The early naked-unknown drop concluded what checkValidation used to conclude
after verifying a signature, but returned without any resource charge. Since
a cold probe now holds the connection's one in-flight token, that free path
is the one every further unknown naked validation on the connection takes,
so an unresolvable signing key could be replayed at no cost.
Charge feeUselessData at the drop, matching the job's charge for the same
conclusion. Also correct the duplicate-repair comment: the repair is a cache
lookup that no-ops unless some connection's probe already resolved the key,
not a check that the first probe resolved.
A cache-miss naked validation queued a probe job per hash, so a burst of
unknown signers bypassed the connection's one-in-flight token. Share that
token with the cold lookup, and do not probe while a pending candidate
occupies the slot.
Cold lookup treated the open ledger as ledger-authoritative, so an
unvalidated SetManifest could stick in ManifestCache. Unknown naked
validations also occupied the validation hash before the probe,
poisoning a later verified pair.
Probe only the validated ledger and refuse open views. Restore
drop-before-claim when no probe will run. Give cold probes their own
HashRouter domain until the signer resolves. Comments match the
settled split: paired TMManifests for live rotation, standalone
revocations, paid SetManifest for durability only.
The original design sketch had honest nodes informing senders of fresher
manifests upon receipt of stale; it was parked as an amplification
surface pending an explicit bounded one-shot model. The repair ledger is
that model, so the lane lands as one more caller of sendManifestRepair
at the singleton global-sequence guard, reusing the snapshot the guard
already fetches.
Strictly-stale only: equal-sequence arrivals are ordinary always-send
traffic and draw nothing. The trigger needs no signature verification;
safety comes from bounds, not authentication - answers are limited to
masters this node retains, once per sequence per connection via the
shared ledger, and monotone sequences make correction exchanges
converge in one round trip. A retained revocation is itself the answer:
a stale normal manifest for a revoked master draws the tombstone, giving
revocations a demand-driven re-supply path to any peer that demonstrably
still uses the dead identity. Retention, not listing, qualifies a master
for an answer.
Deferred: the legacy batch lane does not correct (singletons only); no
live-scenario control yet (the mixed old-binary connect dump is the
natural trigger); design-doc sync for the reopened corrections language
left to the integration pass.
Three scenarios on the new scripts primitives: mid-run rotation to
sequence 2 through an old relay (supersede, admission, repair re-arm);
a config-injected revocation seeded by the old node with the remaining
four of five validators holding exact quorum; and wallet-wipe recovery
through an old upstream with resumed paired forwarding. Waits are
event-driven on terminal log facts with heartbeat logging.
A naked validation that authenticates against the current cached manifest
for its signing key is an implicit request for that manifest. The recipient
returns one singleton TMManifests on the same connection, bounded by a
strand-owned per-connection repair ledger (256 rows, cleared on overflow,
at most one singleton per master/sequence). Forged, malformed, unknown, and
paired traffic draws no response. A validation with no available manifest
is still sent naked.
