@serfab/cadre-core 1.6.0 → 1.7.0

package/dist/index.d.ts

@@ -13,6 +13,11 @@ export { MemoryTrustedOwnerStore, PersistentTrustedOwnerStore, type TrustedOwner
 export type { DurableSlot } from './node-local-snapshot.js';
 export { MemoryBootstrapPeerStore, PersistentBootstrapPeerStore, type BootstrapPeerStore, type BootstrapPeerEntry } from './bootstrap-peer-store.js';
 export { MemoryEnrolledMachineStore, PersistentEnrolledMachineStore, type EnrolledMachineStore } from './enrolled-machine-store.js';
+export { MemoryJoinedStrandStore, KeyStoreJoinedStrandStore, type JoinedStrandStore, type JoinedStrandRecord } from './joined-strand-store.js';
+export { MemoryStrandPeerBookStore, PersistentStrandPeerBookStore, mergeStrandPeerEntry, sanitizeStrandPeerEntry, strandPeerFreshness, MAX_STRAND_PEERS, STRAND_PEER_MAX_AGE_MS, type StrandPeerBookStore, type StrandPeerBookOptions, type StrandPeerEntry } from './strand-peer-book.js';
+export { StrandPeerObserver, dialableAddrs, connectedIdentifiedPeers, STRAND_PEER_OBSERVE_THROTTLE_MS, type StrandPeerObservation, type StrandPeerObserverDeps, type StrandPeerObserverOptions, type ConnectedIdentifiedPeer } from './strand-peer-observer.js';
+export { STRAND_PEER_BOOK_PROTOCOL, SIGNED_STRAND_PEER_ENTRY_VERSION, STRAND_PEER_ISSUED_AT_SKEW_MS, MAX_BOOK_FRAME_SIZE, StrandPeerBookService, exchangeStrandPeerBook, signStrandPeerEntry, signedStrandPeerEntryPayload, verifySignedStrandPeerEntry, verifyStrandPeerBookFrame, trimBookFrameToFit, assertBookFrameFits, type SignedStrandPeerEntry, type StrandPeerBookFrame, type StrandPeerEntryVerdict, type StrandPeerBookServiceDeps, type ExchangeStrandPeerBookOptions } from './strand-peer-book-protocol.js';
+export { StrandPeerBookSwap, STRAND_PEER_BOOK_SWAP_THROTTLE_MS, OWN_ENTRY_RESIGN_DEBOUNCE_MS, type StrandPeerBookSwapDeps, type StrandPeerBookSwapOptions } from './strand-peer-book-swap.js';
 export { controlStorageScope, isControlStorageScope, isValidStrandScopeKey, assertStrandScopeKey, InvalidStrandIdError } from './storage-scope.js';
 export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js';
 export { StrandWatcher, type StrandWatcherCallbacks, type StrandQueryable, type SAppIdLookup, type StrandRowWithApp } from './strand-watcher.js';

package/dist/index.js

@@ -49,6 +49,22 @@ export { MemoryBootstrapPeerStore, PersistentBootstrapPeerStore } from './bootst
 // DIVERGES from theirs (an unreadable slot cold-starts rather than throwing) —
 // see the module comment before unifying the three.
 export { MemoryEnrolledMachineStore, PersistentEnrolledMachineStore } from './enrolled-machine-store.js';
+// Node-local record of the strands this node joined from ANOTHER party, re-offered on
+// every start as `strand:discovered`. Cross-platform: its durable form rides the
+// KeyStore seam above (the record carries a closed strand's read secret), so there is
+// no file-backed subpath.
+export { MemoryJoinedStrandStore, KeyStoreJoinedStrandStore } from './joined-strand-store.js';
+// Node-local strand peer book: per strand, the strand peers this node has met and
+// their last-known addresses, dialed first on every launch so a restarted machine
+// re-finds the other parties. Same cross-platform split as the bootstrap-peer store
+// above — interface + in-memory + slot-backed stores here, Node-only file backend
+// behind the subpath '@serfab/cadre-core/strand-peer-book-file'.
+export { MemoryStrandPeerBookStore, PersistentStrandPeerBookStore, mergeStrandPeerEntry, sanitizeStrandPeerEntry, strandPeerFreshness, MAX_STRAND_PEERS, STRAND_PEER_MAX_AGE_MS } from './strand-peer-book.js';
+export { StrandPeerObserver, dialableAddrs, connectedIdentifiedPeers, STRAND_PEER_OBSERVE_THROTTLE_MS } from './strand-peer-observer.js';
+// The signed book SWAP between strand peers (`/sereus/strand-peers/1.0.0`): the wire
+// protocol, signing and verification, and the per-strand driver that arms it.
+export { STRAND_PEER_BOOK_PROTOCOL, SIGNED_STRAND_PEER_ENTRY_VERSION, STRAND_PEER_ISSUED_AT_SKEW_MS, MAX_BOOK_FRAME_SIZE, StrandPeerBookService, exchangeStrandPeerBook, signStrandPeerEntry, signedStrandPeerEntryPayload, verifySignedStrandPeerEntry, verifyStrandPeerBookFrame, trimBookFrameToFit, assertBookFrameFits } from './strand-peer-book-protocol.js';
+export { StrandPeerBookSwap, STRAND_PEER_BOOK_SWAP_THROTTLE_MS, OWN_ENTRY_RESIGN_DEBOUNCE_MS } from './strand-peer-book-swap.js';
 // Storage scope keys — what `CadreNodeConfig.storage.provider` is called with. A
 // strand's key is its strand id; the control database's key carries the party id,
 // so two parties on one device never share a control store. Every key stays within

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,EAAwO,MAAM,uBAAuB,CAAC;AAElZ,+EAA+E;AAC/E,qFAAqF;AACrF,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,yFAAyF;AACzF,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAWjC,2FAA2F;AAC3F,OAAO,EAAE,0BAA0B,EAA0C,MAAM,4BAA4B,CAAC;AAEhH,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,0BAA0B,EAAuB,MAAM,kBAAkB,CAAC;AAE1I,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,6CAA6C;AAC7C,mEAAmE;AACnE,wDAAwD;AACxD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAG5B,MAAM,0BAA0B,CAAC;AAQlC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAG7B,MAAM,2BAA2B,CAAC;AAEnC,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,2DAA2D;AAC3D,iFAAiF;AACjF,+EAA+E;AAC/E,oDAAoD;AACpD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAE/B,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,yEAAyE;AACzE,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAEtC,kFAAkF;AAClF,sFAAsF;AACtF,kEAAkE;AAClE,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,iCAAiC,EACjC,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAExB,MAAM,6BAA6B,CAAC;AAErC,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,sCAAsC,EAKvC,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2CAA2C;AAC3C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,EAQpC,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAI/B,MAAM,mCAAmC,CAAC;AAE3C,oFAAoF;AACpF,oFAAoF;AACpF,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAOxC,MAAM,0BAA0B,CAAC;AAElC,wFAAwF;AACxF,yFAAyF;AACzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EAMvB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,qBAAqB;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,EACd,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EAmBtB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,2BAA2B,EAG5B,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAGrC,MAAM,qBAAqB,CAAC;AAE7B,6EAA6E;AAC7E,kEAAkE;AAClE,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,sCAAsC,EACtC,kDAAkD,EAClD,oCAAoC,EACpC,wBAAwB,EAGzB,MAAM,gBAAgB,CAAC;AAExB,8FAA8F;AAC9F,+FAA+F;AAC/F,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAE1B,sDAAsD;AACtD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAWnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,oCAAoC,EACpC,oCAAoC,EAGrC,MAAM,+BAA+B,CAAC;AAEvC,wEAAwE;AACxE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,EACnC,gCAAgC,EAChC,mCAAmC,EACnC,+BAA+B,EAC/B,6BAA6B,EAG9B,MAAM,kCAAkC,CAAC;AAE1C,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,yEAAyE;AACzE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,YAAY;AACZ,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAEnF,gFAAgF;AAChF,0EAA0E;AAC1E,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAM7B,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,EAAwO,MAAM,uBAAuB,CAAC;AAElZ,+EAA+E;AAC/E,qFAAqF;AACrF,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,yFAAyF;AACzF,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAWjC,2FAA2F;AAC3F,OAAO,EAAE,0BAA0B,EAA0C,MAAM,4BAA4B,CAAC;AAEhH,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,0BAA0B,EAAuB,MAAM,kBAAkB,CAAC;AAE1I,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,6CAA6C;AAC7C,mEAAmE;AACnE,wDAAwD;AACxD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAG5B,MAAM,0BAA0B,CAAC;AAQlC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAG7B,MAAM,2BAA2B,CAAC;AAEnC,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,2DAA2D;AAC3D,iFAAiF;AACjF,+EAA+E;AAC/E,oDAAoD;AACpD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAE/B,MAAM,6BAA6B,CAAC;AAErC,sFAAsF;AACtF,iFAAiF;AACjF,sFAAsF;AACtF,0BAA0B;AAC1B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EAG1B,MAAM,0BAA0B,CAAC;AAElC,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,kFAAkF;AAClF,iEAAiE;AACjE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EAIvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,wBAAwB,EACxB,+BAA+B,EAKhC,MAAM,2BAA2B,CAAC;AACnC,qFAAqF;AACrF,8EAA8E;AAC9E,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EAMpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,iCAAiC,EACjC,4BAA4B,EAG7B,MAAM,4BAA4B,CAAC;AAEpC,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,yEAAyE;AACzE,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAEtC,kFAAkF;AAClF,sFAAsF;AACtF,kEAAkE;AAClE,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,EACpC,iCAAiC,EACjC,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAExB,MAAM,6BAA6B,CAAC;AAErC,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,sCAAsC,EAKvC,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2CAA2C;AAC3C,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,EAQpC,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAI/B,MAAM,mCAAmC,CAAC;AAE3C,oFAAoF;AACpF,oFAAoF;AACpF,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAOxC,MAAM,0BAA0B,CAAC;AAElC,wFAAwF;AACxF,yFAAyF;AACzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EAMvB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,qBAAqB;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,EACd,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EAmBtB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,2BAA2B,EAG5B,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAGrC,MAAM,qBAAqB,CAAC;AAE7B,6EAA6E;AAC7E,kEAAkE;AAClE,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,sCAAsC,EACtC,kDAAkD,EAClD,oCAAoC,EACpC,wBAAwB,EAGzB,MAAM,gBAAgB,CAAC;AAExB,8FAA8F;AAC9F,+FAA+F;AAC/F,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAE1B,sDAAsD;AACtD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAWnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,oCAAoC,EACpC,oCAAoC,EAGrC,MAAM,+BAA+B,CAAC;AAEvC,wEAAwE;AACxE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,EACnC,gCAAgC,EAChC,mCAAmC,EACnC,+BAA+B,EAC/B,6BAA6B,EAG9B,MAAM,kCAAkC,CAAC;AAE1C,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,yEAAyE;AACzE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,YAAY;AACZ,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAwB,MAAM,4BAA4B,CAAC;AAEnF,gFAAgF;AAChF,0EAA0E;AAC1E,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAM7B,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}

package/dist/joined-strand-store.d.ts

@@ -0,0 +1,112 @@
+import type { KeyStore } from './key-store.js';
+import type { StrandRow } from './types.js';
+/** One strand this node joined from ANOTHER party — nothing in this party's control DB names it. */
+export interface JoinedStrandRecord {
+    /** The strand id (a valid scope key, see storage-scope.ts). */
+    Id: string;
+    Type: 'o' | 'c';
+    /** The closed strand's shared read secret the formation delivered; null for an open strand. */
+    MemberPrivateKey: string | null;
+    /** Wall-clock ms this node first recorded the join. Diagnostics only. */
+    joinedAt: number;
+}
+export interface JoinedStrandStore {
+    /** Party this store is scoped to. */
+    readonly partyId: string;
+    /** Every remembered join. A call reflects every {@link record}/{@link forget} that resolved before it was made. */
+    list(): Promise<JoinedStrandRecord[]>;
+    /** Remember a join, REPLACING any record with the same `Id`. */
+    record(record: JoinedStrandRecord): Promise<void>;
+    /** Forget a join. A no-op when there is no record for `strandId`. */
+    forget(strandId: string): Promise<void>;
+}
+/**
+ * The {@link StrandRow} a record stands for — the shape `addStrand` and `strand:discovered`
+ * carry. `FounderOwnerKey` is null because a joiner never founds; `CadreNode.launchStrand`
+ * reads null as "not mine" and joins.
+ */
+export declare function joinedStrandRow(record: JoinedStrandRecord): StrandRow;
+/**
+ * Ephemeral store for a node without a `keyStore`. Warns once, at the first join it is
+ * asked to remember, because a join held only here is not re-offered after a restart —
+ * exactly the gotchoices/sereus#18 shape, and it should show in a log rather than pass
+ * silently.
+ */
+export declare class MemoryJoinedStrandStore implements JoinedStrandStore {
+    readonly partyId: string;
+    private readonly records;
+    private warned;
+    constructor(partyId: string);
+    list(): Promise<JoinedStrandRecord[]>;
+    record(record: JoinedStrandRecord): Promise<void>;
+    forget(strandId: string): Promise<void>;
+    private warnOnce;
+}
+/**
+ * Durable store over a {@link KeyStore}: one slot per join, id
+ * `cadre/joined-strand/<base64url party id>/<strand id>`, holding the record's UTF-8 JSON.
+ * The party segment is base64url for the reason `controlStorageScope` gives: a party id is
+ * arbitrary text, and base64url never contains the `/` that ends the segment.
+ *
+ * Loads every slot once, at the first {@link list}, then answers from memory and writes
+ * through, so the strand watcher's five-second poll does not read the enclave on every
+ * pass. A load that fails — `KeyStoreAccessError` from a refused unlock prompt, say —
+ * is rethrown rather than read as "no joins" and retried at the next call, exactly as
+ * `loadOrCreateIdentityKey` treats the identity slot. A slot that does not parse as a
+ * record for its own id is dropped with a log and its siblings kept: refusing to start
+ * repairs nothing, and the other joins are still good.
+ */
+export declare class KeyStoreJoinedStrandStore implements JoinedStrandStore {
+    private readonly keyStore;
+    readonly partyId: string;
+    private readonly slotPrefix;
+    /** The loaded records; null until a load succeeds. */
+    private records;
+    /** Runs every KeyStore access in call order, so a load never interleaves with a write. */
+    private queue;
+    constructor(keyStore: KeyStore, partyId: string);
+    list(): Promise<JoinedStrandRecord[]>;
+    /** Throws `InvalidStrandIdError` for an id that could never load back, before anything is written. */
+    record(record: JoinedStrandRecord): Promise<void>;
+    forget(strandId: string): Promise<void>;
+    private slotId;
+    private inOrder;
+    private loaded;
+}
+/**
+ * What the strand watcher sees of the joined-strand store: the control rows plus one row per
+ * remembered join, which is how a join comes back as `strand:discovered` (or auto-launches)
+ * after a restart with no second offer path. One instance per node session.
+ *
+ * Holds the two pieces of state a plain union would get wrong, both of which would otherwise
+ * make the watcher detach running strands, since a joined row missing from a poll reads to it
+ * as a removal:
+ *  - the last list the store answered, reused when a later list fails, so a read failure is
+ *    not "every join was forgotten";
+ *  - joins forgotten because this party was removed from the strand
+ *    ({@link forgetAfterThisSession}): gone from the store, so the next start does not
+ *    re-attach them, but still offered until this session ends, because `strand:revoked`
+ *    promises that nothing is torn down for the app.
+ */
+export declare class JoinedStrandRows {
+    private readonly store;
+    private lastListed;
+    private readonly keptForSession;
+    constructor(store: JoinedStrandStore);
+    /**
+     * `control` plus a row for every remembered join. A control row wins an id collision: the
+     * strand is this party's own now (its founding party enrolled this machine, say), the
+     * control database remembers it, and the record is stale — so it is forgotten here.
+     */
+    withControlRows(control: readonly StrandRow[]): Promise<StrandRow[]>;
+    /** Forget a join for good: the app is leaving the strand. */
+    forget(strandId: string): Promise<void>;
+    /**
+     * Forget a join durably, but keep offering it until this session ends. For a strand this
+     * party was removed from: it must not re-attach on every launch, and it must not be torn
+     * down underneath the app either. A no-op for a strand with no record.
+     */
+    forgetAfterThisSession(strandId: string): Promise<void>;
+    private listed;
+    private forgetSuperseded;
+}

package/dist/joined-strand-store.js

@@ -0,0 +1,263 @@
+/**
+ * Node-local record of the strands this node joined from ANOTHER party.
+ *
+ * A party's own strands come back after a restart through its control database: the
+ * `Strand` table holds their rows, the strand watcher polls it, and each row no sApp
+ * config claims is offered as `strand:discovered`. A strand joined through formation with
+ * another party (`CadreNode.formStrand`) has no row there — the other party's control
+ * database holds it — so nothing re-offered it after a restart, and every embedding app
+ * kept its own list of joins, read secret included (gotchoices/sereus#18).
+ *
+ * `CadreNode` records each such join here, hands the records to its strand watcher beside
+ * the control rows ({@link JoinedStrandRows}), and forgets one on `forgetJoinedStrand` or
+ * when this party is removed from the strand.
+ *
+ * Two implementations:
+ *  - {@link MemoryJoinedStrandStore} — joins die with the process. The default only for a
+ *    node configured with no `keyStore`.
+ *  - {@link KeyStoreJoinedStrandStore} — one {@link KeyStore} slot per join. A record holds
+ *    the closed strand's shared read secret, and the KeyStore is the one seam every
+ *    platform already routes secrets through (the platform enclave on React Native, the
+ *    state directory for `FileKeyStore`), so the record goes there rather than into a
+ *    `DurableSlot` like the bootstrap-peer store.
+ *
+ * Party-scoped like every other node-local store, because one KeyStore can serve several
+ * parties: the React Native app keeps one per device and lets the user switch party. A
+ * join made for one party must never be offered to a node started for another.
+ *
+ * Dependency-free beyond the KeyStore seam, so safe in every entry graph.
+ */
+import debug from 'debug';
+import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
+import { assertStrandScopeKey, isValidStrandScopeKey } from './storage-scope.js';
+const log = debug('sereus:cadre:joined-strand-store');
+/**
+ * The {@link StrandRow} a record stands for — the shape `addStrand` and `strand:discovered`
+ * carry. `FounderOwnerKey` is null because a joiner never founds; `CadreNode.launchStrand`
+ * reads null as "not mine" and joins.
+ */
+export function joinedStrandRow(record) {
+    return { Id: record.Id, Type: record.Type, MemberPrivateKey: record.MemberPrivateKey, FounderOwnerKey: null };
+}
+/**
+ * Ephemeral store for a node without a `keyStore`. Warns once, at the first join it is
+ * asked to remember, because a join held only here is not re-offered after a restart —
+ * exactly the gotchoices/sereus#18 shape, and it should show in a log rather than pass
+ * silently.
+ */
+export class MemoryJoinedStrandStore {
+    constructor(partyId) {
+        this.partyId = partyId;
+        this.records = new Map();
+        this.warned = false;
+    }
+    async list() {
+        return [...this.records.values()];
+    }
+    async record(record) {
+        this.warnOnce();
+        this.records.set(record.Id, { ...record });
+    }
+    async forget(strandId) {
+        this.records.delete(strandId);
+    }
+    warnOnce() {
+        if (this.warned) {
+            return;
+        }
+        this.warned = true;
+        console.warn('CadreNode has no keyStore and no joinedStrands.store, so strands joined from another party ' +
+            'are remembered in memory only and will NOT be re-offered after a restart. Configure a keyStore, ' +
+            'or inject joinedStrands: { store: new KeyStoreJoinedStrandStore(<a durable KeyStore>, partyId) }.');
+    }
+}
+/** Slot id prefix for every joined-strand record; the party segment and the strand id follow. */
+const SLOT_PREFIX = 'cadre/joined-strand/';
+/**
+ * Durable store over a {@link KeyStore}: one slot per join, id
+ * `cadre/joined-strand/<base64url party id>/<strand id>`, holding the record's UTF-8 JSON.
+ * The party segment is base64url for the reason `controlStorageScope` gives: a party id is
+ * arbitrary text, and base64url never contains the `/` that ends the segment.
+ *
+ * Loads every slot once, at the first {@link list}, then answers from memory and writes
+ * through, so the strand watcher's five-second poll does not read the enclave on every
+ * pass. A load that fails — `KeyStoreAccessError` from a refused unlock prompt, say —
+ * is rethrown rather than read as "no joins" and retried at the next call, exactly as
+ * `loadOrCreateIdentityKey` treats the identity slot. A slot that does not parse as a
+ * record for its own id is dropped with a log and its siblings kept: refusing to start
+ * repairs nothing, and the other joins are still good.
+ */
+export class KeyStoreJoinedStrandStore {
+    constructor(keyStore, partyId) {
+        this.keyStore = keyStore;
+        this.partyId = partyId;
+        /** The loaded records; null until a load succeeds. */
+        this.records = null;
+        /** Runs every KeyStore access in call order, so a load never interleaves with a write. */
+        this.queue = Promise.resolve();
+        this.slotPrefix = SLOT_PREFIX + uint8ArrayToString(uint8ArrayFromString(partyId, 'utf8'), 'base64url') + '/';
+    }
+    list() {
+        return this.inOrder(async () => [...(await this.loaded()).values()]);
+    }
+    /** Throws `InvalidStrandIdError` for an id that could never load back, before anything is written. */
+    record(record) {
+        assertStrandScopeKey(record.Id);
+        const stored = { ...record };
+        return this.inOrder(async () => {
+            await this.keyStore.set(this.slotId(record.Id), uint8ArrayFromString(JSON.stringify(stored), 'utf8'));
+            this.records?.set(record.Id, stored);
+            log('joined strand remembered (party=%s, strand=%s, type=%s)', this.partyId, record.Id, record.Type);
+        });
+    }
+    forget(strandId) {
+        return this.inOrder(async () => {
+            await this.keyStore.delete(this.slotId(strandId));
+            this.records?.delete(strandId);
+            log('joined strand forgotten (party=%s, strand=%s)', this.partyId, strandId);
+        });
+    }
+    slotId(strandId) {
+        return this.slotPrefix + strandId;
+    }
+    inOrder(op) {
+        const result = this.queue.then(op);
+        // The caller receives `result`, rejection included; the queue only needs to know it settled.
+        this.queue = result.catch(() => undefined);
+        return result;
+    }
+    // NOTE: a failed load is retried at the next list(), which is every strand-watcher poll;
+    // over a backend that gates reads behind an unlock prompt the user keeps declining, that
+    // is a prompt every five seconds. Every KeyStore shipped today is ungated for this reason
+    // (see `SecureStoreKeyStoreOptions.requireAuthentication`); if one is ever gated, back
+    // off the retry here.
+    async loaded() {
+        if (this.records) {
+            return this.records;
+        }
+        const records = new Map();
+        for (const slot of await this.keyStore.list()) {
+            if (!slot.startsWith(this.slotPrefix)) {
+                continue;
+            }
+            const strandId = slot.slice(this.slotPrefix.length);
+            const bytes = await this.keyStore.get(slot);
+            if (!bytes) {
+                continue;
+            }
+            const record = parseRecord(strandId, bytes);
+            if (record) {
+                records.set(strandId, record);
+            }
+        }
+        this.records = records;
+        log('joined strands loaded (party=%s, count=%d)', this.partyId, records.size);
+        return records;
+    }
+}
+/** The record a slot holds, or undefined (logged) when it is not one for `strandId`. */
+function parseRecord(strandId, bytes) {
+    let parsed;
+    try {
+        parsed = JSON.parse(uint8ArrayToString(bytes, 'utf8'));
+    }
+    catch (error) {
+        log('dropping joined-strand slot for %s: not JSON (%o)', strandId, error);
+        return undefined;
+    }
+    const { Id, Type, MemberPrivateKey, joinedAt } = (typeof parsed === 'object' && parsed !== null ? parsed : {});
+    const valid = Id === strandId
+        && isValidStrandScopeKey(strandId)
+        && (Type === 'o' || Type === 'c')
+        && (MemberPrivateKey === null || typeof MemberPrivateKey === 'string')
+        && typeof joinedAt === 'number';
+    if (!valid) {
+        log('dropping joined-strand slot for %s: not a joined-strand record for that id', strandId);
+        return undefined;
+    }
+    return { Id: strandId, Type: Type, MemberPrivateKey: MemberPrivateKey, joinedAt: joinedAt };
+}
+/**
+ * What the strand watcher sees of the joined-strand store: the control rows plus one row per
+ * remembered join, which is how a join comes back as `strand:discovered` (or auto-launches)
+ * after a restart with no second offer path. One instance per node session.
+ *
+ * Holds the two pieces of state a plain union would get wrong, both of which would otherwise
+ * make the watcher detach running strands, since a joined row missing from a poll reads to it
+ * as a removal:
+ *  - the last list the store answered, reused when a later list fails, so a read failure is
+ *    not "every join was forgotten";
+ *  - joins forgotten because this party was removed from the strand
+ *    ({@link forgetAfterThisSession}): gone from the store, so the next start does not
+ *    re-attach them, but still offered until this session ends, because `strand:revoked`
+ *    promises that nothing is torn down for the app.
+ */
+export class JoinedStrandRows {
+    constructor(store) {
+        this.store = store;
+        this.lastListed = [];
+        this.keptForSession = new Map();
+    }
+    /**
+     * `control` plus a row for every remembered join. A control row wins an id collision: the
+     * strand is this party's own now (its founding party enrolled this machine, say), the
+     * control database remembers it, and the record is stale — so it is forgotten here.
+     */
+    async withControlRows(control) {
+        const controlIds = new Set(control.map((row) => row.Id));
+        const joined = new Map(this.keptForSession);
+        for (const record of await this.listed()) {
+            joined.set(record.Id, record);
+        }
+        const rows = [...control];
+        for (const record of joined.values()) {
+            if (controlIds.has(record.Id)) {
+                await this.forgetSuperseded(record.Id);
+            }
+            else {
+                rows.push(joinedStrandRow(record));
+            }
+        }
+        return rows;
+    }
+    /** Forget a join for good: the app is leaving the strand. */
+    async forget(strandId) {
+        this.keptForSession.delete(strandId);
+        await this.store.forget(strandId);
+    }
+    /**
+     * Forget a join durably, but keep offering it until this session ends. For a strand this
+     * party was removed from: it must not re-attach on every launch, and it must not be torn
+     * down underneath the app either. A no-op for a strand with no record.
+     */
+    async forgetAfterThisSession(strandId) {
+        const record = (await this.listed()).find((listed) => listed.Id === strandId);
+        if (!record) {
+            return;
+        }
+        // Kept BEFORE the store forgets, so no poll can list the store without it and union
+        // without the kept copy.
+        this.keptForSession.set(strandId, record);
+        await this.store.forget(strandId);
+    }
+    async listed() {
+        try {
+            this.lastListed = await this.store.list();
+        }
+        catch (error) {
+            log('joined-strand store list failed; offering the last list it answered (%d join(s)): %o', this.lastListed.length, error);
+        }
+        return this.lastListed;
+    }
+    async forgetSuperseded(strandId) {
+        this.keptForSession.delete(strandId);
+        try {
+            await this.store.forget(strandId);
+            log('joined strand %s now has a control row — record forgotten', strandId);
+        }
+        catch (error) {
+            log('forgetting superseded joined strand %s failed; the next poll retries: %o', strandId, error);
+        }
+    }
+}
+//# sourceMappingURL=joined-strand-store.js.map

package/dist/joined-strand-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"joined-strand-store.js","sourceRoot":"","sources":["../src/joined-strand-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGjF,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AA2BtD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B;IACzD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAInC,YAAqB,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;QAHnB,YAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QACzD,WAAM,GAAG,KAAK,CAAC;IAEgB,CAAC;IAExC,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAEO,QAAQ;QACf,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACR,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,CAAC,IAAI,CACX,6FAA6F;YAC7F,kGAAkG;YAClG,mGAAmG,CACnG,CAAC;IACH,CAAC;CACD;AAED,iGAAiG;AACjG,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAAyB;IAOrC,YAA6B,QAAkB,EAAW,OAAe;QAA5C,aAAQ,GAAR,QAAQ,CAAU;QAAW,YAAO,GAAP,OAAO,CAAQ;QALzE,sDAAsD;QAC9C,YAAO,GAA2C,IAAI,CAAC;QAC/D,0FAA0F;QAClF,UAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;QAGnD,IAAI,CAAC,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,GAAG,CAAC;IAC9G,CAAC;IAED,IAAI;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,sGAAsG;IACtG,MAAM,CAAC,MAA0B;QAChC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAuB,EAAE,GAAG,MAAM,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrC,GAAG,CAAC,yDAAyD,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACtG,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;IACnC,CAAC;IAEO,OAAO,CAAI,EAAoB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnC,6FAA6F;QAC7F,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IACf,CAAC;IAED,yFAAyF;IACzF,yFAAyF;IACzF,0FAA0F;IAC1F,uFAAuF;IACvF,sBAAsB;IACd,KAAK,CAAC,MAAM;QACnB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,OAAO,CAAC;QACrB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,GAAG,CAAC,4CAA4C,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IAChB,CAAC;CACD;AAED,wFAAwF;AACxF,SAAS,WAAW,CAAC,QAAgB,EAAE,KAAiB;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,mDAAmD,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC1I,MAAM,KAAK,GAAG,EAAE,KAAK,QAAQ;WACzB,qBAAqB,CAAC,QAAQ,CAAC;WAC/B,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;WAC9B,CAAC,gBAAgB,KAAK,IAAI,IAAI,OAAO,gBAAgB,KAAK,QAAQ,CAAC;WACnE,OAAO,QAAQ,KAAK,QAAQ,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,GAAG,CAAC,4EAA4E,EAAE,QAAQ,CAAC,CAAC;QAC5F,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAiB,EAAE,gBAAgB,EAAE,gBAAiC,EAAE,QAAQ,EAAE,QAAkB,EAAE,CAAC;AACrI,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gBAAgB;IAI5B,YAA6B,KAAwB;QAAxB,UAAK,GAAL,KAAK,CAAmB;QAH7C,eAAU,GAAyB,EAAE,CAAC;QAC7B,mBAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEhB,CAAC;IAEzD;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,OAA6B;QAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,CAA6B,IAAI,CAAC,cAAc,CAAC,CAAC;QACxE,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QAC5C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO;QACR,CAAC;QACD,oFAAoF;QACpF,yBAAyB;QACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,MAAM;QACnB,IAAI,CAAC;YACJ,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,sFAAsF,EACzF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QAC9C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,GAAG,CAAC,2DAA2D,EAAE,QAAQ,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,0EAA0E,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClG,CAAC;IACF,CAAC;CACD"}

package/dist/key-store.d.ts

@@ -29,6 +29,12 @@ export declare const DEFAULT_IDENTITY_KEY_ID: KeyId;
  * Key material is raw bytes (e.g. libp2p protobuf-serialized private keys).
  * Text-only backends encode/decode (base64) internally; byte-native backends
  * (LevelDB) store as-is.
+ *
+ * Not only keys: `KeyStoreJoinedStrandStore` keeps one small UTF-8 JSON record
+ * (about 200 bytes, a closed strand's read secret among its fields) per strand
+ * this node joined from another party, under ids beginning
+ * `cadre/joined-strand/`. {@link list} therefore returns those ids too, and a
+ * backend must accept `/` in an id and values of that size.
  */
 export interface KeyStore {
     /** Resolves to the stored material, or undefined if the slot is empty. */

package/dist/key-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../src/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAU,gBAAgB,CAAC;AA0B/D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAG7C,YAAY,KAAY,EAAE,OAAe,EAAE,OAA6B;QACvE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACkB,UAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAkBvD,CAAC;IAhBA,KAAK,CAAC,GAAG,CAAC,KAAY;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAY,EAAE,WAAuB;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;CACD"}
+{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../src/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAU,gBAAgB,CAAC;AAgC/D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAG7C,YAAY,KAAY,EAAE,OAAe,EAAE,OAA6B;QACvE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACkB,UAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAkBvD,CAAC;IAhBA,KAAK,CAAC,GAAG,CAAC,KAAY;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAY,EAAE,WAAuB;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;CACD"}

package/dist/node-local-snapshot.d.ts

@@ -28,15 +28,16 @@ export interface DurableSlot {
 }
 /**
  * What one unusable entry means for its siblings — the single intentional
- * difference between the two records:
+ * difference between the records:
  *
  *  - `'discard-all'` (the trusted-owner anchor): a record that cannot be read
  *    in full is not an anchor. Trusting a *subset* of the keys a file claims is
  *    a silent, security-relevant downgrade, so the whole record is discarded
  *    and the node trusts no one until re-seeded out of band.
- *  - `'drop-entry'` (the bootstrap-peer store): the record is a best-effort
- *    retry list and nothing in it is trust-bearing, so one junk entry must not
- *    discard a stranded node's only remaining way back into its party.
+ *  - `'drop-entry'` (the bootstrap-peer store and the strand peer book): the
+ *    record is a best-effort dial list and nothing in it is trust-bearing, so one
+ *    junk entry must not discard a stranded node's only remaining way back to
+ *    its party or its strand's peers.
  */
 export type UnusableEntryPolicy = 'discard-all' | 'drop-entry';
 /** What a particular node-local record persists, and how it validates it. */

package/dist/node-local-snapshot.js

@@ -4,15 +4,18 @@
  * from shared group state:
  *
  *  - the trusted-owner anchor (`trusted-owner-store.ts`),
- *  - the cold-start bootstrap-peer store (`bootstrap-peer-store.ts`).
+ *  - the cold-start bootstrap-peer store (`bootstrap-peer-store.ts`),
+ *  - the strand peer book (`strand-peer-book.ts`), whose entries are one map per
+ *    strand rather than one value per key — the validation hook below is what
+ *    lets it drop a single junk peer without dropping the strand.
  *
- * A THIRD node-local record — the enrolled-machine count
+ * ANOTHER node-local record — the enrolled-machine count
  * (`enrolled-machine-store.ts`) — reuses {@link DurableSlot} but deliberately
  * NOT this module's snapshot machinery: it is one scalar rather than an entry
  * map, and it must cold-start rather than throw on an unreadable slot. Its
  * module comment carries the reasoning; do not fold it in here.
  *
- * Both records here are the same mechanism with a different payload: a
+ * Every record here is the same mechanism with a different payload: a
  * `{ version, partyId, <entries> }` envelope, snapshot-written whole on every
  * change, loaded under one fail-safe-but-not-fail-silent policy. The only part
  * that differs per platform is WHERE the bytes are kept — Node writes a file,

package/dist/node-local-snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-local-snapshot.js","sourceRoot":"","sources":["../src/node-local-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AA+BtD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAgC3B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAQ7B,YACkB,IAAiB,EACzB,OAAe,EACP,IAA8B,EAC9B,OAAuB;QAHvB,SAAI,GAAJ,IAAI,CAAa;QACzB,YAAO,GAAP,OAAO,CAAQ;QACP,SAAI,GAAJ,IAAI,CAA0B;QAC9B,YAAO,GAAP,OAAO,CAAgB;QAXzC;;;;WAIG;QACK,eAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAOnD,CAAC;IAEJ;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAChB,IAAiB,EACjB,OAAe,EACf,IAA8B;QAE9B,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,mGAAmG;IACnG,WAAW;QACV,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACZ,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,GAAW,EAAE,KAAQ;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IACtE,YAAY;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC5B,MAAM,QAAQ,GAA4B;YACzC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;SACxD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;CACD;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,OAAe,EACf,IAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,aAAa;QACb,MAAM,IAAI,KAAK,CACd,sBAAsB,IAAI,CAAC,KAAK,cAAc,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClH,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAEvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,gDAAgD,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;gBAC1C,GAAG,CAAC,4EAA4E,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC5G,OAAO,IAAI,GAAG,EAAE,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/E,SAAS;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,KAAc,EACd,OAAe,EACf,UAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"node-local-snapshot.js","sourceRoot":"","sources":["../src/node-local-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AA+BtD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAiC3B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAQ7B,YACkB,IAAiB,EACzB,OAAe,EACP,IAA8B,EAC9B,OAAuB;QAHvB,SAAI,GAAJ,IAAI,CAAa;QACzB,YAAO,GAAP,OAAO,CAAQ;QACP,SAAI,GAAJ,IAAI,CAA0B;QAC9B,YAAO,GAAP,OAAO,CAAgB;QAXzC;;;;WAIG;QACK,eAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAOnD,CAAC;IAEJ;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAChB,IAAiB,EACjB,OAAe,EACf,IAA8B;QAE9B,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,mGAAmG;IACnG,WAAW;QACV,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACZ,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,GAAW,EAAE,KAAQ;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IACtE,YAAY;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC5B,MAAM,QAAQ,GAA4B;YACzC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;SACxD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;CACD;AAED,uGAAuG;AACvG,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,OAAe,EACf,IAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,aAAa;QACb,MAAM,IAAI,KAAK,CACd,sBAAsB,IAAI,CAAC,KAAK,cAAc,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClH,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAEvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,gDAAgD,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;gBAC1C,GAAG,CAAC,4EAA4E,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC5G,OAAO,IAAI,GAAG,EAAE,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/E,SAAS;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,KAAc,EACd,OAAe,EACf,UAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}

package/dist/peer-join-backfill.d.ts

@@ -8,6 +8,15 @@ import { BlockTransferClient, type IRawStorage } from '@optimystic/db-p2p';
  * changes it or starts exporting it.
  */
 export declare const MAX_BLOCK_MESSAGE_BYTES: number;
+/**
+ * Whether an identified peer's protocol list names this network's own block-transfer
+ * protocol — the one gate that decides whether {@link PeerJoinBackfill} schedules a peer at
+ * all. A peer that lacks it (a bare circuit relay, a bootstrap node, a stranger the control
+ * network's inbound gate admitted without membership) cannot receive a push no matter how
+ * long it is dialed, since the protocol id is namespaced per network. Exported because a
+ * later strand peer-address ticket's identify-driven observation needs the identical test.
+ */
+export declare function speaksBlockTransfer(protocols: readonly string[], protocolPrefix: string): boolean;
 /**
  * Consecutive failed catch-up runs against ONE peer before the module says so on
  * `console.warn` rather than only in its DEBUG log. At the default backoff that is reached
@@ -109,7 +118,7 @@ export interface PeerJoinBackfillResult {
  * Best-effort throughout: nothing here throws into a libp2p event handler or into a
  * runtime bring-up; a failed chunk is logged and the run continues. A peer is marked
  * fully caught up ONLY after a run with no thrown chunk and an empty `missing` list, so
- * the next `connection:open` from a peer whose catch-up failed retries it.
+ * the next `peer:identify` from a peer whose catch-up failed retries it.
  */
 export declare class PeerJoinBackfill {
     private readonly deps;
@@ -136,30 +145,40 @@ export declare class PeerJoinBackfill {
     private readonly failures;
     /**
      * Epoch ms before which a peer's catch-up must not be re-run, set alongside a backoff timer
-     * that will run it. Its presence is what makes `connection:open` churn free: a schedule
+     * that will run it. Its presence is what makes `peer:identify` churn free: a schedule
      * arriving inside the wait is dropped, rather than collapsing the backoff to the debounce.
      */
     private readonly retryAfter;
     /** Peers already reported on `console.warn`; reset when a run finally lands cleanly. */
     private readonly warned;
-    private readonly onConnectionOpen;
+    private readonly onPeerIdentify;
     private loggedNoListBlockIds;
     constructor(deps: PeerJoinBackfillDeps, config?: PeerJoinBackfillConfig);
-    /** Subscribe to connection:open AND schedule a catch-up for peers already connected. */
+    /**
+     * Subscribe to `peer:identify` AND schedule a catch-up for already-connected peers whose
+     * stored protocols already name this network's block-transfer protocol — a peer that does
+     * not speak it (a bare circuit relay, a bootstrap node) is never scheduled at all. See
+     * {@link speaksBlockTransfer} and the module comment.
+     */
     start(): void;
     /** Unsubscribe, clear timers; in-flight runs observe the stopped flag and bail. */
     stop(): void;
     /**
-     * (Re-)schedule a debounced catch-up for every currently-connected peer not yet caught
-     * up. Idempotent and cheap (caught-up peers are skipped before any timer is set, and a
-     * peer whose run is in flight is deferred to the end of that run rather than dropped).
-     * Driven by {@link start}, and — on a gated network — by the embedder whenever
-     * membership changes, so a peer whose first pass was denied (connected before it was
-     * authorized: the production join order) is retried without waiting for a reconnect.
-     * Returns how many distinct peers were considered (for the start() log) — a peer holding
-     * several connections is one peer, and is scheduled once.
+     * (Re-)schedule a debounced catch-up for every currently-connected peer whose protocols, as
+     * already stored in the libp2p peer store, name this network's block-transfer protocol. A
+     * peer not yet in the peer store — its identify has not finished — is left to the
+     * `peer:identify` handler rather than dialed blind; one whose stored protocols are known
+     * and lack ours is skipped outright. Idempotent and cheap otherwise (caught-up peers are
+     * skipped before any timer is set, and a peer whose run is in flight is deferred to the end
+     * of that run rather than dropped). Driven by {@link start}, and — on a gated network — by
+     * the embedder whenever membership changes, so a peer whose first pass was denied (connected
+     * before it was authorized: the production join order) is retried without waiting for a
+     * reconnect. Returns how many distinct peers were considered (for the start() log) — a peer
+     * holding several connections is one peer, and is scheduled once.
      */
-    scheduleConnectedPeers(): number;
+    scheduleConnectedPeers(): Promise<number>;
+    /** Schedules `peerId` only if the peer store already knows it speaks this network's protocol. */
+    private scheduleIfKnownToSpeak;
     /** Debounced entry point for connection churn: one run per peer per settle window. */
     private schedulePeer;
     /**
@@ -173,7 +192,7 @@ export declare class PeerJoinBackfill {
     /**
      * Re-arm one peer's catch-up after a run whose push failed, on a wait that doubles
      * per consecutive failure up to `maxRetryBackoffMs`. Sets {@link retryAfter} alongside the
-     * timer, which is what makes `connection:open` churn inside the wait free.
+     * timer, which is what makes `peer:identify` churn inside the wait free.
      */
     private scheduleRetryWithBackoff;
     /**