@peerbit/shared-log 13.2.10 → 13.2.12

package/src/index.ts

@@ -6,7 +6,11 @@ import {
 	variant,
 } from "@dao-xyz/borsh";
 import type { AnyStore } from "@peerbit/any-store";
-import { AnyBlockStore, RemoteBlocks } from "@peerbit/blocks";
+import {
+	AnyBlockStore,
+	type EagerBlocksSetting,
+	RemoteBlocks,
+} from "@peerbit/blocks";
 import { cidifyString } from "@peerbit/blocks-interface";
 import { Cache } from "@peerbit/cache";
 import {
@@ -105,6 +109,7 @@ import {
 	BACKGROUND_MESSAGE_PRIORITY,
 	CONVERGENCE_MESSAGE_PRIORITY,
 	DataMessage,
+	DeliveryError,
 	MessageHeader,
 	NotStartedError,
 	type RouteHint,
@@ -278,10 +283,20 @@ type PendingIHave<T> = {
 	resetTimeout: () => void;
 	requesting: Set<string>;
 	clear: () => void;
-	callback: (entry: Entry<T>) => void;
+	callback: (entry: Entry<T>) => MaybePromise<void>;
 	expiresAt?: number;
 };
 
+type PeerReceiveLeaseBucket = {
+	active: number;
+	drain?: DeferredPromise<void>;
+};
+
+type PeerReceiveLeaseState = {
+	current: PeerReceiveLeaseBucket;
+	activeBuckets: Set<PeerReceiveLeaseBucket>;
+};
+
 const toLocalPublicSignKey = (
 	key: PublicSignKey | string,
 ): PublicSignKey | undefined => {
@@ -2307,6 +2322,64 @@ const isTransientReplicationAnnouncementError = (
 	return constructorName === "TimeoutError" || name === "TimeoutError";
 };
 
+/**
+ * Directed transport-delivery repair is allowed to retry explicit delivery
+ * failures in addition to timeouts. A DirectStream ACK confirms receipt of the
+ * signed envelope, not successful application by the receiver. Keep this
+ * separate from the primary fanout classifier above so replicate() rejection
+ * semantics remain unchanged for programming, serialization, and lifecycle
+ * errors.
+ */
+const isTransientReplicationAnnouncementRepairError = (
+	error: unknown,
+	seen = new Set<unknown>(),
+): boolean => {
+	if (
+		error != null &&
+		(typeof error === "object" || typeof error === "function")
+	) {
+		if (seen.has(error)) {
+			return false;
+		}
+		seen.add(error);
+	}
+
+	if (error instanceof DeliveryError || error instanceof TimeoutError) {
+		return true;
+	}
+
+	const nested = (error as { errors?: unknown })?.errors;
+	if (Array.isArray(nested) && nested.length > 0) {
+		return nested.every((item) =>
+			isTransientReplicationAnnouncementRepairError(item, new Set(seen)),
+		);
+	}
+
+	const cause = (error as { cause?: unknown })?.cause;
+	if (
+		cause != null &&
+		isTransientReplicationAnnouncementRepairError(cause, seen)
+	) {
+		return true;
+	}
+
+	const constructorName =
+		typeof (error as { constructor?: { name?: unknown } })?.constructor
+			?.name === "string"
+			? (error as { constructor: { name: string } }).constructor.name
+			: "";
+	const name =
+		typeof (error as { name?: unknown })?.name === "string"
+			? (error as { name: string }).name
+			: "";
+	return (
+		constructorName === "DeliveryError" ||
+		name === "DeliveryError" ||
+		constructorName === "TimeoutError" ||
+		name === "TimeoutError"
+	);
+};
+
 interface IndexableDomain<R extends "u32" | "u64"> {
 	numbers: Numbers<R>;
 	constructorEntry: new (properties: {
@@ -2511,32 +2584,61 @@ export type SharedLogOptions<
 	strictFullReplicaFallback?: boolean;
 	compatibility?: number;
 	domain?: ReplicationDomainConstructor<D>;
-	eagerBlocks?: boolean | { cacheSize?: number };
+	eagerBlocks?: EagerBlocksSetting;
 	fanout?: SharedLogFanoutOptions;
 };
 
 /**
- * Native defaults a client can advertise for shared-log programs opened on
- * it (the peerbit client's native network preset sets these; see
- * `peerbit/rust`). They fill in open options the caller left undefined;
- * explicit per-open options (including `false`) always win. Without the
- * property on the client, behavior is unchanged.
+ * Runtime defaults a client can advertise for shared-log programs opened on
+ * it. The historical name is retained because the peerbit native network
+ * preset introduced this hook. Defaults fill in open options the caller left
+ * undefined; explicit per-open options (including `false`) always win.
+ * Without the property on the client, behavior is unchanged.
  */
 export type SharedLogNativeDefaults = {
 	nativeBackbone?: SharedLogOptions<any, any, any>["nativeBackbone"];
 	nativeGraph?: LogProperties<any>["nativeGraph"];
 	sync?: Pick<SyncOptions<any>, "rawExchangeHeads" | "nativeWireSync">;
+	/**
+	 * Per-channel defaults applied only when the caller opts into SharedLog
+	 * fanout. Explicit per-open channel options take precedence.
+	 */
+	fanout?: Pick<SharedLogFanoutOptions, "channel">;
 };
 
 type NodeWithSharedLogNativeDefaults = {
 	sharedLogNativeDefaults?: SharedLogNativeDefaults;
 };
 
+type SharedLogFanoutChannelOptions = NonNullable<
+	SharedLogFanoutOptions["channel"]
+>;
+
+const mergeDefinedFanoutChannelOptions = (
+	...sources: Array<SharedLogFanoutChannelOptions | undefined>
+): SharedLogFanoutChannelOptions | undefined => {
+	let merged: Record<string, unknown> | undefined;
+	for (const source of sources) {
+		if (!source) {
+			continue;
+		}
+		for (const [key, value] of Object.entries(source)) {
+			if (value === undefined) {
+				continue;
+			}
+			merged ??= {};
+			merged[key] = value;
+		}
+	}
+	return merged as SharedLogFanoutChannelOptions | undefined;
+};
+
 const applySharedLogNativeDefaults = <
 	O extends {
 		nativeBackbone?: SharedLogOptions<any, any, any>["nativeBackbone"];
 		nativeGraph?: LogProperties<any>["nativeGraph"];
 		sync?: SyncOptions<any>;
+		fanout?: SharedLogFanoutOptions;
 	},
 >(
 	options: O | undefined,
@@ -2555,11 +2657,21 @@ const applySharedLogNativeDefaults = <
 						options?.sync?.nativeWireSync ?? defaults.sync?.nativeWireSync,
 				}
 			: undefined;
+	const fanout = options?.fanout
+		? {
+				...options.fanout,
+				channel: mergeDefinedFanoutChannelOptions(
+					defaults.fanout?.channel,
+					options.fanout.channel,
+				),
+			}
+		: undefined;
 	return {
 		...options,
 		nativeBackbone: options?.nativeBackbone ?? defaults.nativeBackbone,
 		nativeGraph: options?.nativeGraph ?? defaults.nativeGraph,
 		sync,
+		fanout,
 	} as O;
 };
 
@@ -2582,6 +2694,14 @@ const CHECKED_PRUNE_RETRY_MAX_DELAY_MS = 30_000;
 // DONT SET THIS ANY LOWER, because it will make the pid controller unstable as the system responses are not fast enough to updates from the pid controller
 const RECALCULATE_PARTICIPATION_DEBOUNCE_INTERVAL = 1000;
 const REPLICATION_ANNOUNCEMENT_RETRY_INTERVAL = 1000;
+const REPLICATION_ANNOUNCEMENT_REPAIR_INTERVAL = 1000;
+const REPLICATION_ANNOUNCEMENT_REPAIR_MAX_ATTEMPTS = 3;
+// Repair one bounded cohort per mutation generation. The subscriber snapshot
+// is a best-effort cache and can contain thousands of entries, so attempting
+// the whole cache after every role mutation would turn convergence repair into
+// an unbounded burst of separately signed, acknowledged messages. A cursor
+// retained across generations rotates best-effort coverage over later changes.
+const REPLICATION_ANNOUNCEMENT_REPAIR_TARGETS_PER_GENERATION = 8;
 const RECALCULATE_PARTICIPATION_MIN_RELATIVE_CHANGE = 0.01;
 const RECALCULATE_PARTICIPATION_MIN_RELATIVE_CHANGE_WITH_CPU_LIMIT = 0.005;
 const RECALCULATE_PARTICIPATION_MIN_RELATIVE_CHANGE_WITH_MEMORY_LIMIT = 0.001;
@@ -2618,6 +2738,13 @@ const NATIVE_ED25519_VERIFY_BATCH_MIN_ENTRIES = 16;
 const hasPreverifiedSignature = (entry: Entry<any>) =>
 	(entry as { __peerbitSignatureVerified?: unknown })
 		.__peerbitSignatureVerified === true;
+
+type ReplicationAnnouncementRepairTarget = {
+	key: PublicSignKey;
+	generation: number;
+	attempts: number;
+	done: boolean;
+};
 // In sparse topologies (browser/relay), peers can learn about replicators via broadcast
 // replication announcements without having a direct connection that emits unsubscribe
 // on abrupt churn. Probe conservatively so a single missed ACK does not evict a
@@ -2631,9 +2758,13 @@ const REPLICATOR_LIVENESS_PROBE_FAILURES_TO_EVICT = 2;
 const CHURN_REPAIR_RETRY_SCHEDULE_MS = [
 	0, 1_000, 3_000, 7_000, 15_000, 30_000, 45_000,
 ];
+// Preserve the bounded retry window for transient local misses, but serialize
+// delayed warmup sends per target so fixed snapshots cannot overlap and amplify
+// large transfers. Every queued pass re-checks current peer knowledge on entry.
 const JOIN_WARMUP_RETRY_SCHEDULE_MS = [
 	0, 1_000, 3_000, 7_000, 15_000, 30_000, 60_000,
 ];
+const JOIN_WARMUP_SEND_SPACING_MS = 250;
 const JOIN_AUTHORITATIVE_RETRY_SCHEDULE_MS = [
 	0, 1_000, 3_000, 7_000, 15_000, 30_000, 60_000,
 ];
@@ -2664,6 +2795,48 @@ type RepairMetricBucket = {
 };
 type RepairMetrics = Record<RepairDispatchMode, RepairMetricBucket>;
 
+type JoinWarmupSendState<R extends "u32" | "u64"> = {
+	bypassKnownPeerHints: boolean;
+	entries: Map<string, RepairDispatchEntry<R>>;
+	generation: object;
+	lastCompletedAt: number;
+	pending: boolean;
+	running: boolean;
+};
+
+type JoinWarmupRetryTimer = {
+	handle: ReturnType<typeof setTimeout>;
+	resolve?: () => void;
+};
+
+type JoinWarmupScheduledRetryBatch<R extends "u32" | "u64"> = {
+	bypassKnownPeerHints: boolean;
+	entries: Map<string, RepairDispatchEntry<R>>;
+	remainingAttempts: number;
+};
+
+type JoinWarmupScheduledRetryCohort<R extends "u32" | "u64"> = {
+	batches: JoinWarmupScheduledRetryBatch<R>[];
+	dueAt: number;
+};
+
+type JoinWarmupScheduledRetrySlot<R extends "u32" | "u64"> = {
+	cohorts: JoinWarmupScheduledRetryCohort<R>[];
+	head: number;
+	timer?: JoinWarmupRetryTimer;
+	timerDueAt?: number;
+};
+
+type JoinWarmupScheduledRetries<R extends "u32" | "u64"> = {
+	generation: object;
+	slotsByDelay: Map<number, JoinWarmupScheduledRetrySlot<R>>;
+};
+
+type RepairSweepOptimisticPeerState = {
+	count: number;
+	generation: object;
+};
+
 const REPAIR_DISPATCH_MODES: RepairDispatchMode[] = [
 	"join-warmup",
 	"join-authoritative",
@@ -2816,6 +2989,11 @@ export type DeliveryOptions = {
 	reliability?: DeliveryReliability;
 	minAcks?: number;
 	requireRecipients?: boolean;
+	/**
+	 * Transport priority for directed RPC delivery. Fanout unicast already uses
+	 * its control lane, so this only changes the direct/fallback RPC path.
+	 */
+	priority?: number;
 	timeout?: number;
 	signal?: AbortSignal;
 };
@@ -3094,6 +3272,13 @@ export interface SharedLogEvents extends ProgramEvents {
 	"replicator:mature": CustomEvent<ReplicatorMatureEvent>;
 }
 
+export type SharedLogRuntimeSnapshot = Readonly<{
+	nativeGraph: Readonly<{
+		active: boolean;
+		useHeads: boolean;
+	}>;
+}>;
+
 @variant("shared_log")
 export class SharedLog<
 	T,
@@ -3158,6 +3343,14 @@ export class SharedLog<
 	private _subscriptionChangeCallbacks?: Set<Promise<void>>;
 	private _acceptSubscriptionChangeCallbacks = false;
 	private _replicationLifecycleController?: AbortController;
+	private _activeReceiveHandlersByPeer!: Map<string, PeerReceiveLeaseState>;
+	private _receiveHandlerDrainByPeer!: Map<string, Set<Promise<void>>>;
+	private _receiveCleanupGateByPeer!: Map<string, number>;
+	private _subscriptionOpeningEpochByPeer!: Map<string, object>;
+	private _openingSyncCapabilitiesByPeer!: Map<
+		string,
+		{ epoch: object; capabilities: number }
+	>;
 	private _onFanoutDataFn?: (arg: any) => void;
 	private _onFanoutUnicastFn?: (arg: any) => void;
 	private _fanoutChannel?: FanoutChannel;
@@ -3173,6 +3366,7 @@ export class SharedLog<
 	private _closeController!: AbortController;
 	private _respondToIHaveTimeout!: any;
 	private _checkedPrune!: CheckedPruneCoordinator<T, R>;
+	private _pendingIHaveCallbacks!: Set<Promise<void>>;
 	private _pendingIHaveExpiryTimer?: ReturnType<typeof setTimeout>;
 	private _pendingIHaveExpiryDeadline = Number.POSITIVE_INFINITY;
 
@@ -3204,6 +3398,18 @@ export class SharedLog<
 		{ attempts: number; timer?: ReturnType<typeof setTimeout> }
 	>;
 	private _replicationInfoApplyQueueByPeer!: Map<string, Promise<void>>;
+	// Local receive generations fence replication-info handlers that were admitted
+	// before a liveness eviction but reach the per-peer apply lane after it. Unlike
+	// message timestamps, these tokens never compare clocks from different peers.
+	private _replicationInfoReceiveEpochByPeer!: Map<string, object>;
+	// Subscription callbacks can overlap because removing a replicator mutates the
+	// replication index asynchronously. Keep that lifecycle separate from message
+	// timestamps so a reconnect can synchronously revoke an older unsubscribe.
+	private _subscriptionEpochByPeer!: Map<string, object>;
+	// A superseded removal may be the queue item that actually observed an active
+	// replicator. Carry that leave obligation to the transition that ultimately
+	// wins, while a winning reconnect clears it without emitting a stale leave.
+	private _pendingReplicatorLeaveByPeer!: Set<string>;
 	private _replicatorLivenessSweepRunning!: boolean;
 	private _replicatorLivenessTimer?: ReturnType<typeof setInterval>;
 	private _replicatorLivenessTargets!: string[];
@@ -4175,6 +4381,20 @@ export class SharedLog<
 	private _replicationAnnouncementRetryPending!: boolean;
 	private _replicationAnnouncementRetryGeneration!: number;
 	private _replicationAnnouncementRetryController!: AbortController;
+	private replicationAnnouncementRepairDebounced:
+		| ReturnType<typeof debounceFixedInterval>
+		| undefined;
+	private _replicationAnnouncementRepairPending!: boolean;
+	private _replicationAnnouncementRepairGeneration!: number;
+	private _replicationAnnouncementRepairGenerationController!: AbortController;
+	private _replicationAnnouncementRepairTargets!: Map<
+		string,
+		ReplicationAnnouncementRepairTarget
+	>;
+	private _replicationAnnouncementRepairCohortSelected!: boolean;
+	private _replicationAnnouncementRepairFairCursorHash!: string | undefined;
+	private _replicationAnnouncementRepairMaxAttempts!: number;
+	private _replicationAnnouncementRepairController!: AbortController;
 
 	// A fn for debouncing the calls for pruning
 	pruneDebouncedFn!: DebouncedAccumulatorMap<{
@@ -4210,6 +4430,7 @@ export class SharedLog<
 	private _repairSweepRunning!: boolean;
 	private _repairSweepPendingModes!: Set<RepairDispatchMode>;
 	private _repairSweepPendingPeersByMode!: Map<RepairDispatchMode, Set<string>>;
+	private _repairSweepJoinWarmupGenerationByTarget!: Map<string, object>;
 	private _repairFrontierByMode!: Map<
 		RepairDispatchMode,
 		Map<string, Map<string, RepairDispatchEntry<R>>>
@@ -4222,10 +4443,24 @@ export class SharedLog<
 		RepairDispatchMode,
 		Set<string>
 	>;
+	private _joinWarmupGenerationByTarget!: Map<string, object>;
+	private _joinWarmupSendStateByTarget!: Map<
+		string,
+		JoinWarmupSendState<R>
+	>;
+	private _joinWarmupRetryTimersByTarget!: Map<
+		string,
+		Set<JoinWarmupRetryTimer>
+	>;
+	private _joinWarmupScheduledRetriesByTarget!: Map<
+		string,
+		JoinWarmupScheduledRetries<R>
+	>;
 	private _repairSweepOptimisticGidPeersPending!: Map<
 		string,
-		Map<string, number>
+		Map<string, RepairSweepOptimisticPeerState>
 	>;
+	private _repairSweepOptimisticGidsByPeer!: Map<string, Set<string>>;
 	private _entryKnownPeers!: Map<string, Set<string>>;
 	private _entryKnownPeerObservedAt!: Map<string, Map<string, number>>;
 	private _joinAuthoritativeRepairTimersByDelay!: Map<
@@ -4289,22 +4524,39 @@ export class SharedLog<
 		this.rpc = new RPC();
 		this._checkedPrune = new CheckedPruneCoordinator<T, R>();
 		this._pendingIHave = new Map();
+		this._pendingIHaveCallbacks = new Set();
 		this.latestReplicationInfoMessage = new Map();
 		this._replicationInfoBlockedPeers = new Set();
 		this._replicationInfoRequestByPeer = new Map();
 		this._replicationInfoApplyQueueByPeer = new Map();
+		this._replicationInfoReceiveEpochByPeer = new Map();
+		this._subscriptionEpochByPeer = new Map();
+		this._pendingReplicatorLeaveByPeer = new Set();
+		this._activeReceiveHandlersByPeer = new Map();
+		this._receiveHandlerDrainByPeer = new Map();
+		this._receiveCleanupGateByPeer = new Map();
+		this._subscriptionOpeningEpochByPeer = new Map();
+		this._openingSyncCapabilitiesByPeer = new Map();
 		this._gidPeersHistory = new Map();
 		this._repairRetryTimers = new Set();
 		this._recentRepairDispatch = new Map();
 		this._repairSweepRunning = false;
 		this._repairSweepPendingModes = new Set();
 		this._repairSweepPendingPeersByMode = createRepairPendingPeersByMode();
+		this._repairSweepJoinWarmupGenerationByTarget = new Map();
 		this._repairFrontierByMode = createRepairFrontierByMode() as Map<
 			RepairDispatchMode,
 			Map<string, Map<string, RepairDispatchEntry<R>>>
 		>;
 		this._repairFrontierActiveTargetsByMode = createRepairActiveTargetsByMode();
+		this._repairFrontierBypassKnownPeersByMode =
+			createRepairFrontierBypassKnownPeersByMode();
+		this._joinWarmupGenerationByTarget = new Map();
+		this._joinWarmupSendStateByTarget = new Map();
+		this._joinWarmupRetryTimersByTarget = new Map();
+		this._joinWarmupScheduledRetriesByTarget = new Map();
 		this._repairSweepOptimisticGidPeersPending = new Map();
+		this._repairSweepOptimisticGidsByPeer = new Map();
 		this._entryKnownPeers = new Map();
 		this._joinAuthoritativeRepairTimersByDelay = new Map();
 		this._joinAuthoritativeRepairPeersByDelay = new Map();
@@ -4327,6 +4579,16 @@ export class SharedLog<
 		this._replicationAnnouncementRetryPending = false;
 		this._replicationAnnouncementRetryGeneration = 0;
 		this._replicationAnnouncementRetryController = new AbortController();
+		this._replicationAnnouncementRepairPending = false;
+		this._replicationAnnouncementRepairGeneration = 0;
+		this._replicationAnnouncementRepairGenerationController =
+			new AbortController();
+		this._replicationAnnouncementRepairTargets = new Map();
+		this._replicationAnnouncementRepairCohortSelected = false;
+		this._replicationAnnouncementRepairFairCursorHash = undefined;
+		this._replicationAnnouncementRepairMaxAttempts =
+			REPLICATION_ANNOUNCEMENT_REPAIR_MAX_ATTEMPTS;
+		this._replicationAnnouncementRepairController = new AbortController();
 		this.pendingMaturity = new Map();
 		this._closeController = new AbortController();
 	}
@@ -4689,9 +4951,11 @@ export class SharedLog<
 		peer: string;
 		message: ExchangeHeadsMessage<any>;
 		payload: Uint8Array;
+		priority?: number;
 		fanoutUnicastOptions?: { timeoutMs?: number; signal?: AbortSignal };
 	}): Promise<void> {
-		const { peer, message, payload, fanoutUnicastOptions } = properties;
+		const { peer, message, payload, priority, fanoutUnicastOptions } =
+			properties;
 		const hints = await this._getSortedRouteHints(peer);
 		const hasDirectHint = hints.some(
 			(hint) => hint.kind === "directstream-ack",
@@ -4708,6 +4972,7 @@ export class SharedLog<
 						redundancy: 1,
 						to: [peer],
 					}),
+					priority,
 				});
 				return;
 			} catch {
@@ -4746,6 +5011,7 @@ export class SharedLog<
 				redundancy: 1,
 				to: [peer],
 			}),
+			priority,
 		});
 	}
 
@@ -5146,6 +5412,7 @@ export class SharedLog<
 									peer,
 									message,
 									payload,
+									priority: delivery.priority,
 									fanoutUnicastOptions,
 								});
 							})(),
@@ -5160,6 +5427,7 @@ export class SharedLog<
 								redundancy: 1,
 								to: nativeDeliveryPlan.silentTo,
 							}),
+							priority: delivery.priority,
 						})
 						.catch((error) => logger.error(error));
 				}
@@ -5300,6 +5568,7 @@ export class SharedLog<
 								peer,
 								message,
 								payload,
+								priority: delivery.priority,
 								fanoutUnicastOptions,
 							});
 						})(),
@@ -5311,6 +5580,7 @@ export class SharedLog<
 				this.rpc
 					.send(message, {
 						mode: new SilentDelivery({ redundancy: 1, to: silentTo }),
+						priority: delivery.priority,
 					})
 					.catch((error) => logger.error(error));
 			}
@@ -5654,6 +5924,184 @@ export class SharedLog<
 		}
 	}
 
+	private isPeerReceiveAdmissionOpen(
+		peerHash: string,
+		replicationLifecycleController: AbortController | undefined,
+		subscriptionEpoch: object | null,
+		options?: {
+			allowReplicationInfoBlocked?: boolean;
+			allowCleanupGate?: boolean;
+		},
+	) {
+		return (
+			this.isReplicationLifecycleActive(replicationLifecycleController) &&
+			this.isCurrentSubscriptionEpoch(peerHash, subscriptionEpoch) &&
+			(options?.allowReplicationInfoBlocked === true ||
+				!this._replicationInfoBlockedPeers.has(peerHash)) &&
+			(options?.allowCleanupGate === true ||
+				(this._receiveCleanupGateByPeer.get(peerHash) ?? 0) === 0)
+		);
+	}
+
+	private acquirePeerReceiveLease(
+		peerHash: string,
+		replicationLifecycleController: AbortController | undefined,
+		subscriptionEpoch: object | null,
+		options?: {
+			allowReplicationInfoBlocked?: boolean;
+			allowCleanupGate?: boolean;
+		},
+	): (() => void) | undefined {
+		if (
+			!this.isPeerReceiveAdmissionOpen(
+				peerHash,
+				replicationLifecycleController,
+				subscriptionEpoch,
+				options,
+			)
+		) {
+			return;
+		}
+
+		let state = this._activeReceiveHandlersByPeer.get(peerHash);
+		if (!state) {
+			const current: PeerReceiveLeaseBucket = { active: 0 };
+			state = { current, activeBuckets: new Set() };
+			this._activeReceiveHandlersByPeer.set(peerHash, state);
+		}
+		const bucket = state.current;
+		bucket.active += 1;
+		state.activeBuckets.add(bucket);
+		let released = false;
+		return () => {
+			if (released) {
+				return;
+			}
+			released = true;
+			bucket.active -= 1;
+			if (bucket.active > 0) {
+				return;
+			}
+			state.activeBuckets.delete(bucket);
+			bucket.drain?.resolve();
+			if (
+				state.activeBuckets.size === 0 &&
+				state.current.active === 0 &&
+				this._activeReceiveHandlersByPeer.get(peerHash) === state
+			) {
+				this._activeReceiveHandlersByPeer.delete(peerHash);
+			}
+		};
+	}
+
+	private async drainPeerReceiveHandlers(peerHash: string): Promise<void> {
+		const state = this._activeReceiveHandlersByPeer.get(peerHash);
+		if (!state || state.activeBuckets.size === 0) {
+			return;
+		}
+
+		// Rotate before awaiting so a reconnect/opening generation can keep receiving
+		// sync traffic without joining the drain for the previous subscription. Cleanup
+		// callers gate admission first; terminal callers also repeat until empty.
+		const buckets = [...state.activeBuckets];
+		state.current = { active: 0 };
+		const drain = Promise.all(
+			buckets.map((bucket) => {
+				bucket.drain ??= pDefer<void>();
+				return bucket.drain.promise;
+			}),
+		).then(() => undefined);
+		let drains = this._receiveHandlerDrainByPeer.get(peerHash);
+		if (!drains) {
+			drains = new Set();
+			this._receiveHandlerDrainByPeer.set(peerHash, drains);
+		}
+		drains.add(drain);
+		try {
+			await drain;
+		} finally {
+			drains.delete(drain);
+			if (drains.size === 0) {
+				this._receiveHandlerDrainByPeer.delete(peerHash);
+			}
+		}
+	}
+
+	private async drainReceiveHandlers(): Promise<void> {
+		for (;;) {
+			const peers = [...this._activeReceiveHandlersByPeer.keys()];
+			if (peers.length === 0) {
+				return;
+			}
+			await Promise.all(
+				peers.map((peerHash) => this.drainPeerReceiveHandlers(peerHash)),
+			);
+		}
+	}
+
+	private runPendingIHaveCallback(
+		pending: PendingIHave<T>,
+		entry: Entry<T>,
+	): void {
+		const replicationLifecycleController =
+			this._replicationLifecycleController;
+		if (!this.isReplicationLifecycleActive(replicationLifecycleController)) {
+			if (this._pendingIHave.get(entry.hash) === pending) {
+				pending.clear();
+				this._pendingIHave.delete(entry.hash);
+			}
+			return;
+		}
+
+		// Register before invoking the callback so a synchronous terminal reentry
+		// cannot make close/drop miss work that has already been admitted.
+		const completion = pDefer<void>();
+		const observed = completion.promise.catch((error) => {
+			if (!(this.isTerminating() && isNotStartedError(error as Error))) {
+				logger.error(error?.toString?.() ?? String(error));
+			}
+		});
+		this._pendingIHaveCallbacks.add(observed);
+		void observed.finally(() => {
+			this._pendingIHaveCallbacks.delete(observed);
+			if (this._pendingIHave.get(entry.hash) === pending) {
+				pending.clear();
+				this._pendingIHave.delete(entry.hash);
+			}
+		});
+
+		try {
+			Promise.resolve(pending.callback(entry)).then(
+				() => completion.resolve(),
+				(error) => completion.reject(error),
+			);
+		} catch (error) {
+			completion.reject(error);
+		}
+	}
+
+	private async drainPendingIHaveCallbacks(): Promise<void> {
+		while (this._pendingIHaveCallbacks.size > 0) {
+			await Promise.all([...this._pendingIHaveCallbacks]);
+		}
+	}
+
+	private blockPeerReceiveAdmission(peerHash: string) {
+		this._receiveCleanupGateByPeer.set(
+			peerHash,
+			(this._receiveCleanupGateByPeer.get(peerHash) ?? 0) + 1,
+		);
+	}
+
+	private unblockPeerReceiveAdmission(peerHash: string) {
+		const remaining = (this._receiveCleanupGateByPeer.get(peerHash) ?? 1) - 1;
+		if (remaining > 0) {
+			this._receiveCleanupGateByPeer.set(peerHash, remaining);
+		} else {
+			this._receiveCleanupGateByPeer.delete(peerHash);
+		}
+	}
+
 	private handleReplicationLifecycleSendError(
 		error: unknown,
 		controller = this._replicationLifecycleController,
@@ -5765,11 +6213,301 @@ export class SharedLog<
 		);
 	}
 
+	private setupReplicationAnnouncementRepairFunction(
+		interval = REPLICATION_ANNOUNCEMENT_REPAIR_INTERVAL,
+		maxAttempts = REPLICATION_ANNOUNCEMENT_REPAIR_MAX_ATTEMPTS,
+	): void {
+		if (!Number.isSafeInteger(maxAttempts) || maxAttempts <= 0) {
+			throw new RangeError(
+				"Replication announcement repair attempts must be positive",
+			);
+		}
+		this.replicationAnnouncementRepairDebounced?.close();
+		this._replicationAnnouncementRepairController?.abort();
+		this._replicationAnnouncementRepairGenerationController?.abort();
+		this._replicationAnnouncementRepairController = new AbortController();
+		this._replicationAnnouncementRepairGenerationController =
+			new AbortController();
+		this._replicationAnnouncementRepairPending = false;
+		this._replicationAnnouncementRepairGeneration =
+			this._replicationAnnouncementRetryGeneration;
+		this._replicationAnnouncementRepairTargets = new Map();
+		this._replicationAnnouncementRepairCohortSelected = false;
+		this._replicationAnnouncementRepairFairCursorHash = undefined;
+		this._replicationAnnouncementRepairMaxAttempts = maxAttempts;
+		this.replicationAnnouncementRepairDebounced = debounceFixedInterval(
+			() => this.runCurrentReplicationStateAnnouncementRepair(),
+			interval,
+			{
+				leading: false,
+				// The wrapper catches worker failures while it still owns the generation
+				// context. Keep this boundary visibility-only: it must never mutate a
+				// possibly newer generation's pending state.
+				onError: (error) => logger.error(error),
+			},
+		);
+	}
+
+	private cancelCurrentReplicationStateAnnouncementRepair(): void {
+		this._replicationAnnouncementRepairPending = false;
+		this._replicationAnnouncementRepairController?.abort();
+		this._replicationAnnouncementRepairGenerationController?.abort();
+		this.replicationAnnouncementRepairDebounced?.close();
+		this._replicationAnnouncementRepairTargets?.clear();
+	}
+
+	private advanceCurrentReplicationStateAnnouncementRepairGeneration(): void {
+		const generation = this._replicationAnnouncementRetryGeneration;
+		if (generation === this._replicationAnnouncementRepairGeneration) {
+			return;
+		}
+
+		// Abort acknowledged sends carrying the old full-state snapshot before the
+		// primary announcement for the new mutation waits on transport. Otherwise a
+		// stale batch can hold the current state behind DirectStream's seek timeout.
+		this._replicationAnnouncementRepairGenerationController?.abort();
+		this._replicationAnnouncementRepairGenerationController =
+			new AbortController();
+		this._replicationAnnouncementRepairGeneration = generation;
+		this._replicationAnnouncementRepairPending = false;
+		this._replicationAnnouncementRepairTargets.clear();
+		this._replicationAnnouncementRepairCohortSelected = false;
+	}
+
+	private queueCurrentReplicationStateAnnouncementRepair(): void {
+		if (
+			this.closed ||
+			this._closeController.signal.aborted ||
+			this._replicationAnnouncementRepairController.signal.aborted ||
+			!this.replicationAnnouncementRepairDebounced
+		) {
+			return;
+		}
+
+		this.advanceCurrentReplicationStateAnnouncementRepairGeneration();
+		this._replicationAnnouncementRepairPending = true;
+		void this.replicationAnnouncementRepairDebounced.call();
+	}
+
+	private async runCurrentReplicationStateAnnouncementRepair(): Promise<void> {
+		const generation = this._replicationAnnouncementRetryGeneration;
+		const lifecycleController = this._replicationAnnouncementRepairController;
+		const generationController =
+			this._replicationAnnouncementRepairGenerationController;
+		try {
+			await this.repairCurrentReplicationStateAnnouncement({
+				generation,
+				lifecycleController,
+				generationController,
+			});
+		} catch (error) {
+			if (
+				this.closed ||
+				this._closeController.signal.aborted ||
+				lifecycleController.signal.aborted ||
+				generationController.signal.aborted ||
+				generation !== this._replicationAnnouncementRetryGeneration ||
+				generationController !==
+					this._replicationAnnouncementRepairGenerationController
+			) {
+				return;
+			}
+			if (isNotStartedError(error as Error)) {
+				return;
+			}
+
+			// Only the worker that still owns the current generation may conclude
+			// that its repair failed. A stale worker must not clear a newer call's
+			// pending flag or attribute its error to the new generation.
+			this._replicationAnnouncementRepairPending = false;
+			logger.error(error);
+		}
+	}
+
+	private async repairCurrentReplicationStateAnnouncement(context?: {
+		generation: number;
+		lifecycleController: AbortController;
+		generationController: AbortController;
+	}): Promise<void> {
+		if (!this._replicationAnnouncementRepairPending) {
+			return;
+		}
+		const generation =
+			context?.generation ?? this._replicationAnnouncementRetryGeneration;
+		const lifecycleController =
+			context?.lifecycleController ??
+			this._replicationAnnouncementRepairController;
+		const generationController =
+			context?.generationController ??
+			this._replicationAnnouncementRepairGenerationController;
+		const segments = (await this.getMyReplicationSegments()).map((range) =>
+			range.toReplicationRange(),
+		);
+		if (
+			this.closed ||
+			this._closeController.signal.aborted ||
+			lifecycleController.signal.aborted ||
+			generationController.signal.aborted
+		) {
+			return;
+		}
+		if (generation !== this._replicationAnnouncementRetryGeneration) {
+			this.queueCurrentReplicationStateAnnouncementRepair();
+			return;
+		}
+
+		const subscribers =
+			(await this.node.services.pubsub.getSubscribers(this.topic)) ?? [];
+		if (
+			this.closed ||
+			this._closeController.signal.aborted ||
+			lifecycleController.signal.aborted ||
+			generationController.signal.aborted
+		) {
+			return;
+		}
+		if (generation !== this._replicationAnnouncementRetryGeneration) {
+			this.queueCurrentReplicationStateAnnouncementRepair();
+			return;
+		}
+
+		const selfHash = this.node.identity.publicKey.hashcode();
+		const currentTargets = new Map<string, PublicSignKey>();
+		for (const key of subscribers) {
+			const hash = key.hashcode();
+			if (
+				hash !== selfHash &&
+				!this._replicationInfoBlockedPeers.has(hash) &&
+				!currentTargets.has(hash)
+			) {
+				currentTargets.set(hash, key);
+			}
+		}
+
+		for (const [hash, target] of this._replicationAnnouncementRepairTargets) {
+			if (target.generation !== generation || !currentTargets.has(hash)) {
+				this._replicationAnnouncementRepairTargets.delete(hash);
+			} else {
+				target.key = currentTargets.get(hash)!;
+			}
+		}
+		if (!this._replicationAnnouncementRepairCohortSelected) {
+			const candidates = [...currentTargets.entries()].sort(([left], [right]) =>
+				left.localeCompare(right),
+			);
+			const cursorIndex = this._replicationAnnouncementRepairFairCursorHash
+				? candidates.findIndex(
+						([hash]) =>
+							hash.localeCompare(
+								this._replicationAnnouncementRepairFairCursorHash!,
+							) > 0,
+					)
+				: 0;
+			const fairStart = cursorIndex < 0 ? 0 : cursorIndex;
+			const fairOrder = [
+				...candidates.slice(fairStart),
+				...candidates.slice(0, fairStart),
+			];
+			const cohort = fairOrder.slice(
+				0,
+				REPLICATION_ANNOUNCEMENT_REPAIR_TARGETS_PER_GENERATION,
+			);
+			for (const [hash, key] of cohort) {
+				this._replicationAnnouncementRepairTargets.set(hash, {
+					key,
+					generation,
+					attempts: 0,
+					done: false,
+				});
+			}
+			if (cohort.length > 0) {
+				this._replicationAnnouncementRepairFairCursorHash =
+					cohort[cohort.length - 1][0];
+			}
+			this._replicationAnnouncementRepairCohortSelected = true;
+		}
+
+		const batch = [
+			...this._replicationAnnouncementRepairTargets.entries(),
+		].filter(([, target]) => !target.done);
+		const snapshot = new AllReplicatingSegmentsMessage({ segments });
+		const results = await Promise.allSettled(
+			batch.map(([, target]) =>
+				this.rpc.send(snapshot, {
+					mode: new AcknowledgeDelivery({
+						to: [target.key],
+						redundancy: 1,
+					}),
+					priority: CONVERGENCE_MESSAGE_PRIORITY,
+					signal: generationController.signal,
+				}),
+			),
+		);
+		if (
+			this.closed ||
+			this._closeController.signal.aborted ||
+			lifecycleController.signal.aborted ||
+			generationController.signal.aborted
+		) {
+			return;
+		}
+		if (generation !== this._replicationAnnouncementRetryGeneration) {
+			this.queueCurrentReplicationStateAnnouncementRepair();
+			return;
+		}
+
+		for (const [index, result] of results.entries()) {
+			const [hash, attemptedTarget] = batch[index];
+			const target = this._replicationAnnouncementRepairTargets.get(hash);
+			if (target !== attemptedTarget || target.generation !== generation) {
+				continue;
+			}
+			if (result.status === "fulfilled") {
+				// DirectStream ACKs confirm that the signed transport envelope reached
+				// the target. Applying the contained replication state remains a
+				// receiver-local, best-effort operation.
+				target.done = true;
+				continue;
+			}
+
+			target.attempts += 1;
+			if (!isTransientReplicationAnnouncementRepairError(result.reason)) {
+				target.done = true;
+				logger.error(result.reason);
+			} else if (
+				target.attempts >= this._replicationAnnouncementRepairMaxAttempts
+			) {
+				target.done = true;
+				logger.trace(
+					"Acknowledged replication announcement repair exhausted for %s",
+					hash,
+				);
+			}
+		}
+
+		if (generation !== this._replicationAnnouncementRetryGeneration) {
+			this.queueCurrentReplicationStateAnnouncementRepair();
+			return;
+		}
+		if (
+			[...this._replicationAnnouncementRepairTargets.values()].some(
+				(target) => !target.done,
+			)
+		) {
+			void this.replicationAnnouncementRepairDebounced?.call();
+			return;
+		}
+
+		this._replicationAnnouncementRepairPending = false;
+		this._replicationAnnouncementRepairTargets.clear();
+	}
+
 	private cancelCurrentReplicationStateAnnouncementRetry(): void {
 		this._replicationAnnouncementRetryGeneration += 1;
 		this._replicationAnnouncementRetryPending = false;
 		this._replicationAnnouncementRetryController?.abort();
 		this.replicationAnnouncementRetryDebounced?.close();
+		this.cancelCurrentReplicationStateAnnouncementRepair();
 	}
 
 	private async sendReplicationAnnouncement(
@@ -5783,10 +6521,12 @@ export class SharedLog<
 		// local state; the generation mismatch forces one more current snapshot
 		// after that stale send settles.
 		this._replicationAnnouncementRetryGeneration += 1;
+		this.advanceCurrentReplicationStateAnnouncementRepairGeneration();
 		try {
 			await this.rpc.send(message, {
 				priority: CONVERGENCE_MESSAGE_PRIORITY,
 			});
+			this.queueCurrentReplicationStateAnnouncementRepair();
 		} catch (error) {
 			// The local replication-index mutation precedes all calls to this
 			// wrapper. Preserve the explicit caller's rejection, but independently
@@ -5820,6 +6560,7 @@ export class SharedLog<
 				priority: CONVERGENCE_MESSAGE_PRIORITY,
 				signal: controller.signal,
 			});
+			this.queueCurrentReplicationStateAnnouncementRepair();
 		} catch (error) {
 			if (
 				this.closed ||
@@ -6363,76 +7104,167 @@ export class SharedLog<
 
 	private async removeReplicator(
 		key: PublicSignKey | string,
-		options?: { noEvent?: boolean },
-	) {
+		options?: {
+			cleanupIfSubscriptionSuperseded?: boolean;
+			expectedJoinWarmupGeneration?: object | null;
+			noEvent?: boolean;
+			onRemoved?: (state: { wasReplicator: boolean }) => void;
+			replicationLifecycleController?: AbortController;
+			shouldRemove?: () => boolean;
+			subscriptionEpoch?: object | null;
+		},
+	): Promise<boolean> {
 		const keyHash = typeof key === "string" ? key : key.hashcode();
-		const deleted = await this.replicationIndex
-			.iterate({
-				query: { hash: keyHash },
-			})
-			.all();
+		const expectedJoinWarmupGeneration =
+			options?.expectedJoinWarmupGeneration !== undefined
+				? options.expectedJoinWarmupGeneration
+				: (this._joinWarmupGenerationByTarget.get(keyHash) ?? null);
+		const ownsSubscriptionEpoch = () =>
+			options?.subscriptionEpoch === undefined ||
+			this.isCurrentSubscriptionEpoch(keyHash, options.subscriptionEpoch);
+		const ownsReplicationLifecycle = () =>
+			options?.replicationLifecycleController === undefined ||
+			this.isReplicationLifecycleActive(
+				options.replicationLifecycleController,
+			);
+		const cancelExpectedJoinWarmupTarget = () => {
+			if (
+				expectedJoinWarmupGeneration !== null &&
+				this._joinWarmupGenerationByTarget.get(keyHash) ===
+					expectedJoinWarmupGeneration
+			) {
+				this.cancelJoinWarmupTarget(keyHash);
+			}
+		};
+		const isMe = this.node.identity.publicKey.hashcode() === keyHash;
+		let receiveAdmissionBlocked = false;
+		const blockAndDrainPeerReceives = async () => {
+			if (!receiveAdmissionBlocked) {
+				this.blockPeerReceiveAdmission(keyHash);
+				receiveAdmissionBlocked = true;
+			}
+			await this.drainPeerReceiveHandlers(keyHash);
+		};
+		const cleanupDisconnectedPeer = async () => {
+			await blockAndDrainPeerReceives();
+			this.removePeerFromGidPeerHistory(keyHash);
+			this.cleanupPeerDisconnectTracking(keyHash);
+			this.removeRepairFrontierTarget(keyHash, {
+				expectedJoinWarmupGeneration,
+			});
+			this._recentRepairDispatch.delete(keyHash);
+			if (!isMe) {
+				await this.syncronizer.onPeerDisconnected(keyHash);
+			}
+		};
+		let removed = false;
 
-		this.uniqueReplicators.delete(keyHash);
-		this._replicatorJoinEmitted.delete(keyHash);
-		await this.replicationIndex.del({ query: { hash: keyHash } });
-		for (const result of deleted) {
-			this.deleteNativeReplicationRange(result.value);
-		}
+		// Replication-info updates already serialize per peer. Put the hash-wide
+		// removal on the same queue so a newer reset cannot be deleted underneath
+		// itself by an older unsubscribe callback.
+		await this.withReplicationInfoApplyQueue(keyHash, async () => {
+			if (!ownsReplicationLifecycle()) {
+				return;
+			}
+			if (!ownsSubscriptionEpoch()) {
+				// A reconnect may supersede an unsubscribe before its destructive
+				// removal starts. Still retire the old connection's sync/request state
+				// in lane order so the reconnect barrier cannot inherit stale caches.
+				if (options?.cleanupIfSubscriptionSuperseded) {
+					await cleanupDisconnectedPeer();
+				}
+				return;
+			}
+			if (options?.shouldRemove && !options.shouldRemove()) {
+				return;
+			}
+			const wasReplicator = this.uniqueReplicators.has(keyHash);
 
-		await this.updateOldestTimestampFromIndex();
+			const deleted = await this.replicationIndex
+				.iterate({
+					query: { hash: keyHash },
+				})
+				.all();
+			// Liveness evidence can arrive without a subscription transition while
+			// this scan is pending. Stop new receives, drain those already admitted,
+			// then revalidate immediately before the first destructive mutation.
+			await blockAndDrainPeerReceives();
+			if (options?.shouldRemove && !options.shouldRemove()) {
+				return;
+			}
+			// Liveness removal must not cancel a still-current warmup until fresh
+			// activity has been rechecked at the destructive boundary.
+			cancelExpectedJoinWarmupTarget();
 
-		const isMe = this.node.identity.publicKey.hashcode() === keyHash;
-		if (isMe) {
-			// announce that we are no longer replicating
+			await this.replicationIndex.del({ query: { hash: keyHash } });
+			for (const result of deleted) {
+				this.deleteNativeReplicationRange(result.value);
+			}
 
-			await this.sendReplicationAnnouncement(
-				new AllReplicatingSegmentsMessage({ segments: [] }),
-			);
-		}
+			// Once the range indexes have removed the peer, make membership agree
+			// before any later awaited bookkeeping can fail.
+			this.uniqueReplicators.delete(keyHash);
+			this._replicatorJoinEmitted.delete(keyHash);
 
-		if (options?.noEvent !== true) {
-			const publicKey = toLocalPublicSignKey(key);
-			if (publicKey) {
-				this.events.dispatchEvent(
-					new CustomEvent<ReplicationChangeEvent>("replication:change", {
-						detail: { publicKey },
-					}),
+			await this.updateOldestTimestampFromIndex();
+
+			if (isMe) {
+				// announce that we are no longer replicating
+
+				await this.sendReplicationAnnouncement(
+					new AllReplicatingSegmentsMessage({ segments: [] }),
 				);
-			} else {
-				throw new Error("Key was not a PublicSignKey");
 			}
-		}
 
-		const timestamp = BigInt(+new Date());
-		for (const x of deleted) {
-			this.replicationChangeDebounceFn.add({
-				range: x.value,
-				type: "removed",
-				timestamp,
-			});
-		}
+			if (options?.noEvent !== true) {
+				const publicKey = toLocalPublicSignKey(key);
+				if (publicKey) {
+					this.events.dispatchEvent(
+						new CustomEvent<ReplicationChangeEvent>("replication:change", {
+							detail: { publicKey },
+						}),
+					);
+				} else {
+					throw new Error("Key was not a PublicSignKey");
+				}
+			}
+			const timestamp = BigInt(+new Date());
+			for (const x of deleted) {
+				this.replicationChangeDebounceFn.add({
+					range: x.value,
+					type: "removed",
+					timestamp,
+				});
+			}
 
-		const pendingMaturity = this.pendingMaturity.get(keyHash);
-		if (pendingMaturity) {
-			for (const [_k, v] of pendingMaturity) {
-				clearTimeout(v.timeout);
+			const pendingMaturity = this.pendingMaturity.get(keyHash);
+			if (pendingMaturity) {
+				for (const [_k, v] of pendingMaturity) {
+					clearTimeout(v.timeout);
+				}
+				this.pendingMaturity.delete(keyHash);
 			}
-			this.pendingMaturity.delete(keyHash);
-		}
 
-		// Keep local sync/prune state consistent even when a peer disappears
-		// through replication-info updates without a topic unsubscribe event.
-		this.removePeerFromGidPeerHistory(keyHash);
-		this._checkedPrune.cleanupPeer(keyHash);
-		this.removeRepairFrontierTarget(keyHash);
-		this._recentRepairDispatch.delete(keyHash);
-		if (!isMe) {
-			this.syncronizer.onPeerDisconnected(keyHash);
-		}
+			// Keep local sync/prune state consistent even when a peer disappears
+			// through replication-info updates without a topic unsubscribe event.
+			await cleanupDisconnectedPeer();
 
-		if (!isMe) {
-			this.rebalanceParticipationDebounced?.call();
-		}
+			if (!isMe) {
+				// Replication-info handlers release their receive lease before joining
+				// this lane. Fence every handler queued behind this successful removal,
+				// regardless of whether it came from liveness, startup pruning, or an
+				// unsubscribe transition.
+				this.advanceReplicationInfoRecoveryEpoch(keyHash);
+				this.rebalanceParticipationDebounced?.call();
+			}
+			removed = true;
+			options?.onRemoved?.({ wasReplicator });
+		}).finally(() => {
+			if (receiveAdmissionBlocked) {
+				this.unblockPeerReceiveAdmission(keyHash);
+			}
+		});
+		return removed;
 	}
 
 	private async updateOldestTimestampFromIndex() {
@@ -6541,6 +7373,10 @@ export class SharedLog<
 		if (this._isTrustedReplicator && !(await this._isTrustedReplicator(from))) {
 			return undefined;
 		}
+		// Preserve what the peer announced before duplicate filtering can empty the
+		// working array. A repeated authoritative/non-empty announcement is still
+		// proof of live membership after this process reopens.
+		const announcedReplication = ranges.length > 0;
 		let isNewReplicator = false;
 		let timestamp = BigInt(ts ?? +new Date());
 		rebalance = rebalance == null ? true : rebalance;
@@ -6678,13 +7514,13 @@ export class SharedLog<
 		// means "nothing new", not "stopped". Removing the peer here would let
 		// uniqueReplicators diverge from replicationIndex while the peer's
 		// ranges stay indexed.
-		const announcedStopped = reset === true && ranges.length === 0;
+		const announcedStopped = reset === true && !announcedReplication;
 		const stoppedTransition = announcedStopped
 			? this.uniqueReplicators.delete(fromHash)
 			: false;
 		if (announcedStopped) {
 			this._replicatorJoinEmitted.delete(fromHash);
-		} else if (ranges.length > 0) {
+		} else if (announcedReplication) {
 			this.uniqueReplicators.add(fromHash);
 		}
 
@@ -6822,6 +7658,18 @@ export class SharedLog<
 				this.rebalanceParticipationDebounced?.call();
 			}
 		}
+		if (
+			announcedReplication &&
+			!from.equals(this.node.identity.publicKey) &&
+			!this._replicatorJoinEmitted.has(fromHash)
+		) {
+			this._replicatorJoinEmitted.add(fromHash);
+			this.events.dispatchEvent(
+				new CustomEvent<ReplicatorJoinEvent>("replicator:join", {
+					detail: { publicKey: from },
+				}),
+			);
+		}
 		return diffs;
 	}
 
@@ -7068,21 +7916,50 @@ export class SharedLog<
 		return observedAt != null && Date.now() - observedAt <= maxAgeMs;
 	}
 
-	private markRepairSweepOptimisticPeer(gid: string, peer: string) {
+	private markRepairSweepOptimisticPeer(
+		gid: string,
+		peer: string,
+		generation: object,
+	) {
 		let peers = this._repairSweepOptimisticGidPeersPending.get(gid);
 		if (!peers) {
 			peers = new Map();
 			this._repairSweepOptimisticGidPeersPending.set(gid, peers);
 		}
-		peers.set(peer, (peers.get(peer) || 0) + 1);
+		const current = peers.get(peer);
+		peers.set(peer, {
+			count: current?.generation === generation ? current.count + 1 : 1,
+			generation,
+		});
+		let gids = this._repairSweepOptimisticGidsByPeer.get(peer);
+		if (!gids) {
+			gids = new Set();
+			this._repairSweepOptimisticGidsByPeer.set(peer, gids);
+		}
+		gids.add(gid);
 	}
 
 	private hasPendingRepairSweepOptimisticPeer(gid: string, peer: string) {
 		return (
-			(this._repairSweepOptimisticGidPeersPending.get(gid)?.get(peer) || 0) > 0
+			(this._repairSweepOptimisticGidPeersPending.get(gid)?.get(peer)?.count ||
+				0) > 0
 		);
 	}
 
+	private clearRepairSweepOptimisticPeer(peer: string) {
+		for (const gid of this._repairSweepOptimisticGidsByPeer.get(peer) ?? []) {
+			const peers = this._repairSweepOptimisticGidPeersPending.get(gid);
+			if (!peers) {
+				continue;
+			}
+			peers.delete(peer);
+			if (peers.size === 0) {
+				this._repairSweepOptimisticGidPeersPending.delete(gid);
+			}
+		}
+		this._repairSweepOptimisticGidsByPeer.delete(peer);
+	}
+
 	private createEntryReplicatedForRepair(properties: {
 		entry: Entry<T>;
 		coordinates: NumberFromType<R>[];
@@ -7133,54 +8010,309 @@ export class SharedLog<
 			const timer = setTimeout(() => {
 				this._repairRetryTimers.delete(timer);
 				resolve();
-			}, delayMs);
-			timer.unref?.();
-			this._repairRetryTimers.add(timer);
+			}, delayMs);
+			timer.unref?.();
+			this._repairRetryTimers.add(timer);
+		});
+	}
+
+	private queueRepairFrontierEntries(
+		mode: RepairDispatchMode,
+		target: string,
+		entries: ReadonlyMap<string, RepairDispatchEntry<R>>,
+		options?: { bypassKnownPeerHints?: boolean },
+	) {
+		let targets = this._repairFrontierByMode.get(mode);
+		if (!targets) {
+			targets = new Map();
+			this._repairFrontierByMode.set(mode, targets);
+		}
+		let pending = targets.get(target);
+		if (!pending) {
+			pending = new Map();
+			targets.set(target, pending);
+		}
+		for (const [hash, entry] of entries) {
+			pending.set(hash, entry);
+		}
+		if (options?.bypassKnownPeerHints === true) {
+			this._repairFrontierBypassKnownPeersByMode.get(mode)?.add(target);
+		}
+	}
+
+	private clearRepairFrontierHashes(target: string, hashes: Iterable<string>) {
+		const hashList = [...hashes];
+		if (hashList.length === 0) {
+			return;
+		}
+		for (const mode of REPAIR_DISPATCH_MODES) {
+			const pending = this._repairFrontierByMode.get(mode)?.get(target);
+			if (!pending) {
+				continue;
+			}
+			for (const hash of hashList) {
+				pending.delete(hash);
+			}
+			if (pending.size === 0) {
+				this._repairFrontierByMode.get(mode)?.delete(target);
+				this._repairFrontierBypassKnownPeersByMode.get(mode)?.delete(target);
+			}
+		}
+	}
+
+	private getJoinWarmupGeneration(target: string) {
+		let generation = this._joinWarmupGenerationByTarget.get(target);
+		if (!generation) {
+			generation = {};
+			this._joinWarmupGenerationByTarget.set(target, generation);
+		}
+		return generation;
+	}
+
+	private trackJoinWarmupTimer(
+		target: string,
+		timer: JoinWarmupRetryTimer,
+	) {
+		let timers = this._joinWarmupRetryTimersByTarget.get(target);
+		if (!timers) {
+			timers = new Set();
+			this._joinWarmupRetryTimersByTarget.set(target, timers);
+		}
+		timers.add(timer);
+		this._repairRetryTimers.add(timer.handle);
+	}
+
+	private untrackJoinWarmupTimer(
+		target: string,
+		timer: JoinWarmupRetryTimer,
+	) {
+		this._repairRetryTimers.delete(timer.handle);
+		const timers = this._joinWarmupRetryTimersByTarget.get(target);
+		if (!timers) {
+			return;
+		}
+		timers.delete(timer);
+		if (timers.size === 0) {
+			this._joinWarmupRetryTimersByTarget.delete(target);
+		}
+	}
+
+	private cancelJoinWarmupTimers(target: string) {
+		const timers = this._joinWarmupRetryTimersByTarget.get(target);
+		if (!timers) {
+			return;
+		}
+		for (const timer of [...timers]) {
+			clearTimeout(timer.handle);
+			timer.resolve?.();
+			this.untrackJoinWarmupTimer(target, timer);
+		}
+	}
+
+	private cancelJoinWarmupTarget(target: string) {
+		this._joinWarmupGenerationByTarget.delete(target);
+		const pendingWarmupPeers =
+			this._repairSweepPendingPeersByMode.get("join-warmup");
+		pendingWarmupPeers?.delete(target);
+		if (pendingWarmupPeers?.size === 0) {
+			this._repairSweepPendingModes.delete("join-warmup");
+		}
+		this._repairSweepJoinWarmupGenerationByTarget.delete(target);
+		this.clearRepairSweepOptimisticPeer(target);
+		this.cancelJoinWarmupTimers(target);
+		this._joinWarmupScheduledRetriesByTarget.delete(target);
+		const state = this._joinWarmupSendStateByTarget.get(target);
+		if (!state) {
+			return;
+		}
+		state.bypassKnownPeerHints = false;
+		state.entries.clear();
+		state.pending = false;
+		if (!state.running) {
+			this._joinWarmupSendStateByTarget.delete(target);
+		}
+	}
+
+	private cancelAllJoinWarmupTargets() {
+		const targets = new Set([
+			...this._joinWarmupGenerationByTarget.keys(),
+			...this._joinWarmupRetryTimersByTarget.keys(),
+			...this._joinWarmupScheduledRetriesByTarget.keys(),
+			...this._joinWarmupSendStateByTarget.keys(),
+		]);
+		for (const target of targets) {
+			this.cancelJoinWarmupTarget(target);
+		}
+	}
+
+	private async sleepJoinWarmupTracked(target: string, delayMs: number) {
+		if (delayMs <= 0) {
+			return;
+		}
+		await new Promise<void>((resolve) => {
+			let settled = false;
+			let trackedTimer!: JoinWarmupRetryTimer;
+			const settle = () => {
+				if (settled) {
+					return;
+				}
+				settled = true;
+				this.untrackJoinWarmupTimer(target, trackedTimer);
+				resolve();
+			};
+			const handle = setTimeout(settle, delayMs);
+			handle.unref?.();
+			trackedTimer = { handle, resolve: settle };
+			this.trackJoinWarmupTimer(target, trackedTimer);
 		});
 	}
 
-	private queueRepairFrontierEntries(
-		mode: RepairDispatchMode,
+	private scheduleJoinWarmupRetries(
 		target: string,
+		generation: object,
+		delaysMs: Iterable<number>,
 		entries: ReadonlyMap<string, RepairDispatchEntry<R>>,
-		options?: { bypassKnownPeerHints?: boolean },
+		bypassKnownPeerHints: boolean,
 	) {
-		let targets = this._repairFrontierByMode.get(mode);
-		if (!targets) {
-			targets = new Map();
-			this._repairFrontierByMode.set(mode, targets);
+		if (
+			this.closed ||
+			this._joinWarmupGenerationByTarget.get(target) !== generation
+		) {
+			return;
 		}
-		let pending = targets.get(target);
-		if (!pending) {
-			pending = new Map();
-			targets.set(target, pending);
+		let scheduled = this._joinWarmupScheduledRetriesByTarget.get(target);
+		if (scheduled?.generation !== generation) {
+			this.cancelJoinWarmupTimers(target);
+			this._joinWarmupScheduledRetriesByTarget.delete(target);
+			scheduled = undefined;
 		}
-		for (const [hash, entry] of entries) {
-			pending.set(hash, entry);
+		if (!scheduled) {
+			scheduled = {
+				generation,
+				slotsByDelay: new Map(),
+			};
+			this._joinWarmupScheduledRetriesByTarget.set(target, scheduled);
 		}
-		if (options?.bypassKnownPeerHints === true) {
-			this._repairFrontierBypassKnownPeersByMode.get(mode)?.add(target);
+		const delays = [...new Set(delaysMs)];
+		const batch: JoinWarmupScheduledRetryBatch<R> = {
+			bypassKnownPeerHints,
+			entries: new Map(entries),
+			remainingAttempts: delays.length,
+		};
+		const now = Date.now();
+		for (const delayMs of delays) {
+			let slot = scheduled.slotsByDelay.get(delayMs);
+			if (!slot) {
+				slot = { cohorts: [], head: 0 };
+				scheduled.slotsByDelay.set(delayMs, slot);
+			}
+			const tail = slot.cohorts.at(-1);
+			const dueAt = Math.max(tail?.dueAt ?? 0, now + delayMs);
+			if (tail?.dueAt === dueAt) {
+				tail.batches.push(batch);
+			} else {
+				slot.cohorts.push({
+					batches: [batch],
+					dueAt,
+				});
+			}
+			this.armJoinWarmupRetrySlot(
+				target,
+				scheduled,
+				delayMs,
+				slot,
+			);
 		}
 	}
 
-	private clearRepairFrontierHashes(target: string, hashes: Iterable<string>) {
-		const hashList = [...hashes];
-		if (hashList.length === 0) {
+	private armJoinWarmupRetrySlot(
+		target: string,
+		scheduled: JoinWarmupScheduledRetries<R>,
+		delayMs: number,
+		slot: JoinWarmupScheduledRetrySlot<R>,
+	) {
+		const nextDueAt = slot.cohorts[slot.head]?.dueAt;
+		if (nextDueAt == null) {
 			return;
 		}
-		for (const mode of REPAIR_DISPATCH_MODES) {
-			const pending = this._repairFrontierByMode.get(mode)?.get(target);
-			if (!pending) {
-				continue;
-			}
-			for (const hash of hashList) {
-				pending.delete(hash);
-			}
-			if (pending.size === 0) {
-				this._repairFrontierByMode.get(mode)?.delete(target);
-				this._repairFrontierBypassKnownPeersByMode.get(mode)?.delete(target);
-			}
+		if (slot.timer && slot.timerDueAt === nextDueAt) {
+			return;
+		}
+		if (slot.timer) {
+			clearTimeout(slot.timer.handle);
+			this.untrackJoinWarmupTimer(target, slot.timer);
 		}
+		let trackedTimer!: JoinWarmupRetryTimer;
+		const handle = setTimeout(
+			() => {
+				this.untrackJoinWarmupTimer(target, trackedTimer);
+				if (slot.timer !== trackedTimer) {
+					return;
+				}
+				slot.timer = undefined;
+				slot.timerDueAt = undefined;
+				const current = this._joinWarmupScheduledRetriesByTarget.get(target);
+				if (
+					current !== scheduled ||
+					current.slotsByDelay.get(delayMs) !== slot
+				) {
+					return;
+				}
+
+				const dueEntries = new Map<string, RepairDispatchEntry<R>>();
+				let bypassKnownPeerHints = false;
+				const now = Date.now();
+				while (
+					slot.head < slot.cohorts.length &&
+					slot.cohorts[slot.head].dueAt <= now
+				) {
+					const cohort = slot.cohorts[slot.head++];
+					for (const batch of cohort.batches) {
+						for (const [hash, entry] of batch.entries) {
+							dueEntries.set(hash, entry);
+						}
+						bypassKnownPeerHints ||=
+							batch.bypassKnownPeerHints;
+						batch.remainingAttempts -= 1;
+						if (batch.remainingAttempts === 0) {
+							batch.entries.clear();
+						}
+					}
+					cohort.batches.length = 0;
+				}
+				if (
+					dueEntries.size > 0 &&
+					!this.closed &&
+					this._joinWarmupGenerationByTarget.get(target) ===
+						scheduled.generation
+				) {
+					this.queueJoinWarmupSend(
+						target,
+						scheduled.generation,
+						dueEntries,
+						bypassKnownPeerHints,
+					);
+				}
+				if (slot.head === slot.cohorts.length) {
+					current.slotsByDelay.delete(delayMs);
+					if (current.slotsByDelay.size === 0) {
+						this._joinWarmupScheduledRetriesByTarget.delete(target);
+					}
+					return;
+				}
+				if (slot.head >= 1_024 && slot.head * 2 >= slot.cohorts.length) {
+					slot.cohorts = slot.cohorts.slice(slot.head);
+					slot.head = 0;
+				}
+				this.armJoinWarmupRetrySlot(target, current, delayMs, slot);
+			},
+			Math.max(0, nextDueAt - Date.now()),
+		);
+		handle.unref?.();
+		trackedTimer = { handle };
+		slot.timer = trackedTimer;
+		slot.timerDueAt = nextDueAt;
+		this.trackJoinWarmupTimer(target, trackedTimer);
 	}
 
 	private async getFullReplicaRepairCandidates(
@@ -7216,7 +8348,18 @@ export class SharedLog<
 		return candidates;
 	}
 
-	private removeRepairFrontierTarget(target: string) {
+	private removeRepairFrontierTarget(
+		target: string,
+		options?: { expectedJoinWarmupGeneration?: object | null },
+	) {
+		if (
+			options?.expectedJoinWarmupGeneration === undefined ||
+			(options.expectedJoinWarmupGeneration !== null &&
+				this._joinWarmupGenerationByTarget.get(target) ===
+					options.expectedJoinWarmupGeneration)
+		) {
+			this.cancelJoinWarmupTarget(target);
+		}
 		for (const mode of REPAIR_DISPATCH_MODES) {
 			this._repairFrontierByMode.get(mode)?.delete(target);
 			this._repairFrontierActiveTargetsByMode.get(mode)?.delete(target);
@@ -7329,6 +8472,110 @@ export class SharedLog<
 		});
 	}
 
+	private queueJoinWarmupSend(
+		target: string,
+		generation: object,
+		entries: ReadonlyMap<string, RepairDispatchEntry<R>>,
+		bypassKnownPeerHints: boolean,
+	) {
+		if (
+			this.closed ||
+			this._joinWarmupGenerationByTarget.get(target) !== generation
+		) {
+			return;
+		}
+		let state = this._joinWarmupSendStateByTarget.get(target);
+		if (!state) {
+			state = {
+				bypassKnownPeerHints: false,
+				entries: new Map(),
+				generation,
+				lastCompletedAt: Number.NEGATIVE_INFINITY,
+				pending: false,
+				running: false,
+			};
+			this._joinWarmupSendStateByTarget.set(target, state);
+		} else if (state.generation !== generation) {
+			state.bypassKnownPeerHints = false;
+			state.entries.clear();
+			state.pending = false;
+		}
+		for (const [hash, entry] of entries) {
+			state.entries.set(hash, entry);
+		}
+		state.bypassKnownPeerHints ||= bypassKnownPeerHints;
+		state.generation = generation;
+		state.pending = true;
+		if (state.running) {
+			return;
+		}
+		void this.drainJoinWarmupSends(target, state).catch((error: any) =>
+			logger.error(error),
+		);
+	}
+
+	private async drainJoinWarmupSends(
+		target: string,
+		state: JoinWarmupSendState<R>,
+	) {
+		if (state.running) {
+			return;
+		}
+		state.running = true;
+		try {
+			while (state.pending) {
+				state.pending = false;
+				const generation = state.generation;
+				const entries = new Map(state.entries);
+				state.entries.clear();
+				const bypassKnownPeerHints = state.bypassKnownPeerHints;
+				state.bypassKnownPeerHints = false;
+				const spacingMs = Math.max(
+					0,
+					state.lastCompletedAt + JOIN_WARMUP_SEND_SPACING_MS - Date.now(),
+				);
+				await this.sleepJoinWarmupTracked(target, spacingMs);
+				if (
+					this.closed ||
+					state.generation !== generation ||
+					this._joinWarmupGenerationByTarget.get(target) !== generation
+				) {
+					continue;
+				}
+				if (entries.size === 0) {
+					continue;
+				}
+				this._repairMetrics["join-warmup"].simpleFallbackPasses += 1;
+				try {
+					await this.sendRepairEntriesWithTransport(
+						target,
+						entries,
+						"simple",
+						{
+							bypassKnownPeers: bypassKnownPeerHints,
+							bypassRecentKnownPeers: bypassKnownPeerHints,
+						},
+					);
+				} catch (error: any) {
+					logger.error(error);
+				} finally {
+					state.lastCompletedAt = Date.now();
+				}
+			}
+		} finally {
+			state.running = false;
+			if (this._joinWarmupSendStateByTarget.get(target) === state) {
+				if (state.pending) {
+					void this.drainJoinWarmupSends(target, state).catch((error: any) =>
+						logger.error(error),
+					);
+				} else if (!this._joinWarmupGenerationByTarget.has(target)) {
+					this._joinWarmupSendStateByTarget.delete(target);
+				}
+			}
+		}
+	}
+
 	private async sendMaybeMissingEntriesNow(
 		target: string,
 		entries: ReadonlyMap<string, RepairDispatchEntry<R>>,
@@ -7616,18 +8863,34 @@ export class SharedLog<
 		const bucket = this._repairMetrics[options.mode];
 		bucket.dispatches += 1;
 		bucket.entries += filteredEntries.size;
+		const joinWarmupGeneration =
+			options.mode === "join-warmup"
+				? this.getJoinWarmupGeneration(target)
+				: undefined;
+		const bypassKnownPeerHints = this.shouldBypassKnownPeerHints(
+			options.mode,
+			options.bypassKnownPeerHints,
+		);
 
 		const run = (transport: RepairTransportMode) => {
-			if (transport === "simple") {
-				bucket.simpleFallbackPasses += 1;
-			} else {
+			if (
+				transport === "simple" &&
+				options.mode === "join-warmup" &&
+				joinWarmupGeneration
+			) {
+				this.queueJoinWarmupSend(
+					target,
+					joinWarmupGeneration,
+					filteredEntries,
+					bypassKnownPeerHints,
+				);
+				return;
+			}
+			if (transport === "rateless") {
 				bucket.ratelessFirstPasses += 1;
+			} else {
+				bucket.simpleFallbackPasses += 1;
 			}
-			const bypassKnownPeerHints = this.shouldBypassKnownPeerHints(
-				options.mode,
-				options.bypassKnownPeerHints,
-			);
-
 			return Promise.resolve(
 				this.sendRepairEntriesWithTransport(
 					target,
@@ -7641,12 +8904,21 @@ export class SharedLog<
 			).catch((error: any) => logger.error(error));
 		};
 
+		const delayedJoinWarmupRetries: number[] = [];
 		retrySchedule.forEach((delayMs, index) => {
 			const transport = getRepairTransportForAttempt(options.mode, index);
 			if (delayMs === 0) {
 				void run(transport);
 				return;
 			}
+			if (
+				options.mode === "join-warmup" &&
+				joinWarmupGeneration &&
+				transport === "simple"
+			) {
+				delayedJoinWarmupRetries.push(delayMs);
+				return;
+			}
 			const timer = setTimeout(() => {
 				this._repairRetryTimers.delete(timer);
 				if (this.closed) {
@@ -7657,19 +8929,46 @@ export class SharedLog<
 			timer.unref?.();
 			this._repairRetryTimers.add(timer);
 		});
+		if (joinWarmupGeneration && delayedJoinWarmupRetries.length > 0) {
+			this.scheduleJoinWarmupRetries(
+				target,
+				joinWarmupGeneration,
+				delayedJoinWarmupRetries,
+				filteredEntries,
+				bypassKnownPeerHints,
+			);
+		}
 	}
 
 	private scheduleRepairSweep(options: {
 		mode: RepairDispatchMode;
 		peers?: Iterable<string>;
+		joinWarmupGenerations?: ReadonlyMap<string, object>;
 	}) {
-		this._repairSweepPendingModes.add(options.mode);
 		const pendingPeers = this._repairSweepPendingPeersByMode.get(options.mode);
 		if (pendingPeers) {
 			for (const peer of options.peers ?? []) {
+				if (options.mode === "join-warmup") {
+					const generation =
+						options.joinWarmupGenerations?.get(peer) ??
+						this.getJoinWarmupGeneration(peer);
+					if (
+						this._joinWarmupGenerationByTarget.get(peer) !== generation
+					) {
+						continue;
+					}
+					this._repairSweepJoinWarmupGenerationByTarget.set(
+						peer,
+						generation,
+					);
+				}
 				pendingPeers.add(peer);
 			}
 		}
+		if (!pendingPeers || pendingPeers.size === 0) {
+			return;
+		}
+		this._repairSweepPendingModes.add(options.mode);
 		if (!this._repairSweepRunning && !this.closed) {
 			this._repairSweepRunning = true;
 			void this.runRepairSweep();
@@ -7731,10 +9030,31 @@ export class SharedLog<
 				const pendingPeersByMode = cloneRepairPendingPeersByMode(
 					this._repairSweepPendingPeersByMode,
 				);
+				const pendingJoinWarmupGenerations = new Map(
+					this._repairSweepJoinWarmupGenerationByTarget,
+				);
 				this._repairSweepPendingModes.clear();
 				for (const peers of this._repairSweepPendingPeersByMode.values()) {
 					peers.clear();
 				}
+				this._repairSweepJoinWarmupGenerationByTarget.clear();
+				const pendingJoinWarmupPeers =
+					pendingPeersByMode.get("join-warmup");
+				const pruneStaleJoinWarmupPeers = () => {
+					for (const peer of [...(pendingJoinWarmupPeers ?? [])]) {
+						if (
+							this._joinWarmupGenerationByTarget.get(peer) !==
+							pendingJoinWarmupGenerations.get(peer)
+						) {
+							pendingJoinWarmupPeers?.delete(peer);
+						}
+					}
+					if (pendingJoinWarmupPeers?.size === 0) {
+						pendingModes.delete("join-warmup");
+					}
+					return pendingModes.size > 0;
+				};
+				pruneStaleJoinWarmupPeers();
 
 				if (pendingModes.size === 0) {
 					return;
@@ -7746,7 +9066,7 @@ export class SharedLog<
 				>();
 				const optimisticGidPeersConsumedByMode = new Map<
 					RepairDispatchMode,
-					Map<string, Map<string, number>>
+					Map<string, Map<string, RepairSweepOptimisticPeerState>>
 				>();
 				for (const mode of pendingModes) {
 					const modePeers = pendingPeersByMode.get(mode);
@@ -7756,20 +9076,22 @@ export class SharedLog<
 					const optimisticGidPeers = new Map<string, Set<string>>();
 					const optimisticGidPeersConsumed = new Map<
 						string,
-						Map<string, number>
+						Map<string, RepairSweepOptimisticPeerState>
 					>();
 					for (const [gid, peerCounts] of this
 						._repairSweepOptimisticGidPeersPending) {
 						let matchedPeers: Set<string> | undefined;
-						let matchedCounts: Map<string, number> | undefined;
-						for (const [peer, count] of peerCounts) {
+						let matchedCounts:
+							| Map<string, RepairSweepOptimisticPeerState>
+							| undefined;
+						for (const [peer, state] of peerCounts) {
 							if (!modePeers.has(peer)) {
 								continue;
 							}
 							matchedPeers ||= new Set();
 							matchedCounts ||= new Map();
 							matchedPeers.add(peer);
-							matchedCounts.set(peer, count);
+							matchedCounts.set(peer, { ...state });
 						}
 						if (matchedPeers && matchedCounts) {
 							optimisticGidPeers.set(gid, matchedPeers);
@@ -7799,6 +9121,7 @@ export class SharedLog<
 					await this.getFullReplicaRepairCandidates(pendingRepairPeers, {
 						includeSubscribers: false,
 					});
+				pruneStaleJoinWarmupPeers();
 				const fullReplicaRepairCandidateCount = Math.max(
 					1,
 					fullReplicaRepairCandidates.size,
@@ -7816,6 +9139,18 @@ export class SharedLog<
 					if (!entries || entries.size === 0) {
 						return;
 					}
+					if (
+						mode === "join-warmup" &&
+						this._joinWarmupGenerationByTarget.get(target) !==
+							pendingJoinWarmupGenerations.get(target)
+					) {
+						targets?.delete(target);
+						pendingJoinWarmupPeers?.delete(target);
+						if (pendingJoinWarmupPeers?.size === 0) {
+							pendingModes.delete("join-warmup");
+						}
+						return;
+					}
 					this.dispatchMaybeMissingEntries(target, entries, {
 						bypassRecentDedupe: true,
 						bypassKnownPeerHints:
@@ -7832,6 +9167,17 @@ export class SharedLog<
 					target: string,
 					entry: RepairDispatchEntry<any>,
 				) => {
+					if (
+						mode === "join-warmup" &&
+						this._joinWarmupGenerationByTarget.get(target) !==
+							pendingJoinWarmupGenerations.get(target)
+					) {
+						pendingJoinWarmupPeers?.delete(target);
+						if (pendingJoinWarmupPeers?.size === 0) {
+							pendingModes.delete("join-warmup");
+						}
+						return;
+					}
 					const sweepTargets = nextFrontierByMode.get(mode);
 					if (sweepTargets) {
 						let sweepSet = sweepTargets.get(target);
@@ -7862,16 +9208,17 @@ export class SharedLog<
 					residentEntriesByHash &&
 					!this.hasCustomFindLeaders()
 				) {
-					const repairDispatchPlan = await this.planResidentRepairDispatchBatch(
-						{
+					const repairDispatchPlan = pruneStaleJoinWarmupPeers()
+						? await this.planResidentRepairDispatchBatch({
 							pendingModes,
 							pendingPeersByMode,
 							optimisticGidPeersByMode,
 							fullReplicaRepairCandidates,
 							fullReplicaRepairCandidateCount,
 							selfHash: this.node.identity.publicKey.hashcode(),
-						},
-					);
+							})
+						: new Map();
+					pruneStaleJoinWarmupPeers();
 					for (const [mode, targets] of repairDispatchPlan) {
 						for (const [target, hashes] of targets) {
 							for (const hash of hashes) {
@@ -7882,13 +9229,20 @@ export class SharedLog<
 							}
 						}
 					}
-				} else {
+				} else if (pruneStaleJoinWarmupPeers()) {
 					const iterator = this.entryCoordinatesIndex.iterate({});
 					try {
-						while (!this.closed && !iterator.done()) {
+						while (
+							!this.closed &&
+							!iterator.done() &&
+							pruneStaleJoinWarmupPeers()
+						) {
 							const entries = await iterator.next(
 								REPAIR_SWEEP_ENTRY_BATCH_SIZE,
 							);
+							if (!pruneStaleJoinWarmupPeers()) {
+								break;
+							}
 							const entryReplicatedBatch = entries.map((entry) => entry.value);
 							const requestedReplicasBatch = entryReplicatedBatch.map((entry) =>
 								decodeReplicas(entry).getValue(this),
@@ -7903,6 +9257,9 @@ export class SharedLog<
 								fullReplicaRepairCandidateCount,
 								selfHash: this.node.identity.publicKey.hashcode(),
 							});
+							if (!pruneStaleJoinWarmupPeers()) {
+								break;
+							}
 							const entriesByHash = new Map(
 								entryReplicatedBatch.map((entry) => [entry.hash, entry]),
 							);
@@ -7932,13 +9289,28 @@ export class SharedLog<
 						if (!pendingPeerCounts) {
 							continue;
 						}
-						for (const [peer, count] of peerCounts) {
-							const current = pendingPeerCounts.get(peer) || 0;
-							const next = current - count;
+						for (const [peer, consumed] of peerCounts) {
+							const current = pendingPeerCounts.get(peer);
+							if (
+								!current ||
+								current.generation !== consumed.generation
+							) {
+								continue;
+							}
+							const next = current.count - consumed.count;
 							if (next > 0) {
-								pendingPeerCounts.set(peer, next);
+								pendingPeerCounts.set(peer, {
+									count: next,
+									generation: current.generation,
+								});
 							} else {
 								pendingPeerCounts.delete(peer);
+								const gids =
+									this._repairSweepOptimisticGidsByPeer.get(peer);
+								gids?.delete(gid);
+								if (gids?.size === 0) {
+									this._repairSweepOptimisticGidsByPeer.delete(peer);
+								}
 							}
 						}
 						if (pendingPeerCounts.size === 0) {
@@ -8513,10 +9885,22 @@ export class SharedLog<
 			return;
 		}
 
-		void Promise.allSettled(this.prune(toPrune));
+		const pruneTasks = this.prune(toPrune);
+		const confirmationTasks: Promise<void>[] = [];
 		for (const hash of responseStillApplies) {
-			void this._checkedPrune.getPendingDelete(hash)?.resolve(publicKeyHash);
+			const pendingDelete = this._checkedPrune.getPendingDelete(hash);
+			if (pendingDelete) {
+				confirmationTasks.push(
+					Promise.resolve(pendingDelete.resolve(publicKeyHash)),
+				);
+			}
 		}
+		// The restarted prune session owns its own bounded timeout and revalidates
+		// before deletion. Only the peer-derived confirmations must remain inside
+		// this receive lease; waiting for the whole prune session could stall close
+		// or disconnect until its background timeout.
+		void Promise.allSettled(pruneTasks);
+		await Promise.allSettled(confirmationTasks);
 	}
 
 	async append(
@@ -12111,15 +13495,27 @@ export class SharedLog<
 		this._respondToIHaveTimeout = options?.respondToIHaveTimeout ?? 2e4;
 		this._checkedPrune = new CheckedPruneCoordinator<T, R>();
 		this._pendingIHave = new Map();
+		this._pendingIHaveCallbacks = new Set();
 		this.latestReplicationInfoMessage = new Map();
 		this._replicationInfoBlockedPeers = new Set();
 		this._replicationInfoRequestByPeer = new Map();
+		// Terminal close/drop drains the previous lifecycle before another open can
+		// install fresh lanes and opaque per-subscription ownership tokens.
 		this._replicationInfoApplyQueueByPeer = new Map();
+		this._replicationInfoReceiveEpochByPeer = new Map();
+		this._subscriptionEpochByPeer = new Map();
+		this._pendingReplicatorLeaveByPeer = new Set();
+		this._activeReceiveHandlersByPeer = new Map();
+		this._receiveHandlerDrainByPeer = new Map();
+		this._receiveCleanupGateByPeer = new Map();
+		this._subscriptionOpeningEpochByPeer = new Map();
+		this._openingSyncCapabilitiesByPeer = new Map();
 		this._repairRetryTimers = new Set();
 		this._recentRepairDispatch = new Map();
 		this._repairSweepRunning = false;
 		this._repairSweepPendingModes = new Set();
 		this._repairSweepPendingPeersByMode = createRepairPendingPeersByMode();
+		this._repairSweepJoinWarmupGenerationByTarget = new Map();
 		this._repairFrontierByMode = createRepairFrontierByMode() as Map<
 			RepairDispatchMode,
 			Map<string, Map<string, RepairDispatchEntry<R>>>
@@ -12127,7 +13523,12 @@ export class SharedLog<
 		this._repairFrontierActiveTargetsByMode = createRepairActiveTargetsByMode();
 		this._repairFrontierBypassKnownPeersByMode =
 			createRepairFrontierBypassKnownPeersByMode();
+		this._joinWarmupGenerationByTarget = new Map();
+		this._joinWarmupSendStateByTarget ??= new Map();
+		this._joinWarmupRetryTimersByTarget = new Map();
+		this._joinWarmupScheduledRetriesByTarget = new Map();
 		this._repairSweepOptimisticGidPeersPending = new Map();
+		this._repairSweepOptimisticGidsByPeer = new Map();
 		this._entryKnownPeers = new Map();
 		this._entryKnownPeerObservedAt = new Map();
 		this._joinAuthoritativeRepairTimersByDelay = new Map();
@@ -12216,6 +13617,7 @@ export class SharedLog<
 
 		this._closeController = new AbortController();
 		this.setupReplicationAnnouncementRetryFunction();
+		this.setupReplicationAnnouncementRepairFunction();
 		this._closeController.signal.addEventListener("abort", () => {
 			for (const [_peer, state] of this._replicationInfoRequestByPeer) {
 				if (state.timer) clearTimeout(state.timer);
@@ -12322,7 +13724,9 @@ export class SharedLog<
 				this.rpc.send(new BlocksMessage(message), options),
 			waitFor: this.rpc.waitFor.bind(this.rpc),
 			publicKey: this.node.identity.publicKey,
-			eagerBlocks: options?.eagerBlocks ?? true,
+			// Unsolicited block retention is opt-in. Explicit `true` retains the
+			// compatible eager path with bounded validation and storage budgets.
+			eagerBlocks: options?.eagerBlocks ?? false,
 			resolveProviders: async (cid, opts) => {
 				// 1) tracker-backed provider directory (best-effort, bounded)
 				try {
@@ -13280,11 +14684,17 @@ export class SharedLog<
 	async afterOpen(): Promise<void> {
 		await super.afterOpen();
 		const existingSubscribersPromise = this._getTopicSubscribers(this.topic);
+		const replicationLifecycleController =
+			this._replicationLifecycleController;
 
 		// We do this here, because these calls requires this.closed == false
 		void this.pruneOfflineReplicators()
 			.then(() => {
-				this._replicatorsReconciled = true;
+				if (
+					this.isReplicationLifecycleActive(replicationLifecycleController)
+				) {
+					this._replicatorsReconciled = true;
+				}
 			})
 			.catch((error) => {
 				if (isNotStartedError(error as Error)) {
@@ -13318,13 +14728,25 @@ export class SharedLog<
 	async pruneOfflineReplicators() {
 		// Go through all segments and wait for replicators to become reachable;
 		// otherwise prune them away from the local membership view.
+		const replicationLifecycleController =
+			this._replicationLifecycleController;
 		try {
+			if (
+				!replicationLifecycleController ||
+				!this.isReplicationLifecycleActive(replicationLifecycleController)
+			) {
+				return;
+			}
 			const promises: Promise<any>[] = [];
 			const iterator = this.replicationIndex.iterate();
 			const checkedIsAlive = new Set<string>();
 
 			while (!iterator.done()) {
-				for (const segment of await iterator.next(1000)) {
+				const segments = await iterator.next(1000);
+				if (!this.isReplicationLifecycleActive(replicationLifecycleController)) {
+					return;
+				}
+				for (const segment of segments) {
 					if (
 						checkedIsAlive.has(segment.value.hash) ||
 						this.node.identity.publicKey.hashcode() === segment.value.hash
@@ -13334,50 +14756,97 @@ export class SharedLog<
 					}
 
 					checkedIsAlive.add(segment.value.hash);
+					const peerHash = segment.value.hash;
+					const subscriptionEpoch = this.getSubscriptionEpoch(peerHash);
 
 					promises.push(
-						waitForSubscribers(this.node, segment.value.hash, this.rpc.topic, {
+						waitForSubscribers(this.node, peerHash, this.rpc.topic, {
 							timeout: this.waitForReplicatorTimeout,
 							signal: this._closeController.signal,
 						})
 							.then(async () => {
-								const key = await this._resolvePublicKeyFromHash(
-									segment.value.hash,
-								);
+								if (
+									!this.isReplicationLifecycleActive(
+										replicationLifecycleController,
+									)
+								) {
+									return;
+								}
+								const key = await this._resolvePublicKeyFromHash(peerHash);
 								if (!key) {
 									throw new Error(
 										"Failed to resolve public key from hash: " +
-											segment.value.hash,
+											peerHash,
 									);
 								}
 
 								const keyHash = key.hashcode();
-								this.uniqueReplicators.add(keyHash);
-
-								if (!this._replicatorJoinEmitted.has(keyHash)) {
-									this._replicatorJoinEmitted.add(keyHash);
-									this.events.dispatchEvent(
-										new CustomEvent<ReplicatorJoinEvent>("replicator:join", {
-											detail: { publicKey: key },
-										}),
-									);
-									this.events.dispatchEvent(
-										new CustomEvent<ReplicationChangeEvent>(
-											"replication:change",
-											{
-												detail: { publicKey: key },
-											},
-										),
-									);
+								if (keyHash !== peerHash) {
+									return;
 								}
+								return this.withReplicationInfoApplyQueue(
+									keyHash,
+									async () => {
+										// A successful reachability check may legitimately span a
+										// subscribe event during startup. The current lane's blocked
+										// state plus an extant index row are the authoritative guard;
+										// only the destructive catch path remains tied to the old token.
+										if (
+											!this.isReplicationLifecycleActive(
+												replicationLifecycleController,
+											) ||
+											this.closed ||
+											this._replicationInfoBlockedPeers.has(keyHash)
+										) {
+											return;
+										}
+										const hasReplicationRange =
+											(await this.replicationIndex.count({
+												query: { hash: keyHash },
+											})) > 0;
+										if (
+											!hasReplicationRange ||
+											!this.isReplicationLifecycleActive(
+												replicationLifecycleController,
+											) ||
+											this._replicationInfoBlockedPeers.has(keyHash)
+										) {
+											return;
+										}
+										this.uniqueReplicators.add(keyHash);
+
+										if (!this._replicatorJoinEmitted.has(keyHash)) {
+											this._replicatorJoinEmitted.add(keyHash);
+											this.events.dispatchEvent(
+												new CustomEvent<ReplicatorJoinEvent>(
+													"replicator:join",
+													{ detail: { publicKey: key } },
+												),
+											);
+											this.events.dispatchEvent(
+												new CustomEvent<ReplicationChangeEvent>(
+													"replication:change",
+													{ detail: { publicKey: key } },
+												),
+											);
+										}
+									},
+								);
 							})
 							.catch(async (error) => {
-								if (isNotStartedError(error as Error)) {
+								if (
+									isNotStartedError(error as Error) ||
+									!this.isReplicationLifecycleActive(
+										replicationLifecycleController,
+									)
+								) {
 									return;
 								}
 
-								return this.removeReplicator(segment.value.hash, {
+								return this.removeReplicator(peerHash, {
 									noEvent: true,
+									replicationLifecycleController,
+									subscriptionEpoch,
 								});
 							}),
 					);
@@ -13386,7 +14855,12 @@ export class SharedLog<
 
 			return Promise.all(promises);
 		} catch (error) {
-			if (isNotStartedError(error as Error)) {
+			if (
+				isNotStartedError(error as Error) ||
+				!this.isReplicationLifecycleActive(
+					replicationLifecycleController,
+				)
+			) {
 				return;
 			}
 			throw error;
@@ -13458,11 +14932,28 @@ export class SharedLog<
 		this._replicatorLivenessFailures.delete(peerHash);
 		this._replicatorLastActivityAt.delete(peerHash);
 		this._peerSyncCapabilities.delete(peerHash);
+		this.cleanupPendingIHavePeer(peerHash);
 		this._checkedPrune.cleanupPeer(peerHash);
 	}
 
+	private cleanupPendingIHavePeer(peerHash: string) {
+		for (const [hash, pending] of this._pendingIHave) {
+			pending.requesting.delete(peerHash);
+			if (pending.requesting.size === 0) {
+				pending.clear();
+				this._pendingIHave.delete(hash);
+			}
+		}
+	}
+
 	private markReplicatorActivity(peerHash: string, now = Date.now()) {
 		this._replicatorLastActivityAt.set(peerHash, now);
+		// Any recent authenticated activity is positive liveness evidence. Reset the
+		// consecutive miss streak immediately, including while an eviction is
+		// waiting in the per-peer mutation lane.
+		if (Date.now() - now < REPLICATOR_LIVENESS_IDLE_THRESHOLD_MS) {
+			this._replicatorLivenessFailures.delete(peerHash);
+		}
 	}
 
 	private hasRecentReplicatorActivity(peerHash: string, now = Date.now()) {
@@ -13477,39 +14968,65 @@ export class SharedLog<
 		return false;
 	}
 
+	private advanceReplicationInfoRecoveryEpoch(peerHash: string) {
+		// Handlers admitted before a successful peer removal must not restore state
+		// when they eventually reach the apply lane. Reset the sender's
+		// ordering watermark with the local epoch so a later arrival can be
+		// accepted without comparing its clock to this receiver's clock.
+		this.advanceReplicationInfoReceiveEpoch(peerHash);
+		this.latestReplicationInfoMessage.delete(peerHash);
+	}
+
 	private async evictReplicatorFromLiveness(
 		peerHash: string,
 		publicKey: PublicSignKey,
+		replicationLifecycleController: AbortController,
+		subscriptionEpoch: object | null,
+		observedActivityAt: number | undefined,
 	) {
-		const wasReplicator = this.uniqueReplicators.has(peerHash);
-		const watermark = BigInt(+new Date());
-		const previousWatermark = this.latestReplicationInfoMessage.get(peerHash);
-		if (!previousWatermark || previousWatermark < watermark) {
-			this.latestReplicationInfoMessage.set(peerHash, watermark);
-		}
+		try {
+			await this.removeReplicator(publicKey, {
+				noEvent: true,
+				replicationLifecycleController,
+				shouldRemove: () =>
+					this._replicatorLastActivityAt.get(peerHash) === observedActivityAt,
+				subscriptionEpoch,
+				onRemoved: ({ wasReplicator }) => {
+					if (wasReplicator) {
+						this._pendingReplicatorLeaveByPeer.add(peerHash);
+					}
+					// A newer subscription/lifecycle may have started while the admitted
+					// removal was completing. Its reconnect barrier owns all later effects.
+					if (
+						!this.isReplicationLifecycleActive(
+							replicationLifecycleController,
+						) ||
+						!this.isCurrentSubscriptionEpoch(peerHash, subscriptionEpoch)
+					) {
+						return;
+					}
+					if (this._pendingReplicatorLeaveByPeer.delete(peerHash)) {
+						this.events.dispatchEvent(
+							new CustomEvent<ReplicatorLeaveEvent>("replicator:leave", {
+								detail: { publicKey },
+							}),
+						);
+					}
 
-		try {
-			await this.removeReplicator(publicKey, { noEvent: true });
+					if (!this._replicationInfoBlockedPeers.has(peerHash)) {
+						this.scheduleReplicationInfoRequests(
+							publicKey,
+							replicationLifecycleController,
+						);
+					}
+					this._replicatorLivenessTargetsSize = -1;
+				},
+			});
 		} catch (error) {
 			if (!isNotStartedError(error as Error)) {
 				throw error;
 			}
 		}
-
-		this.cleanupPeerDisconnectTracking(peerHash);
-
-		if (wasReplicator) {
-			this.events.dispatchEvent(
-				new CustomEvent<ReplicatorLeaveEvent>("replicator:leave", {
-					detail: { publicKey },
-				}),
-			);
-		}
-
-		if (!this._replicationInfoBlockedPeers.has(peerHash)) {
-			this.scheduleReplicationInfoRequests(publicKey);
-		}
-		this._replicatorLivenessTargetsSize = -1;
 	}
 
 	private async resolveCandidatePeersForHash(
@@ -13589,7 +15106,13 @@ export class SharedLog<
 	}
 
 	private async runReplicatorLivenessSweep() {
-		if (this.closed || this._closeController.signal.aborted) {
+		const replicationLifecycleController =
+			this._replicationLifecycleController;
+		if (
+			this.closed ||
+			this._closeController.signal.aborted ||
+			!this.isReplicationLifecycleActive(replicationLifecycleController)
+		) {
 			return;
 		}
 		if (this._replicatorLivenessSweepRunning) {
@@ -13615,14 +15138,30 @@ export class SharedLog<
 				logger.error((error as any)?.toString?.() ?? String(error));
 			}
 		} finally {
-			this._replicatorLivenessSweepRunning = false;
+			if (
+				this._replicationLifecycleController ===
+				replicationLifecycleController
+			) {
+				this._replicatorLivenessSweepRunning = false;
+			}
 		}
 	}
 
 	private async probeReplicatorLiveness(peerHash: string) {
-		if (this.closed || this._closeController.signal.aborted) {
+		const replicationLifecycleController =
+			this._replicationLifecycleController;
+		if (
+			this.closed ||
+			this._closeController.signal.aborted ||
+			!replicationLifecycleController ||
+			!this.isReplicationLifecycleActive(replicationLifecycleController)
+		) {
 			return;
 		}
+		const subscriptionEpoch = this.getSubscriptionEpoch(peerHash);
+		const ownsProbe = () =>
+			this.isReplicationLifecycleActive(replicationLifecycleController) &&
+			this.isCurrentSubscriptionEpoch(peerHash, subscriptionEpoch);
 		if (!this.uniqueReplicators.has(peerHash)) {
 			this._replicatorLivenessFailures.delete(peerHash);
 			return;
@@ -13630,18 +15169,36 @@ export class SharedLog<
 		if (this.hasRecentReplicatorActivity(peerHash)) {
 			return;
 		}
+		const observedActivityAt = this._replicatorLastActivityAt.get(peerHash);
 
 		const publicKey = await this._resolvePublicKeyFromHash(peerHash);
+		if (!ownsProbe()) {
+			return;
+		}
+		if (this.hasRecentReplicatorActivity(peerHash)) {
+			return;
+		}
 		if (!publicKey) {
 			try {
-				await this.removeReplicator(peerHash, { noEvent: true });
+				await this.removeReplicator(peerHash, {
+					noEvent: true,
+					replicationLifecycleController,
+					shouldRemove: () =>
+						this._replicatorLastActivityAt.get(peerHash) ===
+						observedActivityAt,
+					subscriptionEpoch,
+					onRemoved: () => {
+						if (!ownsProbe()) {
+							return;
+						}
+						this._replicatorLivenessTargetsSize = -1;
+					},
+				});
 			} catch (error) {
 				if (!isNotStartedError(error as Error)) {
 					throw error;
 				}
 			}
-			this.cleanupPeerDisconnectTracking(peerHash);
-			this._replicatorLivenessTargetsSize = -1;
 			return;
 		}
 
@@ -13653,6 +15210,9 @@ export class SharedLog<
 				priority: ACK_CONTROL_PRIORITY,
 				responsePriority: ACK_CONTROL_PRIORITY,
 			});
+			if (!ownsProbe()) {
+				return;
+			}
 			this.markReplicatorActivity(peerHash);
 			this._replicatorLivenessFailures.delete(peerHash);
 			return;
@@ -13661,29 +15221,53 @@ export class SharedLog<
 				return;
 			}
 		}
+		if (!ownsProbe()) {
+			return;
+		}
+		if (this.hasRecentReplicatorActivity(peerHash)) {
+			return;
+		}
 
 		// Relay-backed prod paths can keep a peer subscribed/reachable even if an
 		// ACKed liveness ping gets delayed or dropped under load. Treat observed
 		// topic presence as a positive liveness signal before evicting the peer.
 		if (await this.confirmReplicatorSubscriberPresence(peerHash)) {
+			if (!ownsProbe()) {
+				return;
+			}
 			this.markReplicatorActivity(peerHash);
 			this._replicatorLivenessFailures.delete(peerHash);
 			return;
 		}
+		if (!ownsProbe()) {
+			return;
+		}
+		if (this.hasRecentReplicatorActivity(peerHash)) {
+			return;
+		}
 
 		const failures = (this._replicatorLivenessFailures.get(peerHash) ?? 0) + 1;
 		this._replicatorLivenessFailures.set(peerHash, failures);
-		this.scheduleReplicationInfoRequests(publicKey);
+		this.scheduleReplicationInfoRequests(
+			publicKey,
+			replicationLifecycleController,
+		);
 
 		if (failures < REPLICATOR_LIVENESS_PROBE_FAILURES_TO_EVICT) {
 			return;
 		}
-		if (!this.uniqueReplicators.has(peerHash)) {
+		if (!ownsProbe() || !this.uniqueReplicators.has(peerHash)) {
 			this._replicatorLivenessFailures.delete(peerHash);
 			return;
 		}
 
-		await this.evictReplicatorFromLiveness(peerHash, publicKey);
+		await this.evictReplicatorFromLiveness(
+			peerHash,
+			publicKey,
+			replicationLifecycleController,
+			subscriptionEpoch,
+			observedActivityAt,
+		);
 	}
 
 	private async confirmReplicatorSubscriberPresence(peerHash: string) {
@@ -13722,6 +15306,26 @@ export class SharedLog<
 		/* ((await this.log.entryIndex?.getMemoryUsage()) || 0) */ // + (await this.log.blocks.size())
 	}
 
+	/** Return a detached snapshot of effective shared-log runtime settings. */
+	getRuntimeSnapshot(): SharedLogRuntimeSnapshot {
+		const nativeGraph = this.log.entryIndex.properties.nativeGraph;
+		const active = nativeGraph?.graph != null;
+		return Object.freeze({
+			nativeGraph: Object.freeze({
+				active,
+				useHeads: active && nativeGraph?.useHeads === true,
+			}),
+		});
+	}
+
+	/**
+	 * Return a detached snapshot of the optional eager-response cache.
+	 * Undefined means eager response retention is disabled for this log.
+	 */
+	getEagerBlockCacheTelemetry() {
+		return this.remoteBlocks?.getEagerBlockCacheTelemetry();
+	}
+
 	private clampReplicas(value: number) {
 		const lower = this.replicas.min?.getValue(this) || 1;
 		const higher = this.replicas.max?.getValue(this) ?? Number.MAX_SAFE_INTEGER;
@@ -14477,6 +16081,7 @@ export class SharedLog<
 			),
 		);
 		captureSync(() => {
+			this.cancelAllJoinWarmupTargets();
 			for (const timer of this._repairRetryTimers ?? []) clearTimeout(timer);
 			this._repairRetryTimers?.clear();
 			this._recentRepairDispatch?.clear();
@@ -14484,7 +16089,9 @@ export class SharedLog<
 			this._repairSweepPendingModes?.clear();
 			for (const peers of this._repairSweepPendingPeersByMode?.values() ?? [])
 				peers.clear();
+			this._repairSweepJoinWarmupGenerationByTarget?.clear();
 			this._repairSweepOptimisticGidPeersPending?.clear();
+			this._repairSweepOptimisticGidsByPeer?.clear();
 			this._entryKnownPeers?.clear();
 			this._entryKnownPeerObservedAt?.clear();
 			this._nativeSharedLogState?.clearEntryKnownPeers();
@@ -14521,7 +16128,14 @@ export class SharedLog<
 		}
 		captureSync(() => {
 			this._pendingIHave?.clear();
+			this._pendingIHaveCallbacks?.clear();
 			this.latestReplicationInfoMessage?.clear();
+			this._replicationInfoReceiveEpochByPeer?.clear();
+			this._activeReceiveHandlersByPeer?.clear();
+			this._receiveHandlerDrainByPeer?.clear();
+			this._receiveCleanupGateByPeer?.clear();
+			this._subscriptionOpeningEpochByPeer?.clear();
+			this._openingSyncCapabilitiesByPeer?.clear();
 			this._gidPeersHistory?.clear();
 			this._peerSyncCapabilities?.clear();
 			this._liveRawGossipBatches?.clear();
@@ -14594,7 +16208,14 @@ export class SharedLog<
 		// SharedLog-specific await or observable teardown can admit a new owner.
 		this.preventParentAttachments();
 		this.stopSubscriptionChangeCallbackAdmission();
+		this.cancelAllJoinWarmupTargets();
 		await this.drainSubscriptionChangeCallbacks();
+		// An already-admitted subscription callback can create a fresh warmup
+		// generation while the first cancellation is draining.
+		this.cancelAllJoinWarmupTargets();
+		await this.drainReceiveHandlers();
+		await this.drainReplicationInfoApplyQueues();
+		await this.drainPendingIHaveCallbacks();
 		this.ensureNativeDurabilityRuntimeState();
 		this.cancelCurrentReplicationStateAnnouncementRetry();
 		// Best-effort: announce that we are going offline before tearing down
@@ -14715,7 +16336,14 @@ export class SharedLog<
 		// the terminal fence only after that precondition succeeds.
 		this.preventParentAttachments();
 		this.stopSubscriptionChangeCallbackAdmission();
+		this.cancelAllJoinWarmupTargets();
 		await this.drainSubscriptionChangeCallbacks();
+		// An already-admitted subscription callback can create a fresh warmup
+		// generation while the first cancellation is draining.
+		this.cancelAllJoinWarmupTargets();
+		await this.drainReceiveHandlers();
+		await this.drainReplicationInfoApplyQueues();
+		await this.drainPendingIHaveCallbacks();
 		this.cancelCurrentReplicationStateAnnouncementRetry();
 		// Best-effort: announce that we are going offline before tearing down
 		// RPC/subscription state (same reasoning as in `close()`).
@@ -14932,13 +16560,45 @@ export class SharedLog<
 		const stashBackedRawMessage = isStashBackedRawExchangeHeadsMessage(msg)
 			? msg
 			: undefined;
+		let releasePeerReceiveLease: (() => void) | undefined;
 		try {
 			this.throwIfNativeDurableCommitFailed();
 			if (!context.from) {
 				throw new Error("Missing from in update role message");
 			}
+			// Snapshot receive ownership before any async handler gets a chance to
+			// yield. Replication-info messages reach their branch only after the
+			// synchronizer declines them, and a U/S transition can happen meanwhile.
+			const receiveFromHash = context.from.hashcode();
+			const receiveReplicationLifecycleController =
+				this._replicationLifecycleController;
+			const receiveSubscriptionEpoch =
+				this.getSubscriptionEpoch(receiveFromHash);
+			const isOpeningSubscriptionReceive =
+				this._subscriptionOpeningEpochByPeer.get(receiveFromHash) ===
+				receiveSubscriptionEpoch;
+			const isOpeningCapabilityAdvertisement =
+				msg instanceof SyncCapabilitiesMessage && isOpeningSubscriptionReceive;
+			releasePeerReceiveLease = this.acquirePeerReceiveLease(
+				receiveFromHash,
+				receiveReplicationLifecycleController,
+				receiveSubscriptionEpoch,
+				{
+					// The replication-info fence existed before receive leases and is
+					// intentionally narrower than the subscription itself. Keep admitting
+					// sync negotiation/data while the new subscription drains the previous
+					// apply generation; replication-info branches recheck the fence below.
+					allowReplicationInfoBlocked: isOpeningSubscriptionReceive,
+					allowCleanupGate: isOpeningCapabilityAdvertisement,
+				},
+			);
+			if (!releasePeerReceiveLease) {
+				return;
+			}
+			const receiveReplicationInfoReceiveEpoch =
+				this.getReplicationInfoReceiveEpoch(receiveFromHash);
 			if (!context.from.equals(this.node.identity.publicKey)) {
-				this.markReplicatorActivity(context.from.hashcode());
+				this.markReplicatorActivity(receiveFromHash);
 			}
 
 			if (msg instanceof ResponseRoleMessage) {
@@ -16269,6 +17929,7 @@ export class SharedLog<
 						);
 						return allToMergeMaterializedEntries;
 					};
+					let admittedMergeHashes: ReadonlySet<string> = new Set();
 					let nativePreparedCommittedHashes: Set<string> | undefined;
 					if (allToMerge.length > 0) {
 						const validateStartedAt = syncProfileStart(syncProfile);
@@ -16377,9 +18038,9 @@ export class SharedLog<
 						const entriesToPersist = usedNativeAllKeptJoinPlan
 							? allToMergeShallowEntries
 							: joinPlans.flatMap((plan) => plan.toPersist);
-						const coordinatePersistFallbackEntries: ShallowOrFullEntry<any>[] =
+						let coordinatePersistFallbackEntries: ShallowOrFullEntry<any>[] =
 							[];
-						const reusableCoordinatePersistItems: CoordinatePersistBatchItem<R>[] =
+						let reusableCoordinatePersistItems: CoordinatePersistBatchItem<R>[] =
 							[];
 						for (const entry of entriesToPersist) {
 							const reusablePlan = reusableCoordinatePlans.get(entry.hash);
@@ -16397,8 +18058,6 @@ export class SharedLog<
 								prepared: reusablePlan.prepared,
 							});
 						}
-						const reusableCoordinatePersistItemCount =
-							reusableCoordinatePersistItems.length;
 						let nativePreparedCoordinateBatch:
 							| NativeBackboneReceiveCoordinateBatch<R>
 							| undefined;
@@ -16501,6 +18160,34 @@ export class SharedLog<
 								__peerbitProfile: syncProfile,
 							});
 						}
+						// A recursive lower-log join can resolve successfully while declining
+						// an individual top-level entry (for example, when one of its parents
+						// is temporarily unavailable). The public Log.join() API intentionally
+						// does not expose that per-entry result, so make local index presence the
+						// authority before publishing any SharedLog-side effects. A successful
+						// prepared-facts batch is atomic and already proves every input hash.
+						const admittedHashes = joinedPreparedFacts
+							? new Set(allToMergeHashes)
+							: await this.log.hasMany(allToMergeHashes);
+						admittedMergeHashes = admittedHashes;
+						const admittedShallowEntries =
+							admittedHashes.size === allToMergeShallowEntries.length
+								? allToMergeShallowEntries
+								: allToMergeShallowEntries.filter((entry) =>
+										admittedHashes.has(entry.hash),
+									);
+						if (!joinedPreparedFacts) {
+							reusableCoordinatePersistItems =
+								reusableCoordinatePersistItems.filter((item) =>
+									admittedHashes.has(item.entry.hash),
+								);
+							coordinatePersistFallbackEntries =
+								coordinatePersistFallbackEntries.filter((entry) =>
+									admittedHashes.has(entry.hash),
+								);
+						}
+						const reusableCoordinatePersistItemCount =
+							reusableCoordinatePersistItems.length;
 						if (syncProfile) {
 							emitSyncProfileDuration(syncProfile, lowerLogJoinStartedAt, {
 								name: "sharedLog.receive.lowerLogJoin",
@@ -16512,6 +18199,7 @@ export class SharedLog<
 									batchHashOnlyEntryAdded,
 									programOnChange,
 									joinedPreparedFacts,
+									admittedEntries: admittedHashes.size,
 									nativePreparedCoordinatesFinished,
 								},
 							});
@@ -16586,11 +18274,11 @@ export class SharedLog<
 								},
 							});
 						}
-						for (const hash of allToMergeHashes) {
+						for (const hash of admittedHashes) {
 							confirmedHashes.add(hash);
 						}
 						const checkedPruneStartedAt = syncProfileStart(syncProfile);
-						await this.pruneJoinedEntriesNoLongerLed(allToMergeShallowEntries, {
+						await this.pruneJoinedEntriesNoLongerLed(admittedShallowEntries, {
 							decodedReplicaCounts: receiveReplicaCounts,
 							reusableLeaderPlans: reusableCoordinatePlans,
 							profile: syncProfile,
@@ -16605,15 +18293,17 @@ export class SharedLog<
 						}
 
 						for (const plan of joinPlans) {
-							plan.toDelete?.map((x) =>
-								this.pruneDebouncedFnAddIfNotKeeping({
-									key: x.hash,
-									value: {
-										entry: x,
-										leaders: plan.leaders as Map<string, any>,
-									},
-								}),
-							);
+							plan.toDelete
+								?.filter((entry) => admittedMergeHashes.has(entry.hash))
+								.map((entry) =>
+									this.pruneDebouncedFnAddIfNotKeeping({
+										key: entry.hash,
+										value: {
+											entry,
+											leaders: plan.leaders as Map<string, any>,
+										},
+									}),
+								);
 						}
 						this.rebalanceParticipationDebounced?.call();
 					}
@@ -16623,17 +18313,23 @@ export class SharedLog<
 							continue;
 						}
 						for (const entries of plan.maybeDelete) {
+							const admittedEntries = entries.filter((entry) =>
+								admittedMergeHashes.has(getExchangeHeadHash(entry)),
+							);
+							if (admittedEntries.length === 0) {
+								continue;
+							}
 							const minReplicas = await this.getMaxReplicasFromHeads(
-								this.getEntryGid(entries[0].entry),
+								this.getEntryGid(admittedEntries[0].entry),
 							);
 							if (minReplicas != null) {
 								const isLeader = await this.isLeader({
-									entry: entries[0].entry,
+									entry: admittedEntries[0].entry,
 									replicas: minReplicas,
 								});
 
 								if (!isLeader) {
-									for (const x of entries) {
+									for (const x of admittedEntries) {
 										this.pruneDebouncedFnAddIfNotKeeping({
 											key: x.entry.hash,
 											value: {
@@ -16877,6 +18573,13 @@ export class SharedLog<
 				let pendingIHaveExtended = 0;
 				const leaderResponseHashes: string[] = [];
 				for (let i = 0; i < msg.hashes.length; i++) {
+					if (
+						!this.isReplicationLifecycleActive(
+							receiveReplicationLifecycleController,
+						)
+					) {
+						return;
+					}
 					const hash = msg.hashes[i]!;
 
 					const nativeEntryGid = nativeLeaderHints.nativeEntryGids?.[i];
@@ -17012,8 +18715,21 @@ export class SharedLog<
 								resetTimeout: () => this.resetPendingIHaveTimeout(pendingIHave),
 								clear: () => this.clearPendingIHaveTimeout(pendingIHave),
 								callback: async (entry: Entry<T>) => {
-									this.removePeerFromGidPeerHistory(from, entry.meta.gid);
-									this.removePruneRequestSent(entry.hash, from);
+									if (
+										!this.isReplicationLifecycleActive(
+											receiveReplicationLifecycleController,
+										) ||
+										requesting.size === 0
+									) {
+										return;
+									}
+									for (const requester of requesting) {
+										this.removePeerFromGidPeerHistory(
+											requester,
+											entry.meta.gid,
+										);
+										this.removePruneRequestSent(entry.hash, requester);
+									}
 									let isLeader = false;
 									await this._waitForEntryReplicators(
 										entry,
@@ -17032,12 +18748,19 @@ export class SharedLog<
 											},
 										},
 									);
+									if (
+										!this.isReplicationLifecycleActive(
+											receiveReplicationLifecycleController,
+										) ||
+										requesting.size === 0
+									) {
+										return;
+									}
 									if (isLeader) {
 										this.responseToPruneDebouncedFn.add({
 											hashes: [entry.hash],
-											peers: requesting,
+											peers: new Set(requesting),
 										});
-										this._pendingIHave.delete(hash);
 									}
 								},
 							};
@@ -17080,19 +18803,32 @@ export class SharedLog<
 				}
 			} else if (msg instanceof ResponseIPrune) {
 				const lateResponses: string[] = [];
+				const responseTasks: Promise<void>[] = [];
 				for (const hash of msg.hashes) {
 					const pendingDelete = this._checkedPrune.getPendingDelete(hash);
 					if (pendingDelete) {
-						void pendingDelete.resolve(context.from.hashcode());
+						responseTasks.push(
+							Promise.resolve(
+								pendingDelete.resolve(context.from.hashcode()),
+							),
+						);
 					} else {
 						lateResponses.push(hash);
 					}
 				}
 				if (lateResponses.length > 0) {
-					void this.recoverCheckedPruneFromLateResponses(
-						lateResponses,
-						context.from.hashcode(),
-					).catch((error) => logger.error(error.toString()));
+					responseTasks.push(
+						this.recoverCheckedPruneFromLateResponses(
+							lateResponses,
+							context.from.hashcode(),
+						),
+					);
+				}
+				const results = await Promise.allSettled(responseTasks);
+				for (const result of results) {
+					if (result.status === "rejected") {
+						logger.error(result.reason?.toString?.() ?? String(result.reason));
+					}
 				}
 			} else if (msg instanceof ConfirmEntriesMessage) {
 				this.markEntriesKnownByPeer(msg.hashes, context.from.hashcode());
@@ -17100,10 +18836,25 @@ export class SharedLog<
 				return;
 			} else if (msg instanceof SyncCapabilitiesMessage) {
 				if (!context.from.equals(this.node.identity.publicKey)) {
-					this._peerSyncCapabilities.set(
-						context.from.hashcode(),
-						msg.capabilities,
-					);
+					const openingEpoch =
+						this._subscriptionOpeningEpochByPeer.get(receiveFromHash);
+					if (
+						this._replicationInfoBlockedPeers.has(receiveFromHash) &&
+						openingEpoch === receiveSubscriptionEpoch
+					) {
+						// A prior unsubscribe cleanup may still be ahead of this reconnect
+						// barrier. Stage the new generation's one-shot advertisement so that
+						// cleanup cannot erase it before the opening transition commits.
+						this._openingSyncCapabilitiesByPeer.set(receiveFromHash, {
+							epoch: openingEpoch,
+							capabilities: msg.capabilities,
+						});
+					} else {
+						this._peerSyncCapabilities.set(
+							receiveFromHash,
+							msg.capabilities,
+						);
+					}
 				}
 				return;
 			} else if (await this.syncronizer.onMessage(msg, context)) {
@@ -17120,10 +18871,14 @@ export class SharedLog<
 					return;
 				}
 				const replicationLifecycleController =
-					this._replicationLifecycleController;
+					receiveReplicationLifecycleController;
 				if (
 					!replicationLifecycleController ||
-					!this.isReplicationLifecycleActive(replicationLifecycleController)
+					!this.isPeerReceiveAdmissionOpen(
+						receiveFromHash,
+						replicationLifecycleController,
+						receiveSubscriptionEpoch,
+					)
 				) {
 					return;
 				}
@@ -17133,8 +18888,10 @@ export class SharedLog<
 					replicationSegments = await this.getMyReplicationSegments();
 				} catch (error) {
 					if (
-						!this.isReplicationLifecycleActive(
+						!this.isPeerReceiveAdmissionOpen(
+							receiveFromHash,
 							replicationLifecycleController,
+							receiveSubscriptionEpoch,
 						) &&
 						isNotStartedError(error as Error)
 					) {
@@ -17143,7 +18900,11 @@ export class SharedLog<
 					throw error;
 				}
 				if (
-					!this.isReplicationLifecycleActive(replicationLifecycleController)
+					!this.isPeerReceiveAdmissionOpen(
+						receiveFromHash,
+						replicationLifecycleController,
+						receiveSubscriptionEpoch,
+					)
 				) {
 					return;
 				}
@@ -17164,7 +18925,11 @@ export class SharedLog<
 						),
 					);
 				if (
-					!this.isReplicationLifecycleActive(replicationLifecycleController)
+					!this.isPeerReceiveAdmissionOpen(
+						receiveFromHash,
+						replicationLifecycleController,
+						receiveSubscriptionEpoch,
+					)
 				) {
 					return;
 				}
@@ -17214,14 +18979,38 @@ export class SharedLog<
 				// (and downstream `waitForReplicator()` timeouts) under timing-sensitive joins.
 				const from = context.from!;
 				const fromHash = from.hashcode();
-				if (this._replicationInfoBlockedPeers.has(fromHash)) {
+				if (
+					!this.isReplicationLifecycleActive(
+						receiveReplicationLifecycleController,
+					) ||
+					!this.isCurrentReplicationInfoReceiveEpoch(
+						receiveFromHash,
+						receiveReplicationInfoReceiveEpoch,
+					) ||
+					this._replicationInfoBlockedPeers.has(fromHash)
+				) {
 					return;
 				}
 				const messageTimestamp = context.message.header.timestamp;
+				releasePeerReceiveLease?.();
+				releasePeerReceiveLease = undefined;
 				await this.withReplicationInfoApplyQueue(fromHash, async () => {
 					try {
 						// The peer may have unsubscribed after this message was queued.
-						if (this._replicationInfoBlockedPeers.has(fromHash)) {
+						if (
+							!this.isReplicationLifecycleActive(
+								receiveReplicationLifecycleController,
+							) ||
+							!this.isCurrentSubscriptionEpoch(
+								fromHash,
+								receiveSubscriptionEpoch,
+							) ||
+							!this.isCurrentReplicationInfoReceiveEpoch(
+								fromHash,
+								receiveReplicationInfoReceiveEpoch,
+							) ||
+							this._replicationInfoBlockedPeers.has(fromHash)
+						) {
 							return;
 						}
 
@@ -17269,29 +19058,72 @@ export class SharedLog<
 					}
 				});
 			} else if (msg instanceof StoppedReplicating) {
-				if (context.from.equals(this.node.identity.publicKey)) {
+				const from = context.from!;
+				const segmentIds = msg.segmentIds;
+				if (from.equals(this.node.identity.publicKey)) {
 					return;
 				}
-				const fromHash = context.from.hashcode();
-				if (this._replicationInfoBlockedPeers.has(fromHash)) {
+				const fromHash = from.hashcode();
+				if (
+					!this.isReplicationLifecycleActive(
+						receiveReplicationLifecycleController,
+					) ||
+					!this.isCurrentReplicationInfoReceiveEpoch(
+						receiveFromHash,
+						receiveReplicationInfoReceiveEpoch,
+					) ||
+					this._replicationInfoBlockedPeers.has(fromHash)
+				) {
 					return;
 				}
-				this._replicatorLivenessFailures.delete(fromHash);
+				const messageTimestamp = context.message.header.timestamp;
+				releasePeerReceiveLease?.();
+				releasePeerReceiveLease = undefined;
+				await this.withReplicationInfoApplyQueue(fromHash, async () => {
+					if (
+						!this.isReplicationLifecycleActive(
+							receiveReplicationLifecycleController,
+						) ||
+						!this.isCurrentSubscriptionEpoch(
+							fromHash,
+							receiveSubscriptionEpoch,
+						) ||
+						!this.isCurrentReplicationInfoReceiveEpoch(
+							fromHash,
+							receiveReplicationInfoReceiveEpoch,
+						) ||
+						this._replicationInfoBlockedPeers.has(fromHash)
+					) {
+						return;
+					}
 
-				const rangesToRemove = await this.resolveReplicationRangesFromIdsAndKey(
-					msg.segmentIds,
-					context.from,
-				);
+					const previousTimestamp =
+						this.latestReplicationInfoMessage.get(fromHash);
+					if (previousTimestamp && previousTimestamp > messageTimestamp) {
+						return;
+					}
+					this.latestReplicationInfoMessage.set(fromHash, messageTimestamp);
+					this._replicatorLivenessFailures.delete(fromHash);
+					if (this.closed) {
+						return;
+					}
 
-				await this.removeReplicationRanges(rangesToRemove, context.from);
-				const timestamp = BigInt(+new Date());
-				for (const range of rangesToRemove) {
-					this.replicationChangeDebounceFn.add({
-						range,
-						type: "removed",
-						timestamp,
-					});
-				}
+					const rangesToRemove =
+						await this.resolveReplicationRangesFromIdsAndKey(
+							segmentIds,
+							from,
+						);
+
+					await this.removeReplicationRanges(rangesToRemove, from);
+					const timestamp = BigInt(+new Date());
+					for (const range of rangesToRemove) {
+						this.replicationChangeDebounceFn.add({
+							range,
+							type: "removed",
+							timestamp,
+						});
+					}
+				});
 			} else {
 				throw new Error("Unexpected message");
 			}
@@ -17345,6 +19177,8 @@ export class SharedLog<
 				// Every return and every locally swallowed receive error passes this
 				// boundary. Release a native wire stash exactly once first, then surface
 				// any durable mutation poison that arose while handling the message.
+				releasePeerReceiveLease?.();
+				releasePeerReceiveLease = undefined;
 				this.throwIfNativeDurableCommitFailed();
 			}
 		}
@@ -17987,30 +19821,35 @@ export class SharedLog<
 		checkLeaders: (options: WaitForReplicatorsOptions<R>) => Promise<LeaderMap>,
 	): Promise<LeaderMap | false> {
 		const timeout = options.timeout ?? this.waitForReplicatorTimeout;
+		const closeSignal = this._closeController.signal;
+		const replicationLifecycleSignal =
+			this._replicationLifecycleController?.signal;
 
 		return new Promise((resolve, reject) => {
 			let settled = false;
+			const checks = new Set<Promise<void>>();
 			const removeListeners = () => {
 				this.events.removeEventListener("replication:change", roleListener);
 				this.events.removeEventListener("replicator:mature", roleListener);
-				this._closeController.signal.removeEventListener(
-					"abort",
-					abortListener,
-				);
+				closeSignal.removeEventListener("abort", abortListener);
+				replicationLifecycleSignal?.removeEventListener("abort", abortListener);
 			};
 			const settleResolve = (value: LeaderMap | false) => {
 				if (settled) return;
 				settled = true;
 				removeListeners();
 				clearTimeout(timer);
-				resolve(value);
+				// Leader planning may persist coordinates. Keep the caller (and any
+				// receive lease it owns) alive until checks admitted before this
+				// timeout/abort have finished their local side effects.
+				void Promise.allSettled([...checks]).then(() => resolve(value));
 			};
 			const settleReject = (error: unknown) => {
 				if (settled) return;
 				settled = true;
 				removeListeners();
 				clearTimeout(timer);
-				reject(error);
+				void Promise.allSettled([...checks]).then(() => reject(error));
 			};
 			const abortListener = () => {
 				settleResolve(false);
@@ -18044,9 +19883,14 @@ export class SharedLog<
 				settleResolve(leaders);
 			};
 			const runCheck = () => {
-				void check().catch((error) => {
-					settleReject(error);
-				});
+				if (settled) return;
+				let running!: Promise<void>;
+				running = check()
+					.catch((error) => {
+						settleReject(error);
+					})
+					.finally(() => checks.delete(running));
+				checks.add(running);
 			};
 
 			const roleListener = () => {
@@ -18055,7 +19899,15 @@ export class SharedLog<
 
 			this.events.addEventListener("replication:change", roleListener);
 			this.events.addEventListener("replicator:mature", roleListener);
-			this._closeController.signal.addEventListener("abort", abortListener);
+			closeSignal.addEventListener("abort", abortListener);
+			replicationLifecycleSignal?.addEventListener("abort", abortListener);
+			// AbortSignal does not replay an abort event to listeners added after it
+			// fired. Recheck after registration so work started concurrently with the
+			// terminal fence cannot wait for the full leader-selection timeout.
+			if (closeSignal.aborted || replicationLifecycleSignal?.aborted) {
+				abortListener();
+				return;
+			}
 			runCheck();
 		});
 	}
@@ -21059,6 +22911,53 @@ export class SharedLog<
 		});
 	}
 
+	private async drainReplicationInfoApplyQueues(): Promise<void> {
+		for (;;) {
+			const tails = [...(this._replicationInfoApplyQueueByPeer?.values() ?? [])];
+			if (tails.length === 0) {
+				return;
+			}
+			await Promise.allSettled(tails);
+			// Queue cleanup runs in `finally`; give it a microtask before checking for
+			// tails admitted while the previous snapshot was settling.
+			await Promise.resolve();
+		}
+	}
+
+	private advanceReplicationInfoReceiveEpoch(peerHash: string): object {
+		const next = {};
+		this._replicationInfoReceiveEpochByPeer.set(peerHash, next);
+		return next;
+	}
+
+	private getReplicationInfoReceiveEpoch(peerHash: string): object | null {
+		return this._replicationInfoReceiveEpochByPeer.get(peerHash) ?? null;
+	}
+
+	private isCurrentReplicationInfoReceiveEpoch(
+		peerHash: string,
+		epoch: object | null,
+	): boolean {
+		return this.getReplicationInfoReceiveEpoch(peerHash) === epoch;
+	}
+
+	private advanceSubscriptionEpoch(peerHash: string): object {
+		const next = {};
+		this._subscriptionEpochByPeer.set(peerHash, next);
+		return next;
+	}
+
+	private getSubscriptionEpoch(peerHash: string): object | null {
+		return this._subscriptionEpochByPeer.get(peerHash) ?? null;
+	}
+
+	private isCurrentSubscriptionEpoch(
+		peerHash: string,
+		epoch: object | null,
+	): boolean {
+		return this.getSubscriptionEpoch(peerHash) === epoch;
+	}
+
 	private cancelReplicationInfoRequests(peerHash: string) {
 		const state = this._replicationInfoRequestByPeer.get(peerHash);
 		if (!state) return;
@@ -21147,6 +23046,7 @@ export class SharedLog<
 		publicKey: PublicSignKey,
 		topics: string[],
 		subscribed: boolean,
+		subscriptionEpoch?: object,
 	) {
 		if (!topics.includes(this.topic)) {
 			return;
@@ -21160,8 +23060,76 @@ export class SharedLog<
 		}
 
 		const peerHash = publicKey.hashcode();
+		const expectedSubscriptionEpoch =
+			subscriptionEpoch ?? this.advanceSubscriptionEpoch(peerHash);
+		const ownsSubscriptionEpoch = () =>
+			this.isCurrentSubscriptionEpoch(peerHash, expectedSubscriptionEpoch);
+		if (!ownsSubscriptionEpoch()) {
+			return;
+		}
+		if (subscribed) {
+			const pendingOpeningCapabilities =
+				this._openingSyncCapabilitiesByPeer.get(peerHash);
+			if (
+				pendingOpeningCapabilities &&
+				pendingOpeningCapabilities.epoch !== expectedSubscriptionEpoch
+			) {
+				this._openingSyncCapabilitiesByPeer.delete(peerHash);
+			}
+			this._subscriptionOpeningEpochByPeer.set(
+				peerHash,
+				expectedSubscriptionEpoch,
+			);
+			// Fence new messages immediately, drain handlers admitted by the previous
+			// subscription, then wait behind every queued replication mutation. A
+			// reconnect must not inherit metadata or ranges from the old connection.
+			try {
+				this._replicationInfoBlockedPeers.add(peerHash);
+				await this.drainPeerReceiveHandlers(peerHash);
+				await this.withReplicationInfoApplyQueue(peerHash, async () => {});
+				if (
+					!this.isReplicationLifecycleActive(replicationLifecycleController) ||
+					!ownsSubscriptionEpoch()
+				) {
+					return;
+				}
+				// The timestamp watermark belongs to the previous subscription epoch.
+				// Sender clocks are not synchronized, so carrying a local unsubscribe
+				// timestamp forward could reject every valid announcement after reconnect.
+				this.latestReplicationInfoMessage.delete(peerHash);
+				this._pendingReplicatorLeaveByPeer.delete(peerHash);
+				const openingCapabilities =
+					this._openingSyncCapabilitiesByPeer.get(peerHash);
+				if (openingCapabilities?.epoch === expectedSubscriptionEpoch) {
+					this._peerSyncCapabilities.set(
+						peerHash,
+						openingCapabilities.capabilities,
+					);
+					this._openingSyncCapabilitiesByPeer.delete(peerHash);
+				}
+				this._replicationInfoBlockedPeers.delete(peerHash);
+			} finally {
+				if (
+					this._openingSyncCapabilitiesByPeer.get(peerHash)?.epoch ===
+					expectedSubscriptionEpoch
+				) {
+					this._openingSyncCapabilitiesByPeer.delete(peerHash);
+				}
+				if (
+					this._subscriptionOpeningEpochByPeer.get(peerHash) ===
+					expectedSubscriptionEpoch
+				) {
+					this._subscriptionOpeningEpochByPeer.delete(peerHash);
+				}
+			}
+		}
 		if (!subscribed) {
+			this._subscriptionOpeningEpochByPeer.delete(peerHash);
+			this._openingSyncCapabilitiesByPeer.delete(peerHash);
 			this._replicationInfoBlockedPeers.add(peerHash);
+			const disconnectedJoinWarmupGeneration =
+				this._joinWarmupGenerationByTarget.get(peerHash) ?? null;
+			this.cancelJoinWarmupTarget(peerHash);
 
 			const now = BigInt(+new Date());
 			const previous = this.latestReplicationInfoMessage.get(peerHash);
@@ -21169,24 +23137,37 @@ export class SharedLog<
 				this.latestReplicationInfoMessage.set(peerHash, now);
 			}
 
-			const wasReplicator = this.uniqueReplicators.has(peerHash);
+			let removed = false;
 			try {
 				// Unsubscribe can race with the peer's final replication reset message.
 				// Proactively evict its ranges so leader selection doesn't keep stale owners.
-				await this.removeReplicator(publicKey, { noEvent: true });
+				removed = await this.removeReplicator(publicKey, {
+					cleanupIfSubscriptionSuperseded: true,
+					expectedJoinWarmupGeneration:
+						disconnectedJoinWarmupGeneration,
+					noEvent: true,
+					onRemoved: ({ wasReplicator }) => {
+						if (wasReplicator) {
+							this._pendingReplicatorLeaveByPeer.add(peerHash);
+						}
+					},
+					replicationLifecycleController,
+					subscriptionEpoch: expectedSubscriptionEpoch,
+				});
 			} catch (error) {
 				if (!isNotStartedError(error as Error)) {
 					throw error;
 				}
 			}
-			if (!this.isReplicationLifecycleActive(replicationLifecycleController)) {
+			if (
+				!this.isReplicationLifecycleActive(replicationLifecycleController) ||
+				!ownsSubscriptionEpoch() ||
+				!removed
+			) {
 				return;
 			}
 
-			this._replicatorJoinEmitted.delete(peerHash);
-			this.cleanupPeerDisconnectTracking(peerHash);
-
-			if (wasReplicator) {
+			if (this._pendingReplicatorLeaveByPeer.delete(peerHash)) {
 				this.events.dispatchEvent(
 					new CustomEvent<ReplicatorLeaveEvent>("replicator:leave", {
 						detail: { publicKey },
@@ -21234,7 +23215,10 @@ export class SharedLog<
 			}
 			throw error;
 		}
-		if (!this.isReplicationLifecycleActive(replicationLifecycleController)) {
+		if (
+			!this.isReplicationLifecycleActive(replicationLifecycleController) ||
+			!ownsSubscriptionEpoch()
+		) {
 			return;
 		}
 		if (replicationSegments.length > 0) {
@@ -21254,7 +23238,10 @@ export class SharedLog<
 						replicationLifecycleController,
 					),
 				);
-			if (!this.isReplicationLifecycleActive(replicationLifecycleController)) {
+			if (
+				!this.isReplicationLifecycleActive(replicationLifecycleController) ||
+				!ownsSubscriptionEpoch()
+			) {
 				return;
 			}
 
@@ -21285,7 +23272,10 @@ export class SharedLog<
 		// Request the remote peer's replication info. This makes joins resilient to
 		// timing-sensitive delivery/order issues where we may miss their initial
 		// replication announcement.
-		if (this.isReplicationLifecycleActive(replicationLifecycleController)) {
+		if (
+			this.isReplicationLifecycleActive(replicationLifecycleController) &&
+			ownsSubscriptionEpoch()
+		) {
 			this.scheduleReplicationInfoRequests(
 				publicKey,
 				replicationLifecycleController,
@@ -21718,14 +23708,23 @@ export class SharedLog<
 		if (this.closed) {
 			return;
 		}
-
-		await this.log.trim();
-
 		const batchedChanges = Array.isArray(changeOrChanges[0])
 			? (changeOrChanges as ReplicationChanges<ReplicationRangeIndexable<R>>[])
 			: [changeOrChanges as ReplicationChanges<ReplicationRangeIndexable<R>>];
 		const changes = batchedChanges.flat();
 		const selfHash = this.node.identity.publicKey.hashcode();
+		const joinWarmupGenerations = new Map<string, object>();
+		for (const change of changes) {
+			if (change.type === "added" && change.range.hash !== selfHash) {
+				joinWarmupGenerations.set(
+					change.range.hash,
+					this.getJoinWarmupGeneration(change.range.hash),
+				);
+			}
+		}
+
+		await this.log.trim();
+
 		// On removed ranges (peer leaves / shrink), gid-level history can hide
 		// per-entry gaps. Force a fresh delivery pass for reassigned entries.
 		const forceFreshDelivery = changes.some(
@@ -21803,6 +23802,12 @@ export class SharedLog<
 						),
 				)
 			: changes;
+		const isCurrentJoinWarmupTarget = (target: string) =>
+			warmupPeers.has(target) &&
+			this._joinWarmupGenerationByTarget.get(target) ===
+				joinWarmupGenerations.get(target);
+		const areJoinWarmupGenerationsCurrent = () =>
+			[...warmupPeers].every(isCurrentJoinWarmupTarget);
 
 		try {
 			const uncheckedDeliver: Map<
@@ -21815,6 +23820,10 @@ export class SharedLog<
 					return;
 				}
 				const isWarmupTarget = warmupPeers.has(target);
+				if (isWarmupTarget && !isCurrentJoinWarmupTarget(target)) {
+					uncheckedDeliver.delete(target);
+					return;
+				}
 				const mode: RepairDispatchMode = forceFreshDelivery
 					? "churn"
 					: isWarmupTarget
@@ -21839,6 +23848,9 @@ export class SharedLog<
 				target: string,
 				entry: EntryReplicated<any>,
 			) => {
+				if (warmupPeers.has(target) && !isCurrentJoinWarmupTarget(target)) {
+					return;
+				}
 				churnRepairPeers.add(target);
 				let set = uncheckedDeliver.get(target);
 				if (!set) {
@@ -21863,7 +23875,11 @@ export class SharedLog<
 						forceFresh: forceFreshDelivery || useJoinWarmupFastPath,
 					},
 				)) {
-					if (this.closed) {
+					if (
+						this.closed ||
+						(useJoinWarmupFastPath &&
+							!areJoinWarmupGenerationsCurrent())
+					) {
 						break;
 					}
 
@@ -21883,7 +23899,9 @@ export class SharedLog<
 
 						const candidatePeers = new Set<string>([selfHash]);
 						for (const target of warmupPeers) {
-							candidatePeers.add(target);
+							if (isCurrentJoinWarmupTarget(target)) {
+								candidatePeers.add(target);
+							}
 						}
 						if (oldPeersSet) {
 							for (const oldPeer of oldPeersSet) {
@@ -21900,6 +23918,9 @@ export class SharedLog<
 								persist: false,
 							},
 						);
+						if (!areJoinWarmupGenerationsCurrent()) {
+							continue;
+						}
 
 						if (oldPeersSet) {
 							for (const oldPeer of oldPeersSet) {
@@ -21910,14 +23931,18 @@ export class SharedLog<
 						}
 
 						for (const [peer] of currentPeers) {
-							if (warmupPeers.has(peer)) {
-								this.markRepairSweepOptimisticPeer(entryReplicated.gid, peer);
+							if (isCurrentJoinWarmupTarget(peer)) {
+								this.markRepairSweepOptimisticPeer(
+									entryReplicated.gid,
+									peer,
+									joinWarmupGenerations.get(peer)!,
+								);
 							}
 						}
 
 						const authoritativePeers = [...currentPeers.keys()].filter(
 							(peer) =>
-								!warmupPeers.has(peer) &&
+								!isCurrentJoinWarmupTarget(peer) &&
 								!this.hasPendingRepairSweepOptimisticPeer(
 									entryReplicated.gid,
 									peer,
@@ -21983,8 +24008,12 @@ export class SharedLog<
 					}
 
 					for (const [peer] of currentPeers) {
-						if (addedPeers.has(peer)) {
-							this.markRepairSweepOptimisticPeer(entryReplicated.gid, peer);
+						if (isCurrentJoinWarmupTarget(peer)) {
+							this.markRepairSweepOptimisticPeer(
+								entryReplicated.gid,
+								peer,
+								joinWarmupGenerations.get(peer)!,
+							);
 						}
 					}
 
@@ -22036,6 +24065,7 @@ export class SharedLog<
 					this.scheduleRepairSweep({
 						mode: "join-warmup",
 						peers,
+						joinWarmupGenerations,
 					});
 				}, 250);
 				timer.unref?.();
@@ -22110,6 +24140,7 @@ export class SharedLog<
 		}
 
 		const fromHash = evt.detail.from.hashcode();
+		const subscriptionEpoch = this.advanceSubscriptionEpoch(fromHash);
 		this._replicationInfoBlockedPeers.add(fromHash);
 		this._recentRepairDispatch.delete(fromHash);
 
@@ -22127,6 +24158,7 @@ export class SharedLog<
 			evt.detail.from,
 			evt.detail.topics,
 			false,
+			subscriptionEpoch,
 		);
 	}
 
@@ -22140,14 +24172,17 @@ export class SharedLog<
 			return;
 		}
 
+		const fromHash = evt.detail.from.hashcode();
+		const subscriptionEpoch = this.advanceSubscriptionEpoch(fromHash);
 		this.remoteBlocks.onReachable(evt.detail.from);
-		this._replicationInfoBlockedPeers.delete(evt.detail.from.hashcode());
+		this._replicationInfoBlockedPeers.add(fromHash);
 		this.invalidateSharedLogTopicSubscribersCache();
 
 		await this.handleSubscriptionChange(
 			evt.detail.from,
 			evt.detail.topics,
 			true,
+			subscriptionEpoch,
 		);
 	}
 
@@ -22342,7 +24377,7 @@ export class SharedLog<
 
 		if (ih) {
 			ih.clear();
-			ih.callback(entry);
+			this.runPendingIHaveCallback(ih, entry);
 		}
 
 		this.syncronizer.onEntryAdded(entry);
@@ -22356,7 +24391,7 @@ export class SharedLog<
 			}
 			const entry = materializeEntry();
 			ih.clear();
-			ih.callback(entry);
+			this.runPendingIHaveCallback(ih, entry);
 			this.syncronizer.onEntryAdded(entry);
 			return;
 		}