@optimystic/db-p2p 0.14.1 → 0.16.3

package/dist/src/protocol-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-limits.d.ts","sourceRoot":"","sources":["../../src/protocol-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAkB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,QAAkB,CAAC"}

package/dist/src/protocol-limits.js

@@ -0,0 +1,32 @@
+/**
+ * Inbound-message size caps for the db-p2p consensus protocols.
+ *
+ * Every inbound stream handler frames its wire data with length-prefixed
+ * encoding (`it-length-prefixed`) and `JSON.parse`s each frame. Passing one of
+ * these constants as the decoder's `maxDataLength` makes an oversized frame
+ * reject at the length-prefix (before any allocation against the declared size)
+ * instead of buffering up to the library default (4 MiB) of attacker-controlled
+ * JSON per frame. Mirrors the existing precedent
+ * `DEFAULT_MAX_MESSAGE_BYTES = 1024 * 1024` in
+ * `packages/db-core/src/cohort-topic/wire/codec.ts`.
+ */
+/**
+ * Max size (bytes) of a single inbound framed message on a *control-plane*
+ * protocol — cluster records, dispute votes, sync requests. These carry a peer
+ * set + signatures + small metadata, never bulk block data.
+ */
+export const MAX_CONTROL_MESSAGE_BYTES = 1 * 1024 * 1024; // 1 MiB
+/**
+ * Max size (bytes) of a single inbound framed message on a *block-carrying*
+ * protocol — repo operations (pend/commit transforms + block bodies),
+ * block-transfer push payloads (base64-inflated block data, multiple per
+ * request), and the block-bearing responses those protocols return.
+ *
+ * NOTE: the repo enforces no hard per-block byte ceiling today, so this is a
+ * heuristic. If a legitimate block/transform can exceed this, the transfer will
+ * be rejected — raise this constant (or thread a config override) rather than
+ * removing the cap. If the repo later grows a real max-block constant, derive
+ * this cap from it.
+ */
+export const MAX_BLOCK_MESSAGE_BYTES = 8 * 1024 * 1024; // 8 MiB
+//# sourceMappingURL=protocol-limits.js.map

package/dist/src/protocol-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-limits.js","sourceRoot":"","sources":["../../src/protocol-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAElE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ"}

package/dist/src/repo/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/repo/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAC7F,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAC3D,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,qBAAa,UAAW,SAAQ,cAAe,YAAW,KAAK;IACC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM;IAA/F,OAAO;IAIP,mCAAmC;WACrB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU;IAI9F,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAO5E,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,GAAG,YAAY,CAAC;IAOxF,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC;IAOpF,OAAO,CAAC,oBAAoB;YASd,kBAAkB;YAkElB,wBAAwB;YA6BxB,kCAAkC;CAQhD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/repo/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAC7F,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAC3D,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,qBAAa,UAAW,SAAQ,cAAe,YAAW,KAAK;IACC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM;IAA/F,OAAO;IAIP,mCAAmC;WACrB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU;IAI9F,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAO5E,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,GAAG,YAAY,CAAC;IAOxF,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC;IAOpF,OAAO,CAAC,oBAAoB;YASd,kBAAkB;YAoElB,wBAAwB;YA6BxB,kCAAkC;CAQhD"}

package/dist/src/repo/client.js

@@ -1,5 +1,6 @@
 import { blockIdsForTransforms, blockIdToBytes } from "@optimystic/db-core";
 import { ProtocolClient } from "../protocol-client.js";
+import { MAX_BLOCK_MESSAGE_BYTES } from "../protocol-limits.js";
 import { peerIdFromString } from "@libp2p/peer-id";
 export class RepoClient extends ProtocolClient {
     protocolPrefix;
@@ -67,6 +68,8 @@ export class RepoClient extends ProtocolClient {
                 signal: combinedSignal,
                 correlationId,
                 dialTimeoutMs: options?.dialTimeoutMs,
+                // A get response carries block data → block cap (not control).
+                maxDataLength: MAX_BLOCK_MESSAGE_BYTES,
             });
         }
         finally {

package/dist/src/repo/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/repo/client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,UAAW,SAAQ,cAAc;IAC2B;IAAxE,YAAoB,MAAc,EAAE,WAAyB,EAAW,cAAuB;QAC9F,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAD4C,mBAAc,GAAd,cAAc,CAAS;IAE/F,CAAC;IAED,mCAAmC;IAC5B,MAAM,CAAC,MAAM,CAAC,MAAc,EAAE,WAAyB,EAAE,cAAuB;QACtF,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAoB,EAAE,OAAuB;QACtD,OAAO,IAAI,CAAC,kBAAkB,CAC7B,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EACpB,OAAO,CACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,OAAuB;QACvD,OAAO,IAAI,CAAC,kBAAkB,CAC7B,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EACnB,OAAO,CACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAuB,EAAE,OAAuB;QAC5D,OAAO,IAAI,CAAC,kBAAkB,CAC7B,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,EAC3B,OAAO,CACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAE,OAAuB;QAC3D,OAAO,IAAI,CAAC,kBAAkB,CAC7B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EACrB,OAAO,CACP,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,UAAqC;QACjE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,IAAI,QAAQ,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,IAAI,QAAQ,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;QACxD,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC/B,UAAqC,EACrC,OAAuB,EACvB,MAAc,CAAC;QAEf,MAAM,OAAO,GAAgB;YAC5B,UAAU;YACV,UAAU,EAAE,OAAO,CAAC,UAAU;SAC9B,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC,GAAG,aAAa,CAAA;QAEpE,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,yEAAyE;QACzE,gFAAgF;QAChF,4EAA4E;QAC5E,qEAAqE;QACrE,EAAE;QACF,+EAA+E;QAC/E,+DAA+D;QAC/D,gFAAgF;QAChF,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;QAChD,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAC/D,UAAU,CACV,CAAA;QACD,MAAM,cAAc,GAAG,OAAO,EAAE,MAAM;YACrC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAA;QAC5B,IAAI,QAAa,CAAA;QACjB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAM,OAAO,EAAE,SAAS,EAAE;gBAC9D,MAAM,EAAE,cAAc;gBACtB,aAAa;gBACb,aAAa,EAAE,OAAO,EAAE,aAAa;aACrC,CAAC,CAAA;QACH,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QAED,IAAI,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACvC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;YAC3E,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;YAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1G,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxC,IAAI,IAAI,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACpE,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,IAAI,CAAC,kCAAkC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;YACjE,2DAA2D;YAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;YACnF,OAAO,MAAM,UAAU,CAAC,kBAAkB,CAAI,UAAU,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,QAAa,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAC,GAA8B;QACpE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,8DAA8D;QAC9D,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAClB,6EAA6E;YAC7E,wEAAwE;YACxE,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpB,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,kCAAkC,CAAC,GAA8B,EAAE,MAAc;QAC9F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACzD,MAAM,EAAE,GAAQ,IAAI,CAAC,WAAkB,CAAA;QACvC,IAAI,QAAQ,IAAI,IAAI,IAAI,OAAO,EAAE,EAAE,iBAAiB,KAAK,UAAU,EAAE,CAAC;YACrE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACvC,CAAC;IACF,CAAC;CAED"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/repo/client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,UAAW,SAAQ,cAAc;IAC2B;IAAxE,YAAoB,MAAc,EAAE,WAAyB,EAAW,cAAuB;QAC9F,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAD4C,mBAAc,GAAd,cAAc,CAAS;IAE/F,CAAC;IAED,mCAAmC;IAC5B,MAAM,CAAC,MAAM,CAAC,MAAc,EAAE,WAAyB,EAAE,cAAuB;QACtF,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAoB,EAAE,OAAuB;QACtD,OAAO,IAAI,CAAC,kBAAkB,CAC7B,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EACpB,OAAO,CACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,OAAuB;QACvD,OAAO,IAAI,CAAC,kBAAkB,CAC7B,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EACnB,OAAO,CACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAuB,EAAE,OAAuB;QAC5D,OAAO,IAAI,CAAC,kBAAkB,CAC7B,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,EAC3B,OAAO,CACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAE,OAAuB;QAC3D,OAAO,IAAI,CAAC,kBAAkB,CAC7B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EACrB,OAAO,CACP,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,UAAqC;QACjE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,IAAI,QAAQ,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,IAAI,QAAQ,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;QACxD,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC/B,UAAqC,EACrC,OAAuB,EACvB,MAAc,CAAC;QAEf,MAAM,OAAO,GAAgB;YAC5B,UAAU;YACV,UAAU,EAAE,OAAO,CAAC,UAAU;SAC9B,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC,GAAG,aAAa,CAAA;QAEpE,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,yEAAyE;QACzE,gFAAgF;QAChF,4EAA4E;QAC5E,qEAAqE;QACrE,EAAE;QACF,+EAA+E;QAC/E,+DAA+D;QAC/D,gFAAgF;QAChF,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;QAChD,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAC/D,UAAU,CACV,CAAA;QACD,MAAM,cAAc,GAAG,OAAO,EAAE,MAAM;YACrC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAA;QAC5B,IAAI,QAAa,CAAA;QACjB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAM,OAAO,EAAE,SAAS,EAAE;gBAC9D,MAAM,EAAE,cAAc;gBACtB,aAAa;gBACb,aAAa,EAAE,OAAO,EAAE,aAAa;gBACrC,+DAA+D;gBAC/D,aAAa,EAAE,uBAAuB;aACtC,CAAC,CAAA;QACH,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QAED,IAAI,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACvC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;YAC3E,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;YAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1G,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxC,IAAI,IAAI,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACpE,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,IAAI,CAAC,kCAAkC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;YACjE,2DAA2D;YAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;YACnF,OAAO,MAAM,UAAU,CAAC,kBAAkB,CAAI,UAAU,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,QAAa,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAC,GAA8B;QACpE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,8DAA8D;QAC9D,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAClB,6EAA6E;YAC7E,wEAAwE;YACxE,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpB,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,kCAAkC,CAAC,GAA8B,EAAE,MAAc;QAC9F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACzD,MAAM,EAAE,GAAQ,IAAI,CAAC,WAAkB,CAAA;QACvC,IAAI,QAAQ,IAAI,IAAI,IAAI,OAAO,EAAE,EAAE,iBAAiB,KAAK,UAAU,EAAE,CAAC;YACrE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACvC,CAAC;IACF,CAAC;CAED"}

package/dist/src/repo/cluster-coordinator.d.ts

@@ -4,6 +4,19 @@ import type { PeerId } from "@libp2p/interface";
 import type { FretService } from "p2p-fret";
 import type { IPeerReputation } from "../reputation/types.js";
 import type { ITransactionStateStore } from "../cluster/i-transaction-state-store.js";
+/** Cancel handle for an injected timer; cancels a not-yet-fired timer (safe no-op after fire/cancel). */
+export type TimerCancel = () => void;
+/**
+ * Optional injection seam for deterministic time. Production leaves both undefined and gets
+ * `Date.now` + an unref'd `setTimeout`; tests inject a fake clock + timer queue so scheduled
+ * commit-retries fire in virtual (not wall-clock) time.
+ */
+export interface ClusterCoordinatorClock {
+    /** Clock (Unix ms). Defaults to `Date.now`. */
+    now?: () => number;
+    /** Schedule a one-shot timer, returning a cancel handle. Defaults to an unref'd `setTimeout`. */
+    setTimer?: (fn: () => void, delayMs: number) => TimerCancel;
+}
 /** Manages distributed transactions across clusters */
 export declare class ClusterCoordinator {
     private readonly keyNetwork;
@@ -19,18 +32,42 @@ export declare class ClusterCoordinator {
     private readonly retryMaxIntervalMs;
     private readonly retryMaxAttempts;
     private readonly commitBroadcastImmediateRetries;
+    private readonly promiseImmediateRetries;
+    /** Injected clock/timer seam; production defaults to `Date.now` + unref'd `setTimeout`. */
+    private readonly now;
+    private readonly setTimer;
     constructor(keyNetwork: IKeyNetwork, createClusterClient: (peerId: PeerId) => ClusterClient, cfg: ClusterConsensusConfig & {
         clusterSize: number;
     }, localCluster?: {
         update: (record: ClusterRecord) => Promise<ClusterRecord>;
         peerId: PeerId;
         wasTransactionExecuted?: (messageHash: string) => boolean;
-    } | undefined, fretService?: FretService | undefined, reputation?: IPeerReputation | undefined, stateStore?: ITransactionStateStore | undefined);
+    } | undefined, fretService?: FretService | undefined, reputation?: IPeerReputation | undefined, stateStore?: ITransactionStateStore | undefined, clock?: ClusterCoordinatorClock);
+    /**
+     * Invoke one cluster member's `update`, retrying transient REMOTE failures up to
+     * `immediateRetries` times before surfacing the error. The local cluster is invoked
+     * exactly once — a local throw is a real fault (validation / merge / consensus), not a
+     * transient transport blip. A remote call rides a libp2p stream that a circuit-relay
+     * ("limited") connection can reset once a per-circuit cap or reservation lapses, which
+     * surfaces as a StreamResetError; an immediate retry on the (usually still-warm)
+     * connection recovers most of those without escalating the peer to a failure. Shared by
+     * the promise-collection, commit-collection, and commit-broadcast phases so all three
+     * react to a relayed reset the same way.
+     */
+    private updateMember;
     /**
-     * Creates a base 58 BTC string hash for a message to uniquely identify a transaction
+     * Creates a base58btc string hash uniquely identifying a transaction. For a v2 record the caller
+     * threads in the {@link membershipDigest} of the peer set so the responsible membership is bound into
+     * the identity (two different peer sets ⇒ two different hashes). Omitting `membershipDigestValue`
+     * reproduces the legacy v1 hash byte-for-byte.
+     *
+     * NOTE: the whole `message` is hashed (canonicalJson), so a transaction's advisory aged priority —
+     * which rides inside the pend operation as `pend.transaction.priority` (multi-collection) or
+     * `pend.priority` (single-collection) — is automatically covered here and by the derived
+     * promise/commit hashes. That is what makes priority integrity-protected in transit: a relaying peer
+     * cannot strip or inflate it without invalidating the message hash the members verify. No separate
+     * priority-hashing step is needed.
      */
-    /** Deterministic JSON: sorts object keys so hash is order-independent */
-    private static canonicalJson;
     private createMessageHash;
     /**
      * Gets all peers in the cluster for a specific block ID

package/dist/src/repo/cluster-coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-coordinator.d.ts","sourceRoot":"","sources":["../../../src/repo/cluster-coordinator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAgB,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGlJ,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAwBtF,uDAAuD;AACvD,qBAAa,kBAAkB;IAS7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAK9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAlB7B,OAAO,CAAC,YAAY,CAAmD;IACvE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAS;gBAGvC,UAAU,EAAE,WAAW,EACvB,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,aAAa,EACtD,GAAG,EAAE,sBAAsB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,EACrD,YAAY,CAAC,EAAE;QAC/B,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,EAAE,MAAM,CAAC;QACf,sBAAsB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;KAC1D,YAAA,EACgB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,UAAU,CAAC,EAAE,eAAe,YAAA,EAC5B,UAAU,CAAC,EAAE,sBAAsB,YAAA;IASrD;;OAEG;IACH,yEAAyE;IACzE,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,iBAAiB;IAM/B;;OAEG;YACW,kBAAkB;IAahC,OAAO,CAAC,UAAU;IA6BlB;;;OAGG;IACG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;QAC3G,MAAM,EAAE,aAAa,CAAC;QACtB,aAAa,EAAE,OAAO,CAAC;KACvB,CAAC;IAuEF;;OAEG;YACW,kBAAkB;IAyF1B,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvD;;;OAGG;YACW,oBAAoB;IAmClC;;OAEG;YACW,eAAe;IA6F7B;;OAEG;YACW,iBAAiB;IAiH/B;;;;;;OAMG;YACW,qBAAqB;IA8CnC,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,mBAAmB;YAqCb,YAAY;IAkD1B,OAAO,CAAC,UAAU;IAoBlB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAgB/B,gEAAgE;IAChE,OAAO,CAAC,sBAAsB;IAM9B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;CA+B1C"}
+{"version":3,"file":"cluster-coordinator.d.ts","sourceRoot":"","sources":["../../../src/repo/cluster-coordinator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAgB,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElJ,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAItF,yGAAyG;AACzG,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAerC;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACvC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,WAAW,CAAC;CAC5D;AAsBD,uDAAuD;AACvD,qBAAa,kBAAkB;IAa7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAK9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAtB7B,OAAO,CAAC,YAAY,CAAmD;IACvE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAS;IACzD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;gBAG1D,UAAU,EAAE,WAAW,EACvB,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,aAAa,EACtD,GAAG,EAAE,sBAAsB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,EACrD,YAAY,CAAC,EAAE;QAC/B,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,EAAE,MAAM,CAAC;QACf,sBAAsB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;KAC1D,YAAA,EACgB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,UAAU,CAAC,EAAE,eAAe,YAAA,EAC5B,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACpD,KAAK,CAAC,EAAE,uBAAuB;IAYhC;;;;;;;;;;OAUG;YACW,YAAY;IA0B1B;;;;;;;;;;;;OAYG;YACW,iBAAiB;IAI/B;;OAEG;YACW,kBAAkB;IAahC,OAAO,CAAC,UAAU;IAiClB;;;OAGG;IACG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;QAC3G,MAAM,EAAE,aAAa,CAAC;QACtB,aAAa,EAAE,OAAO,CAAC;KACvB,CAAC;IA4EF;;OAEG;YACW,kBAAkB;IA8F1B,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvD;;;OAGG;YACW,oBAAoB;IAwClC;;OAEG;YACW,eAAe;IA8F7B;;OAEG;YACW,iBAAiB;IAqH/B;;;;;;OAMG;YACW,qBAAqB;IAkBnC,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,mBAAmB;YAmCb,YAAY;IAkD1B,OAAO,CAAC,UAAU;IAkBlB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAgB/B,gEAAgE;IAChE,OAAO,CAAC,sBAAsB;IAM9B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;CA+B1C"}

package/dist/src/repo/cluster-coordinator.js

@@ -1,10 +1,22 @@
 import { peerIdFromString } from "@libp2p/peer-id";
-import { base58btc } from "multiformats/bases/base58";
-import { sha256 } from "multiformats/hashes/sha2";
+import { CURRENT_MEMBERSHIP_VERSION, computeClusterMessageHash, membershipDigest } from "@optimystic/db-core";
+import { ClusterClient } from "../cluster/client.js";
 import { Pending } from "@optimystic/db-core";
 import { createLogger, verbose } from '../logger.js';
 import { PenaltyReason } from "../reputation/types.js";
 const log = createLogger('cluster');
+/**
+ * Production timer binding: a one-shot `setTimeout` whose handle is **unref'd** so a pending
+ * commit-retry (or the deferred transaction cleanup) never keeps an otherwise-idle process alive.
+ * The returned handle clears the timeout (idempotent). Mirrors the reactivity rotation
+ * re-registration scheduler's `defaultSetTimer` (see reactivity/rotation-rereg-scheduler.ts).
+ */
+function defaultSetTimer(fn, delayMs) {
+    const handle = setTimeout(fn, delayMs);
+    // An idle retry/cleanup timer must not pin a process (mirror rotation re-registration + push-state gossip).
+    handle.unref?.();
+    return () => clearTimeout(handle);
+}
 /** Manages distributed transactions across clusters */
 export class ClusterCoordinator {
     keyNetwork;
@@ -20,7 +32,11 @@ export class ClusterCoordinator {
     retryMaxIntervalMs;
     retryMaxAttempts;
     commitBroadcastImmediateRetries;
-    constructor(keyNetwork, createClusterClient, cfg, localCluster, fretService, reputation, stateStore) {
+    promiseImmediateRetries;
+    /** Injected clock/timer seam; production defaults to `Date.now` + unref'd `setTimeout`. */
+    now;
+    setTimer;
+    constructor(keyNetwork, createClusterClient, cfg, localCluster, fretService, reputation, stateStore, clock) {
         this.keyNetwork = keyNetwork;
         this.createClusterClient = createClusterClient;
         this.cfg = cfg;
@@ -33,20 +49,62 @@ export class ClusterCoordinator {
         this.retryMaxIntervalMs = cfg.commitBroadcastRetryMaxIntervalMs ?? 8000;
         this.retryMaxAttempts = cfg.commitBroadcastRetryMaxAttempts ?? 5;
         this.commitBroadcastImmediateRetries = cfg.commitBroadcastImmediateRetries ?? 1;
+        this.promiseImmediateRetries = cfg.promiseImmediateRetries ?? 1;
+        this.now = clock?.now ?? (() => Date.now());
+        this.setTimer = clock?.setTimer ?? defaultSetTimer;
     }
     /**
-     * Creates a base 58 BTC string hash for a message to uniquely identify a transaction
+     * Invoke one cluster member's `update`, retrying transient REMOTE failures up to
+     * `immediateRetries` times before surfacing the error. The local cluster is invoked
+     * exactly once — a local throw is a real fault (validation / merge / consensus), not a
+     * transient transport blip. A remote call rides a libp2p stream that a circuit-relay
+     * ("limited") connection can reset once a per-circuit cap or reservation lapses, which
+     * surfaces as a StreamResetError; an immediate retry on the (usually still-warm)
+     * connection recovers most of those without escalating the peer to a failure. Shared by
+     * the promise-collection, commit-collection, and commit-broadcast phases so all three
+     * react to a relayed reset the same way.
      */
-    /** Deterministic JSON: sorts object keys so hash is order-independent */
-    static canonicalJson(value) {
-        return JSON.stringify(value, (_, v) => v && typeof v === 'object' && !Array.isArray(v)
-            ? Object.keys(v).sort().reduce((o, k) => { o[k] = v[k]; return o; }, {})
-            : v);
+    async updateMember(peerIdStr, record, immediateRetries, phase) {
+        const isLocal = this.localCluster && peerIdStr === this.localCluster.peerId.toString();
+        if (isLocal) {
+            return await this.localCluster.update(record);
+        }
+        const maxAttempts = 1 + Math.max(0, immediateRetries);
+        let lastError;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                return await this.createClusterClient(peerIdFromString(peerIdStr)).update(record);
+            }
+            catch (err) {
+                lastError = err;
+                if (attempt < maxAttempts) {
+                    log('cluster-tx:member-update-retry', {
+                        messageHash: record.messageHash,
+                        peerId: peerIdStr,
+                        phase,
+                        attempt,
+                        error: err instanceof Error ? err.message : String(err)
+                    });
+                }
+            }
+        }
+        throw lastError;
     }
-    async createMessageHash(message) {
-        const msgBytes = new TextEncoder().encode(ClusterCoordinator.canonicalJson(message));
-        const hashBytes = await sha256.digest(msgBytes);
-        return base58btc.encode(hashBytes.digest);
+    /**
+     * Creates a base58btc string hash uniquely identifying a transaction. For a v2 record the caller
+     * threads in the {@link membershipDigest} of the peer set so the responsible membership is bound into
+     * the identity (two different peer sets ⇒ two different hashes). Omitting `membershipDigestValue`
+     * reproduces the legacy v1 hash byte-for-byte.
+     *
+     * NOTE: the whole `message` is hashed (canonicalJson), so a transaction's advisory aged priority —
+     * which rides inside the pend operation as `pend.transaction.priority` (multi-collection) or
+     * `pend.priority` (single-collection) — is automatically covered here and by the derived
+     * promise/commit hashes. That is what makes priority integrity-protected in transit: a relaying peer
+     * cannot strip or inflate it without invalidating the message hash the members verify. No separate
+     * priority-hashing step is needed.
+     */
+    async createMessageHash(message, membershipDigestValue) {
+        return computeClusterMessageHash(message, membershipDigestValue);
     }
     /**
      * Gets all peers in the cluster for a specific block ID
@@ -64,11 +122,15 @@ export class ClusterCoordinator {
             return {};
         }
     }
-    makeRecord(peers, messageHash, message) {
+    makeRecord(peers, messageHash, message, membershipDigestValue) {
         const peerCount = Object.keys(peers ?? {}).length;
         const record = {
             messageHash,
             peers,
+            // v2: bind the responsible membership into the signed identity. messageHash was computed over
+            // this same digest, so a different peer set would have produced a different messageHash.
+            membershipVersion: CURRENT_MEMBERSHIP_VERSION,
+            membershipDigest: membershipDigestValue,
             message,
             coordinatingBlockIds: message.coordinatingBlockIds,
             promises: {},
@@ -98,10 +160,14 @@ export class ClusterCoordinator {
     async executeClusterTransaction(blockId, message, _options) {
         // Get the cluster peers for this block
         const peers = await this.getClusterForBlock(blockId);
-        // Create a unique hash for this transaction
-        const messageHash = await this.createMessageHash(message);
+        // Bind the responsible membership into the transaction identity (v2): the digest is folded into
+        // the messageHash below, so two different peer sets produce two different messageHashes rather
+        // than one hash with a silent internal disagreement about who is responsible.
+        const membershipDigestValue = await membershipDigest(peers);
+        // Create a unique hash for this transaction (over message + membership digest)
+        const messageHash = await this.createMessageHash(message, membershipDigestValue);
         // Create a cluster record for this transaction
-        const record = this.makeRecord(peers, messageHash, message);
+        const record = this.makeRecord(peers, messageHash, message, membershipDigestValue);
         log('cluster-tx:start', {
             messageHash,
             blockId,
@@ -119,7 +185,7 @@ export class ClusterCoordinator {
             messageHash,
             record,
             pending,
-            lastUpdate: Date.now()
+            lastUpdate: this.now()
         };
         this.transactions.set(messageHash, state);
         this.persistCoordinatorState(messageHash, record, 'promising');
@@ -150,7 +216,7 @@ export class ClusterCoordinator {
             // Let the retry completion or abort handle cleanup
             if (!stored?.retry) {
                 // Wait a bit before cleanup to allow any in-flight responses to arrive
-                setTimeout(() => {
+                this.setTimer(() => {
                     this.transactions.delete(messageHash);
                     this.deleteCoordinatorState(messageHash);
                     log('cluster-tx:transaction-remove', {
@@ -240,6 +306,11 @@ export class ClusterCoordinator {
                 rejectionCount,
                 peerCount
             });
+            // [dispute-subsystem-dormant] Evidence is computed and persisted but initiateDispute() is
+            // intentionally NOT called here. Dispute origination stays dormant pending arbitrator-set
+            // anchoring — without it a forged synthetic cohort passes resolution.
+            // Gate: tickets/backlog/hardening/invalidation-live-wiring-requires-arbitrator-set-anchoring
+            // Wiring plan: tickets/backlog/feat-dispute-subsystem-live-activation
         }
         this.persistCoordinatorState(promised.record.messageHash, promised.record, 'committing');
         return await this.commitTransaction(promised.record);
@@ -277,13 +348,18 @@ export class ClusterCoordinator {
                 // Ignore errors
             }
         }
-        // Fallback: accept small clusters in development/testing scenarios
-        // In production, FRET should provide validation
-        log('cluster-tx:small-cluster-accepted-without-validation', {
+        // Fallback: with no confident network-size estimate, fail CLOSED by default.
+        // An undersized cluster with no way to justify its size is unsafe (a lone/
+        // near-lone node could rubber-stamp its own writes), so reject unless the
+        // operator has explicitly opted in via allowUnvalidatedSmallCluster (e.g.
+        // single-node / local dev knowingly running below the floor).
+        const admit = this.cfg.allowUnvalidatedSmallCluster ?? false;
+        log('cluster-tx:small-cluster-no-confident-estimate', {
             localSize,
-            reason: 'no-confident-network-size-estimate'
+            reason: 'no-confident-network-size-estimate',
+            admit
         });
-        return true;
+        return admit;
     }
     /**
      * Collects promises from all peers in the cluster
@@ -298,14 +374,15 @@ export class ClusterCoordinator {
             }));
             log('cluster-tx:promise-peers', { messageHash: record.messageHash, peers: peerDetail });
         }
-        // For each peer, create a client and request a promise
+        // For each peer, create a client and request a promise. A remote promise rides
+        // a libp2p stream that a relayed (limited) connection can reset transiently, so
+        // each remote request gets `promiseImmediateRetries` in-line re-attempts before
+        // it counts as a failure — without this a single relayed reset drops the peer and
+        // sinks super-majority (the commit broadcast already has the same guard).
         const promiseRequests = peerIds.map(peerIdStr => {
             const isLocal = this.localCluster && peerIdStr === this.localCluster.peerId.toString();
             log('cluster-tx:promise-request', { messageHash: record.messageHash, peerId: peerIdStr, isLocal });
-            const promise = isLocal
-                ? this.localCluster.update(record)
-                : this.createClusterClient(peerIdFromString(peerIdStr)).update(record);
-            return new Pending(promise);
+            return new Pending(this.updateMember(peerIdStr, record, this.promiseImmediateRetries, 'promise'));
         });
         // Wait for all promises to complete
         const results = await Promise.all(promiseRequests.map((p, idx) => p.result().then(res => {
@@ -396,6 +473,10 @@ export class ClusterCoordinator {
         const commitPayload = {
             ...record
         };
+        // No per-peer immediate retry here: a commit-collection failure is recovered
+        // downstream by broadcastMergedRecord's in-line retry and the scheduled
+        // commit-retry timer. (The promise phase has no such backstop, which is why
+        // collectPromises gets the immediate retry instead.)
         const commitRequests = peerIds.map(peerIdStr => {
             const isLocal = this.localCluster && peerIdStr === this.localCluster.peerId.toString();
             log('cluster-tx:commit-request', { messageHash: record.messageHash, peerId: peerIdStr, isLocal });
@@ -499,48 +580,19 @@ export class ClusterCoordinator {
      * Local cluster is invoked exactly once — local failures are fatal, not transient.
      */
     async broadcastMergedRecord(record, peerIds) {
-        const maxAttempts = 1 + Math.max(0, this.commitBroadcastImmediateRetries);
         const results = await Promise.all(peerIds.map(async (peerIdStr) => {
-            const isLocal = this.localCluster && peerIdStr === this.localCluster.peerId.toString();
-            if (isLocal) {
-                try {
-                    await this.localCluster.update(record);
-                    return { peerId: peerIdStr, success: true };
-                }
-                catch (err) {
-                    log('cluster-tx:consensus-broadcast-error', {
-                        messageHash: record.messageHash,
-                        peerId: peerIdStr,
-                        error: err.message
-                    });
-                    return { peerId: peerIdStr, success: false };
-                }
+            try {
+                await this.updateMember(peerIdStr, record, this.commitBroadcastImmediateRetries, 'commit-broadcast');
+                return { peerId: peerIdStr, success: true };
             }
-            let lastError;
-            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-                try {
-                    await this.createClusterClient(peerIdFromString(peerIdStr)).update(record);
-                    return { peerId: peerIdStr, success: true };
-                }
-                catch (err) {
-                    lastError = err;
-                    if (attempt < maxAttempts) {
-                        log('cluster-tx:consensus-broadcast-retry', {
-                            messageHash: record.messageHash,
-                            peerId: peerIdStr,
-                            attempt,
-                            error: err.message
-                        });
-                    }
-                }
+            catch (err) {
+                log('cluster-tx:consensus-broadcast-error', {
+                    messageHash: record.messageHash,
+                    peerId: peerIdStr,
+                    error: err instanceof Error ? err.message : String(err)
+                });
+                return { peerId: peerIdStr, success: false };
             }
-            log('cluster-tx:consensus-broadcast-error', {
-                messageHash: record.messageHash,
-                peerId: peerIdStr,
-                attempts: maxAttempts,
-                error: lastError instanceof Error ? lastError.message : String(lastError)
-            });
-            return { peerId: peerIdStr, success: false };
         }));
         const failures = results.filter(r => !r.success).map(r => r.peerId);
         return { failures };
@@ -552,7 +604,7 @@ export class ClusterCoordinator {
             return;
         }
         state.record = { ...record };
-        state.lastUpdate = Date.now();
+        state.lastUpdate = this.now();
         log('cluster-tx:transaction-update', {
             messageHash: record.messageHash,
             stage,
@@ -577,17 +629,15 @@ export class ClusterCoordinator {
         }
         const pendingPeers = new Set(missingPeers);
         const baseInterval = existing ? Math.min(existing.intervalMs * this.retryBackoffFactor, this.retryMaxIntervalMs) : this.retryInitialIntervalMs;
-        if (existing?.timer) {
-            clearTimeout(existing.timer);
-        }
-        const timer = setTimeout(() => {
+        existing?.cancel?.();
+        const cancel = this.setTimer(() => {
             void this.retryCommits(messageHash);
         }, baseInterval);
         state.retry = {
             pendingPeers,
             attempt: nextAttempt,
             intervalMs: baseInterval,
-            timer
+            cancel
         };
         this.persistCoordinatorState(messageHash, state.record, 'broadcasting', {
             pendingPeers: Array.from(pendingPeers),
@@ -651,12 +701,10 @@ export class ClusterCoordinator {
         if (!state?.retry) {
             return;
         }
-        if (state.retry.timer) {
-            clearTimeout(state.retry.timer);
-        }
+        state.retry.cancel?.();
         state.retry = undefined;
         // Clean up the transaction after retry is complete
-        setTimeout(() => {
+        this.setTimer(() => {
             this.transactions.delete(messageHash);
             this.deleteCoordinatorState(messageHash);
             log('cluster-tx:transaction-remove', {
@@ -672,7 +720,7 @@ export class ClusterCoordinator {
         this.stateStore.saveCoordinatorState(messageHash, {
             messageHash,
             record,
-            lastUpdate: Date.now(),
+            lastUpdate: this.now(),
             phase,
             retryState
         }).catch(err => log('cluster-tx:persist-error', { messageHash, error: err.message }));
@@ -695,7 +743,7 @@ export class ClusterCoordinator {
         for (const state of states) {
             const { messageHash } = state;
             // Expired — clean up
-            if (state.record.message.expiration && state.record.message.expiration < Date.now()) {
+            if (state.record.message.expiration && state.record.message.expiration < this.now()) {
                 log('cluster-tx:recovery-expired', { messageHash });
                 await this.stateStore.deleteCoordinatorState(messageHash);
                 continue;