@steve02081504/fount-p2p 0.0.49 → 0.0.51

package/discovery/nostr/constants.mjs

@@ -26,6 +26,8 @@ export const STALE_PENALTY = 2
 export const NIP66_REFRESH_MS = 6 * 3600 * 1000
 /** 超过此时间未探测视为 stale。 */
 export const PROBE_STALE_MS = 24 * 3600 * 1000
+/** 发布失败后暂时避开 relay，冷却结束后允许再次尝试。 */
+export const PUBLISH_FAILURE_COOLDOWN_MS = 30 * 60 * 1000
 /** 路由退避基数。 */
 export const BACKOFF_BASE_MS = 2000
 /** 路由退避上限。 */

package/discovery/nostr/index.mjs

@@ -26,6 +26,7 @@ import {
 	getPoolByUrl,
 	isRelayDestinationAllowed,
 	probeRelay,
+	recordPublishResult,
 	registerProviderTrustedRelayUrls,
 	resolveRelayConnectTarget,
 	setPeerRoute,
@@ -202,6 +203,20 @@ async function signNostrEvent(kind, tags, content, secretKey) {
 	return { id, pubkey, created_at, kind, tags, content, sig: bytesToHex(await schnorr.sign(hexToBytes(id), secretKey)) }
 }
 
+/**
+ * 记录一次发布结果并回报同一个布尔值，供 `Promise.any` 直接消费。
+ * 调用方已取消时不记：那不是 relay 的过错，不该压它的健康分。
+ * @param {string} relayUrl 中继 URL
+ * @param {boolean} ok 是否成功
+ * @param {AbortSignal} [signal] 取消信号
+ * @returns {boolean} ok
+ */
+function recordPublishOutcome(relayUrl, ok, signal) {
+	if (signal?.aborted) return ok
+	recordPublishResult(relayUrl, ok)
+	return ok
+}
+
 /**
  * 全量发布到给定 relay：任一成功即返回，其余 relay 的发布留在后台自行结算。
  * 每个 relay 尝试都有界（连接超时 / OK 超时 / 入队等待上限），故后台不会永久悬挂。
@@ -213,29 +228,36 @@ async function signNostrEvent(kind, tags, content, secretKey) {
 async function publishEvent(relayUrls, event, signal) {
 	const urls = dedupeRelayUrls(relayUrls)
 	if (!urls.length) throw new Error('nostr: no relay')
-	const targets = (await Promise.all(urls.map(async relayUrl => {
+	/** @type {Map<string, { hostname: string, addresses: string[] }>} */
+	const targets = new Map()
+	await Promise.all(urls.map(async relayUrl => {
 		try {
-			return { relayUrl, connectTarget: await resolveRelayConnectTarget(relayUrl) }
+			const connectTarget = await resolveRelayConnectTarget(relayUrl)
+			if (connectTarget) targets.set(relayUrl, connectTarget)
+			else recordPublishOutcome(relayUrl, false, signal)
 		}
-		catch {
-			return { relayUrl, connectTarget: null }
+		catch (error) {
+			recordPublishOutcome(relayUrl, false, signal)
+			nodeDebug('p2p:nostr relay target resolve fail', { relay: relayUrl, err: String(error?.message || error) })
 		}
-	}))).filter(target => target.connectTarget)
+	}))
+	if (!targets.size) throw new Error('nostr: no relay')
 	let lastError = null
-	if (!targets.length) throw new Error('nostr: no relay')
-	const attempts = targets.map(target => publishViaSharedRelay(target.relayUrl, event, signal, target.connectTarget)
-		.then(ok => {
-			if (ok) return true
-			lastError = new Error(`nostr: relay rejected publish (${target.relayUrl})`)
-			return false
-		}, error => {
+	const accepted = await Promise.any([...targets].map(async ([relayUrl, connectTarget]) => {
+		let ok = false
+		try {
+			ok = await publishViaSharedRelay(relayUrl, event, signal, connectTarget)
+			if (!ok) lastError = new Error(`nostr: relay rejected publish (${relayUrl})`)
+		}
+		catch (error) {
+			if (error?.message === 'nostr: aborted') throw error
 			lastError = error
-			return false
-		}))
-	// 首个成功的 relay 即结算调用方；其余尝试继续在后台跑（失败已就地吞掉，不会变成 unhandled rejection）。
-	const accepted = await Promise.race(attempts.map((attempt, index) => attempt.then(ok => ok ? index : -1)))
-	if (accepted >= 0) return
-	await Promise.all(attempts)
+		}
+		// 快速失败不掩盖稍后成功的 relay：全部尝试各自结算并更新健康度，任一成功即视为发布成功。
+		if (!recordPublishOutcome(relayUrl, ok, signal)) throw new Error('nostr: relay rejected publish')
+		return relayUrl
+	})).catch(() => null)
+	if (accepted) return
 	throw lastError || new Error('nostr: no relay accepted publish')
 }
 

package/discovery/nostr/relays.mjs

@@ -25,6 +25,7 @@ import {
 	NIP66_REFRESH_MS,
 	POOL_CAP,
 	PROBE_STALE_MS,
+	PUBLISH_FAILURE_COOLDOWN_MS,
 	STALE_PENALTY,
 	WORKING_RELAYS_COUNT,
 } from './constants.mjs'
@@ -40,6 +41,8 @@ const NIP66_REQ_LIMIT = 500
 const MAX_NIP66_PROBES_PER_ROUND = 48
 /** NIP-66 候选 probe 并发批大小（有界，避免同轮瞬时打满连接）。 */
 const NIP66_PROBE_BATCH_SIZE = 8
+/** 规范化后的 NIP-66 引导集：它们先当发现源，只有发布成功过才进监听/发布子集。 */
+const NIP66_BOOTSTRAP_RELAY_URLS = new Set(NIP66_BOOTSTRAP_RELAYS.map(normalizeNostrRelayUrl).filter(Boolean))
 
 /** @typedef {'nip66' | 'public' | 'manual' | 'peer'} RelaySource */
 
@@ -52,6 +55,8 @@ const NIP66_PROBE_BATCH_SIZE = 8
  *   lastSuccess: number,
  *   lastFailure: number,
  *   lastProbe: number,
+ *   lastPublishSuccess: number,
+ *   lastPublishFailure: number,
  *   firstSeen: number,
  *   lastSeen: number,
  *   source: RelaySource,
@@ -103,7 +108,7 @@ let discoveryEnabled = true
 
 /**
  * 规范化 Nostr relay URL（唯一入站入口）。
- * - 仅允许 wss://；`ws://` 仅限回环/私有地址（本地测试/开发）。
+ * - `wss://` 不限地址；`ws://` 只接受本机回环（`localhost` / `::1` / `127.x`），私网与公网一律拒绝。
  * - hostname 小写，去除默认端口，去除尾部斜杠，保留非空 path。
  * @param {unknown} raw 原始 URL
  * @returns {string | null} 规范化字符串，无效返回 null
@@ -250,7 +255,8 @@ function currentTrustedRelayUrls() {
 
 /**
  * 判定该 relay 是否允许作为连接目的地（probe/发布/订阅）。
- * 本机显式配置或 NIP-66 引导集保留信任例外；其余须为公网 hostname 且 DNS 全部解析为公网地址。
+ * 受信 relay（本机显式配置、提供方注册、NIP-66 引导集、pinned，见 [currentTrustedRelayUrls]）不受公网限制；
+ * 其余须为公网 hostname 且 DNS 全部解析为公网地址。
  * @param {string} relayUrl 规范化 relay URL
  * @returns {Promise<boolean>} 允许连接为 true
  */
@@ -261,20 +267,32 @@ export async function isRelayDestinationAllowed(relayUrl) {
 	return relayUrlResolvesPublic(relayUrl)
 }
 
+/**
+ * 最近一次尝试是否失败。时间戳与 lastSuccess 打平按失败算（同一毫秒内的并发尝试里，成功者会记下更晚的时间戳）。
+ * @param {number} lastFailure 最近一次失败时间戳
+ * @param {number} lastSuccess 最近一次成功时间戳
+ * @returns {boolean} 最近一次尝试失败为 true
+ */
+function latestAttemptFailed(lastFailure, lastSuccess) {
+	return lastFailure >= lastSuccess
+}
+
 /**
  * 计算 relay 健康分（越低越优）。
+ * 最近一次尝试失败（或从未成功过）时 RTT 与失败率都取最差值，分数必定高于任何活着的 relay。
  * @param {Partial<RelayPoolEntry>} entry 条目
  * @returns {number} 健康分
  */
 export function computeRelayHealth(entry) {
-	const { rttMs, successCount, failureCount, lastProbe } = entry
-	const total = (successCount || 0) + (failureCount || 0)
-	const failureRate = total > 0 ? (failureCount || 0) / total : 0
-	let rtt = rttMs !== undefined && rttMs !== null ? Number(rttMs) : DEFAULT_RTT_MS
-	if (!Number.isFinite(rtt)) rtt = DEFAULT_RTT_MS
-	rtt = Math.max(1, Math.min(MAX_RTT_MS, rtt))
+	const { rttMs, successCount = 0, failureCount = 0, lastProbe = 0, lastSuccess = 0, lastFailure = 0 } = entry
+	const failed = failureCount > 0 && (!successCount || latestAttemptFailed(lastFailure, lastSuccess))
+	const total = successCount + failureCount
+	const failureRate = failed ? 1 : total > 0 ? failureCount / total : 0
+	// 失败的 relay 最后一次测量已被作废：没有可信 RTT 可依，按上限算。
+	const measuredRtt = failed ? MAX_RTT_MS : rttMs
+	const rtt = Math.max(1, Math.min(MAX_RTT_MS, Number.isFinite(measuredRtt) && measuredRtt > 0 ? measuredRtt : DEFAULT_RTT_MS))
 	let score = rtt * (1 + failureRate * FAILURE_WEIGHT)
-	if (Date.now() - (lastProbe || 0) > PROBE_STALE_MS) score *= STALE_PENALTY
+	if (Date.now() - lastProbe > PROBE_STALE_MS) score *= STALE_PENALTY
 	return score
 }
 
@@ -375,7 +393,8 @@ export function loadRelayPool() {
  * @returns {RelayPoolEntry | null} 规范化条目或 null
  */
 function toRelayEntry(raw, url) {
-	const rttMs = Number(raw?.rttMs)
+	// 失败作废的 RTT 落盘为 null：`Number(null)` 是 0，直接取数会把「没有可信 RTT」变成「0ms 最快」。
+	const rttMs = raw?.rttMs == null ? null : Number(raw.rttMs)
 	return {
 		url,
 		rttMs: Number.isFinite(rttMs) ? Math.round(rttMs) : null,
@@ -384,6 +403,8 @@ function toRelayEntry(raw, url) {
 		lastSuccess: Number(raw?.lastSuccess) || 0,
 		lastFailure: Number(raw?.lastFailure) || 0,
 		lastProbe: Number(raw?.lastProbe) || 0,
+		lastPublishSuccess: Number(raw?.lastPublishSuccess) || 0,
+		lastPublishFailure: Number(raw?.lastPublishFailure) || 0,
 		firstSeen: Number(raw?.firstSeen) || Date.now(),
 		lastSeen: Number(raw?.lastSeen) || Date.now(),
 		source: SOURCE_PRIORITY[String(raw?.source || '')] !== undefined ? raw.source : 'nip66',
@@ -446,6 +467,8 @@ function seedPublicDefaults() {
 			lastSuccess: 0,
 			lastFailure: 0,
 			lastProbe: 0,
+			lastPublishSuccess: 0,
+			lastPublishFailure: 0,
 			firstSeen: now,
 			lastSeen: now,
 			source: 'public',
@@ -476,6 +499,8 @@ export function upsertRelay(input) {
 		if (incoming.lastSuccess) existing.lastSuccess = incoming.lastSuccess
 		if (incoming.lastFailure) existing.lastFailure = incoming.lastFailure
 		if (incoming.lastProbe) existing.lastProbe = incoming.lastProbe
+		if (incoming.lastPublishSuccess) existing.lastPublishSuccess = incoming.lastPublishSuccess
+		if (incoming.lastPublishFailure) existing.lastPublishFailure = incoming.lastPublishFailure
 		if (incoming.rttMs != null) existing.rttMs = incoming.rttMs
 		if (incoming.nips.length) existing.nips = incoming.nips
 		existing.clearnet = existing.clearnet || incoming.clearnet
@@ -512,7 +537,7 @@ export function recordProbeSuccess(url, rttMs) {
 	const entry = ensureEntry(normalized)
 	if (rttMs != null && Number.isFinite(Number(rttMs))) entry.rttMs = Math.max(0, Math.min(MAX_RTT_MS, Math.round(Number(rttMs))))
 	entry.successCount++
-	entry.lastSuccess = entry.lastProbe = entry.lastSeen = Date.now()
+	entry.lastSuccess = entry.lastProbe = entry.lastSeen = Math.max(Date.now(), entry.lastProbe + 1)
 	markDirty()
 }
 
@@ -525,19 +550,30 @@ export function recordProbeFailure(url) {
 	if (!normalized) return
 	const entry = ensureEntry(normalized)
 	entry.failureCount++
-	entry.lastFailure = entry.lastProbe = entry.lastSeen = Date.now()
+	entry.rttMs = null
+	entry.lastFailure = entry.lastProbe = entry.lastSeen = Math.max(Date.now(), entry.lastProbe + 1)
 	markDirty()
 }
 
 /**
  * 记录一次发布结果（与探测共用统计）。
+ * 成功/失败时间戳必须严格递增：同一毫秒内的并发发布否则无法分出先后，会误判 relay 是否已恢复。
  * @param {string} url relay URL
  * @param {boolean} ok 是否成功
  * @returns {void}
  */
 export function recordPublishResult(url, ok) {
-	if (ok) recordProbeSuccess(url, null)
-	else recordProbeFailure(url)
+	const normalized = normalizeNostrRelayUrl(url)
+	if (!normalized) return
+	const entry = ensureEntry(normalized)
+	if (ok) {
+		entry.lastPublishSuccess = Math.max(Date.now(), entry.lastPublishFailure + 1)
+		recordProbeSuccess(normalized, null)
+	}
+	else {
+		entry.lastPublishFailure = Math.max(Date.now(), entry.lastPublishSuccess + 1)
+		recordProbeFailure(normalized)
+	}
 }
 
 /**
@@ -557,6 +593,8 @@ function ensureEntry(url) {
 		lastSuccess: 0,
 		lastFailure: 0,
 		lastProbe: 0,
+		lastPublishSuccess: 0,
+		lastPublishFailure: 0,
 		firstSeen: now,
 		lastSeen: now,
 		source: 'nip66',
@@ -583,22 +621,31 @@ export function clearStale() {
 }
 
 /**
- * @returns {RelayPoolEntry[]} 工作集（健康分升序，含全部 pinned）
+ * @returns {RelayPoolEntry[]} 工作集（保留未探测引导项，排除失败或过期项，优先 pinned）
  */
 export function getWorkingRelays() {
-	const sorted = sortByHealth([...poolEntries.values()])
+	const now = Date.now()
+	// 合格项：最近一次尝试成功且没过期，或压根还没探测过的引导项；发布失败在冷却期内一律避开。
+	const eligible = [...poolEntries.values()].filter(entry =>
+		(entry.lastPublishFailure <= entry.lastPublishSuccess
+			|| now - entry.lastPublishFailure >= PUBLISH_FAILURE_COOLDOWN_MS)
+		&& (entry.successCount === 0
+			? entry.lastFailure === 0
+			: !latestAttemptFailed(entry.lastFailure, entry.lastSuccess) && now - entry.lastSuccess <= PROBE_STALE_MS))
+	const sorted = sortByHealth(eligible)
 	const pinned = sorted.filter(isPinned)
 	const rest = sorted.filter(entry => !isPinned(entry))
 	return dedupeByUrl([...pinned, ...rest.slice(0, Math.max(0, WORKING_RELAYS_COUNT - pinned.length))])
 }
 
 /**
- * @returns {RelayPoolEntry[]} 监听/发布子集（含全部 public/manual）
+ * @returns {RelayPoolEntry[]} 监听/发布子集（NIP-66 引导 relay 需先成功发布）
  */
 export function getListenRelays() {
 	const working = getWorkingRelays()
 	const pinned = working.filter(isPinned)
-	const rest = working.filter(entry => !isPinned(entry))
+	const rest = working.filter(entry => !isPinned(entry)
+		&& (!NIP66_BOOTSTRAP_RELAY_URLS.has(entry.url) || entry.lastPublishSuccess > 0))
 	return dedupeByUrl([...pinned, ...rest.slice(0, Math.max(0, LISTEN_RELAYS_COUNT - pinned.length))])
 }
 

package/discovery/nostr/selection.mjs

@@ -12,7 +12,6 @@ import {
 import {
 	computeRelayHealth,
 	getPeerRoute,
-	getPinnedRelays,
 	getPoolByUrl,
 	getWorkingRelays,
 	recordPublishResult,
@@ -116,7 +115,7 @@ export function expandFromHistory(nodeHash, base, limit) {
 
 /**
  * 计算到指定节点的当前轮路由目标集。
- * Round 0：对端声称前4（无则本机工作集前4，再空则 pinned）。
+ * Round 0：对端声称前4（无则本机工作集前4）。
  * Round ≥1：历史成功 + 对端综合分补足 + 加权采样，附退避；总扇出封顶。
  * @param {string} nodeHash 目标节点
  * @param {number} attempt 当前尝试轮次（0 起）
@@ -139,7 +138,6 @@ export function handshakeTargets(nodeHash, attempt) {
 			for (const entry of working.slice(0, ROUND0_TARGET_COUNT)) push(entry.url)
 			return
 		}
-		for (const url of getPinnedRelays().slice(0, ROUND0_TARGET_COUNT)) push(url)
 	}
 	if (attempt <= 0) {
 		round0()

package/docs/nostr_relay_discovery.md

@@ -16,8 +16,12 @@ Source layout (`discovery/nostr/`):
 
 `relayPool` (all known) → `workingRelays` (top-`WORKING_RELAYS_COUNT` by health) → `listenRelays` (top-`LISTEN_RELAYS_COUNT` working subset used for publish/listen).
 
-- `public`/`manual` entries are **pinned**: always in `working`/`listen` and never evicted by `clearStale` or pool-cap. Pin count may exceed the nominal caps.
+- `public`/`manual` entries are **pinned**: preferred in `working`/`listen` when eligible and never evicted by `clearStale` or pool-cap. Failed or stale pins remain in the pool for retry, but leave the working/listen sets. Pin count may exceed the nominal caps.
 - `nip66`/`peer` entries are disposable: evicted when stale (`PROBE_STALE_MS`) or when the pool exceeds `POOL_CAP`.
+- A relay leaves the working/listen sets when it is **not eligible**: never probed but already failed, or its latest attempt failed, or its last success is older than `PROBE_STALE_MS`. Untested bootstrap entries stay eligible for the working set; exclusion never evicts from the pool, so dead relays keep getting retried.
+- A **publish** outcome is tracked separately from probes (`lastPublishSuccess`/`lastPublishFailure`): a rejected publish keeps the relay out of the working set for `PUBLISH_FAILURE_COOLDOWN_MS` (30min) even if a later connectivity probe succeeds, and a later accepted publish clears it — a relay that answers a WebSocket probe but refuses our events must not keep advertising capacity.
+- The `NIP66_BOOTSTRAP_RELAYS` set is discovery-only: those URLs are `nip66` entries and are not publish/listen targets until one of our publishes is accepted (`lastPublishSuccess > 0`). Ordinary NIP-66 discoveries stay eligible for publish testing.
+- Configured `relayUrls` override the automatic listen subset; adverts publish this resolved subscription set as `listenNostrRelays`.
 - Fresh nodes are seeded with `DEFAULT_RELAY_URLS` (`source: 'public'`) so `listenRelays` is never empty at cold start.
 - Persistent connections stay bounded by `workingRelays` (`WORKING_RELAYS_COUNT`, max 32); pins influence selection, not simultaneous connections.
 
@@ -25,20 +29,22 @@ Source layout (`discovery/nostr/`):
 
 `normalizeNostrRelayUrl` (in `relays.mjs`) is the only entry for every inbound URL (NIP-66 `d` tag, manual config, peer advert):
 
-- `wss://` always; `ws://` only for loopback/private hosts (local dev/tests).
+- `wss://` to any host; `ws://` to loopback only (`localhost` / `::1` / `127.x` — local dev/tests). Private and public `ws://` are rejected outright.
+- `isRelayDestinationAllowed` then gates dialling: a **trusted** relay (local config, provider registration, the NIP-66 bootstrap set, or any pinned `public`/`manual` entry) may be private; every other relay must be a public hostname whose DNS resolves entirely to public addresses. So a private `wss://` is only reachable when something pinned or configured it.
 - hostname lowercased, default port removed, trailing slashes removed, non-empty path kept.
 - Invalid → `null` → dropped with an audit log (`nodeDebug('invalidRelayUrl', { url, reason })`), never silently cleaned.
 
 ## Health score
 
 ```text
-failureRate = failureCount / (successCount + failureCount)
-rtt         = clamp(rttMs ?? DEFAULT_RTT_MS, 1, MAX_RTT_MS)
-score       = rtt * (1 + failureRate * FAILURE_WEIGHT)     // FAILURE_WEIGHT = 4
-score      *= STALE_PENALTY                                 // ×2 if lastProbe older than PROBE_STALE_MS
+dead        = latest attempt failed, or the entry never succeeded   // ties count as failed
+failureRate = dead ? 1 : failureCount / (successCount + failureCount)
+rtt         = clamp(dead ? MAX_RTT_MS : rttMs, 1, MAX_RTT_MS)      // DEFAULT_RTT_MS when unknown, zero or invalid
+score       = rtt * (1 + failureRate * FAILURE_WEIGHT)             // FAILURE_WEIGHT = 4
+score      *= STALE_PENALTY                                        // ×2 if lastProbe older than PROBE_STALE_MS
 ```
 
-Lower is better. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishResult` share the same counters. Writes to `nodeDir/nostr/relays.json` are **throttled** (2s debounce).
+Lower is better. A dead entry (`failureCount > 0` and either no successes or a latest failure) scores with `MAX_RTT_MS`, `failureRate = 1`, and its stale RTT discarded, so it can never outrank a live one. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishResult` share the same counters; attempt timestamps advance monotonically so success/failure ordering survives same-millisecond attempts. The health score itself does not look at publish outcomes — the publish-failure cooldown above is a separate eligibility gate. Writes to `nodeDir/nostr/relays.json` are **throttled** (2s debounce).
 
 ## Persistence
 
@@ -47,7 +53,7 @@ Lower is better. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishRes
 ```text
 {
   "updatedAt": 1234567890,
-  "nostrRelays": [{ "url", "rttMs", "successCount", "failureCount", "lastSuccess", "lastFailure", "lastProbe", "firstSeen", "lastSeen", "source", "nips", "clearnet", "monitorCount" }],
+  "nostrRelays": [{ "url", "rttMs", "successCount", "failureCount", "lastSuccess", "lastFailure", "lastProbe", "lastPublishSuccess", "lastPublishFailure", "firstSeen", "lastSeen", "source", "nips", "clearnet", "monitorCount" }],
   "peerRoutes": { "<nodeHash64>": { "listenRelays", "peerPool", "lastGoodNostrRelays", "lastSeen" } }
 }
 ```
@@ -74,7 +80,7 @@ Lower is better. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishRes
 
 `handshakeTargets(nodeHash, attempt)`:
 
-- **Round 0**: peer-claimed `listenRelays` top 4 by composite score (own health + peer rtt); else local `workingRelays` top 4; else pinned top 4.
+- **Round 0**: peer-claimed `listenRelays` top 4 by composite score (own health + peer rtt); else local `workingRelays` top 4. Empty working sets do not fall back to failed pins.
 - **Round ≥1**: backoff `min(2000 · 2^(attempt−1), 60000)`; base on `lastGoodNostrRelays` (expanded via `expandFromHistory` ≤ 16), or weighted-random sample of `workingRelays` (weight `1/score`); round-0 core always included; fanout capped at `MAX_ROUTING_FANOUT` (64).
 - Retries ≤ `MAX_ROUTING_ATTEMPTS` (4).
 

package/link/pipe.mjs

@@ -422,6 +422,7 @@ export function createLinkPipe(options) {
 		stats() {
 			return {
 				ready,
+				closed,
 				providerId,
 				level,
 				nodeHash: remoteNodeHash,

package/link/providers/webrtc.mjs

@@ -22,6 +22,7 @@ import { LINK_LEVEL_WEBRTC } from './levels.mjs'
 export const ICE_CANDIDATE_SETTLE_MS = 300
 /** gathering 状态轮询间隔。 */
 const ICE_GATHERING_POLL_MS = 50
+const ANSWER_SIGNAL_RETRY_DELAYS_MS = [200, 500]
 /** 一个候选都没收到时，等这么久就放行让 DTLS/数据通道自行判成败。 */
 export const ICE_GATHERING_STALL_MS = ms('3s')
 
@@ -142,6 +143,7 @@ export async function createWebRtcLink(options) {
 	let bulkChannel = null
 	let unlistenRemote = null
 	let sendQueues = null
+	let linkReady = false
 	let controlLowEvents = 0
 	let bulkLowEvents = 0
 	let reconnectCount = 0
@@ -157,6 +159,32 @@ export async function createWebRtcLink(options) {
 		await Promise.resolve(options.signal.send(message))
 	}
 
+	/**
+	 * 发送 answer 信令：暂时性失败按 [ANSWER_SIGNAL_RETRY_DELAYS_MS] 重试。
+	 * 链路已就绪（重协商）或已被换掉/关闭时不再重试——那时重发只会打到过期的会话。
+	 * @param {object} message 待发送的 answer
+	 * @param {() => boolean} isCurrent 该 answer 是否仍属于当前一级与存活的链路
+	 * @returns {Promise<void>}
+	 */
+	async function sendAnswerSignal(message, isCurrent) {
+		for (let attempt = 0; ; attempt++) {
+			if (!isCurrent()) return
+			try {
+				await sendSignal(message)
+				return
+			}
+			catch (error) {
+				// 过期的 answer（换级/换 pc 或链路已关）：直接放弃，不能再靠失败去拆掉当前活链路。
+				if (!isCurrent()) return
+				if (linkReady) throw error
+				const delayMs = ANSWER_SIGNAL_RETRY_DELAYS_MS[attempt]
+				if (delayMs == null) throw error
+				nodeDebug('p2p:webrtc answer signal retry', { attempt: attempt + 1, reason: formatErrorReason(error) })
+				await new Promise(resolve => setTimeout(resolve, delayMs))
+			}
+		}
+	}
+
 	const createPipe = options.createPipe ?? createLinkPipe
 	const pipe = createPipe({
 		providerId: 'webrtc',
@@ -216,6 +244,8 @@ export async function createWebRtcLink(options) {
 			}
 		},
 	})
+	// 数据链路是否已完成握手认证：完成后，发不出去的重协商答复不该再拆掉这条活链路。
+	void pipe.ready.then(() => { linkReady = true }, () => { })
 
 	/**
 	 * @param {RTCDataChannel} channel RTC 数据通道
@@ -420,11 +450,19 @@ export async function createWebRtcLink(options) {
 					candidates: localCandidateCount,
 					hasCandidates,
 				})
-				await sendSignal({
-					type: 'description',
-					rung: rungIndex,
-					description: peerConnection.localDescription?.toJSON?.() ?? peerConnection.localDescription ?? answer,
-				})
+				try {
+					const answerPeerConnection = peerConnection
+					await sendAnswerSignal({
+						type: 'description',
+						rung: rungIndex,
+						description: peerConnection.localDescription?.toJSON?.() ?? peerConnection.localDescription ?? answer,
+					}, () => peerConnection === answerPeerConnection && rungIndex === remoteRung && !pipe.stats().closed)
+				}
+				catch (error) {
+					// 已认证的数据链路不应被后续信令发送失败关闭。
+					if (!linkReady) throw error
+					nodeDebug('p2p:webrtc answer signal send failed after link ready', { reason: formatErrorReason(error) })
+				}
 				await pipe.maybeSendAuth()
 			}
 			return

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@steve02081504/fount-p2p",
-	"version": "0.0.49",
+	"version": "0.0.51",
 	"description": "fount federation P2P layer — link, trust graph, mailbox, DAG, EVFS.",
 	"keywords": [
 		"network",

package/transport/runtime_bootstrap.mjs

@@ -15,7 +15,7 @@ import {
 	createNostrDiscoveryProvider,
 	resolveNostrRelayUrls,
 } from '../discovery/nostr/index.mjs'
-import { getListenRelays, getWorkingRelays, loadRelayPool, startNostrRelayDiscovery } from '../discovery/nostr/relays.mjs'
+import { getWorkingRelays, loadRelayPool, startNostrRelayDiscovery } from '../discovery/nostr/relays.mjs'
 import { createBleGattLinkProvider } from '../link/providers/ble_gatt.mjs'
 import {
 	listLinkProviders,
@@ -188,7 +188,7 @@ export function createRuntimeBootstrap(deps) {
 						.filter(entry => entry.rttMs != null)
 						.slice(0, MAX_ADVERT_RELAY_POOL)
 						.map(entry => ({ url: entry.url, rttMs: entry.rttMs })),
-					listen: getListenRelays().map(entry => entry.url),
+					listen: resolveNostrRelayUrls(),
 				}
 				: { pool: [], listen: [] },
 		)