@syncular/client 0.29.1 → 0.30.1

package/README.md

@@ -209,20 +209,35 @@ A leader tab that processes no messages (hung or frozen) therefore blocks its
 followers within `followerCallTimeoutMs`; a closed leader releases its Web
 Lock and hands over without waiting for that deadline. A blocked follower keeps
 probing at the same interval: an answer rebinds the same handle, and a granted
-Web Lock promotes it. A single call that runs past `followerCallTimeoutMs`
-rejects with `client.follower_timeout` and leaves the handle bound, because
-reachability is decided by the probe alone. An unreachable `BroadcastChannel`
-is never treated as evidence that the lock owner is stale, so it never
-authorizes a second worker or database owner.
-
-**Upgrade note: reload every open tab.** Followers running 0.26.0 or older
-wait for a leader heartbeat that current leaders no longer send. Such a tab
-next to a current leader reports `leader-unreachable` with
-`client.follower_timeout` after `followerCallTimeoutMs`, unless a current
-follower's probe happens to make the leader announce, and stays that way
-until it reloads. A current follower next to an older leader works, because
-older leaders answer every `hello`. After upgrading, reload every open tab of
-the origin.
+Web Lock promotes it. An unreachable `BroadcastChannel` is never treated as
+evidence that the lock owner is stale, so it never authorizes a second worker
+or database owner.
+
+**Forwarded calls have no deadline.** The leader's core serializes window
+edits and sync rounds, so a follower's `setWindow` can wait behind a long
+bootstrap download, exactly as the same call does in the leader tab. While
+the leader answers probes, a forwarded call waits for its result. It rejects
+with `client.follower_timeout` when the link goes `blocked`, with
+`client.leader_handover` when another leader announces or this tab promotes
+before the answer arrives, and with `client.worker_failed` when the handle
+closes. Only calls queued while no leader is bound keep the
+`followerCallTimeoutMs` deadline; when this tab wins the lock itself, its own
+core runs them.
+
+**Tabs of different builds never serve each other.** Every `hello`, `req`,
+and `announce` carries `MULTI_TAB_PROTOCOL_VERSION` and the schema version.
+A follower whose leader differs sends it nothing: `handle.leadership` becomes
+`{ state: 'blocked', reason: 'leader-incompatible', code:
+'client.leader_incompatible', leader: 'older' | 'newer', retryable: true }`
+and calls reject with `client.leader_incompatible`. A leader that hears a
+`hello` from a newer tab closes its core and releases the Web Lock; the newer
+tab promotes, and the former leader stays blocked with `leader: 'newer'`
+until it reloads. A leader answers a request with another identity with a
+`client.leader_incompatible` error. Tabs running 0.29.1 or older send no
+identity and count as older: they never step down, so a newer tab next to
+one shows `leader: 'older'` until that tab reloads or closes. Bump
+`MULTI_TAB_PROTOCOL_VERSION` with every change to a message shape or to a
+forwarded method's arguments or result.
 
 **A hidden leader keeps leadership.** A visible tab does not take leadership
 from a hidden leader. Web Locks `steal` revokes the lease while the leader's
@@ -291,8 +306,9 @@ errors or inspecting generated schema modules:
 ```
 
 The state is a discriminated union covering startup, migration,
-`client-upgrade-required`, `server-behind`, `incompatible-schema`, and
-`leader-unreachable`. Recovery changes the same handle/provider back to its
+`client-upgrade-required`, `server-behind`, `incompatible-schema`,
+`leader-unreachable`, and `leader-incompatible` (with `leader: 'older' |
+'newer'`). Recovery changes the same handle/provider back to its
 children; a blocked live query has `phase === 'blocked'`, never an indefinite
 loading state.
 

package/dist/availability.d.ts

@@ -7,11 +7,18 @@ export type SyncAvailability = {
     readonly currentSchemaVersion: number;
 } | {
     readonly state: 'blocked';
-    readonly reason: 'client-upgrade-required' | 'server-behind' | 'incompatible-schema' | 'leader-unreachable';
+    readonly reason: 'client-upgrade-required' | 'server-behind' | 'incompatible-schema' | 'leader-unreachable' | 'leader-incompatible';
     readonly currentSchemaVersion: number;
+    /** `leader-incompatible`: whether the tab holding the database runs an
+     * older or a newer build than this one. */
+    readonly leader?: 'older' | 'newer';
     readonly requiredSchemaVersion?: number;
     readonly latestServerSchemaVersion?: number;
     readonly retryable: boolean;
 };
+/** The availability of a tab whose leader link is blocked. */
+export declare function blockedLeadershipAvailability(leadership: Extract<LeadershipState, {
+    state: 'blocked';
+}>, currentSchemaVersion: number): SyncAvailability;
 /** Classify schema and browser-ownership state without parsing diagnostics. */
 export declare function classifySyncAvailability(status: SyncStatusSnapshot, leadership?: LeadershipState): SyncAvailability;

package/dist/availability.js

@@ -1,13 +1,25 @@
-/** Classify schema and browser-ownership state without parsing diagnostics. */
-export function classifySyncAvailability(status, leadership) {
-    const currentSchemaVersion = status.currentSchemaVersion;
-    if (leadership?.state === 'blocked') {
-        return {
+/** The availability of a tab whose leader link is blocked. */
+export function blockedLeadershipAvailability(leadership, currentSchemaVersion) {
+    return leadership.reason === 'leader-incompatible'
+        ? {
+            state: 'blocked',
+            reason: 'leader-incompatible',
+            currentSchemaVersion,
+            leader: leadership.leader,
+            retryable: true,
+        }
+        : {
             state: 'blocked',
             reason: 'leader-unreachable',
             currentSchemaVersion,
             retryable: true,
         };
+}
+/** Classify schema and browser-ownership state without parsing diagnostics. */
+export function classifySyncAvailability(status, leadership) {
+    const currentSchemaVersion = status.currentSchemaVersion;
+    if (leadership?.state === 'blocked') {
+        return blockedLeadershipAvailability(leadership, currentSchemaVersion);
     }
     const required = status.schemaFloor?.requiredSchemaVersion;
     const latest = status.schemaFloor?.latestSchemaVersion;

package/dist/multi-tab.d.ts

@@ -1,7 +1,30 @@
 import type { SyncWorkerEvent } from './worker-protocol.js';
 /** Client-local: a follower call could not reach a leader before its deadline. */
 export declare const FOLLOWER_TIMEOUT_CODE = "client.follower_timeout";
-/** Default deadline for a follower request (covers a leader-handover gap). */
+/** Client-local: the leader runs a different protocol or schema version. */
+export declare const LEADER_INCOMPATIBLE_CODE = "client.leader_incompatible";
+/** Client-local: the leader that received a call stopped leading before it answered. */
+export declare const LEADER_HANDOVER_CODE = "client.leader_handover";
+/**
+ * Version of the leader/follower wire and the forwarded handle API. Bump it
+ * with every change to a message shape or to a forwarded method's arguments
+ * or result, so tabs of different builds never serve each other.
+ */
+export declare const MULTI_TAB_PROTOCOL_VERSION = 1;
+/** What a tab must share with its leader to be served by it. */
+export interface TabIdentity {
+    readonly protocol: number;
+    readonly schemaVersion: number;
+}
+/**
+ * Order a peer's identity against our own: -1 older, 0 same, 1 newer. A peer
+ * from before protocol 1 sends no identity and is older.
+ */
+export declare function compareTabIdentity(peer: {
+    readonly protocol?: number;
+    readonly schemaVersion?: number;
+}, own: TabIdentity): -1 | 0 | 1;
+/** Default deadline for a call queued while no leader is bound (the handover gap). */
 export declare const DEFAULT_FOLLOWER_CALL_TIMEOUT_MS = 10000;
 /** Max follower calls queued across a handover before we fail loudly. */
 export declare const DEFAULT_FOLLOWER_QUEUE_LIMIT = 256;
@@ -20,15 +43,27 @@ export type LeadershipState = {
     readonly reason: 'leader-unreachable';
     readonly code: typeof FOLLOWER_TIMEOUT_CODE;
     readonly retryable: true;
+} | {
+    readonly state: 'blocked';
+    readonly reason: 'leader-incompatible';
+    readonly code: typeof LEADER_INCOMPATIBLE_CODE;
+    /** Whether the tab holding the database runs an older or a newer build. */
+    readonly leader: 'older' | 'newer';
+    readonly retryable: true;
 };
-interface HelloMessage {
+/** Identity fields; absent in messages from tabs before protocol 1. */
+interface IdentityFields {
+    readonly protocol?: number;
+    readonly schemaVersion?: number;
+}
+interface HelloMessage extends IdentityFields {
     readonly t: 'hello';
     readonly fromId: string;
     /** Highest epoch the sender has observed (helps a promoter monotonically
      * advance even if it never saw the previous leader's announce). */
     readonly epoch?: number;
 }
-interface ReqMessage {
+interface ReqMessage extends IdentityFields {
     readonly t: 'req';
     readonly epoch: number;
     readonly fromId: string;
@@ -36,7 +71,7 @@ interface ReqMessage {
     readonly method: string;
     readonly args: readonly unknown[];
 }
-interface AnnounceMessage {
+interface AnnounceMessage extends IdentityFields {
     readonly t: 'announce';
     readonly epoch: number;
     readonly clientId: string;
@@ -83,7 +118,9 @@ export declare function newTabId(): string;
  * Runs on the leader tab. Announces leadership, answers follower `req`s by
  * invoking the (already-running) worker via `invoke`, and rebroadcasts every
  * worker event to followers. Owns nothing about the worker lifecycle — the
- * worker-host stays the single core owner; this is a relay.
+ * worker-host stays the single core owner; this is a relay. A hello from a
+ * newer tab calls `onNewerTab`, whose owner closes the core and releases the
+ * lock.
  */
 export declare class LeaderBridge {
     #private;
@@ -91,7 +128,9 @@ export declare class LeaderBridge {
         channel: CrossTabChannel;
         epoch: number;
         clientId: string;
+        identity: TabIdentity;
         invoke: (method: string, args: readonly unknown[]) => Promise<unknown>;
+        onNewerTab: () => void;
     });
     /** Announce leadership (on promotion and in answer to every `hello`). */
     announce(): void;
@@ -111,13 +150,15 @@ type FollowerSchedule = (callback: () => void, delayMs: number) => () => void;
  * Feeds fanned-out events to `onEvent`. Learns leadership changes and hands
  * the resolved leader `clientId` back through `onLeaderChange`. Probes the
  * bound leader with `hello` after a quiet period and reports `blocked` only
- * when a probe goes unanswered (see the module comment).
+ * when a probe goes unanswered, or when the leader's identity differs from
+ * this tab's (see the module comment).
  */
 export declare class FollowerLink {
     #private;
     constructor(options: {
         channel: CrossTabChannel;
         fromId: string;
+        identity: TabIdentity;
         onEvent: (event: SyncWorkerEvent) => void;
         onLeaderChange: (clientId: string) => void;
         onStateChange?: (state: LeadershipState) => void;
@@ -147,10 +188,15 @@ export declare class FollowerLink {
     /**
      * The leader we were bound to went away (its lock released). Un-bind so new
      * calls queue again; re-request an announce so the next leader finds us.
-     * In-flight calls stay pending — their per-call timeout is the backstop,
-     * and the winner's announce will flush any that were queued.
+     * Calls in flight to the departed leader reject; the winner's announce
+     * flushes the queued ones.
      */
     unbind(): void;
+    /**
+     * This tab won the lock and runs its own core: calls queued for the next
+     * leader run on `invoke` instead of failing, then the link closes.
+     */
+    handOver(invoke: (method: string, args: readonly unknown[]) => Promise<unknown>): void;
     close(): void;
 }
 export {};

package/dist/multi-tab.js

@@ -11,11 +11,13 @@
  * survive `postMessage` on a BroadcastChannel):
  *
  *   follower → leader
- *     hello  {t,epoch?,fromId}                — "who's the leader?" on join,
+ *     hello  {t,epoch?,fromId,protocol,schemaVersion}
+ *                                              — "who's the leader?" on join,
  *                                                and the follower's liveness probe
- *     req    {t,epoch,fromId,reqId,method,args}
+ *     req    {t,epoch,fromId,reqId,method,args,protocol,schemaVersion}
  *   leader → all
- *     announce {t,epoch,clientId}             — "I am the leader, this epoch";
+ *     announce {t,epoch,clientId,protocol,schemaVersion}
+ *                                              — "I am the leader, this epoch";
  *                                                the answer to every hello
  *     res      {t,epoch,reqId,ok,value|error} — reply to one req
  *     event    {t,epoch,event}                — fan-out (invalidate/presence/…)
@@ -30,6 +32,14 @@
  * promoter reads the highest epoch it has seen and adds one, so successive
  * leaders always strictly increase it even across the lock-handover gap.
  *
+ * Identity: every hello, req, and announce carries the sender's
+ * {@link MULTI_TAB_PROTOCOL_VERSION} and application schema version. A leader
+ * serves only requests with its own identity. A follower whose leader has a
+ * different identity goes `blocked` with `leader-incompatible` and sends it
+ * nothing. A leader that hears a hello from a newer tab closes its core and
+ * releases the lock, so the newer tab takes over. Tabs from before protocol 1
+ * send no identity and count as older.
+ *
  * Liveness is follower-driven: the leader runs no timer. Browsers throttle
  * the timers of a hidden tab (Chrome's intensive throttling wakes them about
  * once a minute) but still dispatch its BroadcastChannel messages, so a leader
@@ -39,6 +49,9 @@
  * stays unanswered for the rest of the timeout. A leader tab whose main thread
  * processes no messages (hung or frozen) therefore still blocks its followers
  * within `callTimeoutMs`, and a closed leader hands over through the lock.
+ * A forwarded call has no deadline of its own: a live leader may run it behind
+ * a long sync round, exactly as it runs its own tab's calls. It rejects when
+ * the link blocks, when another leader announces, or when the link closes.
  *
  * Presence identity: all tabs share the leader's one connection, so a device
  * is exactly ONE presence peer collectively — `(actorId, leaderClientId)`.
@@ -49,7 +62,30 @@ import { ClientSyncError } from './errors.js';
 import { WORKER_FAILED_CODE } from './worker-protocol.js';
 /** Client-local: a follower call could not reach a leader before its deadline. */
 export const FOLLOWER_TIMEOUT_CODE = 'client.follower_timeout';
-/** Default deadline for a follower request (covers a leader-handover gap). */
+/** Client-local: the leader runs a different protocol or schema version. */
+export const LEADER_INCOMPATIBLE_CODE = 'client.leader_incompatible';
+/** Client-local: the leader that received a call stopped leading before it answered. */
+export const LEADER_HANDOVER_CODE = 'client.leader_handover';
+/**
+ * Version of the leader/follower wire and the forwarded handle API. Bump it
+ * with every change to a message shape or to a forwarded method's arguments
+ * or result, so tabs of different builds never serve each other.
+ */
+export const MULTI_TAB_PROTOCOL_VERSION = 1;
+/**
+ * Order a peer's identity against our own: -1 older, 0 same, 1 newer. A peer
+ * from before protocol 1 sends no identity and is older.
+ */
+export function compareTabIdentity(peer, own) {
+    if (peer.protocol === undefined || peer.schemaVersion === undefined)
+        return -1;
+    if (peer.protocol !== own.protocol)
+        return peer.protocol < own.protocol ? -1 : 1;
+    if (peer.schemaVersion !== own.schemaVersion)
+        return peer.schemaVersion < own.schemaVersion ? -1 : 1;
+    return 0;
+}
+/** Default deadline for a call queued while no leader is bound (the handover gap). */
 export const DEFAULT_FOLLOWER_CALL_TIMEOUT_MS = 10_000;
 /** Max follower calls queued across a handover before we fail loudly. */
 export const DEFAULT_FOLLOWER_QUEUE_LIMIT = 256;
@@ -76,20 +112,26 @@ export function newTabId() {
  * Runs on the leader tab. Announces leadership, answers follower `req`s by
  * invoking the (already-running) worker via `invoke`, and rebroadcasts every
  * worker event to followers. Owns nothing about the worker lifecycle — the
- * worker-host stays the single core owner; this is a relay.
+ * worker-host stays the single core owner; this is a relay. A hello from a
+ * newer tab calls `onNewerTab`, whose owner closes the core and releases the
+ * lock.
  */
 export class LeaderBridge {
     #channel;
     #epoch;
     #clientId;
+    #identity;
     #invoke;
+    #onNewerTab;
     #onMessage;
     #closed = false;
     constructor(options) {
         this.#channel = options.channel;
         this.#epoch = options.epoch;
         this.#clientId = options.clientId;
+        this.#identity = options.identity;
         this.#invoke = options.invoke;
+        this.#onNewerTab = options.onNewerTab;
         this.#onMessage = (event) => this.#handle(event.data);
         this.#channel.addEventListener('message', this.#onMessage);
         this.announce();
@@ -102,6 +144,7 @@ export class LeaderBridge {
             t: 'announce',
             epoch: this.#epoch,
             clientId: this.#clientId,
+            ...this.#identity,
         });
     }
     /** Fan a worker event out to all followers on the current epoch. */
@@ -114,7 +157,12 @@ export class LeaderBridge {
         if (this.#closed)
             return;
         if (message.t === 'hello') {
-            // A follower joined or probes liveness: tell it who leads.
+            // A newer tab takes over; any other follower learns who leads.
+            if (compareTabIdentity(message, this.#identity) > 0) {
+                this.close();
+                this.#onNewerTab();
+                return;
+            }
             this.announce();
             return;
         }
@@ -125,6 +173,20 @@ export class LeaderBridge {
         if (message.epoch !== this.#epoch)
             return;
         const { reqId, method, args } = message;
+        if (compareTabIdentity(message, this.#identity) !== 0) {
+            this.#channel.postMessage({
+                t: 'res',
+                epoch: this.#epoch,
+                reqId,
+                ok: false,
+                error: {
+                    code: LEADER_INCOMPATIBLE_CODE,
+                    message: 'the leader runs a different protocol or schema version',
+                    retryable: true,
+                },
+            });
+            return;
+        }
         this.#invoke(method, args).then((value) => {
             this.#channel.postMessage({
                 t: 'res',
@@ -169,11 +231,13 @@ export class LeaderBridge {
  * Feeds fanned-out events to `onEvent`. Learns leadership changes and hands
  * the resolved leader `clientId` back through `onLeaderChange`. Probes the
  * bound leader with `hello` after a quiet period and reports `blocked` only
- * when a probe goes unanswered (see the module comment).
+ * when a probe goes unanswered, or when the leader's identity differs from
+ * this tab's (see the module comment).
  */
 export class FollowerLink {
     #channel;
     #fromId;
+    #identity;
     #onEvent;
     #onLeaderChange;
     #onStateChange;
@@ -203,6 +267,7 @@ export class FollowerLink {
     constructor(options) {
         this.#channel = options.channel;
         this.#fromId = options.fromId;
+        this.#identity = options.identity;
         this.#onEvent = options.onEvent;
         this.#onLeaderChange = options.onLeaderChange;
         this.#onStateChange = options.onStateChange ?? (() => { });
@@ -286,7 +351,7 @@ export class FollowerLink {
             return Promise.reject(new ClientSyncError(WORKER_FAILED_CODE, 'the follower link is closed'));
         }
         if (this.#state.state === 'blocked') {
-            return Promise.reject(new ClientSyncError(FOLLOWER_TIMEOUT_CODE, 'the follower cannot reach the tab that owns the database', true));
+            return Promise.reject(this.#blockedError());
         }
         return new Promise((resolve, reject) => {
             const queued = {
@@ -316,16 +381,11 @@ export class FollowerLink {
     }
     #send(queued) {
         const reqId = this.#nextReqId++;
-        // The deadline fails this one call. Leader reachability is decided by the
-        // liveness probe alone, so a slow call against a live leader leaves the
-        // link bound.
+        // No deadline: a live leader may queue the call behind a long sync round.
+        // The liveness probe, a leader change, or close settles it otherwise.
         this.#inFlight.set(reqId, {
             resolve: queued.resolve,
             reject: queued.reject,
-            cancelTimer: this.#schedule(() => {
-                this.#inFlight.delete(reqId);
-                queued.reject(new ClientSyncError(FOLLOWER_TIMEOUT_CODE, 'the leader did not answer within the follower call timeout', true));
-            }, this.#callTimeoutMs),
         });
         this.#channel.postMessage({
             t: 'req',
@@ -334,8 +394,23 @@ export class FollowerLink {
             reqId,
             method: queued.method,
             args: queued.args,
+            ...this.#identity,
         });
     }
+    /** The rejection for a call made while the link is blocked. */
+    #blockedError() {
+        return this.#state.state === 'blocked' &&
+            this.#state.reason === 'leader-incompatible'
+            ? new ClientSyncError(LEADER_INCOMPATIBLE_CODE, 'the tab that owns the database runs a different protocol or schema version', true)
+            : new ClientSyncError(FOLLOWER_TIMEOUT_CODE, 'the follower cannot reach the tab that owns the database', true);
+    }
+    /** Reject every forwarded call; their leader will not answer them. */
+    #rejectInFlight(error) {
+        const pending = [...this.#inFlight.values()];
+        this.#inFlight.clear();
+        for (const inflight of pending)
+            inflight.reject(error);
+    }
     #dropQueued(queued) {
         const index = this.#queue.indexOf(queued);
         if (index >= 0)
@@ -351,8 +426,17 @@ export class FollowerLink {
             // Ignore a stale announce (older than the leader we already track).
             if (message.epoch < this.#epoch)
                 return;
+            const relation = compareTabIdentity(message, this.#identity);
+            if (relation !== 0) {
+                this.#setIncompatible(relation < 0 ? 'older' : 'newer');
+                return;
+            }
             const changed = message.epoch !== this.#epoch ||
                 message.clientId !== this.#leaderClientId;
+            // Calls sent to the previous leader get no answer from this one.
+            if (changed && this.#epoch >= 0) {
+                this.#rejectInFlight(new ClientSyncError(LEADER_HANDOVER_CODE, 'the leader changed before it answered the call', true));
+            }
             this.#epoch = message.epoch;
             this.#leaderClientId = message.clientId;
             if (changed)
@@ -376,7 +460,6 @@ export class FollowerLink {
             if (inflight === undefined)
                 return;
             this.#inFlight.delete(message.reqId);
-            inflight.cancelTimer();
             if (message.ok) {
                 inflight.resolve(message.value);
             }
@@ -406,18 +489,32 @@ export class FollowerLink {
     /**
      * The leader we were bound to went away (its lock released). Un-bind so new
      * calls queue again; re-request an announce so the next leader finds us.
-     * In-flight calls stay pending — their per-call timeout is the backstop,
-     * and the winner's announce will flush any that were queued.
+     * Calls in flight to the departed leader reject; the winner's announce
+     * flushes the queued ones.
      */
     unbind() {
         if (this.#closed)
             return;
+        this.#rejectInFlight(new ClientSyncError(LEADER_HANDOVER_CODE, 'the leader released the database before it answered the call', true));
         this.#epoch = -1;
         this.#leaderClientId = '';
         this.#setState({ state: 'waiting', reason: 'handover' });
         this.#armUnboundDeadline();
         this.#probe();
     }
+    /**
+     * This tab won the lock and runs its own core: calls queued for the next
+     * leader run on `invoke` instead of failing, then the link closes.
+     */
+    handOver(invoke) {
+        const queued = this.#queue;
+        this.#queue = [];
+        for (const call of queued) {
+            call.cancelTimer?.();
+            invoke(call.method, call.args).then(call.resolve, call.reject);
+        }
+        this.close();
+    }
     close() {
         if (this.#closed)
             return;
@@ -425,11 +522,7 @@ export class FollowerLink {
         this.#clearReachabilityTimers();
         this.#channel.removeEventListener('message', this.#onMessage);
         const closedError = new ClientSyncError(WORKER_FAILED_CODE, 'the follower link was closed');
-        for (const inflight of this.#inFlight.values()) {
-            inflight.cancelTimer();
-            inflight.reject(closedError);
-        }
-        this.#inFlight.clear();
+        this.#rejectInFlight(closedError);
         for (const queued of this.#queue) {
             queued.cancelTimer?.();
             queued.reject(closedError);
@@ -443,7 +536,12 @@ export class FollowerLink {
     #setState(state) {
         const previous = this.#state;
         if (previous.state === state.state &&
-            (state.state === 'blocked' ||
+            ((state.state === 'blocked' &&
+                previous.state === 'blocked' &&
+                previous.reason === state.reason &&
+                (state.reason !== 'leader-incompatible' ||
+                    (previous.reason === 'leader-incompatible' &&
+                        previous.leader === state.leader))) ||
                 (state.state === 'waiting' &&
                     previous.state === 'waiting' &&
                     previous.reason === state.reason) ||
@@ -467,8 +565,35 @@ export class FollowerLink {
             t: 'hello',
             fromId: this.#fromId,
             epoch: this.#maxEpochSeen,
+            ...this.#identity,
         });
     }
+    /**
+     * The leader runs another build. Send it nothing and stay unbound until a
+     * leader with this tab's identity announces (a newer leader's own hello
+     * already asked an older one to step down; see the module comment).
+     */
+    #setIncompatible(leader) {
+        this.#clearReachabilityTimers();
+        this.#epoch = -1;
+        this.#leaderClientId = '';
+        this.#setState({
+            state: 'blocked',
+            reason: 'leader-incompatible',
+            code: LEADER_INCOMPATIBLE_CODE,
+            leader,
+            retryable: true,
+        });
+        const error = this.#blockedError();
+        this.#rejectInFlight(error);
+        const queued = this.#queue;
+        this.#queue = [];
+        for (const call of queued) {
+            call.cancelTimer?.();
+            call.reject(error);
+        }
+        this.#resolveBindWaiters();
+    }
     /**
      * No leader answered in time. Calls reject immediately from here on; keep
      * probing so a leader that answers again rebinds this link.
@@ -481,6 +606,7 @@ export class FollowerLink {
             code: FOLLOWER_TIMEOUT_CODE,
             retryable: true,
         });
+        this.#rejectInFlight(this.#blockedError());
         const reprobe = () => {
             this.#cancelProbe = this.#schedule(() => {
                 reprobe();