The contract check ended up with two walks over the extension block, one
after the other. The first leaves position at the end of the packet, so the
second computes its own end from there - past the packet - and almost never
lands on it. Every hello was therefore reported as declaring lengths that
disagree, on connections the relay went on to accept, which is the worst kind
of diagnostic: loud, constant and wrong.
The remaining walk is the stricter of the two. It requires the walk to land
exactly on the end of the packet, so it also covers what the second one was
added for: a template whose extensions stop short of the block it declared.
Verified against every profile in the tree, twice over, for a short and a
long domain: the check now reports nothing on hellos the relays verify.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
e43a15185d