refactor(queue): assert the delivery-id prefixes are distinguishable, not longest-match

The longest-prefix tie-break could only run if one prefix were a prefix of another,
which none is -- untestable defensive code standing in for a guarantee nobody stated.
The guarantee is now an invariant test, so adding an ambiguous prefix fails with the
real problem named rather than being silently absorbed by a scan.

Author: JSONbored

src/queue/delivery-id.ts

@@ -43,17 +43,12 @@ export function deliveryIdFor(origin: DeliveryIdOrigin, suffix: string): string
 /**
  * Which producer minted this delivery id, or null for a raw GitHub webhook delivery id.
  *
- * Longest prefix wins, so an origin whose prefix is a prefix of another's still resolves to the more
- * specific one rather than to whichever happens to be declared first.
+ * First match wins, which is unambiguous ONLY because no prefix here is a prefix of another -- an
+ * invariant asserted directly in decision-record.test.ts rather than worked around with a
+ * longest-match scan. A tie-break that can never run is untestable defensive code; a failing
+ * invariant test names the real problem (two origins that cannot be told apart) to whoever adds one.
  */
 export function deliveryIdOrigin(deliveryId: string | null | undefined): DeliveryIdOrigin | null {
   if (typeof deliveryId !== "string") return null;
-  let match: DeliveryIdOrigin | null = null;
-  for (const origin of DELIVERY_ID_ORIGINS) {
-    if (!deliveryId.startsWith(DELIVERY_ID_PREFIXES[origin])) continue;
-    if (match === null || DELIVERY_ID_PREFIXES[origin].length > DELIVERY_ID_PREFIXES[match].length) {
-      match = origin;
-    }
-  }
-  return match;
+  return DELIVERY_ID_ORIGINS.find((origin) => deliveryId.startsWith(DELIVERY_ID_PREFIXES[origin])) ?? null;
 }

test/unit/decision-record.test.ts

@@ -15,7 +15,7 @@ import {
   sha256Hex,
   type DecisionRecord,
 } from "../../src/review/decision-record";
-import { DELIVERY_ID_ORIGINS, deliveryIdFor, deliveryIdOrigin } from "../../src/queue/delivery-id";
+import { DELIVERY_ID_ORIGINS, DELIVERY_ID_PREFIXES, deliveryIdFor, deliveryIdOrigin } from "../../src/queue/delivery-id";
 import { appendDecisionLedger, LEDGER_GENESIS_HASH, loadDecisionLedgerTip, loadDecisionRecordCollapsible, loadPublicDecisionRecord, verifyDecisionLedger } from "../../src/review/decision-record";
 import { createTestEnv } from "../helpers/d1";
 
@@ -1015,9 +1015,16 @@ describe("deriveReevaluationReason", () => {
     expect(DELIVERY_ID_ORIGINS.length).toBeGreaterThan(0);
   });
 
-  it("resolves the LONGEST matching prefix, so one origin cannot shadow another", () => {
-    // `regate-sweep:` and `regate-repair:` share a stem; a first-match scan could mis-attribute a repair
-    // as routine maintenance, which is exactly the distinction the record exists to preserve.
+  it("keeps every origin distinguishable: no prefix may be a prefix of another", () => {
+    // This is what makes a first-match scan unambiguous. If it ever fails, two producers have become
+    // indistinguishable and one would silently inherit the other's reason -- `regate-sweep:` read as
+    // `regate-repair:` would file a repair as routine maintenance, the exact distinction this preserves.
+    for (const a of DELIVERY_ID_ORIGINS) {
+      for (const b of DELIVERY_ID_ORIGINS) {
+        if (a === b) continue;
+        expect(DELIVERY_ID_PREFIXES[a].startsWith(DELIVERY_ID_PREFIXES[b]), `${a} vs ${b}`).toBe(false);
+      }
+    }
     expect(deliveryIdOrigin(deliveryIdFor("regateRepair", "o/r#7"))).toBe("regateRepair");
     expect(deliveryIdOrigin(deliveryIdFor("regateSweep", "o/r#7"))).toBe("regateSweep");
     expect(deliveryIdOrigin("not-a-known-prefix:o/r#7")).toBeNull();