From 82fcccd1135747076522cc47322c66980ed4e049 Mon Sep 17 00:00:00 2001 From: archipelago Date: Thu, 23 Jul 2026 18:25:18 -0400 Subject: [PATCH] =?UTF-8?q?docs(handoff):=20node-side=20mesh=20diagnosis?= =?UTF-8?q?=20=E2=80=94=20nginx=20v6=20fixed,=20real=20blocker=20is=20sess?= =?UTF-8?q?ion=20path=20quality?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- ...HANDOFF-2026-07-23-companion-apk-deploy.md | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/docs/HANDOFF-2026-07-23-companion-apk-deploy.md b/docs/HANDOFF-2026-07-23-companion-apk-deploy.md index fcf67854..1dba26d8 100644 --- a/docs/HANDOFF-2026-07-23-companion-apk-deploy.md +++ b/docs/HANDOFF-2026-07-23-companion-apk-deploy.md @@ -85,3 +85,44 @@ what remains to the node side. State as of vc24: - `ip addr show fips0` + confirm the web server listens on `[::]:80` Report whether the node ever sees a session attempt from `npub132c5whrsa6ccs0eylcpzaejq9uxul5ldvczz0axq78dh7fxkqj9st4uvzu`. + +## Node-side diagnosis complete (23:00–23:30, archi-dev-box agent) + +Chain of findings, each verified live: + +1. **FIXED: nginx had no IPv6 listener anywhere** — every shipped config + listened on 0.0.0.0 only, so `http://[]` could NEVER connect on any + node, ever. Live-fixed on framework-pt + .116, canonical conf + bootstrap + self-heal shipped (`1e89362e`), heal binary deployed. ULA HTTP verified + answering on both nodes (local + over-mesh). +2. Firewall clean, fd00::/8 routes correct both ends, wire compat proven + (node + vps2 anchor both run fips 0.4.1 rev 15db6471db — the latest + upstream stable; nothing newer exists). +3. **THE REMAINING PROBLEM IS MESH SESSION PATH QUALITY.** From the vps2 + anchor — a DIRECT connected peer — `GET /health` on the node's ULA takes + **15–17 s per request and intermittently fails outright** (nginx logs + show 499 client-gave-up then 200; TCP SYN-retransmit backoff signature). + Session MMP is wildly asymmetric: node→vps2 srtt 204 ms, **vps2→node + srtt 4270 ms** — on a direct link whose raw RTT is 4 ms. Session traffic + is not riding the direct link; it appears to route through the ~1271-node + public tree (node's tree root is the public 00001a8c, depth 8; the node's + log also shows chronic "Discovery lookup timed out" for other targets). +4. The phone's npub never appears in the node's sessions — consistent with + discovery/handshake dying on the same degraded tree path, and the app's + ~8 s probe window being far smaller than the observed 15 s+ first-request + latency even on the GOOD path. + +### Recommendations + +- **App side (Mac agent):** widen the ULA probe/connect window to ≥30 s + with retransmit-friendly pacing, and PRE-WARM the mesh session (start + pinging the node ULA as soon as the VPN is up, decoupled from the UI + probe) so the WebView hits a warm session. +- **Infra decision (user):** consider detaching the fleet from the public + v0l mesh — private tree rooted at the vps2 anchor (drop the legacy + 185.18.221.160 seed anchor fleet-wide AND vps2's public peering). A + 2-hop private tree would make session paths ride the direct links and + should collapse latency to ms. Trade-off: no reachability to/from the + broader public mesh. +- **Upstream:** report the direct-peer session-path asymmetry to + jmcorgan/fips (0.4.1).