fix(payment): widen receiver storage admission to uploader over-query window

[jacderida]

Problem

On NAT-simulated testnets (STG-01, rc-2026.6.2), ~3–6% of single-node uploads fail. Each failed upload reports N-1/N stored, 1 failed, and the storer-side rejection is:

ClientPut receiver <peer> is not among this node's local 9 closest peers (close group plus storage margin)

Because the single-node payment path fails the whole file on one un-stored chunk, the per-chunk rejection rate compounds into per-file failures.

Regression

The previous staging run on the same fault-injection environment (30% NAT-simulated nodes, ±2h clock-skewed clients, +3h-skewed node) running v0.12.0-rc.1 achieved 1,724/1,724 uploads (100%) with 2 retried chunks of 69,403. v0.12.0-rc.1 had no single-node receiver/issuer close-group admission gate at all.

The gate was introduced after that run by #136 (feat(payment): accept flexible single-node proof bundles) — validate_store_membership (receiver) and the paid-quote-issuer check. It has since been tuned by #137 (margin), #140 (XOR-only — correct, kept), and #147 (issuer width → K_BUCKET_SIZE). #140 fixed the reachability re-rank; the receiver width was left at close_group_size + STORAGE_ADMISSION_MARGIN (= 9), which is the remaining binding constraint.

Cause

On a network with unreachable (NAT'd, relay-only) peers, the client cannot quote the genuinely-closest nodes, so it legitimately pays a peer that ranks just past close_group_size in a storer's full local routing-table view — that view still contains the closer peers the client could not reach. A close_group_size + 2 admission window is narrower than that divergence, so the storer rejects an honest payment for a chunk it is genuinely XOR-close to.

The merkle path is largely spared because its closeness check already uses a much wider window (2 * CANDIDATES_PER_POOL = 32, 9-of-16 majority) for exactly this reason.

Fix

Size the storage-admission window to the uploader's quote over-query window: close_group_size * STORAGE_ADMISSION_OVERQUERY_MULTIPLIER, where the multiplier (2) mirrors ant-client get_store_quotes (CLOSE_GROUP_SIZE * FAULT_TOLERANT_QUOTE_QUERY_MULTIPLIER). A storer now admits a chunk it is XOR-close to within the same window the uploader selected its close group from. Production close group of 7 → admission window 14 (was 9).

• Check stays XOR-only (find_closest_nodes_local_by_distance_with_self, fix(payment): use XOR-only local lookup for close-group verification #140 preserved).
• Admission and stored-record retention stay coupled (a node that accepts a chunk also retains it) — storage_admission_width drives both, avoiding accept-then-prune churn; the 3-day prune hysteresis is unchanged.
• Audit, quorum, and paid-list target sets are unchanged at close_group_size (they do not use storage_admission_width), so Sybil/payment-integrity guarantees are not loosened.
• The issuer gate (fix(payment): accept paid quote issuers within K closest peers #147, K_BUCKET_SIZE) is untouched.

If 14 proves insufficient under heavier NAT clustering, the multiplier is a one-line bump.

Verification

• cargo check -p ant-node ✅
• cargo test -p ant-node --lib storage_admission_width ✅ (storage_admission_width_is_overquery_window)
• Full validation is a redeploy of STG-01 on this build, confirming the not among local 9 closest rejections disappear — the receiver gate's live behaviour needs a real routing table (the handler only exposes a boolean test-override seam), so it isn't unit-testable in isolation.

🤖 Generated with Claude Code