fix: run cert expiry check concurrently to avoid delaying results

apps/monitor/src/runner.rs

@@ -195,29 +195,35 @@ async fn run_check(client: &reqwest::Client, monitor: &Monitor, scheduled_at: Op
         Ok((status_code, headers, body)) => {
             let status = status_code;
 
-            // Only attempt cert check after a successful response
-            let cert_expiry_days = if is_https {
-                match tokio::time::timeout(
-                    std::time::Duration::from_secs(5),
-                    check_cert_expiry(&url_for_cert),
-                ).await {
-                    Ok(Ok(days)) => days,
-                    _ => None,
-                }
+            // Start cert expiry check in background — don't block result posting.
+            // We'll use None for cert_expiry_days in query evaluation since it
+            // shouldn't delay the main result by seconds of extra TLS handshake.
+            let cert_handle = if is_https {
+                Some(tokio::spawn(async move {
+                    match tokio::time::timeout(
+                        std::time::Duration::from_secs(5),
+                        check_cert_expiry(&url_for_cert),
+                    ).await {
+                        Ok(Ok(days)) => days,
+                        _ => None,
+                    }
+                }))
             } else {
                 None
             };
 
             let query = &monitor.query;
 
-            // Evaluate query if present
+            // Evaluate query if present (cert_expiry_days not yet available —
+            // $certExpiry queries will use None here; the actual value is
+            // attached to the result once the background check completes)
             let (up, query_error) = if let Some(q) = query {
                 let response = Response {
                     status,
                     body: body.clone(),
                     headers: headers.clone(),
                     latency_ms: Some(latency_ms),
-                    cert_expiry_days,
+                    cert_expiry_days: None,
                 };
                 match query::evaluate(q, &response) {
                     Ok(result) => (result, None),
@@ -232,6 +238,12 @@ async fn run_check(client: &reqwest::Client, monitor: &Monitor, scheduled_at: Op
                 (status < 400, None)
             };
 
+            // Await the cert check now (it's been running concurrently during query eval)
+            let cert_expiry_days = match cert_handle {
+                Some(h) => h.await.unwrap_or(None),
+                None => None,
+            };
+
             let meta = json!({
                 "headers": headers,
                 "body_preview": &body[..body.len().min(500)],