P2P: ranking notes

P1 is held to remote resource-exhaustion/memory-corruption vectors (#36521, #36015, #35888), the exploitable 1p1c relay-liveness holes (#36437/#36506), and the private broadcast reimplementation that removes a recurring deanonymization surface. The private broadcast cluster is the largest single sub-area here (ten PRs across all four bands) and its ordering is dominated by one unresolved direction question. Address-manager fixes, Tor/I2P connection fixes, net/net_processing restructuring, and test-only repairs were each grouped so a reviewer can take a cluster in one pass; within P3 I ordered behavioural fixes above structural work above tooling and tests, which moves several test-only PRs down relative to their individual scores.

• #34533 and #36330 fix the same leak (wallet resubmission under -privatebroadcast) in opposite ways: route rebroadcasts privately vs. suppress resubmission entirely. #36607 is a broader guard covering the same class. Decide the approach on #36607/#36330 first; #34533 should not be merged independently.
• #36374 and #36637 fix the identical Tor control password bug (backslashes in -torpassword). #36637 (hex-encoded token, explicitly allowed by control-spec) is the more robust approach and should be reviewed first; the other then closes.
• Chain: #36437 is the base for #36506, and #36506 restates #36437's orphan-reassignment fix plus more. Review #36437 first, then #36506. #36486 fixes the same txid==wtxid forget hole that #36506's typed-forgetting commit addresses - coordinate so one is not merged blind to the other.
• Chain: #36628 is the base reimplementation and #36608 extends it with package relay and the bitcoin-privbcast tool. Review #36628 first; a direction decision there determines whether #36608 is reviewed at all.
• The private broadcast rework (#36628/#36608) removes or rewrites the subsystem that #34322, #36477, #36607, #36566, #34271 and #36670 modify. A direction call on the rework should precede detailed review of those six, or that review effort is wasted.
• #36477 is a stated prerequisite for #36607 (P2) but is only P3 on its own merit; it must be reviewed before, not after, #36607.
• #35600 (track in-flight manual connections) and #36014 (dedupe startup -addnode) address the same duplicate-manual-connection problem at different layers; #35600 is the general fix and should be reviewed first.
• #36244 and #36445 both remove cs_main from the peer message loop; #36445 is close to a subset of the lock decoupling in #36244. Review #36445 first as the self-contained piece, or fold it in.
• #35502 and #35522 are the same kind of move-only net_processing split and now share a band; both also collide with #34824 and #35561, which rewrite the same functions. Sequencing matters more than priority here.
• #36716 supersedes the approach in #36688 (SO_OOBINLINE); only one should be pursued.
• #35591 (Erlay) is explicitly DO NOT MERGE and will be carved into smaller PRs; its P2 band reflects the protocol's importance, not this artifact's mergeability.

• #36506: P2 alone, P1 after comparison. Promoted to P1: it contains #36437's fix plus several further exploitable 1p1c liveness/pinning holes, so it cannot sit a band below its base.
• #36608: Ranked just below its base #36628, which it depends on and whose direction must be decided first.
• #34533: P1 alone, P2 after comparison. Demoted to P2: the same rebroadcast leak is addressed by #36330 and more broadly by #36607, both P2; equal-consequence PRs must share a band.
• #36675: A concrete connectivity failure against 20-30% of IPv6 peers via Tor outranks the opt-in features later in the band.
• #36445: Measured responsiveness win in the message loop; grouped with the other cs_main contention work.
• #36305: Supported-platform hijacking risk kept adjacent to the other security fixes in the band.
• #34322: Ranked below the leak fixes because the private broadcast rework (#36628/#36608) may rewrite the state it persists.
• #30951: Opt-in operator hardening ranks below the correctness, DoS and privacy fixes in the same band.
• #35591: Problem is major, but this artifact is marked DO NOT MERGE and will be split; its benefit as a reviewable change is the least certain.
• #35054: Benefit is contested by sustained concept opposition, so it sits last among equally banded features.
• #35920: Protocol-conformance plus a missed-disconnect path ranks above the test and refactor work that scored near it.
• #35936: Disconnect-evasion edge case grouped with the other message-handling bug fixes rather than with refactors.
• #35003: Stability under I/O failure belongs at the top of P3 with the other correctness fixes.
• #35578: Broadest effect of the P3 address-handling fixes (network-wide addrman pollution).
• #35750: Kept with the other addrman correctness fixes so they can be reviewed coherently.
• #36208: Grouped with the addrman bookkeeping fixes it interacts with.
• #36477: Stated prerequisite for P2 #36607, so it must not be queued behind the rest of P3.
• #34486: Local-only misbehaviour of an operator toggle; ranks below relay and address correctness fixes.
• #36637: Same Tor-auth bug as #36374 and the approach the control spec endorses, so it leads that pair.
• #36636: Grouped with the other Tor/I2P address-handling fixes.
• #36570: Grouped with the Tor/I2P connection fixes; removes a round trip and corrects failure accounting.
• #36014: Kept adjacent to #35600, which covers the general form of the same duplicate-connection problem.
• #30988: P2 alone, P3 after comparison. Demoted to P3: like #35040, #34824 and #35561 it is architectural restructuring whose payoff (reuse, O(1) lookup) is stated but not yet concrete; those siblings sit at P3.
• #35040: Ranked with the other net/net_processing restructuring PRs it shares scope with.
• #35027: Niche multi-homed configuration need; placed with the other opt-in operator options.
• #29418: Operator observability ranks below behavioural fixes and structural work in this band.
• #35315: Mostly type hygiene with only a marginal eviction-precision gain.
• #35368: Diagnostic tooling, below the behaviour-changing PRs in the band.
• #33954: Valuable new coverage but test-only; ranked at the head of the test cluster rather than among bug fixes.
• #36406: Test-only repair of a vacuous assertion; ordered inside the test cluster.
• #36405: Test-only repair of a vacuous assertion; ordered inside the test cluster.
• #36410: New coverage only; ordered inside the test cluster.
• #36429: P3 alone, P4 after comparison. Demoted to P4: speculative RFC with author-only motivation that overlaps the randomized scheduling already part of the private broadcast rework.
• #35502: P3 alone, P4 after comparison. Demoted to P4 to match #35522, the identical move-only split of the sibling net_processing function.

This pass by claude-opus-5 on 2026-11-01 saw every PR in the category at once and checked the bands given to each PR alone against each other, ordered the PRs, and noted chains and overlaps. Back to the category.