@peerbit/shared-log 16.0.39 → 16.0.40

package/src/index.ts

@@ -4134,6 +4134,7 @@ export class SharedLog<
 		receiveEpoch: object | null;
 		signal: AbortSignal;
 		requestRemoteFullRearm?: boolean;
+		acknowledgeRearm?: boolean;
 	}): Promise<
 		{ receiverTransportSession: bigint; requestNotBeforeMs: number } | undefined
 	> {
@@ -4148,15 +4149,16 @@ export class SharedLog<
 						: 0),
 			}),
 			{
-				// The transient rearm is only a bounded recovery hint. The ensuing
-				// authenticated Full/Applied exchange is the readiness proof, so do not
-				// let an ACK-delivery promise park the recovery scheduler itself.
-				mode: properties.requestRemoteFullRearm
-					? new SilentDelivery({ redundancy: 1, to: [properties.target] })
-					: new AcknowledgeDelivery({
-							redundancy: 1,
-							to: [properties.target],
-						}),
+				// Watchdog hints stay silent so ACK latency cannot park that scheduler.
+				// Opening adverts still need an ACK before granting local receive
+				// readiness, even when they also solicit reciprocal recovery.
+				mode:
+					properties.requestRemoteFullRearm && !properties.acknowledgeRearm
+						? new SilentDelivery({ redundancy: 1, to: [properties.target] })
+						: new AcknowledgeDelivery({
+								redundancy: 1,
+								to: [properties.target],
+							}),
 				priority: CONVERGENCE_MESSAGE_PRIORITY,
 				signal: properties.signal,
 			},
@@ -4218,6 +4220,7 @@ export class SharedLog<
 					receiveEpoch: properties.receiveEpoch,
 					signal: properties.signal,
 					requestRemoteFullRearm: properties.requestRemoteFullRearm,
+					acknowledgeRearm: properties.acknowledgeRearm,
 				}),
 			onRequestError: (error) => {
 				if (
@@ -6461,7 +6464,9 @@ export class SharedLog<
 					});
 			}
 		};
-		let maxAttemptMs = MAX_PERSISTED_RECEIPT_ATTEMPT_MS;
+		let maxPrerequisiteAttemptMs = MAX_PERSISTED_RECEIPT_ATTEMPT_MS;
+		let maxReceiptResponseAttemptMs = MAX_PERSISTED_RECEIPT_ATTEMPT_MS;
+		let noProgressRetryMs = PERSISTED_RECEIPT_RETRY_MS;
 		let initialTransferPending = transferOnFirstRound;
 		let needsInitialLeaderCheck = true;
 		const carriedAcknowledgements = new Map<
@@ -6653,16 +6658,19 @@ export class SharedLog<
 				);
 				const roundController = new AbortController();
 				const roundSignal = AbortSignal.any([signal, roundController.signal]);
-				const getAttemptTimeout = () =>
+				const getAttemptTimeout = (maxMs = maxPrerequisiteAttemptMs) =>
 					Math.max(
 						1,
 						Math.min(
-							maxAttemptMs,
+							maxMs,
 							Math.floor((deadline.deadline - Date.now()) / candidateWaves),
 						),
 					);
 				const requests = new Set<Promise<void>>();
 				const transferAllOnRound = initialTransferPending;
+				let receivedValidReceipt = false;
+				let receivedNewReceipt = false;
+				let missedReceiptResponse = false;
 				try {
 					for (const [peer, hashes] of hashesByPeer) {
 						let request!: Promise<void>;
@@ -6850,6 +6858,7 @@ export class SharedLog<
 									break;
 								}
 								let responses;
+								let requestIssued = false;
 								const attempt = offset / PERSISTED_RECEIPT_CHUNK_SIZE + 1;
 								let requestStartedAt: number | undefined;
 								let endRequest:
@@ -6875,11 +6884,16 @@ export class SharedLog<
 										throw error;
 									}
 									if (!isPeerRoundCurrent()) break;
-									const attemptTimeout = getAttemptTimeout();
 									responses =
 										(await operationQueue.add(async () => {
 											if (!isPeerRoundCurrent()) return [];
+											// Only a missed response grows this bounded wait. Valid empty
+											// receipts instead back off polling while durability catches up.
+											const attemptTimeout = getAttemptTimeout(
+												maxReceiptResponseAttemptMs,
+											);
 											requestStartedAt = profile?.now();
+											requestIssued = true;
 											const pending = this.rpc.request(
 												new RequestPersistedEntriesV1({
 													expectedReceiverSession: captured.capabilitySession,
@@ -6909,6 +6923,7 @@ export class SharedLog<
 								} catch {
 									endRequest?.("rejected", 0);
 									if (roundSignal.aborted) break;
+									if (requestIssued) missedReceiptResponse = true;
 									// A peer can disconnect or miss this retry while the overall
 									// quorum deadline remains active. Replan on the next round.
 									break;
@@ -6947,11 +6962,17 @@ export class SharedLog<
 										continue;
 									}
 									receivedValidConfirmation = true;
+									receivedValidReceipt = true;
 									for (const hash of unique) {
 										confirmed.add(hash);
-										carriedAcknowledgements.get(hash)?.set(peer, captured);
+										const acknowledgements = carriedAcknowledgements.get(hash)!;
+										if (!acknowledgements.has(peer)) receivedNewReceipt = true;
+										acknowledgements.set(peer, captured);
 									}
 								}
+								if (requestIssued && !receivedValidConfirmation) {
+									missedReceiptResponse = true;
+								}
 								if (receivedValidConfirmation) {
 									const state = ensureRepairState();
 									for (const hash of requested) {
@@ -7064,21 +7085,34 @@ export class SharedLog<
 				if (isRoundOwnershipCurrent()) {
 					initialTransferPending = false;
 				}
-				// Keep early retries fair and responsive, then let a caller's longer
-				// overall deadline accommodate a genuinely slow durability barrier.
-				maxAttemptMs = Math.min(
+				// Confirmation and transfer can need a growing preparation window, but
+				// receipt response waits stay bounded independently of that work.
+				maxPrerequisiteAttemptMs = Math.min(
 					MAX_PERSISTED_DELIVERY_TIMEOUT_MS,
-					maxAttemptMs * 2,
+					maxPrerequisiteAttemptMs * 2,
 				);
+				// A genuinely slow receiver may need more than one response window.
+				// Grow on any issued request's miss, even if another peer replied empty,
+				// preserving the existing timer maximum and caller-deadline clamp.
+				if (missedReceiptResponse) {
+					maxReceiptResponseAttemptMs = Math.min(
+						MAX_PERSISTED_DELIVERY_TIMEOUT_MS,
+						maxReceiptResponseAttemptMs * 2,
+					);
+				}
+				// A valid empty/unchanged receipt should reduce polling, not grow the
+				// next RPC's response timeout. New receipts or a round without a valid
+				// response reset this backoff; readiness recovery gets no extra pause.
+				const noReceiptProgress = receivedValidReceipt && !receivedNewReceipt;
+				const retryMs = noReceiptProgress
+					? noProgressRetryMs
+					: PERSISTED_RECEIPT_RETRY_MS;
+				noProgressRetryMs = noReceiptProgress
+					? Math.min(1_000, noProgressRetryMs * 2)
+					: PERSISTED_RECEIPT_RETRY_MS;
 				await this.waitPersistedReceiptRetry(
 					signal,
-					Math.max(
-						0,
-						Math.min(
-							PERSISTED_RECEIPT_RETRY_MS,
-							deadline.deadline - Date.now(),
-						),
-					),
+					Math.max(0, Math.min(retryMs, deadline.deadline - Date.now())),
 				);
 			}
 		} catch (error) {
@@ -23350,6 +23384,7 @@ export class SharedLog<
 									));
 								if (!joinedPreparedFacts) {
 									await trustedLowerLog.join(materializeAllToMergeEntries(), {
+										signal: releasePeerReceiveLease.signal,
 										__peerbitBatchIndependent: true,
 										__peerbitEntriesAlreadyMissing: true,
 										__peerbitCanAppendAlreadyValidated:
@@ -23788,23 +23823,18 @@ export class SharedLog<
 									capabilityTimestamp > previousCapabilityTimestamp;
 								if (
 									freshExactRearm &&
-									this._v2Receive.isCurrentActive({
+									this._v2Receive.acceptRemoteRearm({
 										peerHash: receiveFromHash,
 										peerSession: receiveSession,
 										receiveEpoch:
 											this._peerSessions.receiveEpoch(receiveFromHash),
-										senderTransportSession: capabilityTransportSession,
 									})
 								) {
-									// Rotate the receiver grant/challenge before requesting Full. A
-									// sender rebuilt from no state starts at sequence one, which an
-									// active receiver's old sequence fence must otherwise reject.
-									this._v2Receive.advanceRecovery({
-										peerHash: receiveFromHash,
-										peerSession: receiveSession,
-										receiveEpoch:
-											this._peerSessions.receiveEpoch(receiveFromHash),
-									});
+									// A one-sided topic reopening can discard the opposite receive
+									// stream without changing transport. Retire its old Applied proof
+									// before refreshing our capability and requesting a new Full.
+									this._v2Send.reconfirmAfterPeerRecovery(receiveFromHash);
+									this.dispatchPersistedReceiptReadinessChange(receiveFromHash);
 								}
 							} else if (observed && receiveSession === null) {
 								// A capability can arrive before the sender's topic Subscribe after
@@ -28880,6 +28910,11 @@ export class SharedLog<
 			peerSession: expectedSubscriptionEpoch,
 			receiveEpoch,
 			signal: replicationLifecycleController.signal,
+			// Without a signed remote binding, even a fresh local instance may
+			// face a peer that still considers its old topic session fully active.
+			// Solicit one steady capability through the receiver-led Full handshake;
+			// ordinary timestamp refreshes do not themselves request another reply.
+			requestRemoteFullRearm: !this._peerSyncCapabilitySessions.has(peerHash),
 		});
 		this.scheduleReplicationInfoV2Recovery(
 			publicKey,

package/src/ranges.ts

@@ -3517,6 +3517,7 @@ export const toRebalance = <R extends "u32" | "u64">(
 	return {
 		[Symbol.asyncIterator]: async function* () {
 			let completed = false;
+			let scannedPage = false;
 			try {
 				let cursor: RebalanceTaskCursor | undefined;
 				for (;;) {
@@ -3535,6 +3536,16 @@ export const toRebalance = <R extends "u32" | "u64">(
 						let taskCompleted = false;
 						try {
 							while (iterator.done() !== true) {
+								if (scannedPage) {
+									// SQLite pages can settle synchronously. Give transport and
+									// lifecycle work a turn before reading the next bounded page.
+									await new Promise<void>((resolve) => {
+										if (typeof setImmediate === "function")
+											setImmediate(resolve);
+										else setTimeout(resolve, 0);
+									});
+								}
+								scannedPage = true;
 								const entries = await iterator.next(
 									REBALANCE_ITERATOR_BATCH_SIZE,
 								);

package/src/replication-info-v2-receive.ts

@@ -111,6 +111,7 @@ export type ReplicationInfoV2LocalCapabilityAdvertisement = {
 	context: ReplicationInfoV2LocalCapabilityContext;
 	attempts: number;
 	ready: boolean;
+	requestRemoteFullRearm?: boolean;
 	acknowledgedReady?: LocalCapabilityReady;
 	receiverTransportSession?: bigint;
 	timer?: ReturnType<typeof setTimeout>;
@@ -190,6 +191,7 @@ export type ReplicationInfoV2ReceiveState = {
 	requestsSinceCapabilityRefresh: number;
 	requestParked: boolean;
 	capabilityRefreshRequired: boolean;
+	remoteRearmPending?: boolean;
 	reservedAdmission?: ReplicationInfoV2ReceiveAdmission;
 };
 
@@ -235,6 +237,7 @@ export type ReplicationInfoV2ReceiveDeps = {
 		receiveEpoch: object | null;
 		signal: AbortSignal;
 		requestRemoteFullRearm?: boolean;
+		acknowledgeRearm?: boolean;
 	}) => Promise<ReplicationInfoV2LocalCapabilityRefresh | undefined>;
 	onRequestError?: (error: unknown) => void;
 	onLocalCapabilityError?: (error: unknown) => void;
@@ -596,6 +599,8 @@ export class ReplicationInfoV2ReceiveCoordinator {
 					state.controller.signal,
 					state.lifecycleSignal,
 				]),
+				requestRemoteFullRearm: state.requestRemoteFullRearm,
+				acknowledgeRearm: state.requestRemoteFullRearm,
 			});
 			if (
 				!refreshed ||
@@ -653,6 +658,7 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		peerSession: object;
 		receiveEpoch: object | null;
 		signal: AbortSignal;
+		requestRemoteFullRearm?: boolean;
 	}): ReplicationInfoV2LocalCapabilityAdvertisementHandle {
 		const peerHash = properties.target.hashcode();
 		if (
@@ -729,6 +735,7 @@ export class ReplicationInfoV2ReceiveCoordinator {
 				context,
 				attempts: 0,
 				ready: false,
+				requestRemoteFullRearm: properties.requestRemoteFullRearm,
 				receiverTransportSession: this.deps.getReceiverTransportSession(),
 			};
 			advertisement.onLifecycleAbort = () =>
@@ -1418,6 +1425,28 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		});
 	}
 
+	/** Coalesce reciprocal capability recovery into the existing request worker. */
+	acceptRemoteRearm(properties: {
+		peerHash: string;
+		peerSession: object;
+		receiveEpoch: object | null;
+	}): boolean {
+		const state = this._receiveStates.get(properties.peerHash);
+		if (
+			!state ||
+			state.peerSession !== properties.peerSession ||
+			state.receiveEpoch !== properties.receiveEpoch ||
+			!this.isStateCurrent(state)
+		) {
+			return false;
+		}
+		// A newer solicitation can describe another remote topic opening before
+		// the previous Full commits. Invalidating the captured version makes an
+		// in-flight refresh yield to one trailing refresh, not a second worker.
+		state.remoteRearmPending = true;
+		return this.advanceRecovery(properties);
+	}
+
 	/** Require a fresh capability-bound grant and authoritative Full. */
 	advanceRecovery(properties: {
 		peerHash: string;
@@ -1796,11 +1825,11 @@ export class ReplicationInfoV2ReceiveCoordinator {
 			return false;
 		}
 		state.lastSequence = message.sequence;
-		state.phase = "active";
+		state.phase = state.remoteRearmPending ? "resync" : "active";
 		state.requestAttempts = 0;
 		state.requestsSinceCapabilityRefresh = 0;
 		state.requestParked = false;
-		state.capabilityRefreshRequired = false;
+		state.capabilityRefreshRequired = state.remoteRearmPending === true;
 		if (state.requestTimer) {
 			clearTimeout(state.requestTimer);
 			state.requestTimer = undefined;
@@ -1810,6 +1839,7 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		admission.receiveEpoch = state.receiveEpoch;
 		admission.committed = true;
 		this.release(admission);
+		if (state.remoteRearmPending) this.armRequest(state, 0);
 		return true;
 	}
 
@@ -1959,6 +1989,7 @@ export class ReplicationInfoV2ReceiveCoordinator {
 		state.lastSequence = undefined;
 		state.phase = "resync";
 		state.capabilityRefreshRequired = false;
+		state.remoteRearmPending = false;
 		state.requestsSinceCapabilityRefresh = 0;
 		state.version++;
 		this.bindLocalCapability(state, ready);

package/src/replication-info-v2-send.ts

@@ -132,6 +132,7 @@ export type ReplicationInfoV2SendState = {
 	worker?: Promise<void>;
 	applicationConfirmationRequest?: ApplicationConfirmationRequest;
 	appliedRevision?: bigint;
+	minimumConfirmationSequence?: bigint;
 };
 
 export type ReplicationInfoV2SendDeps<R extends "u32" | "u64"> = {
@@ -258,6 +259,22 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 		}
 	}
 
+	/** Re-prove an unchanged transport stream after an authenticated recovery hint. */
+	reconfirmAfterPeerRecovery(peerHash: string): void {
+		const state = this._sendStates.get(peerHash);
+		if (!state || !this.isCurrent(state)) return;
+		state.appliedRevision = undefined;
+		state.minimumConfirmationSequence = state.nextSequence;
+		state.applicationConfirmationRequest?.controller.abort(
+			new AbortError("Replication confirmation peer recovery"),
+		);
+		state.applicationConfirmationRequest = undefined;
+		// Keep the stream: older rearm callers may still own its receive grant.
+		// A new Full sequence fences even an old Applied packet arriving after a
+		// replacement confirmation query has been registered for the same revision.
+		this.enqueueState(state, { kind: "snapshot", revision: this._revision });
+	}
+
 	private clearState(state: ReplicationInfoV2SendState): void {
 		this.trackRetiringWorker(state);
 		this.rejectTargetConfirmations(
@@ -1264,6 +1281,8 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 			!bytesEqual(message.receiverChallenge, state.receiverChallenge) ||
 			!bytesEqual(message.senderEpoch, state.senderEpoch) ||
 			message.sequence !== requested.sequence ||
+			(state.minimumConfirmationSequence !== undefined &&
+				message.sequence < state.minimumConfirmationSequence) ||
 			message.revision !== requested.revision ||
 			message.revision > this._revision
 		) {
@@ -1359,6 +1378,8 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 			if (
 				this.hasConfirmationFor(state, request.revision) &&
 				this.supportsApplicationConfirmation(state) &&
+				(state.minimumConfirmationSequence === undefined ||
+					message.sequence >= state.minimumConfirmationSequence) &&
 				this.isCurrent(state)
 			) {
 				// Keep one outstanding query until answered or no longer needed. A