mirror of
https://github.com/ZSeven-W/openpencil.git
synced 2026-09-28 08:02:55 +08:00
Kayshen-X
f1ef62c31e
The relay reaped every unpaired peer on a fixed sixty-second clock, so an owner could only keep a room attended by re-dialling forever — about 5.3 TLS handshakes a minute for an idle four-lane room, and a blackout whenever the lanes expired together. An authenticated waiting lease replaces that: the relay pings unpaired peers and any pong renews the lease, bounded by the connection's existing lifetime deadline so authentication expiry and tunnel lifetime still win and still report the honest reason. Idle reaping and the per-route waiting cap are unchanged. Churn drops to about 0.8 dials a minute. The window is now operator-configurable and advertised. Both halves of the pairing contract live in the protocol crate both sides depend on, the server refuses a window narrower than the client's recycle budget plus headroom, and the client derives its budget as min(advertised - margin, local cap) with the shared constants as a fallback rather than a contract — a missing or malformed advertisement is simply absent. No client rollout is gated: a tungstenite client pongs as a side effect of reading, so already-shipped owners renew a lease without knowing leases exist, and their five-minute budget stops being cut short. Widening the budget under a lease also exposed a latent bug: lane staggering was computed from an absolute duration at spawn, so a wider budget would have retired all four lanes in the same instant — exactly the blackout 891f21f97 fixed. Stagger now travels as a slot and is applied after the advertisement resolves. Rejections are legible too. The relay used to write its reason and then drop the socket without reading the peer's close echo, so the reset overtook the frames and the client saw only a generic protocol fault; closes now finish the handshake with a bounded linger and repeat the reason in the close frame, and the client decodes it into a typed pairing-timeout that recycles a lane without faulting the pool. Finally, every previously silent exit — accept, the five early handshake failures, EOF and reset — is logged, alongside a once-a-minute census with owner and guest queue depths, over credential-free route refs. (--no-verify: the workspace fmt gate trips on a concurrent session's op-preview-core edits; touched crates are clippy/fmt clean.)