I2704

What it is

Objective

Bound the link and rendezvous replies a dialer reads at the link message bound and the candidate count it accepts at the registration bound, give the link backoff jitter, and measure the unknown_link retry rate in a test.

Why

Split from I2133 on 2026-10-14. I2133 bounded the discovery queue, answered a refused registration with its refusal alone and slowed the unknown_link retry, and its desired_state said 'Not done here' of capping the reply a dialer reads and the received candidate count, jitter on the link backoff, and a test that measures the unknown_link retry rate, while its acceptance criteria still required them, so it could never close. Baseline audit of 2026-10-09 at master 1fb8d6be44, mesh gaps 5 and 11, threats T4 and T13.

Now

Every reply bridge::request reads is bounded at MAX_REPLY_BYTES, 32 MiB (apps/majordomus-cli/src/mcp/bridge.rs, I2147), not at MAX_LINK_MESSAGE (900 KiB, apps/majordomus-cli/src/mesh/link.rs), which bounds only what the answerer receives and the dialer sends. The rendezvous client takes every candidate an answer carries (apps/majordomus-cli/src/mesh/rendezvous.rs); MAX_CANDIDATES (32) bounds only what this node answers (apps/majordomus-cli/src/mesh/manager.rs). Cooperation::backoff (apps/majordomus-cli/src/mesh/cooperation.rs) is heartbeat times 2^failures with no jitter. No test measures how often a peer that answers hello and refuses every sync is retried.

Wanted

A link reply over MAX_LINK_MESSAGE and a rendezvous answer with more than MAX_CANDIDATES candidates are refused as typed errors before they are parsed; the link backoff carries a bounded jitter; a test drives a peer that welcomes and refuses every sync and measures the retry rate.

Done when

unknown: the record declares no `completion`

Risk

unknown: the record declares no `risk`

Acceptance

Scope

Touches

apps/majordomus-cli/src/mesh/link.rsapps/majordomus-cli/src/mesh/rendezvous.rsapps/majordomus-cli/src/mesh/manager.rsapps/majordomus-cli/src/mesh/cooperation.rsapps/majordomus-cli/src/mcp/bridge.rsapps/majordomus-cli/tests/mesh.rsapps/majordomus-cli/tests/mesh_cooperation.rsdocs/MESH.md

Not

The bounded discovery queue and the registration answer, which I2133 deliveredThe general MAX_REPLY_BYTES bound of bridge::request, which is I2147's

Depends on

I2133

Priority

p1

Profile

implementation

Parallel safe

false

Owner

unknown: the record declares no `owner`

The work so far

Synchronisation

Adapter

scripts/github-sync

Repository

unknown: the derived plan's header carries no repository

External issue

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

State there

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings