@peerbit/shared-log 13.2.34 → 13.2.36

package/src/index.ts

@@ -1346,6 +1346,13 @@ export const WAIT_FOR_REPLICATOR_TIMEOUT = 20000;
 export const WAIT_FOR_ROLE_MATURITY = 5000;
 export const WAIT_FOR_REPLICATOR_REQUEST_INTERVAL = 1000;
 export const WAIT_FOR_REPLICATOR_REQUEST_MIN_ATTEMPTS = 3;
+// The V2 recovery scheduler is deliberately persistent (a subscribed peer is
+// re-solicited for as long as its topic session stays open), but consecutive
+// fruitless park/unpark cycles double the wait before the next unpark so a
+// silent-but-subscribed peer converges to one bounded request cycle per cap
+// window instead of one per base interval. Any applied V2 progress resets it.
+export const REPLICATION_INFO_V2_RECOVERY_MAX_UNPARK_DELAY = 300_000;
+const REPLICATION_INFO_V2_RECOVERY_MAX_UNPARK_EXPONENT = 20;
 // TODO(prune): Investigate if/when a non-zero prune delay is required for correctness
 // (e.g. responsibility/replication-info message reordering in multi-peer scenarios).
 // Prefer making pruning robust without timing-based heuristics.
@@ -2086,9 +2093,23 @@ export class SharedLog<
 	// reconnect barrier commits. See PeerSessionRegistry._replicationInfoBlockedPeers.
 	private _replicationInfoRequestByPeer!: Map<
 		string,
-		{ attempts: number; timer?: ReturnType<typeof setTimeout> }
+		{
+			// Legacy scheduler: sends issued (bounded by maxAttempts). V2 recovery
+			// scheduler: consecutive fruitless unparks — the escalation exponent
+			// for the next unpark delay, reset on any applied V2 progress.
+			attempts: number;
+			timer?: ReturnType<typeof setTimeout>;
+			peerSession?: PeerSession;
+			// V2 recovery scheduler only: when the current park was first observed.
+			parkedSinceMs?: number;
+		}
 	>;
 	private _replicationInfoApplyQueueByPeer!: Map<string, Promise<void>>;
+	// One in-flight targeted subscriber-snapshot request per session-less peer.
+	// A capability burst from a peer whose Subscribe has not been observed must
+	// coalesce into a single pubsub.requestSubscribers call (mirrors the
+	// waitForReplicator in-flight coalescing); a later burst may request again.
+	private _subscriberSnapshotRequestsByPeer!: Map<string, Promise<void>>;
 	// Range ids are global primary keys while receive lanes are per peer. Keep
 	// reads and writes that decide one mutation in a single global lane.
 	private _replicationRangeMutationTail: Promise<void> = Promise.resolve();
@@ -3382,6 +3403,7 @@ export class SharedLog<
 					error,
 				),
 			enqueueReplicationInfoV2: (message) => this._v2Send.enqueue(message),
+			isLegacyReplicationInfoEnabled: () => this.legacyReplicationInfoEnabled,
 			isClosed: () => this.closed,
 			getCloseSignal: () => this._closeController.signal,
 			getMyReplicationSegments: () => this.getMyReplicationSegments(),
@@ -3628,6 +3650,7 @@ export class SharedLog<
 		this._pendingIHaveCallbacks = new Set();
 		this.latestReplicationInfoMessage = new Map();
 		this._replicationInfoRequestByPeer = new Map();
+		this._subscriberSnapshotRequestsByPeer = new Map();
 		this._replicationInfoApplyQueueByPeer = new Map();
 		// The registry constructor runs resetForOpen(), which creates the
 		// replication-info blocked set (fence B5) alongside the session maps —
@@ -3740,6 +3763,14 @@ export class SharedLog<
 		return this._logProperties?.compatibility;
 	}
 
+	/**
+	 * Legacy replication-info is an explicit compatibility fallback. Current
+	 * logs never infer or re-enable it from a remote peer's capabilities.
+	 */
+	private get legacyReplicationInfoEnabled(): boolean {
+		return this.compatibility !== undefined && this.compatibility < 10;
+	}
+
 	get isAdaptiveReplicating() {
 		return this._isAdaptiveReplicating;
 	}
@@ -4269,6 +4300,9 @@ export class SharedLog<
 		);
 		if (generationAdvanced) {
 			this._v2Send.advancePeerCapability(peerHash);
+			// A fresh signed capability generation is V2 progress from the peer:
+			// recovery re-solicitation may restart from the base interval.
+			this.resetReplicationInfoV2RecoveryEscalation(peerHash);
 		}
 		return true;
 	}
@@ -4299,6 +4333,36 @@ export class SharedLog<
 		});
 	}
 
+	/**
+	 * Coalesced targeted subscriber-snapshot request for the
+	 * capability-before-Subscribe recovery path. The observed-capability gate
+	 * is sender-paced (any advancing timestamp passes), so a burst of frames
+	 * from one session-less peer must not fan out into one GetSubscribers
+	 * unicast per frame. One request per peer is in flight at a time; once it
+	 * settles, a genuinely new session-less capability may request again.
+	 */
+	private requestSubscriberSnapshotForCapability(target: PublicSignKey): void {
+		const peerHash = target.hashcode();
+		if (this._subscriberSnapshotRequestsByPeer.has(peerHash)) {
+			return;
+		}
+		const request = Promise.resolve()
+			.then(() =>
+				this.node.services.pubsub.requestSubscribers(this.topic, target),
+			)
+			.catch((error) => {
+				if (!isNotStartedError(error as Error)) {
+					logger.error(error?.toString?.() ?? String(error));
+				}
+			})
+			.finally(() => {
+				if (this._subscriberSnapshotRequestsByPeer.get(peerHash) === request) {
+					this._subscriberSnapshotRequestsByPeer.delete(peerHash);
+				}
+			});
+		this._subscriberSnapshotRequestsByPeer.set(peerHash, request);
+	}
+
 	/**
 	 * Live append gossip may use the raw exchange-heads path only when we
 	 * opted into raw sync and every remote recipient advertised raw capability
@@ -14163,7 +14227,9 @@ export class SharedLog<
 		this.domain = options?.domain
 			? (options.domain(this) as unknown as D)
 			: (createReplicationDomainHash(
-					options?.compatibility && options?.compatibility < 10 ? "u32" : "u64",
+					options?.compatibility !== undefined && options.compatibility < 10
+						? "u32"
+						: "u64",
 				)(this) as unknown as D);
 		this.indexableDomain = createIndexableDomainFromResolution(
 			this.domain.resolution,
@@ -14176,6 +14242,7 @@ export class SharedLog<
 		this._pendingIHaveCallbacks = new Set();
 		this.latestReplicationInfoMessage = new Map();
 		this._replicationInfoRequestByPeer = new Map();
+		this._subscriberSnapshotRequestsByPeer = new Map();
 		// Terminal close/drop drains the previous lifecycle before another open can
 		// install fresh lanes and opaque per-subscription ownership tokens.
 		this._replicationInfoApplyQueueByPeer = new Map();
@@ -14309,8 +14376,12 @@ export class SharedLog<
 		}
 
 		this._closeController = new AbortController();
-		this._announcements.setupReplicationAnnouncementRetryFunction();
-		this._announcements.setupReplicationAnnouncementRepairFunction();
+		if (this.legacyReplicationInfoEnabled) {
+			this._announcements.setupReplicationAnnouncementRetryFunction();
+			this._announcements.setupReplicationAnnouncementRepairFunction();
+		} else {
+			this._announcements.cancelCurrentReplicationStateAnnouncementRetry();
+		}
 		this._closeController.signal.addEventListener("abort", () => {
 			for (const [_peer, state] of this._replicationInfoRequestByPeer) {
 				if (state.timer) clearTimeout(state.timer);
@@ -15512,7 +15583,14 @@ export class SharedLog<
 
 	async afterOpen(): Promise<void> {
 		await super.afterOpen();
-		const existingSubscribersPromise = this._getTopicSubscribers(this.topic);
+		// Start the broader discovery eagerly, in parallel with rebalance, for its
+		// routing/cache side effects. It also contains connected/provider/fanout
+		// candidates that have not subscribed to this log, so only the authoritative
+		// pubsub snapshot below may create subscription fallback sessions.
+		const subscriberDiscoveryPromise = this._getTopicSubscribers(this.topic);
+		const existingSubscribersPromise = this.node.services.pubsub.getSubscribers(
+			this.topic,
+		);
 		const replicationLifecycleController =
 			this._instanceLifecycle?.membershipLifecycleController;
 
@@ -15533,6 +15611,7 @@ export class SharedLog<
 		this._liveness.startReplicatorLivenessSweep();
 
 		await this.rebalanceParticipation();
+		await subscriberDiscoveryPromise;
 
 		// Take into account existing subscription
 		(await existingSubscribersPromise)?.forEach((v) => {
@@ -15542,6 +15621,14 @@ export class SharedLog<
 			if (this.closed) {
 				return;
 			}
+			// The live subscribe event and this after-open snapshot can report the
+			// same initial transport generation. The live callback rotates its
+			// PeerSession synchronously, so any current session here proves the
+			// fallback is stale/duplicate. Rotating again would erase the signed
+			// capability binding that the first callback just established.
+			if (this._peerSessions.current(v.hashcode()) !== null) {
+				return;
+			}
 			void this.runSubscriptionChangeCallback(() =>
 				this.handleSubscriptionChange(v, [this.topic], true),
 			);
@@ -15754,7 +15841,9 @@ export class SharedLog<
 		const peerSession = this._peerSessions.current(peerHash);
 		const preserveV2Session =
 			peerSession?.phase === "open" && peerSession.isActive();
-		this.cancelReplicationInfoRequests(peerHash);
+		if (this.legacyReplicationInfoEnabled || !preserveV2Session) {
+			this.cancelReplicationInfoRequests(peerHash);
+		}
 		this._liveness._replicatorLivenessFailures.delete(peerHash);
 		this._liveness._replicatorLastActivityAt.delete(peerHash);
 		if (!preserveV2Session) {
@@ -16925,15 +17014,18 @@ export class SharedLog<
 				}, 2_000);
 				try {
 					const reset = new AllReplicatingSegmentsMessage({ segments: [] });
-					await Promise.all([
-						this.rpc
-							.send(reset, {
-								priority: CONVERGENCE_MESSAGE_PRIORITY,
-								signal: abort.signal,
-							})
-							.catch(() => {}),
-						this._v2Send.sendTerminalReset(abort.signal),
-					]);
+					const resets = [this._v2Send.sendTerminalReset(abort.signal)];
+					if (this.legacyReplicationInfoEnabled) {
+						resets.push(
+							this.rpc
+								.send(reset, {
+									priority: CONVERGENCE_MESSAGE_PRIORITY,
+									signal: abort.signal,
+								})
+								.catch(() => {}),
+						);
+					}
+					await Promise.all(resets);
 				} finally {
 					clearTimeout(abortTimer);
 				}
@@ -17055,15 +17147,18 @@ export class SharedLog<
 				}, 2_000);
 				try {
 					const reset = new AllReplicatingSegmentsMessage({ segments: [] });
-					await Promise.all([
-						this.rpc
-							.send(reset, {
-								priority: CONVERGENCE_MESSAGE_PRIORITY,
-								signal: abort.signal,
-							})
-							.catch(() => {}),
-						this._v2Send.sendTerminalReset(abort.signal),
-					]);
+					const resets = [this._v2Send.sendTerminalReset(abort.signal)];
+					if (this.legacyReplicationInfoEnabled) {
+						resets.push(
+							this.rpc
+								.send(reset, {
+									priority: CONVERGENCE_MESSAGE_PRIORITY,
+									signal: abort.signal,
+								})
+								.catch(() => {}),
+						);
+					}
+					await Promise.all(resets);
 				} finally {
 					clearTimeout(abortTimer);
 				}
@@ -17589,6 +17684,19 @@ export class SharedLog<
 			if (!context.from) {
 				throw new Error("Missing from in update role message");
 			}
+			if (
+				!this.legacyReplicationInfoEnabled &&
+				(msg instanceof RequestReplicationInfoMessage ||
+					msg instanceof ResponseRoleMessage ||
+					msg instanceof AllReplicatingSegmentsMessage ||
+					msg instanceof AddedReplicationSegmentMessage ||
+					msg instanceof StoppedReplicating)
+			) {
+				// These variants remain registered decode tombstones, but current logs
+				// fail closed before leases, synchronizer work, liveness, watermarks or
+				// mutations. Only an explicit pre-v10 compatibility open admits them.
+				return;
+			}
 			// Snapshot receive ownership before any async handler gets a chance to
 			// yield. Replication-info messages reach their branch only after the
 			// synchronizer declines them, and a U/S transition can happen meanwhile.
@@ -19310,19 +19418,26 @@ export class SharedLog<
 								timestamp: capabilityTimestamp,
 								openingSession: receiveSession!,
 							});
-						} else if (
-							this.observePeerSyncCapabilities({
+						} else {
+							const observed = this.observePeerSyncCapabilities({
 								peerHash: receiveFromHash,
 								capabilities: msg.capabilities,
 								transportSession: capabilityTransportSession,
 								timestamp: capabilityTimestamp,
-							}) &&
-							receiveSession?.phase === "open"
-						) {
-							this.promoteReplicationInfoV2ReceiveCapability(
-								context.from,
-								receiveSession,
-							);
+							});
+							if (observed && receiveSession?.phase === "open") {
+								this.promoteReplicationInfoV2ReceiveCapability(
+									context.from,
+									receiveSession,
+								);
+							} else if (observed && receiveSession === null) {
+								// A capability can arrive before the sender's topic Subscribe after
+								// reconnect. Ask that authenticated peer for its authoritative
+								// subscriber snapshot; the resulting Subscribe creates the real
+								// PeerSession and completes the symmetric capability handshake.
+								// Never synthesize membership from capability traffic alone.
+								this.requestSubscriberSnapshotForCapability(context.from);
+							}
 						}
 					}
 					return;
@@ -19889,7 +20004,13 @@ export class SharedLog<
 					return;
 				}
 				this._liveness.markReplicatorActivity(fromHash);
-				if (msg instanceof FullReplicationInfoV2Message) {
+				// A committed V2 announcement is applied progress: the peer answers,
+				// so recovery re-solicitation may restart from the base interval.
+				this.resetReplicationInfoV2RecoveryEscalation(fromHash);
+				if (
+					msg instanceof FullReplicationInfoV2Message &&
+					this.legacyReplicationInfoEnabled
+				) {
 					this.cancelReplicationInfoRequests(fromHash);
 				}
 			});
@@ -20553,6 +20674,7 @@ export class SharedLog<
 		}, timeoutMs);
 
 		let requestAttempts = 0;
+		let subscriberSnapshotInFlight: Promise<void> | undefined;
 		const requestIntervalMs = this.waitForReplicatorRequestIntervalMs;
 		const maxRequestAttempts =
 			this.waitForReplicatorRequestMaxAttempts ??
@@ -20560,6 +20682,26 @@ export class SharedLog<
 				WAIT_FOR_REPLICATOR_REQUEST_MIN_ATTEMPTS,
 				Math.ceil(timeoutMs / requestIntervalMs),
 			);
+		const requestSubscriberSnapshot = () => {
+			if (subscriberSnapshotInFlight) {
+				return;
+			}
+			subscriberSnapshotInFlight = Promise.resolve()
+				.then(async () => {
+					if (settled || this.closed) {
+						return;
+					}
+					await this.node.services.pubsub.requestSubscribers(this.topic, key);
+				})
+				.catch((error) => {
+					if (!isNotStartedError(error as Error)) {
+						logger.error(error?.toString?.() ?? String(error));
+					}
+				})
+				.finally(() => {
+					subscriberSnapshotInFlight = undefined;
+				});
+		};
 
 		const requestReplicationInfo = () => {
 			if (settled || this.closed) {
@@ -20572,17 +20714,35 @@ export class SharedLog<
 
 			requestAttempts++;
 
-			this.rpc
-				.send(new RequestReplicationInfoMessage(), {
-					mode: new AcknowledgeDelivery({ redundancy: 1, to: [key] }),
-				})
-				.catch((e) => {
-					// Best-effort: missing peers / unopened RPC should not fail the wait logic.
-					if (isNotStartedError(e as Error)) {
-						return;
-					}
-					logger.error(e?.toString?.() ?? String(e));
-				});
+			if (this.legacyReplicationInfoEnabled) {
+				this.rpc
+					.send(new RequestReplicationInfoMessage(), {
+						mode: new AcknowledgeDelivery({ redundancy: 1, to: [key] }),
+					})
+					.catch((e) => {
+						// Best-effort: missing peers / unopened RPC should not fail the wait logic.
+						if (isNotStartedError(e as Error)) {
+							return;
+						}
+						logger.error(e?.toString?.() ?? String(e));
+					});
+			} else {
+				const peerHash = key.hashcode();
+				const peerSession = this._peerSessions.current(peerHash);
+				if (peerSession?.phase === "open") {
+					this._v2Receive.resumeParkedRequest({
+						peerHash,
+						peerSession,
+						receiveEpoch: this._peerSessions.receiveEpoch(peerHash),
+					});
+				} else if (peerSession === null || peerSession.phase === "departing") {
+					// A peer can be known to routing before its SharedLog topic
+					// subscription has been observed. Legacy requests used to bootstrap
+					// that case directly; V2 needs an authoritative Subscribe snapshot
+					// before it can create a fenced PeerSession and request a Full.
+					requestSubscriberSnapshot();
+				}
+			}
 
 			if (requestAttempts < maxRequestAttempts) {
 				requestTimer = setTimeout(requestReplicationInfo, requestIntervalMs);
@@ -23316,6 +23476,132 @@ export class SharedLog<
 		this._replicationInfoRequestByPeer.delete(peerHash);
 	}
 
+	/**
+	 * Applied V2 progress from a peer (a committed Full/Added/Stopped, or a
+	 * rotated capability generation) proves the peer answers. Reset the
+	 * recovery scheduler's unpark escalation so a later stall restarts from
+	 * the base interval. Peer-session rotation resets implicitly: the recovery
+	 * scheduler creates a fresh per-session state.
+	 */
+	private resetReplicationInfoV2RecoveryEscalation(peerHash: string) {
+		const state = this._replicationInfoRequestByPeer.get(peerHash);
+		if (!state || state.peerSession === undefined) {
+			return;
+		}
+		state.attempts = 0;
+		state.parkedSinceMs = undefined;
+	}
+
+	private scheduleReplicationInfoV2Recovery(
+		peer: PublicSignKey,
+		replicationLifecycleController = this._instanceLifecycle
+			?.membershipLifecycleController,
+	) {
+		if (
+			!replicationLifecycleController ||
+			!this.isReplicationLifecycleActive(replicationLifecycleController)
+		) {
+			return;
+		}
+		const peerHash = peer.hashcode();
+		const peerSession = this._peerSessions.current(peerHash);
+		if (!peerSession || peerSession.phase !== "open") {
+			return;
+		}
+		const requestStates = this._replicationInfoRequestByPeer;
+		const existing = requestStates.get(peerHash);
+		if (existing?.peerSession === peerSession) {
+			return;
+		}
+		if (existing) {
+			if (existing.timer) {
+				clearTimeout(existing.timer);
+			}
+			requestStates.delete(peerHash);
+		}
+		const state: {
+			attempts: number;
+			timer?: ReturnType<typeof setTimeout>;
+			peerSession: PeerSession;
+			parkedSinceMs?: number;
+		} = {
+			attempts: 0,
+			peerSession,
+		};
+		requestStates.set(peerHash, state);
+		const cancel = () => {
+			if (requestStates.get(peerHash) !== state) {
+				return;
+			}
+			if (state.timer) {
+				clearTimeout(state.timer);
+			}
+			requestStates.delete(peerHash);
+		};
+		const intervalMs = Math.max(50, this.waitForReplicatorRequestIntervalMs);
+		const maxUnparkDelayMs = Math.max(
+			intervalMs,
+			REPLICATION_INFO_V2_RECOVERY_MAX_UNPARK_DELAY,
+		);
+		const unparkDelayMs = () =>
+			Math.min(
+				maxUnparkDelayMs,
+				intervalMs *
+					2 **
+						Math.min(
+							state.attempts,
+							REPLICATION_INFO_V2_RECOVERY_MAX_UNPARK_EXPONENT,
+						),
+			);
+		const arm = (delayMs: number) => {
+			state.timer = setTimeout(tick, delayMs);
+			state.timer.unref?.();
+		};
+		const tick = () => {
+			if (
+				!this.isReplicationLifecycleActive(replicationLifecycleController) ||
+				peerSession.phase !== "open" ||
+				!this._peerSessions.isCurrent(peerHash, peerSession)
+			) {
+				cancel();
+				return;
+			}
+			const receiveEpoch = this._peerSessions.receiveEpoch(peerHash);
+			if (
+				!this._v2Receive.isRequestParked({ peerHash, peerSession, receiveEpoch })
+			) {
+				// Active, or a bounded request cycle is still running its own
+				// exponential retries. Keep polling for the next park.
+				state.parkedSinceMs = undefined;
+				arm(intervalMs);
+				return;
+			}
+			const now = Date.now();
+			if (state.parkedSinceMs === undefined) {
+				state.parkedSinceMs = now;
+			}
+			const resumeAtMs = state.parkedSinceMs + unparkDelayMs();
+			if (now < resumeAtMs) {
+				arm(Math.max(50, resumeAtMs - now));
+				return;
+			}
+			if (
+				this._v2Receive.resumeParkedRequest({
+					peerHash,
+					peerSession,
+					receiveEpoch,
+				})
+			) {
+				// Fruitless until proven otherwise: escalate the next unpark wait.
+				// Applied progress resets via resetReplicationInfoV2RecoveryEscalation.
+				state.attempts++;
+				state.parkedSinceMs = undefined;
+			}
+			arm(intervalMs);
+		};
+		tick();
+	}
+
 	private scheduleReplicationInfoRequests(
 		peer: PublicSignKey,
 		replicationLifecycleController = this._instanceLifecycle
@@ -23327,6 +23613,13 @@ export class SharedLog<
 		) {
 			return;
 		}
+		if (!this.legacyReplicationInfoEnabled) {
+			this.scheduleReplicationInfoV2Recovery(
+				peer,
+				replicationLifecycleController,
+			);
+			return;
+		}
 		const peerHash = peer.hashcode();
 		const requestStates = this._replicationInfoRequestByPeer;
 		if (requestStates.has(peerHash)) {
@@ -23360,7 +23653,6 @@ export class SharedLog<
 				cancel();
 				return;
 			}
-
 			state.attempts++;
 
 			this.rpc
@@ -23397,6 +23689,7 @@ export class SharedLog<
 		topics: string[],
 		subscribed: boolean,
 		subscriptionEpoch?: PeerSession,
+		subscriptionTransportSession?: bigint,
 	) {
 		if (!topics.includes(this.topic)) {
 			return;
@@ -23419,13 +23712,31 @@ export class SharedLog<
 		if (!ownsSubscriptionEpoch()) {
 			return;
 		}
+		// A reconnect can arrive before the previous exact-session recovery tick
+		// observes its stale session. Retire that job synchronously so it cannot
+		// suppress the replacement session's scheduler in the shared peer slot.
+		this.cancelReplicationInfoRequests(peerHash);
 		// A destination stream is scoped to exactly one topic-subscription
 		// session. Abort the predecessor synchronously before either barrier can
 		// yield; a late queue completion must never enter the new session.
 		this._v2Receive.clearPeer(peerHash);
 		this._v2Send.clearPeer(peerHash);
-		this._peerSyncCapabilitySessions.delete(peerHash);
-		this._peerSyncCapabilityTimestamps.delete(peerHash);
+		const capabilityTransportSession =
+			this._peerSyncCapabilitySessions.get(peerHash);
+		const canInheritCapability =
+			subscribed &&
+			(subscriptionTransportSession !== undefined
+				? capabilityTransportSession === subscriptionTransportSession
+				: !expectedSubscriptionEpoch.hasPredecessor);
+		if (!canInheritCapability) {
+			// Departures and successor openings revoke the signed transport binding.
+			// A live successor may inherit a capability that arrived just before its
+			// Subscribe only when both signed frames belong to the same transport
+			// generation. Snapshot fallbacks lack that proof, so only their first
+			// opening may inherit pre-opening capability state.
+			this._peerSyncCapabilitySessions.delete(peerHash);
+			this._peerSyncCapabilityTimestamps.delete(peerHash);
+		}
 		if (subscribed) {
 			const pendingOpeningCapabilities =
 				this._openingSyncCapabilitiesByPeer.get(peerHash);
@@ -23577,6 +23888,17 @@ export class SharedLog<
 				receiveEpoch,
 				signal: replicationLifecycleController.signal,
 			});
+		if (!this.legacyReplicationInfoEnabled) {
+			// Current logs have no legacy startup work to order ahead of RequestV2.
+			// Releasing is synchronous and exact-session fenced; the ACK may still
+			// arrive later and promote readiness through the coordinator.
+			localCapabilityAdvertisement.releaseLegacyBarrier();
+			this.scheduleReplicationInfoV2Recovery(
+				publicKey,
+				replicationLifecycleController,
+			);
+			return;
+		}
 
 		try {
 			let replicationSegments: ReplicationRangeIndexable<R>[];
@@ -25105,6 +25427,7 @@ export class SharedLog<
 			evt.detail.topics,
 			true,
 			subscriptionEpoch,
+			evt.detail.session,
 		);
 	}
 

package/src/peer-session.ts

@@ -31,6 +31,11 @@ export type PeerReceiveAdmissionOptions = {
 export class PeerSession {
 	readonly peerHash: string;
 	readonly kind: PeerSessionKind;
+	// True when rotate() superseded an earlier subscription generation. This is
+	// deliberately independent of the predecessor's phase/kind: a newer
+	// transport can announce a subscription without first delivering an
+	// unsubscribe, and must not inherit the old transport's signed capability.
+	readonly hasPredecessor: boolean;
 	// The lifecycle controller live at rotation. All current seams pair the
 	// epoch check with a lifecycle check against a controller captured in the
 	// same synchronous window as the epoch advance; capturing it here
@@ -59,10 +64,12 @@ export class PeerSession {
 		peerHash: string,
 		kind: PeerSessionKind,
 		replicationLifecycleController: AbortController | undefined,
+		hasPredecessor: boolean,
 	) {
 		this.peerHash = peerHash;
 		this.kind = kind;
 		this.replicationLifecycleController = replicationLifecycleController;
+		this.hasPredecessor = hasPredecessor;
 		this.phase = kind;
 	}
 
@@ -278,6 +285,7 @@ export class PeerSessionRegistry {
 			peerHash,
 			kind,
 			this.deps.getReplicationLifecycleController(),
+			previous !== undefined,
 		);
 		this.sessions.set(peerHash, next);
 		return next;