docs(mempool): clarify per-peer getdata routing and lock it in with tests

The package-level comment claimed we 'ask every peer for every announced
transaction', which suggested a per-tx fan-out. handleInv actually issues
the getdata back to the single announcing peer; the privacy property comes
from not filtering on a local heuristic, not from broadcasting.

Tighten the docstring to match the implementation and add two tests that
lock in the contract: getdata is sent only to the announcing peer, and
handleInv exits early when no addresses are watched.

Author: m0wer

neutrino_server/internal/neutrino/mempool.go

@@ -4,9 +4,12 @@ subscribing to every connected peer's incoming P2P messages, fetching
 each announced transaction, and matching it against the watched script
 set / confirmed UTXO set tracked by RescanManager.
 
-Privacy model: we ask every peer for every announced transaction (rather
-than only those that match a local heuristic). This avoids leaking which
-addresses we care about, at the cost of a small bandwidth overhead.
+Privacy model: for every tx inv received from a peer we issue a getdata
+back to that same peer (not to all peers) without filtering on any local
+heuristic. Because the request set is "every announced tx", peers cannot
+infer which addresses or scripts we care about from our fetch pattern.
+The bandwidth cost is one extra tx download per inv on top of a normal
+SPV flow.
 
 Eviction:
   - A tx is removed when the block-connect hook (RescanManager.runAutoSyncPass)

neutrino_server/internal/neutrino/mempool_test.go

@@ -413,6 +413,95 @@ func TestNotifyMempoolConfirmed_EmptyTxidsIsNoOp(t *testing.T) {
 	}
 }
 
+// fakePeer is a minimal query.Peer used to assert handleInv's getdata
+// routing. It records every QueueMessageWithEncoding invocation; the
+// channels and Addr exist only so the type satisfies the interface.
+type fakePeer struct {
+	addr     string
+	sent     []wire.Message
+	disconCh chan struct{}
+	mu       sync.Mutex
+}
+
+func newFakePeer(addr string) *fakePeer {
+	return &fakePeer{addr: addr, disconCh: make(chan struct{})}
+}
+
+func (p *fakePeer) Addr() string                  { return p.addr }
+func (p *fakePeer) OnDisconnect() <-chan struct{} { return p.disconCh }
+func (p *fakePeer) SubscribeRecvMsg() (<-chan wire.Message, func()) {
+	ch := make(chan wire.Message)
+	return ch, func() { close(ch) }
+}
+func (p *fakePeer) QueueMessageWithEncoding(m wire.Message, _ chan<- struct{},
+	_ wire.MessageEncoding,
+) {
+	p.mu.Lock()
+	p.sent = append(p.sent, m)
+	p.mu.Unlock()
+}
+
+// TestHandleInv_GetDataGoesOnlyToAnnouncingPeer locks in the privacy
+// contract documented at the top of mempool.go: getdata for a tx inv is
+// issued only to the peer that announced the tx, never broadcast. If we
+// fanned out we would leak nothing about *which* txs we care about, but we
+// would still expand bandwidth quadratically and give a network-wide
+// observer extra fingerprintable behaviour.
+func TestHandleInv_GetDataGoesOnlyToAnnouncingPeer(t *testing.T) {
+	mgr := newTestRescanMgr(t, watchedAddrMain, nil)
+	tr := newTracker(mgr)
+
+	announcer := newFakePeer("announcer:8333")
+	other := newFakePeer("other:8333")
+
+	inv := wire.NewMsgInv()
+	hash := mustHash(t, "0000000000000000000000000000000000000000000000000000000000000ccc")
+	if err := inv.AddInvVect(&wire.InvVect{Type: wire.InvTypeTx, Hash: hash}); err != nil {
+		t.Fatalf("AddInvVect: %v", err)
+	}
+
+	tr.handleInv(announcer, inv)
+
+	if got := len(announcer.sent); got != 1 {
+		t.Fatalf("announcer should have received 1 getdata, got %d", got)
+	}
+	if got := len(other.sent); got != 0 {
+		t.Fatalf("non-announcing peer must not receive getdata, got %d", got)
+	}
+	gd, ok := announcer.sent[0].(*wire.MsgGetData)
+	if !ok {
+		t.Fatalf("expected MsgGetData, got %T", announcer.sent[0])
+	}
+	if len(gd.InvList) != 1 || gd.InvList[0].Hash != hash {
+		t.Errorf("unexpected getdata payload: %+v", gd.InvList)
+	}
+	// Witness-stripped form is required so we receive the full tx.
+	if gd.InvList[0].Type != wire.InvTypeWitnessTx {
+		t.Errorf("expected witness-tx inv type, got %v", gd.InvList[0].Type)
+	}
+}
+
+// TestHandleInv_NoWatchedAddressesSkipsGetData verifies the early-exit in
+// handleInv: when zero addresses are watched, no getdata is issued (no
+// point fetching txs we can't match).
+func TestHandleInv_NoWatchedAddressesSkipsGetData(t *testing.T) {
+	mgr := newTestRescanMgr(t, "", nil)
+	tr := newTracker(mgr)
+
+	announcer := newFakePeer("announcer:8333")
+	inv := wire.NewMsgInv()
+	hash := mustHash(t, "0000000000000000000000000000000000000000000000000000000000000ddd")
+	if err := inv.AddInvVect(&wire.InvVect{Type: wire.InvTypeTx, Hash: hash}); err != nil {
+		t.Fatalf("AddInvVect: %v", err)
+	}
+
+	tr.handleInv(announcer, inv)
+
+	if got := len(announcer.sent); got != 0 {
+		t.Fatalf("no getdata expected with zero watched addrs, got %d", got)
+	}
+}
+
 // TestEvictExpired_DropsStaleInflight verifies the TTL sweep also clears
 // abandoned getdata requests so a never-delivered tx (e.g. announcing peer
 // disconnected before responding) stops blocking re-fetch from other peers.