Index: /branches/cname-collision/DNSDB.pm
===================================================================
--- /branches/cname-collision/DNSDB.pm	(revision 983)
+++ /branches/cname-collision/DNSDB.pm	(revision 984)
@@ -665,13 +665,13 @@
     # Check timestamps of pending active-after records.  Coerce expires-at fields to soonest match if found.
     if ($args{defrec} eq 'n') {
-      $sql = "SELECT extract(epoch from stamp) FROM "._rectable($args{defrec}, $args{revrec}).
-       " WHERE "._recparent($args{defrec}, $args{revrec})." = ? AND type $tcompare 5 AND $hfield = ?".
-       " AND stampactive = 't' AND expires = 'f' AND stamp >= now() ";
+      $sql = "SELECT extract(epoch from stamp),stamp < now() FROM "._rectable($args{defrec}, $args{revrec}).
+	" WHERE "._recparent($args{defrec}, $args{revrec})." = ? AND type $tcompare 5 AND $hfield = ?".
+	" AND stampactive = 't' AND expires = 'f'";
       my @lookupargs = ($args{id}, $hcheck);
       if ($args{update}) {
-        $sql .= "AND record_id <> ? ";
+        $sql .= " AND record_id <> ?";
         push @lookupargs, $args{update};
       }
-      $sql .= "ORDER BY stamp LIMIT 1";
+      $sql .= " ORDER BY stamp LIMIT 1";
       my @t = $dbh->selectrow_array($sql, undef, @lookupargs);
       if (@t) {
@@ -693,8 +693,12 @@
           }
         } else {
-          # no expiry requested, but we found a valid-after, so coerce the new record down to expiring at that time
-          ${$args{stamp}} = strftime('%Y-%m-%d %H:%M:%S', localtime($t[0]));
-          ${$args{expires}} = 't';
-          return ('WARN', "CNAME added with expiry time;  conflicting valid-after record found");
+          if ($t[1]) {
+            return('FAIL', "Cannot add CNAME, a record with a valid-after time in the past is already present");
+          } else {
+            # no expiry requested, but we found a valid-after, so coerce the new record down to expiring at that time
+            ${$args{stamp}} = strftime('%Y-%m-%d %H:%M:%S', localtime($t[0]));
+            ${$args{expires}} = 't';
+            return ('WARN', "CNAME added with expiry time;  conflicting valid-after record found");
+          }
         }
       }
Index: /branches/cname-collision/t/cname.t
===================================================================
--- /branches/cname-collision/t/cname.t	(revision 983)
+++ /branches/cname-collision/t/cname.t	(revision 984)
@@ -226,5 +226,5 @@
       }
     };
-    subtest '  - collision with active-after record' => sub {
+    subtest '  - collision with pending active-after record' => sub {
       $newname = 'active-after1.expiry1.test';
       ($code, $msg) = $dnsdb->addRec('n', 'n', 4, \$newname, \$rectype, \$newval, 900);
@@ -243,4 +243,14 @@
       }
     };
+    subtest '  - collision with active active-after record' => sub {
+      $newname = 'active-after2.expiry1.test';
+      ($code, $msg) = $dnsdb->addRec('n', 'n', 4, \$newname, \$rectype, \$newval, 900);
+      ok( $code eq 'FAIL', "addRec() claimed failure" );
+      if ($code eq 'FAIL') {
+        ($rcount) = $dbh->selectrow_array("SELECT count(*) FROM records WHERE domain_id = 4 AND host = '$newname' AND type <> 5");
+        ok( $rcount == 1, " ... [$rcount] record(s) with $newname already exist" );
+        like( $msg, qr/record with a valid-after time in the past/, " ... returned matching error" );
+      }
+    };
   }; # add non-timestamp CNAME
 
Index: /branches/cname-collision/t/dns-unitbase.sql
===================================================================
--- /branches/cname-collision/t/dns-unitbase.sql	(revision 983)
+++ /branches/cname-collision/t/dns-unitbase.sql	(revision 984)
@@ -657,5 +657,5 @@
 2	example.org	1		1	2025121800	D	f	ac
 3	example.net	1		1	2025121800	D	f	ab
-4	expiry1.test	1		1	2026010702	D	t	
+4	expiry1.test	1		1	2026011400	D	t	
 \.
 
@@ -764,4 +764,5 @@
 57	4	1	1	admin	Initial User	Added record 'expired2.expiry1.test TXT imma expire soon', TTL 5400, expires at 2026-01-10 07:00	2026-01-07 17:57:07.015962-05	0	0
 58	4	1	1	admin	Initial User	Added record 'active-after1.expiry1.test TXT not active yet', TTL 5400, valid after 2026-01-11 11:30	2026-01-07 18:12:57.491476-05	0	0
+59	4	1	1	admin	Initial User	Added record 'active-after2.expiry1.test TXT I'm done waiting', TTL 5400, expires at 2025-12-31 14:00	2026-01-14 18:02:13.876839-05	0	0
 \.
 
@@ -771,5 +772,5 @@
 --
 
-SELECT pg_catalog.setval('public.log_log_id_seq', 58, true);
+SELECT pg_catalog.setval('public.log_log_id_seq', 59, true);
 
 
@@ -861,4 +862,5 @@
 4	48	expired2.expiry1.test	16	imma expire soon	0	0	0	5400	\N	0		2026-01-10 07:00:00-05	t	t	\N
 4	49	active-after1.expiry1.test	16	not active yet	0	0	0	5400	\N	0		2026-01-11 11:30:00-05	f	t	\N
+4	50	active-after2.expiry1.test	16	I'm done waiting	0	0	0	5400	\N	0		2025-12-31 14:00:00-05	f	t	\N
 \.
 
@@ -868,5 +870,5 @@
 --
 
-SELECT pg_catalog.setval('public.records_record_id_seq', 49, true);
+SELECT pg_catalog.setval('public.records_record_id_seq', 50, true);
 
 
Index: /branches/cname-collision/t/test-cname-timestamps.sql
===================================================================
--- /branches/cname-collision/t/test-cname-timestamps.sql	(revision 983)
+++ /branches/cname-collision/t/test-cname-timestamps.sql	(revision 984)
@@ -6,2 +6,3 @@
 UPDATE records SET stamp = date_trunc('day', now() + interval '3 day') + '07:00' WHERE record_id = 48;
 UPDATE records SET stamp = date_trunc('day', now() + interval '5 day') + '11:30' WHERE record_id = 49;
+UPDATE records SET stamp = date_trunc('day', now() - interval '3 day') + '14:00' WHERE record_id = 50;