I2704 — A dialer reads no reply beyond the link bound and no more candidates than the bound, and a refusing peer is retried at a measured, jittered rate

○READY wave 1 · p1 · implementation profile · runs alone

Part of runtime-trust — A runtime is safe to reach from another machine, and joining the mesh trusts nobody by accident.

Objective

Bound the link and rendezvous replies a dialer reads at the link message bound and the candidate count it accepts at the registration bound, give the link backoff jitter, and measure the unknown_link retry rate in a test.

Why

Split from I2133 on 2026-10-14. I2133 bounded the discovery queue, answered a refused registration with its refusal alone and slowed the unknown_link retry, and its desired_state said 'Not done here' of capping the reply a dialer reads and the received candidate count, jitter on the link backoff, and a test that measures the unknown_link retry rate, while its acceptance criteria still required them, so it could never close. Baseline audit of 2026-10-09 at master 1fb8d6be44, mesh gaps 5 and 11, threats T4 and T13.

Current state

Every reply bridge::request reads is bounded at MAX_REPLY_BYTES, 32 MiB (apps/majordomus-cli/src/mcp/bridge.rs, I2147), not at MAX_LINK_MESSAGE (900 KiB, apps/majordomus-cli/src/mesh/link.rs), which bounds only what the answerer receives and the dialer sends. The rendezvous client takes every candidate an answer carries (apps/majordomus-cli/src/mesh/rendezvous.rs); MAX_CANDIDATES (32) bounds only what this node answers (apps/majordomus-cli/src/mesh/manager.rs). Cooperation::backoff (apps/majordomus-cli/src/mesh/cooperation.rs) is heartbeat times 2^failures with no jitter. No test measures how often a peer that answers hello and refuses every sync is retried.

Desired state

A link reply over MAX_LINK_MESSAGE and a rendezvous answer with more than MAX_CANDIDATES candidates are refused as typed errors before they are parsed; the link backoff carries a bounded jitter; a test drives a peer that welcomes and refuses every sync and measures the retry rate.

Scope

• apps/majordomus-cli/src/mesh/link.rs
• apps/majordomus-cli/src/mesh/rendezvous.rs
• apps/majordomus-cli/src/mesh/manager.rs
• apps/majordomus-cli/src/mesh/cooperation.rs
• apps/majordomus-cli/src/mcp/bridge.rs
• apps/majordomus-cli/tests/mesh.rs
• apps/majordomus-cli/tests/mesh_cooperation.rs
• docs/MESH.md

Out of scope

• The bounded discovery queue and the registration answer, which I2133 delivered
• The general MAX_REPLY_BYTES bound of bridge::request, which is I2147's

Dependencies

• I2133✓DONE Every mesh input and answer has a bound, and a refused registration learns nothing

Acceptance criteria

• A reply one byte over MAX_LINK_MESSAGE and a rendezvous answer with more than MAX_CANDIDATES candidates are refused as typed errors
• A peer that answers hello and refuses every sync is retried no faster than once per heartbeat
• Two runtimes whose links to one peer fail together do not retry it at the same instant: the link backoff carries a bounded jitter

Validation

• bin/majordomus plan validate
• cargo test --lib mesh
• cargo test --test mesh --test mesh_cooperation

Evidence required

• reply_bound_test
• unknown_link_retry_rate_test

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2704.yaml. Read it back with majordomus plan show I2704.