Severity: High
Summary
PR #136's headline feature — relay forwarding + ACK reverse-routing for NAT'd transients — is plumbed on the substrate side but does not function end to end. NAT'd transients receive 202 on every write.
Two compounding defects
- ACK fallback never fires (
internal/cluster/node.go:381-397): handlePutMessage finds the originator in the HTTP peer list, calls cn.protocol.Send(...) with the return value discarded, and sets delivered = true merely from finding the peer entry. Since transients HTTP-bootstrap before WS-attaching, they are always in the peer list, so the WS RouteAck fallback is skipped. For a NAT'd transient the HTTP ACK send fails silently against an unreachable advertised address.
- No up-pipe sender (
internal/tree/manager.go, cmd/repram/main.go:968): ClusterNode.Put only broadcasts via HTTP BroadcastToEnclave. No transient-side code ever sends a PUT up the WS pipe, so RecordAckRoute and the entire relay-forwarding path are dead code in an all-Go network. The package doc still says these "land in subsequent phases," contradicting the phases-1-6 claim.
Impact
The "201 via relay = substrate confirmed storage" promise is not delivered. Phase-7 burn-in won't catch this unless it explicitly tests a NAT'd writer.
Suggested fix
Decide whether the WS relay is a shipped feature: if yes, wire the transient PUT path through the WS pipe, use the Send return value to drive the RouteAck fallback, and add an end-to-end test (WS PUT → substrate store → ACK reverse-route). If no, remove the dead relay/ACK-route code so it stops implying a guarantee.
Related: #140, #141, #142, #146, #147.
Severity: High
Summary
PR #136's headline feature — relay forwarding + ACK reverse-routing for NAT'd transients — is plumbed on the substrate side but does not function end to end. NAT'd transients receive 202 on every write.
Two compounding defects
internal/cluster/node.go:381-397):handlePutMessagefinds the originator in the HTTP peer list, callscn.protocol.Send(...)with the return value discarded, and setsdelivered = truemerely from finding the peer entry. Since transients HTTP-bootstrap before WS-attaching, they are always in the peer list, so the WSRouteAckfallback is skipped. For a NAT'd transient the HTTP ACK send fails silently against an unreachable advertised address.internal/tree/manager.go,cmd/repram/main.go:968):ClusterNode.Putonly broadcasts via HTTPBroadcastToEnclave. No transient-side code ever sends a PUT up the WS pipe, soRecordAckRouteand the entire relay-forwarding path are dead code in an all-Go network. The package doc still says these "land in subsequent phases," contradicting the phases-1-6 claim.Impact
The "201 via relay = substrate confirmed storage" promise is not delivered. Phase-7 burn-in won't catch this unless it explicitly tests a NAT'd writer.
Suggested fix
Decide whether the WS relay is a shipped feature: if yes, wire the transient PUT path through the WS pipe, use the
Sendreturn value to drive theRouteAckfallback, and add an end-to-end test (WS PUT → substrate store → ACK reverse-route). If no, remove the dead relay/ACK-route code so it stops implying a guarantee.Related: #140, #141, #142, #146, #147.