@serfab/cadre-core 1.5.0 → 1.7.0

package/dist/link-budget.d.ts

@@ -35,62 +35,78 @@
  *
  * | operation                                            | link round trips | at the declared default |
  * | ---------------------------------------------------- | ---------------- | ----------------------- |
- * | open a relayed connection to another machine          | 4                | 8 000 ms                |
- * | dial the relay itself                                 | 1                | 2 000 ms                |
- * | request a reservation on an open relay connection     | 1                | 2 000 ms                |
- * | negotiate a protocol over an established circuit      | 1                | 2 000 ms                |
- *
- * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay, re-run for this
- * change: a relayed dial took 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and
- * **12 066-12 094 ms at 1 500 ms one-way**. Four link round trips of pure delay would be 7 200
- * and 12 000, so the real cost sits about 60-95 ms ABOVE the arithmetic — the handshakes and a
- * phone's pure-JS crypto, which no delay figure contains. That residue is small but it is why
- * {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the band sereus supports rather
- * than matching it exactly: a declaration equal to the measured round trip would derive a
- * budget marginally BELOW the dial it has to contain.
- *
- * ── The ceiling this does NOT lift ──
- *
- * Above roughly 1 250 ms one-way — a 2.5-second link round trip — no relayed connection can be
- * established by this stack whatever cadre declares here. Two budgets of 10 000 ms each inside
- * libp2p bound the same dial and cannot be reached from sereus at all:
- * `connectionManager.dialTimeout` (libp2p's own default, which `@optimystic/db-p2p`'s
- * `libp2p-node-base.ts` neither sets nor exposes) and `connectionManager.inboundUpgradeTimeout`
- * (which it sets to 10 000). Both appear in the same re-run: at 1 500 ms one-way the dial under
- * libp2p's default failed with `The operation was aborted due to timeout`, and with the shipped
- * inbound-upgrade budget the DIALER's own 12 094 ms dial resolved while the LISTENER had
- * already thrown the half-built connection away — so the first stream over it died with
+ * | open a relayed connection to another machine          | 4                | 14 000 ms               |
+ * | dial the relay itself                                 | 1                | 3 500 ms                |
+ * | request a reservation on an open relay connection     | 1                | 3 500 ms                |
+ * | negotiate a protocol over an established circuit      | 1                | 3 500 ms                |
+ *
+ * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay: a relayed dial took
+ * 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and **12 066-12 094 ms at 1 500 ms
+ * one-way**. Four link round trips of pure delay would be 7 200 and 12 000, so the real cost
+ * sits about 60-95 ms ABOVE the arithmetic — the handshakes, which no delay figure contains.
+ * That residue is why {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the link sereus
+ * supports rather than matching it exactly: a declaration equal to the supported round trip
+ * would derive a budget marginally BELOW the dial it has to contain.
+ *
+ * ── libp2p's own two limits ──
+ *
+ * Two limits inside libp2p bound the same relayed dial as cadre's budgets do, and both were
+ * 10 000 ms until `@optimystic/db-p2p` 1.7.0 let an embedder set them: the DIALER's
+ * `connectionManager.dialTimeout`, which bounds every dial that carries no abort signal of its
+ * own, and the LISTENER's `connectionManager.inboundUpgradeTimeout`, which is how long the
+ * machine being called lets a half-built connection finish its handshakes. At 10 000 ms each,
+ * no relayed connection could be opened above about 1 250 ms one-way (a 2.5-second link round
+ * trip) whatever cadre declared. The listener's limit is the one that makes that failure
+ * silent: at 1 500 ms one-way the dialer's own 12 094 ms dial RESOLVED while the listener had
+ * already thrown the connection away at 10 s, so the first stream over it died with
  * `Unexpected EOF - stream closed while reading 0/1 bytes` and the listener reported no peer at
- * all. That is why a too-slow link produces silence rather than an error.
- *
- * Two consequences for a reader choosing a declaration. Below that ceiling, the DEFAULT
- * declaration of 2 000 ms does not reach it: four round trips of 2 000 ms is 8 000 ms, which
- * covers a one-way delay up to 1 000 ms, so a deployment somewhere between 1 000 and 1 250 ms
- * one-way has to declare its own (about 2 200-2 500) to use the band libp2p still allows. And
- * declaring much ABOVE 2 500 buys nothing: the budgets here grow, and
- * the connection still fails inside libp2p. Lifting that needs an upstream change and a
- * decision about how slow a link sereus intends to carry —
- * `tickets/blocked/how-slow-a-relayed-link-does-sereus-carry`. A reader who raised these
- * numbers and still cannot connect at 1 500 ms one-way has met that ceiling, not this module.
+ * all. cadre now declares both from this module ({@link connectionManagerTimeouts}) on the
+ * control node and every strand node.
+ *
+ * ── What still fails at the supported link ──
+ *
+ * - **Optimystic's own request dials.** `@optimystic/db-p2p`'s RPC clients dial with fixed
+ *   3 000 ms deadlines of their own (`DEFAULT_DIAL_TIMEOUT_MS`, the `pushDialTimeoutMs`
+ *   defaults), which neither limit above reaches because a caller's signal replaces
+ *   `dialTimeout`. So an Optimystic request that has to OPEN a relayed connection fails above
+ *   375 ms one-way. A request over a connection that is already open does not dial, and the
+ *   connections cadre opens itself are budgeted here. Upstream:
+ *   `debt-rpc-dial-deadlines-cannot-open-a-slow-relayed-connection` in optimystic.
+ * - **Cadre deadlines still typed as milliseconds.** The strand wake, strand-address and seed
+ *   delivery deadlines, and the cohort read deadline, bound exchanges over the same link but do
+ *   not derive from it: `tickets/backlog/debt-three-more-dial-deadlines-ignore-the-declared-link`.
+ * - **A machine that declares a faster link than its peers.** Every machine is the listener
+ *   for the others, so its `inboundUpgradeTimeout` — derived from ITS declaration — bounds
+ *   connections other machines open to it. A peer declaring 3 500 ms dialing a machine that
+ *   declared 500 ms gets exactly the silent failure above. Declare the same link on every
+ *   machine of a party.
  */
+import type { Libp2pConnectionTimeouts } from '@optimystic/db-p2p';
 /**
  * The link round trip cadre assumes when a host declares none, in milliseconds. A deployment
  * that knows its own link states it with `NetworkConfig.linkRoundTripMs` instead.
  *
- * **Why 2 000.** It states the slowest link sereus already claims to support, and two other
- * budgets fix that claim independently: `COHORT_READ_DEADLINE_MS`
- * (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
- * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`, 120 000 ms) were both
- * sized against two parties reaching each other only through a public relay at a round trip
- * near 1.8 s. Declaring 2 000 rounds that band up and leaves about 720 ms over the worst
- * relayed dial measured at it (7 279 ms against a derived 8 000 ms).
- *
- * Raising it is how a deployment that KNOWS its link is slower moves every derived budget at
- * once. The cost is the ordinary cost of a longer deadline: a peer that is genuinely gone holds
- * the operation for that much longer before it is abandoned and retried. Above about 2 500 it
- * buys nothing — see the module doc's ceiling paragraph.
+ * **Why 3 500.** Sereus supports two machines that reach each other only through a relay up to
+ * a **3-second link round trip** (1 500 ms each way — a congested mobile or satellite link;
+ * `docs/architecture.md` → "Relay Integration"). The worst relayed dial measured at that link
+ * was 12 094 ms, above the 12 000 ms a declaration of exactly 3 000 would derive, so the
+ * declaration rounds the supported link up to the next half second. 3 500 derives 14 000 ms
+ * and leaves about 1.9 s over that dial: room for a phone's Noise handshake, which the
+ * loopback measurement on a desktop does not contain. (The previous 2 000 followed the same
+ * convention for the 1.8 s band sereus supported before, with about 720 ms to spare.)
+ *
+ * Two budgets outside this module were sized against the 1.8 s band and do NOT move with it:
+ * `COHORT_READ_DEADLINE_MS` (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
+ * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`). The module doc's
+ * "What still fails" list carries the first.
+ *
+ * What 3 500 costs, against 2 000: a peer that is genuinely gone holds each operation longer
+ * before it is abandoned and retried — a relayed dial or a reservation drive 14 s instead of
+ * 8 s, and a control-cohort dial of one peer across all its addresses 56 s instead of 32 s.
+ * Raise it further for a link slower still; lower it only on a deployment where EVERY machine
+ * of the party is that close, for the reason the "What still fails" list gives.
  */
-export declare const DECLARED_LINK_ROUND_TRIP_MS = 2000;
+export declare const DECLARED_LINK_ROUND_TRIP_MS = 3500;
 /**
  * Link round trips one relayed connection setup costs: transport, encryption and multiplexer
  * handshakes to the relay, the circuit open, then both handshakes again end to end through it.
@@ -127,10 +143,10 @@ export declare const CIRCUIT_REQUEST_ROUND_TRIPS = 2;
  *
  * NOTE: 6 000 ms is not a measurement of any throughput — it is the residue of the 10 000 ms
  * this deadline shipped as before it was split into a latency part and a transfer part, chosen
- * so that at the default declaration the derived value is the same 10 000 and no fast link got
- * slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile link. If pushes
- * ever time out with the transfer only part done, measure that and raise THIS, not the declared
- * round trip.
+ * so that at the declaration then in force (2 000 ms) the derived value stayed 10 000 and no
+ * fast link got slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile
+ * link. If pushes ever time out with the transfer only part done, measure that and raise THIS,
+ * not the declared round trip.
  */
 export declare const PUSH_TRANSFER_ALLOWANCE_MS = 6000;
 /**
@@ -155,6 +171,32 @@ export declare function resolveLinkRoundTripMs(linkRoundTripMs?: number): number
  * relay: {@link RELAYED_DIAL_ROUND_TRIPS} at the declared link round trip.
  */
 export declare function relayedDialBudgetMs(linkRoundTripMs?: number): number;
+/**
+ * libp2p's two connection-manager limits for a node at the declared link, handed to
+ * `@optimystic/db-p2p`'s `NodeOptions.connectionManager` on the control node and every strand
+ * node.
+ *
+ * Both bound the same thing — opening a relayed connection, measured at 8 one-way link delays,
+ * which is {@link RELAYED_DIAL_ROUND_TRIPS} (4) link round trips — so both are
+ * {@link relayedDialBudgetMs}: 4 x 3 500 = 14 000 ms at the default declaration, covering the
+ * 12 094 ms measured at the supported 3-second link.
+ *
+ * The listener's limit is deliberately NOT smaller than the dialer's. The listener's clock
+ * starts only when the relay hands it the circuit, a few one-way delays after the dialer's
+ * started, and both sides finish the handshakes at about the same moment; so with equal limits
+ * the listener never discards a connection that the dialer's own dial would still accept. A
+ * listener limit below the dialer's is what produced the silent failure in the module doc.
+ *
+ * The cost of a longer `inboundUpgradeTimeout` is that a peer which opens a connection and then
+ * stalls its handshake holds that half-built connection 14 s instead of 10 s.
+ *
+ * NOTE: derived from the declaration alone, so a per-field override that raises a cadre dial
+ * budget above it (`controlCohort.perAddressDialTimeoutMs`, `strandBackfill.dialTimeoutMs`)
+ * does not raise these; a dial that outlasts the listener's limit gets the silent failure
+ * again. If such overrides start being used for slow links, raise the declaration instead or
+ * take the largest configured dial budget here.
+ */
+export declare function connectionManagerTimeouts(linkRoundTripMs?: number): Libp2pConnectionTimeouts;
 /**
  * Deadline for one whole relay reservation drive: {@link RELAY_RESERVATION_ROUND_TRIPS} at the
  * declared link round trip.

package/dist/link-budget.js

@@ -35,62 +35,77 @@
  *
  * | operation                                            | link round trips | at the declared default |
  * | ---------------------------------------------------- | ---------------- | ----------------------- |
- * | open a relayed connection to another machine          | 4                | 8 000 ms                |
- * | dial the relay itself                                 | 1                | 2 000 ms                |
- * | request a reservation on an open relay connection     | 1                | 2 000 ms                |
- * | negotiate a protocol over an established circuit      | 1                | 2 000 ms                |
- *
- * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay, re-run for this
- * change: a relayed dial took 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and
- * **12 066-12 094 ms at 1 500 ms one-way**. Four link round trips of pure delay would be 7 200
- * and 12 000, so the real cost sits about 60-95 ms ABOVE the arithmetic — the handshakes and a
- * phone's pure-JS crypto, which no delay figure contains. That residue is small but it is why
- * {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the band sereus supports rather
- * than matching it exactly: a declaration equal to the measured round trip would derive a
- * budget marginally BELOW the dial it has to contain.
- *
- * ── The ceiling this does NOT lift ──
- *
- * Above roughly 1 250 ms one-way — a 2.5-second link round trip — no relayed connection can be
- * established by this stack whatever cadre declares here. Two budgets of 10 000 ms each inside
- * libp2p bound the same dial and cannot be reached from sereus at all:
- * `connectionManager.dialTimeout` (libp2p's own default, which `@optimystic/db-p2p`'s
- * `libp2p-node-base.ts` neither sets nor exposes) and `connectionManager.inboundUpgradeTimeout`
- * (which it sets to 10 000). Both appear in the same re-run: at 1 500 ms one-way the dial under
- * libp2p's default failed with `The operation was aborted due to timeout`, and with the shipped
- * inbound-upgrade budget the DIALER's own 12 094 ms dial resolved while the LISTENER had
- * already thrown the half-built connection away — so the first stream over it died with
+ * | open a relayed connection to another machine          | 4                | 14 000 ms               |
+ * | dial the relay itself                                 | 1                | 3 500 ms                |
+ * | request a reservation on an open relay connection     | 1                | 3 500 ms                |
+ * | negotiate a protocol over an established circuit      | 1                | 3 500 ms                |
+ *
+ * **Measured** 2026-09-26, one Windows machine, loopback dedicated relay: a relayed dial took
+ * 20-25 ms at no delay, **7 255-7 279 ms at 900 ms one-way**, and **12 066-12 094 ms at 1 500 ms
+ * one-way**. Four link round trips of pure delay would be 7 200 and 12 000, so the real cost
+ * sits about 60-95 ms ABOVE the arithmetic — the handshakes, which no delay figure contains.
+ * That residue is why {@link DECLARED_LINK_ROUND_TRIP_MS} carries headroom over the link sereus
+ * supports rather than matching it exactly: a declaration equal to the supported round trip
+ * would derive a budget marginally BELOW the dial it has to contain.
+ *
+ * ── libp2p's own two limits ──
+ *
+ * Two limits inside libp2p bound the same relayed dial as cadre's budgets do, and both were
+ * 10 000 ms until `@optimystic/db-p2p` 1.7.0 let an embedder set them: the DIALER's
+ * `connectionManager.dialTimeout`, which bounds every dial that carries no abort signal of its
+ * own, and the LISTENER's `connectionManager.inboundUpgradeTimeout`, which is how long the
+ * machine being called lets a half-built connection finish its handshakes. At 10 000 ms each,
+ * no relayed connection could be opened above about 1 250 ms one-way (a 2.5-second link round
+ * trip) whatever cadre declared. The listener's limit is the one that makes that failure
+ * silent: at 1 500 ms one-way the dialer's own 12 094 ms dial RESOLVED while the listener had
+ * already thrown the connection away at 10 s, so the first stream over it died with
  * `Unexpected EOF - stream closed while reading 0/1 bytes` and the listener reported no peer at
- * all. That is why a too-slow link produces silence rather than an error.
- *
- * Two consequences for a reader choosing a declaration. Below that ceiling, the DEFAULT
- * declaration of 2 000 ms does not reach it: four round trips of 2 000 ms is 8 000 ms, which
- * covers a one-way delay up to 1 000 ms, so a deployment somewhere between 1 000 and 1 250 ms
- * one-way has to declare its own (about 2 200-2 500) to use the band libp2p still allows. And
- * declaring much ABOVE 2 500 buys nothing: the budgets here grow, and
- * the connection still fails inside libp2p. Lifting that needs an upstream change and a
- * decision about how slow a link sereus intends to carry —
- * `tickets/blocked/how-slow-a-relayed-link-does-sereus-carry`. A reader who raised these
- * numbers and still cannot connect at 1 500 ms one-way has met that ceiling, not this module.
+ * all. cadre now declares both from this module ({@link connectionManagerTimeouts}) on the
+ * control node and every strand node.
+ *
+ * ── What still fails at the supported link ──
+ *
+ * - **Optimystic's own request dials.** `@optimystic/db-p2p`'s RPC clients dial with fixed
+ *   3 000 ms deadlines of their own (`DEFAULT_DIAL_TIMEOUT_MS`, the `pushDialTimeoutMs`
+ *   defaults), which neither limit above reaches because a caller's signal replaces
+ *   `dialTimeout`. So an Optimystic request that has to OPEN a relayed connection fails above
+ *   375 ms one-way. A request over a connection that is already open does not dial, and the
+ *   connections cadre opens itself are budgeted here. Upstream:
+ *   `debt-rpc-dial-deadlines-cannot-open-a-slow-relayed-connection` in optimystic.
+ * - **Cadre deadlines still typed as milliseconds.** The strand wake, strand-address and seed
+ *   delivery deadlines, and the cohort read deadline, bound exchanges over the same link but do
+ *   not derive from it: `tickets/backlog/debt-three-more-dial-deadlines-ignore-the-declared-link`.
+ * - **A machine that declares a faster link than its peers.** Every machine is the listener
+ *   for the others, so its `inboundUpgradeTimeout` — derived from ITS declaration — bounds
+ *   connections other machines open to it. A peer declaring 3 500 ms dialing a machine that
+ *   declared 500 ms gets exactly the silent failure above. Declare the same link on every
+ *   machine of a party.
  */
 /**
  * The link round trip cadre assumes when a host declares none, in milliseconds. A deployment
  * that knows its own link states it with `NetworkConfig.linkRoundTripMs` instead.
  *
- * **Why 2 000.** It states the slowest link sereus already claims to support, and two other
- * budgets fix that claim independently: `COHORT_READ_DEADLINE_MS`
- * (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
- * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`, 120 000 ms) were both
- * sized against two parties reaching each other only through a public relay at a round trip
- * near 1.8 s. Declaring 2 000 rounds that band up and leaves about 720 ms over the worst
- * relayed dial measured at it (7 279 ms against a derived 8 000 ms).
- *
- * Raising it is how a deployment that KNOWS its link is slower moves every derived budget at
- * once. The cost is the ordinary cost of a longer deadline: a peer that is genuinely gone holds
- * the operation for that much longer before it is abandoned and retried. Above about 2 500 it
- * buys nothing — see the module doc's ceiling paragraph.
+ * **Why 3 500.** Sereus supports two machines that reach each other only through a relay up to
+ * a **3-second link round trip** (1 500 ms each way — a congested mobile or satellite link;
+ * `docs/architecture.md` → "Relay Integration"). The worst relayed dial measured at that link
+ * was 12 094 ms, above the 12 000 ms a declaration of exactly 3 000 would derive, so the
+ * declaration rounds the supported link up to the next half second. 3 500 derives 14 000 ms
+ * and leaves about 1.9 s over that dial: room for a phone's Noise handshake, which the
+ * loopback measurement on a desktop does not contain. (The previous 2 000 followed the same
+ * convention for the 1.8 s band sereus supported before, with about 720 ms to spare.)
+ *
+ * Two budgets outside this module were sized against the 1.8 s band and do NOT move with it:
+ * `COHORT_READ_DEADLINE_MS` (`quereus-plugin-sereus/src/cluster-size.ts`, 5 000 ms) and
+ * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS` (`strand-first-sync-gate.ts`). The module doc's
+ * "What still fails" list carries the first.
+ *
+ * What 3 500 costs, against 2 000: a peer that is genuinely gone holds each operation longer
+ * before it is abandoned and retried — a relayed dial or a reservation drive 14 s instead of
+ * 8 s, and a control-cohort dial of one peer across all its addresses 56 s instead of 32 s.
+ * Raise it further for a link slower still; lower it only on a deployment where EVERY machine
+ * of the party is that close, for the reason the "What still fails" list gives.
  */
-export const DECLARED_LINK_ROUND_TRIP_MS = 2000;
+export const DECLARED_LINK_ROUND_TRIP_MS = 3500;
 /**
  * Link round trips one relayed connection setup costs: transport, encryption and multiplexer
  * handshakes to the relay, the circuit open, then both handshakes again end to end through it.
@@ -127,10 +142,10 @@ export const CIRCUIT_REQUEST_ROUND_TRIPS = 2;
  *
  * NOTE: 6 000 ms is not a measurement of any throughput — it is the residue of the 10 000 ms
  * this deadline shipped as before it was split into a latency part and a transfer part, chosen
- * so that at the default declaration the derived value is the same 10 000 and no fast link got
- * slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile link. If pushes
- * ever time out with the transfer only part done, measure that and raise THIS, not the declared
- * round trip.
+ * so that at the declaration then in force (2 000 ms) the derived value stayed 10 000 and no
+ * fast link got slower. Nobody has measured how long 1 MiB takes to cross a relayed mobile
+ * link. If pushes ever time out with the transfer only part done, measure that and raise THIS,
+ * not the declared round trip.
  */
 export const PUSH_TRANSFER_ALLOWANCE_MS = 6000;
 /**
@@ -165,6 +180,35 @@ export function resolveLinkRoundTripMs(linkRoundTripMs) {
 export function relayedDialBudgetMs(linkRoundTripMs) {
     return RELAYED_DIAL_ROUND_TRIPS * resolveLinkRoundTripMs(linkRoundTripMs);
 }
+/**
+ * libp2p's two connection-manager limits for a node at the declared link, handed to
+ * `@optimystic/db-p2p`'s `NodeOptions.connectionManager` on the control node and every strand
+ * node.
+ *
+ * Both bound the same thing — opening a relayed connection, measured at 8 one-way link delays,
+ * which is {@link RELAYED_DIAL_ROUND_TRIPS} (4) link round trips — so both are
+ * {@link relayedDialBudgetMs}: 4 x 3 500 = 14 000 ms at the default declaration, covering the
+ * 12 094 ms measured at the supported 3-second link.
+ *
+ * The listener's limit is deliberately NOT smaller than the dialer's. The listener's clock
+ * starts only when the relay hands it the circuit, a few one-way delays after the dialer's
+ * started, and both sides finish the handshakes at about the same moment; so with equal limits
+ * the listener never discards a connection that the dialer's own dial would still accept. A
+ * listener limit below the dialer's is what produced the silent failure in the module doc.
+ *
+ * The cost of a longer `inboundUpgradeTimeout` is that a peer which opens a connection and then
+ * stalls its handshake holds that half-built connection 14 s instead of 10 s.
+ *
+ * NOTE: derived from the declaration alone, so a per-field override that raises a cadre dial
+ * budget above it (`controlCohort.perAddressDialTimeoutMs`, `strandBackfill.dialTimeoutMs`)
+ * does not raise these; a dial that outlasts the listener's limit gets the silent failure
+ * again. If such overrides start being used for slow links, raise the declaration instead or
+ * take the largest configured dial budget here.
+ */
+export function connectionManagerTimeouts(linkRoundTripMs) {
+    const budgetMs = relayedDialBudgetMs(linkRoundTripMs);
+    return { dialTimeout: budgetMs, inboundUpgradeTimeout: budgetMs };
+}
 /**
  * Deadline for one whole relay reservation drive: {@link RELAY_RESERVATION_ROUND_TRIPS} at the
  * declared link round trip.

package/dist/link-budget.js.map

@@ -1 +1 @@
-{"version":3,"file":"link-budget.js","sourceRoot":"","sources":["../src/link-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,eAAwB;IAC9D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,2BAA2B,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACd,mFAAmF,MAAM,CAAC,eAAe,CAAC,EAAE,CAC5G,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAwB;IAC3D,OAAO,wBAAwB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,eAAwB;IAChE,OAAO,6BAA6B,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,eAAwB,EACxB,mBAAmB,GAAG,0BAA0B;IAEhD,OAAO,2BAA2B,GAAG,sBAAsB,CAAC,eAAe,CAAC,GAAG,mBAAmB,CAAC;AACpG,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAwB;IAC1D,OAAO;QACN,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC;QACnD,iBAAiB,EAAE,sBAAsB,CAAC,eAAe,CAAC;KAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"link-budget.js","sourceRoot":"","sources":["../src/link-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAIH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,eAAwB;IAC9D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,2BAA2B,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACd,mFAAmF,MAAM,CAAC,eAAe,CAAC,EAAE,CAC5G,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAwB;IAC3D,OAAO,wBAAwB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CAAC,eAAwB;IACjE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACtD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,eAAwB;IAChE,OAAO,6BAA6B,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,eAAwB,EACxB,mBAAmB,GAAG,0BAA0B;IAEhD,OAAO,2BAA2B,GAAG,sBAAsB,CAAC,eAAe,CAAC,GAAG,mBAAmB,CAAC;AACpG,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAwB;IAC1D,OAAO;QACN,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC;QACnD,iBAAiB,EAAE,sBAAsB,CAAC,eAAe,CAAC;KAC1D,CAAC;AACH,CAAC"}

package/dist/node-local-snapshot.d.ts

@@ -28,15 +28,16 @@ export interface DurableSlot {
 }
 /**
  * What one unusable entry means for its siblings — the single intentional
- * difference between the two records:
+ * difference between the records:
  *
  *  - `'discard-all'` (the trusted-owner anchor): a record that cannot be read
  *    in full is not an anchor. Trusting a *subset* of the keys a file claims is
  *    a silent, security-relevant downgrade, so the whole record is discarded
  *    and the node trusts no one until re-seeded out of band.
- *  - `'drop-entry'` (the bootstrap-peer store): the record is a best-effort
- *    retry list and nothing in it is trust-bearing, so one junk entry must not
- *    discard a stranded node's only remaining way back into its party.
+ *  - `'drop-entry'` (the bootstrap-peer store and the strand peer book): the
+ *    record is a best-effort dial list and nothing in it is trust-bearing, so one
+ *    junk entry must not discard a stranded node's only remaining way back to
+ *    its party or its strand's peers.
  */
 export type UnusableEntryPolicy = 'discard-all' | 'drop-entry';
 /** What a particular node-local record persists, and how it validates it. */

package/dist/node-local-snapshot.js

@@ -4,15 +4,18 @@
  * from shared group state:
  *
  *  - the trusted-owner anchor (`trusted-owner-store.ts`),
- *  - the cold-start bootstrap-peer store (`bootstrap-peer-store.ts`).
+ *  - the cold-start bootstrap-peer store (`bootstrap-peer-store.ts`),
+ *  - the strand peer book (`strand-peer-book.ts`), whose entries are one map per
+ *    strand rather than one value per key — the validation hook below is what
+ *    lets it drop a single junk peer without dropping the strand.
  *
- * A THIRD node-local record — the enrolled-machine count
+ * ANOTHER node-local record — the enrolled-machine count
  * (`enrolled-machine-store.ts`) — reuses {@link DurableSlot} but deliberately
  * NOT this module's snapshot machinery: it is one scalar rather than an entry
  * map, and it must cold-start rather than throw on an unreadable slot. Its
  * module comment carries the reasoning; do not fold it in here.
  *
- * Both records here are the same mechanism with a different payload: a
+ * Every record here is the same mechanism with a different payload: a
  * `{ version, partyId, <entries> }` envelope, snapshot-written whole on every
  * change, loaded under one fail-safe-but-not-fail-silent policy. The only part
  * that differs per platform is WHERE the bytes are kept — Node writes a file,

package/dist/node-local-snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-local-snapshot.js","sourceRoot":"","sources":["../src/node-local-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AA+BtD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAgC3B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAQ7B,YACkB,IAAiB,EACzB,OAAe,EACP,IAA8B,EAC9B,OAAuB;QAHvB,SAAI,GAAJ,IAAI,CAAa;QACzB,YAAO,GAAP,OAAO,CAAQ;QACP,SAAI,GAAJ,IAAI,CAA0B;QAC9B,YAAO,GAAP,OAAO,CAAgB;QAXzC;;;;WAIG;QACK,eAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAOnD,CAAC;IAEJ;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAChB,IAAiB,EACjB,OAAe,EACf,IAA8B;QAE9B,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,mGAAmG;IACnG,WAAW;QACV,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACZ,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,GAAW,EAAE,KAAQ;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IACtE,YAAY;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC5B,MAAM,QAAQ,GAA4B;YACzC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;SACxD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;CACD;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,OAAe,EACf,IAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,aAAa;QACb,MAAM,IAAI,KAAK,CACd,sBAAsB,IAAI,CAAC,KAAK,cAAc,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClH,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAEvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,gDAAgD,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;gBAC1C,GAAG,CAAC,4EAA4E,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC5G,OAAO,IAAI,GAAG,EAAE,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/E,SAAS;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,KAAc,EACd,OAAe,EACf,UAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"node-local-snapshot.js","sourceRoot":"","sources":["../src/node-local-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AA+BtD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAiC3B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAQ7B,YACkB,IAAiB,EACzB,OAAe,EACP,IAA8B,EAC9B,OAAuB;QAHvB,SAAI,GAAJ,IAAI,CAAa;QACzB,YAAO,GAAP,OAAO,CAAQ;QACP,SAAI,GAAJ,IAAI,CAA0B;QAC9B,YAAO,GAAP,OAAO,CAAgB;QAXzC;;;;WAIG;QACK,eAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAOnD,CAAC;IAEJ;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAChB,IAAiB,EACjB,OAAe,EACf,IAA8B;QAE9B,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,mGAAmG;IACnG,WAAW;QACV,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACZ,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,GAAW,EAAE,KAAQ;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IACtE,YAAY;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC5B,MAAM,QAAQ,GAA4B;YACzC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;SACxD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;CACD;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,OAAe,EACf,IAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,aAAa;QACb,MAAM,IAAI,KAAK,CACd,sBAAsB,IAAI,CAAC,KAAK,cAAc,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClH,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAEvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,gDAAgD,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;gBAC1C,GAAG,CAAC,4EAA4E,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC5G,OAAO,IAAI,GAAG,EAAE,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/E,SAAS;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,KAAc,EACd,OAAe,EACf,UAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}

package/dist/peer-dial.d.ts

@@ -26,8 +26,8 @@ import type { Connection } from '@libp2p/interface';
 import type { Multiaddr } from '@multiformats/multiaddr';
 /**
  * Default limit on ONE address's dial attempt, in ms, at the DEFAULT declared link round trip:
- * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (2000 ms) = 8000 ms, which is
- * what this constant was already set to as a fixed number.
+ * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (3500 ms) = 14 000 ms. It was
+ * a fixed 8000 ms before it was derived.
  *
  * It has to cover the slowest address that should succeed, because an attempt
  * that needs longer fails the same way on every retry. That is a relayed dial on
@@ -35,7 +35,7 @@ import type { Multiaddr } from '@multiformats/multiaddr';
  * handshakes, when no relay connection is open yet), open the circuit, then run
  * both handshakes again end to end through the relay. `link-budget.ts` is where that
  * reasoning is now a measured count instead of an estimate — four link round trips, measured at
- * 7 279 ms on a link whose round trip is 1.8 s — so the value MOVES with a host's
+ * 12 094 ms on a link whose round trip is 3 s — so the value MOVES with a host's
  * `NetworkConfig.linkRoundTripMs` rather than pinning the band this node can reach to whatever
  * number was typed here. A direct dial that works is far quicker — a phone's WebSocket dial to
  * a node forwarded over `adb reverse` measured 1.6 s end to end.

package/dist/peer-dial.js

@@ -28,8 +28,8 @@ import { relayedDialBudgetMs } from './link-budget.js';
 const log = debug('sereus:cadre:peer-dial');
 /**
  * Default limit on ONE address's dial attempt, in ms, at the DEFAULT declared link round trip:
- * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (2000 ms) = 8000 ms, which is
- * what this constant was already set to as a fixed number.
+ * `RELAYED_DIAL_ROUND_TRIPS` (4) x `DECLARED_LINK_ROUND_TRIP_MS` (3500 ms) = 14 000 ms. It was
+ * a fixed 8000 ms before it was derived.
  *
  * It has to cover the slowest address that should succeed, because an attempt
  * that needs longer fails the same way on every retry. That is a relayed dial on
@@ -37,7 +37,7 @@ const log = debug('sereus:cadre:peer-dial');
  * handshakes, when no relay connection is open yet), open the circuit, then run
  * both handshakes again end to end through the relay. `link-budget.ts` is where that
  * reasoning is now a measured count instead of an estimate — four link round trips, measured at
- * 7 279 ms on a link whose round trip is 1.8 s — so the value MOVES with a host's
+ * 12 094 ms on a link whose round trip is 3 s — so the value MOVES with a host's
  * `NetworkConfig.linkRoundTripMs` rather than pinning the band this node can reach to whatever
  * number was typed here. A direct dial that works is far quicker — a phone's WebSocket dial to
  * a node forwarded over `adb reverse` measured 1.6 s end to end.

package/dist/peer-join-backfill.d.ts

@@ -8,6 +8,15 @@ import { BlockTransferClient, type IRawStorage } from '@optimystic/db-p2p';
  * changes it or starts exporting it.
  */
 export declare const MAX_BLOCK_MESSAGE_BYTES: number;
+/**
+ * Whether an identified peer's protocol list names this network's own block-transfer
+ * protocol — the one gate that decides whether {@link PeerJoinBackfill} schedules a peer at
+ * all. A peer that lacks it (a bare circuit relay, a bootstrap node, a stranger the control
+ * network's inbound gate admitted without membership) cannot receive a push no matter how
+ * long it is dialed, since the protocol id is namespaced per network. Exported because a
+ * later strand peer-address ticket's identify-driven observation needs the identical test.
+ */
+export declare function speaksBlockTransfer(protocols: readonly string[], protocolPrefix: string): boolean;
 /**
  * Consecutive failed catch-up runs against ONE peer before the module says so on
  * `console.warn` rather than only in its DEBUG log. At the default backoff that is reached
@@ -29,7 +38,7 @@ export interface PeerJoinBackfillConfig {
     maxChunkBlocks?: number;
     /**
      * Per-push dial deadline, ms. Default {@link peerJoinPushBudget}'s `dialTimeoutMs` — four link
-     * round trips at the declared link, 8000 ms as shipped. NOT a fixed number: a relayed dial
+     * round trips at the declared link, 14 000 ms as shipped. NOT a fixed number: a relayed dial
      * costs a fixed number of exchanges, so a host on a slower link moves this (and every other
      * cadre dial budget) by declaring `NetworkConfig.linkRoundTripMs`. Naming it here still wins
      * over the derived value — `link-budget.ts` has the counts and the measurement.
@@ -38,7 +47,7 @@ export interface PeerJoinBackfillConfig {
     /**
      * Per-push response deadline, ms. Default {@link peerJoinPushBudget}'s `responseTimeoutMs` —
      * two link round trips at the declared link plus a transfer allowance for the chunk's own
-     * bytes, 10_000 ms as shipped. Derived differently from {@link dialTimeoutMs} because it
+     * bytes, 13 000 ms as shipped. Derived differently from {@link dialTimeoutMs} because it
      * bounds a data transfer over a connection that is already open, not a dial.
      */
     responseTimeoutMs?: number;
@@ -109,7 +118,7 @@ export interface PeerJoinBackfillResult {
  * Best-effort throughout: nothing here throws into a libp2p event handler or into a
  * runtime bring-up; a failed chunk is logged and the run continues. A peer is marked
  * fully caught up ONLY after a run with no thrown chunk and an empty `missing` list, so
- * the next `connection:open` from a peer whose catch-up failed retries it.
+ * the next `peer:identify` from a peer whose catch-up failed retries it.
  */
 export declare class PeerJoinBackfill {
     private readonly deps;
@@ -136,30 +145,40 @@ export declare class PeerJoinBackfill {
     private readonly failures;
     /**
      * Epoch ms before which a peer's catch-up must not be re-run, set alongside a backoff timer
-     * that will run it. Its presence is what makes `connection:open` churn free: a schedule
+     * that will run it. Its presence is what makes `peer:identify` churn free: a schedule
      * arriving inside the wait is dropped, rather than collapsing the backoff to the debounce.
      */
     private readonly retryAfter;
     /** Peers already reported on `console.warn`; reset when a run finally lands cleanly. */
     private readonly warned;
-    private readonly onConnectionOpen;
+    private readonly onPeerIdentify;
     private loggedNoListBlockIds;
     constructor(deps: PeerJoinBackfillDeps, config?: PeerJoinBackfillConfig);
-    /** Subscribe to connection:open AND schedule a catch-up for peers already connected. */
+    /**
+     * Subscribe to `peer:identify` AND schedule a catch-up for already-connected peers whose
+     * stored protocols already name this network's block-transfer protocol — a peer that does
+     * not speak it (a bare circuit relay, a bootstrap node) is never scheduled at all. See
+     * {@link speaksBlockTransfer} and the module comment.
+     */
     start(): void;
     /** Unsubscribe, clear timers; in-flight runs observe the stopped flag and bail. */
     stop(): void;
     /**
-     * (Re-)schedule a debounced catch-up for every currently-connected peer not yet caught
-     * up. Idempotent and cheap (caught-up peers are skipped before any timer is set, and a
-     * peer whose run is in flight is deferred to the end of that run rather than dropped).
-     * Driven by {@link start}, and — on a gated network — by the embedder whenever
-     * membership changes, so a peer whose first pass was denied (connected before it was
-     * authorized: the production join order) is retried without waiting for a reconnect.
-     * Returns how many distinct peers were considered (for the start() log) — a peer holding
-     * several connections is one peer, and is scheduled once.
+     * (Re-)schedule a debounced catch-up for every currently-connected peer whose protocols, as
+     * already stored in the libp2p peer store, name this network's block-transfer protocol. A
+     * peer not yet in the peer store — its identify has not finished — is left to the
+     * `peer:identify` handler rather than dialed blind; one whose stored protocols are known
+     * and lack ours is skipped outright. Idempotent and cheap otherwise (caught-up peers are
+     * skipped before any timer is set, and a peer whose run is in flight is deferred to the end
+     * of that run rather than dropped). Driven by {@link start}, and — on a gated network — by
+     * the embedder whenever membership changes, so a peer whose first pass was denied (connected
+     * before it was authorized: the production join order) is retried without waiting for a
+     * reconnect. Returns how many distinct peers were considered (for the start() log) — a peer
+     * holding several connections is one peer, and is scheduled once.
      */
-    scheduleConnectedPeers(): number;
+    scheduleConnectedPeers(): Promise<number>;
+    /** Schedules `peerId` only if the peer store already knows it speaks this network's protocol. */
+    private scheduleIfKnownToSpeak;
     /** Debounced entry point for connection churn: one run per peer per settle window. */
     private schedulePeer;
     /**
@@ -173,7 +192,7 @@ export declare class PeerJoinBackfill {
     /**
      * Re-arm one peer's catch-up after a run whose push failed, on a wait that doubles
      * per consecutive failure up to `maxRetryBackoffMs`. Sets {@link retryAfter} alongside the
-     * timer, which is what makes `connection:open` churn inside the wait free.
+     * timer, which is what makes `peer:identify` churn inside the wait free.
      */
     private scheduleRetryWithBackoff;
     /**