fix(nip-rs): close C1/I2/I3 residuals — fence timeout, commit point, real-primitive tests

Residual 1 (C1 — fence establishment timeout):
- createFencedSubscription() gains an FENCED_ESTABLISHMENT_TIMEOUT_MS timer;
  a relay that never sends EOSE lapses the fence and resolves established so
  initialize() never hangs. Timeout never counts as establishment.
- Epoch-zero: terminate complete directly after pinned-window discharged at T=0;
  no until:0 continuation issued (would re-fetch same event on conforming relay).

Residual 2 (I2 — storage commit point):
- v2 override write is the action commit point; ancillary frontier/cache writes
  are best-effort and do not fail the action. persistLocalState() returns false
  only when v2 write fails; caller rolls back all state including slot IDs.
- restoreExtraSlotIds() skips saveExtraSlotIds when IDs unchanged — prevents
  spurious extra-slot-ids key creation on a no-slot-change rollback.

Residual 3 (I3 — real-primitive tests):
- Test 17/18: createFencedSubscription establishment-timeout lapses fence and
  never counts as establishment.
- Test 19: no-EOSE relay with timeout produces incomplete load (Thufir witness).
- Test 20: early-write-fails/v2-succeeds — action succeeds, restart agrees.
- Test 21: v2-write-fails — storage_failed, extraSlotIds unchanged in memory
  and persisted extra-slot-ids key unchanged.
- Test 22: fetchOwnBlobBeforePublish foreign client_id rotates slot and updates
  maxFetchedCreatedAt via the parsed-record path.
- Epoch-zero test (2g) uses inclusive-filter-conforming fixture.

Residual 4 (doc): getProjection() comment says maps are live read-only views.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

desktop/src/shared/api/relayClientShared.ts

@@ -120,14 +120,22 @@ export function buildFenceHandle(
   };
 }
 
+/**
+ * Millis to wait for EOSE after the REQ is sent.  If the relay keeps the
+ * socket alive but never sends this subscription's EOSE, the fence lapses and
+ * the load concludes `complete: false`.  Reconnect / `retryLoad` owns recovery.
+ * Must NEVER count as establishment.
+ */
+export const FENCED_ESTABLISHMENT_TIMEOUT_MS = 30_000;
+
 /**
  * Core of `RelayClient.subscribeFenced()` extracted for testability.
  *
  * Registers a fenced subscription, sends REQ, and returns a `FenceHandle`
  * whose `established` resolves ONLY on EOSE — never on a fallback timer or
- * CLOSED. Any lapse (generation mismatch, send failure, `resetConnection`)
- * sets `lapsed = true` and resolves `established` so no caller suspends
- * forever.
+ * CLOSED. Any lapse (generation mismatch, send failure, `resetConnection`,
+ * or establishment timeout) sets `lapsed = true` and resolves `established`
+ * so no caller suspends forever.
  */
 export async function createFencedSubscription(
   deps: {
@@ -135,6 +143,8 @@ export async function createFencedSubscription(
     subscriptions: Map<string, RelaySubscription>;
     sendReq: (subId: string, filter: RelaySubscriptionFilter) => Promise<void>;
     closeSub: (subId: string) => Promise<void>;
+    /** Override the establishment timeout (ms). Defaults to FENCED_ESTABLISHMENT_TIMEOUT_MS. */
+    establishmentTimeoutMs?: number;
   },
   filter: RelaySubscriptionFilter,
   onEvent: (event: RelayEvent) => void,
@@ -168,7 +178,42 @@ export async function createFencedSubscription(
   }
   if (deps.connectionGeneration() !== generation || fencedSub.lapsed)
     return lapseAndReturn();
+
+  // ── Establishment timeout ───────────────────────────────────────────────
+  // A relay that stays alive but never delivers this subscription's EOSE must
+  // not hang initialize() forever.  The timeout lapses the fence exactly like
+  // a CLOSED or reconnect — it NEVER counts as establishment.
+  const timeoutMs =
+    deps.establishmentTimeoutMs ?? FENCED_ESTABLISHMENT_TIMEOUT_MS;
+  let establishmentTimer: ReturnType<typeof setTimeout> | null = null;
+
+  // Wrap resolveEstablished so the timer is cancelled on normal EOSE.
+  const originalResolve = fencedSub.resolveEstablished;
+  fencedSub.resolveEstablished = () => {
+    if (establishmentTimer !== null) {
+      clearTimeout(establishmentTimer);
+      establishmentTimer = null;
+    }
+    originalResolve();
+  };
+  // Also patch the closed reference so the promise resolves via the wrapper.
+  resolveEstablished = fencedSub.resolveEstablished;
+
+  establishmentTimer = setTimeout(() => {
+    establishmentTimer = null;
+    // Only lapse if the fence hasn't already been resolved (EOSE or prior lapse).
+    if (!fencedSub.lapsed && deps.subscriptions.get(subId) === fencedSub) {
+      fencedSub.lapsed = true;
+      fencedSub.resolveEstablished();
+      deps.subscriptions.delete(subId);
+    }
+  }, timeoutMs);
+
   return buildFenceHandle(fencedSub, established, async () => {
+    if (establishmentTimer !== null) {
+      clearTimeout(establishmentTimer);
+      establishmentTimer = null;
+    }
     if (deps.subscriptions.get(subId) !== fencedSub) return;
     deps.subscriptions.delete(subId);
     await deps.closeSub(subId);