refactor(bpa,bpv7): stream the ingress spool — validate the payload as it drains, one metadata write

[ricktaylor]

Stream the ingress spool: validate on the drain, store as received, write metadata once

Stacked PR. This branch sits on refactor/filters (#712), which sits on fix/bpa-dispatch-redelivery (#710); with main as the base the diff shows those legs too. This PR's own content is the 17 commits from feat(bpv7): add incremental payload-BIB verification to refactor(bpa): drop the rebuild-and-retry loop on DuplicateBundle.

What this leg does

Bundle reception becomes one streaming pipeline: every gate decision is taken on the resident header prefix, the payload then drains through a validating tail, and an admitted bundle is written to the metadata store exactly once. Nothing about a bundle is edited on input — what is stored is what arrived.

• Incremental payload-BIB verification (bpv7). bpsec::bib::Operation::begin_verify returns a Verifier pre-fed with every header-resident IPPT part; the caller feeds payload data as it streams and settles with a constant-time tag compare. Verifiers are begun inside the keyed header pass — key material is resolved once per bundle and never crosses an await; only the Send digest states ride the drain. BREAKING: checks::verify_payload is removed — an oversized signed bundle needs no whole-buffer verification pass, which is the point.
• TailReceiver, the validating drain. Payload CRC, bundle framing, and each deferred payload-BIB digest are fed per segment as the payload drains; finalize/verify_payload and the resident re-verification they implied are gone.
• The Ingress chain runs at the pre-drain gate. A chain Drop skips the drain and the store entirely and reports like the sibling gate rejections. RFC 9171 §5.1.1 failure-drops and unrecognised-block removals are scheduled in metadata and applied per attempt at the output doors — received bytes are never rewritten in place, and a shared BCB whose failed co-target is dropped keeps its remaining coverage.
• One metadata write. An admitted bundle is inserted directly at Dispatching, carrying the chain's classifier deltas; New becomes an in-memory marker that is never persisted, and restart treats a recovered Dispatching record as chain-complete. BREAKING: MetadataStorage::replace is removed with the last non-status rewrite of a stored record — after insert, only status moves.
• Conforming, coalesced reject reporting. Every ingress reject with a recoverable bundle id emits the RFC 9171 §5.6/§5.10 pair as a single status report bundle (one §6.1.1 record asserting both reception and deletion, each gated on its own flag). §5.6 Step 4 is honoured: a block flagged report_on_failure triggers its "Block unsupported" report on the block flag alone. Drain failures report like any other parsing failure; truncated streams are refused, never reported.

Rides along

• The add_peer mid-construction removal race (whole-codebase review Bump regex from 1.10.4 to 1.10.5 #14) is fixed and pinned: peers are constructed complete, published once, and the addition re-checks its address claim after construction.
• The post-registration WaitingForService poll is spawned, not awaited inline, so a gRPC-bridge-shaped sink cannot deadlock registration against its own announcements (the Refactor/grpc api v1 #667 salvage, now pinned by test).
• The rebuild-and-retry loop on DuplicateBundle at the originate door is gone.
• The controller-owned queue assignment is recorded in docs/policy_subsystem_redesign.md.

Storage backends change shape (replace deleted); external implementors should read the BREAKING bullets in bpa/CHANGELOG.md and bpv7/CHANGELOG.md.

🤖 Generated with Claude Code