@serfab/cadre-core 1.4.0 → 1.6.0

package/dist/strand-first-sync-gate.d.ts

@@ -17,9 +17,17 @@
  * freshly initialized `StrandDatabase` back from the app — `StrandInstance.database` stays
  * unset and the instance reports `'syncing'` — and probes on a cadence until the Header is
  * readable AND a read of each app table settles, at which point the database is published
- * and the instance goes `'active'`. A machine that already holds the Header (a restart, a
- * hibernation resume, a founder) passes the probe on the first try and is never gated, so
- * offline-first writes on a machine that has synced before keep working.
+ * and the instance goes `'active'`. A machine whose store already holds the Header and every
+ * app table (a founder, and normally a restart or a hibernation resume) passes the probe on
+ * the first try and is never gated, so offline-first writes on a machine that has synced
+ * before keep working.
+ *
+ * "Has synced before" is decided by what the local store actually holds, not by whether this
+ * machine once read the strand: a machine that left soon after its first sync can hold less
+ * than it read, and is then gated like a joiner. The re-attach measurement on
+ * {@link DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS} saw exactly that — a machine back over the store
+ * it kept, without the `Strand.Header` collection it had read before it left. Gating it is
+ * right: writing into a collection this machine does not hold would fork it.
  *
  * Why the app tables too: the Header is ONE collection. It reaches a joiner ahead of the
  * founder's app-table collections (peer-join backfill and pull-on-read deliver those
@@ -36,10 +44,12 @@
  * every machine; the first write to it still creates its collection — see `docs/strands.md`
  * ("Joining") for that residual.
  *
- * Owned by `StrandInstanceManager`: created in `buildStrandRuntime` for a non-founder launch
- * whose first probe finds no Header, stopped and dropped in `releaseRuntime` (so a quiesce →
- * resume rebuild re-probes over the same store), and force-opened when a founder request
- * runs the bootstrap against the still-gated database (`foundExistingStrand`).
+ * Owned by `StrandInstanceManager`: created in `buildStrandRuntime` for every launch, armed
+ * only for a non-founder launch whose first probe fails, stopped and dropped in
+ * `releaseRuntime` (so a quiesce → resume rebuild re-probes over the same store), and opened
+ * by `publishDatabase` whenever the database is published without its loop — a launch that
+ * needed no gate, or a founder request that ran the bootstrap against the still-gated
+ * database (`foundExistingStrand`).
  *
  * NOTE: the gate covers app and membership tables, not the schema catalog. Every launch —
  * joiner or founder — writes the catalog collection (`optimystic/schema` plus two
@@ -57,18 +67,80 @@ import { type TimeoutScheduler } from './timeout-scheduler.js';
 /** How often a gated launch re-probes (`Strand.Header`, then every `App` table) while waiting for its first sync. */
 export declare const DEFAULT_STRAND_FIRST_SYNC_POLL_MS = 500;
 /**
- * How long `CadreNode.addStrand` waits for a joining machine's first sync before rejecting
- * with {@link StrandAwaitingFirstSyncError}. Measured: over a direct connection the
- * joiner reads the founder's rows about 1.3 s after `addStrand` would previously have
- * resolved; a relayed path is slower, and a phone that just redeemed an invitation has the
- * host reachable moments ago, so 30 s is generous without leaving an app hanging.
+ * How long `CadreNode.addStrand` waits for a machine's first sync before rejecting with
+ * {@link StrandAwaitingFirstSyncError}. It has to cover the slowest attach sereus carries,
+ * which is not a first join: a machine RE-attaching through a relay on a slow link can take
+ * longer than one joining for the first time.
+ *
+ * Measured over a DIRECT connection (2026-09-16): the joiner reads the founder's rows about
+ * 1.3 s after `addStrand` would previously have resolved. That is the fast case, and it is not
+ * what this budget has to cover.
+ *
+ * Every harness figure below was taken on one shape: one Windows developer machine, two
+ * relay-only `CadreNode`s (`listenAddrs: []`) on a shared loopback dedicated relay, with a
+ * 900 ms one-way per-frame outbound delay applied to every websocket by
+ * `integration-tests/src/harness/ws-latency.ts` in `pipelined` mode — frames stay overlapped
+ * in flight, so the figure is latency and bandwidth stays unlimited; the harness's other mode
+ * (`serial`) is a per-socket frame-rate cap and its delays are NOT comparable
+ * (`docs/testing.md` → "Link latency"). A round trip therefore costs about 1.8 s. Times run
+ * from the `addStrand` call to writable.
+ *
+ * FRESH JOIN (2026-09-26), a machine holding nothing of the strand yet: 23, 27, 31 and 41 s
+ * over four runs at optimystic's 1000 ms cohort read deadline, and 35, 42 and 46 s over three
+ * runs at a 5000 ms one; the re-attach scenario below later took 38.7, 38.7 and 56.9 s for
+ * the same fresh join. **The 5000 ms band, 35-57 s, is the one in force**: sereus declares
+ * 5000 ms (`COHORT_READ_DEADLINE_MS`, `quereus-plugin-sereus/src/cluster-size.ts`), because
+ * 1000 ms is shorter than one round trip on that link and leaves every cohort read with no
+ * answer to corroborate against. Widening that deadline makes a consult against a peer that
+ * cannot answer cost longer, and this phase runs several of those — which is why both bands
+ * are recorded here, and why a change to either number has to be weighed against the other.
+ *
+ * RE-ATTACH (2026-09-26, the opt-in
+ * `integration-tests/src/scenarios/strand-reattach-first-sync-measure.integration.ts` — re-run
+ * it before changing this number): B attached once on an undelayed link, left with
+ * `stopStrand`, A wrote while it was away, the delay was raised, and B called `addStrand`
+ * again.
+ *  - Over an EMPTY store (one minted per launch, cadre's default with no storage provider):
+ *    gated in all four runs and writable at 38.7-56.8 s, the same as a fresh join.
+ *  - Over the store it KEPT (a phone with durable storage), bimodal. In 3 of 8 runs the store
+ *    held everything and the launch came up writable (5.6 s, the launch itself). In the other
+ *    5 it lacked the `Strand.Header` collection B had read on its first attach, so B was gated
+ *    like a joiner and became writable at 64.1-78.7 s — the slowest attach measured, about
+ *    twice a fresh join. Why syncing over a partial store is slower sits inside optimystic
+ *    (`tickets/blocked/report-reattach-over-partial-replica-to-optimystic`).
+ *  - Neither a redial nor catching up on missed writes explains the time: B's strand node
+ *    connected to A's at 11 s in every arm, fresh join included, and a run with 20 missed
+ *    writes fell inside the run-to-run spread of those with 1.
+ * This budget covers WRITABLE, not caught up: in the gated kept-store runs the row A wrote
+ * while B was away became readable only at 140-162 s.
+ *
+ * Two samples from outside this harness, neither reproduced here and neither discarded: a
+ * reporter's re-attach of the same shape (optimystic #22; their harness, storage and delay
+ * injector are unknown to us) opened the gate at about 150 s, after the previous 120 s budget
+ * had already rejected; and a real Galaxy S7 joining fresh through relay.sereus.org took 178 s.
+ *
+ * 300 s clears the worst harness sample (79 s) by about 3.8x, the reporter's re-attach by 2x
+ * and the device join by about 1.7x. 240 s was rejected: it clears the device join by only
+ * 1.35x, and that sample was not a re-attach. History: the original 30 s sat INSIDE the 1000 ms
+ * fresh band and refused about half of those joins while their sync was progressing normally;
+ * 120 s was sized from fresh joins only and refused the reporter's re-attach.
+ *
+ * NOTE: accepted tradeoff — what 300 s costs. This wait is what an app's `addStrand` sits in
+ * before it is told "not yet", so a strand none of whose members is reachable at all takes five
+ * minutes to report instead of two. The slow report was weighed against refusing attaches that
+ * were working, and the refusal is the worse failure. The cost is bounded — the rejection is
+ * retryable, the strand stays launched and keeps probing, and `strand:writable` fires the
+ * moment the sync lands, so an app that listens for the event rather than awaiting the call is
+ * unaffected either way. Revisit if the gate ever learns whether ANY other member is connected:
+ * "no peer at all" could then be reported at once and this budget would only ever be spent on a
+ * sync that is actually in progress — worth more the longer this budget gets.
  */
-export declare const DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS = 30000;
+export declare const DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS = 300000;
 /** Embedder-facing tuning for the gate, threaded from `CadreNodeConfig.strandFirstSync`. */
 export interface StrandFirstSyncConfig {
     /**
-     * Default wait for `CadreNode.addStrand` (and `whenStrandWritable`) before a joining
-     * machine that has reached no other member is reported as not yet writable. Default
+     * Default wait for `CadreNode.addStrand` (and `whenStrandWritable`) before a machine whose
+     * first sync has not completed is reported as not yet writable. Default
      * {@link DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS}.
      */
     timeoutMs?: number;
@@ -76,11 +148,12 @@ export interface StrandFirstSyncConfig {
     pollIntervalMs?: number;
 }
 /**
- * Thrown by `CadreNode.addStrand` / `whenStrandWritable` when a joining machine has not
- * received the strand's data from any other member within the wait budget. RETRYABLE: the
- * strand stays launched and keeps probing, so a later `addStrand` (or `whenStrandWritable`)
- * for the same strand completes the attach once another member is reachable; the
- * `strand:writable` event fires at that moment too.
+ * Thrown by `CadreNode.addStrand` / `whenStrandWritable` when a machine has not received the
+ * strand's data from another member within the wait budget — because no other member is
+ * reachable, or because one is and the sync is still arriving over a slow link; the gate
+ * cannot tell the two apart. RETRYABLE: the strand stays launched and keeps probing, so a
+ * later `addStrand` (or `whenStrandWritable`) for the same strand completes the attach once
+ * the data has arrived; the `strand:writable` event fires at that moment too.
  */
 export declare class StrandAwaitingFirstSyncError extends Error {
     readonly strandId: string;
@@ -141,12 +214,22 @@ export declare class StrandFirstSyncGate {
     /** Arm the probe loop. The first probe runs after one interval — the caller already probed once. */
     start(): void;
     /**
-     * Force-open: the caller has just written the Header itself (a founder bootstrap run
-     * against the gated database). Stops the loop; `onHeaderHeld` is NOT invoked.
+     * Open without the probe loop: the caller is publishing the database itself — a launch
+     * whose first probe passed (or a founder's), which never armed the loop, or a founder
+     * bootstrap just run against the gated database. Stops the loop; `onHeaderHeld` is NOT
+     * invoked.
      */
     open(): void;
     /** Disarm the loop; a probe already in flight completes and is then ignored. */
     stop(): void;
     private schedule;
     private probe;
+    /**
+     * One probe's answer, with a throw from OUTSIDE {@link strandFirstSyncComplete}'s own read
+     * guards — the `App` schema lookup, or `getDatabase()` itself — reported as "not yet" like
+     * any failing read. The loop is scheduled from `void this.probe()`, so an escaping rejection
+     * would be unhandled AND leave nothing scheduled: the strand would stay gated for the whole
+     * `timeoutMs` and never recover, which is the one failure this gate must not have.
+     */
+    private probeHeld;
 }

package/dist/strand-first-sync-gate.js

@@ -17,9 +17,17 @@
  * freshly initialized `StrandDatabase` back from the app — `StrandInstance.database` stays
  * unset and the instance reports `'syncing'` — and probes on a cadence until the Header is
  * readable AND a read of each app table settles, at which point the database is published
- * and the instance goes `'active'`. A machine that already holds the Header (a restart, a
- * hibernation resume, a founder) passes the probe on the first try and is never gated, so
- * offline-first writes on a machine that has synced before keep working.
+ * and the instance goes `'active'`. A machine whose store already holds the Header and every
+ * app table (a founder, and normally a restart or a hibernation resume) passes the probe on
+ * the first try and is never gated, so offline-first writes on a machine that has synced
+ * before keep working.
+ *
+ * "Has synced before" is decided by what the local store actually holds, not by whether this
+ * machine once read the strand: a machine that left soon after its first sync can hold less
+ * than it read, and is then gated like a joiner. The re-attach measurement on
+ * {@link DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS} saw exactly that — a machine back over the store
+ * it kept, without the `Strand.Header` collection it had read before it left. Gating it is
+ * right: writing into a collection this machine does not hold would fork it.
  *
  * Why the app tables too: the Header is ONE collection. It reaches a joiner ahead of the
  * founder's app-table collections (peer-join backfill and pull-on-read deliver those
@@ -36,10 +44,12 @@
  * every machine; the first write to it still creates its collection — see `docs/strands.md`
  * ("Joining") for that residual.
  *
- * Owned by `StrandInstanceManager`: created in `buildStrandRuntime` for a non-founder launch
- * whose first probe finds no Header, stopped and dropped in `releaseRuntime` (so a quiesce →
- * resume rebuild re-probes over the same store), and force-opened when a founder request
- * runs the bootstrap against the still-gated database (`foundExistingStrand`).
+ * Owned by `StrandInstanceManager`: created in `buildStrandRuntime` for every launch, armed
+ * only for a non-founder launch whose first probe fails, stopped and dropped in
+ * `releaseRuntime` (so a quiesce → resume rebuild re-probes over the same store), and opened
+ * by `publishDatabase` whenever the database is published without its loop — a launch that
+ * needed no gate, or a founder request that ran the bootstrap against the still-gated
+ * database (`foundExistingStrand`).
  *
  * NOTE: the gate covers app and membership tables, not the schema catalog. Every launch —
  * joiner or founder — writes the catalog collection (`optimystic/schema` plus two
@@ -57,26 +67,90 @@ const log = debug('sereus:cadre:strand-first-sync');
 /** How often a gated launch re-probes (`Strand.Header`, then every `App` table) while waiting for its first sync. */
 export const DEFAULT_STRAND_FIRST_SYNC_POLL_MS = 500;
 /**
- * How long `CadreNode.addStrand` waits for a joining machine's first sync before rejecting
- * with {@link StrandAwaitingFirstSyncError}. Measured: over a direct connection the
- * joiner reads the founder's rows about 1.3 s after `addStrand` would previously have
- * resolved; a relayed path is slower, and a phone that just redeemed an invitation has the
- * host reachable moments ago, so 30 s is generous without leaving an app hanging.
+ * How long `CadreNode.addStrand` waits for a machine's first sync before rejecting with
+ * {@link StrandAwaitingFirstSyncError}. It has to cover the slowest attach sereus carries,
+ * which is not a first join: a machine RE-attaching through a relay on a slow link can take
+ * longer than one joining for the first time.
+ *
+ * Measured over a DIRECT connection (2026-09-16): the joiner reads the founder's rows about
+ * 1.3 s after `addStrand` would previously have resolved. That is the fast case, and it is not
+ * what this budget has to cover.
+ *
+ * Every harness figure below was taken on one shape: one Windows developer machine, two
+ * relay-only `CadreNode`s (`listenAddrs: []`) on a shared loopback dedicated relay, with a
+ * 900 ms one-way per-frame outbound delay applied to every websocket by
+ * `integration-tests/src/harness/ws-latency.ts` in `pipelined` mode — frames stay overlapped
+ * in flight, so the figure is latency and bandwidth stays unlimited; the harness's other mode
+ * (`serial`) is a per-socket frame-rate cap and its delays are NOT comparable
+ * (`docs/testing.md` → "Link latency"). A round trip therefore costs about 1.8 s. Times run
+ * from the `addStrand` call to writable.
+ *
+ * FRESH JOIN (2026-09-26), a machine holding nothing of the strand yet: 23, 27, 31 and 41 s
+ * over four runs at optimystic's 1000 ms cohort read deadline, and 35, 42 and 46 s over three
+ * runs at a 5000 ms one; the re-attach scenario below later took 38.7, 38.7 and 56.9 s for
+ * the same fresh join. **The 5000 ms band, 35-57 s, is the one in force**: sereus declares
+ * 5000 ms (`COHORT_READ_DEADLINE_MS`, `quereus-plugin-sereus/src/cluster-size.ts`), because
+ * 1000 ms is shorter than one round trip on that link and leaves every cohort read with no
+ * answer to corroborate against. Widening that deadline makes a consult against a peer that
+ * cannot answer cost longer, and this phase runs several of those — which is why both bands
+ * are recorded here, and why a change to either number has to be weighed against the other.
+ *
+ * RE-ATTACH (2026-09-26, the opt-in
+ * `integration-tests/src/scenarios/strand-reattach-first-sync-measure.integration.ts` — re-run
+ * it before changing this number): B attached once on an undelayed link, left with
+ * `stopStrand`, A wrote while it was away, the delay was raised, and B called `addStrand`
+ * again.
+ *  - Over an EMPTY store (one minted per launch, cadre's default with no storage provider):
+ *    gated in all four runs and writable at 38.7-56.8 s, the same as a fresh join.
+ *  - Over the store it KEPT (a phone with durable storage), bimodal. In 3 of 8 runs the store
+ *    held everything and the launch came up writable (5.6 s, the launch itself). In the other
+ *    5 it lacked the `Strand.Header` collection B had read on its first attach, so B was gated
+ *    like a joiner and became writable at 64.1-78.7 s — the slowest attach measured, about
+ *    twice a fresh join. Why syncing over a partial store is slower sits inside optimystic
+ *    (`tickets/blocked/report-reattach-over-partial-replica-to-optimystic`).
+ *  - Neither a redial nor catching up on missed writes explains the time: B's strand node
+ *    connected to A's at 11 s in every arm, fresh join included, and a run with 20 missed
+ *    writes fell inside the run-to-run spread of those with 1.
+ * This budget covers WRITABLE, not caught up: in the gated kept-store runs the row A wrote
+ * while B was away became readable only at 140-162 s.
+ *
+ * Two samples from outside this harness, neither reproduced here and neither discarded: a
+ * reporter's re-attach of the same shape (optimystic #22; their harness, storage and delay
+ * injector are unknown to us) opened the gate at about 150 s, after the previous 120 s budget
+ * had already rejected; and a real Galaxy S7 joining fresh through relay.sereus.org took 178 s.
+ *
+ * 300 s clears the worst harness sample (79 s) by about 3.8x, the reporter's re-attach by 2x
+ * and the device join by about 1.7x. 240 s was rejected: it clears the device join by only
+ * 1.35x, and that sample was not a re-attach. History: the original 30 s sat INSIDE the 1000 ms
+ * fresh band and refused about half of those joins while their sync was progressing normally;
+ * 120 s was sized from fresh joins only and refused the reporter's re-attach.
+ *
+ * NOTE: accepted tradeoff — what 300 s costs. This wait is what an app's `addStrand` sits in
+ * before it is told "not yet", so a strand none of whose members is reachable at all takes five
+ * minutes to report instead of two. The slow report was weighed against refusing attaches that
+ * were working, and the refusal is the worse failure. The cost is bounded — the rejection is
+ * retryable, the strand stays launched and keeps probing, and `strand:writable` fires the
+ * moment the sync lands, so an app that listens for the event rather than awaiting the call is
+ * unaffected either way. Revisit if the gate ever learns whether ANY other member is connected:
+ * "no peer at all" could then be reported at once and this budget would only ever be spent on a
+ * sync that is actually in progress — worth more the longer this budget gets.
  */
-export const DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS = 30000;
+export const DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS = 300000;
 /**
- * Thrown by `CadreNode.addStrand` / `whenStrandWritable` when a joining machine has not
- * received the strand's data from any other member within the wait budget. RETRYABLE: the
- * strand stays launched and keeps probing, so a later `addStrand` (or `whenStrandWritable`)
- * for the same strand completes the attach once another member is reachable; the
- * `strand:writable` event fires at that moment too.
+ * Thrown by `CadreNode.addStrand` / `whenStrandWritable` when a machine has not received the
+ * strand's data from another member within the wait budget — because no other member is
+ * reachable, or because one is and the sync is still arriving over a slow link; the gate
+ * cannot tell the two apart. RETRYABLE: the strand stays launched and keeps probing, so a
+ * later `addStrand` (or `whenStrandWritable`) for the same strand completes the attach once
+ * the data has arrived; the `strand:writable` event fires at that moment too.
  */
 export class StrandAwaitingFirstSyncError extends Error {
     constructor(strandId, waitedMs) {
-        super(`Strand ${strandId} is not writable yet: no member of this strand has been reachable ` +
-            `since this machine joined, so it has not received the strand's data (waited ${waitedMs} ms). ` +
-            'The strand stays launched and keeps trying — call addStrand again, or wait for the ' +
-            "'strand:writable' event, once another member is reachable.");
+        super(`Strand ${strandId} is not writable yet: this machine has not yet received the strand's data ` +
+            `from another member (waited ${waitedMs} ms). Either no other member is reachable, or the ` +
+            'link to one is slow and the sync is still in progress. The strand stays launched and keeps ' +
+            'trying — call addStrand or whenStrandWritable(strandId) again to keep waiting, or listen ' +
+            "for the 'strand:writable' event.");
         this.name = 'StrandAwaitingFirstSyncError';
         this.strandId = strandId;
         this.waitedMs = waitedMs;
@@ -162,15 +236,17 @@ export class StrandFirstSyncGate {
         log('[%s] first-sync gate armed: no Strand.Header held yet; probing every %dms', this.deps.label, this.pollIntervalMs);
     }
     /**
-     * Force-open: the caller has just written the Header itself (a founder bootstrap run
-     * against the gated database). Stops the loop; `onHeaderHeld` is NOT invoked.
+     * Open without the probe loop: the caller is publishing the database itself — a launch
+     * whose first probe passed (or a founder's), which never armed the loop, or a founder
+     * bootstrap just run against the gated database. Stops the loop; `onHeaderHeld` is NOT
+     * invoked.
      */
     open() {
         if (this.opened)
             return;
         this.opened = true;
         this.stop();
-        log('[%s] first-sync gate opened by the caller (Header written locally)', this.deps.label);
+        log('[%s] database published by the caller; first-sync gate not needed or force-opened', this.deps.label);
     }
     /** Disarm the loop; a probe already in flight completes and is then ignored. */
     stop() {
@@ -190,8 +266,7 @@ export class StrandFirstSyncGate {
         if (this.stopped || this.opened || this.probing)
             return;
         this.probing = true;
-        const held = await strandFirstSyncComplete(this.deps.database.getDatabase(), this.deps.label)
-            .finally(() => { this.probing = false; });
+        const held = await this.probeHeld();
         // Re-check after the await: a release or a force-open may have landed mid-read.
         if (this.stopped || this.opened)
             return;
@@ -204,5 +279,24 @@ export class StrandFirstSyncGate {
         log('[%s] first-sync gate opened: Strand.Header and every App table read from a peer', this.deps.label);
         this.deps.onHeaderHeld();
     }
+    /**
+     * One probe's answer, with a throw from OUTSIDE {@link strandFirstSyncComplete}'s own read
+     * guards — the `App` schema lookup, or `getDatabase()` itself — reported as "not yet" like
+     * any failing read. The loop is scheduled from `void this.probe()`, so an escaping rejection
+     * would be unhandled AND leave nothing scheduled: the strand would stay gated for the whole
+     * `timeoutMs` and never recover, which is the one failure this gate must not have.
+     */
+    async probeHeld() {
+        try {
+            return await strandFirstSyncComplete(this.deps.database.getDatabase(), this.deps.label);
+        }
+        catch (error) {
+            log('[%s] first-sync probe threw (treated as not yet synced): %s', this.deps.label, error instanceof Error ? error.message : String(error));
+            return false;
+        }
+        finally {
+            this.probing = false;
+        }
+    }
 }
 //# sourceMappingURL=strand-first-sync-gate.js.map

package/dist/strand-first-sync-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-first-sync-gate.js","sourceRoot":"","sources":["../src/strand-first-sync-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD,qHAAqH;AACrH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,KAAM,CAAC;AAc3D;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,QAAgB,EAAE,QAAgB;QAC5C,KAAK,CACH,UAAU,QAAQ,oEAAoE;YACtF,+EAA+E,QAAQ,QAAQ;YAC/F,qFAAqF;YACrF,4DAA4D,CAC7D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,KAAa;IAChE,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAE,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,wDAAwD,EAAE,KAAK,EACjE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,KAAa;IACjE,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,sCAAsC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjF,MAAM;YACR,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,0DAA0D,EAAE,KAAK,EAAE,KAAK,EAC1E,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,KAAa;IACvE,OAAO,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAiBD;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAQ9B,YAA6B,IAA6B,EAAE,MAA8B;QAA7D,SAAI,GAAJ,IAAI,CAAyB;QAJlD,YAAO,GAAG,KAAK,CAAC;QAChB,WAAM,GAAG,KAAK,CAAC;QACf,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,iCAAiC,CAAC;IACpF,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,2FAA2F;IAC3F,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,oGAAoG;IACpG,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,GAAG,CAAC,2EAA2E,EAC7E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,oEAAoE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,gFAAgF;IAChF,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1F,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,gFAAgF;QAChF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,iFAAiF,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"strand-first-sync-gate.js","sourceRoot":"","sources":["../src/strand-first-sync-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD,qHAAqH;AACrH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAO,CAAC;AAc5D;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,QAAgB,EAAE,QAAgB;QAC5C,KAAK,CACH,UAAU,QAAQ,4EAA4E;YAC9F,+BAA+B,QAAQ,oDAAoD;YAC3F,6FAA6F;YAC7F,2FAA2F;YAC3F,kCAAkC,CACnC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,KAAa;IAChE,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAE,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,wDAAwD,EAAE,KAAK,EACjE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,KAAa;IACjE,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,sCAAsC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjF,MAAM;YACR,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,0DAA0D,EAAE,KAAK,EAAE,KAAK,EAC1E,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,KAAa;IACvE,OAAO,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAiBD;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAQ9B,YAA6B,IAA6B,EAAE,MAA8B;QAA7D,SAAI,GAAJ,IAAI,CAAyB;QAJlD,YAAO,GAAG,KAAK,CAAC;QAChB,WAAM,GAAG,KAAK,CAAC;QACf,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,iCAAiC,CAAC;IACpF,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,2FAA2F;IAC3F,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,oGAAoG;IACpG,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,GAAG,CAAC,2EAA2E,EAC7E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,mFAAmF,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5G,CAAC;IAED,gFAAgF;IAChF,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,gFAAgF;QAChF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,iFAAiF,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,6DAA6D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAChF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/strand-instance-manager.d.ts

@@ -157,6 +157,18 @@ export interface StartStrandConfig {
      * this node's behalf — what to do about it is the app's call.
      */
     onSelfRevoked?: (strandId: string) => void;
+    /**
+     * Called when the membership reconciler reports a blocked re-join — this node holds a
+     * staged membership invitation for the strand that its writes cannot redeem, which is
+     * what a REMOVED party handed a fresh invitation hits (see "Reporting a blocked
+     * re-join" in `strand-membership-reconciler.ts` for the two triggers, one of them a
+     * suspicion rather than a verdict). At most once per re-arm of the loop — a further
+     * invitation staged while the loop is still running does not reset the report — and
+     * only for closed strands with a party key. `CadreNode` wires it to its `strand:rejoin-blocked`
+     * event; nothing is stopped or torn down — a remaining manager admitting this party's
+     * key directly is the remedy, and the loop finishes the join by itself once that lands.
+     */
+    onRejoinBlocked?: (strandId: string) => void;
     /**
      * Tuning for the JOINING machine's first-sync write gate (`strand-first-sync-gate.ts`),
      * forwarded from {@link CadreNodeConfig.strandFirstSync}: the Header probe cadence while
@@ -370,8 +382,11 @@ export declare class StrandInstanceManager {
     /**
      * One {@link superviseRelayReservation} per relay dial addr, each over exactly
      * that relay so "held" is judged per relay (`circuitMultiaddrsVia`) and losing
-     * one relay re-drives only that one. Default timings — the control node's (2 s
-     * doubling to 60 s between failed attempts, a 5 s liveness check while held).
+     * one relay re-drives only that one. Default retry timings — the control node's (2 s
+     * doubling to 60 s between failed attempts, a 5 s liveness check while held). Each DRIVE's
+     * own deadline is counted in link round trips at this host's declared
+     * `network.linkRoundTripMs` (`link-budget.ts`), so the same declaration that lengthens the
+     * control node's drive lengthens these.
      *
      * Each supervisor's `beforeRedrive` is the caller's
      * {@link StartStrandConfig.announceDelegateToRelay} for THIS relay and THIS
@@ -416,6 +431,16 @@ export declare class StrandInstanceManager {
      * finished.
      */
     refreshRevocationEnforcement(strandId: string): Promise<void>;
+    /**
+     * A fresh membership invitation was staged for `strandId` (`CadreNode`'s
+     * `adoptFormationMembershipInvite`): re-arm the strand's membership reconciler so the
+     * invitation is attempted now rather than never — the loop finished during the first
+     * join and would otherwise stay stopped until a relaunch. Quiet no-op when no reconciler
+     * is armed: a first formation stages before the strand is added, and bring-up then arms
+     * a loop that finds the invitation by itself. Returns at once; the pass runs on the
+     * loop's own serialized chain and never rejects.
+     */
+    notifyMembershipInviteStaged(strandId: string): void;
     /**
      * Best-effort removal of THIS machine's own `Strand.MemberPeer` binding — the
      * self arm of `removeMemberPeer`, signed with the retained launch config's party

package/dist/strand-instance-manager.js

@@ -13,6 +13,7 @@ import { StrandFirstSyncGate, StrandAwaitingFirstSyncError, strandFirstSyncCompl
 import { DEFAULT_CONNECTION_MONITOR, resolveStrandClusterSize, strandClusterPolicy } from './types.js';
 import { strandNodeAddrs } from './strand-network-config.js';
 import { superviseRelayReservation } from './relay-reservation.js';
+import { connectionManagerTimeouts, peerJoinPushBudget, relayReservationBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 const log = debug('sereus:cadre:strand-manager');
 const timing = debug('sereus:cadre:timing');
 /**
@@ -319,6 +320,11 @@ export class StrandInstanceManager {
     async buildStrandRuntime(instance, config) {
         const strandId = instance.strandId;
         const { sAppConfig } = config;
+        // Refuse a bad `linkRoundTripMs` before any strand bring-up, for the reason
+        // `CadreNode.start()` does: every budget derived from it here is behind a condition
+        // (backfill disabled, no relay addrs), so a zero or NaN declaration would otherwise
+        // surface later inside a path that logs and carries on. `link-budget.ts`.
+        resolveLinkRoundTripMs(config.network?.linkRoundTripMs);
         // The store the instance OWNS (resolved once in `startStrand`), not a fresh
         // resolution: a rebuild must reach the same backend through the same warm cache.
         const strandStorage = this.strandStorages.get(strandId);
@@ -410,7 +416,12 @@ export class StrandInstanceManager {
                 // returns the frozen STRAND_CLUSTER_POLICY itself, declaring nothing. Resolved
                 // HERE rather than at `startStrand`, so a wake from hibernation would pick up a
                 // serving set that changed while the strand slept.
-                clusterPolicy: strandClusterPolicy(strandClusterSize, config.servingMachines),
+                // The read deadline is the same field the control node reads, because the two
+                // networks ride one link; absent, the base policy's COHORT_READ_DEADLINE_MS stands.
+                clusterPolicy: strandClusterPolicy(strandClusterSize, {
+                    servingMachines: config.servingMachines,
+                    cohortQueryTimeoutMs: config.network?.cohortQueryTimeoutMs
+                }),
                 arachnode: {
                     enableRingZulu: config.profile === 'storage'
                 },
@@ -422,6 +433,10 @@ export class StrandInstanceManager {
                 // widened ping deadline has to reach the strand nodes too (see
                 // DEFAULT_CONNECTION_MONITOR).
                 connectionMonitor: config.network?.connectionMonitor ?? DEFAULT_CONNECTION_MONITOR,
+                // The same declared-link limits the control node takes, and for the same reason: a
+                // strand node is the listener for every other member's strand node (`link-budget.ts`,
+                // `connectionManagerTimeouts`).
+                connectionManager: connectionManagerTimeouts(config.network?.linkRoundTripMs),
                 // Listen entries plus the WebSocket transport switch they imply — a strand node
                 // announces nothing the operator configured (`strand-network-config.ts`), and
                 // spreads AFTER `transports` above because the switch is a no-op whenever the
@@ -525,7 +540,8 @@ export class StrandInstanceManager {
                             const ownPeerId = instance.libp2pNode?.peerId.toString();
                             return ownPeerId !== undefined && revocationEnforcer.isRevoked(ownPeerId);
                         }
-                        : undefined
+                        : undefined,
+                    onRejoinBlocked: () => config.onRejoinBlocked?.(strandId)
                 }, {
                     pollIntervalMs: config.membershipReconciliation?.pollIntervalMs
                         ?? config.revocationEnforcement?.pollIntervalMs
@@ -564,7 +580,15 @@ export class StrandInstanceManager {
                         // The same prefix the receiver registered its block-transfer handler
                         // under — derived from networkName above, never re-spelled here.
                         protocolPrefix
-                    }, config.backfill);
+                    }, {
+                        // Dial and response deadlines counted in link round trips, not fixed milliseconds:
+                        // a relayed dial costs a fixed number of exchanges, so a fixed budget has a link
+                        // speed above which this catch-up can never reach the peer at all. See
+                        // `link-budget.ts`. Spread BEFORE the host's own config so an explicit
+                        // `strandBackfill.dialTimeoutMs` still wins.
+                        ...peerJoinPushBudget(config.network?.linkRoundTripMs),
+                        ...config.backfill
+                    });
                     backfill.start();
                     this.backfills.set(strandId, backfill);
                 }
@@ -579,10 +603,12 @@ export class StrandInstanceManager {
             // The strand's database is up, and the supervisor keeps trying on its backoff;
             // failing here would only trade that for `StrandWatcher`'s full-rebuild retry.
             //
-            // NOTE: a relay that is down costs this launch one full drive (10 s), and
-            // `StrandWatcher` launches strands one at a time — so N strands cost N × 10 s
-            // of bring-up during a relay outage. If that ever matters, stop awaiting here
-            // (the circuit addr then lands after `active`) rather than shortening the drive.
+            // NOTE: a relay that is down costs this launch one full drive — the reservation budget
+            // counted from the declared link round trip, 14 s at its default (`link-budget.ts`) — and
+            // `StrandWatcher` launches strands one at a time, so N strands cost N of those in
+            // bring-up during a relay outage, and MORE on a host that declared a slower link. If that
+            // ever matters, stop awaiting here (the circuit addr then lands after `active`) rather
+            // than shortening the drive.
             t0 = performance.now();
             await this.awaitFirstRelayAttempts(strandId);
             timing('[buildStrandRuntime:%s] relay first attempts: %dms', strandId, Math.round(performance.now() - t0));
@@ -619,10 +645,9 @@ export class StrandInstanceManager {
         // Relay supervisors FIRST of all — before anything below is torn down — so no
         // re-drive is scheduled against a node being stopped. `stop()` is synchronous
         // and never awaits a drive, so a relay that is down cannot delay this teardown.
-        // NOTE: a drive ALREADY in flight cannot be aborted (the drive takes no
-        // AbortSignal — `backlog/bug-relay-drive-not-cancellable`); it fails soft
-        // against the stopped node within its own 10 s deadline and its result is
-        // discarded.
+        // `stop()` also cancels the drive already in flight, so an attempt started
+        // moments before this does not keep dialing and polling the node the lines
+        // below are stopping; its result is discarded either way.
         const relaySupervisors = this.relaySupervisors.get(instance.strandId);
         if (relaySupervisors) {
             relaySupervisors.forEach((supervisor) => supervisor.stop());
@@ -672,8 +697,11 @@ export class StrandInstanceManager {
     /**
      * One {@link superviseRelayReservation} per relay dial addr, each over exactly
      * that relay so "held" is judged per relay (`circuitMultiaddrsVia`) and losing
-     * one relay re-drives only that one. Default timings — the control node's (2 s
-     * doubling to 60 s between failed attempts, a 5 s liveness check while held).
+     * one relay re-drives only that one. Default retry timings — the control node's (2 s
+     * doubling to 60 s between failed attempts, a 5 s liveness check while held). Each DRIVE's
+     * own deadline is counted in link round trips at this host's declared
+     * `network.linkRoundTripMs` (`link-budget.ts`), so the same declaration that lengthens the
+     * control node's drive lengthens these.
      *
      * Each supervisor's `beforeRedrive` is the caller's
      * {@link StartStrandConfig.announceDelegateToRelay} for THIS relay and THIS
@@ -687,7 +715,9 @@ export class StrandInstanceManager {
         }
         const announce = config.announceDelegateToRelay;
         const delegatePeerId = node.peerId.toString();
+        const timeoutMs = relayReservationBudgetMs(config.network?.linkRoundTripMs);
         return relayDialAddrs.map((relayAddr) => superviseRelayReservation(node, [relayAddr], {
+            timeoutMs,
             ...(announce && { beforeRedrive: () => announce(strandId, relayAddr, delegatePeerId) })
         }));
     }
@@ -757,6 +787,23 @@ export class StrandInstanceManager {
         }
         await enforcer.refresh();
     }
+    /**
+     * A fresh membership invitation was staged for `strandId` (`CadreNode`'s
+     * `adoptFormationMembershipInvite`): re-arm the strand's membership reconciler so the
+     * invitation is attempted now rather than never — the loop finished during the first
+     * join and would otherwise stay stopped until a relaunch. Quiet no-op when no reconciler
+     * is armed: a first formation stages before the strand is added, and bring-up then arms
+     * a loop that finds the invitation by itself. Returns at once; the pass runs on the
+     * loop's own serialized chain and never rejects.
+     */
+    notifyMembershipInviteStaged(strandId) {
+        const reconciler = this.membershipReconcilers.get(strandId);
+        if (!reconciler) {
+            log('notifyMembershipInviteStaged: strand %s has no armed membership reconciler — bring-up will find the invitation', strandId);
+            return;
+        }
+        void reconciler.rearm();
+    }
     /**
      * Best-effort removal of THIS machine's own `Strand.MemberPeer` binding — the
      * self arm of `removeMemberPeer`, signed with the retained launch config's party