Remove ringbuffer usage for node-to-node traffic

[Eddy Ashton (eddyashton)]

Motivation

Stacked on #8445 as the next step of the ringbuffer-removal plan (#8405 has landed). Node-to-node traffic still crosses the host-enclave ringbuffer as four messages (associate_node_address, node_outbound, node_inbound, close_node_outbound). This PR replaces them with typed interfaces.

Ready for review. The agreed design uses the existing shared task system without a critical-task class or dedicated consensus executor. Repeated green CI runs since that simplification, including the latest head, support proceeding with this design.

AdminMessage::tick remains on the ringbuffer; removing it and the remaining ringbuffer infrastructure is follow-up work.

Implementation summary

• Add a typed, thread-safe AbstractNodeTransport / NodeInboundHandler (src/node/node_transport.h), implemented by the host's NodeConnections. Channels, the channel manager, NodeState and Enclave take the transport instead of ringbuffer writer factories. Libuv-loop constraints stay inside the host transport.
• Outbound operations still go through the ledger lane, so AppendEntries frames carry exactly (prev_idx, idx] after earlier appends. Channels submit under their lock, preserving per-peer key-exchange and nonce order. The wire format is unchanged.
• Inbound frames are copied into owned buffers and run, with node ticks and stop notices, on one ordinary OrderedTasks lane (NodeIngress) on the main job board. These operations remain FIFO and mutually exclusive regardless of which worker executes them.
• The dispatch thread stays ingress-only, as after Raise worker_threads default to 1, make dispatch thread ingress-only #8404: it submits ticks and stop notices to NodeIngress and executes no tasks. There are no task-system changes in this PR.
• Remove the four message declarations, serialisers and dispatcher handlers, and the enclave's now-unused writer factories.
• The host drains the ledger lane before job-board shutdown, then explicitly closes node sockets because the enclave retains the transport.

Safety and compatibility

• Accepted scheduling change: node ingress previously ran directly on the dispatch thread, independently of worker tasks. It now queues as an ordinary task and needs a free worker. Blocking tasks occupying every worker can delay consensus messages and ticks and cause elections. FIFO, mutual exclusion and protocol validation are preserved; no consensus safety rules are changed. CI coverage is reassuring, not proof that worker-saturation stalls are impossible. A separate consensus thread/job board is a possible follow-up if operational evidence warrants it, not part of this PR.
• A frame declaring a size above memory.max_msg_size now closes that connection before buffering, rather than throwing in the libuv callback and terminating the node. The inbound backlog remains unbounded, as before.
• Malformed peer input is still dropped per message; framing errors close the connection.
• No wire-format, ledger-format, public API or configuration change. Mixed-version peers continue to use the same protocol.
• Heartbeats still queue behind ledger IO; reordering outbound Raft traffic is out of scope. Forwarding is deprecated and its removal is separate work.

Validation: focused unit tests cover ingress ownership/order/shutdown, malformed input, channel key exchange and nonce ordering, connection lifecycle and AppendEntries attachment. Local host/app builds and formatting/include/ASCII checks pass. On head 1df49ba61, all regular CI buckets, long Debug/Release tests, Long Shuffled/LTS/Snmalloc, ASAN and TSAN pass. A fresh independent adversarial review found no significant issues. No changelog entry is included, as agreed for this internal change.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It changes consensus ingress scheduling, cross-thread transport ordering, and shutdown behavior, warranting final human review.

Review effort: Balanced
Findings: None

What changed in this PR

Replaces node-to-node ringbuffer messages with a typed, thread-safe transport while preserving framing and ordering.

Changes:

• Introduces AbstractNodeTransport and host implementation.
• Serializes inbound traffic, ticks, and stop notices through NodeIngress.
• Adds transport ordering, framing, lifecycle, and concurrency tests.

Custom instructions used

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md
• .github/skills/testing/SKILL.md

File	Description
src/​node/​test/​node_inbound_message.cpp	Tests ingress ordering, ownership, shutdown, and serialization.
src/​node/​test/​channels.cpp	Migrates channel tests to typed transports and adds ordering coverage.
src/​node/​node_types.h	Removes node ringbuffer message declarations.
src/​node/​node_transport.h	Defines typed transport interfaces.
src/​node/​node_to_node_channel_manager.h	Routes channel management through the transport.
src/​node/​node_state.h	Injects the transport and accepts typed inbound frames.
src/​node/​node_inbound_message.h	Adds the serialized NodeIngress task lane.
src/​node/​channels.h	Sends channel traffic directly through the transport.
src/​host/​test/​node_connections.cpp	Expands framing, ordering, malformed-input, and shutdown tests.
src/​host/​run.cpp	Creates and shuts down the host transport.
src/​host/​node_connections.h	Implements typed transport, framing, limits, and lifecycle handling.
src/​host/​ledger_subsystem.h	Documents transport use of mutation ordering.
src/​enclave/​main.cpp	Passes the transport into enclave creation.
src/​enclave/​entry_points.h	Extends the enclave creation interface.
src/​enclave/​enclave.h	Connects transport ingress to node processing.
doc/​architecture/​threading.rst	Documents shared-worker ingress scheduling.
doc/​architecture/​tcp_internals.rst	Updates node transport architecture documentation.
CMakeLists.txt	Links ingress tests with the task library.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.