@serfab/cadre-core 1.13.0 → 1.15.0

package/dist/strand-peer-redial.js

@@ -0,0 +1,236 @@
+/**
+ * A running strand node redialing the strand's other members itself, when it holds a
+ * connection to none of them, with the dial budget the host's declared link gives a
+ * relayed connection.
+ *
+ * Why. Below cadre-core the only thing that redials a strand peer is FRET's maintenance:
+ * its pings and neighbour announcements open the connection themselves (`dial: true`) under
+ * a fixed 2 000 ms limit on the whole call (`MAINTENANCE_RPC_TIMEOUT_MS` in `p2p-fret`'s
+ * `fret-service.ts`). Opening a relayed connection takes longer than that on a slow link:
+ * about 9 s on a 20 ms per-frame cap with a 70%-busy event loop
+ * (`joiner-first-commit-over-slow-relay`, whose slow-restart arm reproduces this), where
+ * {@link relayedDialBudgetMs} allows 21.5 s at the default declaration. Each such redial is
+ * cut off part-way through the handshake, from both sides, for as long as the link stays that
+ * slow. And after a restart nothing else dials a strand peer: a cross-party strand's launch
+ * seed is empty, and cadre-core's address passes only fill the address book. Two phones that
+ * restarted then never reconnect, and a write either made alone never reaches the other.
+ *
+ * What it does. One loop per strand runtime, started in `StrandInstanceManager`'s runtime
+ * build and stopped with the runtime (stop, quiesce, failed build), so a hibernating strand
+ * never dials. Each look at the node:
+ * - a member connected: nothing to do; look again in {@link STRAND_REDIAL_CHECK_MS}, or as
+ *   soon as a peer disconnects.
+ * - no member connected and none known: likewise nothing (a founder alone, a storage replica
+ *   before anyone arrives).
+ * - no member connected and some known: dial every known member at once
+ *   ({@link dialPeerAddrs}, direct addresses before relayed ones), each address with the
+ *   relayed-dial budget. A round that connects to one goes back to watching; one that does
+ *   not waits a backoff starting at that budget and doubling to
+ *   {@link STRAND_REDIAL_MAX_BACKOFF_MS}.
+ *
+ * Who is known: every peer the node's FRET table holds a verified signed address record for
+ * (`strand-fret-addrs.ts`), plus the launch seed (sibling strand addresses and a formation's
+ * carried addresses). Who counts as connected: a peer FRET labels `'member'` (it has seen it
+ * speak this strand's protocols), or a seed peer. Neither ever includes a configured relay, a
+ * peer FRET labels `'foreign'`, or a peer the revocation gate refuses. The relay matters most:
+ * the strand node is connected to it throughout and FRET files it with a record like any
+ * peer, so counting it would leave this loop idle exactly when it is needed.
+ *
+ * NOTE: this compensates for FRET's 2 000 ms maintenance dial limit, which cannot open a
+ * relayed connection on a slow link (upstream half:
+ * `blocked/fret-maintenance-ping-dial-budget-below-a-relayed-dial`). If FRET's maintenance
+ * dial ever takes a limit derived from the declared link, this loop becomes a backstop and
+ * may be deleted, as `peer-join-backfill.ts` says of itself.
+ */
+import debug from 'debug';
+import { relayedDialBudgetMs } from './link-budget.js';
+import { CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS, SelfRelayOnlyError, dialPeerAddrs } from './peer-dial.js';
+import { groupAddrsByPeerId } from './peer-addr-book.js';
+import { strandFretMembership, strandFretPeerAddrs } from './strand-fret-addrs.js';
+import { defaultTimeoutScheduler } from './timeout-scheduler.js';
+const log = debug('sereus:cadre:strand-redial');
+/**
+ * Gap between looks while a member is connected or none is known. While a member is
+ * connected a look reads FRET's labels and the connection list and checks no signature
+ * ({@link strandFretMembership}); a disconnect also triggers a look at once.
+ */
+export const STRAND_REDIAL_CHECK_MS = 5000;
+/**
+ * Ceiling on the wait between failed rounds. A member that is gone for good is dialed this
+ * often for as long as FRET keeps its record (up to 14 days after it was last confirmed).
+ */
+export const STRAND_REDIAL_MAX_BACKOFF_MS = 5 * 60000;
+/**
+ * The timings at a declared link round trip: {@link relayedDialBudgetMs} per address, the
+ * same whole-budget count per member as the control cohort's dials (dead direct addresses
+ * a record lists ahead of the relayed one that works), and a first backoff of one per-address
+ * budget.
+ */
+export function strandRedialTimings(linkRoundTripMs) {
+    const perAddressMs = relayedDialBudgetMs(linkRoundTripMs);
+    return {
+        budget: { perAddressMs, totalMs: CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS * perAddressMs },
+        minBackoffMs: perAddressMs,
+        maxBackoffMs: STRAND_REDIAL_MAX_BACKOFF_MS,
+        checkMs: STRAND_REDIAL_CHECK_MS
+    };
+}
+/** Start the loop; its first look runs at once. */
+export function superviseStrandPeerRedial(deps, timings) {
+    return new StrandPeerRedialLoop(deps, timings);
+}
+class StrandPeerRedialLoop {
+    constructor(deps, timings) {
+        this.deps = deps;
+        this.timings = timings;
+        this.timer = null;
+        /**
+         * Whether the pending wait is a plain gap between looks, which a disconnect cuts short. A
+         * backoff after a failed round is not cut short, or a flapping relay connection would turn
+         * the backoff into a dial on every flap; and while a look or round runs there is no wait.
+         */
+        this.watching = false;
+        this.stopped = false;
+        this.onDisconnect = () => {
+            if (this.watching && !this.stopped) {
+                this.cancelTimer();
+                void this.tick();
+            }
+        };
+        this.scheduler = deps.scheduler ?? defaultTimeoutScheduler;
+        this.seed = groupAddrsByPeerId([...deps.seed]);
+        this.selfId = deps.node.peerId.toString();
+        this.backoffMs = timings.minBackoffMs;
+        deps.node.addEventListener('peer:disconnect', this.onDisconnect);
+        void this.tick();
+    }
+    stop() {
+        if (this.stopped) {
+            return;
+        }
+        this.stopped = true;
+        this.cancelTimer();
+        this.deps.node.removeEventListener('peer:disconnect', this.onDisconnect);
+    }
+    async tick() {
+        if (this.stopped) {
+            return;
+        }
+        this.watching = false;
+        let outcome = 'watch';
+        try {
+            outcome = await this.lookAndDial();
+        }
+        catch (error) {
+            // A node torn down under the look throws from its table export or connection list.
+            log('strand %s: redial look failed (looking again in %dms): %o', this.deps.label, this.timings.checkMs, error);
+        }
+        if (this.stopped) {
+            return;
+        }
+        this.watching = outcome === 'watch';
+        const waitMs = outcome === 'watch' ? this.resetBackoff() : this.nextBackoff();
+        this.timer = this.scheduler.setTimeout(() => {
+            this.timer = null;
+            void this.tick();
+        }, waitMs);
+    }
+    /**
+     * One look, and a round of dials when it finds no member connected but some known. A node
+     * whose own party was removed dials nobody: the strand keeps running for the session, but a
+     * removed party must not keep dialing the strand's peers (`CadreNode.forgetRevokedJoin`).
+     */
+    async lookAndDial() {
+        if (this.deps.isRevoked?.(this.selfId) === true) {
+            return 'watch';
+        }
+        const membership = strandFretMembership(this.deps.node);
+        if (this.memberConnected(membership)) {
+            return 'watch';
+        }
+        const known = await this.knownMembers(membership);
+        if (known.size === 0 || this.stopped) {
+            return 'watch';
+        }
+        log('strand %s: no member connected; dialing %d known member(s)', this.deps.label, known.size);
+        if (await this.dialAny(known)) {
+            log('strand %s: reconnected to a member', this.deps.label);
+            return 'watch';
+        }
+        log('strand %s: no known member answered; next round in %dms', this.deps.label, this.backoffMs);
+        return 'retry';
+    }
+    /** The gap between looks, with the backoff started over. */
+    resetBackoff() {
+        this.backoffMs = this.timings.minBackoffMs;
+        return this.timings.checkMs;
+    }
+    /**
+     * The wait after a round that reached no member, doubling the next one up to the cap.
+     *
+     * NOTE: a round whose dials failed within milliseconds (a relay connection that is still
+     * closing, the member's relay reservation not back yet) waits as long as one whose dials ran
+     * out their budget. In `joiner-first-commit-over-slow-relay`'s third arm that first wait is what
+     * leaves the joiner writable with no member connected. If reconnecting within seconds of a cut
+     * ever matters, retry a round that failed that fast after a short delay instead.
+     *
+     * NOTE: one such fast failure is `ConnectionClosedError: The connection muxer is "closed"`. A
+     * relay that aborts its connection to this node cannot tell it so (`@libp2p/websockets`'
+     * listener resets with close code 1006, which the `ws` package refuses to send;
+     * `blocked/report-libp2p-websockets-buffered-amount`, second arm), so this node keeps a dead
+     * relay connection until its own monitor drops it, up to 65 s, and every relayed dial reuses
+     * it. If rounds keep failing that way, close a relay connection whose muxer is closed before
+     * the next round instead of waiting it out.
+     */
+    nextBackoff() {
+        const waitMs = this.backoffMs;
+        this.backoffMs = Math.min(waitMs * 2, this.timings.maxBackoffMs);
+        return waitMs;
+    }
+    eligible(peerId) {
+        return peerId !== this.selfId && !this.deps.excluded.has(peerId) && this.deps.isRevoked?.(peerId) !== true;
+    }
+    /** Whether an open connection reaches a peer FRET has seen speak this strand's protocols, or a seed peer. */
+    memberConnected(membership) {
+        return this.deps.node.getConnections().some((connection) => {
+            const peerId = connection.remotePeer.toString();
+            return this.eligible(peerId) && (membership.get(peerId) === 'member' || this.seed.has(peerId));
+        });
+    }
+    /** The members to dial, each with its candidate addresses: verified FRET records first, then the seed's. */
+    async knownMembers(membership) {
+        const { peers } = await strandFretPeerAddrs(this.deps.node);
+        const known = new Map();
+        for (const [peerId, addrs] of [...peers, ...this.seed]) {
+            if (!this.eligible(peerId) || membership.get(peerId) === 'foreign') {
+                continue;
+            }
+            known.set(peerId, unionAddrs(known.get(peerId) ?? [], addrs));
+        }
+        return known;
+    }
+    /** Dial every member in `known` at once; resolves to whether any connected. */
+    async dialAny(known) {
+        const members = [...known];
+        const outcomes = await Promise.allSettled(members.map(([peerId, addrs]) => dialPeerAddrs(this.deps.node, peerId, addrs, this.timings.budget, `strand ${this.deps.label} redial of ${peerId}`)));
+        outcomes.forEach((outcome, i) => {
+            if (outcome.status === 'rejected') {
+                const reason = outcome.reason instanceof SelfRelayOnlyError ? 'reachable only by relaying through this node' : outcome.reason;
+                log('strand %s: redial of %s failed: %o', this.deps.label, members[i][0], reason);
+            }
+        });
+        return outcomes.some((outcome) => outcome.status === 'fulfilled');
+    }
+    cancelTimer() {
+        if (this.timer !== null) {
+            this.scheduler.clearTimeout(this.timer);
+            this.timer = null;
+        }
+    }
+}
+/** `primary` then the entries of `extra` it lacks, compared as strings. */
+function unionAddrs(primary, extra) {
+    const seen = new Set(primary.map((addr) => addr.toString()));
+    return [...primary, ...extra.filter((addr) => !seen.has(addr.toString()))];
+}
+//# sourceMappingURL=strand-peer-redial.js.map

package/dist/strand-peer-redial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strand-peer-redial.js","sourceRoot":"","sources":["../src/strand-peer-redial.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,oCAAoC,EAAE,kBAAkB,EAAE,aAAa,EAAwC,MAAM,gBAAgB,CAAC;AAC/I,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAA0C,MAAM,wBAAwB,CAAC;AAC3H,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,MAAM,GAAG,GAAG,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAK,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,KAAM,CAAC;AAcvD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAwB;IAC1D,MAAM,YAAY,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,oCAAoC,GAAG,YAAY,EAAE;QACtF,YAAY,EAAE,YAAY;QAC1B,YAAY,EAAE,4BAA4B;QAC1C,OAAO,EAAE,sBAAsB;KAChC,CAAC;AACJ,CAAC;AAuCD,mDAAmD;AACnD,MAAM,UAAU,yBAAyB,CAAC,IAAsB,EAAE,OAA4B;IAC5F,OAAO,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,oBAAoB;IAoBxB,YAA6B,IAAsB,EAAmB,OAA4B;QAArE,SAAI,GAAJ,IAAI,CAAkB;QAAmB,YAAO,GAAP,OAAO,CAAqB;QAf1F,UAAK,GAAY,IAAI,CAAC;QAC9B;;;;WAIG;QACK,aAAQ,GAAG,KAAK,CAAC;QACjB,YAAO,GAAG,KAAK,CAAC;QACP,iBAAY,GAAG,GAAS,EAAE;YACzC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QAGA,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACjE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,OAAO,GAAgB,OAAO,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mFAAmF;YACnF,GAAG,CAAC,2DAA2D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,KAAK,OAAO,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,CAAC;IACb,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,4DAA4D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,oCAAoC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,yDAAyD,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4DAA4D;IACpD,YAAY;QAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,WAAW;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,QAAQ,CAAC,MAAc;QAC7B,OAAO,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAC7G,CAAC;IAED,6GAA6G;IACrG,eAAe,CAAC,UAA+C;QACrE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;YACzD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4GAA4G;IACpG,KAAK,CAAC,YAAY,CAAC,UAA+C;QACxE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC7C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,OAAO,CAAC,KAAuC;QAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CACxE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,cAAc,MAAM,EAAE,CAAC,CACnH,CAAC,CAAC;QACH,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;YAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,YAAY,kBAAkB,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC9H,GAAG,CAAC,oCAAoC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACpF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IACpE,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,OAA6B,EAAE,KAA2B;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/strand-revocation-enforcer.d.ts

@@ -83,23 +83,23 @@
  *
  * ## What transfers from the control gater (`membership-connection-gater.ts`)
  *
- * Transfers: the two-layer shape (fail-closed per-stream gate as PRIMARY, an
- * opportunistic connection-level deny on top), the synchronous in-memory
+ * Transfers: the two-layer shape (fail-closed per-stream gate as PRIMARY, a
+ * connection-level layer on top), the synchronous in-memory
  * snapshot judged by the stream gate (a live DB read inside a gate deadlocks —
  * the same argument as the control node's `authorizeInboundControlStream`), the
  * fail-open-on-error/timeout posture for the connection hooks
  * (`decideWithinDeadline`, reused as-is), and the "compose over the caller's
  * gater, every base hook preserved" mechanics.
  *
- * Does NOT transfer — the relay-reservation seam (`'admit-for-relay'` + the
- * unauthorized budget). That machinery exists because the control gate denies on
- * ABSENCE of placement, where a member whose row is in flight is
- * indistinguishable from an outsider and a wrong reservation deny is
- * unrecoverable. This gate denies on POSITIVE revocation evidence, so a
- * reservation deny is never that kind of wrong answer; the one stale-wrong case
- * (a missed re-add) heals via replication as above. `denyInboundRelayReservation`
- * here is therefore a plain "deny iff revoked" — no budget, no admit-for-relay
- * verdict, no reserve deadline.
+ * Does NOT transfer — provisional admission and the relay-reservation seam
+ * (`'admit-provisionally'`, its deadline, the unauthorized budget). That
+ * machinery exists because the control gate judges on ABSENCE of placement,
+ * where a member whose row is in flight, or a device whose invitation row has
+ * not arrived, is indistinguishable from an outsider, and a wrong reservation
+ * deny is unrecoverable. This gate denies on POSITIVE revocation evidence, so a
+ * deny is never that kind of wrong answer; the one stale-wrong case (a missed
+ * re-add) heals via replication as above. Every hook here is therefore a plain
+ * "deny iff revoked" — no budget, no provisional verdict, no deadline.
  *
  * Does NOT transfer — the bring-up quiet period. A strand node's DB bring-up
  * NEEDS its cross-party cohort connections; this enforcer simply starts with an

package/dist/strand-revocation-enforcer.js

@@ -83,23 +83,23 @@
  *
  * ## What transfers from the control gater (`membership-connection-gater.ts`)
  *
- * Transfers: the two-layer shape (fail-closed per-stream gate as PRIMARY, an
- * opportunistic connection-level deny on top), the synchronous in-memory
+ * Transfers: the two-layer shape (fail-closed per-stream gate as PRIMARY, a
+ * connection-level layer on top), the synchronous in-memory
  * snapshot judged by the stream gate (a live DB read inside a gate deadlocks —
  * the same argument as the control node's `authorizeInboundControlStream`), the
  * fail-open-on-error/timeout posture for the connection hooks
  * (`decideWithinDeadline`, reused as-is), and the "compose over the caller's
  * gater, every base hook preserved" mechanics.
  *
- * Does NOT transfer — the relay-reservation seam (`'admit-for-relay'` + the
- * unauthorized budget). That machinery exists because the control gate denies on
- * ABSENCE of placement, where a member whose row is in flight is
- * indistinguishable from an outsider and a wrong reservation deny is
- * unrecoverable. This gate denies on POSITIVE revocation evidence, so a
- * reservation deny is never that kind of wrong answer; the one stale-wrong case
- * (a missed re-add) heals via replication as above. `denyInboundRelayReservation`
- * here is therefore a plain "deny iff revoked" — no budget, no admit-for-relay
- * verdict, no reserve deadline.
+ * Does NOT transfer — provisional admission and the relay-reservation seam
+ * (`'admit-provisionally'`, its deadline, the unauthorized budget). That
+ * machinery exists because the control gate judges on ABSENCE of placement,
+ * where a member whose row is in flight, or a device whose invitation row has
+ * not arrived, is indistinguishable from an outsider, and a wrong reservation
+ * deny is unrecoverable. This gate denies on POSITIVE revocation evidence, so a
+ * deny is never that kind of wrong answer; the one stale-wrong case (a missed
+ * re-add) heals via replication as above. Every hook here is therefore a plain
+ * "deny iff revoked" — no budget, no provisional verdict, no deadline.
  *
  * Does NOT transfer — the bring-up quiet period. A strand node's DB bring-up
  * NEEDS its cross-party cohort connections; this enforcer simply starts with an

package/dist/strand-wake-protocol.d.ts

@@ -16,13 +16,12 @@
  *
  * **Authorization (v1):** a wake is low-risk — it only causes the receiver to
  * spend resources coming online for a strand it already participates in — so the
- * receiver carries no per-request signature and instead defers entirely to the
- * injected `isMember` predicate. `CadreNode` injects its AUTHORIZED-membership
- * predicate there (`isAuthorizedMember`: the sender's `CadrePeer` row must carry
- * a voucher that verifies against an owner key in the receiver's node-local
- * trusted-owner anchor), so a peer that merely published rows into the replicated
- * control DB is refused. This module stays agnostic: it enforces whatever
- * predicate it is given.
+ * request carries no signature. Membership is checked before this handler runs, by
+ * the control node's protocol guard (`control-protocol-guard.ts`, the `members`
+ * class: `CadreNode.isAuthorizedMember`, under which the sender's `CadrePeer` row
+ * must carry a voucher that verifies against an owner key in the receiver's
+ * node-local trusted-owner anchor), so a peer that merely published rows into the
+ * replicated control DB gets its stream reset and never reaches this module.
  */
 import type { Libp2p } from '@libp2p/interface';
 import type { Multiaddr } from '@multiformats/multiaddr';
@@ -38,8 +37,8 @@ export declare const WAKE_PROTOCOL = "/sereus/strand-wake/1.0.0";
  * It holds only link work because the receiver acks as soon as it has DECIDED, before the
  * wake itself runs ({@link StrandWakeService.processWakeRequest}).
  *
- * NOTE: the receiver's membership check (two live control reads) runs inside this deadline and
- * is not counted. In steady state those reads touch only held blocks and do not consult the
+ * NOTE: the receiver's membership check (two live control reads, in its protocol guard) runs
+ * inside this deadline and is not counted. In steady state those reads touch only held blocks and do not consult the
  * cohort. If a wake or address request is seen timing out while the receiver's membership read
  * is consulting, count one membership decision in this deadline or answer the check from the
  * materialized authorized-peer snapshot. See docs/cadre-consistency.md → "Deadlines Over
@@ -83,8 +82,6 @@ export declare const DEFAULT_WAKE_DIAL_BUDGET_MS: number;
  * (`CadreNode`), injected so the service is testable without a full node.
  */
 export interface StrandWakeServiceOptions {
-    /** Membership gate: is the remote peer a `CadrePeer` member of this cadre? */
-    isMember(remotePeerId: string): Promise<boolean>;
     /** Look up a local strand instance by id (undefined if not participated in). */
     getStrand(strandId: string): StrandInstance | undefined;
     /**
@@ -117,9 +114,10 @@ export interface StrandWakeServiceOptions {
 }
 /**
  * Receiver side of the push-wake protocol. Registers a `WAKE_PROTOCOL` handler
- * on the control node and, for each inbound {@link WakeRequest}, gates on cadre
- * membership, replies with a {@link WakeAck}, and starts resuming the named
- * strand if it is hibernating/idle and we participate in it.
+ * on the control node and, for each inbound {@link WakeRequest} (from a peer the
+ * protocol guard has already admitted as an authorized member), replies with a
+ * {@link WakeAck} and starts resuming the named strand if it is hibernating/idle
+ * and we participate in it.
  */
 export declare class StrandWakeService {
     private readonly options;
@@ -155,8 +153,7 @@ export declare class StrandWakeService {
      * Decide the wake for a decoded request and start it. Exposed (not private) so
      * the decision matrix can be unit-tested directly.
      *
-     * - Non-member sender → rejected (`accepted: false`).
-     * - Unknown / not-participated strand → rejected.
+     * - Unknown / not-participated strand → rejected (`accepted: false`).
      * - Hibernating or idle strand → `accepted` with that status, and a wake started.
      * - Already-live strand → no-op, `accepted` with current status.
      *

package/dist/strand-wake-protocol.js

@@ -16,18 +16,17 @@
  *
  * **Authorization (v1):** a wake is low-risk — it only causes the receiver to
  * spend resources coming online for a strand it already participates in — so the
- * receiver carries no per-request signature and instead defers entirely to the
- * injected `isMember` predicate. `CadreNode` injects its AUTHORIZED-membership
- * predicate there (`isAuthorizedMember`: the sender's `CadrePeer` row must carry
- * a voucher that verifies against an owner key in the receiver's node-local
- * trusted-owner anchor), so a peer that merely published rows into the replicated
- * control DB is refused. This module stays agnostic: it enforces whatever
- * predicate it is given.
+ * request carries no signature. Membership is checked before this handler runs, by
+ * the control node's protocol guard (`control-protocol-guard.ts`, the `members`
+ * class: `CadreNode.isAuthorizedMember`, under which the sender's `CadrePeer` row
+ * must carry a voucher that verifies against an owner key in the receiver's
+ * node-local trusted-owner anchor), so a peer that merely published rows into the
+ * replicated control DB gets its stream reset and never reaches this module.
  */
 import debug from 'debug';
 import { decodeLengthPrefixedFrame } from './seed-bootstrap.js';
 import { exchangeFrame, readStreamToEnd, replyAndClose } from './control-stream.js';
-import { tryAddrsInTurn } from './peer-dial.js';
+import { dialAddr, tryAddrsInTurn } from './peer-dial.js';
 import { relayedRequestBudgetMs } from './link-budget.js';
 const log = debug('sereus:cadre:strand-wake');
 /** Protocol id for control-network push-wake (parallel to `/sereus/seed/1.0.0`). */
@@ -47,8 +46,8 @@ const MAX_WAKE_SIZE = 64 * 1024;
  * It holds only link work because the receiver acks as soon as it has DECIDED, before the
  * wake itself runs ({@link StrandWakeService.processWakeRequest}).
  *
- * NOTE: the receiver's membership check (two live control reads) runs inside this deadline and
- * is not counted. In steady state those reads touch only held blocks and do not consult the
+ * NOTE: the receiver's membership check (two live control reads, in its protocol guard) runs
+ * inside this deadline and is not counted. In steady state those reads touch only held blocks and do not consult the
  * cohort. If a wake or address request is seen timing out while the receiver's membership read
  * is consulting, count one membership decision in this deadline or answer the check from the
  * materialized authorized-peer snapshot. See docs/cadre-consistency.md → "Deadlines Over
@@ -105,9 +104,10 @@ async function readFrame(stream, timeoutMs) {
 }
 /**
  * Receiver side of the push-wake protocol. Registers a `WAKE_PROTOCOL` handler
- * on the control node and, for each inbound {@link WakeRequest}, gates on cadre
- * membership, replies with a {@link WakeAck}, and starts resuming the named
- * strand if it is hibernating/idle and we participate in it.
+ * on the control node and, for each inbound {@link WakeRequest} (from a peer the
+ * protocol guard has already admitted as an authorized member), replies with a
+ * {@link WakeAck} and starts resuming the named strand if it is hibernating/idle
+ * and we participate in it.
  */
 export class StrandWakeService {
     constructor(options) {
@@ -187,8 +187,7 @@ export class StrandWakeService {
      * Decide the wake for a decoded request and start it. Exposed (not private) so
      * the decision matrix can be unit-tested directly.
      *
-     * - Non-member sender → rejected (`accepted: false`).
-     * - Unknown / not-participated strand → rejected.
+     * - Unknown / not-participated strand → rejected (`accepted: false`).
      * - Hibernating or idle strand → `accepted` with that status, and a wake started.
      * - Already-live strand → no-op, `accepted` with current status.
      *
@@ -198,12 +197,6 @@ export class StrandWakeService {
      * sender's attempt deadline, coupling that deadline to this node's own budgets.
      */
     async processWakeRequest(request, remotePeerId) {
-        // The injected membership predicate is the whole v1 authorization (CadreNode
-        // supplies the voucher-anchored one); only a peer it admits may ask us to wake.
-        if (!(await this.options.isMember(remotePeerId))) {
-            log('Rejecting wake from non-member %s', remotePeerId);
-            return { accepted: false, reason: 'Sender is not a cadre member' };
-        }
         const instance = this.options.getStrand(request.strandId);
         if (!instance) {
             log('Rejecting wake for unknown/unparticipated strand %s', request.strandId);
@@ -275,20 +268,23 @@ export async function dialWake(node, addrs, request, options = {}) {
     return await tryAddrsInTurn(addrs, budget, 'Wake dial', (addr, signal, attemptMs) => sendWake(node, addr, protocolId, request, attemptMs, signal));
 }
 /**
- * Open one stream, send the request, half-close, and read the ack.
+ * Dial one address, open one stream, send the request, half-close, and read the ack.
+ *
+ * The address is dialed outside libp2p's dial queue (`dialAddr`), so another dial of
+ * the target in flight cannot capture this attempt; an open connection is still reused.
  *
- * `signal` is the per-attempt deadline from {@link dialWake}: it goes to
- * `dialProtocol` so a timeout during connect aborts the dial, and into
- * {@link exchangeFrame} so a timeout after the stream is open resets it —
- * releasing the otherwise unbounded ack-read.
+ * `signal` is the per-attempt deadline from {@link dialWake}: it goes to the dial so a
+ * timeout during connect aborts it, and into {@link exchangeFrame} so a timeout after
+ * the stream is open resets it — releasing the otherwise unbounded ack-read.
  */
 async function sendWake(node, addr, protocolId, request, timeoutMs, signal) {
+    const connection = await dialAddr(node, addr, signal, 'Wake dial');
     // `runOnLimitedConnection: true`: the target may be reachable only over a
     // circuit-relay connection (the signaling-first addr), which libp2p marks
     // "limited". The wake exchange is a single tiny request→ack well within the
     // relay's data/duration cap, so opening it on the limited connection is safe
     // and is the whole point of dialing the relay address.
-    const rawStream = await node.dialProtocol(addr, protocolId, { runOnLimitedConnection: true, signal });
+    const rawStream = await connection.newStream(protocolId, { runOnLimitedConnection: true, signal });
     const ack = await exchangeFrame(rawStream, signal, request, (stream) => readFrame(stream, timeoutMs), 'Wake dial aborted by timeout');
     log('Wake ack from %s: accepted=%s status=%s', addr.toString(), ack.accepted, ack.status ?? '-');
     return ack;

package/dist/strand-wake-protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-wake-protocol.js","sourceRoot":"","sources":["../src/strand-wake-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAsB,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,EAAE,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,uBAAuB,CAAC;AAExF,sFAAsF;AACtF,uNAAuN;AACvN,MAAM,4BAA4B,GAAG,KAAM,CAAC;AAE5C,iFAAiF;AACjF,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEzC;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAI,MAAqB,EAAE,SAAiB;IAClE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAM,CAAC;AACzD,CAAC;AAwCD;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IAQ5B,YAAY,OAAiC;QAJrC,SAAI,GAAkB,IAAI,CAAC;QACnC,6EAA6E;QACrE,kBAAa,GAAG,CAAC,CAAC;QAGxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC;IAC7E,CAAC;IAED,gDAAgD;IAChD,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,SAAkB,EAAE,aAAsB,EAAE,EAAE;YACpF,MAAM,YAAY,GAAI,aAA4B,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzE,MAAM,IAAI,CAAC,YAAY,CAAC,SAA0B,EAAE,YAAY,CAAC,CAAC;QACpE,CAAC,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,GAAG,CAAC,0CAA0C,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,YAAY,CAAC,MAAqB,EAAE,YAAoB;QACpE,GAAG,CAAC,gCAAgC,EAAE,YAAY,CAAC,CAAC;QAEpD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,yDAAyD,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACrH,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAoB,EAAE,MAAM,CAAC,CAAC;YACxH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACrF,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,oFAAoF;IAC5E,KAAK,CAAC,YAAY,CAAC,MAAqB,EAAE,YAAoB;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAc,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACzE,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,yCAAyC,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kBAAkB,CAAC,OAAoB,EAAE,YAAoB;QACjE,6EAA6E;QAC7E,gFAAgF;QAChF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,qDAAqD,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAChF,CAAC;QAED,0EAA0E;QAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,8CAA8C,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;YACrH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,4CAA4C,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,QAAgB;QAChC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtD,GAAG,CAAC,yDAAyD,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,KAAkB,EAClB,OAAoB,EACpB,UAA2B,EAAE;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG;QACb,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,kBAAkB,GAAG,YAAY;KAC/D,CAAC;IACF,6EAA6E;IAC7E,yDAAyD;IACzD,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAClF,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,IAAe,EACf,UAAkB,EAClB,OAAoB,EACpB,SAAiB,EACjB,MAAmB;IAEnB,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,uDAAuD;IACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtG,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,SAAqC,EACrC,MAAM,EACN,OAAO,EACP,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAU,MAAM,EAAE,SAAS,CAAC,EACjD,8BAA8B,CAC/B,CAAC;IAEF,GAAG,CAAC,yCAAyC,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"strand-wake-protocol.js","sourceRoot":"","sources":["../src/strand-wake-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAsB,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,EAAE,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,uBAAuB,CAAC;AAExF,sFAAsF;AACtF,uNAAuN;AACvN,MAAM,4BAA4B,GAAG,KAAM,CAAC;AAE5C,iFAAiF;AACjF,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEzC;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAI,MAAqB,EAAE,SAAiB;IAClE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAM,CAAC;AACzD,CAAC;AAsCD;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IAQ5B,YAAY,OAAiC;QAJrC,SAAI,GAAkB,IAAI,CAAC;QACnC,6EAA6E;QACrE,kBAAa,GAAG,CAAC,CAAC;QAGxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC;IAC7E,CAAC;IAED,gDAAgD;IAChD,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,SAAkB,EAAE,aAAsB,EAAE,EAAE;YACpF,MAAM,YAAY,GAAI,aAA4B,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzE,MAAM,IAAI,CAAC,YAAY,CAAC,SAA0B,EAAE,YAAY,CAAC,CAAC;QACpE,CAAC,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,GAAG,CAAC,0CAA0C,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,YAAY,CAAC,MAAqB,EAAE,YAAoB;QACpE,GAAG,CAAC,gCAAgC,EAAE,YAAY,CAAC,CAAC;QAEpD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,yDAAyD,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACrH,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAoB,EAAE,MAAM,CAAC,CAAC;YACxH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACrF,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,oFAAoF;IAC5E,KAAK,CAAC,YAAY,CAAC,MAAqB,EAAE,YAAoB;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAc,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACzE,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,yCAAyC,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,kBAAkB,CAAC,OAAoB,EAAE,YAAoB;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,qDAAqD,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAChF,CAAC;QAED,0EAA0E;QAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,8CAA8C,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;YACrH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,4CAA4C,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,QAAgB;QAChC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtD,GAAG,CAAC,yDAAyD,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,KAAkB,EAClB,OAAoB,EACpB,UAA2B,EAAE;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG;QACb,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,kBAAkB,GAAG,YAAY;KAC/D,CAAC;IACF,6EAA6E;IAC7E,yDAAyD;IACzD,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAClF,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,IAAe,EACf,UAAkB,EAClB,OAAoB,EACpB,SAAiB,EACjB,MAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACnE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,uDAAuD;IACvD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAEnG,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,SAAqC,EACrC,MAAM,EACN,OAAO,EACP,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAU,MAAM,EAAE,SAAS,CAAC,EACjD,8BAA8B,CAC/B,CAAC;IAEF,GAAG,CAAC,yCAAyC,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/trusted-owner-store.d.ts

@@ -1,6 +1,14 @@
 import { type DurableSlot } from './node-local-snapshot.js';
-/** How an owner key entered the anchor (out-of-band provenance). */
-export type TrustSource = 'genesis' | 'invite' | 'operator';
+/**
+ * How an owner key entered the anchor. Every source but `chain` is out-of-band provenance
+ * and forms the base the anchor sync derives from; `claim` is the durable "this node has
+ * been claimed" marker: the first seed whose sender proved it held the node's claim secret
+ * anchored its signer under this source. `chain` marks a key derived from the replicated
+ * `OwnerKey` table through a proof that verified against a key already anchored
+ * (`CadreNode.syncOwnerAnchor`); the sync keeps such an entry while its row is live and
+ * prunes it once the row is gone, which a base entry never is.
+ */
+export type TrustSource = 'genesis' | 'invite' | 'operator' | 'claim' | 'chain';
 export interface TrustedOwnerStore {
     /** Party this anchor is scoped to. */
     readonly partyId: string;
@@ -16,14 +24,28 @@ export interface TrustedOwnerStore {
      */
     all(): ReadonlySet<string>;
     /**
-     * Add a key established out of band (genesis self-trust / invite pin /
-     * operator pin). Idempotent: re-trusting a known key is a no-op that keeps
-     * the original source. Implementations MUST reflect the key in {@link has} /
+     * Every anchored key with its provenance, as a snapshot (same copy contract as
+     * {@link all}). The anchor sync splits the base (every source but `chain`) from the
+     * derived entries with this.
+     */
+    sources(): ReadonlyMap<string, TrustSource>;
+    /**
+     * Add a key. Idempotent with one asymmetry in provenance: re-trusting a known key
+     * keeps its source, EXCEPT that an out-of-band source over an existing `chain` entry
+     * rewrites the provenance (out of band wins: the key is then base, and a later sync
+     * no longer prunes it when its row goes), while `trust(key, 'chain')` over any
+     * existing entry is a no-op. Implementations MUST reflect the key in {@link has} /
      * {@link all} synchronously; the returned promise tracks durability only
      * (a persistent backend's write), so a synchronous caller may safely consult
      * the store right after invoking this.
      */
     trust(ownerKey: string, source: TrustSource): Promise<void>;
+    /**
+     * Drop a key, with {@link trust}'s contract: gone from {@link has} / {@link all}
+     * synchronously, the returned promise tracks durability. Removing an absent key
+     * is a no-op. See the module doc for who may call this.
+     */
+    remove(ownerKey: string): Promise<void>;
 }
 /**
  * Ephemeral in-memory anchor for nodes without durable storage (tests, browser
@@ -36,7 +58,9 @@ export declare class MemoryTrustedOwnerStore implements TrustedOwnerStore {
     constructor(partyId: string);
     has(ownerKey: string): boolean;
     all(): ReadonlySet<string>;
+    sources(): ReadonlyMap<string, TrustSource>;
     trust(ownerKey: string, source: TrustSource): Promise<void>;
+    remove(ownerKey: string): Promise<void>;
 }
 /**
  * Durable {@link TrustedOwnerStore} over an app-supplied {@link DurableSlot} —
@@ -56,9 +80,15 @@ export declare class PersistentTrustedOwnerStore implements TrustedOwnerStore {
     get partyId(): string;
     has(ownerKey: string): boolean;
     all(): ReadonlySet<string>;
+    sources(): ReadonlyMap<string, TrustSource>;
     /**
      * Anchor a key: visible via {@link has} / {@link all} synchronously, then the
      * full snapshot is persisted (see `NodeLocalSnapshot.put`).
      */
     trust(ownerKey: string, source: TrustSource): Promise<void>;
+    /**
+     * Drop a key: gone from {@link has} / {@link all} synchronously, then the full
+     * snapshot is persisted (see `NodeLocalSnapshot.remove`).
+     */
+    remove(ownerKey: string): Promise<void>;
 }