@serfab/cadre-core 1.3.0 → 1.5.0

package/dist/index.js

@@ -51,8 +51,10 @@ export { MemoryBootstrapPeerStore, PersistentBootstrapPeerStore } from './bootst
 export { MemoryEnrolledMachineStore, PersistentEnrolledMachineStore } from './enrolled-machine-store.js';
 // Storage scope keys — what `CadreNodeConfig.storage.provider` is called with. A
 // strand's key is its strand id; the control database's key carries the party id,
-// so two parties on one device never share a control store.
-export { controlStorageScope, isControlStorageScope } from './storage-scope.js';
+// so two parties on one device never share a control store. Every key stays within
+// `[A-Za-z0-9._-]`: the control key by base64url encoding, a strand's by
+// `assertStrandScopeKey`, which every strand launch runs.
+export { controlStorageScope, isControlStorageScope, isValidStrandScopeKey, assertStrandScopeKey, InvalidStrandIdError } from './storage-scope.js';
 // Strand database
 export { StrandDatabase } from './strand-database.js';
 // Strand management
@@ -65,7 +67,7 @@ export { StrandAwaitingFirstSyncError, DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS, DEF
 // Peer-join block catch-up (push this network's own blocks to each newly
 // connected peer, so a late joiner physically holds pre-join blocks). Shared
 // by the strand networks (ungated) and the control network (membership-gated).
-export { PeerJoinBackfill, DEFAULT_PEER_JOIN_BACKFILL, MAX_BLOCK_MESSAGE_BYTES } from './peer-join-backfill.js';
+export { PeerJoinBackfill, DEFAULT_PEER_JOIN_BACKFILL, MAX_BLOCK_MESSAGE_BYTES, PEER_JOIN_BACKFILL_WARN_AFTER_FAILURES } from './peer-join-backfill.js';
 // Closed-strand revoked-peer enforcement (deny the network nodes of removed
 // members at the stream and connection layers, and hang up the sessions they
 // already hold — see the module doc for the settled deny-list design, the
@@ -134,7 +136,10 @@ export { PushFanoutService, DEFAULT_PUSH_COOLDOWN_MS, DEFAULT_PUSH_DEBOUNCE_MS }
 export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
 // Dialing one peer from several candidate addresses, each under its own time
 // limit, so an address that never answers cannot starve the rest.
-export { dialPeerAddrs, tryAddrsInTurn, directBeforeRelayed, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS, DEFAULT_PEER_DIAL_BUDGET } from './peer-dial.js';
+export { dialPeerAddrs, tryAddrsInTurn, directBeforeRelayed, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS, DEFAULT_PEER_DIAL_BUDGET } from './peer-dial.js';
+// Dial and reservation budgets counted in link round trips rather than fixed milliseconds, so
+// one declared assumption about the link moves them all — see `NetworkConfig.linkRoundTripMs`.
+export { DECLARED_LINK_ROUND_TRIP_MS, RELAYED_DIAL_ROUND_TRIPS, RELAY_RESERVATION_ROUND_TRIPS, CIRCUIT_REQUEST_ROUND_TRIPS, PUSH_TRANSFER_ALLOWANCE_MS, resolveLinkRoundTripMs, relayedDialBudgetMs, relayReservationBudgetMs, circuitRequestBudgetMs, peerJoinPushBudget } from './link-budget.js';
 // Seed trust policy (trust anchor for incoming seeds)
 export { anchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy } from './seed-trust-policy.js';
 // Schema Verification
@@ -144,7 +149,7 @@ export { FormationListener, dialFormation, isValidResponderCreatesResult, isWell
 // Strand Formation manager (drives the native transport)
 export { StrandFormationManager, createStrandFormationManager, MEMBERSHIP_INVITE_TTL_MS, MEMBERSHIP_INVITE_UNAVAILABLE_REASON, HOST_STRAND_MUST_BE_RECREATED_REASON } from './strand-formation-manager.js';
 // Control-network inbound connection gate (membership defense-in-depth)
-export { createMembershipConnectionGater, STRANGER_OPEN_PROTOCOLS, DEFAULT_ENROLLMENT_WINDOW_MS, ADMISSION_DECISION_TIMEOUT_MS, RELAY_ADMISSION_RESERVE_DEADLINE_MS, MAX_UNAUTHORIZED_RELAY_RESERVATIONS, UNAUTHORIZED_RESERVATION_TTL_MS, UnauthorizedReservationBudget } from './membership-connection-gater.js';
+export { createMembershipConnectionGater, STRANGER_OPEN_PROTOCOLS, DEFAULT_ENROLLMENT_WINDOW_MS, ADMISSION_DECISION_TIMEOUT_MS, RELAY_ADMISSION_RESERVE_DEADLINE_MS, RELAY_ADMISSION_CLOSE_TIMEOUT_MS, MAX_UNAUTHORIZED_RELAY_RESERVATIONS, UNAUTHORIZED_RESERVATION_TTL_MS, UnauthorizedReservationBudget } from './membership-connection-gater.js';
 // Thrown out of `CadreNode.start()` when a `network.relayAddrs` reservation does
 // not land on its first attempt — the fail-fast posture of that config field now
 // that the control node reserves AFTER control-database bring-up (relay-addrs.ts).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,EAAwO,MAAM,uBAAuB,CAAC;AAElZ,+EAA+E;AAC/E,qFAAqF;AACrF,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,yFAAyF;AACzF,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAWjC,2FAA2F;AAC3F,OAAO,EAAE,0BAA0B,EAA0C,MAAM,4BAA4B,CAAC;AAEhH,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,0BAA0B,EAAuB,MAAM,kBAAkB,CAAC;AAE1I,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,6CAA6C;AAC7C,mEAAmE;AACnE,wDAAwD;AACxD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAG5B,MAAM,0BAA0B,CAAC;AAQlC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAG7B,MAAM,2BAA2B,CAAC;AAEnC,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,2DAA2D;AAC3D,iFAAiF;AACjF,+EAA+E;AAC/E,oDAAoD;AACpD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAE/B,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,kFAAkF;AAClF,4DAA4D;AAC5D,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAEtC,kFAAkF;AAClF,sFAAsF;AACtF,kEAAkE;AAClE,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,iCAAiC,EACjC,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAExB,MAAM,6BAA6B,CAAC;AAErC,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EAKxB,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2CAA2C;AAC3C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,EAQpC,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAI/B,MAAM,mCAAmC,CAAC;AAE3C,oFAAoF;AACpF,oFAAoF;AACpF,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAOxC,MAAM,0BAA0B,CAAC;AAElC,wFAAwF;AACxF,yFAAyF;AACzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EAMvB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,qBAAqB;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,EACd,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EAmBtB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,2BAA2B,EAG5B,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAGrC,MAAM,qBAAqB,CAAC;AAE7B,6EAA6E;AAC7E,kEAAkE;AAClE,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,sCAAsC,EACtC,kDAAkD,EAClD,wBAAwB,EAGzB,MAAM,gBAAgB,CAAC;AAExB,sDAAsD;AACtD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAWnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,oCAAoC,EACpC,oCAAoC,EAGrC,MAAM,+BAA+B,CAAC;AAEvC,wEAAwE;AACxE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,EACnC,mCAAmC,EACnC,+BAA+B,EAC/B,6BAA6B,EAG9B,MAAM,kCAAkC,CAAC;AAE1C,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,yEAAyE;AACzE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,YAAY;AACZ,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAEnF,gFAAgF;AAChF,0EAA0E;AAC1E,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAM7B,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,EAAwO,MAAM,uBAAuB,CAAC;AAElZ,+EAA+E;AAC/E,qFAAqF;AACrF,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,yFAAyF;AACzF,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAWjC,2FAA2F;AAC3F,OAAO,EAAE,0BAA0B,EAA0C,MAAM,4BAA4B,CAAC;AAEhH,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,0BAA0B,EAAuB,MAAM,kBAAkB,CAAC;AAE1I,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,6CAA6C;AAC7C,mEAAmE;AACnE,wDAAwD;AACxD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAG5B,MAAM,0BAA0B,CAAC;AAQlC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAG7B,MAAM,2BAA2B,CAAC;AAEnC,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,2DAA2D;AAC3D,iFAAiF;AACjF,+EAA+E;AAC/E,oDAAoD;AACpD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAE/B,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,yEAAyE;AACzE,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAEtC,kFAAkF;AAClF,sFAAsF;AACtF,kEAAkE;AAClE,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,iCAAiC,EACjC,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAExB,MAAM,6BAA6B,CAAC;AAErC,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,sCAAsC,EAKvC,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2CAA2C;AAC3C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,EAQpC,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAI/B,MAAM,mCAAmC,CAAC;AAE3C,oFAAoF;AACpF,oFAAoF;AACpF,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAOxC,MAAM,0BAA0B,CAAC;AAElC,wFAAwF;AACxF,yFAAyF;AACzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EAMvB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,qBAAqB;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,EACd,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EAmBtB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,2BAA2B,EAG5B,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAGrC,MAAM,qBAAqB,CAAC;AAE7B,6EAA6E;AAC7E,kEAAkE;AAClE,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,sCAAsC,EACtC,kDAAkD,EAClD,oCAAoC,EACpC,wBAAwB,EAGzB,MAAM,gBAAgB,CAAC;AAExB,8FAA8F;AAC9F,+FAA+F;AAC/F,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAE1B,sDAAsD;AACtD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAWnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,oCAAoC,EACpC,oCAAoC,EAGrC,MAAM,+BAA+B,CAAC;AAEvC,wEAAwE;AACxE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,EACnC,gCAAgC,EAChC,mCAAmC,EACnC,+BAA+B,EAC/B,6BAA6B,EAG9B,MAAM,kCAAkC,CAAC;AAE1C,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,yEAAyE;AACzE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,YAAY;AACZ,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAEnF,gFAAgF;AAChF,0EAA0E;AAC1E,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAM7B,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}

package/dist/link-budget.d.ts

@@ -0,0 +1,182 @@
+/**
+ * Dial and reservation budgets derived from ONE declared link round trip, instead of fixed
+ * millisecond numbers chosen on a fast local network.
+ *
+ * Reaching another machine through a relay costs a FIXED NUMBER OF EXCHANGES, not a fixed
+ * number of milliseconds. So every budget written as milliseconds has a link speed above which
+ * it can never open a connection at all — and the slower the link, the more of them fall over,
+ * silently, because an abandoned dial looks the same as a peer that is not there. Counting round
+ * trips instead is what stops that class of defect coming back: the next person to widen a
+ * budget changes ONE declaration, and the next person to add a dial writes down its round-trip
+ * count beside the arithmetic.
+ *
+ * ── The instrument ──
+ *
+ * Every count and every number below comes from
+ * `packages/integration-tests/src/scenarios/relayed-dial-cost-by-latency.integration.ts`, which
+ * is committed and opt-in (`RELAY_DIAL_COST=1`). **Its doc comment is the single home of the
+ * measurement**; this module holds only what the derivation needs. Re-run it before changing
+ * anything here.
+ *
+ * ── The unit ──
+ *
+ * ONE LINK ROUND TRIP is a message from one machine reaching the other and a reply coming
+ * back, over the path those two machines actually use — through the relay, when that is the
+ * only way they can reach each other. In the instrument, which injects a constant ONE-WAY
+ * frame delay `d`, one link round trip is `2d`.
+ *
+ * A leg between a node and the RELAY is half a link round trip, because it crosses one of the
+ * two hops rather than both. That is why the reservation drive's cost reads as "four
+ * node-to-relay round trips" in one telling and "two link round trips" in another: same
+ * quantity, different unit. This module uses the LINK round trip throughout, so there is one
+ * unit to reason in.
+ *
+ * ── The counts, and what they cost ──
+ *
+ * | operation                                            | link round trips | at the declared default |
+ * | ---------------------------------------------------- | ---------------- | ----------------------- |
+ * | open a relayed connection to another machine          | 4                | 8 000 ms                |
+ * | dial the relay itself                                 | 1                | 2 000 ms                |
+ * | request a reservation on an open relay connection     | 1                | 2 000 ms                |
+ * | negotiate a protocol over an established circuit      | 1                | 2 000 ms                |
+ *
+ * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay, re-run for this
+ * change: a relayed dial took 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and
+ * **12 066-12 094 ms at 1 500 ms one-way**. Four link round trips of pure delay would be 7 200
+ * and 12 000, so the real cost sits about 60-95 ms ABOVE the arithmetic — the handshakes and a
+ * phone's pure-JS crypto, which no delay figure contains. That residue is small but it is why
+ * {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the band sereus supports rather
+ * than matching it exactly: a declaration equal to the measured round trip would derive a
+ * budget marginally BELOW the dial it has to contain.
+ *
+ * ── The ceiling this does NOT lift ──
+ *
+ * Above roughly 1 250 ms one-way — a 2.5-second link round trip — no relayed connection can be
+ * established by this stack whatever cadre declares here. Two budgets of 10 000 ms each inside
+ * libp2p bound the same dial and cannot be reached from sereus at all:
+ * `connectionManager.dialTimeout` (libp2p's own default, which `@optimystic/db-p2p`'s
+ * `libp2p-node-base.ts` neither sets nor exposes) and `connectionManager.inboundUpgradeTimeout`
+ * (which it sets to 10 000). Both appear in the same re-run: at 1 500 ms one-way the dial under
+ * libp2p's default failed with `The operation was aborted due to timeout`, and with the shipped
+ * inbound-upgrade budget the DIALER's own 12 094 ms dial resolved while the LISTENER had
+ * already thrown the half-built connection away — so the first stream over it died with
+ * `Unexpected EOF - stream closed while reading 0/1 bytes` and the listener reported no peer at
+ * all. That is why a too-slow link produces silence rather than an error.
+ *
+ * Two consequences for a reader choosing a declaration. Below that ceiling, the DEFAULT
+ * declaration of 2 000 ms does not reach it: four round trips of 2 000 ms is 8 000 ms, which
+ * covers a one-way delay up to 1 000 ms, so a deployment somewhere between 1 000 and 1 250 ms
+ * one-way has to declare its own (about 2 200-2 500) to use the band libp2p still allows. And
+ * declaring much ABOVE 2 500 buys nothing: the budgets here grow, and
+ * the connection still fails inside libp2p. Lifting that needs an upstream change and a
+ * decision about how slow a link sereus intends to carry —
+ * `tickets/blocked/how-slow-a-relayed-link-does-sereus-carry`. A reader who raised these
+ * numbers and still cannot connect at 1 500 ms one-way has met that ceiling, not this module.
+ */
+/**
+ * The link round trip cadre assumes when a host declares none, in milliseconds. A deployment
+ * that knows its own link states it with `NetworkConfig.linkRoundTripMs` instead.
+ *
+ * **Why 2 000.** It states the slowest link sereus already claims to support, and two other
+ * budgets fix that claim independently: `COHORT_READ_DEADLINE_MS`
+ * (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
+ * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`, 120 000 ms) were both
+ * sized against two parties reaching each other only through a public relay at a round trip
+ * near 1.8 s. Declaring 2 000 rounds that band up and leaves about 720 ms over the worst
+ * relayed dial measured at it (7 279 ms against a derived 8 000 ms).
+ *
+ * Raising it is how a deployment that KNOWS its link is slower moves every derived budget at
+ * once. The cost is the ordinary cost of a longer deadline: a peer that is genuinely gone holds
+ * the operation for that much longer before it is abandoned and retried. Above about 2 500 it
+ * buys nothing — see the module doc's ceiling paragraph.
+ */
+export declare const DECLARED_LINK_ROUND_TRIP_MS = 2000;
+/**
+ * Link round trips one relayed connection setup costs: transport, encryption and multiplexer
+ * handshakes to the relay, the circuit open, then both handshakes again end to end through it.
+ * Measured at 8 one-way delays, which is 4 link round trips.
+ */
+export declare const RELAYED_DIAL_ROUND_TRIPS = 4;
+/**
+ * Link round trips one whole reservation drive is budgeted for
+ * (`relay-reservation.ts`'s `driveRelayReservation`, whose ONE deadline covers the dial, the
+ * reservation request and the wait together).
+ *
+ * The protocol work measured is 2 — dial the relay (1) plus request the reservation (1). It is
+ * budgeted at 4, the relayed-dial count, because the wait afterwards may instead be satisfied
+ * by libp2p's own relay discovery, which repeats both legs after identify has run; 4 is
+ * therefore the largest thing this one deadline can be asked to contain, and the poll interval
+ * (`DEFAULT_RELAY_RESERVE_POLL_MS`) rounds up on top of it.
+ */
+export declare const RELAY_RESERVATION_ROUND_TRIPS = 4;
+/**
+ * Link round trips one request-and-answer over an ALREADY-OPEN circuit costs: the protocol
+ * negotiation (1, measured at 2 one-way delays) plus the request and its response (1). It does
+ * not include a dial — a caller that may have to open the connection budgets
+ * {@link RELAYED_DIAL_ROUND_TRIPS} separately, which is exactly what the two-field shape of
+ * Optimystic's `dialTimeoutMs` / `responseTimeoutMs` pair is for.
+ */
+export declare const CIRCUIT_REQUEST_ROUND_TRIPS = 2;
+/**
+ * What a block-transfer push message's BYTES get to cross, on top of the latency
+ * {@link CIRCUIT_REQUEST_ROUND_TRIPS} covers, in milliseconds.
+ *
+ * This part is bandwidth, not latency, so it does not scale with the declared round trip: a
+ * chunk is capped at `PeerJoinBackfillConfig.maxChunkBytes` (1 MiB by default) and crossing it
+ * costs whatever the link's throughput costs.
+ *
+ * NOTE: 6 000 ms is not a measurement of any throughput — it is the residue of the 10 000 ms
+ * this deadline shipped as before it was split into a latency part and a transfer part, chosen
+ * so that at the default declaration the derived value is the same 10 000 and no fast link got
+ * slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile link. If pushes
+ * ever time out with the transfer only part done, measure that and raise THIS, not the declared
+ * round trip.
+ */
+export declare const PUSH_TRANSFER_ALLOWANCE_MS = 6000;
+/**
+ * Resolve a host's declared link round trip, falling back to
+ * {@link DECLARED_LINK_ROUND_TRIP_MS}.
+ *
+ * Validated here rather than downstream because nothing downstream would: every consumer
+ * multiplies this value into a `setTimeout` deadline, where a zero silently turns a budget into
+ * "give up immediately" and a `NaN` turns it into "never time out".
+ *
+ * Both node bring-up paths call this EAGERLY — `CadreNode.start()`, and
+ * `StrandInstanceManager.buildStrandRuntime` behind `addStrand`/`resumeStrand` — so a bad
+ * declaration fails the same start that Optimystic's own check on `cohortQueryTimeoutMs` fails.
+ * The eager call is what makes that true: every budget derived here is behind a condition (a
+ * node with no control storage builds no catch-up, a node with no relay addrs drives no
+ * reservation), so waiting for a first consumer would let a broken declaration boot and then
+ * throw inside a best-effort path that logs and carries on.
+ */
+export declare function resolveLinkRoundTripMs(linkRoundTripMs?: number): number;
+/**
+ * Deadline for OPENING a connection to another machine that may only be reachable through a
+ * relay: {@link RELAYED_DIAL_ROUND_TRIPS} at the declared link round trip.
+ */
+export declare function relayedDialBudgetMs(linkRoundTripMs?: number): number;
+/**
+ * Deadline for one whole relay reservation drive: {@link RELAY_RESERVATION_ROUND_TRIPS} at the
+ * declared link round trip.
+ */
+export declare function relayReservationBudgetMs(linkRoundTripMs?: number): number;
+/**
+ * Deadline for one request and its answer over a circuit that is already open —
+ * {@link CIRCUIT_REQUEST_ROUND_TRIPS} at the declared link round trip, plus `transferAllowanceMs`
+ * for the payload's own bytes.
+ */
+export declare function circuitRequestBudgetMs(linkRoundTripMs?: number, transferAllowanceMs?: number): number;
+/** The two deadlines one peer-join catch-up push needs, both derived from the declared link. */
+export interface PeerJoinPushBudget {
+    /** Opening the connection to the peer being caught up — a relayed dial, in the worst case. */
+    dialTimeoutMs: number;
+    /** The push request and its answer over that connection, including the chunk's own bytes. */
+    responseTimeoutMs: number;
+}
+/**
+ * The dial and response deadlines a peer-join catch-up push needs at a declared link. One
+ * helper rather than two call-site expressions, because the two construction sites
+ * (`CadreNode`'s control catch-up and `StrandInstanceManager`'s per-strand one) and
+ * `DEFAULT_PEER_JOIN_BACKFILL` must not drift apart.
+ */
+export declare function peerJoinPushBudget(linkRoundTripMs?: number): PeerJoinPushBudget;

package/dist/link-budget.js

@@ -0,0 +1,195 @@
+/**
+ * Dial and reservation budgets derived from ONE declared link round trip, instead of fixed
+ * millisecond numbers chosen on a fast local network.
+ *
+ * Reaching another machine through a relay costs a FIXED NUMBER OF EXCHANGES, not a fixed
+ * number of milliseconds. So every budget written as milliseconds has a link speed above which
+ * it can never open a connection at all — and the slower the link, the more of them fall over,
+ * silently, because an abandoned dial looks the same as a peer that is not there. Counting round
+ * trips instead is what stops that class of defect coming back: the next person to widen a
+ * budget changes ONE declaration, and the next person to add a dial writes down its round-trip
+ * count beside the arithmetic.
+ *
+ * ── The instrument ──
+ *
+ * Every count and every number below comes from
+ * `packages/integration-tests/src/scenarios/relayed-dial-cost-by-latency.integration.ts`, which
+ * is committed and opt-in (`RELAY_DIAL_COST=1`). **Its doc comment is the single home of the
+ * measurement**; this module holds only what the derivation needs. Re-run it before changing
+ * anything here.
+ *
+ * ── The unit ──
+ *
+ * ONE LINK ROUND TRIP is a message from one machine reaching the other and a reply coming
+ * back, over the path those two machines actually use — through the relay, when that is the
+ * only way they can reach each other. In the instrument, which injects a constant ONE-WAY
+ * frame delay `d`, one link round trip is `2d`.
+ *
+ * A leg between a node and the RELAY is half a link round trip, because it crosses one of the
+ * two hops rather than both. That is why the reservation drive's cost reads as "four
+ * node-to-relay round trips" in one telling and "two link round trips" in another: same
+ * quantity, different unit. This module uses the LINK round trip throughout, so there is one
+ * unit to reason in.
+ *
+ * ── The counts, and what they cost ──
+ *
+ * | operation                                            | link round trips | at the declared default |
+ * | ---------------------------------------------------- | ---------------- | ----------------------- |
+ * | open a relayed connection to another machine          | 4                | 8 000 ms                |
+ * | dial the relay itself                                 | 1                | 2 000 ms                |
+ * | request a reservation on an open relay connection     | 1                | 2 000 ms                |
+ * | negotiate a protocol over an established circuit      | 1                | 2 000 ms                |
+ *
+ * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay, re-run for this
+ * change: a relayed dial took 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and
+ * **12 066-12 094 ms at 1 500 ms one-way**. Four link round trips of pure delay would be 7 200
+ * and 12 000, so the real cost sits about 60-95 ms ABOVE the arithmetic — the handshakes and a
+ * phone's pure-JS crypto, which no delay figure contains. That residue is small but it is why
+ * {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the band sereus supports rather
+ * than matching it exactly: a declaration equal to the measured round trip would derive a
+ * budget marginally BELOW the dial it has to contain.
+ *
+ * ── The ceiling this does NOT lift ──
+ *
+ * Above roughly 1 250 ms one-way — a 2.5-second link round trip — no relayed connection can be
+ * established by this stack whatever cadre declares here. Two budgets of 10 000 ms each inside
+ * libp2p bound the same dial and cannot be reached from sereus at all:
+ * `connectionManager.dialTimeout` (libp2p's own default, which `@optimystic/db-p2p`'s
+ * `libp2p-node-base.ts` neither sets nor exposes) and `connectionManager.inboundUpgradeTimeout`
+ * (which it sets to 10 000). Both appear in the same re-run: at 1 500 ms one-way the dial under
+ * libp2p's default failed with `The operation was aborted due to timeout`, and with the shipped
+ * inbound-upgrade budget the DIALER's own 12 094 ms dial resolved while the LISTENER had
+ * already thrown the half-built connection away — so the first stream over it died with
+ * `Unexpected EOF - stream closed while reading 0/1 bytes` and the listener reported no peer at
+ * all. That is why a too-slow link produces silence rather than an error.
+ *
+ * Two consequences for a reader choosing a declaration. Below that ceiling, the DEFAULT
+ * declaration of 2 000 ms does not reach it: four round trips of 2 000 ms is 8 000 ms, which
+ * covers a one-way delay up to 1 000 ms, so a deployment somewhere between 1 000 and 1 250 ms
+ * one-way has to declare its own (about 2 200-2 500) to use the band libp2p still allows. And
+ * declaring much ABOVE 2 500 buys nothing: the budgets here grow, and
+ * the connection still fails inside libp2p. Lifting that needs an upstream change and a
+ * decision about how slow a link sereus intends to carry —
+ * `tickets/blocked/how-slow-a-relayed-link-does-sereus-carry`. A reader who raised these
+ * numbers and still cannot connect at 1 500 ms one-way has met that ceiling, not this module.
+ */
+/**
+ * The link round trip cadre assumes when a host declares none, in milliseconds. A deployment
+ * that knows its own link states it with `NetworkConfig.linkRoundTripMs` instead.
+ *
+ * **Why 2 000.** It states the slowest link sereus already claims to support, and two other
+ * budgets fix that claim independently: `COHORT_READ_DEADLINE_MS`
+ * (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
+ * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`, 120 000 ms) were both
+ * sized against two parties reaching each other only through a public relay at a round trip
+ * near 1.8 s. Declaring 2 000 rounds that band up and leaves about 720 ms over the worst
+ * relayed dial measured at it (7 279 ms against a derived 8 000 ms).
+ *
+ * Raising it is how a deployment that KNOWS its link is slower moves every derived budget at
+ * once. The cost is the ordinary cost of a longer deadline: a peer that is genuinely gone holds
+ * the operation for that much longer before it is abandoned and retried. Above about 2 500 it
+ * buys nothing — see the module doc's ceiling paragraph.
+ */
+export const DECLARED_LINK_ROUND_TRIP_MS = 2000;
+/**
+ * Link round trips one relayed connection setup costs: transport, encryption and multiplexer
+ * handshakes to the relay, the circuit open, then both handshakes again end to end through it.
+ * Measured at 8 one-way delays, which is 4 link round trips.
+ */
+export const RELAYED_DIAL_ROUND_TRIPS = 4;
+/**
+ * Link round trips one whole reservation drive is budgeted for
+ * (`relay-reservation.ts`'s `driveRelayReservation`, whose ONE deadline covers the dial, the
+ * reservation request and the wait together).
+ *
+ * The protocol work measured is 2 — dial the relay (1) plus request the reservation (1). It is
+ * budgeted at 4, the relayed-dial count, because the wait afterwards may instead be satisfied
+ * by libp2p's own relay discovery, which repeats both legs after identify has run; 4 is
+ * therefore the largest thing this one deadline can be asked to contain, and the poll interval
+ * (`DEFAULT_RELAY_RESERVE_POLL_MS`) rounds up on top of it.
+ */
+export const RELAY_RESERVATION_ROUND_TRIPS = 4;
+/**
+ * Link round trips one request-and-answer over an ALREADY-OPEN circuit costs: the protocol
+ * negotiation (1, measured at 2 one-way delays) plus the request and its response (1). It does
+ * not include a dial — a caller that may have to open the connection budgets
+ * {@link RELAYED_DIAL_ROUND_TRIPS} separately, which is exactly what the two-field shape of
+ * Optimystic's `dialTimeoutMs` / `responseTimeoutMs` pair is for.
+ */
+export const CIRCUIT_REQUEST_ROUND_TRIPS = 2;
+/**
+ * What a block-transfer push message's BYTES get to cross, on top of the latency
+ * {@link CIRCUIT_REQUEST_ROUND_TRIPS} covers, in milliseconds.
+ *
+ * This part is bandwidth, not latency, so it does not scale with the declared round trip: a
+ * chunk is capped at `PeerJoinBackfillConfig.maxChunkBytes` (1 MiB by default) and crossing it
+ * costs whatever the link's throughput costs.
+ *
+ * NOTE: 6 000 ms is not a measurement of any throughput — it is the residue of the 10 000 ms
+ * this deadline shipped as before it was split into a latency part and a transfer part, chosen
+ * so that at the default declaration the derived value is the same 10 000 and no fast link got
+ * slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile link. If pushes
+ * ever time out with the transfer only part done, measure that and raise THIS, not the declared
+ * round trip.
+ */
+export const PUSH_TRANSFER_ALLOWANCE_MS = 6000;
+/**
+ * Resolve a host's declared link round trip, falling back to
+ * {@link DECLARED_LINK_ROUND_TRIP_MS}.
+ *
+ * Validated here rather than downstream because nothing downstream would: every consumer
+ * multiplies this value into a `setTimeout` deadline, where a zero silently turns a budget into
+ * "give up immediately" and a `NaN` turns it into "never time out".
+ *
+ * Both node bring-up paths call this EAGERLY — `CadreNode.start()`, and
+ * `StrandInstanceManager.buildStrandRuntime` behind `addStrand`/`resumeStrand` — so a bad
+ * declaration fails the same start that Optimystic's own check on `cohortQueryTimeoutMs` fails.
+ * The eager call is what makes that true: every budget derived here is behind a condition (a
+ * node with no control storage builds no catch-up, a node with no relay addrs drives no
+ * reservation), so waiting for a first consumer would let a broken declaration boot and then
+ * throw inside a best-effort path that logs and carries on.
+ */
+export function resolveLinkRoundTripMs(linkRoundTripMs) {
+    if (linkRoundTripMs === undefined) {
+        return DECLARED_LINK_ROUND_TRIP_MS;
+    }
+    if (!Number.isFinite(linkRoundTripMs) || linkRoundTripMs <= 0) {
+        throw new Error(`network.linkRoundTripMs must be a finite number of milliseconds above zero, not ${String(linkRoundTripMs)}`);
+    }
+    return linkRoundTripMs;
+}
+/**
+ * Deadline for OPENING a connection to another machine that may only be reachable through a
+ * relay: {@link RELAYED_DIAL_ROUND_TRIPS} at the declared link round trip.
+ */
+export function relayedDialBudgetMs(linkRoundTripMs) {
+    return RELAYED_DIAL_ROUND_TRIPS * resolveLinkRoundTripMs(linkRoundTripMs);
+}
+/**
+ * Deadline for one whole relay reservation drive: {@link RELAY_RESERVATION_ROUND_TRIPS} at the
+ * declared link round trip.
+ */
+export function relayReservationBudgetMs(linkRoundTripMs) {
+    return RELAY_RESERVATION_ROUND_TRIPS * resolveLinkRoundTripMs(linkRoundTripMs);
+}
+/**
+ * Deadline for one request and its answer over a circuit that is already open —
+ * {@link CIRCUIT_REQUEST_ROUND_TRIPS} at the declared link round trip, plus `transferAllowanceMs`
+ * for the payload's own bytes.
+ */
+export function circuitRequestBudgetMs(linkRoundTripMs, transferAllowanceMs = PUSH_TRANSFER_ALLOWANCE_MS) {
+    return CIRCUIT_REQUEST_ROUND_TRIPS * resolveLinkRoundTripMs(linkRoundTripMs) + transferAllowanceMs;
+}
+/**
+ * The dial and response deadlines a peer-join catch-up push needs at a declared link. One
+ * helper rather than two call-site expressions, because the two construction sites
+ * (`CadreNode`'s control catch-up and `StrandInstanceManager`'s per-strand one) and
+ * `DEFAULT_PEER_JOIN_BACKFILL` must not drift apart.
+ */
+export function peerJoinPushBudget(linkRoundTripMs) {
+    return {
+        dialTimeoutMs: relayedDialBudgetMs(linkRoundTripMs),
+        responseTimeoutMs: circuitRequestBudgetMs(linkRoundTripMs)
+    };
+}
+//# sourceMappingURL=link-budget.js.map

package/dist/link-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-budget.js","sourceRoot":"","sources":["../src/link-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,eAAwB;IAC9D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,2BAA2B,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACd,mFAAmF,MAAM,CAAC,eAAe,CAAC,EAAE,CAC5G,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAwB;IAC3D,OAAO,wBAAwB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,eAAwB;IAChE,OAAO,6BAA6B,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,eAAwB,EACxB,mBAAmB,GAAG,0BAA0B;IAEhD,OAAO,2BAA2B,GAAG,sBAAsB,CAAC,eAAe,CAAC,GAAG,mBAAmB,CAAC;AACpG,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAwB;IAC1D,OAAO;QACN,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC;QACnD,iBAAiB,EAAE,sBAAsB,CAAC,eAAe,CAAC;KAC1D,CAAC;AACH,CAAC"}

package/dist/membership-connection-gater.d.ts

@@ -88,9 +88,10 @@
  *    annex the party's relay capacity.
  *  - An `'admit-for-relay'` connection that is NOT reserving is dropped: it has
  *    {@link RELAY_ADMISSION_RESERVE_DEADLINE_MS} to get a reservation ADMITTED
- *    at that hook, after which the underlying connection is aborted. The
- *    guarantee above thus weakens on relay-enabled nodes from "never in the
- *    conversation" to "in it briefly, and can speak nothing".
+ *    at that hook, after which the gate CLOSES the underlying connection so
+ *    both ends let go of the socket. The guarantee above thus weakens on
+ *    relay-enabled nodes from "never in the conversation" to "in it briefly,
+ *    and can speak nothing".
  *
  * The deadline clears on reservation ADMISSION, not on the reservation's own
  * success: this gate cannot observe the server-side `reserve()` outcome, so a
@@ -187,13 +188,25 @@ export declare const ADMISSION_DECISION_TIMEOUT_MS = 2000;
 /**
  * How long an `'admit-for-relay'` connection may exist without a relay
  * reservation being ADMITTED at the `denyInboundRelayReservation` hook, after
- * which the gate aborts the underlying connection. A reserving client asks for
+ * which the gate closes the underlying connection. A reserving client asks for
  * its slot immediately after the connection upgrades (`relay-reservation.ts`
  * dials and requests in one drive; a strand node's configured circuit listener
  * does the same from inside its own `listen()`), so a connection idle past this
  * deadline is not reserving.
  */
 export declare const RELAY_ADMISSION_RESERVE_DEADLINE_MS = 5000;
+/**
+ * Bound on the graceful close of an expired relay-only connection. It exists
+ * because `AbstractMultiaddrConnection.close()` awaits an `idle`/`drain` event
+ * when the connection still has unsent bytes, and that wait has no timeout of
+ * its own — an unsignalled one never ends. This gate writes nothing to a
+ * stranger, so the wait is not reachable today; the bound is here so a timer
+ * callback can never hold an unending await.
+ *
+ * Applied through {@link withDeadline}, not `AbortSignal.timeout`: the latter is
+ * not reliably present on React Native/Hermes, which loads this same module.
+ */
+export declare const RELAY_ADMISSION_CLOSE_TIMEOUT_MS = 2000;
 /**
  * Default cap on concurrent relay reservations held by peers the membership
  * check could not place (see {@link UnauthorizedReservationBudget}). Small on
@@ -311,7 +324,7 @@ export declare class UnauthorizedReservationBudget {
  *
  * An `'admit-for-relay'` verdict admits the connection and arms a
  * `reserveDeadlineMs` timer against it; the timer is disarmed when a
- * reservation for that peer is ADMITTED at the reservation hook, and aborts the
+ * reservation for that peer is ADMITTED at the reservation hook, and closes the
  * underlying `MultiaddrConnection` when it fires first.
  *
  * NOTE: `base` is spread, so a gater passed as a CLASS INSTANCE would lose its

package/dist/membership-connection-gater.js

@@ -88,9 +88,10 @@
  *    annex the party's relay capacity.
  *  - An `'admit-for-relay'` connection that is NOT reserving is dropped: it has
  *    {@link RELAY_ADMISSION_RESERVE_DEADLINE_MS} to get a reservation ADMITTED
- *    at that hook, after which the underlying connection is aborted. The
- *    guarantee above thus weakens on relay-enabled nodes from "never in the
- *    conversation" to "in it briefly, and can speak nothing".
+ *    at that hook, after which the gate CLOSES the underlying connection so
+ *    both ends let go of the socket. The guarantee above thus weakens on
+ *    relay-enabled nodes from "never in the conversation" to "in it briefly,
+ *    and can speak nothing".
  *
  * The deadline clears on reservation ADMISSION, not on the reservation's own
  * success: this gate cannot observe the server-side `reserve()` outcome, so a
@@ -156,6 +157,7 @@
 import debug from 'debug';
 import { SEED_PROTOCOL } from './seed-bootstrap.js';
 import { FORMATION_PROTOCOL } from './strand-formation-protocol.js';
+import { withDeadline } from './control-stream.js';
 const log = debug('sereus:cadre:connection-gater');
 /**
  * The protocols a not-yet-authorized peer may legitimately speak on a control
@@ -190,13 +192,25 @@ export const ADMISSION_DECISION_TIMEOUT_MS = 2000;
 /**
  * How long an `'admit-for-relay'` connection may exist without a relay
  * reservation being ADMITTED at the `denyInboundRelayReservation` hook, after
- * which the gate aborts the underlying connection. A reserving client asks for
+ * which the gate closes the underlying connection. A reserving client asks for
  * its slot immediately after the connection upgrades (`relay-reservation.ts`
  * dials and requests in one drive; a strand node's configured circuit listener
  * does the same from inside its own `listen()`), so a connection idle past this
  * deadline is not reserving.
  */
 export const RELAY_ADMISSION_RESERVE_DEADLINE_MS = 5000;
+/**
+ * Bound on the graceful close of an expired relay-only connection. It exists
+ * because `AbstractMultiaddrConnection.close()` awaits an `idle`/`drain` event
+ * when the connection still has unsent bytes, and that wait has no timeout of
+ * its own — an unsignalled one never ends. This gate writes nothing to a
+ * stranger, so the wait is not reachable today; the bound is here so a timer
+ * callback can never hold an unending await.
+ *
+ * Applied through {@link withDeadline}, not `AbortSignal.timeout`: the latter is
+ * not reliably present on React Native/Hermes, which loads this same module.
+ */
+export const RELAY_ADMISSION_CLOSE_TIMEOUT_MS = 2000;
 /**
  * Default cap on concurrent relay reservations held by peers the membership
  * check could not place (see {@link UnauthorizedReservationBudget}). Small on
@@ -297,7 +311,7 @@ export class UnauthorizedReservationBudget {
  *
  * An `'admit-for-relay'` verdict admits the connection and arms a
  * `reserveDeadlineMs` timer against it; the timer is disarmed when a
- * reservation for that peer is ADMITTED at the reservation hook, and aborts the
+ * reservation for that peer is ADMITTED at the reservation hook, and closes the
  * underlying `MultiaddrConnection` when it fires first.
  *
  * NOTE: `base` is spread, so a gater passed as a CLASS INSTANCE would lose its
@@ -406,11 +420,11 @@ export async function decideWithinDeadline(decide, fallback, timeoutMs, what) {
 /**
  * The not-reserving deadlines for `'admit-for-relay'` connections, keyed by
  * remote peerId (a Set per peer — one peer can hold several in-flight
- * connections). `arm` starts a timer that aborts the connection; `disarm`
+ * connections). `arm` starts a timer that closes the connection; `disarm`
  * (called when a reservation for that peer is admitted) cancels every pending
  * timer for the peer. Timers are unref'd so an armed deadline never holds a
  * process open, and a timer that fires against an already-closed connection is
- * a swallowed no-op.
+ * a no-op (`close()` returns at once on any status but `open`).
  *
  * Disarming is final for the connections it cancelled: a peer that reserved
  * once and then lets its reservation lapse keeps a mute connection (the
@@ -453,12 +467,38 @@ class PendingReserveDeadlines {
         if (entries?.size === 0) {
             this.byPeer.delete(remotePeerId);
         }
-        log('Relay-only admission expired for %s — no reservation admitted within %dms, aborting the connection', remotePeerId, this.deadlineMs);
+        log('Relay-only admission expired for %s — no reservation admitted within %dms, closing the connection', remotePeerId, this.deadlineMs);
+        void this.drop(remotePeerId, entry.maConn);
+    }
+    /**
+     * End an expired relay-only connection: a bounded graceful close, with
+     * `abort()` only as the escalation. The order cannot be reversed — `abort()`
+     * marks the connection `aborted`, and `close()` returns immediately on any
+     * status that is not `open`, so aborting first would make the close a silent
+     * no-op. Closing a connection the peer already dropped returns at once
+     * without throwing, so the fallback stays unreached in the ordinary case.
+     */
+    async drop(remotePeerId, maConn) {
+        try {
+            await withDeadline(RELAY_ADMISSION_CLOSE_TIMEOUT_MS, `relay-only close for ${remotePeerId}`, (signal) => maConn.close({ signal }));
+            return;
+        }
+        catch (error) {
+            log('Closing the expired relay-only connection from %s failed — aborting: %o', remotePeerId, error);
+        }
+        // NOTE: this fallback cannot actually free a WebSocket. `@libp2p/websockets`'
+        // `sendReset()` calls `websocket.close(1006)`, and 1006 is a reserved code
+        // RFC 6455 forbids an endpoint from sending, so `ws` throws and
+        // `AbstractMessageStream.abort()` swallows it — the local end flips to
+        // `aborted` while the socket stays up. Measured against
+        // @libp2p/websockets@10.1.3 (see tickets/blocked/report-libp2p-websockets-abort-close-code.md).
+        // `MultiaddrConnection` exposes no way down to the raw socket, so this is as
+        // far as this layer can go. Revisit — drop the fallback, or go back to a
+        // plain `abort()` — once that transport sends a legal reset code.
         try {
-            entry.maConn.abort(new Error(`relay-only admission expired: no relay reservation admitted within ${this.deadlineMs}ms`));
+            maConn.abort(new Error(`relay-only admission expired: no relay reservation admitted within ${this.deadlineMs}ms`));
         }
         catch (error) {
-            // Aborting a connection that already closed on its own is not a failure.
             log('Aborting the expired relay-only connection from %s threw: %o', remotePeerId, error);
         }
     }