feat(network)!: regulate GetBlocks with paired streams

.config/nextest.toml

@@ -4,6 +4,7 @@
 [profile.default]
 fail-fast = true
 status-level = "pass"
+default-filter = 'not test(~handler::tests::paired_block_sync::gate::)'
 
 # --- Platform-specific overrides ---
 
@@ -36,7 +37,13 @@ threads-required = "num-test-threads"
 # TODO: We need a better test architecture to run all non-stateful
 [profile.all-tests]
 failure-output = "immediate"
-default-filter = "not test(check_no_git_dependencies) and not test(=fully_synced_rpc_z_getsubtreesbyindex_snapshot_test) and not test(=lwd_rpc_test) and not test(=lwd_rpc_send_tx) and not test(=lwd_grpc_wallet) and not test(=lwd_integration) and not test(=lwd_sync_full) and not test(=lwd_sync_update) and not test(=lightwalletd_test_suite) and not test(=rpc_get_block_template) and not test(=rpc_submit_block) and not test(~generate_checkpoints_) and not test(=sync_one_checkpoint_mainnet) and not test(=sync_one_checkpoint_testnet) and not test(=sync_update_mainnet) and not test(=activate_mempool_mainnet) and not test(=restart_stop_at_height) and not test(=sync_large_checkpoints_mempool_mainnet) and not test(=pruned_storage_mode_prunes_during_regtest_sync) and not test(=config_tests) and not test(~zakura::testkit::cluster) and not test(~zakura::testkit::blocksync_fuzz)"
+default-filter = "not test(check_no_git_dependencies) and not test(=fully_synced_rpc_z_getsubtreesbyindex_snapshot_test) and not test(=lwd_rpc_test) and not test(=lwd_rpc_send_tx) and not test(=lwd_grpc_wallet) and not test(=lwd_integration) and not test(=lwd_sync_full) and not test(=lwd_sync_update) and not test(=lightwalletd_test_suite) and not test(=rpc_get_block_template) and not test(=rpc_submit_block) and not test(~generate_checkpoints_) and not test(=sync_one_checkpoint_mainnet) and not test(=sync_one_checkpoint_testnet) and not test(=sync_update_mainnet) and not test(=activate_mempool_mainnet) and not test(=restart_stop_at_height) and not test(=sync_large_checkpoints_mempool_mainnet) and not test(=pruned_storage_mode_prunes_during_regtest_sync) and not test(=config_tests) and not test(~zakura::testkit::cluster) and not test(~zakura::testkit::blocksync_fuzz) and not test(~handler::tests::paired_block_sync::gate::)"
+
+# Controlled regulation tests must fail on their first divergent execution.
+[[profile.all-tests.overrides]]
+filter = 'test(~message_payload_limits_) or test(~inbound_frame_cap_rejects_) or test(~paused_ordered_reads_) or test(~stream_cancel_closes_ordered_worker_) or test(~block_sync::service::tests::) or test(~transport::io::) or test(~reconciliation_rejects_stale_admissions_) or test(~regulation::request::) or test(~serving_regulation::) or test(~block_sync::serving::) or test(~work_queue::request_write::tests::) or test(~handler::ordered_pair::tests::) or test(~service::block_range::tests::) or (test(~handler::tests::paired_block_sync::) and not test(~handler::tests::paired_block_sync::gate::))'
+retries = 0
+slow-timeout = { period = "60s", terminate-after = 1 }
 
 # The Zakura block-sync tests drive the real reactor through a real-time (wall-clock)
 # scenario harness — multi-threaded tokio with real sleeps and timeouts. Under a loaded
@@ -63,7 +70,13 @@ retries = 2
 # no-fail-fast without hiding fast unit failures.
 [profile.full-tests]
 failure-output = "immediate"
-default-filter = "not test(check_no_git_dependencies) and not test(=fully_synced_rpc_z_getsubtreesbyindex_snapshot_test) and not test(=lwd_rpc_test) and not test(=lwd_rpc_send_tx) and not test(=lwd_grpc_wallet) and not test(=lwd_integration) and not test(=lwd_sync_full) and not test(=lwd_sync_update) and not test(=lightwalletd_test_suite) and not test(=rpc_get_block_template) and not test(=rpc_submit_block) and not test(~generate_checkpoints_) and not test(=sync_one_checkpoint_mainnet) and not test(=sync_one_checkpoint_testnet) and not test(=sync_update_mainnet) and not test(=activate_mempool_mainnet) and not test(=restart_stop_at_height) and not test(=sync_large_checkpoints_mempool_mainnet) and not test(=pruned_storage_mode_prunes_during_regtest_sync) and not test(=config_tests) and not test(~zakura::testkit::cluster) and not test(~zakura::testkit::blocksync_fuzz)"
+default-filter = "not test(check_no_git_dependencies) and not test(=fully_synced_rpc_z_getsubtreesbyindex_snapshot_test) and not test(=lwd_rpc_test) and not test(=lwd_rpc_send_tx) and not test(=lwd_grpc_wallet) and not test(=lwd_integration) and not test(=lwd_sync_full) and not test(=lwd_sync_update) and not test(=lightwalletd_test_suite) and not test(=rpc_get_block_template) and not test(=rpc_submit_block) and not test(~generate_checkpoints_) and not test(=sync_one_checkpoint_mainnet) and not test(=sync_one_checkpoint_testnet) and not test(=sync_update_mainnet) and not test(=activate_mempool_mainnet) and not test(=restart_stop_at_height) and not test(=sync_large_checkpoints_mempool_mainnet) and not test(=pruned_storage_mode_prunes_during_regtest_sync) and not test(=config_tests) and not test(~zakura::testkit::cluster) and not test(~zakura::testkit::blocksync_fuzz) and not test(~handler::tests::paired_block_sync::gate::)"
+
+# Controlled regulation tests must fail on their first divergent execution.
+[[profile.full-tests.overrides]]
+filter = 'test(~message_payload_limits_) or test(~inbound_frame_cap_rejects_) or test(~paused_ordered_reads_) or test(~stream_cancel_closes_ordered_worker_) or test(~block_sync::service::tests::) or test(~transport::io::) or test(~reconciliation_rejects_stale_admissions_) or test(~regulation::request::) or test(~serving_regulation::) or test(~block_sync::serving::) or test(~work_queue::request_write::tests::) or test(~handler::ordered_pair::tests::) or test(~service::block_range::tests::) or (test(~handler::tests::paired_block_sync::) and not test(~handler::tests::paired_block_sync::gate::))'
+retries = 0
+slow-timeout = { period = "60s", terminate-after = 1 }
 
 # Retry the real-time Zakura block-sync scenario tests under load (see the note on the
 # `all-tests` override above).
@@ -232,3 +245,17 @@ test-threads = 1
 slow-timeout = { period = "5m", terminate-after = 2 }
 failure-output = "immediate"
 default-filter = 'package(zakura) and test(~zcashd_compat)'
+
+# Also selected by ordinary unit-test profiles; isolate the fixed regression checks.
+[profile.blocksync-regression]
+default-filter = 'test(~message_payload_limits_) or test(~inbound_frame_cap_rejects_) or test(~paused_ordered_reads_) or test(~stream_cancel_closes_ordered_worker_) or test(~block_sync::service::tests::) or test(~transport::io::) or test(~reconciliation_rejects_stale_admissions_) or test(~regulation::request::) or test(~serving_regulation::) or test(~block_sync::serving::) or test(~work_queue::request_write::tests::) or test(~handler::ordered_pair::tests::) or test(~service::block_range::tests::) or (test(~handler::tests::paired_block_sync::) and not test(~handler::tests::paired_block_sync::gate::))'
+retries = 0
+slow-timeout = { period = "60s", terminate-after = 1 }
+
+# Run explicitly with --run-ignored=all after building; no automatic retry.
+[profile.blocksync-transport-gate]
+default-filter = 'test(~handler::tests::paired_block_sync::gate::)'
+test-threads = 1
+retries = 0
+slow-timeout = { period = "90m", terminate-after = 1 }
+failure-output = "immediate"

Cargo.toml

@@ -35,6 +35,14 @@ keywords = ["zakura", "zcash"]
 rust-version = "1.97"
 edition = "2021"
 
+# Backport the loss-probe datagram limit fix to Iroh 0.92's exact QUIC versions.
+# Keep the related crates on one revision. Workspace patches are not inherited
+# by downstream library users; they must apply the same patch in their workspace.
+[patch.crates-io]
+iroh-quinn = { git = "https://github.com/zakura-core/iroh-quinn", rev = "1dcc7a43488fecd199d343d47e93e9ed8319fcaa" }
+iroh-quinn-proto = { git = "https://github.com/zakura-core/iroh-quinn", rev = "1dcc7a43488fecd199d343d47e93e9ed8319fcaa" }
+iroh-quinn-udp = { git = "https://github.com/zakura-core/iroh-quinn", rev = "1dcc7a43488fecd199d343d47e93e9ed8319fcaa" }
+
 [workspace.dependencies]
 # Zakura's published binary assets: the reviewed Mainnet historical frontier grid, which is too
 # large to carry in git history at the weekly cadence the release state advances.

crates/zakura-network/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "zakura-network"
-version = "7.1.1-rc1"
+version = "8.0.0"
 authors.workspace = true
 description = "Networking code for the Zakura node. Internal crate, published to support cargo install zakura"
 # # Legal

crates/zakura-network/src/zakura.rs

@@ -88,17 +88,21 @@ pub struct ServicePeerLimits {
     pub max_inbound_peers: usize,
     /// Maximum outbound peers this service admits.
     pub max_outbound_peers: usize,
-    /// Inbound queue depth reserved for this service.
+    /// Maximum inbound frames queued on each service stream.
     ///
-    /// Reserved for future transport queue wiring; not enforced in this phase.
+    /// Block sync applies this limit alongside the negotiated transport limit.
+    /// Its paired request stream always uses a single queue slot.
     pub inbound_queue_depth: usize,
-    /// Outbound queue depth reserved for this service.
+    /// Maximum outbound frames queued on each service stream.
     ///
-    /// Reserved for future transport queue wiring; not enforced in this phase.
+    /// Block sync applies this limit alongside the transport limit. Its paired
+    /// request stream always uses a single queue slot.
     pub outbound_queue_depth: usize,
-    /// Maximum service escalations that may be pending admission.
+    /// Maximum paired service sessions that may be establishing at once.
     ///
-    /// Reserved for future lazy service escalation; not enforced in this phase.
+    /// Paired block sync reserves this allowance until both roles arrive or
+    /// setup ends. Zero disables new paired sessions. Other services currently
+    /// use their existing admission policy.
     pub max_pending_escalations: usize,
 }
 

crates/zakura-network/src/zakura/block_sync/README.md

@@ -47,7 +47,13 @@ while anything anchored to the verified tip is pinned until real progress commit
 | Candidate selection | first pending in `[servable_low, min(servable_high, floor_high)]`, only if this peer is the preferred floor carrier | first pending in the peer's servable range, only when the floor arm produced nothing |
 | cwnd slots | may borrow up to `floor_bypass_slots` (default 2) beyond a saturated cwnd — bypass slots fund the floor **only** | normal cwnd slots only |
 | Byte funding | never refused: `reserve_request_budget`'s floor path overdrafts the in-flight budget by at most one request when `try_reserve` fails — reachable even at zero in-flight budget | non-blocking `try_reserve`; refused if the in-flight budget is spent |
-| Request deadline | short fixed leash (`floor_rescue_timeout`, default 2 s); on expiry the height is rescued to a faster carrier, the peer is retry-avoided but **not** disconnected | `request_timeout` (default 8 s) + expected transfer time (`estimated_bytes / measured BtlBw`, rate floored at 256 KiB/s) — patient, since it never gates the floor |
+| Request deadline | with a fresh delivery-rate sample, `floor_rescue_timeout` (default 2 s) + estimated transfer time; without a sample, use the normal deadline so the cold peer's only probe can finish | `request_timeout` (default 8 s) + estimated transfer time |
+
+Both lanes compute transfer time as `pending_response_bytes / measured_bytes_per_second`,
+using at least 256 KiB/s to keep the deadline bounded. An unmeasured peer uses
+256 KiB/s. Include this request and earlier unreceived responses in the byte
+estimate because they share an ordered data stream. Floor expiry returns the missing height for retry; the separate
+block-progress deadline controls session cooldown and repeated-stall disconnects.
 
 **Floor carrier preference:** the floor rides the fastest servable peer. Before taking
 floor work, a routine asks the shared registry
@@ -167,7 +173,7 @@ the worst-case decoded contribution is approximately
 
 1. **Commit-window heights are always fundable**, on both lanes, regardless of the
    look-ahead gates — a pinned checkpoint range can always assemble.
-2. **Floor grants never size below one byte**, and `take_in_range_budgeted` always
+2. **Floor grants never size below one byte**, and `take_for_request` always
    takes its first item regardless of the byte cap — so the floor block is taken even
    when the in-flight budget is exactly full, reaching the floor reservation path…
 3. **…which overdrafts instead of waiting.** When `try_reserve` fails,
@@ -207,7 +213,7 @@ borrowed a bypass slot.
 | `max_inflight_block_bytes` | 6 GiB | outstanding-request wire budget, released at receipt (separate from the resident gate) |
 | `max_blocks_per_response` | 1 | count cap per request (effective = min of both sides' advertisements, hard max 128) |
 | `floor_bypass_slots` | 2 | extra slots past a saturated cwnd, floor lane only |
-| `request_timeout` / `floor_rescue_timeout` | 8 s / 2 s | above-floor base deadline / floor rescue leash |
+| `request_timeout` / `floor_rescue_timeout` | 8 s / 2 s | normal base deadline / measured-peer floor-rescue base; both add ordered transfer time |
 | `max_submitted_block_applies` | 401 | sequencer submit window (floored at one checkpoint range; no ceiling — which is why the exemption span is a constant) |
 
 ## Known limitations and follow-ups