@peerbit/shared-log 13.1.0 → 13.1.2

package/dist/src/index.js

@@ -54,7 +54,7 @@ import { CPUUsageIntervalLag } from "./cpu.js";
 import { debouncedAccumulatorMap, } from "./debounce.js";
 import { NoPeersError } from "./errors.js";
 const getSharedLogFanoutService = (services) => services.fanout;
-import { EntryWithRefs, ExchangeHeadsMessage, RequestIPrune, ResponseIPrune, createExchangeHeadsMessages, } from "./exchange-heads.js";
+import { EXCHANGE_HEADS_REPAIR_HINT, EntryWithRefs, ExchangeHeadsMessage, RequestIPrune, ResponseIPrune, createExchangeHeadsMessages, } from "./exchange-heads.js";
 import { FanoutEnvelope } from "./fanout-envelope.js";
 import { MAX_U32, MAX_U64, bytesToNumber, createNumbers, denormalizer, } from "./integers.js";
 import { TransportMessage } from "./message.js";
@@ -66,7 +66,7 @@ import {} from "./replication-domain.js";
 import { AbsoluteReplicas, AddedReplicationSegmentMessage, AllReplicatingSegmentsMessage, MinReplicas, ReplicationPingMessage, ReplicationError, RequestReplicationInfoMessage, ResponseRoleMessage, StoppedReplicating, decodeReplicas, encodeReplicas, maxReplicas, } from "./replication.js";
 import { Observer, Replicator } from "./role.js";
 import { RatelessIBLTSynchronizer } from "./sync/rateless-iblt.js";
-import { SimpleSyncronizer } from "./sync/simple.js";
+import { ConfirmEntriesMessage, SimpleSyncronizer } from "./sync/simple.js";
 import { groupByGid } from "./utils.js";
 const toLocalPublicSignKey = (key) => {
     if (typeof key === "string") {
@@ -263,10 +263,95 @@ const REPLICATOR_LIVENESS_PROBE_FAILURES_TO_EVICT = 2;
 // Churn/join repair can race with pruning and transient missed sync requests under
 // heavy event-loop load. Keep retries alive with a longer tail so reassigned
 // entries are retried after short bursts and slower recovery windows.
-const FORCE_FRESH_RETRY_SCHEDULE_MS = [
+const CHURN_REPAIR_RETRY_SCHEDULE_MS = [
     0, 1_000, 3_000, 7_000, 15_000, 30_000, 45_000,
 ];
-const JOIN_WARMUP_RETRY_SCHEDULE_MS = [0, 1_000, 3_000, 7_000, 15_000];
+const JOIN_WARMUP_RETRY_SCHEDULE_MS = [
+    0,
+    1_000,
+    3_000,
+    7_000,
+    15_000,
+    30_000,
+    60_000,
+];
+const JOIN_AUTHORITATIVE_RETRY_SCHEDULE_MS = [
+    0,
+    1_000,
+    3_000,
+    7_000,
+    15_000,
+    30_000,
+    60_000,
+];
+const APPEND_BACKFILL_RETRY_SCHEDULE_MS = [0, 1_000, 3_000, 7_000];
+const JOIN_AUTHORITATIVE_REPAIR_DELAY_MS = 2_000;
+const JOIN_AUTHORITATIVE_REPAIR_SWEEP_DELAYS_MS = [
+    JOIN_AUTHORITATIVE_REPAIR_DELAY_MS,
+    7_000,
+    15_000,
+    30_000,
+];
+const APPEND_BACKFILL_DELAY_MS = 500;
+const ASSUME_SYNCED_REPAIR_SUPPRESSION_MS = 5_000;
+const REPAIR_CONFIRMATION_HASH_BATCH_SIZE = 1_024;
+const REPAIR_DISPATCH_MODES = [
+    "join-warmup",
+    "join-authoritative",
+    "append-backfill",
+    "churn",
+];
+const createRepairMetricBucket = () => ({
+    dispatches: 0,
+    entries: 0,
+    ratelessFirstPasses: 0,
+    simpleFallbackPasses: 0,
+});
+const createRepairMetrics = () => ({
+    "join-warmup": createRepairMetricBucket(),
+    "join-authoritative": createRepairMetricBucket(),
+    "append-backfill": createRepairMetricBucket(),
+    churn: createRepairMetricBucket(),
+});
+const createRepairPendingPeersByMode = () => new Map(REPAIR_DISPATCH_MODES.map((mode) => [mode, new Set()]));
+const cloneRepairPendingPeersByMode = (pending) => new Map(REPAIR_DISPATCH_MODES.map((mode) => [mode, new Set(pending.get(mode) ?? [])]));
+const createRepairFrontierByMode = () => new Map(REPAIR_DISPATCH_MODES.map((mode) => [mode, new Map()]));
+const createRepairActiveTargetsByMode = () => new Map(REPAIR_DISPATCH_MODES.map((mode) => [mode, new Set()]));
+const getRepairRetrySchedule = (mode) => {
+    switch (mode) {
+        case "join-warmup":
+            return JOIN_WARMUP_RETRY_SCHEDULE_MS;
+        case "join-authoritative":
+            return JOIN_AUTHORITATIVE_RETRY_SCHEDULE_MS;
+        case "append-backfill":
+            return APPEND_BACKFILL_RETRY_SCHEDULE_MS;
+        case "churn":
+            return CHURN_REPAIR_RETRY_SCHEDULE_MS;
+    }
+};
+const resolveRepairRetrySchedule = (mode, override, trackedFrontier = false) => {
+    const fallback = getRepairRetrySchedule(mode);
+    if (!override || override.length === 0) {
+        return fallback;
+    }
+    if (trackedFrontier &&
+        override.length === 1 &&
+        override[0] === 0 &&
+        fallback.length > 1) {
+        // A tracked frontier with only an immediate retry would otherwise stay on
+        // attempt 0 forever, which means rateless-only retries and no sparse-tail
+        // simple fallback. Keep the immediate seed, then continue with the normal
+        // tracked repair schedule.
+        return [0, ...fallback.slice(1)];
+    }
+    return override;
+};
+const getRepairTransportForAttempt = (mode, attemptIndex) => {
+    if (mode === "churn") {
+        return "simple";
+    }
+    return attemptIndex === 0 ? "rateless" : "simple";
+};
 const toPositiveInteger = (value, fallback, label) => {
     if (value == null) {
         return fallback;
@@ -375,8 +460,18 @@ let SharedLog = (() => {
         _repairRetryTimers;
         _recentRepairDispatch;
         _repairSweepRunning;
-        _repairSweepForceFreshPending;
-        _repairSweepAddedPeersPending;
+        _repairSweepPendingModes;
+        _repairSweepPendingPeersByMode;
+        _repairFrontierByMode;
+        _repairFrontierActiveTargetsByMode;
+        _repairSweepOptimisticGidPeersPending;
+        _entryKnownPeers;
+        _joinAuthoritativeRepairTimersByDelay;
+        _joinAuthoritativeRepairPeersByDelay;
+        _assumeSyncedRepairSuppressedUntil;
+        _appendBackfillTimer;
+        _appendBackfillPendingByTarget;
+        _repairMetrics;
         _topicSubscribersCache;
         // regular distribution checks
         distributeQueue;
@@ -716,7 +811,7 @@ let SharedLog = (() => {
                 }),
             });
         }
-        async _appendDeliverToReplicators(entry, minReplicasValue, leaders, selfHash, isLeader, deliveryArg) {
+        async _appendDeliverToReplicators(entry, coordinates, minReplicasValue, leaders, selfHash, isLeader, deliveryArg) {
             const { delivery, reliability, requireRecipients, minAcks, wrap } = this._parseDeliveryOptions(deliveryArg);
             const pending = [];
             const track = (promise) => {
@@ -725,10 +820,32 @@ let SharedLog = (() => {
             const fanoutUnicastOptions = delivery?.timeout != null || delivery?.signal != null
                 ? { timeoutMs: delivery.timeout, signal: delivery.signal }
                 : undefined;
+            const fullReplicaDeliveryCandidates = await this.getFullReplicaRepairCandidates(undefined, {
+                includeSubscribers: false,
+            });
+            if (minReplicasValue >= Math.max(1, fullReplicaDeliveryCandidates.size)) {
+                for (const peer of fullReplicaDeliveryCandidates) {
+                    if (!leaders.has(peer)) {
+                        leaders.set(peer, { intersecting: true });
+                    }
+                }
+            }
+            const entryReplicatedForRepair = this.createEntryReplicatedForRepair({
+                entry,
+                coordinates,
+                leaders: leaders,
+                replicas: minReplicasValue,
+            });
             for await (const message of createExchangeHeadsMessages(this.log, [entry])) {
                 await this._mergeLeadersFromGidReferences(message, minReplicasValue, leaders);
-                const leadersForDelivery = delivery ? new Set(leaders.keys()) : undefined;
-                const set = this.addPeersToGidPeerHistory(entry.meta.gid, leaders.keys());
+                const authoritativeRecipients = new Set(leaders.keys());
+                const leadersForDelivery = delivery
+                    ? new Set(authoritativeRecipients)
+                    : undefined;
+                // Outbound append delivery only tells us who we intend to send to, not who has
+                // actually stored the entry. Keep this recipient set local so later repair
+                // sweeps can still backfill peers that missed the initial delivery.
+                const set = new Set(leaders.keys());
                 let hasRemotePeers = set.has(selfHash) ? set.size > 1 : set.size > 0;
                 const allowSubscriberFallback = this.syncronizer instanceof SimpleSyncronizer ||
                     (this.compatibility ?? Number.MAX_VALUE) < 10;
@@ -758,6 +875,17 @@ let SharedLog = (() => {
                     continue;
                 }
                 if (!delivery) {
+                    for (const peer of authoritativeRecipients) {
+                        if (peer === selfHash) {
+                            continue;
+                        }
+                        // Default live append delivery is still optimistic. If one remote misses
+                        // the initial heads exchange and the caller did not opt into explicit
+                        // delivery acks, we still need a targeted backfill source of truth for the
+                        // authoritative recipients or one entry can get stuck at 2/3 replicas
+                        // forever. Best-effort fallback subscribers are not repair-worthy.
+                        this.queueAppendBackfill(peer, entryReplicatedForRepair);
+                    }
                     this.rpc
                         .send(message, {
                         mode: isLeader
@@ -785,12 +913,16 @@ let SharedLog = (() => {
                 }
                 const ackTo = [];
                 let silentTo;
+                const repairTargets = new Set();
                 // Default delivery semantics: require enough remote ACKs to reach the requested
                 // replication degree (local append counts as 1).
                 const defaultMinAcks = Math.max(0, minReplicasValue - 1);
                 const ackLimitRaw = reliability === "ack" ? (minAcks ?? defaultMinAcks) : 0;
                 const ackLimit = Math.max(0, Math.min(Math.floor(ackLimitRaw), orderedRemoteRecipients.length));
                 for (const peer of orderedRemoteRecipients) {
+                    if (authoritativeRecipients.has(peer)) {
+                        repairTargets.add(peer);
+                    }
                     if (ackTo.length < ackLimit) {
                         ackTo.push(peer);
                     }
@@ -825,6 +957,12 @@ let SharedLog = (() => {
                     })
                         .catch((error) => logger.error(error));
                 }
+                for (const peer of repairTargets) {
+                    // Direct append delivery is intentionally optimistic. Queue one delayed,
+                    // batched maybe-sync pass for the intended recipients so stable 3-peer
+                    // append workloads do not depend on perfect first-try delivery ordering.
+                    this.queueAppendBackfill(peer, entryReplicatedForRepair);
+                }
             }
             if (pending.length > 0) {
                 await Promise.all(pending);
@@ -1376,6 +1514,7 @@ let SharedLog = (() => {
             // Keep local sync/prune state consistent even when a peer disappears
             // through replication-info updates without a topic unsubscribe event.
             this.removePeerFromGidPeerHistory(keyHash);
+            this.removeRepairFrontierTarget(keyHash);
             this._recentRepairDispatch.delete(keyHash);
             if (!isMe) {
                 this.syncronizer.onPeerDisconnected(keyHash);
@@ -1726,6 +1865,7 @@ let SharedLog = (() => {
                 for (const key of this._gidPeersHistory.keys()) {
                     this.removePeerFromGidPeerHistory(publicKeyHash, key);
                 }
+                this.removePeerFromEntryKnownPeers(publicKeyHash);
             }
         }
         addPeersToGidPeerHistory(gid, publicKeys, reset) {
@@ -1744,10 +1884,344 @@ let SharedLog = (() => {
             }
             return set;
         }
+        markEntriesKnownByPeer(hashes, peer) {
+            for (const hash of hashes) {
+                let peers = this._entryKnownPeers.get(hash);
+                if (!peers) {
+                    peers = new Set();
+                    this._entryKnownPeers.set(hash, peers);
+                }
+                peers.add(peer);
+            }
+        }
+        removeEntriesKnownByPeer(hashes, peer) {
+            for (const hash of hashes) {
+                const peers = this._entryKnownPeers.get(hash);
+                if (!peers) {
+                    continue;
+                }
+                peers.delete(peer);
+                if (peers.size === 0) {
+                    this._entryKnownPeers.delete(hash);
+                }
+            }
+        }
+        removePeerFromEntryKnownPeers(peer) {
+            for (const [hash, peers] of this._entryKnownPeers) {
+                peers.delete(peer);
+                if (peers.size === 0) {
+                    this._entryKnownPeers.delete(hash);
+                }
+            }
+        }
+        isEntryKnownByPeer(hash, peer) {
+            return this._entryKnownPeers.get(hash)?.has(peer) === true;
+        }
+        markRepairSweepOptimisticPeer(gid, peer) {
+            let peers = this._repairSweepOptimisticGidPeersPending.get(gid);
+            if (!peers) {
+                peers = new Map();
+                this._repairSweepOptimisticGidPeersPending.set(gid, peers);
+            }
+            peers.set(peer, (peers.get(peer) || 0) + 1);
+        }
+        hasPendingRepairSweepOptimisticPeer(gid, peer) {
+            return (this._repairSweepOptimisticGidPeersPending.get(gid)?.get(peer) || 0) > 0;
+        }
+        createEntryReplicatedForRepair(properties) {
+            const assignedToRangeBoundary = shouldAssignToRangeBoundary(properties.leaders, properties.replicas);
+            const cidObject = cidifyString(properties.entry.hash);
+            const hashNumber = this.indexableDomain.numbers.bytesToNumber(cidObject.multihash.digest);
+            return new this.indexableDomain.constructorEntry({
+                assignedToRangeBoundary,
+                coordinates: properties.coordinates,
+                meta: properties.entry.meta,
+                hash: properties.entry.hash,
+                hashNumber,
+            });
+        }
+        isAssumeSyncedRepairSuppressed() {
+            return this._assumeSyncedRepairSuppressedUntil > Date.now();
+        }
+        isFrontierTrackedRepairMode(mode) {
+            return mode !== "join-warmup";
+        }
+        async sleepTracked(delayMs) {
+            if (delayMs <= 0) {
+                return;
+            }
+            await new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    this._repairRetryTimers.delete(timer);
+                    resolve();
+                }, delayMs);
+                timer.unref?.();
+                this._repairRetryTimers.add(timer);
+            });
+        }
+        queueRepairFrontierEntries(mode, target, entries) {
+            let targets = this._repairFrontierByMode.get(mode);
+            if (!targets) {
+                targets = new Map();
+                this._repairFrontierByMode.set(mode, targets);
+            }
+            let pending = targets.get(target);
+            if (!pending) {
+                pending = new Map();
+                targets.set(target, pending);
+            }
+            for (const [hash, entry] of entries) {
+                pending.set(hash, entry);
+            }
+        }
+        clearRepairFrontierHashes(target, hashes) {
+            const hashList = [...hashes];
+            if (hashList.length === 0) {
+                return;
+            }
+            for (const mode of REPAIR_DISPATCH_MODES) {
+                const pending = this._repairFrontierByMode.get(mode)?.get(target);
+                if (!pending) {
+                    continue;
+                }
+                for (const hash of hashList) {
+                    pending.delete(hash);
+                }
+                if (pending.size === 0) {
+                    this._repairFrontierByMode.get(mode)?.delete(target);
+                }
+            }
+        }
+        async getFullReplicaRepairCandidates(extraPeers, options) {
+            const candidates = new Set([
+                this.node.identity.publicKey.hashcode(),
+            ]);
+            try {
+                for (const peer of await this.getReplicators()) {
+                    candidates.add(peer);
+                }
+            }
+            catch {
+                for (const peer of this.uniqueReplicators) {
+                    candidates.add(peer);
+                }
+            }
+            for (const peer of extraPeers ?? []) {
+                candidates.add(peer);
+            }
+            if (options?.includeSubscribers !== false) {
+                try {
+                    for (const subscriber of (await this._getTopicSubscribers(this.topic)) ?? []) {
+                        candidates.add(subscriber.hashcode());
+                    }
+                }
+                catch {
+                    // Best-effort only; explicit repair peers still keep the path safe.
+                }
+            }
+            return candidates;
+        }
+        removeRepairFrontierTarget(target) {
+            for (const mode of REPAIR_DISPATCH_MODES) {
+                this._repairFrontierByMode.get(mode)?.delete(target);
+                this._repairFrontierActiveTargetsByMode.get(mode)?.delete(target);
+            }
+        }
+        async sendRepairConfirmation(target, hashes) {
+            const uniqueHashes = [...new Set(hashes)];
+            for (let i = 0; i < uniqueHashes.length; i += REPAIR_CONFIRMATION_HASH_BATCH_SIZE) {
+                const chunk = uniqueHashes.slice(i, i + REPAIR_CONFIRMATION_HASH_BATCH_SIZE);
+                await this.rpc.send(new ConfirmEntriesMessage({ hashes: chunk }), {
+                    priority: 1,
+                    mode: new SilentDelivery({ to: [target], redundancy: 1 }),
+                });
+            }
+        }
+        async pushRepairEntries(target, entries) {
+            for await (const message of createExchangeHeadsMessages(this.log, [...entries.keys()])) {
+                message.reserved[0] |= EXCHANGE_HEADS_REPAIR_HINT;
+                await this.rpc.send(message, {
+                    priority: 1,
+                    mode: new SilentDelivery({ to: [target], redundancy: 1 }),
+                });
+            }
+        }
+        async sendRepairEntriesWithTransport(target, entries, transport, options) {
+            const unknownEntries = new Map();
+            const knownHashes = [];
+            for (const [hash, entry] of entries) {
+                if (options?.bypassKnownPeers || !this.isEntryKnownByPeer(hash, target)) {
+                    unknownEntries.set(hash, entry);
+                }
+                else {
+                    knownHashes.push(hash);
+                }
+            }
+            this.clearRepairFrontierHashes(target, knownHashes);
+            if (unknownEntries.size === 0) {
+                return;
+            }
+            if (transport === "simple") {
+                // Fallback repair should not depend on the target completing the
+                // RequestMaybeSync -> ResponseMaybeSync round trip.
+                await this.pushRepairEntries(target, unknownEntries);
+                return;
+            }
+            await this.syncronizer.onMaybeMissingEntries({
+                entries: unknownEntries,
+                targets: [target],
+            });
+        }
+        async sendMaybeMissingEntriesNow(target, entries, options) {
+            if (entries.size === 0) {
+                return;
+            }
+            const now = Date.now();
+            let recentlyDispatchedByHash = this._recentRepairDispatch.get(target);
+            if (!recentlyDispatchedByHash) {
+                recentlyDispatchedByHash = new Map();
+                this._recentRepairDispatch.set(target, recentlyDispatchedByHash);
+            }
+            for (const [hash, ts] of recentlyDispatchedByHash) {
+                if (now - ts > RECENT_REPAIR_DISPATCH_TTL_MS) {
+                    recentlyDispatchedByHash.delete(hash);
+                }
+            }
+            const filteredEntries = options.bypassRecentDedupe === true
+                ? new Map(entries)
+                : new Map();
+            if (options.bypassRecentDedupe !== true) {
+                for (const [hash, entry] of entries) {
+                    const prev = recentlyDispatchedByHash.get(hash);
+                    if (prev != null && now - prev <= RECENT_REPAIR_DISPATCH_TTL_MS) {
+                        continue;
+                    }
+                    recentlyDispatchedByHash.set(hash, now);
+                    filteredEntries.set(hash, entry);
+                }
+            }
+            else {
+                for (const hash of entries.keys()) {
+                    recentlyDispatchedByHash.set(hash, now);
+                }
+            }
+            if (filteredEntries.size === 0) {
+                return;
+            }
+            const bucket = this._repairMetrics[options.mode];
+            bucket.dispatches += 1;
+            bucket.entries += filteredEntries.size;
+            if (options.transport === "simple") {
+                bucket.simpleFallbackPasses += 1;
+            }
+            else {
+                bucket.ratelessFirstPasses += 1;
+            }
+            await Promise.resolve(this.sendRepairEntriesWithTransport(target, filteredEntries, options.transport, { bypassKnownPeers: options.mode === "churn" })).catch((error) => logger.error(error));
+        }
+        ensureRepairFrontierRunner(mode, target, retryScheduleMs) {
+            const activeTargets = this._repairFrontierActiveTargetsByMode.get(mode);
+            if (!activeTargets || activeTargets.has(target) || this.closed) {
+                return;
+            }
+            activeTargets.add(target);
+            const retrySchedule = resolveRepairRetrySchedule(mode, retryScheduleMs, this.isFrontierTrackedRepairMode(mode));
+            const steadyStateDelay = retrySchedule.length > 1
+                ? Math.max(1, retrySchedule[retrySchedule.length - 1] - retrySchedule[retrySchedule.length - 2])
+                : Math.max(retrySchedule[0] || 1_000, 1_000);
+            void (async () => {
+                let attemptIndex = 0;
+                try {
+                    for (;;) {
+                        if (this.closed) {
+                            return;
+                        }
+                        const pending = this._repairFrontierByMode.get(mode)?.get(target);
+                        if (!pending || pending.size === 0) {
+                            return;
+                        }
+                        if ((mode === "join-warmup" || mode === "join-authoritative") &&
+                            this.isAssumeSyncedRepairSuppressed()) {
+                            await this.sleepTracked(Math.max(250, this._assumeSyncedRepairSuppressedUntil - Date.now()));
+                            continue;
+                        }
+                        await this.sendMaybeMissingEntriesNow(target, pending, {
+                            mode,
+                            transport: getRepairTransportForAttempt(mode, attemptIndex),
+                            bypassRecentDedupe: true,
+                        });
+                        const remaining = this._repairFrontierByMode.get(mode)?.get(target);
+                        if (!remaining || remaining.size === 0) {
+                            return;
+                        }
+                        const waitMs = attemptIndex + 1 < retrySchedule.length
+                            ? Math.max(0, retrySchedule[attemptIndex + 1] - retrySchedule[attemptIndex])
+                            : steadyStateDelay;
+                        attemptIndex = Math.min(attemptIndex + 1, retrySchedule.length - 1);
+                        await this.sleepTracked(waitMs);
+                    }
+                }
+                finally {
+                    activeTargets.delete(target);
+                    if (!this.closed &&
+                        (this._repairFrontierByMode.get(mode)?.get(target)?.size || 0) > 0) {
+                        this.ensureRepairFrontierRunner(mode, target, retryScheduleMs);
+                    }
+                }
+            })().catch((error) => {
+                activeTargets.delete(target);
+                logger.error(error);
+            });
+        }
+        flushAppendBackfill() {
+            if (this._appendBackfillPendingByTarget.size === 0) {
+                return;
+            }
+            const pending = this._appendBackfillPendingByTarget;
+            this._appendBackfillPendingByTarget = new Map();
+            for (const [target, entries] of pending) {
+                this.dispatchMaybeMissingEntries(target, entries, {
+                    mode: "append-backfill",
+                });
+            }
+        }
+        queueAppendBackfill(target, entry) {
+            let entries = this._appendBackfillPendingByTarget.get(target);
+            if (!entries) {
+                entries = new Map();
+                this._appendBackfillPendingByTarget.set(target, entries);
+            }
+            entries.set(entry.hash, entry);
+            if (entries.size >= this.repairSweepTargetBufferSize) {
+                this.flushAppendBackfill();
+                return;
+            }
+            if (this._appendBackfillTimer || this.closed) {
+                return;
+            }
+            const timer = setTimeout(() => {
+                this._repairRetryTimers.delete(timer);
+                if (this._appendBackfillTimer === timer) {
+                    this._appendBackfillTimer = undefined;
+                }
+                if (this.closed) {
+                    return;
+                }
+                this.flushAppendBackfill();
+            }, APPEND_BACKFILL_DELAY_MS);
+            timer.unref?.();
+            this._repairRetryTimers.add(timer);
+            this._appendBackfillTimer = timer;
+        }
         dispatchMaybeMissingEntries(target, entries, options) {
             if (entries.size === 0) {
                 return;
             }
+            if (this.isFrontierTrackedRepairMode(options.mode)) {
+                this.queueRepairFrontierEntries(options.mode, target, entries);
+                this.ensureRepairFrontierRunner(options.mode, target, options.retryScheduleMs);
+                return;
+            }
             const now = Date.now();
             let recentlyDispatchedByHash = this._recentRepairDispatch.get(target);
             if (!recentlyDispatchedByHash) {
@@ -1759,10 +2233,10 @@ let SharedLog = (() => {
                     recentlyDispatchedByHash.delete(hash);
                 }
             }
-            const filteredEntries = options?.bypassRecentDedupe === true
+            const filteredEntries = options.bypassRecentDedupe === true
                 ? new Map(entries)
                 : new Map();
-            if (options?.bypassRecentDedupe !== true) {
+            if (options.bypassRecentDedupe !== true) {
                 for (const [hash, entry] of entries) {
                     const prev = recentlyDispatchedByHash.get(hash);
                     if (prev != null && now - prev <= RECENT_REPAIR_DISPATCH_TTL_MS) {
@@ -1780,95 +2254,186 @@ let SharedLog = (() => {
             if (filteredEntries.size === 0) {
                 return;
             }
-            const retrySchedule = options?.retryScheduleMs && options.retryScheduleMs.length > 0
-                ? options.retryScheduleMs
-                : options?.forceFreshDelivery
-                    ? FORCE_FRESH_RETRY_SCHEDULE_MS
-                    : [0];
-            const run = () => {
-                // For force-fresh churn repair we intentionally bypass rateless IBLT and
-                // use simple hash-based sync. This path is a directed "push these hashes
-                // to that peer" recovery flow; using simple sync here avoids occasional
-                // single-hash gaps seen with IBLT-oriented maybe-sync batches under churn.
-                if (options?.forceFreshDelivery &&
-                    this.syncronizer instanceof RatelessIBLTSynchronizer) {
-                    return Promise.resolve(this.syncronizer.simple.onMaybeMissingEntries({
-                        entries: filteredEntries,
-                        targets: [target],
-                    })).catch((error) => logger.error(error));
-                }
-                return Promise.resolve(this.syncronizer.onMaybeMissingEntries({
-                    entries: filteredEntries,
-                    targets: [target],
-                })).catch((error) => logger.error(error));
+            if ((options.mode === "join-warmup" ||
+                options.mode === "join-authoritative") &&
+                this.isAssumeSyncedRepairSuppressed()) {
+                return;
+            }
+            const retrySchedule = resolveRepairRetrySchedule(options.mode, options.retryScheduleMs, this.isFrontierTrackedRepairMode(options.mode));
+            const bucket = this._repairMetrics[options.mode];
+            bucket.dispatches += 1;
+            bucket.entries += filteredEntries.size;
+            const run = (transport) => {
+                if (transport === "simple") {
+                    bucket.simpleFallbackPasses += 1;
+                }
+                else {
+                    bucket.ratelessFirstPasses += 1;
+                }
+                return Promise.resolve(this.sendRepairEntriesWithTransport(target, filteredEntries, transport, { bypassKnownPeers: options.mode === "churn" })).catch((error) => logger.error(error));
             };
-            for (const delayMs of retrySchedule) {
+            retrySchedule.forEach((delayMs, index) => {
+                const transport = getRepairTransportForAttempt(options.mode, index);
                 if (delayMs === 0) {
-                    void run();
-                    continue;
+                    void run(transport);
+                    return;
                 }
                 const timer = setTimeout(() => {
                     this._repairRetryTimers.delete(timer);
                     if (this.closed) {
                         return;
                     }
-                    void run();
+                    void run(transport);
                 }, delayMs);
                 timer.unref?.();
                 this._repairRetryTimers.add(timer);
-            }
+            });
         }
         scheduleRepairSweep(options) {
-            if (options.forceFreshDelivery) {
-                this._repairSweepForceFreshPending = true;
-            }
-            for (const peer of options.addedPeers) {
-                this._repairSweepAddedPeersPending.add(peer);
+            this._repairSweepPendingModes.add(options.mode);
+            const pendingPeers = this._repairSweepPendingPeersByMode.get(options.mode);
+            if (pendingPeers) {
+                for (const peer of options.peers ?? []) {
+                    pendingPeers.add(peer);
+                }
             }
             if (!this._repairSweepRunning && !this.closed) {
                 this._repairSweepRunning = true;
                 void this.runRepairSweep();
             }
         }
+        scheduleJoinAuthoritativeRepair(peers) {
+            if (this.closed || peers.size === 0) {
+                return;
+            }
+            for (const delayMs of JOIN_AUTHORITATIVE_REPAIR_SWEEP_DELAYS_MS) {
+                let pendingPeers = this._joinAuthoritativeRepairPeersByDelay.get(delayMs);
+                if (!pendingPeers) {
+                    pendingPeers = new Set();
+                    this._joinAuthoritativeRepairPeersByDelay.set(delayMs, pendingPeers);
+                }
+                for (const peer of peers) {
+                    pendingPeers.add(peer);
+                }
+                if (this._joinAuthoritativeRepairTimersByDelay.has(delayMs)) {
+                    continue;
+                }
+                const timer = setTimeout(() => {
+                    this._repairRetryTimers.delete(timer);
+                    this._joinAuthoritativeRepairTimersByDelay.delete(delayMs);
+                    if (this.closed) {
+                        return;
+                    }
+                    const peersForSweep = new Set(this._joinAuthoritativeRepairPeersByDelay.get(delayMs) ?? []);
+                    this._joinAuthoritativeRepairPeersByDelay.delete(delayMs);
+                    if (peersForSweep.size === 0) {
+                        return;
+                    }
+                    // A joiner's leader view can still be partial on the first delayed pass
+                    // under pubsub jitter. Bounded per-peer rescans widen the authoritative
+                    // frontier without adding per-append sweeps.
+                    this.scheduleRepairSweep({
+                        mode: "join-authoritative",
+                        peers: peersForSweep,
+                    });
+                }, delayMs);
+                timer.unref?.();
+                this._repairRetryTimers.add(timer);
+                this._joinAuthoritativeRepairTimersByDelay.set(delayMs, timer);
+            }
+        }
         async runRepairSweep() {
             try {
                 while (!this.closed) {
-                    const forceFreshDelivery = this._repairSweepForceFreshPending;
-                    const addedPeers = new Set(this._repairSweepAddedPeersPending);
-                    this._repairSweepForceFreshPending = false;
-                    this._repairSweepAddedPeersPending.clear();
-                    if (!forceFreshDelivery && addedPeers.size === 0) {
+                    const pendingModes = new Set(this._repairSweepPendingModes);
+                    const pendingPeersByMode = cloneRepairPendingPeersByMode(this._repairSweepPendingPeersByMode);
+                    this._repairSweepPendingModes.clear();
+                    for (const peers of this._repairSweepPendingPeersByMode.values()) {
+                        peers.clear();
+                    }
+                    if (pendingModes.size === 0) {
                         return;
                     }
-                    const pendingByTarget = new Map();
-                    const flushTarget = (target) => {
-                        const entries = pendingByTarget.get(target);
+                    const optimisticGidPeersByMode = new Map();
+                    const optimisticGidPeersConsumedByMode = new Map();
+                    for (const mode of pendingModes) {
+                        const modePeers = pendingPeersByMode.get(mode);
+                        if (!modePeers || modePeers.size === 0) {
+                            continue;
+                        }
+                        const optimisticGidPeers = new Map();
+                        const optimisticGidPeersConsumed = new Map();
+                        for (const [gid, peerCounts] of this._repairSweepOptimisticGidPeersPending) {
+                            let matchedPeers;
+                            let matchedCounts;
+                            for (const [peer, count] of peerCounts) {
+                                if (!modePeers.has(peer)) {
+                                    continue;
+                                }
+                                matchedPeers ||= new Set();
+                                matchedCounts ||= new Map();
+                                matchedPeers.add(peer);
+                                matchedCounts.set(peer, count);
+                            }
+                            if (matchedPeers && matchedCounts) {
+                                optimisticGidPeers.set(gid, matchedPeers);
+                                optimisticGidPeersConsumed.set(gid, matchedCounts);
+                            }
+                        }
+                        if (optimisticGidPeers.size > 0) {
+                            optimisticGidPeersByMode.set(mode, optimisticGidPeers);
+                            optimisticGidPeersConsumedByMode.set(mode, optimisticGidPeersConsumed);
+                        }
+                    }
+                    const pendingByMode = new Map(REPAIR_DISPATCH_MODES.map((mode) => [mode, new Map()]));
+                    const pendingRepairPeers = new Set();
+                    for (const peers of pendingPeersByMode.values()) {
+                        for (const peer of peers) {
+                            pendingRepairPeers.add(peer);
+                        }
+                    }
+                    const fullReplicaRepairCandidates = await this.getFullReplicaRepairCandidates(pendingRepairPeers, {
+                        includeSubscribers: false,
+                    });
+                    const fullReplicaRepairCandidateCount = Math.max(1, fullReplicaRepairCandidates.size);
+                    const nextFrontierByMode = new Map([
+                        ["join-authoritative", new Map()],
+                        ["churn", new Map()],
+                    ]);
+                    const flushTarget = (mode, target) => {
+                        const targets = pendingByMode.get(mode);
+                        const entries = targets?.get(target);
                         if (!entries || entries.size === 0) {
                             return;
                         }
-                        const isJoinWarmupTarget = addedPeers.has(target);
-                        const bypassRecentDedupe = isJoinWarmupTarget || forceFreshDelivery;
                         this.dispatchMaybeMissingEntries(target, entries, {
-                            bypassRecentDedupe,
-                            retryScheduleMs: isJoinWarmupTarget
-                                ? JOIN_WARMUP_RETRY_SCHEDULE_MS
-                                : undefined,
-                            forceFreshDelivery,
+                            bypassRecentDedupe: true,
+                            mode,
                         });
-                        pendingByTarget.delete(target);
+                        targets?.delete(target);
                     };
-                    const queueEntryForTarget = (target, entry) => {
-                        let set = pendingByTarget.get(target);
+                    const queueEntryForTarget = (mode, target, entry) => {
+                        const sweepTargets = nextFrontierByMode.get(mode);
+                        if (sweepTargets) {
+                            let sweepSet = sweepTargets.get(target);
+                            if (!sweepSet) {
+                                sweepSet = new Map();
+                                sweepTargets.set(target, sweepSet);
+                            }
+                            sweepSet.set(entry.hash, entry);
+                        }
+                        const targets = pendingByMode.get(mode);
+                        let set = targets.get(target);
                         if (!set) {
                             set = new Map();
-                            pendingByTarget.set(target, set);
+                            targets.set(target, set);
                         }
                         if (set.has(entry.hash)) {
                             return;
                         }
                         set.set(entry.hash, entry);
                         if (set.size >= this.repairSweepTargetBufferSize) {
-                            flushTarget(target);
+                            flushTarget(mode, target);
                         }
                     };
                     const iterator = this.entryCoordinatesIndex.iterate({});
@@ -1877,20 +2442,42 @@ let SharedLog = (() => {
                             const entries = await iterator.next(REPAIR_SWEEP_ENTRY_BATCH_SIZE);
                             for (const entry of entries) {
                                 const entryReplicated = entry.value;
-                                const knownPeers = this._gidPeersHistory.get(entryReplicated.gid);
+                                const gid = entryReplicated.gid;
+                                const knownPeers = this._gidPeersHistory.get(gid);
+                                const requestedReplicas = decodeReplicas(entryReplicated).getValue(this);
                                 const currentPeers = await this.findLeaders(entryReplicated.coordinates, entryReplicated, { roleAge: 0 });
-                                if (forceFreshDelivery) {
+                                if (pendingModes.has("churn")) {
                                     for (const [currentPeer] of currentPeers) {
                                         if (currentPeer === this.node.identity.publicKey.hashcode()) {
                                             continue;
                                         }
-                                        queueEntryForTarget(currentPeer, entryReplicated);
+                                        queueEntryForTarget("churn", currentPeer, entryReplicated);
                                     }
                                 }
-                                if (addedPeers.size > 0) {
-                                    for (const peer of addedPeers) {
-                                        if (currentPeers.has(peer) && !knownPeers?.has(peer)) {
-                                            queueEntryForTarget(peer, entryReplicated);
+                                for (const mode of pendingModes) {
+                                    const modePeers = pendingPeersByMode.get(mode);
+                                    if (!modePeers || modePeers.size === 0) {
+                                        continue;
+                                    }
+                                    const optimisticPeers = optimisticGidPeersByMode.get(mode)?.get(gid);
+                                    for (const peer of modePeers) {
+                                        if (this.isEntryKnownByPeer(entryReplicated.hash, peer)) {
+                                            continue;
+                                        }
+                                        const wasOptimisticallyAssigned = optimisticPeers?.has(peer) === true;
+                                        const isCoveredByFullReplicaRepair = mode === "join-authoritative" &&
+                                            fullReplicaRepairCandidates.has(peer) &&
+                                            requestedReplicas >= fullReplicaRepairCandidateCount;
+                                        const shouldQueue = mode === "join-authoritative"
+                                            ? currentPeers.has(peer) || isCoveredByFullReplicaRepair
+                                            : wasOptimisticallyAssigned ||
+                                                (currentPeers.has(peer) && !knownPeers?.has(peer));
+                                        if (shouldQueue) {
+                                            // Authoritative join repair must not trust partial gid peer history,
+                                            // otherwise a late joiner can get stuck with a partial historical
+                                            // backfill forever. Once we enter the authoritative pass, queue every
+                                            // entry whose current leader set still includes the added peer.
+                                            queueEntryForTarget(mode, peer, entryReplicated);
                                         }
                                     }
                                 }
@@ -1900,8 +2487,64 @@ let SharedLog = (() => {
                     finally {
                         await iterator.close();
                     }
-                    for (const target of [...pendingByTarget.keys()]) {
-                        flushTarget(target);
+                    for (const [, optimisticGidPeersConsumed] of optimisticGidPeersConsumedByMode) {
+                        for (const [gid, peerCounts] of optimisticGidPeersConsumed) {
+                            const pendingPeerCounts = this._repairSweepOptimisticGidPeersPending.get(gid);
+                            if (!pendingPeerCounts) {
+                                continue;
+                            }
+                            for (const [peer, count] of peerCounts) {
+                                const current = pendingPeerCounts.get(peer) || 0;
+                                const next = current - count;
+                                if (next > 0) {
+                                    pendingPeerCounts.set(peer, next);
+                                }
+                                else {
+                                    pendingPeerCounts.delete(peer);
+                                }
+                            }
+                            if (pendingPeerCounts.size === 0) {
+                                this._repairSweepOptimisticGidPeersPending.delete(gid);
+                            }
+                        }
+                    }
+                    for (const mode of pendingModes) {
+                        if (mode !== "join-authoritative" && mode !== "churn") {
+                            continue;
+                        }
+                        const nextTargets = nextFrontierByMode.get(mode) ?? new Map();
+                        const frontierTargets = this._repairFrontierByMode.get(mode);
+                        for (const target of pendingPeersByMode.get(mode) ?? []) {
+                            const replacement = nextTargets.get(target);
+                            if (mode === "join-authoritative") {
+                                // Authoritative join repair is receipt-driven: a later sweep can have a
+                                // narrower transient leader view, but it must not forget unconfirmed
+                                // hashes that were already queued for this joiner.
+                                if (replacement && replacement.size > 0) {
+                                    const existing = frontierTargets?.get(target);
+                                    if (existing && existing.size > 0) {
+                                        for (const [hash, entry] of replacement) {
+                                            existing.set(hash, entry);
+                                        }
+                                    }
+                                    else {
+                                        frontierTargets?.set(target, replacement);
+                                    }
+                                }
+                                continue;
+                            }
+                            if (replacement && replacement.size > 0) {
+                                frontierTargets?.set(target, replacement);
+                            }
+                            else {
+                                frontierTargets?.delete(target);
+                            }
+                        }
+                    }
+                    for (const [mode, targets] of pendingByMode) {
+                        for (const target of [...targets.keys()]) {
+                            flushTarget(mode, target);
+                        }
                     }
                 }
             }
@@ -1912,17 +2555,78 @@ let SharedLog = (() => {
             }
             finally {
                 this._repairSweepRunning = false;
-                if (!this.closed &&
-                    (this._repairSweepForceFreshPending ||
-                        this._repairSweepAddedPeersPending.size > 0)) {
+                if (!this.closed && this._repairSweepPendingModes.size > 0) {
                     this._repairSweepRunning = true;
                     void this.runRepairSweep();
                 }
             }
         }
         async pruneDebouncedFnAddIfNotKeeping(args) {
-            if (!this.keep || !(await this.keep(args.value.entry))) {
-                return this.pruneDebouncedFn.add(args);
+            if (this.keep && (await this.keep(args.value.entry))) {
+                return false;
+            }
+            void this.pruneDebouncedFn.add(args);
+            return true;
+        }
+        async pruneJoinedEntriesNoLongerLed(entries) {
+            const selfHash = this.node.identity.publicKey.hashcode();
+            for (const entry of entries) {
+                if (this.closed || this._pendingDeletes.has(entry.hash)) {
+                    continue;
+                }
+                const leaders = await this.findLeadersFromEntry(entry, decodeReplicas(entry).getValue(this), { roleAge: 0 });
+                if (leaders.has(selfHash)) {
+                    this.pruneDebouncedFn.delete(entry.hash);
+                    continue;
+                }
+                if (leaders.size === 0) {
+                    continue;
+                }
+                await this.pruneDebouncedFnAddIfNotKeeping({
+                    key: entry.hash,
+                    value: { entry, leaders },
+                });
+                this.responseToPruneDebouncedFn.delete(entry.hash);
+            }
+        }
+        async pruneIndexedEntriesNoLongerLed() {
+            const selfHash = this.node.identity.publicKey.hashcode();
+            const iterator = this.entryCoordinatesIndex.iterate({});
+            let enqueuedPrune = false;
+            try {
+                while (!this.closed && !iterator.done()) {
+                    const entries = await iterator.next(REPAIR_SWEEP_ENTRY_BATCH_SIZE);
+                    for (const entry of entries) {
+                        const entryReplicated = entry.value;
+                        if (this.closed || this._pendingDeletes.has(entryReplicated.hash)) {
+                            continue;
+                        }
+                        const leaders = await this.findLeaders(entryReplicated.coordinates, entryReplicated, { roleAge: 0 });
+                        if (leaders.has(selfHash)) {
+                            this.pruneDebouncedFn.delete(entryReplicated.hash);
+                            await this._pendingDeletes
+                                .get(entryReplicated.hash)
+                                ?.reject(new Error("Failed to delete, is leader again"));
+                            this.removePruneRequestSent(entryReplicated.hash);
+                            continue;
+                        }
+                        if (leaders.size === 0) {
+                            continue;
+                        }
+                        enqueuedPrune =
+                            (await this.pruneDebouncedFnAddIfNotKeeping({
+                                key: entryReplicated.hash,
+                                value: { entry: entryReplicated, leaders },
+                            })) || enqueuedPrune;
+                        this.responseToPruneDebouncedFn.delete(entryReplicated.hash);
+                    }
+                }
+            }
+            finally {
+                await iterator.close();
+            }
+            if (enqueuedPrune && !this.closed) {
+                await this.pruneDebouncedFn.flush();
             }
         }
         clearCheckedPruneRetry(hash) {
@@ -2065,16 +2769,17 @@ let SharedLog = (() => {
                     await this._appendDeliverToAllFanout(result.entry);
                 }
                 else {
-                    await this._appendDeliverToReplicators(result.entry, minReplicasValue, leaders, selfHash, isLeader, deliveryArg);
+                    await this._appendDeliverToReplicators(result.entry, coordinates, minReplicasValue, leaders, selfHash, isLeader, deliveryArg);
                 }
             }
-            if (!isLeader && !this.shouldDelayAdaptiveRebalance()) {
+            const delayAdaptiveRebalance = this.shouldDelayAdaptiveRebalance();
+            if (!isLeader && !delayAdaptiveRebalance) {
                 this.pruneDebouncedFnAddIfNotKeeping({
                     key: result.entry.hash,
                     value: { entry: result.entry, leaders },
                 });
             }
-            if (!this._isAdaptiveReplicating) {
+            if (!delayAdaptiveRebalance) {
                 this.rebalanceParticipationDebounced?.call();
             }
             return result;
@@ -2108,8 +2813,18 @@ let SharedLog = (() => {
             this._repairRetryTimers = new Set();
             this._recentRepairDispatch = new Map();
             this._repairSweepRunning = false;
-            this._repairSweepForceFreshPending = false;
-            this._repairSweepAddedPeersPending = new Set();
+            this._repairSweepPendingModes = new Set();
+            this._repairSweepPendingPeersByMode = createRepairPendingPeersByMode();
+            this._repairFrontierByMode = createRepairFrontierByMode();
+            this._repairFrontierActiveTargetsByMode = createRepairActiveTargetsByMode();
+            this._repairSweepOptimisticGidPeersPending = new Map();
+            this._entryKnownPeers = new Map();
+            this._joinAuthoritativeRepairTimersByDelay = new Map();
+            this._joinAuthoritativeRepairPeersByDelay = new Map();
+            this._assumeSyncedRepairSuppressedUntil = 0;
+            this._appendBackfillTimer = undefined;
+            this._appendBackfillPendingByTarget = new Map();
+            this._repairMetrics = createRepairMetrics();
             this._topicSubscribersCache = new Map();
             this.coordinateToHash = new Cache({ max: 1e6, ttl: 1e4 });
             this.recentlyRebalanced = new Cache({ max: 1e4, ttl: 1e5 });
@@ -2167,7 +2882,10 @@ let SharedLog = (() => {
             this.keep = options?.keep;
             this.pendingMaturity = new Map();
             const id = sha256Base64Sync(this.log.id);
-            const storage = await this.node.storage.sublevel(id);
+            const [storage, logScope] = await Promise.all([
+                this.node.storage.sublevel(id),
+                this.node.indexer.scope(id),
+            ]);
             const localBlocks = await new AnyBlockStore(await storage.sublevel("blocks"));
             const fanoutService = getSharedLogFanoutService(this.node.services);
             const blockProviderNamespace = (cid) => `cid:${cid}`;
@@ -2223,16 +2941,18 @@ let SharedLog = (() => {
                     }
                 },
             });
-            await this.remoteBlocks.start();
-            const logScope = await this.node.indexer.scope(id);
-            const replicationIndex = await logScope.scope("replication");
+            const remoteBlocksStartPromise = this.remoteBlocks.start();
+            const [replicationIndex, logIndex] = await Promise.all([
+                logScope.scope("replication"),
+                logScope.scope("log"),
+            ]);
             this._replicationRangeIndex = await replicationIndex.init({
                 schema: this.indexableDomain.constructorRange,
             });
             this._entryCoordinatesIndex = await replicationIndex.init({
                 schema: this.indexableDomain.constructorEntry,
             });
-            const logIndex = await logScope.scope("log");
+            await remoteBlocksStartPromise;
             const hasIndexedReplicationInfo = (await this.replicationIndex.count({
                 query: [
                     new StringMatch({
@@ -2360,27 +3080,33 @@ let SharedLog = (() => {
                 }
             }
             // Open for communcation
-            await this.rpc.open({
-                queryType: TransportMessage,
-                responseType: TransportMessage,
-                responseHandler: (query, context) => this.onMessage(query, context),
-                topic: this.topic,
-            });
             this._onSubscriptionFn =
                 this._onSubscriptionFn || this._onSubscription.bind(this);
-            await this.node.services.pubsub.addEventListener("subscribe", this._onSubscriptionFn);
             this._onUnsubscriptionFn =
                 this._onUnsubscriptionFn || this._onUnsubscription.bind(this);
-            await this.node.services.pubsub.addEventListener("unsubscribe", this._onUnsubscriptionFn);
-            await this.rpc.subscribe();
-            await this._openFanoutChannel(options?.fanout);
-            // mark all our replicaiton ranges as "new", this would allow other peers to understand that we recently reopend our database and might need some sync and warmup
-            await this.updateTimestampOfOwnedReplicationRanges(); // TODO do we need to do this before subscribing?
+            await Promise.all([
+                this.rpc.open({
+                    queryType: TransportMessage,
+                    responseType: TransportMessage,
+                    responseHandler: (query, context) => this.onMessage(query, context),
+                    topic: this.topic,
+                }),
+                this.node.services.pubsub.addEventListener("subscribe", this._onSubscriptionFn),
+                this.node.services.pubsub.addEventListener("unsubscribe", this._onUnsubscriptionFn),
+            ]);
+            const fanoutOpenPromise = this._openFanoutChannel(options?.fanout);
+            // Mark previously-owned replication ranges as "new" only when they already exist.
+            // Fresh opens have nothing to touch here, so skip the extra scan/write entirely.
+            const updateOwnedReplicationPromise = hasIndexedReplicationInfo
+                ? this.updateTimestampOfOwnedReplicationRanges()
+                : Promise.resolve();
+            await Promise.all([fanoutOpenPromise, updateOwnedReplicationPromise]);
             // if we had a previous session with replication info, and new replication info dictates that we unreplicate
             // we should do that. Otherwise if options is a unreplication we dont need to do anything because
             // we are already unreplicated (as we are just opening)
-            let isUnreplicationOptionsDefined = isUnreplicationOptions(options?.replicate);
-            const canResumeReplication = (await isReplicationOptionsDependentOnPreviousState(options?.replicate, this.replicationIndex, this.node.identity.publicKey)) && hasIndexedReplicationInfo;
+            const isUnreplicationOptionsDefined = isUnreplicationOptions(options?.replicate);
+            const canResumeReplication = hasIndexedReplicationInfo &&
+                (await isReplicationOptionsDependentOnPreviousState(options?.replicate, this.replicationIndex, this.node.identity.publicKey));
             if (hasIndexedReplicationInfo && isUnreplicationOptionsDefined) {
                 await this.replicate(options?.replicate, { checkDuplicates: true });
             }
@@ -2423,6 +3149,7 @@ let SharedLog = (() => {
         }
         async afterOpen() {
             await super.afterOpen();
+            const existingSubscribersPromise = this._getTopicSubscribers(this.topic);
             // We do this here, because these calls requires this.closed == false
             void this.pruneOfflineReplicators()
                 .then(() => {
@@ -2437,7 +3164,7 @@ let SharedLog = (() => {
             this.startReplicatorLivenessSweep();
             await this.rebalanceParticipation();
             // Take into account existing subscription
-            (await this._getTopicSubscribers(this.topic))?.forEach((v) => {
+            (await existingSubscribersPromise)?.forEach((v) => {
                 if (v.equals(this.node.identity.publicKey)) {
                     return;
                 }
@@ -2952,8 +3679,28 @@ let SharedLog = (() => {
             this._repairRetryTimers.clear();
             this._recentRepairDispatch.clear();
             this._repairSweepRunning = false;
-            this._repairSweepForceFreshPending = false;
-            this._repairSweepAddedPeersPending.clear();
+            this._repairSweepPendingModes.clear();
+            for (const peers of this._repairSweepPendingPeersByMode.values()) {
+                peers.clear();
+            }
+            this._repairSweepOptimisticGidPeersPending.clear();
+            this._entryKnownPeers.clear();
+            for (const timer of this._joinAuthoritativeRepairTimersByDelay.values()) {
+                clearTimeout(timer);
+            }
+            this._joinAuthoritativeRepairTimersByDelay.clear();
+            this._joinAuthoritativeRepairPeersByDelay.clear();
+            for (const targets of this._repairFrontierByMode.values()) {
+                targets.clear();
+            }
+            for (const targets of this._repairFrontierActiveTargetsByMode.values()) {
+                targets.clear();
+            }
+            if (this._appendBackfillTimer) {
+                clearTimeout(this._appendBackfillTimer);
+                this._appendBackfillTimer = undefined;
+            }
+            this._appendBackfillPendingByTarget.clear();
             for (const [_k, v] of this._pendingDeletes) {
                 v.clear();
                 v.promise.resolve(); // TODO or reject?
@@ -3111,9 +3858,11 @@ let SharedLog = (() => {
                      * I can use them to load associated logs and join/sync them with the data stores I own
                      */
                     const { heads } = msg;
+                    const isRepairHint = (msg.reserved[0] & EXCHANGE_HEADS_REPAIR_HINT) !== 0;
                     logger.trace(`${this.node.identity.publicKey.hashcode()}: Recieved heads: ${heads.length === 1 ? heads[0].entry.hash : "#" + heads.length}, logId: ${this.log.idString}`);
                     if (heads) {
                         const filteredHeads = [];
+                        const confirmedHashes = new Set();
                         for (const head of heads) {
                             if (!(await this.log.has(head.entry.hash))) {
                                 head.entry.init({
@@ -3123,8 +3872,18 @@ let SharedLog = (() => {
                                 });
                                 filteredHeads.push(head);
                             }
+                            else {
+                                confirmedHashes.add(head.entry.hash);
+                            }
+                        }
+                        const fromIsSelf = context.from.equals(this.node.identity.publicKey);
+                        if (!fromIsSelf) {
+                            this.markEntriesKnownByPeer(heads.map((head) => head.entry.hash), context.from.hashcode());
                         }
                         if (filteredHeads.length === 0) {
+                            if (confirmedHashes.size > 0 && !fromIsSelf) {
+                                await this.sendRepairConfirmation(context.from, confirmedHashes);
+                            }
                             return;
                         }
                         const groupedByGid = await groupByGid(filteredHeads);
@@ -3186,8 +3945,15 @@ let SharedLog = (() => {
                                 }
                                 let maybeDelete;
                                 let toMerge = [];
+                                let toPersist = [];
                                 let toDelete;
-                                if (isLeader) {
+                                // Targeted repair is sent only to peers the sender currently believes
+                                // should store the entry. Accept it while local membership catches up;
+                                // the normal checked-prune path below can still remove it if this peer
+                                // truly no longer owns the entry.
+                                const acceptsTargetedRepair = isRepairHint && fromIsLeader;
+                                const keepAsLeader = isLeader || acceptsTargetedRepair;
+                                if (keepAsLeader) {
                                     for (const entry of entries) {
                                         this.pruneDebouncedFn.delete(entry.entry.hash);
                                         this.removePruneRequestSent(entry.entry.hash);
@@ -3203,8 +3969,9 @@ let SharedLog = (() => {
                                     }
                                 }
                                 outer: for (const entry of entries) {
-                                    if (isLeader || (await this.keep?.(entry.entry))) {
+                                    if (keepAsLeader || (await this.keep?.(entry.entry))) {
                                         toMerge.push(entry.entry);
+                                        toPersist.push(entry.entry);
                                     }
                                     else {
                                         for (const ref of entry.gidRefrences) {
@@ -3222,7 +3989,18 @@ let SharedLog = (() => {
                                     return;
                                 }
                                 if (toMerge.length > 0) {
+                                    this.markEntriesKnownByPeer(toMerge.map((entry) => entry.hash), context.from.hashcode());
                                     await this.log.join(toMerge);
+                                    // Network joins bypass SharedLog.join(), but churn repair scans
+                                    // the coordinate index to redistribute entries after membership changes.
+                                    for (const entry of toPersist) {
+                                        const replicas = decodeReplicas(entry).getValue(this);
+                                        await this.findLeaders(await this.createCoordinates(entry, replicas), entry, { roleAge: 0, persist: {} });
+                                    }
+                                    for (const merged of toMerge) {
+                                        confirmedHashes.add(merged.hash);
+                                    }
+                                    await this.pruneJoinedEntriesNoLongerLed(toMerge);
                                     toDelete?.map((x) => 
                                     // TODO types
                                     this.pruneDebouncedFnAddIfNotKeeping({
@@ -3261,6 +4039,10 @@ let SharedLog = (() => {
                             promises.push(fn()); // we do this concurrently since waitForIsLeader might be a blocking operation for some entries
                         }
                         await Promise.all(promises);
+                        if (confirmedHashes.size > 0 && !context.from.equals(this.node.identity.publicKey)) {
+                            this.markEntriesKnownByPeer(confirmedHashes, context.from.hashcode());
+                            await this.sendRepairConfirmation(context.from, confirmedHashes);
+                        }
                     }
                 }
                 else if (msg instanceof RequestIPrune) {
@@ -3268,6 +4050,7 @@ let SharedLog = (() => {
                     const from = context.from.hashcode();
                     for (const hash of msg.hashes) {
                         this.removePruneRequestSent(hash, from);
+                        this.removeEntriesKnownByPeer([hash], from);
                         // if we expect the remote to be owner of this entry because we are to prune ourselves, then we need to remove the remote
                         // this is due to that the remote has previously indicated to be a replicator to help us prune but now has changed their mind
                         const outGoingPrunes = this._requestIPruneResponseReplicatorSet.get(hash);
@@ -3276,7 +4059,9 @@ let SharedLog = (() => {
                         }
                         const indexedEntry = await this.log.entryIndex.getShallow(hash);
                         let isLeader = false;
-                        if (indexedEntry) {
+                        if (indexedEntry &&
+                            !this._pendingDeletes.has(hash) &&
+                            (await this.log.blocks.has(hash))) {
                             this.removePeerFromGidPeerHistory(context.from.hashcode(), indexedEntry.value.meta.gid);
                             await this._waitForReplicators(await this.createCoordinates(indexedEntry.value, decodeReplicas(indexedEntry.value).getValue(this)), indexedEntry.value, [
                                 {
@@ -3355,6 +4140,11 @@ let SharedLog = (() => {
                         this._pendingDeletes.get(hash)?.resolve(context.from.hashcode());
                     }
                 }
+                else if (msg instanceof ConfirmEntriesMessage) {
+                    this.markEntriesKnownByPeer(msg.hashes, context.from.hashcode());
+                    this.clearRepairFrontierHashes(context.from.hashcode(), msg.hashes);
+                    return;
+                }
                 else if (await this.syncronizer.onMessage(msg, context)) {
                     return; // the syncronizer has handled the message
                 }
@@ -3679,6 +4469,11 @@ let SharedLog = (() => {
             if (options?.replicate) {
                 let messageToSend = undefined;
                 if (assumeSynced) {
+                    // `assumeSynced` is an explicit contract that this join should trust the
+                    // supplied history and avoid initiating outbound repair while the local
+                    // replication ranges settle.
+                    this._assumeSyncedRepairSuppressedUntil =
+                        Date.now() + ASSUME_SYNCED_REPAIR_SUPPRESSION_MS;
                     for (const entry of entriesToReplicate) {
                         await seedAssumeSyncedPeerHistory(entry);
                     }
@@ -3747,9 +4542,14 @@ let SharedLog = (() => {
                 clear();
                 // `waitForReplicator()` is typically used as a precondition before join/replicate
                 // flows. A replicator can become mature and enqueue a debounced rebalance
-                // (`replicationChangeDebounceFn`) slightly later. Flush here so callers don't
-                // observe a "late" rebalance after the wait resolves.
-                await this.replicationChangeDebounceFn?.flush?.();
+                // (`replicationChangeDebounceFn`) slightly later. Kick the flush, but do not
+                // make membership waits depend on all rebalance work finishing; callers that
+                // need settled distribution already wait for that explicitly.
+                this.replicationChangeDebounceFn?.flush?.().catch((error) => {
+                    if (!isNotStartedError(error)) {
+                        logger.error(error?.toString?.() ?? String(error));
+                    }
+                });
                 deferred.resolve();
             };
             const reject = (error) => {
@@ -4141,11 +4941,51 @@ let SharedLog = (() => {
                     }
                 }
             }
+            if (!options?.candidates) {
+                const fullReplicaLeaders = await this.findFullReplicaLeaders(cursors.length, roleAge, peerFilter);
+                if (fullReplicaLeaders) {
+                    return fullReplicaLeaders;
+                }
+            }
             return getSamples(cursors, this.replicationIndex, roleAge, this.indexableDomain.numbers, {
                 peerFilter,
                 uniqueReplicators: peerFilter,
             });
         }
+        async findFullReplicaLeaders(replicas, roleAge, peerFilter) {
+            const now = Date.now();
+            const leaders = new Map();
+            const includeStrict = this._logProperties?.strictFullReplicaFallback !== false;
+            const iterator = this.replicationIndex.iterate({}, { shape: { hash: true, timestamp: true, mode: true } });
+            try {
+                for (;;) {
+                    const batch = await iterator.next(64);
+                    if (batch.length === 0) {
+                        break;
+                    }
+                    for (const result of batch) {
+                        const range = result.value;
+                        if (peerFilter && !peerFilter.has(range.hash)) {
+                            continue;
+                        }
+                        if (!isMatured(range, now, roleAge)) {
+                            continue;
+                        }
+                        if (range.mode === ReplicationIntent.Strict && !includeStrict) {
+                            continue;
+                        }
+                        leaders.set(range.hash, { intersecting: true });
+                        if (leaders.size > replicas) {
+                            return undefined;
+                        }
+                    }
+                }
+            }
+            finally {
+                await iterator.close();
+            }
+            return leaders.size > 0 ? leaders : undefined;
+        }
         async findLeadersFromEntry(entry, replicas, options) {
             const coordinates = await this.createCoordinates(entry, replicas);
             const result = await this._findLeaders(coordinates, options);
@@ -4613,13 +5453,25 @@ let SharedLog = (() => {
             }
             const changed = false;
             const addedPeers = new Set();
+            const authoritativeRepairPeers = new Set();
             const warmupPeers = new Set();
+            const churnRepairPeers = new Set();
             const hasSelfWarmupChange = changes.some((change) => change.range.hash === selfHash &&
                 (change.type === "added" || change.type === "replaced"));
+            const hasSelfRangeRemoval = changes.some((change) => change.range.hash === selfHash &&
+                (change.type === "removed" || change.type === "replaced"));
             for (const change of changes) {
+                if (change.range.hash !== selfHash &&
+                    (change.type === "removed" || change.type === "replaced")) {
+                    this.removePeerFromEntryKnownPeers(change.range.hash);
+                }
                 if (change.type === "added" || change.type === "replaced") {
                     const hash = change.range.hash;
                     if (hash !== selfHash) {
+                        // Existing peers can widen/shift ranges after the initial join. If we
+                        // only rescan on first-seen "added", late authoritative range updates can
+                        // leave historical backfill permanently partial under load.
+                        authoritativeRepairPeers.add(hash);
                         // Range updates can reassign entries to an existing peer shortly after it
                         // already received a subset. Avoid suppressing legitimate follow-up repair.
                         this._recentRepairDispatch.delete(hash);
@@ -4651,17 +5503,24 @@ let SharedLog = (() => {
                         return;
                     }
                     const isWarmupTarget = warmupPeers.has(target);
-                    const bypassRecentDedupe = isWarmupTarget || forceFreshDelivery;
+                    const mode = forceFreshDelivery
+                        ? "churn"
+                        : isWarmupTarget
+                            ? "join-warmup"
+                            : "join-authoritative";
                     this.dispatchMaybeMissingEntries(target, entries, {
-                        bypassRecentDedupe,
-                        retryScheduleMs: isWarmupTarget
+                        bypassRecentDedupe: isWarmupTarget || forceFreshDelivery,
+                        mode,
+                        retryScheduleMs: mode === "join-warmup"
                             ? JOIN_WARMUP_RETRY_SCHEDULE_MS
-                            : undefined,
-                        forceFreshDelivery,
+                            : mode === "join-authoritative"
+                                ? [0]
+                                : undefined,
                     });
                     uncheckedDeliver.delete(target);
                 };
                 const queueUncheckedDeliver = (target, entry) => {
+                    churnRepairPeers.add(target);
                     let set = uncheckedDeliver.get(target);
                     if (!set) {
                         set = new Map();
@@ -4715,7 +5574,14 @@ let SharedLog = (() => {
                                     }
                                 }
                             }
-                            this.addPeersToGidPeerHistory(entryReplicated.gid, currentPeers.keys(), true);
+                            for (const [peer] of currentPeers) {
+                                if (warmupPeers.has(peer)) {
+                                    this.markRepairSweepOptimisticPeer(entryReplicated.gid, peer);
+                                }
+                            }
+                            const authoritativePeers = [...currentPeers.keys()].filter((peer) => !warmupPeers.has(peer) &&
+                                !this.hasPendingRepairSweepOptimisticPeer(entryReplicated.gid, peer));
+                            this.addPeersToGidPeerHistory(entryReplicated.gid, authoritativePeers, true);
                             if (!currentPeers.has(selfHash)) {
                                 this.pruneDebouncedFnAddIfNotKeeping({
                                     key: entryReplicated.hash,
@@ -4763,7 +5629,14 @@ let SharedLog = (() => {
                                 }
                             }
                         }
-                        this.addPeersToGidPeerHistory(entryReplicated.gid, currentPeers.keys(), true);
+                        for (const [peer] of currentPeers) {
+                            if (addedPeers.has(peer)) {
+                                this.markRepairSweepOptimisticPeer(entryReplicated.gid, peer);
+                            }
+                        }
+                        const authoritativePeers = [...currentPeers.keys()].filter((peer) => !addedPeers.has(peer) &&
+                            !this.hasPendingRepairSweepOptimisticPeer(entryReplicated.gid, peer));
+                        this.addPeersToGidPeerHistory(entryReplicated.gid, authoritativePeers, true);
                         if (!isLeader) {
                             this.pruneDebouncedFnAddIfNotKeeping({
                                 key: entryReplicated.hash,
@@ -4780,9 +5653,17 @@ let SharedLog = (() => {
                         }
                     }
                 }
+                if (this._isAdaptiveReplicating && hasSelfRangeRemoval) {
+                    await this.pruneIndexedEntriesNoLongerLed();
+                }
                 if (forceFreshDelivery) {
-                    // Removed/shrunk ranges still need the authoritative background pass.
-                    this.scheduleRepairSweep({ forceFreshDelivery, addedPeers });
+                    // Pure leave/shrink churn can have zero `addedPeers`, but the peers that
+                    // received redistributed entries still need a follow-up repair pass if the
+                    // immediate maybe-sync misses one entry.
+                    this.scheduleRepairSweep({
+                        mode: "churn",
+                        peers: churnRepairPeers,
+                    });
                 }
                 else if (useJoinWarmupFastPath) {
                     // Pure join warmup uses the cheap immediate maybe-missing dispatch above,
@@ -4795,19 +5676,22 @@ let SharedLog = (() => {
                             return;
                         }
                         this.scheduleRepairSweep({
-                            forceFreshDelivery: false,
-                            addedPeers: peers,
+                            mode: "join-warmup",
+                            peers,
                         });
                     }, 250);
                     timer.unref?.();
                     this._repairRetryTimers.add(timer);
                 }
-                else if (addedPeers.size > 0) {
+                else if (authoritativeRepairPeers.size > 0) {
                     this.scheduleRepairSweep({
-                        forceFreshDelivery: false,
-                        addedPeers,
+                        mode: "join-authoritative",
+                        peers: authoritativeRepairPeers,
                     });
                 }
+                if (!forceFreshDelivery && authoritativeRepairPeers.size > 0) {
+                    this.scheduleJoinAuthoritativeRepair(authoritativeRepairPeers);
+                }
                 for (const target of [...uncheckedDeliver.keys()]) {
                     flushUncheckedDeliverTarget(target);
                 }
@@ -4879,6 +5763,10 @@ let SharedLog = (() => {
                     if (!dynamicRange) {
                         return; // not allowed to replicate
                     }
+                    if (this.replicationController.maxMemoryLimit != null &&
+                        usedMemory > this.replicationController.maxMemoryLimit) {
+                        await this.pruneIndexedEntriesNoLongerLed();
+                    }
                     const peersSize = (await peers.getSize()) || 1;
                     const totalParticipation = await this.calculateTotalParticipation();
                     const newFactor = this.replicationController.step({