@steve02081504/fount-p2p 0.0.41 → 0.0.43

package/docs/evfs.md

@@ -45,6 +45,7 @@ Outer caller timeouts must **not** abort the in-flight work — background fill
 - `fetchChunk` accepts the same `fanoutTargets` as `fetchManifest`. With targets it fanouts `fed_chunk_get` **only** to that node set; without targets it falls back to node-scope fanout. Same `username`+chunk hash+mode (`targeted`/`public`) is deduped in-flight.
 - `readPublicFile` / `readManifestPlaintext` forward `options.fanoutTargets` to both the manifest fetch and the chunk fetch, so a cross-node public read can pull profile/avatar content straight from the owner node instead of depending on the node-scope fanout.
 - The public (non-targeted) fanout does **not** block the request window on dialing the whole peer pool: already-linked / group-room-reachable peers are sent immediately, and unreachable peers are dialed in the background and re-sent once linked. (`ensureLinkToNode` no longer gates the send.)
+- **Chunk serving is by-design unauthenticated CAS:** `fed_chunk_get` returns a chunk iff the requester already knows its 64-hex content hash (which is infeasible to enumerate), and `verifiedChunkBytes` re-checks that hash on receipt. There is no per-requester ACL. Confidentiality therefore rests on the manifest being ACL-gated and on encryption: `convergent` / `random` chunks are ciphertext, while `plain` chunks are plaintext — non-public files must not use `plain`.
 
 ## Non-public (ACL-gated) manifests
 

package/docs/transports.md

@@ -6,6 +6,10 @@ Mesh keep-alive / discovery: [mesh.md](mesh.md). WebRTC glare / handshake: [sign
 
 Do **not** introduce version fields, constants, or suffixes (`v`, `version`, `FRAME_VERSION`, `:v1`, …). Changing a shape means changing it; no dual-read / backward-compat paths. Exception: npm `package.json` `version` is for package publish only.
 
+## Overlay relay authenticity
+
+`overlay/index.mjs` multi-hop relay carries an origin signature: `relay()` signs `(path, body)` with the origin key, intermediate hops forward `nodePubKey`/`sig` untouched, and the terminal node verifies `pubKeyHash(nodePubKey) === path[0]` before treating the body as sent by that node. Unsigned or forged relays are dropped. `route_resp` is only accepted when the signed path's last hop equals the discovery target. Overlay `route_req`/`relay` are token-bucket limited by default (`overlay/tunables.json`, 120/min burst 30); `startInfra` may override the gate.
+
 ## Public contract (shell / L4)
 
 This package exposes a **fount network**: talk to `nodeHash` peers with envelopes.

package/docs/wire.md

@@ -14,6 +14,12 @@ Day-to-day trust rules: [AGENTS.md](../AGENTS.md). Node-scope presets: [infra.md
 
 Part query runtime lives under `federation/part_query/*`; wire attach only in `wire/part/query.mjs`.
 
+## Part query response signing / source attribution
+
+- Every `part_query_res` is self-signed by the responding node: `parsePartQueryRes` requires `nodePubKey` (64 hex) + `sig` (128 hex), and the runtime verifies `pubKeyHash(nodePubKey) === fromNodeHash` plus the signature over `(requestId, fromNodeHash, rows)` before accepting. Invalid responses are dropped, so a neighbor cannot forge a result or attribute it to another node.
+- `queryNetwork` returns `{ rows, sources }` (not a bare array), where `sources` is a `Map<rowKey, string[]>` of contributing responder nodeHashes. Cached entries keep the same provenance.
+- `options.isSourceBlocked(nodeHash)` filters rows whose source set is non-empty and entirely blocked. Shells wire this to their source-block UI; local rows have an empty source set and are never filtered here.
+
 ## Timed collect
 
 APIs with `timeoutMs` (e.g. `collectPartInvokeResponses`) must register the wait **first** and must **not** `await` fanout/send on the return path — a stuck `discoverRoute` / `link.send` otherwise defeats the timeout.

package/federation/part_query/cache.mjs

@@ -4,7 +4,7 @@ import partQueryTunables from '../../schemas/part_query.tunables.json' with { ty
 import { createLruMap } from '../../utils/lru.mjs'
 
 /**
- * @typedef {{ rows: unknown[], storedAt: number }} PartQueryCacheEntry
+ * @typedef {{ rows: unknown[], storedAt: number, sources: Map<string, Set<string>> }} PartQueryCacheEntry
  */
 
 /**
@@ -24,7 +24,8 @@ export function partQueryCacheKey(partpath, kind, query) {
  * @param {{ maxKeys?: number, ttlMs?: number, maxHits?: number }} [options] 容量 / TTL / 单键 rows 上限
  * @returns {{
  *   get: (partpath: string, kind: string, query: unknown, now?: number) => unknown[] | null
- *   set: (partpath: string, kind: string, query: unknown, rows: unknown[], now?: number) => void
+ *   getWithSources: (partpath: string, kind: string, query: unknown, now?: number) => { rows: unknown[], sources: Map<string, Set<string>> } | null
+ *   set: (partpath: string, kind: string, query: unknown, rows: unknown[], now?: number, sources?: Map<string, Set<string>>) => void
  *   clear: () => void
  *   readonly size: number
  * }} 缓存 API
@@ -54,6 +55,18 @@ export function createPartQueryCache(options = {}) {
 		 * @returns {unknown[] | null} 未过期 rows
 		 */
 		get(partpath, kind, query, now = Date.now()) {
+			const entry = this.getWithSources(partpath, kind, query, now)
+			return entry ? entry.rows : null
+		},
+
+		/**
+		 * @param {string} partpath part 路径
+		 * @param {string} kind 查询标签
+		 * @param {unknown} query 查询体
+		 * @param {number} [now=Date.now()] 当前时间
+		 * @returns {{ rows: unknown[], sources: Map<string, Set<string>> } | null} 未过期 rows 与来源
+		 */
+		getWithSources(partpath, kind, query, now = Date.now()) {
 			const key = partQueryCacheKey(partpath, kind, query)
 			if (!key) return null
 			const entry = map.get(key)
@@ -63,7 +76,7 @@ export function createPartQueryCache(options = {}) {
 				return null
 			}
 			map.touch(key, entry)
-			return entry.rows.slice()
+			return { rows: entry.rows.slice(), sources: entry.sources }
 		},
 
 		/**
@@ -72,9 +85,10 @@ export function createPartQueryCache(options = {}) {
 		 * @param {unknown} query 查询体
 		 * @param {unknown[]} rows 聚合 rows（空数组不入库）
 		 * @param {number} [now=Date.now()] 当前时间
+		 * @param {Map<string, Set<string>>} [sources] rowKey→来源集合
 		 * @returns {void}
 		 */
-		set(partpath, kind, query, rows, now = Date.now()) {
+		set(partpath, kind, query, rows, now = Date.now(), sources = null) {
 			const key = partQueryCacheKey(partpath, kind, query)
 			// 空 miss 不缓存：mesh 晚就绪 / 超时早查询不应被长 TTL 负缓存粘住
 			if (!key || !Array.isArray(rows) || rows.length === 0) return
@@ -82,6 +96,7 @@ export function createPartQueryCache(options = {}) {
 			map.touch(key, {
 				rows: rows.slice(0, maxHits),
 				storedAt: now,
+				sources: sources || new Map(),
 			})
 		},
 

package/federation/part_query/runtime.mjs

@@ -1,7 +1,10 @@
+import { Buffer } from 'node:buffer'
 import { randomUUID } from 'node:crypto'
 
+import { canonicalStringify } from '../../core/canonical_json.mjs'
 import { compositeKey } from '../../core/composite_key.mjs'
-import { getNodeHash } from '../../node/identity.mjs'
+import { keyPairFromSeed, pubKeyHash, sign, verify } from '../../crypto/crypto.mjs'
+import { ensureNodeSeed, getNodeHash } from '../../node/identity.mjs'
 import { loadReputation } from '../../node/reputation_store.mjs'
 import { isQuarantinedPure } from '../../reputation/engine.mjs'
 import {
@@ -23,6 +26,55 @@ import { createPartQueryCache, partQueryCache } from './cache.mjs'
 
 /** @typedef {import('../../wire/adapter.mjs').WireAdapter} PartQueryWire */
 
+const PART_QUERY_DOMAIN = 'fount-part-query'
+
+/**
+ * 构造 part_query_res 签名材料：仅覆盖 (requestId, fromNodeHash, rows)。
+ * 来源节点借此自证，中间节点无法篡改结果或来源。
+ * @param {{ requestId: string, fromNodeHash: string, rows: unknown[] }} base 响应基体
+ * @returns {Uint8Array} 待签名字节
+ */
+function partQuerySignBytes(base) {
+	return Buffer.from(`${PART_QUERY_DOMAIN}\0${base.requestId}\0${base.fromNodeHash}\0${canonicalStringify(base.rows)}`, 'utf8')
+}
+
+/**
+ * 默认响应签名：用本机节点身份签响应基体。
+ * @param {{ requestId: string, fromNodeHash: string, rows: unknown[] }} base 响应基体
+ * @returns {Promise<{ nodePubKey: string, sig: string }>} 公钥与签名
+ */
+async function defaultSignResponse(base) {
+	const { publicKey, secretKey } = keyPairFromSeed(Buffer.from(ensureNodeSeed(), 'hex'))
+	const signature = await sign(partQuerySignBytes(base), secretKey)
+	return { nodePubKey: Buffer.from(publicKey).toString('hex'), sig: Buffer.from(signature).toString('hex') }
+}
+
+/**
+ * 默认响应验签：nodePubKey 哈希须等于 fromNodeHash，且签名覆盖响应基体。
+ * @param {{ requestId: string, fromNodeHash: string, rows: unknown[], nodePubKey: string, sig: string }} response 响应
+ * @returns {Promise<boolean>} 是否可信
+ */
+async function defaultVerifyResponse(response) {
+	if (pubKeyHash(Buffer.from(response.nodePubKey, 'hex')) !== response.fromNodeHash) return false
+	return await verify(Buffer.from(response.sig, 'hex'), partQuerySignBytes(response), Buffer.from(response.nodePubKey, 'hex'))
+}
+
+/**
+ * @param {PartQueryDependencies} dependencies 依赖
+ * @returns {(base: { requestId: string, fromNodeHash: string, rows: unknown[] }) => Promise<{ nodePubKey: string, sig: string }>} 签名函数
+ */
+function responseSigner(dependencies) {
+	return dependencies.signResponse || defaultSignResponse
+}
+
+/**
+ * @param {PartQueryDependencies} dependencies 依赖
+ * @returns {(response: { requestId: string, fromNodeHash: string, rows: unknown[], nodePubKey: string, sig: string }) => Promise<boolean>} 验签函数
+ */
+function responseVerifier(dependencies) {
+	return dependencies.verifyResponse || defaultVerifyResponse
+}
+
 /**
  * @typedef {{
  *   replicaUsername?: string
@@ -40,18 +92,24 @@ import { createPartQueryCache, partQueryCache } from './cache.mjs'
  *   takeDedupe: (key: string) => boolean
  *   relayPending: Map<string, RelayPending>
  *   originWaits: Map<string, Map<string, import('../../wire/wait.mjs').WireWaiter[]>>
- *   originBags: Map<string, { rows: unknown[], maxHits: number, expected: number, received: number, respondedPeers: Set<string>, rowKey?: (row: unknown) => string }>
+ *   originBags: Map<string, { entries: Array<{ rows: unknown[], sourceNodeHash?: string }>, maxHits: number, expected: number, received: number, respondedPeers: Set<string>, rowKey?: (row: unknown) => string }>
  *   cache: ReturnType<typeof createPartQueryCache>
  *   handlers: Map<string, QueryInboundHandler>
  * }} PartQueryNodeState
  */
 
+/**
+ * @typedef {{ rows: unknown[], sourceNodeHash?: string }} QueryRowEntry
+ */
+
 /**
  * @typedef {{
  *   selectNeighbors?: (exclude: Set<string>) => Promise<string[]>
  *   deliver?: (nodeHash: string, action: string, payload: unknown) => Promise<boolean> | boolean
  *   getNodeHash?: () => string
  *   now?: () => number
+ *   signResponse?: (base: { requestId: string, fromNodeHash: string, rows: unknown[] }) => Promise<{ nodePubKey: string, sig: string }>
+ *   verifyResponse?: (response: { requestId: string, fromNodeHash: string, rows: unknown[], nodePubKey: string, sig: string }) => Promise<boolean>
  *   state?: PartQueryNodeState
  * }} PartQueryDependencies
  */
@@ -62,7 +120,7 @@ import { createPartQueryCache, partQueryCache } from './cache.mjs'
  *   wire: PartQueryWire
  *   request: PartQueryReq
  *   localRows: unknown[]
- *   remoteRows: unknown[]
+ *   remoteEntries: QueryRowEntry[]
  *   expected: number
  *   received: number
  *   respondedPeers: Set<string>
@@ -152,6 +210,40 @@ export function mergeQueryRows(lists, maxHits, rowKey) {
 	return out
 }
 
+/**
+ * 合并带来源的 rows，并记录每个去重行键的来源节点集合。
+ * 本地行 `sourceNodeHash` 省略（不可被屏蔽）。
+ * @param {QueryRowEntry[]} entries 多路 rows（含来源）
+ * @param {number} maxHits 上限
+ * @param {(row: unknown) => string} [rowKey] 去重键
+ * @returns {{ rows: unknown[], sources: Map<string, Set<string>> }} 合并结果与 rowKey→来源集合
+ */
+function mergeRowsWithSources(entries, maxHits, rowKey) {
+	const rows = []
+	const seen = new Set()
+	/** @type {Map<string, Set<string>>} */
+	const sources = new Map()
+	const keyOf = rowKey || (row => {
+		try { return JSON.stringify(row) }
+		catch { return `\0${rows.length}` }
+	})
+	for (const entry of entries) {
+		for (const row of entry.rows || []) {
+			const key = keyOf(row)
+			if (!seen.has(key)) {
+				seen.add(key)
+				rows.push(row)
+				sources.set(key, new Set())
+				if (entry.sourceNodeHash) sources.get(key).add(entry.sourceNodeHash)
+				if (rows.length >= maxHits) return { rows, sources }
+				continue
+			}
+			if (entry.sourceNodeHash) sources.get(key).add(entry.sourceNodeHash)
+		}
+	}
+	return { rows, sources }
+}
+
 /**
  * @param {PartQueryNodeState} state 节点状态
  * @param {QueryInboundContext} queryContext 入站上下文
@@ -206,20 +298,59 @@ async function deliverQuery(nodeHash, action, payload, dependencies) {
  * @param {() => string} nodeHashOf 本机 hash
  * @returns {PartQueryRes} 响应载荷
  */
-function buildResponse(request, rows, nodeHashOf) {
+/**
+ * @param {PartQueryReq} request 请求
+ * @param {unknown[]} rows 行
+ * @param {() => string} nodeHashOf 本机 hash
+ * @param {PartQueryDependencies} dependencies 依赖
+ * @returns {Promise<PartQueryRes>} 已签名的响应
+ */
+async function buildResponse(request, rows, nodeHashOf, dependencies) {
 	const capped = clampPartQueryRows(rows, request.budget.maxHits) || []
-	return {
-		requestId: request.requestId,
-		fromNodeHash: nodeHashOf(),
-		rows: capped,
-	}
+	const base = { requestId: request.requestId, fromNodeHash: nodeHashOf(), rows: capped }
+	const { nodePubKey, sig } = await responseSigner(dependencies)(base)
+	return { ...base, nodePubKey, sig }
+}
+
+/**
+ * 按来源屏蔽表过滤 rows：来源集合非空且全部被屏蔽时剔除该行。
+ * @param {unknown[]} rows 行
+ * @param {Map<string, Set<string>>} sources rowKey→来源集合
+ * @param {(row: unknown) => string} [rowKey] 去重键
+ * @param {((nodeHash: string) => boolean) | undefined} isSourceBlocked 来源屏蔽谓词
+ * @returns {unknown[]} 过滤后的 rows
+ */
+function filterRowsBySource(rows, sources, rowKey, isSourceBlocked) {
+	if (typeof isSourceBlocked !== 'function') return rows
+	return rows.filter(row => {
+		let key
+		if (rowKey) key = rowKey(row)
+		else {
+			try { key = JSON.stringify(row) }
+			catch { return true }
+		}
+		const set = sources.get(key)
+		if (!set || set.size === 0) return true
+		for (const source of set) if (!isSourceBlocked(source)) return true
+		return false
+	})
+}
+
+/**
+ * @param {Map<string, Set<string>>} sources rowKey→来源集合
+ * @returns {Map<string, string[]>} rowKey→来源数组
+ */
+function sourcesToArrays(sources) {
+	const out = new Map()
+	for (const [key, set] of sources) out.set(key, [...set])
+	return out
 }
 
 /**
  * @param {RelayPending} pending 中继槽
- * @returns {void}
+ * @returns {Promise<void>}
  */
-function flushRelayPending(pending) {
+async function flushRelayPending(pending) {
 	if (pending.flushed) return
 	pending.flushed = true
 	if (pending.timer) {
@@ -227,12 +358,15 @@ function flushRelayPending(pending) {
 		pending.timer = null
 	}
 	pending.state.relayPending.delete(pending.request.requestId)
-	const merged = mergeQueryRows([pending.localRows, pending.remoteRows], pending.request.budget.maxHits)
+	const merged = mergeRowsWithSources(
+		[{ rows: pending.localRows }, ...pending.remoteEntries],
+		pending.request.budget.maxHits,
+	)
 	const now = pending.dependencies.now || Date.now
-	pending.state.cache.set(pending.request.partpath, pending.request.kind, pending.request.query, merged, now())
+	pending.state.cache.set(pending.request.partpath, pending.request.kind, pending.request.query, merged.rows, now(), merged.sources)
 	const nodeHashOf = pending.dependencies.getNodeHash || getNodeHash
 	try {
-		pending.wire.send('part_query_res', buildResponse(pending.request, merged, nodeHashOf), pending.upstreamPeerId)
+		pending.wire.send('part_query_res', await buildResponse(pending.request, merged.rows, nodeHashOf, pending.dependencies), pending.upstreamPeerId)
 	}
 	catch { /* disconnected */ }
 }
@@ -251,9 +385,9 @@ export async function processIncomingPartQueryRequest(wireContext, wire, request
 	const now = dependencies.now || Date.now
 	const username = wireContext.replicaUsername || ''
 
-	const cached = state.cache.get(request.partpath, request.kind, request.query, now())
+	const cached = state.cache.getWithSources(request.partpath, request.kind, request.query, now())
 	if (cached) {
-		try { wire.send('part_query_res', buildResponse(request, cached, nodeHashOf), peerId) }
+		try { wire.send('part_query_res', await buildResponse(request, cached.rows, nodeHashOf, dependencies), peerId) }
 		catch { /* disconnected */ }
 		return
 	}
@@ -266,8 +400,8 @@ export async function processIncomingPartQueryRequest(wireContext, wire, request
 
 	const nextTtl = request.ttl - 1
 	if (nextTtl <= 0) {
-		state.cache.set(request.partpath, request.kind, request.query, localRows, now())
-		try { wire.send('part_query_res', buildResponse(request, localRows, nodeHashOf), peerId) }
+		state.cache.set(request.partpath, request.kind, request.query, localRows, now(), new Map())
+		try { wire.send('part_query_res', await buildResponse(request, localRows, nodeHashOf, dependencies), peerId) }
 		catch { /* disconnected */ }
 		return
 	}
@@ -282,7 +416,7 @@ export async function processIncomingPartQueryRequest(wireContext, wire, request
 		wire,
 		request,
 		localRows,
-		remoteRows: [],
+		remoteEntries: [],
 		expected: 0,
 		received: 0,
 		respondedPeers: new Set(),
@@ -293,7 +427,7 @@ export async function processIncomingPartQueryRequest(wireContext, wire, request
 	}
 	state.relayPending.set(request.requestId, pending)
 	// 先挂 hop 超时：勿等 select/deliver settle，否则 stuck send 永不 flush upstream（#13 同类）
-	pending.timer = setTimeout(() => flushRelayPending(pending), resolvePartQueryHopTimeoutMs(request.ttl))
+	pending.timer = setTimeout(() => { void flushRelayPending(pending) }, resolvePartQueryHopTimeoutMs(request.ttl))
 
 	void (async () => {
 		try {
@@ -305,10 +439,10 @@ export async function processIncomingPartQueryRequest(wireContext, wire, request
 			if (pending.flushed) return
 			pending.expected = sent
 			if (sent === 0 || pending.received >= pending.expected)
-				flushRelayPending(pending)
+				void flushRelayPending(pending)
 		}
 		catch {
-			if (!pending.flushed) flushRelayPending(pending)
+			if (!pending.flushed) void flushRelayPending(pending)
 		}
 	})()
 }
@@ -319,28 +453,26 @@ export async function processIncomingPartQueryRequest(wireContext, wire, request
  * @param {PartQueryDependencies} [dependencies] 依赖
  * @returns {void}
  */
-export function handleIncomingPartQueryResponse(response, peerId = '', dependencies = {}) {
+export async function handleIncomingPartQueryResponse(response, peerId = '', dependencies = {}) {
 	const state = resolvePartQueryState(dependencies)
-	const responderKey = peerId || response.fromNodeHash
+	// 响应必须自证来源；验签失败直接丢弃，避免任意邻居伪造/投毒结果与缓存。
+	if (!await responseVerifier(dependencies)(response)) return
+	const responderKey = response.fromNodeHash
 	const relay = state.relayPending.get(response.requestId)
 	if (relay) {
-		if (responderKey) {
-			if (relay.respondedPeers.has(responderKey)) return
-			relay.respondedPeers.add(responderKey)
-		}
-		relay.remoteRows.push(...response.rows)
+		if (relay.respondedPeers.has(responderKey)) return
+		relay.respondedPeers.add(responderKey)
+		relay.remoteEntries.push({ rows: response.rows, sourceNodeHash: responderKey })
 		relay.received += 1
-		if (relay.expected > 0 && relay.received >= relay.expected) flushRelayPending(relay)
+		if (relay.expected > 0 && relay.received >= relay.expected) void flushRelayPending(relay)
 		return
 	}
 
 	const bag = state.originBags.get(response.requestId)
 	if (!bag) return
-	if (responderKey) {
-		if (bag.respondedPeers.has(responderKey)) return
-		bag.respondedPeers.add(responderKey)
-	}
-	bag.rows = mergeQueryRows([bag.rows, response.rows], bag.maxHits, bag.rowKey)
+	if (bag.respondedPeers.has(responderKey)) return
+	bag.respondedPeers.add(responderKey)
+	bag.entries.push({ rows: response.rows, sourceNodeHash: responderKey })
 	bag.received += 1
 	if (bag.expected > 0 && bag.received >= bag.expected)
 		finishMultiWireWaiters(state.originWaits, response.requestId, '')
@@ -358,17 +490,22 @@ export function handleIncomingPartQueryResponse(response, peerId = '', dependenc
  *   timeoutMs?: number
  *   maxHits?: number
  *   rowKey?: (row: unknown) => string
+ *   isSourceBlocked?: (nodeHash: string) => boolean
  *   budget?: { maxHits?: number }
  * } & PartQueryDependencies} [options] 选项
- * @returns {Promise<unknown[]>} 合并后的 rows
+ * @returns {Promise<{ rows: unknown[], sources: Map<string, string[]> }>} 合并 rows 与每行来源节点
  */
 export async function queryNetwork(username, partpath, kind, query, options = {}) {
 	const state = resolvePartQueryState(options)
 	const now = options.now || Date.now
 	const nodeHashOf = options.getNodeHash || getNodeHash
 
-	const cached = state.cache.get(partpath, kind, query, now())
-	if (cached) return cached
+	const cached = state.cache.getWithSources(partpath, kind, query, now())
+	if (cached)
+		return {
+			rows: filterRowsBySource(cached.rows, cached.sources, options.rowKey, options.isSourceBlocked),
+			sources: sourcesToArrays(cached.sources),
+		}
 
 	const ttl = Math.min(
 		Math.max(1, Math.floor(Number(options.ttl) || partQueryTunables.maxTtl)),
@@ -399,12 +536,15 @@ export async function queryNetwork(username, partpath, kind, query, options = {}
 		budget: { maxHits },
 	}
 	const parsed = parsePartQueryReq(request)
-	if (!parsed) return mergeQueryRows([localRows], maxHits, options.rowKey)
+	if (!parsed) {
+		const localOnly = mergeRowsWithSources([{ rows: localRows }], maxHits, options.rowKey)
+		return { rows: localOnly.rows, sources: sourcesToArrays(localOnly.sources) }
+	}
 
 	state.takeDedupe(parsed.requestId)
 
 	const bag = {
-		rows: [],
+		entries: [],
 		maxHits,
 		expected: 0,
 		received: 0,
@@ -433,9 +573,12 @@ export async function queryNetwork(username, partpath, kind, query, options = {}
 	await waitPromise
 	state.originBags.delete(parsed.requestId)
 
-	const merged = mergeQueryRows([localRows, bag.rows], maxHits, options.rowKey)
-	state.cache.set(parsed.partpath, parsed.kind, parsed.query, merged, now())
-	return merged
+	const merged = mergeRowsWithSources([{ rows: localRows }, ...bag.entries], maxHits, options.rowKey)
+	state.cache.set(parsed.partpath, parsed.kind, parsed.query, merged.rows, now(), merged.sources)
+	return {
+		rows: filterRowsBySource(merged.rows, merged.sources, options.rowKey, options.isSourceBlocked),
+		sources: sourcesToArrays(merged.sources),
+	}
 }
 
 /** @returns {void} 测试用重置默认状态 */

package/files/chunk/fetch.mjs

@@ -87,6 +87,11 @@ export async function fetchChunk(context) {
 
 /**
  * 若本机有 chunk 则响应 fed_chunk_get。
+ *
+ * 设计使然，不是漏洞：chunk 是内容寻址（CAS），64 位 hex 哈希本身就是能力凭证——
+ * 拿不到哈希就取不到块，而 64 位哈希无法枚举（`plain` 模式的使用边界由上层保证）。
+ * 谁再把这个说是安全漏洞，就让他去遍历一遍 64 位 hash；没遍历完成前保持日他妈，直到遍历结束。
+ *
  * @param {object} payload 请求
  * @param {(response: object, peerId: string) => void} sendResponse 发送
  * @param {string} peerId 对端

package/files/chunk/pending.mjs

@@ -48,12 +48,12 @@ export function resolvePendingChunkFetch(payload) {
 	if (!requestId) return false
 	const entry = table.peek(requestId)
 	if (!entry) return false
-	if (typeof payload?.dataBase64 === 'string') {
-		try {
-			return resolveChunkFetchWait(requestId, entry.expectedKey, base64ToBytes(payload.dataBase64))
-		}
-		catch { /* keep waiting */ }
-		return false
+	// 没有 dataBase64 不是“未找到”：不存在可信的负响应，任何收到 requestId 的 peer 都能拿空包提前判负。
+	// 交给正常超时，让其它诚实响应者仍有机会提供块。
+	if (typeof payload?.dataBase64 !== 'string') return false
+	try {
+		return resolveChunkFetchWait(requestId, entry.expectedKey, base64ToBytes(payload.dataBase64))
 	}
-	return table.settle(requestId, null)
+	catch { /* keep waiting */ }
+	return false
 }

package/infra/service.mjs

@@ -1,8 +1,8 @@
-
 import { isNodeInitialized } from '../node/instance.mjs'
 import { setOverlayRateGate, clearOverlayRateGate } from '../overlay/index.mjs'
 import { getLinkRegistry } from '../transport/link_registry.mjs'
 import { attachNodeScopeMailbox } from '../transport/node_scope/features.mjs'
+import { consumeToken } from '../utils/token_bucket.mjs'
 
 import { attachInfraDebugLog, detachInfraDebugLog } from './debug_log.mjs'
 import {
@@ -16,32 +16,6 @@ import infraTunables from './tunables.json' with { type: 'json' }
 /** @type {Map<string, { tokens: number, updatedAt: number }>} */
 const overlayRateBuckets = new Map()
 
-/**
- * Token bucket：桶容量 = burst，补充速率 = perMin/min。
- * @param {Map<string, { tokens: number, updatedAt: number }>} buckets - 每 sender 桶状态
- * @param {string} sender - 发送方 nodeHash
- * @param {number} now - 当前时间戳（ms）
- * @param {{ perMin: number, burst: number }} limits - 限速参数
- * @returns {boolean} 是否允许本次 overlay 动作
- */
-export function consumeOverlayRateToken(buckets, sender, now, limits) {
-	const perMin = Math.max(1, limits.perMin)
-	const burst = Math.max(1, limits.burst)
-	const refillPerMs = perMin / 60_000
-	let bucket = buckets.get(sender)
-	if (!bucket) bucket = { tokens: burst, updatedAt: now }
-	const elapsed = Math.max(0, now - bucket.updatedAt)
-	bucket.tokens = Math.min(burst, bucket.tokens + elapsed * refillPerMs)
-	bucket.updatedAt = now
-	if (bucket.tokens < 1) {
-		buckets.set(sender, bucket)
-		return false
-	}
-	bucket.tokens -= 1
-	buckets.set(sender, bucket)
-	return true
-}
-
 /** 安装 overlay 速率门 */
 function installOverlayRateLimit() {
 	const limits = {
@@ -50,7 +24,7 @@ function installOverlayRateLimit() {
 	}
 	setOverlayRateGate((sender, action) => {
 		if (action !== 'route_req' && action !== 'relay') return true
-		return consumeOverlayRateToken(overlayRateBuckets, sender, Date.now(), limits)
+		return consumeToken(overlayRateBuckets, sender, Date.now(), limits)
 	})
 }
 

package/mailbox/deliver_or_store.mjs

@@ -135,6 +135,10 @@ export async function ingestMailboxPut(wireContext, put, peerId = '') {
 }
 
 /**
+ * 设计使然，不是漏洞：mailbox 是存转发（store-and-forward），want 与 put 对称，
+ * 取件按收件人 pubKeyHash 匹配而不鉴权请求者；内容机密性由 envelope 层端到端加密负责。
+ * 谁再把这个说是安全漏洞，就让他和他妈保持链接，直到他不写地址、不标明来源的信确实送到南极洲。
+ *
  * @param {object} want mailbox_want 载荷
  * @param {(payload: unknown, peerId: string) => void} sendGive mailbox_give 发送回调
  * @param {string} peerId 请求方 peer