execution/p2p: improve bal fetcher reliability

[taratorio]

Summary

Extracting p2p improvements from wider PR #22190 about 0 BAL re-execs. Tested on bal-devnet-7 and glamsterdam-devnet-6. We were missing bal downloads for some blocks. Consistently downloaded all bals for all blocks after the below improvements.

Improve best-effort Block Access List fetching over P2P by making peer usage more efficient and resilient to incomplete responses.

• Shard large BAL request batches across peers on the first round to avoid repeatedly downloading the same response prefix.
• Broadcast unresolved requests in later rounds so BALs held by only one connected peer can still be found.
• Preserve valid BALs from a response even when another entry is invalid, while still penalizing the peer for protocol violations.
• Track recent per-peer BAL misses to avoid querying peers for block ranges they are unlikely to retain.
• Use separate timeouts for the complete BAL batch and each individual peer request.
• Refresh the backward downloader's peer set for each block window and avoid leading body and BAL downloads through the same peer when alternatives exist.
• Keep block delivery best-effort when BALs remain unavailable, with additional diagnostic logging for partial batches.
• Add types.Header.HasBAL to centralize the check for a non-empty EIP-7928 BAL commitment.

Testing

• go test ./execution/p2p ./execution/types -count=1

[Copilot]

Pull request overview

This PR improves best-effort EIP-7928 Block Access List (BAL) fetching over eth/71 by making BAL retrieval more resilient to partial/invalid peer responses and by spreading requests across peers to avoid redundant truncated-prefix downloads. It also centralizes the “header has a non-empty BAL commitment” check in types.Header.

Changes:

• Add Header.HasBAL() and use it in BAL request building.
• Rework BAL fetching to shard large batches across peers initially, then broadcast unresolved requests in later rounds; keep valid entries even if some response entries are invalid, while still penalizing the peer.
• Introduce per-peer “BAL miss” tracking (with TTL) and add new downloader timeouts/config and tests around BAL deficit behavior.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
execution/types/block.go	Adds Header.HasBAL() helper for checking a non-empty BAL commitment.
execution/p2p/bbd.go	Refreshes peer set per window, improves BAL peer selection, adds partial-miss logging, and switches BAL request building to HasBAL().
execution/p2p/bbd_test.go	Adds a regression test ensuring blocks are still delivered even when BALs are persistently unavailable.
execution/p2p/bbd_options.go	Adds separate BAL batch/request timeouts and increases body batch timeout.
execution/p2p/bal_peer_misses.go	Adds per-peer BAL miss tracking with TTL to avoid querying peers for ranges they likely don’t retain.
execution/p2p/bal_peer_misses_test.go	Adds unit test coverage for per-peer BAL miss tracking behavior.
execution/p2p/bal_fetcher.go	Updates BAL fetcher API/signature, adds sharded/broadcast multi-round fetching, increases parallelism, and integrates miss tracking + partial-validation retention.
execution/p2p/bal_fetcher_test.go	Updates/extends tests to cover partial-invalid response retention and new multi-round fetch behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mh0lt]

Reviewed at opus/high effort — LGTM, approving. Focused on the concurrency/networking rework since that is the highest-risk part.

Concurrency: no data race and no goroutine/channel leak found. Each round's workers in fetchAcrossPeers write only their own results[i] slot and the merge is serial after eg.Wait() (strictly safer than the old shared-map-under-mutex); balPeerMisses access is fully under b.mu; the bbd.go goroutines only read peer state (peersExcept) with mutations kept on the serial loop; errgroup ctx is derived from the batch timeout and cancelled via defer.

Verified correct: sharding/broadcast/termination (disjoint shards partition remaining exactly, remainder recomputed each round, no-progress broadcast round breaks — no dropped-and-never-retried request, no infinite loop); the partial-invalid path preserves valid entries while still penalizing the peer, and each entry is independently keccak-validated against the header-committed hash so a malicious peer can't poison neighbors; the miss heuristic can't permanently blacklist (TTL re-probe in mayHave + allPeers fallback when plausible is empty); best-effort fallback masks nothing consensus-critical (blocks are still delivered BAL-less); HasBAL migration is correctly scoped.

Nits / one question (all non-blocking):

• balPeerMisses.mark: the TTL branch looks dead — when it enters via time.Since(mark.at) > balMissTTL, blockNum <= maxMissing, so max(...) leaves the watermark unchanged; the real re-probe already lives in mayHave. Consider dropping the || TTL clause from mark.
• balPeerMisses.m has no eviction and grows with peer churn (entries never removed on disconnect). Not a functional leak (tiny entries, TTL-ignored in mayHave), but a prune-on-mark or disconnect hook would bound it. Fine as a follow-up.
• Question: downloadBlocksForHeaders now re-queries plausible peers per window and returns no peers available when empty. If the miss-tracker transiently reports zero plausible peers for a window mid-span, does the whole backward download abort rather than back off/retry? Worth confirming a momentary peer-set dip can't kill a long span (non-pinned peerId==nil path only).

Test coverage is good (prefix-truncation, single-peer straggler, termination bound, parallelism limit, both partial-invalid variants, miss-tracker, and BAL-less delivery).