fix(payment): verify closeness against pure-XOR view; escalate Merkle on mismatch

[jacderida]

Summary

Fixes two upload-breaking regressions seen on testnets with a meaningful NAT fraction (e.g. STG-01: ~900 nodes, 30% NAT-simulated — every upload failed). Both stem from the same root cause: storer-side closeness verification compares the uploader's network-walk-derived peer set against the storer's local routing-table view, and those views diverge on a real network.

1. Single-node payment close-group check (regressed by saorsa-core #121)

The check (introduced in #107) calls find_closest_nodes_local_with_self. When saorsa-core #121 re-ranked that lookup (reachability_tier, xor_distance) — correct for storage selection — the verifier silently inherited it. The re-rank demotes XOR-close relay-only / NAT'd peers out of the local top-CLOSE_GROUP_SIZE, while the uploader's quoted set (get_store_quotes, pure XOR) still contains them. Result: only 3–4 of 7 quoted peers match, breaching the >=5 threshold → every single-node payment rejected.

Fix: switch to the XOR-only find_closest_nodes_local_by_distance_with_self (WithAutonomi/saorsa-core#122), exactly mirroring the Merkle closeness path. Still a pure local lookup → no added network cost.

2. Merkle candidate-pool closeness check (regressed by #111)

#111 moved this check off the authoritative iterative-Kademlia network lookup onto the local routing table (a real per-chunk latency win), with the network fallback gated on local-table size, not match outcome. The DoS argument was sound — an attacker can't make a victim's table sparse — but it also means that when the local k-bucket sample legitimately disagrees with the uploader's network-walked candidates (which include reachable responders from positions 17–32), honest pools are hard-rejected with no escalation. On STG-01 this was 100% of Merkle uploads (candidate pub_keys do not match; node logs: all match-failures, zero sparse-defers, zero timeouts).

Fix: keep #111's local fast path — accept immediately on a local match (the common case on a healthy, converged network) — but escalate to the authoritative network lookup on match failure as well as sparsity. This restores the pre-#111 correctness only on the (rare, on a healthy net) mismatch path, not per chunk.

DoS bound: the reopened network-fallback path is capped by a new closeness_fallback_permits semaphore (CLOSENESS_NETWORK_FALLBACK_CONCURRENCY = 16). inflight_closeness already collapses same-pool concurrency; this caps the distinct-pool_hash case so a forged-pool flood cannot spawn unbounded CLOSENESS_LOOKUP_TIMEOUT-long walks. Excess concurrent walks get a fast, retryable rejection rather than queueing — addressing the exact DoS rationale #111 gave for the size-only gate.

Dependency / merge order

⚠️ Requires WithAutonomi/saorsa-core#122 (find_closest_nodes_local_by_distance_with_self) to land on rc-2026.5.4 first. The saorsa-core git pin then resolves it via cargo update -p saorsa-core; until then CI here will not compile. (Verified locally against #122 via a path patch.)

Test plan

• cargo check --lib — clean (against saorsa-core#122)
• cargo test --lib payment::verifier — 67 passed, 0 failed
• cargo clippy --lib --all-features -- -D clippy::panic -D clippy::unwrap_used -D clippy::expect_used — clean
• cargo fmt --all -- --check — clean
• Follow-up (not in this PR): testnet upload run on a NAT-simulated network confirming single-node + Merkle uploads succeed, plus per-chunk store_durations_ms p50/p99 vs baseline to confirm the fast path is preserved

🤖 Generated with Claude Code