Land the money-test follow-up: the timestamp exemption reached inside nested fields, exempting from a money check whose whole point is that nothing is exempt

platform/internal/config/effective_test.go

@@ -37,6 +37,36 @@ func effective(t *testing.T) (map[string]Setting, string) {
 	return by, buf.String()
 }
 
+// The exemption `loggedFields` grants is exactly ONE field of ONE line, and nothing deeper.
+//
+// It exists because the first version of that helper skipped any key named `time` at any DEPTH, so a
+// nested group called `time` would have been silently exempt from the money check — a hole aimed the
+// wrong way, in a helper whose entire purpose is that no field escapes. Flat lines made the two
+// behave identically, which is how such a hole survives until the shape changes and nobody looks.
+//
+// Mutation caught: moving the `delete` back inside the recursive walk.
+func TestTheTimestampExemptionDoesNotReachInsideTheLine(t *testing.T) {
+	const line = `{"time":"2026-08-29T03:00:00.123456789+03:00","level":"INFO","msg":"config",` +
+		`"nested":{"time":"7.50","key":"TM_PLATFORM_SIGNUP_GRANT_USD"}}`
+	fields := loggedFields(t, line)
+	var top, deep bool
+	for _, f := range fields {
+		if strings.Contains(f, "2026-08-29T03:00:00") {
+			top = true // the handler's own clock leaked through
+		}
+		if f == "7.50" {
+			deep = true // a value under a nested key called `time` was still looked at
+		}
+	}
+	if top {
+		t.Error("the handler's own timestamp reached the assertion: the false positive is back")
+	}
+	if !deep {
+		t.Error("a value nested under a key called `time` was exempted from the check: the exemption " +
+			"is meant to cover the handler's field, not any field that happens to share its name")
+	}
+}
+
 // loggedFields is every key and every value the boot log printed, MINUS the handler's own timestamp.
 //
 // ⚠ It exists because the money test used to search the RAW buffer, and that buffer carries an
@@ -69,9 +99,6 @@ func loggedFields(t *testing.T, log string) []string {
 		switch v := v.(type) {
 		case map[string]any:
 			for k, sub := range v {
-				if k == slog.TimeKey {
-					continue // the handler's own clock is not part of what this deployment printed
-				}
 				out = append(out, k)
 				walk(sub)
 			}
@@ -94,6 +121,12 @@ func loggedFields(t *testing.T, log string) []string {
 			// that every field is looked at.
 			t.Fatalf("the boot log emitted a line that is not JSON: %q (%v)", l, err)
 		}
+		// ⚠ Dropped at the TOP LEVEL only, which is where the handler writes it. The first version of
+		// this helper skipped any key named `time` at any DEPTH, and that is a hole pointing the wrong
+		// way: a nested group called `time` would have been quietly exempt from a check whose whole
+		// purpose is that nothing is exempt. Today every line is flat, so the two behaved alike — which
+		// is exactly how such a hole survives to the day the shape changes.
+		delete(m, slog.TimeKey)
 		walk(m)
 	}
 	if len(out) == 0 {
@@ -182,8 +215,9 @@ func TestAConfiguredAmountIsNeverPrinted(t *testing.T) {
 			t.Errorf("%s: value %q, want it withheld", k, got[k].Value)
 		}
 	}
+	fields := loggedFields(t, line) // parsed ONCE: the log does not change between amounts
 	for _, amount := range []string{"7.50", "7500000", "0.0425", "42500"} {
-		for _, field := range loggedFields(t, line) {
+		for _, field := range fields {
 			if strings.Contains(field, amount) {
 				t.Errorf("the boot line carries the amount %q, in the field %q", amount, field)
 			}