ARC Polish

AGENTS.md

@@ -1,5 +1,5 @@
 # Fabric Agents
-See also [DEVELOPERS.md](DEVELOPERS.md) (repo layout, tests) and [docs/PRODUCTION.md](docs/PRODUCTION.md) (release gate).
+See also [DEVELOPERS.md](DEVELOPERS.md) (repo layout, tests), [docs/PRODUCTION.md](docs/PRODUCTION.md) (release gate), and [docs/TYPES_AND_SERVICES.md](docs/TYPES_AND_SERVICES.md) (suite `types/` + `services/` layering vs http / Hub / Passport / GoonCitizen).
 
 ## Release posture
 - **Target:** `0.1.0-RC1` reference client — not a production-hardened VM claim

CHANGELOG.md

@@ -2,6 +2,8 @@
 Recent changes to Fabric Core.
 
 ## 2026-08-14
+- **IdentityCrossSign lift:** `functions/identityCrossSign.js`, `fabricIdentitySchnorr.js`, `identityCrossSignVerify.js` (+ `.d.ts`) are the canonical gossip strings and BIP340 helpers. HTTP site-login / device-link stay in `@fabric/http` and re-export these leaves.
+- **Peer dial storms:** `_fillPeerSlots` waits `PEER_CANDIDATE_RETRY_MS` (60s) before redialing the same candidate; refused TCP no longer constructs NOISE (shared handshake EventEmitter was leaking listeners). Transient `ECONNREFUSED` is recognized from the error message when Node omits `error.code`.
 - **Tests:** coverage for `--password=VALUE` (`functions/cliPasswordArgv`), GroupChange `signers.set` vote bind, wallet atomic write / touchWallet truncate, advertised vs verified peering suppress, Beacon persist-fail retain, `Environment.stop()` key wipe, and related lock/setup fail-closed paths.
 - **Codacy (PR #183):** timing-safe setup password confirm; setup TUI treats cancel as a non-string password (no `== null`); hallmark hex length uses a literal class (no `new RegExp`); tier `when` paths skip `__proto__`/`constructor`/`prototype`; BIP65 lock constants avoid 32-bit hex literals; Semgrep/Opengrep exclude path-hardened `fabricSetup` / `environment` (containment already tested).
 - **Shutdown / create:** `Environment.stop()` calls `lockWallet()` so seed/xprv/plaintext keys wipe even when the idle-lock handler was never installed; `touchWallet` creates a missing file with exclusive `wx` and does not truncate on `EEXIST`.

DEVELOPERS.md

@@ -34,7 +34,7 @@ Working from a **git checkout** (not the global package) is best when you are ch
 ## Repository layout
 | Path | Role |
 |------|------|
-| `types/` | ES6 **classes** — `Actor`, `Peer`, `Service`, `Store`, `Message`, etc. CommonJS (`require`) throughout. |
+| `types/` | ES6 **classes** — `Actor`, `Peer`, `Service`, `Store`, `Message`, etc. CommonJS (`require`) throughout. Cross-package homes: **[docs/TYPES_AND_SERVICES.md](docs/TYPES_AND_SERVICES.md)**. |
 | `services/` | Long-running **integrations** (Bitcoin RPC, Lightning stubs, ZMQ, …) built on `Service`. |
 | `contracts/` | Language snippets, traces, and tooling (e.g. type dependency graph). |
 | `scripts/` | CLI entrypoints, doc helpers (`list-jsdoc-type-files.js`, `remove-legacy-types.sh`). |

PUBLIC_API.md

@@ -38,6 +38,12 @@ Password-sealed JSON and in-memory lock sessions (CLI / setup wallets):
 `@fabric/core/functions/sealedBlob`, `@fabric/core/functions/identityLock`
 (ambient stubs `functions/sealedBlob.d.ts` / `functions/identityLock.d.ts`).
 
+Protocol identity Schnorr + IdentityCrossSign (device-link gossip strings):
+`@fabric/core/functions/fabricIdentitySchnorr`,
+`@fabric/core/functions/identityCrossSign`,
+`@fabric/core/functions/identityCrossSignVerify`. HTTP site-login / device-link
+handlers stay in `@fabric/http` and re-export these leaves.
+
 ### Services
 
 `@fabric/core/services/bitcoin`, `@fabric/core/services/lightning` — optional RPC

constants.js

@@ -194,6 +194,11 @@ const PEERING_OFFER_MAX_RELAYS_PER_ORIGIN_PER_MINUTE = 60;
 const PEERING_OFFER_MAX_PAYLOAD_CACHE = 50000;
 /** Max queued connection candidates from {@link P2P_PEERING_OFFER} (FIFO eviction). */
 const PEER_MAX_CANDIDATES_QUEUE = 128;
+/**
+ * Minimum delay before {@link Peer#_fillPeerSlots} redials the same candidate.
+ * Immediate requeue plus `connections:close` was a tight ECONNREFUSED loop.
+ */
+const PEER_CANDIDATE_RETRY_MS = 60000;
 /** Max wire-hash dedup entries in {@link Peer} (bounded memory). */
 const PEER_MAX_WIRE_HASH_CACHE = 10000;
 /**
@@ -430,6 +435,7 @@ module.exports = {
   PEERING_OFFER_MAX_RELAYS_PER_ORIGIN_PER_MINUTE,
   PEERING_OFFER_MAX_PAYLOAD_CACHE,
   PEER_MAX_CANDIDATES_QUEUE,
+  PEER_CANDIDATE_RETRY_MS,
   PEER_MAX_WIRE_HASH_CACHE,
   PEER_MAX_LOGICAL_REGISTER_CACHE,
   PEER_SCORE_BODY_HASH_MISMATCH_PENALTY,

docs/OUTSTANDING.md

@@ -9,7 +9,6 @@ Living queue for this repo. Detail and closed items live in [SECURITY.md](../SEC
 3. Downstream **site-login / device-link redeem** is not a core bug; Hub/`@fabric/http` still treat QR `sessionId` as the capability. Tracked in those repos.
 
 ## Next slices (this repo)
-- [ ] **IdentityCrossSign lift (local, not #183)** — `functions/identityCrossSign.js`, `fabricIdentitySchnorr.js`, `identityCrossSignVerify.js` + tests exist on disk. Held off [#183](https://github.com/FabricLabs/fabric/pull/183) (CodeRabbit ~150-file cap). Do **not** commit working-tree `package.json` / `PUBLIC_API.md` / `AGENTS.md` pointers until that follow-up PR (smoke would require missing leaves). Pin/link core before Hub/http/Passport/GoonCitizen re-exports CI.
 - [ ] Type-tree keep/remove lock in [PRODUCTION_MARCH.md](PRODUCTION_MARCH.md) (`Scribe` / `Reader` / Global docs clutter).
 - [ ] Eager `messageHex` laziness on Peer hot paths (performance, not a correctness claim).
 - [ ] Coordinated `contractId` → `contractIdentifier` rename.
@@ -18,6 +17,8 @@ Living queue for this repo. Detail and closed items live in [SECURITY.md](../SEC
 - [ ] Keep `.codacy.yml` Semgrep/Opengrep exclusions for `functions/fabricSetup.js` and `types/environment.js` unless a replacement SAST job covers those path-construction helpers (CodeRabbit asked to drop the excludes; Codacy still ignores `nosemgrep`).
 
 ## Closed this pass (do not re-open)
+- IdentityCrossSign / identity Schnorr / verify lifted into `functions/` after [#183](https://github.com/FabricLabs/fabric/pull/183) merge (was held for the CodeRabbit file cap).
+- `_fillPeerSlots` candidate retry cooldown + NOISE-after-TCP-connect (playnet `:7778` ECONNREFUSED / MaxListeners storm).
 - Blinded-execution `at` bind; Beacon `ready` finalize; peering self-suppress via verified AMP signer; empty `signers: []` spend-key widen; Beacon ARC authority walk.
 - Gossip-network `P2P_PEERING_OFFER` candidate expect includes AMP `verifiedPubkey` (`tests/fabric.peer.gossip-network.js`).
 - Codacy `no-loss-of-precision` on `functions/contractTaproot.js` `CLTV_TIMESTAMP_THRESHOLD` — use `Number('500000000')` (decimal and `5e8` both trip the PR check).
@@ -26,4 +27,4 @@ Living queue for this repo. Detail and closed items live in [SECURITY.md](../SEC
 - `printGeneratedWallet` never prints the master xprv (`FABRIC_DEBUG` included). Plaintext restore validates encryption password before `setWallet`.
 
 ## PRs
-[#183](https://github.com/FabricLabs/fabric/pull/183) — mocha + codecov green at `4d7351ee3`; remaining GitHub check was Codacy (`500000000` literal). Cursor review on `4d7351ee3` reports **no remaining High/Medium/Critical**. Still deferred: IdentityCrossSign lift (file cap); `sealedBlob`/`identityLock` `.d.ts` stubs (new files); RFC6902 multi-op JSON bridge (http); eager `messageHex`; `withIsolatedHome` test helper; wallet tmp-name random suffix; `.codacy.yml` Semgrep excludes stay until a replacement SAST job exists.
+[#183](https://github.com/FabricLabs/fabric/pull/183) — **merged** 2026-08-14 (`a80e8aa7e`). This follow-up stages IdentityCrossSign leaves + Peer dial-storm fixes. Still deferred: RFC6902 multi-op JSON bridge (http); eager `messageHex`; `withIsolatedHome` test helper; wallet tmp-name random suffix; `.codacy.yml` Semgrep excludes stay until a replacement SAST job exists.

docs/PRODUCTION_MARCH.md

@@ -10,6 +10,7 @@ Related docs:
 - `docs/PRODUCTION.md`
 - `docs/RELEASE_CHECKLIST.md`
 - `docs/OUTSTANDING.md` — **security-first queue** (this repo)
+- `docs/TYPES_AND_SERVICES.md` — cross-package `types/` + `services/` homes (http / Hub / Passport / GoonCitizen)
 - `SECURITY.md` / `AUDIT.md`
 - `AGENTS.md`
 

docs/README.md

@@ -37,4 +37,4 @@ One-off reports and analysis files in the repo root are listed in **[NON_CANONIC
 
 ## Downstream
 
-**hub.fabric.pub** (rendezvous hub, HTTP bridge) and **@fabric/http** are separate repos; align versions per **[docs/PRODUCTION.md](PRODUCTION.md)** and **[../DEVELOPERS.md](../DEVELOPERS.md)**.
+**hub.fabric.pub** (rendezvous hub, HTTP bridge) and **@fabric/http** are separate repos; align versions per **[docs/PRODUCTION.md](PRODUCTION.md)** and **[../DEVELOPERS.md](../DEVELOPERS.md)**. Cross-package `types/` + `services/` ownership (including Passport and GoonCitizen): **[TYPES_AND_SERVICES.md](TYPES_AND_SERVICES.md)**.