@serfab/cadre-core 1.5.0 → 1.6.0

package/src/strand-instance-manager.ts

@@ -41,7 +41,7 @@ import type {
 import { DEFAULT_CONNECTION_MONITOR, resolveStrandClusterSize, strandClusterPolicy } from './types.js';
 import { strandNodeAddrs } from './strand-network-config.js';
 import { superviseRelayReservation, type RelayReservationSupervisor } from './relay-reservation.js';
-import { peerJoinPushBudget, relayReservationBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
+import { connectionManagerTimeouts, peerJoinPushBudget, relayReservationBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 
 const log = debug('sereus:cadre:strand-manager');
 const timing = debug('sereus:cadre:timing');
@@ -711,6 +711,10 @@ export class StrandInstanceManager {
         // widened ping deadline has to reach the strand nodes too (see
         // DEFAULT_CONNECTION_MONITOR).
         connectionMonitor: config.network?.connectionMonitor ?? DEFAULT_CONNECTION_MONITOR,
+        // The same declared-link limits the control node takes, and for the same reason: a
+        // strand node is the listener for every other member's strand node (`link-budget.ts`,
+        // `connectionManagerTimeouts`).
+        connectionManager: connectionManagerTimeouts(config.network?.linkRoundTripMs),
         // Listen entries plus the WebSocket transport switch they imply — a strand node
         // announces nothing the operator configured (`strand-network-config.ts`), and
         // spreads AFTER `transports` above because the switch is a no-op whenever the
@@ -884,7 +888,7 @@ export class StrandInstanceManager {
       // failing here would only trade that for `StrandWatcher`'s full-rebuild retry.
       //
       // NOTE: a relay that is down costs this launch one full drive — the reservation budget
-      // counted from the declared link round trip, 8 s at its default (`link-budget.ts`) — and
+      // counted from the declared link round trip, 14 s at its default (`link-budget.ts`) — and
       // `StrandWatcher` launches strands one at a time, so N strands cost N of those in
       // bring-up during a relay outage, and MORE on a host that declared a slower link. If that
       // ever matters, stop awaiting here (the circuit addr then lands after `active`) rather

package/src/types.ts

@@ -317,7 +317,7 @@ export interface NetworkConfig {
    * It buys a node that BOOTS, not a node that boots fast: `start()` still waits
    * out that first attempt, which costs the drive's whole timeout
    * (`DEFAULT_RELAY_RESERVE_TIMEOUT_MS`, four link round trips at
-   * {@link linkRoundTripMs} — 8 s at its default) against a relay that is unreachable
+   * {@link linkRoundTripMs} — 14 s at its default) against a relay that is unreachable
    * rather than merely refusing (`relay-reservation.ts` polls to the deadline, in
    * case libp2p's own discovery lands a reservation independently).
    *
@@ -434,22 +434,25 @@ export interface NetworkConfig {
    * The round trip this node assumes between itself and another machine, in milliseconds, for
    * the control node and every strand node — as {@link cohortQueryTimeoutMs} is, and for the
    * same reason: the setting describes the LINK, and a phone's control node and its strand
-   * nodes ride the same one. Omitted takes {@link DECLARED_LINK_ROUND_TRIP_MS} (2000 ms).
+   * nodes ride the same one. Omitted takes {@link DECLARED_LINK_ROUND_TRIP_MS} (3500 ms).
    *
    * This is NOT a timeout. It is the one stated assumption that cadre's own dial and
    * reservation deadlines are DERIVED from, each by the number of round trips that operation
    * was measured to cost: a peer-join catch-up's dial to one peer, its push response, one relay
-   * reservation drive, and the control-cohort dial budgets. Reaching another machine through a
-   * relay costs a fixed number of exchanges, so a deadline written as milliseconds has a link
-   * speed above which it can never open a connection — which is the defect this declaration
-   * exists to make impossible to reintroduce one budget at a time. The counts, the measurement
-   * behind them, and the ceiling that no declaration here can lift are in `link-budget.ts`.
+   * reservation drive, the control-cohort dial budgets, and libp2p's own `dialTimeout` and
+   * `inboundUpgradeTimeout` on every node. Reaching another machine through a relay costs a
+   * fixed number of exchanges, so a deadline written as milliseconds has a link speed above
+   * which it can never open a connection — which is the defect this declaration exists to make
+   * impossible to reintroduce one budget at a time. The counts, the measurement behind them,
+   * and what still fails at the supported link are in `link-budget.ts`.
    *
-   * Raise it for a link slower than the relayed phone-to-phone band sereus assumes; the cost is
-   * the ordinary cost of longer deadlines, a peer that is genuinely gone holding each operation
-   * that much longer before it is abandoned and retried. Above about 2500 it buys nothing: two
-   * libp2p budgets that sereus cannot reach abandon the connection first
-   * (`tickets/blocked/how-slow-a-relayed-link-does-sereus-carry`).
+   * The default covers the slowest link sereus supports, a 3-second round trip through a relay.
+   * Raise it for a link slower still; the cost is the ordinary cost of longer deadlines, a peer
+   * that is genuinely gone holding each operation that much longer before it is abandoned and
+   * retried. Lower it only if EVERY machine of the party is that close: this node is also the
+   * listener for connections other machines open to it, and its `inboundUpgradeTimeout` comes
+   * from this value, so a node declaring a faster link than its peers discards their
+   * half-built connections — silently, from the dialer's side.
    *
    * Refused where the libp2p node is built — inside `CadreNode.start()` for the control
    * network, inside `CadreNode.addStrand` for a strand — if it is not a finite number above
@@ -569,6 +572,12 @@ export interface NetworkConfig {
  * kept it (the same pair aborted at a 200ms stall only when the deadline was 300ms). An
  * interval strictly above the deadline is what makes the 30 seconds real.
  *
+ * WHAT THE LINK NEEDS OF IT. One ping opens a fresh stream and echoes over it: a protocol
+ * negotiation plus the echo, two link round trips by `link-budget.ts`'s counts (a `newStream`
+ * over a relayed circuit measured 3016 ms at 1500 ms one-way). At the slowest link sereus
+ * supports, a 3-second relayed round trip, that is about 6 s — well inside the 30 s deadline,
+ * which exists for the phone's CPU rather than the link.
+ *
  * WHAT IT COSTS. A dead peer is reclaimed 30 to 65 seconds after it stops answering — the
  * deadline, plus up to one interval of waiting for the ping that will fail — where
  * libp2p's defaults took about 5 to 15 seconds. `db-p2p` caps a node at 16 connections,
@@ -807,11 +816,11 @@ export interface CadreNodeConfig {
    * `timeoutMs` bounds how long {@link CadreNode.addStrand} waits before rejecting with
    * `StrandAwaitingFirstSyncError` (retryable — the launch stays up and keeps probing);
    * `pollIntervalMs` is the probe cadence. Omit for the defaults (`DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS`,
-   * 120 s — sized for a machine joining through a relay on a slow link; that constant's doc
-   * comment carries the measurement behind the number and what the budget costs, and is the
-   * only copy of it; `DEFAULT_STRAND_FIRST_SYNC_POLL_MS`, 500 ms). There is
-   * deliberately no way to disable the gate: a machine that already holds the Header is never
-   * gated, so nothing that works today is blocked by it.
+   * sized for a machine re-attaching through a relay on a slow link, the slowest attach
+   * measured; that constant's doc comment carries the number, the measurement behind it and
+   * what the budget costs, and is the only copy of them; `DEFAULT_STRAND_FIRST_SYNC_POLL_MS`,
+   * 500 ms). There is deliberately no way to disable the gate: a machine whose store already
+   * holds the Header is never gated, so nothing that works today is blocked by it.
    */
   strandFirstSync?: StrandFirstSyncConfig;