@serfab/cadre-core 1.17.0 → 1.18.0

package/dist/control-schema.js

@@ -2,19 +2,19 @@ import { Parser } from '@quereus/quereus';
 /**
  * The version of the declared control schema, carried in the schema text as the
  * {@link CONTROL_SCHEMA_VERSION_TAG} tag on the `OwnerKey` table. A warm start compares
- * it with the version the store records before applying anything
- * (`control-schema-version.ts`, which also says why that is the version the store was
- * created under).
+ * it with the version the store records before applying anything, and the apply then
+ * migrates the store to this version and records it (`control-schema-version.ts`).
  *
  * When it changes, what a new version may change, and the fixture each version keeps:
- * docs/architecture.md → "Control schema changes and incompatible stores", enforced by
+ * docs/architecture.md → "Control schema versions and migrations", enforced by
  * `control-schema-versions.spec.ts`.
  */
 export const CONTROL_SCHEMA_VERSION = 3;
 /**
  * The first control schema version whose fixture is kept, and the oldest a store can be
- * migrated from. Stores that record no version (written by 1.16.0 and earlier) are not
- * migrated; docs/architecture.md says why.
+ * migrated from. A store that records a version below it (written by 1.16.0 and earlier,
+ * which recorded none) is refused with reason `before-migrations`; docs/architecture.md
+ * says why it is not migrated.
  */
 export const CONTROL_SCHEMA_BASELINE_VERSION = 3;
 /** The `OwnerKey` table tag that records {@link CONTROL_SCHEMA_VERSION} in the schema and in every store. */
@@ -663,7 +663,7 @@ declare schema CadreControl {
     ) with context (Now datetime, ValidationKey text null, ValidationSignature text null);
 
     -- Serves the per-token reads (the cap count above; cadre-core's countFormationUsage,
-    -- isTokenUsed and hasOutstandingFormationInvite) on an append-only table. Its cross-machine
+    -- readToken and hasOutstandingFormationInvite) on an append-only table. Its cross-machine
     -- convergence is guarded by the integration scenario strand-formation-concurrent-redemption.
     index FormationUsageByToken on FormationUsage (Token);
 
@@ -899,16 +899,15 @@ declare schema CadreControl {
 
     -- Append-only retirement record for the stamps of removed rows of every guarded table, with
     -- the removed row's key. Every append is owner-signed, so the growth surface is the owner
-    -- keys. One singleton marker row, ('Revocation', 'ledger', 'opened'), retires nothing: an
-    -- owner's connected reconcile pass files it (ControlDatabase.openRevocationLedger) so this
-    -- table is never a never-written block, which the storage layer would consult the cohort
-    -- for on every guarded insert and membership lookup. Readers filter on their own guarded
+    -- keys. A party founded before genesis created every control collection may hold one marker
+    -- row, ('Revocation', 'ledger', 'opened'), which retires nothing: an owner filed it so this
+    -- table had a collection. Nothing files it now. Readers filter on their own guarded
     -- TableName, and queryRevocations skips it. A 'CadreInvite' or 'OwnerGrant' row withdraws
     -- an invitation or a grant whose row stays (the table comments).
     table Revocation (
         TableName text,             -- 'OwnerKey' | 'ValidationKey' | 'Strand' | 'StrandPartyKey' | 'JoinedStrand' |
                                     -- 'JoinRequest' | 'CadrePeer' | 'DeviceToken' | 'CadreInvite' | 'OwnerGrant', or
-                                    -- 'Revocation' for the marker
+                                    -- 'Revocation' for an older party's marker
         RowKey text,                -- primary key of the removed row
         StampId text,               -- the retired stamp
         ReissuedAt integer default 0,   -- bumped by an owner-signed re-issue so a tombstone committed while the
@@ -938,7 +937,9 @@ declare schema CadreControl {
         -- never existed is harmless: stamps carry 128 random bits (generateStampId). For
         -- 'CadreInvite' and 'OwnerGrant' there is no row-gone test: a tombstone there is a
         -- withdrawal, and the row stays (the table comments). The last branch admits the marker
-        -- row and nothing else under 'Revocation'.
+        -- row an older party may hold, and nothing else under 'Revocation'; nothing files it now.
+        -- NOTE: drop this branch, REVOCATION_LEDGER_MARKER and the readers' skip together with the
+        -- next CONTROL_SCHEMA_VERSION change that already needs a migration.
         constraint RowIsGone check on insert (
             (new.TableName = 'OwnerKey' and not exists (select 1 from OwnerKey K where K.StampId = new.StampId))
                 or (new.TableName = 'CadrePeer' and not exists (select 1 from CadrePeer P where P.StampId = new.StampId))
@@ -957,9 +958,8 @@ declare schema CadreControl {
         -- writer could evict a peer party-wide and block its re-admission. RowKey is not checked
         -- against the retired row here (that would reject a tombstone re-issued later, or filed on
         -- a node that never held the row); each guarded table's RevocationRecorded binds it
-        -- instead. Reads live OwnerKey like the sibling tables. The marker is signed under this
-        -- rule too, over ('Revocation', 'ledger', 'opened'). The stored signer pair must be the
-        -- pair verified here.
+        -- instead. Reads live OwnerKey like the sibling tables. An older party's marker was signed
+        -- under this rule too. The stored signer pair must be the pair verified here.
         constraint Authorized check on insert (
             exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.Revocation', 'remove', party_id(), new.TableName, new.RowKey, new.StampId), context.Signature, A.Key, 'ed25519'))
                 and coalesce(new.SignerKey, '') = context.OwnerKey

package/dist/control-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-schema.js","sourceRoot":"","sources":["../src/control-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAEjD,6GAA6G;AAC7G,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA4GtB,0BAA0B,OAAO,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAi0BzE,CAAC;AAEH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD,2HAA2H;AAC3H,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,mBAAmB,GAAG,CAAC;AAE3E,oGAAoG;AACpG,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,0BAA0B;;EAEzD,oBAAoB;CACrB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAc;IAC1D,MAAM,UAAU,GAAG,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC;IACxC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;WACvB,WAAW,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,UAAU,CAAC;WACpF,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;WACtE,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;WACvF,WAAW,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACd,4DAA4D,mBAAmB,WAAW;YAC1F,iBAAiB,oBAAoB,wCAAwC,CAC7E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB;IACpD,OAAO,IAAI,EAAE,WAAW,EAAE,KAAK,mBAAmB,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"control-schema.js","sourceRoot":"","sources":["../src/control-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAEjD,6GAA6G;AAC7G,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA4GtB,0BAA0B,OAAO,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAi0BzE,CAAC;AAEH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD,2HAA2H;AAC3H,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,mBAAmB,GAAG,CAAC;AAE3E,oGAAoG;AACpG,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,0BAA0B;;EAEzD,oBAAoB;CACrB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAc;IAC1D,MAAM,UAAU,GAAG,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC;IACxC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;WACvB,WAAW,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,UAAU,CAAC;WACpF,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;WACtE,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;WACvF,WAAW,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACd,4DAA4D,mBAAmB,WAAW;YAC1F,iBAAiB,oBAAoB,wCAAwC,CAC7E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAwB;IACpD,OAAO,IAAI,EAAE,WAAW,EAAE,KAAK,mBAAmB,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC"}

package/dist/control-write-retry.d.ts

@@ -28,12 +28,13 @@ import type { ControlRetryOptions } from './control-retry.js';
  * before any matcher runs. The one half-landed write that IS re-presented is a torn write the
  * library marks final — not saved and unable to land ({@link isFinalTornWrite}).
  *
- * TWO policies ship from here, and the split is deliberate: the default
+ * THREE policies ship from here, and the split is deliberate: the default
  * ({@link isRetriableControlWriteFailure}, {@link CONTROL_WRITE_ATTEMPTS}) sits under every
- * control write, and {@link SCHEMA_INIT_RETRY_POLICY} is opted into by
- * `ControlDatabase.applyControlSchema` alone. The widened one absorbs one extra failure class whose
- * re-run safety holds for schema DDL and NOT for writes in general; anything added to the default
- * list must be safe for all ~19 callers.
+ * control write; {@link SCHEMA_INIT_RETRY_POLICY} is opted into by
+ * `ControlDatabase.applyControlSchema` alone; {@link LOST_UPDATE_RETRY_POLICY} is opted into by
+ * the `CadrePeer` writers whose bodies re-read the row and decide again. Each widened one absorbs
+ * one extra failure class whose re-run safety holds for its opted-in bodies and NOT for writes in
+ * general; anything added to the default list must be safe for all ~19 callers.
  *
  * Lives outside `control-database.ts` so a spec can drive the classifier against real engine
  * errors without importing the whole database class. The loop itself lives in
@@ -218,6 +219,14 @@ export declare function isRetriableControlWriteFailure(error: unknown): boolean;
  * default classifier untouched.
  */
 export declare function isRetriableSchemaInitFailure(error: unknown): boolean;
+/**
+ * {@link isRetriableControlWriteFailure} widened by exactly one class — a lost update
+ * ({@link isLostUpdate}), claimed by type — for the `CadrePeer` writers that re-read the row inside
+ * their locked body. Opt-in per call site, via {@link LOST_UPDATE_RETRY_POLICY}; both vetoes still
+ * run first, so a lost update carried inside a partial commit, a spent sync budget or a non-final
+ * torn write stays declined.
+ */
+export declare function isRetriableLostUpdateFailure(error: unknown): boolean;
 /**
  * Policy and pacing overrides for {@link retryControlWrite}. Production callers pass nothing
  * (or a named policy such as {@link SCHEMA_INIT_RETRY_POLICY}); specs inject a recorded
@@ -230,7 +239,7 @@ export declare function isRetriableSchemaInitFailure(error: unknown): boolean;
  */
 export type ControlWriteRetryOptions = ControlRetryOptions;
 /**
- * The one non-default retry policy: `ControlDatabase.applyControlSchema`'s distributed DDL, which
+ * The schema-init policy: `ControlDatabase.applyControlSchema`'s distributed DDL, which
  * additionally absorbs optimystic's self-coordination grace refusal and gets more attempts over a
  * longer backoff to do it (see {@link SCHEMA_INIT_ATTEMPTS} and
  * {@link SCHEMA_INIT_RETRY_DELAYS_MS}). Still bounded by the shared
@@ -241,9 +250,35 @@ export type ControlWriteRetryOptions = ControlRetryOptions;
  * and verified against the pre-apply catalog (full argument at the `applyControlSchema` call site
  * in `control-database.ts`). A second opt-in must re-derive that argument for its own write body
  * first; if this policy ever grows a third consumer, rename it for what the callers share rather
- * than widening it by default.
+ * than widening it by default. {@link LOST_UPDATE_RETRY_POLICY} is a separate policy for a
+ * separate class, not a second consumer of this one.
  */
 export declare const SCHEMA_INIT_RETRY_POLICY: Readonly<ControlWriteRetryOptions>;
+/**
+ * The lost-update policy: the default classifier plus a lost update claimed by type
+ * ({@link isRetriableLostUpdateFailure}), over the default attempts, backoff and budget. A re-run
+ * here is a RE-DECISION, not a re-presentation: the body reads the row again under the lock and
+ * signs over what it finds, so the write that lost to a rival is replaced by one made over the
+ * rival's result. The budget bounds it as it bounds every write — a losing attempt whose read
+ * phase waited out one per-peer read deadline (~7.5 s measured in the degraded-cohort scenario's
+ * trio boot) gets exactly one retry, which is the ceiling to expect; one that waited out two
+ * (14.7 s, measured once in 18 of that scenario's boots, on the member that cannot reach one
+ * sibling) gets none and is abandoned on the budget, and the lost publish is then the reconcile
+ * pass's or the heartbeat's to redo, as every abandoned self-publish is.
+ *
+ * NOTE: the re-run safety this policy assumes is each opted-in body's, not a general property. A
+ * body may opt in only when its read of the row, its decision and its signature ALL run inside
+ * the locked body, so that the re-run presents a write made over the row as it now stands rather
+ * than the first attempt's signed record (which the rival may have stamped past, or which may
+ * overwrite what the rival wrote). Three `CadrePeer` writers opt in, through
+ * `ControlDatabase.mutateCadrePeer`'s policy parameter or `lockedWithRetry` directly:
+ * `updateSelfPeerRecord` (re-reads and re-signs the node's own record), `reauthorizeCadrePeer`
+ * (re-reads the stamp and decides again whether the row is still the owner's to re-touch) and
+ * the two removals `deleteCadrePeer` / `removeMachine` (stamp read and signature already inside
+ * the body, and a self-publish never changes the stamp the `'remove'` digest binds). A new opt-in
+ * must re-derive that argument for its own body first.
+ */
+export declare const LOST_UPDATE_RETRY_POLICY: Readonly<ControlWriteRetryOptions>;
 /**
  * Run `attempt` up to {@link CONTROL_WRITE_ATTEMPTS} times (or `options.attempts`), retrying only
  * failures the policy's classifier — {@link isRetriableControlWriteFailure} by default —

package/dist/control-write-retry.js

@@ -1,5 +1,5 @@
 import { CoordinatorPartialCommitError, SyncRetryExhaustedError, TornActionError } from '@optimystic/db-core';
-import { PartialCommitError } from '@optimystic/quereus-plugin-optimystic';
+import { ConcurrentModificationError, PartialCommitError } from '@optimystic/quereus-plugin-optimystic';
 import { causeChain, chainMessages, retryControlOperation } from './control-retry.js';
 /**
  * Bounded retry for TRANSIENT control-write failures — the classifier and loop behind
@@ -30,12 +30,13 @@ import { causeChain, chainMessages, retryControlOperation } from './control-retr
  * before any matcher runs. The one half-landed write that IS re-presented is a torn write the
  * library marks final — not saved and unable to land ({@link isFinalTornWrite}).
  *
- * TWO policies ship from here, and the split is deliberate: the default
+ * THREE policies ship from here, and the split is deliberate: the default
  * ({@link isRetriableControlWriteFailure}, {@link CONTROL_WRITE_ATTEMPTS}) sits under every
- * control write, and {@link SCHEMA_INIT_RETRY_POLICY} is opted into by
- * `ControlDatabase.applyControlSchema` alone. The widened one absorbs one extra failure class whose
- * re-run safety holds for schema DDL and NOT for writes in general; anything added to the default
- * list must be safe for all ~19 callers.
+ * control write; {@link SCHEMA_INIT_RETRY_POLICY} is opted into by
+ * `ControlDatabase.applyControlSchema` alone; {@link LOST_UPDATE_RETRY_POLICY} is opted into by
+ * the `CadrePeer` writers whose bodies re-read the row and decide again. Each widened one absorbs
+ * one extra failure class whose re-run safety holds for its opted-in bodies and NOT for writes in
+ * general; anything added to the default list must be safe for all ~19 callers.
  *
  * Lives outside `control-database.ts` so a spec can drive the classifier against real engine
  * errors without importing the whole database class. The loop itself lives in
@@ -324,6 +325,33 @@ function isFinalTornWrite(link) {
 function isUnansweredSuperMajorityShortfall(message) {
     return SUPER_MAJORITY_SHORTFALL_UNANSWERED.test(message);
 }
+/**
+ * A LOST UPDATE: the optimystic bridge refusing a commit because another writer changed or
+ * removed a row this statement read (`TransactionBridge.mapCommitRefusal` over a
+ * `TreeEntryChangedError`, `quereus-plugin-optimystic/src/optimystic-adapter/txn-bridge.ts`).
+ * Claimed by TYPE for {@link LOST_UPDATE_RETRY_POLICY} only.
+ *
+ * Why it is a proven non-commit: the refusal is raised inside the action's atomic handler, so
+ * none of that action's entries land. A refusal after a sibling tree or collection of the same
+ * transaction already synced is not delivered bare — the per-tree sweep wraps it in
+ * `PartialCommitError`, the coordinator path in `CoordinatorPartialCommitError` — and
+ * {@link reportsPossiblyStoredWrite} vetoes both by type before this predicate runs. A bare chain
+ * carrying this class therefore means nothing of the write is durable.
+ *
+ * Why it is not in the default list: the rejection is of the write's READ SET, not of its
+ * signature, so re-presenting the same statement is only right when the body re-reads the row and
+ * decides again over what it finds. That is a property of each opted-in body (see the policy's
+ * `NOTE:`), not of control writes in general.
+ *
+ * Not matched by text: `ConcurrentModificationError` is exported from both the plugin's root and
+ * `/plugin` entries over one shared chunk, as `PartialCommitError` is, so the one `instanceof`
+ * covers both (the `NOTE:` on {@link reportsPossiblyStoredWrite} applies to it too). A second
+ * loaded copy of the plugin would fail the `instanceof` and the lost update would then simply not
+ * be retried — the safe side.
+ */
+function isLostUpdate(link) {
+    return link instanceof ConcurrentModificationError;
+}
 /**
  * Optimystic refusing to let a node elect ITSELF coordinator because its last connection dropped
  * less than the guard's grace period ago (`Libp2pKeyPeerNetwork.shouldAllowSelfCoordination` →
@@ -388,9 +416,9 @@ const RETRIABLE_CONTROL_WRITE_MATCHERS = [
  * does not complete — an undo statement threw, the post-unwind catalog did not match the pre-apply
  * fingerprint, that catalog could not be re-collected to check, or a step the differ marks
  * irreversible because it discards data (dropping a table or a column, narrowing a column's type —
- * none of which reaches a `CadreControl` apply: a cold store's diff is all creates, and
- * `refuseIncompatibleControlStore` in `control-schema-version.ts` refuses a warm store whose diff
- * holds anything but creates and tag changes before the apply runs) poisoned the journal before it
+ * of which only dropping a column reaches a `CadreControl` apply, as the catalog-only migration
+ * step `refuseIncompatibleControlStore` in `control-schema-version.ts` lets through; it discards
+ * nothing there, since rows keep the field) poisoned the journal before it
  * ran, leaving nothing unwound — Quereus keeps the failing step's own message, APPENDS the reason the
  * schema could not be restored, and carries the original as `cause`. So a transient cause
  * underneath still matches here, and neither veto ({@link reportsPossiblyStoredWrite},
@@ -443,14 +471,26 @@ export function isRetriableSchemaInitFailure(error) {
     return matchesRetriableFailure(error, RETRIABLE_SCHEMA_INIT_MATCHERS);
 }
 /**
- * Shared body of both classifiers: walk the `cause` chain, let {@link reportsPossiblyStoredWrite}
- * and then {@link reportsIndeterminateCommit} veto it, then claim a final torn write
- * ({@link isFinalTornWrite}), then ask `matchers`. The vetoes run BEFORE any matcher for every
- * policy — a chain reporting a possibly-stored write or a commit-phase batch is never retried,
- * however transient some other level looks, and a final torn write carried by a partial commit is
- * still declined because a sibling collection landed.
+ * {@link isRetriableControlWriteFailure} widened by exactly one class — a lost update
+ * ({@link isLostUpdate}), claimed by type — for the `CadrePeer` writers that re-read the row inside
+ * their locked body. Opt-in per call site, via {@link LOST_UPDATE_RETRY_POLICY}; both vetoes still
+ * run first, so a lost update carried inside a partial commit, a spent sync budget or a non-final
+ * torn write stays declined.
  */
-function matchesRetriableFailure(error, matchers) {
+export function isRetriableLostUpdateFailure(error) {
+    return matchesRetriableFailure(error, RETRIABLE_CONTROL_WRITE_MATCHERS, isLostUpdate);
+}
+/**
+ * Shared body of the three classifiers: walk the `cause` chain, let
+ * {@link reportsPossiblyStoredWrite} and then {@link reportsIndeterminateCommit} veto it, then claim
+ * a final torn write ({@link isFinalTornWrite}) or any link `claimsLink` names, then ask `matchers`.
+ * The vetoes run BEFORE any claim for every policy — a chain reporting a possibly-stored write or a
+ * commit-phase batch is never retried, however transient some other level looks, and a final torn
+ * write or a lost update carried by a partial commit is still declined because a sibling collection
+ * landed. `claimsLink` is the one typed claim a policy may add; it sits here beside the torn-write
+ * claim so the vetoes stay in one place above both.
+ */
+function matchesRetriableFailure(error, matchers, claimsLink) {
     if (!(error instanceof Error)) {
         return false;
     }
@@ -462,13 +502,13 @@ function matchesRetriableFailure(error, matchers) {
     if (reportsIndeterminateCommit(messages)) {
         return false;
     }
-    if (links.some(isFinalTornWrite)) {
+    if (links.some(link => isFinalTornWrite(link) || claimsLink?.(link) === true)) {
         return true;
     }
     return messages.some(message => matchers.some(matches => matches(message)));
 }
 /**
- * The one non-default retry policy: `ControlDatabase.applyControlSchema`'s distributed DDL, which
+ * The schema-init policy: `ControlDatabase.applyControlSchema`'s distributed DDL, which
  * additionally absorbs optimystic's self-coordination grace refusal and gets more attempts over a
  * longer backoff to do it (see {@link SCHEMA_INIT_ATTEMPTS} and
  * {@link SCHEMA_INIT_RETRY_DELAYS_MS}). Still bounded by the shared
@@ -479,13 +519,41 @@ function matchesRetriableFailure(error, matchers) {
  * and verified against the pre-apply catalog (full argument at the `applyControlSchema` call site
  * in `control-database.ts`). A second opt-in must re-derive that argument for its own write body
  * first; if this policy ever grows a third consumer, rename it for what the callers share rather
- * than widening it by default.
+ * than widening it by default. {@link LOST_UPDATE_RETRY_POLICY} is a separate policy for a
+ * separate class, not a second consumer of this one.
  */
 export const SCHEMA_INIT_RETRY_POLICY = {
     attempts: SCHEMA_INIT_ATTEMPTS,
     delaysMs: SCHEMA_INIT_RETRY_DELAYS_MS,
     isRetriable: isRetriableSchemaInitFailure,
 };
+/**
+ * The lost-update policy: the default classifier plus a lost update claimed by type
+ * ({@link isRetriableLostUpdateFailure}), over the default attempts, backoff and budget. A re-run
+ * here is a RE-DECISION, not a re-presentation: the body reads the row again under the lock and
+ * signs over what it finds, so the write that lost to a rival is replaced by one made over the
+ * rival's result. The budget bounds it as it bounds every write — a losing attempt whose read
+ * phase waited out one per-peer read deadline (~7.5 s measured in the degraded-cohort scenario's
+ * trio boot) gets exactly one retry, which is the ceiling to expect; one that waited out two
+ * (14.7 s, measured once in 18 of that scenario's boots, on the member that cannot reach one
+ * sibling) gets none and is abandoned on the budget, and the lost publish is then the reconcile
+ * pass's or the heartbeat's to redo, as every abandoned self-publish is.
+ *
+ * NOTE: the re-run safety this policy assumes is each opted-in body's, not a general property. A
+ * body may opt in only when its read of the row, its decision and its signature ALL run inside
+ * the locked body, so that the re-run presents a write made over the row as it now stands rather
+ * than the first attempt's signed record (which the rival may have stamped past, or which may
+ * overwrite what the rival wrote). Three `CadrePeer` writers opt in, through
+ * `ControlDatabase.mutateCadrePeer`'s policy parameter or `lockedWithRetry` directly:
+ * `updateSelfPeerRecord` (re-reads and re-signs the node's own record), `reauthorizeCadrePeer`
+ * (re-reads the stamp and decides again whether the row is still the owner's to re-touch) and
+ * the two removals `deleteCadrePeer` / `removeMachine` (stamp read and signature already inside
+ * the body, and a self-publish never changes the stamp the `'remove'` digest binds). A new opt-in
+ * must re-derive that argument for its own body first.
+ */
+export const LOST_UPDATE_RETRY_POLICY = {
+    isRetriable: isRetriableLostUpdateFailure,
+};
 /**
  * Run `attempt` up to {@link CONTROL_WRITE_ATTEMPTS} times (or `options.attempts`), retrying only
  * failures the policy's classifier — {@link isRetriableControlWriteFailure} by default —

package/dist/control-write-retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-write-retry.js","sourceRoot":"","sources":["../src/control-write-retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,0NAA0N;AAC1N,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAM,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,CAAC,GAAG,EAAE,IAAK,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,IAAK,CAAC,CAAC;AAEhF,+FAA+F;AAC/F,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAE3C;;;GAGG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,MAAM,mCAAmC,GACxC,+EAA+E,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC/D,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,0BAA0B,CAAC,QAA2B;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,0BAA0B,CAAC,KAAuB;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxB,IAAI,YAAY,uBAAuB;WACpC,CAAC,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;WACxD,IAAI,YAAY,6BAA6B;WAC7C,IAAI,YAAY,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,gBAAgB,CAAC,IAAW;IACpC,OAAO,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED,mFAAmF;AACnF,SAAS,kCAAkC,CAAC,OAAe;IAC1D,OAAO,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,+BAA+B,GACpC,0FAA0F,CAAC;AAE5F,wFAAwF;AACxF,SAAS,8BAA8B,CAAC,OAAe;IACtD,OAAO,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAA8C;IACnF,gCAAgC;IAChC,kCAAkC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,8BAA8B,GAA8C;IACjF,GAAG,gCAAgC;IACnC,8BAA8B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,uBAAuB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,OAAO,uBAAuB,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAC/B,KAAc,EACd,QAAmD;IAEnD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAcD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,4BAA4B;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAChC,OAAyB,EACzB,UAAoC,EAAE;IAEtC,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,6BAA6B;QACvC,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EAAE,8BAA8B;QAC3C,4EAA4E;QAC5E,mDAAmD;QACnD,SAAS,EAAE,eAAe;KAC1B,EAAE,OAAO,CAAC,CAAC;AACb,CAAC"}
+{"version":3,"file":"control-write-retry.js","sourceRoot":"","sources":["../src/control-write-retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AACxG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,0NAA0N;AAC1N,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAM,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,CAAC,GAAG,EAAE,IAAK,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,IAAK,CAAC,CAAC;AAEhF,+FAA+F;AAC/F,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAE3C;;;GAGG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,MAAM,mCAAmC,GACxC,+EAA+E,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC/D,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,0BAA0B,CAAC,QAA2B;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,0BAA0B,CAAC,KAAuB;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxB,IAAI,YAAY,uBAAuB;WACpC,CAAC,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;WACxD,IAAI,YAAY,6BAA6B;WAC7C,IAAI,YAAY,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,gBAAgB,CAAC,IAAW;IACpC,OAAO,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED,mFAAmF;AACnF,SAAS,kCAAkC,CAAC,OAAe;IAC1D,OAAO,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,YAAY,CAAC,IAAW;IAChC,OAAO,IAAI,YAAY,2BAA2B,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,+BAA+B,GACpC,0FAA0F,CAAC;AAE5F,wFAAwF;AACxF,SAAS,8BAA8B,CAAC,OAAe;IACtD,OAAO,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAA8C;IACnF,gCAAgC;IAChC,kCAAkC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,8BAA8B,GAA8C;IACjF,GAAG,gCAAgC;IACnC,8BAA8B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,uBAAuB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,OAAO,uBAAuB,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,OAAO,uBAAuB,CAAC,KAAK,EAAE,gCAAgC,EAAE,YAAY,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC/B,KAAc,EACd,QAAmD,EACnD,UAAqC;IAErC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAcD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,4BAA4B;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,WAAW,EAAE,4BAA4B;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAChC,OAAyB,EACzB,UAAoC,EAAE;IAEtC,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,6BAA6B;QACvC,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EAAE,8BAA8B;QAC3C,4EAA4E;QAC5E,mDAAmD;QACnD,SAAS,EAAE,eAAe;KAC1B,EAAE,OAAO,CAAC,CAAC;AACb,CAAC"}

package/dist/enrolled-machine-store.d.ts

@@ -65,9 +65,9 @@ export declare class PersistentEnrolledMachineStore implements EnrolledMachineSt
      * Record the count: visible via {@link count} synchronously, then persisted.
      *
      * Writes are SKIPPED when the slot already holds this number, because the sole
-     * caller runs on every committed membership write *and* every timed reconcile
-     * pass — a party whose membership is stable would otherwise rewrite the same
-     * integer forever. The skip is keyed off {@link persisted} rather than
+     * caller runs on every membership refresh — each committed membership write, each
+     * replicated membership change, and each reconcile pass down to its backstop — so a
+     * party whose membership is stable would otherwise rewrite the same integer forever. The skip is keyed off {@link persisted} rather than
      * {@link current}, so a write that FAILED is retried by the next refresh instead
      * of being suppressed as "unchanged".
      */

package/dist/enrolled-machine-store.js

@@ -123,9 +123,9 @@ export class PersistentEnrolledMachineStore {
      * Record the count: visible via {@link count} synchronously, then persisted.
      *
      * Writes are SKIPPED when the slot already holds this number, because the sole
-     * caller runs on every committed membership write *and* every timed reconcile
-     * pass — a party whose membership is stable would otherwise rewrite the same
-     * integer forever. The skip is keyed off {@link persisted} rather than
+     * caller runs on every membership refresh — each committed membership write, each
+     * replicated membership change, and each reconcile pass down to its backstop — so a
+     * party whose membership is stable would otherwise rewrite the same integer forever. The skip is keyed off {@link persisted} rather than
      * {@link current}, so a write that FAILED is retried by the next refresh instead
      * of being suppressed as "unchanged".
      */

package/dist/formation-token.d.ts

@@ -0,0 +1,48 @@
+import type { FormationRejectionCode } from './strand-formation-rejection.js';
+/** The `FormationInvite` columns a formation session acts on. */
+export interface FormationInviteFacts {
+    sAppId: string;
+    /** Epoch ms of the stored `ExpiresAt`; null when the invitation never expires. */
+    expiresAtMs: number | null;
+    /** Null is unlimited. */
+    totalUses: number | null;
+    /** A bound invitation's host strand; null on the responder-provisions path. */
+    strandId: string | null;
+    /** The outside approval hook; null when no approval is required. */
+    validationUrl: string | null;
+}
+/**
+ * One formation token as read once at the start of a responder session. Every later step of
+ * the session takes this value instead of reading the invite again.
+ */
+export interface FormationTokenRead {
+    token: string;
+    /** Null: no invite row here (it may not have replicated to this machine yet). */
+    invite: FormationInviteFacts | null;
+    /** Uses recorded so far; counted only for a metered, unexpired invite, else null. */
+    usesRecorded: number | null;
+}
+/**
+ * What the responder's token check yields; an invalid token names which way it failed. The
+ * valid arm carries the session's {@link FormationTokenRead}, absent only when the manager has
+ * no recorder and so accepts every token with nothing read.
+ */
+export type FormationTokenCheck = {
+    valid: true;
+    read?: FormationTokenRead;
+} | {
+    valid: false;
+    code: Extract<FormationRejectionCode, 'token-unknown' | 'token-spent'>;
+};
+/**
+ * `expiresAtMs <= nowMs` is expired: the same boundary `hasOutstandingFormationInvite` applies,
+ * so an invite the formation handler refuses can never hold the connection gate open.
+ */
+export declare function isInviteExpired(invite: FormationInviteFacts, nowMs: number): boolean;
+/** Used up: a metered invite whose recorded uses reached `totalUses`. An unknown token is not used up. */
+export declare function isTokenReadSpent(read: FormationTokenRead): boolean;
+/**
+ * No invite row is `'token-unknown'` (retryable: the row may not have replicated to this
+ * machine yet); an expired or used-up invite is `'token-spent'` (final).
+ */
+export declare function classifyTokenRead(read: FormationTokenRead, nowMs: number): FormationTokenCheck;

package/dist/formation-token.js

@@ -0,0 +1,26 @@
+/**
+ * `expiresAtMs <= nowMs` is expired: the same boundary `hasOutstandingFormationInvite` applies,
+ * so an invite the formation handler refuses can never hold the connection gate open.
+ */
+export function isInviteExpired(invite, nowMs) {
+    return invite.expiresAtMs !== null && invite.expiresAtMs <= nowMs;
+}
+/** Used up: a metered invite whose recorded uses reached `totalUses`. An unknown token is not used up. */
+export function isTokenReadSpent(read) {
+    const totalUses = read.invite?.totalUses ?? null;
+    return totalUses !== null && read.usesRecorded !== null && read.usesRecorded >= totalUses;
+}
+/**
+ * No invite row is `'token-unknown'` (retryable: the row may not have replicated to this
+ * machine yet); an expired or used-up invite is `'token-spent'` (final).
+ */
+export function classifyTokenRead(read, nowMs) {
+    if (read.invite === null) {
+        return { valid: false, code: 'token-unknown' };
+    }
+    if (isInviteExpired(read.invite, nowMs) || isTokenReadSpent(read)) {
+        return { valid: false, code: 'token-spent' };
+    }
+    return { valid: true, read };
+}
+//# sourceMappingURL=formation-token.js.map

package/dist/formation-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formation-token.js","sourceRoot":"","sources":["../src/formation-token.ts"],"names":[],"mappings":"AAoCA;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAA4B,EAAE,KAAa;IACzE,OAAO,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC;AACpE,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC;IACjD,OAAO,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwB,EAAE,KAAa;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC"}

package/dist/index.d.ts

@@ -3,10 +3,10 @@ export { canonicalJson } from './canonical-json.js';
 export { CadreNode, CADRE_INVITATION_DEFAULT_TTL_MS, OWNER_GRANT_DEFAULT_TTL_MS } from './cadre-node.js';
 export { MachineRemovalRefusedError } from './machine-removal.js';
 export { OwnerKeyAddRefusedError, OwnerKeyRemovalRefusedError } from './owner-keys.js';
-export { ControlDatabase, parseNullableStoredDatetimeMs, MissingHostStrandError, InvitationExhaustedError, CadreInviteIssuerUnknownError, OwnerGrantIssuerUnknownError, IssuedRowNotHereYetError, buildAuthorizationMessage, registerPartyIdFunction, formationVouchMessage, formationConsentMessage, cadreInviteAddMessage, cadreInviteRedeemMessage, cadreInviteConsentMessage, ownerGrantAddMessage, ownerGrantRedeemMessage, ownerGrantConsentMessage, projectSeedPeers, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type FormationInviteRow, type MembershipChangeListener, type GuardedDeleteListener, type ControlWriteAbandonedListener, type RevokedRowRef, type ControlSign, type OwnerGrantRedemptionFields } from './control-database.js';
-export { CONTROL_SCHEMA_VERSION, CONTROL_SCHEMA_BASELINE_VERSION } from './control-schema.js';
-export { ControlStoreIncompatibleError } from './control-schema-version.js';
-export { CONTROL_WRITE_ATTEMPTS, CONTROL_WRITE_RETRY_BUDGET_MS, SCHEMA_INIT_ATTEMPTS, SCHEMA_INIT_RETRY_POLICY, isRetriableControlWriteFailure, isRetriableSchemaInitFailure, retryControlWrite, type ControlWriteRetryOptions } from './control-write-retry.js';
+export { ControlDatabase, parseNullableStoredDatetimeMs, MissingHostStrandError, InvitationExhaustedError, CadreInviteIssuerUnknownError, OwnerGrantIssuerUnknownError, IssuedRowNotHereYetError, buildAuthorizationMessage, registerPartyIdFunction, formationVouchMessage, formationConsentMessage, cadreInviteAddMessage, cadreInviteRedeemMessage, cadreInviteConsentMessage, ownerGrantAddMessage, ownerGrantRedeemMessage, ownerGrantConsentMessage, projectSeedPeers, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type FormationInviteRow, type FoundingRows, type FoundingInvite, type MembershipChangeListener, type GuardedDeleteListener, type ControlWriteAbandonedListener, type RevokedRowRef, type ControlSign, type SelfRecordSigner, type CadrePeerRetouchMode, type CadrePeerRetouchOutcome, type OwnerGrantRedemptionFields } from './control-database.js';
+export { CONTROL_SCHEMA_VERSION, CONTROL_SCHEMA_BASELINE_VERSION, CONTROL_SCHEMA_VERSION_TAG } from './control-schema.js';
+export { ControlStoreIncompatibleError, type ControlStoreIncompatibility } from './control-schema-version.js';
+export { CONTROL_WRITE_ATTEMPTS, CONTROL_WRITE_RETRY_BUDGET_MS, LOST_UPDATE_RETRY_POLICY, SCHEMA_INIT_ATTEMPTS, SCHEMA_INIT_RETRY_POLICY, isRetriableControlWriteFailure, isRetriableLostUpdateFailure, isRetriableSchemaInitFailure, retryControlWrite, type ControlWriteRetryOptions } from './control-write-retry.js';
 export { CONTROL_READ_ATTEMPTS, CONTROL_READ_RETRY_DELAYS_MS, CONTROL_READ_RETRY_BUDGET_MS, isRetriableControlReadFailure, retryControlRead, type ControlReadRetryOptions } from './control-read-retry.js';
 export type { ControlRetryAbandonment, ControlRetryAbandonReason, ControlRetryAbandonListener } from './control-retry.js';
 export { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, ownerGrantRowFields, type ControlDomain, type BoundControlDomain, type UnboundControlDomain, type ControlAction, type CadreInviteSignedFields, type OwnerGrantSignedFields } from './control-authorization.js';
@@ -30,23 +30,23 @@ export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js'
 export type { StrandCommitDurability, StrandCommitHeld } from './strand-commit-durability.js';
 export { StrandWatcher, type StrandWatcherCallbacks, type StrandQueryable, type SAppIdLookup, type StrandRowWithApp } from './strand-watcher.js';
 export { StrandInstanceManager, type StartStrandConfig, type ResumeStrandOverrides, getStrandStoragePath, isAwaitingFirstSync, liveStrandStatus } from './strand-instance-manager.js';
-export { StrandAwaitingFirstSyncError, DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS, DEFAULT_STRAND_FIRST_SYNC_POLL_MS, strandHeaderHeld, appTablesReadable, strandFirstSyncComplete, type StrandFirstSyncConfig } from './strand-first-sync-gate.js';
+export { StrandAwaitingFirstSyncError, DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS, DEFAULT_STRAND_FIRST_SYNC_BACKSTOP_MS, type StrandFirstSyncConfig } from './strand-first-sync-gate.js';
 export { PeerJoinBackfill, DEFAULT_PEER_JOIN_BACKFILL, MAX_BLOCK_MESSAGE_BYTES, PEER_JOIN_BACKFILL_WARN_AFTER_FAILURES, type PeerJoinBackfillConfig, type PeerJoinBackfillDeps, type PeerJoinBackfillResult, type PeerJoinBackfillPushClient } from './peer-join-backfill.js';
 export { strandCohortTopicOption, type StrandReactivityConfig } from './strand-reactivity.js';
-export { StrandRevocationEnforcer, createRevocationConnectionGater, readStrandRevocationRows, DEFAULT_REVOCATION_POLL_INTERVAL_MS, type StrandRevocationEnforcementConfig, type StrandRevocationEnforcerDeps, type StrandRevocationRows, type StrandMemberPeerBinding, type StrandRevocationJudge, type StrandRevocationNetwork, type RevocationRefreshScheduler } from './strand-revocation-enforcer.js';
-export { StrandMembershipReconciler, IDLE_PASSES_BEFORE_ESCALATION, INITIAL_JOIN_RETRY_INTERVAL_MS, type StrandMembershipReconcilerDeps, type StrandMembershipReconciliationConfig, type PendingMembershipInviteSource } from './strand-membership-reconciler.js';
+export { StrandRevocationEnforcer, createRevocationConnectionGater, readStrandRevocationRows, DEFAULT_REVOCATION_BACKSTOP_MS, REVOCATION_REFRESH_RETRY_MS, REVOCATION_WIDE_STRAND_REFRESH_MS, type StrandRevocationEnforcementConfig, type StrandRevocationEnforcerDeps, type StrandRevocationRows, type StrandMemberPeerBinding, type StrandRevocationJudge, type StrandRevocationNetwork } from './strand-revocation-enforcer.js';
+export { StrandMembershipReconciler, DEFAULT_MEMBERSHIP_RECONCILE_INTERVAL_MS, IDLE_PASSES_BEFORE_ESCALATION, INITIAL_JOIN_RETRY_INTERVAL_MS, type StrandMembershipReconcilerDeps, type StrandMembershipReconciliationConfig, type PendingMembershipInviteSource } from './strand-membership-reconciler.js';
 export { defaultTimeoutScheduler, type TimeoutScheduler } from './timeout-scheduler.js';
 export { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
 export { ArachnodeStub, createArachnodeStub, type RingConfig } from './arachnode-stub.js';
 export { EnrollmentService, type MemberVerifier, type MemberRegistry } from './enrollment.js';
-export { StrandSolicitationService, createDefaultFormationResponseValidator, type DisclosureValidator, type FormationUsageRecorder, type FormationUsageParams, type AuthorizedFormationUsage, type ResolvedHostStrand, type StrandProvisioner, type FormationResponseValidator, type StrandSolicitationServiceOptions } from './strand-solicitation.js';
+export { StrandSolicitationService, createDefaultFormationResponseValidator, type DisclosureValidator, type FormationUsageRecorder, type FormationUsageParams, type AuthorizedFormationUsage, type BoundHostStrand, type ResolvedHostStrand, type StrandProvisioner, type FormationResponseValidator, type StrandSolicitationServiceOptions } from './strand-solicitation.js';
 export { createHttpFormationApprover, signFormationApproval, verifyFormationApproval, FormationApprovalError, type FormationApprovalRequest, type FormationVouchFields, type FormationApproval, type FormationApprover, type FormationApprovalFailure } from './formation-approval.js';
 export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
 export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
 export { signStrandPayload, verifyStrandPayload, signStrandApproval, generateStrandStampId, bootstrapFounderMembership, PreSplitStrandIdentityError, issueInvite, consumeInvite, burnInvite, isStrandMember, cancelInvite, listOutstandingInvites, addMemberByManager, revokeMember, leaveStrand, registerMemberPeer, listMemberPeers, removeMemberPeer, addManager, admitManager, removeManager, sealStrand, isStrandSealed, StrandTransactionBusyError, STRAND_ENGINE, STRAND_ENGINE_VERSION, type FounderBootstrapParams, type IssueInviteParams, type IssuedInvite, type ConsumeInviteParams, type CancelInviteParams, type OutstandingInvite, type AddMemberByManagerParams, type RevokeMemberParams, type LeaveStrandParams, type RegisterMemberPeerParams, type RemoveOwnPeerParams, type RemoveMemberPeerByManagerParams, type RemoveMemberPeerParams, type AddManagerParams, type AdmitManagerParams, type RemoveManagerParams, type SealStrandParams, type StrandWriteOptions } from './strand-membership-writer.js';
 export { canonicalDatetime } from './canonical-datetime.js';
 export { StrandMemberRegistry, StrandMemberVerifier, memberRegistrationPayload, type StrandAdmission } from './strand-member-registry.js';
-export { SeedBootstrapService, SEED_PROTOCOL, mergeSeedPeers, seedDigest, type SeedBootstrapConfig, type SeedEventCallbacks } from './seed-bootstrap.js';
+export { SeedBootstrapService, SEED_PROTOCOL, mergeSeedPeers, seedDialTargets, seedDigest, type SeedBootstrapConfig, type SeedEventCallbacks } from './seed-bootstrap.js';
 export { peerAuthorizationDigest, cadrePeerVoucherDigest, cadrePeerRemoveDigest, deviceTokenAddDigest, deviceTokenRemoveDigest, formationConsentDigest, cadreInviteAddDigest, cadreInviteRedeemDigest, cadreInviteConsentDigest, ownerKeyAddDigest, verifyPeerAuthorization, verifyCadrePeerVoucher, verifyOwnerKeyVoucher, verifyRevocationSigner, verifyFormationConsent, verifyInvitationAdmission, verifyCadreInviteRow, verifyCadreInviteRedemption, ownerGrantAddDigest, ownerGrantRedeemDigest, ownerGrantConsentDigest, verifyOwnerGrantRow, verifyOwnerGrantRedemption, verifyOwnerGrantAdmission, type DeviceTokenAuthorizedRow } from './peer-authorization.js';
 export { deriveOwnerAnchor, type OwnerAnchorInputs, type OwnerAnchorDerivation } from './owner-anchor-sync.js';
 export { StrandWakeService, dialWake, WAKE_PROTOCOL, DEFAULT_WAKE_DIAL_BUDGET_MS, type StrandWakeServiceOptions, type DialWakeOptions } from './strand-wake-protocol.js';
@@ -57,7 +57,7 @@ export { STRAND_WAKE_TYPE, type StrandWakePayload } from './strand-wake-payload.
 export type { PushNotifier, PushMessage, PushSendResult } from './push-notifier.js';
 export { validatePushCredentials, redactPushCredentials, REDACTED } from './push-credentials.js';
 export { PushFanoutService, DEFAULT_PUSH_COOLDOWN_MS, DEFAULT_PUSH_DEBOUNCE_MS, type PushFanoutOptions, type FanoutMember } from './push-fanout.js';
-export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE, type ControlCohortSelection, type ControlCohortReconcileResult } from './control-cohort.js';
+export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE, CONTROL_COHORT_REDIAL_MS, type ControlCohortSelection, type ControlCohortReconcileResult } from './control-cohort.js';
 export { dialAddr, withTrailingPeerId, dialPeerAddrs, SelfRelayOnlyError, PeerUnreachableError, tryAddrsInTurn, directBeforeRelayed, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS, DEFAULT_PEER_DIAL_BUDGET, type PeerDialBudget, type AddrDialer } from './peer-dial.js';
 export { DECLARED_LINK_ROUND_TRIP_MS, CIRCUIT_DIAL_ROUND_TRIPS, RELAY_DIAL_ROUND_TRIPS, RELAYED_DIAL_ROUND_TRIPS, RELAY_RESERVATION_ROUND_TRIPS, CIRCUIT_REQUEST_ROUND_TRIPS, RELAYED_REQUEST_ROUND_TRIPS, PUSH_TRANSFER_ALLOWANCE_MS, ADMISSION_DECISION_TIMEOUT_MS, resolveLinkRoundTripMs, relayedDialBudgetMs, relayReservationBudgetMs, circuitRequestBudgetMs, relayedRequestBudgetMs, peerJoinPushBudget, type PeerJoinPushBudget, DIAL_ADMISSION_DECISIONS, optimysticDialLimits, type OptimysticDialLimits } from './link-budget.js';
 export { anchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy, claimSecretTrustPolicy, type SeedTrustPolicy, type SeedTrustContext, type SeedTrustDecision, type ClaimSecretTrustPolicyOptions } from './seed-trust-policy.js';
@@ -67,14 +67,15 @@ export { exportStrandBundle, adoptStrandBundle, readStrandHoldings, unheldBundle
 export { encodeCadreJoinRequest, decodeCadreJoinRequest, requireCadreJoinReply, CADRE_JOIN_REQUEST_PREFIX, CADRE_INVITATION_PREFIX, OWNER_KEY_EXPORT_STEM, OWNER_GRANT_PREFIX, CADRE_JOIN_REQUEST_MAX_APP_NAME, type CadreJoinReply, type CadreJoinRequest } from './cadre-join-request.js';
 export * from './provider/index.js';
 export { signSchema, verifySchema, assertSchemaSignature, SchemaVerificationError } from './schema-verification.js';
-export { FormationListener, dialFormation, dialFormationByMachine, isValidResponderCreatesResult, isWellFormedMembershipInvite, sanitizeStrandAddrs, FORMATION_PROTOCOL, type FormationParty, type FormationContactMessage, type FormationResultMessage, type FormationProvisionResult, type FormationStrandInfo, type FormationDbConnectionInfo, type FormationListenerOptions, type FormationDialOptions, type FormationDialResult, type FormationRejection, type FormationTokenCheck, type ResponderProvisionOutcome } from './strand-formation-protocol.js';
+export { FormationListener, dialFormation, dialFormationByMachine, isValidResponderCreatesResult, isWellFormedMembershipInvite, sanitizeStrandAddrs, FORMATION_PROTOCOL, type FormationParty, type FormationContactMessage, type FormationResultMessage, type FormationProvisionResult, type FormationStrandInfo, type FormationDbConnectionInfo, type FormationListenerOptions, type FormationDialOptions, type FormationDialResult, type FormationRejection, type ResponderProvisionOutcome } from './strand-formation-protocol.js';
+export { classifyTokenRead, isTokenReadSpent, type FormationInviteFacts, type FormationTokenRead, type FormationTokenCheck } from './formation-token.js';
 export { FormationRejectedError, FormationUnreachableError, FormationPostApprovalError, FORMATION_REJECTION_RETRYABLE, isFormationRejectionCode, type FormationRejectionCode } from './strand-formation-rejection.js';
 export { formationDeadlines, type FormationDeadlines } from './strand-formation-deadlines.js';
-export { CadreInviteHandler, redeemAtMembers, redeemInPasses, signRedeemRequest, verifyRedeemReply, encodeCadreInvitation, decodeCadreInvitation, isWellFormedCadreInviteRow, sanitizeAddrs, CadreInviteRejectedError, CadreInviteUnreachableError, CadreInviteReplyInvalidError, CADRE_INVITE_PROTOCOL, CADRE_INVITE_REJECTION_RETRYABLE, isCadreInviteRejectionCode, type CadreInvitation, type CadreInviteRedeemRequest, type CadreInviteRedeemReply, type CadreInviteAccepted, type CadreInviteRejectionCode, type CadreInviteAddressOutcome, type CadreInviteHandlerOptions, type CadreInviteStore, type RedeemAtMembersOptions, type RedeemInPassesOptions, type RedeemSigner, type CadreInviteRedemption } from './cadre-invite-protocol.js';
+export { CadreInviteHandler, redeemAtMembers, redeemInPasses, signRedeemRequest, verifyRedeemReply, encodeCadreInvitation, decodeCadreInvitation, isWellFormedCadreInviteRow, sanitizeAddrs, CadreInviteRejectedError, CadreInviteUnreachableError, CadreInviteReplyInvalidError, CADRE_INVITE_PROTOCOL, CADRE_INVITE_REJECTION_RETRYABLE, isCadreInviteRejectionCode, type CadreInvitation, type CadreInviteRedeemRequest, type CadreInviteRedeemReply, type CadreInviteAccepted, type CadreInviteRejectionCode, type CadreInviteAddressOutcome, type CadreInviteHandlerOptions, type CadreInviteStore, type RedeemAtMembersOptions, type RedeemInPassesOptions, type RedeemSigner, type RedeemSelfRecord, type CadreInviteRedemption } from './cadre-invite-protocol.js';
 export { OwnerGrantHandler, redeemOwnerGrantAtMembers, redeemOwnerGrantInPasses, signOwnerGrantRequest, verifyOwnerGrantReply, encodeOwnerGrant, decodeOwnerGrant, isWellFormedOwnerGrantRow, OwnerGrantRejectedError, OwnerGrantUnreachableError, OwnerGrantReplyInvalidError, OWNER_GRANT_PROTOCOL, OWNER_GRANT_REJECTION_RETRYABLE, isOwnerGrantRejectionCode, type OwnerGrantBundle, type OwnerGrantRedeemRequest, type OwnerGrantRedeemReply, type OwnerGrantAccepted, type OwnerGrantRejectionCode, type OwnerGrantHandlerOptions, type OwnerGrantStore, type RedeemOwnerGrantAtMembersOptions, type RedeemOwnerGrantInPassesOptions, type OwnerGrantRedemption } from './owner-grant-protocol.js';
 export { MemberRedemptionHandler, dialRedemption, dialRedemptionInPasses, MAX_REDEMPTION_FRAME_BYTES, type MemberRedemptionHandlerOptions, type MemberRedemptionOptions, type MemberRedemptionPassOptions, type MemberRedemption, type RedemptionAddressOutcome, type RedemptionRejection, type RedemptionRefusalFrame } from './member-redemption.js';
 export { selectCadreInvitationMembers, cadreInvitationReach, CADRE_INVITATION_MAX_ADDRS, CADRE_INVITATION_ADDRS_PER_SIBLING } from './invitation-bootstrap.js';
-export { PENDING_JOIN_POLL_MS, PENDING_JOIN_MAX_BACKOFF_MS, MAX_PENDING_JOIN_MS } from './pending-join-runner.js';
+export { PENDING_JOIN_BACKSTOP_MS, PENDING_JOIN_MAX_BACKOFF_MS, MAX_PENDING_JOIN_MS } from './pending-join-runner.js';
 export { StrandFormationManager, createStrandFormationManager, MEMBERSHIP_INVITE_TTL_MS, MEMBERSHIP_INVITE_UNAVAILABLE_REASON, HOST_STRAND_MUST_BE_RECREATED_REASON, type CadrePeerAddrsSource, type MembershipInviteIssuer, type StrandFormationManagerConfig, type StrandFormationManagerOptions } from './strand-formation-manager.js';
 export { controlProtocolClasses, type ControlProtocolClass } from './control-protocol-guard.js';
 export { createMembershipConnectionGater, PROVISIONAL_ADMISSION_DEADLINE_MS, PROVISIONAL_ADMISSION_CLOSE_TIMEOUT_MS, MAX_UNAUTHORIZED_RELAY_RESERVATIONS, UnauthorizedReservationBudget, type InboundAdmissionPolicy, type InboundConnectionVerdict } from './membership-connection-gater.js';