fix(rust_brain): keep order index aligned during eviction and forget (#7)

Evicting from the front of _order without decrementing _order_index left
stale indices. forget() then tombstoned the wrong slot, and subsequent
evictions could drop live keys while leaving ghosts — silent data loss.

Add _evict_oldest/_remove_from_order helpers and regression tests.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Daniel <DJLougen@users.noreply.github.com>

Author: 3 people

hive/rust_brain/__init__.py

@@ -143,6 +143,31 @@ def __init__(self, *, tenant_id: str = "default", tenant_isolation: bool = True,
         self._order: list[str] = []
         self._order_index: dict[str, int] = {}
 
+    def _remove_order_slot(self, idx: int) -> None:
+        """Remove ``_order[idx]`` and shift down indices above ``idx``."""
+        del self._order[idx]
+        for k, i in list(self._order_index.items()):
+            if i > idx:
+                self._order_index[k] = i - 1
+
+    def _remove_from_order(self, storage_key: str) -> None:
+        """Drop a key from the insertion-order list without leaving tombstones."""
+        idx = self._order_index.pop(storage_key, None)
+        if idx is not None:
+            self._remove_order_slot(idx)
+
+    def _evict_oldest(self) -> None:
+        """Evict the oldest entry from the store and keep order indices aligned."""
+        if not self._order:
+            return
+        oldest_key = self._order[0]
+        if oldest_key:
+            self._nodes.pop(oldest_key, None)
+            self._order_index.pop(oldest_key, None)
+        self._order.pop(0)
+        for k in list(self._order_index):
+            self._order_index[k] -= 1
+
     def _prefix(self, key: str) -> str:
         """Return the internal storage key with tenant prefix when isolation is on."""
         if not self._tenant_isolation or key.startswith(f"{self._tenant_id}:"):
@@ -192,11 +217,7 @@ def remember(
                 self._order.append(storage_key)
             # Evict oldest entries if over capacity
             while len(self._nodes) > self._max_nodes:
-                oldest_key = self._order[0]
-                if oldest_key:
-                    self._nodes.pop(oldest_key, None)
-                    self._order_index.pop(oldest_key, None)
-                self._order.pop(0)
+                self._evict_oldest()
             return node
 
     def supersede(self, key: str, new_value: Any, **kwargs: Any) -> MemoryNode:
@@ -219,9 +240,7 @@ def forget(self, key: str) -> None:
         key = self._prefix(key)
         with self._lock:
             self._nodes.pop(key, None)
-            idx = self._order_index.pop(key, None)
-            if idx is not None:
-                self._order[idx] = ""
+            self._remove_from_order(key)
 
     # -- read path ----------------------------------------------------------
 
@@ -331,9 +350,7 @@ def gc_expired(self) -> int:
             age_s = (_now_ns() - node.ts_ns) / 1e9
             if age_s > self._default_ttl_s:
                 self._nodes.pop(storage_key, None)
-                idx = self._order_index.pop(storage_key, None)
-                if idx is not None:
-                    self._order[idx] = ""
+                self._remove_from_order(storage_key)
                 removed += 1
         return removed
 
@@ -349,9 +366,7 @@ def revoke_tenant(self, tenant_id: str | None = None) -> int:
             to_remove = [k for k in self._nodes if k.startswith(prefix)]
             for k in to_remove:
                 self._nodes.pop(k, None)
-                idx = self._order_index.pop(k, None)
-                if idx is not None:
-                    self._order[idx] = ""
+                self._remove_from_order(k)
             return len(to_remove)
 
     def snapshot_to_file(self, path: str) -> dict[str, Any]:

tests/test_security_fixes.py

@@ -92,6 +92,33 @@ def test_rustbrain_evicts_oldest_when_over_capacity():
     assert brain.recall("d") == 4
 
 
+def test_rustbrain_evicts_oldest_after_forget_and_overflow():
+    """Regression: stale _order_index must not evict the wrong live key."""
+    brain = RustBrain(max_nodes=2)
+    brain.remember("a", 1)
+    brain.remember("b", 2)
+    brain.remember("c", 3)  # evicts "a"; leaves stale order indices
+    brain.forget("b")
+
+    brain.remember("d", 4)
+    brain.remember("e", 5)  # must evict "c" (oldest survivor), not "d"
+
+    assert len(brain) == 2
+    assert brain.recall("c") is None
+    assert brain.recall("d") == 4
+    assert brain.recall("e") == 5
+
+
+def test_rustbrain_forget_keeps_order_index_aligned():
+    brain = RustBrain(max_nodes=3)
+    for label in ("a", "b", "c", "d"):
+        brain.remember(label, label)
+    brain.forget("b")
+
+    assert brain._order == ["default:c", "default:d"]
+    assert brain._order_index == {"default:c": 0, "default:d": 1}
+
+
 def test_rustbrain_max_nodes_default_is_10000():
     brain = RustBrain()
     assert brain._max_nodes == 10_000