Skip to content

A cold requestor's FIRST capsule fetch never relays, so the documented single command fails #322

Description

@MichaelTaylor3d

Measured on a three-machine run, dig-node v0.142.0

A cold requestor's first dign capsule fetch never relays. escalate_for returns false on its first
read for a given (capsule, peer) pair, so the first descriptor round is spent plain. The second
invocation relayed.

Why it clears the bar

A user running the documented single command sees a plain failure. They have no way to know the correct
action is "run it again" — nothing in the output says so, and a second identical command succeeding where
the first failed is the shape users read as flakiness rather than as design.

This is the honest-surface class: the command is not wrong, but its first invocation cannot do the thing it
exists to do.

The tension, stated so the fix does not break the other half

The two-phase escalation is deliberate and correct (dig-node#318): the first round goes proxy: false
so a requestor does not ask the whole connected pool to pull a capsule on its behalf before establishing
that no reachable holder exists. That bound is what keeps the relay from becoming an amplification
primitive, and it must not be removed to fix this.

So the question is not "should the first round escalate" — it should not — but what the requestor does
with a first round that found nothing.

Plausible shapes, in rough order of preference:

  1. Escalate within the same invocation once the plain round has completed and found no holder. That
    preserves the bound exactly — the plain round still happens first — while making one command sufficient.
  2. Report the state honestly if a second invocation is genuinely required, so the user is told rather
    than left guessing.
  3. Leave as-is only if there is a reason a single invocation must not escalate, in which case the docs
    must say so.

Option 1 looks right and should be checked first, since it keeps the amplification bound and removes
the surprise. But confirm the plain round genuinely completes rather than being abandoned by the ladder —
that interaction is exactly where this could go wrong.

Reproduce

Cold requestor, capsule held only by a peer reachable through a relay hop, both DIG_NODE_FORWARD_ON_MISS=1
and DIG_NODE_ONION_RELAY=1 set on the hop. First dign capsule fetch produces no relay line; the second
does.

Full topology and logs on dig_ecosystem#3128 (comment 5386909376).

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind:businessa person can DO something new, or money moves, or a shipped surface stops lying to them

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions