Measured on a three-machine run, dig-node v0.142.0
A cold requestor's first dign capsule fetch never relays. escalate_for returns false on its first
read for a given (capsule, peer) pair, so the first descriptor round is spent plain. The second
invocation relayed.
Why it clears the bar
A user running the documented single command sees a plain failure. They have no way to know the correct
action is "run it again" — nothing in the output says so, and a second identical command succeeding where
the first failed is the shape users read as flakiness rather than as design.
This is the honest-surface class: the command is not wrong, but its first invocation cannot do the thing it
exists to do.
The tension, stated so the fix does not break the other half
The two-phase escalation is deliberate and correct (dig-node#318): the first round goes proxy: false
so a requestor does not ask the whole connected pool to pull a capsule on its behalf before establishing
that no reachable holder exists. That bound is what keeps the relay from becoming an amplification
primitive, and it must not be removed to fix this.
So the question is not "should the first round escalate" — it should not — but what the requestor does
with a first round that found nothing.
Plausible shapes, in rough order of preference:
- Escalate within the same invocation once the plain round has completed and found no holder. That
preserves the bound exactly — the plain round still happens first — while making one command sufficient.
- Report the state honestly if a second invocation is genuinely required, so the user is told rather
than left guessing.
- Leave as-is only if there is a reason a single invocation must not escalate, in which case the docs
must say so.
Option 1 looks right and should be checked first, since it keeps the amplification bound and removes
the surprise. But confirm the plain round genuinely completes rather than being abandoned by the ladder —
that interaction is exactly where this could go wrong.
Reproduce
Cold requestor, capsule held only by a peer reachable through a relay hop, both DIG_NODE_FORWARD_ON_MISS=1
and DIG_NODE_ONION_RELAY=1 set on the hop. First dign capsule fetch produces no relay line; the second
does.
Full topology and logs on dig_ecosystem#3128 (comment 5386909376).
Measured on a three-machine run, dig-node v0.142.0
A cold requestor's first
dign capsule fetchnever relays.escalate_forreturnsfalseon its firstread for a given
(capsule, peer)pair, so the first descriptor round is spent plain. The secondinvocation relayed.
Why it clears the bar
A user running the documented single command sees a plain failure. They have no way to know the correct
action is "run it again" — nothing in the output says so, and a second identical command succeeding where
the first failed is the shape users read as flakiness rather than as design.
This is the honest-surface class: the command is not wrong, but its first invocation cannot do the thing it
exists to do.
The tension, stated so the fix does not break the other half
The two-phase escalation is deliberate and correct (dig-node#318): the first round goes
proxy: falseso a requestor does not ask the whole connected pool to pull a capsule on its behalf before establishing
that no reachable holder exists. That bound is what keeps the relay from becoming an amplification
primitive, and it must not be removed to fix this.
So the question is not "should the first round escalate" — it should not — but what the requestor does
with a first round that found nothing.
Plausible shapes, in rough order of preference:
preserves the bound exactly — the plain round still happens first — while making one command sufficient.
than left guessing.
must say so.
Option 1 looks right and should be checked first, since it keeps the amplification bound and removes
the surprise. But confirm the plain round genuinely completes rather than being abandoned by the ladder —
that interaction is exactly where this could go wrong.
Reproduce
Cold requestor, capsule held only by a peer reachable through a relay hop, both
DIG_NODE_FORWARD_ON_MISS=1and
DIG_NODE_ONION_RELAY=1set on the hop. Firstdign capsule fetchproduces no relay line; the seconddoes.
Full topology and logs on dig_ecosystem#3128 (comment 5386909376).