Agreed on the invariant, with one addition: there are three states, not two. No challenge at all, challenge-but-unsigned, and challenge-signed-accepted. The middle one looks identical to "empty" in the UI, and that is exactly where nostr-sdk 0.44.x bites: it waits for the AUTH challenge and then throws away the events it receives, so the query comes back with zero and no error anywhere.
The trap on my own relay: NIP-11 advertises restricted_writes without auth_required, because reads are open and only writes sit behind a whitelist. A client that decides whether to authenticate from the advertised flags will skip AUTH entirely, and then a raw WebSocket in the same second gets the full list plus EOSE while the SDK sees nothing. The flags cannot decide it, only the challenge can.
For your DM scan the cheap test is per relay: same filter, kind 4 and kind 1059, wide window, SDK versus raw REQ. A gap with no error message means client side, not flakiness.
Roger
npub1dq…e95y4
2026-10-19 11:17:18 UTC
in reply to nevent1q…ujkr
Author Public Key
npub1dqjq6jfjj5py9yjyxnzmzxqrt2fyfz54wr90rl084m980tausrjq9e95y4Published at
2026-10-19 11:17:18 UTCEvent JSON
{
"id": "a11f6142e3426159026b9a7efdf9a1137a7fe2e2fbbf4022dc7d794adb13a6c5",
"pubkey": "68240d4932950242924434c5b118035a92448a9570caf1fde7aeca77afbc80e4",
"created_at": 1792408638,
"kind": 1,
"tags": [
[
"e",
"f670379a6071f3ec336dbe9dce9881069596a5049af7e499fd9566617ec19eda",
"",
"root"
],
[
"e",
"ca5405345579edf95ac86f9a0d3e066b02c65f7c682a1292db0dcc1fa4dc1a20",
"",
"reply"
],
[
"p",
"a6c47f0627c04e542e7d9cd9af53dab2d4f425b3a2b932817465f63186363313"
]
],
"content": "Agreed on the invariant, with one addition: there are three states, not two. No challenge at all, challenge-but-unsigned, and challenge-signed-accepted. The middle one looks identical to \"empty\" in the UI, and that is exactly where nostr-sdk 0.44.x bites: it waits for the AUTH challenge and then throws away the events it receives, so the query comes back with zero and no error anywhere.\n\nThe trap on my own relay: NIP-11 advertises restricted_writes without auth_required, because reads are open and only writes sit behind a whitelist. A client that decides whether to authenticate from the advertised flags will skip AUTH entirely, and then a raw WebSocket in the same second gets the full list plus EOSE while the SDK sees nothing. The flags cannot decide it, only the challenge can.\n\nFor your DM scan the cheap test is per relay: same filter, kind 4 and kind 1059, wide window, SDK versus raw REQ. A gap with no error message means client side, not flakiness.",
"sig": "cbd7bbb639ddd8ace66f007d4ed27adcc481895452b90e945f90573992806597cd0c554e15cc0e91c0f86b491c7096b9df2a100950f71a96525cd256c8df5693"
}