Module negentropy 

Shared NIP-77 negentropy set reconciliation.

One acquisition primitive for the whole app. DM and community sync differ only in their fingerprint source and processing; the reconcile-against-relays step is identical, so it lives here.

Functions

advance_reconcile_cursor

Monotonic advance — one SQL upsert (the stored value only grows), so a late or concurrent writer can never regress the cursor. Session-gated IMMEDIATELY before the write: a swap landing after the caller’s own check must not stamp this account’s cursor into the next account’s KV — that would both skew its quick window and silently skip its bootstrap.

classify_neg_sync_error

is_transient_sync_error

True when a relay.sync failure says nothing durable about the relay — connection-state errors and timeouts. Only deterministic refusals (protocol errors, query caps) repeat identically on a later attempt, so only those belong on a same-boot skip-list; a connected relay that timed out is handled through the capability cache instead.

neg_supported_cached

Cached NIP-77 verdict for a relay. None = unknown or stale — attempt negentropy and let the outcome refresh the cache.

reconcile_cursor

The relay’s reconcile cursor (unix seconds), if it has ever earned one.

reconcile_missing

Race every trusted relay exchanging negentropy fingerprints for filter, and return the union of event IDs that relays hold but we don’t.

record_neg_support

Persist a fresh verdict (value format: 0|1:<unix seconds>). Callers gate on a valid SessionGuard; the verdict is relay-global truth, so a raced write is wasted work rather than cross-account damage.

wait_connected

Interpret a relay.sync error. Some(false) = the relay cannot reconcile: either the SDK recognized the refusal outright, or a relay that was CONNECTED stayed silent past the initial timeout — healthy negentropy implementations answer the first frame in well under a second, so silence on a live connection is the no-implementation signature. A timeout on a relay that wasn’t connected is an outage and classifies as nothing. Wait briefly for a relay to reach Connected before a sync attempt. false = never connected inside the allowance — callers treat that as a TRANSIENT skip (no verdict, no skip-list, no cursor touch): an unreachable relay must cost the allowance, not a full negentropy initial_timeout. The Monitor-driven reconnect catch-up covers it the moment it truly connects.