1 files changed, 45 insertions, 11 deletions

diff --git a/src/nostr.cpp b/src/nostr.cpp
index b3e4a7c..3f43302 100644
--- a/src/nostr.cpp
+++ b/src/nostr.cpp
@@ -1057,9 +1057,14 @@ static void HandlePoolAnnouncement(const json& ev)
 
 // Resolve a `.btf` address via a relay: fetch the descriptor published by that
 // address's key and verify it self-certifies under the decoded pubkey.
+// fExchangeOk reports whether the relay actually finished the conversation
+// (an EOSE arrived) as opposed to the socket dying mid-read. The caller pools
+// this socket for reuse, and only a completed exchange leaves it in a state
+// the next caller can trust.
 static bool ResolveDescriptor(CWebSocket& ws, void* ctx, const string& btfAddr,
-                              btf::Descriptor& out)
+                              btf::Descriptor& out, bool& fExchangeOk)
 {
+    fExchangeOk = false;
     unsigned char pk[32];
     if (!btf::ParseAddress(btfAddr, pk))
         return false;
@@ -1070,26 +1075,42 @@ static bool ResolveDescriptor(CWebSocket& ws, void* ctx, const string& btfAddr,
     json req = json::array({ "REQ", "btf-resolve", filter });
     if (!ws.SendText(req.dump()))
         return false;
+    bool fFound = false;
     for (;;)
     {
         string msg;
         if (!ws.RecvText(msg))
-            break;
+            return fFound;  // socket died mid-exchange; fExchangeOk stays false
         json j;
         try { j = json::parse(msg); } catch (...) { continue; }
         if (!j.is_array() || j.empty() || !j[0].is_string()) continue;
         string t = j[0].get<string>();
+        // Every relay message names the subscription it belongs to. This socket
+        // is pooled and reused, so a message left over from an earlier exchange
+        // is the ordinary case here, not an exotic one -- and an unmatched EOSE
+        // ends this query before it has begun, which is indistinguishable from
+        // "that descriptor does not exist". Check the id.
+        if (j.size() >= 2 && j[1].is_string() && j[1].get<string>() != "btf-resolve")
+            continue;
         if (t == "EVENT" && j.size() >= 3)
         {
             const json& ev = j[2];
-            if (ev.contains("content") &&
+            if (!fFound && ev.contains("content") &&
                 btf::VerifyDescriptor(ctx, ev["content"].get<string>(), pk, out))
-                return true;
+                fFound = true;
+            // Deliberately keep reading to EOSE rather than returning here.
+            // Returning early leaves the rest of the relay's answer queued on a
+            // socket that goes straight back into the pool, and the next caller
+            // reads our leftovers as its own -- one message out of step, for
+            // the life of the process.
         }
         else if (t == "EOSE")
+        {
+            fExchangeOk = true;  // relay said "that is all": socket is clean
             break;
+        }
     }
-    return false;
+    return fFound;
 }
 
 // Resolve a `.btf` address into its rendezvous coordinates by querying the
@@ -1108,12 +1129,22 @@ bool BtfResolve(const std::string& btfAddr, std::string& meetingHostPort,
             if (!lease.Connected())
                 continue;
             btf::Descriptor d;
-            if (!ResolveDescriptor(lease.Ws(), g_nostrKey.ctx, btfAddr, d))
+            bool fExchangeOk = false;
+            if (!ResolveDescriptor(lease.Ws(), g_nostrKey.ctx, btfAddr, d, fExchangeOk))
             {
-                lease.fOk = true; // exchange completed, just no match
+                // Only keep the pooled socket if the relay actually finished
+                // the conversation. This used to say "exchange completed, just
+                // no match" on every failure -- including a dead socket -- so
+                // ~CRelayLease never closed it and fConnected was never
+                // cleared. A relay connection that died was then pinned in the
+                // pool, reported healthy, and reused for every later lookup,
+                // which is why "no Nostr descriptor found" persisted for a
+                // descriptor that was demonstrably published, and why only a
+                // restart cleared it.
+                lease.fOk = fExchangeOk;
                 continue;
             }
-            lease.fOk = true;
+            lease.fOk = fExchangeOk;
             if (d.meeting_node.empty() || d.meeting_node == "rendezvous-pending")
                 continue; // descriptor predates the owner's relay config
             if (!HexDecode(d.enc, enc_pub, 32))
@@ -1761,14 +1792,17 @@ void ThreadNostrSeed(void* parg)
             PublishDescriptor(ws, key);
             Sleep(700); // let the relay store the replaceable event
             btf::Descriptor d;
-            if (ResolveDescriptor(ws, key.ctx, key.BtfAddress(), d))
+            bool fExchangeOk = false;
+            if (ResolveDescriptor(ws, key.ctx, key.BtfAddress(), d, fExchangeOk))
             {
                 LogPrint("nostr", "Nostr: .btf self-resolve OK via %s (meeting_node=%s, enc=%s...)\n",
                        pszNostrRelays[i], d.meeting_node.c_str(), d.enc.substr(0, 16).c_str());
-                lease.fOk = true;
+                lease.fOk = fExchangeOk;
                 break;
             }
-            lease.fOk = true;
+            // Same rule as BtfResolve: a socket only goes back in the pool if
+            // the relay finished the conversation on it.
+            lease.fOk = fExchangeOk;
         }
         CATCH_PRINT_EXCEPTION("btf self-test")
     }