@optimystic/db-p2p 0.24.2 → 0.25.0

package/src/cohort-topic/host.ts

@@ -161,6 +161,7 @@ import { FretCohortThresholdCrypto, createVerifyOnlyThresholdCrypto } from "./th
 import { FretTrustAnchor } from "./fret-trust-anchor.js";
 import { FretSizeEstimator } from "./size-estimator.js";
 import { peerIdToBytes, bytesToPeerIdString } from "./peer-codec.js";
+import { registerProtocolHandler } from "../network/register-protocol-handler.js";
 import { signPeer, verifyPeerSig } from "./peer-sig.js";
 import { createPoWVerifier, createReputationVerifier, type BootstrapReputationView } from "./bootstrap-evidence-verifiers.js";
 import { createParentReferenceVerifier, createDefaultParentTopicView, type BootstrapParentTopicView } from "./bootstrap-parent-reference.js";
@@ -1037,7 +1038,7 @@ export async function createCohortTopicHost(node: Libp2p, fret: FretService, opt
 	// --- protocol handlers + activity callback ---
 	// Await registration so the host is not returned (and dialed) before the five handlers are live —
 	// and, crucially, before the gossip driver below starts ticking (no tick may run on a half-wired node).
-	await registerProtocolHandlers(node, protocols, registry, dispatchRegister, childLinkDeps, minSigs, signEndorse, verifier, promoteGate, gossipTransport, maybeInstantiateColdSibling, publishSink, membershipSource, selfCoord, maxBytes);
+	await registerCohortTopicProtocols(node, protocols, registry, dispatchRegister, childLinkDeps, minSigs, signEndorse, verifier, promoteGate, gossipTransport, maybeInstantiateColdSibling, publishSink, membershipSource, selfCoord, maxBytes);
 	fret.setActivityHandler(async (activity: string, cohort: string[]): Promise<{ commitCertificate: string }> => {
 		const decoded = decodeCohortMessage(b64urlToBytes(activity), maxBytes);
 		// Decode-and-branch: a `ChildLinkV1` (a child cohort registering with this parent) runs the child-link
@@ -2788,7 +2789,7 @@ function tierOfTopic(store: ReturnType<typeof createRegistrationStore>, topicId:
 	return (recs.length > 0 ? recs[0]!.tier : 0) as Tier;
 }
 
-async function registerProtocolHandlers(
+async function registerCohortTopicProtocols(
 	node: Libp2p,
 	protocols: CohortTopicProtocols,
 	registry: CoordRegistry,
@@ -2810,7 +2811,7 @@ async function registerProtocolHandlers(
 	await Promise.all([
 		// register: a direct dial carries a RenewV1 (ping), a ChildLinkV1 (a child cohort registering with this
 		// parent), or a RegisterV1 (re-attach walk fallback). The three shapes are disjoint, so try each in turn.
-		node.handle(protocols.register, makeRequestHandler(async (frame): Promise<Uint8Array> => {
+		registerProtocolHandler(node, protocols.register, makeRequestHandler(async (frame): Promise<Uint8Array> => {
 			const decoded = decodeCohortMessage(frame, maxBytes);
 			const renew = tryValidate(() => validateRenewV1(decoded));
 			if (renew !== undefined) {
@@ -2830,7 +2831,7 @@ async function registerProtocolHandlers(
 		// every coord engine's bus; per-bus epoch matching governs which engine merges the record deltas.
 		// First, if this is a verified co-member frame for a coord we hold no engine for, instantiate that
 		// engine (§Cold-start instantiation) so its freshly-subscribed bus merges this very frame on `deliver`.
-		node.handle(protocols.gossip, makeOneWayHandler(async (frame, from): Promise<void> => {
+		registerProtocolHandler(node, protocols.gossip, makeOneWayHandler(async (frame, from): Promise<void> => {
 			maybeInstantiateColdSibling(frame);
 			gossipTransport.deliver(from.toString(), frame);
 		}, maxBytes)),
@@ -2839,12 +2840,12 @@ async function registerProtocolHandlers(
 		// peer arrives as `from`, so the handler can gate per-(peer, topic) before any expensive work. The
 		// full pipeline (rate limit → findServing → effectiveAt high-water → verify+apply, bounded
 		// refetch) lives in the exported `handleInboundNotice`; it logs and never throws on the stream.
-		node.handle(protocols.promote, makeOneWayHandler(async (frame, from): Promise<void> => {
+		registerProtocolHandler(node, protocols.promote, makeOneWayHandler(async (frame, from): Promise<void> => {
 			await handleInboundNotice(frame, peerIdToBytes(from), registry, verifier, promoteGate, Date.now(), maxBytes);
 		}, maxBytes)),
 
 		// membership: serve this node's latest published cert; cache any cert the requester returns.
-		node.handle(protocols.membership, makeRequestHandler(async (frame): Promise<Uint8Array> => {
+		registerProtocolHandler(node, protocols.membership, makeRequestHandler(async (frame): Promise<Uint8Array> => {
 			void frame; // request frame is the raw coord; this node serves its own cohort cert
 			const latest = publishSink.latest();
 			if (latest !== undefined) {
@@ -2856,7 +2857,7 @@ async function registerProtocolHandlers(
 		// sign: per-member endorsement for threshold-signature assembly. Validate the request, run the
 		// endorsement policy, and reply with this node's peer-key signature over the request payload (or a
 		// refusal). One Ed25519 sign and nothing more — the cohort + epoch gate bounds who we sign for.
-		node.handle(protocols.sign, makeRequestHandler(async (frame, from): Promise<Uint8Array> => {
+		registerProtocolHandler(node, protocols.sign, makeRequestHandler(async (frame, from): Promise<Uint8Array> => {
 			const request = validateSignRequestV1(decodeCohortMessage(frame, maxBytes));
 			const reply = await signEndorse(request, from.toString());
 			return encodeCohortMessage(reply, maxBytes);

package/src/cohort-topic/stream-util.ts

@@ -14,54 +14,23 @@
  * exactly one bounded frame per stream and then closes; if a caller ever writes repeatedly on one
  * stream, honor the flag by awaiting the stream's `'drain'` event the way FRET's `rpcRequest` does.
  *
- * {@link openStream} deliberately duplicates FRET's `rpc/protocols.ts#openRpcStream` connection
- * selection. FRET now exports `openRpcStream`, but the accepted tradeoff on
- * {@link STREAM_OPTIONS} is why the local copy stays: FRET's helper pins `negotiateFully: false`,
- * which this module deliberately does not set — swapping would silently reverse that decision.
- * Same applies to `libp2p-key-network.ts#connect`, which is a third copy.
+ * NOTE: accepted tradeoff — both calls to {@link openProtocolStream} below deliberately omit
+ * `negotiateFully`, taking libp2p's default of full multistream-select negotiation at stream-open.
+ * FRET's `openRpcStream` and `libp2p-key-network.ts#connect` both pass `negotiateFully: false`,
+ * which saves a round trip but defers an unsupported-protocol failure from stream-open to the
+ * first read — that would turn {@link sendOneWay} against a peer lacking the protocol into a
+ * silent no-op. Revisit if stream-open latency shows up in a profile.
  */
 
 import type { Libp2p } from "libp2p";
 import type { Connection, PeerId, Stream } from "@libp2p/interface";
 import { readFramed, sendFramed } from "p2p-fret";
+import { openProtocolStream } from "../network/open-protocol-stream.js";
+import { registerProtocolHandler } from "../network/register-protocol-handler.js";
 
 /** Default per-frame ceiling — matches FRET's 512 KiB maybe-act bound. */
 export const DEFAULT_STREAM_MAX_BYTES = 512 * 1024;
 
-/**
- * libp2p refuses to open a protocol stream over a *limited* (circuit-relay) connection unless the
- * caller opts in, so every peer reachable only through a relay — the steady state for browsers and
- * NATed peers — depends on this flag. It is a harmless no-op on a direct connection.
- *
- * NOTE: accepted tradeoff — FRET's `openRpcStream` and `libp2p-key-network.ts#connect` also set
- * `negotiateFully: false`; deliberately not set here. It saves a round trip but defers an
- * unsupported-protocol failure from stream-open to the first read, which would turn
- * {@link sendOneWay} against a peer lacking the protocol into a silent no-op. Revisit if
- * stream-open latency shows up in a profile.
- */
-const STREAM_OPTIONS = { runOnLimitedConnection: true } as const;
-
-/** True for a circuit-relay ("limited") connection: libp2p stamps one with per-circuit `limits`;
- * sniffing `/p2p-circuit` in the multiaddr covers transports that leave `limits` unpopulated. */
-function isLimitedConnection(c: Connection): boolean {
-	if ((c as { limits?: unknown }).limits != null) return true;
-	return c.remoteAddr?.toString?.().includes("/p2p-circuit") ?? false;
-}
-
-/**
- * Open `protocol` to `peer`, reusing a healthy existing connection when there is one.
- *
- * Skips connections libp2p has not yet evicted from its index but that are no longer open, and
- * prefers a direct connection over a relayed one — a relayed connection can be reset once the
- * relay's per-circuit cap or reservation lapses, and after DCUtR upgrades a link to direct both
- * briefly coexist. Falls back to the relayed connection when it is the only open path.
- */
-async function openStream(node: Libp2p, peer: PeerId, protocol: string): Promise<Stream> {
-	const open = node.getConnections(peer).filter(c => c?.status === "open" && typeof c?.newStream === "function");
-	const chosen = open.find(c => !isLimitedConnection(c)) ?? open[0];
-	return chosen ? await chosen.newStream([protocol], STREAM_OPTIONS) : await node.dialProtocol(peer, [protocol], STREAM_OPTIONS);
-}
-
 /**
  * Open `protocol` to `peer`, send `frame`, and read the bounded reply frame.
  *
@@ -69,7 +38,7 @@ async function openStream(node: Libp2p, peer: PeerId, protocol: string): Promise
  * `readFramed` self-times-out at 5s and `dialProtocol` falls back to libp2p's default dial
  * timeout (~30s) — so an unresponsive peer is slow, not hung. If a caller ever needs a tighter
  * deadline (`membership-source.fetch` walks candidate peers *sequentially*, so its worst case is
- * peers × dial-timeout), thread a signal through {@link openStream} the way
+ * peers × dial-timeout), pass one through {@link openProtocolStream}'s `signal` the way
  * `libp2p-key-network.ts#connect` does.
  */
 export async function requestResponse(
@@ -81,7 +50,8 @@ export async function requestResponse(
 ): Promise<Uint8Array> {
 	let stream: Stream | undefined;
 	try {
-		stream = await openStream(node, peer, protocol);
+		// `negotiateFully` deliberately omitted — see the accepted tradeoff in the module docblock.
+		stream = await openProtocolStream(node, peer, protocol);
 		sendFramed(stream, frame);
 		await stream.close();
 		return await readFramed(stream, maxBytes);
@@ -100,7 +70,8 @@ export async function requestResponse(
 export async function sendOneWay(node: Libp2p, peer: PeerId, protocol: string, frame: Uint8Array): Promise<void> {
 	let stream: Stream | undefined;
 	try {
-		stream = await openStream(node, peer, protocol);
+		// `negotiateFully` deliberately omitted — see the accepted tradeoff in the module docblock.
+		stream = await openProtocolStream(node, peer, protocol);
 		sendFramed(stream, frame);
 		await stream.close();
 	} finally {
@@ -128,7 +99,7 @@ export function handleRequestResponse(
 	handle: (frame: Uint8Array, from: PeerId) => Promise<Uint8Array | undefined>,
 	maxBytes = DEFAULT_STREAM_MAX_BYTES,
 ): void {
-	void node.handle(protocol, (stream: Stream, connection: Connection) => {
+	void registerProtocolHandler(node, protocol, (stream: Stream, connection: Connection) => {
 		void (async (): Promise<void> => {
 			try {
 				const frame = await readFramed(stream, maxBytes);

package/src/dispute/cascade.ts

@@ -40,13 +40,6 @@ export type CollectionEnv = {
 	readonly collectionId: CollectionId;
 	readonly log: Log<unknown>;
 	readonly createBlockStorage: (blockId: BlockId) => IBlockStorage;
-	/**
-	 * Optional per-block commit-latch runner threaded into each cascade child's {@link applyInvalidation}
-	 * so the child's compensating write serializes against a concurrent commit on the same block — the
-	 * same mutual-exclusion the root apply gets (see `InvalidationContext.withBlockCommitLatch`). Omitted
-	 * → child writes run unlatched (today's behavior).
-	 */
-	readonly withBlockCommitLatch?: <T>(blockId: BlockId, fn: () => Promise<T>) => Promise<T>;
 };
 
 // ─── Invalidated (blockId, revision) pairs ───
@@ -213,7 +206,13 @@ export type CascadeEscalation = {
 	readonly collections: ReadonlyArray<CollectionId>;
 	/** Read-dependents left un-cascaded at the horizon — surfaced, never silently dropped. */
 	readonly remainder: ReadonlyArray<CascadeStanding>;
-	/** Candidates that could not be re-evaluated (e.g. legacy entries with no engine to re-execute them). */
+	/**
+	 * Candidates whose fate could not be decided — a legacy entry with no persisted read set (no engine
+	 * to re-execute it), or one the cascade decided to invalidate but whose `applyInvalidation` did not
+	 * apply (a wholesale-refused compensating write, reason `stale-revision`; any other non-applied
+	 * reason lands here too), so the reversal did not happen and the dependent must not be dropped from
+	 * the frontier as if it were fine.
+	 */
 	readonly unevaluable: ReadonlyArray<CascadeStanding>;
 };
 
@@ -290,6 +289,18 @@ export async function cascadeInvalidate(input: CascadeInput): Promise<CascadeRes
 	const children: CascadeChild[] = [];
 	const affectedCollections = new Set<CollectionId>(input.seed.map(s => s.collectionId));
 	const unevaluable: CascadeStanding[] = [];
+	/**
+	 * Park a candidate whose fate the cascade could not decide, at most once. Both callers below mean
+	 * the same thing — this dependent is neither retained nor reverted, so it must not leave the
+	 * frontier as if it were fine — and both must mark its collection affected, or the `unevaluable`
+	 * escalation would not name the collection that needs the re-sync.
+	 */
+	const markUnevaluable = (cand: CascadeCandidate) => {
+		if (!unevaluable.some(u => u.collectionId === cand.collectionId && u.actionId === cand.actionId)) {
+			unevaluable.push(standing(cand));
+		}
+		affectedCollections.add(cand.collectionId);
+	};
 	let retained: CascadeStanding[] = [];
 	let rounds = 0;
 	let escalation: CascadeEscalation | undefined;
@@ -335,10 +346,7 @@ export async function cascadeInvalidate(input: CascadeInput): Promise<CascadeRes
 				continue;
 			}
 			if (verdict === 'unevaluable') {
-				if (!unevaluable.some(u => u.collectionId === cand.collectionId && u.actionId === cand.actionId)) {
-					unevaluable.push(standing(cand));
-				}
-				affectedCollections.add(cand.collectionId);
+				markUnevaluable(cand);
 				continue;
 			}
 
@@ -354,7 +362,7 @@ export async function cascadeInvalidate(input: CascadeInput): Promise<CascadeRes
 
 			const env = cand.env;
 			const result = await applyInvalidation(
-				{ log: env.log, createBlockStorage: env.createBlockStorage, withBlockCommitLatch: env.withBlockCommitLatch },
+				{ log: env.log, createBlockStorage: env.createBlockStorage },
 				{
 					invalidatedActionId: cand.actionId,
 					invalidatedRev: cand.rev,
@@ -370,9 +378,17 @@ export async function cascadeInvalidate(input: CascadeInput): Promise<CascadeRes
 			// exists (prior cascade run / restart). Treat it as invalidated and reuse its reverted blocks
 			// so the frontier still grows and the cascade reconverges without a second entry.
 			if (!result.applied && result.reason !== 'already-applied') {
-				// invalid-certificate should be impossible: the child verifies the root proof against the
-				// root's target (rootCertificateTarget), and the root proof is a valid challenger-wins cert.
+				// The child was decided-to-invalidate but the reversal did not happen, so we do NOT know
+				// whether this dependent still holds — it must not be dropped from the frontier as if it
+				// were fine. Deliberately keyed on "not applied", not on a specific reason, so a reason
+				// added later cannot re-open the silent-drop hole:
+				//  - `stale-revision` — the compensating write was refused wholesale (nothing written,
+				//    nothing appended). The reachable case.
+				//  - `invalid-certificate` — should be impossible here (the child verifies the ROOT proof
+				//    against the root's target, and that proof is a valid challenger-wins cert), but if it
+				//    ever fires, an undecided dependent is the honest report.
 				log('child-apply-rejected actionId=%s reason=%s', cand.actionId, result.reason);
+				markUnevaluable(cand);
 				continue;
 			}