@serfab/cadre-core 1.5.0 → 1.6.0

package/dist/index.d.ts

@@ -44,7 +44,7 @@ export { validatePushCredentials, redactPushCredentials, REDACTED } from './push
 export { PushFanoutService, DEFAULT_PUSH_COOLDOWN_MS, DEFAULT_PUSH_DEBOUNCE_MS, type PushFanoutOptions, type FanoutMember } from './push-fanout.js';
 export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE, type ControlCohortSelection, type ControlCohortReconcileResult } from './control-cohort.js';
 export { dialPeerAddrs, tryAddrsInTurn, directBeforeRelayed, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS, DEFAULT_PEER_DIAL_BUDGET, type PeerDialBudget, type AddrDialer } from './peer-dial.js';
-export { DECLARED_LINK_ROUND_TRIP_MS, RELAYED_DIAL_ROUND_TRIPS, RELAY_RESERVATION_ROUND_TRIPS, CIRCUIT_REQUEST_ROUND_TRIPS, PUSH_TRANSFER_ALLOWANCE_MS, resolveLinkRoundTripMs, relayedDialBudgetMs, relayReservationBudgetMs, circuitRequestBudgetMs, peerJoinPushBudget, type PeerJoinPushBudget } from './link-budget.js';
+export { DECLARED_LINK_ROUND_TRIP_MS, RELAYED_DIAL_ROUND_TRIPS, RELAY_RESERVATION_ROUND_TRIPS, CIRCUIT_REQUEST_ROUND_TRIPS, PUSH_TRANSFER_ALLOWANCE_MS, resolveLinkRoundTripMs, relayedDialBudgetMs, connectionManagerTimeouts, relayReservationBudgetMs, circuitRequestBudgetMs, peerJoinPushBudget, type PeerJoinPushBudget } from './link-budget.js';
 export { anchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy, type SeedTrustPolicy, type SeedTrustContext, type SeedTrustDecision } from './seed-trust-policy.js';
 export { signSchema, verifySchema, assertSchemaSignature, SchemaVerificationError } from './schema-verification.js';
 export { FormationListener, dialFormation, isValidResponderCreatesResult, isWellFormedMembershipInvite, sanitizeStrandAddrs, FORMATION_PROTOCOL, type FormationParty, type FormationContactMessage, type FormationResultMessage, type FormationProvisionResult, type FormationStrandInfo, type FormationDbConnectionInfo, type FormationListenerOptions, type FormationDialOptions, type FormationDialResult, type ResponderProvisionOutcome } from './strand-formation-protocol.js';

package/dist/index.js

@@ -139,7 +139,7 @@ export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_
 export { dialPeerAddrs, tryAddrsInTurn, directBeforeRelayed, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS, DEFAULT_PEER_DIAL_BUDGET } from './peer-dial.js';
 // Dial and reservation budgets counted in link round trips rather than fixed milliseconds, so
 // one declared assumption about the link moves them all — see `NetworkConfig.linkRoundTripMs`.
-export { DECLARED_LINK_ROUND_TRIP_MS, RELAYED_DIAL_ROUND_TRIPS, RELAY_RESERVATION_ROUND_TRIPS, CIRCUIT_REQUEST_ROUND_TRIPS, PUSH_TRANSFER_ALLOWANCE_MS, resolveLinkRoundTripMs, relayedDialBudgetMs, relayReservationBudgetMs, circuitRequestBudgetMs, peerJoinPushBudget } from './link-budget.js';
+export { DECLARED_LINK_ROUND_TRIP_MS, RELAYED_DIAL_ROUND_TRIPS, RELAY_RESERVATION_ROUND_TRIPS, CIRCUIT_REQUEST_ROUND_TRIPS, PUSH_TRANSFER_ALLOWANCE_MS, resolveLinkRoundTripMs, relayedDialBudgetMs, connectionManagerTimeouts, relayReservationBudgetMs, circuitRequestBudgetMs, peerJoinPushBudget } from './link-budget.js';
 // Seed trust policy (trust anchor for incoming seeds)
 export { anchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy } from './seed-trust-policy.js';
 // Schema Verification

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,EAAwO,MAAM,uBAAuB,CAAC;AAElZ,+EAA+E;AAC/E,qFAAqF;AACrF,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,yFAAyF;AACzF,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAWjC,2FAA2F;AAC3F,OAAO,EAAE,0BAA0B,EAA0C,MAAM,4BAA4B,CAAC;AAEhH,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,0BAA0B,EAAuB,MAAM,kBAAkB,CAAC;AAE1I,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,6CAA6C;AAC7C,mEAAmE;AACnE,wDAAwD;AACxD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAG5B,MAAM,0BAA0B,CAAC;AAQlC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAG7B,MAAM,2BAA2B,CAAC;AAEnC,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,2DAA2D;AAC3D,iFAAiF;AACjF,+EAA+E;AAC/E,oDAAoD;AACpD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAE/B,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,yEAAyE;AACzE,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAEtC,kFAAkF;AAClF,sFAAsF;AACtF,kEAAkE;AAClE,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,iCAAiC,EACjC,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAExB,MAAM,6BAA6B,CAAC;AAErC,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,sCAAsC,EAKvC,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2CAA2C;AAC3C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,EAQpC,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAI/B,MAAM,mCAAmC,CAAC;AAE3C,oFAAoF;AACpF,oFAAoF;AACpF,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAOxC,MAAM,0BAA0B,CAAC;AAElC,wFAAwF;AACxF,yFAAyF;AACzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EAMvB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,qBAAqB;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,EACd,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EAmBtB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,2BAA2B,EAG5B,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAGrC,MAAM,qBAAqB,CAAC;AAE7B,6EAA6E;AAC7E,kEAAkE;AAClE,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,sCAAsC,EACtC,kDAAkD,EAClD,oCAAoC,EACpC,wBAAwB,EAGzB,MAAM,gBAAgB,CAAC;AAExB,8FAA8F;AAC9F,+FAA+F;AAC/F,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAE1B,sDAAsD;AACtD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAWnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,oCAAoC,EACpC,oCAAoC,EAGrC,MAAM,+BAA+B,CAAC;AAEvC,wEAAwE;AACxE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,EACnC,gCAAgC,EAChC,mCAAmC,EACnC,+BAA+B,EAC/B,6BAA6B,EAG9B,MAAM,kCAAkC,CAAC;AAE1C,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,yEAAyE;AACzE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,YAAY;AACZ,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAEnF,gFAAgF;AAChF,0EAA0E;AAC1E,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAM7B,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,EAAwO,MAAM,uBAAuB,CAAC;AAElZ,+EAA+E;AAC/E,qFAAqF;AACrF,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,yFAAyF;AACzF,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAWjC,2FAA2F;AAC3F,OAAO,EAAE,0BAA0B,EAA0C,MAAM,4BAA4B,CAAC;AAEhH,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,0BAA0B,EAAuB,MAAM,kBAAkB,CAAC;AAE1I,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,6CAA6C;AAC7C,mEAAmE;AACnE,wDAAwD;AACxD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAG5B,MAAM,0BAA0B,CAAC;AAQlC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAG7B,MAAM,2BAA2B,CAAC;AAEnC,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,2DAA2D;AAC3D,iFAAiF;AACjF,+EAA+E;AAC/E,oDAAoD;AACpD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAE/B,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,yEAAyE;AACzE,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAEtC,kFAAkF;AAClF,sFAAsF;AACtF,kEAAkE;AAClE,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,iCAAiC,EACjC,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAExB,MAAM,6BAA6B,CAAC;AAErC,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,sCAAsC,EAKvC,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2CAA2C;AAC3C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,EAQpC,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAI/B,MAAM,mCAAmC,CAAC;AAE3C,oFAAoF;AACpF,oFAAoF;AACpF,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAOxC,MAAM,0BAA0B,CAAC;AAElC,wFAAwF;AACxF,yFAAyF;AACzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EAMvB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,qBAAqB;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,EACd,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EAmBtB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,2BAA2B,EAG5B,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAGrC,MAAM,qBAAqB,CAAC;AAE7B,6EAA6E;AAC7E,kEAAkE;AAClE,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,sCAAsC,EACtC,kDAAkD,EAClD,oCAAoC,EACpC,wBAAwB,EAGzB,MAAM,gBAAgB,CAAC;AAExB,8FAA8F;AAC9F,+FAA+F;AAC/F,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAE1B,sDAAsD;AACtD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAWnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,oCAAoC,EACpC,oCAAoC,EAGrC,MAAM,+BAA+B,CAAC;AAEvC,wEAAwE;AACxE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,EACnC,gCAAgC,EAChC,mCAAmC,EACnC,+BAA+B,EAC/B,6BAA6B,EAG9B,MAAM,kCAAkC,CAAC;AAE1C,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,yEAAyE;AACzE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,YAAY;AACZ,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAEnF,gFAAgF;AAChF,0EAA0E;AAC1E,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAM7B,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}

package/dist/link-budget.d.ts

@@ -35,62 +35,78 @@
  *
  * | operation                                            | link round trips | at the declared default |
  * | ---------------------------------------------------- | ---------------- | ----------------------- |
- * | open a relayed connection to another machine          | 4                | 8 000 ms                |
- * | dial the relay itself                                 | 1                | 2 000 ms                |
- * | request a reservation on an open relay connection     | 1                | 2 000 ms                |
- * | negotiate a protocol over an established circuit      | 1                | 2 000 ms                |
- *
- * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay, re-run for this
- * change: a relayed dial took 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and
- * **12 066-12 094 ms at 1 500 ms one-way**. Four link round trips of pure delay would be 7 200
- * and 12 000, so the real cost sits about 60-95 ms ABOVE the arithmetic — the handshakes and a
- * phone's pure-JS crypto, which no delay figure contains. That residue is small but it is why
- * {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the band sereus supports rather
- * than matching it exactly: a declaration equal to the measured round trip would derive a
- * budget marginally BELOW the dial it has to contain.
- *
- * ── The ceiling this does NOT lift ──
- *
- * Above roughly 1 250 ms one-way — a 2.5-second link round trip — no relayed connection can be
- * established by this stack whatever cadre declares here. Two budgets of 10 000 ms each inside
- * libp2p bound the same dial and cannot be reached from sereus at all:
- * `connectionManager.dialTimeout` (libp2p's own default, which `@optimystic/db-p2p`'s
- * `libp2p-node-base.ts` neither sets nor exposes) and `connectionManager.inboundUpgradeTimeout`
- * (which it sets to 10 000). Both appear in the same re-run: at 1 500 ms one-way the dial under
- * libp2p's default failed with `The operation was aborted due to timeout`, and with the shipped
- * inbound-upgrade budget the DIALER's own 12 094 ms dial resolved while the LISTENER had
- * already thrown the half-built connection away — so the first stream over it died with
+ * | open a relayed connection to another machine          | 4                | 14 000 ms               |
+ * | dial the relay itself                                 | 1                | 3 500 ms                |
+ * | request a reservation on an open relay connection     | 1                | 3 500 ms                |
+ * | negotiate a protocol over an established circuit      | 1                | 3 500 ms                |
+ *
+ * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay: a relayed dial took
+ * 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and **12 066-12 094 ms at 1 500 ms
+ * one-way**. Four link round trips of pure delay would be 7 200 and 12 000, so the real cost
+ * sits about 60-95 ms ABOVE the arithmetic — the handshakes, which no delay figure contains.
+ * That residue is why {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the link sereus
+ * supports rather than matching it exactly: a declaration equal to the supported round trip
+ * would derive a budget marginally BELOW the dial it has to contain.
+ *
+ * ── libp2p's own two limits ──
+ *
+ * Two limits inside libp2p bound the same relayed dial as cadre's budgets do, and both were
+ * 10 000 ms until `@optimystic/db-p2p` 1.7.0 let an embedder set them: the DIALER's
+ * `connectionManager.dialTimeout`, which bounds every dial that carries no abort signal of its
+ * own, and the LISTENER's `connectionManager.inboundUpgradeTimeout`, which is how long the
+ * machine being called lets a half-built connection finish its handshakes. At 10 000 ms each,
+ * no relayed connection could be opened above about 1 250 ms one-way (a 2.5-second link round
+ * trip) whatever cadre declared. The listener's limit is the one that makes that failure
+ * silent: at 1 500 ms one-way the dialer's own 12 094 ms dial RESOLVED while the listener had
+ * already thrown the connection away at 10 s, so the first stream over it died with
  * `Unexpected EOF - stream closed while reading 0/1 bytes` and the listener reported no peer at
- * all. That is why a too-slow link produces silence rather than an error.
- *
- * Two consequences for a reader choosing a declaration. Below that ceiling, the DEFAULT
- * declaration of 2 000 ms does not reach it: four round trips of 2 000 ms is 8 000 ms, which
- * covers a one-way delay up to 1 000 ms, so a deployment somewhere between 1 000 and 1 250 ms
- * one-way has to declare its own (about 2 200-2 500) to use the band libp2p still allows. And
- * declaring much ABOVE 2 500 buys nothing: the budgets here grow, and
- * the connection still fails inside libp2p. Lifting that needs an upstream change and a
- * decision about how slow a link sereus intends to carry —
- * `tickets/blocked/how-slow-a-relayed-link-does-sereus-carry`. A reader who raised these
- * numbers and still cannot connect at 1 500 ms one-way has met that ceiling, not this module.
+ * all. cadre now declares both from this module ({@link connectionManagerTimeouts}) on the
+ * control node and every strand node.
+ *
+ * ── What still fails at the supported link ──
+ *
+ * - **Optimystic's own request dials.** `@optimystic/db-p2p`'s RPC clients dial with fixed
+ *   3 000 ms deadlines of their own (`DEFAULT_DIAL_TIMEOUT_MS`, the `pushDialTimeoutMs`
+ *   defaults), which neither limit above reaches because a caller's signal replaces
+ *   `dialTimeout`. So an Optimystic request that has to OPEN a relayed connection fails above
+ *   375 ms one-way. A request over a connection that is already open does not dial, and the
+ *   connections cadre opens itself are budgeted here. Upstream:
+ *   `debt-rpc-dial-deadlines-cannot-open-a-slow-relayed-connection` in optimystic.
+ * - **Cadre deadlines still typed as milliseconds.** The strand wake, strand-address and seed
+ *   delivery deadlines, and the cohort read deadline, bound exchanges over the same link but do
+ *   not derive from it: `tickets/backlog/debt-three-more-dial-deadlines-ignore-the-declared-link`.
+ * - **A machine that declares a faster link than its peers.** Every machine is the listener
+ *   for the others, so its `inboundUpgradeTimeout` — derived from ITS declaration — bounds
+ *   connections other machines open to it. A peer declaring 3 500 ms dialing a machine that
+ *   declared 500 ms gets exactly the silent failure above. Declare the same link on every
+ *   machine of a party.
  */
+import type { Libp2pConnectionTimeouts } from '@optimystic/db-p2p';
 /**
  * The link round trip cadre assumes when a host declares none, in milliseconds. A deployment
  * that knows its own link states it with `NetworkConfig.linkRoundTripMs` instead.
  *
- * **Why 2 000.** It states the slowest link sereus already claims to support, and two other
- * budgets fix that claim independently: `COHORT_READ_DEADLINE_MS`
- * (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
- * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`, 120 000 ms) were both
- * sized against two parties reaching each other only through a public relay at a round trip
- * near 1.8 s. Declaring 2 000 rounds that band up and leaves about 720 ms over the worst
- * relayed dial measured at it (7 279 ms against a derived 8 000 ms).
- *
- * Raising it is how a deployment that KNOWS its link is slower moves every derived budget at
- * once. The cost is the ordinary cost of a longer deadline: a peer that is genuinely gone holds
- * the operation for that much longer before it is abandoned and retried. Above about 2 500 it
- * buys nothing — see the module doc's ceiling paragraph.
+ * **Why 3 500.** Sereus supports two machines that reach each other only through a relay up to
+ * a **3-second link round trip** (1 500 ms each way — a congested mobile or satellite link;
+ * `docs/architecture.md` → "Relay Integration"). The worst relayed dial measured at that link
+ * was 12 094 ms, above the 12 000 ms a declaration of exactly 3 000 would derive, so the
+ * declaration rounds the supported link up to the next half second. 3 500 derives 14 000 ms
+ * and leaves about 1.9 s over that dial: room for a phone's Noise handshake, which the
+ * loopback measurement on a desktop does not contain. (The previous 2 000 followed the same
+ * convention for the 1.8 s band sereus supported before, with about 720 ms to spare.)
+ *
+ * Two budgets outside this module were sized against the 1.8 s band and do NOT move with it:
+ * `COHORT_READ_DEADLINE_MS` (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
+ * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`). The module doc's
+ * "What still fails" list carries the first.
+ *
+ * What 3 500 costs, against 2 000: a peer that is genuinely gone holds each operation longer
+ * before it is abandoned and retried — a relayed dial or a reservation drive 14 s instead of
+ * 8 s, and a control-cohort dial of one peer across all its addresses 56 s instead of 32 s.
+ * Raise it further for a link slower still; lower it only on a deployment where EVERY machine
+ * of the party is that close, for the reason the "What still fails" list gives.
  */
-export declare const DECLARED_LINK_ROUND_TRIP_MS = 2000;
+export declare const DECLARED_LINK_ROUND_TRIP_MS = 3500;
 /**
  * Link round trips one relayed connection setup costs: transport, encryption and multiplexer
  * handshakes to the relay, the circuit open, then both handshakes again end to end through it.
@@ -127,10 +143,10 @@ export declare const CIRCUIT_REQUEST_ROUND_TRIPS = 2;
  *
  * NOTE: 6 000 ms is not a measurement of any throughput — it is the residue of the 10 000 ms
  * this deadline shipped as before it was split into a latency part and a transfer part, chosen
- * so that at the default declaration the derived value is the same 10 000 and no fast link got
- * slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile link. If pushes
- * ever time out with the transfer only part done, measure that and raise THIS, not the declared
- * round trip.
+ * so that at the declaration then in force (2 000 ms) the derived value stayed 10 000 and no
+ * fast link got slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile
+ * link. If pushes ever time out with the transfer only part done, measure that and raise THIS,
+ * not the declared round trip.
  */
 export declare const PUSH_TRANSFER_ALLOWANCE_MS = 6000;
 /**
@@ -155,6 +171,32 @@ export declare function resolveLinkRoundTripMs(linkRoundTripMs?: number): number
  * relay: {@link RELAYED_DIAL_ROUND_TRIPS} at the declared link round trip.
  */
 export declare function relayedDialBudgetMs(linkRoundTripMs?: number): number;
+/**
+ * libp2p's two connection-manager limits for a node at the declared link, handed to
+ * `@optimystic/db-p2p`'s `NodeOptions.connectionManager` on the control node and every strand
+ * node.
+ *
+ * Both bound the same thing — opening a relayed connection, measured at 8 one-way link delays,
+ * which is {@link RELAYED_DIAL_ROUND_TRIPS} (4) link round trips — so both are
+ * {@link relayedDialBudgetMs}: 4 x 3 500 = 14 000 ms at the default declaration, covering the
+ * 12 094 ms measured at the supported 3-second link.
+ *
+ * The listener's limit is deliberately NOT smaller than the dialer's. The listener's clock
+ * starts only when the relay hands it the circuit, a few one-way delays after the dialer's
+ * started, and both sides finish the handshakes at about the same moment; so with equal limits
+ * the listener never discards a connection that the dialer's own dial would still accept. A
+ * listener limit below the dialer's is what produced the silent failure in the module doc.
+ *
+ * The cost of a longer `inboundUpgradeTimeout` is that a peer which opens a connection and then
+ * stalls its handshake holds that half-built connection 14 s instead of 10 s.
+ *
+ * NOTE: derived from the declaration alone, so a per-field override that raises a cadre dial
+ * budget above it (`controlCohort.perAddressDialTimeoutMs`, `strandBackfill.dialTimeoutMs`)
+ * does not raise these; a dial that outlasts the listener's limit gets the silent failure
+ * again. If such overrides start being used for slow links, raise the declaration instead or
+ * take the largest configured dial budget here.
+ */
+export declare function connectionManagerTimeouts(linkRoundTripMs?: number): Libp2pConnectionTimeouts;
 /**
  * Deadline for one whole relay reservation drive: {@link RELAY_RESERVATION_ROUND_TRIPS} at the
  * declared link round trip.

package/dist/link-budget.js

@@ -35,62 +35,77 @@
  *
  * | operation                                            | link round trips | at the declared default |
  * | ---------------------------------------------------- | ---------------- | ----------------------- |
- * | open a relayed connection to another machine          | 4                | 8 000 ms                |
- * | dial the relay itself                                 | 1                | 2 000 ms                |
- * | request a reservation on an open relay connection     | 1                | 2 000 ms                |
- * | negotiate a protocol over an established circuit      | 1                | 2 000 ms                |
- *
- * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay, re-run for this
- * change: a relayed dial took 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and
- * **12 066-12 094 ms at 1 500 ms one-way**. Four link round trips of pure delay would be 7 200
- * and 12 000, so the real cost sits about 60-95 ms ABOVE the arithmetic — the handshakes and a
- * phone's pure-JS crypto, which no delay figure contains. That residue is small but it is why
- * {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the band sereus supports rather
- * than matching it exactly: a declaration equal to the measured round trip would derive a
- * budget marginally BELOW the dial it has to contain.
- *
- * ── The ceiling this does NOT lift ──
- *
- * Above roughly 1 250 ms one-way — a 2.5-second link round trip — no relayed connection can be
- * established by this stack whatever cadre declares here. Two budgets of 10 000 ms each inside
- * libp2p bound the same dial and cannot be reached from sereus at all:
- * `connectionManager.dialTimeout` (libp2p's own default, which `@optimystic/db-p2p`'s
- * `libp2p-node-base.ts` neither sets nor exposes) and `connectionManager.inboundUpgradeTimeout`
- * (which it sets to 10 000). Both appear in the same re-run: at 1 500 ms one-way the dial under
- * libp2p's default failed with `The operation was aborted due to timeout`, and with the shipped
- * inbound-upgrade budget the DIALER's own 12 094 ms dial resolved while the LISTENER had
- * already thrown the half-built connection away — so the first stream over it died with
+ * | open a relayed connection to another machine          | 4                | 14 000 ms               |
+ * | dial the relay itself                                 | 1                | 3 500 ms                |
+ * | request a reservation on an open relay connection     | 1                | 3 500 ms                |
+ * | negotiate a protocol over an established circuit      | 1                | 3 500 ms                |
+ *
+ * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay: a relayed dial took
+ * 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and **12 066-12 094 ms at 1 500 ms
+ * one-way**. Four link round trips of pure delay would be 7 200 and 12 000, so the real cost
+ * sits about 60-95 ms ABOVE the arithmetic — the handshakes, which no delay figure contains.
+ * That residue is why {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the link sereus
+ * supports rather than matching it exactly: a declaration equal to the supported round trip
+ * would derive a budget marginally BELOW the dial it has to contain.
+ *
+ * ── libp2p's own two limits ──
+ *
+ * Two limits inside libp2p bound the same relayed dial as cadre's budgets do, and both were
+ * 10 000 ms until `@optimystic/db-p2p` 1.7.0 let an embedder set them: the DIALER's
+ * `connectionManager.dialTimeout`, which bounds every dial that carries no abort signal of its
+ * own, and the LISTENER's `connectionManager.inboundUpgradeTimeout`, which is how long the
+ * machine being called lets a half-built connection finish its handshakes. At 10 000 ms each,
+ * no relayed connection could be opened above about 1 250 ms one-way (a 2.5-second link round
+ * trip) whatever cadre declared. The listener's limit is the one that makes that failure
+ * silent: at 1 500 ms one-way the dialer's own 12 094 ms dial RESOLVED while the listener had
+ * already thrown the connection away at 10 s, so the first stream over it died with
  * `Unexpected EOF - stream closed while reading 0/1 bytes` and the listener reported no peer at
- * all. That is why a too-slow link produces silence rather than an error.
- *
- * Two consequences for a reader choosing a declaration. Below that ceiling, the DEFAULT
- * declaration of 2 000 ms does not reach it: four round trips of 2 000 ms is 8 000 ms, which
- * covers a one-way delay up to 1 000 ms, so a deployment somewhere between 1 000 and 1 250 ms
- * one-way has to declare its own (about 2 200-2 500) to use the band libp2p still allows. And
- * declaring much ABOVE 2 500 buys nothing: the budgets here grow, and
- * the connection still fails inside libp2p. Lifting that needs an upstream change and a
- * decision about how slow a link sereus intends to carry —
- * `tickets/blocked/how-slow-a-relayed-link-does-sereus-carry`. A reader who raised these
- * numbers and still cannot connect at 1 500 ms one-way has met that ceiling, not this module.
+ * all. cadre now declares both from this module ({@link connectionManagerTimeouts}) on the
+ * control node and every strand node.
+ *
+ * ── What still fails at the supported link ──
+ *
+ * - **Optimystic's own request dials.** `@optimystic/db-p2p`'s RPC clients dial with fixed
+ *   3 000 ms deadlines of their own (`DEFAULT_DIAL_TIMEOUT_MS`, the `pushDialTimeoutMs`
+ *   defaults), which neither limit above reaches because a caller's signal replaces
+ *   `dialTimeout`. So an Optimystic request that has to OPEN a relayed connection fails above
+ *   375 ms one-way. A request over a connection that is already open does not dial, and the
+ *   connections cadre opens itself are budgeted here. Upstream:
+ *   `debt-rpc-dial-deadlines-cannot-open-a-slow-relayed-connection` in optimystic.
+ * - **Cadre deadlines still typed as milliseconds.** The strand wake, strand-address and seed
+ *   delivery deadlines, and the cohort read deadline, bound exchanges over the same link but do
+ *   not derive from it: `tickets/backlog/debt-three-more-dial-deadlines-ignore-the-declared-link`.
+ * - **A machine that declares a faster link than its peers.** Every machine is the listener
+ *   for the others, so its `inboundUpgradeTimeout` — derived from ITS declaration — bounds
+ *   connections other machines open to it. A peer declaring 3 500 ms dialing a machine that
+ *   declared 500 ms gets exactly the silent failure above. Declare the same link on every
+ *   machine of a party.
  */
 /**
  * The link round trip cadre assumes when a host declares none, in milliseconds. A deployment
  * that knows its own link states it with `NetworkConfig.linkRoundTripMs` instead.
  *
- * **Why 2 000.** It states the slowest link sereus already claims to support, and two other
- * budgets fix that claim independently: `COHORT_READ_DEADLINE_MS`
- * (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
- * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`, 120 000 ms) were both
- * sized against two parties reaching each other only through a public relay at a round trip
- * near 1.8 s. Declaring 2 000 rounds that band up and leaves about 720 ms over the worst
- * relayed dial measured at it (7 279 ms against a derived 8 000 ms).
- *
- * Raising it is how a deployment that KNOWS its link is slower moves every derived budget at
- * once. The cost is the ordinary cost of a longer deadline: a peer that is genuinely gone holds
- * the operation for that much longer before it is abandoned and retried. Above about 2 500 it
- * buys nothing — see the module doc's ceiling paragraph.
+ * **Why 3 500.** Sereus supports two machines that reach each other only through a relay up to
+ * a **3-second link round trip** (1 500 ms each way — a congested mobile or satellite link;
+ * `docs/architecture.md` → "Relay Integration"). The worst relayed dial measured at that link
+ * was 12 094 ms, above the 12 000 ms a declaration of exactly 3 000 would derive, so the
+ * declaration rounds the supported link up to the next half second. 3 500 derives 14 000 ms
+ * and leaves about 1.9 s over that dial: room for a phone's Noise handshake, which the
+ * loopback measurement on a desktop does not contain. (The previous 2 000 followed the same
+ * convention for the 1.8 s band sereus supported before, with about 720 ms to spare.)
+ *
+ * Two budgets outside this module were sized against the 1.8 s band and do NOT move with it:
+ * `COHORT_READ_DEADLINE_MS` (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
+ * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`). The module doc's
+ * "What still fails" list carries the first.
+ *
+ * What 3 500 costs, against 2 000: a peer that is genuinely gone holds each operation longer
+ * before it is abandoned and retried — a relayed dial or a reservation drive 14 s instead of
+ * 8 s, and a control-cohort dial of one peer across all its addresses 56 s instead of 32 s.
+ * Raise it further for a link slower still; lower it only on a deployment where EVERY machine
+ * of the party is that close, for the reason the "What still fails" list gives.
  */
-export const DECLARED_LINK_ROUND_TRIP_MS = 2000;
+export const DECLARED_LINK_ROUND_TRIP_MS = 3500;
 /**
  * Link round trips one relayed connection setup costs: transport, encryption and multiplexer
  * handshakes to the relay, the circuit open, then both handshakes again end to end through it.
@@ -127,10 +142,10 @@ export const CIRCUIT_REQUEST_ROUND_TRIPS = 2;
  *
  * NOTE: 6 000 ms is not a measurement of any throughput — it is the residue of the 10 000 ms
  * this deadline shipped as before it was split into a latency part and a transfer part, chosen
- * so that at the default declaration the derived value is the same 10 000 and no fast link got
- * slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile link. If pushes
- * ever time out with the transfer only part done, measure that and raise THIS, not the declared
- * round trip.
+ * so that at the declaration then in force (2 000 ms) the derived value stayed 10 000 and no
+ * fast link got slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile
+ * link. If pushes ever time out with the transfer only part done, measure that and raise THIS,
+ * not the declared round trip.
  */
 export const PUSH_TRANSFER_ALLOWANCE_MS = 6000;
 /**
@@ -165,6 +180,35 @@ export function resolveLinkRoundTripMs(linkRoundTripMs) {
 export function relayedDialBudgetMs(linkRoundTripMs) {
     return RELAYED_DIAL_ROUND_TRIPS * resolveLinkRoundTripMs(linkRoundTripMs);
 }
+/**
+ * libp2p's two connection-manager limits for a node at the declared link, handed to
+ * `@optimystic/db-p2p`'s `NodeOptions.connectionManager` on the control node and every strand
+ * node.
+ *
+ * Both bound the same thing — opening a relayed connection, measured at 8 one-way link delays,
+ * which is {@link RELAYED_DIAL_ROUND_TRIPS} (4) link round trips — so both are
+ * {@link relayedDialBudgetMs}: 4 x 3 500 = 14 000 ms at the default declaration, covering the
+ * 12 094 ms measured at the supported 3-second link.
+ *
+ * The listener's limit is deliberately NOT smaller than the dialer's. The listener's clock
+ * starts only when the relay hands it the circuit, a few one-way delays after the dialer's
+ * started, and both sides finish the handshakes at about the same moment; so with equal limits
+ * the listener never discards a connection that the dialer's own dial would still accept. A
+ * listener limit below the dialer's is what produced the silent failure in the module doc.
+ *
+ * The cost of a longer `inboundUpgradeTimeout` is that a peer which opens a connection and then
+ * stalls its handshake holds that half-built connection 14 s instead of 10 s.
+ *
+ * NOTE: derived from the declaration alone, so a per-field override that raises a cadre dial
+ * budget above it (`controlCohort.perAddressDialTimeoutMs`, `strandBackfill.dialTimeoutMs`)
+ * does not raise these; a dial that outlasts the listener's limit gets the silent failure
+ * again. If such overrides start being used for slow links, raise the declaration instead or
+ * take the largest configured dial budget here.
+ */
+export function connectionManagerTimeouts(linkRoundTripMs) {
+    const budgetMs = relayedDialBudgetMs(linkRoundTripMs);
+    return { dialTimeout: budgetMs, inboundUpgradeTimeout: budgetMs };
+}
 /**
  * Deadline for one whole relay reservation drive: {@link RELAY_RESERVATION_ROUND_TRIPS} at the
  * declared link round trip.

package/dist/link-budget.js.map

@@ -1 +1 @@
-{"version":3,"file":"link-budget.js","sourceRoot":"","sources":["../src/link-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,eAAwB;IAC9D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,2BAA2B,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACd,mFAAmF,MAAM,CAAC,eAAe,CAAC,EAAE,CAC5G,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAwB;IAC3D,OAAO,wBAAwB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,eAAwB;IAChE,OAAO,6BAA6B,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,eAAwB,EACxB,mBAAmB,GAAG,0BAA0B;IAEhD,OAAO,2BAA2B,GAAG,sBAAsB,CAAC,eAAe,CAAC,GAAG,mBAAmB,CAAC;AACpG,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAwB;IAC1D,OAAO;QACN,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC;QACnD,iBAAiB,EAAE,sBAAsB,CAAC,eAAe,CAAC;KAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"link-budget.js","sourceRoot":"","sources":["../src/link-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAIH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,eAAwB;IAC9D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,2BAA2B,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACd,mFAAmF,MAAM,CAAC,eAAe,CAAC,EAAE,CAC5G,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAwB;IAC3D,OAAO,wBAAwB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CAAC,eAAwB;IACjE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACtD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,eAAwB;IAChE,OAAO,6BAA6B,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,eAAwB,EACxB,mBAAmB,GAAG,0BAA0B;IAEhD,OAAO,2BAA2B,GAAG,sBAAsB,CAAC,eAAe,CAAC,GAAG,mBAAmB,CAAC;AACpG,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAwB;IAC1D,OAAO;QACN,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC;QACnD,iBAAiB,EAAE,sBAAsB,CAAC,eAAe,CAAC;KAC1D,CAAC;AACH,CAAC"}

package/dist/peer-dial.d.ts

@@ -26,8 +26,8 @@ import type { Connection } from '@libp2p/interface';
 import type { Multiaddr } from '@multiformats/multiaddr';
 /**
  * Default limit on ONE address's dial attempt, in ms, at the DEFAULT declared link round trip:
- * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (2000 ms) = 8000 ms, which is
- * what this constant was already set to as a fixed number.
+ * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (3500 ms) = 14 000 ms. It was
+ * a fixed 8000 ms before it was derived.
  *
  * It has to cover the slowest address that should succeed, because an attempt
  * that needs longer fails the same way on every retry. That is a relayed dial on
@@ -35,7 +35,7 @@ import type { Multiaddr } from '@multiformats/multiaddr';
  * handshakes, when no relay connection is open yet), open the circuit, then run
  * both handshakes again end to end through the relay. `link-budget.ts` is where that
  * reasoning is now a measured count instead of an estimate — four link round trips, measured at
- * 7 279 ms on a link whose round trip is 1.8 s — so the value MOVES with a host's
+ * 12 094 ms on a link whose round trip is 3 s — so the value MOVES with a host's
  * `NetworkConfig.linkRoundTripMs` rather than pinning the band this node can reach to whatever
  * number was typed here. A direct dial that works is far quicker — a phone's WebSocket dial to
  * a node forwarded over `adb reverse` measured 1.6 s end to end.

package/dist/peer-dial.js

@@ -28,8 +28,8 @@ import { relayedDialBudgetMs } from './link-budget.js';
 const log = debug('sereus:cadre:peer-dial');
 /**
  * Default limit on ONE address's dial attempt, in ms, at the DEFAULT declared link round trip:
- * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (2000 ms) = 8000 ms, which is
- * what this constant was already set to as a fixed number.
+ * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (3500 ms) = 14 000 ms. It was
+ * a fixed 8000 ms before it was derived.
  *
  * It has to cover the slowest address that should succeed, because an attempt
  * that needs longer fails the same way on every retry. That is a relayed dial on
@@ -37,7 +37,7 @@ const log = debug('sereus:cadre:peer-dial');
  * handshakes, when no relay connection is open yet), open the circuit, then run
  * both handshakes again end to end through the relay. `link-budget.ts` is where that
  * reasoning is now a measured count instead of an estimate — four link round trips, measured at
- * 7 279 ms on a link whose round trip is 1.8 s — so the value MOVES with a host's
+ * 12 094 ms on a link whose round trip is 3 s — so the value MOVES with a host's
  * `NetworkConfig.linkRoundTripMs` rather than pinning the band this node can reach to whatever
  * number was typed here. A direct dial that works is far quicker — a phone's WebSocket dial to
  * a node forwarded over `adb reverse` measured 1.6 s end to end.

package/dist/peer-join-backfill.d.ts

@@ -29,7 +29,7 @@ export interface PeerJoinBackfillConfig {
     maxChunkBlocks?: number;
     /**
      * Per-push dial deadline, ms. Default {@link peerJoinPushBudget}'s `dialTimeoutMs` — four link
-     * round trips at the declared link, 8000 ms as shipped. NOT a fixed number: a relayed dial
+     * round trips at the declared link, 14 000 ms as shipped. NOT a fixed number: a relayed dial
      * costs a fixed number of exchanges, so a host on a slower link moves this (and every other
      * cadre dial budget) by declaring `NetworkConfig.linkRoundTripMs`. Naming it here still wins
      * over the derived value — `link-budget.ts` has the counts and the measurement.
@@ -38,7 +38,7 @@ export interface PeerJoinBackfillConfig {
     /**
      * Per-push response deadline, ms. Default {@link peerJoinPushBudget}'s `responseTimeoutMs` —
      * two link round trips at the declared link plus a transfer allowance for the chunk's own
-     * bytes, 10_000 ms as shipped. Derived differently from {@link dialTimeoutMs} because it
+     * bytes, 13 000 ms as shipped. Derived differently from {@link dialTimeoutMs} because it
      * bounds a data transfer over a connection that is already open, not a dial.
      */
     responseTimeoutMs?: number;

package/dist/peer-join-backfill.js

@@ -50,11 +50,12 @@ import { peerJoinPushBudget } from './link-budget.js';
 // link slow enough to matter it had never once managed to. The reproduction is
 // `packages/integration-tests/src/scenarios/relayed-dial-cost-by-latency.integration.ts`.
 //
-// It does NOT work at every speed. Above roughly 1250 ms one-way, two libp2p budgets that
-// sereus cannot reach abandon the connection before any deadline here is consulted, and the
-// listener's one makes that failure look like an absent peer rather than a timeout — see
-// `link-budget.ts` ("The ceiling this does NOT lift") and
-// `tickets/blocked/how-slow-a-relayed-link-does-sereus-carry`.
+// It does NOT work at every speed. Above the declared link, libp2p's own dial and
+// inbound-upgrade limits — derived from the same declaration — abandon the connection before
+// any deadline here is consulted, and the listener's one makes that failure look like an absent
+// peer rather than a timeout. That is also what happens when the machine being caught up
+// declared a FASTER link than this one, since its limit is the listener's. See
+// `link-budget.ts` ("libp2p's own two limits", "What still fails at the supported link").
 //
 // RETRY, and why it backs off. A run whose PUSH FAILED — the transport threw, which is what
 // a dial or response deadline expiring looks like here — re-arms on a doubling backoff
@@ -363,8 +364,8 @@ export class PeerJoinBackfill {
         console.warn(`[cadre:${this.deps.label}] peer-join block catch-up to peer ${key} has failed ${failures} times in a row `
             + `(dial budget ${this.config.dialTimeoutMs}ms, response budget ${this.config.responseTimeoutMs}ms). `
             + 'That peer may not be holding blocks committed before it joined. If it is reachable only through a relay, '
-            + 'these budgets are derived from network.linkRoundTripMs (see link-budget.ts); above about a 2.5-second '
-            + 'round trip no relayed connection can be established at all, whatever they are set to.');
+            + 'these budgets and libp2p\'s own connection limits are derived from network.linkRoundTripMs (see link-budget.ts); '
+            + 'a link slower than that declaration, or a peer that declared a faster one, cannot open a relayed connection at all.');
     }
     /**
      * The actual copy. `clean` = every chunk pushed and the remote persisted every block.