[Historical testnet] P2P redesign for the v2.0.0 public testnet #6

Merged

ignotusnemo merged 12 commits from v2 into main

2026-08-15 18:24:23 +00:00

ignotusnemo commented

2026-08-15 18:18:02 +00:00

(Migrated from github.com)

Historical testnet PR

This PR documents the P2P redesign introduced for the retired v2.x public testnet. The architecture was later carried into the current mainnet, but the version numbers, ports, network identifiers and migration instructions below refer to the old testnet and should not be used for current deployments.

Current mainnet release: https://github.com/ignotusnemo/parano1d/releases/latest

Summary

This PR replaces the previous P2P synchronization architecture and prepares Parano1d v2.0.0 for a new public testnet.

The first public launch exposed networking and synchronization failures that were not reproduced under controlled testing. The incident evidence pointed to the P2P orchestration layer rather than consensus, state-transition verification or recursive proof verification.

The previous design treated large block bodies, recursive terminals, snapshot metadata and live tip propagation as parts of the same synchronization flow. Under load, slow proof and State transfers could delay headers, bind progress to one peer and repeatedly restart synchronization when that peer disconnected or the selected tip moved.

What changed

Header-first propagation

Headers and tip announcements now use a separate control path.

Headers are validated for parent linkage, proof of work, ASERT, timestamps and cumulative work before entering a bounded HeaderDAG. Block bodies, recursive terminals and State data are then requested as exact content-addressed objects.

Large transfers cannot block header propagation or the main P2P reactor.

Immutable multi-source synchronization

Synchronization plans are now bound to an exact validated branch, not to one peer.

Different peers may provide different bodies, terminal proofs, manifest pages or State segments for the same plan. Disconnects, timeouts and local queue pressure no longer discard already verified progress.

Transport failures rotate the source for the affected object. Invalid content removes the responsible provider without blaming unrelated peers. If every source for a plan genuinely disappears, only the transport plan is retired; the validated HeaderDAG and committed chain remain intact.

Atomic branch replacement with one recursive terminal

A competing branch is selected from validated headers by cumulative work.

The node downloads its exact bodies and one recursive HistoryStep terminal at the selected tip. Bodies still pass native header, transaction and State-transition checks. The replacement is applied in memory and committed through one atomic MDBX transaction after finality and fork-choice conditions are rechecked.

An invalid or interrupted replacement leaves the existing chain unchanged.

Snapshot redesign

Snapshot synchronization retains its two-proof security boundary:

a recursive terminal authenticates the snapshot boundary;
a later terminal authenticates the exact suffix to the selected live tip.

Snapshot manifests are now split into small authenticated pages instead of moving one potentially multi-megabyte descriptor list through the control plane.

Manifest pages and State segments have bounded queues, byte budgets and dedicated scheduling capacity. Verified pages and segments survive source changes and reconnects.

Network topology and resource control

All ordinary GUI and daemon nodes participate in the same network without introducing user-facing node roles.

The network now includes:

automatic Kademlia discovery;
relay-v2 reservations and DCUtR direct upgrades;
outbound failure-domain diversity;
bounded inbound connections per network group;
separate control, header, live-object, snapshot-metadata and State capacities;
CPU reservation for networking while the internal or external miner is active.

Mining now requires one compatible peer rather than two exact-tip confirmations. Proof construction is cancelled when a genuinely newer parent is accepted, so slower machines do not continue proving obsolete work.

Clean v2 testnet boundary

v2.0.0 uses a new network magic, libp2p namespace, network profile, storage epoch and default ports:

P2P: 9500
RPC: 9501
block target: 20 seconds

The network profile includes the authenticated embedded HistoryStep proof-bank identity, but it is not tied to a Git commit or build machine. Independent builds remain compatible when they use the same protocol and verified proof pack.

Older clients cannot join this testnet.

On first start, v2.0.0 automatically removes old chain data, peer state, caches and GUI network settings while preserving only wallet.key. No manual data-directory cleanup is required.

> **Historical testnet PR** > > This PR documents the P2P redesign introduced for the retired v2.x public testnet. The architecture was later carried into the current mainnet, but the version numbers, ports, network identifiers and migration instructions below refer to the old testnet and should not be used for current deployments. > > Current mainnet release: https://github.com/ignotusnemo/parano1d/releases/latest ## Summary This PR replaces the previous P2P synchronization architecture and prepares Parano1d v2.0.0 for a new public testnet. The first public launch exposed networking and synchronization failures that were not reproduced under controlled testing. The incident evidence pointed to the P2P orchestration layer rather than consensus, state-transition verification or recursive proof verification. The previous design treated large block bodies, recursive terminals, snapshot metadata and live tip propagation as parts of the same synchronization flow. Under load, slow proof and State transfers could delay headers, bind progress to one peer and repeatedly restart synchronization when that peer disconnected or the selected tip moved. ## What changed ### Header-first propagation Headers and tip announcements now use a separate control path. Headers are validated for parent linkage, proof of work, ASERT, timestamps and cumulative work before entering a bounded HeaderDAG. Block bodies, recursive terminals and State data are then requested as exact content-addressed objects. Large transfers cannot block header propagation or the main P2P reactor. ### Immutable multi-source synchronization Synchronization plans are now bound to an exact validated branch, not to one peer. Different peers may provide different bodies, terminal proofs, manifest pages or State segments for the same plan. Disconnects, timeouts and local queue pressure no longer discard already verified progress. Transport failures rotate the source for the affected object. Invalid content removes the responsible provider without blaming unrelated peers. If every source for a plan genuinely disappears, only the transport plan is retired; the validated HeaderDAG and committed chain remain intact. ### Atomic branch replacement with one recursive terminal A competing branch is selected from validated headers by cumulative work. The node downloads its exact bodies and one recursive HistoryStep terminal at the selected tip. Bodies still pass native header, transaction and State-transition checks. The replacement is applied in memory and committed through one atomic MDBX transaction after finality and fork-choice conditions are rechecked. An invalid or interrupted replacement leaves the existing chain unchanged. ### Snapshot redesign Snapshot synchronization retains its two-proof security boundary: 1. a recursive terminal authenticates the snapshot boundary; 2. a later terminal authenticates the exact suffix to the selected live tip. Snapshot manifests are now split into small authenticated pages instead of moving one potentially multi-megabyte descriptor list through the control plane. Manifest pages and State segments have bounded queues, byte budgets and dedicated scheduling capacity. Verified pages and segments survive source changes and reconnects. ### Network topology and resource control All ordinary GUI and daemon nodes participate in the same network without introducing user-facing node roles. The network now includes: - automatic Kademlia discovery; - relay-v2 reservations and DCUtR direct upgrades; - outbound failure-domain diversity; - bounded inbound connections per network group; - separate control, header, live-object, snapshot-metadata and State capacities; - CPU reservation for networking while the internal or external miner is active. Mining now requires one compatible peer rather than two exact-tip confirmations. Proof construction is cancelled when a genuinely newer parent is accepted, so slower machines do not continue proving obsolete work. ### Clean v2 testnet boundary v2.0.0 uses a new network magic, libp2p namespace, network profile, storage epoch and default ports: - P2P: `9500` - RPC: `9501` - block target: 20 seconds The network profile includes the authenticated embedded HistoryStep proof-bank identity, but it is not tied to a Git commit or build machine. Independent builds remain compatible when they use the same protocol and verified proof pack. Older clients cannot join this testnet. On first start, v2.0.0 automatically removes old chain data, peer state, caches and GUI network settings while preserving only `wallet.key`. No manual data-directory cleanup is required.