@serfab/cadre-core 0.9.0 → 0.10.0

package/dist/strand-formation-protocol.js

@@ -20,16 +20,86 @@
 import debug from 'debug';
 import { multiaddr } from '@multiformats/multiaddr';
 import { writeFrame, withTimeout } from './control-stream.js';
+import { canonicalJson } from './canonical-json.js';
+import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { verifyFormationConsent } from './peer-authorization.js';
+// seed-bootstrap imports neither this protocol nor the manager/solicitation layers,
+// so this import introduces no cycle.
+import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
 const log = debug('sereus:cadre:formation-proto');
 /** Protocol id for the native formation transport (parallel to `/sereus/seed/1.0.0`). */
 export const FORMATION_PROTOCOL = '/sereus/formation/1.0.0';
+/**
+ * Rejection reason for an invitation that cannot be redeemed at all — unknown, expired, or
+ * fully spent. Shared with `StrandFormationManager`, which reports an
+ * `InvitationExhaustedError` (an invite spent out from under a redemption already in flight)
+ * with this SAME wording on purpose: a joiner that lost the race must be indistinguishable
+ * from a non-racing latecomer, so the two sites must never drift apart.
+ */
+export const INVALID_TOKEN_REASON = 'Invalid token';
 /** Maximum formation message size (1MB). */
 const MAX_FORMATION_MSG_SIZE = 1024 * 1024;
 /** Default whole-session timeout (ms). */
 const DEFAULT_SESSION_TIMEOUT_MS = 30000;
 /** Default per-step (single read/write) timeout (ms). */
 const DEFAULT_STEP_TIMEOUT_MS = 5000;
-/** Default cap on concurrent inbound formation sessions. */
+/**
+ * Default provisioning budget (ms) — distinct from {@link DEFAULT_STEP_TIMEOUT_MS} because
+ * `provisionStrand` is real work (DB writes, and an outbound approval-hook HTTP call when
+ * the invite carries a `ValidationUrl`), not a bare wire read/write.
+ *
+ * Ordering is deliberate — each layer must be able to fail and report before the layer above
+ * it gives up:
+ *
+ *   approval hook (10 s, `formation-approval.ts`)
+ *     < responder provisioning (12 s)
+ *     < initiator await-response (15 s)
+ *     < session (30 s)
+ *
+ * The 3 s margin between responder provisioning and initiator await-response is the wire
+ * latency budget for the result frame to travel back.
+ *
+ * The last {@link PROVISION_SETTLE_GRACE_MS} of this budget is a settle grace, so the default
+ * WORK budget (12 s − 2 s = 10 s) EQUALS the hook's own 10 s: a dead hook races 'Formation
+ * approval unavailable, retry' against 'Formation provisioning timed out'. Both are retryable
+ * and both leave the invite unspent, so the race is benign.
+ */
+const DEFAULT_PROVISION_TIMEOUT_MS = 12000;
+/**
+ * Settle grace (ms), carved OUT of `provisionTimeoutMs` — never added on top, so the budget
+ * ladder above is untouched. The listener aborts the provisioning hook when the work budget
+ * ({@link splitProvisionBudget}) expires, then waits up to this grace for the work to settle
+ * anyway: once the `FormationUsage` insert has been issued nothing can un-spend it (the table
+ * is append-only), so a provisioning that lands late is ADOPTED and reported as a real
+ * approval rather than lying "timed out" over a spent invite. A hook that observes the
+ * abort before writing leaves the invite unspent.
+ */
+const PROVISION_SETTLE_GRACE_MS = 2000;
+/**
+ * Wire-latency margin (ms) added to the responder's provisioning budget to get the
+ * initiator's await-response budget — the travel time for the result frame to come back
+ * after the responder finishes (see {@link DEFAULT_PROVISION_TIMEOUT_MS}).
+ * `StrandFormationManager` reuses this constant so a CONFIGURED budget preserves the same
+ * margin the defaults do, instead of applying the same number to both sides and racing the
+ * initiator's own timeout against the responder's clean rejection reply. The responder's
+ * clamp ({@link provisionCeilingMs}) holds the same margin back, so the ordering survives a
+ * budget large enough that BOTH roles get clamped.
+ *
+ * NOTE: 3 s is a fixed assumption about how long the result frame takes to travel back. If
+ * formation ever runs over paths where that frame can take longer (a slow circuit relay, a
+ * congested mobile link), the margin is too thin and the initiator's timeout races the
+ * responder's reply again — raise it, or derive it from an observed round-trip.
+ */
+export const PROVISION_RESPONSE_TRAVEL_MARGIN_MS = 3000;
+/** Default initiator await-response budget (ms); see {@link DEFAULT_PROVISION_TIMEOUT_MS}. */
+const DEFAULT_INITIATOR_PROVISION_TIMEOUT_MS = DEFAULT_PROVISION_TIMEOUT_MS + PROVISION_RESPONSE_TRAVEL_MARGIN_MS;
+/**
+ * Default cap on concurrent inbound formation sessions.
+ * NOTE: a longer provisioning budget holds a session's slot longer, so a slow hook can
+ * exhaust this cap and make the listener reject fresh joiners with 'Too many concurrent
+ * formation sessions'. Fine at the current default; revisit if `provisionTimeoutMs` is
+ * raised well above its default or this cap is lowered.
+ */
 const DEFAULT_MAX_CONCURRENT_SESSIONS = 100;
 // ── Stream framing helpers ───────────────────────────────────────────────────
 /**
@@ -114,6 +184,49 @@ export function isValidResponderCreatesResult(response) {
         return false;
     return true;
 }
+/**
+ * Ceiling for a resolved provisioning budget.
+ *
+ * The session budget also has to cover the wire step that PRECEDES provisioning (the
+ * responder's contact read, the initiator's dial-connect), so a whole step is held back
+ * rather than triggering only on a literal overrun.
+ *
+ * `reserveMs` is the EXTRA room only the responder holds back, so its own budget still
+ * lands strictly before the initiator's larger await-response budget even when both are
+ * clamped — without it, any configured budget at or above `sessionTimeoutMs -
+ * stepTimeoutMs` clamps both roles onto the same number and the responder's clean
+ * rejection races the initiator's timeout again. Capped at half the remaining room (like
+ * {@link splitProvisionBudget}) so a small session config still spends most of it working.
+ */
+function provisionCeilingMs(sessionTimeoutMs, stepTimeoutMs, reserveMs) {
+    const roomMs = sessionTimeoutMs - stepTimeoutMs;
+    return Math.max(1, roomMs - Math.min(reserveMs, Math.floor(roomMs / 2)));
+}
+/**
+ * Resolve a caller-supplied provisioning budget: `0`/negative means "unset" (use
+ * `defaultMs`). If the result would let provisioning outlive the session — no result
+ * frame is ever sent, exactly the failure this budget exists to prevent — clamp it to
+ * {@link provisionCeilingMs} and log a warning.
+ */
+function resolveProvisionTimeoutMs(configured, defaultMs, sessionTimeoutMs, stepTimeoutMs, role, reserveMs = 0) {
+    const requested = configured && configured > 0 ? configured : defaultMs;
+    const ceilingMs = provisionCeilingMs(sessionTimeoutMs, stepTimeoutMs, reserveMs);
+    if (requested >= ceilingMs) {
+        log('%s provisionTimeoutMs %dms leaves no room under sessionTimeoutMs %dms (step %dms, reserve %dms); clamping to %dms', role, requested, sessionTimeoutMs, stepTimeoutMs, reserveMs, ceilingMs);
+        return ceilingMs;
+    }
+    return requested;
+}
+/**
+ * Split a resolved provisioning budget into the WORK budget and the trailing settle grace.
+ *
+ * The grace is carved OUT of the budget (see {@link PROVISION_SETTLE_GRACE_MS}), and capped at
+ * half of it so a small configured budget still spends at least half its time doing work.
+ */
+function splitProvisionBudget(provisionTimeoutMs) {
+    const graceMs = Math.min(PROVISION_SETTLE_GRACE_MS, Math.floor(provisionTimeoutMs / 2));
+    return { workMs: provisionTimeoutMs - graceMs, graceMs };
+}
 /**
  * Responder side of the native formation protocol. Registers a libp2p handler and
  * drives each inbound stream through token + disclosure validation, provisioning,
@@ -128,6 +241,9 @@ export class FormationListener {
         this.options = options;
         this.sessionTimeoutMs = options.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;
         this.stepTimeoutMs = options.stepTimeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
+        const split = splitProvisionBudget(resolveProvisionTimeoutMs(options.provisionTimeoutMs, DEFAULT_PROVISION_TIMEOUT_MS, this.sessionTimeoutMs, this.stepTimeoutMs, 'FormationListener', PROVISION_RESPONSE_TRAVEL_MARGIN_MS));
+        this.provisionWorkMs = split.workMs;
+        this.provisionGraceMs = split.graceMs;
         this.maxConcurrentSessions = options.maxConcurrentSessions ?? DEFAULT_MAX_CONCURRENT_SESSIONS;
     }
     /** Number of in-flight inbound sessions. */
@@ -181,6 +297,107 @@ export class FormationListener {
             catch { /* ignore */ }
         }
     }
+    /**
+     * Run the provisioning hook under its WORK budget — the configured provisioning budget minus
+     * the trailing settle grace ({@link splitProvisionBudget}, {@link PROVISION_SETTLE_GRACE_MS}).
+     *
+     * When the work budget expires the hook's signal is aborted, then
+     * {@link settleWithinGrace} waits out the grace for the aborted work to settle anyway.
+     * Returns `undefined` for "timed out" — which the caller turns into a retryable rejection
+     * frame — and rethrows every other failure so it reaches the internal-error path.
+     *
+     * Deliberately not `withDeadline`: that exposes neither the timed-out flag nor the signal
+     * outside its `op`, and both are needed here.
+     */
+    async provision(id, contact) {
+        const controller = new AbortController();
+        let timedOut = false;
+        const pending = this.options.provisionStrand(contact, controller.signal);
+        try {
+            return await withTimeout(this.provisionWorkMs, `Formation provisioning#${id}`, () => pending, () => { timedOut = true; controller.abort(); });
+        }
+        catch (err) {
+            if (!timedOut)
+                throw err;
+            log('formation session #%d provisioning work budget expired after %dms; aborted, settling up to %dms', id, this.provisionWorkMs, this.provisionGraceMs);
+            return await this.settleWithinGrace(id, pending);
+        }
+    }
+    /**
+     * Wait out the settle grace for an ABORTED provisioning, adopting a late success.
+     *
+     * A hook that observed the abort before issuing its `FormationUsage` insert rejects (with
+     * `FormationAbortedError`) and leaves the invite unspent → reported as a timeout. A hook
+     * that had already written cannot be un-written (the table is append-only), so if it lands
+     * inside the grace its outcome is ADOPTED — the joiner is told the truth (approved, or the
+     * hook's own rejection reason) rather than "timed out" over a spent invite.
+     *
+     * NOTE: one window stays open — a work budget that expires after the `FormationUsage`
+     * insert was issued AND a commit that outlasts the grace. The joiner is told 'timed out'
+     * while its one-time invite is in fact spent, and since every retry mints a fresh keypair
+     * no recovery path can match it. Nothing can un-spend an append-only row, so the late-settle
+     * logging below is the observability for it; widen the grace only if it is seen in the wild.
+     */
+    async settleWithinGrace(id, pending) {
+        let stillPending = false;
+        try {
+            const outcome = await withTimeout(this.provisionGraceMs, `Formation settle#${id}`, () => pending, () => { stillPending = true; });
+            log('formation session #%d provisioning settled within its grace: approved=%s — adopting', id, outcome.approved);
+            return outcome;
+        }
+        catch (err) {
+            if (!stillPending) {
+                log('formation session #%d provisioning failed after its abort: %o', id, err);
+                return undefined;
+            }
+            log('formation session #%d provisioning still pending after its %dms grace', id, this.provisionGraceMs);
+            // Log how it eventually settled so a late failure is not swallowed by the two
+            // abandoned `withTimeout` calls.
+            void pending.then((late) => log('formation session #%d provisioning settled after its grace: approved=%s', id, late.approved), (err2) => log('formation session #%d provisioning failed after its grace: %o', id, err2));
+            return undefined;
+        }
+    }
+    /**
+     * Joiner-consent pre-check — the legibility twin of the schema's
+     * `FormationUsage.PeerConsented` CHECK, exactly as `verifyFormationApproval` is for the
+     * approver's vouch. The database constraint stays the authority; this turns a bad consent
+     * into a clean 'Invalid joiner consent' rejection instead of an opaque CHECK failure at
+     * commit. Runs BEFORE token/disclosure validation: it is the cheapest check (pure local
+     * crypto, no DB read) and a rejection discloses nothing.
+     *
+     * Also pins `partyId` to `peerKey`: an ed25519 peer id is an identity multihash of the
+     * very key, and this is the ONLY layer that can check the match — SQL cannot unwrap a
+     * multihash, and `partyId` itself is never stored.
+     */
+    isJoinerConsentValid(id, contact) {
+        try {
+            requireEd25519PublicKeyB64(contact.peerKey, 'joiner peer key');
+        }
+        catch {
+            // Deliberately not rethrown or echoed: the helper's error message embeds the whole
+            // rejected value, and this one arrived from a remote peer (the cap-the-echo case its
+            // own NOTE warns about). Log without the raw value instead.
+            log('formation session #%d: joiner peer key is not a base64url ed25519 public key', id);
+            return false;
+        }
+        const embedded = ed25519PublicKeyB64FromPeerId(contact.partyId);
+        if (!embedded || embedded !== contact.peerKey) {
+            log('formation session #%d: partyId does not embed the presented peer key', id);
+            return false;
+        }
+        const consentOk = verifyFormationConsent({
+            token: contact.token,
+            usageStampId: contact.usageStampId,
+            peerKey: contact.peerKey,
+            disclosure: canonicalJson(contact.disclosure),
+            peerSig: contact.peerSignature
+        });
+        if (!consentOk) {
+            log('formation session #%d: joiner consent signature failed verification', id);
+            return false;
+        }
+        return true;
+    }
     async runSession(id, stream) {
         // Track whether ANY frame has been written so the catch below can convert an
         // unexpected internal error into a non-disclosing rejection ONLY when nothing has
@@ -194,9 +411,13 @@ export class FormationListener {
             const reader = new FrameReader(stream);
             const contact = await withTimeout(this.stepTimeoutMs, `Formation await-contact#${id}`, () => reader.read());
             log('formation session #%d contact: token=%s party=%s', id, contact.token, contact.partyId);
+            if (!this.isJoinerConsentValid(id, contact)) {
+                send({ approved: false, reason: 'Invalid joiner consent' });
+                return;
+            }
             const tokenResult = await this.options.validateToken(contact.token);
             if (!tokenResult.valid) {
-                send({ approved: false, reason: 'Invalid token' });
+                send({ approved: false, reason: INVALID_TOKEN_REASON });
                 return;
             }
             const disclosureOk = await this.options.validateDisclosure(contact.token, contact.disclosure);
@@ -204,7 +425,13 @@ export class FormationListener {
                 send({ approved: false, reason: 'Invalid disclosure' });
                 return;
             }
-            const outcome = await this.options.provisionStrand(contact.token, contact.partyId, contact.disclosure);
+            const outcome = await this.provision(id, contact);
+            if (!outcome) {
+                // Reported as its own retryable reason rather than falling through to the generic
+                // catch below, which would report the misleading 'Internal formation error'.
+                send({ approved: false, reason: 'Formation provisioning timed out' });
+                return;
+            }
             if (!outcome.approved) {
                 // A post-validation rejection still discloses NEITHER identity NOR cadre,
                 // exactly like the token/disclosure rejections above.
@@ -250,6 +477,7 @@ export async function dialFormation(node, options) {
     const protocolId = options.protocolId ?? FORMATION_PROTOCOL;
     const sessionTimeoutMs = options.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;
     const stepTimeoutMs = options.stepTimeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
+    const provisionTimeoutMs = resolveProvisionTimeoutMs(options.provisionTimeoutMs, DEFAULT_INITIATOR_PROVISION_TIMEOUT_MS, sessionTimeoutMs, stepTimeoutMs, 'dialFormation');
     const addr = multiaddr(options.responderAddrs[0]);
     return withTimeout(sessionTimeoutMs, 'Formation dial', async () => {
         const rawStream = await withTimeout(stepTimeoutMs, 'Formation dial-connect', async () => node.dialProtocol(addr, protocolId));
@@ -257,7 +485,7 @@ export async function dialFormation(node, options) {
         try {
             const reader = new FrameReader(stream);
             writeFrame(stream, options.contact);
-            const response = await withTimeout(stepTimeoutMs, 'Formation await-response', () => reader.read());
+            const response = await withTimeout(provisionTimeoutMs, 'Formation await-response', () => reader.read());
             if (!response.approved) {
                 throw new Error(`Formation rejected: ${response.reason ?? 'no reason provided'}`);
             }

package/dist/strand-formation-protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-formation-protocol.js","sourceRoot":"","sources":["../src/strand-formation-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAAsB,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElF,MAAM,GAAG,GAAG,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAElD,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,0CAA0C;AAC1C,MAAM,0BAA0B,GAAG,KAAM,CAAC;AAC1C,yDAAyD;AACzD,MAAM,uBAAuB,GAAG,IAAK,CAAC;AACtC,4DAA4D;AAC5D,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAqE5C,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW;IAKf,YAAY,MAAiC,EAAE,SAAS,GAAG,sBAAsB;QAFzE,WAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAGjC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAEO,MAAM,CAAC,KAAiB;QAC9B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,IAAI,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAC;YACvB,MAAM,KAAK,GAAG,KAAK,YAAY,UAAU;gBACvC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAE,KAAoC,CAAC,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,yBAAyB,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;CACF;AAED,gFAAgF;AAEhF,0FAA0F;AAC1F,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAgC;IAC5E,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AA0BD;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IAS5B,YAAY,OAAiC;QAJ5B,eAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,mBAAc,GAAG,CAAC,CAAC;QACnB,mBAAc,GAAG,CAAC,CAAC;QAGzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACtE,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;IAChG,CAAC;IAED,4CAA4C;IAC5C,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,aAAqB,kBAAkB;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,SAAkB,EAAE,WAAoB,EAAE,EAAE;YAC9E,MAAM,IAAI,CAAC,YAAY,CAAC,SAA0B,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,oCAAoC,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAED,UAAU,CAAC,IAAY,EAAE,aAAqB,kBAAkB;QAC9D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACvC,KAAK,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,sCAAsC,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAqB;QAC9C,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtD,MAAM,SAAS,GAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;YAChH,IAAI,CAAC;gBAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAClE,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;QACjC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACzG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,kCAAkC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,MAAqB;QACxD,6EAA6E;QAC7E,kFAAkF;QAClF,mFAAmF;QACnF,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,GAA2B,EAAQ,EAAE;YACjD,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxB,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,2BAA2B,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAA2B,CAAC,CAAC;YACrI,GAAG,CAAC,kDAAkD,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAE5F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9F,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YACvG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,0EAA0E;gBAC1E,sDAAsD;gBACtD,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,gFAAgF;YAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,eAAe,EAAE,OAAO,CAAC,MAAM;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iFAAiF;YACjF,qFAAqF;YACrF,kFAAkF;YAClF,oFAAoF;YACpF,gFAAgF;YAChF,6CAA6C;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;gBACtG,IAAI,CAAC;oBAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAgBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAA6B;IAC7E,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAChF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACvE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAElD,OAAO,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,wBAAwB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9H,MAAM,MAAM,GAAG,SAAqC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;YACvC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAEpC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAA0B,CAAC,CAAC;YAC3H,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAE/D,IAAI,CAAC,QAAQ,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACrG,OAAO,QAAQ,CAAC,eAAe,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"strand-formation-protocol.js","sourceRoot":"","sources":["../src/strand-formation-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAAsB,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,oFAAoF;AACpF,sCAAsC;AACtC,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,GAAG,GAAG,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAElD,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAEpD,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,0CAA0C;AAC1C,MAAM,0BAA0B,GAAG,KAAM,CAAC;AAC1C,yDAAyD;AACzD,MAAM,uBAAuB,GAAG,IAAK,CAAC;AACtC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,4BAA4B,GAAG,KAAM,CAAC;AAC5C;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAG,IAAK,CAAC;AACxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAK,CAAC;AACzD,8FAA8F;AAC9F,MAAM,sCAAsC,GAAG,4BAA4B,GAAG,mCAAmC,CAAC;AAClH;;;;;;GAMG;AACH,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAiF5C,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW;IAKf,YAAY,MAAiC,EAAE,SAAS,GAAG,sBAAsB;QAFzE,WAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAGjC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAEO,MAAM,CAAC,KAAiB;QAC9B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,IAAI,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAC;YACvB,MAAM,KAAK,GAAG,KAAK,YAAY,UAAU;gBACvC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAE,KAAoC,CAAC,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,yBAAyB,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;CACF;AAED,gFAAgF;AAEhF,0FAA0F;AAC1F,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAgC;IAC5E,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,CAAC,SAAS,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAC,gBAAwB,EAAE,aAAqB,EAAE,SAAiB;IAC5F,MAAM,MAAM,GAAG,gBAAgB,GAAG,aAAa,CAAC;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,UAA8B,EAC9B,SAAiB,EACjB,gBAAwB,EACxB,aAAqB,EACrB,IAAY,EACZ,SAAS,GAAG,CAAC;IAEb,MAAM,SAAS,GAAG,UAAU,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACjF,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAC3B,GAAG,CACD,mHAAmH,EACnH,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CACvE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,kBAA0B;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAC3D,CAAC;AAuCD;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IAW5B,YAAY,OAAiC;QAJ5B,eAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,mBAAc,GAAG,CAAC,CAAC;QACnB,mBAAc,GAAG,CAAC,CAAC;QAGzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACtE,MAAM,KAAK,GAAG,oBAAoB,CAAC,yBAAyB,CAC1D,OAAO,CAAC,kBAAkB,EAAE,4BAA4B,EACxD,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,aAAa,EAAE,mBAAmB,EAC9D,mCAAmC,CACpC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC;QACtC,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;IAChG,CAAC;IAED,4CAA4C;IAC5C,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,aAAqB,kBAAkB;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,SAAkB,EAAE,WAAoB,EAAE,EAAE;YAC9E,MAAM,IAAI,CAAC,YAAY,CAAC,SAA0B,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,oCAAoC,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAED,UAAU,CAAC,IAAY,EAAE,aAAqB,kBAAkB;QAC9D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACvC,KAAK,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,sCAAsC,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAqB;QAC9C,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtD,MAAM,SAAS,GAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;YAChH,IAAI,CAAC;gBAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAClE,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;QACjC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACzG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,kCAAkC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,OAAgC;QAClE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CACtB,IAAI,CAAC,eAAe,EACpB,0BAA0B,EAAE,EAAE,EAC9B,GAAG,EAAE,CAAC,OAAO,EACb,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAC/C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ;gBAAE,MAAM,GAAG,CAAC;YACzB,GAAG,CACD,iGAAiG,EACjG,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAChD,CAAC;YACF,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,iBAAiB,CAC7B,EAAU,EACV,OAA2C;QAE3C,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,IAAI,CAAC,gBAAgB,EACrB,oBAAoB,EAAE,EAAE,EACxB,GAAG,EAAE,CAAC,OAAO,EACb,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAC/B,CAAC;YACF,GAAG,CAAC,qFAAqF,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,GAAG,CAAC,+DAA+D,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC9E,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,GAAG,CAAC,uEAAuE,EAAE,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACxG,8EAA8E;YAC9E,iCAAiC;YACjC,KAAK,OAAO,CAAC,IAAI,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,yEAAyE,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAC3G,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,+DAA+D,EAAE,EAAE,EAAE,IAAI,CAAC,CACzF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,oBAAoB,CAAC,EAAU,EAAE,OAAgC;QACvE,IAAI,CAAC;YACH,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;YACnF,qFAAqF;YACrF,4DAA4D;YAC5D,GAAG,CAAC,8EAA8E,EAAE,EAAE,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,sEAAsE,EAAE,EAAE,CAAC,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,sBAAsB,CAAC;YACvC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,OAAO,EAAE,OAAO,CAAC,aAAa;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,qEAAqE,EAAE,EAAE,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,MAAqB;QACxD,6EAA6E;QAC7E,kFAAkF;QAClF,mFAAmF;QACnF,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,GAA2B,EAAQ,EAAE;YACjD,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxB,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,2BAA2B,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAA2B,CAAC,CAAC;YACrI,GAAG,CAAC,kDAAkD,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAE5F,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9F,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,kFAAkF;gBAClF,6EAA6E;gBAC7E,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,0EAA0E;gBAC1E,sDAAsD;gBACtD,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,gFAAgF;YAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,eAAe,EAAE,OAAO,CAAC,MAAM;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iFAAiF;YACjF,qFAAqF;YACrF,kFAAkF;YAClF,oFAAoF;YACpF,gFAAgF;YAChF,6CAA6C;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;gBACtG,IAAI,CAAC;oBAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAsBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAA6B;IAC7E,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAChF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACvE,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,OAAO,CAAC,kBAAkB,EAAE,sCAAsC,EAClE,gBAAgB,EAAE,aAAa,EAAE,eAAe,CACjD,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAElD,OAAO,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,wBAAwB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9H,MAAM,MAAM,GAAG,SAAqC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;YACvC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAEpC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,kBAAkB,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAA0B,CAAC,CAAC;YAChI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAE/D,IAAI,CAAC,QAAQ,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACrG,OAAO,QAAQ,CAAC,eAAe,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/strand-instance-manager.d.ts

@@ -1,4 +1,5 @@
 import type { PrivateKey } from '@libp2p/interface';
+import { type StrandBackfillConfig } from './strand-backfill.js';
 import type { StrandInstance, StrandRow, StorageConfig, NetworkConfig, LatencyHint, NodeProfile, SAppConfig, StrandMode } from './types.js';
 /**
  * Configuration for starting a strand instance
@@ -33,6 +34,25 @@ export interface StartStrandConfig {
      * {@link StrandConfig.founder}.
      */
     founder?: boolean;
+    /**
+     * Number of nodes Optimystic is told this strand's replication cluster should
+     * have. Same rule as {@link CadreNodeConfig.strandClusterSize}, which CadreNode
+     * forwards here: every node on the strand should use the same value, and it is
+     * frozen when the strand's libp2p node is created. Defaults to
+     * `DEFAULT_STRAND_CLUSTER_SIZE` (4); values below `MIN_CLUSTER_SIZE` (2) are
+     * rejected by `resolveStrandClusterSize`. Strand-only — the
+     * control network's breadth is the fixed `CONTROL_REPLICATION_BREADTH`.
+     */
+    clusterSize?: number;
+    /**
+     * Tuning for the strand peer-join block catch-up ({@link StrandBackfill}),
+     * forwarded from {@link CadreNodeConfig.strandBackfill}. When the strand's
+     * libp2p node connects to a peer this runtime has not yet caught up, every
+     * block in the strand's own raw store is pushed to it. Runs only on
+     * `networked` strands with per-strand storage; `{ enabled: false }` restores
+     * the pre-existing no-backfill behaviour.
+     */
+    backfill?: StrandBackfillConfig;
 }
 /**
  * Volatile inputs re-resolved when resuming a quiesced strand. These may have
@@ -72,6 +92,15 @@ export declare class StrandInstanceManager {
      * without the caller re-threading storage/network/profile/key/sApp config.
      */
     private launchConfigs;
+    /**
+     * The per-strand peer-join block catch-up, keyed by strand id. Private (not on
+     * the public {@link StrandInstance}) because it is runtime plumbing with the
+     * same lifetime as the strand's libp2p node: created in `buildStrandRuntime`,
+     * stopped and dropped in `releaseRuntime` — so quiesce → resume rebuilds it
+     * with a fresh caught-up-peer memo, which is intended (a resumed node may have
+     * missed writes).
+     */
+    private backfills;
     private stopping;
     constructor();
     /**
@@ -87,7 +116,16 @@ export declare class StrandInstanceManager {
      */
     hasStrand(strandId: string): boolean;
     /**
-     * Start a new strand instance
+     * Start a new strand instance.
+     *
+     * A failed launch leaves NOTHING tracked: the instance and its retained launch
+     * config are both dropped before the error is rethrown, so the strand id is
+     * free for a genuine retry. This matches the pre-registration failure path
+     * (a rejected schema signature, which throws before anything is recorded) —
+     * both failure modes of this call leave the same residue: none. Callers learn
+     * of the failure from the rejected promise (and, on the control-discovered
+     * path, from CadreNode's `strand:error` event), not from an error record left
+     * behind in `instances`.
      */
     startStrand(config: StartStrandConfig): Promise<StrandInstance>;
     /**

package/dist/strand-instance-manager.js

@@ -1,7 +1,10 @@
 import debug from 'debug';
 import { createLibp2pNode } from '@optimystic/db-p2p';
 import { StrandDatabase } from './strand-database.js';
+import { StrandBackfill } from './strand-backfill.js';
 import { assertSchemaSignature } from './schema-verification.js';
+import { resolveStrandClusterSize, STRAND_CLUSTER_POLICY } from './types.js';
+import { resolveListenAddrs } from './relay-addrs.js';
 const log = debug('sereus:cadre:strand-manager');
 const timing = debug('sereus:cadre:timing');
 /**
@@ -61,6 +64,15 @@ export class StrandInstanceManager {
          * without the caller re-threading storage/network/profile/key/sApp config.
          */
         this.launchConfigs = new Map();
+        /**
+         * The per-strand peer-join block catch-up, keyed by strand id. Private (not on
+         * the public {@link StrandInstance}) because it is runtime plumbing with the
+         * same lifetime as the strand's libp2p node: created in `buildStrandRuntime`,
+         * stopped and dropped in `releaseRuntime` — so quiesce → resume rebuilds it
+         * with a fresh caught-up-peer memo, which is intended (a resumed node may have
+         * missed writes).
+         */
+        this.backfills = new Map();
         this.stopping = false;
         log('StrandInstanceManager created');
     }
@@ -83,7 +95,16 @@ export class StrandInstanceManager {
         return this.instances.has(strandId);
     }
     /**
-     * Start a new strand instance
+     * Start a new strand instance.
+     *
+     * A failed launch leaves NOTHING tracked: the instance and its retained launch
+     * config are both dropped before the error is rethrown, so the strand id is
+     * free for a genuine retry. This matches the pre-registration failure path
+     * (a rejected schema signature, which throws before anything is recorded) —
+     * both failure modes of this call leave the same residue: none. Callers learn
+     * of the failure from the rejected promise (and, on the control-discovered
+     * path, from CadreNode's `strand:error` event), not from an error record left
+     * behind in `instances`.
      */
     async startStrand(config) {
         const { strandRow, sAppConfig } = config;
@@ -117,7 +138,10 @@ export class StrandInstanceManager {
             memberPrivateKey: strandRow.MemberPrivateKey ?? undefined,
             connectedPeers: 0,
             lastActivity: new Date(),
-            latencyHint
+            latencyHint,
+            // Seed only — buildStrandRuntime overwrites this with the same resolution,
+            // so an instance that errors mid-build still reads sensibly.
+            mode: config.mode ?? 'networked'
         };
         this.instances.set(strandId, instance);
         this.launchConfigs.set(strandId, config);
@@ -128,9 +152,15 @@ export class StrandInstanceManager {
             return instance;
         }
         catch (error) {
+            // Status/error first — the (now discarded) record is still what `log` reports on.
             instance.status = 'error';
             instance.error = error instanceof Error ? error.message : String(error);
             log('Failed to start strand %s: %s', strandId, instance.error);
+            // Drop the dead record so this strand id can be launched again. Keep the
+            // `launchConfigs` has an entry iff `instances` does invariant — resumeStrand
+            // reads both, and a config without an instance would strand the config.
+            this.instances.delete(strandId);
+            this.launchConfigs.delete(strandId);
             throw error;
         }
     }
@@ -145,6 +175,7 @@ export class StrandInstanceManager {
     async buildStrandRuntime(instance, config) {
         const strandId = instance.strandId;
         const { sAppConfig } = config;
+        const mode = config.mode ?? 'networked';
         // Resolve storage for this strand. If a factory function is provided, it is
         // called with the strandId to create strand-specific storage (e.g.,
         // strand-isolated directories).
@@ -152,39 +183,56 @@ export class StrandInstanceManager {
         if (strandStorage) {
             log('Strand %s using provided storage provider', strandId);
         }
-        // Note: protocolPrefix would be used by libp2p services, but createLibp2pNode
-        // may not support it yet - tracked for future implementation.
-        const _protocolPrefix = `/sereus/strand/${strandId}`;
+        // db-p2p namespaces every one of the node's protocol ids by network name
+        // (`/optimystic/<networkName>/...`), so anything dialing this node's own
+        // services must derive its prefix from the SAME string the node was built
+        // with — hence one binding for both, not two literals that can drift.
+        const networkName = `strand-${strandId}`;
+        const protocolPrefix = `/optimystic/${networkName}`;
         // Determine relay mode: if explicitly set in config, use that;
         // otherwise default to true for storage profile nodes.
         const enableRelay = config.network?.enableRelay ?? (config.profile === 'storage');
+        const listenAddrs = resolveListenAddrs(config.network);
         try {
             let t0 = performance.now();
             const node = await createLibp2pNode({
                 port: 0, // Random port
                 bootstrapNodes: config.bootstrapNodes ?? [],
-                networkName: `strand-${strandId}`,
+                networkName,
                 storage: strandStorage,
                 fretProfile: config.profile === 'storage' ? 'core' : 'edge',
                 relay: enableRelay,
-                clusterSize: 3,
-                clusterPolicy: {
-                    allowDownsize: true,
-                    sizeTolerance: 0.5
-                },
+                clusterSize: resolveStrandClusterSize(config.clusterSize),
+                // Deliberately NOT CONTROL_CLUSTER_POLICY: a strand is application data with its own
+                // breadth reasoning, and the shape match with the control policy is a coincidence.
+                clusterPolicy: STRAND_CLUSTER_POLICY,
                 arachnode: {
                     enableRingZulu: config.profile === 'storage'
                 },
                 ...(config.privateKey && { privateKey: config.privateKey }),
                 ...(config.network?.transports && { transports: config.network.transports }),
-                ...(config.network?.listenAddrs && { listenAddrs: config.network.listenAddrs }),
+                // NOTE: strand nodes receive the same RESOLVED listen addrs as the
+                // control node. A fixed-port listen addr (e.g. cadre-cli's example
+                // `/ip4/0.0.0.0/tcp/4001`) would have control + strand nodes racing to
+                // bind one port — EADDRINUSE. Unverified; if a deployment configures a
+                // fixed port and strands fail to start, rewrite the port per node here.
+                // An inherited `/p2p-circuit` addr, by contrast, is deliberate — it is
+                // what gives a NAT'd strand node a reachable relay slot — and works
+                // because the launch path announces this strand's derived peerId to
+                // the relay first (delegate admission; see cadre-node.ts). Those circuit
+                // entries come either from a hand-written `network.listenAddrs` or from
+                // `network.relayAddrs`, which `resolveListenAddrs` folds into the same list.
+                ...(listenAddrs && { listenAddrs }),
                 ...(config.network?.connectionGater && { connectionGater: config.network.connectionGater })
             });
             timing('[buildStrandRuntime:%s] createLibp2pNode: %dms', strandId, Math.round(performance.now() - t0));
             instance.libp2pNode = node;
+            // Assigned on every runtime (re)build — resume re-enters here with
+            // resumeConfig, so a bootstrap → networked shift refreshes the field.
+            instance.mode = mode;
             // Create and initialize the StrandDatabase. In bootstrap mode the same
             // strandStorage instance also backs the optimystic local transactor so
-            // DML lands on the host's persistent storage (e.g. MMKV on RN). Sharing
+            // DML lands on the host's persistent storage (e.g. LevelDB on RN). Sharing
             // the instance — not creating a second one over the same id+prefix —
             // avoids cache divergence between the libp2p and database paths.
             //
@@ -196,7 +244,7 @@ export class StrandInstanceManager {
                 sAppConfig,
                 libp2pNode: node,
                 coordinatedRepo: node.coordinatedRepo,
-                mode: config.mode ?? 'networked',
+                mode,
                 rawStorage: strandStorage,
                 // Founder bootstrap inputs: the strand's type drives which membership rows
                 // are written, and the closed-strand MemberPrivateKey derives the founding
@@ -208,6 +256,28 @@ export class StrandInstanceManager {
             instance.database = strandDb;
             await strandDb.initialize();
             timing('[buildStrandRuntime:%s] strandDatabase.initialize: %dms', strandId, Math.round(performance.now() - t0));
+            // Peer-join block catch-up: push this strand's own blocks to each newly
+            // connected peer, so a machine that joined after blocks were committed
+            // still ends up physically holding them (a bootstrap strand has no mesh
+            // to catch up, and without per-strand storage there is nothing to copy).
+            if (mode === 'networked' && strandStorage && config.backfill?.enabled !== false) {
+                if (node.keyNetwork) {
+                    const backfill = new StrandBackfill({
+                        strandId,
+                        libp2p: node,
+                        peerNetwork: node.keyNetwork,
+                        storage: strandStorage,
+                        // The same prefix the receiver registered its block-transfer handler
+                        // under — derived from networkName above, never re-spelled here.
+                        protocolPrefix
+                    }, config.backfill);
+                    backfill.start();
+                    this.backfills.set(strandId, backfill);
+                }
+                else {
+                    log('Strand %s: libp2p node exposes no keyNetwork; peer-join block catch-up is inert', strandId);
+                }
+            }
             instance.status = 'active';
             instance.lastActivity = new Date();
         }
@@ -230,6 +300,14 @@ export class StrandInstanceManager {
      * Shared by `quiesceStrand`, `stopStrand`, and that rollback path.
      */
     async releaseRuntime(instance) {
+        // Backfill first — before the database closes and the libp2p node stops — so
+        // no NEW catch-up push is issued against a torn-down transport. A push already
+        // in flight is not awaited; it fails into the module's own per-chunk catch.
+        const backfill = this.backfills.get(instance.strandId);
+        if (backfill) {
+            backfill.stop();
+            this.backfills.delete(instance.strandId);
+        }
         if (instance.database) {
             await instance.database.close();
             instance.database = undefined;