A failure we provoked is not a failure of the host

Following up on "the data seems thin": it was, and for two reasons worth
separating.

**Of the seed's 85 transfers, six are real and seventy-nine are zero-value
address-poisoning dust.** A 6% signal-to-noise ratio, which the `poisoning`
analyzer already reports and which is the honest reason the number looked
both large and empty.

**And two of those six were something I missed by hand.** Tracing manually I
scanned forward from the exploit block, so I never saw the funding: 1,000
then 115,495 USDC arriving from 0xa16f5ba4…8968 two thousand blocks *before*
the attack, and 116,495 going out to the attack contract. That address is not
just the downstream hop I had it as --- it staked the attacker and took the
proceeds back. The tool found it because it scans a window rather than
following a hunch.

Expanding the counterparties then failed, and the cause was mine. The span
widens on success up to a ceiling; at 40,000 blocks one endpoint times out,
and a timeout is indistinguishable from an unwell host, so it counted toward
the circuit breaker. Four concurrent chunks each provoking one took down a
node answering in under a second.

`CircuitBreaker.forgive` takes back a single recorded failure, for a caller
that caused it and is responding to it. Deliberately not `record_success`,
which clears the tally: a host genuinely failing in between should not have
its slate wiped by an unrelated probe. And the ceiling drops from 40,000 to
20,000, which is a measured value --- the same endpoint served 20,000 in
seconds --- rather than an aspiration.

The breaker call is guarded with `getattr`, because `client` is typed `Any`
and a test double need not carry one. A scan must not fail because the thing
it was being polite to is absent; two tests caught that immediately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FXWQ25VgFeMuuMhGWjvdof

Author: Toby1009

src/chainscope/providers/jsonrpc.py

@@ -75,8 +75,10 @@
 #: per step --- and a failed request that is a timeout is indistinguishable
 #: from an unwell host, which is what opened the circuit breaker mid-fetch.
 #: So the first chunk is cheap and cautious and the rest ride on what it
-#: learned.
-_SPAN_CEILING = 40_000
+#: learned. The ceiling is a measured value rather than an aspiration: one BSC
+#: endpoint served 20,000 blocks in seconds and timed out at 40,000, and a
+#: timeout costs far more than the request it saves.
+_SPAN_CEILING = 20_000
 
 #: How far back a scan reaches when the caller does not say.
 #:
@@ -567,6 +569,17 @@ def _chunk(
                 narrower = max(_SPAN_FLOOR, span // 2)
                 self._span_cap = min(self._span_cap, narrower)
                 self._span = narrower
+                # This failure was ours: we asked for more than the endpoint
+                # serves and are about to ask for less. Left on the breaker's
+                # tally it counts toward declaring a healthy node unwell ---
+                # measured, four concurrent chunks narrowing once each took
+                # down an endpoint answering in under a second.
+                # `getattr`: `client` is typed `Any` and a test double or an
+                # alternative transport need not carry a breaker. A scan must
+                # not fail because the thing it was being polite to is absent.
+                breaker = getattr(self.client, "breaker", None)
+                if breaker is not None:
+                    breaker.forgive(_host(self.url))
                 continue
             at += span
             # It worked, so try more next time. Doubling rather than jumping

src/chainscope/transport/http.py

@@ -219,6 +219,29 @@ def record_success(self, host: str) -> None:
             self._failures.pop(host, None)
             self._opened_at.pop(host, None)
 
+    def forgive(self, host: str) -> None:
+        """Take back one recorded failure.
+
+        For a caller that *provoked* the failure and is responding to it. A
+        log scan discovers an endpoint's block-range limit by asking for too
+        much and narrowing, and those refusals are probes rather than symptoms
+        --- but a timeout looks identical to an unwell host from here, so they
+        were counted, and four concurrent chunks each narrowing once spent the
+        threshold on a node that was answering in under a second.
+
+        Deliberately not `record_success`: that clears the count entirely, and
+        a host that is genuinely failing in between should not have its slate
+        wiped by an unrelated probe.
+        """
+        with self._lock:
+            remaining = self._failures.get(host, 0) - 1
+            if remaining > 0:
+                self._failures[host] = remaining
+            else:
+                self._failures.pop(host, None)
+            if remaining < self.threshold:
+                self._opened_at.pop(host, None)
+
     def record_failure(self, host: str) -> None:
         with self._lock:
             n = self._failures.get(host, 0) + 1