…hods

Adds the libp2p / catchup / sync-backoff / breakdown-metrics state that the
P2P registry tracks today, so the blockchain registry can become the single
source of truth.

PeerInfo + PeerRegistryInfo proto gain 12 fields:
IsConnected, LastBlockTime, BlocksReceived, SubtreesReceived,
TransactionsReceived, CatchupBlocks, LastSyncAttempt, SyncAttemptCount,
LastReputationReset, ReputationResetCount, LastCatchupError,
LastCatchupErrorTime.

CentralizedPeerRegistry + PeerRegistryService gain 11 RPCs / methods:
UpdateConnectionState, UpdateLastMessageTime, UpdateStorage,
RecordSyncAttempt, ClearAllSyncAttempts, RecordBlockReceived,
RecordSubtreeReceived, RecordTransactionReceived, RecordCatchupError,
ResetReputation, ReconsiderBadPeers. Cleanup(maxSize, ttl) is also
ported (the periodic driver lives in a follow-up).

ReconsiderBadPeers semantics swap from threshold-30/recover-50 to
threshold-20/recover-30 with exponential cooldown via LastReputationReset
+ ReputationResetCount, matching the original P2P behaviour.

ListPeers gains a sort_by_storage filter so catchup peer selection can
prefer "full" peers without a separate RPC.

Foundation only: still no consumer beyond existing tests.

…hain client

P2P no longer hosts peer state. The local PeerRegistry, peer_registry_cache,
and BanManager are deleted; the centralized blockchain peer registry (PR bsv-blockchain#832)
is the single source of truth for peer identity, ban scoring, reputation, and
runtime metrics. P2P holds a blockchain.PeerRegistryClientI and translates
between libp2p peer.ID and the registry's canonical string ID at every
boundary.

Architecture:
- p2p.Server.peerRegistry is now a gRPC client into the blockchain service.
  The daemon wires it via daemon_stores.GetPeerRegistryClient, mirroring the
  existing GetBlockchainClient pattern (always-gRPC, even single-binary).
- SyncCoordinator drops its banManager and *PeerRegistry fields; every
  registry callsite goes through the client. currentSyncPeer becomes a
  canonical libp2p ID string instead of peer.ID.
- PeerSelector takes []*blockchain.PeerInfo and returns string IDs.
- BanManager's threshold bookkeeping moves to the registry's AddBanScore
  RPC, which already syncs BanScore/IsBanned atomically. The disconnect-on-
  ban side effect is preserved via Server.onPeerBanned, invoked when AddBanScore
  reports a NEW ban transition.
- updateBytesReceived and RecordBytesDownloaded swap their racy
  read-modify-write for the registry's atomic UpdatePeerMetrics delta path.
- p2p.ClientI signatures and p2p_api proto wire format are preserved so
  external consumers (asset, RPC, blockvalidation, monitor, diagnose)
  compile unchanged. Conversion between blockchain.PeerInfo and
  p2p_api.PeerRegistryInfo lives in peerInfoToP2PProto.

Out of scope (PR2):
- External consumers migrate from p2p.ClientI to blockchain.PeerRegistryClientI
  directly.
- p2p_api.PeerRegistryInfo proto and the now-redundant P2P RPCs are deleted.
- TTL+LRU cleanup goroutine driver moves to blockchain Server.go (the
  Cleanup method itself ships in PR1).
- Settings rename (P2P.PeerCacheDir → BlockChain.PeerRegistryPath etc).

Tests:
- All P2P registry / cache / ban manager tests are deleted along with the
  files they exercise (~13K LOC of generated proto + test fixtures gone).
- Server_test, sync_coordinator_test, peer_selector_test, server_handler_test,
  sync_integration_test, report_invalid_block_test, catchup_metrics_integration_test
  are deleted in this commit; coverage is rebuilt against the new client in
  PR2 (tracked).
- A new blockchain.NewLocalPeerRegistryClient adapter ships in this commit
  for tests and same-process callers that want to avoid gRPC.

Remove was deleting both the peer entry and its ban-score entry, which broke
the ban-on-threshold flow: P2P Server.onPeerBanned calls removePeer right
after AddBanScore reports a fresh ban, and that path was wiping the score
needed for the very next IsBanned check. The end-to-end TestPeerIDBanE2E
caught the regression.

Bans are intentionally independent of peer presence: a peer cannot reset its
own ban by reconnecting. ClearBannedPeers is the explicit knob for wiping
ban state.

Persistence
- Save() and Load() now serialise the banScores map alongside peers via a
  versioned envelope. Banned peers are exempt from the TTL cull on Load —
  otherwise a peer could clear its own ban by going quiet for the TTL
  window and reconnecting. Ban entries whose BanUntil already passed are
  dropped on load. New tests cover round-trip, TTL exemption, and expired
  ban cleanup.

gRPC round-trip
- protoToPeerInfo unconditionally sets TransportTypeSet=true. The wire
  format always carries transport_type, so a peer arriving via gRPC has
  always crossed an explicit-set boundary; subsequent Register updates
  that omit the field will now correctly preserve the transport.

Coverage
- New unit tests for handle_catchup_metrics (RecordCatchup{Attempt,Success,
  Failure,Malicious}, UpdateCatchup{Reputation,Error}, GetPeersForCatchup,
  ReportValid{Subtree,Block}, IsPeer{Malicious,Unhealthy}).
- New unit tests for peer_selector (full vs pruned, forced peer, sync
  cooldown, tie-breakers).
- New server-handler tests covering peerInfoToP2PProto round-trip,
  AddBanScore reasons, RecordBytesDownloaded delta accumulation,
  ResetReputation, GetPeerRegistry, GetPeer, IsBanned via the registry.

Tests use blockchain.NewLocalPeerRegistryClient against an in-memory
CentralizedPeerRegistry so they exercise the same code paths the gRPC-mode
daemon uses, just bypassing the wire round-trip.

Adds 33 tests against the rewritten p2p code so sonar's new-code coverage
gate has something to count.

server_helpers_test.go:
- addPeer / addConnectedPeer / removePeer / getPeer / updateStorage
  wrappers (all delegate to the centralized peer registry).
- InjectPeerForTesting (storage=full marker).
- getSyncPeer with no coordinator.
- getPeerIDFromDataHubURL lookup hit + miss.
- shouldSkipBannedPeer / shouldSkipUnhealthyPeer behaviour against the
  registry's ban + reputation state.
- addProtocolViolation accumulating to a ban via the registry.
- applyBanScore on a nil registry (no-panic).
- onPeerBanned with a non-decodable peer ID (no-panic).

sync_coordinator_test.go:
- isViableSyncCandidate filter cases.
- listAllPeers / GetCurrentSyncPeer / ClearSyncPeer.
- isCaughtUp paths: no peers, ahead peer, low-rep peer.
- HandlePeerDisconnected removes the registry entry.
- HandleCatchupFailure with no current sync peer (no-panic).
- getPeer round-trip via libp2p ID.
- Backoff lifecycle (enter, reset, multiplier).
- considerReputationRecovery is a no-op for healthy peers.
- UpdatePeerInfo registers in the centralized registry.
- UpdateBanStatus on an unknown peer (no-panic).
- TriggerSync with no eligible peers does not enter backoff.
- selectNewSyncPeer prefers full storage over pruned.

All tests use blockchain.NewLocalPeerRegistryClient against an in-memory
CentralizedPeerRegistry.

Pushes new-code coverage past the gate by exercising paths the previous
test pass didn't reach.

sync_coordinator_test.go (+9):
- selectAndActivateNewPeer: enters backoff when no eligible peer; activates
  the eligible peer and stamps currentSyncPeer.
- activateSyncPeer: stores the ID and syncStartTime even when the kafka
  send fails (no producer wired in tests).
- sendSyncTriggerToKafka: nil producer / empty hash short-circuits.
- Start/Stop lifecycle: Stop returns within 2s after Start (catches
  goroutine leaks symmetrically with the registry-side Close test).
- checkAndClearExpiredBackoff: not-in-backoff vs still-in-window.

handle_catchup_metrics_test.go (+9):
- Invalid peer IDs return errors for RecordCatchupSuccess/Failure/Malicious
  and UpdateCatchupError.
- ReportValidSubtree/Block invalid peer IDs.
- ReportValidBlock empty-arg validation.
- IsPeerUnhealthy: invalid ID, empty ID, low success rate path.

971 unit tests pass with -race; golangci-lint clean.

1. Concurrent saves used the same `<path>.tmp`, so the periodic saver +
   shutdown could clobber each other's temp file. savePeerRegistry now
   uses os.CreateTemp(dir, basename+".tmp.*") for a unique, exclusive
   temp file per call, with cleanup on every error path. Added concurrent-
   save smoke test.

2. Load dropped expired ban entries but left PeerInfo.IsBanned=true on the
   peer struct, so selection / cleanup paths saw the peer as banned even
   though IsBannedPeer() returned false. Load now reconciles
   PeerInfo.IsBanned / BanScore against the surviving banScores map.
   Added test for the expired-on-disk case.

3. AddBanScore did not refresh a stale ban: an expired ban with
   Banned=true would absorb the new violation's score, then a later
   IsBannedPeer call would wipe everything. AddBanScore now expires the
   stale ban entry first (clears Banned/Score/Reasons + syncs to PeerInfo)
   so the new strike accumulates fresh and can re-arm a new ban via the
   threshold check. Added test.

4. Server.onPeerBanned hardcoded a 24h address-list ban, disagreeing with
   the centralized registry when p2p_ban_duration was configured. Now
   reads s.settings.P2P.BanDuration with a 24h fallback. Test confirms
   the helper still completes when P2PClient is nil.

5. Untrusted peer-supplied client names are now sanitized (length cap +
   strip control bytes / XSS-flavoured ASCII) before storage in the
   registry, restoring the protection the deleted P2P registry had. Both
   the new-entry and update branches of Register apply the filter. Tests
   cover sanitization and length cap.

Adjusted TestCentralizedPeerRegistry_Persistence_AllFields to also seed a
banScores entry so Load's new reconciliation keeps IsBanned=true.

977 tests pass with -race; golangci-lint clean.

Adds 13 tests aimed at the new-code lines sonar still flagged.

peer_registry_client_additional_test.go (+8):
- UpdateConnectionState round-trip (true/false flip).
- UpdateLastMessageTime advances the timestamp.
- UpdateStorage stores the mode.
- RecordSyncAttempt accumulates SyncAttemptCount; ClearAllSyncAttempts
  reports the cleared count.
- RecordBlock/Subtree/Transaction increment the per-type counters and
  blend AvgResponseTimeMs.
- RecordCatchupError stores message + timestamp.
- ResetReputation single peer + all-peers count.
- ReconsiderBadPeers respects cooldown (recent failure → 0).

server_test.go (+2):
- savePeerRegistryPeriodically writes the file at the configured tick
  and exits cleanly on ctx cancel.
- Stop persists the registry when PeerRegistryPath is set (also exercises
  the new Close() drain that runs before Save).

987 unit tests pass with -race; golangci-lint clean.

1. Save serialization (Server.go:794, peer_registry_persistence.go:71).
   savePeerRegistry already used os.CreateTemp for unique tmp paths, but
   two saves could still snapshot at different times and rename
   out-of-order, so the final file lost the latest state. Adds a
   per-registry saveMu around the entire snapshot+write+rename sequence
   so concurrent Save() calls cannot trample one another. Test runs 32
   concurrent writers and verifies the final envelope is intact with no
   leftover .tmp files.

2. Cleanup goroutine + configured TTL (Server.go:421, peer_registry.go).
   Adds CentralizedPeerRegistry.StartCleanup(ctx, interval, ttl, maxSize)
   which runs the existing Cleanup method on a ticker, registered with
   the same WaitGroup as StartBanDecay so Close() drains it cleanly.
   Server.Start now wires it from tSettings.P2P.PeerRegistryTTL,
   PeerRegistryCleanupInterval, PeerRegistryMaxSize. Load() also honours
   PeerRegistryTTL instead of the hardcoded 24h. Settings remain under
   tSettings.P2P.* in this PR; the ownership rename is a follow-up.
   Tests cover the loop running, exiting on Close(), and the
   zero-interval no-op path.

3. Expire bans before reads + cleanup (peer_registry.go).
   expireBansLocked now runs at the start of Get, List (any
   excludeBanned value), ListBannedPeers, and Cleanup. Previously only
   List(excludeBanned=true) ran the sweep, so dashboards / RPC clients
   could still see IsBanned=true on a peer whose ban window had elapsed,
   and Cleanup's isCleanupExempt() would treat that stale flag as a
   reason to keep an idle peer. Get and List now take the write lock so
   the snapshot they return reflects the elapsed ban window. Cleanup
   normalises before checking exemptions. Tests cover Get, List, and
   ListBannedPeers normalising an expired ban; a separate test confirms
   an expired-ban peer is no longer exempt from TTL cleanup.

994 unit tests pass with -race; golangci-lint clean.

…astMessageTime

Cleanup was using LastMessageTime as the TTL/LRU recency signal, but several
hot activity paths only refresh LastSeen:

- UpdateMetrics(LastSeen = now)
- recordReceivedSuccessLocked(LastSeen = LastInteractionSuccess) used by
  RecordBlockReceived / RecordSubtreeReceived / RecordTransactionReceived

So a peer that was actively delivering blocks/subtrees but not gossiping
could be evicted as stale on the first cleanup tick — a regression
amplified now that StartCleanup runs by default. Persistence Load already
uses LastSeen as its TTL signal, so the two paths disagreed.

Adds peerActivity(info) which prefers LastSeen and falls back to
LastMessageTime for older persisted records that pre-date that
convention. Cleanup uses peerActivity for both the TTL pass and the
LRU candidate sort.

Existing TTL tests updated to backdate both freshness fields. New tests:
- Cleanup keeps an active peer alive when LastSeen is fresh but
  LastMessageTime is stale.
- Cleanup falls back to LastMessageTime when LastSeen is zero.

Previously peerActivity only fell back to LastMessageTime when LastSeen
was zero, which let UpdateLastMessageTime callers get evicted: the RPC
refreshes only LastMessageTime, so a peer with an old non-zero LastSeen
plus a fresh LastMessageTime was treated as stale even though activity
just landed.

peerActivity now returns the newer of the two timestamps. Adds a
regression test where LastSeen is older than the TTL, LastMessageTime
is current, and Cleanup must keep the peer.

…egistry

…egistry

…iles

Per @icellan's review feedback. The previous implementation talked
directly to the filesystem (os.WriteFile / os.Rename), which matches
what the old P2P registry did but doesn't compose with the blob.Store
abstraction the rest of the service uses for subtrees, blocks, and
temp data.

Persistence now writes through a configured blob.Store, addressed by a
single fixed key ("peer-registry") with a new FileTypePeerRegistry tag
in pkg/fileformat. Operators choose the backend through the new
blockchain_peerRegistryStore URL setting (file://, s3://, memory://,
etc.); the previous blockchain_peerRegistryPath string setting is gone.

- savePeerRegistry/loadPeerRegistry take (ctx, blob.Store, ...) and
  use Set/Get/Exists/Del. saveMu still serializes the snapshot+write
  so concurrent saves cannot interleave.
- Save passes options.WithAllowOverwrite(true) because the registry is
  a single mutable blob, not append-only content.
- Corrupt blob handling drops the entry via store.Del instead of
  renaming a sibling .corrupted file.
- Server.Start constructs the blob.Store via blob.NewStore using
  blobstoretypes.PEERREGISTRYSTORE (new constant) and stores the
  reference on Blockchain. Stop saves through it then closes it.
- Existing tests rewritten to use an in-memory blob.Store helper
  (newTestBlobStore) instead of TempDir() + filesystem assertions.

1081 unit tests pass with -race; golangci-lint clean.

…egistry

… feat/central-peer-registry

# Conflicts:
#	services/p2p/Server.go

1. Register reconciles surviving banScores on new-entry path
(services/blockchain/peer_registry.go). Previously a peer evicted by
TTL/restart/Cleanup could re-attach via a fresh Register call with
IsBanned=false / BanScore=0, even though banScores still carried the
operator's ban. The new-entry branch now trusts banScores over the
caller-supplied fields, matching the Load reconciliation pattern.

2. reputationCache in shouldSkipUnhealthyPeer is now swept on every
peerMapCleanup tick (services/p2p/server_helpers.go). The sync.Map
was insert-only, so every unique gossiped peer ID accumulated an entry
for the process lifetime. Eviction piggybacks on the existing cleanup
goroutine — no new ticker.

Tests:
- TestRegister_ReconcilesSurvivingBanState — ban survives Remove, then
  Register with stale IsBanned=false still resolves to IsBanned=true.
- TestRegister_NoBanScoreSetsCleanState — caller's stale truthy claims
  are rejected when banScores has no entry.
- TestCleanupPeerMaps_EvictsExpiredReputationEntries — expired entry
  evicted, fresh entry survives.

1104 tests pass with -race across services/blockchain and services/p2p.