@ibgib/core-gib 0.1.59 → 0.1.61

package/src/sync/sync-innerspace.withid.respec.mts

@@ -0,0 +1,265 @@
+/**
+ * @module sync-innerspace.withid.respec
+ *
+ * Verifies SyncSagaCoordinator using InnerSpace (in-memory/local) spaces with Identity.
+ * This utilizes SyncPeerInnerspace_V1 for local-to-local synchronization simulations.
+ */
+
+import {
+    respecfully, lastOfAll, ifWe, iReckon,
+    ifWeMight
+} from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+const maam = `[${import.meta.url}]`, sir = maam;
+import { clone, delay, extractErrorMsg, pretty } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
+import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
+
+import { GLOBAL_LOG_A_LOT } from '../core-constants.mjs';
+import { SyncSagaCoordinator } from './sync-saga-coordinator.mjs';
+import { getFromSpace } from '../witness/space/space-helper.mjs';
+import { Metaspace_Innerspace } from '../witness/space/metaspace/metaspace-innerspace/metaspace-innerspace.mjs';
+import { getDependencyGraph } from '../common/other/graph-helper.mjs';
+import { InnerSpace_V1 } from '../witness/space/inner-space/inner-space-v1.mjs';
+import { createTimelineRootTestHelper, } from '../test-helpers.mjs';
+import { mut8Timeline, } from '../timeline/timeline-api.mjs';
+import { DEFAULT_INNER_SPACE_DATA_V1 } from '../witness/space/inner-space/inner-space-types.mjs';
+import { toDto } from '../common/other/ibgib-helper.mjs';
+import { fnObs } from '../common/pubsub/observer/observer-helper.mjs';
+import { SyncPeerInnerspace_V1 } from './sync-peer/sync-peer-innerspace/sync-peer-innerspace-v1.mjs';
+import { SYNC_PEER_INNERSPACE_DEFAULT_DATA_V1 } from './sync-peer/sync-peer-innerspace/sync-peer-innerspace-constants.mjs';
+
+import { KeystoneService_V1 } from '../keystone/keystone-service-v1.mjs';
+import {
+    KEYSTONE_VERB_SYNC, POOL_ID_SYNC,
+} from '../keystone/keystone-constants.mjs';
+import { createStandardPoolConfig } from '../keystone/keystone-config-builder.mjs';
+import { KeystoneReplenishStrategy } from '../keystone/keystone-types.mjs';
+import { SyncConflictStrategy } from './sync-constants.mjs';
+
+const logalot = GLOBAL_LOG_A_LOT;
+const lc = `[sync-innerspace.withid.respec]`;
+
+const SENDER_SECRET = 'test-sender-secret-innerspace-withid';
+
+const SENDER_IDENTITY_SYNC_POOL_CONFIG = createStandardPoolConfig({
+    id: POOL_ID_SYNC,
+    salt: 'senderidentitysyncsaltinnerspacewithid',
+    verbs: [KEYSTONE_VERB_SYNC],
+    size: 200,
+    sequential: 1,
+    random: 1,
+    targetBinding: 2,
+    replenishStrategy: KeystoneReplenishStrategy.topUp,
+});
+
+await respecfully(sir, `Sync InnerSpaces with Identity`, async () => {
+
+    let metaspace: Metaspace_Innerspace;
+    let sourceSpace: InnerSpace_V1;
+    let destSpace: InnerSpace_V1;
+
+    // #region Round 1 - Push timeline
+    await respecfully(sir, `Basic Push Sync with Identity (Source -> Dest)`, async () => {
+        // 1. Setup Spaces
+        metaspace = new Metaspace_Innerspace(undefined);
+        await metaspace.initialize({
+            getFnAlert: () => async ({ title, msg }) => { console.log(`[Alert] ${title}: ${msg}`); },
+            getFnPrompt: () => async ({ title, msg }) => { console.log(`[Prompt] ${title}: ${msg}`); return ''; },
+            getFnPromptPassword: () => async (title, msg) => { console.log(`[PromptPwd] ${title}: ${msg}`); return null; },
+        });
+        while (!metaspace.initialized) { await delay(10); }
+
+        const defaultLocalUserSpace = await metaspace.getLocalUserSpace({ lock: false });
+        if (!defaultLocalUserSpace) { throw new Error(`(UNEXPECTED) defaultLocalUserSpace falsy? (E: 87da738ca09e8fcabde916298126)`); }
+        await defaultLocalUserSpace.initialized;
+        if (logalot) { console.log(`defaultLocalUserSpace: ${pretty(toDto({ ibGib: defaultLocalUserSpace }))}`); }
+
+        sourceSpace = new InnerSpace_V1({
+            ...DEFAULT_INNER_SPACE_DATA_V1,
+            name: 'source',
+            uuid: 'source_uuid',
+            description: 'source test space',
+        });
+        await sourceSpace.initialized;
+        if (logalot) { console.log(`sourceSpace: ${pretty(toDto({ ibGib: sourceSpace }))}`); }
+
+        destSpace = new InnerSpace_V1({
+            ...DEFAULT_INNER_SPACE_DATA_V1,
+            name: 'dest',
+            uuid: 'dest_uuid',
+            description: 'dest test space',
+        });
+        await destSpace.initialized;
+        if (logalot) { console.log(`destSpace: ${pretty(toDto({ ibGib: destSpace }))}`); }
+
+        const keystoneSvc = new KeystoneService_V1();
+        const senderIdentity = await keystoneSvc.genesis({
+            masterSecret: SENDER_SECRET,
+            configs: [SENDER_IDENTITY_SYNC_POOL_CONFIG],
+            metaspace,
+            space: sourceSpace,
+        });
+
+        // post the senderIdentity to receiver
+        await metaspace.put({ ibGib: senderIdentity, space: destSpace });
+        await metaspace.registerNewIbGib({ ibGib: senderIdentity, space: destSpace });
+
+        // #region r1 setup
+        // 2. Seed Source Data
+        if (logalot) { console.log(`${lc} Creating data in Source...`); }
+        const r1_alpha_v0_source = await createTimelineRootTestHelper({
+            ib: 'timeline_root',
+            data: { type: 'root', },
+            space: sourceSpace,
+        });
+
+        const r1_alpha_v1_source = await mut8Timeline({
+            timeline: r1_alpha_v0_source,
+            mut8Opts: {
+                dataToAddOrPatch: { type: 'child', },
+            },
+            metaspace,
+            space: sourceSpace,
+        });
+        const r1_alpha_v1_source_addr = getIbGibAddr({ ibGib: r1_alpha_v1_source });
+        // #endregion r1 setup
+
+        // 3. Setup Coordinators & Peer
+        if (logalot) { console.log(`${lc} Setting up Coordinators...`); }
+
+        // Sender Coordinator
+        const senderCoordinator = new SyncSagaCoordinator();
+
+        // Receiver Coordinator
+        const receiverCoordinator = new SyncSagaCoordinator();
+
+        // Peer (The "Network")
+        const peer = new SyncPeerInnerspace_V1(clone(SYNC_PEER_INNERSPACE_DEFAULT_DATA_V1));
+        await peer.initialized;
+        await peer.initializeOpts({
+            sagaId: '',
+            localMetaspace: metaspace,
+            localSpace: sourceSpace,   // "Client"
+            receiverSpace: destSpace,   // "Server"
+            receiverCoordinator,
+            receiverMetaspace: metaspace,
+        });
+
+        // 4. Run Sync
+        if (logalot) { console.log(`${lc} Running Sync...`); }
+        const resSync = await senderCoordinator.sync({
+            peer: peer,
+            localSpace: sourceSpace,
+            metaspace: metaspace,
+            domainIbGibs: [r1_alpha_v1_source], // Sync the child
+            senderIdentity,
+            fnSenderSecret: async () => SENDER_SECRET,
+            conflictStrategy: SyncConflictStrategy.optimisticWithLCS,
+        });
+
+        if (logalot) { console.log(`${lc} resSync: ${pretty(resSync)}`); }
+
+        const sublc = `${lc}[updates$]`;
+        const subscription = await resSync.updates$.subscribe(fnObs({
+            next: async (ctxIbGib) => {
+                if (logalot) { console.log(`${sublc} next fired`); }
+            },
+            error: async (e) => {
+                if (logalot) { console.log(`${sublc} error fired`); }
+            },
+            complete: async () => {
+                if (logalot) { console.log(`${sublc} complete fired`); }
+            },
+        }));
+
+        if (logalot) { console.log(`${lc} awaiting resSync.done`) }
+        await resSync.done;
+
+        // #region r1 verify post
+        // 5. Verify Dest
+        if (logalot) { console.log(`${lc} Verifying Destination...`); }
+        try {
+            const getChildInDest = await getFromSpace({ space: destSpace, addr: r1_alpha_v1_source_addr });
+
+            await ifWe(sir, `verify success getChildInDest`, async () => {
+                iReckon(sir, getChildInDest.success).asTo('Child present in Dest').isGonnaBeTrue();
+            });
+
+            await ifWe(sir, `verify getChildInDest.ibGibs`, async () => {
+                const firstChild = getChildInDest.ibGibs?.[0];
+                if (logalot) { console.log(`${lc} firstChild: ${pretty(firstChild)}`); }
+                iReckon(sir, firstChild?.data?.n).asTo('Child content matches').isGonnaBe(2);
+            });
+
+            await ifWe(sir, 'sessionIdentity evolved the expected number of times', async () => {
+                const latestS = peer.currentSessionIdentity;
+                iReckon(sir, latestS).asTo('latest session identity exists on peer').isGonnaBeTruthy();
+                if (latestS) {
+                    iReckon(sir, latestS.data?.n).asTo('session identity data.n').isGonnaBe(2);
+                }
+            });
+
+            await ifWe(sir, 'sender durable space has I (evolved frame)', async () => {
+                const latestSenderIdentityAddr = await metaspace.getLatestAddr({
+                    addr: getIbGibAddr({ ibGib: senderIdentity }),
+                    space: sourceSpace,
+                });
+                iReckon(sir, latestSenderIdentityAddr).asTo('latestSenderIdentityAddr exists').isGonnaBeTruthy();
+                if (latestSenderIdentityAddr) {
+                    const resGetSourceI = await getFromSpace({ space: sourceSpace, addr: latestSenderIdentityAddr });
+                    iReckon(sir, resGetSourceI.success && resGetSourceI.ibGibs?.length === 1).asTo('evolved I exists in sourceSpace').isGonnaBeTrue();
+                    if (resGetSourceI.success && resGetSourceI.ibGibs?.[0]) {
+                        const evolvedI = resGetSourceI.ibGibs[0];
+                        iReckon(sir, evolvedI.data?.n).asTo('evolved I data.n').isGonnaBe(1);
+                    }
+                }
+            });
+
+            await ifWe(sir, 'receiver durable space has I (evolved frame)', async () => {
+                const latestSenderIdentityAddr = await metaspace.getLatestAddr({
+                    addr: getIbGibAddr({ ibGib: senderIdentity }),
+                    space: sourceSpace,
+                });
+                iReckon(sir, latestSenderIdentityAddr).asTo('latestSenderIdentityAddr exists').isGonnaBeTruthy();
+                if (latestSenderIdentityAddr) {
+                    const resGetDestI = await getFromSpace({ space: destSpace, addr: latestSenderIdentityAddr });
+                    iReckon(sir, resGetDestI.success && resGetDestI.ibGibs?.length === 1).asTo('evolved I exists in destSpace').isGonnaBeTrue();
+                    if (resGetDestI.success && resGetDestI.ibGibs?.[0]) {
+                        const evolvedI = resGetDestI.ibGibs[0];
+                        iReckon(sir, evolvedI.data?.n).asTo('evolved I data.n').isGonnaBe(1);
+                    }
+                }
+            });
+
+            await ifWe(sir, 'sender durable space has full S dep graph', async () => {
+                const latestS = peer.currentSessionIdentity;
+                iReckon(sir, latestS).asTo('latestS exists').isGonnaBeTruthy();
+                if (latestS) {
+                    const depGraphS = await getDependencyGraph({ ibGib: latestS, space: sourceSpace });
+                    const addrs = Object.keys(depGraphS);
+                    iReckon(sir, addrs.length > 2).asTo('number of nodes in S graph > 2').isGonnaBeTrue();
+                }
+            });
+
+            await ifWe(sir, 'receiver durable space has full S dep graph', async () => {
+                const latestS = peer.currentSessionIdentity;
+                iReckon(sir, latestS).asTo('latestS exists').isGonnaBeTruthy();
+                if (latestS) {
+                    const depGraphS = await getDependencyGraph({ ibGib: latestS, space: destSpace });
+                    const addrs = Object.keys(depGraphS);
+                    iReckon(sir, addrs.length > 2).asTo('number of nodes in S graph in destSpace > 2').isGonnaBeTrue();
+                }
+            });
+
+        } catch (error) {
+            await ifWe(sir, `doh`, async () => {
+                iReckon(sir, true).asTo(`error: ${extractErrorMsg(error)}`).isGonnaBeFalse();
+            });
+        } finally {
+            if (logalot) { console.log(`${lc} Test complete.`); }
+        }
+        // #endregion r1 verify post
+    });
+    // #endregion Round 1 - Push timeline
+
+});

package/src/sync/sync-peer/sync-peer-innerspace/sync-peer-innerspace-v1.mts

@@ -325,7 +325,7 @@ export class SyncPeerInnerspace_V1 extends SyncPeer_V1<ConnectSyncPeerInnerspace
             if (!msgResponse.data) { throw new Error(`(UNEXPECTED) sync saga message ibgib.data falsy? (E: 61ec18743988ad3cbab2072d1dd69826)`); }
 
             const responsePayloadIbGibsControl = [
-                msgResponse, responseCtx.sagaFrame, context
+                msgResponse, responseCtx.sagaFrame, responseCtx
             ].map(x => toDto({ ibGib: x }));
             // ...put into sender's durable space
             await putInSpace({

package/src/sync/sync-peer/sync-peer-types.mts

@@ -198,7 +198,17 @@ export interface SyncPeerWitness<TInitializeOpts extends InitializeSyncPeerOpts
     // getSenderIdentity(): KeystoneIbGib_V1 | undefined;
 
     /**
-     * Evolves the session identity (S_n -> S_n+1) and signs targeting contextAddr.
+     * Evolves the session identity (S_n -> S_n+1) and signs targeting
+     * contextAddr for the **sync** verb. This is in contrast to signing for
+     * the "connect" verb, for which you use {@link signContextConnect}
      */
     signContext(opts: { contextAddr: IbGibAddr }): Promise<KeystoneIbGib_V1 | undefined>;
+
+    /**
+     * Evolves the session identity (S_n -> S_n+1) solving the demanded connect
+     * challenges.  This is NOT for signing session when doing the ping pong of
+     * sync protocol. For that, you use {@link signContext}
+     */
+    signContextConnect(opts: { challengeUuid: string, demandedIds: string[] }): Promise<KeystoneIbGib_V1 | undefined>;
+
 }

package/src/sync/sync-peer/sync-peer-v1.mts

@@ -23,7 +23,7 @@ import { getFullSyncSagaHistory, deriveSessionSecret } from '../sync-helpers.mjs
 import { SessionGenesisFrameDetails, SyncSagaFrameDependencyGraph } from '../sync-types.mjs';
 import { KeystoneService_V1 } from '../../keystone/keystone-service-v1.mjs';
 import { KeystoneIbGib_V1 } from '../../keystone/keystone-types.mjs';
-import { KEYSTONE_VERB_SYNC, } from '../../keystone/keystone-constants.mjs';
+import { KEYSTONE_VERB_CONNECT, KEYSTONE_VERB_SYNC, POOL_ID_CONNECT, } from '../../keystone/keystone-constants.mjs';
 import { getTjpAddr } from '../../common/other/ibgib-helper.mjs';
 import { IbGibAddr } from '@ibgib/ts-gib/dist/types.mjs';
 
@@ -99,6 +99,52 @@ export abstract class SyncPeer_V1<
         }
     }
 
+    /**
+ * Evolves the session identity (S_n -> S_n+1) solving the demanded connect challenges.
+ */
+    public async signContextConnect({
+        challengeUuid,
+        demandedIds,
+    }: {
+        challengeUuid: string;
+        demandedIds: string[];
+    }): Promise<KeystoneIbGib_V1 | undefined> {
+        const lc = `${this.lc}[${this.signContextConnect.name}]`;
+        try {
+            if (!this.currentSessionIdentity) {
+                return undefined;
+            }
+            if (!this.opts) { throw new Error(`opts not initialized. (E: bcf5978aed789b0ebcbdc51971ebe826)`); }
+            const { fnSenderSecret, sagaId, localMetaspace, localSpace } = this.opts;
+            if (!fnSenderSecret) { throw new Error(`fnSenderSecret not initialized. (E: 207fd292a2e8c53c05fd0a74a4ae6d26)`); }
+            if (!sagaId) { throw new Error(`sagaId not initialized. (E: f2e35cc13ed873b638116188119d1826)`); }
+
+            const senderSecret = await fnSenderSecret();
+            const sessionSecret = await deriveSessionSecret({ senderSecret, sagaId });
+
+            const keystoneSvc = new KeystoneService_V1();
+            const evolved = await keystoneSvc.sign({
+                latestKeystone: this.currentSessionIdentity,
+                masterSecret: sessionSecret,
+                poolId: POOL_ID_CONNECT,
+                requiredChallengeIds: demandedIds,
+                claim: {
+                    verb: KEYSTONE_VERB_CONNECT,
+                    target: challengeUuid,
+                },
+                metaspace: localMetaspace,
+                space: localSpace,
+            });
+
+            this.currentSessionIdentity = evolved;
+            return evolved;
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        }
+    }
+
+
     get classname(): string {
         if (!this.data) { throw new Error(`(UNEXPECTED) this.data falsy? (E: 1ab1841e9338b54f3aa615fa37024826)`); }
         if (!this.data.classname) { throw new Error(`invalid peer. this.data.classname is falsy (E: b0ee28a0abb84a06588d9de7afcef826)`); }

package/src/sync/sync-peer/sync-peer-websocket/README.md

@@ -0,0 +1,42 @@
+# WebSocket Sync Peers
+
+This directory contains the WebSocket client (sender) and server (receiver) peer implementations.
+
+## WebSocket Resource Management & Teardown
+
+Since WebSockets manage active OS-level TCP connections, they must be cleanly closed to prevent socket descriptor leaks on the client and resource exhaustion (DoS) on the server.
+
+### Analysis (2026-06-12T09:45:21-05:00)
+
+Our analysis highlights several areas where WebSocket connections are currently left open:
+
+1. **Sender Connect Failures**: If connection handshake fails or times out, the client rejects the promise but does not close the socket.
+2. **Sender Runtime Failures**: If runtime message validation fails, we throw an error but leave the socket open.
+3. **Sender Saga Completion**: When the sync loop finishes successfully, the socket is left open indefinitely because there is no `disconnect` method.
+4. **Receiver Message Handling Failures**: If incoming messages fail validation/authentication, the server sends a `sync_error` or `auth_fail` frame, but relies on the client to close the connection. A buggy/malicious client can leave it open forever.
+
+#### Design Questions & Ideas
+* **Idempotent `disconnect()`**: The disconnect method on the sender should clear `this.handshakeMessageListener` and set it to `undefined` so that multiple calls to `disconnect()` are safe.
+* **Reuse `disconnect()`**: In connection failure handlers (like `handleHandshakeAuthFail`), we can call `this.disconnect()` to ensure uniform cleanup.
+* **Server-side Close on Error (best-effort `send`)**: If a message fails, we want to notify the client first and then close the connection. If the `send()` itself throws, we want a safe cleanup. In JavaScript, we can nest `try..catch..finally` inside a `catch` block, or use a short `setTimeout` to push the socket close operation to the next event loop tick, ensuring the outgoing frame is written before the socket is terminated.
+
+---
+
+### Implementation TODOs
+
+- [x] **Implement `disconnect` method on `SyncPeerWebSocketSender_V1`**
+  - Implement a synchronous or asynchronous `disconnect()` method.
+  - Safely remove the message event listener `this.handshakeMessageListener`.
+  - Set `this.handshakeMessageListener = undefined` to make it idempotent.
+  - Close the WebSocket `this.ws.close()`.
+  
+- [x] **Clean up socket on Sender connection failures**
+  - Call `this.disconnect()` inside `handleHandshakeAuthFail`.
+  - Call `this.disconnect()` inside `handleHandshakeSyncError`.
+  
+- [x] **Close socket on Sender runtime message validation failures**
+  - In `handleRuntimeMessage` and `handleRuntimeSyncFrameResponse`, catch validation errors, trigger `this.disconnect()`, and rethrow.
+
+- [x] **Close socket on Receiver message handling failures**
+  - In the catch block of `handleIncomingMessage`, call `this.socketWrapper?.close()` (or equivalent wrapper cleanup) to force-close connections after sending error frames.
+  - Wrap the `send()` call in a nested try/catch or use `setTimeout` to ensure best-effort message transmission before terminating the socket wrapper.

package/src/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-peer-websocket-receiver-v1.mts

@@ -34,6 +34,7 @@ export interface IWebSocketWrapper {
     send(data: string): void;
     onMessage(callback: (data: string) => void): void;
     onClose(callback: () => void): void;
+    close(): void;
 }
 
 /**
@@ -67,6 +68,7 @@ export class SyncPeerWebSocketReceiver_V1
     protected pendingContext?: SyncSagaContextIbGib_V1;
     protected pendingPayloadAddrs?: Set<string>;
     protected pendingResponsePayloadsToSend: IbGib_V1[] = [];
+    protected receivedPayloads: IbGib_V1[] = [];
 
     constructor(
         initialData: SyncPeerWebSocketReceiverData_V1,
@@ -188,16 +190,20 @@ export class SyncPeerWebSocketReceiver_V1
                     throw new Error(`controlIbGibs invalid intrinsically. validationErrors: ${validationErrors.join('|')} (E: 5ee1787d4cc53d3d2c55f3d4f2865226)`);
                 }
 
-                if (this.pendingContext && this.pendingPayloadAddrs) {
+                const pendingPayloadAddrs = this.pendingPayloadAddrs;
+                if (this.pendingContext && pendingPayloadAddrs) {
                     const addr = getIbGibAddr({ ibGib });
-                    if (this.pendingPayloadAddrs.has(addr)) {
+                    if (pendingPayloadAddrs.has(addr)) {
                         const tempSpace = await this.ensureLocalTempSpace();
                         await putInSpace({ space: tempSpace, ibGibs: [ibGib] });
-                        this.pendingPayloadAddrs.delete(addr);
+                        this.receivedPayloads.push(ibGib);
+                        pendingPayloadAddrs.delete(addr);
 
                         // If all expected payloads for the pending context are received
-                        if (this.pendingPayloadAddrs.size === 0) {
+                        if (pendingPayloadAddrs.size === 0 && this.pendingPayloadAddrs !== undefined) {
                             const context = this.pendingContext;
+                            context.payloadIbGibsDomain = this.receivedPayloads;
+                            this.receivedPayloads = [];
                             this.pendingContext = undefined;
                             this.pendingPayloadAddrs = undefined;
 
@@ -213,7 +219,8 @@ export class SyncPeerWebSocketReceiver_V1
                 // First, validate and authenticate the context
                 const allControlIbGibs: IbGib_V1[] = [
                     toDto({ ibGib: context }),
-                    context.sagaFrame
+                    context.sagaFrame,
+                    context.sagaFrameMsg
                 ];
                 if (context.signedSessionIdentity) {
                     allControlIbGibs.push(context.signedSessionIdentity);
@@ -241,6 +248,7 @@ export class SyncPeerWebSocketReceiver_V1
                     // Set up wait state and request payloads
                     this.pendingContext = context;
                     this.pendingPayloadAddrs = new Set(expectedPayloadAddrs);
+                    this.receivedPayloads = [];
                     this.socketWrapper.send(JSON.stringify({
                         type: SyncWebSocketMsgType.sync_frame_authenticated,
                         contextAddr: getIbGibAddr({ ibGib: context })
@@ -259,13 +267,21 @@ export class SyncPeerWebSocketReceiver_V1
                         ibGib
                     }));
                 }
+            } else {
+                throw new Error(`(UNEXPECTED) msg.type is ${msg.type}? not expected at this time (E: bad7c4fa1958b1976904cb884e624826)`);
             }
         } catch (error) {
             console.error(`${lc} message frame handling failed: ${extractErrorMsg(error)}`);
-            this.socketWrapper?.send(JSON.stringify({
-                type: this.isAuthenticated ? SyncWebSocketMsgType.sync_error : SyncWebSocketMsgType.auth_fail,
-                message: extractErrorMsg(error)
-            }));
+            try {
+                this.socketWrapper?.send(JSON.stringify({
+                    type: this.isAuthenticated ? SyncWebSocketMsgType.sync_error : SyncWebSocketMsgType.auth_fail,
+                    message: extractErrorMsg(error)
+                }));
+            } catch (nestedError) {
+                console.error(`${lc}[nested catch] failed to send error frame: ${extractErrorMsg(nestedError)}`);
+            } finally {
+                this.socketWrapper?.close();
+            }
         }
     }
 
@@ -327,6 +343,7 @@ export class SyncPeerWebSocketReceiver_V1
 
             // Persist the newly validated evolved session keystone tip
             await metaspace.put({ ibGibs: [proofFrame], space });
+            await metaspace.registerNewIbGib({ ibGib: proofFrame, space });
 
             if (logalot) { console.log(`${lc} connect validation successful! Connection upgraded to active sync session.`); }
             this.isAuthenticated = true;

package/src/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mts

@@ -41,7 +41,7 @@ export const SESSION_KEYSTONE_POLICY = {
         SIZE: 10,
         SELECT_SEQUENTIALLY: 2,
         SELECT_RANDOMLY: 2,
-        TARGET_BINDING_CHARS: 0,
+        TARGET_BINDING_COUNT: 0,
         SERVER_DEMAND_COUNT: 3,
     }
 } as const;
@@ -298,8 +298,10 @@ export async function validateAndRegisterEvolveKeystone({
         }
 
         // 2. Verify URL :domainAddr matches the keystone's tjp
-        const { tjpGib } = getGibInfo({ ibGibAddr: addr });
-        const expectedTjpGib = getGibInfo({ ibGibAddr: domainAddr }).punctiliarHash;
+        const infoAddr = getGibInfo({ ibGibAddr: addr });
+        const tjpGib = infoAddr.tjpGib ?? infoAddr.punctiliarHash;
+        const infoDomain = getGibInfo({ ibGibAddr: domainAddr });
+        const expectedTjpGib = infoDomain.tjpGib ?? infoDomain.punctiliarHash;
         if (tjpGib !== expectedTjpGib) {
             throw new Error(`Keystone tjpGib (${tjpGib}) does not match URL domainAddr tjpGib (${expectedTjpGib})`);
         }