@lazily-hub/lazily-js 0.16.0 → 0.19.0

package/README.md

@@ -33,12 +33,12 @@ the FFI projection transport is used.
 The full `lazily` capability set across every binding. Legend: ✅ shipped ·
 `~` partial · `—` absent or not applicable. The canonical matrix with per-cell
 notes and platform carve-outs lives in
-[`lazily-spec` § Cross-Language Coverage](../lazily-spec/docs/coverage.md).
+[`lazily-spec` § Cross-Language Coverage](https://github.com/lazily-hub/lazily-spec/blob/main/docs/coverage.md).
 
 <!-- coverage-table:start -->
 | Feature | Rust | Python | Kotlin | JS | Dart | Zig | Go | C++ |
 | --------- | :----: | :------: | :------: | :--: | :----: | :---: | :--: | :---: |
-| Reactive graph — `Cell` / `Slot` / `Signal` / `Effect` / memo / batch | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Reactive graph — core `Cell` / `Slot` / `Effect` (+ derived `Signal` = `Slot.eager`) / memo / batch | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Keyed-map materialization (`SlotMap`) — mint-on-access derived slots: transparency + deferral (`#lzmatmode`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Thread-safe keyed map (`ThreadSafeSlotMap`) — `Send + Sync` + materialization confluence (`#lzmatmode`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Async keyed map (`AsyncSlotMap`) — eventual transparency (`#lzmatmode`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
@@ -51,10 +51,13 @@ notes and platform carve-outs lives in
 | Memoized semantic tree (`SemTree`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Stable-id alignment (manufactured identity) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Reactive queue (`QueueCell` SPSC/MPSC + `QueueStorage` adapter) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Broadcast topic (`TopicCell`) — independent cursors + durable replay + safe GC (`#lztopiccell`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Competing-consumer work queue (`WorkQueueCell`) — exclusive leases + ack/nack + redelivery + DLQ (`#lzworkqueue`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Merge algebra + `MergeCell` — associative `MergePolicy` (`KeepLatest`/`Sum`/`Max`/`SetUnion`/`RawFifo`), `Cell ≡ MergeCell<KeepLatest>`, `Reactive`/`Source` split (`#relaycell`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-| RelayCell — conflating relay + `BackpressurePolicy` + `SpillStore` + `Transport` + Inbox/Outbox + Rate/Window/Expiry/Priority/keyed policies (`#relaycell`) | ✅ | — | — | ✅ | — | — | — | — |
+| RelayCell — conflating relay + `BackpressurePolicy` + `SpillStore` + `Transport` + Inbox/Outbox + Rate/Window/Expiry/Priority/keyed policies (`#relaycell`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Free-text character CRDT (`TextCrdt`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | `TextCrdt` delta sync (`version_vector` / `delta_since` / `apply_delta`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| `CrdtTree` lossless document contract (`#lzcrdttree`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Move-aware sequence CRDT (`SeqCrdt`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Lossless tree CRDT core (`LosslessTreeCrdt`, M1) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Lossless tree — dotted-frontier anti-entropy | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
@@ -65,6 +68,7 @@ notes and platform carve-outs lives in
 | Cross-process zero-copy transport (`BlobBackend` / shm / arrow) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Distributed CRDT plane (`CrdtPlaneRuntime` / anti-entropy) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Reliable sync — resync coordinator + at-least-once durable outbox + OR-set/LWW liveness (`#lzsync`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Storage-independent durable outbox (`OutboxStore` + shared outbox protocol; SQLite/Room/IndexedDB/file adapters) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Reliable-sync transport seam + full-duplex `SyncDriver` loop (`IpcSink`/`IpcSource`, `#sync-driver`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Distributed plane — WebRTC transport + signaling | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | State projection / mirror | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
@@ -74,6 +78,14 @@ notes and platform carve-outs lives in
 | Permission boundary (`PeerPermissions` / `RemoteOp`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Capability negotiation (`SessionHandshake`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | Instrumentation / benchmarks | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Temporal sources — `TimerCell` / `IntervalCell` / `CronCell` / `DeadlineCell` over a logical clock (`#lztime`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Rate-shaping operators — `DebounceCell` / `ThrottleCell` / `SampleCell` / `ProbabilisticSampleCell` (`#lzrateshape`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Membership + failure detection — `MembershipCell` (SWIM + Phi-accrual) / `PeerSet` / `PeerChangeEvent` (`#lzmemb`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Distributed coordination — `LeaseCell` / `LeaderCell` / `LockCell` / `SemaphoreCell` / `BarrierCell`+`QuorumCell` (`#lzcoord`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Presence + ephemeral plane — `PresenceCell` / `AwarenessCell` / `EphemeralCell` + `Ephemeral`/`Durable` markers (`#lzpresence`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Stream windowing — `TumblingWindow` / `SlidingWindow` / `SessionWindow` over the merge algebra (`#lzwindow`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Fault tolerance — `CircuitBreakerCell` / `RetryPolicyCell` / `BulkheadCell` / `TimeoutCell` (`#lzresilience`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Embedded-service plane — `HealthCell` / `ReadinessCell` / `DiscoveryCell` / `ServiceRegistry` (`#lzservice`) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 <!-- coverage-table:end -->
 
 Two JS ✅ marks are backed by runtime-specific mechanisms while keeping the core isomorphic:
@@ -115,10 +127,12 @@ JavaScript. The family is:
 
 - **Slot** - lazy, memoized derived value;
 - **Cell** - mutable source value;
-- **Signal** - eager derived value that re-materializes as soon as a dependency
-  invalidates;
 - **Effect** - side-effecting observer with cleanup.
 
+The core primitives are **Cell** / **Slot** / **Effect**. **`Signal` is a
+derived construct, not a core primitive** — `Signal ≡ Slot.eager`, a memo Slot
+plus a puller Effect that re-materializes as soon as a dependency invalidates.
+
 Dependencies are discovered dynamically while a slot/effect/signal computes.
 Invalidation is pull-based and glitch-free; `memo`/`Signal` use equality guards
 to suppress downstream work when a recompute produces the same value. `batch`
@@ -337,6 +351,26 @@ tree.value(); // 1
 tree.setValue("leaf", 99); // only the ancestor chain recomputes
 ```
 
+## Competing-consumer work queue
+
+The `queue` package exports `WorkQueueCell`, a pull-based local authority with
+exclusive FIFO claims, stable item IDs, fresh delivery IDs per attempt,
+worker-owned ack/nack, strict visibility-timeout redelivery, bounded attempts,
+and DLQ routing. Every mutation reports exact `pending_len` / `is_empty` /
+`in_flight_len` / `dead_letter_len` invalidation metadata.
+
+```js
+import { WorkQueueCell } from "@lazily-hub/lazily-js/queue";
+
+const work = new WorkQueueCell({ visibility_timeout: 30, max_deliveries: 3 });
+work.push("render-report");
+const delivery = work.claim("worker-a", 100).returns;
+work.ack("worker-a", delivery.delivery_id);
+```
+
+The instance serializes local claims; distributed/HA assignment still requires
+a leader or consensus-committed assignment log.
+
 ## CRDTs
 
 `SeqCrdt` is the move-aware sequence CRDT: each element has independent LWW
@@ -344,7 +378,10 @@ registers for value, position, and deletion, so a move is one position
 assignment rather than delete plus reinsert. `TextCrdt` is a Fugue/RGA
 character CRDT: concurrent same-point inserts are preserved, deletes are sticky
 tombstones, and merge is commutative / associative / idempotent. Both expose
-tombstone GC behind caller-supplied causal-stability watermarks.
+tombstone GC behind caller-supplied causal-stability watermarks. `TextCrdt`
+also satisfies the `CrdtTree` document contract: its snapshot is the delta from
+an empty frontier, so full hydration and incremental exchange preserve the same
+identity-bearing state.
 
 ```js
 import { SeqCrdt } from "@lazily-hub/lazily-js/seq-crdt";
@@ -360,6 +397,16 @@ peer.insert(2, "!");
 text.merge(peer); // converges
 ```
 
+## Durable outbox stores
+
+The root `Outbox` class owns one append/ack/prune/replay protocol over the
+five-operation `OutboxStore` boundary. `InMemoryStore` exercises that path in
+tests. Browsers can open an `IndexedDbStore` from
+`@lazily-hub/lazily-js/indexeddb-outbox`; await `append` before transport send
+and `ackThrough` before treating an acknowledgement as committed. Reopening the
+same database and channel restores the durable cursor and only unacknowledged
+frames.
+
 ## IPC wire types and capability negotiation
 
 Every IPC value round-trips the canonical externally-tagged

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazily-hub/lazily-js",
-  "version": "0.16.0",
+  "version": "0.19.0",
   "description": "Native JavaScript port of the lazily reactive core: a full reactive graph (Cell/Slot/Signal/Effect), sync/async/thread-safe keyed reactive maps (ReactiveMap/CellMap/SlotMap), the lazily-spec IPC wire types + C-ABI FFI boundary (isomorphic channel + Node native binding), keyed cell collections + LIS reconciliation, the memoized semantic tree, the move-aware sequence CRDT, the Fugue/RGA text CRDT, manufactured text identity, full-Harel state charts, an FFI state-projection consumer, and an in-library instrumentation/benchmark API.",
   "license": "MIT",
   "repository": {
@@ -77,6 +77,38 @@
       "types": "./src/relay.d.ts",
       "default": "./src/relay.js"
     },
+    "./temporal": {
+      "types": "./src/temporal.d.ts",
+      "default": "./src/temporal.js"
+    },
+    "./rateshape": {
+      "types": "./src/rateshape.d.ts",
+      "default": "./src/rateshape.js"
+    },
+    "./membership": {
+      "types": "./src/membership.d.ts",
+      "default": "./src/membership.js"
+    },
+    "./coordination": {
+      "types": "./src/coordination.d.ts",
+      "default": "./src/coordination.js"
+    },
+    "./presence": {
+      "types": "./src/presence.d.ts",
+      "default": "./src/presence.js"
+    },
+    "./windowing": {
+      "types": "./src/windowing.d.ts",
+      "default": "./src/windowing.js"
+    },
+    "./resilience": {
+      "types": "./src/resilience.d.ts",
+      "default": "./src/resilience.js"
+    },
+    "./service": {
+      "types": "./src/service.d.ts",
+      "default": "./src/service.js"
+    },
     "./sem-tree": {
       "types": "./src/sem-tree.d.ts",
       "default": "./src/sem-tree.js"
@@ -97,6 +129,11 @@
       "types": "./src/lossless-tree-crdt.d.ts",
       "default": "./src/lossless-tree-crdt.js"
     },
+    "./indexeddb-outbox": {
+      "types": "./src/indexeddb-outbox.d.ts",
+      "browser": "./src/indexeddb-outbox.js",
+      "default": "./src/indexeddb-outbox.js"
+    },
     "./state-projection": {
       "types": "./src/state-projection.d.ts",
       "default": "./src/state-projection.js"
@@ -111,7 +148,7 @@
     }
   },
   "scripts": {
-    "build": "node --check src/index.js && node --check src/transport.js && node --check src/shm-backend.js && node --check src/reactive.js && node --check src/reactive-async.js && node --check src/reactive-family.js && node --check src/async-reactive-family.js && node --check src/thread-safe.js && node --check src/thread-safe-reactive-family.js && node --check src/ffi.js && node --check src/ffi-node.js && node --check src/instrumentation.js && node --check src/state-machine.js && node --check src/statechart.js && node --check src/collections.js && node --check src/queue.js && node --check src/merge.js && node --check src/relay.js && node --check src/sem-tree.js && node --check src/stable-id.js && node --check src/seq-crdt.js && node --check src/text-crdt.js && node --check src/utf8-offsets.js && node --check src/lossless-tree-crdt.js && node --check src/state-projection.js && node --check src/graph-view.js && node --check src/signaling.js && node --check src/distributed.js",
+    "build": "node --check src/index.js && node --check src/transport.js && node --check src/shm-backend.js && node --check src/reactive.js && node --check src/reactive-async.js && node --check src/reactive-family.js && node --check src/async-reactive-family.js && node --check src/thread-safe.js && node --check src/thread-safe-reactive-family.js && node --check src/ffi.js && node --check src/ffi-node.js && node --check src/instrumentation.js && node --check src/state-machine.js && node --check src/statechart.js && node --check src/collections.js && node --check src/queue.js && node --check src/merge.js && node --check src/relay.js && node --check src/rateshape.js && node --check src/membership.js && node --check src/coordination.js && node --check src/presence.js && node --check src/windowing.js && node --check src/resilience.js && node --check src/service.js && node --check src/temporal.js && node --check src/sem-tree.js && node --check src/stable-id.js && node --check src/seq-crdt.js && node --check src/text-crdt.js && node --check src/indexeddb-outbox.js && node --check src/utf8-offsets.js && node --check src/lossless-tree-crdt.js && node --check src/state-projection.js && node --check src/graph-view.js && node --check src/signaling.js && node --check src/distributed.js",
     "test:formal": "node scripts/formal-check.mjs",
     "bench": "node bench/context.bench.mjs",
     "bench:scale": "node --max-old-space-size=8192 bench/scale.bench.mjs",
@@ -125,6 +162,7 @@
   "devDependencies": {
     "@types/node": "^22.0.0",
     "ajv": "^8.20.0",
+    "fake-indexeddb": "^6.2.5",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0"
   }

package/src/coordination.d.ts

@@ -0,0 +1,81 @@
+// Distributed coordination (#lzcoord) — the JS port.
+// See coordination.js and `lazily-spec/docs/coordination.md`.
+
+import type { Context, CellHandle } from "./reactive.js";
+
+export class LeaseCore<P = unknown> {
+  fence: number;
+  isHeld(now: number): boolean;
+  holder(now: number): P | null;
+  acquire(peer: P, now: number, ttl: number): number | null;
+  renew(peer: P, now: number, ttl: number): boolean;
+  release(peer: P): void;
+  tick(now: number): boolean;
+}
+
+export class LeaseCell<P = unknown> {
+  constructor(ctx: Context);
+  readonly holderCell: CellHandle<P | null>;
+  acquire(peer: P, now: number, ttl: number): number | null;
+  renew(peer: P, now: number, ttl: number): boolean;
+  release(peer: P, now: number): void;
+  tick(now: number): boolean;
+  holder(now: number): P | null;
+  isHeld(now: number): boolean;
+  fence(): number;
+}
+
+export type LeaderRoleLabel = "Leader" | "Follower" | "Candidate";
+export const LeaderRole: Readonly<{ Leader: "Leader"; Follower: "Follower"; Candidate: "Candidate" }>;
+
+export class LeaderCell<P = unknown> {
+  constructor(ctx: Context, me: P);
+  readonly currentLeaderCell: CellHandle<P | null>;
+  campaign(now: number, ttl: number): LeaderRoleLabel;
+  contend(peer: P, now: number, ttl: number): LeaderRoleLabel;
+  tick(now: number): LeaderRoleLabel;
+  currentLeader(now: number): P | null;
+  role(now: number): LeaderRoleLabel;
+}
+
+export class LockCell<P = unknown> {
+  constructor(ctx: Context);
+  readonly isLockedCell: CellHandle<boolean>;
+  acquire(peer: P, now: number, ttl: number): number | null;
+  release(peer: P, now: number): void;
+  tick(now: number): boolean;
+  validate(fence: number): boolean;
+  isLocked(now: number): boolean;
+  fence(): number;
+}
+
+export class SemaphoreCore {
+  constructor(capacity: number);
+  available(): number;
+  acquire(): boolean;
+  release(): void;
+}
+
+export class SemaphoreCell {
+  constructor(ctx: Context, capacity: number);
+  readonly permitsAvailableCell: CellHandle<number>;
+  acquire(): boolean;
+  release(): void;
+  permitsAvailable(): number;
+}
+
+export class BarrierCore<P = unknown> {
+  constructor(required: number);
+  arrive(peer: P): boolean;
+  count(): number;
+  isOpen(): boolean;
+}
+
+export class BarrierCell<P = unknown> {
+  constructor(ctx: Context, required: number);
+  static quorum<P = unknown>(ctx: Context, total: number): BarrierCell<P>;
+  readonly isOpenCell: CellHandle<boolean>;
+  arrive(peer: P): boolean;
+  count(): number;
+  isOpen(): boolean;
+}

package/src/coordination.js

@@ -0,0 +1,283 @@
+// Distributed coordination (#lzcoord) — the JS port.
+//
+// See `lazily-spec/docs/coordination.md` and the formal model
+// `lazily-formal/LazilyFormal/Coordination.lean`. Lease / leader / lock /
+// semaphore / barrier + quorum primitives, each a pure compute core split from a
+// reactive cell projecting the salient reader. Time is the logical clock. A
+// holder of `null` means "no holder".
+
+// ---------------------------------------------------------------------------
+// Lease + fencing token
+// ---------------------------------------------------------------------------
+
+/** Single-writer lease authority with a monotone fencing token. */
+export class LeaseCore {
+  constructor() {
+    this.holderPeer = null;
+    this.expiry = 0;
+    this.fence = 0;
+  }
+  #isExpired(now) {
+    return this.holderPeer !== null && now >= this.expiry;
+  }
+  isHeld(now) {
+    return this.holderPeer !== null && !this.#isExpired(now);
+  }
+  holder(now) {
+    return this.isHeld(now) ? this.holderPeer : null;
+  }
+  acquire(peer, now, ttl) {
+    if (this.holderPeer === null || this.#isExpired(now)) {
+      this.fence += 1;
+      this.holderPeer = peer;
+      this.expiry = now + ttl;
+      return this.fence;
+    }
+    if (this.holderPeer === peer) {
+      this.expiry = now + ttl; // renew keeps fence
+      return this.fence;
+    }
+    return null;
+  }
+  renew(peer, now, ttl) {
+    if (this.isHeld(now) && this.holderPeer === peer) {
+      this.expiry = now + ttl;
+      return true;
+    }
+    return false;
+  }
+  release(peer) {
+    if (this.holderPeer === peer) this.holderPeer = null;
+  }
+  tick(now) {
+    if (this.#isExpired(now)) {
+      this.holderPeer = null;
+      return true;
+    }
+    return false;
+  }
+}
+
+/** Reactive lease: projects the holder onto a cell. */
+export class LeaseCell {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.core = new LeaseCore();
+    this.holderCell = ctx.cell(null);
+  }
+  #refresh(now) {
+    this.ctx.setCell(this.holderCell, this.core.holder(now));
+  }
+  acquire(peer, now, ttl) {
+    const r = this.core.acquire(peer, now, ttl);
+    this.#refresh(now);
+    return r;
+  }
+  renew(peer, now, ttl) {
+    const r = this.core.renew(peer, now, ttl);
+    this.#refresh(now);
+    return r;
+  }
+  release(peer, now) {
+    this.core.release(peer);
+    this.#refresh(now);
+  }
+  tick(now) {
+    const r = this.core.tick(now);
+    this.#refresh(now);
+    return r;
+  }
+  holder(now) {
+    return this.core.holder(now);
+  }
+  isHeld(now) {
+    return this.core.isHeld(now);
+  }
+  fence() {
+    return this.core.fence;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Leader / follower / candidate
+// ---------------------------------------------------------------------------
+
+export const LeaderRole = Object.freeze({
+  Leader: "Leader",
+  Follower: "Follower",
+  Candidate: "Candidate",
+});
+
+/** Reactive leadership over a lease from node `me`'s perspective. */
+export class LeaderCell {
+  constructor(ctx, me) {
+    this.ctx = ctx;
+    this.me = me;
+    this.core = new LeaseCore();
+    this.currentLeaderCell = ctx.cell(null);
+  }
+  #refresh(now) {
+    this.ctx.setCell(this.currentLeaderCell, this.core.holder(now));
+  }
+  campaign(now, ttl) {
+    this.core.acquire(this.me, now, ttl);
+    this.#refresh(now);
+    return this.role(now);
+  }
+  contend(peer, now, ttl) {
+    this.core.acquire(peer, now, ttl);
+    this.#refresh(now);
+    return this.role(now);
+  }
+  tick(now) {
+    this.core.tick(now);
+    this.#refresh(now);
+    return this.role(now);
+  }
+  currentLeader(now) {
+    return this.core.holder(now);
+  }
+  role(now) {
+    const h = this.core.holder(now);
+    if (h === null) return LeaderRole.Candidate;
+    return h === this.me ? LeaderRole.Leader : LeaderRole.Follower;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Distributed lock + fencing
+// ---------------------------------------------------------------------------
+
+/** Reactive distributed mutex over a lease + fencing token. */
+export class LockCell {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.core = new LeaseCore();
+    this.isLockedCell = ctx.cell(false);
+  }
+  #refresh(now) {
+    this.ctx.setCell(this.isLockedCell, this.core.isHeld(now));
+  }
+  acquire(peer, now, ttl) {
+    const r = this.core.acquire(peer, now, ttl);
+    this.#refresh(now);
+    return r;
+  }
+  release(peer, now) {
+    this.core.release(peer);
+    this.#refresh(now);
+  }
+  tick(now) {
+    const r = this.core.tick(now);
+    this.#refresh(now);
+    return r;
+  }
+  /** Whether `fence` is the current (non-stale) fencing token. */
+  validate(fence) {
+    return this.core.fence === fence;
+  }
+  isLocked(now) {
+    return this.core.isHeld(now);
+  }
+  fence() {
+    return this.core.fence;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Semaphore
+// ---------------------------------------------------------------------------
+
+/** Bounded permit pool compute core. */
+export class SemaphoreCore {
+  constructor(capacity) {
+    this.capacity = capacity;
+    this.acquired = 0;
+  }
+  available() {
+    return this.capacity - this.acquired;
+  }
+  acquire() {
+    if (this.acquired < this.capacity) {
+      this.acquired += 1;
+      return true;
+    }
+    return false;
+  }
+  release() {
+    if (this.acquired > 0) this.acquired -= 1;
+  }
+}
+
+/** Reactive semaphore: projects permitsAvailable onto a cell. */
+export class SemaphoreCell {
+  constructor(ctx, capacity) {
+    this.ctx = ctx;
+    this.core = new SemaphoreCore(capacity);
+    this.permitsAvailableCell = ctx.cell(capacity);
+  }
+  #refresh() {
+    this.ctx.setCell(this.permitsAvailableCell, this.core.available());
+  }
+  acquire() {
+    const r = this.core.acquire();
+    this.#refresh();
+    return r;
+  }
+  release() {
+    this.core.release();
+    this.#refresh();
+  }
+  permitsAvailable() {
+    return this.ctx.getCell(this.permitsAvailableCell);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Barrier / quorum
+// ---------------------------------------------------------------------------
+
+/** Wait-for-N gate over distinct arriving peers. */
+export class BarrierCore {
+  constructor(required) {
+    this.required = required;
+    this.arrived = new Set();
+  }
+  arrive(peer) {
+    this.arrived.add(peer);
+    return this.isOpen();
+  }
+  count() {
+    return this.arrived.size;
+  }
+  isOpen() {
+    return this.count() >= this.required;
+  }
+}
+
+/** Reactive wait-for-N gate. A quorum is a barrier with required = total/2 + 1. */
+export class BarrierCell {
+  constructor(ctx, required) {
+    this.ctx = ctx;
+    this.core = new BarrierCore(required);
+    this.isOpenCell = ctx.cell(this.core.isOpen());
+  }
+  /** A quorum gate: opens at strict majority of `total`. */
+  static quorum(ctx, total) {
+    return new BarrierCell(ctx, Math.floor(total / 2) + 1);
+  }
+  #refresh() {
+    this.ctx.setCell(this.isOpenCell, this.core.isOpen());
+  }
+  arrive(peer) {
+    const r = this.core.arrive(peer);
+    this.#refresh();
+    return r;
+  }
+  count() {
+    return this.core.count();
+  }
+  isOpen() {
+    return this.ctx.getCell(this.isOpenCell);
+  }
+}

package/src/index.d.ts

@@ -449,20 +449,40 @@ export class ResyncCoordinator {
 }
 
 export interface DurableOutbox {
-  append(epoch: number, msg: IpcMessage): void;
-  ackThrough(epoch: number): void;
+  append(epoch: number, msg: IpcMessage): void | Promise<void>;
+  ackThrough(epoch: number): void | Promise<void>;
   replayFrom(cursor: number): Array<[number, IpcMessage]>;
   retainedEpochs(): number[];
 }
 
-export class InMemoryOutbox implements DurableOutbox {
+export interface OutboxStore {
+  put(epoch: number, frame: Uint8Array): void | Promise<void>;
+  deleteThrough(epoch: number): void | Promise<void>;
+  scanAfter(cursor: number): Array<[number, Uint8Array]>;
+  loadCursor(): number;
+  saveCursor(epoch: number): void | Promise<void>;
+}
+
+export class Outbox<S extends OutboxStore = OutboxStore> implements DurableOutbox {
+  constructor(store: S);
+  readonly store: S;
   ackedThrough: number;
-  append(epoch: number, msg: IpcMessage): void;
-  ackThrough(epoch: number): void;
+  append(epoch: number, msg: IpcMessage): void | Promise<void>;
+  ackThrough(epoch: number): void | Promise<void>;
   replayFrom(cursor: number): Array<[number, IpcMessage]>;
   retainedEpochs(): number[];
 }
 
+export class InMemoryStore implements OutboxStore {
+  put(epoch: number, frame: Uint8Array): void;
+  deleteThrough(epoch: number): void;
+  scanAfter(cursor: number): Array<[number, Uint8Array]>;
+  loadCursor(): number;
+  saveCursor(epoch: number): void;
+}
+
+export class InMemoryOutbox extends Outbox<InMemoryStore> {}
+
 export class OrSet {
   add(tag: string): void;
   removeObserved(tags: Iterable<string>): void;