Module peer 

Per-server reachability store backed by the servername_status CF.

Each failure writes one row keyed (servername, bucket) with bucket = now.as_secs() / window_secs; the tuple codec joins the parts with ser::SEP, so the on-disk key is servername || SEP || u64_be(bucket). The value is the Classification byte, optionally trailed by the failure instant as u64_be seconds. Two failures in one window collide on the same key (a correct collision: the window is the coalescing quantum) and two failures in different windows produce two rows, so a failure is always a blind write and never a read-modify-write.

should_attempt scans a server’s rows: the newest failure is the backoff anchor (its recorded instant) and the window span between the oldest and newest surviving rows is the streak, so the gate and the earliest_retry it reports are one comparison and stay coherent when the clock crosses a window boundary. record_success and note_peer_alive clear the whole prefix, so a recovered or reachable peer is immediately attemptable again.

window_secs is sourced from sender_timeout at service build time so the peer-status curve does not drift from the sender’s existing quadratic backoff when both observe the same peer.

Structs

Backoff 🔒

Latest-failure state feeding the pure attempt_verdict decision.

PeerBackoff

Admin-facing summary of a peer’s current failure streak, seconds since the epoch.

Streak 🔒

Fold state accumulated over one server’s failure rows.

Enums

Classification

Permanence classification supplied alongside a failure.

ShouldAttempt

Verdict for [Service::should_attempt].

Constants

MAX_BACKOFF 🔒

Backoff ceiling, matching sender_retry_backoff_limit’s 24h default.

Functions

attempt_verdict 🔒

Pure backoff verdict from a peer’s latest failure state: attemptable once the delay past the anchor has elapsed.

classify 🔒

classify_error 🔒

Classifies a failed federation attempt for the peer-reachability store, or None when it carries no reachability signal. An HTTP response proves the peer reachable, so a content-level 4xx (a forbidden invite, a 403 backfill) must not count against it; only 5xx or an explicit rate-limit (429) records Transient. A 410 is the exception: a Matrix server never returns it for one endpoint and not another, so a received 410 is a proxy operator deliberately signaling the peer is gone, and records Permanent. A non-JSON body is the other exception: it means a proxy or CDN answered rather than the homeserver, so it signals a stale route, not peer content, and records Transient to place the eviction that follows behind the backoff gate. Transport failures carry no response and are always transient.

failure_secs 🔒

Failure instant (seconds since the epoch) recorded after the classification byte; old single-byte rows carry no timestamp and yield None.

fold_streak 🔒

Folds one failure row into a server’s running streak: the newest row sets the class and anchor, the oldest bucket is retained.