autobee 2.0.0-rc.2 → 2.0.0-rc.21

package/index.js

@@ -14,16 +14,17 @@ const asserts = require('./lib/asserts.js')
 const boot = require('./lib/boot.js')
 const { resolveWeight, currentWeight } = require('./lib/witness.js')
 const encoding = require('./lib/encoding.js')
-const Reboot = require('./lib/reboot.js')
+const FastForward = require('./lib/fast-forward.js')
 const System = require('./lib/system.js')
 const ApplyCalls = require('./lib/apply-calls.js')
 const topo = require('./lib/topo.js')
 const { ActiveWriters } = require('./lib/writers.js')
+const TrustedPeers = require('./lib/trusted.js')
+const ApplyView = require('./lib/apply-view.js')
 const UpdateChanges = require('./lib/updates.js')
 
 const EMPTY_HEAD = { length: 0, key: null }
 const INTERRUPT = new Error('Apply interrupted')
-const MIN_FF_GAP = 32
 
 module.exports = class Autobee extends ReadyResource {
   constructor(store, key = null, handlers = {}) {
@@ -56,7 +57,8 @@ module.exports = class Autobee extends ReadyResource {
     this.discoveryKey = null
     this.id = null
     this.bootstrap = null
-    this.handlers = handlers
+    this._handlers = handlers
+    this.stats = { undos: 0, fastForwards: 0, drains: 0, applies: 0, appends: 0 }
 
     this.system = new System(this.store.namespace('system'), this.name, {
       getEncryptionProvider: this.getSystemEncryption,
@@ -65,7 +67,7 @@ module.exports = class Autobee extends ReadyResource {
     this.system.auto = this
 
     this.bee = bee.snapshot()
-    this.view = handlers.open ? handlers.open(this.bee, this) : this.bee
+    this.view = ApplyView.open(this.bee, this)
     this.optimistic = handlers.optimistic !== false // TODO: should default to false instead
 
     this.name = name // for debugging
@@ -76,23 +78,32 @@ module.exports = class Autobee extends ReadyResource {
     this.writers = null
     this.bumping = 0
 
-    // system head to boot from: migrates or fast-forwards depending on its version
-    this.bootFrom = handlers.bootFrom || null
+    const fastForward = handlers.fastForward || {}
+
+    // oplog head to boot from: migrates or fast-forwards depending on its version
+    this.bootFrom = fastForward.boot || null
+
+    // conservative (default on): only fast-forward onto a head someone can serve whole
+    this._conservativeFF = fastForward.conservative !== false
+
+    this.trusted = new TrustedPeers(handlers)
 
-    this.reboot = null
-    this.rebooting = null
-    this.rebootTo = null
+    this.ff = null
+    this.fastForwarding = null
+    this.fastForwardTo = null
 
     this._workingBee = bee
-    this._workingView = handlers.open ? handlers.open(this._workingBee, this) : this._workingBee
+    this._workingView = new ApplyView(this._workingBee, this)
 
     this._localSystemStart = 0
     this._localSystemLength = 0
+    this._localFlushes = 0
     this._localViewStart = 0
     this._localViewLength = 0
 
     this._appending = []
     this._draining = null
+    this._bootWait = null
 
     this.legacyViews = handlers.legacyViews || []
 
@@ -100,11 +111,12 @@ module.exports = class Autobee extends ReadyResource {
     this._bootingState = null
     this._bootingAll = null
 
-    this._handlers = handlers
     this._now = handlers.now || Date.now // overridable for clock-drift tests
     this._hasApply = !!handlers.apply
     this._hasUpdate = !!handlers.update
     this._needsUpdate = false
+    this._ackRequired = false
+    this._ackedHeads = new Map()
     this._updateLocalCore = null
     this._host = new ApplyCalls(this)
     this._notifyHandler = null
@@ -120,6 +132,7 @@ module.exports = class Autobee extends ReadyResource {
     this.previousDrain = 0
 
     this._catchupMigratedNodes = null
+    this._migratedHead = null
 
     this.ready().catch(noop)
   }
@@ -161,10 +174,16 @@ module.exports = class Autobee extends ReadyResource {
 
     this._localSystemStart = this.system.bee.context.local.length
     this._localViewStart = this._workingBee.context.local.length
+    this._localFlushes = this.system.flushes
 
     this.bumpSoon()
   }
 
+  _requestWakeup() {
+    const session = this._wakeup._session
+    if (session) session.broadcastLookup()
+  }
+
   _registerWakeup() {
     if (!this.wakeupCapability) return
     this._wakeup.recouple()
@@ -209,6 +228,7 @@ module.exports = class Autobee extends ReadyResource {
 
   async _close() {
     this._interrupting = true
+    if (this._bootWait !== null) this._bootWait.resolve()
     if (this._notifyHandler) this._notifyHandler.destroy()
     if (this._draining) {
       // drain may be waiting on replicated blocks
@@ -216,18 +236,21 @@ module.exports = class Autobee extends ReadyResource {
       await this._draining
     }
 
+    if (this._updating) await this._updating
+
     // let in-flight writer adds finish
     try {
       await this._bootingAll
     } catch {}
 
-    if (this._handlers.close) await this._handlers.close(this.view)
+    await ApplyView.close(this.view, this)
 
     if (this.writers) await this.writers.close()
     await this.local.close()
     await this.system.close()
     await this._wakeup.close()
-    await this._workingBee.close()
+    if (this.bootstrap && !this.bootstrap.closed) await this.bootstrap.close()
+    await this._workingView.close()
     await this.bee.close()
     await this.store.close()
   }
@@ -239,20 +262,8 @@ module.exports = class Autobee extends ReadyResource {
         session.clearRequests(session.activeRequests, closingError)
       }
     }
-  }
-
-  async changesFrom({ system } = {}) {
-    const info = await this.system.getInfo()
-
-    const current = {
-      flushes: info ? info.flushes : 0,
-      system: this.system.bee.head(),
-      view: info ? info.view : EMPTY_HEAD
-    }
-
-    const shared = await this.system.commonAncestor(system || EMPTY_HEAD)
 
-    return UpdateChanges.from(shared, current)
+    if (this.fastForwarding) this.fastForwarding.clearRequests(closingError)
   }
 
   replicate(...args) {
@@ -269,6 +280,14 @@ module.exports = class Autobee extends ReadyResource {
     this._wakeup.hint(wakeup)
   }
 
+  // the view an oplog head points at, opened and closed through the handlers
+  openViewAt(oplog) {
+    const v = oplog.op.views.view
+    if (!v) return null
+
+    return new ApplyView(this.bee.checkout({ key: v.key, length: v.start + v.length }), this)
+  }
+
   openCore(key) {
     const encryption = this.encryptionKey ? new WriterEncryption(this) : null
     return this.store.get({ key, encryption })
@@ -294,7 +313,7 @@ module.exports = class Autobee extends ReadyResource {
     }
 
     if (this.bootFrom) {
-      this.bootFrom = (await this.bootFrom) || null
+      this.bootFrom = getBootOption(await this.bootFrom)
     }
   }
 
@@ -372,15 +391,26 @@ module.exports = class Autobee extends ReadyResource {
 
     await this.system.boot(system)
 
-    // Use the view position from the system info (authoritative, post-processing)
-    // rather than from the oplog (stale, captured at append time before _bump)
-    let view = this.system.view || EMPTY_HEAD
+    const migrated = await this.local.getUserData('autobee/migrated-head')
+    if (migrated) this._migratedHead = encoding.decodeMigratedHead(migrated)
+
+    let view = this.system.view
+    if (!view) view = (this._migratedHead && this._migratedHead.view) || EMPTY_HEAD
 
     // @todo migration
     if (result.migration) {
-      if (this.handlers.migrate) {
-        view = (await this.handlers.migrate(result.migration.views)) || EMPTY_HEAD
+      if (this._handlers.migrate) {
+        view =
+          (await this._handlers.migrate(result.migration.views, result.migration.system)) ||
+          EMPTY_HEAD
         this._catchupMigratedNodes = result.migration.catchup
+
+        this._migratedHead = {
+          system: result.migration.system,
+          view: view.length ? view : (this._migratedHead && this._migratedHead.view) || null
+        }
+
+        await this._storeMigratedHead()
       }
 
       // ff boot invalidated by migration
@@ -420,7 +450,7 @@ module.exports = class Autobee extends ReadyResource {
   async _bump() {
     if (!(await this._bootReady())) return
 
-    await this._flushWakeup()
+    if (this._bootWait !== null) this._bootWait.resolve()
 
     this.bumping++
 
@@ -476,13 +506,20 @@ module.exports = class Autobee extends ReadyResource {
   }
 
   async _drain() {
+    if (this._updating) await this._updating
+
+    this.stats.drains++
+
     if (this.bootFrom) {
-      await this._initFromHead(this.bootFrom)
+      const { head = null, legacy = null, bootCondition = null } = this.bootFrom
+
       this.bootFrom = null
+
+      if (legacy) await this._bootFromSystem(legacy)
+      else if (head) await this._bootFromHead(head, bootCondition)
     }
 
-    // tracked across drain iteration
-    this.system.shared = null
+    this._ackRequired = false
 
     const changes = this._hasUpdate ? new UpdateChanges(this) : null
     if (changes) changes.track()
@@ -498,16 +535,26 @@ module.exports = class Autobee extends ReadyResource {
 
       try {
         while (!this._interrupting) {
-          if (this.rebootTo !== null) {
-            await this._applyReboot()
+          await this._flushWakeup()
+          if (this._interrupting) break
+
+          if (this.fastForwardTo !== null) {
+            await this._applyFastForward()
             break // revaluate conditions...
           }
 
-          if (!(await this._bumpPendingWriters())) break
+          if (await this._bumpPendingWriters()) {
+            this._needsUpdate = true
+            continue
+          }
+
+          if (!this._appendAck()) break
           this._needsUpdate = true
         }
 
         await this._flushLocal()
+
+        if (!this._interrupting) await this.writers.refresh()
       } finally {
         if (this.bumping === 1) this.bumping = 0
         else this.bumping = 1
@@ -517,8 +564,15 @@ module.exports = class Autobee extends ReadyResource {
     this._draining = null
     if (this._interrupting) return
 
-    if (this._needsUpdate) {
-      await this._update(changes)
+    const updating = rrp()
+    this._updating = updating.promise
+
+    try {
+      if (this._needsUpdate) await this._update(changes)
+      await this._storeBoot()
+    } finally {
+      this._updating = null
+      updating.resolve()
     }
   }
 
@@ -551,71 +605,153 @@ module.exports = class Autobee extends ReadyResource {
     }
   }
 
-  async _flushWakeup() {
+  // wakeup hints keep arriving asynchronously
+  async _applyWakeupHints() {
     const hints = this._wakeup.flush()
+    if (!hints.size) return hints
 
     this.previousDrain = Date.now()
-    this.rebootFromHeads(hints).catch(noop)
 
     for (const [hex, length] of hints) {
       const key = b4a.from(hex, 'hex')
-      if (this.writers.has(hex)) continue
+      // wakeup() itself no-ops the add for an already-active writer, but still
+      // needs to run so it can hint() the announced length - skipping it here
+      // for active writers left gc with no hint to protect them
       await this.writers.wakeup(key, length)
     }
+
+    return hints
+  }
+
+  async _flushWakeup() {
+    const hints = await this._applyWakeupHints()
+    if (!hints.size) return
+
+    // a scheduled fast-forward is applied by the drain before we look again
+    if (this.fastForwardTo !== null || this.fastForwarding !== null) return
+    if (this._interrupting || this.closing || this.bootFrom) return
+
+    try {
+      const heads = await this._readCandidateHeads(hints, FastForward.DEFAULT_TIMEOUT)
+
+      const ff = await FastForward.fromHeads(this, heads, {
+        timeout: FastForward.DEFAULT_TIMEOUT
+      })
+
+      if (ff !== null) await this._runFastForward(ff)
+    } catch (err) {
+      safetyCatch(err)
+    }
   }
 
-  async _getOplog(key, length) {
+  async _readCandidateHeads(hints, timeout) {
+    const promises = []
+
+    for (const [hex, length] of hints) {
+      if (length === 0) continue
+      const key = b4a.from(hex, 'hex')
+      promises.push(this._getOplog(key, length, timeout ? { timeout } : null))
+    }
+
+    const ops = await Promise.all(promises)
+    const heads = []
+
+    for (const res of ops) {
+      if (res === null) continue
+
+      // the head we were woken on is a candidate in its own right
+      heads.push({ key: res.key, length: res.length })
+
+      if (!res.op.trusted) continue
+
+      for (const trusted of res.op.trusted) {
+        const head = this.trusted.read(trusted)
+        if (head !== null) heads.push(head)
+      }
+    }
+
+    return heads
+  }
+
+  async _getOplog(key, length, opts = null) {
     const core = this.openCore(key)
+
+    try {
+      return await this.readOplog(core, length, opts)
+    } finally {
+      await core.close()
+    }
+  }
+
+  // reads on a core the caller owns, so a walk does not churn a session per step
+  async readOplog(core, length, opts = null) {
     await core.ready()
 
     const target = length >= 0 ? length : core.length
     if (target === 0) return null
 
-    const buf = await core.get(target - 1)
+    // conservative: only proceed when a connected peer can serve the head whole
+    if (opts && opts.conservative && core.remoteContiguousLength < target) return null
+
+    const buf = await core.get(target - 1, opts)
+    if (buf === null) return null
+
     let op = encoding.decodeOplog(buf)
 
+    // legacy nodes always inflate, but only indexers carry views - callers
+    // that need system info must check op.views
     if (op.version < 3) {
-      op = await this._inflateLegacyOplog(buf, core, target - 1)
+      op = await this._inflateLegacyOplog(buf, core, target - 1, opts)
     }
 
-    await core.close()
-
-    if (buf === null) return null
-
     return {
-      key,
+      key: core.key,
       length: target,
       op
     }
   }
 
-  async _inflateLegacyOplog(buf, core, seq) {
+  async _inflateLegacyOplog(buf, core, seq, opts = null) {
     const m = encoding.decodeRawOplog(buf)
+
+    const op = {
+      version: m.version,
+      timestamp: 0,
+      links: m.node.heads,
+      batch: { start: 0, end: m.node.batch - 1 },
+      views: null,
+      optimistic: !!m.optimistic,
+      value: m.node.value
+    }
+
+    if (m.digest === null || m.checkpoint === null || !m.checkpoint.system) return op
+
     const fetches = []
 
-    fetches.push(m.digest.pointer ? core.get(seq - m.digest.pointer) : buf)
-    fetches.push(m.checkpoint.pointer ? core.get(seq - m.checkpoint.system.checkpointer) : buf)
+    fetches.push(m.digest.pointer ? core.get(seq - m.digest.pointer, opts) : buf)
+    fetches.push(
+      m.checkpoint.pointer ? core.get(seq - m.checkpoint.system.checkpointer, opts) : buf
+    )
 
     const [digestNode, checkpointNode] = await Promise.all(fetches)
+    // a wait: false get we could not satisfy locally
+    if (digestNode === null || checkpointNode === null) return op
 
     const { digest } = encoding.decodeRawOplog(digestNode)
     const { checkpoint } = encoding.decodeRawOplog(checkpointNode)
 
-    return {
-      version: m.version,
-      timestamp: 0,
-      links: m.node.heads,
-      batch: { start: 0, end: m.node.batch - 1 },
-      views: {
-        system: {
-          key: digest.key,
-          length: checkpoint.system.checkpoint.length
-        },
-        flushes: seq
+    if (!checkpoint.system || !checkpoint.system.checkpoint) return op
+
+    op.views = {
+      system: {
+        key: digest.key,
+        start: 0,
+        length: checkpoint.system.checkpoint.length
       },
-      optimistic: !!m.optimistic,
-      value: m.node.value
+      flushes: seq
     }
+
+    return op
   }
 
   async _update(changes) {
@@ -675,7 +811,7 @@ module.exports = class Autobee extends ReadyResource {
     await this.bootstrap.setUserData('autobee/local', this.local.key)
     await oldLocal.close()
 
-    // done, soft reboot
+    // done, soft restart
     this.emit('rotate-local-writer')
   }
 
@@ -739,9 +875,49 @@ module.exports = class Autobee extends ReadyResource {
   }
 
   async _bumpMigratedWriters() {
+    const opened = new Set()
+
     for (const batch of this._catchupMigratedNodes) {
       await this._processBatch(batch)
+      for (const node of batch) {
+        if (node.from) opened.add(node.from)
+      }
     }
+
+    for (const core of opened) await core.close()
+  }
+
+  // append a null value node to ack writer
+  _appendAck() {
+    if (!this._ackRequired) return false
+    if (!this.writers.writable) return false
+
+    if (this.writers.localWriter.pending !== null) return false
+
+    const links = this.system.getLinks(this.local.key)
+    const t = Math.max(this._now(), this.system.timestamp)
+
+    let unlinked = false
+    for (const { key, length } of links) {
+      const hex = b4a.toString(key, 'hex')
+      const acked = this._ackedHeads.get(hex) || 0
+      if (length > acked) {
+        unlinked = true
+        break
+      }
+    }
+    if (!unlinked) {
+      this._ackRequired = false
+      return false
+    }
+
+    for (const { key, length } of links) {
+      this._ackedHeads.set(b4a.toString(key, 'hex'), length)
+    }
+
+    this.writers.appendLocal(null, t, { start: 0, end: 0 }, links, false, null)
+    this._ackRequired = false
+    return true
   }
 
   async _bumpPendingWriters() {
@@ -750,41 +926,33 @@ module.exports = class Autobee extends ReadyResource {
       this._catchupMigratedNodes = null
     }
 
-    let updated = false
+    // apply the best next node to keep the prefix stable
+    const next = await this.writers.nextPendingNode()
+    if (next === null) return false
 
-    const pending = this.writers.pending.slice()
+    const { writer: w, batch } = next
 
-    for (let i = pending.length - 1; i >= 0; i--) {
-      const w = pending[i]
-
-      const batch = await w.next()
-      if (batch === null) continue
-
-      if (w.isAdded || (w.isRemoved && w.hasReferrals())) {
-        await this._processBatch(batch)
-        w.notify(batch)
-        updated = true
-        continue
-      }
+    if (w.isAdded || (w.isRemoved && w.hasReferrals())) {
+      await this._processBatch(batch)
+      w.notify(batch)
+      return true
+    }
 
-      if (this.optimistic && !w.isRemoved && batch[0].optimistic) {
-        if (!(await this._optimisticBatch(batch))) {
-          w.removePending()
-          continue
-        }
-        w.notify(batch)
-        updated = true
-        continue
+    if (this.optimistic && !w.isRemoved && batch[0].optimistic) {
+      if (!(await this._optimisticBatch(batch))) {
+        w.removePending()
+        return true
       }
+      w.notify(batch)
+      return true
     }
 
-    return updated
+    return true
   }
 
   async _optimisticBatch(batch) {
     const rollbackSystem = this.system.bee.head()
     const rollbackView = this._workingBee.head()
-    const rollbackShared = this.system.shared
     const rollbackAttestations = this.writers.attestations.length
 
     const t = await this.prepareBatch(batch)
@@ -807,7 +975,6 @@ module.exports = class Autobee extends ReadyResource {
         this._workingBee.move(rollbackView)
         this.system.bee.move(rollbackSystem)
         await this.system.reset()
-        this.system.shared = rollbackShared
         // don't attest grants that were just undone
         this.writers.attestations.length = rollbackAttestations
         return false
@@ -830,7 +997,12 @@ module.exports = class Autobee extends ReadyResource {
     const t = await topo.sort(this, batch)
 
     if (t.undo) {
+      this.stats.undos++
+      this.trusted.clear()
       t.view = await this.system.undo(t.undo)
+      if (!t.view.length && this._migratedHead && this._migratedHead.view) {
+        t.view = this._migratedHead.view
+      }
     }
 
     return t
@@ -878,8 +1050,9 @@ module.exports = class Autobee extends ReadyResource {
     }
 
     if (this._hasApply && (await this.system.canApply(batch[0].key, optimistic))) {
+      this.stats.applies++
       this._host.applying = batch
-      await this._handlers.apply(userBatch, this._workingView, this._host)
+      await this._workingView.apply(userBatch)
       this._host.applying = null
     }
 
@@ -888,12 +1061,11 @@ module.exports = class Autobee extends ReadyResource {
     if (local) {
       this._localSystemLength = this.system.bee.context.local.length - this._localSystemStart
       this._localViewLength = this._workingBee.context.local.length - this._localViewStart
+      this._localFlushes = this.system.flushes
     }
 
     this.writers.attest(witnessed)
 
-    await this._storeBoot()
-
     for (const { key, added, isAnchor } of changed) {
       if (isAnchor) {
         // no Writer/ActiveWriters tracking, but still wake anything linked to it
@@ -922,6 +1094,11 @@ module.exports = class Autobee extends ReadyResource {
     return Promise.all(proms)
   }
 
+  _storeMigratedHead() {
+    const value = this._migratedHead ? encoding.encodeMigratedHead(this._migratedHead) : null
+    return this.local.setUserData('autobee/migrated-head', value)
+  }
+
   static decodeValue(buf, opts) {
     return encoding.decodeValue(buf, opts)
   }
@@ -939,6 +1116,8 @@ module.exports = class Autobee extends ReadyResource {
   async append(values, { optimistic = false } = {}) {
     if (this.closing) throw new Error('Autobee closed')
 
+    this.stats.appends++
+
     if (!Array.isArray(values)) values = [values]
 
     if (!this.opened) await this.ready()
@@ -996,7 +1175,7 @@ module.exports = class Autobee extends ReadyResource {
 
   async _flushLocal() {
     await this.writers.flushLocal({
-      flushes: this.system.flushes,
+      flushes: this._localFlushes,
       system: {
         key: this.system.bee.context.local.key,
         start: this._localSystemStart,
@@ -1011,133 +1190,135 @@ module.exports = class Autobee extends ReadyResource {
 
     this._localSystemStart = this.system.bee.context.local.length
     this._localSystemLength = 0
+    this._localFlushes = this.system.flushes
     this._localViewStart = this._workingBee.context.local.length
     this._localViewLength = 0
   }
 
-  async rebootFromHeads(hints, { force = false } = {}) {
-    if (!this._handlers.onwakeup) return false
-    if (this._interrupting) return false
-    if (!hints.size || this.rebooting || this.rebootTo || this.bootFrom) {
-      return false
-    }
+  async moveTo(head) {
+    if (!this.opened) await this.ready()
+    if (this.closing) throw new Error('Autobee closed')
 
-    const promises = []
-    const heads = []
-    for (const [hex, length] of hints) {
-      if (length === 0) continue
-      const key = b4a.from(hex, 'hex')
-      heads.push({ key, length })
-      promises.push(this._getOplog(key, length))
-    }
+    const ff = await FastForward.fromHead(this, head, null, { force: true })
+    if (ff === null) return null
 
-    const ops = await Promise.all(promises)
-    if (this.rebooting || this.rebootTo) return false
+    if (!(await this._runFastForward(ff))) return null
 
-    let best = null
-    let bestFlushes = -1
+    return this.ff.promise
+  }
 
-    for (let i = 0; i < ops.length; i++) {
-      const res = ops[i]
-      if (res === null) continue
+  // legacy: ungated boot straight onto a system head
+  async _bootFromSystem(system) {
+    try {
+      const ff = new FastForward(this, system, null, { timeout: FastForward.DEFAULT_TIMEOUT })
+      return await this._runFastForward(ff)
+    } catch (err) {
+      safetyCatch(err)
+      return false
+    }
+  }
 
-      if (res.op.views && res.op.views.flushes > bestFlushes) {
-        bestFlushes = res.op.views.flushes
-        best = res
+  // the boot head seeds the view every trust decision here is made against,
+  // since our own view is still empty
+  async _bootFromHead(head, bootCondition) {
+    // just a head: one attempt, we do not wait around if it cannot be read
+    if (bootCondition === null) {
+      try {
+        const ff = await FastForward.fromHead(this, head, null, {
+          force: true,
+          timeout: FastForward.DEFAULT_TIMEOUT
+        })
+
+        return ff !== null && (await this._runFastForward(ff))
+      } catch (err) {
+        safetyCatch(err)
+        return false
       }
     }
 
-    if (best && force) {
-      return this._rebootFromHead(best, null, { force: true })
-    }
+    // a condition needs the view at head to check against, so park until we
+    // can read it and something acceptable turns up
+    let opened = null
 
-    if (best === null || bestFlushes - this.system.flushes < MIN_FF_GAP) return false
+    try {
+      while (!this._interrupting) {
+        this._bootWait = rrp()
 
-    const head = { key: best.key, length: best.length }
+        try {
+          if (opened === null) opened = await this._bootReference(head)
 
-    const v = best.op.views.view
-    const view = this.bee.checkout({ key: v.key, length: v.start + v.length })
+          if (opened !== null && (await this._bootAttempt(head, bootCondition, opened.view))) {
+            return true
+          }
+        } catch (err) {
+          safetyCatch(err)
+        }
 
-    let trusted = null
-    try {
-      trusted = await this._handlers.onwakeup(head, view, this)
-      if (!trusted || this.rebooting || this.rebootTo) return false
+        if (this._interrupting) break
+
+        await this._bootWait.promise
+      }
     } finally {
-      view.close()
+      this._bootWait = null
+      if (opened !== null) await opened.close()
     }
 
-    return this._rebootFromHead(best, trusted)
+    return false
   }
 
-  async _rebootFromHead(head, trusted, { force = false, wait = true } = {}) {
-    const oplog = await this._getOplog(head.key, head.length)
-    if (!oplog) return false
-
-    const verified = trusted ? await this._getOplog(trusted.key, trusted.length) : oplog
-
-    if (!verified.op.views) return null
-
-    if (!force && verified.op.views.flushes - this.system.flushes < MIN_FF_GAP) {
-      return false
-    }
+  async _bootAttempt(head, bootCondition, reference) {
+    // peek, so the hints are still there for the drain once we have booted
+    const candidates = await this._readCandidateHeads(
+      this._wakeup.hints,
+      FastForward.DEFAULT_TIMEOUT
+    )
 
-    const moved = await this._moveTo(batchToHead(verified.op.views.system), {
-      system: batchToHead(oplog.op.views.system),
-      verified: {
-        op: trusted || head,
-        flushes: verified.op.views.flushes
-      }
+    const ff = await FastForward.fromHeads(this, [head, ...candidates], {
+      force: true,
+      timeout: FastForward.DEFAULT_TIMEOUT,
+      condition: bootCondition,
+      reference
     })
 
-    if (moved && wait) return this.reboot.promise
-
-    return null
+    return ff !== null && (await this._runFastForward(ff))
   }
 
-  // same as moveTo except we don't return the final promise
-  _initFromHead(head, tip) {
-    if (!head.length) {
-      // legacy fastForward boot
-      return this._runReboot(new Reboot(this, head, tip))
-    }
+  async _bootReference(head) {
+    const oplog = await FastForward.flushHead(this, head, {
+      timeout: FastForward.DEFAULT_TIMEOUT
+    })
 
-    return this._rebootFromHead(head, null, { force: true, wait: false })
+    return oplog === null ? null : this.openViewAt(oplog)
   }
 
-  // head is a system head; reboots onto it, migrating in place if it's a legacy version
-  async _moveTo(systemHead, tip) {
-    if (this.rebootTo !== null || this.rebooting !== null) return false
-
-    if (await this._runReboot(new Reboot(this, systemHead, tip))) {
-      return true
+  async _runFastForward(ff) {
+    if (this.fastForwardTo !== null || this.fastForwarding !== null) {
+      await ff.close()
+      return false
     }
 
-    return false
-  }
-
-  async _runReboot(reboot) {
-    this.rebooting = reboot
+    this.fastForwarding = ff
 
-    const result = await reboot.run()
-    await reboot.close()
+    const result = await ff.run()
+    await ff.close()
 
-    if (this.rebooting === reboot) this.rebooting = null
+    if (this.fastForwarding === ff) this.fastForwarding = null
 
     if (!result) return false
 
-    this.rebootTo = result
-    this.reboot = rrp()
+    this.fastForwardTo = result
+    this.ff = rrp()
 
     this.bumpSoon()
 
     return true
   }
 
-  async _applyReboot() {
+  async _applyFastForward() {
     const changes = this._hasUpdate ? new UpdateChanges(this) : null
     if (changes) changes.track()
 
-    const { head, tip, migrate } = this.rebootTo
+    const { head, tip, migrate } = this.fastForwardTo
 
     const from = this.system.bee.head()
     const to = head
@@ -1145,15 +1326,16 @@ module.exports = class Autobee extends ReadyResource {
     this.system.bee.move(head)
     await this.system.reset()
 
-    this.system.shared = this.rebootTo.shared || {
-      flushes: -1,
-      view: EMPTY_HEAD,
-      system: EMPTY_HEAD
-    }
-
     // migrate is set when fast-forwarding from a legacy head
     if (migrate) {
-      const view = (await this.handlers.migrate(migrate)) || EMPTY_HEAD
+      const view = (await this._handlers.migrate(migrate, head)) || EMPTY_HEAD
+
+      this._migratedHead = {
+        system: head,
+        view: view.length ? view : (this._migratedHead && this._migratedHead.view) || null
+      }
+
+      await this._storeMigratedHead()
       this.bee.move(view)
       this._workingBee.move(view)
     } else {
@@ -1161,13 +1343,21 @@ module.exports = class Autobee extends ReadyResource {
       this._workingBee.move(this.system.view)
     }
 
-    this.rebootTo = null
+    this.fastForwardTo = null
+
+    // process any wakeup while fast-forward itself was in flight
+    await this._applyWakeupHints()
     await this.writers.refresh()
 
+    // we moved, so ask our peers to tell us their heads again
+    this._requestWakeup()
+
     await this._update(changes)
+    await this._storeBoot()
 
+    this.stats.fastForwards++
     this.emit('move-to', to, from)
-    this.reboot.resolve({ to, from })
+    this.ff.resolve({ to, from })
 
     // tip is null during boot
     if (!tip) return
@@ -1187,7 +1377,8 @@ module.exports = class Autobee extends ReadyResource {
     const t = await topo.rollback(this, sys, verified)
     await sys.close()
 
-    await this.applyBacklog(t.tip)
+    if (t !== null) await this.applyBacklog(t.tip)
+
     return this._update(changes)
   }
 
@@ -1200,6 +1391,17 @@ function isObject(o) {
   return typeof o === 'object' && o && !b4a.isBuffer(o)
 }
 
+function getBootOption(boot) {
+  if (!boot) return null
+
+  // oldest style, supported for now but will go away: a bare key is legacy
+  if (boot.key) return { legacy: boot, head: null, bootCondition: null }
+
+  asserts.assert(!(boot.head && boot.legacy), 'Boot from either a head or a legacy pointer')
+
+  return boot
+}
+
 function noop() {}
 
 function createAnchorCore(store, prologue, manifestData) {
@@ -1228,10 +1430,3 @@ function crashSoon(err) {
   })
   throw err
 }
-
-function batchToHead(b) {
-  return {
-    key: b.key,
-    length: b.start + b.length
-  }
-}