Relay: a duplicate that differs from the cached copy makes the track malformed (§9.1)

[floatdrop]

Summary

§9.1: "An endpoint that receives a duplicate Object with a different Forwarding Preference, Subgroup ID, Priority or Payload MUST treat the track as Malformed" (also §2.4.2 items 6 and 7). Until now, when a second publisher's copy of an Object lost the dedup claim (§9.3), the relay dropped it without comparing it to anything.

The relay now compares that copy with the first copy in its cache, on both the subgroup and datagram paths. It ends the track (PUBLISH_DONE MALFORMED_TRACK, §2.4.2) when the copies differ in:

• Forwarding Preference, Subgroup ID or Priority: always compared. Priority is the resolved value, inline or the alias's DEFAULT_PUBLISHER_PRIORITY. Subgroup ID is compared only when both copies came on subgroup streams.
• Payload or Immutable Properties: compared only when both copies are Normal, because only a Normal Object has a Payload or Properties (§11.2.1.1, §11.2.1.2). Immutable Properties are compared byte for byte, and one copy having them while the other doesn't counts as a difference (§12.7).

Not treated as malformed:

• Mutable Properties differ: allowed by §9.1 item 2.
• Normal becomes End of Group or End of Track: the existing-to-not-existing change §9.1 item 1 allows.
• The reverse order: a late Object, which §2.1 says is not malformed.

Decisions (made with you)

• No cached copy, no check: a duplicate is compared only against a cached first copy. If that copy was evicted, expired (§12.3), or not yet cached by another publisher's stream, nothing is compared. This is a documented limitation; it keeps per-Object hashing off the hot path.
• Immutable Properties included: they're compared on top of §9.1's four fields.
• Status differences allowed: as described above.

Interpretation

A copy that an announced gap says doesn't exist is still compared against a cached first copy. §2.1 excuses its late arrival, not different content.

API

• New: message.ImmutableProperties(raw) ([]byte, bool), which returns the Immutable Properties value exactly as serialized, without allocating.

Test changes

• Existing tests corrected: three tests sent "duplicates" with a different Payload or Subgroup, which §9.1 now makes malformed. Two multi-publisher tests now send identical copies. TestFanout_UpdatesTrackEntryLargestObject no longer re-sends Object {4, 1} with different content.
• Refactor: runFanout sets terminalSeen once instead of in two branches. It behaves the same and keeps the function under the gocyclo limit.

Tests

• Malformed cases: the seven cases in TestRelay_DuplicateConsistency were verified red with the check disabled. They include a subgroup copy duplicated by a datagram, and two datagrams.
• Guard cases:
  • Six cases must not end the track, and publisher B's own next Object has to arrive afterwards.
  • Comparing all Properties, or Payloads regardless of Status, makes a guard fail.
  • The two Status-plus-Immutable-Properties guards were verified red before the review fix.
• Message: TestImmutableProperties, including a zero-allocation check.
• Checks: lint, the full suite, -race and make bench-quick all pass, with no allocs/op increase.

Not in this PR

The rest of the §2.4.2 list is still undetected:

• Priority changing within a Subgroup.
• Objects past a Subgroup's, Group's or Track's final Object, beyond the existing same-stream END_OF_GROUP check.

🤖 Generated with Claude Code