@optimystic/db-p2p 0.17.0 → 0.19.0

package/dist/src/cluster/block-transfer-service.d.ts

@@ -54,6 +54,16 @@ export interface BlockTransferServiceComponents {
         unhandle: (...args: any[]) => Promise<void>;
     };
     repo: IBlockReplicaStore;
+    /**
+     * Optional libp2p component logger. Supplied by the node factory so authorization denials
+     * land on the same `logger.forComponent(...).error` sink as the repo/cluster/sync services;
+     * without it they fall back to this module's `debug` logger.
+     */
+    logger?: {
+        forComponent: (name: string) => {
+            error: (message: string, ...args: unknown[]) => void;
+        };
+    };
 }
 /**
  * Libp2p service that handles incoming block transfer requests.

package/dist/src/cluster/block-transfer-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"block-transfer-service.d.ts","sourceRoot":"","sources":["../../../src/cluster/block-transfer-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,SAAS,EAAU,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAK7G,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAAqE,KAAK,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAQrJ,eAAO,MAAM,0BAA0B,GAAI,iBAAgB,MAAW,KAAG,MACJ,CAAC;AAEtE,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,+BAA+B;AAC/B,MAAM,WAAW,qBAAqB;IACrC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAID;;;;;GAKG;AACH,MAAM,WAAW,kBAAmB,SAAQ,KAAK;IAChD;;;;;OAKG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,wBAAyB,SAAQ,8BAA8B;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC9C,SAAS,EAAE;QAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACtG,IAAI,EAAE,kBAAkB,CAAC;CACzB;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,SAAS;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;IACxE,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyC;gBAGtE,UAAU,EAAE,8BAA8B,EAC1C,IAAI,GAAE,wBAA6B;IAQ9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,aAAa;YA8Cb,UAAU;IAkBxB;;;;;OAKG;YACW,UAAU;CA8CxB;AAED,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,GAAI,OAAM,wBAA6B,MACtE,YAAY,8BAA8B,yBAA+C,CAAC;AAI5F;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,YAAY,EACzB,cAAc,GAAE,MAAW;IAM5B;;;;;;;OAOG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,GAAE,oBAAoB,CAAC,QAAQ,CAAe,EACpD,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,qBAAqB,CAAC;IAKjC;;;;;;;;;;;;OAYG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,gBAAgB,EAAE,UAAU,EAAE,EAC9B,MAAM,GAAE,oBAAoB,CAAC,QAAQ,CAAe,EACpD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,EAC/D,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,qBAAqB,CAAC;CAQjC"}
+{"version":3,"file":"block-transfer-service.d.ts","sourceRoot":"","sources":["../../../src/cluster/block-transfer-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,SAAS,EAAU,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAK7G,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAAqE,KAAK,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAQrJ,eAAO,MAAM,0BAA0B,GAAI,iBAAgB,MAAW,KAAG,MACJ,CAAC;AAEtE,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,+BAA+B;AAC/B,MAAM,WAAW,qBAAqB;IACrC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAID;;;;;GAKG;AACH,MAAM,WAAW,kBAAmB,SAAQ,KAAK;IAChD;;;;;OAKG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,wBAAyB,SAAQ,8BAA8B;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC9C,SAAS,EAAE;QAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACtG,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;SAAE,CAAA;KAAE,CAAC;CACtG;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,SAAS;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;IACxE,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyC;gBAGtE,UAAU,EAAE,8BAA8B,EAC1C,IAAI,GAAE,wBAA6B;IAU9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,aAAa;YA8Cb,UAAU;IAkBxB;;;;;OAKG;YACW,UAAU;CA8CxB;AAED,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,GAAI,OAAM,wBAA6B,MACtE,YAAY,8BAA8B,yBAA+C,CAAC;AAI5F;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,YAAY,EACzB,cAAc,GAAE,MAAW;IAM5B;;;;;;;OAOG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,GAAE,oBAAoB,CAAC,QAAQ,CAAe,EACpD,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,qBAAqB,CAAC;IAKjC;;;;;;;;;;;;OAYG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,gBAAgB,EAAE,UAAU,EAAE,EAC9B,MAAM,GAAE,oBAAoB,CAAC,QAAQ,CAAe,EACpD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,EAC/D,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,qBAAqB,CAAC;CAQjC"}

package/dist/src/cluster/block-transfer-service.js

@@ -28,7 +28,8 @@ export class BlockTransferService {
         this.protocol = buildBlockTransferProtocol(init.protocolPrefix ?? '');
         this.repo = components.repo;
         this.registrar = components.registrar;
-        this.authorization = createInboundStreamAuthorization(init, this.protocol, (msg, ...args) => log(msg, ...args));
+        const componentLog = components.logger?.forComponent('db-p2p:block-transfer');
+        this.authorization = createInboundStreamAuthorization(init, this.protocol, componentLog ? (msg, ...args) => componentLog.error(msg, ...args) : (msg, ...args) => log(msg, ...args));
     }
     async start() {
         if (this.running)

package/dist/src/cluster/block-transfer-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"block-transfer-service.js","sourceRoot":"","sources":["../../../src/cluster/block-transfer-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gCAAgC,EAAwE,MAAM,6BAA6B,CAAC;AAErJ,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAEnD,oBAAoB;AACpB,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,iBAAyB,EAAE,EAAU,EAAE,CACjF,GAAG,cAAc,GAAG,qBAAqB,GAAG,sBAAsB,EAAE,CAAC;AAuDtE;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACxB,OAAO,GAAG,KAAK,CAAC;IACP,QAAQ,CAAS;IACjB,IAAI,CAAqB;IACzB,SAAS,CAA8C;IACxE,2FAA2F;IAC1E,aAAa,CAAyC;IAEvE,YACC,UAA0C,EAC1C,OAAiC,EAAE;QAEnC,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,gCAAgC,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjH,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAS,EAAE,UAAuB,EAAE,EAAE;YACvF,qFAAqF;YACrF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,4EAA4E;YAC5E,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;YACpC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,UAAuB;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACJ,iFAAiF;YACjF,8DAA8D;YAC9D,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;gBAAE,OAAO;YAC5G,gFAAgF;YAChF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,iFAAiF;YACjF,sFAAsF;YACtF,yBAAyB;YACzB,MAAM,SAAS,GAAG,IAAI,CACrB,MAAM,EACN,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,EACzE,KAAK,SAAS,CAAC,EAAE,MAAM;gBACtB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAyB,CAAC;oBACvF,GAAG,CAAC,qCAAqC,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBAClG,IAAI,QAA+B,CAAC;oBACpC,IAAI,CAAC;wBACJ,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM;4BACjC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;4BAChC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBACnC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,GAAG,CAAC,WAAW,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;wBAC3C,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBACxC,CAAC;oBACD,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;oBACrD,OAAO,CAAC,wCAAwC;gBACjD,CAAC;YACF,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7B,CAAC;YACF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClD,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,kDAAkD;YAClD,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAW,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,8EAA8E;YAC9E,gFAAgF;YAChF,iFAAiF;YACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3F,GAAG,CAAC,wDAAwD,EAAE,OAAO,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,6EAA6E;YAC7E,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,8BAA8B,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;CACD;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAiC,EAAE,EAAE,EAAE,CAC3E,CAAC,UAA0C,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAE5F,iBAAiB;AAEjB;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACrC,QAAQ,CAAS;IAElC,YACC,MAAc,EACd,WAAyB,EACzB,iBAAyB,EAAE;QAE3B,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACf,QAAkB,EAClB,SAAyC,WAAW,EACpD,OAAsF;QAEtF,MAAM,OAAO,GAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACzE,OAAO,MAAM,IAAI,CAAC,cAAc,CAAwB,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzI,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CACf,QAAkB,EAClB,gBAA8B,EAC9B,SAAyC,WAAW,EACpD,SAA+D,EAC/D,OAAsF;QAEtF,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAwB,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzI,CAAC;CACD"}
+{"version":3,"file":"block-transfer-service.js","sourceRoot":"","sources":["../../../src/cluster/block-transfer-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gCAAgC,EAAwE,MAAM,6BAA6B,CAAC;AAErJ,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAEnD,oBAAoB;AACpB,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,iBAAyB,EAAE,EAAU,EAAE,CACjF,GAAG,cAAc,GAAG,qBAAqB,GAAG,sBAAsB,EAAE,CAAC;AA6DtE;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACxB,OAAO,GAAG,KAAK,CAAC;IACP,QAAQ,CAAS;IACjB,IAAI,CAAqB;IACzB,SAAS,CAA8C;IACxE,2FAA2F;IAC1E,aAAa,CAAyC;IAEvE,YACC,UAA0C,EAC1C,OAAiC,EAAE;QAEnC,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,GAAG,gCAAgC,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EACxE,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAS,EAAE,UAAuB,EAAE,EAAE;YACvF,qFAAqF;YACrF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,4EAA4E;YAC5E,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;YACpC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,UAAuB;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACJ,iFAAiF;YACjF,8DAA8D;YAC9D,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;gBAAE,OAAO;YAC5G,gFAAgF;YAChF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,iFAAiF;YACjF,sFAAsF;YACtF,yBAAyB;YACzB,MAAM,SAAS,GAAG,IAAI,CACrB,MAAM,EACN,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,EACzE,KAAK,SAAS,CAAC,EAAE,MAAM;gBACtB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAyB,CAAC;oBACvF,GAAG,CAAC,qCAAqC,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBAClG,IAAI,QAA+B,CAAC;oBACpC,IAAI,CAAC;wBACJ,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM;4BACjC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;4BAChC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBACnC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,GAAG,CAAC,WAAW,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;wBAC3C,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBACxC,CAAC;oBACD,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;oBACrD,OAAO,CAAC,wCAAwC;gBACjD,CAAC;YACF,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7B,CAAC;YACF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClD,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,kDAAkD;YAClD,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAW,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,8EAA8E;YAC9E,gFAAgF;YAChF,iFAAiF;YACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3F,GAAG,CAAC,wDAAwD,EAAE,OAAO,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,6EAA6E;YAC7E,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,8BAA8B,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;CACD;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAiC,EAAE,EAAE,EAAE,CAC3E,CAAC,UAA0C,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAE5F,iBAAiB;AAEjB;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACrC,QAAQ,CAAS;IAElC,YACC,MAAc,EACd,WAAyB,EACzB,iBAAyB,EAAE;QAE3B,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACf,QAAkB,EAClB,SAAyC,WAAW,EACpD,OAAsF;QAEtF,MAAM,OAAO,GAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACzE,OAAO,MAAM,IAAI,CAAC,cAAc,CAAwB,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzI,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CACf,QAAkB,EAClB,gBAA8B,EAC9B,SAAyC,WAAW,EACpD,SAA+D,EAC/D,OAAsF;QAEtF,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAwB,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzI,CAAC;CACD"}

package/dist/src/cluster/cluster-policy.d.ts

@@ -0,0 +1,112 @@
+import { type ClusterConsensusConfig } from "@optimystic/db-core";
+/**
+ * Resolves the operator-facing cluster knobs (`clusterSize`, `clusterPolicy.*`) into the concrete
+ * numbers the consensus and block-restoration paths run on.
+ *
+ * Extracted from `createLibp2pNodeBase` rather than left inline so the composition root's defaults
+ * are assertable without booting a libp2p node — the layer a real deployment actually uses, and
+ * therefore the layer where a default that relaxed the repair corroboration floor to a single voter
+ * survived unnoticed (see `test/cluster-policy.spec.ts`).
+ *
+ * ## Why two size yardsticks, not one
+ *
+ * One operator field — `clusterPolicy.assumedClusterSize`, "the smallest cohort this deployment can
+ * genuinely field" — feeds two consumers whose failure modes point in opposite directions, so its
+ * *default* cannot serve both:
+ *
+ * - **Membership admission gate** (`cluster/cluster-repo.ts`, `admitMembership`) reads it only on its
+ *   fallback path, when this node has no confident network-size estimate. Too small: a
+ *   partition-induced downsize slips past while the node is unconfident. Too large: the node refuses
+ *   legitimate writes — unavailability. It wants a *permissive* default, because an unconfigured
+ *   two-node mesh must still be able to transact. It gets {@link minAbsoluteClusterSize} (2).
+ * - **Repair corroboration floor** (`corroboratorCapacity` in `cluster/quorum-restore.ts`, called by
+ *   `CoordinatorRepo.queryClusterForLatest` and `createReconcileBlock`) reads it on *every* repair,
+ *   unconditionally. Too small: a shrunken — and always unauthenticated — cohort view buys a lone
+ *   peer full trust. Too large: a block stays unrepaired, degraded rather than dead. It wants a
+ *   *strict* default. It gets {@link ResolvedClusterPolicy.repairCorroborationClusterSize}, which
+ *   falls back to `clusterSize` (the configured replication factor).
+ *
+ * A single explicit `clusterPolicy.assumedClusterSize` still sets BOTH — an operator declaring their
+ * real cohort size means it for both consumers. Only the unconfigured case diverges.
+ *
+ * So a genuine two-node mesh needs exactly one setting to self-repair: either
+ * `clusterPolicy.assumedClusterSize: 2` (which does not lower the replication factor) or an honest
+ * `clusterSize: 2`. Writes and voting still work with zero configuration.
+ *
+ * ## Future
+ *
+ * Deriving the yardstick from observation (the largest peer group this node has ever seen for the
+ * key) would remove the trade entirely and subsume both values. Filed as backlog
+ * `feat-admission-floor-from-observed-cohort-high-water-mark`; do not build it here.
+ */
+/**
+ * Absolute floor below which no cohort is safe, whatever the size references say. Named rather than
+ * inlined because the admission gate's `assumedClusterSize` defaults to exactly this value — the two
+ * must not drift.
+ */
+export declare const minAbsoluteClusterSize = 2;
+/**
+ * The operator-facing cluster knobs. `NodeOptions` (`libp2p-node-base.ts`) intersects this rather
+ * than restating it, so a knob added here is one `resolveClusterPolicy` is guaranteed to see — a
+ * second declaration would compile fine and be silently dropped.
+ */
+export interface ClusterPolicyOptions {
+    /**
+     * Desired cluster size per key (default 10) — the replication factor / target cohort breadth
+     * the coordinator aims for. NOT a statement about how many peers actually exist, so the
+     * membership admission gate is never measured against it (see `cluster/cluster-repo.ts`).
+     *
+     * The read-repair/reconcile corroboration floor DOES fall back to it when
+     * `clusterPolicy.assumedClusterSize` is absent — the strict direction, so an unconfigured node
+     * cannot have its floor talked down by a shrunken cohort view. A deployment that genuinely runs
+     * fewer peers than this should declare `clusterPolicy.assumedClusterSize`.
+     */
+    clusterSize?: number;
+    clusterPolicy?: {
+        allowDownsize?: boolean;
+        /** Acceptable relative difference (e.g. 0.5 = +/-50%). */
+        sizeTolerance?: number;
+        /** Fraction of peers needed for super-majority (default {@link DEFAULT_SUPER_MAJORITY_THRESHOLD}). */
+        superMajorityThreshold?: number;
+        /**
+         * Opt in to transacting below the safe cluster-size floor when FRET has no confident
+         * network-size estimate — the membership-admission and coordinator small-cluster gates both
+         * fail closed without it. Default false. Turn on only for single-node / local dev meshes that
+         * knowingly run undersized.
+         */
+        allowUnvalidatedSmallCluster?: boolean;
+        /**
+         * The smallest cohort this deployment can genuinely field — normally the number of nodes you
+         * actually run, capped at `clusterSize`. Two consumers read it: the membership admission gate,
+         * on its fallback path when the node has no confident network-size estimate; and the
+         * read-repair/reconcile corroboration floor (`corroboratorCapacity`), unconditionally.
+         *
+         * Declaring it sets BOTH. Leaving it unset does NOT — see the module doc for why the two
+         * defaults point in opposite directions. A large deployment should still set this to its real
+         * cohort size, otherwise the admission gate cannot police a partition-induced downsize while
+         * its size estimate is unconfident; a genuine two-node mesh needs it (or an honest
+         * `clusterSize: 2`) to self-repair.
+         */
+        assumedClusterSize?: number;
+    };
+}
+/** Everything a node's consensus + restoration paths need, with every default already applied. */
+export type ResolvedClusterPolicy = ClusterConsensusConfig & {
+    /** Replication factor / target cohort breadth. Always concrete after resolution. */
+    clusterSize: number;
+    /**
+     * Yardstick the repair corroboration floor measures a (possibly shrunken, always unauthenticated)
+     * cohort view against — see `corroboratorCapacity` in `cluster/quorum-restore.ts`.
+     *
+     * Deliberately distinct from {@link ClusterConsensusConfig.assumedClusterSize}, which the
+     * membership admission gate reads: the two share an operator field but not a default, because
+     * over- and under-stating them cost opposite things. See the module doc.
+     */
+    repairCorroborationClusterSize: number;
+};
+/**
+ * Apply every cluster-policy default a node needs. Pure — same options in, same numbers out — so the
+ * composition root's behavior is unit-testable (`test/cluster-policy.spec.ts`).
+ */
+export declare function resolveClusterPolicy(options: ClusterPolicyOptions): ResolvedClusterPolicy;
+//# sourceMappingURL=cluster-policy.d.ts.map

package/dist/src/cluster/cluster-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster-policy.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0DAA0D;QAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,sGAAsG;QACtG,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC;;;;;WAKG;QACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;QACvC;;;;;;;;;;;WAWG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG;IAC5D,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,8BAA8B,EAAE,MAAM,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,CAoCzF"}

package/dist/src/cluster/cluster-policy.js

@@ -0,0 +1,88 @@
+import { DEFAULT_SUPER_MAJORITY_THRESHOLD } from "@optimystic/db-core";
+/**
+ * Resolves the operator-facing cluster knobs (`clusterSize`, `clusterPolicy.*`) into the concrete
+ * numbers the consensus and block-restoration paths run on.
+ *
+ * Extracted from `createLibp2pNodeBase` rather than left inline so the composition root's defaults
+ * are assertable without booting a libp2p node — the layer a real deployment actually uses, and
+ * therefore the layer where a default that relaxed the repair corroboration floor to a single voter
+ * survived unnoticed (see `test/cluster-policy.spec.ts`).
+ *
+ * ## Why two size yardsticks, not one
+ *
+ * One operator field — `clusterPolicy.assumedClusterSize`, "the smallest cohort this deployment can
+ * genuinely field" — feeds two consumers whose failure modes point in opposite directions, so its
+ * *default* cannot serve both:
+ *
+ * - **Membership admission gate** (`cluster/cluster-repo.ts`, `admitMembership`) reads it only on its
+ *   fallback path, when this node has no confident network-size estimate. Too small: a
+ *   partition-induced downsize slips past while the node is unconfident. Too large: the node refuses
+ *   legitimate writes — unavailability. It wants a *permissive* default, because an unconfigured
+ *   two-node mesh must still be able to transact. It gets {@link minAbsoluteClusterSize} (2).
+ * - **Repair corroboration floor** (`corroboratorCapacity` in `cluster/quorum-restore.ts`, called by
+ *   `CoordinatorRepo.queryClusterForLatest` and `createReconcileBlock`) reads it on *every* repair,
+ *   unconditionally. Too small: a shrunken — and always unauthenticated — cohort view buys a lone
+ *   peer full trust. Too large: a block stays unrepaired, degraded rather than dead. It wants a
+ *   *strict* default. It gets {@link ResolvedClusterPolicy.repairCorroborationClusterSize}, which
+ *   falls back to `clusterSize` (the configured replication factor).
+ *
+ * A single explicit `clusterPolicy.assumedClusterSize` still sets BOTH — an operator declaring their
+ * real cohort size means it for both consumers. Only the unconfigured case diverges.
+ *
+ * So a genuine two-node mesh needs exactly one setting to self-repair: either
+ * `clusterPolicy.assumedClusterSize: 2` (which does not lower the replication factor) or an honest
+ * `clusterSize: 2`. Writes and voting still work with zero configuration.
+ *
+ * ## Future
+ *
+ * Deriving the yardstick from observation (the largest peer group this node has ever seen for the
+ * key) would remove the trade entirely and subsume both values. Filed as backlog
+ * `feat-admission-floor-from-observed-cohort-high-water-mark`; do not build it here.
+ */
+/**
+ * Absolute floor below which no cohort is safe, whatever the size references say. Named rather than
+ * inlined because the admission gate's `assumedClusterSize` defaults to exactly this value — the two
+ * must not drift.
+ */
+export const minAbsoluteClusterSize = 2;
+/**
+ * Apply every cluster-policy default a node needs. Pure — same options in, same numbers out — so the
+ * composition root's behavior is unit-testable (`test/cluster-policy.spec.ts`).
+ */
+export function resolveClusterPolicy(options) {
+    // undefined here means "the operator said nothing", which is the only case where the two
+    // yardsticks below diverge.
+    //
+    // NOTE: a declared value is passed through unvalidated. The admission gate floors a degenerate one
+    // (0, negative, NaN, Infinity) itself — see `cluster-repo.admissionFloor` and its specs — but
+    // `corroboratorCapacity` does not: NaN there makes every quorum comparison false, so repair
+    // silently declines forever. Fail-safe, and unreachable through the reference-peer CLI (which
+    // rejects non-positive integers). If another composition root starts accepting unvalidated config,
+    // clamp here rather than in each consumer.
+    const declaredCohortSize = options.clusterPolicy?.assumedClusterSize;
+    const clusterSize = options.clusterSize ?? 10;
+    return {
+        superMajorityThreshold: options.clusterPolicy?.superMajorityThreshold ?? DEFAULT_SUPER_MAJORITY_THRESHOLD,
+        simpleMajorityThreshold: 0.51,
+        minAbsoluteClusterSize,
+        allowClusterDownsize: options.clusterPolicy?.allowDownsize ?? true,
+        clusterSizeTolerance: options.clusterPolicy?.sizeTolerance ?? 0.5,
+        // Fail closed by default (an undersized cluster with no confident network-size estimate is
+        // rejected); embedders running knowingly-small meshes opt in through clusterPolicy.
+        allowUnvalidatedSmallCluster: options.clusterPolicy?.allowUnvalidatedSmallCluster ?? false,
+        partitionDetectionWindow: 60000,
+        // Replication factor / target cohort breadth — what the coordinator aims for when selecting a
+        // cohort. Deliberately NOT the membership admission gate's yardstick: it says nothing about how
+        // many peers actually exist, so an unconfigured small mesh would refuse every write.
+        clusterSize,
+        // Membership admission gate, fallback path only (no confident network-size estimate). Defaults
+        // permissive so a two- or three-node mesh transacts unconfigured; the cost of that default is
+        // bounded to the gate, since the repair floor no longer reads this field.
+        assumedClusterSize: declaredCohortSize ?? minAbsoluteClusterSize,
+        // Repair corroboration floor, every repair. Defaults strict — to the replication factor — so an
+        // unconfigured node cannot have its floor talked down to a single voter by a shrunken cohort
+        // view. A genuinely small mesh declares its size (either field) to regain self-repair.
+        repairCorroborationClusterSize: declaredCohortSize ?? clusterSize
+    };
+}
+//# sourceMappingURL=cluster-policy.js.map

package/dist/src/cluster/cluster-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster-policy.js","sourceRoot":"","sources":["../../../src/cluster/cluster-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAA+B,MAAM,qBAAqB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AA+DxC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA6B;IACjE,yFAAyF;IACzF,4BAA4B;IAC5B,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,4FAA4F;IAC5F,8FAA8F;IAC9F,mGAAmG;IACnG,2CAA2C;IAC3C,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAE9C,OAAO;QACN,sBAAsB,EAAE,OAAO,CAAC,aAAa,EAAE,sBAAsB,IAAI,gCAAgC;QACzG,uBAAuB,EAAE,IAAI;QAC7B,sBAAsB;QACtB,oBAAoB,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,IAAI,IAAI;QAClE,oBAAoB,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,IAAI,GAAG;QACjE,2FAA2F;QAC3F,oFAAoF;QACpF,4BAA4B,EAAE,OAAO,CAAC,aAAa,EAAE,4BAA4B,IAAI,KAAK;QAC1F,wBAAwB,EAAE,KAAK;QAC/B,8FAA8F;QAC9F,gGAAgG;QAChG,qFAAqF;QACrF,WAAW;QACX,+FAA+F;QAC/F,8FAA8F;QAC9F,0EAA0E;QAC1E,kBAAkB,EAAE,kBAAkB,IAAI,sBAAsB;QAChE,gGAAgG;QAChG,6FAA6F;QAC7F,uFAAuF;QACvF,8BAA8B,EAAE,kBAAkB,IAAI,WAAW;KACjE,CAAC;AACH,CAAC"}

package/dist/src/cluster/cluster-repo.d.ts

@@ -68,9 +68,10 @@ export type ExpectedClusterView = {
  * Independently derive this member's own view of a block's responsible cluster. Injected so
  * {@link ClusterMember} stays transport-agnostic — the composition root supplies it from
  * `IKeyNetwork.findCluster` + FRET (mirroring how the coordinator derives the cluster). Absent on nodes
- * that cannot derive a view (no FRET, unit tests): with no derived view AND no configured full-size
- * reference the gate preserves legacy approve behavior, but a configured `clusterSize` still lets the gate
- * fail closed on an unjustified downsize. See {@link ClusterMember} admission gate.
+ * that cannot derive a view (no FRET, unit tests): with no derived view AND no asserted
+ * {@link ClusterConsensusConfig.assumedClusterSize} the gate preserves legacy approve behavior, but an
+ * asserted size still lets the gate fail closed on an unjustified downsize. See {@link ClusterMember}
+ * admission gate.
  */
 export type DeriveExpectedClusterCallback = (blockId: BlockId) => Promise<ExpectedClusterView>;
 /** Stable reject reason a member emits when a declared peer set fails the membership admission gate. */
@@ -141,8 +142,8 @@ export declare class ClusterMember implements ICluster {
     private readonly minAbsoluteClusterSize;
     private readonly clusterSizeTolerance;
     private readonly membershipAdmissionFraction;
-    /** Configured full cluster size, or undefined when unknown (then the gate cannot judge a downsize). */
-    private readonly configuredClusterSize;
+    /** Operator-asserted smallest genuine cohort size, or undefined when unknown. */
+    private readonly assumedClusterSize;
     private readonly allowUnvalidatedSmallCluster;
     constructor(storageRepo: IRepo, peerNetwork: IPeerNetwork, peerId: PeerId, privateKey: PrivateKey, protocolPrefix?: string | undefined, _partitionDetector?: PartitionDetector, fretService?: FretService | undefined, validator?: ITransactionValidator | undefined, reputation?: IPeerReputation | undefined, consensusConfig?: ClusterConsensusConfig, stateStore?: ITransactionStateStore | undefined, reconcileBlock?: ReconcileBlockCallback | undefined, onCommitCertificate?: CommitCertificateSink | undefined, onInvalidate?: InvalidationApplySink | undefined, recomputeArbitratorSet?: RecomputeArbitratorSetCapability | undefined, deriveExpectedCluster?: DeriveExpectedClusterCallback | undefined);
     /**
@@ -240,14 +241,37 @@ export declare class ClusterMember implements ICluster {
      *     of a peer or two is absorbed, a wholesale-disjoint or half-size set is not.
      *
      * **Fail-closed posture.** When the member cannot confidently derive `E` (no capability, low FRET
-     * confidence — exactly what a partition induces), it must refuse any *downsizing* decision: a
-     * below-full-size `D` is rejected against the configured full `clusterSize`. With NEITHER a confident
-     * view NOR a configured full size the gate cannot judge a downsize at all, so it preserves the legacy
-     * approve behavior (backward-compatible for nodes/tests with no derivation wired). `allowUnvalidatedSmallCluster`
-     * is the explicit opt-in (single-node / local dev knowingly below the safe floor), matching the
-     * coordinator's `validateSmallCluster` semantics.
+     * confidence — exactly what a partition induces), it must refuse any *downsizing* decision — but it
+     * needs a size reference to judge "downsize" against, and it may NOT borrow `clusterSize` for that:
+     * `clusterSize` is the replication factor (what a cohort should aim for), not a claim about how many
+     * peers exist, so a small deployment configured with the default 10 would refuse every write. The
+     * fallback yardstick is instead {@link ClusterConsensusConfig.assumedClusterSize} — the operator's own
+     * assertion of the smallest cohort this deployment can genuinely field — run through the SAME
+     * {@link admissionFloor} as the confident path, so the fallback can never be stricter than the measured
+     * path (it was: it demanded the full configured size, with no fraction and no slack for churn or a peer
+     * not yet discovered). With NEITHER a confident view NOR an asserted size the gate cannot judge a
+     * downsize at all, so it preserves the legacy approve behavior (backward-compatible for nodes/tests with
+     * no derivation wired). `allowUnvalidatedSmallCluster` is the explicit opt-in (single-node / local dev
+     * knowingly below the safe floor), matching the coordinator's `validateSmallCluster` semantics.
      */
     private admitMembership;
+    /**
+     * The smallest declared peer set admissible against a cohort-size reference `k`, whether `k` is
+     * measured (the confident path's `kEst`) or asserted (`assumedClusterSize`). One function so the
+     * fallback can never be stricter than the measured path — which it was, demanding the full configured
+     * size with no fraction and no slack. Clamped at `minAbsoluteClusterSize`, so a degenerate `k` of 0, 1
+     * or negative yields the absolute floor rather than a floor that admits everything. A non-finite scaled
+     * size (a `NaN` or `Infinity` config value) is likewise treated as no usable reference rather than
+     * propagating: an unguarded `NaN` floor fails EVERY comparison, which would silently make the node
+     * reject every unconfident write.
+     *
+     * NOTE: partition safety needs `2 · membershipAdmissionFraction · superMajorityThreshold > 1` — each
+     * side of a split must recruit `fraction · threshold · K` distinct honest members, and two sides cannot
+     * both find them in one K-peer cluster. At the shipped defaults (0.75 · 0.67) that product is 1.005 —
+     * true, but with almost no margin. If either default is ever lowered, re-check Theorem 2 in
+     * `docs/correctness.md` before shipping it.
+     */
+    private admissionFloor;
     /**
      * Derive this member's own view of the record's block cluster via the injected capability, or
      * `undefined` when it cannot (no capability, no coordinating block id, or a derivation error — all of

package/dist/src/cluster/cluster-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-repo.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAA0B,qBAAqB,EAAE,sBAAsB,EAAgB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAiB,UAAU,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/O,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAiC,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAmC7E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IACjC,wGAAwG;IACxG,KAAK,EAAE,YAAY,CAAC;IACpB,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE/F,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,UAAU,uBAAuB;IAChC,WAAW,EAAE,KAAK,CAAC;IACnB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,oGAAoG;IACpG,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,oHAAoH;IACpH,sBAAsB,CAAC,EAAE,gCAAgC,CAAC;IAC1D,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;CACtD;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,uBAAuB,GAAG,aAAa,CAmBhF;AAqBD;;;GAGG;AACH,qBAAa,aAAc,YAAW,QAAQ;IA0C5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAxDxC,OAAO,CAAC,kBAAkB,CAA4C;IAEtE,OAAO,CAAC,oBAAoB,CAAkC;IAK9D,OAAO,CAAC,oBAAoB,CAAkC;IAE9D,OAAO,CAAC,YAAY,CAAgB;IAEpC,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IAEjD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAO;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAGhD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,uGAAuG;IACvG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;gBAGrC,WAAW,EAAE,KAAK,EAClB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,MAAM,YAAA,EAExC,kBAAkB,CAAC,EAAE,iBAAiB,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,SAAS,CAAC,EAAE,qBAAqB,YAAA,EACjC,UAAU,CAAC,EAAE,eAAe,YAAA,EAC7C,eAAe,CAAC,EAAE,sBAAsB,EACvB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,cAAc,CAAC,EAAE,sBAAsB,YAAA,EACvC,mBAAmB,CAAC,EAAE,qBAAqB,YAAA,EAC3C,YAAY,CAAC,EAAE,qBAAqB,YAAA,EACpC,sBAAsB,CAAC,EAAE,gCAAgC,YAAA,EACzD,qBAAqB,CAAC,EAAE,6BAA6B,YAAA;IAgBvE;;;;;OAKG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED;;;OAGG;IACH,OAAO,IAAI,IAAI;IAWf;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpD;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAyB7C,aAAa;IA8J3B;;;OAGG;YACW,YAAY;IAwD1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;YAyCZ,cAAc;IAmC5B;;;;OAIG;YACW,kBAAkB;YAIlB,kBAAkB;IA4BhC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,kBAAkB;YAIlB,iBAAiB;IAI/B,OAAO,CAAC,qBAAqB;YAKf,QAAQ;IAMtB;;;;;;;;;;;OAWG;YACW,eAAe;YAqCf,mBAAmB;IAwCjC,OAAO,CAAC,WAAW;YAIL,mBAAmB;IAgCjC;;;;;;OAMG;YACW,eAAe;IAQ7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,eAAe;IAkF7B;;;;;OAKG;YACW,yBAAyB;IAmBvC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC;;;;OAIG;YACW,sBAAsB;YAuCtB,kBAAkB;IAoBhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IAiD7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;YACW,uBAAuB;IA0GrC;;;;;;;;;;OAUG;YACW,0BAA0B;IAwExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;;;;;OAMG;YACW,wBAAwB;IAgBtC,uFAAuF;YACzE,iBAAiB;IAc/B,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;YAcd,eAAe;IAI7B,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,WAAW;IA2DnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,OAAO,CAAC,WAAW;IAmBnB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,kBAAkB;IA0B1B,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,mBAAmB;YAuBb,iBAAiB;YAejB,gBAAgB;YA+BhB,gBAAgB;IAM9B,OAAO,CAAC,wBAAwB;YAwBlB,mBAAmB;IAejC,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,gBAAgB;IAqBxB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAS/B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC1C;;;OAGG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}
+{"version":3,"file":"cluster-repo.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAA0B,qBAAqB,EAAE,sBAAsB,EAAgB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAiB,UAAU,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/O,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAiC,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAmC7E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IACjC,wGAAwG;IACxG,KAAK,EAAE,YAAY,CAAC;IACpB,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE/F,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,UAAU,uBAAuB;IAChC,WAAW,EAAE,KAAK,CAAC;IACnB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,oGAAoG;IACpG,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,oHAAoH;IACpH,sBAAsB,CAAC,EAAE,gCAAgC,CAAC;IAC1D,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;CACtD;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,uBAAuB,GAAG,aAAa,CAmBhF;AAqBD;;;GAGG;AACH,qBAAa,aAAc,YAAW,QAAQ;IA0C5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAxDxC,OAAO,CAAC,kBAAkB,CAA4C;IAEtE,OAAO,CAAC,oBAAoB,CAAkC;IAK9D,OAAO,CAAC,oBAAoB,CAAkC;IAE9D,OAAO,CAAC,YAAY,CAAgB;IAEpC,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IAEjD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAO;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAGhD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;gBAGrC,WAAW,EAAE,KAAK,EAClB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,MAAM,YAAA,EAExC,kBAAkB,CAAC,EAAE,iBAAiB,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,SAAS,CAAC,EAAE,qBAAqB,YAAA,EACjC,UAAU,CAAC,EAAE,eAAe,YAAA,EAC7C,eAAe,CAAC,EAAE,sBAAsB,EACvB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,cAAc,CAAC,EAAE,sBAAsB,YAAA,EACvC,mBAAmB,CAAC,EAAE,qBAAqB,YAAA,EAC3C,YAAY,CAAC,EAAE,qBAAqB,YAAA,EACpC,sBAAsB,CAAC,EAAE,gCAAgC,YAAA,EACzD,qBAAqB,CAAC,EAAE,6BAA6B,YAAA;IAyBvE;;;;;OAKG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED;;;OAGG;IACH,OAAO,IAAI,IAAI;IAWf;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpD;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAyB7C,aAAa;IA8J3B;;;OAGG;YACW,YAAY;IAwD1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;YAyCZ,cAAc;IAmC5B;;;;OAIG;YACW,kBAAkB;YAIlB,kBAAkB;IA4BhC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,kBAAkB;YAIlB,iBAAiB;IAI/B,OAAO,CAAC,qBAAqB;YAKf,QAAQ;IAMtB;;;;;;;;;;;OAWG;YACW,eAAe;YAqCf,mBAAmB;IAwCjC,OAAO,CAAC,WAAW;YAIL,mBAAmB;IAgCjC;;;;;;OAMG;YACW,eAAe;IAQ7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,eAAe;IAiG7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;OAKG;YACW,yBAAyB;IAmBvC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC;;;;OAIG;YACW,sBAAsB;YA4DtB,kBAAkB;IAoBhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IAiD7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;YACW,uBAAuB;IA0GrC;;;;;;;;;;OAUG;YACW,0BAA0B;IAwExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;;;;;OAMG;YACW,wBAAwB;IAgBtC,uFAAuF;YACzE,iBAAiB;IAmB/B,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;YAcd,eAAe;IAI7B,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,WAAW;IA2DnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,OAAO,CAAC,WAAW;IAmBnB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,kBAAkB;IA0B1B,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,mBAAmB;YAuBb,iBAAiB;YAejB,gBAAgB;YA+BhB,gBAAgB;IAM9B,OAAO,CAAC,wBAAwB;YAwBlB,mBAAmB;IAejC,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,gBAAgB;IAqBxB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAS/B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC1C;;;OAGG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}

package/dist/src/cluster/cluster-repo.js

@@ -96,8 +96,8 @@ export class ClusterMember {
     minAbsoluteClusterSize;
     clusterSizeTolerance;
     membershipAdmissionFraction;
-    /** Configured full cluster size, or undefined when unknown (then the gate cannot judge a downsize). */
-    configuredClusterSize;
+    /** Operator-asserted smallest genuine cohort size, or undefined when unknown. */
+    assumedClusterSize;
     allowUnvalidatedSmallCluster;
     constructor(storageRepo, peerNetwork, peerId, privateKey, protocolPrefix, 
     // Reserved for partition-healing (backlog ticket 6.5-partition-healing); held but not yet consumed.
@@ -120,8 +120,17 @@ export class ClusterMember {
         this.minAbsoluteClusterSize = consensusConfig?.minAbsoluteClusterSize ?? 3;
         this.clusterSizeTolerance = consensusConfig?.clusterSizeTolerance ?? 0.5;
         this.membershipAdmissionFraction = consensusConfig?.membershipAdmissionFraction ?? 0.75;
-        this.configuredClusterSize = consensusConfig?.clusterSize;
+        this.assumedClusterSize = consensusConfig?.assumedClusterSize;
         this.allowUnvalidatedSmallCluster = consensusConfig?.allowUnvalidatedSmallCluster ?? false;
+        // State the resolved gate parameters once, so an operator diagnosing a membership rejection can see
+        // what this node actually resolved. A fact, not a warning: `assumedClusterSize < clusterSize` is the
+        // normal default state, so warning on it would fire for every node and be ignored.
+        log('cluster-member:admission-config', {
+            assumedClusterSize: this.assumedClusterSize,
+            minAbsoluteClusterSize: this.minAbsoluteClusterSize,
+            membershipAdmissionFraction: this.membershipAdmissionFraction,
+            allowUnvalidatedSmallCluster: this.allowUnvalidatedSmallCluster
+        });
         // Periodically clean up expired transactions (.unref() so tests/short-lived processes can exit)
         this.expirationInterval = setInterval(() => this.queueExpiredTransactions(), 60000);
         this.expirationInterval.unref();
@@ -657,12 +666,18 @@ export class ClusterMember {
      *     of a peer or two is absorbed, a wholesale-disjoint or half-size set is not.
      *
      * **Fail-closed posture.** When the member cannot confidently derive `E` (no capability, low FRET
-     * confidence — exactly what a partition induces), it must refuse any *downsizing* decision: a
-     * below-full-size `D` is rejected against the configured full `clusterSize`. With NEITHER a confident
-     * view NOR a configured full size the gate cannot judge a downsize at all, so it preserves the legacy
-     * approve behavior (backward-compatible for nodes/tests with no derivation wired). `allowUnvalidatedSmallCluster`
-     * is the explicit opt-in (single-node / local dev knowingly below the safe floor), matching the
-     * coordinator's `validateSmallCluster` semantics.
+     * confidence — exactly what a partition induces), it must refuse any *downsizing* decision — but it
+     * needs a size reference to judge "downsize" against, and it may NOT borrow `clusterSize` for that:
+     * `clusterSize` is the replication factor (what a cohort should aim for), not a claim about how many
+     * peers exist, so a small deployment configured with the default 10 would refuse every write. The
+     * fallback yardstick is instead {@link ClusterConsensusConfig.assumedClusterSize} — the operator's own
+     * assertion of the smallest cohort this deployment can genuinely field — run through the SAME
+     * {@link admissionFloor} as the confident path, so the fallback can never be stricter than the measured
+     * path (it was: it demanded the full configured size, with no fraction and no slack for churn or a peer
+     * not yet discovered). With NEITHER a confident view NOR an asserted size the gate cannot judge a
+     * downsize at all, so it preserves the legacy approve behavior (backward-compatible for nodes/tests with
+     * no derivation wired). `allowUnvalidatedSmallCluster` is the explicit opt-in (single-node / local dev
+     * knowingly below the safe floor), matching the coordinator's `validateSmallCluster` semantics.
      */
     async admitMembership(record) {
         const ourId = this.peerId.toString();
@@ -689,28 +704,40 @@ export class ClusterMember {
             && derived.confidence > ClusterMember.MembershipConfidenceThreshold
             && derivedSize > 0;
         if (!confident) {
-            // Fail closed for downsizing under low/absent confidence. A full-size (or larger) declared set is
-            // still admitted — there is nothing to shrink. Without a configured full-size reference we cannot
-            // tell a downsize from a legitimate small cluster, so we preserve legacy approve behavior.
-            if (this.configuredClusterSize === undefined) {
+            // Fail closed for downsizing under low/absent confidence, measured against the operator's asserted
+            // cohort size rather than the replication factor. With no asserted size the gate cannot tell a
+            // downsize from a legitimately small cluster at all, so it preserves legacy approve behavior.
+            if (this.assumedClusterSize === undefined) {
                 return { admit: true };
             }
-            if (declared.length >= this.configuredClusterSize) {
+            const floor = this.admissionFloor(this.assumedClusterSize);
+            if (declared.length >= floor) {
                 return { admit: true };
             }
             log('cluster-member:admission-reject', {
                 messageHash: record.messageHash,
                 reason: 'low-confidence-downsize',
                 declaredSize: declared.length,
-                configuredClusterSize: this.configuredClusterSize,
+                floor,
+                assumedClusterSize: this.assumedClusterSize,
                 confidence: derived?.confidence
             });
-            return { admit: false, reason: `${MEMBERSHIP_NOT_ADMITTED}:low-confidence-downsize` };
+            // The numbers ride along in the reason: this rejection is caused by *local* configuration, and
+            // without them a coordinator (or an operator reading a dispute record) has no hint which knob did it.
+            // NOTE: two honest members with different local config now emit *different* reason strings for the
+            // same record. Nothing compares reasons across peers today (`disputeEvidence.rejectReasons` is a
+            // per-peer map, and the signed payload hashes the string each vote carries); if anything ever groups
+            // or dedupes dispute reasons by string equality, group on the `membership-not-admitted:<variant>`
+            // prefix, not the whole string.
+            return {
+                admit: false,
+                reason: `${MEMBERSHIP_NOT_ADMITTED}:low-confidence-downsize (declared=${declared.length}, floor=${floor}, assumedClusterSize=${this.assumedClusterSize})`
+            };
         }
         const expected = Object.keys(derived.peers ?? {});
         const kEst = expected.length;
         // Predicate 2: floor derived from the member's OWN confident estimate.
-        const floor = Math.max(this.minAbsoluteClusterSize, Math.ceil(this.membershipAdmissionFraction * kEst));
+        const floor = this.admissionFloor(kEst);
         if (declared.length < floor) {
             log('cluster-member:admission-reject', {
                 messageHash: record.messageHash,
@@ -719,7 +746,10 @@ export class ClusterMember {
                 floor,
                 kEst
             });
-            return { admit: false, reason: `${MEMBERSHIP_NOT_ADMITTED}:below-floor` };
+            return {
+                admit: false,
+                reason: `${MEMBERSHIP_NOT_ADMITTED}:below-floor (declared=${declared.length}, floor=${floor}, kEst=${kEst})`
+            };
         }
         // Predicate 3: consistency with the derived view within tolerance.
         const symmetricDiff = ClusterMember.symmetricDifferenceSize(declared, expected);
@@ -737,6 +767,26 @@ export class ClusterMember {
         }
         return { admit: true };
     }
+    /**
+     * The smallest declared peer set admissible against a cohort-size reference `k`, whether `k` is
+     * measured (the confident path's `kEst`) or asserted (`assumedClusterSize`). One function so the
+     * fallback can never be stricter than the measured path — which it was, demanding the full configured
+     * size with no fraction and no slack. Clamped at `minAbsoluteClusterSize`, so a degenerate `k` of 0, 1
+     * or negative yields the absolute floor rather than a floor that admits everything. A non-finite scaled
+     * size (a `NaN` or `Infinity` config value) is likewise treated as no usable reference rather than
+     * propagating: an unguarded `NaN` floor fails EVERY comparison, which would silently make the node
+     * reject every unconfident write.
+     *
+     * NOTE: partition safety needs `2 · membershipAdmissionFraction · superMajorityThreshold > 1` — each
+     * side of a split must recruit `fraction · threshold · K` distinct honest members, and two sides cannot
+     * both find them in one K-peer cluster. At the shipped defaults (0.75 · 0.67) that product is 1.005 —
+     * true, but with almost no margin. If either default is ever lowered, re-check Theorem 2 in
+     * `docs/correctness.md` before shipping it.
+     */
+    admissionFloor(k) {
+        const scaled = Math.ceil(this.membershipAdmissionFraction * k);
+        return Math.max(this.minAbsoluteClusterSize, Number.isFinite(scaled) ? scaled : 0);
+    }
     /**
      * Derive this member's own view of the record's block cluster via the injected capability, or
      * `undefined` when it cannot (no capability, no coordinating block id, or a derivation error — all of
@@ -792,6 +842,20 @@ export class ClusterMember {
                     const blockResults = await this.storageRepo.get({ blockIds });
                     for (const blockId of blockIds) {
                         const blockResult = blockResults[blockId];
+                        if (blockResult?.unavailable !== undefined) {
+                            // This member cannot establish the block's revision, so it cannot judge
+                            // staleness. Vote reject rather than approve on an answer it knows is a
+                            // guess — approving would let a stale pend reach consensus on the strength
+                            // of a member that could not check it. (Before StorageRepo caught
+                            // materialization faults per block, this read threw out of the promise
+                            // handler; rejecting keeps the fail-closed posture with a signed reason.)
+                            log('cluster-member:validation-block-unavailable', {
+                                messageHash: record.messageHash,
+                                blockId,
+                                reason: blockResult.unavailable
+                            });
+                            return { valid: false, reason: `block ${blockId} unavailable (${blockResult.unavailable}): cannot verify revision` };
+                        }
                         const latestRev = blockResult?.state?.latest?.rev;
                         if (latestRev !== undefined && latestRev >= pendRequest.rev) {
                             log('cluster-member:validation-stale-revision', {
@@ -800,6 +864,13 @@ export class ClusterMember {
                                 requestedRev: pendRequest.rev,
                                 latestRev
                             });
+                            // Deliberately prose-only: this reason is fed to computeSigningPayload, signed,
+                            // and carried as Signature.rejectReason, so adding a structured revision here
+                            // would change the signed byte layout and the Signature type — every peer would
+                            // have to agree on the new format or verification breaks across versions. This
+                            // is NOT a StaleFailure producer, so StaleFailure.staleAt does not apply; the
+                            // coordinator's own local re-read (CoordinatorRepo.classifyStaleRejection)
+                            // supplies that number when it can confirm the revision itself.
                             return { valid: false, reason: `stale revision: block ${blockId} at rev ${latestRev}, requested rev ${pendRequest.rev}` };
                         }
                     }
@@ -1169,7 +1240,12 @@ export class ClusterMember {
     async reconcileOneBlock(messageHash, blockId, committed, cohortPeerIds) {
         try {
             await this.withReconcileTimeout(this.reconcileBlock(blockId, committed, cohortPeerIds), blockId);
-            log('cluster-member:consensus-commit-reconciled', { messageHash, blockId, rev: committed.rev });
+            // "attempted", not "reconciled": the callback returns void, and a quorum decline is a
+            // normal, non-throwing outcome — so reaching here means the pass ran to completion, NOT
+            // that anything was restored. `reconcile:restored` (reconcile-block.ts) is the line that
+            // says the bytes actually landed; `reconcile:no-rev-quorum` / `reconcile:no-content-quorum`
+            // say they did not.
+            log('cluster-member:consensus-commit-reconcile-attempted', { messageHash, blockId, rev: committed.rev });
         }
         catch (err) {
             log('cluster-member:consensus-commit-reconcile-failed', {