autobee 2.0.0-rc.9 → 2.0.0

package/index.js

@@ -14,16 +14,19 @@ const asserts = require('./lib/asserts.js')
 const boot = require('./lib/boot.js')
 const { resolveWeight, currentWeight } = require('./lib/witness.js')
 const encoding = require('./lib/encoding.js')
-const Reboot = require('./lib/reboot.js')
+const { LEGACY_OPLOG_VERSION } = require('./lib/constants.js')
+const FastForward = require('./lib/fast-forward.js')
 const System = require('./lib/system.js')
 const ApplyCalls = require('./lib/apply-calls.js')
 const topo = require('./lib/topo.js')
 const { ActiveWriters } = require('./lib/writers.js')
+const TrustedPeers = require('./lib/trusted.js')
+const ApplyView = require('./lib/apply-view.js')
 const UpdateChanges = require('./lib/updates.js')
+const migrations = require('./lib/migrations.js')
 
 const EMPTY_HEAD = { length: 0, key: null }
 const INTERRUPT = new Error('Apply interrupted')
-const MIN_FF_GAP = 32
 
 module.exports = class Autobee extends ReadyResource {
   constructor(store, key = null, handlers = {}) {
@@ -34,9 +37,16 @@ module.exports = class Autobee extends ReadyResource {
       key = null
     }
 
-    const { name = null, encrypted, encryptionKey, viewName = 'view' } = handlers
+    const {
+      name = null,
+      encrypted,
+      encryptionKey,
+      viewName = 'view',
+      bootstrapWeight = 2
+    } = handlers
 
     this.encrypted = encrypted === true || !!encryptionKey
+    this.bootstrapWeight = bootstrapWeight
 
     this.getSystemEncryption = this._getEncryptionProvider.bind(this, '_system')
     this.getViewEncryption = this._getEncryptionProvider.bind(this, viewName)
@@ -56,7 +66,8 @@ module.exports = class Autobee extends ReadyResource {
     this.discoveryKey = null
     this.id = null
     this.bootstrap = null
-    this.handlers = handlers
+    this._handlers = handlers
+    this.stats = { undos: 0, fastForwards: 0, drains: 0, applies: 0, appends: 0 }
 
     this.system = new System(this.store.namespace('system'), this.name, {
       getEncryptionProvider: this.getSystemEncryption,
@@ -65,7 +76,7 @@ module.exports = class Autobee extends ReadyResource {
     this.system.auto = this
 
     this.bee = bee.snapshot()
-    this.view = handlers.open ? handlers.open(this.bee, this) : this.bee
+    this.view = ApplyView.open(this.bee, this)
     this.optimistic = handlers.optimistic !== false // TODO: should default to false instead
 
     this.name = name // for debugging
@@ -76,23 +87,36 @@ module.exports = class Autobee extends ReadyResource {
     this.writers = null
     this.bumping = 0
 
-    // system head to boot from: migrates or fast-forwards depending on its version
-    this.bootFrom = handlers.bootFrom || null
+    // fastForward: false disables all fast-forwards - both wakeup and boot
+    const fastForward = handlers.fastForward === false ? null : handlers.fastForward || {}
+
+    this._ffEnabled = fastForward !== null
+
+    // oplog head to boot from: migrates or fast-forwards depending on its version
+    this.bootFrom = (fastForward && fastForward.boot) || null
+
+    // conservative (default on): only fast-forward onto a head someone can serve whole
+    this._conservativeFF = !fastForward || fastForward.conservative !== false
 
-    this.reboot = null
-    this.rebooting = null
-    this.rebootTo = null
+    this.trusted = new TrustedPeers(handlers)
+
+    this.ff = null
+    this.fastForwarding = null
+    this.fastForwardTo = null
 
     this._workingBee = bee
-    this._workingView = handlers.open ? handlers.open(this._workingBee, this) : this._workingBee
+    this._workingView = new ApplyView(this._workingBee, this)
 
     this._localSystemStart = 0
     this._localSystemLength = 0
+    this._localFlushes = 0
     this._localViewStart = 0
     this._localViewLength = 0
 
     this._appending = []
     this._draining = null
+    this._updating = null
+    this._bootWait = null
 
     this.legacyViews = handlers.legacyViews || []
 
@@ -100,13 +124,16 @@ module.exports = class Autobee extends ReadyResource {
     this._bootingState = null
     this._bootingAll = null
 
-    this._handlers = handlers
     this._now = handlers.now || Date.now // overridable for clock-drift tests
+    this._preapply = handlers.preapply || null
+    this._preApplied = false
     this._hasApply = !!handlers.apply
     this._hasUpdate = !!handlers.update
     this._needsUpdate = false
-    this._ackRequired = false
-    this._ackedHeads = new Map()
+    this._approvalCheck = true
+    this._approvedPending = new Map()
+    this._approvalRequests = []
+    this._prefetchingApprovals = false
     this._updateLocalCore = null
     this._host = new ApplyCalls(this)
     this._notifyHandler = null
@@ -122,6 +149,7 @@ module.exports = class Autobee extends ReadyResource {
     this.previousDrain = 0
 
     this._catchupMigratedNodes = null
+    this._migratedHead = null
 
     this.ready().catch(noop)
   }
@@ -149,6 +177,10 @@ module.exports = class Autobee extends ReadyResource {
     return this.system.flushes
   }
 
+  get busy() {
+    return !!(this._draining || this._updating)
+  }
+
   async _open() {
     await this._preBoot()
 
@@ -159,14 +191,21 @@ module.exports = class Autobee extends ReadyResource {
     this._bootingAll.catch(safetyCatch)
 
     await this.bee.ready()
+    await this._workingBee.ready()
     await this._bootingState
 
     this._localSystemStart = this.system.bee.context.local.length
     this._localViewStart = this._workingBee.context.local.length
+    this._localFlushes = this.system.flushes
 
     this.bumpSoon()
   }
 
+  _requestWakeup() {
+    const session = this._wakeup._session
+    if (session) session.broadcastLookup()
+  }
+
   _registerWakeup() {
     if (!this.wakeupCapability) return
     this._wakeup.recouple()
@@ -211,6 +250,8 @@ module.exports = class Autobee extends ReadyResource {
 
   async _close() {
     this._interrupting = true
+    Hypercore.destroyRequests(this._approvalRequests, null)
+    if (this._bootWait !== null) this._bootWait.resolve()
     if (this._notifyHandler) this._notifyHandler.destroy()
     if (this._draining) {
       // drain may be waiting on replicated blocks
@@ -218,19 +259,21 @@ module.exports = class Autobee extends ReadyResource {
       await this._draining
     }
 
+    if (this._updating) await this._updating
+
     // let in-flight writer adds finish
     try {
       await this._bootingAll
     } catch {}
 
-    if (this._handlers.close) await this._handlers.close(this.view)
+    await ApplyView.close(this.view, this)
 
     if (this.writers) await this.writers.close()
     await this.local.close()
     await this.system.close()
     await this._wakeup.close()
     if (this.bootstrap && !this.bootstrap.closed) await this.bootstrap.close()
-    await this._workingBee.close()
+    await this._workingView.close()
     await this.bee.close()
     await this.store.close()
   }
@@ -242,25 +285,8 @@ module.exports = class Autobee extends ReadyResource {
         session.clearRequests(session.activeRequests, closingError)
       }
     }
-  }
-
-  async changesFrom({ system } = {}) {
-    const info = await this.system.getInfo()
-
-    const current = {
-      flushes: info ? info.flushes : 0,
-      system: this.system.bee.head(),
-      view: info ? info.view : EMPTY_HEAD
-    }
 
-    // no common ancestor (null) -> flushes -1 never matches, forcing a full diff
-    const shared = (await this.system.commonAncestor(system || EMPTY_HEAD)) || {
-      flushes: -1,
-      system: EMPTY_HEAD,
-      view: EMPTY_HEAD
-    }
-
-    return UpdateChanges.from(shared, current)
+    if (this.fastForwarding) this.fastForwarding.clearRequests(closingError)
   }
 
   replicate(...args) {
@@ -277,6 +303,14 @@ module.exports = class Autobee extends ReadyResource {
     this._wakeup.hint(wakeup)
   }
 
+  // the view an oplog head points at, opened and closed through the handlers
+  openViewAt(oplog) {
+    const v = oplog.op.views.view
+    if (!v) return null
+
+    return new ApplyView(this.bee.checkout({ key: v.key, length: v.start + v.length }), this)
+  }
+
   openCore(key) {
     const encryption = this.encryptionKey ? new WriterEncryption(this) : null
     return this.store.get({ key, encryption })
@@ -302,7 +336,7 @@ module.exports = class Autobee extends ReadyResource {
     }
 
     if (this.bootFrom) {
-      this.bootFrom = (await this.bootFrom) || null
+      this.bootFrom = getBootOption(await this.bootFrom)
     }
   }
 
@@ -354,7 +388,6 @@ module.exports = class Autobee extends ReadyResource {
     }
 
     this.local.setEncryption(this._getEncryptionProvider())
-    this.local.setActive(true)
 
     this.writers = new ActiveWriters(this)
 
@@ -380,15 +413,26 @@ module.exports = class Autobee extends ReadyResource {
 
     await this.system.boot(system)
 
-    // Use the view position from the system info (authoritative, post-processing)
-    // rather than from the oplog (stale, captured at append time before _bump)
-    let view = this.system.view || EMPTY_HEAD
+    const migrated = await this.local.getUserData('autobee/migrated-head')
+    if (migrated) this._migratedHead = encoding.decodeMigratedHead(migrated)
+
+    let view = this.system.view
+    if (!view) view = (this._migratedHead && this._migratedHead.view) || EMPTY_HEAD
 
     // @todo migration
     if (result.migration) {
-      if (this.handlers.migrate) {
-        view = (await this.handlers.migrate(result.migration.views)) || EMPTY_HEAD
+      if (this._handlers.migrate) {
+        view =
+          (await this._handlers.migrate(result.migration.views, result.migration.system)) ||
+          EMPTY_HEAD
         this._catchupMigratedNodes = result.migration.catchup
+
+        this._migratedHead = {
+          system: result.migration.system,
+          view: view.length ? view : (this._migratedHead && this._migratedHead.view) || null
+        }
+
+        await this._storeMigratedHead()
       }
 
       // ff boot invalidated by migration
@@ -405,6 +449,11 @@ module.exports = class Autobee extends ReadyResource {
       }
     }
 
+    // since we are doing this DURING the hyperbee2 boot we need to ready the core
+    // be good if we had better plumbing for it
+    await this._workingBee.core.ready()
+    await this.bee.core.ready()
+
     this._workingBee.move(view)
     this.bee.move(view)
 
@@ -414,10 +463,14 @@ module.exports = class Autobee extends ReadyResource {
   async _bootAll() {
     if (!(await this._bootReady())) return
 
-    for await (const node of this.system.list()) {
-      if (node.isAnchor) continue
-      await this.writers.add(node.key)
+    for (const head of this.system.heads) {
+      await this.writers.add(head.key)
+    }
+
+    if (!this.system.heads.length) {
+      await this.writers.add(this.bootstrap.key)
     }
+
     await this._bump()
   }
 
@@ -428,7 +481,7 @@ module.exports = class Autobee extends ReadyResource {
   async _bump() {
     if (!(await this._bootReady())) return
 
-    await this._flushWakeup()
+    if (this._bootWait !== null) this._bootWait.resolve()
 
     this.bumping++
 
@@ -483,18 +536,30 @@ module.exports = class Autobee extends ReadyResource {
     this.emit('error', err)
   }
 
+  // one-shot user gate: nothing applies until the host has resolved whatever
+  // state apply depends on (e.g. legacy views recorded by a migration)
+  async _runPreApply() {
+    if (this._preapply === null || this._preApplied) return
+
+    this._preApplied = true
+    await this._preapply(this.view)
+  }
+
   async _drain() {
     if (this._updating) await this._updating
 
+    await this._runPreApply()
+
+    this.stats.drains++
+
     if (this.bootFrom) {
-      await this._initFromHead(this.bootFrom)
-      this.bootFrom = null
-    }
+      const { head = null, legacy = null, bootCondition = null, wait = false } = this.bootFrom
 
-    // tracked across drain iteration
-    this.system.shared = null
+      this.bootFrom = null
 
-    this._ackRequired = false
+      if (legacy) await this._bootFromSystem(legacy)
+      else if (head) await this._bootFromHead(head, bootCondition, wait)
+    }
 
     const changes = this._hasUpdate ? new UpdateChanges(this) : null
     if (changes) changes.track()
@@ -510,21 +575,21 @@ module.exports = class Autobee extends ReadyResource {
 
       try {
         while (!this._interrupting) {
-          if (this.rebootTo !== null) {
-            await this._applyReboot()
-            break // revaluate conditions...
-          }
+          await this._flushWakeup()
+          if (this._interrupting) break
 
-          if (await this._bumpPendingWriters()) {
-            this._needsUpdate = true
-            continue
+          if (this.fastForwardTo !== null) {
+            await this._applyFastForward()
+            break // revaluate conditions...
           }
 
-          if (!this._appendAck()) break
+          if (!(await this._bumpPendingWriters())) break
           this._needsUpdate = true
         }
 
         await this._flushLocal()
+
+        if (!this._interrupting) await this.writers.refresh()
       } finally {
         if (this.bumping === 1) this.bumping = 0
         else this.bumping = 1
@@ -534,16 +599,15 @@ module.exports = class Autobee extends ReadyResource {
     this._draining = null
     if (this._interrupting) return
 
-    if (this._needsUpdate) {
-      const updating = rrp()
-      this._updating = updating.promise
+    const updating = rrp()
+    this._updating = updating.promise
 
-      try {
-        await this._update(changes)
-      } finally {
-        this._updating = null
-        updating.resolve()
-      }
+    try {
+      if (this._needsUpdate) await this._update(changes)
+      await this._storeBoot()
+    } finally {
+      this._updating = null
+      updating.resolve()
     }
   }
 
@@ -576,87 +640,149 @@ module.exports = class Autobee extends ReadyResource {
     }
   }
 
-  async _flushWakeup() {
+  // wakeup hints keep arriving asynchronously
+  async _applyWakeupHints() {
     const hints = this._wakeup.flush()
+    if (!hints.size) return []
 
     this.previousDrain = Date.now()
-    this.rebootFromHeads(hints).catch(noop)
+    const results = await this._filterHints(hints)
+
+    for (const { key, length } of results) {
+      // wakeup() itself no-ops the add for an already-active writer, but still
+      // needs to run so it can hint() the announced length - skipping it here
+      // for active writers left gc with no hint to protect them
+      await this.writers.wakeup(key, length)
+    }
+
+    return results
+  }
 
+  async _filterHints(hints) {
+    const results = []
+    const promises = []
     for (const [hex, length] of hints) {
       const key = b4a.from(hex, 'hex')
-      if (this.writers.has(hex)) continue
-      await this.writers.wakeup(key, length)
+      promises.push(this._filterTracked(key, length, results))
     }
+    await Promise.all(promises)
+    return results
   }
 
-  async _getOplog(key, length, opts = null) {
-    const core = this.openCore(key)
+  async _filterTracked(key, length, results) {
+    if (length) {
+      const info = await this.system.get(key)
+      // if we've seen this already, ignore
+      if (info && info.length >= length) return
+    }
+    results.push({ key, length })
+  }
+
+  async _flushWakeup() {
+    const hints = await this._applyWakeupHints()
+    if (!hints.length) return
+
+    if (!this._ffEnabled) return
+
+    // a scheduled fast-forward is applied by the drain before we look again
+    if (this.fastForwardTo !== null || this.fastForwarding !== null) return
+    if (this._interrupting || this.closing || this.bootFrom) return
 
     try {
-      await core.ready()
+      const heads = await this._readCandidateHeads(hints, FastForward.DEFAULT_TIMEOUT)
 
-      const target = length >= 0 ? length : core.length
-      if (target === 0) return null
+      const ff = await FastForward.fromHeads(this, heads, {
+        timeout: FastForward.DEFAULT_TIMEOUT
+      })
 
-      const buf = await core.get(target - 1, opts)
-      if (buf === null) return null
+      if (ff !== null) await this._runFastForward(ff)
+    } catch (err) {
+      safetyCatch(err)
+    }
+  }
 
-      let op = encoding.decodeOplog(buf)
+  async _readCandidateHeads(hints, timeout) {
+    const promises = []
 
-      // legacy nodes always inflate, but only indexers carry views - callers
-      // that need system info must check op.views
-      if (op.version < 3) {
-        op = await this._inflateLegacyOplog(buf, core, target - 1, opts)
-      }
+    for (const { key, length } of hints) {
+      if (length === 0) continue
+      promises.push(this._resolveOplogHint(key, length, timeout ? { timeout } : null))
+    }
+
+    const ops = await Promise.all(promises)
+    const heads = []
+
+    for (const res of ops) {
+      if (res === null) continue
+
+      // the head we were woken on is a candidate in its own right
+      heads.push({ key: res.key, length: res.length })
 
-      return {
-        key,
-        length: target,
-        op
+      if (!res.op.trusted) continue
+
+      for (const trusted of res.op.trusted) {
+        const head = this.trusted.read(trusted)
+        if (head !== null) heads.push(head)
       }
+    }
+
+    return heads
+  }
+
+  async _resolveOplogHint(key, length, opts) {
+    const core = this.openCore(key)
+
+    try {
+      await core.ready()
+      const max = Math.max(length, core.length)
+
+      const block = await this.readOplog(core, max, opts)
+      if (max >= core.length) return block // best one
+
+      return await this.readOplog(core, core.length, opts)
     } finally {
       await core.close()
     }
   }
 
-  async _inflateLegacyOplog(buf, core, seq, opts = null) {
-    const m = encoding.decodeRawOplog(buf)
+  async _getOplog(key, length, opts = null) {
+    const core = this.openCore(key)
 
-    const op = {
-      version: m.version,
-      timestamp: 0,
-      links: m.node.heads,
-      batch: { start: 0, end: m.node.batch - 1 },
-      views: null,
-      optimistic: !!m.optimistic,
-      value: m.node.value
+    try {
+      return await this.readOplog(core, length, opts)
+    } finally {
+      await core.close()
     }
+  }
+
+  // reads on a core the caller owns, so a walk does not churn a session per step
+  async readOplog(core, length, opts = null) {
+    await core.ready()
 
-    if (m.digest === null || m.checkpoint === null) return op
+    const { conservative = false, timeout } = opts === null ? {} : opts
 
-    const fetches = []
+    const target = length >= 0 ? length : core.length
+    if (target === 0) return null
 
-    fetches.push(m.digest.pointer ? core.get(seq - m.digest.pointer, opts) : buf)
-    fetches.push(
-      m.checkpoint.pointer ? core.get(seq - m.checkpoint.system.checkpointer, opts) : buf
-    )
+    // conservative: only proceed when a connected peer can serve the head whole
+    if (conservative && core.remoteContiguousLength < target) return null
 
-    const [digestNode, checkpointNode] = await Promise.all(fetches)
-    // a wait: false get we could not satisfy locally
-    if (digestNode === null || checkpointNode === null) return op
+    const buf = await core.get(target - 1, { timeout })
+    if (buf === null) return null
 
-    const { digest } = encoding.decodeRawOplog(digestNode)
-    const { checkpoint } = encoding.decodeRawOplog(checkpointNode)
+    let op = encoding.decodeOplog(buf)
 
-    op.views = {
-      system: {
-        key: digest.key,
-        length: checkpoint.system.checkpoint.length
-      },
-      flushes: seq
+    // legacy nodes always inflate, but only indexers carry views - callers
+    // that need system info must check op.views
+    if (op.version < 3) {
+      op = await migrations.inflateLegacyOplog(buf, core, target - 1, timeout)
     }
 
-    return op
+    return {
+      key: core.key,
+      length: target,
+      op
+    }
   }
 
   async _update(changes) {
@@ -716,7 +842,7 @@ module.exports = class Autobee extends ReadyResource {
     await this.bootstrap.setUserData('autobee/local', this.local.key)
     await oldLocal.close()
 
-    // done, soft reboot
+    // done, soft restart
     this.emit('rotate-local-writer')
   }
 
@@ -780,86 +906,152 @@ module.exports = class Autobee extends ReadyResource {
   }
 
   async _bumpMigratedWriters() {
+    const opened = new Set()
+    let updated = false
+
     for (const batch of this._catchupMigratedNodes) {
       await this._processBatch(batch)
+      updated = true
+      for (const node of batch) {
+        if (node.from) opened.add(node.from)
+      }
     }
-  }
 
-  // append a null value node to ack writer
-  _appendAck() {
-    if (!this._ackRequired) return false
-    if (!this.writers.writable) return false
+    for (const core of opened) await core.close()
+    return updated
+  }
 
-    if (this.writers.localWriter.pending !== null) return false
+  async _prefetchApprovals() {
+    if (this._prefetchingApprovals) return
+    this._prefetchingApprovals = true
 
-    const links = this.system.getLinks(this.local.key)
-    const t = Math.max(this._now(), this.system.timestamp)
+    const activeRequests = this._approvalRequests
 
-    let unlinked = false
-    for (const { key, length } of links) {
-      const hex = b4a.toString(key, 'hex')
-      const acked = this._ackedHeads.get(hex) || 0
-      if (length > acked) {
-        unlinked = true
-        break
+    try {
+      const prefetch = []
+      const standing = await this._standing(activeRequests)
+      if (standing <= 0 || !this._pendingWork(standing)) return
+      for await (const p of this._servableRequests(standing, activeRequests)) {
+        prefetch.push(this.system.get(p.key, { activeRequests }).catch(safetyCatch))
+        prefetch.push(this.system.grantHint(p.key, { activeRequests }).catch(safetyCatch))
       }
+      await Promise.allSettled(prefetch)
+    } finally {
+      this._prefetchingApprovals = false
     }
-    if (!unlinked) {
-      this._ackRequired = false
-      return false
-    }
+  }
+
+  async _standing(activeRequests) {
+    const rec = await this.system.get(this.local.key, { activeRequests })
+    return currentWeight(rec)
+  }
 
-    for (const { key, length } of links) {
-      this._ackedHeads.set(b4a.toString(key, 'hex'), length)
+  // only our own tiers: a request whose lower tiers are already anchored is
+  // somebody stronger's job, and must not keep every peer at this standing
+  // rescanning (or offering) while it waits
+  _pendingWork(standing) {
+    const digest = this.system.promotions.digest
+    const end = Math.min(standing, digest.length)
+    for (let w = 1; w <= end; w++) {
+      if (digest[w - 1]) return true
     }
+    return false
+  }
 
-    this.writers.appendLocal(null, t, { start: 0, end: 0 }, links, false, null)
-    this._ackRequired = false
-    return true
+  // the requests we could serve and by how much - shared by the prefetch and
+  // the collector so the two cannot drift on what counts as ours
+  async *_servableRequests(standing, activeRequests) {
+    for await (const p of this.system.listPendingPromotions({ activeRequests })) {
+      const amount = Math.min(standing, p.weight)
+      if (amount <= 0) continue
+      yield { key: p.key, amount }
+    }
   }
 
-  async _bumpPendingWriters() {
-    if (this._catchupMigratedNodes !== null) {
-      await this._bumpMigratedWriters()
-      this._catchupMigratedNodes = null
+  async _collectApprovals() {
+    if (!this.system.promotions.changed && !this._approvalCheck) return null
+    if (!this.writers.writable) return null
+
+    const activeRequests = this._approvalRequests
+    const standing = await this._standing(activeRequests)
+    if (standing <= 0) return null
+
+    this.system.promotions.changed = false
+    this._approvalCheck = false
+
+    if (!this._pendingWork(standing)) return null
+
+    const approvals = []
+    const approving = []
+
+    for await (const p of this._servableRequests(standing, activeRequests)) {
+      approving.push(fetchApproval.call(this, p.key, p.amount, approvals))
     }
 
-    let updated = false
+    if (!approving.length) return null
 
-    const pending = this.writers.pending.slice()
+    try {
+      await Promise.all(approving)
+    } catch (err) {
+      if (this._interrupting) return null
+      throw err
+    }
 
-    for (let i = pending.length - 1; i >= 0; i--) {
-      const w = pending[i]
+    if (!approvals.length) return null
 
-      const batch = await w.next()
-      if (batch === null) continue
+    for (const a of approvals) {
+      this._approvedPending.set(b4a.toString(a.key, 'hex'), a.weight)
+    }
 
-      if (w.isAdded || (w.isRemoved && w.hasReferrals())) {
-        await this._processBatch(batch)
-        w.notify(batch)
-        updated = true
-        continue
-      }
+    return approvals
 
-      if (this.optimistic && !w.isRemoved && batch[0].optimistic) {
-        if (!(await this._optimisticBatch(batch))) {
-          w.removePending()
-          continue
-        }
-        w.notify(batch)
-        updated = true
-        continue
+    async function fetchApproval(key, weight, approvals) {
+      const hex = b4a.toString(key, 'hex')
+      if ((this._approvedPending.get(hex) || 0) >= weight) return
+      const [target, hint] = await Promise.all([
+        this.system.get(key, { activeRequests }),
+        this.system.grantHint(key, { activeRequests })
+      ])
+      if (!target || target.isRemoved) return
+      if (hint && hint.weight >= weight) return
+      approvals.push({ key, weight })
+    }
+  }
+
+  async _bumpPendingWriters({ local = false } = {}) {
+    if (!local && this._catchupMigratedNodes !== null) {
+      const updated = await this._bumpMigratedWriters()
+      this._catchupMigratedNodes = null
+      if (updated) return true
+    }
+
+    // apply the best next node to keep the prefix stable
+    const next = await this.writers.nextPendingNode({ local })
+    if (next === null) return false
+
+    const { writer: w, batch } = next
+
+    if (w.isAdded || (w.isRemoved && w.hasReferrals())) {
+      await this._processBatch(batch)
+      w.notify(batch)
+      return true
+    }
+
+    if (this.optimistic && !w.isRemoved && batch[0].optimistic) {
+      if (!(await this._optimisticBatch(batch))) {
+        w.removePending()
+        return true
       }
+      w.notify(batch)
+      return true
     }
 
-    return updated
+    return true
   }
 
   async _optimisticBatch(batch) {
     const rollbackSystem = this.system.bee.head()
     const rollbackView = this._workingBee.head()
-    const rollbackShared = this.system.shared
-    const rollbackAttestations = this.writers.attestations.length
 
     const t = await this.prepareBatch(batch)
     if (t.view) this._workingBee.move(t.view)
@@ -881,9 +1073,6 @@ module.exports = class Autobee extends ReadyResource {
         this._workingBee.move(rollbackView)
         this.system.bee.move(rollbackSystem)
         await this.system.reset()
-        this.system.shared = rollbackShared
-        // don't attest grants that were just undone
-        this.writers.attestations.length = rollbackAttestations
         return false
       }
     }
@@ -904,7 +1093,12 @@ module.exports = class Autobee extends ReadyResource {
     const t = await topo.sort(this, batch)
 
     if (t.undo) {
+      this.stats.undos++
+      this.trusted.clear()
       t.view = await this.system.undo(t.undo)
+      if (!t.view.length && this._migratedHead && this._migratedHead.view) {
+        t.view = this._migratedHead.view
+      }
     }
 
     return t
@@ -924,7 +1118,7 @@ module.exports = class Autobee extends ReadyResource {
       }
 
       if (b4a.equals(batch[0].key, this.key) && batch[0].length === 1) {
-        await this._host.addWriter(batch[0].key)
+        await this._host.addWriter(batch[0].key, { weight: this.bootstrapWeight })
       }
 
       await this._applyBatch(batch, batch[0].optimistic)
@@ -947,33 +1141,39 @@ module.exports = class Autobee extends ReadyResource {
     for (const node of batch) {
       this.system.addNode(node)
 
+      if (node.approvals) {
+        for (const a of node.approvals) {
+          await this.system.addWriter(a.key, {
+            weight: a.weight,
+            coord: { key: node.key, length: node.length },
+            carrier: node.weight,
+            anchor: true
+          })
+        }
+      }
+
       // compat: autobase nodes may be null (legacy null decodes to 0-length buffer)
       if (node.value && node.value.length) userBatch.push(node)
     }
 
     if (this._hasApply && (await this.system.canApply(batch[0].key, optimistic))) {
+      this.stats.applies++
       this._host.applying = batch
-      await this._handlers.apply(userBatch, this._workingView, this._host)
+      await this._workingView.apply(userBatch)
       this._host.applying = null
     }
 
-    const { changed, witnessed } = await this.system.flush(batch, this._workingBee)
+    const changed = await this.system.flush(batch, this._workingBee)
+
+    if (this.system.promotions.changed) this._prefetchApprovals().catch(safetyCatch)
 
     if (local) {
       this._localSystemLength = this.system.bee.context.local.length - this._localSystemStart
       this._localViewLength = this._workingBee.context.local.length - this._localViewStart
+      this._localFlushes = this.system.flushes
     }
 
-    this.writers.attest(witnessed)
-
-    await this._storeBoot()
-
-    for (const { key, added, isAnchor } of changed) {
-      if (isAnchor) {
-        // no Writer/ActiveWriters tracking, but still wake anything linked to it
-        this.writers.triggers.trigger(b4a.toString(key, 'hex'), 1)
-        continue
-      }
+    for (const { key, added } of changed) {
       if (added) await this.writers.add(key)
       else await this.writers.remove(key)
     }
@@ -996,6 +1196,11 @@ module.exports = class Autobee extends ReadyResource {
     return Promise.all(proms)
   }
 
+  _storeMigratedHead() {
+    const value = this._migratedHead ? encoding.encodeMigratedHead(this._migratedHead) : null
+    return this.local.setUserData('autobee/migrated-head', value)
+  }
+
   static decodeValue(buf, opts) {
     return encoding.decodeValue(buf, opts)
   }
@@ -1013,6 +1218,8 @@ module.exports = class Autobee extends ReadyResource {
   async append(values, { optimistic = false } = {}) {
     if (this.closing) throw new Error('Autobee closed')
 
+    this.stats.appends++
+
     if (!Array.isArray(values)) values = [values]
 
     if (!this.opened) await this.ready()
@@ -1029,27 +1236,17 @@ module.exports = class Autobee extends ReadyResource {
     const t = Math.max(this._now(), this.system.timestamp)
     const batch = []
 
-    // witnesses only ride upgrade windows. witness.weight is the value the backer's
-    // snapshot witnesses - verifiers recompute the same read and verify
     const rec = await this.system.get(this.local.key)
     let witness = null
-    if (rec && rec.maxWeight > currentWeight(rec)) {
-      const sorted = this.writers.witnesses.sort(
-        (a, b) => b.attestation.weight - a.attestation.weight
-      )
-
-      for (const { key, length, attestation, manifest } of sorted) {
-        if (attestation.weight > rec.maxWeight) continue
-
-        const backer = await this.system.get(key)
-        if (!backer || backer.isRemoved || backer.length < length) continue
-
-        const { weight, signature } = attestation
-        witness = { weight, backer: { key, length, signature, manifest } }
-        break
+    if (rec) {
+      const hint = await this.system.grantHint(this.local.key)
+      if (hint && hint.weight > currentWeight(rec)) {
+        witness = { weight: hint.weight, link: { key: hint.key, length: hint.length } }
       }
     }
 
+    const approvals = optimistic ? null : await this._collectApprovals()
+
     for (let i = 0; i < values.length; i++) {
       const value = values[i]
       const buffer = typeof value === 'string' ? b4a.from(value) : value
@@ -1060,7 +1257,8 @@ module.exports = class Autobee extends ReadyResource {
         { start: i, end: values.length - 1 - i },
         lnk,
         optimistic,
-        i === 0 ? witness : null
+        i === 0 ? witness : null,
+        i === 0 ? approvals : null
       )
       batch.push(node)
     }
@@ -1069,8 +1267,13 @@ module.exports = class Autobee extends ReadyResource {
   }
 
   async _flushLocal() {
+    // pull any available local nodes in before flushing
+    while (!this._interrupting && (await this._bumpPendingWriters({ local: true }))) {
+      this._needsUpdate = true
+    }
+
     await this.writers.flushLocal({
-      flushes: this.system.flushes,
+      flushes: this._localFlushes,
       system: {
         key: this.system.bee.context.local.key,
         start: this._localSystemStart,
@@ -1085,135 +1288,166 @@ module.exports = class Autobee extends ReadyResource {
 
     this._localSystemStart = this.system.bee.context.local.length
     this._localSystemLength = 0
+    this._localFlushes = this.system.flushes
     this._localViewStart = this._workingBee.context.local.length
     this._localViewLength = 0
   }
 
-  async rebootFromHeads(hints, { force = false } = {}) {
-    if (!this._handlers.onwakeup) return false
-    if (this._interrupting) return false
-    if (!hints.size || this.rebooting || this.rebootTo || this.bootFrom) {
-      return false
-    }
-
-    const promises = []
-    const heads = []
-    for (const [hex, length] of hints) {
-      if (length === 0) continue
-      const key = b4a.from(hex, 'hex')
-      heads.push({ key, length })
-      promises.push(this._getOplog(key, length))
-    }
+  async moveTo(head) {
+    if (!this.opened) await this.ready()
+    if (this.closing) throw new Error('Autobee closed')
 
-    const ops = await Promise.all(promises)
-    if (this.rebooting || this.rebootTo) return false
+    const ff = await FastForward.fromHead(this, head, null, { force: true })
+    if (ff === null) return null
 
-    let best = null
-    let bestFlushes = -1
+    if (!(await this._runFastForward(ff))) return null
 
-    for (let i = 0; i < ops.length; i++) {
-      const res = ops[i]
-      if (res === null) continue
+    return this.ff.promise
+  }
 
-      if (res.op.views && res.op.views.flushes > bestFlushes) {
-        bestFlushes = res.op.views.flushes
-        best = res
-      }
+  // legacy: ungated boot straight onto a system head
+  async _bootFromSystem(system) {
+    try {
+      const ff = new FastForward(this, system, { timeout: FastForward.DEFAULT_TIMEOUT })
+      return await this._runFastForward(ff)
+    } catch (err) {
+      safetyCatch(err)
+      return false
     }
+  }
 
-    if (best && force) {
-      return this._rebootFromHead(best, null, { force: true })
+  // the boot head seeds the view every trust decision here is made against,
+  // since our own view is still empty
+  async _bootFromHead(head, bootCondition, wait = false) {
+    // just a head: one attempt, we do not wait around if it cannot be read
+    if (bootCondition === null && !wait) {
+      try {
+        const ff = await FastForward.fromHead(this, head, null, {
+          force: true,
+          timeout: FastForward.DEFAULT_TIMEOUT
+        })
+
+        return ff !== null && (await this._runFastForward(ff))
+      } catch (err) {
+        safetyCatch(err)
+        return false
+      }
     }
 
-    if (best === null || bestFlushes - this.system.flushes < MIN_FF_GAP) return false
+    // park until the head can be read and, if a condition is set, something
+    // acceptable turns up
+    let opened = null
 
-    const head = { key: best.key, length: best.length }
+    try {
+      while (!this._interrupting) {
+        this._bootWait = rrp()
+
+        try {
+          if (bootCondition === null) {
+            const ff = await FastForward.fromHead(this, head, null, {
+              force: true,
+              timeout: FastForward.DEFAULT_TIMEOUT
+            })
+
+            if (ff !== null && (await this._runFastForward(ff))) return true
+          } else {
+            if (opened === null) opened = await this._bootReference(head)
+
+            if (opened !== null) {
+              if (await this._bootAttempt(head, bootCondition, opened.view)) {
+                return true
+              }
+
+              // the reference may be stale - resolve it afresh next attempt
+              await opened.close()
+              opened = null
+            } else if (await this._bootLegacyHead(head)) {
+              // boot legacy head through the migration pathway
+              return true
+            }
+          }
+        } catch (err) {
+          safetyCatch(err)
+        }
 
-    const v = best.op.views.view
-    const view = this.bee.checkout({ key: v.key, length: v.start + v.length })
+        if (this._interrupting) break
 
-    let trusted = null
-    try {
-      trusted = await this._handlers.onwakeup(head, view, this)
-      if (!trusted || this.rebooting || this.rebootTo) return false
+        await this._bootWait.promise
+      }
     } finally {
-      view.close()
+      this._bootWait = null
+      if (opened !== null) await opened.close()
     }
 
-    return this._rebootFromHead(best, trusted)
+    return false
   }
 
-  async _rebootFromHead(head, trusted, { force = false, wait = true } = {}) {
-    const oplog = await this._getOplog(head.key, head.length)
-    if (!oplog) return null
+  async _bootAttempt(head, bootCondition, reference) {
+    // peek, so the hints are still there for the drain once we have booted
+    const result = await this._filterHints(this._wakeup.hints)
 
-    const verified = trusted ? await this._getOplog(trusted.key, trusted.length) : oplog
-    if (!verified) return null
+    const candidates = await this._readCandidateHeads(result, FastForward.DEFAULT_TIMEOUT)
 
-    // legacy nodes from non-indexers have no system info to reboot from
-    if (!oplog.op.views || !verified.op.views) return null
+    const ff = await FastForward.fromHeads(this, [head, ...candidates], {
+      force: true,
+      timeout: FastForward.DEFAULT_TIMEOUT,
+      condition: bootCondition,
+      reference
+    })
 
-    if (!force && verified.op.views.flushes - this.system.flushes < MIN_FF_GAP) {
-      return null
-    }
+    return ff !== null && (await this._runFastForward(ff))
+  }
 
-    const moved = await this._moveTo(batchToHead(verified.op.views.system), {
-      system: batchToHead(oplog.op.views.system),
-      verified: {
-        op: trusted || head,
-        flushes: verified.op.views.flushes
-      }
+  async _bootLegacyHead(head) {
+    const oplog = await FastForward.flushHead(this, head, {
+      timeout: FastForward.DEFAULT_TIMEOUT
     })
+    if (oplog === null || oplog.op.version > LEGACY_OPLOG_VERSION) return false
 
-    if (moved && wait) return this.reboot.promise
+    const ff = await FastForward.fromHead(this, head, null, {
+      force: true,
+      timeout: FastForward.DEFAULT_TIMEOUT
+    })
 
-    return null
+    return ff !== null && (await this._runFastForward(ff))
   }
 
-  // same as moveTo except we don't return the final promise
-  _initFromHead(head, tip) {
-    if (!head.length) {
-      // legacy fastForward boot
-      return this._runReboot(new Reboot(this, head, tip))
-    }
+  async _bootReference(head) {
+    const oplog = await FastForward.flushHead(this, head, {
+      timeout: FastForward.DEFAULT_TIMEOUT
+    })
 
-    return this._rebootFromHead(head, null, { force: true, wait: false })
+    return oplog === null ? null : this.openViewAt(oplog)
   }
 
-  // head is a system head; reboots onto it, migrating in place if it's a legacy version
-  async _moveTo(systemHead, tip) {
-    if (this.rebootTo !== null || this.rebooting !== null) return false
-
-    if (await this._runReboot(new Reboot(this, systemHead, tip))) {
-      return true
+  async _runFastForward(ff) {
+    if (this.fastForwardTo !== null || this.fastForwarding !== null) {
+      await ff.close()
+      return false
     }
 
-    return false
-  }
-
-  async _runReboot(reboot) {
-    this.rebooting = reboot
+    this.fastForwarding = ff
 
-    const result = await reboot.run()
-    await reboot.close()
+    const result = await ff.run()
+    await ff.close()
 
-    if (this.rebooting === reboot) this.rebooting = null
+    if (this.fastForwarding === ff) this.fastForwarding = null
 
     if (!result) return false
 
-    this.rebootTo = result
-    this.reboot = rrp()
+    this.fastForwardTo = result
+    this.ff = rrp()
 
     this.bumpSoon()
 
     return true
   }
 
-  async _applyReboot() {
+  async _applyFastForward() {
     const changes = this._hasUpdate ? new UpdateChanges(this) : null
     if (changes) changes.track()
 
-    const { head, tip, migrate } = this.rebootTo
+    const { head, migrate } = this.fastForwardTo
 
     const from = this.system.bee.head()
     const to = head
@@ -1221,15 +1455,16 @@ module.exports = class Autobee extends ReadyResource {
     this.system.bee.move(head)
     await this.system.reset()
 
-    this.system.shared = this.rebootTo.shared || {
-      flushes: -1,
-      view: EMPTY_HEAD,
-      system: EMPTY_HEAD
-    }
-
     // migrate is set when fast-forwarding from a legacy head
     if (migrate) {
-      const view = (await this.handlers.migrate(migrate)) || EMPTY_HEAD
+      const view = (await this._handlers.migrate(migrate, head)) || EMPTY_HEAD
+
+      this._migratedHead = {
+        system: head,
+        view: view.length ? view : (this._migratedHead && this._migratedHead.view) || null
+      }
+
+      await this._storeMigratedHead()
       this.bee.move(view)
       this._workingBee.move(view)
     } else {
@@ -1237,34 +1472,22 @@ module.exports = class Autobee extends ReadyResource {
       this._workingBee.move(this.system.view)
     }
 
-    this.rebootTo = null
+    this._approvalCheck = true
+    this.fastForwardTo = null
+
+    // process any wakeup while fast-forward itself was in flight
+    await this._applyWakeupHints()
     await this.writers.refresh()
 
+    // we moved, so ask our peers to tell us their heads again
+    this._requestWakeup()
+
     await this._update(changes)
+    await this._storeBoot()
 
+    this.stats.fastForwards++
     this.emit('move-to', to, from)
-    this.reboot.resolve({ to, from })
-
-    // tip is null during boot
-    if (!tip) return
-
-    try {
-      await this._reapply(tip)
-    } catch (err) {
-      throw err
-    }
-  }
-
-  async _reapply({ system, verified }) {
-    const changes = this._hasUpdate ? new UpdateChanges(this) : null
-    if (changes) changes.track()
-
-    const sys = this.system.bee.checkout(system)
-    const t = await topo.rollback(this, sys, verified)
-    await sys.close()
-
-    await this.applyBacklog(t.tip)
-    return this._update(changes)
+    this.ff.resolve({ to, from })
   }
 
   replay() {
@@ -1276,6 +1499,17 @@ function isObject(o) {
   return typeof o === 'object' && o && !b4a.isBuffer(o)
 }
 
+function getBootOption(boot) {
+  if (!boot) return null
+
+  // oldest style, supported for now but will go away: a bare key is legacy
+  if (boot.key) return { legacy: boot, head: null, bootCondition: null }
+
+  asserts.assert(!(boot.head && boot.legacy), 'Boot from either a head or a legacy pointer')
+
+  return boot
+}
+
 function noop() {}
 
 function createAnchorCore(store, prologue, manifestData) {
@@ -1304,10 +1538,3 @@ function crashSoon(err) {
   })
   throw err
 }
-
-function batchToHead(b) {
-  return {
-    key: b.key,
-    length: b.start + b.length
-  }
-}