@serfab/cadre-core 0.13.0 → 1.0.0

package/dist/control-write-retry.d.ts

@@ -14,8 +14,19 @@ import type { ControlRetryOptions } from './control-retry.js';
  * a moment later, which the degraded-cohort-member scenario measured as safe (a failed
  * write rolls back, nothing half-commits) and effective (the next write commits in ~1 s).
  *
- * A write somebody actually REJECTED is never retried — re-presenting it would re-present
- * a spent signature against a cohort that already said no.
+ * A write somebody actually REJECTED is never retried on the strength of the rejection itself —
+ * no matcher here claims a rejection message, at any phase, because re-presenting one would
+ * re-present a spent signature against a cohort that already said no. Rejections are re-presented
+ * anyway when they arrive inside the transactor's promise-phase `[block:` aggregate, which
+ * {@link isUncommittedTransactorAggregate} claims on the WRAPPER alone, whatever the cause inside
+ * says. Safe because nothing has committed at that phase, and deliberately kept — one of the
+ * remaining promise-phase rejections is exactly the kind a re-presentation fixes. See the
+ * accepted-tradeoff `NOTE:` there for which, and why no blanket rejection veto is wanted.
+ *
+ * A failure that says some of the write may be STORED is a different matter, and never
+ * re-presented whatever text it carries: {@link reportsPossiblyStoredWrite} vetoes it by type
+ * before any matcher runs. The one half-landed write that IS re-presented is a torn write the
+ * library marks final — not saved and unable to land ({@link isFinalTornWrite}).
  *
  * TWO policies ship from here, and the split is deliberate: the default
  * ({@link isRetriableControlWriteFailure}, {@link CONTROL_WRITE_ATTEMPTS}) sits under every
@@ -63,6 +74,17 @@ export declare const SCHEMA_INIT_ATTEMPTS = 5;
  * attempts, measured in `control-write-degraded-cohort-member.integration.ts`), which
  * already exceeds this budget when attempt 1 returns — so that case is surfaced immediately
  * and retry adds ZERO latency to the case where it cannot help.
+ *
+ * NOTE: a failed commit attempt now also pays a cancel discharge before its error returns
+ * (optimystic `TransactorSource.transact`'s catch, added by upstream
+ * `1-a-failed-attempt-must-discharge-its-own-pend`) — bounded by six rounds and
+ * `abortOrCancelTimeoutMs`, which every collection this repo opens sets to 5 s
+ * (`../optimystic/packages/quereus-plugin-optimystic/src/optimystic-adapter/collection-factory.ts`).
+ * Two failed attempts whose cancels each run their full budget would consume this whole 10 s
+ * ceiling and cut the three-attempt policy to two. Not observed — every measured round of the
+ * transient-reset case committed on attempt 3 of 3 — so this is a condition to watch, not work
+ * to do: if that case ever starts failing with `failed after 2/3 attempt(s)`, the cancel
+ * discharge is where the time went.
  */
 export declare const CONTROL_WRITE_RETRY_BUDGET_MS = 10000;
 /**
@@ -101,6 +123,42 @@ export declare const CONTROL_WRITE_RETRY_BUDGET_MS = 10000;
  * token on the live aggregate; if it reddens there, an upstream reformat is the first thing to
  * check.
  *
+ * NOTE: the discriminator is the prefix AND the token within ONE message — never relax it to
+ * "contains `[block:`". Beyond the `get` and `pend` sites above, Optimystic renders `[block:` in
+ * one further place — a third formatter, outside the aggregate's three sites — `dischargeCancel`
+ * (`Cancel of action <id> did not discharge <n> block(s): …`), which does not raise the
+ * `Some peers did not complete:` prefix; only the conjunction keeps a cancel fault from
+ * classifying as a retriable get/pend (checked against optimystic `c56c2bd4`, 2026-09-16).
+ *
+ * NOTE: accepted tradeoff — a REJECTION raised while promises are still being collected reaches
+ * this repo wrapped in this same aggregate, and this matcher claims it on the wrapper alone,
+ * whatever the cause inside says. That re-presents such a rejection up to two more times inside
+ * the 10 s budget. Kept deliberately, and re-decided on 2026-09-17 against the current upstream
+ * behaviour rather than inherited:
+ *
+ *  - Contention is no longer a rejection at all. "Another write holds this block right now"
+ *    (`pending conflict`) is now a `held` verdict that counts toward neither approvals nor
+ *    rejections (`validatePendOperations`,
+ *    `../optimystic/packages/db-p2p/src/cluster/cluster-repo.ts`), so the rejection this tradeoff
+ *    was originally written about does not arrive any more. It reaches this funnel as
+ *    `SyncRetryExhaustedError` instead, which {@link reportsPossiblyStoredWrite} declines by type
+ *    — upstream documents resubmitting after it as unsafe (the attempt that spent the budget may
+ *    have left its log entry standing), and its collection sync has already spent ten retries on
+ *    the race. The torn-write rule beside it: a `TornActionError` is re-presented only when
+ *    `final` is true; any other torn write is declined.
+ *  - What remains rejectable at the promise phase is stale revision, block-unavailable,
+ *    membership-not-admitted, and a configured validator's refusal. Only the first is worth a
+ *    retry — and it is worth one: this loop re-runs the WHOLE write body, reads included
+ *    (`ControlDatabase.withWriteLock`'s contract), so attempt 2 presents a pend against the
+ *    revision that made attempt 1 stale. A blanket "decline any chain reporting a validator
+ *    rejection" rule would remove that retry to save two wasted attempts on the other three.
+ *
+ * Revisit if a re-presentation ever becomes expensive relative to what it buys — a rejection class
+ * that costs a full cohort round-trip to re-present, or a write body whose reads are no longer
+ * cheap — or when upstream offers a typed refusal surface to classify on instead of this text
+ * (`../optimystic/tickets/backlog/debt-a-downstream-repo-classifies-retries-by-parsing-our-error-text`).
+ * Contention is no longer the reason to revisit.
+ *
  * An aggregate whose details came out EMPTY (possible when `formatBatchStatuses` has no
  * batches to format) carries neither token, matches nothing here, and is not retried — an
  * unattributable failure is not a proven non-commit.
@@ -114,16 +172,18 @@ export declare function isUncommittedTransactorAggregate(message: string): boole
  * Did this control write fail because the cluster cohort did not ANSWER — i.e. is
  * re-presenting the SAME signed write a moment later the right response?
  *
- * Classifies by MESSAGE, walking the `cause` chain with the shared {@link chainMessages}
- * (Quereus' own `unwrapError` underneath) —
- * the failure surface is not recognisable by type. The transactor and the coordinator both throw bare `Error`s, and by
- * the time one reaches `ControlDatabase` it is wrapped in a `QuereusError` (the real chain
- * is `QuereusError` → `Error` → `Error`), so the match must work at any depth. Anything
- * that is not an `Error` is never retried.
+ * Classifies the transient cases by MESSAGE, walking the `cause` chain with the shared
+ * {@link chainMessages} (Quereus' own `unwrapError` underneath) — the transactor and the
+ * coordinator both throw bare `Error`s, not recognisable by type. By the time one reaches
+ * `ControlDatabase` it is wrapped in a `QuereusError` (the real chain is `QuereusError` → `Error`
+ * → `Error`), so the match must work at any depth. Anything that is not an `Error` is never
+ * retried.
  *
- * {@link reportsIndeterminateCommit} vetoes the whole chain before any matcher runs, so a
- * failure that reports a commit-phase batch anywhere is never retried on the strength of some
- * other level looking transient.
+ * Two vetoes run over the whole chain before any matcher: {@link reportsPossiblyStoredWrite}
+ * (by type — a spent sync budget, a non-final torn write, a partial commit) and
+ * {@link reportsIndeterminateCommit} (by text — a commit-phase batch). A chain either veto flags,
+ * at any level, is never retried on the strength of some other level looking transient. The one
+ * typed failure claimed as retriable is a final torn write ({@link isFinalTornWrite}).
  *
  * NOTE: this depends on engine/transactor error TEXT. The messages producible without a
  * network are driven from the REAL engine in `control-formation-seat-budget.spec.ts`, so
@@ -181,5 +241,14 @@ export declare const SCHEMA_INIT_RETRY_POLICY: Readonly<ControlWriteRetryOptions
  * On exhaustion (attempts or budget) the LAST error is rethrown unchanged — never wrapped,
  * so the exact messages downstream code and the degraded-cohort-member scenario assert on
  * survive. A non-retriable failure propagates from the attempt that raised it.
+ *
+ * Either way — declined or exhausted — an `options.onAbandon` observer is notified exactly
+ * once before the rethrow (a `ControlRetryAbandonment`). Only WRITES pass one: an abandoned
+ * read throws to a caller that is awaiting it, so nothing is lost silently there
+ * (`control-read-retry.ts` says so at its own seam), while an abandoned write may have no
+ * caller at all — a background self-record republish is `void`-ed with a `debug` catch, so
+ * its failure reaches nobody unless something is listening here.
+ * `ControlDatabase.setControlWriteAbandonedListener` is the only thing that passes one in
+ * production; `retryControlWrite` itself neither supplies nor requires an observer.
  */
 export declare function retryControlWrite<T>(attempt: () => Promise<T>, options?: ControlWriteRetryOptions): Promise<T>;

package/dist/control-write-retry.js

@@ -1,4 +1,6 @@
-import { chainMessages, retryControlOperation } from './control-retry.js';
+import { CoordinatorPartialCommitError, SyncRetryExhaustedError, TornActionError } from '@optimystic/db-core';
+import { PartialCommitError } from '@optimystic/quereus-plugin-optimystic';
+import { causeChain, chainMessages, retryControlOperation } from './control-retry.js';
 /**
  * Bounded retry for TRANSIENT control-write failures — the classifier and loop behind
  * `ControlDatabase.lockedWithRetry`, the single funnel every local control write passes
@@ -14,8 +16,19 @@ import { chainMessages, retryControlOperation } from './control-retry.js';
  * a moment later, which the degraded-cohort-member scenario measured as safe (a failed
  * write rolls back, nothing half-commits) and effective (the next write commits in ~1 s).
  *
- * A write somebody actually REJECTED is never retried — re-presenting it would re-present
- * a spent signature against a cohort that already said no.
+ * A write somebody actually REJECTED is never retried on the strength of the rejection itself —
+ * no matcher here claims a rejection message, at any phase, because re-presenting one would
+ * re-present a spent signature against a cohort that already said no. Rejections are re-presented
+ * anyway when they arrive inside the transactor's promise-phase `[block:` aggregate, which
+ * {@link isUncommittedTransactorAggregate} claims on the WRAPPER alone, whatever the cause inside
+ * says. Safe because nothing has committed at that phase, and deliberately kept — one of the
+ * remaining promise-phase rejections is exactly the kind a re-presentation fixes. See the
+ * accepted-tradeoff `NOTE:` there for which, and why no blanket rejection veto is wanted.
+ *
+ * A failure that says some of the write may be STORED is a different matter, and never
+ * re-presented whatever text it carries: {@link reportsPossiblyStoredWrite} vetoes it by type
+ * before any matcher runs. The one half-landed write that IS re-presented is a torn write the
+ * library marks final — not saved and unable to land ({@link isFinalTornWrite}).
  *
  * TWO policies ship from here, and the split is deliberate: the default
  * ({@link isRetriableControlWriteFailure}, {@link CONTROL_WRITE_ATTEMPTS}) sits under every
@@ -63,6 +76,17 @@ export const SCHEMA_INIT_ATTEMPTS = 5;
  * attempts, measured in `control-write-degraded-cohort-member.integration.ts`), which
  * already exceeds this budget when attempt 1 returns — so that case is surfaced immediately
  * and retry adds ZERO latency to the case where it cannot help.
+ *
+ * NOTE: a failed commit attempt now also pays a cancel discharge before its error returns
+ * (optimystic `TransactorSource.transact`'s catch, added by upstream
+ * `1-a-failed-attempt-must-discharge-its-own-pend`) — bounded by six rounds and
+ * `abortOrCancelTimeoutMs`, which every collection this repo opens sets to 5 s
+ * (`../optimystic/packages/quereus-plugin-optimystic/src/optimystic-adapter/collection-factory.ts`).
+ * Two failed attempts whose cancels each run their full budget would consume this whole 10 s
+ * ceiling and cut the three-attempt policy to two. Not observed — every measured round of the
+ * transient-reset case committed on attempt 3 of 3 — so this is a condition to watch, not work
+ * to do: if that case ever starts failing with `failed after 2/3 attempt(s)`, the cancel
+ * discharge is where the time went.
  */
 export const CONTROL_WRITE_RETRY_BUDGET_MS = 10000;
 /**
@@ -110,9 +134,14 @@ const COMMIT_BATCH_TOKEN = '[blocks:';
  * matched ONLY with a ZERO rejection count. The same message with a non-zero count means a
  * member actually voted no (that branch carries `membership-not-admitted` rejections), and
  * retrying it would re-present a spent signature to a cohort that already refused it. This one
- * is raised while collecting PROMISES, before any commit, so re-presenting it is safe. A
- * decisive rejection is a different error entirely (`ValidatorRejectionError`,
- * `Transaction rejected by validators`), which this classifier also never matches.
+ * is raised while collecting PROMISES, before any commit, so re-presenting it is safe.
+ *
+ * This regex itself never matches a decisive rejection (`ValidatorRejectionError`, `Transaction
+ * rejected by validators`) — that text carries no `Failed to get super-majority:` prefix. But the
+ * composite classifier is not this matcher alone: a rejection raised while promises are still
+ * being collected reaches this repo wrapped in the transactor's `Some peers did not complete:
+ * …[block:…]` aggregate, and {@link isUncommittedTransactorAggregate} matches that wrapper on its
+ * own, whatever the cause inside it says — see the accepted-tradeoff `NOTE:` there.
  */
 const SUPER_MAJORITY_SHORTFALL_UNANSWERED = /Failed to get super-majority: \d+\/\d+ approvals \(needed \d+, 0 rejections\)/;
 /**
@@ -151,6 +180,42 @@ const SUPER_MAJORITY_SHORTFALL_UNANSWERED = /Failed to get super-majority: \d+\/
  * token on the live aggregate; if it reddens there, an upstream reformat is the first thing to
  * check.
  *
+ * NOTE: the discriminator is the prefix AND the token within ONE message — never relax it to
+ * "contains `[block:`". Beyond the `get` and `pend` sites above, Optimystic renders `[block:` in
+ * one further place — a third formatter, outside the aggregate's three sites — `dischargeCancel`
+ * (`Cancel of action <id> did not discharge <n> block(s): …`), which does not raise the
+ * `Some peers did not complete:` prefix; only the conjunction keeps a cancel fault from
+ * classifying as a retriable get/pend (checked against optimystic `c56c2bd4`, 2026-09-16).
+ *
+ * NOTE: accepted tradeoff — a REJECTION raised while promises are still being collected reaches
+ * this repo wrapped in this same aggregate, and this matcher claims it on the wrapper alone,
+ * whatever the cause inside says. That re-presents such a rejection up to two more times inside
+ * the 10 s budget. Kept deliberately, and re-decided on 2026-09-17 against the current upstream
+ * behaviour rather than inherited:
+ *
+ *  - Contention is no longer a rejection at all. "Another write holds this block right now"
+ *    (`pending conflict`) is now a `held` verdict that counts toward neither approvals nor
+ *    rejections (`validatePendOperations`,
+ *    `../optimystic/packages/db-p2p/src/cluster/cluster-repo.ts`), so the rejection this tradeoff
+ *    was originally written about does not arrive any more. It reaches this funnel as
+ *    `SyncRetryExhaustedError` instead, which {@link reportsPossiblyStoredWrite} declines by type
+ *    — upstream documents resubmitting after it as unsafe (the attempt that spent the budget may
+ *    have left its log entry standing), and its collection sync has already spent ten retries on
+ *    the race. The torn-write rule beside it: a `TornActionError` is re-presented only when
+ *    `final` is true; any other torn write is declined.
+ *  - What remains rejectable at the promise phase is stale revision, block-unavailable,
+ *    membership-not-admitted, and a configured validator's refusal. Only the first is worth a
+ *    retry — and it is worth one: this loop re-runs the WHOLE write body, reads included
+ *    (`ControlDatabase.withWriteLock`'s contract), so attempt 2 presents a pend against the
+ *    revision that made attempt 1 stale. A blanket "decline any chain reporting a validator
+ *    rejection" rule would remove that retry to save two wasted attempts on the other three.
+ *
+ * Revisit if a re-presentation ever becomes expensive relative to what it buys — a rejection class
+ * that costs a full cohort round-trip to re-present, or a write body whose reads are no longer
+ * cheap — or when upstream offers a typed refusal surface to classify on instead of this text
+ * (`../optimystic/tickets/backlog/debt-a-downstream-repo-classifies-retries-by-parsing-our-error-text`).
+ * Contention is no longer the reason to revisit.
+ *
  * An aggregate whose details came out EMPTY (possible when `formatBatchStatuses` has no
  * batches to format) carries neither token, matches nothing here, and is not retried — an
  * unattributable failure is not a proven non-commit.
@@ -177,6 +242,59 @@ export function isUncommittedTransactorAggregate(message) {
 function reportsIndeterminateCommit(messages) {
     return messages.some(message => message.includes(COMMIT_BATCH_TOKEN));
 }
+/**
+ * Does any link of the `cause` chain say some of this write may be stored, or may still be?
+ * Such a failure is never re-presented — a re-run could store the write twice.
+ *
+ * - `SyncRetryExhaustedError` (and its `SyncRevisionStalledError` subclass): upstream documents
+ *   resubmitting as unsafe, because the attempt that spent the budget may have left its log
+ *   entry standing.
+ * - `TornActionError` without `final: true`: the write's log entry is stored and nobody could
+ *   establish that the rest can never land — it may be saved already, or land later.
+ * - `CoordinatorPartialCommitError` / `PartialCommitError`: another collection or tree of the
+ *   same transaction is already durable, and re-running the whole body would apply it twice.
+ *
+ * Every one of these embeds text from elsewhere in its message (a responder's refusal, the
+ * underlying failure), which can carry the pend-phase aggregate's prefix and `[block:` token —
+ * so this veto runs before any text matcher.
+ *
+ * Matched by TYPE: each survives the bridge's and Quereus' rewraps on `cause`. An error built by a
+ * second loaded copy of `@optimystic/db-core` (or of the plugin, for `PartialCommitError`) fails
+ * `instanceof`, and then this veto does not fire — falling back to the text classifiers, which is
+ * how these failures were classified before the veto existed. The asymmetry with
+ * {@link isFinalTornWrite} is deliberate: there, a missed `instanceof` means no retry, which is the
+ * safe side. No text fallback parses `TornActionError`'s closing sentence, since upstream says its
+ * wording is for log lines only.
+ *
+ * NOTE: the plugin is registered through its `/plugin` entry (`control-database.ts`) but
+ * `PartialCommitError` is imported from its root entry; the two are one class only because the
+ * plugin's build emits both entries over one shared chunk. If upstream ever bundles the entries
+ * separately, this `instanceof` stops matching with every spec still green — import the class from
+ * the entry the plugin is registered through.
+ */
+function reportsPossiblyStoredWrite(links) {
+    return links.some(link => link instanceof SyncRetryExhaustedError
+        || (link instanceof TornActionError && link.final !== true)
+        || link instanceof CoordinatorPartialCommitError
+        || link instanceof PartialCommitError);
+}
+/**
+ * A torn write the library marks FINAL: not saved, unable to land, its pending records confirmed
+ * cancelled — so submitting it again stores it once.
+ *
+ * Worth re-presenting, not merely safe to: upstream raises it mostly when a rival holds the
+ * revision this write's log entry claimed, which is contention, and the loop re-runs the write
+ * body's reads, so the next attempt builds on the rival's revision — the same argument that keeps
+ * stale-revision rejections retried (the accepted-tradeoff `NOTE:` on
+ * {@link isUncommittedTransactorAggregate}).
+ *
+ * NOTE: `CoordinatorStaleLossError` (db-core; "nothing durably committed, safe to re-drive") is not
+ * claimed, so it falls to the text matchers; it escapes only after the coordinator's own retry budget
+ * ran out. If control writes are seen abandoned on it, claim it here by type beside this one.
+ */
+function isFinalTornWrite(link) {
+    return link instanceof TornActionError && link.final === true;
+}
 /** The coordinator's shortfall, raised pre-commit, with nobody having voted no. */
 function isUnansweredSuperMajorityShortfall(message) {
     return SUPER_MAJORITY_SHORTFALL_UNANSWERED.test(message);
@@ -193,13 +311,14 @@ function isUnansweredSuperMajorityShortfall(message) {
  * one connection again, which a cold-starting node dialling its bootstrap peers is actively
  * working on.
  *
- * NOTE: matched by TEXT, not by type, and that is forced rather than chosen.
- * `FindCoordinatorError` (`code: 'SELF_COORDINATION_BLOCKED'`) is exported from `@optimystic/db-p2p`
- * and this package depends on it, but the error OBJECT does not survive the trip:
- * `OptimysticVirtualTable.initialize` catches and rethrows as `new Error(message)` with no `cause`
- * (`quereus-plugin-optimystic/src/optimystic-module.ts`), so only the text reaches this repo. Like
- * every matcher here this fails CLOSED — a rewording upstream stops the retry engaging, it never
- * makes it unsafe.
+ * NOTE: matched by TEXT, not by type. `FindCoordinatorError` (`code: 'SELF_COORDINATION_BLOCKED'`)
+ * is exported from `@optimystic/db-p2p`, and when this matcher was written the error OBJECT did not
+ * survive the trip: `OptimysticVirtualTable.initialize` rethrew as `new Error(message)` with no
+ * `cause`. It now rethrows through `rewrapAsQueryError`, which keeps `cause`
+ * (`quereus-plugin-optimystic/src/optimystic-module.ts`); whether every Quereus wrapper above it on
+ * the schema-init path keeps it too has not been checked, and the text still arrives either way.
+ * Like every matcher here this fails CLOSED — a rewording upstream stops the retry engaging, it
+ * never makes it unsafe.
  */
 const SELF_COORDINATION_GRACE_REFUSAL = /Self-coordination blocked: grace-period-not-elapsed\. No coordinator available for key\./;
 /** Self-coordination refused because the node's last connection dropped moments ago. */
@@ -246,16 +365,18 @@ const RETRIABLE_SCHEMA_INIT_MATCHERS = [
  * Did this control write fail because the cluster cohort did not ANSWER — i.e. is
  * re-presenting the SAME signed write a moment later the right response?
  *
- * Classifies by MESSAGE, walking the `cause` chain with the shared {@link chainMessages}
- * (Quereus' own `unwrapError` underneath) —
- * the failure surface is not recognisable by type. The transactor and the coordinator both throw bare `Error`s, and by
- * the time one reaches `ControlDatabase` it is wrapped in a `QuereusError` (the real chain
- * is `QuereusError` → `Error` → `Error`), so the match must work at any depth. Anything
- * that is not an `Error` is never retried.
+ * Classifies the transient cases by MESSAGE, walking the `cause` chain with the shared
+ * {@link chainMessages} (Quereus' own `unwrapError` underneath) — the transactor and the
+ * coordinator both throw bare `Error`s, not recognisable by type. By the time one reaches
+ * `ControlDatabase` it is wrapped in a `QuereusError` (the real chain is `QuereusError` → `Error`
+ * → `Error`), so the match must work at any depth. Anything that is not an `Error` is never
+ * retried.
  *
- * {@link reportsIndeterminateCommit} vetoes the whole chain before any matcher runs, so a
- * failure that reports a commit-phase batch anywhere is never retried on the strength of some
- * other level looking transient.
+ * Two vetoes run over the whole chain before any matcher: {@link reportsPossiblyStoredWrite}
+ * (by type — a spent sync budget, a non-final torn write, a partial commit) and
+ * {@link reportsIndeterminateCommit} (by text — a commit-phase batch). A chain either veto flags,
+ * at any level, is never retried on the strength of some other level looking transient. The one
+ * typed failure claimed as retriable is a final torn write ({@link isFinalTornWrite}).
  *
  * NOTE: this depends on engine/transactor error TEXT. The messages producible without a
  * network are driven from the REAL engine in `control-formation-seat-budget.spec.ts`, so
@@ -266,7 +387,7 @@ const RETRIABLE_SCHEMA_INIT_MATCHERS = [
  * aggregate from a real stream reset, which the retry there absorbs end to end.
  */
 export function isRetriableControlWriteFailure(error) {
-    return matchesRetriableMessage(error, RETRIABLE_CONTROL_WRITE_MATCHERS);
+    return matchesRetriableFailure(error, RETRIABLE_CONTROL_WRITE_MATCHERS);
 }
 /**
  * {@link isRetriableControlWriteFailure} widened by exactly one class — the self-coordination
@@ -276,22 +397,31 @@ export function isRetriableControlWriteFailure(error) {
  * default classifier untouched.
  */
 export function isRetriableSchemaInitFailure(error) {
-    return matchesRetriableMessage(error, RETRIABLE_SCHEMA_INIT_MATCHERS);
+    return matchesRetriableFailure(error, RETRIABLE_SCHEMA_INIT_MATCHERS);
 }
 /**
- * Shared body of both classifiers: walk the `cause` chain, let
- * {@link reportsIndeterminateCommit} veto it, then ask `matchers`. The veto runs BEFORE any
- * matcher for every policy — a chain reporting a commit-phase batch is never retried, however
- * transient some other level looks.
+ * Shared body of both classifiers: walk the `cause` chain, let {@link reportsPossiblyStoredWrite}
+ * and then {@link reportsIndeterminateCommit} veto it, then claim a final torn write
+ * ({@link isFinalTornWrite}), then ask `matchers`. The vetoes run BEFORE any matcher for every
+ * policy — a chain reporting a possibly-stored write or a commit-phase batch is never retried,
+ * however transient some other level looks, and a final torn write carried by a partial commit is
+ * still declined because a sibling collection landed.
  */
-function matchesRetriableMessage(error, matchers) {
+function matchesRetriableFailure(error, matchers) {
     if (!(error instanceof Error)) {
         return false;
     }
+    const links = causeChain(error);
+    if (reportsPossiblyStoredWrite(links)) {
+        return false;
+    }
     const messages = chainMessages(error);
     if (reportsIndeterminateCommit(messages)) {
         return false;
     }
+    if (links.some(isFinalTornWrite)) {
+        return true;
+    }
     return messages.some(message => matchers.some(matches => matches(message)));
 }
 /**
@@ -326,6 +456,15 @@ export const SCHEMA_INIT_RETRY_POLICY = {
  * On exhaustion (attempts or budget) the LAST error is rethrown unchanged — never wrapped,
  * so the exact messages downstream code and the degraded-cohort-member scenario assert on
  * survive. A non-retriable failure propagates from the attempt that raised it.
+ *
+ * Either way — declined or exhausted — an `options.onAbandon` observer is notified exactly
+ * once before the rethrow (a `ControlRetryAbandonment`). Only WRITES pass one: an abandoned
+ * read throws to a caller that is awaiting it, so nothing is lost silently there
+ * (`control-read-retry.ts` says so at its own seam), while an abandoned write may have no
+ * caller at all — a background self-record republish is `void`-ed with a `debug` catch, so
+ * its failure reaches nobody unless something is listening here.
+ * `ControlDatabase.setControlWriteAbandonedListener` is the only thing that passes one in
+ * production; `retryControlWrite` itself neither supplies nor requires an observer.
  */
 export function retryControlWrite(attempt, options = {}) {
     return retryControlOperation(attempt, {

package/dist/control-write-retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-write-retry.js","sourceRoot":"","sources":["../src/control-write-retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAM,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,CAAC,GAAG,EAAE,IAAK,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,IAAK,CAAC,CAAC;AAEhF,+FAA+F;AAC/F,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAE3C;;;GAGG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,mCAAmC,GACxC,+EAA+E,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC/D,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,0BAA0B,CAAC,QAA2B;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,mFAAmF;AACnF,SAAS,kCAAkC,CAAC,OAAe;IAC1D,OAAO,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,+BAA+B,GACpC,0FAA0F,CAAC;AAE5F,wFAAwF;AACxF,SAAS,8BAA8B,CAAC,OAAe;IACtD,OAAO,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAA8C;IACnF,gCAAgC;IAChC,kCAAkC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,8BAA8B,GAA8C;IACjF,GAAG,gCAAgC;IACnC,8BAA8B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,uBAAuB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,OAAO,uBAAuB,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC/B,KAAc,EACd,QAAmD;IAEnD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAcD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,4BAA4B;CACzC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAChC,OAAyB,EACzB,UAAoC,EAAE;IAEtC,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,6BAA6B;QACvC,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EAAE,8BAA8B;QAC3C,4EAA4E;QAC5E,mDAAmD;QACnD,SAAS,EAAE,eAAe;KAC1B,EAAE,OAAO,CAAC,CAAC;AACb,CAAC"}
+{"version":3,"file":"control-write-retry.js","sourceRoot":"","sources":["../src/control-write-retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAM,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,CAAC,GAAG,EAAE,IAAK,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,IAAK,CAAC,CAAC;AAEhF,+FAA+F;AAC/F,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAE3C;;;GAGG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,MAAM,mCAAmC,GACxC,+EAA+E,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC/D,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,0BAA0B,CAAC,QAA2B;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,0BAA0B,CAAC,KAAuB;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxB,IAAI,YAAY,uBAAuB;WACpC,CAAC,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;WACxD,IAAI,YAAY,6BAA6B;WAC7C,IAAI,YAAY,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CAAC,IAAW;IACpC,OAAO,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED,mFAAmF;AACnF,SAAS,kCAAkC,CAAC,OAAe;IAC1D,OAAO,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,+BAA+B,GACpC,0FAA0F,CAAC;AAE5F,wFAAwF;AACxF,SAAS,8BAA8B,CAAC,OAAe;IACtD,OAAO,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAA8C;IACnF,gCAAgC;IAChC,kCAAkC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,8BAA8B,GAA8C;IACjF,GAAG,gCAAgC;IACnC,8BAA8B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,uBAAuB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,OAAO,uBAAuB,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAC/B,KAAc,EACd,QAAmD;IAEnD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAcD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,4BAA4B;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAChC,OAAyB,EACzB,UAAoC,EAAE;IAEtC,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,6BAA6B;QACvC,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EAAE,8BAA8B;QAC3C,4EAA4E;QAC5E,mDAAmD;QACnD,SAAS,EAAE,eAAe;KAC1B,EAAE,OAAO,CAAC,CAAC;AACb,CAAC"}

package/dist/enrolled-machine-store.js

@@ -41,8 +41,8 @@
  * `Memory*` / `Persistent*` / `File*` split, same party scoping. It does NOT share
  * their `NodeLocalSnapshot` machinery, for two reasons:
  *
- *  - **Shape.** `NodeLocalSnapshot` is a `key -> entry` map with no delete. This
- *    record is one integer that must be able to go DOWN after a machine is removed.
+ *  - **Shape.** `NodeLocalSnapshot` is a `key -> entry` map. This record is one
+ *    integer that must be able to go DOWN after a machine is removed.
  *  - **Load policy — the important one.** `NodeLocalSnapshot.open` THROWS when the
  *    slot is present but unreadable. That is right for the anchor (a record that
  *    cannot be read in full is not a trust anchor) and right for the peer store (a

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 export * from './types.js';
 export { canonicalJson } from './canonical-json.js';
 export { CadreNode } from './cadre-node.js';
-export { ControlDatabase, MissingHostStrandError, buildAuthorizationMessage, formationVouchMessage, formationConsentMessage, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type MembershipChangeListener, type GuardedDeleteListener, type RevokedRowRef } from './control-database.js';
+export { ControlDatabase, MissingHostStrandError, buildAuthorizationMessage, formationVouchMessage, formationConsentMessage, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type MembershipChangeListener, type GuardedDeleteListener, type ControlWriteAbandonedListener, type RevokedRowRef } from './control-database.js';
 export { CONTROL_WRITE_ATTEMPTS, CONTROL_WRITE_RETRY_BUDGET_MS, SCHEMA_INIT_ATTEMPTS, SCHEMA_INIT_RETRY_POLICY, isRetriableControlWriteFailure, isRetriableSchemaInitFailure, retryControlWrite, type ControlWriteRetryOptions } from './control-write-retry.js';
 export { CONTROL_READ_ATTEMPTS, CONTROL_READ_RETRY_DELAYS_MS, CONTROL_READ_RETRY_BUDGET_MS, isRetriableControlReadFailure, retryControlRead, type ControlReadRetryOptions } from './control-read-retry.js';
+export type { ControlRetryAbandonment, ControlRetryAbandonReason, ControlRetryAbandonListener } from './control-retry.js';
 export { controlAuthorizationFields, type ControlDomain, type ControlAction } from './control-authorization.js';
 export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
 export { InMemoryKeyStore, KeyStoreAccessError, DEFAULT_IDENTITY_KEY_ID, type KeyStore, type KeyId } from './key-store.js';
@@ -12,11 +13,15 @@ export { MemoryTrustedOwnerStore, PersistentTrustedOwnerStore, type TrustedOwner
 export type { DurableSlot } from './node-local-snapshot.js';
 export { MemoryBootstrapPeerStore, PersistentBootstrapPeerStore, type BootstrapPeerStore, type BootstrapPeerEntry } from './bootstrap-peer-store.js';
 export { MemoryEnrolledMachineStore, PersistentEnrolledMachineStore, type EnrolledMachineStore } from './enrolled-machine-store.js';
+export { controlStorageScope, isControlStorageScope } from './storage-scope.js';
 export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js';
 export { StrandWatcher, type StrandWatcherCallbacks, type StrandQueryable, type SAppIdLookup, type StrandRowWithApp } from './strand-watcher.js';
-export { StrandInstanceManager, type StartStrandConfig, type ResumeStrandOverrides, getStrandStoragePath } from './strand-instance-manager.js';
+export { StrandInstanceManager, type StartStrandConfig, type ResumeStrandOverrides, getStrandStoragePath, isAwaitingFirstSync, liveStrandStatus } from './strand-instance-manager.js';
+export { StrandAwaitingFirstSyncError, DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS, DEFAULT_STRAND_FIRST_SYNC_POLL_MS, strandHeaderHeld, appTablesReadable, strandFirstSyncComplete, type StrandFirstSyncConfig } from './strand-first-sync-gate.js';
 export { PeerJoinBackfill, DEFAULT_PEER_JOIN_BACKFILL, MAX_BLOCK_MESSAGE_BYTES, type PeerJoinBackfillConfig, type PeerJoinBackfillDeps, type PeerJoinBackfillResult, type PeerJoinBackfillPushClient } from './peer-join-backfill.js';
 export { StrandRevocationEnforcer, createRevocationConnectionGater, readStrandRevocationRows, DEFAULT_REVOCATION_POLL_INTERVAL_MS, type StrandRevocationEnforcementConfig, type StrandRevocationEnforcerDeps, type StrandRevocationRows, type StrandMemberPeerBinding, type StrandRevocationJudge, type StrandRevocationNetwork, type RevocationRefreshScheduler } from './strand-revocation-enforcer.js';
+export { StrandMembershipReconciler, IDLE_PASSES_BEFORE_ESCALATION, INITIAL_JOIN_RETRY_INTERVAL_MS, type StrandMembershipReconcilerDeps, type StrandMembershipReconciliationConfig, type PendingMembershipInviteSource } from './strand-membership-reconciler.js';
+export { defaultTimeoutScheduler, type TimeoutScheduler } from './timeout-scheduler.js';
 export { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
 export { ArachnodeStub, createArachnodeStub, type RingConfig } from './arachnode-stub.js';
 export { EnrollmentService, type MemberVerifier, type MemberRegistry } from './enrollment.js';
@@ -24,7 +29,7 @@ export { StrandSolicitationService, createDefaultFormationResponseValidator, typ
 export { createHttpFormationApprover, signFormationApproval, verifyFormationApproval, FormationApprovalError, type FormationApprovalRequest, type FormationVouchFields, type FormationApproval, type FormationApprover, type FormationApprovalFailure } from './formation-approval.js';
 export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
 export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
-export { signStrandPayload, verifyStrandPayload, signStrandApproval, generateStrandStampId, bootstrapFounderMembership, issueInvite, consumeInvite, cancelInvite, listOutstandingInvites, addMemberByManager, revokeMember, leaveStrand, registerMemberPeer, listMemberPeers, removeMemberPeer, addManager, admitManager, removeManager, sealStrand, isStrandSealed, STRAND_ENGINE, STRAND_ENGINE_VERSION, type FounderBootstrapParams, type IssueInviteParams, type IssuedInvite, type ConsumeInviteParams, type CancelInviteParams, type OutstandingInvite, type AddMemberByManagerParams, type RevokeMemberParams, type LeaveStrandParams, type RegisterMemberPeerParams, type RemoveOwnPeerParams, type RemoveMemberPeerByManagerParams, type RemoveMemberPeerParams, type AddManagerParams, type AdmitManagerParams, type RemoveManagerParams, type SealStrandParams } from './strand-membership-writer.js';
+export { signStrandPayload, verifyStrandPayload, signStrandApproval, generateStrandStampId, bootstrapFounderMembership, PreSplitStrandIdentityError, issueInvite, consumeInvite, burnInvite, isStrandMember, cancelInvite, listOutstandingInvites, addMemberByManager, revokeMember, leaveStrand, registerMemberPeer, listMemberPeers, removeMemberPeer, addManager, admitManager, removeManager, sealStrand, isStrandSealed, StrandTransactionBusyError, STRAND_ENGINE, STRAND_ENGINE_VERSION, type FounderBootstrapParams, type IssueInviteParams, type IssuedInvite, type ConsumeInviteParams, type CancelInviteParams, type OutstandingInvite, type AddMemberByManagerParams, type RevokeMemberParams, type LeaveStrandParams, type RegisterMemberPeerParams, type RemoveOwnPeerParams, type RemoveMemberPeerByManagerParams, type RemoveMemberPeerParams, type AddManagerParams, type AdmitManagerParams, type RemoveManagerParams, type SealStrandParams, type StrandWriteOptions } from './strand-membership-writer.js';
 export { canonicalDatetime } from './canonical-datetime.js';
 export { StrandMemberRegistry, StrandMemberVerifier, memberRegistrationPayload, type StrandAdmission } from './strand-member-registry.js';
 export { SeedBootstrapService, SEED_PROTOCOL, ed25519PublicKeyB64FromPeerId, type SeedBootstrapConfig, type SeedEventCallbacks } from './seed-bootstrap.js';
@@ -37,12 +42,14 @@ export { STRAND_WAKE_TYPE, type StrandWakePayload } from './strand-wake-payload.
 export type { PushNotifier, PushMessage, PushSendResult } from './push-notifier.js';
 export { validatePushCredentials, redactPushCredentials, REDACTED } from './push-credentials.js';
 export { PushFanoutService, DEFAULT_PUSH_COOLDOWN_MS, DEFAULT_PUSH_DEBOUNCE_MS, type PushFanoutOptions, type FanoutMember } from './push-fanout.js';
-export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE, type ControlCohortSelection } from './control-cohort.js';
+export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE, type ControlCohortSelection, type ControlCohortReconcileResult } from './control-cohort.js';
+export { dialPeerAddrs, tryAddrsInTurn, directBeforeRelayed, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS, DEFAULT_PEER_DIAL_BUDGET, type PeerDialBudget, type AddrDialer } from './peer-dial.js';
 export { anchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy, type SeedTrustPolicy, type SeedTrustContext, type SeedTrustDecision } from './seed-trust-policy.js';
 export { signSchema, verifySchema, assertSchemaSignature, SchemaVerificationError } from './schema-verification.js';
-export { FormationListener, dialFormation, isValidResponderCreatesResult, sanitizeStrandAddrs, FORMATION_PROTOCOL, type FormationParty, type FormationContactMessage, type FormationResultMessage, type FormationProvisionResult, type FormationStrandInfo, type FormationDbConnectionInfo, type FormationListenerOptions, type FormationDialOptions, type FormationDialResult, type ResponderProvisionOutcome } from './strand-formation-protocol.js';
-export { StrandFormationManager, createStrandFormationManager, type StrandFormationManagerConfig, type StrandFormationManagerOptions } from './strand-formation-manager.js';
+export { FormationListener, dialFormation, isValidResponderCreatesResult, isWellFormedMembershipInvite, sanitizeStrandAddrs, FORMATION_PROTOCOL, type FormationParty, type FormationContactMessage, type FormationResultMessage, type FormationProvisionResult, type FormationStrandInfo, type FormationDbConnectionInfo, type FormationListenerOptions, type FormationDialOptions, type FormationDialResult, type ResponderProvisionOutcome } from './strand-formation-protocol.js';
+export { StrandFormationManager, createStrandFormationManager, MEMBERSHIP_INVITE_TTL_MS, MEMBERSHIP_INVITE_UNAVAILABLE_REASON, HOST_STRAND_MUST_BE_RECREATED_REASON, type StrandFormationManagerConfig, type StrandFormationManagerOptions } from './strand-formation-manager.js';
 export { createMembershipConnectionGater, STRANGER_OPEN_PROTOCOLS, DEFAULT_ENROLLMENT_WINDOW_MS, ADMISSION_DECISION_TIMEOUT_MS, RELAY_ADMISSION_RESERVE_DEADLINE_MS, MAX_UNAUTHORIZED_RELAY_RESERVATIONS, UNAUTHORIZED_RESERVATION_TTL_MS, UnauthorizedReservationBudget, type InboundAdmissionPolicy, type InboundConnectionVerdict } from './membership-connection-gater.js';
-export { RelayReservationFailedError, UnbindableListenAddressError, RELAY_SEARCH_LISTEN_ADDR } from './relay-addrs.js';
+export { RelayReservationFailedError, UnbindableListenAddressError, RELAY_SEARCH_LISTEN_ADDR, resolveListenAddrs } from './relay-addrs.js';
+export { strandNodeAddrs, type StrandNodeAddrs } from './strand-network-config.js';
 export { circuitMultiaddrs, superviseRelayReservation, DEFAULT_RELAY_RESERVE_TIMEOUT_MS, DEFAULT_RELAY_RESERVE_POLL_MS, DEFAULT_RELAY_CHECK_MS, DEFAULT_RELAY_MIN_BACKOFF_MS, DEFAULT_RELAY_MAX_BACKOFF_MS, type RelayReservationStatus, type RelayReservationState, type RelayReserveOptions, type RelayReservationSupervisor, type RelayReservationSupervisorOptions } from './relay-reservation.js';
 export { classifyTransport, classifyConnectionPath, summarizeConnectionPaths, emptyConnectionPathSummary, DEFAULT_SETTLE_WINDOW_MS, type ConnectionPathKind, type ConnectionTransport, type ConnectionPath, type ConnectionPathSummary, type ConnectionLike } from './diagnostics/connection-path.js';

package/dist/index.js

@@ -49,11 +49,19 @@ export { MemoryBootstrapPeerStore, PersistentBootstrapPeerStore } from './bootst
 // DIVERGES from theirs (an unreadable slot cold-starts rather than throwing) —
 // see the module comment before unifying the three.
 export { MemoryEnrolledMachineStore, PersistentEnrolledMachineStore } from './enrolled-machine-store.js';
+// Storage scope keys — what `CadreNodeConfig.storage.provider` is called with. A
+// strand's key is its strand id; the control database's key carries the party id,
+// so two parties on one device never share a control store.
+export { controlStorageScope, isControlStorageScope } from './storage-scope.js';
 // Strand database
 export { StrandDatabase } from './strand-database.js';
 // Strand management
 export { StrandWatcher } from './strand-watcher.js';
-export { StrandInstanceManager, getStrandStoragePath } from './strand-instance-manager.js';
+export { StrandInstanceManager, getStrandStoragePath, isAwaitingFirstSync, liveStrandStatus } from './strand-instance-manager.js';
+// The joining machine's first-sync write gate: a non-founder launch withholds its
+// database (status 'syncing') until the strand's Header has arrived from a peer, so a
+// write before the first sync can never fork the strand's tables.
+export { StrandAwaitingFirstSyncError, DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS, DEFAULT_STRAND_FIRST_SYNC_POLL_MS, strandHeaderHeld, appTablesReadable, strandFirstSyncComplete } from './strand-first-sync-gate.js';
 // Peer-join block catch-up (push this network's own blocks to each newly
 // connected peer, so a late joiner physically holds pre-join blocks). Shared
 // by the strand networks (ungated) and the control network (membership-gated).
@@ -63,6 +71,14 @@ export { PeerJoinBackfill, DEFAULT_PEER_JOIN_BACKFILL, MAX_BLOCK_MESSAGE_BYTES }
 // already hold — see the module doc for the settled deny-list design, the
 // teardown seam, and the fail directions).
 export { StrandRevocationEnforcer, createRevocationConnectionGater, readStrandRevocationRows, DEFAULT_REVOCATION_POLL_INTERVAL_MS } from './strand-revocation-enforcer.js';
+// Closed-strand membership reconciliation: the bring-up loop that finishes a
+// party's join on every machine — redeem the staged formation invitation, then
+// write the durable machine→party MemberPeer binding — without ever blocking
+// bring-up (see the module doc for the pass ladder and terminal states).
+export { StrandMembershipReconciler, IDLE_PASSES_BEFORE_ESCALATION, INITIAL_JOIN_RETRY_INTERVAL_MS } from './strand-membership-reconciler.js';
+// The timer seam the self-rescheduling strand bring-up loops share (first-sync gate
+// probe loop, membership retry ladder) — injected by tests as a hand-cranked clock.
+export { defaultTimeoutScheduler } from './timeout-scheduler.js';
 // Hibernation
 export { HibernationManager } from './hibernation-manager.js';
 // Arachnode (stub)
@@ -83,7 +99,7 @@ export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-ke
 // manager-admit, member-peer registration, manager rotation, sealing — the sole
 // manager permanently freezing admission — + shared signing primitives reused
 // across the flows).
-export { signStrandPayload, verifyStrandPayload, signStrandApproval, generateStrandStampId, bootstrapFounderMembership, issueInvite, consumeInvite, cancelInvite, listOutstandingInvites, addMemberByManager, revokeMember, leaveStrand, registerMemberPeer, listMemberPeers, removeMemberPeer, addManager, admitManager, removeManager, sealStrand, isStrandSealed, STRAND_ENGINE, STRAND_ENGINE_VERSION } from './strand-membership-writer.js';
+export { signStrandPayload, verifyStrandPayload, signStrandApproval, generateStrandStampId, bootstrapFounderMembership, PreSplitStrandIdentityError, issueInvite, consumeInvite, burnInvite, isStrandMember, cancelInvite, listOutstandingInvites, addMemberByManager, revokeMember, leaveStrand, registerMemberPeer, listMemberPeers, removeMemberPeer, addManager, admitManager, removeManager, sealStrand, isStrandSealed, StrandTransactionBusyError, STRAND_ENGINE, STRAND_ENGINE_VERSION } from './strand-membership-writer.js';
 // Engine-canonical datetime helper (shared by control + strand signed-write flows
 // so a signed timestamp byte-matches the datetime-coerced column the CHECK sees).
 export { canonicalDatetime } from './canonical-datetime.js';
@@ -115,15 +131,18 @@ export { validatePushCredentials, redactPushCredentials, REDACTED } from './push
 export { PushFanoutService, DEFAULT_PUSH_COOLDOWN_MS, DEFAULT_PUSH_DEBOUNCE_MS } from './push-fanout.js';
 // Control-cohort dial selection (backbone-preferential, bounded out-degree) +
 // the cadence/degree defaults the proactive reconcile routine reads.
-export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
+export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
+// Dialing one peer from several candidate addresses, each under its own time
+// limit, so an address that never answers cannot starve the rest.
+export { dialPeerAddrs, tryAddrsInTurn, directBeforeRelayed, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS, DEFAULT_PEER_DIAL_BUDGET } from './peer-dial.js';
 // Seed trust policy (trust anchor for incoming seeds)
 export { anchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy } from './seed-trust-policy.js';
 // Schema Verification
 export { signSchema, verifySchema, assertSchemaSignature, SchemaVerificationError } from './schema-verification.js';
 // Strand Formation transport (native cadre-core protocol)
-export { FormationListener, dialFormation, isValidResponderCreatesResult, sanitizeStrandAddrs, FORMATION_PROTOCOL } from './strand-formation-protocol.js';
+export { FormationListener, dialFormation, isValidResponderCreatesResult, isWellFormedMembershipInvite, sanitizeStrandAddrs, FORMATION_PROTOCOL } from './strand-formation-protocol.js';
 // Strand Formation manager (drives the native transport)
-export { StrandFormationManager, createStrandFormationManager } from './strand-formation-manager.js';
+export { StrandFormationManager, createStrandFormationManager, MEMBERSHIP_INVITE_TTL_MS, MEMBERSHIP_INVITE_UNAVAILABLE_REASON, HOST_STRAND_MUST_BE_RECREATED_REASON } from './strand-formation-manager.js';
 // Control-network inbound connection gate (membership defense-in-depth)
 export { createMembershipConnectionGater, STRANGER_OPEN_PROTOCOLS, DEFAULT_ENROLLMENT_WINDOW_MS, ADMISSION_DECISION_TIMEOUT_MS, RELAY_ADMISSION_RESERVE_DEADLINE_MS, MAX_UNAUTHORIZED_RELAY_RESERVATIONS, UNAUTHORIZED_RESERVATION_TTL_MS, UnauthorizedReservationBudget } from './membership-connection-gater.js';
 // Thrown out of `CadreNode.start()` when a `network.relayAddrs` reservation does
@@ -132,7 +151,15 @@ export { createMembershipConnectionGater, STRANGER_OPEN_PROTOCOLS, DEFAULT_ENROL
 // `UnbindableListenAddressError` is the same posture for the OTHER half of the listen
 // config: a `network.listenAddrs` entry whose transport the node will not have refuses
 // start instead of being silently dropped by libp2p's transport manager.
-export { RelayReservationFailedError, UnbindableListenAddressError, RELAY_SEARCH_LISTEN_ADDR } from './relay-addrs.js';
+//
+// `resolveListenAddrs` and `strandNodeAddrs` are the derivations themselves — what a
+// `NetworkConfig` actually turns into for the control node and for each strand node.
+// Exported so an embedder that hand-writes a `network` block (the React Native and web
+// reference apps) can assert on the resulting SHAPE rather than on its own field names,
+// which is the difference between a test that proves reachability and one that proves a
+// spelling.
+export { RelayReservationFailedError, UnbindableListenAddressError, RELAY_SEARCH_LISTEN_ADDR, resolveListenAddrs } from './relay-addrs.js';
+export { strandNodeAddrs } from './strand-network-config.js';
 // Relay reservation via the bare `/p2p-circuit` search listener — the one route
 // every control node takes; `network.relayAddrs` is its fail-fast posture
 // (see relay-reservation.ts)