@peerbit/shared-log 16.0.0 → 16.0.1

package/src/checked-prune.ts

@@ -76,6 +76,14 @@ export class CheckedPruneCoordinator<T, R extends "u32" | "u64"> {
 	readonly retries = new Map<string, CheckedPruneRetryState<T, R>>();
 	private readonly sessions = new Map<string, CheckedPruneSession<T, R>>();
 	private readonly grantSends = new Map<string, Set<Promise<void>>>();
+	// Per-peer refcount of in-flight removal fences; while non-zero the peer is
+	// withheld from the exact-replicator set (see fencePeerRemoval /
+	// isPeerRemovalFenced).
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): a concurrency-DEPTH
+	// refcount held across removal lanes that may span a peer reconnect, so
+	// neither a session token (it would reset mid-drain) nor lifecycle identity
+	// (it cannot count open lanes) can replace it.
 	private readonly peerRemovalFences = new Map<string, number>();
 	private readonly restartReservations = new Map<string, object>();
 	private readonly candidateTokens = new Map<string, object>();
@@ -88,6 +96,10 @@ export class CheckedPruneCoordinator<T, R extends "u32" | "u64"> {
 	// a fresh coordinator); deliberately NOT touched by close() — the release
 	// closures drain it, matching the legacy host counter which was reset
 	// only at open.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): a concurrency-DEPTH
+	// counter of re-entrant removals — identity tells you which coordinator a
+	// continuation started under, never how many removals are in flight now.
 	private _checkedPruneRemoveBlocksLocalRangeMutationAdmission = 0;
 
 	/** ≡ the legacy inc / `finally`-dec pair around the admitted lower-log

package/src/index.ts

@@ -2017,7 +2017,6 @@ export class SharedLog<
 
 	uniqueReplicators!: Set<string>;
 	private _replicatorJoinEmitted!: Set<string>;
-	private _replicatorsReconciled!: boolean;
 
 	/* private _totalParticipation!: number; */
 
@@ -3658,7 +3657,6 @@ export class SharedLog<
 		this.recentlyRebalanced = new Cache<string>({ max: 1e4, ttl: 1e5 });
 		this.uniqueReplicators = new Set();
 		this._replicatorJoinEmitted = new Set();
-		this._replicatorsReconciled = false;
 		this._liveness = this.createReplicatorLivenessMonitor();
 		this._v2Receive = this.createReplicationInfoV2ReceiveCoordinator();
 		this._v2Send = this.createReplicationInfoV2SendCoordinator();
@@ -6779,7 +6777,7 @@ export class SharedLog<
 			rebalance?: boolean;
 			checkDuplicates?: boolean;
 			timestamp?: number;
-			allowLegacyOrderedReplacementPairs?: boolean;
+			allowOrderedReplacementPairs?: boolean;
 			onConfirmedDurableStateChanged?: () => void;
 			onDurableApplyCommitted?: () => boolean | void;
 			shouldApply?: () => boolean;
@@ -6821,7 +6819,7 @@ export class SharedLog<
 			checkDuplicates,
 			timestamp: ts,
 			rebalance,
-			allowLegacyOrderedReplacementPairs,
+			allowOrderedReplacementPairs,
 			onConfirmedDurableStateChanged,
 			onDurableApplyCommitted,
 			shouldApply,
@@ -6830,7 +6828,7 @@ export class SharedLog<
 			rebalance?: boolean;
 			checkDuplicates?: boolean;
 			timestamp?: number;
-			allowLegacyOrderedReplacementPairs?: boolean;
+			allowOrderedReplacementPairs?: boolean;
 			onConfirmedDurableStateChanged?: () => void;
 			onDurableApplyCommitted?: () => boolean | void;
 			shouldApply?: () => boolean;
@@ -6869,17 +6867,19 @@ export class SharedLog<
 			incomingRangeCountsById.set(range.idString, count);
 			if (
 				count > 1 &&
-				(!allowLegacyOrderedReplacementPairs || reset === true || count > 2)
+				(!allowOrderedReplacementPairs || reset === true || count > 2)
 			) {
 				throw new Error(
 					`Duplicate replication range id in announcement: ${range.idString}`,
 				);
 			}
-			// Released peers represented a non-reset replacement as the retired
-			// geometry followed by the current geometry under the same id. The
-			// sender is already authorized to replace that id with the final item,
-			// so collapsing an exact two-item incremental pair to its last item
-			// preserves rolling-upgrade compatibility without broadening authority.
+			// Rolling-upgrade relaxation on the live V2 Added path: a peer may
+			// still express a non-reset replacement as the retired geometry
+			// followed by the current geometry under one id. The sender is already
+			// authorized to replace that id with the final item, so collapsing an
+			// EXACT two-item incremental pair to its last item accepts the older
+			// wire shape without broadening authority. Deliberately narrow — reset
+			// announcements and any run longer than two still fail as duplicates.
 			incomingRangesById.set(range.idString, range);
 		}
 		const incomingRanges = [...incomingRangesById.values()];
@@ -14235,7 +14235,6 @@ export class SharedLog<
 
 		this.uniqueReplicators = new Set();
 		this._replicatorJoinEmitted = new Set();
-		this._replicatorsReconciled = false;
 		// Deserialized instances never ran the constructor; create the monitor and
 		// coordinator lazily on first open. Reopens keep the SAME instances so
 		// stale async continuations observe resets via property lookup.
@@ -15513,16 +15512,8 @@ export class SharedLog<
 		const existingSubscribersPromise = this.node.services.pubsub.getSubscribers(
 			this.topic,
 		);
-		const replicationLifecycleController =
-			this._instanceLifecycle?.membershipLifecycleController;
-
 		// We do this here, because these calls requires this.closed == false
 		void this.pruneOfflineReplicators()
-			.then(() => {
-				if (this.isReplicationLifecycleActive(replicationLifecycleController)) {
-					this._replicatorsReconciled = true;
-				}
-			})
 			.catch((error) => {
 				if (isNotStartedError(error as Error)) {
 					return;
@@ -19652,7 +19643,7 @@ export class SharedLog<
 								reset: msg instanceof FullReplicationInfoV2Message,
 								checkDuplicates: true,
 								timestamp: Number(context.message.header.timestamp),
-								allowLegacyOrderedReplacementPairs:
+								allowOrderedReplacementPairs:
 									msg instanceof AddedReplicationInfoV2Message,
 								shouldApply: () => {
 									mutationGateChecked = true;
@@ -19761,7 +19752,6 @@ export class SharedLog<
 		}
 	}
 
-
 	async calculateTotalParticipation(options?: { sum?: boolean }) {
 		if (options?.sum) {
 			const ranges = await this.replicationIndex.iterate().all();
@@ -23063,7 +23053,11 @@ export class SharedLog<
 			}
 			const receiveEpoch = this._peerSessions.receiveEpoch(peerHash);
 			if (
-				!this._v2Receive.isRequestParked({ peerHash, peerSession, receiveEpoch })
+				!this._v2Receive.isRequestParked({
+					peerHash,
+					peerSession,
+					receiveEpoch,
+				})
 			) {
 				// Active, or a bounded request cycle is still running its own
 				// exponential retries. Keep polling for the next park.

package/src/instance-lifecycle.ts

@@ -66,10 +66,19 @@ export class InstanceLifecycle {
 	// code. Incremented synchronously with leader-cache invalidation so the
 	// handler can detect whether its pre-join plan needs one fresh
 	// post-persist audit.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): a sub-generation
+	// WITHIN one lifecycle — it advances while the lifecycle identity is
+	// deliberately unchanged, so an identity/session token cannot tell a
+	// pre-invalidation plan from a post-invalidation one.
 	public _receiveOwnershipRevision = 0;
 	// Count of ownership-changing range mutations from queue admission
 	// through settlement, including mutations already pending when a receive
 	// starts.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): a concurrency-DEPTH
+	// refcount, not a staleness token — identity answers "which generation
+	// started this?", never "how many mutation lanes are open right now?".
 	public _receiveOwnershipMutationAdmissions = 0;
 
 	// ---- stage 4: physically owned controllers (moved from SharedLog) ----

package/src/peer-session.ts

@@ -131,6 +131,11 @@ export class PeerSessionRegistry {
 	// peer stays subscribed), and it must also fence a peer that never had a
 	// session. Unlike sessions this map IS cleared at _close (see
 	// clearReceiveEpochsForClose) and replaced at open.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): the per-PEER lifetime
+	// above is the whole mechanism — a session token would rotate at exactly
+	// the moments this map must survive, and could not fence a session-less
+	// peer at all.
 	_replicationInfoReceiveEpochByPeer!: Map<string, object>;
 	// Moved from SharedLog (fence B6, same name — the sanctioned file-to-file
 	// ratchet move). Refcount of in-flight destructive peer cleanups: while
@@ -140,6 +145,10 @@ export class PeerSessionRegistry {
 	// reconnect may rotate the session; a fresh session with a zero gate
 	// would reopen receive admission mid-drain. The map instance is replaced
 	// only at open (resetForOpen) and cleared in place at _close.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): both structural
+	// reasons at once — a concurrency-DEPTH refcount whose per-PEER lifetime
+	// deliberately spans the session rotation a reconnect causes mid-drain.
 	_receiveCleanupGateByPeer!: Map<string, number>;
 	// Moved from SharedLog (fence B5, same name). Peers whose replication-info
 	// is fenced: added when a departure/unsubscribe rotation or a reconnect

package/src/pid.ts

@@ -3,8 +3,6 @@ const MIN_MEMORY_HEADROOM_BALANCE_SCALER = 0.25;
 export class PIDReplicationController {
 	integral!: number;
 	prevError!: number;
-	prevMemoryUsage!: number;
-	prevTotalFactor!: number;
 	kp: number;
 	ki: number;
 	kd: number;
@@ -42,9 +40,6 @@ export class PIDReplicationController {
 		let { memoryUsage, totalFactor, peerCount, cpuUsage, currentFactor } =
 			properties;
 
-		this.prevTotalFactor = totalFactor;
-		this.prevMemoryUsage = memoryUsage;
-
 		const estimatedTotalSize =
 			currentFactor > 0 ? memoryUsage / currentFactor : 1e5;
 
@@ -238,6 +233,5 @@ export class PIDReplicationController {
 	reset() {
 		this.prevError = 0;
 		this.integral = 0;
-		this.prevMemoryUsage = 0;
 	}
 }

package/src/replication-info-v2-receive.ts

@@ -84,12 +84,6 @@ type LocalCapabilityReadyProperties = {
 
 export type ReplicationInfoV2LocalCapabilityAdvertisementHandle = {
 	firstAttempt: Promise<void>;
-	/**
-	 * B12: the two-phase legacy barrier is retired — an ACKed advert promotes
-	 * readiness immediately. Retained as a no-op so the handle shape (and the
-	 * tests that drive it) stay stable.
-	 */
-	releaseLegacyBarrier(): void;
 };
 
 export type ReplicationInfoV2LocalCapabilityContext = {
@@ -203,6 +197,14 @@ export type ReplicationInfoV2ReceiveDeps = {
  */
 export class ReplicationInfoV2ReceiveCoordinator {
 	_receiveStates!: Map<string, ReplicationInfoV2ReceiveState>;
+	/**
+	 * Post-B12 V2 resync memory: sessions that have already taken one full
+	 * replication-info snapshot. Two load-bearing reads, both in
+	 * observeCapability: phase selection (a remembered session opens in
+	 * "resync" instead of "awaiting-full"), and capability refresh (the
+	 * preserveCutover decision, which keeps the memory only when a re-advert
+	 * arrives under the same session with a ready sender).
+	 */
 	_cutoverPeerSessions!: WeakSet<object>;
 	_localCapabilityReadyBySession!: WeakMap<object, LocalCapabilityReady>;
 	_localCapabilityContextBySession!: WeakMap<
@@ -292,15 +294,17 @@ export class ReplicationInfoV2ReceiveCoordinator {
 	}
 
 	/** Revoke an unauthenticated or downgraded capability generation. */
-	revokePeerCapability(peerHash: string, reopenLegacy = true): void {
+	revokePeerCapability(peerHash: string): void {
 		const state = this._receiveStates.get(peerHash);
 		if (!state) {
 			return;
 		}
 		this.clearState(state);
-		if (reopenLegacy) {
-			this._cutoverPeerSessions.delete(state.peerSession);
-		}
+		// Unconditional: the revoked session must lose its resync memory so a
+		// re-advert starts from the first phase again. (This used to sit behind
+		// an opt-out parameter that defaulted to true, had no else-arm, and that
+		// no caller ever overrode.)
+		this._cutoverPeerSessions.delete(state.peerSession);
 	}
 
 	private clearState(state: ReplicationInfoV2ReceiveState): void {
@@ -531,7 +535,6 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		) {
 			return {
 				firstAttempt: Promise.resolve(),
-				releaseLegacyBarrier: () => {},
 			};
 		}
 		let context = this._localCapabilityContextBySession.get(
@@ -545,7 +548,6 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		) {
 			return {
 				firstAttempt: Promise.resolve(),
-				releaseLegacyBarrier: () => {},
 			};
 		}
 		if (!context) {
@@ -584,7 +586,6 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		) {
 			return {
 				firstAttempt: Promise.resolve(),
-				releaseLegacyBarrier: () => {},
 			};
 		}
 		if (!state) {
@@ -619,7 +620,6 @@ export class ReplicationInfoV2ReceiveCoordinator {
 			(state.firstAttempt = this.runLocalCapabilityAdvertisement(state));
 		return {
 			firstAttempt,
-			releaseLegacyBarrier: () => {},
 		};
 	}
 

package/src/role.ts

@@ -6,19 +6,10 @@
 import { field, variant, vec } from "@dao-xyz/borsh";
 import { MAX_U32, denormalizer } from "./integers.js";
 
-export const overlaps = (x1: number, x2: number, y1: number, y2: number) => {
-	if (x1 <= y2 && y1 <= x2) {
-		return true;
-	}
-	return false;
-};
-
 export abstract class Role {
 	abstract equals(other: Role): boolean;
 }
 
-export const NO_TYPE_VARIANT = new Uint8Array([0]);
-
 @variant(0)
 export class NoType extends Role {
 	equals(other: Role) {
@@ -26,8 +17,6 @@ export class NoType extends Role {
 	}
 }
 
-export const OBSERVER_TYPE_VARIANT = new Uint8Array([1]);
-
 @variant(1)
 export class Observer extends Role {
 	equals(other: Role) {
@@ -35,8 +24,6 @@ export class Observer extends Role {
 	}
 }
 
-export const REPLICATOR_TYPE_VARIANT = new Uint8Array([2]);
-
 const denormalizeru32 = denormalizer("u32");
 export class RoleReplicationSegment {
 	@field({ type: "u64" })