perf(db): stop the events recent pass at a ceiling for regular-kind reads - #9157

Summary

The recent pass of a split newest-first events read now has an upper bound when every requested kind is a regular kind. Postgres stops planning the empty monthlies made ahead of time and the open-ended catch-all. Results are unchanged.

Why. #9091 gave the recent pass a floor (created_at >= <start of previous month>) but no ceiling, and its "Not covered" section names that gap. The partition manager keeps 6 empty monthlies ahead of the current month, plus an open-ended catch-all, so the recent pass still planned and locked about 9 partitions, each with its full index set. That is far past a backend's 16 fast-path lock slots.

What changes. For a regular-kinds-only read, the recent pass reads floor <= created_at < ceiling. The ceiling is a SQL literal at 00:00 UTC on the first day of the month after now + 1 h, so the pass plans the previous and current monthlies, plus the next one during the last hour of a month. The older pass is unchanged.

Why no row is lost. Ingest rejects events more than 900 s ahead of the relay's clock (MAX_TIMESTAMP_DRIFT_SECS). Every regular-kind event the relay signs itself is stamped with its clock. The extra margin up to 1 h covers clock differences between relay processes. I audited every writer of events rows for this.

Why only regular kinds. The relay stamps its own replacements of some replaceable and addressable rows at max(previous + 1 s, now): group discovery (39000–39002), the NIP-43 membership list, the archived list, DM visibility and verified profiles. A coordinate replaced faster than once a second can therefore run ahead of the clock. A read that may match those kinds (no kinds, or any replaceable/addressable kind) keeps the open recent pass from #9091.

No protocol, schema, index or client change.

Related issue

Follow-up to #9091 (its "Not covered" upper bound).

Testing

• recent_pass::tests: ceiling arithmetic (month and year wraps, and either side of the 1 h margin). Predicate literals with and without a ceiling. The eligibility table now records not split / ceiled / open per read shape, including mixed regular and latest-state kinds. The in-memory exactness test runs both the ceiled and the open split.
• split_passes_bound_created_at_with_a_literal: SQL shape. The recent pass is bounded on both sides, on e. and m. for #p. The older pass and unsplit reads carry no ceiling.
• postgres_tests::recent_pass_locks_only_the_partitions_below_its_ceiling (new): runs partition maintenance to get the layout a running relay keeps, then runs the recent pass under plan_cache_mode = force_generic_plan inside a transaction and reads the backend's pg_locks. The ceiled pass locks exactly the partitions holding rows at the floor, now, and one second below the ceiling. The open pass locks strictly more.
• split_page_reads_match_the_unsplit_read: now matches the recent pass by its exact floor and ceiling literals.
• Fixture fix (test-only): the perf(db): split newest-first events reads at a month floor so Postgres prunes partitions #9091 snapshot fixtures waited for any ungranted pg_locks row on a partition's OID. pg_locks covers every database, and the per-test databases are clones that share OIDs, so a wait in another test's database could release the fixture early. That likely caused one CI failure of split_read_passes_share_one_snapshot, which I couldn't reproduce on Blox. Both lock checks now match only the current database, as several advisory-lock waits in other fixtures already do.

Mutation-checked on Blox. Each of these fails the new Postgres test or the unit tests: dropping the ceiling from the predicate, applying it to every split read, and widening it.

What got simpler

Nothing got simpler. The change adds one optional bound to the existing Split/Range types in store/recent_pass.rs and no new concept. floor_for became split_for, and it returns the floor and the ceiling together.

Identified, out of scope: unsplit reads whose since is a bind parameter (live REQs with a recent since) still lock every partition under a cached generic plan on PG 16. Postgres prunes bind-parameter bounds only at execution, after it has taken the locks.

🤖 Generated with Claude Code