@enbox/agent 0.5.12 → 0.5.14

package/dist/esm/sync-engine-level.js

@@ -24,7 +24,9 @@ import { createClosureContext, invalidateClosureCache } from './sync-closure-typ
 import { AgentPermissionsApi } from './permissions-api.js';
 import { DwnInterface } from './types/dwn.js';
 import { isRecordsWrite } from './utils.js';
+import { SyncLinkReconciler } from './sync-link-reconciler.js';
 import { topologicalSort } from './sync-topological-sort.js';
+import { buildLegacyCursorKey, buildLinkId } from './sync-link-id.js';
 import { fetchRemoteMessages, pullMessages, pushMessages } from './sync-messages.js';
 /**
  * Maximum bit prefix depth for the per-node tree walk (legacy fallback).
@@ -40,16 +42,12 @@ const MAX_DIFF_DEPTH = 16;
  */
 const BATCHED_DIFF_DEPTH = 8;
 /**
-/**
- * Key for the subscription cursor sublevel. Cursors are keyed by
- * `{did}^{dwnUrl}[^{protocol}]` and store an opaque EventLog cursor string.
- */
-const CURSOR_SEPARATOR = '^';
-/**
- * Debounce window for push-on-write. When the local EventLog emits events,
- * we batch them and push after this delay to avoid a push per individual write.
+ * Debounce window for batching writes that arrive while a push is in flight.
+ * The first write in a quiet window triggers an immediate push; subsequent
+ * writes arriving during the push are batched and flushed after this delay
+ * once the in-flight push completes.
  */
-const PUSH_DEBOUNCE_MS = 250;
+const PUSH_DEBOUNCE_MS = 100;
 /**
  * Checks whether a message's protocolPath and contextId match the link's
  * subset scope prefixes. Returns true if the message is in scope.
@@ -122,7 +120,7 @@ export class SyncEngineLevel {
          * and bail if it has changed — this prevents stale work from mutating
          * state after teardown or mode switch.
          */
-        this._syncGeneration = 0;
+        this._engineGeneration = 0;
         /** Active live pull subscriptions (remote -> local via MessagesSubscribe). */
         this._liveSubscriptions = [];
         /** Active local EventLog subscriptions for push-on-write (local -> remote). */
@@ -131,8 +129,8 @@ export class SyncEngineLevel {
         this._connectivityState = 'unknown';
         /** Registered event listeners for observability. */
         this._eventListeners = new Set();
-        /** Entry in the pending push queue — a message CID with its local EventLog token. */
-        this._pendingPushCids = new Map();
+        /** Per-link push runtime: queue, debounce timer, retry state. */
+        this._pushRuntimes = new Map();
         /**
          * CIDs recently received via pull subscription, keyed by `cid|dwnUrl` to
          * scope suppression per remote endpoint. A message pulled from Provider A
@@ -163,6 +161,13 @@ export class SyncEngineLevel {
          * a valid boundary instead of starting live-only.
          */
         this._repairContext = new Map();
+        // ---------------------------------------------------------------------------
+        // Per-link reconciliation
+        // ---------------------------------------------------------------------------
+        /** Active reconcile timers, keyed by link key. */
+        this._reconcileTimers = new Map();
+        /** Active reconcile operations, keyed by link key (dedup). */
+        this._reconcileInFlight = new Map();
         this._agent = agent;
         this._permissionsApi = new AgentPermissionsApi({ agent: agent });
         this._db = (db) ? db : new Level(dataPath !== null && dataPath !== void 0 ? dataPath : 'DATA/AGENT/SYNC_STORE');
@@ -232,12 +237,14 @@ export class SyncEngineLevel {
     }
     clear() {
         return __awaiter(this, void 0, void 0, function* () {
+            yield this.teardownLiveSync();
             yield this._permissionsApi.clear();
             yield this._db.clear();
         });
     }
     close() {
         return __awaiter(this, void 0, void 0, function* () {
+            yield this.teardownLiveSync();
             yield this._db.close();
         });
     }
@@ -304,91 +311,60 @@ export class SyncEngineLevel {
             }
             this._syncLock = true;
             try {
-                // Iterate over all registered identities and their DWN endpoints.
+                // Group targets by remote endpoint so each URL group can be reconciled
+                // concurrently. Within a group, targets are processed sequentially so
+                // that a single network failure skips the rest of that group.
                 const syncTargets = yield this.getSyncTargets();
-                const errored = new Set();
-                let hadFailure = false;
+                const byUrl = new Map();
                 for (const target of syncTargets) {
-                    const { did, delegateDid, dwnUrl, protocol } = target;
-                    if (errored.has(dwnUrl)) {
-                        continue;
+                    let group = byUrl.get(target.dwnUrl);
+                    if (!group) {
+                        group = [];
+                        byUrl.set(target.dwnUrl, group);
                     }
-                    try {
-                        // Phase 1: Compare SMT roots between local and remote.
-                        const localRoot = yield this.getLocalRoot(did, delegateDid, protocol);
-                        const remoteRoot = yield this.getRemoteRoot(did, dwnUrl, delegateDid, protocol);
-                        if (localRoot === remoteRoot) {
-                            // Trees are identical — nothing to sync for this target.
-                            continue;
-                        }
-                        // Phase 2: Compute the diff in a single round-trip using the
-                        // batched 'diff' action.  This replaces the per-node tree walk
-                        // that previously required dozens of HTTP requests.
-                        const diff = yield this.diffWithRemote({
-                            did, dwnUrl, delegateDid, protocol,
-                        });
-                        // Phase 3: Pull missing messages (remote has, local doesn't).
-                        // The diff response may include inline message data — use it
-                        // directly instead of re-fetching via individual MessagesRead calls.
-                        if (!direction || direction === 'pull') {
-                            if (diff.onlyRemote.length > 0) {
-                                // Separate entries into three categories:
-                                // 1. Fully prefetched: have message + inline data (or no data needed)
-                                // 2. Need data fetch: have message but missing data for RecordsWrite
-                                // 3. Need full fetch: no message at all
-                                const prefetched = [];
-                                const needsFetchCids = [];
-                                for (const entry of diff.onlyRemote) {
-                                    if (!entry.message) {
-                                        // No message at all — need full fetch.
-                                        needsFetchCids.push(entry.messageCid);
-                                    }
-                                    else if (entry.message.descriptor.interface === 'Records' &&
-                                        entry.message.descriptor.method === 'Write' &&
-                                        entry.message.descriptor.dataCid &&
-                                        !entry.encodedData) {
-                                        // RecordsWrite with data but data wasn't inlined (too large).
-                                        // Need to fetch individually to get the data stream.
-                                        needsFetchCids.push(entry.messageCid);
-                                    }
-                                    else {
-                                        // Fully prefetched (message + data or no data needed).
-                                        prefetched.push(entry);
-                                    }
-                                }
-                                yield this.pullMessages({
-                                    did, dwnUrl, delegateDid, protocol,
-                                    messageCids: needsFetchCids,
-                                    prefetched,
-                                });
-                            }
+                    group.push(target);
+                }
+                let groupsSucceeded = 0;
+                let groupsFailed = 0;
+                const results = yield Promise.allSettled([...byUrl.entries()].map((_a) => __awaiter(this, [_a], void 0, function* ([dwnUrl, targets]) {
+                    for (const target of targets) {
+                        const { did, delegateDid, protocol } = target;
+                        try {
+                            yield this.createLinkReconciler().reconcile({
+                                did, dwnUrl, delegateDid, protocol,
+                            }, { direction });
                         }
-                        // Phase 4: Push missing messages (local has, remote doesn't).
-                        if (!direction || direction === 'push') {
-                            if (diff.onlyLocal.length > 0) {
-                                yield this.pushMessages({ did, dwnUrl, delegateDid, protocol, messageCids: diff.onlyLocal });
-                            }
+                        catch (error) {
+                            // Skip remaining targets for this DWN endpoint.
+                            groupsFailed++;
+                            console.error(`SyncEngineLevel: Error syncing ${did} with ${dwnUrl}`, error);
+                            return;
                         }
                     }
-                    catch (error) {
-                        // Skip this DWN endpoint for remaining targets and log the real cause.
-                        errored.add(dwnUrl);
-                        hadFailure = true;
-                        console.error(`SyncEngineLevel: Error syncing ${did} with ${dwnUrl}`, error);
+                    groupsSucceeded++;
+                })));
+                // Check for unexpected rejections (should not happen given inner try/catch).
+                for (const result of results) {
+                    if (result.status === 'rejected') {
+                        groupsFailed++;
                     }
                 }
-                // Track consecutive failures for backoff in poll mode.
-                if (hadFailure) {
+                // Track connectivity based on per-group outcomes. If at least one
+                // group succeeded, stay online — partial reachability is still online.
+                if (groupsSucceeded > 0) {
+                    this._consecutiveFailures = 0;
+                    this._connectivityState = 'online';
+                }
+                else if (groupsFailed > 0) {
                     this._consecutiveFailures++;
                     if (this._connectivityState === 'online') {
                         this._connectivityState = 'offline';
                     }
                 }
-                else {
+                else if (syncTargets.length > 0) {
+                    // All targets had matching roots (no reconciliation needed).
                     this._consecutiveFailures = 0;
-                    if (syncTargets.length > 0) {
-                        this._connectivityState = 'online';
-                    }
+                    this._connectivityState = 'online';
                 }
             }
             finally {
@@ -428,6 +404,7 @@ export class SyncEngineLevel {
      */
     stopSync() {
         return __awaiter(this, arguments, void 0, function* (timeout = 2000) {
+            this._engineGeneration++;
             let elapsedTimeout = 0;
             while (this._syncLock) {
                 if (elapsedTimeout >= timeout) {
@@ -448,7 +425,11 @@ export class SyncEngineLevel {
     // ---------------------------------------------------------------------------
     startPollSync(intervalMilliseconds) {
         return __awaiter(this, void 0, void 0, function* () {
+            const generation = this._engineGeneration;
             const intervalSync = () => __awaiter(this, void 0, void 0, function* () {
+                if (this._engineGeneration !== generation) {
+                    return;
+                }
                 if (this._syncLock) {
                     return;
                 }
@@ -465,6 +446,9 @@ export class SyncEngineLevel {
                 const effectiveInterval = this._consecutiveFailures > 0
                     ? intervalMilliseconds * backoffMultiplier
                     : intervalMilliseconds;
+                if (this._engineGeneration !== generation) {
+                    return;
+                }
                 if (!this._syncIntervalId) {
                     this._syncIntervalId = setInterval(intervalSync, effectiveInterval);
                 }
@@ -499,8 +483,9 @@ export class SyncEngineLevel {
                 console.error('SyncEngineLevel: Error during initial live-sync catch-up', error);
             }
             // Step 2: Initialize replication links and open live subscriptions.
+            // Each target's link initialization is independent — process concurrently.
             const syncTargets = yield this.getSyncTargets();
-            for (const target of syncTargets) {
+            yield Promise.allSettled(syncTargets.map((target) => __awaiter(this, void 0, void 0, function* () {
                 let link;
                 try {
                     // Get or create the link in the durable ledger.
@@ -516,18 +501,32 @@ export class SyncEngineLevel {
                         protocol: target.protocol,
                     });
                     // Cache the link for fast access by subscription handlers.
-                    const linkKey = this.buildCursorKey(target.did, target.dwnUrl, target.protocol);
+                    // Use scopeId from the link for consistent runtime identity.
+                    const linkKey = this.buildLinkKey(target.did, target.dwnUrl, link.scopeId);
+                    // One-time migration: if the link has no pull checkpoint, check for
+                    // a legacy cursor in the old syncCursors sublevel. The legacy key
+                    // used protocol, not scopeId, so we must build it the old way.
+                    if (!link.pull.contiguousAppliedToken) {
+                        const legacyKey = buildLegacyCursorKey(target.did, target.dwnUrl, target.protocol);
+                        const legacyCursor = yield this.getCursor(legacyKey);
+                        if (legacyCursor) {
+                            ReplicationLedger.resetCheckpoint(link.pull, legacyCursor);
+                            yield this.ledger.saveLink(link);
+                            yield this.deleteLegacyCursor(legacyKey);
+                        }
+                    }
                     this._activeLinks.set(linkKey, link);
                     // Open subscriptions — only transition to live if both succeed.
                     // If pull succeeds but push fails, close the pull subscription to
                     // avoid a resource leak with inconsistent state.
-                    yield this.openLivePullSubscription(target);
+                    const targetWithKey = Object.assign(Object.assign({}, target), { linkKey });
+                    yield this.openLivePullSubscription(targetWithKey);
                     try {
-                        yield this.openLocalPushSubscription(target);
+                        yield this.openLocalPushSubscription(targetWithKey);
                     }
                     catch (pushError) {
                         // Close the already-opened pull subscription.
-                        const pullSub = this._liveSubscriptions.find(s => s.did === target.did && s.dwnUrl === target.dwnUrl && s.protocol === target.protocol);
+                        const pullSub = this._liveSubscriptions.find((s) => s.linkKey === linkKey);
                         if (pullSub) {
                             try {
                                 yield pullSub.close();
@@ -539,9 +538,16 @@ export class SyncEngineLevel {
                     }
                     this.emitEvent({ type: 'link:status-change', tenantDid: target.did, remoteEndpoint: target.dwnUrl, protocol: target.protocol, from: 'initializing', to: 'live' });
                     yield this.ledger.setStatus(link, 'live');
+                    // If the link was marked dirty in a previous session, schedule
+                    // immediate reconciliation now that subscriptions are open.
+                    if (link.needsReconcile) {
+                        this.scheduleReconcile(linkKey, 1000);
+                    }
                 }
                 catch (error) {
-                    const linkKey = this.buildCursorKey(target.did, target.dwnUrl, target.protocol);
+                    const linkKey = link
+                        ? this.buildLinkKey(target.did, target.dwnUrl, link.scopeId)
+                        : buildLegacyCursorKey(target.did, target.dwnUrl, target.protocol);
                     // Detect ProgressGap (410) — the cursor is stale, link needs SMT repair.
                     if (error.isProgressGap && link) {
                         console.warn(`SyncEngineLevel: ProgressGap detected for ${target.did} -> ${target.dwnUrl}, initiating repair`);
@@ -550,7 +556,7 @@ export class SyncEngineLevel {
                         yield this.transitionToRepairing(linkKey, link, {
                             resumeToken: gapInfo === null || gapInfo === void 0 ? void 0 : gapInfo.latestAvailable,
                         });
-                        continue;
+                        return;
                     }
                     console.error(`SyncEngineLevel: Failed to open live subscription for ${target.did} -> ${target.dwnUrl}`, error);
                     // Clean up in-memory state for the failed link so it doesn't appear
@@ -562,7 +568,7 @@ export class SyncEngineLevel {
                         this._connectivityState = 'unknown';
                     }
                 }
-            }
+            })));
             // Step 3: Schedule infrequent SMT integrity check.
             const integrityCheck = () => __awaiter(this, void 0, void 0, function* () {
                 if (this._syncLock) {
@@ -672,11 +678,11 @@ export class SyncEngineLevel {
         const attempts = (_a = this._repairAttempts.get(linkKey)) !== null && _a !== void 0 ? _a : 1;
         const backoff = SyncEngineLevel.REPAIR_BACKOFF_MS;
         const delayMs = backoff[Math.min(attempts - 1, backoff.length - 1)];
-        const timerGeneration = this._syncGeneration;
+        const timerGeneration = this._engineGeneration;
         const timer = setTimeout(() => __awaiter(this, void 0, void 0, function* () {
             this._repairRetryTimers.delete(linkKey);
             // Bail if teardown occurred since this timer was scheduled.
-            if (this._syncGeneration !== timerGeneration) {
+            if (this._engineGeneration !== timerGeneration) {
                 return;
             }
             // Verify link still exists and is still repairing.
@@ -708,6 +714,14 @@ export class SyncEngineLevel {
         }
         const promise = this.doRepairLink(linkKey).finally(() => {
             this._activeRepairs.delete(linkKey);
+            // Post-repair reconcile: if doRepairLink() marked needsReconcile
+            // (to close the gap between diff snapshot and new push subscription),
+            // schedule reconciliation NOW — after _activeRepairs is cleared so
+            // scheduleReconcile() won't skip it.
+            const link = this._activeLinks.get(linkKey);
+            if ((link === null || link === void 0 ? void 0 : link.needsReconcile) && link.status === 'live') {
+                this.scheduleReconcile(linkKey, 500);
+            }
         });
         this._activeRepairs.set(linkKey, promise);
         return promise;
@@ -728,7 +742,7 @@ export class SyncEngineLevel {
             // Capture the sync generation at repair start. If teardown occurs during
             // any await, the generation will have incremented and we bail before
             // mutating state — preventing the race where repair continues after teardown.
-            const generation = this._syncGeneration;
+            const generation = this._engineGeneration;
             const { tenantDid: did, remoteEndpoint: dwnUrl, delegateDid, protocol } = link;
             this.emitEvent({ type: 'repair:started', tenantDid: did, remoteEndpoint: dwnUrl, protocol, attempt: ((_a = this._repairAttempts.get(linkKey)) !== null && _a !== void 0 ? _a : 0) + 1 });
             const attempts = ((_b = this._repairAttempts.get(linkKey)) !== null && _b !== void 0 ? _b : 0) + 1;
@@ -736,7 +750,7 @@ export class SyncEngineLevel {
             // Step 1: Close existing subscriptions FIRST to stop old events from
             // mutating local state while repair runs.
             yield this.closeLinkSubscriptions(link);
-            if (this._syncGeneration !== generation) {
+            if (this._engineGeneration !== generation) {
                 return;
             } // Teardown occurred.
             // Step 2: Clear runtime ordinals immediately — stale state must not
@@ -747,71 +761,60 @@ export class SyncEngineLevel {
             rt.nextCommitOrdinal = 0;
             try {
                 // Step 3: Run SMT reconciliation for this link.
-                const localRoot = yield this.getLocalRoot(did, delegateDid, protocol);
-                if (this._syncGeneration !== generation) {
-                    return;
-                }
-                const remoteRoot = yield this.getRemoteRoot(did, dwnUrl, delegateDid, protocol);
-                if (this._syncGeneration !== generation) {
+                const reconcileOutcome = yield this.createLinkReconciler(() => this._engineGeneration === generation).reconcile({ did, dwnUrl, delegateDid, protocol });
+                if (reconcileOutcome.aborted) {
                     return;
                 }
-                if (localRoot !== remoteRoot) {
-                    const diff = yield this.diffWithRemote({ did, dwnUrl, delegateDid, protocol });
-                    if (this._syncGeneration !== generation) {
-                        return;
-                    }
-                    if (diff.onlyRemote.length > 0) {
-                        const prefetched = [];
-                        const needsFetchCids = [];
-                        for (const entry of diff.onlyRemote) {
-                            if (!entry.message || (entry.message.descriptor.interface === 'Records' &&
-                                entry.message.descriptor.method === 'Write' &&
-                                entry.message.descriptor.dataCid && !entry.encodedData)) {
-                                needsFetchCids.push(entry.messageCid);
-                            }
-                            else {
-                                prefetched.push(entry);
-                            }
-                        }
-                        yield this.pullMessages({ did, dwnUrl, delegateDid, protocol, messageCids: needsFetchCids, prefetched });
-                        if (this._syncGeneration !== generation) {
-                            return;
-                        }
-                    }
-                    if (diff.onlyLocal.length > 0) {
-                        yield this.pushMessages({ did, dwnUrl, delegateDid, protocol, messageCids: diff.onlyLocal });
-                        if (this._syncGeneration !== generation) {
-                            return;
-                        }
-                    }
-                }
-                // Step 4: Determine the post-repair resume token.
+                // Step 4: Determine the post-repair pull resume token.
                 // - If repair was triggered by ProgressGap, use the stored resumeToken
                 //   (from gapInfo.latestAvailable) so the reopened subscription replays
                 //   from a valid boundary, closing the race window between SMT and resubscribe.
                 // - Otherwise, use the existing contiguousAppliedToken if still valid.
-                // - Push checkpoint is NOT reset during repair: push frontier tracks what
-                //   the local EventLog has delivered to the remote. SMT repair handles
-                //   pull-side convergence; push-side convergence is handled by the diff's
-                //   onlyLocal push. The push checkpoint remains the local authority.
+                // Push is opportunistic — no push checkpoint to reset.
                 const repairCtx = this._repairContext.get(linkKey);
                 const resumeToken = (_c = repairCtx === null || repairCtx === void 0 ? void 0 : repairCtx.resumeToken) !== null && _c !== void 0 ? _c : link.pull.contiguousAppliedToken;
                 ReplicationLedger.resetCheckpoint(link.pull, resumeToken);
                 yield this.ledger.saveLink(link);
-                if (this._syncGeneration !== generation) {
+                if (this._engineGeneration !== generation) {
+                    return;
+                }
+                // Step 5: Reopen subscriptions.
+                // Mark needsReconcile BEFORE reopening — local push starts from "now",
+                // so any writes between the diff snapshot (step 3) and the new push
+                // subscription are invisible to both mechanisms. A short post-reopen
+                // reconcile will close this gap (cheap: SMT root comparison short-circuits
+                // if roots already match).
+                link.needsReconcile = true;
+                yield this.ledger.saveLink(link);
+                if (this._engineGeneration !== generation) {
                     return;
                 }
-                // Step 5: Reopen subscriptions with the repaired checkpoints.
-                const target = { did, dwnUrl, delegateDid, protocol };
-                yield this.openLivePullSubscription(target);
-                if (this._syncGeneration !== generation) {
+                const target = { did, dwnUrl, delegateDid, protocol, linkKey };
+                try {
+                    yield this.openLivePullSubscription(target);
+                }
+                catch (pullErr) {
+                    if (pullErr.isProgressGap) {
+                        console.warn(`SyncEngineLevel: Stale pull resume token for ${did} -> ${dwnUrl}, resetting to start fresh`);
+                        ReplicationLedger.resetCheckpoint(link.pull);
+                        yield this.ledger.saveLink(link);
+                        if (this._engineGeneration !== generation) {
+                            return;
+                        }
+                        yield this.openLivePullSubscription(target);
+                    }
+                    else {
+                        throw pullErr;
+                    }
+                }
+                if (this._engineGeneration !== generation) {
                     return;
                 }
                 try {
-                    yield this.openLocalPushSubscription(Object.assign(Object.assign({}, target), { pushCursor: link.push.contiguousAppliedToken }));
+                    yield this.openLocalPushSubscription(target);
                 }
                 catch (pushError) {
-                    const pullSub = this._liveSubscriptions.find(s => s.did === did && s.dwnUrl === dwnUrl && s.protocol === protocol);
+                    const pullSub = this._liveSubscriptions.find((s) => s.linkKey === linkKey);
                     if (pullSub) {
                         try {
                             yield pullSub.close();
@@ -821,9 +824,13 @@ export class SyncEngineLevel {
                     }
                     throw pushError;
                 }
-                if (this._syncGeneration !== generation) {
+                if (this._engineGeneration !== generation) {
                     return;
                 }
+                // Note: post-repair reconcile to close the repair-window gap is
+                // scheduled by repairLink() AFTER _activeRepairs is cleared — not
+                // here, because scheduleReconcile() would skip it while _activeRepairs
+                // still contains this link.
                 // Step 6: Clean up repair context and transition to live.
                 this._repairContext.delete(linkKey);
                 this._repairAttempts.delete(linkKey);
@@ -843,7 +850,7 @@ export class SyncEngineLevel {
             }
             catch (error) {
                 // If teardown occurred during repair, don't retry or enter degraded_poll.
-                if (this._syncGeneration !== generation) {
+                if (this._engineGeneration !== generation) {
                     return;
                 }
                 console.error(`SyncEngineLevel: Repair failed for ${did} -> ${dwnUrl} (attempt ${attempts})`, error);
@@ -863,9 +870,10 @@ export class SyncEngineLevel {
      */
     closeLinkSubscriptions(link) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { tenantDid: did, remoteEndpoint: dwnUrl, protocol } = link;
+            const { tenantDid: did, remoteEndpoint: dwnUrl } = link;
+            const linkKey = this.buildLinkKey(did, dwnUrl, link.scopeId);
             // Close pull subscription.
-            const pullSub = this._liveSubscriptions.find(s => s.did === did && s.dwnUrl === dwnUrl && s.protocol === protocol);
+            const pullSub = this._liveSubscriptions.find((s) => s.linkKey === linkKey);
             if (pullSub) {
                 try {
                     yield pullSub.close();
@@ -874,7 +882,7 @@ export class SyncEngineLevel {
                 this._liveSubscriptions = this._liveSubscriptions.filter(s => s !== pullSub);
             }
             // Close local push subscription.
-            const pushSub = this._localSubscriptions.find(s => s.did === did && s.dwnUrl === dwnUrl && s.protocol === protocol);
+            const pushSub = this._localSubscriptions.find((s) => s.linkKey === linkKey);
             if (pushSub) {
                 try {
                     yield pushSub.close();
@@ -910,10 +918,10 @@ export class SyncEngineLevel {
             const baseInterval = 15000;
             const jitter = Math.floor(Math.random() * 15000);
             const interval = baseInterval + jitter;
-            const pollGeneration = this._syncGeneration;
+            const pollGeneration = this._engineGeneration;
             const timer = setInterval(() => __awaiter(this, void 0, void 0, function* () {
                 // Bail if teardown occurred since this timer was created.
-                if (this._syncGeneration !== pollGeneration) {
+                if (this._engineGeneration !== pollGeneration) {
                     clearInterval(timer);
                     this._degradedPollTimers.delete(linkKey);
                     return;
@@ -956,14 +964,14 @@ export class SyncEngineLevel {
             // Increment generation to invalidate all in-flight async operations
             // (repairs, retry timers, degraded-poll ticks). Any async work that
             // captured the previous generation will bail on its next checkpoint.
-            this._syncGeneration++;
-            // Clear the push debounce timer.
-            if (this._pushDebounceTimer) {
-                clearTimeout(this._pushDebounceTimer);
-                this._pushDebounceTimer = undefined;
-            }
-            // Flush any pending push CIDs.
-            this._pendingPushCids.clear();
+            this._engineGeneration++;
+            // Clear per-link push runtime state.
+            for (const pushRuntime of this._pushRuntimes.values()) {
+                if (pushRuntime.timer) {
+                    clearTimeout(pushRuntime.timer);
+                }
+            }
+            this._pushRuntimes.clear();
             // Close all live pull subscriptions.
             for (const sub of this._liveSubscriptions) {
                 try {
@@ -996,8 +1004,15 @@ export class SyncEngineLevel {
             }
             this._repairRetryTimers.clear();
             this._repairContext.clear();
+            // Clear reconcile timers and in-flight operations.
+            for (const timer of this._reconcileTimers.values()) {
+                clearTimeout(timer);
+            }
+            this._reconcileTimers.clear();
+            this._reconcileInFlight.clear();
             // Clear closure evaluation contexts.
             this._closureContexts.clear();
+            this._recentlyPulledCids.clear();
             // Clear the in-memory link and runtime state.
             this._activeLinks.clear();
             this._linkRuntimes.clear();
@@ -1012,12 +1027,24 @@ export class SyncEngineLevel {
      */
     openLivePullSubscription(target) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
+            var _a;
             const { did, delegateDid, dwnUrl, protocol } = target;
-            // Resolve the cursor from the link's pull checkpoint (preferred) or legacy storage.
-            const cursorKey = this.buildCursorKey(did, dwnUrl, protocol);
+            // Resolve the cursor from the link's durable pull checkpoint.
+            // Legacy syncCursors migration happens at link load time in startLiveSync().
+            const cursorKey = target.linkKey;
             const link = this._activeLinks.get(cursorKey);
-            const cursor = (_a = link === null || link === void 0 ? void 0 : link.pull.contiguousAppliedToken) !== null && _a !== void 0 ? _a : yield this.getCursor(cursorKey);
+            let cursor = link === null || link === void 0 ? void 0 : link.pull.contiguousAppliedToken;
+            // Guard against corrupted tokens with empty fields — these would fail
+            // MessagesSubscribe JSON schema validation (minLength: 1). Discard and
+            // start from the beginning rather than crash the subscription.
+            if (cursor && (!cursor.streamId || !cursor.messageCid || !cursor.epoch || !cursor.position)) {
+                console.warn(`SyncEngineLevel: Discarding stored cursor with empty field(s) for ${did} -> ${dwnUrl}`);
+                cursor = undefined;
+                if (link) {
+                    ReplicationLedger.resetCheckpoint(link.pull);
+                    yield this.ledger.saveLink(link);
+                }
+            }
             // Build the MessagesSubscribe filters.
             // When the link has protocolPathPrefixes, include them in the filter so the
             // EventLog delivers only matching events (server-side filtering). This replaces
@@ -1026,7 +1053,7 @@ export class SyncEngineLevel {
             // MessagesFilter.protocolPathPrefix is a single string. Multiple prefixes
             // would need multiple filters (OR semantics) — for now we use the first one.
             const protocolPathPrefix = (link === null || link === void 0 ? void 0 : link.scope.kind) === 'protocol'
-                ? (_b = link.scope.protocolPathPrefixes) === null || _b === void 0 ? void 0 : _b[0]
+                ? (_a = link.scope.protocolPathPrefixes) === null || _a === void 0 ? void 0 : _a[0]
                 : undefined;
             const filters = protocol
                 ? [Object.assign({ protocol }, (protocolPathPrefix ? { protocolPathPrefix } : {}))]
@@ -1046,11 +1073,15 @@ export class SyncEngineLevel {
                 });
                 permissionGrantId = grant.grant.id;
             }
+            const handlerGeneration = this._engineGeneration;
             // Define the subscription handler that processes incoming events.
             // NOTE: The WebSocket client fires handlers without awaiting (fire-and-forget),
             // so multiple handlers can be in-flight concurrently. The ordinal tracker
             // ensures the checkpoint advances only when all earlier deliveries are committed.
             const subscriptionHandler = (subMessage) => __awaiter(this, void 0, void 0, function* () {
+                if (this._engineGeneration !== handlerGeneration) {
+                    return;
+                }
                 if (subMessage.type === 'eose') {
                     // End-of-stored-events — catch-up complete.
                     if (link) {
@@ -1072,9 +1103,6 @@ export class SyncEngineLevel {
                         this.drainCommittedPull(cursorKey);
                         yield this.ledger.saveLink(link);
                     }
-                    else {
-                        yield this.setCursor(cursorKey, subMessage.cursor);
-                    }
                     // Transport is reachable — set connectivity to online.
                     if (link) {
                         const prevEoseConnectivity = link.connectivity;
@@ -1082,6 +1110,10 @@ export class SyncEngineLevel {
                         if (prevEoseConnectivity !== 'online') {
                             this.emitEvent({ type: 'link:connectivity-change', tenantDid: did, remoteEndpoint: dwnUrl, protocol, from: prevEoseConnectivity, to: 'online' });
                         }
+                        // If the link was marked dirty, schedule reconciliation now that it's healthy.
+                        if (link.needsReconcile) {
+                            this.scheduleReconcile(cursorKey, 500);
+                        }
                     }
                     else {
                         this._connectivityState = 'online';
@@ -1211,10 +1243,6 @@ export class SyncEngineLevel {
                                 yield this.transitionToRepairing(cursorKey, link);
                             }
                         }
-                        else if (!link) {
-                            // Legacy path: no link available, use simple cursor persistence.
-                            yield this.setCursor(cursorKey, subMessage.cursor);
-                        }
                     }
                     catch (error) {
                         console.error(`SyncEngineLevel: Error processing live-pull event for ${did}`, error);
@@ -1249,7 +1277,11 @@ export class SyncEngineLevel {
             const resubscribeFactory = (resumeCursor) => __awaiter(this, void 0, void 0, function* () {
                 var _a;
                 // On reconnect, use the latest durable checkpoint position if available.
-                const effectiveCursor = (_a = resumeCursor !== null && resumeCursor !== void 0 ? resumeCursor : link === null || link === void 0 ? void 0 : link.pull.contiguousAppliedToken) !== null && _a !== void 0 ? _a : cursor;
+                // Discard tokens with empty fields to avoid schema validation failures.
+                let effectiveCursor = (_a = resumeCursor !== null && resumeCursor !== void 0 ? resumeCursor : link === null || link === void 0 ? void 0 : link.pull.contiguousAppliedToken) !== null && _a !== void 0 ? _a : cursor;
+                if (effectiveCursor && (!effectiveCursor.streamId || !effectiveCursor.messageCid || !effectiveCursor.epoch || !effectiveCursor.position)) {
+                    effectiveCursor = undefined;
+                }
                 const resumeRequest = Object.assign(Object.assign({}, subscribeRequest), { messageParams: Object.assign(Object.assign({}, subscribeRequest.messageParams), { cursor: effectiveCursor }) });
                 const { message: resumeMsg } = yield this.agent.dwn.processRequest(resumeRequest);
                 if (!resumeMsg) {
@@ -1281,6 +1313,7 @@ export class SyncEngineLevel {
                 throw new Error(`SyncEngineLevel: MessagesSubscribe failed for ${did} -> ${dwnUrl}: ${reply.status.code} ${reply.status.detail}`);
             }
             this._liveSubscriptions.push({
+                linkKey: cursorKey,
                 did,
                 dwnUrl,
                 delegateDid,
@@ -1288,7 +1321,7 @@ export class SyncEngineLevel {
                 close: () => __awaiter(this, void 0, void 0, function* () { yield reply.subscription.close(); }),
             });
             // Set per-link connectivity to online after successful subscription setup.
-            const pullLink = this._activeLinks.get(this.buildCursorKey(did, dwnUrl, protocol));
+            const pullLink = this._activeLinks.get(cursorKey);
             if (pullLink) {
                 const prevPullConnectivity = pullLink.connectivity;
                 pullLink.connectivity = 'online';
@@ -1307,6 +1340,7 @@ export class SyncEngineLevel {
      */
     openLocalPushSubscription(target) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             const { did, delegateDid, dwnUrl, protocol } = target;
             // Build filters scoped to the protocol (if any).
             const filters = protocol ? [{ protocol }] : [];
@@ -1322,35 +1356,24 @@ export class SyncEngineLevel {
                 });
                 permissionGrantId = grant.grant.id;
             }
+            const handlerGeneration = this._engineGeneration;
             // Subscribe to the local DWN's EventLog.
             const subscriptionHandler = (subMessage) => __awaiter(this, void 0, void 0, function* () {
+                if (this._engineGeneration !== handlerGeneration) {
+                    return;
+                }
                 if (subMessage.type !== 'event') {
                     return;
                 }
-                // Subset scope filtering for push: only push events that match the
-                // link's scope prefixes. Events outside the scope are not our responsibility.
-                // Skipped events MUST advance the push checkpoint to prevent infinite
-                // replay after repair/reconnect (same reason as the pull side).
-                const pushLink = this._activeLinks.get(this.buildCursorKey(did, dwnUrl, protocol));
+                // Subset scope filtering: only push events that match the link's
+                // scope prefixes. Events outside the scope are not our responsibility.
+                const pushLinkKey = target.linkKey;
+                const pushLink = this._activeLinks.get(pushLinkKey);
                 if (pushLink && !isEventInScope(subMessage.event.message, pushLink.scope)) {
-                    // Guard: only mutate durable state when the link is live/initializing.
-                    // During repair/degraded_poll, orchestration owns checkpoint progression.
-                    if (pushLink.status !== 'live' && pushLink.status !== 'initializing') {
-                        return;
-                    }
-                    // Validate token domain before committing — a stream/epoch mismatch
-                    // on the local EventLog should trigger repair, not silently overwrite.
-                    if (!ReplicationLedger.validateTokenDomain(pushLink.push, subMessage.cursor)) {
-                        yield this.transitionToRepairing(this.buildCursorKey(did, dwnUrl, protocol), pushLink);
-                        return;
-                    }
-                    ReplicationLedger.setReceivedToken(pushLink.push, subMessage.cursor);
-                    ReplicationLedger.commitContiguousToken(pushLink.push, subMessage.cursor);
-                    yield this.ledger.saveLink(pushLink);
                     return;
                 }
                 // Accumulate the message CID for a debounced push.
-                const targetKey = this.buildCursorKey(did, dwnUrl, protocol);
+                const targetKey = pushLinkKey;
                 const cid = yield Message.getCid(subMessage.event.message);
                 if (cid === undefined) {
                     return;
@@ -1361,30 +1384,26 @@ export class SyncEngineLevel {
                 if (this.isRecentlyPulled(cid, dwnUrl)) {
                     return;
                 }
-                let pending = this._pendingPushCids.get(targetKey);
-                if (!pending) {
-                    pending = { did, dwnUrl, delegateDid, protocol, entries: [] };
-                    this._pendingPushCids.set(targetKey, pending);
-                }
-                pending.entries.push({ cid, localToken: subMessage.cursor });
-                // Debounce the push.
-                if (this._pushDebounceTimer) {
-                    clearTimeout(this._pushDebounceTimer);
+                const pushRuntime = this.getOrCreatePushRuntime(targetKey, {
+                    did, dwnUrl, delegateDid, protocol,
+                });
+                pushRuntime.entries.push({ cid });
+                // Immediate-first: if no push is in flight and no batch timer is
+                // pending, push immediately. Otherwise, the pending batch timer
+                // or the post-flush drain will pick up the new entry.
+                if (!pushRuntime.flushing && !pushRuntime.timer) {
+                    void this.flushPendingPushesForLink(targetKey);
                 }
-                this._pushDebounceTimer = setTimeout(() => {
-                    void this.flushPendingPushes();
-                }, PUSH_DEBOUNCE_MS);
             });
-            // Process the local subscription request.
-            // When a push cursor is provided (e.g., after repair), the local subscription
-            // replays events from that position, closing the race window where local
-            // writes during repair would otherwise be missed by push-on-write.
+            // Subscribe to the local DWN EventLog from "now" — opportunistic push
+            // does not replay from a stored cursor. Any writes missed during outages
+            // are recovered by the post-repair reconciliation path.
             const response = yield this.agent.dwn.processRequest({
                 author: did,
                 target: did,
                 messageType: DwnInterface.MessagesSubscribe,
                 granteeDid: delegateDid,
-                messageParams: { filters, permissionGrantId, cursor: target.pushCursor },
+                messageParams: { filters, permissionGrantId },
                 subscriptionHandler: subscriptionHandler,
             });
             const reply = response.reply;
@@ -1392,6 +1411,7 @@ export class SyncEngineLevel {
                 throw new Error(`SyncEngineLevel: Local MessagesSubscribe failed for ${did}: ${reply.status.code} ${reply.status.detail}`);
             }
             this._localSubscriptions.push({
+                linkKey: (_a = target.linkKey) !== null && _a !== void 0 ? _a : buildLegacyCursorKey(did, dwnUrl, protocol),
                 did,
                 dwnUrl,
                 delegateDid,
@@ -1405,104 +1425,234 @@ export class SyncEngineLevel {
      */
     flushPendingPushes() {
         return __awaiter(this, void 0, void 0, function* () {
-            this._pushDebounceTimer = undefined;
-            const batches = [...this._pendingPushCids.entries()];
-            this._pendingPushCids.clear();
-            // Push to all endpoints in parallel — each target is independent.
-            yield Promise.all(batches.map((_a) => __awaiter(this, [_a], void 0, function* ([targetKey, pending]) {
-                const { did, dwnUrl, delegateDid, protocol, entries: pushEntries } = pending;
-                if (pushEntries.length === 0) {
-                    return;
+            yield Promise.all([...this._pushRuntimes.keys()].map((linkKey) => __awaiter(this, void 0, void 0, function* () {
+                yield this.flushPendingPushesForLink(linkKey);
+            })));
+        });
+    }
+    flushPendingPushesForLink(linkKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const pushRuntime = this._pushRuntimes.get(linkKey);
+            if (!pushRuntime) {
+                return;
+            }
+            const { did, dwnUrl, delegateDid, protocol, entries: pushEntries, retryCount } = pushRuntime;
+            pushRuntime.entries = [];
+            if (pushEntries.length === 0) {
+                if (!pushRuntime.timer && !pushRuntime.flushing && retryCount === 0) {
+                    this._pushRuntimes.delete(linkKey);
                 }
-                const cids = pushEntries.map(e => e.cid);
-                try {
-                    const result = yield pushMessages({
+                return;
+            }
+            const cids = pushEntries.map((entry) => entry.cid);
+            pushRuntime.flushing = true;
+            try {
+                const result = yield pushMessages({
+                    did, dwnUrl, delegateDid, protocol,
+                    messageCids: cids,
+                    agent: this.agent,
+                    permissionsApi: this._permissionsApi,
+                });
+                if (result.failed.length > 0) {
+                    const failedSet = new Set(result.failed);
+                    const failedEntries = pushEntries.filter((entry) => failedSet.has(entry.cid));
+                    this.requeueOrReconcile(linkKey, {
                         did, dwnUrl, delegateDid, protocol,
-                        messageCids: cids,
-                        agent: this.agent,
-                        permissionsApi: this._permissionsApi,
+                        entries: failedEntries,
+                        retryCount: retryCount + 1,
                     });
-                    // Advance the push checkpoint for successfully pushed entries.
-                    // Push is sequential (single batch, in-order processing) so we can
-                    // commit directly without ordinal tracking — there's no concurrent
-                    // completion to reorder.
-                    const link = this._activeLinks.get(targetKey);
-                    if (link) {
-                        const succeededSet = new Set(result.succeeded);
-                        // Track highest contiguous success: if a CID fails, we stop advancing.
-                        let hitFailure = false;
-                        for (const entry of pushEntries) {
-                            if (hitFailure) {
-                                break;
-                            }
-                            if (succeededSet.has(entry.cid) && entry.localToken) {
-                                if (!ReplicationLedger.validateTokenDomain(link.push, entry.localToken)) {
-                                    console.warn(`SyncEngineLevel: Push checkpoint domain mismatch for ${did} -> ${dwnUrl}, transitioning to repairing`);
-                                    yield this.transitionToRepairing(targetKey, link);
-                                    break;
-                                }
-                                ReplicationLedger.setReceivedToken(link.push, entry.localToken);
-                                ReplicationLedger.commitContiguousToken(link.push, entry.localToken);
-                            }
-                            else {
-                                // This CID failed or had no token — stop advancing.
-                                hitFailure = true;
-                            }
-                        }
-                        yield this.ledger.saveLink(link);
-                    }
-                    // Re-queue only TRANSIENT failures for retry. Permanent failures (400/401/403)
-                    // are dropped — they will never succeed regardless of retry.
-                    if (result.failed.length > 0) {
-                        console.error(`SyncEngineLevel: Push-on-write failed for ${did} -> ${dwnUrl}: ` +
-                            `${result.failed.length} transient failures of ${cids.length} messages`);
-                        const failedSet = new Set(result.failed);
-                        const failedEntries = pushEntries.filter(e => failedSet.has(e.cid));
-                        let requeued = this._pendingPushCids.get(targetKey);
-                        if (!requeued) {
-                            requeued = { did, dwnUrl, delegateDid, protocol, entries: [] };
-                            this._pendingPushCids.set(targetKey, requeued);
-                        }
-                        requeued.entries.push(...failedEntries);
-                        // Schedule a retry after a short delay.
-                        if (!this._pushDebounceTimer) {
-                            this._pushDebounceTimer = setTimeout(() => {
-                                void this.flushPendingPushes();
-                            }, PUSH_DEBOUNCE_MS * 4);
-                        }
-                    }
-                    // Permanent failures are logged by pushMessages but NOT re-queued.
-                    // They will be rediscovered by the next SMT integrity check if the
-                    // local/remote state has changed, but won't spin in a retry loop.
                 }
-                catch (error) {
-                    // Truly unexpected error (not per-message failure). Re-queue entire
-                    // batch so entries aren't silently dropped from the debounce queue.
-                    console.error(`SyncEngineLevel: Push-on-write failed for ${did} -> ${dwnUrl}`, error);
-                    let requeued = this._pendingPushCids.get(targetKey);
-                    if (!requeued) {
-                        requeued = { did, dwnUrl, delegateDid, protocol, entries: [] };
-                        this._pendingPushCids.set(targetKey, requeued);
-                    }
-                    requeued.entries.push(...pushEntries);
-                    if (!this._pushDebounceTimer) {
-                        this._pushDebounceTimer = setTimeout(() => {
-                            void this.flushPendingPushes();
-                        }, PUSH_DEBOUNCE_MS * 4);
+                else {
+                    // Successful push — reset retry count so subsequent unrelated
+                    // batches on this link start with a fresh budget.
+                    pushRuntime.retryCount = 0;
+                    if (!pushRuntime.timer && pushRuntime.entries.length === 0) {
+                        this._pushRuntimes.delete(linkKey);
                     }
                 }
-            })));
+            }
+            catch (error) {
+                console.error(`SyncEngineLevel: Push batch failed for ${did} -> ${dwnUrl}`, error);
+                this.requeueOrReconcile(linkKey, {
+                    did, dwnUrl, delegateDid, protocol,
+                    entries: pushEntries,
+                    retryCount: retryCount + 1,
+                });
+            }
+            finally {
+                pushRuntime.flushing = false;
+                // If new entries accumulated while this push was in flight, schedule
+                // a short drain to flush them. This gives a brief batching window
+                // for burst writes while keeping single-write latency low.
+                const rt = this._pushRuntimes.get(linkKey);
+                if (rt && rt.entries.length > 0 && !rt.timer) {
+                    rt.timer = setTimeout(() => {
+                        rt.timer = undefined;
+                        void this.flushPendingPushesForLink(linkKey);
+                    }, PUSH_DEBOUNCE_MS);
+                }
+            }
+        });
+    }
+    /**
+     * Re-queues a failed push batch for retry, or marks the link
+     * `needsReconcile` if retries are exhausted. Bounded to prevent
+     * infinite retry loops.
+     */
+    requeueOrReconcile(targetKey, pending) {
+        var _a;
+        const maxRetries = SyncEngineLevel.PUSH_RETRY_BACKOFF_MS.length;
+        const pushRuntime = this.getOrCreatePushRuntime(targetKey, pending);
+        if (pending.retryCount >= maxRetries) {
+            // Retry budget exhausted — mark link dirty for reconciliation.
+            if (pushRuntime.timer) {
+                clearTimeout(pushRuntime.timer);
+            }
+            this._pushRuntimes.delete(targetKey);
+            const link = this._activeLinks.get(targetKey);
+            if (link && !link.needsReconcile) {
+                link.needsReconcile = true;
+                void this.ledger.saveLink(link).then(() => {
+                    this.emitEvent({ type: 'reconcile:needed', tenantDid: pending.did, remoteEndpoint: pending.dwnUrl, protocol: pending.protocol, reason: 'push-retry-exhausted' });
+                    this.scheduleReconcile(targetKey);
+                });
+            }
+            return;
+        }
+        pushRuntime.entries.push(...pending.entries);
+        pushRuntime.retryCount = pending.retryCount;
+        const delayMs = (_a = SyncEngineLevel.PUSH_RETRY_BACKOFF_MS[pending.retryCount]) !== null && _a !== void 0 ? _a : 2000;
+        if (pushRuntime.timer) {
+            clearTimeout(pushRuntime.timer);
+        }
+        pushRuntime.timer = setTimeout(() => {
+            pushRuntime.timer = undefined;
+            void this.flushPendingPushesForLink(targetKey);
+        }, delayMs);
+    }
+    createLinkReconciler(shouldContinue) {
+        return new SyncLinkReconciler({
+            getLocalRoot: (did, delegateDid, protocol) => __awaiter(this, void 0, void 0, function* () { return this.getLocalRoot(did, delegateDid, protocol); }),
+            getRemoteRoot: (did, dwnUrl, delegateDid, protocol) => __awaiter(this, void 0, void 0, function* () { return this.getRemoteRoot(did, dwnUrl, delegateDid, protocol); }),
+            diffWithRemote: (target) => __awaiter(this, void 0, void 0, function* () { return this.diffWithRemote(target); }),
+            pullMessages: (params) => __awaiter(this, void 0, void 0, function* () { return this.pullMessages(params); }),
+            pushMessages: (params) => __awaiter(this, void 0, void 0, function* () { return this.pushMessages(params); }),
+            shouldContinue,
+        });
+    }
+    /**
+     * Schedule a per-link reconciliation after a short debounce. Coalesces
+     * repeated requests for the same link.
+     */
+    scheduleReconcile(linkKey, delayMs = 1500) {
+        if (this._reconcileTimers.has(linkKey)) {
+            return;
+        }
+        if (this._reconcileInFlight.has(linkKey)) {
+            return;
+        }
+        if (this._activeRepairs.has(linkKey)) {
+            return;
+        }
+        const generation = this._engineGeneration;
+        const timer = setTimeout(() => {
+            this._reconcileTimers.delete(linkKey);
+            if (this._engineGeneration !== generation) {
+                return;
+            }
+            void this.reconcileLink(linkKey);
+        }, delayMs);
+        this._reconcileTimers.set(linkKey, timer);
+    }
+    /**
+     * Run SMT reconciliation for a single link. Deduplicates concurrent calls.
+     * On success, clears `needsReconcile`. On failure, schedules retry.
+     */
+    reconcileLink(linkKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const existing = this._reconcileInFlight.get(linkKey);
+            if (existing) {
+                return existing;
+            }
+            const promise = this.doReconcileLink(linkKey).finally(() => {
+                this._reconcileInFlight.delete(linkKey);
+            });
+            this._reconcileInFlight.set(linkKey, promise);
+            return promise;
         });
     }
+    /**
+     * Internal reconciliation implementation for a single link. Runs the
+     * same SMT diff + pull/push that `sync()` does, but scoped to one link.
+     */
+    doReconcileLink(linkKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const link = this._activeLinks.get(linkKey);
+            if (!link) {
+                return;
+            }
+            // Only reconcile live links — repairing/degraded links have their own
+            // recovery path. Reconciling during repair would race with SMT diff.
+            if (link.status !== 'live') {
+                return;
+            }
+            // Skip if a repair is in progress for this link.
+            if (this._activeRepairs.has(linkKey)) {
+                return;
+            }
+            const generation = this._engineGeneration;
+            const { tenantDid: did, remoteEndpoint: dwnUrl, delegateDid, protocol } = link;
+            try {
+                const reconcileOutcome = yield this.createLinkReconciler(() => this._engineGeneration === generation).reconcile({ did, dwnUrl, delegateDid, protocol }, { verifyConvergence: true });
+                if (reconcileOutcome.aborted) {
+                    return;
+                }
+                if (reconcileOutcome.converged) {
+                    yield this.ledger.clearNeedsReconcile(link);
+                    this.emitEvent({ type: 'reconcile:completed', tenantDid: did, remoteEndpoint: dwnUrl, protocol });
+                }
+                else {
+                    // Roots still differ — retry after a delay. This can happen when
+                    // pushMessages() had permanent failures, pullMessages() partially
+                    // failed, or new writes arrived during reconciliation.
+                    this.scheduleReconcile(linkKey, 5000);
+                }
+            }
+            catch (error) {
+                console.error(`SyncEngineLevel: Reconciliation failed for ${did} -> ${dwnUrl}`, error);
+                // Schedule retry with longer delay.
+                this.scheduleReconcile(linkKey, 5000);
+            }
+        });
+    }
+    getOrCreatePushRuntime(linkKey, params) {
+        let pushRuntime = this._pushRuntimes.get(linkKey);
+        if (!pushRuntime) {
+            pushRuntime = Object.assign(Object.assign({}, params), { entries: [], retryCount: 0 });
+            this._pushRuntimes.set(linkKey, pushRuntime);
+        }
+        return pushRuntime;
+    }
     // ---------------------------------------------------------------------------
     // Cursor persistence
     // ---------------------------------------------------------------------------
-    buildCursorKey(did, dwnUrl, protocol) {
-        const base = `${did}${CURSOR_SEPARATOR}${dwnUrl}`;
-        return protocol ? `${base}${CURSOR_SEPARATOR}${protocol}` : base;
+    /**
+     * Build the runtime key for a replication link.
+     *
+     * Live-mode subscription methods (`openLivePullSubscription`,
+     * `openLocalPushSubscription`) receive `linkKey` directly and never
+     * call this. The remaining callers are poll-mode `sync()` and the
+     * live-mode startup/error paths that already have `link.scopeId`.
+     *
+     * The `undefined` fallback (which produces a legacy cursor key) exists
+     * only for the no-protocol full-tenant targets in poll mode.
+     */
+    buildLinkKey(did, dwnUrl, scopeIdOrProtocol) {
+        return scopeIdOrProtocol ? buildLinkId(did, dwnUrl, scopeIdOrProtocol) : buildLegacyCursorKey(did, dwnUrl);
     }
     /**
-     * Retrieves a stored progress token. Handles migration from old string cursors:
+     * @deprecated Used by poll-mode sync and one-time migration only. Live mode
+     * uses ReplicationLedger checkpoints. Handles migration from old string cursors:
      * if the stored value is a bare string (pre-ProgressToken format), it is treated
      * as absent — the sync engine will do a full SMT reconciliation on first startup
      * after upgrade, which is correct and safe.
@@ -1515,16 +1665,19 @@ export class SyncEngineLevel {
                 try {
                     const parsed = JSON.parse(raw);
                     if (parsed && typeof parsed === 'object' &&
-                        typeof parsed.streamId === 'string' &&
-                        typeof parsed.epoch === 'string' &&
-                        typeof parsed.position === 'string' &&
-                        typeof parsed.messageCid === 'string') {
+                        typeof parsed.streamId === 'string' && parsed.streamId.length > 0 &&
+                        typeof parsed.epoch === 'string' && parsed.epoch.length > 0 &&
+                        typeof parsed.position === 'string' && parsed.position.length > 0 &&
+                        typeof parsed.messageCid === 'string' && parsed.messageCid.length > 0) {
                         return parsed;
                     }
                 }
                 catch (_a) {
-                    // Not valid JSON (old string cursor) — treat as absent.
+                    // Not valid JSON (old string cursor) — fall through to delete.
                 }
+                // Entry exists but is unparseable or has invalid/empty fields. Delete it
+                // so subsequent startups don't re-check it on every launch.
+                yield this.deleteLegacyCursor(key);
                 return undefined;
             }
             catch (error) {
@@ -1536,10 +1689,21 @@ export class SyncEngineLevel {
             }
         });
     }
-    setCursor(key, cursor) {
+    /**
+     * Delete a legacy cursor from the old syncCursors sublevel.
+     * Called as part of one-time migration to ReplicationLedger.
+     */
+    deleteLegacyCursor(key) {
         return __awaiter(this, void 0, void 0, function* () {
             const cursors = this._db.sublevel('syncCursors');
-            yield cursors.put(key, JSON.stringify(cursor));
+            try {
+                yield cursors.del(key);
+            }
+            catch (_a) {
+                // Best-effort — ignore LEVEL_NOT_FOUND and transient I/O errors alike.
+                // A failed delete leaves the bad entry for one more re-check on the
+                // next startup, which is harmless.
+            }
         });
     }
     // ---------------------------------------------------------------------------
@@ -1555,8 +1719,11 @@ export class SyncEngineLevel {
             return undefined;
         }
         // Check for inline base64url-encoded data (small records from EventLog).
+        // Delete the transport-level field so the DWN schema validator does not
+        // reject the message for having unevaluated properties.
         const encodedData = event.message.encodedData;
         if (encodedData) {
+            delete event.message.encodedData;
             const bytes = Encoder.base64UrlToBytes(encodedData);
             return new ReadableStream({
                 start(controller) {
@@ -2026,4 +2193,6 @@ SyncEngineLevel.MAX_BACKOFF_MULTIPLIER = 4;
 SyncEngineLevel.MAX_REPAIR_ATTEMPTS = 3;
 /** Backoff schedule for repair retries (milliseconds). */
 SyncEngineLevel.REPAIR_BACKOFF_MS = [1000, 3000, 10000];
+/** Push retry backoff schedule: immediate, 250ms, 1s, 2s, then give up. */
+SyncEngineLevel.PUSH_RETRY_BACKOFF_MS = [0, 250, 1000, 2000];
 //# sourceMappingURL=sync-engine-level.js.map