#36277 net: always complete all initial private broadcast connections

• Protect the origin privacy of privately broadcast transactions
• Prevent timing leaks caused by canceling connections when a transaction is seen early

Ensures all three initial private broadcast connections finish even if the transaction is received back from the network early. Replaces immediate transaction removal with a received marker, and regulates retries on peer disconnects using explicit grants.

Problem: Previously, receiving a privately broadcast transaction back immediately removed it from tracking and canceled pending initial connections. An observer could detect this cancellation or time the cutoff, creating a timing side channel that compromises transaction origin privacy.

P2 · bug fix

• P2 because it fixes an origin privacy leak in private transaction propagation
• Stops network observers from deducing the origin by timing connection cancellation

P2 because it addresses an origin privacy vulnerability in transaction propagation. Quoting andrewtoth, the patch addresses 'the theoretical timing attack described in #34707' and #29415 by guaranteeing all initial connections complete rather than leaking sender identity through connection count truncation.

Membership: Changes P2P private broadcast connection handling and message processing in net_processing and private_broadcast.

Factors: security/stability 2, bug 2, performance 0, user value 2, leverage 1

• Ready for review with passing tests and no open blockers

The patch is clean, compiles with passing tests, and has no open blockers or rebases required.

Author status: active

• Positive sentiment with no objections raised
• Concept approval with an intent to review (vasild)

Positive; concept acknowledged by vasild without unresolved objections.

vasild provided a Concept ACK stating an intent to review, with no objections raised.

• vasild: 'Concept ACK, will review'

Review verdicts (DrahtBot): 0

• Concept ACK: vasild

126 lines under test/bench/ci.

• test/functional/p2p_private_broadcast_completion.py +78/-0
• src/private_broadcast.cpp +41/-4
• src/private_broadcast.h +33/-0
• src/test/private_broadcast_tests.cpp +28/-0
• src/net_processing.cpp +12/-14
• src/test/fuzz/private_broadcast.cpp +15/-4
• test/functional/test_runner.py +1/-0

This PR modifies private broadcast logic so all initial connections finish even if the transaction is received back from another peer first. It addresses a timing side channel where canceling remaining connections revealed transaction origin to observing peers. Origin privacy is a core concern of the P2P subsystem. Review is active and ready with an initial Concept ACK from vasild. It is proposed as an alternative approach to PR #34707.