fix(0.17.1): static lease reaper missed same-day expirations

The static lease manager wrote expires_at via toISOString()
('2026-05-15T10:00:00.000Z') but compared with SQLite's
datetime('now') ('2026-05-15 10:00:00'). At position 10 of those
two strings, 'T' (0x54) lex-compares greater than ' ' (0x20), so
ANY approved lease whose expires_at fell on the same UTC calendar
day as the current moment lex-compared as still-in-the-future.

Effect:
- listActive() kept expired-today rows in the Active Leases page.
- reapExpired() never revoked them; they sat with revoked=0 until
  the UTC date rolled over. Audit confirmed: zero lease.reap
  events in our retained history.

Dynamic leases already converted to SQLite format on write
(dynamic/manager.ts:357) and were unaffected.

Fix: every static-lease WHERE that compared expires_at or
request_expires_at to datetime('now') now uses
strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), which produces the
byte-identical format toISOString emits. No DB migration needed
(stored format is unchanged). No API or wire change.

Existing test masked the bug by manually setting expires_at via
SQLite's space-separated datetime() instead of going through the
production write path. Test now writes via toISOString() like
production does. Added a regression test specifically for the
same-day expiration case.

568/568 tests pass.

Author: bshandley

CHANGELOG.md

@@ -5,6 +5,13 @@ release notes (built from conventional-commit subjects between tags) carry the
 fine-grained per-commit log. This file summarises each release at a higher
 level.
 
+## [0.17.1] - 2026-05-15
+
+### Fix
+
+- **Static lease reaper now catches same-day expirations.** The static lease manager wrote `expires_at` via JavaScript's `toISOString()` (`'2026-05-15T10:00:00.000Z'`) but compared it in SQLite against `datetime('now')` (`'2026-05-15 10:00:00'`). At character position 10 of those two strings, `'T'` (0x54) is lexicographically greater than `' '` (0x20), so any approved lease whose `expires_at` falls on the same UTC calendar day as the current moment lex-compared as still-in-the-future. Effect: `listActive()` kept showing those rows on the Active Leases page after they expired, and `reapExpired()` never revoked them until the UTC date rolled over. The dynamic lease manager already converted to SQLite format before storing and was unaffected. Fix: every static-lease WHERE clause that compared `expires_at` or `request_expires_at` to `datetime('now')` now uses `strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`, which produces the byte-identical format `toISOString()` emits. No DB migration required (the stored format is unchanged). No API/wire format change.
+- Test fix: `test("reapExpired marks expired leases as revoked")` was manually overwriting `expires_at` with SQLite's space-separated format via `datetime('now', '-1 minute')`, bypassing the production write path and masking the bug. Test now writes via `new Date(...).toISOString()` matching how production writes. Added a regression test specifically for the same-day expiration case.
+
 ## [0.17.0] - 2026-05-15
 
 ### Feature

src/lease/manager.ts

@@ -5,6 +5,15 @@ import type { AuditLog } from "../audit/logger";
 import type { EventBus } from "../events/bus";
 import { sendLeaseRequestWebhook } from "./webhook";
 
+// SQLite expression that yields the current UTC time in the SAME ISO format
+// `Date.prototype.toISOString()` produces ('YYYY-MM-DDTHH:MM:SS.fffZ'). Used
+// for every comparison against `expires_at` / `request_expires_at` so the
+// lex compare matches chronological order. Using bare `datetime('now')`
+// returns 'YYYY-MM-DD HH:MM:SS' (space separator) which lex-compares LESS
+// than any ISO-format string at the date/time boundary, silently breaking
+// same-day expiry checks.
+const SQL_NOW_ISO = "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
+
 export type LeaseStatus = "pending" | "approved" | "denied" | "expired";
 
 export interface Lease {
@@ -196,7 +205,7 @@ export class LeaseManager {
       .query(
         `SELECT * FROM leases
          WHERE identity = ? AND secret_path = ? AND status = 'pending'
-         AND revoked = 0 AND request_expires_at > datetime('now')`
+         AND revoked = 0 AND request_expires_at > ${SQL_NOW_ISO}`
       )
       .get(identity, secretPath) as LeaseRow | null;
     if (existing) return rowToLease(existing);
@@ -434,7 +443,7 @@ export class LeaseManager {
 
   listPending(identity?: string): Lease[] {
     let query =
-      "SELECT * FROM leases WHERE status = 'pending' AND revoked = 0 AND request_expires_at > datetime('now')";
+      `SELECT * FROM leases WHERE status = 'pending' AND revoked = 0 AND request_expires_at > ${SQL_NOW_ISO}`;
     const params: string[] = [];
     if (identity) {
       query += " AND identity = ?";
@@ -453,7 +462,7 @@ export class LeaseManager {
       .query(
         `SELECT * FROM leases
          WHERE identity = ? AND secret_path = ? AND status = 'approved'
-         AND revoked = 0 AND expires_at > datetime('now')
+         AND revoked = 0 AND expires_at > ${SQL_NOW_ISO}
          ORDER BY expires_at DESC LIMIT 1`
       )
       .get(identity, secretPath) as LeaseRow | null;
@@ -554,7 +563,7 @@ export class LeaseManager {
 
   listActive(identity?: string): Lease[] {
     let query =
-      "SELECT * FROM leases WHERE revoked = 0 AND status = 'approved' AND expires_at > datetime('now')";
+      `SELECT * FROM leases WHERE revoked = 0 AND status = 'approved' AND expires_at > ${SQL_NOW_ISO}`;
     const params: string[] = [];
 
     if (identity) {
@@ -576,7 +585,7 @@ export class LeaseManager {
     // Approved past expiry: existing semantics (revoke).
     const approvedExpired = this.db
       .query(
-        "UPDATE leases SET revoked = 1 WHERE revoked = 0 AND status = 'approved' AND expires_at <= datetime('now')"
+        `UPDATE leases SET revoked = 1 WHERE revoked = 0 AND status = 'approved' AND expires_at <= ${SQL_NOW_ISO}`
       )
       .run();
 
@@ -585,7 +594,7 @@ export class LeaseManager {
       .query(
         `SELECT id, identity, secret_path FROM leases
          WHERE revoked = 0 AND status = 'pending'
-         AND request_expires_at IS NOT NULL AND request_expires_at <= datetime('now')`
+         AND request_expires_at IS NOT NULL AND request_expires_at <= ${SQL_NOW_ISO}`
       )
       .all() as { id: string; identity: string; secret_path: string }[];
 

src/version.ts

@@ -1,3 +1,3 @@
 // Single source of truth for the Gatehouse version.
 // Update this value when cutting a release, then tag the commit.
-export const VERSION = "0.17.0";
+export const VERSION = "0.17.1";

test/lease.test.ts

@@ -108,11 +108,13 @@ describe("LeaseManager", () => {
   });
 
   test("reapExpired marks expired leases as revoked", () => {
-    // Create a lease with 1-second TTL
     const result = leases.checkout("test/key", "test-agent", 10)!;
 
-    // Manually set expires_at to the past
-    db.query("UPDATE leases SET expires_at = datetime('now', '-1 minute') WHERE id = ?").run(
+    // Set expires_at to one minute in the past, using the SAME format the
+    // production write path uses (toISOString). This is what triggers the
+    // lex-compare bug if the reaper's WHERE clause uses bare datetime('now').
+    db.query("UPDATE leases SET expires_at = ? WHERE id = ?").run(
+      new Date(Date.now() - 60_000).toISOString(),
       result.lease.id
     );
 
@@ -123,6 +125,24 @@ describe("LeaseManager", () => {
     expect(lease!.revoked).toBe(true);
   });
 
+  test("reapExpired catches an approved lease that expired earlier today (regression for lex-compare bug)", () => {
+    const result = leases.checkout("test/key", "test-agent", 10)!;
+
+    // Force the row to look exactly like a real production lease that
+    // expired 5 seconds ago: same UTC calendar day as now, toISOString
+    // format. Bare datetime('now') in the reaper would treat 'T' as
+    // greater than ' ', leaving this row stuck in active.
+    const fiveSecsAgo = new Date(Date.now() - 5_000).toISOString();
+    db.query("UPDATE leases SET expires_at = ? WHERE id = ?").run(
+      fiveSecsAgo,
+      result.lease.id
+    );
+
+    expect(leases.reapExpired()).toBe(1);
+    expect(leases.getLease(result.lease.id)!.revoked).toBe(true);
+    expect(leases.listActive().some(l => l.id === result.lease.id)).toBe(false);
+  });
+
   test("reapExpired returns 0 when no leases expired", () => {
     leases.checkout("test/key", "test-agent", 3600);
     expect(leases.reapExpired()).toBe(0);