@ultimat3/realtime 21.0.0 → 22.0.0

package/src/socket-drops.ts

@@ -0,0 +1,30 @@
+// How many dropped frames close a socket: more than `maxDroppedFrames` inside one window, never a
+// lifetime count. Split from `socket.ts`, which counts the drops; this decides what they mean.
+
+/**
+ * The window `maxDroppedFrames` is counted over. Ten seconds: long enough that a burst of
+ * backpressure drops closes a socket that cannot keep up, short enough that a connection open for
+ * hours is never closed for a lifetime's worth of isolated drops.
+ */
+export const DROP_WINDOW_MS = 10_000;
+
+/**
+ * The instants of the drops inside the current window. A burst of backpressure drops closes a
+ * socket that cannot keep up; the same number spread over a connection open for hours is a flaky
+ * link the cursor repairs, and closing for it was a healthy socket lost after 33 lifetime drops.
+ */
+export class DropWindow {
+  readonly #max: number;
+  readonly #recent: number[] = [];
+
+  constructor(max: number) {
+    this.#max = max;
+  }
+
+  /** Records one drop at `now` (monotonic ms) and answers whether the window is over its ceiling. */
+  overflowed(now: number): boolean {
+    this.#recent.push(now);
+    while ((this.#recent[0] ?? now) <= now - DROP_WINDOW_MS) this.#recent.shift();
+    return this.#recent.length > this.#max;
+  }
+}

package/src/socket-engine.ts

@@ -13,8 +13,8 @@ import { PortRouter } from './socket-routes';
 import { decode, encode, type Frame, PROTOCOL_VERSION } from './sync-protocol';
 import {
   type BackoffPolicy,
-  backoffDelay,
   browserBackoff,
+  policyDelay,
   type Rng,
   type Scheduler,
   timeoutScheduler,
@@ -250,7 +250,8 @@ export class SocketEngine {
     if (this.#reconnect !== null) return;
     const rng = this.#options.rng ?? Math.random;
     const delay =
-      afterMs ?? backoffDelay(this.#attempt, this.#options.backoff ?? browserBackoff, rng);
+      // `#attempt` counts reconnects already scheduled, from 0; the wait being armed is the next one.
+      afterMs ?? policyDelay(this.#options.backoff ?? browserBackoff, this.#attempt + 1, rng);
     this.#attempt += 1;
     this.#reconnect = this.#schedule(() => {
       this.#reconnect = null;
@@ -284,6 +285,17 @@ export class SocketEngine {
     socket?.close(1000, 'no tab left');
   }
 
+  /**
+   * A silent port, released — and TOLD first. Silent is usually a closed tab, but a hidden tab the
+   * browser throttled is silent too, and it was released without a word: its virtual socket stayed
+   * "open" over a port nobody read, and that tab's realtime was dead until a reload. Told, its
+   * client goes offline and redials, and the page re-hosts (`socket-host.ts`'s `rehosting`).
+   */
+  #reap(attached: AttachedPort): void {
+    if (attached.open) this.#post(attached, { t: 'close', code: 1006 });
+    this.#detach(attached);
+  }
+
   /** A `MessagePort` has no close event: a port silent for three beats is a closed tab. */
   #armReaper(): void {
     if (this.#reaper !== null) return;
@@ -291,7 +303,7 @@ export class SocketEngine {
       this.#reaper = null;
       const cutoff = this.#now() - REAP_AFTER_BEATS * this.#beatMs;
       for (const attached of [...this.#ports.values()]) {
-        if (attached.lastSeen < cutoff) this.#detach(attached);
+        if (attached.lastSeen < cutoff) this.#reap(attached);
       }
       if (this.#ports.size > 0) this.#armReaper();
     }, this.#beatMs);

package/src/socket-host.ts

@@ -7,12 +7,15 @@ import { browserSocket, dialUrl } from './browser-socket';
 import type { ClientSocket } from './client-contract';
 import type { SyncTarget } from './page-store';
 import { messagePort, type PortLike, SocketEngine } from './socket-engine';
+import { type Scheduler, timeoutScheduler } from './thundering-herd';
 
 export interface SocketHostOptions {
   /** The built worker script (`<meta name="ultimate-sync-worker">`); absent = in-page host. */
   readonly workerUrl?: string | undefined;
   /** The principal the page acts for: one worker per principal, never a shared socket across two. */
   readonly scope: string | null;
+  /** The build the page was rendered by: one worker per build, too. See `workerName`. */
+  readonly buildId?: string | undefined;
   /** Injected for tests; production reads the globals. */
   readonly sharedWorker?: SharedWorkerLike | undefined;
   readonly inPageEngine?: () => SocketEngine;
@@ -32,9 +35,13 @@ export interface SocketHost {
   bye(): void;
 }
 
-/** The worker's name carries the scope, so two principals in two tabs get two workers. */
-export function workerName(scope: string | null): string {
-  return `ultimate-sync:${encodeURIComponent(scope ?? '')}`;
+/**
+ * The worker's name carries the scope, so two principals in two tabs get two workers — and the
+ * BUILD, so two builds do too. A SharedWorker keeps the first tab's build id for its whole life, so
+ * a tab of the new build joined the old engine and was told "update available" about itself.
+ */
+export function workerName(scope: string | null, buildId: string | undefined): string {
+  return `ultimate-sync:${encodeURIComponent(scope ?? '')}:${encodeURIComponent(buildId ?? '')}`;
 }
 
 export function openHost(options: SocketHostOptions): SocketHost {
@@ -55,7 +62,9 @@ function workerPort(options: SocketHostOptions): PortLike | undefined {
     (typeof SharedWorker === 'function' ? (SharedWorker as SharedWorkerLike) : undefined);
   if (Worker === undefined || options.workerUrl === undefined) return undefined;
   try {
-    return messagePort(new Worker(options.workerUrl, { name: workerName(options.scope) }).port);
+    return messagePort(
+      new Worker(options.workerUrl, { name: workerName(options.scope, options.buildId) }).port,
+    );
   } catch {
     return undefined;
   }
@@ -124,3 +133,93 @@ class VirtualSocket implements ClientSocket {
     }
   }
 }
+
+/** A host that can be replaced under the page's one client. */
+export interface RehostingHost extends SocketHost {
+  /** Say bye to the current host and build a new one — the next `socket()` dials through it. */
+  rehost(): void;
+}
+
+export interface RehostingOptions {
+  /** How long a virtual socket may wait for `open` before its host is presumed dead. */
+  readonly openTimeoutMs: number;
+  readonly schedule?: Scheduler | undefined;
+}
+
+/**
+ * The page's host, replaceable. A port the engine reaped (a throttled hidden tab), or one the tab
+ * itself said `bye` on at `pagehide` before a bfcache restore, is a port nobody reads: the virtual
+ * socket over it waited for `open` forever and the tab's realtime was dead until a reload. So an
+ * `open` unanswered by `openTimeoutMs` closes that socket (1006, which the client redials on) and
+ * re-hosts on a fresh port; `page-socket.ts` also re-hosts on a bfcache `pageshow`.
+ */
+export function rehosting(make: () => SocketHost, options: RehostingOptions): RehostingHost {
+  const schedule = options.schedule ?? timeoutScheduler;
+  let current = make();
+  const self: RehostingHost = {
+    get kind(): 'worker' | 'in-page' {
+      return current.kind;
+    },
+    socket: (target) => {
+      const inner = current.socket(target);
+      return watchOpen(inner, schedule, options.openTimeoutMs, () => self.rehost());
+    },
+    bye: () => current.bye(),
+    rehost: () => {
+      current.bye();
+      current = make();
+    },
+  };
+  return self;
+}
+
+/** `inner`, with a deadline on its `open`: missed, the host is re-made and the socket closes. */
+function watchOpen(
+  inner: ClientSocket,
+  schedule: Scheduler,
+  ms: number,
+  rehost: () => void,
+): ClientSocket {
+  let opened: (() => void) | null = null;
+  let closed: ((code: number) => void) | null = null;
+  let settled = false;
+  const disarm = schedule(() => {
+    if (settled) return;
+    settled = true;
+    rehost();
+    closed?.(1006);
+  }, ms);
+  inner.onOpen(() => {
+    if (settled) return;
+    settled = true;
+    disarm();
+    opened?.();
+  });
+  inner.onClose((code) => {
+    if (!settled) {
+      settled = true;
+      disarm();
+    }
+    closed?.(code);
+  });
+  return {
+    get bufferedAmount(): number {
+      return inner.bufferedAmount ?? 0;
+    },
+    send: (data) => inner.send(data),
+    close: (code, reason) => {
+      if (!settled) {
+        settled = true;
+        disarm();
+      }
+      inner.close(code, reason);
+    },
+    onOpen: (handler) => {
+      opened = handler;
+    },
+    onMessage: (handler) => inner.onMessage(handler),
+    onClose: (handler) => {
+      closed = handler;
+    },
+  };
+}

package/src/socket-idle.ts

@@ -0,0 +1,21 @@
+// The application idle budget a sync node evicts a silent socket on, and how often it asks. Split
+// from `socket.ts` at its line ceiling.
+
+/**
+ * How long a socket may route no frame before `sync-node` evicts it. It is an APPLICATION
+ * inactivity budget and not Bun's transport one: Bun's `idleTimeout` is renewed by its own
+ * ping/pong, so a client whose TCP stack still answers pings while its frame loop is wedged holds
+ * its grant, its subscriptions and its topic membership forever. A beating client sends a `hello`
+ * every `DEFAULT_HEARTBEAT_MS` (15s), so this is eight missed beats.
+ */
+export const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
+
+/**
+ * How often to ask. A quarter of the budget, floored at a second: a socket is evicted within 25%
+ * of its window of going quiet, and a node holding 50,000 of them pays one pass over the table
+ * four times per window rather than once a second. Derived rather than configured — a second knob
+ * is a second number that can disagree with the one it is a fraction of.
+ */
+export function idleSweepPeriodMs(idleTimeoutMs: number): number {
+  return Math.max(1_000, Math.floor(idleTimeoutMs / 4));
+}

package/src/socket.ts

@@ -19,6 +19,8 @@ import {
 import { GapRepairs } from './channel-gaps';
 import type { ChannelRecordsFrame } from './channel-wire';
 import { CLOSE } from './close-codes';
+import { DropWindow } from './socket-drops';
+import { DEFAULT_IDLE_TIMEOUT_MS } from './socket-idle';
 import { encode, type Frame } from './sync-protocol';
 import { AcceptBudget } from './thundering-herd';
 
@@ -156,6 +158,7 @@ export class SyncSocket {
   readonly #maxDroppedFrames: number;
   #clientBuildId: string;
   #closed = false;
+  readonly #drops: DropWindow;
 
   constructor(options: SyncSocketOptions) {
     this.#ws = options.ws;
@@ -168,6 +171,7 @@ export class SyncSocket {
     finiteOption('SyncSocket', 'maxBufferedBytes', this.#maxBufferedBytes);
     this.#maxDroppedFrames = options.maxDroppedFrames ?? 32;
     finiteOption('SyncSocket', 'maxDroppedFrames', this.#maxDroppedFrames);
+    this.#drops = new DropWindow(this.#maxDroppedFrames);
     this.frameBudget = new AcceptBudget({
       perSecond: finiteOption(
         'SyncSocket',
@@ -215,33 +219,34 @@ export class SyncSocket {
 
   /** `false` means the frame was dropped by backpressure — the caller must mark state stale. */
   send(frame: Frame): boolean {
+    return this.sendEncoded(encode(frame));
+  }
+
+  /** An `encode()`d frame — the fan-outs encode once for every socket. Adds no validation. */
+  sendEncoded(text: string): boolean {
     if (this.#closed) return false;
     if (this.#ws.getBufferedAmount() > this.#maxBufferedBytes) {
-      this.droppedFrames += 1;
-      if (this.droppedFrames > this.#maxDroppedFrames) {
-        this.close(CLOSE.overloaded, 'backpressure');
-      }
+      this.#dropped();
       return false;
     }
-    // `WsLike.send` is declared `: number` for this line and no other: Bun answers `0` for a
-    // message it DROPPED — the socket closed between the buffered-amount check above and this
-    // write — and `-1` under backpressure. Discarded, a dropped frame read as delivered, so
-    // `live-fanout` advanced the subscriber's cursor past a patch that never left and
-    // `sync-frames`' desync mark was never taken: permanently stale on a healthy socket, which is
-    // the exact outcome every other `socket.send` on this node reads its answer to prevent.
-    if (this.#ws.send(encode(frame)) <= 0) {
-      this.droppedFrames += 1;
-      // The same ceiling backpressure takes: a socket the runtime keeps refusing is one to close,
-      // and the two are one failure — the write went nowhere either way.
-      if (this.droppedFrames > this.#maxDroppedFrames) {
-        this.close(CLOSE.overloaded, 'backpressure');
-      }
+    // Bun answers `0` for a message it DROPPED (the socket closed after the check above) — the one
+    // drop. `-1` means QUEUED under backpressure, and it is delivered: counted as a drop it sent a
+    // spurious `replay-gap`, desynced a healthy subscriber, and closed the socket after 33.
+    if (this.#ws.send(text) === 0) {
+      this.#dropped();
       return false;
     }
     this.sentFrames += 1;
     return true;
   }
 
+  /** One frame that never left: counted for life, judged per `DROP_WINDOW_MS` (`socket-drops.ts`). */
+  #dropped(): void {
+    this.droppedFrames += 1;
+    if (this.#drops.overflowed(this.#clock.monotonic()))
+      this.close(CLOSE.overloaded, 'backpressure');
+  }
+
   /** Record a dropped or invalidated subscription so the next flush re-snapshots it. */
   markDesynced(sid: string): void {
     this.desynced.add(sid);
@@ -282,25 +287,6 @@ export class SyncSocket {
   }
 }
 
-/**
- * How long a socket may route no frame before `sync-node` evicts it. It is an APPLICATION
- * inactivity budget and not Bun's transport one: Bun's `idleTimeout` is renewed by its own
- * ping/pong, so a client whose TCP stack still answers pings while its frame loop is wedged holds
- * its grant, its subscriptions and its topic membership forever. A beating client sends a `hello`
- * every `DEFAULT_HEARTBEAT_MS` (15s), so this is eight missed beats.
- */
-export const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
-
-/**
- * How often to ask. A quarter of the budget, floored at a second: a socket is evicted within 25%
- * of its window of going quiet, and a node holding 50,000 of them pays one pass over the table
- * four times per window rather than once a second. Derived rather than configured — a second knob
- * is a second number that can disagree with the one it is a fraction of.
- */
-export function idleSweepPeriodMs(idleTimeoutMs: number): number {
-  return Math.max(1_000, Math.floor(idleTimeoutMs / 4));
-}
-
 export interface SocketRegistryOptions {
   readonly clock?: Clock;
   /** Bun's own `idleTimeout` is renewed by its ping/pong; this budget counts routed FRAMES. */
@@ -425,6 +411,9 @@ export class SocketRegistry {
   deliver(topic: string, frame: Frame): number {
     const members = this.#byTopic.get(topic);
     if (!members) return 0;
+    // Encoded ONCE for every member: per socket it was 16.9 ms against 0.6 ms for a 2 kB frame to
+    // 10,000 sockets, measured.
+    const text = encode(frame);
     let sent = 0;
     let dropped = 0;
     for (const socket of members) {
@@ -432,7 +421,7 @@ export class SocketRegistry {
         members.delete(socket);
         continue;
       }
-      if (socket.send(frame)) sent += 1;
+      if (socket.sendEncoded(text)) sent += 1;
       else dropped += 1;
     }
     if (members.size === 0) this.#byTopic.delete(topic);
@@ -447,6 +436,7 @@ export class SocketRegistry {
   deliverRecords(topic: string, epoch: string, frame: ChannelRecordsFrame): number {
     const members = this.#byTopic.get(topic);
     if (!members) return 0;
+    const text = encode(frame);
     let sent = 0;
     let dropped = 0;
     for (const socket of members) {
@@ -455,7 +445,7 @@ export class SocketRegistry {
         continue;
       }
       this.gapRepairs.repair(socket, topic);
-      if (socket.send(frame)) {
+      if (socket.sendEncoded(text)) {
         sent += 1;
         continue;
       }
@@ -467,6 +457,19 @@ export class SocketRegistry {
     return sent;
   }
 
+  /** Every member owes a re-read (a TRUNCATE): one `replay-gap` each now, or kept as a mark. */
+  announceGap(topic: string, epoch: string): number {
+    const members = this.#byTopic.get(topic);
+    if (!members) return 0;
+    let announced = 0;
+    for (const socket of members) {
+      if (socket.closed) continue;
+      socket.gaps.set(topic, epoch);
+      if (this.gapRepairs.repair(socket, topic)) announced += 1;
+    }
+    return announced;
+  }
+
   #countDropped(topic: string, dropped: number): void {
     this.#droppedChannelFrames += dropped;
     // Two readers, one event, one spelling: the series an operator alerts on and the line that

package/src/subscriber-gate.ts

@@ -54,6 +54,55 @@ export interface GateTarget {
   readonly rows: readonly Row[];
 }
 
+/**
+ * The shared window, indexed ONCE per fan-out rather than searched per subscriber per patch: a
+ * `rows.find` inside the subscriber loop was O(subscribers × window) — 54.6 ms against 0.7 ms at
+ * 1000 subscribers over a 500-row window. `windowIndex` builds it; `filterPatches` builds its own
+ * when a caller passes none.
+ */
+export interface WindowIndex {
+  readonly byId: ReadonlyMap<string, Row>;
+  readonly position: ReadonlyMap<string, number>;
+}
+
+export function windowIndex(rows: readonly Row[]): WindowIndex {
+  const byId = new Map<string, Row>();
+  const position = new Map<string, number>();
+  rows.forEach((row, at) => {
+    byId.set(row.id, row);
+    position.set(row.id, at);
+  });
+  return { byId, position };
+}
+
+/**
+ * What a subscriber holds as a patch list is folded: the cursor's set, plus what this list has
+ * inserted, minus what it has deleted — never a copy of the set per subscriber.
+ */
+class Holding {
+  readonly #base: ReadonlySet<string>;
+  readonly #added = new Set<string>();
+  readonly #removed = new Set<string>();
+
+  constructor(base: ReadonlySet<string>) {
+    this.#base = base;
+  }
+
+  has(id: string): boolean {
+    return this.#added.has(id) || (this.#base.has(id) && !this.#removed.has(id));
+  }
+
+  fold(patch: RowPatch): void {
+    if (patch.op === 'delete') {
+      this.#added.delete(patch.id);
+      this.#removed.add(patch.id);
+    } else if (patch.op === 'insert') {
+      this.#removed.delete(patch.id);
+      this.#added.add(patch.id);
+    }
+  }
+}
+
 export interface SubscriberGateOptions {
   /**
    * `live.rows_denied`. A row an actor's policy refuses is dropped, never sent and never turned
@@ -113,11 +162,16 @@ export class SubscriberGate {
     who: Subscriber,
     patches: readonly RowPatch[],
     held: ReadonlySet<string>,
+    index: WindowIndex = windowIndex(target.rows),
   ): Promise<RowPatch[]> {
     const out: RowPatch[] = [];
+    const holding = new Holding(held);
     for (const patch of patches) {
-      const allowed = await this.patch(target, who, patch, held.has(patch.id));
-      if (allowed !== null) out.push(allowed);
+      const allowed = await this.#decide(target, who, patch, holding.has(patch.id), index);
+      if (allowed === null) continue;
+      const placed = rebase(allowed, holding, target.rows, index);
+      holding.fold(placed);
+      out.push(placed);
     }
     return out;
   }
@@ -128,6 +182,16 @@ export class SubscriberGate {
     who: Subscriber,
     patch: RowPatch,
     holds: boolean,
+  ): Promise<RowPatch | null> {
+    return await this.#decide(target, who, patch, holds, windowIndex(target.rows));
+  }
+
+  async #decide(
+    target: GateTarget,
+    who: Subscriber,
+    patch: RowPatch,
+    holds: boolean,
+    index: WindowIndex,
   ): Promise<RowPatch | null> {
     // A delete carries no row, so there is nothing to put in front of the rule — `holds` IS the
     // decision, the same one the two branches below take for a row a rule has just refused.
@@ -147,7 +211,7 @@ export class SubscriberGate {
       this.#denied(target.qid, who, patch.id);
       return null;
     }
-    const full = target.rows.find((row) => row.id === patch.id);
+    const full = index.byId.get(patch.id);
     // No whole row means no decision to take. An update patch carries the changed columns only, so
     // a rule reading `row.ownerId` on one reads `undefined` and answers as if the row had said so —
     // fail-closed for `=== actor.id`, and a leak for every `!row.private`. It is not a gate that
@@ -218,6 +282,31 @@ const actorIdOf = (who: Subscriber): string | null => (who.actor === null ? null
  * window stopped holding it. Written once so the two paths cannot answer differently: a client left
  * holding the row instead renders a revoked grant until something else reconnects it.
  */
+/**
+ * The patch as this subscriber must read it. `index` was a position in the SHARED, pre-policy
+ * window, and forwarded unchanged it placed the row out of order for anyone who sees fewer rows —
+ * and its size told them how many rows they may not see sit ahead of it. Re-based on the rows ahead
+ * of it that this subscriber holds; dropped from a delete, which the client applies by id. Bounded
+ * by `CURSOR_ID_LIMIT` like `holds` is: a held row past it is not counted.
+ */
+function rebase(
+  patch: RowPatch,
+  holding: Holding,
+  rows: readonly Row[],
+  index: WindowIndex,
+): RowPatch {
+  if (patch.index === undefined) return patch;
+  const { index: _shared, ...rest } = patch;
+  if (patch.op === 'delete' || patch.row === null) return rest;
+  const at = index.position.get(patch.id) ?? patch.index;
+  let local = 0;
+  for (let i = 0; i < at && i < rows.length; i += 1) {
+    const id = rows[i]?.id;
+    if (id !== undefined && id !== patch.id && holding.has(id)) local += 1;
+  }
+  return { ...rest, index: local };
+}
+
 const withdrawn = (patch: RowPatch): RowPatch => ({
   op: 'delete',
   id: patch.id,

package/src/sync-node.ts

@@ -11,13 +11,8 @@ import { evictInChunks } from './drain-evictions';
 import { isClientFault } from './errors';
 import type { TransportSubscription } from './fanout';
 import { CHANGE_SUBJECT_ALL, parseEnvelope, SeqGapDetector } from './replicator';
-import {
-  CLOSE,
-  DEFAULT_MAX_BUFFERED_BYTES,
-  idleSweepPeriodMs,
-  SocketRegistry,
-  SyncSocket,
-} from './socket';
+import { CLOSE, DEFAULT_MAX_BUFFERED_BYTES, SocketRegistry, SyncSocket } from './socket';
+import { idleSweepPeriodMs } from './socket-idle';
 import { GrantBook, sweepGrants } from './sync-auth';
 import { ackRefOf, createFrameRouter } from './sync-frames';
 import { drainGraceMs, socketCeilings, syncNodeBounds } from './sync-node-bounds';

package/src/thundering-herd.ts

@@ -3,12 +3,12 @@
 //
 // Three mechanisms, in the order they fire:
 //   1. drainPlan()    — the draining node assigns each client a distinct delay slot before closing
-//   2. backoffDelay() — the client's own jittered retry, for failures nobody scheduled
+//   2. policyDelay()  — the client's own jittered retry, for failures nobody scheduled
 //   3. AcceptBudget   — the receiving node's token bucket, so recovery sheds instead of collapsing
 
 import {
+  backoffDelay,
   type Clock,
-  backoffDelay as coreBackoffDelay,
   finiteOption,
   type JitterMode,
   type Random,
@@ -59,20 +59,21 @@ export const browserBackoff: BackoffPolicy = {
 };
 
 /**
- * Attempt is 0-BASED. Result is always in `[0, maxMs]`.
+ * A {@link BackoffPolicy} mapped onto `@ultimat3/core`'s `backoffDelay` — the one curve. Attempt is
+ * 1-BASED, core's count: the wait after the first failure is `attempt: 1` and is `baseMs`.
  *
- * The arithmetic is core's, and `attempt + 1` is the WHOLE of the seam: a client counts its first
- * reconnect as attempt 0 and core counts the first wait as attempt 1, so dropping the shift would
- * double every reconnect delay in the framework — silently, and only under the load this file
- * exists to survive. `thundering-herd-core-parity.test.ts` pins the numbers.
+ * Internal to this package and never re-exported from the barrel. Until 22.0.0 `.` exported a
+ * 0-based `backoffDelay` of its own that shifted by one before delegating, which made two counting
+ * conventions under one name — and a caller that passed a 1-based count to it (the channel
+ * catch-up retry did) waited twice as long as it meant to, with no error anywhere.
  */
-export function backoffDelay(
+export function policyDelay(
+  policy: BackoffPolicy,
   attempt: number,
-  policy: BackoffPolicy = defaultBackoff,
   rng: Rng = Math.random,
 ): number {
-  return coreBackoffDelay({
-    attempt: attempt + 1,
+  return backoffDelay({
+    attempt,
     base: policy.baseMs,
     max: policy.maxMs,
     factor: policy.factor,