fix: track transient connections separately

AGENTS.md

@@ -157,6 +157,7 @@ Run these in any worktree before pushing a branch or opening a PR.
   ```
 - Tests can share the static network and access `NETWORK.gateway(0).ws_url()` to communicate via `freenet_stdlib::client_api::WebApi`.
 - Run the crate’s suite with `cargo test -p freenet-test-network`. When `preserve_temp_dirs_on_failure(true)` is set, failing startups keep logs under `/tmp/freenet-test-network-<timestamp>/` for inspection.
+- A larger soak test lives in `crates/core/tests/large_network.rs`. It is `#[ignore]` by default—run it manually with `cargo test -p freenet --test large_network -- --ignored --nocapture` once you have `riverctl` installed. The test writes diagnostics snapshots to the network’s `run_root()` directory for later analysis.
 
 ## Pull Requests & Reviews
 

apps/freenet-ping/app/tests/common/mod.rs

@@ -125,6 +125,8 @@ pub async fn base_node_test_config_with_rng(
             ignore_protocol_checking: true,
             address: Some(Ipv4Addr::LOCALHOST.into()),
             network_port: public_port, // if None, node will pick a free one or use default
+            min_connections: None,
+            max_connections: None,
             bandwidth_limit: None,
             blocked_addresses,
             transient_budget: None,

crates/core/Cargo.toml

@@ -65,6 +65,7 @@ xz2 = { version = "0.1" }
 reqwest = { version = "0.12", features = ["json"] }
 rsa = { version = "0.9", features = ["serde", "pem"] }
 pkcs8 = { version = "0.10", features = ["std", "pem"] }
+sha2 = "0.10"
 
 # Tracing deps
 opentelemetry = "0.31"
@@ -90,7 +91,7 @@ arbitrary = { features = ["derive"], version = "1" }
 chrono = { features = ["arbitrary"], workspace = true }
 freenet-stdlib = { features = ["net", "testing"], workspace = true }
 freenet-macros = { path = "../freenet-macros" }
-freenet-test-network = "0.1.1"
+freenet-test-network = { version = "0.1.3", path = "../../../../freenet-test-network" }
 httptest = "0.16"
 statrs = "0.18"
 tempfile = "3"
@@ -100,6 +101,7 @@ tokio-tungstenite = "0.27.0"
 # console-subscriber = { version = "0.4" }
 ureq = { version = "3.1", features = ["json"] }
 which = "8.0"
+regex = "1"
 
 [features]
 default = ["redb", "trace", "websocket"]

crates/core/src/config/mod.rs

@@ -102,6 +102,8 @@ impl Default for ConfigArgs {
                 blocked_addresses: None,
                 transient_budget: Some(DEFAULT_TRANSIENT_BUDGET),
                 transient_ttl_secs: Some(DEFAULT_TRANSIENT_TTL_SECS),
+                min_connections: None,
+                max_connections: None,
             },
             ws_api: WebsocketApiArgs {
                 address: Some(default_listening_address()),
@@ -243,6 +245,38 @@ impl ConfigArgs {
             self.ws_api
                 .token_cleanup_interval_seconds
                 .get_or_insert(cfg.ws_api.token_cleanup_interval_seconds);
+            self.network_api
+                .address
+                .get_or_insert(cfg.network_api.address);
+            self.network_api
+                .network_port
+                .get_or_insert(cfg.network_api.port);
+            if let Some(addr) = cfg.network_api.public_address {
+                self.network_api.public_address.get_or_insert(addr);
+            }
+            if let Some(port) = cfg.network_api.public_port {
+                self.network_api.public_port.get_or_insert(port);
+            }
+            if let Some(limit) = cfg.network_api.bandwidth_limit {
+                self.network_api.bandwidth_limit.get_or_insert(limit);
+            }
+            if let Some(addrs) = cfg.network_api.blocked_addresses {
+                self.network_api
+                    .blocked_addresses
+                    .get_or_insert_with(|| addrs.into_iter().collect());
+            }
+            self.network_api
+                .transient_budget
+                .get_or_insert(cfg.network_api.transient_budget);
+            self.network_api
+                .transient_ttl_secs
+                .get_or_insert(cfg.network_api.transient_ttl_secs);
+            self.network_api
+                .min_connections
+                .get_or_insert(cfg.network_api.min_connections);
+            self.network_api
+                .max_connections
+                .get_or_insert(cfg.network_api.max_connections);
             self.log_level.get_or_insert(cfg.log_level);
             self.config_paths.merge(cfg.config_paths.as_ref().clone());
         }
@@ -374,6 +408,14 @@ impl ConfigArgs {
                     .network_api
                     .transient_ttl_secs
                     .unwrap_or(DEFAULT_TRANSIENT_TTL_SECS),
+                min_connections: self
+                    .network_api
+                    .min_connections
+                    .unwrap_or(DEFAULT_MIN_CONNECTIONS),
+                max_connections: self
+                    .network_api
+                    .max_connections
+                    .unwrap_or(DEFAULT_MAX_CONNECTIONS),
             },
             ws_api: WebsocketApiConfig {
                 // the websocket API is always local
@@ -565,6 +607,22 @@ pub struct NetworkArgs {
     #[arg(long, env = "TRANSIENT_TTL_SECS")]
     #[serde(rename = "transient-ttl-secs", skip_serializing_if = "Option::is_none")]
     pub transient_ttl_secs: Option<u64>,
+
+    /// Minimum desired connections for the ring topology. Defaults to 10.
+    #[arg(long = "min-number-of-connections", env = "MIN_NUMBER_OF_CONNECTIONS")]
+    #[serde(
+        rename = "min-number-of-connections",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub min_connections: Option<usize>,
+
+    /// Maximum allowed connections for the ring topology. Defaults to 20.
+    #[arg(long = "max-number-of-connections", env = "MAX_NUMBER_OF_CONNECTIONS")]
+    #[serde(
+        rename = "max-number-of-connections",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub max_connections: Option<usize>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -639,6 +697,20 @@ pub struct NetworkApiConfig {
     /// Time (in seconds) before an unpromoted transient connection is dropped.
     #[serde(default = "default_transient_ttl_secs", rename = "transient-ttl-secs")]
     pub transient_ttl_secs: u64,
+
+    /// Minimum desired connections for the ring topology.
+    #[serde(
+        default = "default_min_connections",
+        rename = "min-number-of-connections"
+    )]
+    pub min_connections: usize,
+
+    /// Maximum allowed connections for the ring topology.
+    #[serde(
+        default = "default_max_connections",
+        rename = "max-number-of-connections"
+    )]
+    pub max_connections: usize,
 }
 
 mod port_allocation;
@@ -656,6 +728,14 @@ fn default_transient_ttl_secs() -> u64 {
     DEFAULT_TRANSIENT_TTL_SECS
 }
 
+fn default_min_connections() -> usize {
+    DEFAULT_MIN_CONNECTIONS
+}
+
+fn default_max_connections() -> usize {
+    DEFAULT_MAX_CONNECTIONS
+}
+
 #[derive(clap::Parser, Debug, Default, Copy, Clone, Serialize, Deserialize)]
 pub struct WebsocketApiArgs {
     /// Address to bind to for the websocket API, default is 0.0.0.0

crates/core/src/node/mod.rs

@@ -192,8 +192,8 @@ impl NodeConfig {
             config: Arc::new(config.clone()),
             max_hops_to_live: None,
             rnd_if_htl_above: None,
-            max_number_conn: None,
-            min_number_conn: None,
+            max_number_conn: Some(config.network_api.max_connections),
+            min_number_conn: Some(config.network_api.min_connections),
             max_upstream_bandwidth: None,
             max_downstream_bandwidth: None,
             blocked_addresses: config.network_api.blocked_addresses.clone(),