Module node_facts_exchange 

Node facts and deltas over the mesh with receiver-assigned trust (card mesh-placement-03). Node facts over the mesh (ADR-099 sections 2 and 8, card mesh-placement-03).

FactsExchange is the node-local side of facts distribution:

• Publish. The local node signs its NodeFacts and sends the signed base to every peer (FactsExchange::publish). When only live state changed (capability states, free memory) it sends a small signed FactsDelta instead (FactsExchange::update_live); a changed capability set, or a base nearing its TTL, produces a new base. A peer that joins, or that reports a missing base, is sent the current base and latest delta.
• Receive. Facts arrive as mesh.node_facts control messages (FACTS_TOPIC) and are handled through PeerControlSink with the connection’s authenticated identity. Nothing is trusted on arrival: the signature, the key-to-node-id binding, the TTL window and the seq ordering are all checked by [NodeFactsCache], and a peer can only speak for itself (node_id must be the sender).
• Budget. Each connection has a frame and byte budget, charged on the whole frame and spent before anything is parsed or verified; one connection holds at most MAX_DISCOVERED_PER_CONN Discovered entries and the cache holds at most 512 in all (the heaviest connection loses its oldest entry first). A connection that reconnects gets a fresh id and a fresh quota, so a patient attacker can still churn the Discovered class; Paired and Pinned entries are never touched.
• Trust. The receiver assigns the TrustTier. A peer whose node id admission verified (ADR-103 A10) gets FactsTrustPolicy::verified_tier; any other connection (including every peer under observe, where none is marked verified) gets the lowest tier. A node’s tier is never lowered by a later frame, and the local node’s facts can never be replaced from the wire.
• Provenance. The receiver did not probe or measure remote data, so the cached copy caps every capability’s provenance: probed for a verified peer, claimed otherwise. measured is never held for a remote node. The signed envelope is kept as received.

Re-exports

pub use crate::mesh_runtime::FACTS_TOPIC;

pub use crate::mesh_runtime::PeerControlSink;

Structs

FactsExchange

Node-local facts distribution.

FactsTrustPolicy

What tier and provenance a peer’s facts earn.

Enums

FactsWire

Wire body of a mesh.node_facts message.

IngestError

Why a facts message was refused.

IngestOutcome

What receiving one facts message did.

Published

What FactsExchange::update_live sent.

Constants

BYTES_PER_SEC

Payload bytes per second one connection may send (burst 4x).

FRAMES_PER_SEC

Frames per second one connection may send on the facts topic (burst 2x).

MAX_DISCOVERED_PER_CONN

Most Discovered entries one connection may hold: an unverified connection can claim any source id, so it cannot fill the cache.