChannelStarsStore, storageKey } = await import( + "./channelStarsStorage.ts" + ); const { useChannelStars } = await import("./useChannelStars.ts"); - const origFetch = relayClient.fetchEvents; - const origLive = relayClient.subscribeLive; - const origReconnect = relayClient.subscribeToReconnects; - const origTauri = window.__TAURI_INTERNALS__; + const restore = stubRelay(relayClient); + const origDateNow = Date.now; + // Persisted entry is stamped in the FUTURE relative to wall clock, with a + // non-zero rev — the mint must not regress below either. + Date.now = () => 100 * 1_000; + const pubkey = "pk-persist"; + window.localStorage.setItem( + storageKey(pubkey), + starPayload({ shared: { starred: true, updatedAt: 500, rev: 4 } }), + ); + try { + const { result, unmount } = renderHook(() => + useChannelStars(pubkey, "wss://r"), + ); + act(() => result.current.unstarChannel("shared")); + const persisted = readChannelStarsStore(pubkey); + assert.equal(persisted.channels.shared.starred, false, "unstar applied"); + assert.equal( + persisted.channels.shared.updatedAt, + 500, + "updatedAt held at persisted-local high-water (max(100,500,seen))", + ); + assert.equal( + persisted.channels.shared.rev, + 5, + "rev minted as persisted-local rev + 1", + ); + unmount(); + } finally { + cleanup(); + Date.now = origDateNow; + restore(); + } +}); - let live = null; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async (_f, cb) => { - live = cb; - return async () => {}; - }; - relayClient.subscribeToReconnects = () => () => {}; - // Decrypt payload keyed off the event id embedded in the ciphertext so each - // delivered event yields a store starring a distinct channel we can assert on. +// Fast-clock veto fix (Thufir pass-2 finding 1): after observing a +// future-stamped remote (updatedAt = t+300, rev 7, unstarred), a slow device +// clicking star at wall-clock t must WIN — the logical-monotonic stamp lifts the +// click's updatedAt to t+300 and rev to 8, so it dominates the observed entry. +test("fast-clock veto fix: click after observing a future-stamped head wins", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { readChannelStarsStore } = await import("./channelStarsStorage.ts"); + const { useChannelStars } = await import("./useChannelStars.ts"); + + const live = {}; + const restore = stubRelay(relayClient, { live }); + const origTauri = window.__TAURI_INTERNALS__; + const origDateNow = Date.now; + Date.now = () => 100 * 1_000; // slow device: wall clock t = 100 window.__TAURI_INTERNALS__ = { - invoke: (cmd, args) => { - if (cmd === "nip44_decrypt_from_self") { - const id = args?.ciphertext ?? ""; + invoke: (cmd) => { + if (cmd === "nip44_decrypt_from_self") return Promise.resolve( - JSON.stringify({ - version: 1, - channels: { [id]: { starred: true, updatedAt: 0 } }, - }), + starPayload({ shared: { starred: false, updatedAt: 400, rev: 7 } }), ); - } return Promise.reject(new Error(`unmocked ${cmd}`)); }, }; - - const pubkey = "pk-star-tie"; - const relayUrl = "wss://r.tie"; + const pubkey = "pk-fastclock"; let hook = null; try { await act(async () => { - hook = renderHook(() => useChannelStars(pubkey, relayUrl)); - await Promise.resolve(); - await Promise.resolve(); - await Promise.resolve(); + hook = renderHook(() => useChannelStars(pubkey, "wss://r")); + for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.ok(live, "live subscription installed"); - - const deliver = async (id) => { - await act(async () => { - live({ - id, - pubkey, - created_at: 1000, - content: id, // decrypt echoes this into the starred channel id - kind: 30078, - tags: [["d", "channel-stars"]], - sig: "s", - }); - await Promise.resolve(); - await Promise.resolve(); + // Observe the future-stamped head (updatedAt 400 = t+300). + await act(async () => { + live.cb({ + id: "future-head", + pubkey, + created_at: 400, + content: "cipher", + kind: 30078, + tags: [["d", "channel-stars"]], + sig: "s", }); - }; - - // Larger id first (applied), then the lower id at the same timestamp — the - // relay's canonical winner, which must NOT be rejected. - await deliver("bbbb"); - await deliver("aaaa"); - - assert.ok( - hook.result.current.starredChannelIds.has("aaaa"), - "lower event id (relay canonical winner) must be applied, not rejected", + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + assert.equal( + hook.result.current.starredChannelIds.has("shared"), + false, + "future head applied → unstarred", ); + // Slow device clicks star at wall t=100. + await act(async () => hook.result.current.starChannel("shared")); + assert.equal( + hook.result.current.starredChannelIds.has("shared"), + true, + "click must win despite the observed future timestamp", + ); + const persisted = readChannelStarsStore(pubkey); + assert.equal( + persisted.channels.shared.updatedAt, + 400, + "mint lifted to t+300", + ); + assert.equal(persisted.channels.shared.rev, 8, "rev = maxRevSeen+1"); hook.unmount(); } finally { cleanup(); - relayClient.fetchEvents = origFetch; - relayClient.subscribeLive = origLive; - relayClient.subscribeToReconnects = origReconnect; + Date.now = origDateNow; window.__TAURI_INTERNALS__ = origTauri; + restore(); } }); -// Pass-2 finding 2: the comparator admitting the canonical lower id is -// necessary but not sufficient. Stars are a per-entry store, so applyRemote -// merges the incoming blob into local state. On the SAME channel, a stale -// larger-id event delivered first (starred=true) must not survive the merge -// once the canonical lower-id winner (starred=false) arrives at the same entry -// `updatedAt`. Mutation: reverting the apply path to mergeStores (local/prev -// wins on tie) keeps the stale starred=true value. -test("canonical lower-id unstar replaces a stale larger-id star at equal entry timestamp", async () => { +// Future-timestamp propagation (Thufir MINOR 1 / Paul MINOR 1): a poisoned +// far-future observation does not ratchet by itself — two opposite clicks keep +// the timestamp fixed at the observed future value while rev advances, and the +// latest click wins. No clamp; deterministic. +test("far-future observation: timestamp stays fixed, rev advances, latest click wins", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); + const { readChannelStarsStore } = await import("./channelStarsStorage.ts"); const { useChannelStars } = await import("./useChannelStars.ts"); - const origFetch = relayClient.fetchEvents; - const origLive = relayClient.subscribeLive; - const origReconnect = relayClient.subscribeToReconnects; + const live = {}; + const restore = stubRelay(relayClient, { live }); const origTauri = window.__TAURI_INTERNALS__; - - let live = null; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async (_f, cb) => { - live = cb; - return async () => {}; - }; - relayClient.subscribeToReconnects = () => () => {}; - // Both events target the SAME channel `shared` at the same entry updatedAt. - // The larger id `bbbb` says starred; the canonical lower id `aaaa` says not. + const origDateNow = Date.now; + Date.now = () => 100 * 1_000; + const FUTURE = 100 + 31_536_000; // +1yr window.__TAURI_INTERNALS__ = { - invoke: (cmd, args) => { - if (cmd === "nip44_decrypt_from_self") { - const canonicalLowerId = args?.ciphertext === "aaaa"; + invoke: (cmd) => { + if (cmd === "nip44_decrypt_from_self") return Promise.resolve( - JSON.stringify({ - version: 1, - channels: { - shared: { starred: !canonicalLowerId, updatedAt: 100 }, - }, - }), + starPayload({ shared: { starred: true, updatedAt: FUTURE, rev: 1 } }), ); - } return Promise.reject(new Error(`unmocked ${cmd}`)); }, }; - - const pubkey = "pk-star-shared-tie"; - const relayUrl = "wss://r.tie"; + const pubkey = "pk-future"; let hook = null; try { await act(async () => { - hook = renderHook(() => useChannelStars(pubkey, relayUrl)); - await Promise.resolve(); - await Promise.resolve(); - await Promise.resolve(); + hook = renderHook(() => useChannelStars(pubkey, "wss://r")); + for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.ok(live, "live subscription installed"); - - const deliver = async (id) => { - await act(async () => { - live({ - id, - pubkey, - created_at: 1000, - content: id, - kind: 30078, - tags: [["d", "channel-stars"]], - sig: "s", - }); - for (let i = 0; i < 20; i++) await Promise.resolve(); + await act(async () => { + live.cb({ + id: "far-future", + pubkey, + created_at: FUTURE, + content: "cipher", + kind: 30078, + tags: [["d", "channel-stars"]], + sig: "s", }); - }; - - await deliver("bbbb"); // stale larger-id head says starred - await deliver("aaaa"); // canonical lower-id winner says unstarred - - assert.equal( - hook.result.current.starredChannelIds.has("shared"), - false, - "canonical lower-id unstar must replace the stale larger-id star", - ); + for (let i = 0; i < 20; i++) await Promise.resolve(); + }); + await act(async () => hook.result.current.unstarChannel("shared")); + let p = readChannelStarsStore(pubkey); + assert.equal(p.channels.shared.starred, false, "first click applied"); + assert.equal(p.channels.shared.updatedAt, FUTURE, "timestamp stays fixed"); + assert.equal(p.channels.shared.rev, 2, "rev advanced 1→2"); + await act(async () => hook.result.current.starChannel("shared")); + p = readChannelStarsStore(pubkey); + assert.equal(p.channels.shared.starred, true, "latest click wins"); + assert.equal(p.channels.shared.updatedAt, FUTURE, "timestamp still fixed"); + assert.equal(p.channels.shared.rev, 3, "rev advanced 2→3"); hook.unmount(); } finally { cleanup(); - relayClient.fetchEvents = origFetch; - relayClient.subscribeLive = origLive; - relayClient.subscribeToReconnects = origReconnect; + Date.now = origDateNow; window.__TAURI_INTERNALS__ = origTauri; + restore(); } }); -// Fix round 3 (pass-3 finding 2): the remote-wins entry-tie merge and the -// pending-publish cancel apply ONLY to a canonical supersession (a lower id at -// the same event timestamp correcting an already-applied larger id). A plain -// live/bootstrap remote must NOT clobber a later same-second local click or -// cancel its pending publish. Entry `updatedAt` is whole seconds, so a click at -// 100.9s and an older remote entry at 100.1s both carry `updatedAt:100`; the -// later local intent must win and keep publishing. Mutation: applying -// mergeApplyingRemote + cancel unconditionally lets the delayed remote overwrite -// the click and drop its publish. -test("delayed same-second remote does not clobber a later local star or cancel its publish", async () => { +// Click-before-observation (design note gap test a): an empty-store click mints +// updatedAt=now, rev=1; a later bootstrap head carrying a HIGHER rev but an +// OLDER updatedAt for the opposite value must NOT reverse the click — updatedAt +// is primary. +test("empty-store click survives a later higher-rev head with an older updatedAt", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); const { useChannelStars } = await import("./useChannelStars.ts"); - const origFetch = relayClient.fetchEvents; - const origLive = relayClient.subscribeLive; - const origReconnect = relayClient.subscribeToReconnects; + const live = {}; + const restore = stubRelay(relayClient, { live }); const origTauri = window.__TAURI_INTERNALS__; - const origSetTimeout = window.setTimeout; - const origClearTimeout = window.clearTimeout; const origDateNow = Date.now; - - const timers = new Map(); - let nextTimer = 1; - window.setTimeout = (fn, ms) => { - const id = nextTimer++; - timers.set(id, { fn, ms }); - return id; - }; - window.clearTimeout = (id) => timers.delete(id); - // The local click happens later within second 100. - Date.now = () => 100_900; - - let live = null; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async (_f, cb) => { - live = cb; - return async () => {}; - }; - relayClient.subscribeToReconnects = () => () => {}; - // The delayed remote entry sits earlier in the same second and says unstarred. + Date.now = () => 1000 * 1_000; // click at updatedAt 1000 window.__TAURI_INTERNALS__ = { invoke: (cmd) => { if (cmd === "nip44_decrypt_from_self") + // older updatedAt (500) but higher rev (99), opposite value return Promise.resolve( - JSON.stringify({ - version: 1, - channels: { shared: { starred: false, updatedAt: 100 } }, - }), + starPayload({ shared: { starred: false, updatedAt: 500, rev: 99 } }), ); return Promise.reject(new Error(`unmocked ${cmd}`)); }, }; - - const pubkey = "pk-star-same-second"; - const relayUrl = "wss://r.same"; + const pubkey = "pk-empty"; let hook = null; try { await act(async () => { - hook = renderHook(() => useChannelStars(pubkey, relayUrl)); + hook = renderHook(() => useChannelStars(pubkey, "wss://r")); for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.ok(live, "live subscription installed"); - - // Local optimistic click: starred=true at updatedAt=100 (Date.now=100.9s). - await act(async () => { - hook.result.current.starChannel("shared"); - }); - // An older remote entry from the same second decrypts and applies late. + await act(async () => hook.result.current.starChannel("shared")); // empty store → rev 1 @ 1000 await act(async () => { - live({ - id: "remote-before-click", + live.cb({ + id: "older-higher-rev", pubkey, - created_at: 100, - content: "remote", + created_at: 500, + content: "cipher", kind: 30078, tags: [["d", "channel-stars"]], sig: "s", }); - for (let i = 0; i < 40; i++) await Promise.resolve(); + for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.equal( hook.result.current.starredChannelIds.has("shared"), true, - "a later same-second local click must survive a delayed older remote", - ); - assert.ok( - [...timers.values()].some((t) => t.ms === 2000), - "the local pending publish must remain scheduled", + "click at newer updatedAt survives an older higher-rev head", ); hook.unmount(); } finally { cleanup(); - relayClient.fetchEvents = origFetch; - relayClient.subscribeLive = origLive; - relayClient.subscribeToReconnects = origReconnect; - window.__TAURI_INTERNALS__ = origTauri; - window.setTimeout = origSetTimeout; - window.clearTimeout = origClearTimeout; Date.now = origDateNow; + window.__TAURI_INTERNALS__ = origTauri; + restore(); } }); -// Fix round 4 (pass-4 finding 2): a canonical correction (lower id at the same -// event timestamp) knows the incoming event is the relay's winner, but NOT -// whether the user clicked between the superseded larger-id event and the -// correction. Sequence: stale `bbbb` applies → user clicks star later in the -// same second → canonical `aaaa` decrypts late. `aaaa` and the click share -// integer `updatedAt`, so the plain remote-wins tie would clobber the click. -// The dirty-entry overlay keeps the click and the cancel is gone, so its -// publish stays scheduled. Mutation: dropping the dirty overlay (plain -// mergeApplyingRemote) lets `aaaa` erase the click; restoring the cancel drops -// its publish timer. -test("canonical correction preserves a same-second local click made after the larger-id event", async () => { +// Cross-window storage: a peer window's write is observed into the high-water +// and max-merged, so a following click sees the peer's rev and no edit is lost. +test("cross-window storage event is observed and max-merged", async () => { const { act, cleanup, renderHook } = await import("@testing-library/react"); const { relayClient } = await import("@/shared/api/relayClient"); + const { readChannelStarsStore, storageKey } = await import( + "./channelStarsStorage.ts" + ); const { useChannelStars } = await import("./useChannelStars.ts"); - const origFetch = relayClient.fetchEvents; - const origLive = relayClient.subscribeLive; - const origReconnect = relayClient.subscribeToReconnects; - const origTauri = window.__TAURI_INTERNALS__; - const origSetTimeout = window.setTimeout; - const origClearTimeout = window.clearTimeout; + const restore = stubRelay(relayClient); const origDateNow = Date.now; - - const timers = new Map(); - let nextTimer = 1; - window.setTimeout = (fn, ms) => { - const id = nextTimer++; - timers.set(id, { fn, ms }); - return id; - }; - window.clearTimeout = (id) => timers.delete(id); - // The local click happens later within second 100. - Date.now = () => 100_900; - - let live = null; - relayClient.fetchEvents = async () => []; - relayClient.subscribeLive = async (_f, cb) => { - live = cb; - return async () => {}; - }; - relayClient.subscribeToReconnects = () => () => {}; - // bbbb (stale larger id) says starred; aaaa (canonical lower id) says not. - // Both carry the same entry updatedAt=100, tying the later local click. - window.__TAURI_INTERNALS__ = { - invoke: (cmd, args) => { - if (cmd === "nip44_decrypt_from_self") { - const canonicalLowerId = args?.ciphertext === "aaaa"; - return Promise.resolve( - JSON.stringify({ - version: 1, - channels: { - shared: { starred: !canonicalLowerId, updatedAt: 100 }, - }, - }), - ); - } - return Promise.reject(new Error(`unmocked ${cmd}`)); - }, - }; - - const pubkey = "pk-star-canonical-dirty"; - const relayUrl = "wss://r.canon"; + Date.now = () => 100 * 1_000; + const pubkey = "pk-xwin"; let hook = null; try { await act(async () => { - hook = renderHook(() => useChannelStars(pubkey, relayUrl)); + hook = renderHook(() => useChannelStars(pubkey, "wss://r")); for (let i = 0; i < 20; i++) await Promise.resolve(); }); - assert.ok(live, "live subscription installed"); - - const deliver = async (id, content) => { - await act(async () => { - live({ - id, - pubkey, - created_at: 100, - content, - kind: 30078, - tags: [["d", "channel-stars"]], - sig: "s", - }); - for (let i = 0; i < 40; i++) await Promise.resolve(); - }); - }; - - await deliver("bbbb", "bbbb"); // stale larger-id head applies (starred) + // A peer window wrote a higher-rev entry for `shared` at updatedAt 900. + window.localStorage.setItem( + storageKey(pubkey), + starPayload({ shared: { starred: true, updatedAt: 900, rev: 12 } }), + ); await act(async () => { - hook.result.current.starChannel("shared"); // user intent after bbbb + window.dispatchEvent( + new dom.window.StorageEvent("storage", { key: storageKey(pubkey) }), + ); + for (let i = 0; i < 20; i++) await Promise.resolve(); }); - await deliver("aaaa", "aaaa"); // canonical correction decrypts late - assert.equal( hook.result.current.starredChannelIds.has("shared"), true, - "a same-second local click must survive the canonical correction", + "peer write merged into this window", ); + // A following click sees the peer's high-water: updatedAt held at 900, + // rev minted to 13. + await act(async () => hook.result.current.unstarChannel("shared")); + const p = readChannelStarsStore(pubkey); + assert.equal(p.channels.shared.starred, false, "click applied"); + assert.equal(p.channels.shared.updatedAt, 900, "held at peer high-water"); + assert.equal(p.channels.shared.rev, 13, "rev = peer rev + 1"); + hook.unmount(); + } finally { + cleanup(); + Date.now = origDateNow; + restore(); + } +}); + +// Outbox resume: an edit persisted to the durable outbox before teardown is +// re-published on the next mount (bootstrap resume), so a click made <2s before +// quit/community-switch is never silently dropped. +test("bootstrap resumes a persisted outbox edit", async () => { + const { act, cleanup, renderHook } = await import("@testing-library/react"); + const { relayClient } = await import("@/shared/api/relayClient"); + const { useChannelStars } = await import("./useChannelStars.ts"); + + const restore = stubRelay(relayClient); + const origDateNow = Date.now; + Date.now = () => 100 * 1_000; + const pubkey = "pk-outbox"; + const relayUrl = "wss://r.outbox"; + const outboxKey = `buzz-channel-stars-outbox.v1:${pubkey}:${encodeURIComponent(relayUrl)}`; + window.localStorage.setItem( + outboxKey, + starPayload({ resumed: { starred: true, updatedAt: 90, rev: 2 } }), + ); + let hook = null; + try { + await act(async () => { + hook = renderHook(() => useChannelStars(pubkey, relayUrl)); + for (let i = 0; i < 40; i++) await Promise.resolve(); + }); + // The resumed edit is queued for publish (pending), not silently dropped. + // We assert the pending publish debounce is scheduled by observing the + // outbox is still present (cleared only after publish completes). assert.ok( - [...timers.values()].some((t) => t.ms === 2000), - "the local click's pending publish must remain scheduled", + window.localStorage.getItem(outboxKey) !== null, + "outbox retained until the resumed publish completes", ); hook.unmount(); } finally { cleanup(); - relayClient.fetchEvents = origFetch; - relayClient.subscribeLive = origLive; - relayClient.subscribeToReconnects = origReconnect; - window.__TAURI_INTERNALS__ = origTauri; - window.setTimeout = origSetTimeout; - window.clearTimeout = origClearTimeout; Date.now = origDateNow; + restore(); } }); diff --git a/desktop/src/features/sidebar/lib/useChannelStars.ts b/desktop/src/features/sidebar/lib/useChannelStars.ts index 7b6e87eccbd..b4c869f0d36 100644 --- a/desktop/src/features/sidebar/lib/useChannelStars.ts +++ b/desktop/src/features/sidebar/lib/useChannelStars.ts @@ -3,9 +3,10 @@ import * as React from "react"; import { relayClient } from "@/shared/api/relayClient"; import { boundStarStore, + clearChannelStarsOutbox, DEFAULT_STORE, - mergeCanonicalSupersession, mergeStores, + readChannelStarsOutbox, readChannelStarsStore, starredChannelIdsFromStore, storageKey, @@ -16,6 +17,13 @@ import { import { ChannelStarSyncManager } from "./channelStarsSync"; import type { RemoteStars } from "./channelStarsSync"; +// Reconciliation cadence. Steady interval re-fetches the head on a healthy +// socket so a silently-lost publish converges without waiting for a reconnect +// that may never fire; the retry window backs off while the fetch keeps failing. +const RECONCILE_STEADY_MS = 60_000; +const RECONCILE_RETRY_BASE_MS = 3_000; +const RECONCILE_RETRY_MAX_MS = 60_000; + export function useChannelStars( pubkey: string | undefined, relayUrl?: string, @@ -32,28 +40,13 @@ export function useChannelStars( }); const managerRef = React.useRef(null); - const lastAppliedRemoteTs = React.useRef(0); - const lastAppliedEventId = React.useRef(""); - // Channels the user changed locally within the current remote second. Their - // integer-second `updatedAt` ties the remote's, so a late canonical - // correction would clobber them on the remote-wins tie; the overlay in - // `mergeCanonicalSupersession` keeps them. Cleared whenever the remote clock - // strictly advances — a correction for an earlier second is then stale- - // rejected before it can apply, so the prior second's clicks need no cover. - const dirtyChannelIds = React.useRef>(new Set()); React.useEffect(() => { if (!pubkey || !relayUrl) { setStore(DEFAULT_STORE); - lastAppliedRemoteTs.current = 0; - lastAppliedEventId.current = ""; - dirtyChannelIds.current = new Set(); return; } setStore(readChannelStarsStore(pubkey)); - lastAppliedRemoteTs.current = 0; - lastAppliedEventId.current = ""; - dirtyChannelIds.current = new Set(); managerRef.current = new ChannelStarSyncManager(pubkey, relayUrl); return () => { managerRef.current?.destroy(); @@ -61,6 +54,9 @@ export function useChannelStars( }; }, [pubkey, relayUrl]); + // Cross-window sync: another window/tab wrote the shared store. Ingest it into + // the high-water and max-merge it into this window's state, so a click that + // follows sees the peer's revs/timestamps and no window's edit is clobbered. React.useEffect(() => { if (!pubkey) { return; @@ -70,7 +66,9 @@ export function useChannelStars( if (e.key !== key) { return; } - setStore(readChannelStarsStore(pubkey)); + const incoming = readChannelStarsStore(pubkey); + managerRef.current?.observe(incoming); + setStore((prev) => mergeStores(prev, incoming)); }; window.addEventListener("storage", handler); return () => { @@ -78,47 +76,15 @@ export function useChannelStars( }; }, [pubkey]); + // Every remote payload is observed by the manager before it reaches here + // (fetch/subscribe paths call observe() internally; the storage handler + // observes above), so this is a pure max-merge with no ordering or ownership + // overlay — "later" lives in the (updatedAt, rev) tuple. const applyRemote = React.useCallback( (remote: RemoteStars): ((prev: ChannelStarStore) => ChannelStarStore) => { return (prev) => { if (!pubkey) return prev; - if (remote.createdAt < lastAppliedRemoteTs.current) return prev; - // Equal timestamps: the relay/database break ties by `id ASC` — the - // LOWEST event id is the canonical winner. Apply a strictly-lower id and - // ignore any id >= the last applied, so the UI converges on the same - // event the relay stored rather than the largest id seen. - if ( - remote.createdAt === lastAppliedRemoteTs.current && - remote.eventId >= lastAppliedEventId.current - ) - return prev; - // A canonical supersession corrects an already-applied same-timestamp - // LARGER-id head with the true winner: only here may the incoming blob's - // per-entry values win an equal-`updatedAt` tie. Any other application - // (bootstrap / live / newer timestamp) merges over optimistic local - // state with local-wins `mergeStores`. - const isCanonicalSupersession = - remote.createdAt === lastAppliedRemoteTs.current && - lastAppliedEventId.current !== "" && - remote.eventId < lastAppliedEventId.current; - // A strictly-newer remote second retires every locally-dirty entry: a - // later correction can only target this new second, so prior clicks - // need no cover and the set must not grow unbounded. - if (remote.createdAt > lastAppliedRemoteTs.current) - dirtyChannelIds.current = new Set(); - lastAppliedRemoteTs.current = remote.createdAt; - lastAppliedEventId.current = remote.eventId; - // A canonical correction must not erase a locally-owned entry the user - // changed within this same second (integer-second `updatedAt` ties the - // remote's). Overlay the dirty entries back on top of the correction, - // and never cancel the pending publish — the click still needs to sync. - const merged = isCanonicalSupersession - ? mergeCanonicalSupersession( - prev, - remote.store, - dirtyChannelIds.current, - ) - : mergeStores(prev, remote.store); + const merged = mergeStores(prev, remote.store); if (!writeChannelStarsStore(pubkey, merged)) return prev; return merged; }; @@ -136,12 +102,69 @@ export function useChannelStars( setStore(applyRemote(result.data)); } // "hold": seed already performed by bootstrap (if first-sync), or blocked. + // Resume any edit persisted to the durable outbox before a prior + // quit/community-switch so a click made <2s before teardown still syncs. + const outbox = readChannelStarsOutbox(pubkey, relayUrl); + if (outbox) { + managerRef.current?.publishStars(outbox); + } else { + clearChannelStarsOutbox(pubkey, relayUrl); + } }); return () => { cancelled = true; }; }, [pubkey, relayUrl, applyRemote]); + // Reconciliation loop: a single scheduler that both retries a failed bootstrap + // fetch with bounded backoff and periodically re-fetches the head, so a + // silently-lost publish converges within the steady cadence without waiting + // for a reconnect a healthy socket never fires. Also refreshes on visibility. + React.useEffect(() => { + if (!pubkey || !relayUrl) return; + let cancelled = false; + let timer: number | null = null; + let delayMs = RECONCILE_RETRY_BASE_MS; + + const schedule = (ms: number) => { + if (cancelled) return; + if (timer !== null) window.clearTimeout(timer); + timer = window.setTimeout(tick, ms); + }; + + const tick = () => { + void managerRef.current?.fetchRemoteStars().then((result) => { + if (cancelled) return; + if (result.status === "found") { + // max-merge folds the head into state without dropping a pending + // edit (that edit is in prev and owned by the manager's retry lane). + setStore(applyRemote(result.data)); + delayMs = RECONCILE_STEADY_MS; // relay answered → steady cadence + } else if (result.status === "absent") { + delayMs = RECONCILE_STEADY_MS; // answered (no blob) → steady cadence + } else { + delayMs = Math.min(delayMs * 2, RECONCILE_RETRY_MAX_MS); // failed → back off + } + schedule(delayMs); + }); + }; + + const onVisible = () => { + if (document.visibilityState === "visible") { + delayMs = RECONCILE_RETRY_BASE_MS; + tick(); + } + }; + document.addEventListener("visibilitychange", onVisible); + schedule(delayMs); + + return () => { + cancelled = true; + if (timer !== null) window.clearTimeout(timer); + document.removeEventListener("visibilitychange", onVisible); + }; + }, [pubkey, relayUrl, applyRemote]); + // biome-ignore lint/correctness/useExhaustiveDependencies: relayUrl is intentional — rebinds subscription when the active relay changes even though it is not used inside the effect body directly (the manager via managerRef.current carries it) React.useEffect(() => { if (!pubkey) return; @@ -196,11 +219,23 @@ export function useChannelStars( const setStarState = React.useCallback( (channelId: string, starred: boolean) => { if (!pubkey) return; - const entry: ChannelStarEntry = { - starred, - updatedAt: Math.floor(Date.now() / 1000), - }; + const now = Math.floor(Date.now() / 1000); setStore((prev) => { + const manager = managerRef.current; + const localEntry = prev.channels[channelId]; + // Logical-monotonic mint: never regress below any (updatedAt, rev) this + // replica has observed for the channel (local entry OR manager + // high-water), so the click strictly dominates observed state in both + // merge keys — it can never lose to state it has already seen. + const updatedAt = Math.max( + now, + localEntry?.updatedAt ?? 0, + manager?.maxUpdatedAtSeen(channelId) ?? 0, + ); + const rev = + Math.max(localEntry?.rev ?? 0, manager?.maxRevSeen(channelId) ?? 0) + + 1; + const entry: ChannelStarEntry = { starred, updatedAt, rev }; const next = boundStarStore( { version: 1, @@ -209,11 +244,7 @@ export function useChannelStars( channelId, ); if (!writeChannelStarsStore(pubkey, next)) return prev; - // Mark this channel locally-owned for the current remote second so a - // late canonical correction with the same integer `updatedAt` can't - // clobber the click before its publish syncs. - dirtyChannelIds.current.add(channelId); - managerRef.current?.publishStars(next); + manager?.publishStars(next); return next; }); },