@optimystic/db-p2p 0.22.0 → 0.24.1

package/dist/src/cluster/cluster-repo.js

@@ -1,5 +1,5 @@
 import { blockIdsForTransforms, DEFAULT_SUPER_MAJORITY_THRESHOLD } from "@optimystic/db-core";
-import { computeClusterCommitHash, computeClusterMessageHash, computeClusterPromiseHash, membershipDigest, recordMembershipDigest, clampPriority } from "@optimystic/db-core";
+import { computeClusterCommitHash, computeClusterMessageHash, computeClusterPromiseHash, membershipDigest, recordMembershipDigest, clampPriority, clusterVoteSigningPayload, clusterVoteVerificationPayload } from "@optimystic/db-core";
 import { verifyInvalidationCertificate } from "../dispute/invalidation.js";
 import { buildCommitCert, invalidationActionId } from "./commit-cert.js";
 import { ClusterClient } from "./client.js";
@@ -17,10 +17,12 @@ var TransactionPhase;
 (function (TransactionPhase) {
     TransactionPhase[TransactionPhase["Promising"] = 0] = "Promising";
     TransactionPhase[TransactionPhase["OurPromiseNeeded"] = 1] = "OurPromiseNeeded";
-    TransactionPhase[TransactionPhase["OurCommitNeeded"] = 2] = "OurCommitNeeded";
-    TransactionPhase[TransactionPhase["Consensus"] = 3] = "Consensus";
-    TransactionPhase[TransactionPhase["Rejected"] = 4] = "Rejected";
-    TransactionPhase[TransactionPhase["Propagating"] = 5] = "Propagating"; // Transaction is being propagated
+    TransactionPhase[TransactionPhase["OurConflictVoteNeeded"] = 2] = "OurConflictVoteNeeded";
+    TransactionPhase[TransactionPhase["OurCommitNeeded"] = 3] = "OurCommitNeeded";
+    TransactionPhase[TransactionPhase["Consensus"] = 4] = "Consensus";
+    TransactionPhase[TransactionPhase["Rejected"] = 5] = "Rejected";
+    TransactionPhase[TransactionPhase["ConflictSuperseded"] = 6] = "ConflictSuperseded";
+    TransactionPhase[TransactionPhase["Propagating"] = 7] = "Propagating"; // Transaction is being propagated
 })(TransactionPhase || (TransactionPhase = {}));
 /** Stable reject reason a member emits when a declared peer set fails the membership admission gate. */
 export const MEMBERSHIP_NOT_ADMITTED = 'membership-not-admitted';
@@ -239,78 +241,104 @@ export class ClusterMember {
                 mergedCommits: Object.keys(currentRecord.commits ?? {})
             });
         }
-        // Get the current transaction state
-        const phase = await this.getTransactionPhase(currentRecord);
-        log('cluster-member:phase', {
-            messageHash: record.messageHash,
-            phase,
-            promises: Object.keys(currentRecord.promises ?? {}),
-            commits: Object.keys(currentRecord.commits ?? {})
-        });
+        // Drive the phase machine to a FIXPOINT rather than handling one phase per delivery. Each
+        // vote this member adds can put the record straight into the next phase (our promise
+        // completes super-majority ⇒ our commit is due; our commit completes the majority ⇒
+        // consensus; our reject/conflict vote makes the record terminal), and any follow-on phase
+        // not re-handled here would silently wait for the coordinator's next delivery — e.g. a
+        // member whose promise the coordinator never collected receives the commit-phase record,
+        // adds its promise, and must then also commit in the SAME delivery. One loop replaces the
+        // hand-written per-branch re-checks that used to cover only the follow-ons their authors
+        // thought of. Only the three vote-adding phases continue; each strictly grows the record
+        // (adds a promise or commit key), so the loop terminates — the cap guards a
+        // phase-computation bug, not a real bound.
+        const MaxPhaseSteps = 8;
         let shouldPersist = true;
-        // Handle the transaction based on its state
-        switch (phase) {
-            case TransactionPhase.OurPromiseNeeded:
-                log('cluster-member:action-promise', {
-                    messageHash: record.messageHash
-                });
-                currentRecord = await this.handlePromiseNeeded(currentRecord);
-                log('cluster-member:action-promise-complete', {
-                    messageHash: record.messageHash,
-                    promises: Object.keys(currentRecord.promises ?? {})
-                });
-                break;
-            case TransactionPhase.OurCommitNeeded:
-                log('cluster-member:action-commit', {
-                    messageHash: record.messageHash
-                });
-                currentRecord = await this.handleCommitNeeded(currentRecord);
-                log('cluster-member:action-commit-complete', {
-                    messageHash: record.messageHash,
-                    commits: Object.keys(currentRecord.commits ?? {})
-                });
-                // After adding our commit, check if we now have consensus and execute if so
-                {
-                    const newPhase = await this.getTransactionPhase(currentRecord);
-                    if (newPhase === TransactionPhase.Consensus) {
-                        log('cluster-member:action-consensus-after-commit', {
-                            messageHash: record.messageHash
-                        });
-                        await this.handleConsensus(currentRecord);
-                    }
-                }
-                shouldPersist = false;
-                break;
-            case TransactionPhase.Consensus:
-                log('cluster-member:action-consensus', {
-                    messageHash: record.messageHash
-                });
-                await this.handleConsensus(currentRecord);
-                // Don't call clearTransaction here - it happens in handleConsensus
-                shouldPersist = false;
-                break;
-            case TransactionPhase.Rejected:
-                log('cluster-member:action-rejected', {
-                    messageHash: record.messageHash
-                });
-                // Don't call clearTransaction here - it happens in handleRejection
-                await this.handleRejection(currentRecord);
-                shouldPersist = false;
-                break;
-            case TransactionPhase.Propagating:
-                // Transaction is complete and propagating - clean it up
-                log('cluster-member:phase-propagating', {
-                    messageHash: record.messageHash
-                });
-                shouldPersist = false;
-                break;
-            case TransactionPhase.Promising:
-                // Still collecting promises from peers - if we haven't added ours and there's no conflict, add it
-                // This state shouldn't normally be reached since OurPromiseNeeded is checked first
-                log('cluster-member:phase-promising-blocked', {
-                    messageHash: record.messageHash
-                });
+        phaseLoop: for (let step = 0;; step++) {
+            if (step >= MaxPhaseSteps) {
+                log('cluster-member:phase-loop-overflow', { messageHash: record.messageHash, steps: step });
                 break;
+            }
+            const phaseResult = await this.getTransactionPhase(currentRecord);
+            log('cluster-member:phase', {
+                messageHash: record.messageHash,
+                phase: phaseResult.phase,
+                step,
+                promises: Object.keys(currentRecord.promises ?? {}),
+                commits: Object.keys(currentRecord.commits ?? {})
+            });
+            switch (phaseResult.phase) {
+                case TransactionPhase.OurPromiseNeeded:
+                    log('cluster-member:action-promise', {
+                        messageHash: record.messageHash
+                    });
+                    currentRecord = await this.handlePromiseNeeded(currentRecord);
+                    log('cluster-member:action-promise-complete', {
+                        messageHash: record.messageHash,
+                        promises: Object.keys(currentRecord.promises ?? {})
+                    });
+                    // Our own vote can be terminal (a reject where maxAllowedRejections is 0) or complete
+                    // the super-majority — recompute rather than guess which.
+                    continue;
+                case TransactionPhase.OurConflictVoteNeeded:
+                    currentRecord = await this.handleConflictVoteNeeded(currentRecord, phaseResult.conflictsWith);
+                    // Never persist a record we conflict-voted: this member holds the WINNER, and
+                    // persisting the loser would reserve the same blocks a second time — half of what
+                    // made the silent-abstention failure self-sustaining.
+                    shouldPersist = false;
+                    continue;
+                case TransactionPhase.OurCommitNeeded:
+                    log('cluster-member:action-commit', {
+                        messageHash: record.messageHash
+                    });
+                    currentRecord = await this.handleCommitNeeded(currentRecord);
+                    log('cluster-member:action-commit-complete', {
+                        messageHash: record.messageHash,
+                        commits: Object.keys(currentRecord.commits ?? {})
+                    });
+                    shouldPersist = false;
+                    // Our commit may have completed the majority — recompute; Consensus executes below.
+                    continue;
+                case TransactionPhase.Consensus:
+                    log('cluster-member:action-consensus', {
+                        messageHash: record.messageHash
+                    });
+                    await this.handleConsensus(currentRecord);
+                    shouldPersist = false;
+                    break phaseLoop;
+                case TransactionPhase.Rejected:
+                    log('cluster-member:action-rejected', {
+                        messageHash: record.messageHash
+                    });
+                    await this.handleRejection(currentRecord);
+                    shouldPersist = false;
+                    break phaseLoop;
+                case TransactionPhase.ConflictSuperseded:
+                    // Enough conflict votes that super-majority is unreachable. NOT a rejection — the
+                    // callers retry it as a fresh transaction — so it gets its own terminal phase and the
+                    // record is cleared rather than held (holding a provably-dead loser would reserve its
+                    // blocks against the very retry that is supposed to win).
+                    log('cluster-member:action-conflict-superseded', {
+                        messageHash: record.messageHash
+                    });
+                    shouldPersist = false;
+                    break phaseLoop;
+                case TransactionPhase.Propagating:
+                    // Transaction is complete and propagating - clean it up
+                    log('cluster-member:phase-propagating', {
+                        messageHash: record.messageHash
+                    });
+                    shouldPersist = false;
+                    break phaseLoop;
+                case TransactionPhase.Promising:
+                    // We have already voted (approve, reject, or conflict); the record is still
+                    // collecting promises from the rest of the cohort. Nothing to add — retain the
+                    // record only if our vote wasn't a conflict (`shouldPersist` already reflects that).
+                    log('cluster-member:phase-promising-waiting', {
+                        messageHash: record.messageHash
+                    });
+                    break phaseLoop;
+            }
         }
         if (shouldPersist) {
             // Update transaction state
@@ -515,13 +543,8 @@ export class ClusterMember {
     async computeCommitHash(record) {
         return computeClusterCommitHash(record.messageHash, record.message, record.promises, recordMembershipDigest(record));
     }
-    computeSigningPayload(hash, type, rejectReason) {
-        const payload = hash + ':' + type + (rejectReason ? ':' + rejectReason : '');
-        return new TextEncoder().encode(payload);
-    }
-    async signVote(hash, type, rejectReason) {
-        const payload = this.computeSigningPayload(hash, type, rejectReason);
-        const sigBytes = await this.privateKey.sign(payload);
+    async signVote(hash, type, extra) {
+        const sigBytes = await this.privateKey.sign(clusterVoteSigningPayload(hash, type, extra));
         return uint8ArrayToString(sigBytes, 'base64url');
     }
     /**
@@ -557,7 +580,7 @@ export class ClusterMember {
         }
         try {
             const pubKey = publicKeyFromRaw(keyBytes);
-            const payload = this.computeSigningPayload(hash, signature.type, signature.rejectReason);
+            const payload = clusterVoteVerificationPayload(hash, signature);
             const sigBytes = uint8ArrayFromString(signature.signature, 'base64url');
             const ok = await pubKey.verify(payload, sigBytes);
             // Key is bound to peerId: a failed verify is a genuine bad vote from a proven identity → penalize.
@@ -580,31 +603,62 @@ export class ClusterMember {
         const ourId = this.peerId.toString();
         const superMajority = Math.ceil(peerCount * this.superMajorityThreshold);
         const maxAllowedRejections = peerCount - superMajority;
-        // Check for rejections — rejected if too many rejections to ever reach super-majority
+        // Check for rejections — rejected if too many rejections to ever reach super-majority.
+        // ONLY `reject` votes count here: a `conflict` vote is "not now", never a validity
+        // judgement, so it must not push a record into the permanent `Rejected` phase.
         const rejectedPromises = Object.values(record.promises).filter(s => s.type === 'reject');
+        const conflictPromises = Object.values(record.promises).filter(s => s.type === 'conflict');
         const rejectedCommits = Object.values(record.commits).filter(s => s.type === 'reject');
         if (rejectedPromises.length > maxAllowedRejections || this.hasMajority(rejectedCommits.length, peerCount)) {
-            return TransactionPhase.Rejected;
-        }
-        // Check if we need to promise
-        if (!record.promises[ourId] && !this.hasConflict(record)) {
-            return TransactionPhase.OurPromiseNeeded;
-        }
-        // Check if we have enough approved promises to proceed to commit
+            return { phase: TransactionPhase.Rejected };
+        }
+        // Conflict votes don't judge validity, but enough of them still make super-majority
+        // unreachable — a distinct terminal outcome (retryable as a fresh transaction) so logs and
+        // reputation-adjacent paths keep meaning what they say.
+        if (conflictPromises.length > 0 && rejectedPromises.length + conflictPromises.length > maxAllowedRejections) {
+            return { phase: TransactionPhase.ConflictSuperseded };
+        }
+        // Check if we need to vote. A lost race is answered with a conflict vote, not silence:
+        // absence used to mean both "unreachable" and "refusing in favour of a rival", and the
+        // coordinator could not tell the two apart. Once our conflict vote is merged into
+        // `promises`, this branch is skipped forever — a conflict vote is terminal for this record;
+        // a retry must be a fresh transaction (new messageHash), which `CoordinatorRepo.pend`
+        // already mints per call.
+        if (!record.promises[ourId]) {
+            const conflict = this.findConflict(record);
+            if (conflict) {
+                return { phase: TransactionPhase.OurConflictVoteNeeded, conflictsWith: conflict.blockedBy };
+            }
+            return { phase: TransactionPhase.OurPromiseNeeded };
+        }
+        // Check if we have enough approved promises to proceed to commit. Deliberately blind to what
+        // OUR own vote was: the rest of the cohort reaching super-majority is the commit rule
+        // (Theorem 1 Case 2), so a member that rejected — or conflict-voted — still signs the commit
+        // the cohort decided on rather than stalling it. Only the rejection/superseded thresholds
+        // above can stop a record here, and both are checked first.
+        //
+        // NOTE: signing the commit drops this member's reservation on the record
+        // (`shouldPersist = false` in the caller), and the phase fixpoint means that can now happen on
+        // the FIRST delivery when the record already arrives at super-majority, rather than a
+        // round-trip later. The safety argument is quorum intersection (Theorem 9: no rival can
+        // assemble its own super-majority once this one has), NOT the reservation — the reservation
+        // only orders *concurrently-pending* rivals. If a lost-update between commit-signing and
+        // consensus-apply ever shows up, hold the reservation until `handleConsensus` instead of
+        // releasing it here.
         const approvedPromises = Object.values(record.promises).filter(s => s.type === 'approve');
         if (approvedPromises.length >= superMajority && !record.commits[ourId]) {
-            return TransactionPhase.OurCommitNeeded;
+            return { phase: TransactionPhase.OurCommitNeeded };
         }
         // Check if still collecting promises
         if (promiseCount < peerCount && approvedPromises.length < superMajority) {
-            return TransactionPhase.Promising;
+            return { phase: TransactionPhase.Promising };
         }
         // Check for consensus
         const approvedCommits = Object.values(record.commits).filter(s => s.type === 'approve');
         if (this.hasMajority(approvedCommits.length, peerCount)) {
-            return TransactionPhase.Consensus;
+            return { phase: TransactionPhase.Consensus };
         }
-        return TransactionPhase.Propagating;
+        return { phase: TransactionPhase.Propagating };
     }
     hasMajority(count, total) {
         return count > total / 2;
@@ -636,6 +690,31 @@ export class ClusterMember {
             }
         };
     }
+    /**
+     * Answer a record that lost the deterministic race to a transaction this member already holds
+     * (`docs/correctness.md` Theorems 1 & 9: the loser is TOLD it lost, not ignored — an unanswered
+     * loss is indistinguishable from an unreachable cohort at the coordinator). `conflictWith` — the
+     * winning rival's messageHash — is folded into the signed payload, so the claim is
+     * integrity-protected in transit and readable without parsing prose. NOT a validity judgement:
+     * {@link getTransactionPhase} never counts conflict votes toward the permanent-rejection
+     * threshold, and the coordinator surfaces them as a retryable loss, never a validator rejection.
+     */
+    async handleConflictVoteNeeded(record, conflictWith) {
+        log('cluster-member:action-conflict-vote', {
+            messageHash: record.messageHash,
+            conflictWith
+        });
+        const promiseHash = await this.computePromiseHash(record);
+        const sig = await this.signVote(promiseHash, 'conflict', conflictWith);
+        const signature = { type: 'conflict', signature: sig, conflictWith };
+        return {
+            ...record,
+            promises: {
+                ...record.promises,
+                [this.peerId.toString()]: signature
+            }
+        };
+    }
     /**
      * The full promise-phase decision for a record: admit the declared membership FIRST, then (only if
      * admitted) validate its pend operations. Failing either yields a `{ valid:false, reason }` the caller
@@ -1051,7 +1130,7 @@ export class ClusterMember {
             // Gated on the sink: with no reactivity wired the preimage has no consumer, so a sink-less
             // node pays neither the extra `sha256` nor the extra microtask — the true zero-cost default.
             if (this.onCommitCertificate) {
-                const commitSignedPayload = this.computeSigningPayload(await this.computeCommitHash(record), 'approve');
+                const commitSignedPayload = clusterVoteSigningPayload(await this.computeCommitHash(record), 'approve');
                 this.captureCommitCert(record, commit.actionId, commitSignedPayload);
             }
             let result;
@@ -1170,7 +1249,7 @@ export class ClusterMember {
         // {@link invalidationActionId} the invalidation's change event also carries, so the bridge's
         // cert extractor resolves it. Gated on the sink — a node with no reactivity wired pays nothing.
         if (this.onCommitCertificate) {
-            const invSignedPayload = this.computeSigningPayload(await this.computeCommitHash(record), 'approve');
+            const invSignedPayload = clusterVoteSigningPayload(await this.computeCommitHash(record), 'approve');
             this.captureCommitCert(record, invalidationActionId(request.invalidatedActionId, request.resolution.disputeId), invSignedPayload);
         }
         if (!this.onInvalidate) {
@@ -1280,11 +1359,19 @@ export class ClusterMember {
             resolutionTimeout: setTimeout(() => this.resolveWithPeers(record.messageHash), record.message.expiration + 5000 - Date.now()).unref()
         };
     }
-    hasConflict(record) {
+    /**
+     * Scan this member's reservation table (`activeTransactions`) for a held transaction that
+     * conflicts with `record` AND wins the deterministic race against it. Returns the winner's
+     * identity — `{ blockedBy: messageHash }` — rather than a bare boolean, because that identity is
+     * exactly what the resulting conflict vote must name (`Signature.conflictWith`); the old boolean
+     * lost it. `undefined` means no blocking conflict. Side-effectful on the way through: stale
+     * entries are swept, and a held transaction that LOSES the race to `record` is cleared.
+     */
+    findConflict(record) {
         const now = Date.now();
         const staleThresholdMs = 2000; // 2 seconds - allow more time for distributed consensus
         const incomingBlockIds = this.getAffectedBlockIds(record.message.operations);
-        log('cluster-member:hasConflict-check', {
+        log('cluster-member:findConflict-check', {
             messageHash: record.messageHash,
             activeCount: this.activeTransactions.size,
             incomingBlockIds
@@ -1294,7 +1381,7 @@ export class ClusterMember {
                 continue;
             }
             const existingBlockIds = this.getAffectedBlockIds(state.record.message.operations);
-            log('cluster-member:hasConflict-compare', {
+            log('cluster-member:findConflict-compare', {
                 existing: existingHash,
                 incoming: record.messageHash,
                 existingBlockIds,
@@ -1317,7 +1404,7 @@ export class ClusterMember {
                         existing: existingHash,
                         incoming: record.messageHash
                     });
-                    return true; // Reject incoming
+                    return { blockedBy: existingHash }; // Reject incoming, naming the winner
                 }
                 else {
                     // Accept incoming, abort existing
@@ -1330,37 +1417,47 @@ export class ClusterMember {
                 }
             }
         }
-        return false; // No blocking conflicts
+        return undefined; // No blocking conflicts
+    }
+    /** Number of *approve* promise votes on a record — the count the commit rule uses. */
+    static approvalCount(record) {
+        return Object.values(record.promises).filter(s => s.type === 'approve').length;
     }
     /**
      * Resolve a race between two conflicting transactions. Total and deterministic, so every honest
      * member computes the identical winner (the Theorem 1 Case-2 premise). Order:
-     *   1. more promise signatures wins  (progress monotonicity — see safety note below);
-     *   2. equal promise counts → higher aged priority wins  (fairness — see {@link recordPriority});
+     *   1. more *approve* promise signatures wins  (progress monotonicity — see safety note below);
+     *   2. equal approval counts → higher aged priority wins  (fairness — see {@link recordPriority});
      *   3. still tied → higher message hash wins.
      *
-     * Promise count is FIRST so this comparison never displaces a transaction that is further along.
+     * The count is APPROVALS, not `promises` keys. `promises` is the vote map — a reject occupies a key
+     * there exactly as an approve does — so counting keys would treat a rejection as progress, letting a
+     * record that can never commit outrank (and therefore block, via {@link findConflict}) a fresh rival
+     * for the whole staleness window. Approvals is also the count the invariant below actually needs:
+     * the commit rule is `approvedPromises >= superMajority`, which never looks at rejections.
+     *
+     * Approval count is FIRST so this comparison never displaces a transaction that is further along.
      * That restores the pre-priority safety invariant: a member commits purely on promise supermajority
      * (`handleCommitNeeded` signs whenever `approvedPromises >= superMajority`; the commit path has NO
      * conflict re-check), so `resolveRace` is the ONLY arbiter among concurrently-pending conflicts.
-     * With promises-first, once transaction X holds a promise supermajority every conflicting rival Y has
-     * strictly fewer promises — Y can only match X's count by getting the intersecting quorum member to
-     * promise it, but that member already holds X at supermajority and `resolveRace(X, Y)` returns
+     * With approvals-first, once transaction X holds a promise supermajority every conflicting rival Y has
+     * strictly fewer approvals — Y can only match X's count by getting the intersecting quorum member to
+     * approve it, but that member already holds X at supermajority and `resolveRace(X, Y)` returns
      * `keep-existing` on X's higher count, so it never does. By quorum intersection any Y-supermajority
      * overlaps X's in ≥1 honest member, and that member rejects Y. One winner (docs/correctness.md
      * Theorem 9). Priority-first would break this: it could displace an already-quorum-reached X for a
-     * higher-priority Y with fewer promises, letting BOTH commit (split brain) — the regression fixed by
+     * higher-priority Y with fewer approvals, letting BOTH commit (split brain) — the regression fixed by
      * ticket occ-priority-first-breaks-promise-monotonicity.
      *
-     * Priority is now a tie-break that runs only at EQUAL promise counts, which is exactly the
+     * Priority is now a tie-break that runs only at EQUAL approval counts, which is exactly the
      * concurrent-starvation case aging targets (two fresh rivals, 0 promises each, otherwise coin-flipping
      * on the hash). Priority still breaks those ties deterministically, so aging still solves the stated
      * fairness problem in its common case. It only orders two *concurrently-pending* conflicts; it does NOT
      * defer a fresh pend for an absent aged transaction (that residual — sequential sub-window starvation —
      * is the deferred feat-occ-priority-reservation).
      *
-     * NOTE: residual-fairness tripwire. Under promises-first an aged transaction can still lose to a fresh
-     * rival that has *legitimately* gathered even one more promise — that is not the pure-coin-flip
+     * NOTE: residual-fairness tripwire. Under approvals-first an aged transaction can still lose to a fresh
+     * rival that has *legitimately* gathered even one more approval — that is not the pure-coin-flip
      * starvation aging targets (equal counts, priority wins), it is the monotonicity behaviour we WANT (a
      * more-progressed rival is never displaced). If deeper fairness against a genuinely-more-progressed
      * rival is ever needed, it belongs to feat-occ-priority-reservation (reserve/defer at pend time), NOT
@@ -1369,7 +1466,7 @@ export class ClusterMember {
      * NOTE: Byzantine self-assert is a fairness DoS, not a safety hole. A coordinator can stamp
      * priority == MaxPriority on every transaction; recordPriority clamps to the cap so it cannot
      * exceed it, and priority never influences validity/operationsHash/stale-read checks — and now sits
-     * below the promise count, so it can only break equal-count ties it might have ~50% won anyway,
+     * below the approval count, so it can only break equal-count ties it might have ~50% won anyway,
      * degrading to at-worst-status-quo fairness (the same graceful-degradation class as spam under
      * honest-majority). Binding priority to provable age is out of scope (feat-occ-priority-reservation).
      *
@@ -1378,13 +1475,17 @@ export class ClusterMember {
      * (design-hot-log-tail-sharding-guidance).
      */
     resolveRace(existing, incoming) {
-        // 1. Transaction with more promises wins — never displace a more-progressed rival (safety, see above).
-        const existingCount = Object.keys(existing.promises).length;
-        const incomingCount = Object.keys(incoming.promises).length;
+        // 1. Transaction with more APPROVALS wins — never displace a more-progressed rival (safety, see
+        // above). Counting `promises` keys instead would count reject votes as progress: a record holding
+        // one rejection would outrank an untouched rival and reserve its blocks for the whole staleness
+        // window, and the commit rule this ordering protects (`approvedPromises >= superMajority`) never
+        // looks at rejections anyway.
+        const existingCount = ClusterMember.approvalCount(existing);
+        const incomingCount = ClusterMember.approvalCount(incoming);
         if (existingCount !== incomingCount) {
             return existingCount > incomingCount ? 'keep-existing' : 'accept-incoming';
         }
-        // 2. Equal promise counts → higher aged priority wins (fairness tie-break).
+        // 2. Equal approval counts → higher aged priority wins (fairness tie-break).
         const existingPriority = this.recordPriority(existing);
         const incomingPriority = this.recordPriority(incoming);
         if (existingPriority !== incomingPriority) {
@@ -1405,7 +1506,7 @@ export class ClusterMember {
      * NOTE: `message` is fixed for a transaction's whole lifecycle (promises/commits accrue in the
      * separate `promises`/`commits` maps, never in `message`), so a transaction keeps its rank through
      * the commit phase — there is no "priority drops to 0 at commit" asymmetry. resolveRace is only
-     * consulted at the promise decision (hasConflict), i.e. between two still-open conflicting
+     * consulted at the promise decision (findConflict), i.e. between two still-open conflicting
      * transactions, which is exactly the concurrent-contention case priority is meant to order.
      */
     recordPriority(record) {
@@ -1554,7 +1655,13 @@ export class ClusterMember {
             const state = this.activeTransactions.get(messageHash);
             if (!state)
                 continue;
-            const phase = await this.getTransactionPhase(state.record);
+            // NOTE: an expired entry already in a terminal phase is deliberately left alone here —
+            // `processUpdate` clears those on the update that made them terminal, so reaching this point
+            // in one means that update never arrived. It is not stranded: `findConflict`'s 2 s staleness
+            // sweep drops it on the next conflicting arrival. But on a member that then goes idle the
+            // entry lingers until traffic returns. If member memory ever shows entries outliving their
+            // expiration, delete unconditionally here instead of exempting the terminal phases.
+            const { phase } = await this.getTransactionPhase(state.record);
             if (phase !== TransactionPhase.Consensus && phase !== TransactionPhase.Rejected) {
                 this.activeTransactions.delete(messageHash);
             }