@peerbit/pubsub 5.4.8 → 5.4.11

package/dist/src/index.js

@@ -144,6 +144,8 @@ const TOPIC_ROOT_QUERY_ROUND_TIMEOUT_MS = 3_000;
 const TOPIC_ROOT_HOST_SCAN_TIMEOUT_MS = DEFAULT_TOPIC_ROOT_QUERY_TIMEOUT_MS;
 const TOPIC_ROOT_HOST_SCAN_CONCURRENCY = 8;
 const DIRECT_SHARD_ROOT_CONFIRM_TIMEOUT_MS = 2_000;
+const RELAY_ROOT_PREFLIGHT_TIMEOUT_MS = 2_000;
+const RELAY_ROOT_PREFLIGHT_REUSE_MS = 2_000;
 const DEFAULT_PUBSUB_FANOUT_CHANNEL_OPTIONS = {
     msgRate: 30,
     msgSize: 1024,
@@ -225,9 +227,9 @@ export class TopicControlPlane extends DirectStream {
     hostOwnedShardRootsInFlight;
     hostOwnedShardRootsDirty = false;
     signedTopicRootCandidateClaims = new Map();
-    // A directly observed departure makes only that origin's current lease
-    // ineffective locally. This is not a component-wide withdrawal: claims learned
-    // only through relays keep their existing lease semantics. Keeping the verified
+    relayRootProbeCohort;
+    // Locally observed unreachability makes only that origin's current lease
+    // ineffective locally. This is not a component-wide withdrawal. Keeping the verified
     // bytes + replay floor prevents a relay from resurrecting the departed lease;
     // the map is bounded by the same retained-origin cap as the claim map.
     suppressedDepartedTopicRootCandidateClaims = new Map();
@@ -245,6 +247,34 @@ export class TopicControlPlane extends DirectStream {
         refilledAt: Date.now(),
     };
     _onFanoutPeerUnreachable;
+    onFanoutAttached = (ev) => {
+        const st = this.fanoutChannels.get(ev.detail.topic);
+        if (!st || st.root !== ev.detail.root)
+            return;
+        // A successful publish before attachment may have had no listeners.
+        // Coalesce attachment bursts, retaining one trailing pass during a send.
+        st.announceDirty = true;
+        if (st.announceTask)
+            return;
+        const revision = this.topicControlPlaneLifecycleRevision;
+        st.announceTask = Promise.resolve()
+            .then(async () => {
+            await st.join;
+            while (st.announceDirty &&
+                this.isFanoutChannelCurrent(ev.detail.topic, st.channel, revision)) {
+                st.announceDirty = false;
+                await this.announceShardSubscriptions(ev.detail.topic, revision);
+            }
+        })
+            .catch(logErrorIfStarted)
+            .finally(() => {
+            st.announceTask = undefined;
+            if (st.announceDirty &&
+                this.isFanoutChannelCurrent(ev.detail.topic, st.channel, revision)) {
+                this.onFanoutAttached(ev);
+            }
+        });
+    };
     fanoutChannels = new Map();
     ensureFanoutChannelInFlight = new Map();
     pendingTopicRootQueries = new Map();
@@ -387,6 +417,8 @@ export class TopicControlPlane extends DirectStream {
         this._onFanoutPeerUnreachable =
             this._onFanoutPeerUnreachable || this.onFanoutPeerUnreachable.bind(this);
         await this.fanout.addEventListener("fanout:peer-unreachable", this._onFanoutPeerUnreachable);
+        this.fanout.addEventListener("fanout:joined", this.onFanoutAttached);
+        this.fanout.addEventListener("fanout:child-joined", this.onFanoutAttached);
         await super.start();
         if (this.autoTopicRootCandidates) {
             let retryDelayMs = 0;
@@ -427,9 +459,10 @@ export class TopicControlPlane extends DirectStream {
         if (this._onFanoutPeerUnreachable) {
             this.fanout.removeEventListener("fanout:peer-unreachable", this._onFanoutPeerUnreachable);
         }
+        this.fanout.removeEventListener("fanout:joined", this.onFanoutAttached);
+        this.fanout.removeEventListener("fanout:child-joined", this.onFanoutAttached);
         for (const st of this.fanoutChannels.values()) {
-            if (st.idleCloseTimeout)
-                clearTimeout(st.idleCloseTimeout);
+            this.clearFanoutIdleClose(st);
             try {
                 st.channel.removeEventListener("data", st.onData);
             }
@@ -492,22 +525,23 @@ export class TopicControlPlane extends DirectStream {
             this.rebuildAutoTopicRootCandidatesFromClaims(BigInt(Date.now()), {
                 immediate: hadSignedPeer !== hasSignedPeer,
             });
-            if (peer.protocol === TOPIC_CONTROL_PLANE_PROTOCOL_V2_1) {
-                const sendWhenOutboundReady = () => {
-                    if (!this.autoTopicRootCandidates ||
-                        this.peers.get(publicKey.hashcode()) !== peer) {
-                        return;
-                    }
-                    void this.sendAutoTopicRootCandidates([peer]).catch(() => { });
-                };
-                if (peer.isWritable) {
-                    void this.sendAutoTopicRootCandidates([peer]).catch(() => { });
-                }
-                if (existingPeer !== peer) {
-                    peer.addEventListener("stream:outbound", sendWhenOutboundReady);
-                    peer.addEventListener("close", () => peer.removeEventListener("stream:outbound", sendWhenOutboundReady), { once: true });
-                }
+        }
+        const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
+        const sendWhenOutboundReady = () => {
+            if (!this.isTopicControlPlaneActive(lifecycleRevision) ||
+                this.peers.get(publicKey.hashcode()) !== peer)
+                return;
+            if (this.autoTopicRootCandidates &&
+                peer.protocol === TOPIC_CONTROL_PLANE_PROTOCOL_V2_1) {
+                void this.sendAutoTopicRootCandidates([peer]).catch(() => { });
             }
+            void this.announceDirectSubscriptions([...this.subscriptions.keys()], [peer]).catch(logErrorIfStarted);
+        };
+        if (peer.isWritable)
+            sendWhenOutboundReady();
+        if (existingPeer !== peer) {
+            peer.addEventListener("stream:outbound", sendWhenOutboundReady);
+            peer.addEventListener("close", () => peer.removeEventListener("stream:outbound", sendWhenOutboundReady), { once: true });
         }
         return peer;
     }
@@ -525,15 +559,7 @@ export class TopicControlPlane extends DirectStream {
             protocol === TOPIC_CONTROL_PLANE_PROTOCOL_V2_1 &&
             this.signedTopicRootCandidateClaims.has(hash)) {
             const claim = this.signedTopicRootCandidateClaims.get(hash);
-            const suppressed = this.suppressedDepartedTopicRootCandidateClaims.get(hash);
-            suppressedDepartedOrigin =
-                !suppressed ||
-                    suppressed.timestamp !== claim.timestamp ||
-                    !bytesEqual(suppressed.bytes, claim.bytes);
-            this.suppressedDepartedTopicRootCandidateClaims.set(hash, {
-                bytes: claim.bytes,
-                timestamp: claim.timestamp,
-            });
+            suppressedDepartedOrigin = this.suppressTopicRootCandidateClaim(hash, claim);
         }
         if (this.autoTopicRootCandidates &&
             (protocol === TOPIC_CONTROL_PLANE_PROTOCOL_V2_0 ||
@@ -577,6 +603,8 @@ export class TopicControlPlane extends DirectStream {
         }
     }
     clearSignedTopicRootCandidateState() {
+        this.relayRootProbeCohort?.controller.abort(new AbortError("topic root candidate recovery stopped"));
+        this.relayRootProbeCohort = undefined;
         this.clearTopicRootCandidateClaimTimer();
         this.signedTopicRootCandidateClaims.clear();
         this.suppressedDepartedTopicRootCandidateClaims.clear();
@@ -863,6 +891,264 @@ export class TopicControlPlane extends DirectStream {
         return (suppressed?.timestamp === claim.timestamp &&
             bytesEqual(suppressed.bytes, claim.bytes));
     }
+    suppressTopicRootCandidateClaim(origin, claim) {
+        if (!this.autoTopicRootCandidates ||
+            origin === this.publicKeyHash ||
+            this.peers.has(origin) ||
+            this.signedTopicRootCandidateClaims.get(origin) !== claim ||
+            this.isDepartedTopicRootCandidateClaimSuppressed(origin, claim))
+            return false;
+        this.suppressedDepartedTopicRootCandidateClaims.set(origin, {
+            bytes: claim.bytes,
+            timestamp: claim.timestamp,
+        });
+        return true;
+    }
+    topicRootRouteObservations(origin) {
+        return this.routes
+            .getRouteHints(this.publicKeyHash, origin)
+            .map((hint) => JSON.stringify([hint.nextHop, hint.session, hint.updatedAt]));
+    }
+    createRelayRootProbeCohort(claims) {
+        const previous = this.relayRootProbeCohort?.results;
+        const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
+        const controller = new AbortController();
+        const users = new Set();
+        const deadline = new AbortError("relay root reachability deadline reached");
+        const timer = setTimeout(() => controller.abort(deadline), RELAY_ROOT_PREFLIGHT_TIMEOUT_MS);
+        timer.unref?.();
+        let resolveRetry;
+        const retryBoundary = new Promise((resolve) => {
+            resolveRetry = resolve;
+        });
+        const retryTimer = setTimeout(resolveRetry, RELAY_ROOT_PREFLIGHT_TIMEOUT_MS / 2);
+        retryTimer.unref?.();
+        const captured = claims.map(([origin, claim]) => ({
+            origin,
+            claim,
+            routes: this.topicRootRouteObservations(origin),
+        }));
+        const cohort = {
+            controller,
+            users,
+            lifecycleRevision,
+            promise: Promise.resolve()
+                .then(async () => {
+                const outcomes = await Promise.all(captured.map(async ({ origin, claim, routes }) => {
+                    const cached = previous?.get(origin);
+                    if (cached?.claim === claim &&
+                        cached.status === "alive" &&
+                        performance.now() - cached.observedAt <
+                            RELAY_ROOT_PREFLIGHT_REUSE_MS)
+                        return [origin, { ...cached, routes }];
+                    const winner = new AbortController();
+                    const signals = linkAbortSignals([
+                        controller.signal,
+                        winner.signal,
+                    ]);
+                    let alive = false;
+                    let resolveAlive;
+                    const firstSuccess = new Promise((resolve) => {
+                        resolveAlive = resolve;
+                    });
+                    const probe = async (retry) => {
+                        const signal = signals.signal;
+                        let submitted = false;
+                        try {
+                            if (retry)
+                                await withAbort(retryBoundary, signal);
+                            throwIfAborted(signal);
+                            if (alive)
+                                return "alive";
+                            const message = await withAbort(this.createMessage(undefined, {
+                                mode: new AcknowledgeDelivery({
+                                    to: [origin],
+                                    redundancy: 1,
+                                }),
+                                priority: 1,
+                                responsePriority: 1,
+                            }), signal);
+                            // Signers may ignore cancellation. Fence the send continuation.
+                            throwIfAborted(signal);
+                            if (alive)
+                                return "alive";
+                            if (!this.isTopicControlPlaneActive(lifecycleRevision) ||
+                                ![...users].some((current) => current())) {
+                                return "unknown";
+                            }
+                            // No transport neighbor is local readiness, not proof of origin death.
+                            if (this.peers.size === 0)
+                                return "unknown";
+                            submitted = true;
+                            await withAbort(this.publishMessage(this.publicKey, message, undefined, undefined, signal), signal);
+                            throwIfAborted(signal);
+                            alive = true;
+                            resolveAlive("alive");
+                            return "alive";
+                        }
+                        catch (error) {
+                            if (submitted &&
+                                (error === deadline || error instanceof DeliveryError))
+                                return "failed";
+                            else if (!signal.aborted)
+                                throw error;
+                            return "unknown";
+                        }
+                    };
+                    // Hedge once at the shared midpoint without discarding the first
+                    // authenticated ACK wait: a 1.5s first reply is still timely.
+                    let status;
+                    try {
+                        status = await Promise.race([
+                            firstSuccess,
+                            Promise.all([probe(false), probe(true)]).then((results) => results.includes("unknown")
+                                ? "unknown"
+                                : "failed"),
+                        ]);
+                    }
+                    finally {
+                        winner.abort(new AbortError("origin probe settled"));
+                        signals.clear();
+                    }
+                    return [
+                        origin,
+                        { claim, routes, status, observedAt: performance.now() },
+                    ];
+                }));
+                cohort.results = new Map(outcomes);
+                return cohort.results;
+            })
+                .finally(() => {
+                clearTimeout(timer);
+                clearTimeout(retryTimer);
+                controller.abort(new AbortError("relay root probes settled"));
+            }),
+        };
+        this.relayRootProbeCohort = cohort;
+        return cohort;
+    }
+    async preflightRelayRootCandidates(shardTopic, attempt, signal, isCurrent, localPolicyOnly = false) {
+        throwIfAborted(signal);
+        const revision = this.topicControlPlaneLifecycleRevision;
+        const current = () => isCurrent() && this.isTopicControlPlaneActive(revision);
+        if (!current())
+            throw new AbortError("obsolete relay root recovery");
+        if (!this.autoTopicRootCandidates ||
+            this.maybeDisableAutoTopicRootCandidatesIfExternallyConfigured())
+            return false;
+        const claims = [...this.signedTopicRootCandidateClaims.entries()]
+            .filter(([origin, claim]) => origin !== this.publicKeyHash &&
+            !this.peers.has(origin) &&
+            !this.isDepartedTopicRootCandidateClaimSuppressed(origin, claim))
+            .slice(0, TOPIC_ROOT_CANDIDATES_MAX);
+        if (claims.length === 0)
+            return false;
+        const shared = this.relayRootProbeCohort;
+        const cohort = (attempt.cohort ??=
+            shared &&
+                (shared.results
+                    ? shared.users.size > 0
+                    : !shared.controller.signal.aborted) &&
+                shared.lifecycleRevision === revision
+                ? shared
+                : this.createRelayRootProbeCohort(claims));
+        cohort.users.add(current);
+        let held = true;
+        const release = () => {
+            if (!held)
+                return;
+            held = false;
+            cohort.users.delete(current);
+            if (cohort.users.size === 0 && !cohort.results) {
+                cohort.controller.abort(new AbortError("relay root recovery cancelled"));
+            }
+        };
+        signal?.addEventListener("abort", release, { once: true });
+        try {
+            const outcomes = await withAbort(cohort.promise, signal);
+            throwIfAborted(signal);
+            if (!current())
+                throw new AbortError("obsolete relay root recovery");
+            // Policy setters do not share the candidate generation. Re-read configured
+            // roots/resolvers/trackers after observation; a stalled policy is unknown,
+            // never evidence authorizing local suppression.
+            attempt.policyDeadline ??=
+                performance.now() + RELAY_ROOT_PREFLIGHT_TIMEOUT_MS;
+            return await this.withRelayRootPolicyDeadline(attempt, signal, async (policySignal) => {
+                const configured = await withAbort(localPolicyOnly
+                    ? this.topicRootControlPlane.resolveLocalTopicRoot(shardTopic, {
+                        signal: policySignal,
+                    })
+                    : this.topicRootControlPlane.resolveTrackedTopicRoot(shardTopic, {
+                        signal: policySignal,
+                    }), policySignal);
+                throwIfAborted(policySignal);
+                if (!current())
+                    throw new AbortError("obsolete relay root recovery");
+                this.shardRootCache.delete(shardTopic);
+                if (configured ||
+                    this.topicRootControlPlane.getTopicRoot(shardTopic) ||
+                    !this.autoTopicRootCandidates ||
+                    this.maybeDisableAutoTopicRootCandidatesIfExternallyConfigured())
+                    return true;
+                let changed = false;
+                let unknown = false;
+                for (const [origin, claim] of claims) {
+                    if (this.peers.has(origin) ||
+                        this.isDepartedTopicRootCandidateClaimSuppressed(origin, claim))
+                        continue;
+                    const observed = outcomes.get(origin);
+                    if (this.signedTopicRootCandidateClaims.get(origin) !== claim ||
+                        observed?.claim !== claim) {
+                        unknown = true;
+                        continue;
+                    }
+                    const freshRoute = this.routes.isReachable(this.publicKeyHash, origin) &&
+                        this.topicRootRouteObservations(origin).some((route) => !observed.routes.includes(route));
+                    if (freshRoute || observed.status === "alive")
+                        continue;
+                    if (observed.status === "unknown")
+                        unknown = true;
+                    else
+                        changed =
+                            this.suppressTopicRootCandidateClaim(origin, claim) || changed;
+                }
+                if (changed)
+                    this.rebuildAutoTopicRootCandidatesFromClaims(BigInt(Date.now()), {
+                        immediate: true,
+                    });
+                if (unknown)
+                    throw new DeliveryError("Relay root reachability could not be established");
+                return true;
+            });
+        }
+        finally {
+            signal?.removeEventListener("abort", release);
+            release();
+        }
+    }
+    async withRelayRootPolicyDeadline(attempt, signal, resolve) {
+        // Ordinary initial resolution retains its existing contract. Only work
+        // following a probe shares the one additional policy budget, including retries.
+        if (attempt.policyDeadline === undefined)
+            return resolve(signal);
+        throwIfAborted(signal);
+        const remaining = attempt.policyDeadline - performance.now();
+        const deadline = new AbortError("relay root policy recheck deadline reached");
+        if (remaining <= 0)
+            throw deadline;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(deadline), remaining);
+        timer.unref?.();
+        const signals = linkAbortSignals([signal, controller.signal]);
+        try {
+            return await withAbort(resolve(signals.signal), signals.signal);
+        }
+        finally {
+            clearTimeout(timer);
+            signals.clear();
+        }
+    }
     canAdvanceTopicRootCandidateClaimReplayFloor(origin, timestamp) {
         const floor = this.topicRootCandidateClaimReplayFloors.get(origin);
         if (floor !== undefined) {
@@ -923,7 +1209,7 @@ export class TopicControlPlane extends DirectStream {
         this.topicRootCandidateClaimGlobalVerifyBudget.remaining -= 1;
         return true;
     }
-    async importSignedTopicRootCandidateClaim(rawClaim, outerPeerHash, expectedPeer) {
+    async importSignedTopicRootCandidateClaim(rawClaim, outerPeerHash, expectedPeer, batchUpdate) {
         const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
         if (rawClaim.byteLength === 0 ||
             rawClaim.byteLength > TOPIC_ROOT_CANDIDATE_CLAIM_MAX_BYTES) {
@@ -962,7 +1248,13 @@ export class TopicControlPlane extends DirectStream {
         if (acceptanceDeadline === undefined) {
             return false;
         }
-        this.rebuildAutoTopicRootCandidatesFromClaims(now);
+        if (batchUpdate) {
+            if (this.pruneExpiredTopicRootCandidateClaims(now))
+                batchUpdate.immediate = true;
+        }
+        else {
+            this.rebuildAutoTopicRootCandidatesFromClaims(now);
+        }
         const retained = this.signedTopicRootCandidateClaims.get(origin);
         if (outerPeerHash === origin &&
             expectedPeer !== undefined &&
@@ -980,7 +1272,10 @@ export class TopicControlPlane extends DirectStream {
             // monotonic acceptance deadline. A current authenticated origin stream is
             // sufficient liveness evidence; do not advance the floor or lease.
             this.suppressedDepartedTopicRootCandidateClaims.delete(origin);
-            this.rebuildAutoTopicRootCandidatesFromClaims(now, { immediate: true });
+            if (batchUpdate)
+                batchUpdate.immediate = true;
+            else
+                this.rebuildAutoTopicRootCandidatesFromClaims(now, { immediate: true });
             return false;
         }
         if (!this.canAdvanceTopicRootCandidateClaimReplayFloor(origin, timestamp)) {
@@ -1224,6 +1519,7 @@ export class TopicControlPlane extends DirectStream {
     async reconcileShardOverlays() {
         if (!this.started || this.topicControlPlaneStopping)
             return;
+        const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
         const byShard = new Map();
         for (const topic of this.subscriptions.keys()) {
             const shardTopic = this.getShardTopicForUserTopic(topic);
@@ -1231,25 +1527,19 @@ export class TopicControlPlane extends DirectStream {
         }
         // Ensure shard overlays are joined using the current root mapping (may
         // migrate channels if roots changed), then re-announce subscriptions.
-        await Promise.all([...byShard.entries()].map(async ([shardTopic, userTopics]) => {
+        const results = await Promise.allSettled([...byShard.entries()].map(async ([shardTopic, userTopics]) => {
             if (userTopics.length === 0)
                 return;
-            await this.ensureFanoutChannel(shardTopic, { ephemeral: false });
-            const msg = new Subscribe({
-                topics: userTopics,
-                requestSubscribers: true,
-            });
-            const embedded = await this.createMessage(this.encodePubSubMessage(msg), {
-                mode: new AnyWhere(),
-                priority: 1,
-                skipRecipientValidation: true,
+            const owners = userTopics.map((topic) => [topic, this.subscriptions.get(topic)]);
+            await this.ensureFanoutChannel(shardTopic, {
+                ephemeral: false,
+                isCurrent: () => owners.some(([topic, owner]) => owner && this.subscriptions.get(topic) === owner),
             });
-            const st = this.fanoutChannels.get(shardTopic);
-            if (!st)
-                return;
-            await st.channel.publish(toUint8Array(embedded.bytes()));
-            this.touchFanoutChannel(shardTopic);
+            await this.announceShardSubscriptions(shardTopic, lifecycleRevision);
         }));
+        const failure = results.find((result) => result.status === "rejected");
+        if (failure?.status === "rejected")
+            throw failure.reason;
     }
     isTrackedTopic(topic) {
         return this.topics.has(topic);
@@ -1260,16 +1550,17 @@ export class TopicControlPlane extends DirectStream {
     untrackTopic(topic) {
         const peers = this.topics.get(topic);
         this.topics.delete(topic);
-        if (!peers)
-            return;
-        for (const peerHash of peers.keys()) {
+        for (const peerHash of peers?.keys() ?? []) {
             this.peerToTopic.get(peerHash)?.delete(topic);
-            this.lastSubscriptionMessages.get(peerHash)?.delete(topic);
             if (!this.peerToTopic.get(peerHash)?.size) {
                 this.peerToTopic.delete(peerHash);
-                this.lastSubscriptionMessages.delete(peerHash);
             }
         }
+        for (const [peerHash, messages] of this.lastSubscriptionMessages) {
+            messages.delete(topic);
+            if (messages.size === 0)
+                this.lastSubscriptionMessages.delete(peerHash);
+        }
     }
     initializePeer(publicKey) {
         // Remote subscribers can be non-neighbours (learned via relayed topic control).
@@ -1292,10 +1583,26 @@ export class TopicControlPlane extends DirectStream {
             this.lastSubscriptionMessages.get(oldest)?.delete(topic);
             if (!this.peerToTopic.get(oldest)?.size) {
                 this.peerToTopic.delete(oldest);
+            }
+            if (!this.lastSubscriptionMessages.get(oldest)?.size) {
                 this.lastSubscriptionMessages.delete(oldest);
             }
         }
     }
+    pruneUnsubscribedWatermarks(topic) {
+        let remaining = this.subscriberCacheMaxEntries;
+        for (const [peerHash, messages] of [
+            ...this.lastSubscriptionMessages,
+        ].reverse()) {
+            if (!messages.has(topic) || this.topics.get(topic)?.has(peerHash))
+                continue;
+            if (remaining-- > 0)
+                continue;
+            messages.delete(topic);
+            if (messages.size === 0)
+                this.lastSubscriptionMessages.delete(peerHash);
+        }
+    }
     getSubscriptionOverlap(topics) {
         const subscriptions = [];
         if (topics) {
@@ -1327,24 +1634,35 @@ export class TopicControlPlane extends DirectStream {
     }
     scheduleFanoutIdleClose(topic) {
         const st = this.fanoutChannels.get(topic);
-        if (!st || !st.ephemeral)
+        const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
+        if (!st ||
+            !st.ephemeral ||
+            !this.isTopicControlPlaneActive(lifecycleRevision))
             return;
         this.clearFanoutIdleClose(st);
         if (this.fanoutPublishIdleCloseMs <= 0)
             return;
-        st.idleCloseTimeout = setTimeout(() => {
-            const cur = this.fanoutChannels.get(topic);
-            if (!cur || !cur.ephemeral)
+        const timer = setTimeout(() => {
+            // Cancellation can race a queued callback. It must still own this exact
+            // timer, channel state and lifecycle before acting on the topic again.
+            if (!this.isTopicControlPlaneActive(lifecycleRevision) ||
+                this.fanoutChannels.get(topic) !== st ||
+                st.idleCloseTimeout !== timer ||
+                !st.ephemeral)
                 return;
-            const idleMs = Date.now() - cur.lastUsedAt;
+            st.idleCloseTimeout = undefined;
+            const idleMs = Date.now() - st.lastUsedAt;
             if (idleMs >= this.fanoutPublishIdleCloseMs) {
                 void this.closeFanoutChannel(topic);
                 return;
             }
             this.scheduleFanoutIdleClose(topic);
         }, this.fanoutPublishIdleCloseMs);
+        st.idleCloseTimeout = timer;
     }
-    touchFanoutChannel(topic) {
+    touchFanoutChannel(topic, channel, lifecycleRevision) {
+        if (!this.isFanoutChannelCurrent(topic, channel, lifecycleRevision))
+            return;
         const st = this.fanoutChannels.get(topic);
         if (!st)
             return;
@@ -1555,20 +1873,27 @@ export class TopicControlPlane extends DirectStream {
             topic.startsWith(this.shardTopicPrefix) &&
             deterministic &&
             root !== deterministic) {
-            return { root: deterministic, authoritative: false };
+            return { root: deterministic, authoritative: false, autoCandidate: true };
         }
-        return { root, authoritative: true };
+        return {
+            root,
+            authoritative: true,
+            autoCandidate: this.autoTopicRootCandidates &&
+                topic.startsWith(this.shardTopicPrefix) &&
+                root === deterministic,
+        };
     }
     async resolveTopicRootState(topic, options) {
         throwIfAborted(options?.signal);
         const tracked = await this.topicRootControlPlane.resolveTrackedTopicRoot(topic, options);
         if (tracked) {
-            return { root: tracked, authoritative: true };
+            return { root: tracked, authoritative: true, autoCandidate: false };
         }
         if (options?.queryConnectedPeers === false) {
             return {
                 root: this.topicRootControlPlane.resolveDeterministicTopicRoot(topic),
                 authoritative: false,
+                autoCandidate: this.autoTopicRootCandidates,
             };
         }
         const deadlineController = new AbortController();
@@ -1630,6 +1955,7 @@ export class TopicControlPlane extends DirectStream {
         return {
             root: this.topicRootControlPlane.resolveDeterministicTopicRoot(topic),
             authoritative: false,
+            autoCandidate: this.autoTopicRootCandidates,
         };
     }
     async resolveTopicRoot(topic, options) {
@@ -1658,7 +1984,11 @@ export class TopicControlPlane extends DirectStream {
                 ? undefined
                 : this.shardRootCache.get(shardTopic);
             if (cached && (cached.authoritative || !hasConnectedTrackers)) {
-                return { root: cached.root, candidateGeneration };
+                return {
+                    root: cached.root,
+                    candidateGeneration,
+                    autoCandidate: cached.autoCandidate,
+                };
             }
             const resolved = await this.resolveTopicRootState(shardTopic, options);
             this.assertTopicControlPlaneActive(lifecycleRevision);
@@ -1674,7 +2004,11 @@ export class TopicControlPlane extends DirectStream {
             else {
                 this.shardRootCache.delete(shardTopic);
             }
-            return { root: resolved.root, candidateGeneration };
+            return {
+                root: resolved.root,
+                candidateGeneration,
+                autoCandidate: resolved.autoCandidate,
+            };
         }
     }
     getConnectedTopicRootTrackers() {
@@ -1698,6 +2032,11 @@ export class TopicControlPlane extends DirectStream {
         } while (true);
     }
     async sendDirectControlMessage(peer, pubsubMessage, signal) {
+        const revision = this.topicControlPlaneLifecycleRevision;
+        const isCurrent = () => this.isTopicControlPlaneActive(revision) &&
+            this.peers.get(peer.publicKey.hashcode()) === peer;
+        if (!isCurrent())
+            return;
         const embedded = await this.createMessage(this.encodePubSubMessage(pubsubMessage), {
             mode: new SilentDelivery({
                 to: [peer.publicKey.hashcode()],
@@ -1706,7 +2045,9 @@ export class TopicControlPlane extends DirectStream {
             priority: 1,
             skipRecipientValidation: true,
         });
-        await this.publishMessage(this.publicKey, embedded, [peer], undefined, signal);
+        if (!isCurrent())
+            return;
+        await this.publishMessage(this.publicKey, embedded, [peer], undefined, signal ?? this.topicRootResolutionAbortController.signal);
     }
     resolvePendingTopicRootQuery(message, responderPeerHash) {
         const pending = this.pendingTopicRootQueries.get(message.requestId);
@@ -1812,20 +2153,43 @@ export class TopicControlPlane extends DirectStream {
             this.shardRootCache.set(shardTopic, {
                 root: resolved.root,
                 authoritative: true,
+                autoCandidate: resolved.autoCandidate,
             });
         }
         return resolved.root;
     }
-    async resolveQueryableTopicRoot(topic) {
+    async resolveQueryableTopicRoot(topic, isCurrent = () => true) {
         const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
         const lifecycleSignal = this.topicRootResolutionAbortController.signal;
+        const recovery = {};
         return this.withTopicRootCandidateResolution(async ({ candidateGeneration, signal }) => {
             throwIfAborted(signal);
             this.assertTopicControlPlaneActive(lifecycleRevision);
-            const root = await this.topicRootControlPlane.resolveCanonicalTopicRoot(topic, {
-                signal,
+            if (!isCurrent())
+                throw new AbortError("obsolete topic root query");
+            // Incoming queries retain canonical directory semantics: never ask
+            // trackers here, since a tracker may itself query this peer.
+            const resolveCanonical = () => this.withRelayRootPolicyDeadline(recovery, signal, async (policySignal) => {
+                const local = await this.topicRootControlPlane.resolveLocalTopicRoot(topic, {
+                    signal: policySignal,
+                });
+                return {
+                    root: local ??
+                        this.topicRootControlPlane.resolveDeterministicTopicRoot(topic),
+                    autoCandidate: !local && this.autoTopicRootCandidates,
+                };
             });
+            let resolved = await resolveCanonical();
+            if (resolved.autoCandidate && topic.startsWith(this.shardTopicPrefix)) {
+                if (await this.preflightRelayRootCandidates(topic, recovery, signal, isCurrent, true)) {
+                    throwIfAborted(signal);
+                    resolved = await resolveCanonical();
+                }
+            }
+            const root = resolved.root;
             this.assertTopicControlPlaneActive(lifecycleRevision);
+            if (!isCurrent())
+                throw new AbortError("obsolete topic root query");
             if (root !== this.publicKeyHash) {
                 return root;
             }
@@ -1925,8 +2289,11 @@ export class TopicControlPlane extends DirectStream {
     async ensureFanoutChannel(shardTopic, options) {
         const topic = shardTopic.toString();
         const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
+        const recovery = {};
         for (;;) {
             this.assertTopicControlPlaneActive(lifecycleRevision);
+            if (options?.isCurrent?.() === false)
+                throw new AbortError("obsolete fanout channel owner");
             if (options?.signal?.aborted) {
                 throw (options.signal.reason ??
                     new AbortError("fanout channel opening aborted"));
@@ -1934,7 +2301,8 @@ export class TopicControlPlane extends DirectStream {
             const candidateGeneration = this.getTopicRootCandidateGeneration();
             const active = this.ensureFanoutChannelInFlight.get(topic);
             if (active?.candidateGeneration === candidateGeneration &&
-                active.lifecycleRevision === lifecycleRevision) {
+                active.lifecycleRevision === lifecycleRevision &&
+                active.isCurrent()) {
                 try {
                     await withAbort(active.opening, options?.signal);
                 }
@@ -1942,6 +2310,10 @@ export class TopicControlPlane extends DirectStream {
                     if (options?.signal?.aborted)
                         throw error;
                     this.assertTopicControlPlaneActive(lifecycleRevision);
+                    if (candidateGeneration === this.getTopicRootCandidateGeneration() &&
+                        !active.abortController.signal.aborted &&
+                        active.isCurrent())
+                        throw error;
                 }
                 await withAbort(active.settled, options?.signal);
                 if (this.ensureFanoutChannelInFlight.get(topic) === active) {
@@ -1970,13 +2342,19 @@ export class TopicControlPlane extends DirectStream {
                     once: true,
                 });
             }
-            const opening = this.ensureFanoutChannelOnce(topic, { ...options, signal: abortController.signal }, lifecycleRevision, candidateGeneration);
+            // Publish the opening identity before even a synchronously resolved root
+            // can enter its guarded recovery/creation continuation.
+            const opening = Promise.resolve().then(() => this.ensureFanoutChannelOnce(topic, { ...options, signal: abortController.signal }, lifecycleRevision, candidateGeneration, recovery, () => this.ensureFanoutChannelInFlight.get(topic)?.abortController ===
+                abortController &&
+                !abortController.signal.aborted &&
+                options?.isCurrent?.() !== false));
             let resolveSettled;
             const settled = new Promise((resolve) => {
                 resolveSettled = resolve;
             });
             const inFlight = {
                 abortController,
+                isCurrent: () => options?.isCurrent?.() !== false,
                 candidateGeneration,
                 lifecycleRevision,
                 opening,
@@ -2019,7 +2397,7 @@ export class TopicControlPlane extends DirectStream {
             }
         }
     }
-    async ensureFanoutChannelOnce(shardTopic, options, lifecycleRevision, candidateGeneration) {
+    async ensureFanoutChannelOnce(shardTopic, options, lifecycleRevision, candidateGeneration, recovery = {}, isOpeningCurrent = () => true) {
         this.assertTopicControlPlaneActive(lifecycleRevision);
         if (candidateGeneration !== this.getTopicRootCandidateGeneration())
             return;
@@ -2038,15 +2416,16 @@ export class TopicControlPlane extends DirectStream {
         this.assertTopicControlPlaneActive(lifecycleRevision);
         let resolvedGeneration = candidateGeneration;
         let root = suppliedRoot;
+        let autoCandidate = false;
+        const resolveRoot = () => this.withRelayRootPolicyDeadline(recovery, options?.signal, (signal) => this.resolveShardRootState(t, { signal }));
         const existing = this.fanoutChannels.get(t);
         if (existing) {
             if (!root) {
-                const resolved = await this.resolveShardRootState(t, {
-                    signal: options?.signal,
-                });
+                const resolved = await resolveRoot();
                 this.assertTopicControlPlaneActive(lifecycleRevision);
                 root = resolved.root;
                 resolvedGeneration = resolved.candidateGeneration;
+                autoCandidate = resolved.autoCandidate;
             }
             if (resolvedGeneration !== candidateGeneration ||
                 candidateGeneration !== this.getTopicRootCandidateGeneration()) {
@@ -2080,15 +2459,30 @@ export class TopicControlPlane extends DirectStream {
             }
         }
         if (!root) {
-            const resolved = await this.resolveShardRootState(t, {
-                signal: options?.signal,
-            });
+            const resolved = await resolveRoot();
             this.assertTopicControlPlaneActive(lifecycleRevision);
             root = resolved.root;
             resolvedGeneration = resolved.candidateGeneration;
+            autoCandidate = resolved.autoCandidate;
+        }
+        if (autoCandidate &&
+            (await this.preflightRelayRootCandidates(t, recovery, options?.signal, isOpeningCurrent))) {
+            throwIfAborted(options?.signal);
+            if (candidateGeneration !== this.getTopicRootCandidateGeneration())
+                return;
+            const resolved = await resolveRoot();
+            root = resolved.root;
+            resolvedGeneration = resolved.candidateGeneration;
+            autoCandidate = resolved.autoCandidate;
+        }
+        if (suppliedRoot !== undefined ||
+            !this.autoTopicRootCandidates ||
+            autoCandidate) {
+            root = await this.confirmDirectShardRoot(t, root, resolvedGeneration, lifecycleRevision, options?.signal);
         }
-        root = await this.confirmDirectShardRoot(t, root, resolvedGeneration, lifecycleRevision, options?.signal);
         this.assertTopicControlPlaneActive(lifecycleRevision);
+        if (!isOpeningCurrent())
+            throw new AbortError("obsolete fanout channel owner");
         if (resolvedGeneration !== candidateGeneration ||
             candidateGeneration !== this.getTopicRootCandidateGeneration()) {
             return;
@@ -2272,7 +2666,7 @@ export class TopicControlPlane extends DirectStream {
         join
             .then(() => {
             const st = this.fanoutChannels.get(t);
-            if (st === channelState && st.ephemeral) {
+            if (st === channelState && st.ephemeral && isCurrent()) {
                 this.scheduleFanoutIdleClose(t);
             }
         })
@@ -2409,6 +2803,78 @@ export class TopicControlPlane extends DirectStream {
         this.initializeTopic(topic);
         return this.debounceSubscribeAggregator.add({ key: topic });
     }
+    async announceShardSubscriptions(shardTopic, lifecycleRevision) {
+        const st = this.fanoutChannels.get(shardTopic);
+        if (!st)
+            return;
+        let topics = [...this.subscriptions.entries()].filter(([topic]) => this.getShardTopicForUserTopic(topic) === shardTopic);
+        while (topics.length > 0 &&
+            this.isFanoutChannelCurrent(shardTopic, st.channel, lifecycleRevision)) {
+            const embedded = await this.createMessage(this.encodePubSubMessage(new Subscribe({
+                topics: topics.map(([topic]) => topic),
+                requestSubscribers: true,
+            })), {
+                mode: new AnyWhere(),
+                priority: 1,
+                skipRecipientValidation: true,
+            });
+            if (!this.isFanoutChannelCurrent(shardTopic, st.channel, lifecycleRevision))
+                return;
+            const current = topics.filter(([topic, sub]) => this.subscriptions.get(topic) === sub);
+            if (current.length !== topics.length) {
+                // Never announce a subscription removed while signing. This retry
+                // only shrinks the original batch, so churn cannot extend it forever.
+                topics = current;
+                continue;
+            }
+            await st.channel.publish(toUint8Array(embedded.bytes()));
+            if (this.isFanoutChannelCurrent(shardTopic, st.channel, lifecycleRevision)) {
+                this.touchFanoutChannel(shardTopic, st.channel, lifecycleRevision);
+            }
+            return;
+        }
+    }
+    async announceDirectSubscriptions(topics, peers = [...this.peers.values()], subscribed = true) {
+        const revision = this.topicControlPlaneLifecycleRevision;
+        const signal = this.topicRootResolutionAbortController.signal;
+        const subscriptions = new Map(topics.map((topic) => [topic, this.subscriptions.get(topic)]));
+        const isCurrentTopic = (topic) => subscribed
+            ? subscriptions.get(topic) != null &&
+                this.subscriptions.get(topic) === subscriptions.get(topic)
+            : !this.subscriptions.has(topic);
+        await Promise.all(peers
+            .map(async (peer) => {
+            const isCurrent = () => this.isTopicControlPlaneActive(revision) &&
+                this.peers.get(peer.publicKey.hashcode()) === peer &&
+                peer.isWritable;
+            let currentTopics = topics.filter(isCurrentTopic);
+            while (isCurrent() && currentTopics.length > 0) {
+                const embedded = await this.createMessage(this.encodePubSubMessage(subscribed
+                    ? new Subscribe({
+                        topics: currentTopics,
+                        requestSubscribers: true,
+                    })
+                    : new Unsubscribe({ topics: currentTopics })), {
+                    mode: new SilentDelivery({
+                        to: [peer.publicKey.hashcode()],
+                        redundancy: 1,
+                    }),
+                    priority: 1,
+                    skipRecipientValidation: true,
+                });
+                if (!isCurrent())
+                    return;
+                const remaining = currentTopics.filter(isCurrentTopic);
+                if (remaining.length !== currentTopics.length) {
+                    currentTopics = remaining;
+                    continue;
+                }
+                await this.publishMessage(this.publicKey, embedded, [peer], undefined, signal);
+                return;
+            }
+        })
+            .map((task) => task.catch(logErrorIfStarted)));
+    }
     async _subscribe(topics, lifecycleRevision = this.topicControlPlaneLifecycleRevision) {
         if (!this.started)
             throw new NotStartedError();
@@ -2417,7 +2883,6 @@ export class TopicControlPlane extends DirectStream {
         if (topics.length === 0)
             return;
         const byShard = new Map();
-        const joins = [];
         for (const { key: topic, counter } of topics) {
             let prev = this.subscriptions.get(topic);
             if (prev) {
@@ -2431,33 +2896,25 @@ export class TopicControlPlane extends DirectStream {
             const shardTopic = this.getShardTopicForUserTopic(topic);
             byShard.set(shardTopic, [...(byShard.get(shardTopic) ?? []), topic]);
             this.shardRefCounts.set(shardTopic, (this.shardRefCounts.get(shardTopic) ?? 0) + 1);
-            joins.push(this.ensureFanoutChannel(shardTopic));
         }
-        await Promise.all(joins);
-        if (!this.isTopicControlPlaneActive(lifecycleRevision))
-            return;
-        // Announce subscriptions per shard overlay.
-        await Promise.all([...byShard.entries()].map(async ([shardTopic, userTopics]) => {
-            if (userTopics.length === 0)
-                return;
-            const st = this.fanoutChannels.get(shardTopic);
-            if (!st)
-                throw new Error(`Fanout channel missing for shard: ${shardTopic}`);
-            const msg = new Subscribe({
-                topics: userTopics,
-                requestSubscribers: true,
-            });
-            const embedded = await this.createMessage(this.encodePubSubMessage(msg), {
-                mode: new AnyWhere(),
-                priority: 1,
-                skipRecipientValidation: true,
+        // Neighbours can use different root policies. Discover them independently
+        // of shard joins, without adopting or overriding either peer's root policy.
+        void this.announceDirectSubscriptions([...byShard.values()].flat()).catch(logErrorIfStarted);
+        const results = await Promise.allSettled([...byShard.keys()].map(async (shardTopic) => {
+            const owners = byShard
+                .get(shardTopic)
+                .map((topic) => [topic, this.subscriptions.get(topic)]);
+            await this.ensureFanoutChannel(shardTopic, {
+                isCurrent: () => owners.some(([topic, owner]) => owner && this.subscriptions.get(topic) === owner),
             });
-            if (!this.isFanoutChannelCurrent(shardTopic, st.channel, lifecycleRevision))
-                return;
-            await st.channel.publish(toUint8Array(embedded.bytes()));
-            if (this.isFanoutChannelCurrent(shardTopic, st.channel, lifecycleRevision))
-                this.touchFanoutChannel(shardTopic);
+            await this.announceShardSubscriptions(shardTopic, lifecycleRevision);
         }));
+        const failure = results.find((result) => result.status === "rejected");
+        if (failure?.status === "rejected") {
+            if (this.isTopicControlPlaneActive(lifecycleRevision))
+                this.scheduleReconcileShardOverlays();
+            throw failure.reason;
+        }
     }
     async unsubscribe(topic, options) {
         this.pendingSubscriptions.delete(topic);
@@ -2489,6 +2946,10 @@ export class TopicControlPlane extends DirectStream {
         const next = (this.shardRefCounts.get(shardTopic) ?? 0) - 1;
         if (next <= 0) {
             this.shardRefCounts.delete(shardTopic);
+            const opening = this.ensureFanoutChannelInFlight.get(shardTopic);
+            if (opening && !opening.isCurrent()) {
+                opening.abortController.abort(new AbortError("last shard subscription removed"));
+            }
         }
         else {
             this.shardRefCounts.set(shardTopic, next);
@@ -2506,12 +2967,14 @@ export class TopicControlPlane extends DirectStream {
             return;
         const byShard = new Map();
         for (const { key: topic } of topics) {
-            // If the topic got re-subscribed before this debounced batch ran, skip.
+            // A pending reopen must not erase the previous departure: its Subscribe
+            // shares the transport session and would otherwise only refresh the cache.
             if (this.subscriptions.has(topic))
                 continue;
             const shardTopic = this.getShardTopicForUserTopic(topic);
             byShard.set(shardTopic, [...(byShard.get(shardTopic) ?? []), topic]);
         }
+        void this.announceDirectSubscriptions([...byShard.values()].flat(), undefined, false).catch(logErrorIfStarted);
         await Promise.all([...byShard.entries()].map(async ([shardTopic, userTopics]) => {
             if (userTopics.length === 0)
                 return;
@@ -2532,7 +2995,7 @@ export class TopicControlPlane extends DirectStream {
                         .publish(toUint8Array(embedded.bytes()))
                         .catch(() => { });
                     if (this.isFanoutChannelCurrent(shardTopic, st.channel, lifecycleRevision))
-                        this.touchFanoutChannel(shardTopic);
+                        this.touchFanoutChannel(shardTopic, st.channel, lifecycleRevision);
                 }
             }
             catch {
@@ -2554,6 +3017,7 @@ export class TopicControlPlane extends DirectStream {
     async announcePeerUnavailable(publicKeyHash, batches) {
         if (!this.started)
             throw new NotStartedError();
+        const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
         const byShard = new Map();
         for (const batch of batches) {
             for (const topic of batch.topics) {
@@ -2596,7 +3060,7 @@ export class TopicControlPlane extends DirectStream {
                 const st = this.fanoutChannels.get(shardTopic);
                 if (st) {
                     void st.channel.publishMaybe(toUint8Array(embedded.bytes()));
-                    this.touchFanoutChannel(shardTopic);
+                    this.touchFanoutChannel(shardTopic, st.channel, lifecycleRevision);
                 }
             }
             catch {
@@ -2607,6 +3071,7 @@ export class TopicControlPlane extends DirectStream {
     async announcePeerUnavailableOnShard(publicKeyHash, shardTopic) {
         if (!this.started)
             throw new NotStartedError();
+        const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
         try {
             const msg = new PeerUnavailable({
                 publicKeyHash,
@@ -2623,7 +3088,7 @@ export class TopicControlPlane extends DirectStream {
             const st = this.fanoutChannels.get(shardTopic);
             if (st) {
                 void st.channel.publishMaybe(toUint8Array(embedded.bytes()));
-                this.touchFanoutChannel(shardTopic);
+                this.touchFanoutChannel(shardTopic, st.channel, lifecycleRevision);
             }
         }
         catch {
@@ -2675,6 +3140,7 @@ export class TopicControlPlane extends DirectStream {
     async requestSubscribers(topic, to) {
         if (!this.started)
             throw new NotStartedError();
+        const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
         if (topic == null)
             throw new Error("ERR_NOT_VALID_TOPIC");
         if (topic.length === 0)
@@ -2718,12 +3184,13 @@ export class TopicControlPlane extends DirectStream {
             else {
                 await st.channel.publish(payload);
             }
-            this.touchFanoutChannel(shardTopic);
+            this.touchFanoutChannel(shardTopic, st.channel, lifecycleRevision);
         }));
     }
     async publish(data, options) {
         if (!this.started)
             throw new NotStartedError();
+        const lifecycleRevision = this.topicControlPlaneLifecycleRevision;
         const topicsAll = options.topics?.map((x) => x.toString()) || [];
         const hasExplicitTOs = options?.mode && deliveryModeHasReceiver(options.mode);
         // Explicit recipients: use DirectStream delivery (no shard broadcast).
@@ -2802,7 +3269,7 @@ export class TopicControlPlane extends DirectStream {
                 throw new Error(`Fanout channel missing for shard: ${shardTopic}`);
             }
             await withAbort(st.channel.publish(payload), options?.signal);
-            this.touchFanoutChannel(shardTopic);
+            this.touchFanoutChannel(shardTopic, st.channel, lifecycleRevision);
         }));
         if (this.fanoutPublishIdleCloseMs == 0 ||
             this.fanoutPublishMaxEphemeralChannels == 0) {
@@ -2866,6 +3333,16 @@ export class TopicControlPlane extends DirectStream {
     }
     onPeerUnreachable(publicKeyHash) {
         super.onPeerUnreachable(publicKeyHash);
+        const claim = this.signedTopicRootCandidateClaims.get(publicKeyHash);
+        if (this.isTopicControlPlaneActive(this.topicControlPlaneLifecycleRevision) &&
+            !this.maybeDisableAutoTopicRootCandidatesIfExternallyConfigured() &&
+            claim &&
+            !this.routes.isReachable(this.publicKeyHash, publicKeyHash) &&
+            this.suppressTopicRootCandidateClaim(publicKeyHash, claim)) {
+            this.rebuildAutoTopicRootCandidatesFromClaims(BigInt(Date.now()), {
+                immediate: true,
+            });
+        }
         const key = this.peerKeyHashToPublicKey.get(publicKeyHash);
         if (!key) {
             return;
@@ -3149,14 +3626,20 @@ export class TopicControlPlane extends DirectStream {
     }
     async processDirectPubSubMessage(input) {
         const { pubsubMessage, message, from, stream } = input;
-        const isDirectRootControl = pubsubMessage instanceof TopicRootCandidates ||
+        if ((pubsubMessage instanceof Subscribe ||
+            pubsubMessage instanceof Unsubscribe) &&
+            this.peers.get(stream.publicKey.hashcode()) !== stream)
+            return;
+        const isBoundDirectControl = pubsubMessage instanceof TopicRootCandidates ||
             pubsubMessage instanceof TopicRootCandidateClaims ||
             pubsubMessage instanceof TopicRootQuery ||
-            pubsubMessage instanceof TopicRootQueryResponse;
-        const directRootSigner = isDirectRootControl
+            pubsubMessage instanceof TopicRootQueryResponse ||
+            pubsubMessage instanceof Subscribe ||
+            pubsubMessage instanceof Unsubscribe;
+        const directRootSigner = isBoundDirectControl
             ? message.header.signatures?.publicKeys[0]
             : undefined;
-        if (isDirectRootControl &&
+        if (isBoundDirectControl &&
             (!directRootSigner || !directRootSigner.equals(stream.publicKey))) {
             return;
         }
@@ -3174,14 +3657,21 @@ export class TopicControlPlane extends DirectStream {
                 return;
             }
             const imported = [];
+            const batchUpdate = { immediate: false };
+            const revision = this.topicControlPlaneLifecycleRevision;
             const outerPeerHash = stream.publicKey.hashcode();
             for (const claim of pubsubMessage.claims) {
-                if (await this.importSignedTopicRootCandidateClaim(claim, outerPeerHash, stream)) {
+                if (await this.importSignedTopicRootCandidateClaim(claim, outerPeerHash, stream, batchUpdate)) {
                     imported.push(claim);
                 }
             }
+            if (!this.isTopicControlPlaneActive(revision) ||
+                this.peers.get(outerPeerHash) !== stream)
+                return;
+            if (imported.length > 0 || batchUpdate.immediate) {
+                this.rebuildAutoTopicRootCandidatesFromClaims(BigInt(Date.now()), batchUpdate);
+            }
             if (imported.length > 0) {
-                this.rebuildAutoTopicRootCandidatesFromClaims();
                 // Relay the exact nested claims; no relay signature is substituted for
                 // their origin signatures.
                 void this.sendSignedTopicRootCandidateClaims(imported, [...this.peers.values()].filter((peer) => peer.publicKey.hashcode() !== outerPeerHash)).catch(() => { });
@@ -3189,7 +3679,7 @@ export class TopicControlPlane extends DirectStream {
             return;
         }
         if (pubsubMessage instanceof TopicRootQuery) {
-            const root = await this.resolveQueryableTopicRoot(pubsubMessage.topic);
+            const root = await this.resolveQueryableTopicRoot(pubsubMessage.topic, () => this.peers.get(from.hashcode()) === stream);
             await this.sendDirectControlMessage(stream, new TopicRootQueryResponse({
                 requestId: pubsubMessage.requestId,
                 topic: pubsubMessage.topic,
@@ -3250,6 +3740,10 @@ export class TopicControlPlane extends DirectStream {
             }
             return;
         }
+        if (pubsubMessage instanceof Unsubscribe) {
+            this.processUnsubscribeMessage(message, pubsubMessage, from);
+            return;
+        }
         if (pubsubMessage instanceof GetSubscribers) {
             const overlap = this.getSubscriptionOverlap(pubsubMessage.topics);
             if (overlap.length === 0)
@@ -3270,6 +3764,35 @@ export class TopicControlPlane extends DirectStream {
             return;
         }
     }
+    processUnsubscribeMessage(message, unsubscribe, from) {
+        const senderKey = from.hashcode();
+        const relevantTopics = unsubscribe.topics.filter((topic) => this.isTrackedTopic(topic));
+        if (!relevantTopics.length ||
+            !this.subscriptionMessageIsLatest(message, unsubscribe, relevantTopics))
+            return;
+        const changed = [];
+        for (const topic of relevantTopics) {
+            if (this.topics.get(topic)?.delete(senderKey)) {
+                changed.push(topic);
+                this.peerToTopic.get(senderKey)?.delete(topic);
+            }
+        }
+        if (!this.peerToTopic.get(senderKey)?.size) {
+            this.peerToTopic.delete(senderKey);
+        }
+        // Independent direct/shard paths may deliver an older Subscribe later.
+        // Retain recent unsubscribe floors, bounded separately from live subscribers.
+        const messages = this.lastSubscriptionMessages.get(senderKey);
+        this.lastSubscriptionMessages.delete(senderKey);
+        this.lastSubscriptionMessages.set(senderKey, messages);
+        for (const topic of relevantTopics)
+            this.pruneUnsubscribedWatermarks(topic);
+        if (changed.length > 0) {
+            this.dispatchEvent(new CustomEvent("unsubscribe", {
+                detail: new UnsubcriptionEvent(from, changed, "remote-unsubscribe"),
+            }));
+        }
+    }
     async processShardPubSubMessage(input) {
         const { pubsubMessage, message, from, shardTopic, isCurrent } = input;
         if (isCurrent?.() === false)
@@ -3331,31 +3854,7 @@ export class TopicControlPlane extends DirectStream {
             return;
         }
         if (pubsubMessage instanceof Unsubscribe) {
-            const sender = from;
-            const senderKey = sender.hashcode();
-            const relevantTopics = pubsubMessage.topics.filter((t) => this.isTrackedTopic(t));
-            if (relevantTopics.length > 0 &&
-                this.subscriptionMessageIsLatest(message, pubsubMessage, relevantTopics)) {
-                const changed = [];
-                for (const topic of relevantTopics) {
-                    const peers = this.topics.get(topic);
-                    if (!peers)
-                        continue;
-                    if (peers.delete(senderKey)) {
-                        changed.push(topic);
-                        this.peerToTopic.get(senderKey)?.delete(topic);
-                    }
-                }
-                if (!this.peerToTopic.get(senderKey)?.size) {
-                    this.peerToTopic.delete(senderKey);
-                    this.lastSubscriptionMessages.delete(senderKey);
-                }
-                if (changed.length > 0) {
-                    this.dispatchEvent(new CustomEvent("unsubscribe", {
-                        detail: new UnsubcriptionEvent(sender, changed, "remote-unsubscribe"),
-                    }));
-                }
-            }
+            this.processUnsubscribeMessage(message, pubsubMessage, from);
             return;
         }
         if (pubsubMessage instanceof PeerUnavailable) {
@@ -3448,6 +3947,7 @@ export class TopicControlPlane extends DirectStream {
             !(pubsubMessage instanceof TopicRootQuery) &&
             !(pubsubMessage instanceof GetSubscribers) &&
             !(pubsubMessage instanceof Subscribe) &&
+            !(pubsubMessage instanceof Unsubscribe) &&
             !(pubsubMessage instanceof TopicRootQueryResponse)) {
             return true;
         }