@steve02081504/fount-p2p 0.0.48 → 0.0.50

package/AGENTS.md

@@ -54,6 +54,7 @@ Deno / native / BT: [runtime.md](docs/runtime.md).
 - Assertions: `test/helpers/assert.mjs`
 - Fixed-seed identity: `test/helpers/identity.mjs`
 - Mock discovery: `test/helpers/mock_discovery.mjs`
+- Transport fakes must mirror the backend's failure signalling: a fake `RTCPeerConnection` whose `close()` stays silent (no `connectionstatechange`) hides re-entrancy bugs where a replaced connection closes the live one (fount-p2p#39, `link/providers/webrtc.mjs`).
 
 ## Static checks (`scripts/checks/`, ported from fount's check standard)
 

package/discovery/nostr/relays.mjs

@@ -103,7 +103,7 @@ let discoveryEnabled = true
 
 /**
  * 规范化 Nostr relay URL（唯一入站入口）。
- * - 仅允许 wss://；`ws://` 仅限回环/私有地址（本地测试/开发）。
+ * - `wss://` 不限地址；`ws://` 只接受本机回环（`localhost` / `::1` / `127.x`），私网与公网一律拒绝。
  * - hostname 小写，去除默认端口，去除尾部斜杠，保留非空 path。
  * @param {unknown} raw 原始 URL
  * @returns {string | null} 规范化字符串，无效返回 null
@@ -250,7 +250,8 @@ function currentTrustedRelayUrls() {
 
 /**
  * 判定该 relay 是否允许作为连接目的地（probe/发布/订阅）。
- * 本机显式配置或 NIP-66 引导集保留信任例外；其余须为公网 hostname 且 DNS 全部解析为公网地址。
+ * 受信 relay（本机显式配置、提供方注册、NIP-66 引导集、pinned，见 [currentTrustedRelayUrls]）不受公网限制；
+ * 其余须为公网 hostname 且 DNS 全部解析为公网地址。
  * @param {string} relayUrl 规范化 relay URL
  * @returns {Promise<boolean>} 允许连接为 true
  */
@@ -261,20 +262,32 @@ export async function isRelayDestinationAllowed(relayUrl) {
 	return relayUrlResolvesPublic(relayUrl)
 }
 
+/**
+ * 最近一次尝试是否失败。时间戳与 lastSuccess 打平按失败算（同一毫秒内的并发尝试里，成功者会记下更晚的时间戳）。
+ * @param {number} lastFailure 最近一次失败时间戳
+ * @param {number} lastSuccess 最近一次成功时间戳
+ * @returns {boolean} 最近一次尝试失败为 true
+ */
+function latestAttemptFailed(lastFailure, lastSuccess) {
+	return lastFailure >= lastSuccess
+}
+
 /**
  * 计算 relay 健康分（越低越优）。
+ * 最近一次尝试失败（或从未成功过）时 RTT 与失败率都取最差值，分数必定高于任何活着的 relay。
  * @param {Partial<RelayPoolEntry>} entry 条目
  * @returns {number} 健康分
  */
 export function computeRelayHealth(entry) {
-	const { rttMs, successCount, failureCount, lastProbe } = entry
-	const total = (successCount || 0) + (failureCount || 0)
-	const failureRate = total > 0 ? (failureCount || 0) / total : 0
-	let rtt = rttMs !== undefined && rttMs !== null ? Number(rttMs) : DEFAULT_RTT_MS
-	if (!Number.isFinite(rtt)) rtt = DEFAULT_RTT_MS
-	rtt = Math.max(1, Math.min(MAX_RTT_MS, rtt))
+	const { rttMs, successCount = 0, failureCount = 0, lastProbe = 0, lastSuccess = 0, lastFailure = 0 } = entry
+	const failed = failureCount > 0 && (!successCount || latestAttemptFailed(lastFailure, lastSuccess))
+	const total = successCount + failureCount
+	const failureRate = failed ? 1 : total > 0 ? failureCount / total : 0
+	// 失败的 relay 最后一次测量已被作废：没有可信 RTT 可依，按上限算。
+	const measuredRtt = failed ? MAX_RTT_MS : rttMs
+	const rtt = Math.max(1, Math.min(MAX_RTT_MS, Number.isFinite(measuredRtt) && measuredRtt > 0 ? measuredRtt : DEFAULT_RTT_MS))
 	let score = rtt * (1 + failureRate * FAILURE_WEIGHT)
-	if (Date.now() - (lastProbe || 0) > PROBE_STALE_MS) score *= STALE_PENALTY
+	if (Date.now() - lastProbe > PROBE_STALE_MS) score *= STALE_PENALTY
 	return score
 }
 
@@ -512,7 +525,7 @@ export function recordProbeSuccess(url, rttMs) {
 	const entry = ensureEntry(normalized)
 	if (rttMs != null && Number.isFinite(Number(rttMs))) entry.rttMs = Math.max(0, Math.min(MAX_RTT_MS, Math.round(Number(rttMs))))
 	entry.successCount++
-	entry.lastSuccess = entry.lastProbe = entry.lastSeen = Date.now()
+	entry.lastSuccess = entry.lastProbe = entry.lastSeen = Math.max(Date.now(), entry.lastProbe + 1)
 	markDirty()
 }
 
@@ -525,7 +538,8 @@ export function recordProbeFailure(url) {
 	if (!normalized) return
 	const entry = ensureEntry(normalized)
 	entry.failureCount++
-	entry.lastFailure = entry.lastProbe = entry.lastSeen = Date.now()
+	entry.rttMs = null
+	entry.lastFailure = entry.lastProbe = entry.lastSeen = Math.max(Date.now(), entry.lastProbe + 1)
 	markDirty()
 }
 
@@ -583,17 +597,23 @@ export function clearStale() {
 }
 
 /**
- * @returns {RelayPoolEntry[]} 工作集（健康分升序，含全部 pinned）
+ * @returns {RelayPoolEntry[]} 工作集（保留未探测引导项，排除失败或过期项，优先 pinned）
  */
 export function getWorkingRelays() {
-	const sorted = sortByHealth([...poolEntries.values()])
+	const now = Date.now()
+	// 合格项：最近一次尝试成功且没过期，或压根还没探测过的引导项。
+	const eligible = [...poolEntries.values()].filter(entry =>
+		entry.successCount === 0
+			? entry.lastFailure === 0
+			: !latestAttemptFailed(entry.lastFailure, entry.lastSuccess) && now - entry.lastSuccess <= PROBE_STALE_MS)
+	const sorted = sortByHealth(eligible)
 	const pinned = sorted.filter(isPinned)
 	const rest = sorted.filter(entry => !isPinned(entry))
 	return dedupeByUrl([...pinned, ...rest.slice(0, Math.max(0, WORKING_RELAYS_COUNT - pinned.length))])
 }
 
 /**
- * @returns {RelayPoolEntry[]} 监听/发布子集（含全部 public/manual）
+ * @returns {RelayPoolEntry[]} 监听/发布子集（仅含工作集内 public/manual）
  */
 export function getListenRelays() {
 	const working = getWorkingRelays()

package/discovery/nostr/selection.mjs

@@ -12,7 +12,6 @@ import {
 import {
 	computeRelayHealth,
 	getPeerRoute,
-	getPinnedRelays,
 	getPoolByUrl,
 	getWorkingRelays,
 	recordPublishResult,
@@ -116,7 +115,7 @@ export function expandFromHistory(nodeHash, base, limit) {
 
 /**
  * 计算到指定节点的当前轮路由目标集。
- * Round 0：对端声称前4（无则本机工作集前4，再空则 pinned）。
+ * Round 0：对端声称前4（无则本机工作集前4）。
  * Round ≥1：历史成功 + 对端综合分补足 + 加权采样，附退避；总扇出封顶。
  * @param {string} nodeHash 目标节点
  * @param {number} attempt 当前尝试轮次（0 起）
@@ -139,7 +138,6 @@ export function handshakeTargets(nodeHash, attempt) {
 			for (const entry of working.slice(0, ROUND0_TARGET_COUNT)) push(entry.url)
 			return
 		}
-		for (const url of getPinnedRelays().slice(0, ROUND0_TARGET_COUNT)) push(url)
 	}
 	if (attempt <= 0) {
 		round0()

package/docs/nostr_relay_discovery.md

@@ -16,8 +16,10 @@ Source layout (`discovery/nostr/`):
 
 `relayPool` (all known) → `workingRelays` (top-`WORKING_RELAYS_COUNT` by health) → `listenRelays` (top-`LISTEN_RELAYS_COUNT` working subset used for publish/listen).
 
-- `public`/`manual` entries are **pinned**: always in `working`/`listen` and never evicted by `clearStale` or pool-cap. Pin count may exceed the nominal caps.
+- `public`/`manual` entries are **pinned**: preferred in `working`/`listen` when eligible and never evicted by `clearStale` or pool-cap. Failed or stale pins remain in the pool for retry, but leave the working/listen sets. Pin count may exceed the nominal caps.
 - `nip66`/`peer` entries are disposable: evicted when stale (`PROBE_STALE_MS`) or when the pool exceeds `POOL_CAP`.
+- A relay leaves the working/listen sets when it is **not eligible**: never probed but already failed, or its latest attempt failed, or its last success is older than `PROBE_STALE_MS`. Untested bootstrap entries stay eligible; exclusion never evicts from the pool, so dead relays keep getting retried.
+- Configured `relayUrls` override the automatic listen subset; adverts publish this resolved subscription set as `listenNostrRelays`.
 - Fresh nodes are seeded with `DEFAULT_RELAY_URLS` (`source: 'public'`) so `listenRelays` is never empty at cold start.
 - Persistent connections stay bounded by `workingRelays` (`WORKING_RELAYS_COUNT`, max 32); pins influence selection, not simultaneous connections.
 
@@ -25,20 +27,22 @@ Source layout (`discovery/nostr/`):
 
 `normalizeNostrRelayUrl` (in `relays.mjs`) is the only entry for every inbound URL (NIP-66 `d` tag, manual config, peer advert):
 
-- `wss://` always; `ws://` only for loopback/private hosts (local dev/tests).
+- `wss://` to any host; `ws://` to loopback only (`localhost` / `::1` / `127.x` — local dev/tests). Private and public `ws://` are rejected outright.
+- `isRelayDestinationAllowed` then gates dialling: a **trusted** relay (local config, provider registration, the NIP-66 bootstrap set, or any pinned `public`/`manual` entry) may be private; every other relay must be a public hostname whose DNS resolves entirely to public addresses. So a private `wss://` is only reachable when something pinned or configured it.
 - hostname lowercased, default port removed, trailing slashes removed, non-empty path kept.
 - Invalid → `null` → dropped with an audit log (`nodeDebug('invalidRelayUrl', { url, reason })`), never silently cleaned.
 
 ## Health score
 
 ```text
-failureRate = failureCount / (successCount + failureCount)
-rtt         = clamp(rttMs ?? DEFAULT_RTT_MS, 1, MAX_RTT_MS)
-score       = rtt * (1 + failureRate * FAILURE_WEIGHT)     // FAILURE_WEIGHT = 4
-score      *= STALE_PENALTY                                 // ×2 if lastProbe older than PROBE_STALE_MS
+dead        = latest attempt failed, or the entry never succeeded   // ties count as failed
+failureRate = dead ? 1 : failureCount / (successCount + failureCount)
+rtt         = clamp(dead ? MAX_RTT_MS : rttMs, 1, MAX_RTT_MS)      // DEFAULT_RTT_MS when unknown, zero or invalid
+score       = rtt * (1 + failureRate * FAILURE_WEIGHT)             // FAILURE_WEIGHT = 4
+score      *= STALE_PENALTY                                        // ×2 if lastProbe older than PROBE_STALE_MS
 ```
 
-Lower is better. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishResult` share the same counters. Writes to `nodeDir/nostr/relays.json` are **throttled** (2s debounce).
+Lower is better. A dead entry (`failureCount > 0` and either no successes or a latest failure) scores with `MAX_RTT_MS`, `failureRate = 1`, and its stale RTT discarded, so it can never outrank a live one. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishResult` share the same counters; attempt timestamps advance monotonically so success/failure ordering survives same-millisecond attempts. Writes to `nodeDir/nostr/relays.json` are **throttled** (2s debounce).
 
 ## Persistence
 
@@ -74,7 +78,7 @@ Lower is better. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishRes
 
 `handshakeTargets(nodeHash, attempt)`:
 
-- **Round 0**: peer-claimed `listenRelays` top 4 by composite score (own health + peer rtt); else local `workingRelays` top 4; else pinned top 4.
+- **Round 0**: peer-claimed `listenRelays` top 4 by composite score (own health + peer rtt); else local `workingRelays` top 4. Empty working sets do not fall back to failed pins.
 - **Round ≥1**: backoff `min(2000 · 2^(attempt−1), 60000)`; base on `lastGoodNostrRelays` (expanded via `expandFromHistory` ≤ 16), or weighted-random sample of `workingRelays` (weight `1/score`); round-0 core always included; fanout capped at `MAX_ROUTING_FANOUT` (64).
 - Retries ≤ `MAX_ROUTING_ATTEMPTS` (4).
 

package/link/providers/webrtc.mjs

@@ -135,13 +135,14 @@ export async function createWebRtcLink(options) {
 	const rungs = iceLocalHostnameLadder(icePolicy)
 	const remoteSignalQueue = []
 	const seenRemoteSignals = createLruMap(1024)
-	/** @type {InstanceType<import('../rtc/polyfill.mjs').LoadedRtcPolyfill['RTCPeerConnection']> & { onicecandidate?: unknown, ondatachannel?: unknown, onconnectionstatechange?: unknown }} */
+	/** @type {InstanceType<import('../rtc/polyfill.mjs').LoadedRtcPolyfill['RTCPeerConnection']> & { ondatachannel?: unknown, onconnectionstatechange?: unknown, candidateCountHandler?: unknown }} */
 	let peerConnection = null
 	let remoteDescriptionSet = false
 	let controlChannel = null
 	let bulkChannel = null
 	let unlistenRemote = null
 	let sendQueues = null
+	let linkReady = false
 	let controlLowEvents = 0
 	let bulkLowEvents = 0
 	let reconnectCount = 0
@@ -216,6 +217,8 @@ export async function createWebRtcLink(options) {
 			}
 		},
 	})
+	// 数据链路是否已完成握手认证：完成后，发不出去的重协商答复不该再拆掉这条活链路。
+	void pipe.ready.then(() => { linkReady = true }, () => { })
 
 	/**
 	 * @param {RTCDataChannel} channel RTC 数据通道
@@ -269,8 +272,12 @@ export async function createWebRtcLink(options) {
 		remoteSignalQueue.length = 0
 		localCandidateCount = 0
 		attachPeerConnection(peerConnection)
-		if (previous)
+		if (previous) {
+			// 先摘回调再关：旧连接 close() 会经 connectionstatechange 触发 pipe.close，而
+			// closeTransport() 关的是 peerConnection 这个变量（此刻已指向新连接），于是刚建好的一级被自己关掉（fount-p2p#39）。
+			detachPeerConnection(previous)
 			try { await previous.close() } catch { /* ignore */ }
+		}
 		nodeDebug('p2p:webrtc ice rung', {
 			rung: rungIndex,
 			policy: rungs[rungIndex],
@@ -288,22 +295,29 @@ export async function createWebRtcLink(options) {
 
 	/**
 	 * 给 peer connection 挂上事件与回调（换级重建后需重新挂）。
+	 *
+	 * 回调一律用传入的这个连接，不读 `peerConnection` 闭包变量：换级后旧连接仍可能派发事件，
+	 * 读变量就会把事件算到新连接头上。
 	 * @param {RTCPeerConnection} connection peer connection
 	 * @returns {void}
 	 */
 	function attachPeerConnection(connection) {
 		// 候选随 description 一次性带出（对端要先有 remoteDescription 才吃候选），故这里只计数、不外发。
-		// 事件 API 由后端提供（W3C 是 addEventListener）；缺失时退化为 onicecandidate 计数。
+		// 事件 API 由后端提供（W3C 是 addEventListener）；缺失时退化为 onicecandidate，摘的时候看 candidateCountHandler 在不在。
 		const countCandidate = event => {
 			if (event?.candidate) localCandidateCount++
 		}
-		if (connection.addEventListener) connection.addEventListener('icecandidate', countCandidate)
+		if (connection.addEventListener) {
+			connection.candidateCountHandler = countCandidate
+			connection.addEventListener('icecandidate', countCandidate)
+		}
 		else {
 			const previousHandler = connection.onicecandidate
-			connection.onicecandidate = event => {
+			connection.candidateCountHandler = event => {
 				countCandidate(event)
 				previousHandler?.(event)
 			}
+			connection.onicecandidate = connection.candidateCountHandler
 		}
 		connection.ondatachannel = event => {
 			attachChannel(event.channel)
@@ -317,6 +331,19 @@ export async function createWebRtcLink(options) {
 		}
 	}
 
+	/**
+	 * 摘掉某一级 peer connection 上挂的事件与回调（重建前必须调用，见 [buildPeerConnection]）。
+	 * @param {RTCPeerConnection} connection 待摘的连接
+	 * @returns {void}
+	 */
+	function detachPeerConnection(connection) {
+		if (connection.candidateCountHandler) connection.removeEventListener?.('icecandidate', connection.candidateCountHandler)
+		else connection.onicecandidate = null
+		delete connection.candidateCountHandler
+		connection.ondatachannel = null
+		connection.onconnectionstatechange = null
+	}
+
 	/**
 	 * 等本地候选收齐（停滞判定见 [collectIceGathering]），并回报本次是否产出了候选。
 	 * @returns {Promise<boolean>} 是否收到过候选
@@ -396,11 +423,18 @@ export async function createWebRtcLink(options) {
 					candidates: localCandidateCount,
 					hasCandidates,
 				})
-				await sendSignal({
-					type: 'description',
-					rung: rungIndex,
-					description: peerConnection.localDescription?.toJSON?.() ?? peerConnection.localDescription ?? answer,
-				})
+				try {
+					await sendSignal({
+						type: 'description',
+						rung: rungIndex,
+						description: peerConnection.localDescription?.toJSON?.() ?? peerConnection.localDescription ?? answer,
+					})
+				}
+				catch (error) {
+					// 已认证的数据链路不应被后续信令发送失败关闭。
+					if (!linkReady) throw error
+					nodeDebug('p2p:webrtc answer signal send failed after link ready', { reason: formatErrorReason(error) })
+				}
 				await pipe.maybeSendAuth()
 			}
 			return
@@ -469,7 +503,7 @@ export async function createWebRtcLink(options) {
 		void handleRemoteSignal(message).catch(error => pipe.close(`signal-error:${formatErrorReason(error)}`))
 	}) ?? null
 
-	// 信令随时可能到，故先为当前一级建好 pc（发起方随后会在阶梯里逐级重建）。
+	// 信令随时可能到，故先为当前一级（第 0 级）建好 pc；发起方阶梯的首次迭代直接用它，不重建。
 	await ensurePeerConnection()
 
 	if (options.initiator) {
@@ -478,7 +512,8 @@ export async function createWebRtcLink(options) {
 		const ladderDeadline = Date.now() + handshakeTimeoutMs
 		let sentOffer = false
 		for (let index = 0; index < rungs.length; index++) {
-			await buildPeerConnection(index)
+			// 同一级不重建：换 pc 会牵动并发信令与旧连接的关闭，只在真的换级时才需要（fount-p2p#39）。
+			if (rungIndex !== index) await buildPeerConnection(index)
 			attachChannel(peerConnection.createDataChannel(CHANNEL_CONTROL))
 			attachChannel(peerConnection.createDataChannel(CHANNEL_BULK))
 			const offer = await peerConnection.createOffer()
@@ -491,7 +526,8 @@ export async function createWebRtcLink(options) {
 			})
 			// 候选集为空说明这一级策略把本机候选全滤掉了（例如只产出 mDNS 候选），换更宽松的一级重建。
 			// 只在预算内、且还有更宽松的一级时升级；`rewrite-loopback` 起点不会走到这里（阶梯只有它自己）。
-			if (!hasCandidates && Date.now() < ladderDeadline && index + 1 < rungs.length) {
+			const escalatable = index + 1 < rungs.length
+			if (!hasCandidates && escalatable && Date.now() < ladderDeadline) {
 				nodeDebug('p2p:webrtc ice rung escalated', {
 					from: rungs[index],
 					to: rungs[index + 1],
@@ -509,7 +545,7 @@ export async function createWebRtcLink(options) {
 				nodeDebug('p2p:webrtc offer has no usable ice candidates', {
 					rung: index,
 					policy: rungs[index],
-					escalatable: index + 1 < rungs.length,
+					escalatable,
 					iceServers: options.iceServers?.length || 0,
 				})
 			break

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@steve02081504/fount-p2p",
-	"version": "0.0.48",
+	"version": "0.0.50",
 	"description": "fount federation P2P layer — link, trust graph, mailbox, DAG, EVFS.",
 	"keywords": [
 		"network",

package/transport/runtime_bootstrap.mjs

@@ -15,7 +15,7 @@ import {
 	createNostrDiscoveryProvider,
 	resolveNostrRelayUrls,
 } from '../discovery/nostr/index.mjs'
-import { getListenRelays, getWorkingRelays, loadRelayPool, startNostrRelayDiscovery } from '../discovery/nostr/relays.mjs'
+import { getWorkingRelays, loadRelayPool, startNostrRelayDiscovery } from '../discovery/nostr/relays.mjs'
 import { createBleGattLinkProvider } from '../link/providers/ble_gatt.mjs'
 import {
 	listLinkProviders,
@@ -188,7 +188,7 @@ export function createRuntimeBootstrap(deps) {
 						.filter(entry => entry.rttMs != null)
 						.slice(0, MAX_ADVERT_RELAY_POOL)
 						.map(entry => ({ url: entry.url, rttMs: entry.rttMs })),
-					listen: getListenRelays().map(entry => entry.url),
+					listen: resolveNostrRelayUrls(),
 				}
 				: { pool: [], listen: [] },
 		)