A retained epoch secret is what lets a member read a message sent under an epoch
the group has since moved past. Both ways of getting the policy wrong are quiet:
keep too few and old messages become permanently unreadable, keep too many and
secrets that should have been dropped stay on disk. The entire policy is one
strict `<` in a query and an IGNORE on an insert.
The cutoff is strict, and that matters more than an off-by-one usually does.
This query feeds a delete, so an epoch wrongly reported as droppable is not a
stale read -- it is the messages of that epoch becoming undecryptable, with
nothing to recover them from. Covered with three epochs either side of the
boundary: only strictly older ones are droppable, the epoch equal to the cutoff
is still inside the window, and a cutoff at or below every retained epoch drops
nothing.
Room scoping, for the same reason. Rooms advance epochs independently, so a
sweep driven by one room's cutoff must never reach another's -- a leak here
costs the other room its history. Asserted from both ends: the sweep returns
only the sweeping room's rows, and the other room's secret is still there
afterwards.
Insert is IGNORE over the composite key (chatRoomId, epoch), which is what makes
re-processing a commit safe. A redelivery or a replay re-derives the secret, and
overwriting the stored one with that re-derivation would replace the value that
actually decrypts the messages already on disk. Covered by inserting a second,
different secret for the same epoch and asserting the first survives -- and
alongside it, that the same epoch number in two different rooms is two rows
rather than a conflict, since the composite key is what separates them.
Also covered: defenestrate removes exactly the rows the sweep selected and
leaves the rest, and a room's retained epochs are all readable back, which is
what a rejoin or a full replay reads before deciding what it can still decrypt.
Verified by mutation: relaxing the cutoff to `epoch <= :epochCutOffPoint` fails
three of these, including the boundary test. The mutation was reverted; no
production source is touched by this commit.
7 tests.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
521a4f5690