@peerbit/shared-log 16.0.30 → 16.0.31

package/src/index.ts

@@ -6352,6 +6352,95 @@ export class SharedLog<
 				records.size,
 			);
 		const signal = deadline.signal;
+		const recoveryController = new AbortController();
+		const recoverySignal = AbortSignal.any([signal, recoveryController.signal]);
+		const recoveryByPeer = new Map<
+			string,
+			{
+				controller: AbortController;
+				timer: ReturnType<typeof setTimeout>;
+			}
+		>();
+		let recoveryCursor = 0;
+		const recoverSelectedPeers = (selected: Set<string>) => {
+			// Recovery is advisory work, not a receipt or a replacement leader plan.
+			// Never occupy transfer/request slots while waiting for it. The separate
+			// bounded pool rotates through fresh candidates so quiet/incomplete peers
+			// cannot indefinitely hide a later recoverable peer.
+			for (const [peer, state] of recoveryByPeer) {
+				if (!selected.has(peer)) {
+					clearTimeout(state.timer);
+					state.controller.abort();
+				}
+			}
+			const peers = [...selected];
+			for (
+				let visited = 0;
+				visited < peers.length &&
+				recoveryByPeer.size < MAX_PERSISTED_RECEIPT_REQUESTS_GLOBAL &&
+				!recoverySignal.aborted;
+				visited++
+			) {
+				const peer = peers[recoveryCursor++ % peers.length]!;
+				if (recoveryByPeer.has(peer)) continue;
+				const current = this.persistedReceiptPeerSession(peer);
+				if (
+					current &&
+					this._v2Send.isLatestConfirmedForPeer({
+						peerHash: peer,
+						peerSession: current.peerSession,
+						receiverTransportSession: current.capabilitySession,
+					})
+				) {
+					continue;
+				}
+				const expiresAt = Math.min(
+					deadline.deadline,
+					Date.now() + MAX_PERSISTED_RECEIPT_ATTEMPT_MS,
+				);
+				const controller = new AbortController();
+				const attemptSignal = AbortSignal.any([
+					recoverySignal,
+					controller.signal,
+				]);
+				const timer = setTimeout(
+					() => controller.abort(),
+					Math.max(1, expiresAt - Date.now()),
+				);
+				timer.unref?.();
+				const state = { controller, timer };
+				recoveryByPeer.set(peer, state);
+				void (async () => {
+					// Resolve only an authenticated transport-cache key. Keep this slot
+					// reserved until the lookup actually settles, even if a custom
+					// resolver ignores cancellation, rather than launching duplicates.
+					const key = await this._resolvePublicKeyFromHash(peer);
+					if (
+						attemptSignal.aborted ||
+						!key ||
+						key.hashcode() !== peer ||
+						Date.now() >= expiresAt
+					) {
+						return;
+					}
+					// Reuse the exact-session watchdog, capability/subscriber recovery,
+					// and replacement-session handling from the public preflight. Its
+					// result is ignored: settlement still checks the exact entry leaders
+					// and accepts only the subsequent durable, session-bound receipts.
+					await this.waitForPersistedReceiptPeerReadiness(key, {
+						timeout: Math.max(1, expiresAt - Date.now()),
+						signal: attemptSignal,
+					});
+				})()
+					.catch(() => undefined)
+					.finally(() => {
+						clearTimeout(timer);
+						if (recoveryByPeer.get(peer) === state) {
+							recoveryByPeer.delete(peer);
+						}
+					});
+			}
+		};
 		let maxAttemptMs = MAX_PERSISTED_RECEIPT_ATTEMPT_MS;
 		let initialTransferPending = transferOnFirstRound;
 		let needsInitialLeaderCheck = true;
@@ -6418,6 +6507,7 @@ export class SharedLog<
 				// transport epoch. A revision/session change purges them before they can
 				// survive an away-and-back leader transition or combine with a later peer.
 				const hashesByPeer = new Map<string, string[]>();
+				const recoveryCandidates = new Set<string>();
 				const entryArray = [...records.values()];
 				const leadersByEntry = await this.planPersistedDeliveryLeaders(
 					entryArray,
@@ -6462,6 +6552,7 @@ export class SharedLog<
 					if (acknowledgements.size >= minAcks) continue;
 					for (const peer of leaders.keys()) {
 						if (peer === selfHash) continue;
+						recoveryCandidates.add(peer);
 						const current = this.persistedReceiptPeerSession(peer);
 						if (!current) continue;
 						if (acknowledgements.has(peer)) continue;
@@ -6471,6 +6562,7 @@ export class SharedLog<
 					}
 				}
 				if (!isRoundOwnershipCurrent()) continue;
+				recoverSelectedPeers(recoveryCandidates);
 
 				const operationQueue = new PQueue({
 					concurrency: MAX_PERSISTED_RECEIPT_REQUESTS_GLOBAL,
@@ -6831,6 +6923,11 @@ export class SharedLog<
 			}
 			throw new PersistedDeliveryError(error, committedHashes);
 		} finally {
+			recoveryController.abort();
+			for (const state of recoveryByPeer.values()) {
+				clearTimeout(state.timer);
+				state.controller.abort();
+			}
 			if (ownedDeadline) deadline.dispose();
 		}
 	}
@@ -20953,6 +21050,10 @@ export class SharedLog<
 		const pruneRemoveTerminalFence = this.acquirePruneRemoveTerminalFence();
 		try {
 			this.stopSubscriptionChangeCallbackAdmission();
+			// A receive may be awaiting a synchronizer response shipment. Cancel
+			// its dispatch generation before draining that receive, rather than
+			// waiting for _close() to reach the synchronizer's final teardown.
+			this.syncronizer?.beginClose?.();
 			this.joinWarmup.cancelAllJoinWarmupTargets();
 			await this.drainSubscriptionChangeCallbacks();
 			// An already-admitted subscription callback can create a fresh warmup
@@ -21091,6 +21192,7 @@ export class SharedLog<
 		const pruneRemoveTerminalFence = this.acquirePruneRemoveTerminalFence();
 		try {
 			this.stopSubscriptionChangeCallbackAdmission();
+			this.syncronizer?.beginClose?.();
 			this.joinWarmup.cancelAllJoinWarmupTargets();
 			await this.drainSubscriptionChangeCallbacks();
 			// An already-admitted subscription callback can create a fresh warmup

package/src/sync/index.ts

@@ -251,6 +251,13 @@ export interface Syncronizer<R extends "u32" | "u64"> {
 	onPeerDisconnected(key: PublicSignKey | string): void;
 
 	open(): Promise<void> | void;
+	/**
+	 * Synchronously fence dispatch admission and cancel the current generation's
+	 * network waits before SharedLog drains admitted receives. Do not stop shared
+	 * indexes or discard physical-work accounting here: close() still runs after
+	 * those receives settle. Optional for existing custom synchronizers.
+	 */
+	beginClose?(): void;
 	close(): Promise<void> | void;
 
 	get pending(): number;

package/src/sync/rateless-iblt.ts

@@ -1127,6 +1127,9 @@ export class RatelessIBLTSynchronizer<D extends "u32" | "u64">
 		timeoutMs?: number;
 		retryIntervalsMs?: number[];
 	}): RepairSession {
+		if (this.ratelessClosed) {
+			return this.simple.startRepairSession(properties);
+		}
 		const mode = properties.mode ?? "best-effort";
 		const targets = [...new Set(properties.targets)];
 		const timeoutMs = Math.max(
@@ -3303,13 +3306,16 @@ export class RatelessIBLTSynchronizer<D extends "u32" | "u64">
 		return this.simple.open();
 	}
 
-	close(): Promise<void> | void {
+	beginClose(): void {
 		this.ratelessClosed = true;
-		// Abort ownership first. Process abort listeners then cancel any in-flight
-		// StartSync/MoreSymbols send before they detach or free native state.
 		const reason = new Error("rateless synchronizer closed");
 		this.cancelRatelessRepairSessions(reason);
 		this.ratelessDispatchLifecycleController.abort(reason);
+		this.simple.beginClose();
+	}
+
+	close(): Promise<void> | void {
+		this.beginClose();
 		for (const obj of [...this.ingoingSyncProcesses.values()]) {
 			obj.free();
 		}

package/src/sync/simple.ts

@@ -879,7 +879,9 @@ export class SimpleSyncronizer<R extends "u32" | "u64">
 				const epoch =
 					expectedEpoch ??
 					currentEpoch ??
-					(options?.createTargetEpochs === false
+					(options?.createTargetEpochs === false ||
+					this.closed === true ||
+					ownershipLifecycleController.signal.aborted
 						? undefined
 						: this.getOrCreateSyncDispatchTargetEpoch(target));
 				if (!epoch) {
@@ -2362,7 +2364,11 @@ export class SimpleSyncronizer<R extends "u32" | "u64">
 				requestedCount: trackedHashes.length,
 				requestedTotalCount: allHashes.length,
 				attempts: 0,
-				targetEpoch: this.getOrCreateSyncDispatchTargetEpoch(target),
+				// Rejected late repairs only need result metadata. Do not create a
+				// retained dispatch epoch after the terminal admission fence.
+				targetEpoch: this.closed
+					? { id: 0 }
+					: this.getOrCreateSyncDispatchTargetEpoch(target),
 			});
 		}
 
@@ -2377,6 +2383,10 @@ export class SimpleSyncronizer<R extends "u32" | "u64">
 			deferred,
 			cancelled: false,
 		};
+		if (this.closed) {
+			deferred.resolve(this.buildRepairSessionResult(session, false));
+			return { id, done: deferred.promise, cancel: () => {} };
+		}
 
 		if (allHashes.length === 0 || targets.length === 0) {
 			deferred.resolve(this.buildRepairSessionResult(session, true));
@@ -3755,9 +3765,13 @@ export class SimpleSyncronizer<R extends "u32" | "u64">
 		});
 	}
 
-	async close() {
+	beginClose(): void {
 		this.closed = true;
 		this.syncDispatchLifecycleController.abort();
+	}
+
+	async close() {
+		this.beginClose();
 		this.syncDispatchTargetEpochs.clear();
 		this.clearPendingSyncAdmissions();
 		this.syncInFlightRetryIterator = undefined;