@peerbit/shared-log 16.0.0 → 16.0.2

package/src/index.ts

@@ -290,6 +290,7 @@ import {
 } from "./sync/profile.js";
 import {
 	ConfirmEntriesMessage,
+	RECENT_KNOWN_EXCHANGE_HEAD_SUPPRESSION_MS,
 	SYNC_MESSAGE_PRIORITY,
 	SimpleSyncronizer,
 } from "./sync/simple.js";
@@ -1439,6 +1440,16 @@ const JOIN_AUTHORITATIVE_RETRY_SCHEDULE_MS = [
 ];
 const APPEND_BACKFILL_RETRY_SCHEDULE_MS = [0, 1_000, 3_000, 7_000];
 const RECENT_KNOWN_REPAIR_SUPPRESSION_MS = 30_000;
+// `_entryKnownPeerObservedAt` is read ONLY through isEntryRecentlyKnownByPeer,
+// which treats an over-age row and an absent row identically (both false). So
+// rows older than the longest horizon any caller asks about are dead weight,
+// and dropping them is behaviour-identical rather than merely safe. Derived
+// from the horizons themselves -- never hardcode it -- so a future caller with
+// a longer window cannot silently outlive the retention that serves it.
+const ENTRY_KNOWN_PEER_OBSERVED_AT_RETENTION_MS = Math.max(
+	RECENT_KNOWN_REPAIR_SUPPRESSION_MS,
+	RECENT_KNOWN_EXCHANGE_HEAD_SUPPRESSION_MS,
+);
 const JOIN_AUTHORITATIVE_REPAIR_DELAY_MS = 2_000;
 const JOIN_AUTHORITATIVE_REPAIR_SWEEP_DELAYS_MS = [
 	JOIN_AUTHORITATIVE_REPAIR_DELAY_MS,
@@ -2017,7 +2028,6 @@ export class SharedLog<
 
 	uniqueReplicators!: Set<string>;
 	private _replicatorJoinEmitted!: Set<string>;
-	private _replicatorsReconciled!: boolean;
 
 	/* private _totalParticipation!: number; */
 
@@ -3295,6 +3305,7 @@ export class SharedLog<
 	private _repairSweepOptimisticGidsByPeer!: Map<string, Set<string>>;
 	private _entryKnownPeers!: Map<string, Set<string>>;
 	private _entryKnownPeerObservedAt!: Map<string, Map<string, number>>;
+	private _entryKnownPeerObservedAtSweptAt = 0;
 	private _joinAuthoritativeRepairTimersByDelay!: Map<
 		number,
 		ReturnType<typeof setTimeout>
@@ -3645,6 +3656,7 @@ export class SharedLog<
 		this._repairSweepOptimisticGidsByPeer = new Map();
 		this._entryKnownPeers = new Map();
 		this._entryKnownPeerObservedAt = new Map();
+		this._entryKnownPeerObservedAtSweptAt = 0;
 		this._joinAuthoritativeRepairTimersByDelay = new Map();
 		this._joinAuthoritativeRepairPeersByDelay = new Map();
 		this._appendBackfillPendingByTarget = new Map();
@@ -3658,7 +3670,6 @@ export class SharedLog<
 		this.recentlyRebalanced = new Cache<string>({ max: 1e4, ttl: 1e5 });
 		this.uniqueReplicators = new Set();
 		this._replicatorJoinEmitted = new Set();
-		this._replicatorsReconciled = false;
 		this._liveness = this.createReplicatorLivenessMonitor();
 		this._v2Receive = this.createReplicationInfoV2ReceiveCoordinator();
 		this._v2Send = this.createReplicationInfoV2SendCoordinator();
@@ -6779,7 +6790,7 @@ export class SharedLog<
 			rebalance?: boolean;
 			checkDuplicates?: boolean;
 			timestamp?: number;
-			allowLegacyOrderedReplacementPairs?: boolean;
+			allowOrderedReplacementPairs?: boolean;
 			onConfirmedDurableStateChanged?: () => void;
 			onDurableApplyCommitted?: () => boolean | void;
 			shouldApply?: () => boolean;
@@ -6821,7 +6832,7 @@ export class SharedLog<
 			checkDuplicates,
 			timestamp: ts,
 			rebalance,
-			allowLegacyOrderedReplacementPairs,
+			allowOrderedReplacementPairs,
 			onConfirmedDurableStateChanged,
 			onDurableApplyCommitted,
 			shouldApply,
@@ -6830,7 +6841,7 @@ export class SharedLog<
 			rebalance?: boolean;
 			checkDuplicates?: boolean;
 			timestamp?: number;
-			allowLegacyOrderedReplacementPairs?: boolean;
+			allowOrderedReplacementPairs?: boolean;
 			onConfirmedDurableStateChanged?: () => void;
 			onDurableApplyCommitted?: () => boolean | void;
 			shouldApply?: () => boolean;
@@ -6869,17 +6880,19 @@ export class SharedLog<
 			incomingRangeCountsById.set(range.idString, count);
 			if (
 				count > 1 &&
-				(!allowLegacyOrderedReplacementPairs || reset === true || count > 2)
+				(!allowOrderedReplacementPairs || reset === true || count > 2)
 			) {
 				throw new Error(
 					`Duplicate replication range id in announcement: ${range.idString}`,
 				);
 			}
-			// Released peers represented a non-reset replacement as the retired
-			// geometry followed by the current geometry under the same id. The
-			// sender is already authorized to replace that id with the final item,
-			// so collapsing an exact two-item incremental pair to its last item
-			// preserves rolling-upgrade compatibility without broadening authority.
+			// Rolling-upgrade relaxation on the live V2 Added path: a peer may
+			// still express a non-reset replacement as the retired geometry
+			// followed by the current geometry under one id. The sender is already
+			// authorized to replace that id with the final item, so collapsing an
+			// EXACT two-item incremental pair to its last item accepts the older
+			// wire shape without broadening authority. Deliberately narrow — reset
+			// announcements and any run longer than two still fail as duplicates.
 			incomingRangesById.set(range.idString, range);
 		}
 		const incomingRanges = [...incomingRangesById.values()];
@@ -7649,6 +7662,16 @@ export class SharedLog<
 		this._nativeSharedLogState?.markEntriesKnownByPeer(hashArray, peer);
 		this._nativeBackbone?.markEntriesKnownByPeer(hashArray, peer);
 		const now = Date.now();
+		// Growth is driven by writes, so the sweep rides the write path rather
+		// than a timer or the rebalance pass: cost stays proportional to the
+		// traffic that creates rows. Rate-limited to one pass per retention
+		// window, over a map that after the first pass holds one window of marks.
+		if (
+			now - this._entryKnownPeerObservedAtSweptAt >=
+			ENTRY_KNOWN_PEER_OBSERVED_AT_RETENTION_MS
+		) {
+			this.sweepEntryKnownPeerObservedAt(now);
+		}
 		for (const hash of hashArray) {
 			let peers = this._entryKnownPeers.get(hash);
 			if (!peers) {
@@ -7718,6 +7741,28 @@ export class SharedLog<
 		return observedAt != null && Date.now() - observedAt <= maxAgeMs;
 	}
 
+	/** Drop recency marks no reader can still act on.
+	 *
+	 * Touches ONLY `_entryKnownPeerObservedAt`. `_entryKnownPeers` carries
+	 * membership, not recency, and its rows stay until the peer dimension
+	 * clears them; the native mirrors have no recency dimension at all
+	 * (mark/remove/removePeer only), so this must not call into them or the
+	 * two sides would disagree.
+	 */
+	private sweepEntryKnownPeerObservedAt(now: number) {
+		for (const [hash, observedAt] of this._entryKnownPeerObservedAt) {
+			for (const [peer, timestamp] of observedAt) {
+				if (now - timestamp > ENTRY_KNOWN_PEER_OBSERVED_AT_RETENTION_MS) {
+					observedAt.delete(peer);
+				}
+			}
+			if (observedAt.size === 0) {
+				this._entryKnownPeerObservedAt.delete(hash);
+			}
+		}
+		this._entryKnownPeerObservedAtSweptAt = now;
+	}
+
 	private markRepairSweepOptimisticPeer(
 		gid: string,
 		peer: string,
@@ -14213,6 +14258,7 @@ export class SharedLog<
 		this._repairSweepOptimisticGidsByPeer = new Map();
 		this._entryKnownPeers = new Map();
 		this._entryKnownPeerObservedAt = new Map();
+		this._entryKnownPeerObservedAtSweptAt = 0;
 		this._joinAuthoritativeRepairTimersByDelay = new Map();
 		this._joinAuthoritativeRepairPeersByDelay = new Map();
 		this._assumeSyncedRepairSuppressedUntil = 0;
@@ -14235,7 +14281,6 @@ export class SharedLog<
 
 		this.uniqueReplicators = new Set();
 		this._replicatorJoinEmitted = new Set();
-		this._replicatorsReconciled = false;
 		// Deserialized instances never ran the constructor; create the monitor and
 		// coordinator lazily on first open. Reopens keep the SAME instances so
 		// stale async continuations observe resets via property lookup.
@@ -15513,16 +15558,8 @@ export class SharedLog<
 		const existingSubscribersPromise = this.node.services.pubsub.getSubscribers(
 			this.topic,
 		);
-		const replicationLifecycleController =
-			this._instanceLifecycle?.membershipLifecycleController;
-
 		// We do this here, because these calls requires this.closed == false
 		void this.pruneOfflineReplicators()
-			.then(() => {
-				if (this.isReplicationLifecycleActive(replicationLifecycleController)) {
-					this._replicatorsReconciled = true;
-				}
-			})
 			.catch((error) => {
 				if (isNotStartedError(error as Error)) {
 					return;
@@ -19652,7 +19689,7 @@ export class SharedLog<
 								reset: msg instanceof FullReplicationInfoV2Message,
 								checkDuplicates: true,
 								timestamp: Number(context.message.header.timestamp),
-								allowLegacyOrderedReplacementPairs:
+								allowOrderedReplacementPairs:
 									msg instanceof AddedReplicationInfoV2Message,
 								shouldApply: () => {
 									mutationGateChecked = true;
@@ -19761,7 +19798,6 @@ export class SharedLog<
 		}
 	}
 
-
 	async calculateTotalParticipation(options?: { sum?: boolean }) {
 		if (options?.sum) {
 			const ranges = await this.replicationIndex.iterate().all();
@@ -23063,7 +23099,11 @@ export class SharedLog<
 			}
 			const receiveEpoch = this._peerSessions.receiveEpoch(peerHash);
 			if (
-				!this._v2Receive.isRequestParked({ peerHash, peerSession, receiveEpoch })
+				!this._v2Receive.isRequestParked({
+					peerHash,
+					peerSession,
+					receiveEpoch,
+				})
 			) {
 				// Active, or a bounded request cycle is still running its own
 				// exponential retries. Keep polling for the next park.

package/src/instance-lifecycle.ts

@@ -66,10 +66,19 @@ export class InstanceLifecycle {
 	// code. Incremented synchronously with leader-cache invalidation so the
 	// handler can detect whether its pre-join plan needs one fresh
 	// post-persist audit.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): a sub-generation
+	// WITHIN one lifecycle — it advances while the lifecycle identity is
+	// deliberately unchanged, so an identity/session token cannot tell a
+	// pre-invalidation plan from a post-invalidation one.
 	public _receiveOwnershipRevision = 0;
 	// Count of ownership-changing range mutations from queue admission
 	// through settlement, including mutations already pending when a receive
 	// starts.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): a concurrency-DEPTH
+	// refcount, not a staleness token — identity answers "which generation
+	// started this?", never "how many mutation lanes are open right now?".
 	public _receiveOwnershipMutationAdmissions = 0;
 
 	// ---- stage 4: physically owned controllers (moved from SharedLog) ----

package/src/peer-session.ts

@@ -131,6 +131,11 @@ export class PeerSessionRegistry {
 	// peer stays subscribed), and it must also fence a peer that never had a
 	// session. Unlike sessions this map IS cleared at _close (see
 	// clearReceiveEpochsForClose) and replaced at open.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): the per-PEER lifetime
+	// above is the whole mechanism — a session token would rotate at exactly
+	// the moments this map must survive, and could not fence a session-less
+	// peer at all.
 	_replicationInfoReceiveEpochByPeer!: Map<string, object>;
 	// Moved from SharedLog (fence B6, same name — the sanctioned file-to-file
 	// ratchet move). Refcount of in-flight destructive peer cleanups: while
@@ -140,6 +145,10 @@ export class PeerSessionRegistry {
 	// reconnect may rotate the session; a fresh session with a zero gate
 	// would reopen receive admission mid-drain. The map instance is replaced
 	// only at open (resetForOpen) and cleared in place at _close.
+	//
+	// PERMANENT (fence census closed NO-GO 2026-08-12): both structural
+	// reasons at once — a concurrency-DEPTH refcount whose per-PEER lifetime
+	// deliberately spans the session rotation a reconnect causes mid-drain.
 	_receiveCleanupGateByPeer!: Map<string, number>;
 	// Moved from SharedLog (fence B5, same name). Peers whose replication-info
 	// is fenced: added when a departure/unsubscribe rotation or a reconnect

package/src/pid.ts

@@ -3,8 +3,6 @@ const MIN_MEMORY_HEADROOM_BALANCE_SCALER = 0.25;
 export class PIDReplicationController {
 	integral!: number;
 	prevError!: number;
-	prevMemoryUsage!: number;
-	prevTotalFactor!: number;
 	kp: number;
 	ki: number;
 	kd: number;
@@ -42,9 +40,6 @@ export class PIDReplicationController {
 		let { memoryUsage, totalFactor, peerCount, cpuUsage, currentFactor } =
 			properties;
 
-		this.prevTotalFactor = totalFactor;
-		this.prevMemoryUsage = memoryUsage;
-
 		const estimatedTotalSize =
 			currentFactor > 0 ? memoryUsage / currentFactor : 1e5;
 
@@ -238,6 +233,5 @@ export class PIDReplicationController {
 	reset() {
 		this.prevError = 0;
 		this.integral = 0;
-		this.prevMemoryUsage = 0;
 	}
 }

package/src/replication-info-v2-receive.ts

@@ -84,12 +84,6 @@ type LocalCapabilityReadyProperties = {
 
 export type ReplicationInfoV2LocalCapabilityAdvertisementHandle = {
 	firstAttempt: Promise<void>;
-	/**
-	 * B12: the two-phase legacy barrier is retired — an ACKed advert promotes
-	 * readiness immediately. Retained as a no-op so the handle shape (and the
-	 * tests that drive it) stay stable.
-	 */
-	releaseLegacyBarrier(): void;
 };
 
 export type ReplicationInfoV2LocalCapabilityContext = {
@@ -203,6 +197,14 @@ export type ReplicationInfoV2ReceiveDeps = {
  */
 export class ReplicationInfoV2ReceiveCoordinator {
 	_receiveStates!: Map<string, ReplicationInfoV2ReceiveState>;
+	/**
+	 * Post-B12 V2 resync memory: sessions that have already taken one full
+	 * replication-info snapshot. Two load-bearing reads, both in
+	 * observeCapability: phase selection (a remembered session opens in
+	 * "resync" instead of "awaiting-full"), and capability refresh (the
+	 * preserveCutover decision, which keeps the memory only when a re-advert
+	 * arrives under the same session with a ready sender).
+	 */
 	_cutoverPeerSessions!: WeakSet<object>;
 	_localCapabilityReadyBySession!: WeakMap<object, LocalCapabilityReady>;
 	_localCapabilityContextBySession!: WeakMap<
@@ -292,15 +294,17 @@ export class ReplicationInfoV2ReceiveCoordinator {
 	}
 
 	/** Revoke an unauthenticated or downgraded capability generation. */
-	revokePeerCapability(peerHash: string, reopenLegacy = true): void {
+	revokePeerCapability(peerHash: string): void {
 		const state = this._receiveStates.get(peerHash);
 		if (!state) {
 			return;
 		}
 		this.clearState(state);
-		if (reopenLegacy) {
-			this._cutoverPeerSessions.delete(state.peerSession);
-		}
+		// Unconditional: the revoked session must lose its resync memory so a
+		// re-advert starts from the first phase again. (This used to sit behind
+		// an opt-out parameter that defaulted to true, had no else-arm, and that
+		// no caller ever overrode.)
+		this._cutoverPeerSessions.delete(state.peerSession);
 	}
 
 	private clearState(state: ReplicationInfoV2ReceiveState): void {
@@ -531,7 +535,6 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		) {
 			return {
 				firstAttempt: Promise.resolve(),
-				releaseLegacyBarrier: () => {},
 			};
 		}
 		let context = this._localCapabilityContextBySession.get(
@@ -545,7 +548,6 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		) {
 			return {
 				firstAttempt: Promise.resolve(),
-				releaseLegacyBarrier: () => {},
 			};
 		}
 		if (!context) {
@@ -584,7 +586,6 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		) {
 			return {
 				firstAttempt: Promise.resolve(),
-				releaseLegacyBarrier: () => {},
 			};
 		}
 		if (!state) {
@@ -619,7 +620,6 @@ export class ReplicationInfoV2ReceiveCoordinator {
 			(state.firstAttempt = this.runLocalCapabilityAdvertisement(state));
 		return {
 			firstAttempt,
-			releaseLegacyBarrier: () => {},
 		};
 	}
 

package/src/role.ts

@@ -6,19 +6,10 @@
 import { field, variant, vec } from "@dao-xyz/borsh";
 import { MAX_U32, denormalizer } from "./integers.js";
 
-export const overlaps = (x1: number, x2: number, y1: number, y2: number) => {
-	if (x1 <= y2 && y1 <= x2) {
-		return true;
-	}
-	return false;
-};
-
 export abstract class Role {
 	abstract equals(other: Role): boolean;
 }
 
-export const NO_TYPE_VARIANT = new Uint8Array([0]);
-
 @variant(0)
 export class NoType extends Role {
 	equals(other: Role) {
@@ -26,8 +17,6 @@ export class NoType extends Role {
 	}
 }
 
-export const OBSERVER_TYPE_VARIANT = new Uint8Array([1]);
-
 @variant(1)
 export class Observer extends Role {
 	equals(other: Role) {
@@ -35,8 +24,6 @@ export class Observer extends Role {
 	}
 }
 
-export const REPLICATOR_TYPE_VARIANT = new Uint8Array([2]);
-
 const denormalizeru32 = denormalizer("u32");
 export class RoleReplicationSegment {
 	@field({ type: "u64" })

package/src/sync/simple.ts

@@ -325,7 +325,7 @@ export const SYNC_MESSAGE_PRIORITY = CONVERGENCE_MESSAGE_PRIORITY;
 // large historical backfills.
 const SIMPLE_SYNC_RETRY_AFTER_MS = 10_000;
 const EXCHANGE_HEAD_RESPONSE_DEDUPE_TTL_MS = SIMPLE_SYNC_RETRY_AFTER_MS - 1_000;
-const RECENT_KNOWN_EXCHANGE_HEAD_SUPPRESSION_MS = 30_000;
+export const RECENT_KNOWN_EXCHANGE_HEAD_SUPPRESSION_MS = 30_000;
 const PENDING_MAYBE_SYNC_RESPONSE_TTL_MS = 30_000;
 // An incoming maybe-sync claim keeps one retry candidate in both
 // syncInFlightQueue and syncInFlightQueueInverted. Bound associations rather