From 74245e80ac2893f299b8de46712d96822b184d7e Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Fri, 17 Jul 2026 01:32:49 +0000 Subject: [PATCH 1/2] peer: remove the dead PeerSlot enum and PeerConnection resend API PeerSlot (and its entire impl surface) was referenced only by its own module tests and the lib.rs re-export; peer storage has always used the separate connections/peers maps. PeerConnection's resend_count/ next_resend_at_ms/record_resend delegations had no production callers: the live resend counter is machine-sourced (connection_resend_count reads the per-peer machine), and the FSP session layer uses SessionEntry's own methods. ConnectionState::next_resend_at_ms is now test-only (its remaining callers are the fmp state unit tests) and marked cfg(test). The PeerSlot unit tests go with the enum; test_resend_count_tracking is dropped because the delegation target's schedule arithmetic is already covered by the fmp resend_bookkeeping test. --- src/lib.rs | 4 +- src/node/tests/handshake.rs | 27 ------ src/peer/connection.rs | 15 ---- src/peer/mod.rs | 167 ------------------------------------ src/proto/fmp/state.rs | 1 + 5 files changed, 2 insertions(+), 212 deletions(-) diff --git a/src/lib.rs b/src/lib.rs index 47210f8..5938477 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -92,9 +92,7 @@ pub use cache::{CacheEntry, CacheError, CacheStats, CoordCache}; pub use proto::fmp::{PromotionResult, cross_connection_winner}; // Re-export peer types -pub use peer::{ - ActivePeer, ConnectivityState, HandshakeState, PeerConnection, PeerError, PeerSlot, -}; +pub use peer::{ActivePeer, ConnectivityState, HandshakeState, PeerConnection, PeerError}; // Re-export node types pub use node::{Node, NodeError, NodeState, UpdatePeersOutcome}; diff --git a/src/node/tests/handshake.rs b/src/node/tests/handshake.rs index 9dcc0a2..dd241bb 100644 --- a/src/node/tests/handshake.rs +++ b/src/node/tests/handshake.rs @@ -819,8 +819,6 @@ async fn test_msg1_stored_for_resend() { // Verify stored msg1 matches what was built assert_eq!(conn.handshake_msg1().unwrap(), &wire_msg1); - assert_eq!(conn.resend_count(), 0); - assert!(conn.next_resend_at_ms() > now_ms); } /// Test that resend scheduling respects max_resends and backoff. @@ -993,31 +991,6 @@ fn test_msg2_stored_on_connection() { assert_eq!(conn.handshake_msg2().unwrap(), &msg2_bytes); } -/// Test that resend_count and next_resend_at_ms track correctly. -#[test] -fn test_resend_count_tracking() { - let peer_identity = make_peer_identity(); - let mut conn = PeerConnection::outbound(LinkId::new(1), peer_identity, 1000); - - assert_eq!(conn.resend_count(), 0); - assert_eq!(conn.next_resend_at_ms(), 0); - - // Simulate storing msg1 and scheduling first resend - conn.set_handshake_msg1(vec![0x01], 2000); - assert_eq!(conn.resend_count(), 0); - assert_eq!(conn.next_resend_at_ms(), 2000); - - // Record first resend - conn.record_resend(4000); // next at 4000 (2s backoff) - assert_eq!(conn.resend_count(), 1); - assert_eq!(conn.next_resend_at_ms(), 4000); - - // Record second resend - conn.record_resend(8000); // next at 8000 (4s backoff) - assert_eq!(conn.resend_count(), 2); - assert_eq!(conn.next_resend_at_ms(), 8000); -} - /// Test that duplicate msg2 is silently dropped when pending_outbound is already cleared. #[tokio::test] async fn test_duplicate_msg2_dropped() { diff --git a/src/peer/connection.rs b/src/peer/connection.rs index a0c87eb..3db97b9 100644 --- a/src/peer/connection.rs +++ b/src/peer/connection.rs @@ -237,21 +237,6 @@ impl PeerConnection { self.state.handshake_msg2() } - /// Number of resends performed. - pub fn resend_count(&self) -> u32 { - self.state.resend_count() - } - - /// When the next resend is scheduled (Unix ms). - pub fn next_resend_at_ms(&self) -> u64 { - self.state.next_resend_at_ms() - } - - /// Record a resend and schedule the next one. - pub fn record_resend(&mut self, next_resend_at_ms: u64) { - self.state.record_resend(next_resend_at_ms); - } - // === Noise Handshake Operations (shell: drives crypto, updates pure state) === /// Start the handshake as initiator and generate message 1. diff --git a/src/peer/mod.rs b/src/peer/mod.rs index 87c7db9..65e2c33 100644 --- a/src/peer/mod.rs +++ b/src/peer/mod.rs @@ -3,9 +3,6 @@ //! Two-phase peer lifecycle: //! 1. **PeerConnection** - Handshake phase, before identity is verified //! 2. **ActivePeer** - Authenticated phase, after successful Noise handshake -//! -//! The PeerSlot enum represents either phase, enabling unified storage -//! while maintaining type safety for phase-specific operations. mod active; #[cfg(any(target_os = "linux", target_os = "macos"))] @@ -18,7 +15,6 @@ pub use connection::{HandshakeState, PeerConnection}; use crate::NodeAddr; use crate::transport::LinkId; -use std::fmt; use thiserror::Error; // ============================================================================ @@ -62,127 +58,12 @@ pub enum PeerError { MaxPeersExceeded { max: usize }, } -// ============================================================================ -// PeerSlot -// ============================================================================ - -/// A slot in the peer table, representing either connection or active phase. -#[derive(Debug)] -pub enum PeerSlot { - /// Connection in handshake phase. - Connecting(Box), - /// Authenticated peer. - Active(Box), -} - -impl PeerSlot { - /// Create a new connecting slot (outbound). - pub fn outbound(conn: PeerConnection) -> Self { - PeerSlot::Connecting(Box::new(conn)) - } - - /// Create a new connecting slot (inbound). - pub fn inbound(conn: PeerConnection) -> Self { - PeerSlot::Connecting(Box::new(conn)) - } - - /// Create a new active slot. - pub fn active(peer: ActivePeer) -> Self { - PeerSlot::Active(Box::new(peer)) - } - - /// Check if this is a connecting slot. - pub fn is_connecting(&self) -> bool { - matches!(self, PeerSlot::Connecting(_)) - } - - /// Check if this is an active slot. - pub fn is_active(&self) -> bool { - matches!(self, PeerSlot::Active(_)) - } - - /// Get the link ID for this slot. - pub fn link_id(&self) -> LinkId { - match self { - PeerSlot::Connecting(conn) => conn.link_id(), - PeerSlot::Active(peer) => peer.link_id(), - } - } - - /// Get as connection reference, if connecting. - pub fn as_connection(&self) -> Option<&PeerConnection> { - match self { - PeerSlot::Connecting(conn) => Some(conn), - PeerSlot::Active(_) => None, - } - } - - /// Get as mutable connection reference, if connecting. - pub fn as_connection_mut(&mut self) -> Option<&mut PeerConnection> { - match self { - PeerSlot::Connecting(conn) => Some(conn), - PeerSlot::Active(_) => None, - } - } - - /// Get as active peer reference, if active. - pub fn as_active(&self) -> Option<&ActivePeer> { - match self { - PeerSlot::Active(peer) => Some(peer), - PeerSlot::Connecting(_) => None, - } - } - - /// Get as mutable active peer reference, if active. - pub fn as_active_mut(&mut self) -> Option<&mut ActivePeer> { - match self { - PeerSlot::Active(peer) => Some(peer), - PeerSlot::Connecting(_) => None, - } - } - - /// Get the known node_addr, if any. - /// - /// For connections, this is the expected identity (may be None for inbound). - /// For active peers, this is always known. - pub fn node_addr(&self) -> Option<&NodeAddr> { - match self { - PeerSlot::Connecting(conn) => conn.expected_identity().map(|id| id.node_addr()), - PeerSlot::Active(peer) => Some(peer.node_addr()), - } - } -} - -impl fmt::Display for PeerSlot { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - match self { - PeerSlot::Connecting(conn) => { - write!( - f, - "connecting(link={}, state={})", - conn.link_id(), - conn.handshake_state() - ) - } - PeerSlot::Active(peer) => { - write!( - f, - "active(node={:?}, link={})", - peer.node_addr(), - peer.link_id() - ) - } - } - } -} - // ============================================================================ // Tests // ============================================================================ #[cfg(test)] mod tests { - use super::*; use crate::proto::fmp::PromotionResult; use crate::transport::LinkId; use crate::{Identity, PeerIdentity}; @@ -192,32 +73,6 @@ mod tests { PeerIdentity::from_pubkey(identity.pubkey()) } - #[test] - fn test_peer_slot_connecting() { - let identity = make_peer_identity(); - let conn = PeerConnection::outbound(LinkId::new(1), identity, 1000); - let slot = PeerSlot::Connecting(Box::new(conn)); - - assert!(slot.is_connecting()); - assert!(!slot.is_active()); - assert!(slot.as_connection().is_some()); - assert!(slot.as_active().is_none()); - assert_eq!(slot.link_id(), LinkId::new(1)); - } - - #[test] - fn test_peer_slot_active() { - let identity = make_peer_identity(); - let peer = ActivePeer::new(identity, LinkId::new(2), 2000); - let slot = PeerSlot::Active(Box::new(peer)); - - assert!(!slot.is_connecting()); - assert!(slot.is_active()); - assert!(slot.as_connection().is_none()); - assert!(slot.as_active().is_some()); - assert_eq!(slot.link_id(), LinkId::new(2)); - } - #[test] fn test_promotion_result_promoted() { let identity = make_peer_identity(); @@ -255,26 +110,4 @@ mod tests { assert!(!result.should_close_this_connection()); assert_eq!(result.link_to_close(), Some(LinkId::new(1))); } - - #[test] - fn test_peer_slot_node_addr() { - // Outbound connection knows expected identity - let identity = make_peer_identity(); - let expected_node_addr = *identity.node_addr(); - let conn = PeerConnection::outbound(LinkId::new(1), identity, 1000); - let slot = PeerSlot::Connecting(Box::new(conn)); - assert_eq!(slot.node_addr(), Some(&expected_node_addr)); - - // Inbound connection doesn't know identity yet - let conn_inbound = PeerConnection::inbound(LinkId::new(2), 2000); - let slot_inbound = PeerSlot::Connecting(Box::new(conn_inbound)); - assert!(slot_inbound.node_addr().is_none()); - - // Active peer always knows identity - let identity2 = make_peer_identity(); - let active_node_addr = *identity2.node_addr(); - let peer = ActivePeer::new(identity2, LinkId::new(3), 3000); - let slot_active = PeerSlot::Active(Box::new(peer)); - assert_eq!(slot_active.node_addr(), Some(&active_node_addr)); - } } diff --git a/src/proto/fmp/state.rs b/src/proto/fmp/state.rs index 6fda549..1bf71ff 100644 --- a/src/proto/fmp/state.rs +++ b/src/proto/fmp/state.rs @@ -421,6 +421,7 @@ impl ConnectionState { } /// When the next resend is scheduled (Unix ms). + #[cfg(test)] pub fn next_resend_at_ms(&self) -> u64 { self.next_resend_at_ms } From 119b85d28e6dcbda100d49e1a723bb62a82a757f Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Fri, 17 Jul 2026 01:33:06 +0000 Subject: [PATCH 2/2] node: correct stale liveness claims in machine, executor, and timer docs Several module and field docs still described the per-peer machine as unwired shadow scaffolding. It has been live for some time: machines are inserted at dial and inbound msg1, stepped by the handshake handlers and the rekey-cadence and liveness-reap routers, and the executor's SwapSendState/CompleteDrain/InvalidateSendState arms are the authoritative paths (the inline bodies survive only as debug-assert release fallbacks). Rewrite those docs to the current truth while keeping the still-true dormancy facts: PeerEvent::Timeout and PeerEvent::Tick are never dispatched in production, retransmit fires on the machine-armed deadline while the timeout reaper keys on timer presence with the config threshold, and the remaining inert executor stubs are SendRekey, SendLinkMessage, and the connected-UDP arms. Drop the stale allow(dead_code) on the peer_machines field. --- src/node/dataplane/peer_actions.rs | 37 ++++++++++++++++++------------ src/node/handlers/handshake.rs | 7 +++--- src/node/mod.rs | 23 +++++++++++-------- src/peer/machine.rs | 28 +++++++++++++--------- 4 files changed, 57 insertions(+), 38 deletions(-) diff --git a/src/node/dataplane/peer_actions.rs b/src/node/dataplane/peer_actions.rs index bd171f6..de46ca6 100644 --- a/src/node/dataplane/peer_actions.rs +++ b/src/node/dataplane/peer_actions.rs @@ -12,14 +12,17 @@ //! (`handle_msg1` → `step(InboundMsg1)`), the outbound msg2 promote //! (`handle_msg2` looks up the dial-persisted machine), the connectionless //! outbound msg1 send (`SendHandshake` with `their_index == None` → -//! `send_stored_msg1`, driven from `initiate_connection`), and the +//! `send_stored_msg1`, driven from `initiate_connection`), the //! connection-oriented dial (`OpenTransport` performs the non-blocking //! `transport.connect`; `TransportConnected` drives the connect-resolution msg1 -//! send from `poll_pending_connects`). +//! send from `poll_pending_connects`), the rekey cadence (`check_rekey` → +//! `route_rekey_cadence` → `RekeyConsume`, driving the `SwapSendState` and +//! `CompleteDrain` arms), and the liveness reap (`route_link_dead` → +//! `LinkDeadSuspected`, driving `InvalidateSendState` → `remove_active_peer`). //! -//! Not yet driven, so their arms stay inert stubs: rekey/crypto installs, -//! link-control frames, and the connected-UDP plane. `RegisterDecryptSession` is -//! a deliberate no-op — see its arm for the note. +//! The genuine inert stubs remaining are `SendRekey`, `SendLinkMessage`, and +//! the connected-UDP arms. `RegisterDecryptSession` is a deliberate no-op — +//! see its arm for the note. //! //! The timer arms (`SetTimer`/`CancelTimer`) populate/clear the per-peer timer //! store (`peer_timers`). The `HandshakeRetransmit` and `HandshakeTimeout` @@ -386,13 +389,15 @@ impl Node { } } PeerAction::SwapSendState { .. } => { - // Initiator cutover. Reproduces the `ConnAction::Cutover` - // body in `handlers/rekey.rs:53-88` EXACTLY. `addr` is resolved + // Initiator cutover: the live authoritative rekey-cadence + // path, routed here from `check_rekey` via + // `route_rekey_cadence` → `PeerEvent::RekeyConsume`; the + // inline body survives only as `cutover_peer_inline`, a + // debug-assert release fallback. `addr` is resolved // from the ambient verified identity (as `InvalidateSendState` // does). The decrypt re-register folds HERE, gated on // `did_cutover` — the generic `RegisterDecryptSession` arm stays a - // no-op so a promote never double-registers. Shadow-only until the - // cadence fold routes here. + // no-op so a promote never double-registers. let node_addr = *ambient.verified_identity.node_addr(); let did_cutover = if let Some(peer) = self.peers.get_mut(&node_addr) { if let Some(_old_our_index) = peer.cutover_to_new_session() { @@ -436,12 +441,14 @@ impl Node { let _ = did_cutover; } PeerAction::CompleteDrain { peer: node_addr } => { - // Initiator drain completion. Reproduces the - // `ConnAction::Drain` body in `handlers/rekey.rs:90-111` EXACTLY. - // Extract the real previous index + transport_id under the peer - // borrow, drop the borrow, then run the cache_key cleanup (which - // takes &mut self for unregister_decrypt_worker_session). - // Shadow-only until the cadence fold routes here. + // Initiator drain completion: the live authoritative + // rekey-cadence path, routed here from `check_rekey` via + // `route_rekey_cadence` → `PeerEvent::RekeyConsume`; the + // inline body survives only as `drain_peer_inline`, a + // debug-assert release fallback. Extract the real previous + // index + transport_id under the peer borrow, drop the + // borrow, then run the cache_key cleanup (which takes + // &mut self for unregister_decrypt_worker_session). let drained = self.peers.get_mut(&node_addr).and_then(|peer| { peer.complete_drain().map(|idx| (idx, peer.transport_id())) }); diff --git a/src/node/handlers/handshake.rs b/src/node/handlers/handshake.rs index e479612..f87c2d9 100644 --- a/src/node/handlers/handshake.rs +++ b/src/node/handlers/handshake.rs @@ -1271,9 +1271,10 @@ impl Node { }; // The outbound Msg2 Promote step cancels the two dial-armed handshake // timers (the machine survives promotion, so they would otherwise linger - // in the driver's shadow store) and then promotes. The cancels are - // behavior-neutral at this rung — `peer_timers` is written but not yet - // driven — and `PromoteToActive` is still what performs the promotion. + // in `peer_timers` until `drive_peer_timers` lazily discards them — the + // promoted leg's `connections` entry is gone and the machine has left + // `SentMsg1`, so they can no longer fire) and then promotes. + // `PromoteToActive` is still what performs the promotion. debug_assert_eq!( promote_actions, vec![ diff --git a/src/node/mod.rs b/src/node/mod.rs index fb939b8..2770b4b 100644 --- a/src/node/mod.rs +++ b/src/node/mod.rs @@ -355,22 +355,27 @@ pub struct Node { // === Per-Peer Control Machines === /// Per-peer lifecycle control FSMs, keyed by the stable `LinkId` that spans - /// the handshake→active lifetime. A NEW parallel structure introduced by the + /// the handshake→active lifetime. A parallel structure introduced by the /// node-runtime decomposition: `connections`/`peers` stay byte-unchanged (hot - /// path pristine) and are cut over to this machine home path-by-path. Unwired - /// initially — the executor (`dataplane/peer_actions.rs`) and advance helper - /// exist but the live `handle_msg1`/`handle_msg2` path does not drive them yet; - /// the inbound cutover is wired later. - #[allow(dead_code)] + /// path pristine) and are cut over to this machine home path-by-path. + /// Machines are inserted at dial and inbound msg1, and stepped in production + /// by the handshake handlers, the rekey-cadence and liveness-reap routers, + /// and the lifecycle paths, with the executor (`dataplane/peer_actions.rs`) + /// performing the returned actions. Timer FIRING decisions remain + /// shell-side: `PeerEvent::Timeout` is never dispatched in production. peer_machines: HashMap, /// Per-peer timer store, keyed by `LinkId` then `TimerKind`, holding each /// armed timer's absolute deadline (ms). The sans-IO time-as-input backing /// for `PeerEvent::Timeout`: populated/cleared by the machine's /// `SetTimer`/`CancelTimer` actions (`dataplane/peer_actions.rs`) and dropped - /// alongside the machine through the `remove_peer_machine` choke-point. At - /// this rung it is a SHADOW of the legacy tick timers — written but not yet - /// read by any driver (the handshake-kind fold wires the reader). + /// alongside the machine through the `remove_peer_machine` choke-point. The + /// `HandshakeRetransmit`/`HandshakeTimeout` kinds are driven by + /// `drive_peer_timers` (the retransmit fires on the stored deadline; the + /// timeout reap keys on the timer's presence, with the threshold read from + /// config); the rekey/liveness kinds are still SHADOWS of their + /// own shell drivers, and the machine's `on_timeout` handlers stay dormant + /// (`PeerEvent::Timeout` is never dispatched in production). peer_timers: HashMap>, // === Peers (Active Phase) === diff --git a/src/peer/machine.rs b/src/peer/machine.rs index 9d1b8f1..2b546b8 100644 --- a/src/peer/machine.rs +++ b/src/peer/machine.rs @@ -3,9 +3,12 @@ //! The unified per-peer lifecycle state machine that folds the scattered //! `connections`/`peers`/rekey state carriers into one place. It provides the //! FSM types, the machine struct (control-tier state only), and the pure `step` -//! reducer, plus its unit tests. It is **unwired** — nothing in the codebase -//! calls it yet; the driver wiring and the send-state boundary land in later -//! commits. +//! reducer, plus its unit tests. `step` is driven in production by the +//! handshake handlers, the rekey-cadence and liveness-reap routers, and the +//! dial/lifecycle paths, with the executor in +//! `crate::node::dataplane::peer_actions` performing the returned actions. +//! Still dormant: `PeerEvent::Timeout` is never dispatched — timer FIRING +//! decisions stay with the shell drivers. //! //! ## Shape //! @@ -66,11 +69,14 @@ use crate::{NodeAddr, PeerIdentity}; // ============================================================================ // Timing placeholders // -// This module is unwired; the real intervals come from `NodeConfig` when the -// driver is wired. The `poll_*` cores already take the interval/backoff as -// arguments, so these are only used to compute `SetTimer{at_ms}` deadlines and -// the `Closed{backoff_deadline_ms}` park time. The unit tests assert on timer -// *kinds*, not exact deadlines. +// The `poll_*` cores already take the interval/backoff as arguments, so these +// are only used to compute `SetTimer{at_ms}` deadlines and the +// `Closed{backoff_deadline_ms}` park time. The handshake timers are armed +// live at dial time from these constants: the retransmit driver fires on the +// machine-armed deadline, while the timeout reaper keys on the timer's +// presence with its threshold read from `NodeConfig`, which also governs the +// reschedule cadence shell-side. The unit tests assert on timer *kinds*, not +// exact deadlines. // ============================================================================ const HANDSHAKE_RETRANSMIT_INTERVAL_MS: u64 = 1_000; @@ -1267,9 +1273,9 @@ impl PeerMachine { } fn on_tick(&mut self, now: u64) -> Vec { - // The driver evaluates due machine timers on the quantized tick and - // re-enters the Timeout{kind} handlers. This module is unwired; the - // deadline bookkeeping is threaded from the driver, so Tick is a no-op here. + // Dormant no-op: `PeerEvent::Tick` is not dispatched in production. + // The shell drivers evaluate due timer deadlines themselves, so there + // is no machine-side bookkeeping to advance here. let _ = now; Vec::new() }