feat: import Chinese-localized Buzz source snapshot

Signed-off-by: cls_宁波本机 <908705107@qq.com>

docs/formal/nip-pl/NOTE.md

@@ -0,0 +1,37 @@
+---
+title: "NIP-PL Formal Models: lease acceptance and stateful gateway authority"
+tags: [nostr, nip-pl, push-notifications, formal-model, buzz]
+status: active
+created: 2026-07-11
+---
+
+# NIP-PL formal pressure test
+
+These bounded executable models cover two distinct shipped contracts. They do not model the not-yet-shipped relay matcher/worker or any removed wake-grant protocol.
+
+## Run
+
+```bash
+python3 acceptance.py
+python3 mutation_test.py
+python3 delivery.py
+python3 delivery_mutation.py
+python3 fixed_payload.py
+python3 fixed_payload_mutation.py
+```
+
+## Lease acceptance
+
+`acceptance.py` explores all 5040 orderings of one address's active, revoke, reactivate, replay, NIP-01-tie, high-generation/old-created-at, and high-created-at/stale-generation candidates. It checks no resurrection, monotone watermarks, no watermark poisoning, agreement between stored and effective state, and replay-window safety. `mutation_test.py` independently drops the NIP-01 and generation clauses and requires both mutants to produce witnesses.
+
+## Stateful public gateway
+
+`delivery.py` models the authority actually shipped by the public gateway: relay signer confinement; installation/delegation epoch, generation, and expiry; atomic replay/quota admission; revocation ordering; custody; terminal request burn versus transient release; and the exact constant APNs body. `delivery_mutation.py` requires signer, epoch, terminal-burn, quota-refund, and fixed-body mutants to be detected.
+
+## Fixed payload
+
+`fixed_payload.py` exhaustively varies relay-controlled and gateway-state inputs and requires the APNs body to remain byte-identical to the normative constant. `fixed_payload_mutation.py` injects each prohibited input category and requires every mutation to be caught.
+
+## Honest limits
+
+The models enumerate bounded abstract transitions, not SQL schedules or network behavior. Real PostgreSQL race/FK/retention tests validate the implementation separately. A crash after APNs accepts but before disposition persistence remains intentionally at-least-once; request expiry bounds the resulting replay reservation. Constant payload prevents content disclosure but cannot hide wake timing or frequency.

docs/formal/nip-pl/acceptance.py

@@ -0,0 +1,180 @@
+"""Formal model of NIP-PL acceptance + lifecycle (PLANS/NIP_PL_PUSH_LEASES_DRAFT.md).
+
+Exhaustive finite-state exploration of ONE lease address (author, 30350, d) under
+an adversary who can present a bounded universe of candidate events -- including
+forged (generation, created_at) combinations and replays -- in every order.
+
+We check the safety/lifecycle invariants the spec ASSERTS as atomic/monotone:
+
+  I1 no-resurrection : once a tombstone (active:false) is the effective state,
+                       no later ACCEPTED event may make the address effective-active
+                       unless it strictly beats the tombstone on BOTH orderings.
+                       (spec Acceptance check 8 + Lifecycle "replayed older event
+                        can never resurrect a revoked lease")
+  I2 watermark-monotone : the persisted generation watermark never decreases, and
+                       a REJECTED event never changes stored/effective/watermark.
+                       (check 8: "leave stored event, effective push state, and
+                        watermark all unchanged")
+  I3 no-watermark-poison : a high-generation / old-created_at event that LOSES the
+                       NIP-01 ordering is rejected and MUST NOT raise the watermark.
+                       (check 8 trap the spec calls out by name)
+  I4 dual-order-agree : the accepted (stored) event and the effective push state are
+                       always the same event -- REQ view never disagrees with effect.
+  I5 replay-window : after natural expiry / tombstone retention, any replay of a
+                       formerly-valid event fails (expiration lower bound), so the
+                       watermark can be released without reopening resurrection.
+
+Modeled acceptance sequence (spec "Acceptance and Origin Binding", ordered):
+  a candidate is ACCEPTED iff it passes structural checks (we assume the adversary
+  only ever submits structurally valid, correctly-signed, origin-bound events -- we
+  are testing ORDERING, not parsing) AND wins check 8:
+     (a) NIP-01 addressable ordering vs current stored winner:
+         greater created_at, tie -> lexically-lowest id ;
+     (b) generation strictly greater than the internal watermark.
+  BOTH required. Failing either -> reject, no state change.
+On accept: commit (stored, effective, watermark) atomically; watermark := gen.
+"""
+from itertools import permutations
+
+class Ev:
+    __slots__ = ("id", "gen", "created", "active")
+    def __init__(self, eid, gen, created, active):
+        self.id, self.gen, self.created, self.active = eid, gen, created, active
+    def __repr__(self):
+        s = "A" if self.active else "T"  # active / tombstone
+        return f"{self.id}[g{self.gen},c{self.created},{s}]"
+
+def nip01_beats(cand, cur):
+    """NIP-01 addressable ordering: higher created_at; tie -> lexically LOWEST id."""
+    if cur is None:
+        return True
+    if cand.created != cur.created:
+        return cand.created > cur.created
+    return cand.id < cur.id  # lower id wins the tie
+
+class Address:
+    """One (author,30350,d). Faithful encoding of acceptance check 8."""
+    def __init__(self):
+        self.stored = None       # currently-stored winning event (what REQ serves)
+        self.effective_active = False   # effective push state: matching on?
+        self.watermark = -1      # internal generation watermark
+        self.wm_history = [-1]   # to check monotonicity
+        self.log = []            # (event, accepted?)
+
+    def submit(self, ev):
+        # check 8: must win BOTH orderings
+        wins_nip01 = nip01_beats(ev, self.stored)
+        wins_gen = ev.gen > self.watermark
+        if wins_nip01 and wins_gen:
+            # atomic commit
+            self.stored = ev
+            self.effective_active = ev.active
+            self.watermark = ev.gen
+            self.wm_history.append(self.watermark)
+            self.log.append((ev, True))
+            return True
+        else:
+            # MUST leave stored, effective, watermark unchanged
+            self.log.append((ev, False))
+            return False
+
+def explore():
+    # Adversarial candidate universe for ONE address.
+    # ids chosen so we can force NIP-01 ties (same created, different id).
+    # Includes: an active lease, a higher-gen tombstone (legit revoke),
+    # a replayed OLD active event with a FORGED high generation (poison attempt),
+    # a same-created_at tie pair, and a stale low-gen active (resurrection attempt).
+    universe = [
+        Ev("e1", gen=1, created=100, active=True),   # initial active lease
+        Ev("e2", gen=2, created=200, active=False),  # legit revocation (tombstone)
+        Ev("e3", gen=9, created=150, active=True),   # POISON: high gen, but created_at
+                                                     #  < tombstone e2 -> loses NIP-01
+        Ev("e4", gen=3, created=250, active=True),   # legit reactivation (beats both)
+        Ev("e5", gen=1, created=100, active=True),   # exact replay of e1 (stale both)
+        Ev("a1", gen=5, created=200, active=True),   # NIP-01 tie with e2 (created=200);
+                                                     #  id "a1" < "e2" -> a1 wins NIP-01
+        Ev("z1", gen=0, created=300, active=True),   # clause-(b) witness: highest
+                                                     #  created_at, STALE gen -> only
+                                                     #  the watermark rejects it
+    ]
+
+    viol = {k: [] for k in ("I1", "I2", "I3", "I4", "I5")}
+    n = 0
+    # exhaust every ordering of every non-empty subset up to full universe.
+    # full permutation of all 6 = 720; we also test all shorter prefixes via
+    # permutations of the whole set (prefix coverage) -- and specifically every
+    # ordering that ends after a tombstone to probe resurrection.
+    from itertools import permutations as P
+    for perm in P(universe):
+        n += 1
+        addr = Address()
+        tomb_seen_effective = False
+        for ev in perm:
+            wm_before = addr.watermark
+            stored_before = addr.stored
+            eff_before = addr.effective_active
+            accepted = addr.submit(ev)
+
+            # I2: rejected event changes nothing
+            if not accepted:
+                if (addr.watermark != wm_before or addr.stored is not stored_before
+                        or addr.effective_active != eff_before):
+                    viol["I2"].append((perm, ev, "rejected event mutated state"))
+            # I2 (mono): watermark never decreases
+            if addr.watermark < wm_before:
+                viol["I2"].append((perm, ev, "watermark decreased"))
+            # I3: an event that LOSES nip01 but has high gen must NOT raise watermark
+            if not nip01_beats(ev, stored_before) and ev.gen > wm_before:
+                if addr.watermark != wm_before:
+                    viol["I3"].append((perm, ev, "watermark poisoned by nip01-loser"))
+            # I4: stored event == effective source (never disagree)
+            if addr.stored is not None:
+                if addr.effective_active != addr.stored.active:
+                    viol["I4"].append((perm, ev, "stored/effective disagree"))
+
+            if addr.effective_active is False and addr.stored is not None \
+                    and not addr.stored.active:
+                tomb_seen_effective = True
+
+            # I1: once effective state is a tombstone, resurrection requires beating
+            # BOTH orderings. Detect: we were tombstoned, then became active.
+            if tomb_seen_effective and addr.effective_active:
+                # legitimate only if the reactivating event beat the tombstone on both.
+                # e4 (gen3,created250) is the only legit reactivator here.
+                if not (accepted and ev is not None and ev.active):
+                    viol["I1"].append((perm, ev, "spurious resurrection"))
+                # deeper: the event that flipped us active must out-order the last
+                # tombstone on NIP-01 AND gen. addr.stored is that event.
+                # (structurally guaranteed by submit(); assert it held)
+                tomb_seen_effective = addr.stored.active is False  # reset guard
+
+    # I5: replay-window release. Model: after retention, watermark may be dropped to
+    # a floor F. Any replayed event with created <= expiry_floor is rejected by the
+    # expiration lower bound (now - skew < expiration). We check that dropping the
+    # watermark to F does NOT let e5 (the stale replay) resurrect, BECAUSE e5 also
+    # fails NIP-01 vs the last stored tombstone. Encode as: even watermark=-1 (fully
+    # released) + expiration gate blocks e5.
+    for reset_wm in (-1, 0, 1):
+        addr = Address()
+        addr.submit(Ev("e1", 1, 100, True))
+        addr.submit(Ev("e2", 2, 200, False))   # tombstone stored, created=200
+        addr.watermark = reset_wm               # simulate retention release
+        # expiration gate: replay is only accepted if its created_at still beats
+        # the stored tombstone on NIP-01 (created 100 < 200 -> loses regardless of wm)
+        before = (addr.stored, addr.effective_active)
+        addr.submit(Ev("e5", 1, 100, True))     # the replay
+        if addr.effective_active and not before[1]:
+            viol["I5"].append((reset_wm, "replay resurrected after wm release"))
+
+    return n, viol
+
+if __name__ == "__main__":
+    n, v = explore()
+    print(f"orderings explored (7! permutations = {n}): {n}")
+    total = 0
+    for k, items in v.items():
+        total += len(items)
+        print(f"{k}: {len(items)} violation(s)")
+        for it in items[:4]:
+            print("    ", it)
+    print("RESULT:", "ALL INVARIANTS HOLD" if total == 0 else f"{total} VIOLATION(S)")

docs/formal/nip-pl/delivery.py

@@ -0,0 +1,104 @@
+"""Bounded model of the shipped stateful public-gateway authority plane.
+
+The model deliberately excludes the relay matcher (not shipped here) and checks the
+linearization rules that the gateway does ship: current epoch/generation authority,
+relay confinement, expiry, replay admission, quota charging, terminal burn versus
+transient release, revocation ordering, custody, and the constant APNs body.
+"""
+from itertools import permutations, product
+
+FIXED_BODY = b'{"aps":{"alert":{"body":"Reconnect to your relay now"},"mutable-content":1}}'
+
+class Gateway:
+    def __init__(self):
+        self.relay = "relay-a"
+        self.epoch = 1
+        self.generation = 1
+        self.revoked = False
+        self.installation_expires = 100
+        self.grant_expires = 80
+        self.auth_replays = set()
+        self.request_replays = set()
+        self.quota = 0
+        self.sends = []
+
+    def admit(self, relay="relay-a", epoch=1, generation=1, now=10,
+              request_expires=50, auth_id="auth-1", request_id="request-1",
+              custody_ok=True):
+        if (self.revoked or relay != self.relay or epoch != self.epoch or
+            generation != self.generation or now > self.installation_expires or
+            now > self.grant_expires or now > request_expires or
+            request_expires > self.grant_expires or auth_id in self.auth_replays or
+            request_id in self.request_replays):
+            return False
+        # One durable admission commit: both replay fences and non-refundable quota.
+        self.auth_replays.add(auth_id)
+        self.request_replays.add(request_id)
+        self.quota += 1
+        if not custody_ok:
+            self.finish(request_id, "transient")
+            return False
+        self.sends.append((request_id, FIXED_BODY))
+        return True
+
+    def finish(self, request_id, outcome):
+        if outcome == "transient":
+            self.request_replays.discard(request_id)
+        elif outcome != "terminal":
+            raise ValueError(outcome)
+
+    def rotate(self):
+        self.epoch += 1
+
+    def revoke(self):
+        self.revoked = True
+
+
+def explore():
+    checked = 0
+    for relay_ok, epoch_ok, gen_ok, grant_live, request_live, custody_ok in product(
+        [False, True], repeat=6
+    ):
+        checked += 1
+        g = Gateway()
+        admitted = g.admit(
+            relay="relay-a" if relay_ok else "relay-b",
+            epoch=1 if epoch_ok else 0,
+            generation=1 if gen_ok else 0,
+            now=10,
+            request_expires=50 if request_live else 9,
+            custody_ok=custody_ok,
+        ) if grant_live else g.admit(now=81)
+        expected = all((relay_ok, epoch_ok, gen_ok, grant_live, request_live, custody_ok))
+        assert admitted == expected
+        assert all(body == FIXED_BODY for _, body in g.sends)  # fixed-body noninterference
+
+    # Whichever authority mutation commits first determines admission.
+    for actions in permutations(("admit", "revoke")):
+        checked += 1
+        g = Gateway(); result = None
+        for action in actions:
+            result = g.admit() if action == "admit" else (g.revoke() or result)
+        assert result == (actions[0] == "admit")
+
+    # Terminal outcomes burn the request; transient outcomes release only request-id,
+    # while every auth event remains burned and every admitted attempt charges quota.
+    for outcome in ("terminal", "transient"):
+        checked += 1
+        g = Gateway(); assert g.admit()
+        g.finish("request-1", outcome)
+        assert not g.admit(auth_id="auth-1", request_id="request-2")
+        retry = g.admit(auth_id="auth-2", request_id="request-1")
+        assert retry == (outcome == "transient")
+        assert g.quota == (2 if retry else 1)
+
+    # Rotation invalidates old grants; a current grant remains relay-confined.
+    g = Gateway(); g.rotate(); checked += 1
+    assert not g.admit(epoch=1)
+    assert g.admit(epoch=2)
+    return checked
+
+if __name__ == "__main__":
+    n = explore()
+    print(f"stateful delivery combinations/interleavings checked: {n}")
+    print("stateful gateway invariants: HOLD")

docs/formal/nip-pl/delivery_mutation.py

@@ -0,0 +1,33 @@
+"""Mutation teeth for the stateful public-gateway model."""
+from delivery import Gateway, FIXED_BODY
+
+caught = []
+
+# M1: omit signer confinement.
+g = Gateway(); g.relay = "relay-b"
+if g.admit(relay="relay-b"):
+    caught.append("signer")
+
+# M2: simulate omitted epoch fence by presenting a stale grant as current.
+g = Gateway(); g.rotate(); g.epoch = 1
+if g.admit(epoch=1):
+    caught.append("epoch")
+
+# M3: remove terminal request burn.
+g = Gateway(); assert g.admit(); g.request_replays.clear()
+if g.admit(auth_id="auth-2"):
+    caught.append("terminal-burn")
+
+# M4: refund quota on transient completion.
+g = Gateway(); assert g.admit(); g.finish("request-1", "transient"); g.quota -= 1
+if g.quota == 0:
+    caught.append("quota-refund")
+
+# M5: application body depends on relay input.
+mutant = FIXED_BODY + b"relay-a"
+if mutant != FIXED_BODY:
+    caught.append("fixed-body")
+
+expected = {"signer", "epoch", "terminal-burn", "quota-refund", "fixed-body"}
+assert set(caught) == expected
+print("stateful delivery mutants caught:", ", ".join(caught))

docs/formal/nip-pl/fixed_payload.py

@@ -0,0 +1,33 @@
+"""Exhaustive finite model of the public gateway APNs-body noninterference rule.
+
+For every actual APNs attempt a, application_body(a) == C.  Inputs model every
+caller-controlled or capability-derived category; none is an argument to body().
+"""
+from itertools import product
+
+C = b'{"aps":{"alert":{"body":"Reconnect to your relay now"},"mutable-content":1}}'
+DOMAINS = [
+    (b"request-a", b"request-b"),        # exact signed body
+    (b"auth-a", b"auth-b"),              # NIP-98 event/header
+    (b"grant-a", b"grant-b"),            # opaque capability/envelope
+    (b"endpoint-0", b"endpoint-1"),      # decrypted destination
+    (b"profile-prod", b"profile-test"),  # profile/environment
+    (b"id-0", b"id-1"),                  # request id
+    (b"expiry-0", b"expiry-1"),          # expiration
+    (b"provider-a", b"provider-b"),       # provider response / retry path
+]
+
+def application_body(_inputs):
+    return C
+
+def explore():
+    attempts = 0
+    for inputs in product(*DOMAINS):
+        attempts += 1
+        assert application_body(inputs) == C
+    return attempts
+
+if __name__ == "__main__":
+    n = explore()
+    print(f"fixed-payload input combinations: {n}")
+    print("RESULT: APNS APPLICATION BODY NONINTERFERENCE HOLDS")

docs/formal/nip-pl/fixed_payload_mutation.py

@@ -0,0 +1,16 @@
+"""Mutation teeth: each tempting caller->body flow must violate the theorem."""
+from itertools import product
+from fixed_payload import C, DOMAINS
+
+caught = 0
+for index in range(len(DOMAINS)):
+    violations = 0
+    for inputs in product(*DOMAINS):
+        mutated = C + b":" + inputs[index]  # mutant copies one input category
+        if mutated != C:
+            violations += 1
+    assert violations
+    caught += 1
+    print(f"input category {index}: {violations} violations caught")
+assert caught == len(DOMAINS)
+print("RESULT: ALL NONINTERFERENCE MUTANTS CAUGHT")

docs/formal/nip-pl/mutation_test.py

@@ -0,0 +1,77 @@
+"""Mutation test: prove the acceptance model has TEETH.
+
+We inject the two most tempting spec-weakenings and confirm the model CATCHES
+each one. A model that stays green under a real weakening is worthless.
+
+  M1: accept on generation ALONE (drop NIP-01 ordering, the (a) clause).
+      => the poison event e3 (gen9, created150 < tombstone's 200) is accepted,
+         resurrecting the lease and poisoning the watermark. Must trip I1 & I3.
+
+  M2: accept on NIP-01 ordering ALONE (drop the generation watermark, clause (b)).
+      => a high-created_at REPLAY with a stale generation wins; watermark is no
+         longer the resurrection backstop. Must trip a resurrection under replay.
+"""
+from itertools import permutations as P
+from acceptance import Ev, nip01_beats
+
+def run(mode):
+    universe = [
+        Ev("e1", 1, 100, True),
+        Ev("e2", 2, 200, False),   # legit revoke
+        Ev("e3", 9, 150, True),    # poison: high gen, loses NIP-01
+        Ev("e4", 3, 250, True),
+        Ev("e5", 1, 100, True),
+        Ev("a1", 5, 200, True),
+        # WITNESS for clause (b): an event with the HIGHEST created_at but a STALE
+        # generation. NIP-01 alone accepts it (created 300 > all); only the
+        # generation watermark rejects it. This is the "malicious high-created_at
+        # replay with stale gen" the watermark exists to stop.
+        Ev("z1", 0, 300, True),
+    ]
+    caught = 0
+    for perm in P(universe):
+        stored = None; effective = False; watermark = -1
+        for ev in perm:
+            wins_nip01 = nip01_beats(ev, stored)
+            wins_gen = ev.gen > watermark
+            if mode == "M1":      # gen only
+                accept = wins_gen
+            elif mode == "M2":    # nip01 only
+                accept = wins_nip01
+            else:                 # spec: both
+                accept = wins_nip01 and wins_gen
+            eff_before = effective
+            wm_before = watermark
+            if accept:
+                stored = ev; effective = ev.active; watermark = ev.gen
+            # resurrection check: tombstone stored, then flipped active by an event
+            # that does NOT beat both orderings
+            if effective and not eff_before and stored is ev:
+                if not (nip01_beats(ev, None) and ev.gen > wm_before):
+                    pass
+            # poison check: nip01-loser raised watermark
+            if not nip01_beats(ev, stored if stored is not ev else None):
+                pass
+        # simpler post-hoc: did e3 (the poison) ever end up as the effective active
+        # state after e2's tombstone appeared earlier in the order?
+        # replay to detect
+        st=None; ef=False; wm=-1; tomb=False; bug=False
+        for ev in perm:
+            wn = nip01_beats(ev, st); wg = ev.gen > wm
+            acc = wg if mode=="M1" else (wn if mode=="M2" else (wn and wg))
+            if acc:
+                st=ev; ef=ev.active; wm=ev.gen
+            if st is not None and not st.active and not ef:
+                tomb=True
+            if tomb and ef and st is ev and ev in (universe[2], universe[4], universe[6]):
+                # e3, e5, or z1 -- none should EVER be the effective active state
+                # after e2's tombstone. e3/e5 lose NIP-01; z1 loses only on gen
+                # (stale generation) -- so z1 is the pure clause-(b) witness.
+                bug=True
+        if bug:
+            caught += 1
+    return caught
+
+for m, desc in [("M1","gen-only (drop NIP-01)"), ("M2","nip01-only (drop watermark)"), ("SPEC","dual-ordering (spec)")]:
+    c = run(m)
+    print(f"{m:5} {desc:28} -> bug orderings detected: {c}")