v20.3.0: adopt persist v41.2.0 + leviculum v0.25.0, the #568 dial detach, #573 pyo3 hybrid, leviculum#52 rotation seal, #575 quorum

[emooreatx]

The whole cut in one PR. Closes #573. Addresses #568 (second mechanism).

Additive at every public surface — two substrate adopts, one transport fix, one FFI fix.

Adopts

persist v41.0.0 → v41.2.0. Two minors, both currency. All four ABI constants unchanged across both, verify stays v14.2.0, so the >=41,<42 wheel floor holds. v41.1.0 (#807) fixes list_widening_candidates; v41.2.0 (#810) adds rejected to the CIRISLens TaskStatus vocabulary with a SQLite V136 rebuild. Edge drives none of it — no TaskStatus, no lens tables, no lens features enabled. v41.2.0's tag derefs to 52f6592, verified green at job level upstream before tagging.

leviculum v0.24.0+ciris.1 → v0.25.0+ciris.1. This one unbreaks our wheels. The upstream catch-up (+92) brought a BLE interface declaring bluer/dbus unconditionally, both pulling libdbus-sys, which builds on neither macOS nor Windows. leviculum's changelog names the consumer:

CIRISEdge's darwin and win_amd64 wheels resolve this crate as a git dependency and would have failed at build time.

Also carries leviculum#63 (below) and leviculum#52, which is addressed in its own section.

#568 — a round no longer destroys the link it paid for

The v20.2.0 fix addressed the missing-signer race. Re-measured: 181 s and 210 s, unmoved. The owner's key was on the peer at 31 s, so the key was never the bottleneck. This is a second, independent mechanism.

DEFAULT_ROUND_TIMEOUT is 10 s. A pathed peer gets LINK_ESTABLISH_TIMEOUT = 30 s to establish. The dial ran inline in the round's future, so a cold dial could never finish inside the round that started it — arithmetic, not load — and abandoning the round dropped the half-built link. Every retry began cold; the peer converged only when it dialled us. The observed shape matches exactly: timeout at +10 s, next completed round ~150 s later = five 30 s cadence ticks.

This is the #532 establish:identify gap one layer up. #532 stopped N coordinators discarding each other's links; nothing stopped a round discarding its own.

The fix. The dial runs in a spawned task holding a cloneable DialCtx, so abandoning a round abandons the wait, not the link. The task completes and publishes into reusable_dialed_link — dial_and_identify's existing "PUBLISH LAST" step — so the next round takes the fast reuse path.

Two deliberate choices worth review:

• DialCtx, not Weak<Self>. ReticulumTransport::new returns Self, so a self-handle needs installing at every construction site, and a site that forgot would silently lose the detach.
• The gate permit is acquired inside the task. Held by the caller it would release on cancellation while the dial it gates still ran — leaving Link churn: 29 establishes per minute across 20 distinct links on a 3-peer mesh, burning ~80% of a core #532's single-flight property true only for callers that survive.

The three moved functions (dial_and_identify, reusable_link_to, path_table_snapshot) moved verbatim onto DialCtx — field names match, so no body changed — with thin delegates left behind so no existing call site moved.

Measurement, not inference

ladder.owner_binding_converged now records leviculum#63's retry_queued / retry_queue_cap / retry_dropped_total beside elapsed_ms. A slow convergence with a flat queue and one with dropped_total climbing are different bugs that read identically as a stopwatch value — and leviculum reported that exact pattern from the live canonical: "the retry queue climbed past its warning threshold and began discarding traffic while the log read as quiet."

Tests

test	pins
the_dial_ctx_shares_the_transports_link_pool	pointer identity on the shared maps — if dial_ctx() ever handed out copies, a detached dial would publish into a map nobody reads and the fix would look applied while changing nothing
a_cold_dial_cannot_fit_inside_a_round	the inequality, with a failure message saying why the detach is not a workaround for it

Not claimed: that 181/210 s is fixed. The tests pin the mechanism; only a mesh run measures the outcome. One run each was not a regression call, and it is not a fix call either.

leviculum#52 — the rotation seal named the wrong hazard

Audited (subagent) against leviculum's finding that seal retires the old IFAC key for inbound, so a zero-dwell rotation strands in-flight traffic — ~50% packet loss upstream, drops_ifac incrementing exactly once each time.

Edge is the API surface, not a driver. It wraps the three phases and re-exports them to Python; nothing in edge sequences them — no activate → seal pair in src/, tests/, or src/bin/. Edge cannot commit the defect itself. Two things it told the operator were wrong:

• The docstring named the wrong hazard. "Call after the convergence window" is about membership. Sealing also retires the old key for inbound, rejecting packets already on the wire from members that did re-key. Following the instruction correctly still stranded traffic — worse than no guidance, because it read as complete. Both seal docstrings rewritten.
• Seal breaks inbound only, so the gauge points the other way. leviculum consults the alternate key only in verify_ifac; apply_ifac never reads it. A node's seal rejects old-masked traffic arriving from peers (upstream saw drops_ifac at the relay). retry_queued is this node's outbound backlog — zero licenses its peers to seal, not itself. The true precondition (every peer at zero) is unobservable from one node; under lockstep rotation each node polling its own gauge approximates it. Now on PyEdge, documented as a fleet proxy, never a measurement of what this node's own seal will reject. The retry queue is the long pole: masked before enqueueing, re-sent verbatim, count-capped (1024), no time bound.

A default — a conservative choice, not a derivation. DEFAULT_IFAC_ROTATION_DWELL = RESOURCE_TRANSFER_TIMEOUT (120 s), exported as default_ifac_rotation_dwell_ms(). Residency has no time bound, so nothing to derive from; 120 s reuses edge's committed answer to how long traffic can legitimately remain in flight. An earlier draft justified it by transfer duration and leviculum#62 — wrong (old-masked bytes stop at activate; #62 is receiver-side reassembly), caught by the audit and corrected before merge. 10 s was proposed; 10 s is shorter than every in-flight window edge already asserts. The safe default — ejecting a compromised member is a reason to go lower on purpose.

Two clocks, not to be harmonized. install → activate waits on key distribution (DEFAULT_CONVERGENCE_WINDOW, 300 s — activating early only degrades stragglers). activate → seal waits on packet drain (DEFAULT_IFAC_ROTATION_DWELL, 120 s — the silent one). Both docstrings and the constant now cross-reference each other so a later "cleanup" equalising them has to argue past the doc. Residency is bounded by neither a clock nor any deterministic quantity: no TTL, head-of-line, airtime-paced, and the 1024 cap bounds depth.

No seal_after_drain helper. It would have to invent a never-drains policy, and both answers are the operator's: block forever and the excluded member stays admitted; time out and seal and the hazard returns, buried in a function whose name promises it can't.

No test, stated plainly. Nothing sequences the IFAC trio, so zero coverage and nothing to regress from. The activate_next → seal_rotation pair in scope_addressing.rs is the address table — in-memory with an injected Instant, structurally blind to a drain hazard. Per upstream the natural test is a ~50% flake; a real test is a soak.

No prior art: upstream Reticulum's IFAC is static config with no rotation ceremony. The three-phase rotation is a leviculum fork invention, and 500 ms is its loopback floor.

#575 — the AV-28 quorum assertion reports while the trust root transitions

Matches CIRISPersist#809 on the same registry and the same guard. Downgraded to ::warning::; re-ran the #571 fault matrix to prove the change moves exactly one case — absent holders, missing charter root, unparseable protocol, old-shape-none-deployed and unrecognised shapes all still red the lane. Tracked in #575, paired with persist's #809 so the two restore together.

#573 — the pyo3 envelope helper signs hybrid

build_signed_inbound_envelope hard-coded None for the PQC half, so since v19.0.0 it could not build a single envelope on the wheel that ships it. Nothing here caught it because its Rust twin had been moved to hybrid — the two codepaths the doc calls identical had silently diverged, and the only caller of the broken one is Python.

pqc_seed_bytes is taken, not derived: a derivation convention has to be known identically by whoever registers the ML-DSA pubkey and whoever signs with it, and when they disagree the only symptom is a verify refusal at the far end with nothing pointing at the cause. derive_ml_dsa_65_pubkey_base64 closes that loop from the same code that signs.

Unblocks CIRISConformance's test_230_intake_gate and test_520_wire_vocabulary::test_tier1_and_opaque_variants_accepted.

Verification

• cargo tree -i — one copy each of persist 41.1.0, verify trio 14.2.0, leviculum 0.25.0
• clippy -D warnings clean: pyo3-full --all-targets, three transport combos, the mesh-harness binary, the test-anchor lane
• 1461 lib tests pass at 81c18ac; integration suite re-running (1867 passed at 757f97a; exit status captured from cargo, not a filtered pipe)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.