@optimystic/db-p2p 0.24.2 → 0.25.0

package/dist/src/cluster/rebalance-monitor.d.ts

@@ -9,6 +9,17 @@ export interface RebalanceEvent {
     lost: string[];
     /** Peers that are now closer for the lost blocks: blockId → peerId[] */
     newOwners: Map<string, string[]>;
+    /**
+     * Blocks this node KEEPS responsibility for whose cohort now contains peers it has not seen
+     * co-responsible before: blockId → the newly co-responsible peer ids (never self). This is the
+     * cohort-GROWTH arm: the founder case (a block committed while the deployment was one node) never
+     * appears in `lost` — the holder keeps the block — so without this arm nothing ever pushes the
+     * second copy and the block stays readable only by its sole holder. The reaction pushes each
+     * block to these peers (capped by the replication floor). A block can appear in both `gained`
+     * and `grown` (first observation after a restart/regain — the push then finds no local data and
+     * is a benign no-op); it can never appear in both `lost` and `grown` (lost ⇒ not responsible).
+     */
+    grown: Map<string, string[]>;
     /**
      * Replication floor `N` for this event — the cohort size FRET assembled at check time
      * ({@link RebalanceMonitor.getCohortSize}). The reaction gates release of a `lost` block on
@@ -19,6 +30,20 @@ export interface RebalanceEvent {
     /** Timestamp of the topology change that triggered this */
     triggeredAt: number;
 }
+/**
+ * What the growth reaction learned about ONE block reported `grown`. Fed back to
+ * {@link RebalanceMonitor.recordGrowthOutcome} so the seen set is confirmation-driven: a peer
+ * enters a block's seen set only once a replica is confirmed on it, or once the block has
+ * otherwise reached its floor. A block the reaction had NO information about (its confirm was
+ * deduped against one already in flight) gets no outcome at all — the monitor's state stays
+ * untouched and the next check re-detects.
+ */
+export interface GrowthOutcome {
+    /** Newly co-responsible peers that may now be recorded as seen for this block. */
+    satisfiedPeers: string[];
+    /** True when nothing about this block is still owed a push. */
+    complete: boolean;
+}
 export interface RebalanceMonitorConfig {
     /** Debounce window for topology changes (ms). Default: 5000 */
     debounceMs?: number;
@@ -26,6 +51,33 @@ export interface RebalanceMonitorConfig {
     minRebalanceIntervalMs?: number;
     /** Whether to suppress rebalancing during detected partitions. Default: true */
     suppressDuringPartition?: boolean;
+    /**
+     * Maximum blocks reported `grown` per check. Bounds the work a single peer join can trigger on a
+     * node with a large owned-block set — the primary bound is already the floor (a cohort is at most
+     * floor-sized, so each grown block pushes to ≤ floor−1 peers, and the reaction stops per block
+     * once the floor is met); this cap bounds the block COUNT per pass. A block dropped by the cap is
+     * NOT recorded as seen, so the next check re-detects the same growth — deferred, never lost.
+     * Default: 64
+     */
+    growthBlockBudget?: number;
+    /**
+     * How many incomplete growth outcomes ({@link GrowthOutcome} with `complete: false`) a block
+     * absorbs before its still-unsatisfied peers are moved to a per-block abandoned set and no longer
+     * pushed to. Without this bound a peer that permanently refuses would be re-pushed on every check
+     * forever, and its block would re-consume `growthBlockBudget` slots and starve genuinely-new
+     * growth. An abandoned peer that leaves the cohort and later rejoins is retried from scratch.
+     * Default: 5
+     */
+    growthMaxAttempts?: number;
+    /**
+     * Self-arming re-check timer for outstanding growth work (reported-but-unconfirmed peers, or
+     * blocks deferred by `growthBlockBudget`). Checks otherwise fire only on libp2p connection
+     * events, so a failed push on a then-quiet network would never be retried. Armed at the end of a
+     * check only while work is outstanding; fires `maybeRebalance()` so the existing
+     * `minRebalanceIntervalMs` throttle still bounds the push rate. `0` disables.
+     * Default: `minRebalanceIntervalMs`
+     */
+    growthRecheckIntervalMs?: number;
 }
 export interface RebalanceMonitorDeps {
     libp2p: Libp2p;
@@ -50,12 +102,17 @@ export declare class RebalanceMonitor implements Startable {
     private readonly responsibilitySnapshot;
     private readonly handlers;
     private debounceTimer;
+    private recheckTimer;
     private lastRebalanceAt;
     private pendingTopologyChange;
     private topologyChangeTimestamp;
+    private lastGrowthDeferred;
     private readonly debounceMs;
     private readonly minRebalanceIntervalMs;
     private readonly suppressDuringPartition;
+    private readonly growthBlockBudget;
+    private readonly growthMaxAttempts;
+    private readonly growthRecheckIntervalMs;
     private readonly onConnectionOpen;
     private readonly onConnectionClose;
     constructor(deps: RebalanceMonitorDeps, config?: RebalanceMonitorConfig);
@@ -66,6 +123,33 @@ export declare class RebalanceMonitor implements Startable {
     untrackBlock(blockId: string): void;
     getTrackedBlockCount(): number;
     checkNow(): Promise<RebalanceEvent | null>;
+    /**
+     * Feedback from the growth reaction for one block reported `grown`. `satisfiedPeers` enter the
+     * block's seen set; an incomplete outcome counts an attempt against `growthMaxAttempts`, and on
+     * reaching the bound the block's still-unsatisfied reported peers are abandoned (no longer
+     * pushed to until they leave the cohort and rejoin). Never called for a block the reaction had
+     * no information about (a confirm deduped against one already in flight) — a missing outcome
+     * leaves the block's state untouched so the next check retries.
+     */
+    recordGrowthOutcome(blockId: string, outcome: GrowthOutcome): void;
+    /**
+     * Growth-arm observability: how many tracked blocks still await confirmation on reported peers,
+     * how many (block, peer) pairs have been given up on, and whether the re-check timer is armed.
+     */
+    getGrowthDiagnostics(): {
+        blocksAwaitingConfirmation: number;
+        abandonedPairs: number;
+        recheckArmed: boolean;
+    };
+    /** Growth work is outstanding while any reported peer is unconfirmed or blocks were budget-deferred. */
+    private hasOutstandingGrowthWork;
+    /**
+     * Arm the growth re-check timer while work is outstanding; disarm it when there is none. The
+     * timer fires maybeRebalance(), so minRebalanceIntervalMs still bounds the push rate, and it
+     * re-arms itself after firing for as long as work remains. unref'd so it never holds the
+     * process open; stop() clears it.
+     */
+    private updateRecheckTimer;
     private handleTopologyChange;
     private maybeRebalance;
     private performRebalanceCheck;

package/dist/src/cluster/rebalance-monitor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rebalance-monitor.d.ts","sourceRoot":"","sources":["../../../src/cluster/rebalance-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AAM/F,MAAM,WAAW,cAAc;IAC9B,wDAAwD;IACxD,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wEAAwE;IACxE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChC;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,gFAAgF;IAChF,uBAAuB,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,WAAW,CAAA;IACjB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,WAAW,EAAE,oBAAoB,CAAA;IACjC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC3B;AAED,KAAK,gBAAgB,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAA;AAEvD,qBAAa,gBAAiB,YAAW,SAAS;IAuBhD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAtBtB,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAa;IAM3C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,aAAa,CAA6C;IAClE,OAAO,CAAC,eAAe,CAAI;IAC3B,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,uBAAuB,CAAI;IAEnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAC/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IAEjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAY;gBAG5B,IAAI,EAAE,oBAAoB,EAC3C,MAAM,GAAE,sBAA2B;IAc9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAUtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB3B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAI5C,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIjC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKnC,oBAAoB,IAAI,MAAM;IAIxB,QAAQ,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAIhD,OAAO,CAAC,oBAAoB;YAmBd,cAAc;YAgBd,qBAAqB;IA+CnC;;;;;OAKG;IACH,aAAa,IAAI,MAAM;IASvB,OAAO,CAAC,SAAS;IAUjB;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI;CAGhD"}
+{"version":3,"file":"rebalance-monitor.d.ts","sourceRoot":"","sources":["../../../src/cluster/rebalance-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AAM/F,MAAM,WAAW,cAAc;IAC9B,wDAAwD;IACxD,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wEAAwE;IACxE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChC;;;;;;;;;OASG;IACH,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5B;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC7B,kFAAkF;IAClF,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,sBAAsB;IACtC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,gFAAgF;IAChF,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,WAAW,CAAA;IACjB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,WAAW,EAAE,oBAAoB,CAAA;IACjC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC3B;AAED,KAAK,gBAAgB,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAA;AA+CvD,qBAAa,gBAAiB,YAAW,SAAS;IAoChD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAnCtB,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAa;IAc3C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAsC;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,aAAa,CAA6C;IAClE,OAAO,CAAC,YAAY,CAA6C;IACjE,OAAO,CAAC,eAAe,CAAI;IAC3B,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,uBAAuB,CAAI;IACnC,OAAO,CAAC,kBAAkB,CAAI;IAE9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAC/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAQ;IAEhD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAY;gBAG5B,IAAI,EAAE,oBAAoB,EAC3C,MAAM,GAAE,sBAA2B;IAiB9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAUtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAI5C,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIjC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKnC,oBAAoB,IAAI,MAAM;IAIxB,QAAQ,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAIhD;;;;;;;OAOG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,IAAI;IAuClE;;;OAGG;IACH,oBAAoB,IAAI;QAAE,0BAA0B,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE;IAW7G,wGAAwG;IACxG,OAAO,CAAC,wBAAwB;IAUhC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAsB1B,OAAO,CAAC,oBAAoB;YAmBd,cAAc;YAgBd,qBAAqB;IAiHnC;;;;;OAKG;IACH,aAAa,IAAI,MAAM;IASvB,OAAO,CAAC,SAAS;IAUjB;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI;CAGhD"}

package/dist/src/cluster/rebalance-monitor.js

@@ -2,6 +2,27 @@ import { hashKey } from 'p2p-fret';
 import { createLogger } from '../logger.js';
 const log = createLogger('rebalance-monitor');
 const textEncoder = new TextEncoder();
+const emptyGrowthState = (responsible) => ({
+    responsible,
+    cohortPeers: new Set(),
+    pendingPeers: new Set(),
+    growthAttempts: 0,
+    abandonedPeers: new Set()
+});
+const intersect = (remembered, current) => new Set([...(remembered ?? [])].filter(id => current.has(id)));
+/**
+ * Carry a still-responsible block's growth state into the next check, intersecting both remembered
+ * peer sets against the CURRENT cohort: a peer that left drops out of `cohortPeers` (so its return
+ * is re-detected — the departure self-heal) and out of `abandonedPeers` (so a rejoin is retried from
+ * scratch). `pendingPeers` is always rebuilt from this check's own report, never carried.
+ */
+const carryGrowthState = (prior, currentPeers) => ({
+    responsible: true,
+    cohortPeers: intersect(prior?.cohortPeers, currentPeers),
+    pendingPeers: new Set(),
+    growthAttempts: prior?.growthAttempts ?? 0,
+    abandonedPeers: intersect(prior?.abandonedPeers, currentPeers)
+});
 export class RebalanceMonitor {
     deps;
     running = false;
@@ -11,15 +32,28 @@ export class RebalanceMonitor {
     // responsibility-loss eviction going through untrackBlock — a snapshot entry for a since-removed
     // block may linger here. That is acceptable: performRebalanceCheck only iterates trackedBlocks, so
     // a lingering entry is inert; if the block is later re-fed, its responsibility is simply re-derived.
+    //
+    // `cohortPeers` is the growth arm's CONFIRMED-co-responsible memory. A MISSING entry is
+    // deliberately treated as "prior cohort = empty", so the first check after a topology event
+    // reports the whole non-self cohort as grown — that is what heals the founder case (A alone
+    // commits; B joins → first check pushes to B) and the restarted-holder case (snapshot memory is
+    // process-local, so a restarted holder re-pushes to everyone once). Peers enter the set only
+    // through recordGrowthOutcome — a reported-but-unconfirmed peer stays out, so a failed push is
+    // re-detected on the next check instead of being recorded as done.
     responsibilitySnapshot = new Map();
     handlers = [];
     debounceTimer = null;
+    recheckTimer = null;
     lastRebalanceAt = 0;
     pendingTopologyChange = false;
     topologyChangeTimestamp = 0;
+    lastGrowthDeferred = 0;
     debounceMs;
     minRebalanceIntervalMs;
     suppressDuringPartition;
+    growthBlockBudget;
+    growthMaxAttempts;
+    growthRecheckIntervalMs;
     onConnectionOpen;
     onConnectionClose;
     constructor(deps, config = {}) {
@@ -31,6 +65,9 @@ export class RebalanceMonitor {
         this.debounceMs = config.debounceMs ?? 5000;
         this.minRebalanceIntervalMs = config.minRebalanceIntervalMs ?? 60000;
         this.suppressDuringPartition = config.suppressDuringPartition ?? true;
+        this.growthBlockBudget = config.growthBlockBudget ?? 64;
+        this.growthMaxAttempts = config.growthMaxAttempts ?? 5;
+        this.growthRecheckIntervalMs = config.growthRecheckIntervalMs ?? this.minRebalanceIntervalMs;
         this.onConnectionOpen = () => this.handleTopologyChange();
         this.onConnectionClose = () => this.handleTopologyChange();
     }
@@ -52,6 +89,10 @@ export class RebalanceMonitor {
             clearTimeout(this.debounceTimer);
             this.debounceTimer = null;
         }
+        if (this.recheckTimer) {
+            clearTimeout(this.recheckTimer);
+            this.recheckTimer = null;
+        }
         this.pendingTopologyChange = false;
         log('stopped');
     }
@@ -71,6 +112,103 @@ export class RebalanceMonitor {
     async checkNow() {
         return this.performRebalanceCheck(Date.now());
     }
+    /**
+     * Feedback from the growth reaction for one block reported `grown`. `satisfiedPeers` enter the
+     * block's seen set; an incomplete outcome counts an attempt against `growthMaxAttempts`, and on
+     * reaching the bound the block's still-unsatisfied reported peers are abandoned (no longer
+     * pushed to until they leave the cohort and rejoin). Never called for a block the reaction had
+     * no information about (a confirm deduped against one already in flight) — a missing outcome
+     * leaves the block's state untouched so the next check retries.
+     */
+    recordGrowthOutcome(blockId, outcome) {
+        const state = this.responsibilitySnapshot.get(blockId);
+        // No state (untracked since) or responsibility lost since the report: the growth state was
+        // cleared, and recording into it would survive the clear and suppress the regain re-push.
+        if (!state || !state.responsible)
+            return;
+        for (const peerId of outcome.satisfiedPeers) {
+            state.cohortPeers.add(peerId);
+            state.pendingPeers.delete(peerId);
+        }
+        if (outcome.complete) {
+            state.growthAttempts = 0;
+            state.pendingPeers.clear();
+        }
+        else {
+            // NOTE: growthMaxAttempts is a floor on the retry count, not an exact one. `pendingPeers` is
+            // rebuilt from each check's own report, so two cases blunt the bound: a check that defers
+            // this block on growthBlockBudget clears pendingPeers, and a give-up landing right then
+            // abandons nobody while still resetting the counter; and two checks racing (the second
+            // re-reporting the same peer after the first's confirm left `inFlight` but before its outcome
+            // landed) double-count one attempt. Both are rare, both only change how many pushes a doomed
+            // peer absorbs. If a deployment ever tracks far more blocks than growthBlockBudget, deferral
+            // stops being rare — carry the report's peer list on GrowthOutcome and match it against
+            // pendingPeers instead of trusting the latest report.
+            state.growthAttempts++;
+            if (state.growthAttempts >= this.growthMaxAttempts) {
+                for (const peerId of state.pendingPeers) {
+                    state.abandonedPeers.add(peerId);
+                }
+                log('growth give-up: block=%s abandoning %d unsatisfied peer(s) after %d attempts', blockId, state.pendingPeers.size, state.growthAttempts);
+                state.pendingPeers.clear();
+                state.growthAttempts = 0;
+            }
+        }
+        this.updateRecheckTimer();
+    }
+    /**
+     * Growth-arm observability: how many tracked blocks still await confirmation on reported peers,
+     * how many (block, peer) pairs have been given up on, and whether the re-check timer is armed.
+     */
+    getGrowthDiagnostics() {
+        let blocksAwaitingConfirmation = 0;
+        let abandonedPairs = 0;
+        for (const [blockId, state] of this.responsibilitySnapshot) {
+            if (!state.responsible || !this.trackedBlocks.has(blockId))
+                continue;
+            if (state.pendingPeers.size > 0)
+                blocksAwaitingConfirmation++;
+            abandonedPairs += state.abandonedPeers.size;
+        }
+        return { blocksAwaitingConfirmation, abandonedPairs, recheckArmed: this.recheckTimer !== null };
+    }
+    /** Growth work is outstanding while any reported peer is unconfirmed or blocks were budget-deferred. */
+    hasOutstandingGrowthWork() {
+        if (this.lastGrowthDeferred > 0)
+            return true;
+        for (const [blockId, state] of this.responsibilitySnapshot) {
+            if (state.responsible && state.pendingPeers.size > 0 && this.trackedBlocks.has(blockId)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Arm the growth re-check timer while work is outstanding; disarm it when there is none. The
+     * timer fires maybeRebalance(), so minRebalanceIntervalMs still bounds the push rate, and it
+     * re-arms itself after firing for as long as work remains. unref'd so it never holds the
+     * process open; stop() clears it.
+     */
+    updateRecheckTimer() {
+        if (this.growthRecheckIntervalMs <= 0)
+            return;
+        if (!this.running || !this.hasOutstandingGrowthWork()) {
+            if (this.recheckTimer) {
+                clearTimeout(this.recheckTimer);
+                this.recheckTimer = null;
+            }
+            return;
+        }
+        if (this.recheckTimer)
+            return; // already armed
+        this.recheckTimer = setTimeout(() => {
+            this.recheckTimer = null;
+            void this.maybeRebalance()
+                .catch(err => { log('recheck error: %O', err); })
+                .finally(() => this.updateRecheckTimer());
+        }, this.growthRecheckIntervalMs);
+        this.recheckTimer.unref?.();
+    }
     handleTopologyChange() {
         if (!this.running)
             return;
@@ -108,19 +246,27 @@ export class RebalanceMonitor {
         }
         if (this.trackedBlocks.size === 0) {
             this.lastRebalanceAt = Date.now();
+            // Nothing left to grow, so any prior deferral is moot — drop it and let the re-check timer
+            // disarm, rather than re-arming forever against blocks that were untracked out from under it.
+            this.lastGrowthDeferred = 0;
+            this.updateRecheckTimer();
             return null;
         }
         const selfId = this.deps.libp2p.peerId.toString();
         const gained = [];
         const lost = [];
         const newOwners = new Map();
+        const grown = new Map();
+        let growthDeferred = 0;
+        const growthCandidates = [];
         for (const blockId of this.trackedBlocks) {
             const key = textEncoder.encode(blockId);
             const coord = await hashKey(key);
             // Get the current cohort — assembleCohort returns peer IDs sorted by distance
             const cohort = this.deps.fret.assembleCohort(coord, this.getCohortSize());
             const isResponsible = cohort.includes(selfId);
-            const wasResponsible = this.responsibilitySnapshot.get(blockId) ?? false;
+            const prior = this.responsibilitySnapshot.get(blockId);
+            const wasResponsible = prior?.responsible ?? false;
             if (isResponsible && !wasResponsible) {
                 gained.push(blockId);
             }
@@ -129,14 +275,70 @@ export class RebalanceMonitor {
                 // The cohort members are the new owners
                 newOwners.set(blockId, cohort.filter(id => id !== selfId));
             }
-            this.responsibilitySnapshot.set(blockId, isResponsible);
+            // Growth arm: while this node STAYS responsible, any cohort peer not yet CONFIRMED to hold
+            // the block (and not abandoned) gets it pushed (up to the floor). Runs on every responsible
+            // check — NOT gated on wasResponsible — so a first observation (no snapshot entry) treats
+            // the whole non-self cohort as new; see the responsibilitySnapshot comment for why that is
+            // load-bearing. Not responsible ⇒ arm skipped, so `lost` ∩ `grown` is impossible.
+            //
+            // Reporting a peer does NOT record it as seen — only recordGrowthOutcome does — so a push
+            // that fails (dial timeout, receiver refused to persist, partition mid-reaction, reaction
+            // threw) leaves the peer un-seen and the next check re-detects it.
+            let state;
+            if (isResponsible) {
+                const currentSet = new Set(cohort.filter(id => id !== selfId));
+                state = carryGrowthState(prior, currentSet);
+                const newPeers = [...currentSet].filter(id => !state.cohortPeers.has(id) && !state.abandonedPeers.has(id));
+                if (newPeers.length > 0) {
+                    growthCandidates.push({ blockId, newPeers, state });
+                }
+                else {
+                    // Nothing owed for this block. growthAttempts counts CONSECUTIVE incomplete outcomes
+                    // against outstanding growth, so it must not carry across a quiet stretch — otherwise a
+                    // block that failed a few times, then had that peer leave, would spend the leftovers on
+                    // whichever peer joins next and abandon it early.
+                    state.growthAttempts = 0;
+                }
+            }
+            else {
+                // Not responsible: clear ALL growth state (seen set, attempts, abandoned peers), so a
+                // later regain re-pushes to the whole cohort (benign when the local data is gone — the
+                // push finds nothing and no-ops).
+                state = emptyGrowthState(false);
+            }
+            this.responsibilitySnapshot.set(blockId, state);
         }
+        // Fill the growth budget in two passes: fresh growth (no failed attempts yet) first, retrying
+        // blocks with what remains — otherwise a stuck retry set at the front of the tracked-block
+        // insertion order would starve peers that just joined.
+        for (const candidate of [
+            ...growthCandidates.filter(c => c.state.growthAttempts === 0),
+            ...growthCandidates.filter(c => c.state.growthAttempts > 0)
+        ]) {
+            if (grown.size < this.growthBlockBudget) {
+                grown.set(candidate.blockId, candidate.newPeers);
+                candidate.state.pendingPeers = new Set(candidate.newPeers);
+            }
+            else {
+                // Budget-dropped: the seen set was not touched, so the next check re-detects the same
+                // growth — a deferral, not a loss.
+                growthDeferred++;
+            }
+        }
+        this.lastGrowthDeferred = growthDeferred;
         this.lastRebalanceAt = Date.now();
-        if (gained.length === 0 && lost.length === 0) {
+        if (growthDeferred > 0) {
+            // Deferred blocks drain one budget-full per check. Checks fire on libp2p connection events
+            // AND — while growth work is outstanding — on the growthRecheckIntervalMs timer armed
+            // below, so a backlog drains even on a quiet network.
+            log('growth budget reached: %d blocks deferred to the next check (budget=%d)', growthDeferred, this.growthBlockBudget);
+        }
+        this.updateRecheckTimer();
+        if (gained.length === 0 && lost.length === 0 && grown.size === 0) {
             return null;
         }
-        log('rebalance check: gained=%d lost=%d', gained.length, lost.length);
-        return { gained, lost, newOwners, floor: this.getCohortSize(), triggeredAt };
+        log('rebalance check: gained=%d lost=%d grown=%d', gained.length, lost.length, grown.size);
+        return { gained, lost, newOwners, grown, floor: this.getCohortSize(), triggeredAt };
     }
     /**
      * The replication floor `N` — the cohort size FRET assembles for a block. Public so the ring-shift

package/dist/src/cluster/rebalance-monitor.js.map

@@ -1 +1 @@
-{"version":3,"file":"rebalance-monitor.js","sourceRoot":"","sources":["../../../src/cluster/rebalance-monitor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAIlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE3C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAC7C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;AA+CrC,MAAM,OAAO,gBAAgB;IAuBV;IAtBV,OAAO,GAAG,KAAK,CAAA;IACN,aAAa,CAAa;IAC3C,yFAAyF;IACzF,6FAA6F;IAC7F,iGAAiG;IACjG,mGAAmG;IACnG,qGAAqG;IACpF,sBAAsB,GAAG,IAAI,GAAG,EAAmB,CAAA;IACnD,QAAQ,GAAuB,EAAE,CAAA;IAC1C,aAAa,GAAyC,IAAI,CAAA;IAC1D,eAAe,GAAG,CAAC,CAAA;IACnB,qBAAqB,GAAG,KAAK,CAAA;IAC7B,uBAAuB,GAAG,CAAC,CAAA;IAElB,UAAU,CAAQ;IAClB,sBAAsB,CAAQ;IAC9B,uBAAuB,CAAS;IAEhC,gBAAgB,CAAY;IAC5B,iBAAiB,CAAY;IAE9C,YACkB,IAA0B,EAC3C,SAAiC,EAAE;QADlB,SAAI,GAAJ,IAAI,CAAsB;QAG3C,uFAAuF;QACvF,4FAA4F;QAC5F,qDAAqD;QACrD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG,EAAU,CAAA;QAC5D,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAA;QAC3C,IAAI,CAAC,sBAAsB,GAAG,MAAM,CAAC,sBAAsB,IAAI,KAAK,CAAA;QACpE,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,IAAI,IAAI,CAAA;QAErE,IAAI,CAAC,gBAAgB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAA;QACzD,IAAI,CAAC,iBAAiB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QAEnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAE7E,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5D,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QACzB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QAEpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC9E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAEhF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAA;QAC1B,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAA;QAClC,GAAG,CAAC,SAAS,CAAC,CAAA;IACf,CAAC;IAED,WAAW,CAAC,OAAyB;QACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,UAAU,CAAC,OAAe;QACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;IAED,YAAY,CAAC,OAAe;QAC3B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,oBAAoB;QACnB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAEO,oBAAoB;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QAEzB,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACjC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1C,CAAC;QACD,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAA;QAEjC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACjC,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAA;YACzB,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAA;YAClC,IAAI,CAAC,cAAc,EAAE,CAAA;QACtB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACpB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAA;QAC1C,IAAI,OAAO,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC3C,GAAG,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAAA;YACpD,OAAM;QACP,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,IAAI,GAAG,CAAC,CAAA;QACnF,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QACtD,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,CAAC;YACnF,GAAG,CAAC,2CAA2C,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACjC,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;QACjD,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;YAEhC,8EAA8E;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;YACzE,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAA;YAExE,IAAI,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrB,CAAC;iBAAM,IAAI,CAAC,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAClB,wCAAwC;gBACxC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAA;YAC3D,CAAC;YAED,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,GAAG,CAAC,oCAAoC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAErE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,CAAA;IAC7E,CAAC;IAED;;;;;OAKG;IACH,aAAa;QACZ,MAAM,IAAI,GAAS,IAAI,CAAC,IAAI,CAAC,IAAY,CAAC,cAAc,EAAE,EAAE,CAAA;QAC5D,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;QAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,CAAC,CAAA;IACT,CAAC;IAEO,SAAS,CAAC,KAAqB;QACtC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC;gBACJ,OAAO,CAAC,KAAK,CAAC,CAAA;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;YAC9B,CAAC;QACF,CAAC;IACF,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAA+B;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;CACD"}
+{"version":3,"file":"rebalance-monitor.js","sourceRoot":"","sources":["../../../src/cluster/rebalance-monitor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAIlC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE3C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAC7C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;AAwHrC,MAAM,gBAAgB,GAAG,CAAC,WAAoB,EAAoB,EAAE,CAAC,CAAC;IACrE,WAAW;IACX,WAAW,EAAE,IAAI,GAAG,EAAU;IAC9B,YAAY,EAAE,IAAI,GAAG,EAAU;IAC/B,cAAc,EAAE,CAAC;IACjB,cAAc,EAAE,IAAI,GAAG,EAAU;CACjC,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,UAAmC,EAAE,OAAoB,EAAe,EAAE,CAC5F,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE/D;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,CAAC,KAAmC,EAAE,YAAyB,EAAoB,EAAE,CAAC,CAAC;IAC/G,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC;IACxD,YAAY,EAAE,IAAI,GAAG,EAAU;IAC/B,cAAc,EAAE,KAAK,EAAE,cAAc,IAAI,CAAC;IAC1C,cAAc,EAAE,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,CAAC;CAC9D,CAAC,CAAA;AAEF,MAAM,OAAO,gBAAgB;IAoCV;IAnCV,OAAO,GAAG,KAAK,CAAA;IACN,aAAa,CAAa;IAC3C,yFAAyF;IACzF,6FAA6F;IAC7F,iGAAiG;IACjG,mGAAmG;IACnG,qGAAqG;IACrG,EAAE;IACF,wFAAwF;IACxF,4FAA4F;IAC5F,4FAA4F;IAC5F,gGAAgG;IAChG,6FAA6F;IAC7F,+FAA+F;IAC/F,mEAAmE;IAClD,sBAAsB,GAAG,IAAI,GAAG,EAA4B,CAAA;IAC5D,QAAQ,GAAuB,EAAE,CAAA;IAC1C,aAAa,GAAyC,IAAI,CAAA;IAC1D,YAAY,GAAyC,IAAI,CAAA;IACzD,eAAe,GAAG,CAAC,CAAA;IACnB,qBAAqB,GAAG,KAAK,CAAA;IAC7B,uBAAuB,GAAG,CAAC,CAAA;IAC3B,kBAAkB,GAAG,CAAC,CAAA;IAEb,UAAU,CAAQ;IAClB,sBAAsB,CAAQ;IAC9B,uBAAuB,CAAS;IAChC,iBAAiB,CAAQ;IACzB,iBAAiB,CAAQ;IACzB,uBAAuB,CAAQ;IAE/B,gBAAgB,CAAY;IAC5B,iBAAiB,CAAY;IAE9C,YACkB,IAA0B,EAC3C,SAAiC,EAAE;QADlB,SAAI,GAAJ,IAAI,CAAsB;QAG3C,uFAAuF;QACvF,4FAA4F;QAC5F,qDAAqD;QACrD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG,EAAU,CAAA;QAC5D,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAA;QAC3C,IAAI,CAAC,sBAAsB,GAAG,MAAM,CAAC,sBAAsB,IAAI,KAAK,CAAA;QACpE,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,IAAI,IAAI,CAAA;QACrE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAA;QACvD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAA;QACtD,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,IAAI,IAAI,CAAC,sBAAsB,CAAA;QAE5F,IAAI,CAAC,gBAAgB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAA;QACzD,IAAI,CAAC,iBAAiB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QAEnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAE7E,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5D,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QACzB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QAEpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC9E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAEhF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAA;QAC1B,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QACzB,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAA;QAClC,GAAG,CAAC,SAAS,CAAC,CAAA;IACf,CAAC;IAED,WAAW,CAAC,OAAyB;QACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IAED,UAAU,CAAC,OAAe;QACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;IAED,YAAY,CAAC,OAAe;QAC3B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,oBAAoB;QACnB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CAAC,OAAe,EAAE,OAAsB;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtD,2FAA2F;QAC3F,0FAA0F;QAC1F,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,OAAM;QAExC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC7C,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7B,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,KAAK,CAAC,cAAc,GAAG,CAAC,CAAA;YACxB,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAC3B,CAAC;aAAM,CAAC;YACP,6FAA6F;YAC7F,0FAA0F;YAC1F,wFAAwF;YACxF,uFAAuF;YACvF,8FAA8F;YAC9F,6FAA6F;YAC7F,6FAA6F;YAC7F,wFAAwF;YACxF,sDAAsD;YACtD,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACpD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACzC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACjC,CAAC;gBACD,GAAG,CAAC,8EAA8E,EACjF,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAA;gBACxD,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;gBAC1B,KAAK,CAAC,cAAc,GAAG,CAAC,CAAA;YACzB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAA;IAC1B,CAAC;IAED;;;OAGG;IACH,oBAAoB;QACnB,IAAI,0BAA0B,GAAG,CAAC,CAAA;QAClC,IAAI,cAAc,GAAG,CAAC,CAAA;QACtB,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAQ;YACpE,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;gBAAE,0BAA0B,EAAE,CAAA;YAC7D,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,CAAA;QAC5C,CAAC;QACD,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAA;IAChG,CAAC;IAED,wGAAwG;IAChG,wBAAwB;QAC/B,IAAI,IAAI,CAAC,kBAAkB,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5D,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzF,OAAO,IAAI,CAAA;YACZ,CAAC;QACF,CAAC;QACD,OAAO,KAAK,CAAA;IACb,CAAC;IAED;;;;;OAKG;IACK,kBAAkB;QACzB,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC;YAAE,OAAM;QAE7C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;YACzB,CAAC;YACD,OAAM;QACP,CAAC;QAED,IAAI,IAAI,CAAC,YAAY;YAAE,OAAM,CAAC,gBAAgB;QAE9C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;YACxB,KAAK,IAAI,CAAC,cAAc,EAAE;iBACxB,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC,CAAC;iBAC/C,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAA;QAC3C,CAAC,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAC/B;QAAC,IAAI,CAAC,YAAkD,CAAC,KAAK,EAAE,EAAE,CAAA;IACpE,CAAC;IAEO,oBAAoB;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QAEzB,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACjC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1C,CAAC;QACD,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAA;QAEjC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACjC,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAA;YACzB,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAA;YAClC,IAAI,CAAC,cAAc,EAAE,CAAA;QACtB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACpB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAA;QAC1C,IAAI,OAAO,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC3C,GAAG,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAAA;YACpD,OAAM;QACP,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,IAAI,GAAG,CAAC,CAAA;QACnF,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QACtD,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,CAAC;YACnF,GAAG,CAAC,2CAA2C,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACjC,2FAA2F;YAC3F,8FAA8F;YAC9F,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAA;YAC3B,IAAI,CAAC,kBAAkB,EAAE,CAAA;YACzB,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;QACjD,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAA;QAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAA;QACzC,IAAI,cAAc,GAAG,CAAC,CAAA;QACtB,MAAM,gBAAgB,GAA4E,EAAE,CAAA;QAEpG,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;YAEhC,8EAA8E;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;YACzE,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACtD,MAAM,cAAc,GAAG,KAAK,EAAE,WAAW,IAAI,KAAK,CAAA;YAElD,IAAI,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrB,CAAC;iBAAM,IAAI,CAAC,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAClB,wCAAwC;gBACxC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAA;YAC3D,CAAC;YAED,2FAA2F;YAC3F,4FAA4F;YAC5F,0FAA0F;YAC1F,2FAA2F;YAC3F,kFAAkF;YAClF,EAAE;YACF,0FAA0F;YAC1F,0FAA0F;YAC1F,mEAAmE;YACnE,IAAI,KAAuB,CAAA;YAC3B,IAAI,aAAa,EAAE,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAA;gBAC9D,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;gBAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC1G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,gBAAgB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpD,CAAC;qBAAM,CAAC;oBACP,qFAAqF;oBACrF,wFAAwF;oBACxF,wFAAwF;oBACxF,kDAAkD;oBAClD,KAAK,CAAC,cAAc,GAAG,CAAC,CAAA;gBACzB,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sFAAsF;gBACtF,uFAAuF;gBACvF,kCAAkC;gBAClC,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;YAChC,CAAC;YAED,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAChD,CAAC;QAED,8FAA8F;QAC9F,2FAA2F;QAC3F,uDAAuD;QACvD,KAAK,MAAM,SAAS,IAAI;YACvB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,CAAC;YAC7D,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;SAC3D,EAAE,CAAC;YACH,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;gBAChD,SAAS,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC3D,CAAC;iBAAM,CAAC;gBACP,sFAAsF;gBACtF,mCAAmC;gBACnC,cAAc,EAAE,CAAA;YACjB,CAAC;QACF,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,cAAc,CAAA;QAExC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEjC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YACxB,2FAA2F;YAC3F,sFAAsF;YACtF,sDAAsD;YACtD,GAAG,CAAC,yEAAyE,EAC5E,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACzC,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAA;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,GAAG,CAAC,6CAA6C,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAE1F,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,CAAA;IACpF,CAAC;IAED;;;;;OAKG;IACH,aAAa;QACZ,MAAM,IAAI,GAAS,IAAI,CAAC,IAAI,CAAC,IAAY,CAAC,cAAc,EAAE,EAAE,CAAA;QAC5D,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;QAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,CAAC,CAAA;IACT,CAAC;IAEO,SAAS,CAAC,KAAqB;QACtC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC;gBACJ,OAAO,CAAC,KAAK,CAAC,CAAA;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;YAC9B,CAAC;QACF,CAAC;IACF,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAA+B;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;CACD"}

package/dist/src/cluster/reconcile-block.d.ts

@@ -2,6 +2,8 @@ import type { ActionRev, BlockId, IBlock } from "@optimystic/db-core";
 import type { BlockArchive } from "../storage/struct.js";
 import type { ReconcileBlockCallback } from "./cluster-repo.js";
 import type { IPeerReputation } from "../reputation/types.js";
+import { type ProofAnchoring } from "./certified-claims.js";
+import type { BlockCommitProof } from "./commit-proof.js";
 /**
  * Wall-clock bound on one whole reconcile pass (all cohort peers, both quorums, the persist).
  * Shared by both callers so a slow or unreachable cohort peer stalls neither the commit path
@@ -15,10 +17,18 @@ export interface ReconcileBlockDeps {
     selfPeerId: string;
     /** Fetch one cohort peer's archive for `blockId` — `undefined` when it is unreachable or holds nothing. */
     fetchArchive: (peerId: string, blockId: BlockId) => Promise<BlockArchive | undefined>;
-    /** Persist the agreed content through the churn-replication funnel. */
-    saveReplicatedBlock: (blockId: BlockId, block: IBlock, source: ActionRev) => Promise<void>;
+    /**
+     * Persist the agreed content through the churn-replication funnel. `verifiedProof` is passed
+     * ONLY when it was verified against these exact bytes (`certifyContent`'s digest check) — the
+     * receiver persists it as evidence, so an unverified proof must never reach this parameter.
+     */
+    saveReplicatedBlock: (blockId: BlockId, block: IBlock, source: ActionRev, verifiedProof?: BlockCommitProof) => Promise<void>;
     /** Proportional corroboration threshold; the cohort's `simpleMajorityThreshold`. */
     simpleMajorityThreshold: number;
+    /** Promise-round gate for proof verification; the cohort's `superMajorityThreshold`. */
+    superMajorityThreshold: number;
+    /** Optional layer-2 anchoring for accepted proofs — observational only, see `cluster/certified-claims.ts`. */
+    anchoring?: ProofAnchoring;
     /**
      * Yardstick the corroboration floor is measured against — the floor for
      * {@link corroboratorCapacity}. Required, not optional: unlike the membership admission gate there
@@ -40,9 +50,15 @@ export interface ReconcileBlockDeps {
  * corroboration rather than raw `Math.max` (a lone peer inflating its rev cannot steer
  * reconciliation), verifies the cohort agrees on the *content* at that revision, and persists it.
  *
- * Both quorums are capped by {@link corroboratorCapacity}: demanding two corroborators from a
- * cohort that contains exactly one other peer is a permanent deadlock, not a safety property —
- * the node can never heal and stays unreadable forever.
+ * Peer-attached cohort commit proofs are verified first ({@link certifyCandidates}) and both gates
+ * weigh the verdicts: a claim — and, separately, the bytes — that a verified proof certifies is
+ * accepted with no second peer at any cohort size, and the proof that certified the bytes is
+ * persisted alongside them so the repaired replica serves it onward.
+ *
+ * Both quorums are capped by {@link corroboratorCapacity} for the claims that still need
+ * corroboration: demanding two corroborators from a cohort that contains exactly one other peer is
+ * a permanent deadlock, not a safety property — the node can never heal and stays unreadable
+ * forever.
  *
  * **Exposure at capacity 1 (documented, not accidental).** Block ids are random 256-bit strings
  * (`db-core` `structs.ts`), NOT content-addressed, so nothing on the receive path can re-derive
@@ -50,8 +66,12 @@ export interface ReconcileBlockDeps {
  * against `blockId`. A sole cohort peer's content is therefore believed on its word. That adds no
  * trust the cohort had not already extended — the same peer's `(rev, actionId)` claim is likewise
  * uncorroborable at that size (see `selectQuorumRev`'s capacity note), and a two-member cohort has
- * no honest majority to appeal to in the first place. Closing it needs commit-cert verification,
- * tracked by backlog `debt-read-repair-commit-cert-verification`.
+ * no honest majority to appeal to in the first place. It is closed for a candidate that carries a
+ * verified cohort commit proof — {@link certifyCandidates} binds the proof's declared digest to the
+ * served bytes, which is a check against the *cohort's own signatures* rather than against other
+ * peers, so a certified carrier wins the content gate outright and this exposure never applies to
+ * it. It remains open for a proof-less candidate, and for the residual that layer 1 proves only
+ * that the listed signers signed (`feat-cluster-membership-threshold-cert-anchoring`).
  *
  * Declines are cheap and retryable: nothing is persisted, nothing is marked, and the next commit
  * or churn/rebalance pass tries again.

package/dist/src/cluster/reconcile-block.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-block.d.ts","sourceRoot":"","sources":["../../../src/cluster/reconcile-block.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAU9D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAWzC,wGAAwG;AACxG,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACtF,uEAAuE;IACvE,mBAAmB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,oFAAoF;IACpF,uBAAuB,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,CAAC;IACvC,iFAAiF;IACjF,UAAU,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACjD;AAmFD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,sBAAsB,CA2CrF"}
+{"version":3,"file":"reconcile-block.d.ts","sourceRoot":"","sources":["../../../src/cluster/reconcile-block.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EACqE,KAAK,cAAc,EAC9F,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AA6BzC,wGAAwG;AACxG,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACtF;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,oFAAoF;IACpF,uBAAuB,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,CAAC;IACvC,iFAAiF;IACjF,UAAU,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACjD;AA4LD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,sBAAsB,CAgGrF"}