fleetmesh-node 0.2.0__py3-none-any.whl

node/planes/store/sync/initiator.py

@@ -0,0 +1,128 @@
+"""The initiator: `pull` runs one sync/1.0 session against a peer under the
+grant it issued us, keeps the evidence a report could carry, and never
+files a finding for a peer that merely went quiet."""
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from fleetmesh_core.storage import store, sync
+from node.storage import grants as grants_mod
+from .envelope import _thid, verified_events
+from .shape import SyncSessionResult, SyncShape
+
+
+class InitiatorMixin:
+    # ---- initiator ---------------------------------------------------------
+    def pull(
+        self: SyncShape,
+        peer_pk: str,
+        shard: str,
+        interest: Mapping[str, Any],
+        since: int = 0,
+        until: int = 2 ** 31,
+        timeout: float = 30.0,
+        max_messages: int = 64,
+    ) -> SyncSessionResult:
+        """Reconcile one shard with a peer under the grant it issued us."""
+        grant = self._grant(peer_pk, grants_mod.RECEIVED)
+        sess = sync.Session(self.store, grant, shard, interest, since, until, self.clock(), is_initiator=True)
+        sess.thid = _thid(shard)
+        self._initiated.add(sess.thid)       # the oldest forgotten at the store's bound
+        q = self.transport.listen(sess.thid)
+        evidence: list[Mapping[str, Any]] = []
+        status: str = 'aborted'
+        try:
+            m = sess.open()
+            for _ in range(max_messages):
+                self._send(m, peer_pk)
+                try:
+                    inbound = q.get(timeout=timeout)
+                except Exception:
+                    # No finding. A peer that stops answering mid-session has
+                    # told us nothing about its honesty: the specification's own
+                    # partition rule is that a dead node and a quiet one cannot
+                    # be told apart, and that a peer MUST NOT be reported
+                    # unreachable until every shared transport rung has failed.
+                    # This filed an S2, so an operator restarting their node
+                    # earned a misreport finding at every peer that happened to
+                    # be mid-sync - ordinary operations priced as misbehaviour.
+                    # Whatever traffic did move is still measured, and if it
+                    # went unaccounted the window closes on it as active
+                    # silence, which is the mechanism that exists for this.
+                    self._record(self.aborted, (peer_pk, sess.thid))
+                    # A peer that stopped answering is a partition, never a
+                    # finding - the specification's own rule. Recorded so the
+                    # node is readier for the next one rather than discarded.
+                    #
+                    # Unless the peer said it was going. A reserve is a
+                    # function of the directions stress came from, and a
+                    # departure this node was told about in advance is not
+                    # stress from that direction: thickening against it would
+                    # make an orderly retirement cost its peers exactly what
+                    # the retirement exists to save them.
+                    presence = self.presence
+                    announced = presence is not None and presence.is_retiring(peer_pk)
+                    if self.strain is not None and not announced:
+                        self.strain.record('partition', peer=peer_pk, shard=getattr(sess, 'shard', None))
+                    break
+                reply = inbound.message
+                self._seen(peer_pk, reply)
+                kind = reply['type'].rsplit('/', 1)[1]
+                if kind == 'done':
+                    status = reply['body'].get('status')
+                    break
+                if kind == 'deliver':
+                    events, envelopes = verified_events(reply, sess.findings)
+                    reply = dict(reply, body=dict(reply['body'], events=events, count=len(events)))
+                    # What the reference will refuse as outside the interest is
+                    # the evidence a report carries, so keep it before it does -
+                    # with its envelope, which the sender signed even when it
+                    # did not write the event.
+                    evidence += [{'event': e, 'envelope': envelopes.get(e['id'])}
+                                 for e in events if not store.matches(e, sess.interest)]
+                if kind not in ('range', 'deliver'):
+                    sess._finding('S2', 'unexpected sync message %r' % kind)
+                    break
+                if kind == 'deliver' and hasattr(self.store, 'note_origin'):
+                    for e in reply['body']['events']:
+                        self.store.note_origin(e['id'], self.store.MESH)
+                m = getattr(sess, 'on_' + kind)(reply)
+                if kind == 'deliver' and sess.forged:
+                    evidence += [{'event': e, 'envelope': envelopes.get(e.get('id'))} for e in sess.forged]
+                if m['type'].endswith('/done'):
+                    self._send(m, peer_pk)
+                    status = m['body'].get('status')
+                    break
+            else:
+                sess._finding('S2', 'session did not terminate in %d messages' % max_messages)
+                status = 'aborted'
+        finally:
+            self.transport.unlisten(sess.thid)
+            # A handover follows the done on this same thread, and it can
+            # arrive in the gap between the done going out and the listener
+            # coming down. Anything still queued there is unsolicited now,
+            # so it goes where unsolicited messages go.
+            while True:
+                try:
+                    late = q.get_nowait()
+                except Exception:
+                    break
+                self.transport.inbox.put(late)
+        result: SyncSessionResult = {
+            'status': status,
+            'counters': dict(sess.counters),
+            'findings': list(sess.findings),
+            'need': sorted(getattr(sess, 'need', [])),
+            'dup_ratio': sess.dup_ratio(),
+            'thid': sess.thid,
+            'evidence': evidence,
+            'grant': grant.event_id,
+        }
+        with self._lock:
+            self._record(self.completed, (peer_pk, 'initiator', result))
+        if self.budget is not None:
+            self.budget.observe_session(peer_pk, 'initiator', result)
+        for cb in self.on_session:
+            cb(peer_pk, 'initiator', result)
+        return result
+

node/planes/store/sync/responder.py

@@ -0,0 +1,114 @@
+"""The responder: `handle` takes one inbound sync/1.0 message, enforces the
+grant (not just measures it), bounds sessions per peer, and answers in the
+wire form - events in the signed attachment, the count in the body."""
+from __future__ import annotations
+
+import os
+from typing import Any, Mapping, Optional
+
+from fleetmesh_core.wire import validate
+from node.storage import grants as grants_mod
+from .envelope import MAX_SESSIONS_PER_PEER, PIURI, SyncError, envelope_attachment
+from .shape import SyncShape
+
+
+class ResponderMixin:
+    def _refuse_open(self: SyncShape, peer_pk: str, thid: Optional[str], why: str) -> tuple[Any, ...]:
+        """Refuse a session with a done, so the peer stops waiting, and say why."""
+        self._record(self.refused, (peer_pk, thid, why))
+        self.refusals.refuse('session', why, subject=peer_pk)
+        reply = {'id': 'sync-refuse-%s' % os.urandom(4).hex(), 'type': PIURI + '/done', 'thid': thid,
+                 'body': {'status': 'aborted', 'events_transferred': 0}}
+        self._send(reply, peer_pk)
+        return ('refused', peer_pk, why)
+
+    def _precheck(self: SyncShape, inbound: Any, kind: str) -> tuple[Optional[Mapping[str, Any]], str, Optional[tuple[Any, ...]]]:
+        msg = getattr(inbound, 'message', inbound)
+        peer_pk = getattr(inbound, 'sender', msg.get('from', '') if isinstance(msg, dict) else '')
+        self._seen(peer_pk, msg)
+        why = validate.check_body('sync', kind, msg.get('body'))
+        if why is not None:
+            self.rejected.append((peer_pk, kind, why))
+            return None, peer_pk, ('ignored', peer_pk, 'malformed %s: %s' % (kind, why))
+        self._expire(self.clock())
+        return msg, peer_pk, None
+
+    def _send_reply(self: SyncShape, thid: Optional[str], peer_pk: str, sess: Any, reply: Mapping[str, Any]) -> tuple[Any, ...]:
+        if reply['type'].endswith('/deliver'):
+            events = reply['body']['events']
+            reply = dict(reply, body={'count': len(events)},
+                         attachments=[envelope_attachment(events, self.ks.did,
+                                                           self.ks.node_sk, self.clock())])
+        if reply['type'].endswith('/done'):
+            status = reply['body'].get('status')
+            self._finish(thid or '', peer_pk, sess, status)
+            self._send(reply, peer_pk)
+            offered = self._offer_handover(thid or '', peer_pk, sess, status)
+            return ('done', peer_pk, status) + ((offered,) if offered else ())
+        self._send(reply, peer_pk)
+        return ('replied', peer_pk, reply['type'].rsplit('/', 1)[1])
+
+    def handle_handover(self: SyncShape, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]:
+        msg, peer_pk, err = self._precheck(inbound, 'handover')
+        if err is not None or msg is None:
+            return err
+        return self._accept_handover(peer_pk, msg['body'])
+
+    def handle_open(self: SyncShape, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]:
+        msg, peer_pk, err = self._precheck(inbound, 'open')
+        if err is not None or msg is None:
+            return err
+        thid = str(msg.get('thid') or '')
+        try:
+            grant = self._grant(peer_pk, grants_mod.ISSUED)
+        except SyncError as e:
+            return ('ignored', peer_pk, str(e))
+        body = msg['body']
+        with self._lock:
+            mine = sum(1 for v in self.sessions.values() if v[0] == peer_pk)
+        if mine >= MAX_SESSIONS_PER_PEER:
+            return self._refuse_open(peer_pk, thid, 'too many open sessions')
+        refuse_why = self.budget.refuses(peer_pk) if self.budget is not None else None
+        if refuse_why is not None:
+            return self._refuse_open(peer_pk, thid, refuse_why)
+        sess = self.session_cls(self.store, grant, body['shard'], body.get('filter'), body.get('since', 0),
+                                body.get('until', 2 ** 31), self.clock(), is_initiator=False)
+        sess.thid = thid
+        with self._lock:
+            kept = self.sessions.put(thid, (peer_pk, sess, self.clock()))
+        if not kept:
+            return self._refuse_open(peer_pk, thid, 'this node has too many open sessions')
+        reply = sess.on_open(msg)
+        return self._send_reply(thid, peer_pk, sess, reply)
+
+    def _dispatch_session(self: SyncShape, inbound: Any, kind: str) -> Optional[tuple[Any, ...]]:
+        msg, peer_pk, err = self._precheck(inbound, kind)
+        if err is not None or msg is None:
+            return err
+        thid = str(msg.get('thid') or '')
+        if not thid:
+            return ('ignored', peer_pk, 'no such session')
+        with self._lock:
+            entry = self.sessions.get(thid)
+            if entry is not None:
+                self.sessions[thid] = (entry[0], entry[1], self.clock())
+        if entry is None or entry[0] != peer_pk:
+            return ('ignored', peer_pk, 'no such session')
+        sess = entry[1]
+        if kind == 'done':
+            status = msg['body'].get('status')
+            self._finish(thid or '', peer_pk, sess, status)
+            offered = self._offer_handover(thid or '', peer_pk, sess, status)
+            return ('done', peer_pk, status) + ((offered,) if offered else ())
+        reply = getattr(sess, 'on_' + kind)(msg)
+        return self._send_reply(thid, peer_pk, sess, reply)
+
+    def handle_range(self: SyncShape, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]:
+        return self._dispatch_session(inbound, 'range')
+
+    def handle_need(self: SyncShape, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]:
+        return self._dispatch_session(inbound, 'need')
+
+    def handle_done(self: SyncShape, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]:
+        return self._dispatch_session(inbound, 'done')
+

node/planes/store/sync/rules.py

@@ -0,0 +1,179 @@
+"""What this node will sign for, and what it will take somebody's word on.
+
+The handover is the one shape of `asserted` a node may publish over a set it
+did not receive first-hand, and acting on one touches two compartments: the
+sync wire, which offers and accepts them over the wire, and discovery, which
+publishes the claim that rests on one. The rules were written in both places
+and a third copy sat in `validate`, so "what makes a handover acceptable" had
+three homes and no single answer.
+
+They live here, as decisions over plain data. Nothing in this module signs,
+sends, stores or refuses: the compartments keep all of that, because the key,
+the transport, the account store and the refusal channel are theirs. What
+they get back is a verdict and a reason for it, and the reason is what the
+operator reads.
+
+`fleetmesh_core/coverage.py` owns the artefact - its shape, its signature, and the chain
+rules every reader applies. This owns the part that is about *this* node: the
+shard it was configured to hold, the set on its own shelves, the session that
+just closed, and the operator's `handover` setting.
+"""
+from __future__ import annotations
+
+import json
+from typing import Any, Mapping, Optional, Sequence, cast
+
+from fleetmesh_core.wire.wire_types import HandoverLink
+from fleetmesh_core.peering import coverage
+from fleetmesh_core.storage import replication
+from .types import CoverageShardConfig
+
+
+def canonical(filt: Any) -> str:
+    """A filter as the artefact carries it. Two filters that differ only in
+    key order are one filter, and a handover that compared them as written
+    would refuse a peer for having sorted its JSON differently."""
+    return json.dumps(filt, sort_keys=True, separators=(',', ':'))
+
+
+# The shape check for a handover body is core's, `validate.check_handover_body`,
+# which the sync responder already applies through validate.check_body. A copy
+# of it lived here, unused by anything, with the boolean-as-integer hole core
+# has since closed (audit 2026-10-15, D1 and B9).
+
+
+def offered_set(
+    claim: Optional[Mapping[str, Any]],
+    session: Any,
+    now: int,
+    setting: str = 'offer',
+    status: Any = 'complete',
+) -> tuple[Optional[str], Optional[str]]:
+    """(fingerprint, why_not) for a session that may have earned a handover.
+
+    Every condition is about what this node has already said in public. The
+    claim is the kind 30803 last published: asserted, with a bounded range
+    that has closed, and the session covered the whole of that range under
+    that same filter, so the peer now holds the set the claim is about. A node
+    that published best-effort, or whose range is still open, has nothing it
+    can sign for.
+
+    `why_not` is for the operator and not for the wire. Most of these are the
+    ordinary case - a session that reconciled part of a shard has earned
+    nothing and there is nothing wrong with that - so a caller logs at most
+    the ones it asked about.
+    """
+    if status not in ('complete', 'in_sync'):
+        return None, 'the session ended %s' % status
+    if setting != 'offer':
+        return None, 'the operator does not offer handovers'
+    if claim is None or not coverage.reportable(dict(claim)):
+        return None, 'this node publishes no asserted claim for the shard'
+    from fleetmesh_core.storage import store as ref_store
+    until = ref_store.first_tag(claim, 'until')
+    if not until or len(until) < 2:
+        return None, 'the claim has no until: a handover signs for a closed set'
+    filt = ref_store.first_tag(claim, 'filter')
+    fp = ref_store.first_tag(claim, 'fingerprint')
+    if not filt or len(filt) < 2 or not fp or len(fp) < 2:
+        # An asserted claim always carries both; one without them was not
+        # written by fleetmesh_core.peering.coverage and nothing can be signed for it.
+        return None, 'the claim carries no filter or fingerprint'
+    since_tag = ref_store.first_tag(claim, 'since')
+    c_since = int(since_tag[1]) if since_tag and len(since_tag) > 1 else 0
+    c_until = int(until[1])
+    if c_until > now:
+        return None, 'the claim range has not closed yet'
+    if session.since > c_since or session.until < c_until:
+        return None, 'the session did not cover the whole of the claim range'
+    if canonical(session.interest) != canonical(json.loads(filt[1])):
+        return None, 'the session ran under a different filter'
+    return fp[1], None
+
+
+def extend(held: Sequence[HandoverLink | Mapping[str, Any]], link: HandoverLink | Mapping[str, Any]) -> tuple[Optional[list[HandoverLink]], Optional[str]]:
+    """(chain_to_send, why_not): what this node holds, plus its own link.
+
+    A node passing on a shard it holds under a handover passes on the whole
+    provenance with it. Carrying only its own link would leave the node that
+    withheld an event able to report the hole against the node below, liable
+    for it and unbarred from reporting it. The chain is checked before it
+    goes: one this node cannot stand behind is one it should not sign onto.
+    """
+    chain = [dict(h) for h in held] + [dict(link)]
+    if len(chain) > coverage.HANDOVER_MAX_CHAIN:
+        return None, 'the chain would be %d links, longer than %d' % (len(chain), coverage.HANDOVER_MAX_CHAIN)
+    problems = coverage.check_chain(chain)
+    if problems:
+        return None, problems[0]
+    return cast(list[HandoverLink], chain), None
+
+
+def acceptable(
+    chain: Sequence[Mapping[str, Any]],
+    me: str,
+    sender: str,
+    shard_config: Optional[Mapping[str, Any]],
+    held_ids: Optional[Sequence[str]],
+) -> Optional[str]:
+    """Why this node must not keep an inbound chain, or None to keep it.
+
+    Held to more than its signatures. Every link must verify and the chain
+    must join up and describe one set, which is `fleetmesh_core/coverage.py`'s business.
+    Then: the last link names this node, it was signed by the peer that sent
+    it, the shard is one the operator configured with that same filter, and
+    the set fingerprints to what this node holds over the handed range right
+    now. A chain over any other set could only ever support a false claim,
+    and refusing it costs less than publishing one and dropping it next tick.
+
+    `held_ids` is what this node holds over the handed range, or None when the
+    caller could not look - the shard is unconfigured and the answer is
+    already no.
+    """
+    if not chain:
+        return 'the chain is empty'
+    problems: list[str] = []
+    for link in chain:
+        problems += coverage.check_handover(link)
+    problems += coverage.check_chain(chain)
+    if problems:
+        return problems[0]
+    art = chain[-1]
+    if art['to'] != me:
+        return 'names %s, not this node' % art['to'][:16]
+    if art['from'] != sender:
+        return 'signed by %s and sent by %s' % (art['from'][:16], sender[:16])
+    if shard_config is None:
+        return 'shard %s is not one this node claims' % art['shard']
+    if canonical(shard_config.get('filter')) != art['filter']:
+        return 'the handed filter is not the one configured for %s' % art['shard']
+    if held_ids is None:
+        return 'this node cannot say what it holds for %s' % art['shard']
+    if replication.fingerprint(held_ids) != art['fingerprint'] or len(held_ids) != art['count']:
+        return ('what this node holds over the handed range is not the handed set (%d held, %d handed)'
+                % (len(held_ids), art['count']))
+    return None
+
+
+def still_fits(chain: Sequence[Mapping[str, Any]], filt: Any, held_ids: Sequence[str]) -> Optional[str]:
+    """Why a chain this node holds no longer describes what it holds, or None.
+
+    Asked every time the claim goes out. A handover fits while the set this
+    node holds over the handed range, under the handed filter, fingerprints to
+    what was handed; the moment a late event lands in the closed range or
+    retention takes one out, the only claim it could support is a false one.
+    """
+    art = chain[-1]
+    if canonical(filt) != art['filter']:
+        return 'the filter is not the handed one'
+    if replication.fingerprint(held_ids) != art['fingerprint'] or len(held_ids) != art['count']:
+        return 'what this node holds over the handed range is no longer the handed set'
+    return None
+
+
+def shard_config(coverage_config: Any, shard: str) -> Optional[CoverageShardConfig]:
+    """The operator's entry for one shard, or None if they configured none."""
+    for c in coverage_config or []:
+        if isinstance(c, dict) and c.get('shard') == shard:
+            return cast(CoverageShardConfig, c)
+    return None

node/planes/store/sync/shape.py

@@ -0,0 +1,80 @@
+"""The shape of a SyncPeer as its mixins see it.
+
+Split across core.py, initiator.py, responder.py and handover.py the way
+node/reporter/ and node/peering_wire/ are: each mixin annotates `self` as
+this Protocol. A declaration only; SyncPeer satisfies it structurally.
+"""
+from __future__ import annotations
+
+import threading
+from typing import Any, Callable, Mapping, Optional, Protocol
+
+from fleetmesh_core.wire.interfaces import NostrEvent
+from fleetmesh_core.wire.wire_types import HandoverLink, SyncHandoverBody
+from node.compartment import Refusals
+from node.compartment import stores as st
+
+
+from .types import (
+    SyncSessionResult,
+)
+
+
+class SyncShape(Protocol):
+    TROUBLE_WINDOW: int
+    refusals: Refusals
+    node: Any
+    strain: Optional[Any]
+    accounts: Optional[Any]
+    discovery: Optional[Any]
+    presence: Optional[Any]
+    session_cls: Any
+    ks: Any
+    store: Any
+    transport: Any
+    wire_client: Any
+    grants: Any
+    clock: Callable[[], int]
+    budget: Optional[Any]
+    on_session: list[Callable[[str, str, SyncSessionResult], Any]]
+    totals: st.Counters
+    aborted: st.Ring[tuple[str, str]]
+    refused: st.Ring[tuple[str, Optional[str], str]]
+    sessions: st.Table[str, tuple[str, Any, int]]
+    _initiated: st.Members[str]
+    rejected: st.Ring[tuple[str, str, str]]
+    unsent: st.Ring[tuple[str, str, str, int]]
+    completed: st.Ring[tuple[str, str, SyncSessionResult]]
+    handed: st.Ring[tuple[str, str, str, int]]
+    held: st.Ring[tuple[str, str, int]]
+    _offered: st.Table[tuple[str, str], str]
+    _lock: threading.Lock
+
+    # Compartment
+    def config(self, key: str, default: Any = None) -> Any: ...
+    def say(self, name: str, *args: Any, **kw: Any) -> Any: ...
+
+    # core.py
+    def _grant(self, peer_pk: str, direction: str) -> Any: ...
+    def _send(self, m: Mapping[str, Any], peer_pk: str) -> dict[str, tuple[bool, str]]: ...
+    def _seen(self, peer_pk: str, m: Mapping[str, Any]) -> None: ...
+    def _expire(self, now: int) -> list[str]: ...
+    def _finish(self, thid: str, peer_pk: str, sess: Any, status: Any) -> None: ...
+    def _record(self, ring: 'st.Ring[Any]', entry: tuple[Any, ...]) -> None: ...
+
+    # responder.py
+    def _refuse_open(self, peer_pk: str, thid: Optional[str], why: str) -> tuple[Any, ...]: ...
+    def _precheck(self, inbound: Any, kind: str) -> tuple[Optional[Mapping[str, Any]], str, Optional[tuple[Any, ...]]]: ...
+    def _send_reply(self, thid: Optional[str], peer_pk: str, sess: Any, reply: Mapping[str, Any]) -> tuple[Any, ...]: ...
+    def _dispatch_session(self, inbound: Any, kind: str) -> Optional[tuple[Any, ...]]: ...
+    def handle_open(self, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]: ...
+    def handle_handover(self, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]: ...
+    def handle_range(self, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]: ...
+    def handle_need(self, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]: ...
+    def handle_done(self, inbound: Any, sender: str) -> Optional[tuple[Any, ...]]: ...
+
+    # handover.py
+    def _offer_handover(self, thid: str, peer_pk: str, sess: Any, status: Any) -> Optional[str]: ...
+    def _unoffer(self, key: tuple[str, str], previous: Optional[str], entry: tuple[Any, ...]) -> None: ...
+    def _chain_for(self, shard: str, claim: NostrEvent, peer_pk: str, now: int) -> Optional[list[HandoverLink]]: ...
+    def _accept_handover(self, peer_pk: str, body: SyncHandoverBody) -> tuple[Any, ...]: ...

node/planes/store/sync/types.py

@@ -0,0 +1,51 @@
+"""Types and records for the Sync compartment."""
+from __future__ import annotations
+
+from typing import Any, Mapping, Optional, TypedDict
+
+
+class SyncSessionResult(TypedDict, total=False):
+    """Result of a sync session (initiator or responder)."""
+    status: str
+    counters: Mapping[str, int]
+    findings: list[tuple[Any, ...]]
+    need: list[str]
+    dup_ratio: float
+    thid: str
+    evidence: list[Mapping[str, Any]]
+    grant: Optional[str]
+
+
+class SyncHandedRow(TypedDict, total=False):
+    peer: str
+    shard: str
+    at: int
+
+
+class SyncStateReport(TypedDict, total=False):
+    """The report SyncPeer.state() gives of itself."""
+    open: int
+    refused: int
+    aborted: int
+    completed: int
+    unsent: int
+    malformed: int
+    handed: list[SyncHandedRow]
+    held: list[SyncHandedRow]
+
+
+class CoverageShardConfig(TypedDict, total=False):
+    """Configuration for a coverage shard."""
+    shard: str
+    filter: Mapping[str, Any]
+    since: int
+    until: int
+    cadence: int
+
+
+class SyncTotals(TypedDict):
+    """Sessions since the process started, by how they ended. `state` has
+    always reported these as counts; the rings beside them keep the recent."""
+    aborted: int
+    refused: int
+    completed: int

node/planes/transport/__init__.py

@@ -0,0 +1,23 @@
+"""Transport plane: link, lan, p2p, mediation, bridge."""
+from . import bridge, lan, link, mediation, p2p
+from .bridge.compartment import DEFAULT_EGRESS_KINDS, DEFAULT_INGRESS_KINDS, RelayBridge
+from .lan.compartment import Lan
+from .link.compartment import Link, LinkState
+from .mediation.compartment import Mediation
+from .p2p.compartment import P2PTransport
+
+__all__ = [
+    'DEFAULT_EGRESS_KINDS',
+    'DEFAULT_INGRESS_KINDS',
+    'Lan',
+    'Link',
+    'LinkState',
+    'Mediation',
+    'P2PTransport',
+    'RelayBridge',
+    'bridge',
+    'lan',
+    'link',
+    'mediation',
+    'p2p',
+]

node/planes/transport/bridge/__init__.py

@@ -0,0 +1,13 @@
+"""Universal Nostr Relay Bridge for fleetmesh.
+
+One-module compartment: everything is in compartment.py.
+
+The package is `relay_bridge` and the compartment is still called `bridge`:
+the name is the config key, the `meshnode bridge` verb and the health key an
+operator already uses, so it stays. The package moved so that "bridge" in a
+path means a compartment fronting a sidecar (node/sidecar_bridge), and this -
+which fronts relays, not a sidecar process - says what it bridges.
+"""
+from .compartment import RelayBridge
+
+__all__ = ['RelayBridge']