@optimystic/db-core 0.14.0 → 0.16.2

package/dist/src/cohort-topic/antidos/bootstrap-evidence.d.ts

@@ -1,9 +1,14 @@
 /**
  * Cohort-topic substrate — bootstrap evidence policy (anti-DoS).
  *
- * Transcribed from `docs/cohort-topic.md` §Anti-DoS bullet 4. A cold root that accepts a
- * `bootstrap: true` registration must demand evidence, so a cold topic cannot be instantiated for
- * free by an attacker. The accepted evidence is **tier-dependent**:
+ * Transcribed from `docs/cohort-topic.md` §Anti-DoS bullet 4. A cold cohort that accepts a cold-start
+ * registration must demand evidence, so a cold topic cannot be instantiated for free by an attacker.
+ * **A follow-on cold-start (`followOn: true`) is gated identically to a root bootstrap
+ * (`bootstrap: true`)**: the cold tier-`(d+1)` child a `Promoted` redirect points at is participant-
+ * asserted (the child cannot infer the redirect — the routing key decorrelates tiers and it holds no
+ * breadcrumb of where the participant came from), so its safety cannot rest on provenance; it rests on
+ * this gate paying the same anti-abuse cost the root already pays. The accepted evidence is
+ * **tier-dependent**:
  *
  * - **T0 / T1** — generally no proof-of-work, because these tiers correspond to committed work; a
  *   *signed reference to a committed parent topic that does exist* is sufficient.
@@ -18,7 +23,7 @@
  * `bootstrapEvidence` field — a versioned `BootstrapEvidenceEnvelopeV1`
  * (`./bootstrap-evidence-envelope.js`), parsed crypto-free here and checked by the injected verifiers;
  * NOT the opaque `appPayload` slot (which the cohort copies verbatim into the registration's appState).
- * A registration that is not a bootstrap needs no evidence and is admitted.
+ * A registration that is neither a bootstrap nor a follow-on cold-start needs no evidence and is admitted.
  */
 import type { RegisterV1 } from "../wire/types.js";
 /** Tiers at/below this need no proof-of-work — a signed parent reference suffices (T0/T1). */
@@ -39,9 +44,10 @@ export interface BootstrapEvidenceConfig {
 /** Tier-dependent bootstrap-evidence gate for cold-root registrations. */
 export interface BootstrapEvidence {
     /**
-     * Whether `reg` carries acceptable bootstrap evidence for `tier`. A non-bootstrap registration is
-     * always acceptable (nothing to prove). For a bootstrap: T0/T1 require a signed parent reference;
-     * T2/T3 accept proof-of-work OR a reputation signature OR a signed parent reference.
+     * Whether `reg` carries acceptable cold-start evidence for `tier`. A registration that is neither a
+     * `bootstrap` nor a `followOn` is always acceptable (nothing to prove). For a cold-start (either flag):
+     * T0/T1 require a signed parent reference; T2/T3 accept proof-of-work OR a reputation signature OR a
+     * signed parent reference.
      */
     verify(reg: RegisterV1, tier: number): boolean;
 }

package/dist/src/cohort-topic/antidos/bootstrap-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap-evidence.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/bootstrap-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,MAAM,WAAW,qBAAqB;IACrC,gGAAgG;IAChG,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IACzC,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAChD,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IACrD,MAAM,CAAC,EAAE,uBAAuB,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACvC,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/C;AAoCD,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,qBAA0B,GAAG,iBAAiB,CAE3F"}
+{"version":3,"file":"bootstrap-evidence.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/bootstrap-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,MAAM,WAAW,qBAAqB;IACrC,gGAAgG;IAChG,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IACzC,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAChD,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IACrD,MAAM,CAAC,EAAE,uBAAuB,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACvC,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/C;AA0CD,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,qBAA0B,GAAG,iBAAiB,CAE3F"}

package/dist/src/cohort-topic/antidos/bootstrap-evidence.js

@@ -1,9 +1,14 @@
 /**
  * Cohort-topic substrate — bootstrap evidence policy (anti-DoS).
  *
- * Transcribed from `docs/cohort-topic.md` §Anti-DoS bullet 4. A cold root that accepts a
- * `bootstrap: true` registration must demand evidence, so a cold topic cannot be instantiated for
- * free by an attacker. The accepted evidence is **tier-dependent**:
+ * Transcribed from `docs/cohort-topic.md` §Anti-DoS bullet 4. A cold cohort that accepts a cold-start
+ * registration must demand evidence, so a cold topic cannot be instantiated for free by an attacker.
+ * **A follow-on cold-start (`followOn: true`) is gated identically to a root bootstrap
+ * (`bootstrap: true`)**: the cold tier-`(d+1)` child a `Promoted` redirect points at is participant-
+ * asserted (the child cannot infer the redirect — the routing key decorrelates tiers and it holds no
+ * breadcrumb of where the participant came from), so its safety cannot rest on provenance; it rests on
+ * this gate paying the same anti-abuse cost the root already pays. The accepted evidence is
+ * **tier-dependent**:
  *
  * - **T0 / T1** — generally no proof-of-work, because these tiers correspond to committed work; a
  *   *signed reference to a committed parent topic that does exist* is sufficient.
@@ -18,7 +23,7 @@
  * `bootstrapEvidence` field — a versioned `BootstrapEvidenceEnvelopeV1`
  * (`./bootstrap-evidence-envelope.js`), parsed crypto-free here and checked by the injected verifiers;
  * NOT the opaque `appPayload` slot (which the cohort copies verbatim into the registration's appState).
- * A registration that is not a bootstrap needs no evidence and is admitted.
+ * A registration that is neither a bootstrap nor a follow-on cold-start needs no evidence and is admitted.
  */
 import { createLogger } from "../../logger.js";
 const log = createLogger("cohort-topic:antidos");
@@ -36,8 +41,14 @@ class TieredBootstrapEvidence {
         this.verifyParentReference = deps.verifyParentReference ?? (() => false);
     }
     verify(reg, tier) {
-        if (reg.bootstrap !== true) {
-            return true; // only a cold-root bootstrap must carry evidence
+        // A follow-on cold-start is gated identically to a root bootstrap — both must carry evidence.
+        // NOTE: follow-on cold-start is PoW-gated exactly like a root bootstrap; if a spoofed, PoW-paid
+        // follow-on instantiation ever shows up as real abuse, upgrade to a parent-vouched redirect —
+        // echo the parent cohort's threshold-signed PromotionNoticeV1 on the follow-on and verify it
+        // against the parent's MembershipCertV1 (needs a RegisterReplyV1 field + admission-path membership
+        // verify). See docs/cohort-topic.md §Anti-DoS "follow-on hardening".
+        if (reg.bootstrap !== true && reg.followOn !== true) {
+            return true; // only a cold-start (bootstrap or follow-on) must carry evidence
         }
         if (tier <= this.maxNoPowTier) {
             // T0/T1: a signed reference to a committed parent topic is sufficient (no PoW expected).

package/dist/src/cohort-topic/antidos/bootstrap-evidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap-evidence.js","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/bootstrap-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEjD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AA2BzC,MAAM,uBAAuB;IACX,YAAY,CAAS;IACrB,SAAS,CAA+B;IACxC,gBAAgB,CAA+B;IAC/C,qBAAqB,CAA+B;IAErE,YAAY,OAA8B,EAAE;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,IAAI,uBAAuB,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,GAAe,EAAE,IAAY;QACnC,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAC/D,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,yFAAyF;YACzF,MAAM,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACT,GAAG,CAAC,oEAAoE,EAAE,IAAI,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,EAAE,CAAC;QACX,CAAC;QACD,+EAA+E;QAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,CAAC;IACX,CAAC;CACD;AAED,uGAAuG;AACvG,MAAM,UAAU,uBAAuB,CAAC,OAA8B,EAAE;IACvE,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"bootstrap-evidence.js","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/bootstrap-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEjD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AA4BzC,MAAM,uBAAuB;IACX,YAAY,CAAS;IACrB,SAAS,CAA+B;IACxC,gBAAgB,CAA+B;IAC/C,qBAAqB,CAA+B;IAErE,YAAY,OAA8B,EAAE;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,IAAI,uBAAuB,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,GAAe,EAAE,IAAY;QACnC,8FAA8F;QAC9F,gGAAgG;QAChG,8FAA8F;QAC9F,6FAA6F;QAC7F,mGAAmG;QACnG,qEAAqE;QACrE,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,CAAC,iEAAiE;QAC/E,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,yFAAyF;YACzF,MAAM,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACT,GAAG,CAAC,oEAAoE,EAAE,IAAI,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,EAAE,CAAC;QACX,CAAC;QACD,+EAA+E;QAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,CAAC;IACX,CAAC;CACD;AAED,uGAAuG;AACvG,MAAM,UAAU,uBAAuB,CAAC,OAA8B,EAAE;IACvE,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC"}

package/dist/src/cohort-topic/antidos/replay-guard.d.ts

@@ -11,16 +11,31 @@
  * Because a stale registration is rejected outright, the guard only needs to remember correlation ids
  * for one `maxAgeMs` window: an id older than that would be rejected on timestamp alone, so its record
  * can be pruned. Pruning runs on access, bounding memory to the live window's worth of registrations.
+ *
+ * On top of the age-based prune, the map carries a **hard LRU `maxKeys` cap** (mirroring the sibling
+ * {@link import("./rate-limiter.js").RegisterRateLimiter}) so a flood of genuinely-fresh, admitted
+ * correlationIds cannot grow `seen` without bound before the age prune fires. When a new id would
+ * exceed the cap, the **oldest-inserted** entries are evicted until within cap. That victim is the
+ * least-bad one: replay entries are inserted once and never refreshed, so `Map` insertion order tracks
+ * timestamp order — the oldest entry is the one nearest to aging out of the window and being pruned as
+ * stale anyway. Evicting it forgives at most that entry's remaining replay-protection window: a bounded,
+ * documented tradeoff (unlike the rate limiter's fully penalty-free eviction), and one that only
+ * triggers under a flood of admitted ids — which, in the register pipeline, must also have passed the
+ * signature, rate, and bootstrap gates before ever reaching this guard.
  */
 /** Default acceptance window: a registration timestamped older than this (relative to `now`) is stale. */
 export declare const DEFAULT_REPLAY_MAX_AGE_MS = 60000;
 /** Default tolerated forward clock skew: a timestamp this far past `now` is rejected as implausible. */
 export declare const DEFAULT_REPLAY_MAX_FUTURE_SKEW_MS = 5000;
+/** Default hard cap on remembered correlationIds; the oldest-inserted are evicted beyond this. */
+export declare const DEFAULT_REPLAY_GUARD_MAX_KEYS = 100000;
 export interface CorrelationReplayGuardConfig {
     /** A timestamp older than `now − maxAgeMs` is stale. Default {@link DEFAULT_REPLAY_MAX_AGE_MS}. */
     maxAgeMs?: number;
     /** A timestamp newer than `now + maxFutureSkewMs` is rejected. Default {@link DEFAULT_REPLAY_MAX_FUTURE_SKEW_MS}. */
     maxFutureSkewMs?: number;
+    /** Hard LRU cap on remembered correlationIds; oldest-inserted (≈ oldest-timestamp) evicted beyond this. Default {@link DEFAULT_REPLAY_GUARD_MAX_KEYS}. */
+    maxKeys?: number;
 }
 /** Freshness + anti-replay gate over registration `correlationId`s and timestamps. */
 export interface CorrelationReplayGuard {
@@ -31,6 +46,8 @@ export interface CorrelationReplayGuard {
      * id on first sight of a fresh registration.
      */
     accept(correlationId: Uint8Array, peerId: Uint8Array, timestamp: number, now: number): boolean;
+    /** Remembered correlationId count (test/diagnostic introspection). */
+    readonly size: number;
 }
 /** Build a {@link CorrelationReplayGuard} over the configured staleness window and forward skew. */
 export declare function createCorrelationReplayGuard(config?: CorrelationReplayGuardConfig): CorrelationReplayGuard;

package/dist/src/cohort-topic/antidos/replay-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replay-guard.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/replay-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,0GAA0G;AAC1G,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,wGAAwG;AACxG,eAAO,MAAM,iCAAiC,OAAQ,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC5C,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qHAAqH;IACrH,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/F;AAgED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,GAAE,4BAAiC,GAAG,sBAAsB,CAE9G"}
+{"version":3,"file":"replay-guard.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/replay-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,0GAA0G;AAC1G,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,wGAAwG;AACxG,eAAO,MAAM,iCAAiC,OAAQ,CAAC;AACvD,kGAAkG;AAClG,eAAO,MAAM,6BAA6B,SAAU,CAAC;AAErD,MAAM,WAAW,4BAA4B;IAC5C,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qHAAqH;IACrH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0JAA0J;IAC1J,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sFAAsF;AACtF,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/F,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAoFD,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,GAAE,4BAAiC,GAAG,sBAAsB,CAE9G"}

package/dist/src/cohort-topic/antidos/replay-guard.js

@@ -11,6 +11,17 @@
  * Because a stale registration is rejected outright, the guard only needs to remember correlation ids
  * for one `maxAgeMs` window: an id older than that would be rejected on timestamp alone, so its record
  * can be pruned. Pruning runs on access, bounding memory to the live window's worth of registrations.
+ *
+ * On top of the age-based prune, the map carries a **hard LRU `maxKeys` cap** (mirroring the sibling
+ * {@link import("./rate-limiter.js").RegisterRateLimiter}) so a flood of genuinely-fresh, admitted
+ * correlationIds cannot grow `seen` without bound before the age prune fires. When a new id would
+ * exceed the cap, the **oldest-inserted** entries are evicted until within cap. That victim is the
+ * least-bad one: replay entries are inserted once and never refreshed, so `Map` insertion order tracks
+ * timestamp order — the oldest entry is the one nearest to aging out of the window and being pruned as
+ * stale anyway. Evicting it forgives at most that entry's remaining replay-protection window: a bounded,
+ * documented tradeoff (unlike the rate limiter's fully penalty-free eviction), and one that only
+ * triggers under a flood of admitted ids — which, in the register pipeline, must also have passed the
+ * signature, rate, and bootstrap gates before ever reaching this guard.
  */
 import { bytesKey } from "../registration/bytes.js";
 import { createLogger } from "../../logger.js";
@@ -19,10 +30,13 @@ const log = createLogger("cohort-topic:antidos");
 export const DEFAULT_REPLAY_MAX_AGE_MS = 60_000;
 /** Default tolerated forward clock skew: a timestamp this far past `now` is rejected as implausible. */
 export const DEFAULT_REPLAY_MAX_FUTURE_SKEW_MS = 5_000;
+/** Default hard cap on remembered correlationIds; the oldest-inserted are evicted beyond this. */
+export const DEFAULT_REPLAY_GUARD_MAX_KEYS = 100_000;
 class WindowedReplayGuard {
     seen = new Map();
     maxAgeMs;
     maxFutureSkewMs;
+    maxKeys;
     /** `now` of the last prune, so pruning amortizes rather than scanning on every call. */
     lastPruneAt = -Infinity;
     constructor(config = {}) {
@@ -34,6 +48,10 @@ class WindowedReplayGuard {
         if (!(this.maxFutureSkewMs >= 0)) {
             throw new RangeError(`maxFutureSkewMs must be >= 0, got ${this.maxFutureSkewMs}`);
         }
+        this.maxKeys = config.maxKeys ?? DEFAULT_REPLAY_GUARD_MAX_KEYS;
+        if (!Number.isInteger(this.maxKeys) || this.maxKeys <= 0) {
+            throw new RangeError(`maxKeys must be a positive integer, got ${this.maxKeys}`);
+        }
     }
     accept(correlationId, peerId, timestamp, now) {
         if (timestamp < now - this.maxAgeMs) {
@@ -53,6 +71,18 @@ class WindowedReplayGuard {
             log("replay-guard reject: replayed correlationId (first seen from peer=%s)", prior.peer);
             return false; // replay
         }
+        // New id: enforce the hard cap by evicting the oldest-inserted entries (oldest by `Map` insertion
+        // order) until this insertion stays within `maxKeys`. Since entries are inserted once and never
+        // refreshed, insertion order closely tracks timestamp order, so the victim is ≈ the oldest-timestamp
+        // — nearest to aging out as stale. (It is only ≈: ids from distinct peers can arrive out of
+        // timestamp order within the skew window, so a victim may retain slightly more window than a
+        // strictly-oldest pick. The forgiveness bound — at most one entry's remaining window — holds either way.)
+        while (this.seen.size >= this.maxKeys) {
+            const oldest = this.seen.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.seen.delete(oldest);
+        }
         this.seen.set(key, { timestamp, peer: bytesKey(peerId) });
         return true;
     }
@@ -70,6 +100,9 @@ class WindowedReplayGuard {
             }
         }
     }
+    get size() {
+        return this.seen.size;
+    }
 }
 /** Build a {@link CorrelationReplayGuard} over the configured staleness window and forward skew. */
 export function createCorrelationReplayGuard(config = {}) {

package/dist/src/cohort-topic/antidos/replay-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"replay-guard.js","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/replay-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEjD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAChD,wGAAwG;AACxG,MAAM,CAAC,MAAM,iCAAiC,GAAG,KAAK,CAAC;AA0BvD,MAAM,mBAAmB;IACP,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IACpC,QAAQ,CAAS;IACjB,eAAe,CAAS;IACzC,wFAAwF;IAChF,WAAW,GAAG,CAAC,QAAQ,CAAC;IAEhC,YAAY,SAAuC,EAAE;QACpD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,yBAAyB,CAAC;QAC7D,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAAC,6BAA6B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,iCAAiC,CAAC;QACnF,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,qCAAqC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;IAED,MAAM,CAAC,aAAyB,EAAE,MAAkB,EAAE,SAAiB,EAAE,GAAW;QACnF,IAAI,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,GAAG,CAAC,yDAAyD,EAAE,GAAG,GAAG,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/F,OAAO,KAAK,CAAC,CAAC,QAAQ;QACvB,CAAC;QACD,IAAI,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,GAAG,CAAC,4DAA4D,EAAE,SAAS,GAAG,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC,CAAC,qBAAqB;QACpC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,8FAA8F;YAC9F,yFAAyF;YACzF,GAAG,CAAC,uEAAuE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC,CAAC,SAAS;QACxB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,oGAAoG;IAC5F,UAAU,CAAC,GAAW;QAC7B,gFAAgF;QAChF,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO;QACR,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;IACF,CAAC;CACD;AAED,oGAAoG;AACpG,MAAM,UAAU,4BAA4B,CAAC,SAAuC,EAAE;IACrF,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"replay-guard.js","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/replay-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEjD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAChD,wGAAwG;AACxG,MAAM,CAAC,MAAM,iCAAiC,GAAG,KAAK,CAAC;AACvD,kGAAkG;AAClG,MAAM,CAAC,MAAM,6BAA6B,GAAG,OAAO,CAAC;AA8BrD,MAAM,mBAAmB;IACP,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IACpC,QAAQ,CAAS;IACjB,eAAe,CAAS;IACxB,OAAO,CAAS;IACjC,wFAAwF;IAChF,WAAW,GAAG,CAAC,QAAQ,CAAC;IAEhC,YAAY,SAAuC,EAAE;QACpD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,yBAAyB,CAAC;QAC7D,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAAC,6BAA6B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,iCAAiC,CAAC;QACnF,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,qCAAqC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,6BAA6B,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,UAAU,CAAC,2CAA2C,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;IACF,CAAC;IAED,MAAM,CAAC,aAAyB,EAAE,MAAkB,EAAE,SAAiB,EAAE,GAAW;QACnF,IAAI,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,GAAG,CAAC,yDAAyD,EAAE,GAAG,GAAG,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/F,OAAO,KAAK,CAAC,CAAC,QAAQ;QACvB,CAAC;QACD,IAAI,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,GAAG,CAAC,4DAA4D,EAAE,SAAS,GAAG,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC,CAAC,qBAAqB;QACpC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,8FAA8F;YAC9F,yFAAyF;YACzF,GAAG,CAAC,uEAAuE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC,CAAC,SAAS;QACxB,CAAC;QACD,kGAAkG;QAClG,gGAAgG;QAChG,qGAAqG;QACrG,4FAA4F;QAC5F,6FAA6F;QAC7F,0GAA0G;QAC1G,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,oGAAoG;IAC5F,UAAU,CAAC,GAAW;QAC7B,gFAAgF;QAChF,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO;QACR,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;CACD;AAED,oGAAoG;AACpG,MAAM,UAAU,4BAA4B,CAAC,SAAuC,EAAE;IACrF,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/src/cohort-topic/antidos/topic-budget.d.ts

@@ -19,6 +19,13 @@ export declare const DEFAULT_TOPICS_MAX = 2048;
 export interface TopicBudgetConfig {
     /** Max topics with forwarder state. Default {@link DEFAULT_TOPICS_MAX}. */
     topicsMax?: number;
+    /**
+     * Called with the evicted topic's id just before its slot is freed in {@link TopicBudget.admit}, so
+     * the caller can tear down the now-unbacked forwarder + traffic window that outlives the slot. Fires
+     * only for a genuine eviction (a zero-participant victim), never for a plain admit, an already-resident
+     * re-admit, or a refusal. Absent → no teardown hook.
+     */
+    onEvict?: (topicId: Uint8Array) => void;
 }
 /** Per-cohort cap on the number of topics with forwarder state, with LRU eviction of cold topics. */
 export interface TopicBudget {

package/dist/src/cohort-topic/antidos/topic-budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"topic-budget.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/topic-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,MAAM,WAAW,iBAAiB;IACjC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qGAAqG;AACrG,MAAM,WAAW,WAAW;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC;;;OAGG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3D,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IAClC;;;;OAIG;IACH,gBAAgB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1D,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAuFD,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,iBAAsB,GAAG,WAAW,CAE7E"}
+{"version":3,"file":"topic-budget.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/topic-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,MAAM,WAAW,iBAAiB;IACjC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;CACxC;AAED,qGAAqG;AACrG,MAAM,WAAW,WAAW;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC;;;OAGG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3D,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IAClC;;;;OAIG;IACH,gBAAgB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1D,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AA+FD,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,iBAAsB,GAAG,WAAW,CAE7E"}

package/dist/src/cohort-topic/antidos/topic-budget.js

@@ -22,12 +22,14 @@ export const DEFAULT_TOPICS_MAX = 2048;
 class LruTopicBudget {
     residents = new Map();
     topicsMax;
+    onEvict;
     seqCounter = 0;
     constructor(config = {}) {
         this.topicsMax = config.topicsMax ?? DEFAULT_TOPICS_MAX;
         if (!Number.isInteger(this.topicsMax) || this.topicsMax <= 0) {
             throw new RangeError(`topicsMax must be a positive integer, got ${this.topicsMax}`);
         }
+        this.onEvict = config.onEvict;
     }
     get size() {
         return this.residents.size;
@@ -46,7 +48,7 @@ class LruTopicBudget {
             return true;
         }
         if (this.residents.size < this.topicsMax) {
-            this.residents.set(key, { participantCount: 0, seq: ++this.seqCounter });
+            this.residents.set(key, { participantCount: 0, seq: ++this.seqCounter, topicId });
             return true;
         }
         // Full: only a zero-participant resident may be evicted to make room for a new topic.
@@ -55,8 +57,12 @@ class LruTopicBudget {
             log("topic-budget full size=%d max=%d — refuse new topic", this.residents.size, this.topicsMax);
             return false;
         }
+        // Fire the teardown hook with the victim's real bytes BEFORE freeing the slot, so the callback
+        // (drop the now-unbacked forwarder + traffic window) sees a coherent state. Only a genuine
+        // eviction reaches here — `coldestEvictable()` already refused a full-of-populated budget above.
+        this.onEvict?.(this.residents.get(victim).topicId);
         this.residents.delete(victim);
-        this.residents.set(key, { participantCount: 0, seq: ++this.seqCounter });
+        this.residents.set(key, { participantCount: 0, seq: ++this.seqCounter, topicId });
         log("topic-budget evicted cold topic to admit new (size=%d max=%d)", this.residents.size, this.topicsMax);
         return true;
     }

package/dist/src/cohort-topic/antidos/topic-budget.js.map

@@ -1 +1 @@
-{"version":3,"file":"topic-budget.js","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/topic-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEjD,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAyCvC,MAAM,cAAc;IACF,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,SAAS,CAAS;IAC3B,UAAU,GAAG,CAAC,CAAC;IAEvB,YAAY,SAA4B,EAAE;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,UAAU,CAAC,6CAA6C,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;IACF,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,GAAG,CAAC,OAAmB;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,gBAAgB,CAAC,OAAmB;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,gBAAgB,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,OAAmB;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,qDAAqD;YACvF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC;QACb,CAAC;QACD,sFAAsF;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,qDAAqD,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAChG,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,+DAA+D,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAmB,EAAE,gBAAwB;QAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;QACR,CAAC;QACD,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAC1C,KAAK,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACK,gBAAgB;QACvB,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAAS,GAAG,QAAQ,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBAChC,SAAS,CAAC,oEAAoE;YAC/E,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,CAAC;gBACb,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;YACvB,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,SAA4B,EAAE;IAC/D,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"topic-budget.js","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/topic-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEjD,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAkDvC,MAAM,cAAc;IACF,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,SAAS,CAAS;IAClB,OAAO,CAAiC;IACjD,UAAU,GAAG,CAAC,CAAC;IAEvB,YAAY,SAA4B,EAAE;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,UAAU,CAAC,6CAA6C,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,GAAG,CAAC,OAAmB;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,gBAAgB,CAAC,OAAmB;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,gBAAgB,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,OAAmB;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,qDAAqD;YACvF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,sFAAsF;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,qDAAqD,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAChG,OAAO,KAAK,CAAC;QACd,CAAC;QACD,+FAA+F;QAC/F,2FAA2F;QAC3F,iGAAiG;QACjG,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,GAAG,CAAC,+DAA+D,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAmB,EAAE,gBAAwB;QAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;QACR,CAAC;QACD,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAC1C,KAAK,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACK,gBAAgB;QACvB,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAAS,GAAG,QAAQ,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBAChC,SAAS,CAAC,oEAAoE;YAC/E,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,CAAC;gBACb,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;YACvB,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,SAA4B,EAAE;IAC/D,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/src/cohort-topic/coldstart.d.ts

@@ -11,18 +11,22 @@
  *   cold-start case) **or** it arrived as a follow-on to a parent cohort's `Promoted` redirect, AND
  * - a quorum of cohort members is willing to serve `T` at the registration's tier.
  *
- * The `followOn` signal is **not** carried on the wire (`RegisterV1` has only `bootstrap`); a cold
- * high-tier cohort returns `NoState` to a *speculative* `d_max` probe, but the single-direction walk
- * means the only registrations that reach a cold tier-`(d+1)` cohort are those that followed the
- * parent's `Promoted` redirect. Determining `followOn` for a given inbound register therefore belongs
- * to the db-p2p cohort host (it has the routing context); db-core takes it as an explicit input to
- * {@link shouldInstantiate}, keeping this module FRET-free. (See the implement handoff for the wiring
- * gap this leaves for the db-p2p binding.)
+ * The `followOn` signal **is** carried on the wire (`RegisterV1.followOn`), set only on the dedicated
+ * re-issue a participant sends after a parent cohort's `Promoted` redirect target answered `NoState`
+ * (the deeper child is cold). A cold high-tier cohort still returns `NoState` to a *speculative* `d_max`
+ * probe (neither flag set), but the single-direction walk means the only registrations that reach a cold
+ * tier-`(d+1)` cohort carrying `followOn: true` are those that followed the parent's `Promoted` redirect.
+ * The db-p2p cohort host derives `ctx.followOn` from the wire flag (`followOn: reg.followOn === true`) and
+ * db-core takes it as an explicit input to {@link shouldInstantiate}, keeping this module FRET-free. Because
+ * the flag is participant-forgeable, a `followOn: true` register is gated by the **same** tier-dependent
+ * bootstrap-evidence policy a `bootstrap: true` cold-root register passes (§Anti-DoS), so an unbacked
+ * follow-on never reaches this instantiation decision.
  *
  * Once instantiated, the new forwarder **registers itself with its tier-`(d − 1)` parent at first
- * opportunity**; until that registration is acked it {@link Forwarder.acceptsParticipants | accepts
- * participants} but {@link Forwarder.servesParentOps | holds} notifications/queries that need parent
- * involvement. The root (tree tier 0) has no parent and is serving immediately.
+ * opportunity** by sending a child-link the parent authenticates + records; until that link is acked
+ * (`linked`) it {@link Forwarder.acceptsParticipants | accepts participants} but
+ * {@link Forwarder.servesParentOps | holds} notifications/queries that need parent involvement. The root
+ * (tree tier 0) has no parent and is serving immediately.
  *
  * **Just-promoted burst (GROUNDING-resolved: bounce, don't buffer).** A cohort that has just promoted
  * but whose tier-`(d+1)` isn't fully instantiated yet, on a burst of new same-tier registrations,
@@ -82,13 +86,18 @@ export declare function createForwarder(tier: number): Forwarder;
  * redirected participant can estimate whether the target tier is hot (§Topic traffic signal).
  */
 export declare function promotedRedirectReply(targetTier: number, traffic?: TopicTrafficV1): RegisterReplyV1;
-/** Registers a newly-instantiated forwarder with its tier-`(d − 1)` parent; resolves on the parent ack. */
+/**
+ * Registers a newly-instantiated forwarder with its tier-`(d − 1)` parent; resolves only when the parent
+ * authenticates + records the child and returns a `linked` ack. A `rejected` reply (bad coord binding /
+ * failed threshold verify) or an unreachable parent rejects the promise, so the forwarder stays
+ * `awaiting_parent` for a later retry.
+ */
 export interface ParentRegistrar {
     /**
      * Register the forwarder for `topicId` (served at tree tier `tier`, i.e. `d`) with the cohort at
-     * `parentCoord`; resolves on ack. `opTier` is the topic's *capacity* tier (T0–T3), threaded so the
-     * transport can stamp a well-formed forwarder-link frame; absent when the caller has no op-tier
-     * context (the cohort host always supplies it from the instantiating `RegisterV1`).
+     * `parentCoord`; resolves on a `linked` ack. `opTier` is the topic's *capacity* tier (T0–T3), threaded so
+     * the transport can stamp a well-formed child-link frame; absent when the caller has no op-tier context
+     * (the cohort host always supplies it from the instantiating `RegisterV1`).
      */
     registerWithParent(topicId: Uint8Array, parentCoord: Uint8Array, tier: number, opTier?: number): Promise<void>;
 }
@@ -111,6 +120,17 @@ export interface ColdStartManager {
     instantiate(topicId: Uint8Array, tier: number, parentCoord?: Uint8Array, opTier?: number): Forwarder;
     /** The tracked forwarder for `topicId`, or `undefined`. */
     get(topicId: Uint8Array): Forwarder | undefined;
+    /**
+     * Drop the forwarder for `topicId` (budget eviction / teardown). Idempotent; a no-op if the topic is
+     * not tracked. After this, {@link get} returns `undefined` for `topicId`, so the cohort no longer
+     * reports serving it via cold-start state.
+     */
+    remove(topicId: Uint8Array): void;
+    /**
+     * Whether this manager currently tracks any forwarder. The host's idle-engine eviction reads this to
+     * avoid reclaiming a cohort that holds a live (possibly `awaiting_parent`) cold-start forwarder.
+     */
+    hasForwarders(): boolean;
 }
 /** Build a {@link ColdStartManager} over the injected parent registrar. */
 export declare function createColdStartManager(deps: ColdStartManagerDeps): ColdStartManager;

package/dist/src/cohort-topic/coldstart.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coldstart.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/coldstart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAChC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAEpE;AAED,2DAA2D;AAC3D,MAAM,MAAM,cAAc;AACzB,mGAAmG;AACjG,iBAAiB;AACnB,8EAA8E;GAC5E,SAAS,CAAC;AAEb;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,KAAK,IAAI,cAAc,CAAC;IACxB,4FAA4F;IAC5F,mBAAmB,IAAI,OAAO,CAAC;IAC/B,kGAAkG;IAClG,eAAe,IAAI,OAAO,CAAC;IAC3B,uGAAuG;IACvG,WAAW,IAAI,IAAI,CAAC;CACpB;AA2BD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAKvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,eAAe,CAMnG;AAED,2GAA2G;AAC3G,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/G;AAED,MAAM,WAAW,oBAAoB;IACpC,0EAA0E;IAC1E,eAAe,EAAE,eAAe,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrG,2DAA2D;IAC3D,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;CAChD;AAqCD,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAEnF"}
+{"version":3,"file":"coldstart.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/coldstart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAKvE,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAChC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAEpE;AAED,2DAA2D;AAC3D,MAAM,MAAM,cAAc;AACzB,mGAAmG;AACjG,iBAAiB;AACnB,8EAA8E;GAC5E,SAAS,CAAC;AAEb;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,KAAK,IAAI,cAAc,CAAC;IACxB,4FAA4F;IAC5F,mBAAmB,IAAI,OAAO,CAAC;IAC/B,kGAAkG;IAClG,eAAe,IAAI,OAAO,CAAC;IAC3B,uGAAuG;IACvG,WAAW,IAAI,IAAI,CAAC;CACpB;AA2BD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAKvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,eAAe,CAMnG;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/G;AAED,MAAM,WAAW,oBAAoB;IACpC,0EAA0E;IAC1E,eAAe,EAAE,eAAe,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrG,2DAA2D;IAC3D,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC;CACzB;AA+CD,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAEnF"}

package/dist/src/cohort-topic/coldstart.js

@@ -11,18 +11,22 @@
  *   cold-start case) **or** it arrived as a follow-on to a parent cohort's `Promoted` redirect, AND
  * - a quorum of cohort members is willing to serve `T` at the registration's tier.
  *
- * The `followOn` signal is **not** carried on the wire (`RegisterV1` has only `bootstrap`); a cold
- * high-tier cohort returns `NoState` to a *speculative* `d_max` probe, but the single-direction walk
- * means the only registrations that reach a cold tier-`(d+1)` cohort are those that followed the
- * parent's `Promoted` redirect. Determining `followOn` for a given inbound register therefore belongs
- * to the db-p2p cohort host (it has the routing context); db-core takes it as an explicit input to
- * {@link shouldInstantiate}, keeping this module FRET-free. (See the implement handoff for the wiring
- * gap this leaves for the db-p2p binding.)
+ * The `followOn` signal **is** carried on the wire (`RegisterV1.followOn`), set only on the dedicated
+ * re-issue a participant sends after a parent cohort's `Promoted` redirect target answered `NoState`
+ * (the deeper child is cold). A cold high-tier cohort still returns `NoState` to a *speculative* `d_max`
+ * probe (neither flag set), but the single-direction walk means the only registrations that reach a cold
+ * tier-`(d+1)` cohort carrying `followOn: true` are those that followed the parent's `Promoted` redirect.
+ * The db-p2p cohort host derives `ctx.followOn` from the wire flag (`followOn: reg.followOn === true`) and
+ * db-core takes it as an explicit input to {@link shouldInstantiate}, keeping this module FRET-free. Because
+ * the flag is participant-forgeable, a `followOn: true` register is gated by the **same** tier-dependent
+ * bootstrap-evidence policy a `bootstrap: true` cold-root register passes (§Anti-DoS), so an unbacked
+ * follow-on never reaches this instantiation decision.
  *
  * Once instantiated, the new forwarder **registers itself with its tier-`(d − 1)` parent at first
- * opportunity**; until that registration is acked it {@link Forwarder.acceptsParticipants | accepts
- * participants} but {@link Forwarder.servesParentOps | holds} notifications/queries that need parent
- * involvement. The root (tree tier 0) has no parent and is serving immediately.
+ * opportunity** by sending a child-link the parent authenticates + records; until that link is acked
+ * (`linked`) it {@link Forwarder.acceptsParticipants | accepts participants} but
+ * {@link Forwarder.servesParentOps | holds} notifications/queries that need parent involvement. The root
+ * (tree tier 0) has no parent and is serving immediately.
  *
  * **Just-promoted burst (GROUNDING-resolved: bounce, don't buffer).** A cohort that has just promoted
  * but whose tier-`(d+1)` isn't fully instantiated yet, on a burst of new same-tier registrations,
@@ -32,6 +36,8 @@
  */
 import { attachTopicTraffic } from "./traffic.js";
 import { bytesKey } from "./registration/bytes.js";
+import { createLogger } from "../logger.js";
+const log = createLogger('cohort-topic:coldstart');
 /**
  * Whether a cold cohort should instantiate forwarder state for an inbound register: it must be a
  * legitimate growth point (`bootstrap` root case **or** a `Promoted` follow-on) **and** have a willing
@@ -111,7 +117,7 @@ class TrackingColdStartManager {
                 .registerWithParent(topicId, parentCoord, tier, opTier)
                 .then(() => forwarder.onParentAck())
                 .catch((err) => {
-                console.warn(`cohort-topic cold-start: parent registration for tier-${tier} forwarder failed`, err);
+                log('WARN: parent registration for tier-%s forwarder failed %o', tier, err);
             });
         }
         return forwarder;
@@ -119,6 +125,14 @@ class TrackingColdStartManager {
     get(topicId) {
         return this.forwarders.get(bytesKey(topicId));
     }
+    remove(topicId) {
+        // Idempotent: `Map.delete` on an absent key is a safe no-op, so a double-remove (or a remove of a
+        // never-instantiated topic) does nothing.
+        this.forwarders.delete(bytesKey(topicId));
+    }
+    hasForwarders() {
+        return this.forwarders.size > 0;
+    }
 }
 /** Build a {@link ColdStartManager} over the injected parent registrar. */
 export function createColdStartManager(deps) {

package/dist/src/cohort-topic/coldstart.js.map

@@ -1 +1 @@
-{"version":3,"file":"coldstart.js","sourceRoot":"","sources":["../../../src/cohort-topic/coldstart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAanD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAyB;IAC1D,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC;AACzE,CAAC;AA0BD,MAAM,cAAc;IAGE;IAFb,OAAO,CAAU;IAEzB,YAAqB,IAAY,EAAE,SAAkB;QAAhC,SAAI,GAAJ,IAAI,CAAQ;QAChC,yFAAyF;QACzF,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC;IAC3B,CAAC;IAED,KAAK;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED,mBAAmB;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,eAAe;QACd,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,WAAW;QACV,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACrB,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,UAAU,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,OAAwB;IACjF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,mDAAmD,UAAU,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAoB,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACxE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC3E,CAAC;AAmCD,MAAM,wBAAwB;IAGA;IAFZ,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE3D,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;IAAG,CAAC;IAE3D,WAAW,CAAC,OAAmB,EAAE,IAAY,EAAE,WAAwB,EAAE,MAAe;QACvF,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACd,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,mCAAmC,CAAC,CAAC;YAClF,CAAC;YACD,yFAAyF;YACzF,6FAA6F;YAC7F,4FAA4F;YAC5F,KAAK,IAAI,CAAC,IAAI,CAAC,eAAe;iBAC5B,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC;iBACtD,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;iBACnC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACvB,OAAO,CAAC,IAAI,CAAC,yDAAyD,IAAI,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACrG,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,OAAmB;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC;CACD;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAChE,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"coldstart.js","sourceRoot":"","sources":["../../../src/cohort-topic/coldstart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAYnD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAyB;IAC1D,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC;AACzE,CAAC;AA0BD,MAAM,cAAc;IAGE;IAFb,OAAO,CAAU;IAEzB,YAAqB,IAAY,EAAE,SAAkB;QAAhC,SAAI,GAAJ,IAAI,CAAQ;QAChC,yFAAyF;QACzF,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC;IAC3B,CAAC;IAED,KAAK;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED,mBAAmB;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,eAAe;QACd,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,WAAW;QACV,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACrB,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,UAAU,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,OAAwB;IACjF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,mDAAmD,UAAU,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAoB,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACxE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC3E,CAAC;AAmDD,MAAM,wBAAwB;IAGA;IAFZ,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE3D,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;IAAG,CAAC;IAE3D,WAAW,CAAC,OAAmB,EAAE,IAAY,EAAE,WAAwB,EAAE,MAAe;QACvF,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACd,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,mCAAmC,CAAC,CAAC;YAClF,CAAC;YACD,yFAAyF;YACzF,6FAA6F;YAC7F,4FAA4F;YAC5F,KAAK,IAAI,CAAC,IAAI,CAAC,eAAe;iBAC5B,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC;iBACtD,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;iBACnC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACvB,GAAG,CAAC,2DAA2D,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,OAAmB;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,OAAmB;QACzB,kGAAkG;QAClG,0CAA0C;QAC1C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,aAAa;QACZ,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;IACjC,CAAC;CACD;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAChE,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/src/cohort-topic/gossip/bus.d.ts

@@ -24,7 +24,7 @@
  */
 import type { RegistrationStore } from "../registration/types.js";
 import type { ICohortGossipTransport, RingCoord } from "../ports.js";
-import type { CohortGossipV1 } from "../wire/types.js";
+import type { ChildLinkRefV1, CohortGossipV1 } from "../wire/types.js";
 import { type CohortView } from "./view.js";
 /** Handler for inbound gossip (after merge). */
 export type GossipHandler = (g: CohortGossipV1) => void;
@@ -64,6 +64,17 @@ export interface CohortGossipBusDeps {
      * callback so this gossip/replication module carries no anti-DoS dependency. Absent → skipped.
      */
     onRecordsEvicted?: (topicIds: readonly Uint8Array[]) => void;
+    /**
+     * Optional hook fired for the child-cohort link/unlink deltas on an inbound frame (db-p2p merges them into
+     * this coord's child registry, last-writer-wins by `effectiveAt`), so every parent member converges on the
+     * same child set — not only the FRET-routed member that recorded the child. Fired for **our-coord** frames
+     * regardless of epoch match: the child set is keyed by child coord, not the parent's epoch, so a parent
+     * membership rotation (an epoch drift) must not skip the merge (unlike record deltas, whose slot
+     * assignments are epoch-scoped). The merge is a direct registry write — it does **not** re-enqueue the
+     * delta, so a received link/unlink is not re-gossiped (one broadcast reaches the whole cohort). Kept as a
+     * decoupled callback so this module carries no child-registry dependency. Absent → skipped.
+     */
+    onChildDeltas?: (childLinks: readonly ChildLinkRefV1[], childUnlinks: readonly ChildLinkRefV1[]) => void;
 }
 /** Intra-cohort gossip bus (merge logic over an injected transport). */
 export interface CohortGossipBus {

package/dist/src/cohort-topic/gossip/bus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bus.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/gossip/bus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAW,SAAS,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAoB,KAAK,UAAU,EAA0B,MAAM,WAAW,CAAC;AAEtF,gDAAgD;AAChD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;AACxD,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AACpG,qGAAqG;AACrG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC;AAEnE,MAAM,WAAW,mBAAmB;IACnC,mEAAmE;IACnE,SAAS,EAAE,sBAAsB,CAAC;IAClC,yDAAyD;IACzD,KAAK,EAAE,iBAAiB,CAAC;IACzB,kHAAkH;IAClH,KAAK,EAAE,SAAS,CAAC;IACjB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,UAAU,CAAC;IAC7B,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,KAAK,IAAI,CAAC;CAC7D;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC/B,mCAAmC;IACnC,SAAS,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC;IAC7C,0EAA0E;IAC1E,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,IAAI,CAAC;IAC3C,sFAAsF;IACtF,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,mEAAmE;IACnE,IAAI,IAAI,UAAU,CAAC;IACnB,yCAAyC;IACzC,KAAK,IAAI,IAAI,CAAC;CACd;AA6HD,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAEhF"}
+{"version":3,"file":"bus.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/gossip/bus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,KAAK,EAAE,sBAAsB,EAAW,SAAS,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAoB,KAAK,UAAU,EAA0B,MAAM,WAAW,CAAC;AAEtF,gDAAgD;AAChD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;AACxD,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AACpG,qGAAqG;AACrG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC;AAEnE,MAAM,WAAW,mBAAmB;IACnC,mEAAmE;IACnE,SAAS,EAAE,sBAAsB,CAAC;IAClC,yDAAyD;IACzD,KAAK,EAAE,iBAAiB,CAAC;IACzB,kHAAkH;IAClH,KAAK,EAAE,SAAS,CAAC;IACjB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,UAAU,CAAC;IAC7B,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,KAAK,IAAI,CAAC;IAC7D;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,EAAE,YAAY,EAAE,SAAS,cAAc,EAAE,KAAK,IAAI,CAAC;CACzG;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC/B,mCAAmC;IACnC,SAAS,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC;IAC7C,0EAA0E;IAC1E,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,IAAI,CAAC;IAC3C,sFAAsF;IACtF,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,mEAAmE;IACnE,IAAI,IAAI,UAAU,CAAC;IACnB,yCAAyC;IACzC,KAAK,IAAI,IAAI,CAAC;CACd;AAsJD,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAEhF"}

package/dist/src/cohort-topic/gossip/bus.js

@@ -23,6 +23,7 @@
  * members — one {@link CohortGossipBus.applyInbound} of that gossip makes it visible locally.
  */
 import { bytesEqual, bytesKey } from "../registration/bytes.js";
+import { clampTtl } from "../registration/types.js";
 import { b64urlToBytes, decodeCohortGossipV1, encodeCohortMessage } from "../wire/codec.js";
 import { fromGossipRecord } from "./records.js";
 import { createCohortView } from "./view.js";
@@ -69,6 +70,14 @@ class TransportCohortGossipBus {
         if (epochMatches) {
             this.mergeRecords(g, now);
         }
+        // Child link/unlink deltas merge regardless of epoch match: the child set is keyed by child coord, not
+        // the parent's epoch, so a rotation (epoch drift) must not drop it. Freshness (last-writer-wins by
+        // effectiveAt) lives in the registry the callback writes.
+        const childLinks = g.childLinks ?? [];
+        const childUnlinks = g.childUnlinks ?? [];
+        if (this.deps.onChildDeltas !== undefined && (childLinks.length > 0 || childUnlinks.length > 0)) {
+            this.deps.onChildDeltas(childLinks, childUnlinks);
+        }
     }
     view() {
         return this.memberView;
@@ -109,6 +118,11 @@ class TransportCohortGossipBus {
     mergeRecords(g, now) {
         for (const gr of g.records ?? []) {
             const incoming = fromGossipRecord(gr);
+            // Gossip is a second admission path into the store — a peer (buggy, unpatched, or hostile)
+            // can replicate a record whose TTL never passed local `accept()`'s clamp. Re-clamp here so
+            // no replica can hold an unbounded lifetime that wedges the topic budget. Clamp BEFORE the
+            // dead-check below so a poison TTL cannot dodge staleness eviction.
+            incoming.ttl = clampTtl(incoming.ttl);
             // A record already past its TTL is dead; merging it would resurrect a registration the
             // owner has (or soon will have) evicted. Drop it, matching `store.evictStale`'s predicate
             // so replication can never reintroduce what local eviction removes.
@@ -129,7 +143,19 @@ class TransportCohortGossipBus {
         let evictedTopics;
         for (const ref of g.evicted ?? []) {
             const topicId = b64urlToBytes(ref.topicId);
-            this.deps.store.delete(topicId, b64urlToBytes(ref.participantId));
+            const participantId = b64urlToBytes(ref.participantId);
+            // NOTE: freshness guard adds one getByParticipant per eviction ref (on top of the delete's own
+            // lookup); evictions are low-volume, but if this path ever shows as hot, fold the guard into a
+            // single conditional-delete store op.
+            const held = this.deps.store.getByParticipant(topicId, participantId);
+            // A stale eviction (older than the held record) must not delete a fresher re-registration.
+            // Evictions are otherwise NOT last-writer-wins like merges are, so a reordered/slow delta would
+            // win against a record the participant already renewed. Skip it — and, since nothing drained,
+            // do NOT add the topic to `evictedTopics` (no delete → no budget re-touch).
+            if (held !== undefined && held.lastPing > ref.lastPing) {
+                continue;
+            }
+            this.deps.store.delete(topicId, participantId);
             if (this.deps.onRecordsEvicted !== undefined) {
                 (evictedTopics ??= new Map()).set(bytesKey(topicId), topicId);
             }