@serfab/cadre-core 1.7.0 → 1.9.0

package/dist/strand-database.js

@@ -1,6 +1,6 @@
 import debug from 'debug';
 import { Database } from '@quereus/quereus';
-import { connectToStrand } from '@serfab/quereus-plugin-sereus';
+import { applyAppSchema, connectToStrand } from '@serfab/quereus-plugin-sereus';
 import { bootstrapFounderMembership } from './strand-membership-writer.js';
 import { strandMemberKeyPair } from './strand-member-key.js';
 const log = debug('sereus:cadre:strand-db');
@@ -38,7 +38,13 @@ export class StrandDatabase {
             return;
         }
         const sid = this.config.strandId;
-        log('Initializing StrandDatabase for strand: %s (sApp: %s v%s)', sid, this.config.sAppConfig.id, this.config.sAppConfig.version);
+        const { sAppConfig } = this.config;
+        if (this.config.founder === true) {
+            // Before composing anything: a founder that cannot write its Header must not
+            // leave a half-built connection behind.
+            this.founderSApp();
+        }
+        log('Initializing StrandDatabase for strand: %s (%s)', sid, sAppConfig ? `sApp: ${sAppConfig.id} v${sAppConfig.version}` : 'storage replica');
         this.db = new Database();
         // Delegate to the shared composition. The node is injected, so:
         //  - `connectToStrand` never creates a node (its `createdNode` stays null);
@@ -50,9 +56,14 @@ export class StrandDatabase {
         //    and cadre-core always injects the node and runs the network transactor.
         //    (The plugin keeps its `storage` option for the browser entry point.)
         const t0 = performance.now();
+        //
+        // A storage replica passes no schema, so no `App` tables are declared. A warm restart's
+        // hydrate may still load `App` table definitions persisted in the replicated store into
+        // the catalog — declarative metadata, nothing the app supplied runs — and the first-sync
+        // probe then reads those tables once from blocks this node holds.
         const result = await connectToStrand(this.db, {
             strandId: sid,
-            schema: this.config.sAppConfig.schema,
+            schema: sAppConfig?.schema,
             libp2pNode: this.config.libp2pNode,
             coordinatedRepo: this.config.coordinatedRepo,
             enableCache: true,
@@ -83,18 +94,31 @@ export class StrandDatabase {
      * no keypair (Header only). Idempotent — see {@link bootstrapFounderMembership}.
      */
     async bootstrapFounder() {
-        const { strandId, strandType, memberPrivateKey, partyMemberPrivateKey, sAppConfig } = this.config;
+        const { strandId, strandType, memberPrivateKey, partyMemberPrivateKey } = this.config;
         const closed = strandType === 'c';
         await bootstrapFounderMembership(this.db, {
             strandId,
             type: strandType,
-            sApp: sAppConfig,
+            sApp: this.founderSApp(),
             founderKeyPair: closed ? this.deriveFounderKeyPair(strandId, partyMemberPrivateKey) : undefined,
             sharedMemberPublicKey: closed && memberPrivateKey
                 ? strandMemberKeyPair(memberPrivateKey).publicKeyB64
                 : undefined,
         });
     }
+    /**
+     * The sApp a founder bootstrap records in the `Strand.Header`. Throws for a storage
+     * replica (no sApp config): its Header's sApp columns would have nothing to say.
+     * `CadreNode` always launches a replica as a joiner, so this guards a future caller.
+     */
+    founderSApp() {
+        const { sAppConfig, strandId } = this.config;
+        if (!sAppConfig) {
+            throw new Error(`Cannot found strand ${strandId} as a storage replica: the founder bootstrap writes ` +
+                'the sApp id and version into Strand.Header, and a replica has no sApp config.');
+        }
+        return sAppConfig;
+    }
     /**
      * Derive the founding keypair for a closed strand from the party's own
      * `partyMemberPrivateKey`, failing loudly when the key is absent (a closed strand
@@ -133,6 +157,19 @@ export class StrandDatabase {
         await this.bootstrapFounder();
         this.config.founder = true;
     }
+    /**
+     * Give a live storage replica the app's schema: apply `App` to the already-composed
+     * database — same libp2p node, same store, so the new tables read the blocks this node
+     * already holds — and record the sApp, so a later {@link ensureFounderBootstrap} has it
+     * for the `Header`. Idempotent: the apply is a declarative diff, so re-applying the same
+     * schema emits nothing. A failed apply records nothing.
+     */
+    async attachAppSchema(sAppConfig) {
+        this.ensureInitialized();
+        await applyAppSchema(this.db, sAppConfig.schema);
+        this.config.sAppConfig = sAppConfig;
+        log('StrandDatabase for strand %s attached sApp %s v%s', this.config.strandId, sAppConfig.id, sAppConfig.version);
+    }
     /**
      * Get the underlying database for queries
      */

package/dist/strand-database.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-database.js","sourceRoot":"","sources":["../src/strand-database.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAKhE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAyC5C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,cAAc;IAOzB,YAAY,MAA4B;QANhC,OAAE,GAAoB,IAAI,CAAC;QAC3B,mBAAc,GAA0C,IAAI,CAAC;QAC7D,uBAAkB,GAA4C,IAAI,CAAC;QAEnE,gBAAW,GAAG,KAAK,CAAC;QAG1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,kDAAkD,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,GAAG,CAAC,2DAA2D,EAC7D,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;QAEzB,gEAAgE;QAChE,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,iEAAiE;QACjE,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE;YAC5C,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM;YACrC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YAC5C,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC;QAC5C,MAAM,CAAC,sEAAsE,EAC3E,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;QAE/D,+EAA+E;QAC/E,yEAAyE;QACzE,4EAA4E;QAC5E,mFAAmF;QACnF,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,gBAAgB;QAC5B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAClG,MAAM,MAAM,GAAG,UAAU,KAAK,GAAG,CAAC;QAClC,MAAM,0BAA0B,CAAC,IAAI,CAAC,EAAG,EAAE;YACzC,QAAQ;YACR,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,UAAU;YAChB,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/F,qBAAqB,EAAE,MAAM,IAAI,gBAAgB;gBAC/C,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,YAAY;gBACpD,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,QAAgB,EAAE,qBAAyC;QACtF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,6CAA6C;gBACnF,gFAAgF;gBAChF,mFAAmF;gBACnF,kFAAkF;gBAClF,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,OAAO,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,sBAAsB,CAAC,qBAA8B;;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAA,IAAI,CAAC,MAAM,EAAC,qBAAqB,QAArB,qBAAqB,GAAK,qBAAqB,EAAC;QAC5D,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,EAAG,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACX,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,kBAAmB,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,MAAM,CAAC,QAAQ,4CAA4C,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"strand-database.js","sourceRoot":"","sources":["../src/strand-database.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAKhF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;AA6C5C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,cAAc;IAOzB,YAAY,MAA4B;QANhC,OAAE,GAAoB,IAAI,CAAC;QAC3B,mBAAc,GAA0C,IAAI,CAAC;QAC7D,uBAAkB,GAA4C,IAAI,CAAC;QAEnE,gBAAW,GAAG,KAAK,CAAC;QAG1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,kDAAkD,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACjC,6EAA6E;YAC7E,wCAAwC;YACxC,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,iDAAiD,EAAE,GAAG,EACxD,UAAU,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAEpF,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;QAEzB,gEAAgE;QAChE,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,iEAAiE;QACjE,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC7B,EAAE;QACF,wFAAwF;QACxF,wFAAwF;QACxF,yFAAyF;QACzF,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE;YAC5C,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,UAAU,EAAE,MAAM;YAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YAC5C,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC;QAC5C,MAAM,CAAC,sEAAsE,EAC3E,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;QAE/D,+EAA+E;QAC/E,yEAAyE;QACzE,4EAA4E;QAC5E,mFAAmF;QACnF,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,gBAAgB;QAC5B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACtF,MAAM,MAAM,GAAG,UAAU,KAAK,GAAG,CAAC;QAClC,MAAM,0BAA0B,CAAC,IAAI,CAAC,EAAG,EAAE;YACzC,QAAQ;YACR,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;YACxB,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/F,qBAAqB,EAAE,MAAM,IAAI,gBAAgB;gBAC/C,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,YAAY;gBACpD,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,WAAW;QACjB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,sDAAsD;gBACrF,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,QAAgB,EAAE,qBAAyC;QACtF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,6CAA6C;gBACnF,gFAAgF;gBAChF,mFAAmF;gBACnF,kFAAkF;gBAClF,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,OAAO,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,sBAAsB,CAAC,qBAA8B;;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAA,IAAI,CAAC,MAAM,EAAC,qBAAqB,QAArB,qBAAqB,GAAK,qBAAqB,EAAC;QAC5D,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CAAC,UAAsB;QAC1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,cAAc,CAAC,IAAI,CAAC,EAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QACpC,GAAG,CAAC,mDAAmD,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACpH,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,EAAG,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACX,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,kBAAmB,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,MAAM,CAAC,QAAQ,4CAA4C,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;CACF"}

package/dist/strand-first-sync-gate.d.ts

@@ -78,24 +78,57 @@ export declare const DEFAULT_STRAND_FIRST_SYNC_POLL_MS = 500;
  *
  * Every harness figure below was taken on one shape: one Windows developer machine, two
  * relay-only `CadreNode`s (`listenAddrs: []`) on a shared loopback dedicated relay, with a
- * 900 ms one-way per-frame outbound delay applied to every websocket by
+ * one-way per-frame outbound delay applied to every websocket by
  * `integration-tests/src/harness/ws-latency.ts` in `pipelined` mode — frames stay overlapped
  * in flight, so the figure is latency and bandwidth stays unlimited; the harness's other mode
  * (`serial`) is a per-socket frame-rate cap and its delays are NOT comparable
- * (`docs/testing.md` → "Link latency"). A round trip therefore costs about 1.8 s. Times run
- * from the `addStrand` call to writable.
- *
- * FRESH JOIN (2026-09-26), a machine holding nothing of the strand yet: 23, 27, 31 and 41 s
- * over four runs at optimystic's 1000 ms cohort read deadline, and 35, 42 and 46 s over three
- * runs at a 5000 ms one; the re-attach scenario below later took 38.7, 38.7 and 56.9 s for
- * the same fresh join. **The 5000 ms band, 35-57 s, is the one in force**: sereus declares
- * 5000 ms (`COHORT_READ_DEADLINE_MS`, `quereus-plugin-sereus/src/cluster-size.ts`), because
- * 1000 ms is shorter than one round trip on that link and leaves every cohort read with no
- * answer to corroborate against. Widening that deadline makes a consult against a peer that
- * cannot answer cost longer, and this phase runs several of those — which is why both bands
- * are recorded here, and why a change to either number has to be weighed against the other.
- *
- * RE-ATTACH (2026-09-26, the opt-in
+ * (`docs/testing.md` → "Link latency"). Two delays were used: 900 ms one-way, a round trip
+ * near 1.8 s, the band sereus supported first; and 1 500 ms one-way, the supported 3-second
+ * round trip. Times run from the `addStrand` call to writable.
+ *
+ * FRESH JOIN at 900 ms (2026-09-26), a machine holding nothing of the strand yet: 23, 27, 31
+ * and 41 s over four runs at optimystic's 1000 ms cohort read deadline, and 35, 42 and 46 s
+ * over three runs at a 5000 ms one; the re-attach scenario below later took 38.7, 38.7 and
+ * 56.9 s for the same fresh join. At that delay the 5000 ms band, 35-57 s, was the one in
+ * force: sereus then declared 5000 ms, because 1000 ms is shorter than one round trip on
+ * that link and leaves every cohort read with no answer to corroborate against. Widening that
+ * deadline makes a consult against a peer that cannot answer cost longer, and this phase runs
+ * several of those — which is why both bands are recorded here, and why a change to either
+ * number has to be weighed against the other.
+ *
+ * AT THE SUPPORTED LINK ON `@optimystic/*` 1.8.0 (2026-09-29), 1 500 ms one-way, the read
+ * deadline derived from the declared link at 7 000 ms (`cohortReadDeadlineMs` in
+ * `link-budget.ts`; the plugin's `COHORT_READ_DEADLINE_MS` is the same number), and cadre
+ * stating its declared link to Optimystic, the same scenario, all under the coordinator debug
+ * channel:
+ *  - Fresh join: writable at 63.9 and 63.8 s over two runs, the row A wrote before the join
+ *    readable at 88.0 s in both. B's strand node connected to A's at 18.3-18.4 s. No read was
+ *    declined: every consult on B completed, 6.03-6.05 s after the one before it (two link
+ *    round trips each). The time did not fall, because B's consults ran one after another and
+ *    the gate opened only after the seventh.
+ *  - Re-attach over the store B kept: no longer bimodal. All 3 runs held everything and came
+ *    up writable at launch (9.2 s), and the row A wrote while B was away was readable at
+ *    35.6 s in each, read with one consult for the collection and its data block together. No
+ *    read was declined during the attach. The empty-store arm was not re-run.
+ *
+ * AT THE SUPPORTED LINK ON `@optimystic/*` 1.7.0 (2026-09-29), same delay, deadline and
+ * scenario, before cadre stated its link to Optimystic:
+ *  - Fresh join: writable at 52.1 and 82.1 s over two runs, and 63.6 s in a third run under
+ *    the coordinator debug channel; a fourth run with the deadline set back to 5 000 ms took
+ *    70.2 s. B's strand node connected to A's at 18.2-18.3 s in every run at this delay. The
+ *    row A wrote before the join was readable at 67-124 s.
+ *  - Re-attach over the store B kept: bimodal again. 1 of 3 runs held everything and came up
+ *    writable at launch (9.1 s; the row at 33.4 s). The other 2 were gated and writable at
+ *    75.7 and 78.7 s (the row at 120.8 and 175.0 s). The empty-store arm was not re-run; at
+ *    900 ms it matched a fresh join.
+ *  - What that band was NOT: a measure of the 7 000 ms deadline. Every cohort consult in those
+ *    runs ended 3.00-3.02 s after the one before it, at 5 000 and 7 000 alike, because
+ *    Optimystic's then-fixed 3 000 ms request dial deadline also bounded the protocol
+ *    negotiation on an already-open connection, and one negotiation is one link round trip —
+ *    3 s here. So it was the band of a join whose every consult failed and whose blocks
+ *    arrived by peer-join backfill.
+ *
+ * RE-ATTACH at 900 ms (2026-09-26, the opt-in
  * `integration-tests/src/scenarios/strand-reattach-first-sync-measure.integration.ts` — re-run
  * it before changing this number): B attached once on an undelayed link, left with
  * `stopStrand`, A wrote while it was away, the delay was raised, and B called `addStrand`
@@ -112,18 +145,23 @@ export declare const DEFAULT_STRAND_FIRST_SYNC_POLL_MS = 500;
  *    connected to A's at 11 s in every arm, fresh join included, and a run with 20 missed
  *    writes fell inside the run-to-run spread of those with 1.
  * This budget covers WRITABLE, not caught up: in the gated kept-store runs the row A wrote
- * while B was away became readable only at 140-162 s.
+ * while B was away became readable only at 140-162 s (121-175 s at the supported link).
  *
  * Two samples from outside this harness, neither reproduced here and neither discarded: a
  * reporter's re-attach of the same shape (optimystic #22; their harness, storage and delay
  * injector are unknown to us) opened the gate at about 150 s, after the previous 120 s budget
  * had already rejected; and a real Galaxy S7 joining fresh through relay.sereus.org took 178 s.
  *
- * 300 s clears the worst harness sample (79 s) by about 3.8x, the reporter's re-attach by 2x
- * and the device join by about 1.7x. 240 s was rejected: it clears the device join by only
- * 1.35x, and that sample was not a re-attach. History: the original 30 s sat INSIDE the 1000 ms
- * fresh band and refused about half of those joins while their sync was progressing normally;
- * 120 s was sized from fresh joins only and refused the reporter's re-attach.
+ * 300 s clears the worst harness sample (82 s, a fresh join at the supported link on 1.7.0; the
+ * worst on 1.8.0 is 64 s) by about 3.6x, the reporter's re-attach by 2x and the device join by
+ * about 1.7x. Kept at 300 s on 2026-09-29, and again after the 1.8.0 re-measure the same day,
+ * by the rule that re-measure applied and the next one should: keep it while the
+ * worst harness sample is at most 100 s, which holds a margin of at least 3x; otherwise raise
+ * it to 3x the worst sample, rounded up to the next whole minute. 240 s was rejected earlier:
+ * it clears the device join by only 1.35x, and that sample was not a re-attach. History: the
+ * original 30 s sat INSIDE the 1000 ms fresh band and refused about half of those joins while
+ * their sync was progressing normally; 120 s was sized from fresh joins only and refused the
+ * reporter's re-attach.
  *
  * NOTE: accepted tradeoff — what 300 s costs. This wait is what an app's `addStrand` sits in
  * before it is told "not yet", so a strand none of whose members is reachable at all takes five

package/dist/strand-first-sync-gate.js

@@ -78,24 +78,57 @@ export const DEFAULT_STRAND_FIRST_SYNC_POLL_MS = 500;
  *
  * Every harness figure below was taken on one shape: one Windows developer machine, two
  * relay-only `CadreNode`s (`listenAddrs: []`) on a shared loopback dedicated relay, with a
- * 900 ms one-way per-frame outbound delay applied to every websocket by
+ * one-way per-frame outbound delay applied to every websocket by
  * `integration-tests/src/harness/ws-latency.ts` in `pipelined` mode — frames stay overlapped
  * in flight, so the figure is latency and bandwidth stays unlimited; the harness's other mode
  * (`serial`) is a per-socket frame-rate cap and its delays are NOT comparable
- * (`docs/testing.md` → "Link latency"). A round trip therefore costs about 1.8 s. Times run
- * from the `addStrand` call to writable.
+ * (`docs/testing.md` → "Link latency"). Two delays were used: 900 ms one-way, a round trip
+ * near 1.8 s, the band sereus supported first; and 1 500 ms one-way, the supported 3-second
+ * round trip. Times run from the `addStrand` call to writable.
  *
- * FRESH JOIN (2026-09-26), a machine holding nothing of the strand yet: 23, 27, 31 and 41 s
- * over four runs at optimystic's 1000 ms cohort read deadline, and 35, 42 and 46 s over three
- * runs at a 5000 ms one; the re-attach scenario below later took 38.7, 38.7 and 56.9 s for
- * the same fresh join. **The 5000 ms band, 35-57 s, is the one in force**: sereus declares
- * 5000 ms (`COHORT_READ_DEADLINE_MS`, `quereus-plugin-sereus/src/cluster-size.ts`), because
- * 1000 ms is shorter than one round trip on that link and leaves every cohort read with no
- * answer to corroborate against. Widening that deadline makes a consult against a peer that
- * cannot answer cost longer, and this phase runs several of those — which is why both bands
- * are recorded here, and why a change to either number has to be weighed against the other.
+ * FRESH JOIN at 900 ms (2026-09-26), a machine holding nothing of the strand yet: 23, 27, 31
+ * and 41 s over four runs at optimystic's 1000 ms cohort read deadline, and 35, 42 and 46 s
+ * over three runs at a 5000 ms one; the re-attach scenario below later took 38.7, 38.7 and
+ * 56.9 s for the same fresh join. At that delay the 5000 ms band, 35-57 s, was the one in
+ * force: sereus then declared 5000 ms, because 1000 ms is shorter than one round trip on
+ * that link and leaves every cohort read with no answer to corroborate against. Widening that
+ * deadline makes a consult against a peer that cannot answer cost longer, and this phase runs
+ * several of those — which is why both bands are recorded here, and why a change to either
+ * number has to be weighed against the other.
  *
- * RE-ATTACH (2026-09-26, the opt-in
+ * AT THE SUPPORTED LINK ON `@optimystic/*` 1.8.0 (2026-09-29), 1 500 ms one-way, the read
+ * deadline derived from the declared link at 7 000 ms (`cohortReadDeadlineMs` in
+ * `link-budget.ts`; the plugin's `COHORT_READ_DEADLINE_MS` is the same number), and cadre
+ * stating its declared link to Optimystic, the same scenario, all under the coordinator debug
+ * channel:
+ *  - Fresh join: writable at 63.9 and 63.8 s over two runs, the row A wrote before the join
+ *    readable at 88.0 s in both. B's strand node connected to A's at 18.3-18.4 s. No read was
+ *    declined: every consult on B completed, 6.03-6.05 s after the one before it (two link
+ *    round trips each). The time did not fall, because B's consults ran one after another and
+ *    the gate opened only after the seventh.
+ *  - Re-attach over the store B kept: no longer bimodal. All 3 runs held everything and came
+ *    up writable at launch (9.2 s), and the row A wrote while B was away was readable at
+ *    35.6 s in each, read with one consult for the collection and its data block together. No
+ *    read was declined during the attach. The empty-store arm was not re-run.
+ *
+ * AT THE SUPPORTED LINK ON `@optimystic/*` 1.7.0 (2026-09-29), same delay, deadline and
+ * scenario, before cadre stated its link to Optimystic:
+ *  - Fresh join: writable at 52.1 and 82.1 s over two runs, and 63.6 s in a third run under
+ *    the coordinator debug channel; a fourth run with the deadline set back to 5 000 ms took
+ *    70.2 s. B's strand node connected to A's at 18.2-18.3 s in every run at this delay. The
+ *    row A wrote before the join was readable at 67-124 s.
+ *  - Re-attach over the store B kept: bimodal again. 1 of 3 runs held everything and came up
+ *    writable at launch (9.1 s; the row at 33.4 s). The other 2 were gated and writable at
+ *    75.7 and 78.7 s (the row at 120.8 and 175.0 s). The empty-store arm was not re-run; at
+ *    900 ms it matched a fresh join.
+ *  - What that band was NOT: a measure of the 7 000 ms deadline. Every cohort consult in those
+ *    runs ended 3.00-3.02 s after the one before it, at 5 000 and 7 000 alike, because
+ *    Optimystic's then-fixed 3 000 ms request dial deadline also bounded the protocol
+ *    negotiation on an already-open connection, and one negotiation is one link round trip —
+ *    3 s here. So it was the band of a join whose every consult failed and whose blocks
+ *    arrived by peer-join backfill.
+ *
+ * RE-ATTACH at 900 ms (2026-09-26, the opt-in
  * `integration-tests/src/scenarios/strand-reattach-first-sync-measure.integration.ts` — re-run
  * it before changing this number): B attached once on an undelayed link, left with
  * `stopStrand`, A wrote while it was away, the delay was raised, and B called `addStrand`
@@ -112,18 +145,23 @@ export const DEFAULT_STRAND_FIRST_SYNC_POLL_MS = 500;
  *    connected to A's at 11 s in every arm, fresh join included, and a run with 20 missed
  *    writes fell inside the run-to-run spread of those with 1.
  * This budget covers WRITABLE, not caught up: in the gated kept-store runs the row A wrote
- * while B was away became readable only at 140-162 s.
+ * while B was away became readable only at 140-162 s (121-175 s at the supported link).
  *
  * Two samples from outside this harness, neither reproduced here and neither discarded: a
  * reporter's re-attach of the same shape (optimystic #22; their harness, storage and delay
  * injector are unknown to us) opened the gate at about 150 s, after the previous 120 s budget
  * had already rejected; and a real Galaxy S7 joining fresh through relay.sereus.org took 178 s.
  *
- * 300 s clears the worst harness sample (79 s) by about 3.8x, the reporter's re-attach by 2x
- * and the device join by about 1.7x. 240 s was rejected: it clears the device join by only
- * 1.35x, and that sample was not a re-attach. History: the original 30 s sat INSIDE the 1000 ms
- * fresh band and refused about half of those joins while their sync was progressing normally;
- * 120 s was sized from fresh joins only and refused the reporter's re-attach.
+ * 300 s clears the worst harness sample (82 s, a fresh join at the supported link on 1.7.0; the
+ * worst on 1.8.0 is 64 s) by about 3.6x, the reporter's re-attach by 2x and the device join by
+ * about 1.7x. Kept at 300 s on 2026-09-29, and again after the 1.8.0 re-measure the same day,
+ * by the rule that re-measure applied and the next one should: keep it while the
+ * worst harness sample is at most 100 s, which holds a margin of at least 3x; otherwise raise
+ * it to 3x the worst sample, rounded up to the next whole minute. 240 s was rejected earlier:
+ * it clears the device join by only 1.35x, and that sample was not a re-attach. History: the
+ * original 30 s sat INSIDE the 1000 ms fresh band and refused about half of those joins while
+ * their sync was progressing normally; 120 s was sized from fresh joins only and refused the
+ * reporter's re-attach.
  *
  * NOTE: accepted tradeoff — what 300 s costs. This wait is what an app's `addStrand` sits in
  * before it is told "not yet", so a strand none of whose members is reachable at all takes five
@@ -135,6 +173,7 @@ export const DEFAULT_STRAND_FIRST_SYNC_POLL_MS = 500;
  * "no peer at all" could then be reported at once and this budget would only ever be spent on a
  * sync that is actually in progress — worth more the longer this budget gets.
  */
+// eslint-disable-next-line no-restricted-syntax -- measured, not derived: the bands above, from integration-tests' strand-reattach-first-sync-measure.integration.ts; a whole first sync has no round-trip count
 export const DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS = 300000;
 /**
  * Thrown by `CadreNode.addStrand` / `whenStrandWritable` when a machine has not received the

package/dist/strand-first-sync-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-first-sync-gate.js","sourceRoot":"","sources":["../src/strand-first-sync-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD,qHAAqH;AACrH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAO,CAAC;AAc5D;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,QAAgB,EAAE,QAAgB;QAC5C,KAAK,CACH,UAAU,QAAQ,4EAA4E;YAC9F,+BAA+B,QAAQ,oDAAoD;YAC3F,6FAA6F;YAC7F,2FAA2F;YAC3F,kCAAkC,CACnC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,KAAa;IAChE,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAE,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,wDAAwD,EAAE,KAAK,EACjE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,KAAa;IACjE,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,sCAAsC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjF,MAAM;YACR,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,0DAA0D,EAAE,KAAK,EAAE,KAAK,EAC1E,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,KAAa;IACvE,OAAO,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAiBD;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAQ9B,YAA6B,IAA6B,EAAE,MAA8B;QAA7D,SAAI,GAAJ,IAAI,CAAyB;QAJlD,YAAO,GAAG,KAAK,CAAC;QAChB,WAAM,GAAG,KAAK,CAAC;QACf,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,iCAAiC,CAAC;IACpF,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,2FAA2F;IAC3F,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,oGAAoG;IACpG,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,GAAG,CAAC,2EAA2E,EAC7E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,mFAAmF,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5G,CAAC;IAED,gFAAgF;IAChF,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,gFAAgF;QAChF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,iFAAiF,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,6DAA6D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAChF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"strand-first-sync-gate.js","sourceRoot":"","sources":["../src/strand-first-sync-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD,qHAAqH;AACrH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0GG;AACH,iNAAiN;AACjN,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAO,CAAC;AAc5D;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,QAAgB,EAAE,QAAgB;QAC5C,KAAK,CACH,UAAU,QAAQ,4EAA4E;YAC9F,+BAA+B,QAAQ,oDAAoD;YAC3F,6FAA6F;YAC7F,2FAA2F;YAC3F,kCAAkC,CACnC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,KAAa;IAChE,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAE,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,wDAAwD,EAAE,KAAK,EACjE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,KAAa;IACjE,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,sCAAsC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjF,MAAM;YACR,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,0DAA0D,EAAE,KAAK,EAAE,KAAK,EAC1E,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,KAAa;IACvE,OAAO,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAiBD;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAQ9B,YAA6B,IAA6B,EAAE,MAA8B;QAA7D,SAAI,GAAJ,IAAI,CAAyB;QAJlD,YAAO,GAAG,KAAK,CAAC;QAChB,WAAM,GAAG,KAAK,CAAC;QACf,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,iCAAiC,CAAC;IACpF,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,2FAA2F;IAC3F,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,oGAAoG;IACpG,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,GAAG,CAAC,2EAA2E,EAC7E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,mFAAmF,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5G,CAAC;IAED,gFAAgF;IAChF,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,gFAAgF;QAChF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,iFAAiF,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,6DAA6D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAChF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/strand-formation-deadlines.d.ts

@@ -0,0 +1,151 @@
+/**
+ * Strand-formation deadlines, derived from the declared link round trip.
+ *
+ * The wire protocol lives in `strand-formation-protocol.ts`; this module is only the
+ * arithmetic it runs on: the ladder of deadlines one declaration yields
+ * ({@link formationDeadlines}) and the clamping of a caller's configured provisioning budget
+ * under its session ({@link resolveProvisionTimeoutMs}, {@link splitProvisionBudget}). It
+ * reaches `link-budget.ts` for the counts and `formation-approval.ts` for the hook's flat
+ * timeout, and nothing in the protocol, so both roles and the manager can import it freely.
+ */
+/**
+ * Every deadline of one formation session, derived from one declared link round trip
+ * ({@link formationDeadlines}). Each waits on work that crosses the link between the two
+ * parties' machines, so each is a round-trip count times the declaration rather than a
+ * number chosen on a fast network; the initiator's and the responder's fields are derived
+ * together so the ordering between the roles holds by construction.
+ */
+export interface FormationDeadlines {
+    /** Initiator: open a possibly relayed connection and negotiate the formation protocol. */
+    dialMs: number;
+    /** Responder: from the handler starting to the contact frame arriving. */
+    awaitContactMs: number;
+    /**
+     * Responder: `validateToken` plus `validateDisclosure`, budgeted as two consulting control
+     * reads. Counted in the travel margin and the clamp room, not wrapped in a deadline of their
+     * own: the session bounds them.
+     */
+    validationMs: number;
+    /** Responder: the provisioning hook's work budget, after which its signal aborts. */
+    provisionWorkMs: number;
+    /** Responder: the settle grace after the abort, which must contain one control commit. */
+    provisionGraceMs: number;
+    /**
+     * What the initiator's await-response holds over the responder's provisioning: the
+     * contact frame's trip out, the result frame's trip back, and the validation reads that
+     * run before the responder's provisioning clock starts.
+     */
+    responseTravelMarginMs: number;
+    /** Initiator: the result frame read. */
+    initiatorAwaitResponseMs: number;
+    /** Both roles: the whole session. */
+    sessionMs: number;
+}
+/**
+ * Derive every formation deadline from the declared link round trip
+ * (`NetworkConfig.linkRoundTripMs`; the default when none is declared is
+ * `DECLARED_LINK_ROUND_TRIP_MS` in `link-budget.ts`). With `L` the declaration, `R` one
+ * cohort read at that link (`cohortReadDeadlineMs`, 2L: one request and its answer over an
+ * open circuit) and `K` one commit (`commitBudgetMs`, 20L, measured):
+ *
+ *   dialMs                   = a relayed dial plus one protocol negotiation    (5L + 2 000)
+ *   awaitContactMs           = one request over the open stream               (2L)
+ *   validationMs             = 2R                                             (4L)
+ *   provisionWorkMs          = approval hook (10 000, flat) + 2R + K           (10 000 + 24L)
+ *   provisionGraceMs         = R + K                                          (22L)
+ *   responseTravelMarginMs   = L + validationMs                               (5L)
+ *   initiatorAwaitResponseMs = work + grace + margin                          (10 000 + 51L)
+ *   sessionMs                = dialMs + initiatorAwaitResponseMs              (12 000 + 56L)
+ *
+ * Why each term:
+ *
+ * - **awaitContact**: the listener's handler starts when it answers the protocol
+ *   negotiation; the answer reaches the joiner and the contact frame comes back, one round
+ *   trip, budgeted as a request over an open stream (2) for the same headroom as every other
+ *   one-exchange read in `link-budget.ts`.
+ * - **validation** and the reads inside **provisionWork** are budgeted at two consulting
+ *   reads each, not one per read the code issues. What actually runs: validation is three
+ *   control reads (`isTokenValid` reads the invite; `isTokenUsed` reads it again and counts
+ *   its usages) plus whatever the disclosure validator does; the bound provisioning path
+ *   (`StrandFormationManager.provisionAsResponder`) reads the invite and the strand row to
+ *   resolve the host strand, the invite again, the approver's `ValidationKey` and the seat
+ *   count around the outside approval hook (an HTTP call, so its own
+ *   `DEFAULT_APPROVAL_TIMEOUT_MS` is link-independent and added flat), the strand row and its
+ *   `StrandPartyKey` to issue the joiner's membership invite, and the host strand's stamp
+ *   before the `FormationUsage` write; then one strand-database commit issues the invite.
+ *   Every one of those is a read of this party's own control database, which in steady state
+ *   touches held blocks and consults nobody (`cadre-consistency.md` → "Deadlines Over
+ *   Optimystic's Reads and Commits"), so `R` is charged as headroom for the ones that do
+ *   consult, not per read. Waking a hibernating host strand inside the issue is NOT counted
+ *   either: `wakeHostStrandForFormation` cuts it off by design with a retryable rejection
+ *   and leaves the wake running, so the joiner's retry finds the strand live.
+ *   NOTE: if formation is seen timing out while the responder's control reads are consulting
+ *   the cohort (a cold responder, a control database not yet converged), charge one `R` per
+ *   read here rather than raising the flat headroom; the joiner is told 'Formation
+ *   provisioning timed out' with its invite unspent, so the cost is a retry, not a spent
+ *   invite.
+ * - **provisionGrace**: the window it exists for opens when the `FormationUsage` insert
+ *   attempt passes its abort check. `ControlDatabase.redeemInvitation` and
+ *   `recordFormationUsage` check the signal once per attempt inside the write lock, then run
+ *   the seat read (`assertSeatRemains`) and the transaction, so the grace contains one read
+ *   plus one commit. A retry after a failed attempt re-checks the abort, so only one attempt
+ *   needs containing.
+ * - **responseTravelMargin**: half a round trip out, half back, plus the validation reads,
+ *   which run on the initiator's await-response clock but before the responder's
+ *   provisioning clock starts.
+ * - **session**: the initiator's dial plus its await-response. The responder's whole path
+ *   (awaitContact + validation + work + grace = 10 000 + 52L) is inside it at every L.
+ *
+ * Ordering, strict at every L > 0, and pinned by `strand-formation-deadlines.spec.ts`:
+ * approval hook < provisionWork < work + grace < initiatorAwaitResponse < session, and the
+ * responder's whole path < session. Each layer can therefore fail and report before the
+ * layer above it gives up, and the work budget always outlasts the hook's own timeout, so a
+ * dead hook reports 'Formation approval unavailable, retry' rather than racing a
+ * provisioning timeout.
+ *
+ * **What this costs.** At the default declaration (3 500 ms) a joiner whose responder
+ * accepts the contact and then hangs waits up to 188.5 s, about three minutes, before it is
+ * told, where the fixed ladder this replaced told it after 15 s; the whole session is
+ * bounded at 208 s. A responder that is unreachable still fails at the dial, 19.5 s. A host
+ * that knows its party is on a fast link lowers `linkRoundTripMs` and gets roughly the old
+ * numbers back (at L = 100: dial 2.5 s, provisioning 14.6 s, await-response 15.1 s, session
+ * 17.6 s). Before this derivation, the fixed 5 s dial could not open a relayed connection
+ * above a 1.25-second round trip, and the fixed 2 s grace could not contain one commit at the
+ * supported link, so a joiner could be told 'timed out' over an invite that was in fact
+ * spent.
+ */
+export declare function formationDeadlines(linkRoundTripMs?: number): FormationDeadlines;
+/**
+ * The extra room the responder's clamp holds back ({@link provisionCeilingMs}'s `reserveMs`).
+ *
+ * The initiator's clamped await-response is `session - dial`, and the responder's reply
+ * reaches it `responseTravelMarginMs` after provisioning ends, so provisioning must end by
+ * `session - dial - margin`. The responder's own room is `session - awaitContact -
+ * validation`; the difference between the two is what it must hold back on top. Computed
+ * from the responder's own derivation, since it cannot see the initiator's dial budget: the
+ * module doc of `link-budget.ts` says why both parties must declare the same link.
+ */
+export declare function responderClampReserveMs(deadlines: FormationDeadlines, awaitContactMs: number): number;
+/**
+ * Resolve a caller-supplied provisioning budget: `0`/negative means "unset" (use
+ * `defaultMs`). If the result would let provisioning outlive the session — no result
+ * frame is ever sent, exactly the failure this budget exists to prevent — clamp it to
+ * {@link provisionCeilingMs} and log a warning. A budget that exactly meets the ceiling is
+ * not clamped: the derived defaults sit there by construction.
+ */
+export declare function resolveProvisionTimeoutMs(configured: number | undefined, defaultMs: number, sessionTimeoutMs: number, precedingMs: number, role: string, reserveMs?: number): number;
+/**
+ * Split a resolved provisioning budget into the WORK budget and the trailing settle grace.
+ *
+ * The grace is carved OUT of the budget, never added on top, so the ladder in
+ * {@link formationDeadlines} is untouched: the listener aborts the provisioning hook when the
+ * work budget expires, then waits up to the grace for the work to settle anyway
+ * (`FormationListener.settleWithinGrace` in `strand-formation-protocol.ts`). `graceCeilingMs`
+ * is the derived grace, which contains one seat read plus one commit at the declared link; it
+ * is capped at half the budget so a small configured budget still spends at least half its
+ * time doing work.
+ */
+export declare function splitProvisionBudget(provisionTimeoutMs: number, graceCeilingMs: number): {
+    workMs: number;
+    graceMs: number;
+};