@peerbit/shared-log 16.0.1 → 16.0.3

package/src/index.ts

@@ -290,6 +290,7 @@ import {
 } from "./sync/profile.js";
 import {
 	ConfirmEntriesMessage,
+	RECENT_KNOWN_EXCHANGE_HEAD_SUPPRESSION_MS,
 	SYNC_MESSAGE_PRIORITY,
 	SimpleSyncronizer,
 } from "./sync/simple.js";
@@ -636,6 +637,13 @@ export type NativeBackboneCoordinateRollback<R extends "u32" | "u64"> = {
 	hashes: Set<string>;
 	entries: Map<string, ResidentCoordinateEntry<R>>;
 	generations: Map<string, number>;
+	/**
+	 * Set by `settleResidentCoordinateSnapshot` once the token's holds on the
+	 * mutation-generation map have been released. Load-bearing: it makes the
+	 * settle idempotent, so a second settle of this token cannot consume a
+	 * different token's hold on a shared hash.
+	 */
+	settled?: boolean;
 };
 
 export type RepairDispatchEntry<R extends "u32" | "u64"> =
@@ -1439,6 +1447,16 @@ const JOIN_AUTHORITATIVE_RETRY_SCHEDULE_MS = [
 ];
 const APPEND_BACKFILL_RETRY_SCHEDULE_MS = [0, 1_000, 3_000, 7_000];
 const RECENT_KNOWN_REPAIR_SUPPRESSION_MS = 30_000;
+// `_entryKnownPeerObservedAt` is read ONLY through isEntryRecentlyKnownByPeer,
+// which treats an over-age row and an absent row identically (both false). So
+// rows older than the longest horizon any caller asks about are dead weight,
+// and dropping them is behaviour-identical rather than merely safe. Derived
+// from the horizons themselves -- never hardcode it -- so a future caller with
+// a longer window cannot silently outlive the retention that serves it.
+const ENTRY_KNOWN_PEER_OBSERVED_AT_RETENTION_MS = Math.max(
+	RECENT_KNOWN_REPAIR_SUPPRESSION_MS,
+	RECENT_KNOWN_EXCHANGE_HEAD_SUPPRESSION_MS,
+);
 const JOIN_AUTHORITATIVE_REPAIR_DELAY_MS = 2_000;
 const JOIN_AUTHORITATIVE_REPAIR_SWEEP_DELAYS_MS = [
 	JOIN_AUTHORITATIVE_REPAIR_DELAY_MS,
@@ -3103,9 +3121,23 @@ export class SharedLog<
 				};
 				for (const coordinate of intent.coordinates) {
 					rollback.hashes.add(coordinate.hash);
-					const generation =
-						(mutationGenerations.get(coordinate.hash) ?? 0) + 1;
-					mutationGenerations.set(coordinate.hash, generation);
+					// Same hold-counted row shape the coordinator's own
+					// snapshot writes: one hold per hash, released by the
+					// settle after the replay consumes the token below.
+					// RELIES ON `intent.coordinates` HOLDING UNIQUE HASHES —
+					// it is built from the token's `hashes` Set (see
+					// setNativeStrictDurableTransactionOperation). Holds are
+					// taken per element here but released per unique hash by
+					// the settle, so a duplicate would take two and release
+					// one and retain that row forever. That is the safe
+					// direction (a retained row, never a fail-open rollback),
+					// but keep the source a Set.
+					const row = mutationGenerations.get(coordinate.hash);
+					const generation = (row?.generation ?? 0) + 1;
+					mutationGenerations.set(coordinate.hash, {
+						generation,
+						holds: (row?.holds ?? 0) + 1,
+					});
 					rollback.generations.set(coordinate.hash, generation);
 					if (coordinate.value) {
 						const number = (value: string) =>
@@ -3131,6 +3163,9 @@ export class SharedLog<
 					"",
 					rollback,
 				);
+				// The replay fabricated these generations itself one turn
+				// earlier and has now consumed them, so the rows are dead.
+				this._coordinates.settleResidentCoordinateSnapshot(rollback);
 			}
 			for (const document of intent.documents) {
 				this.restoreNativeBackboneDocument({
@@ -3294,6 +3329,7 @@ export class SharedLog<
 	private _repairSweepOptimisticGidsByPeer!: Map<string, Set<string>>;
 	private _entryKnownPeers!: Map<string, Set<string>>;
 	private _entryKnownPeerObservedAt!: Map<string, Map<string, number>>;
+	private _entryKnownPeerObservedAtSweptAt = 0;
 	private _joinAuthoritativeRepairTimersByDelay!: Map<
 		number,
 		ReturnType<typeof setTimeout>
@@ -3644,6 +3680,7 @@ export class SharedLog<
 		this._repairSweepOptimisticGidsByPeer = new Map();
 		this._entryKnownPeers = new Map();
 		this._entryKnownPeerObservedAt = new Map();
+		this._entryKnownPeerObservedAtSweptAt = 0;
 		this._joinAuthoritativeRepairTimersByDelay = new Map();
 		this._joinAuthoritativeRepairPeersByDelay = new Map();
 		this._appendBackfillPendingByTarget = new Map();
@@ -7649,6 +7686,16 @@ export class SharedLog<
 		this._nativeSharedLogState?.markEntriesKnownByPeer(hashArray, peer);
 		this._nativeBackbone?.markEntriesKnownByPeer(hashArray, peer);
 		const now = Date.now();
+		// Growth is driven by writes, so the sweep rides the write path rather
+		// than a timer or the rebalance pass: cost stays proportional to the
+		// traffic that creates rows. Rate-limited to one pass per retention
+		// window, over a map that after the first pass holds one window of marks.
+		if (
+			now - this._entryKnownPeerObservedAtSweptAt >=
+			ENTRY_KNOWN_PEER_OBSERVED_AT_RETENTION_MS
+		) {
+			this.sweepEntryKnownPeerObservedAt(now);
+		}
 		for (const hash of hashArray) {
 			let peers = this._entryKnownPeers.get(hash);
 			if (!peers) {
@@ -7718,6 +7765,28 @@ export class SharedLog<
 		return observedAt != null && Date.now() - observedAt <= maxAgeMs;
 	}
 
+	/** Drop recency marks no reader can still act on.
+	 *
+	 * Touches ONLY `_entryKnownPeerObservedAt`. `_entryKnownPeers` carries
+	 * membership, not recency, and its rows stay until the peer dimension
+	 * clears them; the native mirrors have no recency dimension at all
+	 * (mark/remove/removePeer only), so this must not call into them or the
+	 * two sides would disagree.
+	 */
+	private sweepEntryKnownPeerObservedAt(now: number) {
+		for (const [hash, observedAt] of this._entryKnownPeerObservedAt) {
+			for (const [peer, timestamp] of observedAt) {
+				if (now - timestamp > ENTRY_KNOWN_PEER_OBSERVED_AT_RETENTION_MS) {
+					observedAt.delete(peer);
+				}
+			}
+			if (observedAt.size === 0) {
+				this._entryKnownPeerObservedAt.delete(hash);
+			}
+		}
+		this._entryKnownPeerObservedAtSweptAt = now;
+	}
+
 	private markRepairSweepOptimisticPeer(
 		gid: string,
 		peer: string,
@@ -10934,12 +11003,21 @@ export class SharedLog<
 			return rollbackLowerPublication(error);
 		}
 		if (!result) {
+			// Abandon arm: the token was minted but nothing downstream can
+			// roll it back from here.
+			this._coordinates.settleResidentCoordinateSnapshot(
+				lowerPublicationRollback?.coordinateEntries,
+			);
 			return this.completeNativeStrictDurableTransaction(
 				nativeStrictTransaction,
 			).then(() => undefined);
 		}
 		return mapMaybePromise(result, async (prepared) => {
 			if (!prepared) {
+				// Abandon arm: same shape as the `!result` arm above.
+				this._coordinates.settleResidentCoordinateSnapshot(
+					lowerPublicationRollback?.coordinateEntries,
+				);
 				await this.completeNativeStrictDurableTransaction(
 					nativeStrictTransaction,
 				);
@@ -10973,6 +11051,11 @@ export class SharedLog<
 						prepared.appendFacts.hash,
 						lowerPublicationRollback?.coordinateEntries,
 					);
+					// Terminal: this is the last rollback consumer for the
+					// token. A throw above leaves the row, which is safe.
+					this._coordinates.settleResidentCoordinateSnapshot(
+						lowerPublicationRollback?.coordinateEntries,
+					);
 					for (const document of lowerPublicationRollback?.documents ?? []) {
 						this.restoreNativeBackboneDocument(document);
 					}
@@ -11043,6 +11126,14 @@ export class SharedLog<
 			} catch (error) {
 				return rollback(error);
 			}
+			// Success seam. The last await inside the protected try is the
+			// finalizer acknowledge; `finish()` is synchronous, so no async
+			// boundary separates the catch above from this statement and
+			// `rollback` can no longer fire. Nothing downstream rolls back
+			// (the retire below only warns), so the token is terminal here.
+			this._coordinates.settleResidentCoordinateSnapshot(
+				lowerPublicationRollback?.coordinateEntries,
+			);
 			this.applyPreparedAppendFactsWithDeferredCoordinateDeletes(
 				prepared.appendFacts,
 				prepared.removed,
@@ -11499,6 +11590,12 @@ export class SharedLog<
 				}
 				return mapMaybePromise(result, async (prepared) => {
 					if (!prepared || !backboneAppend) {
+						// Abandon arm: the token was minted inside
+						// `prepareBackboneAppend` and nothing downstream of
+						// this return can roll it back.
+						this._coordinates.settleResidentCoordinateSnapshot(
+							nativeCoordinateRollback,
+						);
 						await this.completeNativeStrictDurableTransaction(
 							nativeStrictTransaction,
 						);
@@ -11590,6 +11687,10 @@ export class SharedLog<
 								prepared.appendFacts.hash,
 								rollbackCoordinateEntries,
 							);
+							// Terminal: last rollback consumer for the token.
+							this._coordinates.settleResidentCoordinateSnapshot(
+								rollbackCoordinateEntries,
+							);
 						} catch (rollbackError) {
 							rollbackFailures.push(rollbackError);
 						}
@@ -11666,6 +11767,12 @@ export class SharedLog<
 					} catch (error) {
 						return rollback(error);
 					}
+					// Success seam: the finalizer acknowledge above is the last
+					// await inside the protected try, so `rollback` can no
+					// longer fire and the retire below only warns.
+					this._coordinates.settleResidentCoordinateSnapshot(
+						rollbackCoordinateEntries,
+					);
 					this.applyPreparedAppendFactsWithDeferredCoordinateDeletes(
 						prepared.appendFacts,
 						prepared.removed,
@@ -12585,6 +12692,10 @@ export class SharedLog<
 			throw error;
 		}
 		if (!appended || !backboneAppends) {
+			// Abandon arm: no consumer downstream of this return.
+			this._coordinates.settleResidentCoordinateSnapshot(
+				batchCoordinateRollback,
+			);
 			await this.completeNativeStrictDurableTransaction(
 				nativeStrictTransaction,
 			);
@@ -12622,6 +12733,10 @@ export class SharedLog<
 					appended.appendFacts[0]?.hash ?? "",
 					batchCoordinateRollback,
 				);
+				// Terminal: last rollback consumer for the batch token.
+				this._coordinates.settleResidentCoordinateSnapshot(
+					batchCoordinateRollback,
+				);
 			} catch (rollbackError) {
 				rollbackFailures.push(rollbackError);
 			}
@@ -12753,6 +12868,11 @@ export class SharedLog<
 		} catch (error) {
 			return rollbackBatch(error);
 		}
+		// Success seam: `rollbackBatch` has exactly one call site (the catch
+		// above), and everything from here on escapes without any rollback.
+		this._coordinates.settleResidentCoordinateSnapshot(
+			batchCoordinateRollback,
+		);
 
 		this.throwIfReplicationOwnershipLifecycleInactive(
 			ownershipLifecycleController,
@@ -14213,6 +14333,7 @@ export class SharedLog<
 		this._repairSweepOptimisticGidsByPeer = new Map();
 		this._entryKnownPeers = new Map();
 		this._entryKnownPeerObservedAt = new Map();
+		this._entryKnownPeerObservedAtSweptAt = 0;
 		this._joinAuthoritativeRepairTimersByDelay = new Map();
 		this._joinAuthoritativeRepairPeersByDelay = new Map();
 		this._assumeSyncedRepairSuppressedUntil = 0;
@@ -18861,292 +18982,305 @@ export class SharedLog<
 									reusableCoordinatePersistItems,
 								)
 							: undefined;
-						const nativePreparedJoinCommit = canUsePreparedAppendFacts
-							? this._coordinates.createNativeBackbonePreparedJoinCommit(
-									nativeReceiveCoordinateBatch,
-									(batch) => {
-										nativePreparedCoordinateBatch = batch;
-									},
-									nativeCommitVerifyHashes,
-									nativeCommitVerifyAllHashes,
-									syncProfile,
-									(committedHashes) => {
-										nativePreparedCommittedHashes = new Set(committedHashes);
-									},
-								)
-							: undefined;
-						const finishNativePreparedCoordinates = async (properties: {
-							nativePreparedCommitted: boolean;
-						}) => {
-							if (
-								!properties.nativePreparedCommitted ||
-								!nativePreparedCoordinateBatch
-							) {
-								return;
-							}
-							try {
-								nativeBackboneOnlyPersistedHashes =
-									await this._coordinates.finishBackboneOnlyReceiveCoordinateBatch(
-										nativePreparedCoordinateBatch,
+						try {
+							const nativePreparedJoinCommit = canUsePreparedAppendFacts
+								? this._coordinates.createNativeBackbonePreparedJoinCommit(
+										nativeReceiveCoordinateBatch,
+										(batch) => {
+											nativePreparedCoordinateBatch = batch;
+										},
+										nativeCommitVerifyHashes,
+										nativeCommitVerifyAllHashes,
 										syncProfile,
+										(committedHashes) => {
+											nativePreparedCommittedHashes = new Set(committedHashes);
+										},
+									)
+								: undefined;
+							const finishNativePreparedCoordinates = async (properties: {
+								nativePreparedCommitted: boolean;
+							}) => {
+								if (
+									!properties.nativePreparedCommitted ||
+									!nativePreparedCoordinateBatch
+								) {
+									return;
+								}
+								try {
+									nativeBackboneOnlyPersistedHashes =
+										await this._coordinates.finishBackboneOnlyReceiveCoordinateBatch(
+											nativePreparedCoordinateBatch,
+											syncProfile,
+										);
+									nativePreparedCoordinatesFinished = true;
+								} catch (error) {
+									this._coordinates.rollbackBackboneOnlyReceiveCoordinateBatch(
+										nativePreparedCoordinateBatch,
 									);
-								nativePreparedCoordinatesFinished = true;
-							} catch (error) {
-								this._coordinates.rollbackBackboneOnlyReceiveCoordinateBatch(
-									nativePreparedCoordinateBatch,
-								);
-								throw error;
+									throw error;
+								}
+							};
+							const preparedAppendCanValidateAppend =
+								canAppendAlreadyValidated ||
+								(nativeCommitCanValidateAppend && !!nativePreparedJoinCommit);
+							if (!preparedAppendCanValidateAppend) {
+								canUsePreparedAppendFacts = false;
 							}
-						};
-						const preparedAppendCanValidateAppend =
-							canAppendAlreadyValidated ||
-							(nativeCommitCanValidateAppend && !!nativePreparedJoinCommit);
-						if (!preparedAppendCanValidateAppend) {
-							canUsePreparedAppendFacts = false;
-						}
-						const nativePreparedJoinCommitValidatesPlan =
-							!!nativePreparedJoinCommit &&
-							(nativeCommitVerifyHashes && nativeCommitVerifyHashes.length > 0
-								? nativeCommitVerifyAllHashes
-									? !!this._nativeBackbone?.graph
-											.commitVerifiedAllPreparedRawReceiveJoinBatch ||
-										!!this._nativeBackbone?.graph
-											.commitVerifiedPreparedRawReceiveJoinBatch
+							const nativePreparedJoinCommitValidatesPlan =
+								!!nativePreparedJoinCommit &&
+								(nativeCommitVerifyHashes && nativeCommitVerifyHashes.length > 0
+									? nativeCommitVerifyAllHashes
+										? !!this._nativeBackbone?.graph
+												.commitVerifiedAllPreparedRawReceiveJoinBatch ||
+											!!this._nativeBackbone?.graph
+												.commitVerifiedPreparedRawReceiveJoinBatch
+										: !!this._nativeBackbone?.graph
+												.commitVerifiedPreparedRawReceiveJoinBatch
 									: !!this._nativeBackbone?.graph
-											.commitVerifiedPreparedRawReceiveJoinBatch
-								: !!this._nativeBackbone?.graph
-										.commitPreparedRawReceiveJoinBatch);
-						const trustedLowerLog = this.log as unknown as TrustedLowerLog<T>;
-						// With a program-level onChange consumer the hash-only
-						// sink is not used: the lower-log join dispatches the
-						// change event (lazy entry views over the prepared raw
-						// facts) so per-entry consumers observe every commit.
-						const joinOnAppendHashes = programOnChange
-							? undefined
-							: onAppendHashes;
-						const joinedPreparedFacts =
-							canUsePreparedAppendFacts &&
-							(await trustedLowerLog.joinPreparedAppendFactsBatch(
-								preparedAppendFacts,
-								{
+											.commitPreparedRawReceiveJoinBatch);
+							const trustedLowerLog = this.log as unknown as TrustedLowerLog<T>;
+							// With a program-level onChange consumer the hash-only
+							// sink is not used: the lower-log join dispatches the
+							// change event (lazy entry views over the prepared raw
+							// facts) so per-entry consumers observe every commit.
+							const joinOnAppendHashes = programOnChange
+								? undefined
+								: onAppendHashes;
+							const joinedPreparedFacts =
+								canUsePreparedAppendFacts &&
+								(await trustedLowerLog.joinPreparedAppendFactsBatch(
+									preparedAppendFacts,
+									{
+										__peerbitEntriesAlreadyMissing: true,
+										__peerbitCanAppendAlreadyValidated: true,
+										__peerbitDeferIndexWrite: true,
+										__peerbitOnAppendHashes: joinOnAppendHashes,
+										__peerbitProfile: syncProfile,
+										__peerbitNativePreparedJoinCommit: nativePreparedJoinCommit,
+										__peerbitNativePreparedJoinCommitValidatesPlan:
+											nativePreparedJoinCommitValidatesPlan,
+										__peerbitOnPreparedJoinCommitted: nativePreparedJoinCommit
+											? finishNativePreparedCoordinates
+											: undefined,
+									},
+								));
+							if (!joinedPreparedFacts) {
+								await trustedLowerLog.join(materializeAllToMergeEntries(), {
+									__peerbitBatchIndependent: true,
 									__peerbitEntriesAlreadyMissing: true,
-									__peerbitCanAppendAlreadyValidated: true,
+									__peerbitCanAppendAlreadyValidated:
+										fallbackCanAppendAlreadyValidated,
 									__peerbitDeferIndexWrite: true,
 									__peerbitOnAppendHashes: joinOnAppendHashes,
 									__peerbitProfile: syncProfile,
-									__peerbitNativePreparedJoinCommit: nativePreparedJoinCommit,
-									__peerbitNativePreparedJoinCommitValidatesPlan:
-										nativePreparedJoinCommitValidatesPlan,
-									__peerbitOnPreparedJoinCommitted: nativePreparedJoinCommit
-										? finishNativePreparedCoordinates
-										: undefined,
-								},
-							));
-						if (!joinedPreparedFacts) {
-							await trustedLowerLog.join(materializeAllToMergeEntries(), {
-								__peerbitBatchIndependent: true,
-								__peerbitEntriesAlreadyMissing: true,
-								__peerbitCanAppendAlreadyValidated:
-									fallbackCanAppendAlreadyValidated,
-								__peerbitDeferIndexWrite: true,
-								__peerbitOnAppendHashes: joinOnAppendHashes,
-								__peerbitProfile: syncProfile,
-							});
-						}
-						// A recursive lower-log join can resolve successfully while declining
-						// an individual top-level entry (for example, when one of its parents
-						// is temporarily unavailable). The public Log.join() API intentionally
-						// does not expose that per-entry result, so make local index presence the
-						// authority before publishing any SharedLog-side effects. A successful
-						// prepared-facts batch is atomic and already proves every input hash.
-						const admittedHashes = joinedPreparedFacts
-							? new Set(allToMergeHashes)
-							: await this.log.hasMany(allToMergeHashes);
-						admittedMergeHashes = admittedHashes;
-						const admittedShallowEntries =
-							admittedHashes.size === allToMergeShallowEntries.length
-								? allToMergeShallowEntries
-								: allToMergeShallowEntries.filter((entry) =>
+								});
+							}
+							// A recursive lower-log join can resolve successfully while declining
+							// an individual top-level entry (for example, when one of its parents
+							// is temporarily unavailable). The public Log.join() API intentionally
+							// does not expose that per-entry result, so make local index presence the
+							// authority before publishing any SharedLog-side effects. A successful
+							// prepared-facts batch is atomic and already proves every input hash.
+							const admittedHashes = joinedPreparedFacts
+								? new Set(allToMergeHashes)
+								: await this.log.hasMany(allToMergeHashes);
+							admittedMergeHashes = admittedHashes;
+							const admittedShallowEntries =
+								admittedHashes.size === allToMergeShallowEntries.length
+									? allToMergeShallowEntries
+									: allToMergeShallowEntries.filter((entry) =>
+											admittedHashes.has(entry.hash),
+										);
+							if (!joinedPreparedFacts) {
+								reusableCoordinatePersistItems =
+									reusableCoordinatePersistItems.filter((item) =>
+										admittedHashes.has(item.entry.hash),
+									);
+								coordinatePersistFallbackEntries =
+									coordinatePersistFallbackEntries.filter((entry) =>
 										admittedHashes.has(entry.hash),
 									);
-						if (!joinedPreparedFacts) {
-							reusableCoordinatePersistItems =
-								reusableCoordinatePersistItems.filter((item) =>
-									admittedHashes.has(item.entry.hash),
-								);
-							coordinatePersistFallbackEntries =
-								coordinatePersistFallbackEntries.filter((entry) =>
-									admittedHashes.has(entry.hash),
-								);
-						}
-						const reusableCoordinatePersistItemCount =
-							reusableCoordinatePersistItems.length;
-						if (syncProfile) {
-							emitSyncProfileDuration(syncProfile, lowerLogJoinStartedAt, {
-								name: "sharedLog.receive.lowerLogJoin",
-								component: "shared-log",
-								entries: allToMerge.length,
-								messages: 1,
-								details: {
-									hashOnlyEntryAdded,
-									batchHashOnlyEntryAdded,
-									programOnChange,
-									joinedPreparedFacts,
-									admittedEntries: admittedHashes.size,
-									nativePreparedCoordinatesFinished,
-								},
-							});
-						}
-						const coordinatePersistStartedAt = syncProfileStart(syncProfile);
-						if (nativePreparedCoordinatesFinished) {
-							// The lower-log prepared receive transaction already finished
-							// the native coordinate mirror/journal after entry-index commit.
-						} else if (nativePreparedCoordinateBatch) {
-							try {
-								nativeBackboneOnlyPersistedHashes =
-									await this._coordinates.finishBackboneOnlyReceiveCoordinateBatch(
+							}
+							const reusableCoordinatePersistItemCount =
+								reusableCoordinatePersistItems.length;
+							if (syncProfile) {
+								emitSyncProfileDuration(syncProfile, lowerLogJoinStartedAt, {
+									name: "sharedLog.receive.lowerLogJoin",
+									component: "shared-log",
+									entries: allToMerge.length,
+									messages: 1,
+									details: {
+										hashOnlyEntryAdded,
+										batchHashOnlyEntryAdded,
+										programOnChange,
+										joinedPreparedFacts,
+										admittedEntries: admittedHashes.size,
+										nativePreparedCoordinatesFinished,
+									},
+								});
+							}
+							const coordinatePersistStartedAt = syncProfileStart(syncProfile);
+							if (nativePreparedCoordinatesFinished) {
+								// The lower-log prepared receive transaction already finished
+								// the native coordinate mirror/journal after entry-index commit.
+							} else if (nativePreparedCoordinateBatch) {
+								try {
+									nativeBackboneOnlyPersistedHashes =
+										await this._coordinates.finishBackboneOnlyReceiveCoordinateBatch(
+											nativePreparedCoordinateBatch,
+											syncProfile,
+										);
+								} catch (error) {
+									this._coordinates.rollbackBackboneOnlyReceiveCoordinateBatch(
 										nativePreparedCoordinateBatch,
-										syncProfile,
 									);
-							} catch (error) {
-								this._coordinates.rollbackBackboneOnlyReceiveCoordinateBatch(
-									nativePreparedCoordinateBatch,
-								);
-								throw error;
+									throw error;
+								}
+							} else {
+								nativeBackboneOnlyPersistedHashes =
+									await this._coordinates.persistBackboneOnlyReceiveCoordinateBatch(
+										reusableCoordinatePersistItems,
+									);
 							}
-						} else {
-							nativeBackboneOnlyPersistedHashes =
-								await this._coordinates.persistBackboneOnlyReceiveCoordinateBatch(
-									reusableCoordinatePersistItems,
-								);
-						}
-						if (
-							nativeBackboneOnlyPersistedHashes &&
-							nativeBackboneOnlyPersistedHashes.size > 0
-						) {
-							for (
-								let i = reusableCoordinatePersistItems.length - 1;
-								i >= 0;
-								i--
+							if (
+								nativeBackboneOnlyPersistedHashes &&
+								nativeBackboneOnlyPersistedHashes.size > 0
 							) {
-								if (
-									nativeBackboneOnlyPersistedHashes.has(
-										reusableCoordinatePersistItems[i]!.entry.hash,
-									)
+								for (
+									let i = reusableCoordinatePersistItems.length - 1;
+									i >= 0;
+									i--
 								) {
-									reusableCoordinatePersistItems.splice(i, 1);
+									if (
+										nativeBackboneOnlyPersistedHashes.has(
+											reusableCoordinatePersistItems[i]!.entry.hash,
+										)
+									) {
+										reusableCoordinatePersistItems.splice(i, 1);
+									}
 								}
 							}
-						}
-						if (reusableCoordinatePersistItems.length > 0) {
-							await this._coordinates.persistCoordinatesBatch(
-								reusableCoordinatePersistItems,
-							);
-						}
-						if (coordinatePersistFallbackEntries.length > 0) {
-							await this.planEntryLeaderBatch(
-								coordinatePersistFallbackEntries.map((entry) => ({
-									entry,
-									replicas:
-										receiveReplicaCounts.get(entry.hash) ??
-										decodeReplicas(entry).getValue(this),
-									options: { roleAge: 0, persist: {} },
-								})),
-							);
-						}
-						if (syncProfile) {
-							emitSyncProfileDuration(syncProfile, coordinatePersistStartedAt, {
-								name: "sharedLog.receive.coordinatePersist",
-								component: "shared-log",
-								entries: entriesToPersist.length,
-								messages: 1,
-								details: {
-									reusedLeaderPlans: reusableCoordinatePersistItemCount,
-									nativeBackboneOnly:
-										nativeBackboneOnlyPersistedHashes?.size ?? 0,
-								},
-							});
-						}
-						for (const hash of admittedHashes) {
-							confirmedHashes.add(hash);
-						}
-						const checkedPruneStartedAt = syncProfileStart(syncProfile);
-						const ownershipChangedDuringReceive =
-							!this.isReceiveOwnershipSnapshotStable(receiveOwnershipRevision);
-						if (ownershipChangedDuringReceive) {
-							const freshAuditRevision =
-								this._instanceLifecycle?._receiveOwnershipRevision ?? 0;
-							const armFreshAuditRetry = () => {
-								for (const entry of admittedShallowEntries) {
-									this.scheduleCheckedPruneRetry(
-										{ entry, leaders: new Map() },
+							if (reusableCoordinatePersistItems.length > 0) {
+								await this._coordinates.persistCoordinatesBatch(
+									reusableCoordinatePersistItems,
+								);
+							}
+							if (coordinatePersistFallbackEntries.length > 0) {
+								await this.planEntryLeaderBatch(
+									coordinatePersistFallbackEntries.map((entry) => ({
+										entry,
+										replicas:
+											receiveReplicaCounts.get(entry.hash) ??
+											decodeReplicas(entry).getValue(this),
+										options: { roleAge: 0, persist: {} },
+									})),
+								);
+							}
+							if (syncProfile) {
+								emitSyncProfileDuration(syncProfile, coordinatePersistStartedAt, {
+									name: "sharedLog.receive.coordinatePersist",
+									component: "shared-log",
+									entries: entriesToPersist.length,
+									messages: 1,
+									details: {
+										reusedLeaderPlans: reusableCoordinatePersistItemCount,
+										nativeBackboneOnly:
+											nativeBackboneOnlyPersistedHashes?.size ?? 0,
+									},
+								});
+							}
+							for (const hash of admittedHashes) {
+								confirmedHashes.add(hash);
+							}
+							const checkedPruneStartedAt = syncProfileStart(syncProfile);
+							const ownershipChangedDuringReceive =
+								!this.isReceiveOwnershipSnapshotStable(receiveOwnershipRevision);
+							if (ownershipChangedDuringReceive) {
+								const freshAuditRevision =
+									this._instanceLifecycle?._receiveOwnershipRevision ?? 0;
+								const armFreshAuditRetry = () => {
+									for (const entry of admittedShallowEntries) {
+										this.scheduleCheckedPruneRetry(
+											{ entry, leaders: new Map() },
+											receiveOwnershipLifecycleController,
+										);
+									}
+								};
+								try {
+									await this.pruneJoinedEntriesNoLongerLed(
+										admittedShallowEntries,
+										{
+											decodedReplicaCounts: receiveReplicaCounts,
+											freshReceiveOwnerAudit: true,
+											preserveExistingPruneOnLocalResult: true,
+											profile: syncProfile,
+										},
 										receiveOwnershipLifecycleController,
 									);
+									this.throwIfReplicationOwnershipLifecycleInactive(
+										receiveOwnershipLifecycleController,
+									);
+									if (
+										!this.isReceiveOwnershipSnapshotStable(freshAuditRevision)
+									) {
+										armFreshAuditRetry();
+									}
+								} catch {
+									// The lower-log and coordinate commits are already durable. A
+									// sender retry will filter these hashes as present, so retain a
+									// bounded local obligation instead of failing the admitted receive.
+									this.throwIfReplicationOwnershipLifecycleInactive(
+										receiveOwnershipLifecycleController,
+									);
+									armFreshAuditRetry();
 								}
-							};
-							try {
+							} else {
 								await this.pruneJoinedEntriesNoLongerLed(
 									admittedShallowEntries,
 									{
 										decodedReplicaCounts: receiveReplicaCounts,
-										freshReceiveOwnerAudit: true,
 										preserveExistingPruneOnLocalResult: true,
+										reusableLeaderPlans: reusableCoordinatePlans,
 										profile: syncProfile,
 									},
 									receiveOwnershipLifecycleController,
 								);
-								this.throwIfReplicationOwnershipLifecycleInactive(
-									receiveOwnershipLifecycleController,
-								);
-								if (
-									!this.isReceiveOwnershipSnapshotStable(freshAuditRevision)
-								) {
-									armFreshAuditRetry();
-								}
-							} catch {
-								// The lower-log and coordinate commits are already durable. A
-								// sender retry will filter these hashes as present, so retain a
-								// bounded local obligation instead of failing the admitted receive.
-								this.throwIfReplicationOwnershipLifecycleInactive(
-									receiveOwnershipLifecycleController,
-								);
-								armFreshAuditRetry();
 							}
-						} else {
-							await this.pruneJoinedEntriesNoLongerLed(
-								admittedShallowEntries,
-								{
-									decodedReplicaCounts: receiveReplicaCounts,
-									preserveExistingPruneOnLocalResult: true,
-									reusableLeaderPlans: reusableCoordinatePlans,
-									profile: syncProfile,
-								},
-								receiveOwnershipLifecycleController,
-							);
-						}
-						if (syncProfile) {
-							emitSyncProfileDuration(syncProfile, checkedPruneStartedAt, {
-								name: "sharedLog.receive.checkedPrune",
-								component: "shared-log",
-								entries: allToMerge.length,
-								messages: 1,
-							});
-						}
+							if (syncProfile) {
+								emitSyncProfileDuration(syncProfile, checkedPruneStartedAt, {
+									name: "sharedLog.receive.checkedPrune",
+									component: "shared-log",
+									entries: allToMerge.length,
+									messages: 1,
+								});
+							}
 
-						for (const plan of joinPlans) {
-							plan.toDelete
-								?.filter((entry) => admittedMergeHashes.has(entry.hash))
-								.map((entry) =>
-									this.pruneDebouncedFnAddIfNotKeeping({
-										key: entry.hash,
-										value: {
-											entry,
-											leaders: plan.leaders as Map<string, any>,
-										},
-									}),
-								);
+							for (const plan of joinPlans) {
+								plan.toDelete
+									?.filter((entry) => admittedMergeHashes.has(entry.hash))
+									.map((entry) =>
+										this.pruneDebouncedFnAddIfNotKeeping({
+											key: entry.hash,
+											value: {
+												entry,
+												leaders: plan.leaders as Map<string, any>,
+											},
+										}),
+									);
+							}
+							this.rebalanceParticipationDebounced?.call();
+						} finally {
+							// Settle seam for the receive token. Every consumer that can
+							// roll it back runs inline before control leaves this block: the
+							// prepared-join callback resolves during the join await, and the
+							// late finish/rollback arm runs above. This `finally` is what
+							// closes the abandon arms (no prepared-join commit, a declined
+							// native commit, a downgrade to the plain join) without having
+							// to enumerate them.
+							this._coordinates.settleResidentCoordinateSnapshot(
+								nativeReceiveCoordinateBatch?.rollbackCoordinateEntries,
+							);
 						}
-						this.rebalanceParticipationDebounced?.call();
 					}
 
 					for (const plan of joinPlans) {