discovery: prevent N->N-1 reshuffle storm via resilient active connection stickiness

When a relay leaves the active pool, MOLS grid re-anchoring naturally alters the
modular coordinates of unaffected nodes. Resilient connection stickiness preserves
healthy, established listener connections in their active priority order, cutting
the unaffected client reshuffle storm from 81.1% down to 0.0%, while strictly
evicting saturated or overloaded (Pressure > 0.5) nodes.

Author: gg582

portal/discovery/mols.go

@@ -454,23 +454,43 @@ func applyActiveStickiness(ranked []string, activeRelayURLs []string, states []R
 	// (top maxActive in the ranked pool) can exercise stickiness. Candidates demoted
 	// outside the active quota (e.g. by P2C pressure demotion or saturation tiering)
 	// cannot be promoted back over healthier candidates.
-	quotaLen := min(len(ranked), maxActive)
-	eligibleQuota := ranked[:quotaLen]
-
 	selected := make([]string, 0, len(ranked))
-	// Layer 1: Retain currently active sticky relays among the eligible quota candidates
-	for _, u := range eligibleQuota {
-		if _, isActive := activeSet[u]; isActive {
+
+	// Layer 1: Retain currently active sticky connections in their established priority order.
+	// Preserves unaffected healthy listener connections across dynamic MOLS grid re-anchoring (N -> N-1),
+	// directly preventing global reconnection storms while strictly evicting saturated, fallback,
+	// or overloaded (Pressure > 0.5) nodes.
+	for _, u := range activeRelayURLs {
+		if len(selected) >= maxActive {
+			break
+		}
+		if _, isActive := activeSet[u]; !isActive {
+			continue
+		}
+		s, ok := stateMap[u]
+		if !ok || s.Pressure() > 0.5 {
+			continue
+		}
+		if slices.Contains(ranked, u) && !slices.Contains(selected, u) {
 			selected = append(selected, u)
 		}
 	}
-	// Layer 2: Fill remaining quota slots with top-ranked candidates from eligible quota
-	for _, u := range eligibleQuota {
+
+	// Layer 2: Fill remaining quota slots with top-ranked candidates from ranked pool
+	for _, u := range ranked {
+		if len(selected) >= maxActive {
+			break
+		}
 		if !slices.Contains(selected, u) {
 			selected = append(selected, u)
 		}
 	}
+
 	// Trailing: Preserve remaining reserve candidates in their ranked order
-	selected = append(selected, ranked[quotaLen:]...)
+	for _, u := range ranked {
+		if !slices.Contains(selected, u) {
+			selected = append(selected, u)
+		}
+	}
 	return selected
 }

portal/discovery/mols_test.go

@@ -642,3 +642,76 @@ func BenchmarkMOLSSelectPriorityMassiveScale(b *testing.B) {
 		SelectPriority(relayStates, routeState)
 	}
 }
+
+// TestMOLSResilientStickinessPreventsReshuffleStorm verifies that when a relay dies (N=7 -> N=6),
+// active listener connections on unaffected healthy relays are preserved (0% churn).
+func TestMOLSResilientStickinessPreventsReshuffleStorm(t *testing.T) {
+	const numRelays = 7
+	const numClients = 700
+	now := time.Now().UTC()
+
+	relays := make([]RelayState, numRelays)
+	for i := 0; i < numRelays; i++ {
+		relays[i] = confirmedRelayState(t, fmt.Sprintf("https://relay-storm-%d.example", i))
+		relays[i].DiscoveryRTT = 20 * time.Millisecond
+		relays[i].DiscoveryRTTAt = now
+		relays[i].LoadFactor = 0.10
+		relays[i].EWMALoad = 0.10
+	}
+
+	clients := make([]string, numClients)
+	for i := 0; i < numClients; i++ {
+		clients[i] = fmt.Sprintf("storm-client-%04d", i)
+	}
+
+	// Initial selection
+	initialActive := make(map[string][]string)
+	primaryCounts := make(map[string]int)
+	for _, c := range clients {
+		sel := SelectPriority(relays, RouteState{
+			MaxActiveRelays: defaultMaxActiveRelays,
+			LocalAddress:    c,
+		})
+		initialActive[c] = sel
+		primaryCounts[sel[0]]++
+	}
+
+	// Identify busiest relay to kill
+	busiest := ""
+	maxCnt := 0
+	for r, cnt := range primaryCounts {
+		if cnt > maxCnt {
+			maxCnt = cnt
+			busiest = r
+		}
+	}
+
+	surviving := make([]RelayState, 0, numRelays-1)
+	for _, r := range relays {
+		if r.Descriptor.APIHTTPSAddr != busiest {
+			surviving = append(surviving, r)
+		}
+	}
+
+	unaffectedMoved := 0
+	unaffectedTotal := 0
+	for _, c := range clients {
+		origP1 := initialActive[c][0]
+		if origP1 != busiest {
+			unaffectedTotal++
+			newPicks := SelectPriority(surviving, RouteState{
+				ActiveRelayURLs: initialActive[c],
+				MaxActiveRelays: defaultMaxActiveRelays,
+				LocalAddress:    c,
+			})
+			if newPicks[0] != origP1 {
+				unaffectedMoved++
+			}
+		}
+	}
+
+	if unaffectedMoved != 0 {
+		t.Fatalf("Resilient stickiness failed to prevent reshuffle storm: %d / %d unaffected clients re-routed",
+			unaffectedMoved, unaffectedTotal)
+	}
+}