@optimystic/db-p2p 0.25.1 → 0.27.0

package/dist/src/cluster/quorum-restore.js

@@ -70,18 +70,26 @@ export function corroboratorCapacity(cohortPeerCount, repairCorroborationCluster
  *
  * **Certified claims** (`certified === true`, injected by a caller that verified the claim's
  * cohort commit proof — see `cluster/certified-claims.ts`) short-circuit the distinct-peer rule,
- * because the proof's signature set IS the corroboration:
+ * because the proof's signature set IS the corroboration — weighed by how many signers that set
+ * actually holds ({@link RevClaim.certifiedSignerCount}):
  *
  *  - No certified claims → today's corroboration result, unchanged.
  *  - A corroborated pair at a HIGHER rev than every certified claim wins — corroboration stays a
  *    legitimate weaker path, so a legacy uncertified tail written after the last proven rev
  *    remains readable.
- *  - Otherwise the highest certified rev wins: this covers a certified rev beaten in raw rev only
- *    by an *uncorroborated* claim (which failed quorum and is no evidence), and the equal-rev
- *    tie, where the proof outweighs votes.
- *  - Except: two distinct `actionId`s certified at that top rev is equivocation — the cohort
- *    provably signed two different actions into one revision — and the whole selection declines
- *    (`undefined`). Callers distinguish this decline from a plain no-quorum via
+ *  - A MULTI-SIGNER certified claim (two-plus signers) at the top certified rev wins over an
+ *    equal-rev corroborated pair and over any uncorroborated claim: the proof outweighs votes.
+ *    Single-signer certified claims at that rev neither outrank it nor equivocate against it — a
+ *    solo cohort's self-signed receipt is one machine's word, not the cohort's second signature.
+ *  - A SINGLE-SIGNER-only certified rev still wins where nothing multi-peer contests it (a lone
+ *    holder with a solo proof stays repairable), but it never beats corroboration by
+ *    {@link CORROBORATION_FLOOR}-plus distinct peers at the SAME revision — one machine that was
+ *    briefly alone must not outrank the cohort that stayed together. A corroborated pair that
+ *    AGREES with the sole certified action is convergence, not a contest; the certified verdict
+ *    is kept.
+ *  - Two distinct `actionId`s still CONTENDING at the top certified rev is equivocation — the
+ *    same keys provably signed two different actions into one revision — and the whole selection
+ *    declines (`undefined`). Callers distinguish this decline from a plain no-quorum via
  *    {@link certifiedEquivocation}.
  */
 export function selectQuorumRev(claims, simpleMajorityThreshold, corroboratorCapacity) {
@@ -124,15 +132,30 @@ export function selectQuorumRev(claims, simpleMajorityThreshold, corroboratorCap
     // `corroborated`), so it cannot outrank a proof.
     if (corroborated && corroborated.rev > certified.rev)
         return corroborated;
-    // Two actions provably signed into the same top revision: decline the whole selection rather
-    // than pick a side. Callers log via certifiedEquivocation.
-    if (certified.byAction.size !== 1)
+    const contenders = certifiedContenders(certified.byAction);
+    // A single-signer-only certified rev loses the equal-rev tie to genuinely multi-peer
+    // corroboration — unless the corroborated pair AGREES with the sole certified action, which is
+    // convergence rather than a contest and keeps the certified verdict (and its logging/penalty
+    // exemptions) intact.
+    // NOTE: the weighing reaches EQUAL revisions only. A solo fork that committed twice while its
+    // cohort committed once claims the higher rev and still wins above. That is not an oversight of
+    // this rule: a claim carries no lineage, so "one peer ahead of two" is identical whether it
+    // forked or the two are lagging, and refusing it would break ordinary lagging-cohort repair.
+    // Pinned by 'does NOT reach a solo fork one revision AHEAD' in quorum-restore-certified.spec.ts;
+    // closing it needs new evidence — debt-repair-cannot-tell-a-fork-from-a-lagging-cohort.
+    if (!contenders.multiSigner && corroborated && corroborated.rev === certified.rev
+        && corroborated.supporters.length >= CORROBORATION_FLOOR
+        && !(certified.byAction.size === 1 && certified.byAction.has(corroborated.actionId))) {
+        return corroborated;
+    }
+    // Two actions provably signed into the same top revision by contending proofs: decline the
+    // whole selection rather than pick a side. Callers log via certifiedEquivocation.
+    if (contenders.entries.length !== 1)
         return undefined;
-    const [entry] = certified.byAction;
-    const [actionId, supporters] = entry; // size === 1 checked above
-    return { rev: certified.rev, actionId, supporters: [...supporters], certified: true };
+    const [actionId, group] = contenders.entries[0];
+    return { rev: certified.rev, actionId, supporters: [...group.supporters], certified: true };
 }
-/** Certified claims at the top certified rev, keyed by actionId → distinct certified claimants. */
+/** Certified claims at the top certified rev, keyed by actionId → the claimants behind each. */
 function certifiedGroups(claims) {
     let top;
     for (const c of claims) {
@@ -145,24 +168,43 @@ function certifiedGroups(claims) {
     for (const c of claims) {
         if (c.certified !== true || c.rev !== top)
             continue;
-        let s = byAction.get(c.actionId);
-        if (!s) {
-            s = new Set();
-            byAction.set(c.actionId, s);
+        let g = byAction.get(c.actionId);
+        if (!g) {
+            g = { supporters: new Set(), multiSigner: false };
+            byAction.set(c.actionId, g);
         }
-        s.add(c.peerId);
+        g.supporters.add(c.peerId);
+        // Absent or sub-two count weighs as single-signer — see RevClaim.certifiedSignerCount.
+        if ((c.certifiedSignerCount ?? 1) >= 2)
+            g.multiSigner = true;
     }
     return { rev: top, byAction };
 }
+/**
+ * Which certified actions at the top rev actually CONTEND for selection. A multi-signer proof is
+ * the cohort's own signature set; a single-signer proof is one machine's word about its own solo
+ * commit — so when any action is multi-signer-backed, only the multi-signer-backed ones contend
+ * (a solo receipt can neither outrank nor equivocate against a cohort proof), and only with no
+ * multi-signer action anywhere do the single-signer ones contend among themselves. One helper so
+ * {@link selectQuorumRev} and {@link certifiedEquivocation} cannot drift on the rule.
+ */
+function certifiedContenders(byAction) {
+    const multi = [...byAction].filter(([, g]) => g.multiSigner);
+    return multi.length > 0
+        ? { entries: multi, multiSigner: true }
+        : { entries: [...byAction], multiSigner: false };
+}
 /**
  * The conflicting certified set at the top certified rev, when there is one: two-plus distinct
- * `actionId`s each carrying a verified cohort commit proof for the SAME revision. It deserves a
- * distinct log line from a plain no-quorum — the cohort (or whoever holds its keys) provably
- * signed both sides. Selection stays pure, so callers do the logging with what this reports.
+ * `actionId`s that CONTEND there ({@link certifiedContenders}) — each carrying a verified cohort
+ * commit proof for the SAME revision, at comparable weight. It deserves a distinct log line from a
+ * plain no-quorum — whoever holds the signing keys provably signed both sides. Selection stays
+ * pure, so callers do the logging with what this reports.
  *
- * `undefined` when no certified claim exists or the top certified rev names a single action —
- * conflicts at LOWER certified revs are history already superseded, not equivocation worth
- * declining over.
+ * `undefined` when no certified claim exists or a single action contends at the top certified rev —
+ * conflicts at LOWER certified revs are history already superseded, and a single-signer proof
+ * disagreeing with a multi-signer one at the same rev is a solo machine's fork losing to the
+ * cohort, not equivocation worth declining over.
  *
  * **Ask this only on a decline.** A non-`undefined` result does NOT imply {@link selectQuorumRev}
  * returned `undefined`: a corroborated pair STRICTLY above the top certified rev still wins, and
@@ -171,9 +213,12 @@ function certifiedGroups(claims) {
  */
 export function certifiedEquivocation(claims) {
     const groups = certifiedGroups(claims);
-    if (!groups || groups.byAction.size < 2)
+    if (!groups)
         return undefined;
-    return { rev: groups.rev, actionIds: [...groups.byAction.keys()] };
+    const contenders = certifiedContenders(groups.byAction);
+    if (contenders.entries.length < 2)
+        return undefined;
+    return { rev: groups.rev, actionIds: contenders.entries.map(([actionId]) => actionId) };
 }
 /**
  * Among candidates already known to corroborate the target `(rev, actionId)`,
@@ -196,22 +241,34 @@ export function certifiedEquivocation(claims) {
  * *genuinely* that small reaches this branch.
  *
  * **Certified candidates** (`certified === true` — a caller verified a cohort commit proof whose
- * declared digest matches these exact bytes) short-circuit the hash quorum: exactly one distinct
- * certified hash → that block wins outright, however many peers served it. Two-plus distinct
- * certified hashes is certified content equivocation → decline (`undefined`), mirroring the
- * existing unique-hash-tie decline; callers name that decline via
- * {@link certifiedContentEquivocation}. No certified candidate → the hash quorum below, unchanged.
+ * declared digest matches these exact bytes) are weighed by the proof's signer count, mirroring
+ * {@link selectQuorumRev}:
+ *
+ *  - Exactly one distinct MULTI-SIGNER certified hash → that block wins outright, however many
+ *    peers served anything else: the cohort's own signatures over the digest outweigh other
+ *    carriers' bytes. Two-plus distinct multi-signer certified hashes is certified content
+ *    equivocation → decline (`undefined`); a single-signer certified hash alongside a
+ *    multi-signer one neither wins nor forces that decline (a solo receipt cannot equivocate
+ *    against the cohort's proof).
+ *  - SINGLE-SIGNER-only certified hashes no longer short-circuit: a hash group carried by
+ *    {@link CORROBORATION_FLOOR}-plus distinct peers that meets the ordinary quorum displaces
+ *    them (two-plus such groups is a genuine content disagreement → decline, as ever). With no
+ *    multi-peer group to defer to, a sole single-signer certified hash still wins on its proof —
+ *    a lone certified holder stays repairable — and two-plus distinct ones decline.
+ *  - No certified candidate → the hash quorum below, unchanged.
+ *
+ * Callers name the certified declines via {@link certifiedContentEquivocation}.
  */
 export function selectQuorumBlock(candidates, simpleMajorityThreshold, corroboratorCapacity) {
     if (candidates.length === 0)
         return undefined;
     const certifiedByHash = certifiedHashes(candidates);
-    if (certifiedByHash.size === 1) {
-        const [entry] = certifiedByHash;
-        const [hash, block] = entry;
+    const multiSignerHashes = [...certifiedByHash].filter(([, v]) => v.multiSigner);
+    if (multiSignerHashes.length === 1) {
+        const [hash, { block }] = multiSignerHashes[0];
         return { block, hash };
     }
-    if (certifiedByHash.size > 1)
+    if (multiSignerHashes.length > 1)
         return undefined; // certified content equivocation — decline
     // One vote per distinct peer per hash group, matching selectQuorumRev — a peer appearing twice
     // must not be able to second itself into a content quorum.
@@ -228,34 +285,74 @@ export function selectQuorumBlock(candidates, simpleMajorityThreshold, corrobora
     }
     const quorum = quorumSize(voters.size, simpleMajorityThreshold, corroboratorCapacity);
     const meeting = [...groups.entries()].filter(([, g]) => g.supporters.size >= quorum);
-    // Exactly one hash may meet quorum; a tie is a genuine content disagreement → decline.
-    if (meeting.length !== 1)
+    if (certifiedByHash.size === 0) {
+        // Exactly one hash may meet quorum; a tie is a genuine content disagreement → decline.
+        if (meeting.length !== 1)
+            return undefined;
+        const [hash, group] = meeting[0];
+        return { block: group.block, hash };
+    }
+    // Only single-signer certified hashes remain. Genuinely multi-peer agreement — a quorum-meeting
+    // group of CORROBORATION_FLOOR-plus distinct carriers — outranks a solo proof, with the usual
+    // uniqueness rule among such groups. (A quorum-meeting group of ONE carrier, possible only on a
+    // capacity-one cohort, is a bare assertion and does not displace a verified proof.)
+    const multiPeer = meeting.filter(([, g]) => g.supporters.size >= CORROBORATION_FLOOR);
+    if (multiPeer.length > 1)
         return undefined;
-    const [hash, group] = meeting[0];
-    return { block: group.block, hash };
+    if (multiPeer.length === 1) {
+        const [hash, group] = multiPeer[0];
+        return { block: group.block, hash };
+    }
+    // No multi-peer agreement to defer to: a sole single-signer certified hash wins on its proof;
+    // two-plus distinct ones are solo-vs-solo equivocation → decline.
+    if (certifiedByHash.size > 1)
+        return undefined;
+    const [entry] = certifiedByHash;
+    const [hash, { block }] = entry;
+    return { block, hash };
 }
-/** Distinct hashes carried by certified candidates → the first block instance serving each. */
+/** Distinct hashes carried by certified candidates → the first block instance serving each, and
+ * whether any certified candidate at that hash carried a two-plus-signer proof. */
 function certifiedHashes(candidates) {
     const byHash = new Map();
     for (const c of candidates) {
-        if (c.certified === true && !byHash.has(c.hash))
-            byHash.set(c.hash, c.block);
+        if (c.certified !== true)
+            continue;
+        let entry = byHash.get(c.hash);
+        if (!entry) {
+            entry = { block: c.block, multiSigner: false };
+            byHash.set(c.hash, entry);
+        }
+        // Absent or sub-two count weighs as single-signer — see BlockHashCandidate.certifiedSignerCount.
+        if ((c.certifiedSignerCount ?? 1) >= 2)
+            entry.multiSigner = true;
     }
     return byHash;
 }
 /**
- * The conflicting certified hashes when there are two or more — the content-side sibling of
- * {@link certifiedEquivocation}, and the reason {@link selectQuorumBlock} declines outright.
- * Candidates reaching that selector all carry the SAME `(rev, actionId)`, so two certified hashes
- * mean the cohort's keys signed two different digests into one revision: a provable compromise an
- * operator must be able to tell apart from the routine "not enough carriers agreed" decline. Both
- * declines return `undefined`, so without this they log identically.
+ * The conflicting certified hashes when there are two or more CONTENDING — the content-side
+ * sibling of {@link certifiedEquivocation}, and the reason {@link selectQuorumBlock} declines
+ * outright. Candidates reaching that selector all carry the SAME `(rev, actionId)`, so two
+ * contending certified hashes mean the same keys signed two different digests into one revision: a
+ * provable compromise an operator must be able to tell apart from the routine "not enough carriers
+ * agreed" decline. Both declines return `undefined`, so without this they log identically.
+ * Contention mirrors the selector: multi-signer certified hashes when any exist, else the
+ * single-signer ones among themselves — a solo receipt disagreeing with a cohort proof is a fork
+ * losing, not equivocation.
  *
- * `undefined` when fewer than two distinct certified hashes exist — including the ordinary
+ * `undefined` when fewer than two certified hashes contend — including the ordinary
  * no-certified-candidate case, where a decline really is a plain content-quorum shortfall.
+ *
+ * **Ask this only on a decline**, exactly as with {@link certifiedEquivocation}: a non-`undefined`
+ * result does NOT imply {@link selectQuorumBlock} returned `undefined`. Two contending
+ * single-signer certified hashes yield to a {@link CORROBORATION_FLOOR}-plus-carrier quorum group,
+ * so selection can succeed while the solo-versus-solo conflict is still reported here. Call it when
+ * selection declined, to say WHY.
  */
 export function certifiedContentEquivocation(candidates) {
     const byHash = certifiedHashes(candidates);
-    return byHash.size < 2 ? undefined : { hashes: [...byHash.keys()] };
+    const multi = [...byHash].filter(([, v]) => v.multiSigner);
+    const contenders = multi.length > 0 ? multi : [...byHash];
+    return contenders.length < 2 ? undefined : { hashes: contenders.map(([hash]) => hash) };
 }
 //# sourceMappingURL=quorum-restore.js.map

package/dist/src/cluster/quorum-restore.js.map

@@ -1 +1 @@
-{"version":3,"file":"quorum-restore.js","sourceRoot":"","sources":["../../../src/cluster/quorum-restore.ts"],"names":[],"mappings":"AA2DA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACzB,cAAsB,EACtB,uBAA+B,EAC/B,uBAA+B,MAAM,CAAC,iBAAiB;IAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,cAAc,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAAuB,EAAE,8BAAsC;IACnG,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,8BAA8B,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAkB,EAClB,uBAA+B,EAC/B,oBAA6B;IAE7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsE,CAAC;IAC7F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IAE1F,iFAAiF;IACjF,mFAAmF;IACnF,iFAAiF;IACjF,oFAAoF;IACpF,iFAAiF;IACjF,qFAAqF;IACrF,QAAQ;IACR,IAAI,IAA4E,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,GAAG,CAAC,CAAC;QACV,CAAC;IACF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI;QACxB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEb,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC;IACpC,0FAA0F;IAC1F,0FAA0F;IAC1F,iDAAiD;IACjD,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC;IAC1E,6FAA6F;IAC7F,2DAA2D;IAC3D,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC;IACnC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,KAAM,CAAC,CAAC,2BAA2B;IAClE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACvF,CAAC;AAED,mGAAmG;AACnG,SAAS,eAAe,CAAC,MAAkB;IAC1C,IAAI,GAAuB,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACvD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACpE,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,iBAAiB,CAChC,UAAgC,EAChC,uBAA+B,EAC/B,oBAA6B;IAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC;QAChC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAM,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,2CAA2C;IAE3F,+FAA+F;IAC/F,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsD,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;IACrF,uFAAuF;IACvF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,+FAA+F;AAC/F,SAAS,eAAe,CAAC,UAAgC;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAgC;IAC5E,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC"}
+{"version":3,"file":"quorum-restore.js","sourceRoot":"","sources":["../../../src/cluster/quorum-restore.ts"],"names":[],"mappings":"AA0EA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACzB,cAAsB,EACtB,uBAA+B,EAC/B,uBAA+B,MAAM,CAAC,iBAAiB;IAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,cAAc,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAAuB,EAAE,8BAAsC;IACnG,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,8BAA8B,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAkB,EAClB,uBAA+B,EAC/B,oBAA6B;IAE7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsE,CAAC;IAC7F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IAE1F,iFAAiF;IACjF,mFAAmF;IACnF,iFAAiF;IACjF,oFAAoF;IACpF,iFAAiF;IACjF,qFAAqF;IACrF,QAAQ;IACR,IAAI,IAA4E,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,GAAG,CAAC,CAAC;QACV,CAAC;IACF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI;QACxB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEb,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC;IACpC,0FAA0F;IAC1F,0FAA0F;IAC1F,iDAAiD;IACjD,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC;IAC1E,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,qFAAqF;IACrF,+FAA+F;IAC/F,6FAA6F;IAC7F,sBAAsB;IACtB,8FAA8F;IAC9F,gGAAgG;IAChG,4FAA4F;IAC5F,6FAA6F;IAC7F,iGAAiG;IACjG,wFAAwF;IACxF,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG;WAC7E,YAAY,CAAC,UAAU,CAAC,MAAM,IAAI,mBAAmB;WACrD,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,2FAA2F;IAC3F,kFAAkF;IAClF,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7F,CAAC;AAUD,gGAAgG;AAChG,SAAS,eAAe,CAAC,MAAkB;IAC1C,IAAI,GAAuB,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAClD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3B,uFAAuF;QACvF,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC3B,QAA2C;IAE3C,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACvD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzF,CAAC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,iBAAiB,CAChC,UAAgC,EAChC,uBAA+B,EAC/B,oBAA6B;IAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAChF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,2CAA2C;IAE/F,+FAA+F;IAC/F,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsD,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;IAErF,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAChC,uFAAuF;QACvF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,gGAAgG;IAChG,8FAA8F;IAC9F,gGAAgG;IAChG,oFAAoF;IACpF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,mBAAmB,CAAC,CAAC;IACtF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,8FAA8F;IAC9F,kEAAkE;IAClE,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC;IAChC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,KAAM,CAAC;IACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;mFACmF;AACnF,SAAS,eAAe,CAAC,UAAgC;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAgC;IAC5E,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AACzF,CAAC"}

package/dist/src/cluster/race-resolution.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The deterministic arbiter between two conflicting cluster transactions: which of two writes to a
+ * shared block wins. Every function here is a total function of its arguments, with no member state
+ * and no effect beyond a debug log — `resolveRace` runs on the vote path, where a throw would cost
+ * the member its vote entirely — so the ordering rule can be read and tested on its own (see
+ * `test/race-resolution.spec.ts`). The stateful scan that consults them (`findConflict`, which sweeps stale
+ * reservations and clears a losing transaction) stays on `ClusterMember` in `cluster-repo.ts`.
+ */
+import type { ClusterRecord, RepoMessage } from "@optimystic/db-core";
+/** Number of *approve* promise votes on a record — the count the commit rule uses. */
+export declare function approvalCount(record: ClusterRecord): number;
+/**
+ * Resolve a race between two conflicting transactions. Total and deterministic, so every honest
+ * member computes the identical winner (the Theorem 1 Case-2 premise). Order:
+ *   1. more *approve* promise signatures wins  (progress monotonicity — see safety note below);
+ *   2. equal approval counts → higher aged priority wins  (fairness — see {@link recordPriority});
+ *   3. still tied → higher message hash wins.
+ *
+ * The count is APPROVALS, not `promises` keys. `promises` is the vote map — a reject occupies a key
+ * there exactly as an approve does — so counting keys would treat a rejection as progress, letting a
+ * record that can never commit outrank (and therefore block, via the reservation scan `findConflict`
+ * in `cluster-repo.ts`) a fresh rival for the whole staleness window. Approvals is also the count
+ * the invariant below actually needs: the commit rule is `approvedPromises >= superMajority`,
+ * which never looks at rejections.
+ *
+ * Approval count is FIRST so this comparison never displaces a transaction that is further along.
+ * That restores the pre-priority safety invariant: a member commits purely on promise supermajority
+ * (`handleCommitNeeded` signs whenever `approvedPromises >= superMajority`; the commit path has NO
+ * conflict re-check), so `resolveRace` is the ONLY arbiter among concurrently-pending conflicts.
+ * With approvals-first, once transaction X holds a promise supermajority every conflicting rival Y has
+ * strictly fewer approvals — Y can only match X's count by getting the intersecting quorum member to
+ * approve it, but that member already holds X at supermajority and `resolveRace(X, Y)` returns
+ * `keep-existing` on X's higher count, so it never does. By quorum intersection any Y-supermajority
+ * overlaps X's in ≥1 honest member, and that member rejects Y. One winner (docs/correctness.md
+ * Theorem 9). Priority-first would break this: it could displace an already-quorum-reached X for a
+ * higher-priority Y with fewer approvals, letting BOTH commit (split brain) — the regression fixed by
+ * ticket occ-priority-first-breaks-promise-monotonicity.
+ *
+ * Priority is now a tie-break that runs only at EQUAL approval counts, which is exactly the
+ * concurrent-starvation case aging targets (two fresh rivals, 0 promises each, otherwise coin-flipping
+ * on the hash). Priority still breaks those ties deterministically, so aging still solves the stated
+ * fairness problem in its common case. It only orders two *concurrently-pending* conflicts; it does NOT
+ * defer a fresh pend for an absent aged transaction (that residual — sequential sub-window starvation —
+ * is the deferred feat-occ-priority-reservation).
+ *
+ * NOTE: residual-fairness tripwire. Under approvals-first an aged transaction can still lose to a fresh
+ * rival that has *legitimately* gathered even one more approval — that is not the pure-coin-flip
+ * starvation aging targets (equal counts, priority wins), it is the monotonicity behaviour we WANT (a
+ * more-progressed rival is never displaced). If deeper fairness against a genuinely-more-progressed
+ * rival is ever needed, it belongs to feat-occ-priority-reservation (reserve/defer at pend time), NOT
+ * to this race tie-break.
+ *
+ * NOTE: Byzantine self-assert is a fairness DoS, not a safety hole. A coordinator can stamp
+ * priority == MaxPriority on every transaction; recordPriority clamps to the cap so it cannot
+ * exceed it, and priority never influences validity/operationsHash/stale-read checks — and now sits
+ * below the approval count, so it can only break equal-count ties it might have ~50% won anyway,
+ * degrading to at-worst-status-quo fairness (the same graceful-degradation class as spam under
+ * honest-majority). Binding priority to provable age is out of scope (feat-occ-priority-reservation).
+ *
+ * NOTE: keep priority a self-contained additive message field + this one comparison key so it
+ * composes with — does not block — a future HLC/crdt-sync redesign of this same path
+ * (design-hot-log-tail-sharding-guidance).
+ */
+export declare function resolveRace(existing: ClusterRecord, incoming: ClusterRecord): 'keep-existing' | 'accept-incoming';
+/**
+ * Aged advisory priority carried by a record's pend operation, clamped to [0, MaxPriority].
+ * The multi-collection path carries it on `pend.validation.transaction.priority`; the single-collection
+ * (`Collection.sync`) path carries it as top-level `pend.priority`; a record with neither — a
+ * legacy/unversioned coordinator's transaction, or a non-pend operation — is priority 0
+ * (backward compatible: such transactions simply never age). Both carriers live inside the signed
+ * `message`, so priority is integrity-protected in transit; clamping here bounds a self-asserted
+ * out-of-range value to the cap.
+ *
+ * NOTE: `message` is fixed for a transaction's whole lifecycle (promises/commits accrue in the
+ * separate `promises`/`commits` maps, never in `message`), so a transaction keeps its rank through
+ * the commit phase — there is no "priority drops to 0 at commit" asymmetry. resolveRace is only
+ * consulted at the promise decision (`findConflict` in `cluster-repo.ts`), i.e. between two
+ * still-open conflicting transactions, which is exactly the concurrent-contention case priority
+ * is meant to order.
+ */
+export declare function recordPriority(record: ClusterRecord): number;
+/**
+ * Whether two messages must serialize against each other: true when they touch a common block AND
+ * are not the same action. The same-action escape is what lets a commit follow its own pend — both
+ * name every block the action writes, so a bare overlap test would have each transaction blocking
+ * its own next phase. Gates whether {@link resolveRace} runs at all.
+ */
+export declare function operationsConflict(ops1: RepoMessage['operations'], ops2: RepoMessage['operations']): boolean;
+//# sourceMappingURL=race-resolution.d.ts.map

package/dist/src/cluster/race-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"race-resolution.d.ts","sourceRoot":"","sources":["../../../src/cluster/race-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAUtE,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,GAAG,eAAe,GAAG,iBAAiB,CAqBjH;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAW5D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,OAAO,CAwB5G"}

package/dist/src/cluster/race-resolution.js

@@ -0,0 +1,140 @@
+import { clampPriority } from "@optimystic/db-core";
+import { getActionId, getAffectedBlockIds } from "./record-operations.js";
+import { createLogger } from "../logger.js";
+// Same sub-namespace `cluster-repo.ts` logs under: these functions moved out of `ClusterMember`, and
+// their emitted tags (and the `debug` namespace they land in) must stay byte-identical, because
+// several specs capture by namespace and tag substring.
+const log = createLogger('cluster-member');
+/** Number of *approve* promise votes on a record — the count the commit rule uses. */
+export function approvalCount(record) {
+    return Object.values(record.promises).filter(s => s.type === 'approve').length;
+}
+/**
+ * Resolve a race between two conflicting transactions. Total and deterministic, so every honest
+ * member computes the identical winner (the Theorem 1 Case-2 premise). Order:
+ *   1. more *approve* promise signatures wins  (progress monotonicity — see safety note below);
+ *   2. equal approval counts → higher aged priority wins  (fairness — see {@link recordPriority});
+ *   3. still tied → higher message hash wins.
+ *
+ * The count is APPROVALS, not `promises` keys. `promises` is the vote map — a reject occupies a key
+ * there exactly as an approve does — so counting keys would treat a rejection as progress, letting a
+ * record that can never commit outrank (and therefore block, via the reservation scan `findConflict`
+ * in `cluster-repo.ts`) a fresh rival for the whole staleness window. Approvals is also the count
+ * the invariant below actually needs: the commit rule is `approvedPromises >= superMajority`,
+ * which never looks at rejections.
+ *
+ * Approval count is FIRST so this comparison never displaces a transaction that is further along.
+ * That restores the pre-priority safety invariant: a member commits purely on promise supermajority
+ * (`handleCommitNeeded` signs whenever `approvedPromises >= superMajority`; the commit path has NO
+ * conflict re-check), so `resolveRace` is the ONLY arbiter among concurrently-pending conflicts.
+ * With approvals-first, once transaction X holds a promise supermajority every conflicting rival Y has
+ * strictly fewer approvals — Y can only match X's count by getting the intersecting quorum member to
+ * approve it, but that member already holds X at supermajority and `resolveRace(X, Y)` returns
+ * `keep-existing` on X's higher count, so it never does. By quorum intersection any Y-supermajority
+ * overlaps X's in ≥1 honest member, and that member rejects Y. One winner (docs/correctness.md
+ * Theorem 9). Priority-first would break this: it could displace an already-quorum-reached X for a
+ * higher-priority Y with fewer approvals, letting BOTH commit (split brain) — the regression fixed by
+ * ticket occ-priority-first-breaks-promise-monotonicity.
+ *
+ * Priority is now a tie-break that runs only at EQUAL approval counts, which is exactly the
+ * concurrent-starvation case aging targets (two fresh rivals, 0 promises each, otherwise coin-flipping
+ * on the hash). Priority still breaks those ties deterministically, so aging still solves the stated
+ * fairness problem in its common case. It only orders two *concurrently-pending* conflicts; it does NOT
+ * defer a fresh pend for an absent aged transaction (that residual — sequential sub-window starvation —
+ * is the deferred feat-occ-priority-reservation).
+ *
+ * NOTE: residual-fairness tripwire. Under approvals-first an aged transaction can still lose to a fresh
+ * rival that has *legitimately* gathered even one more approval — that is not the pure-coin-flip
+ * starvation aging targets (equal counts, priority wins), it is the monotonicity behaviour we WANT (a
+ * more-progressed rival is never displaced). If deeper fairness against a genuinely-more-progressed
+ * rival is ever needed, it belongs to feat-occ-priority-reservation (reserve/defer at pend time), NOT
+ * to this race tie-break.
+ *
+ * NOTE: Byzantine self-assert is a fairness DoS, not a safety hole. A coordinator can stamp
+ * priority == MaxPriority on every transaction; recordPriority clamps to the cap so it cannot
+ * exceed it, and priority never influences validity/operationsHash/stale-read checks — and now sits
+ * below the approval count, so it can only break equal-count ties it might have ~50% won anyway,
+ * degrading to at-worst-status-quo fairness (the same graceful-degradation class as spam under
+ * honest-majority). Binding priority to provable age is out of scope (feat-occ-priority-reservation).
+ *
+ * NOTE: keep priority a self-contained additive message field + this one comparison key so it
+ * composes with — does not block — a future HLC/crdt-sync redesign of this same path
+ * (design-hot-log-tail-sharding-guidance).
+ */
+export function resolveRace(existing, incoming) {
+    // 1. Transaction with more APPROVALS wins — never displace a more-progressed rival (safety, see
+    // above). Counting `promises` keys instead would count reject votes as progress: a record holding
+    // one rejection would outrank an untouched rival and reserve its blocks for the whole staleness
+    // window, and the commit rule this ordering protects (`approvedPromises >= superMajority`) never
+    // looks at rejections anyway.
+    const existingCount = approvalCount(existing);
+    const incomingCount = approvalCount(incoming);
+    if (existingCount !== incomingCount) {
+        return existingCount > incomingCount ? 'keep-existing' : 'accept-incoming';
+    }
+    // 2. Equal approval counts → higher aged priority wins (fairness tie-break).
+    const existingPriority = recordPriority(existing);
+    const incomingPriority = recordPriority(incoming);
+    if (existingPriority !== incomingPriority) {
+        return existingPriority > incomingPriority ? 'keep-existing' : 'accept-incoming';
+    }
+    // 3. Tie-breaker: higher message hash wins (deterministic).
+    return existing.messageHash > incoming.messageHash ? 'keep-existing' : 'accept-incoming';
+}
+/**
+ * Aged advisory priority carried by a record's pend operation, clamped to [0, MaxPriority].
+ * The multi-collection path carries it on `pend.validation.transaction.priority`; the single-collection
+ * (`Collection.sync`) path carries it as top-level `pend.priority`; a record with neither — a
+ * legacy/unversioned coordinator's transaction, or a non-pend operation — is priority 0
+ * (backward compatible: such transactions simply never age). Both carriers live inside the signed
+ * `message`, so priority is integrity-protected in transit; clamping here bounds a self-asserted
+ * out-of-range value to the cap.
+ *
+ * NOTE: `message` is fixed for a transaction's whole lifecycle (promises/commits accrue in the
+ * separate `promises`/`commits` maps, never in `message`), so a transaction keeps its rank through
+ * the commit phase — there is no "priority drops to 0 at commit" asymmetry. resolveRace is only
+ * consulted at the promise decision (`findConflict` in `cluster-repo.ts`), i.e. between two
+ * still-open conflicting transactions, which is exactly the concurrent-contention case priority
+ * is meant to order.
+ */
+export function recordPriority(record) {
+    for (const op of record.message.operations) {
+        if ('pend' in op) {
+            // Every hop optional: `validation` arrives off the wire inside a signed message whose
+            // hash binds its bytes, not its shape, so a malformed pair must yield priority 0 (what
+            // clampPriority already does for a missing or Byzantine number) rather than throw out
+            // of the vote path — the lost vote this fail-closed pass exists to prevent.
+            return clampPriority(op.pend.validation?.transaction?.priority ?? op.pend.priority);
+        }
+    }
+    return 0;
+}
+/**
+ * Whether two messages must serialize against each other: true when they touch a common block AND
+ * are not the same action. The same-action escape is what lets a commit follow its own pend — both
+ * name every block the action writes, so a bare overlap test would have each transaction blocking
+ * its own next phase. Gates whether {@link resolveRace} runs at all.
+ */
+export function operationsConflict(ops1, ops2) {
+    // Check if one is a commit for the same action as a pend - these don't conflict
+    const actionId1 = getActionId(ops1);
+    const actionId2 = getActionId(ops2);
+    if (actionId1 && actionId2 && actionId1 === actionId2) {
+        // Same action - commit is resolving the pend, not conflicting
+        return false;
+    }
+    const blocks1 = new Set(getAffectedBlockIds(ops1));
+    const blocks2 = new Set(getAffectedBlockIds(ops2));
+    for (const block of Array.from(blocks1)) {
+        if (blocks2.has(block)) {
+            log('cluster-member:conflict-detected', {
+                blocks1: Array.from(blocks1),
+                blocks2: Array.from(blocks2),
+                conflictingBlock: block
+            });
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=race-resolution.js.map

package/dist/src/cluster/race-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"race-resolution.js","sourceRoot":"","sources":["../../../src/cluster/race-resolution.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,qGAAqG;AACrG,gGAAgG;AAChG,wDAAwD;AACxD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE1C,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,MAAqB;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,WAAW,CAAC,QAAuB,EAAE,QAAuB;IAC3E,gGAAgG;IAChG,kGAAkG;IAClG,gGAAgG;IAChG,iGAAiG;IACjG,8BAA8B;IAC9B,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC5E,CAAC;IAED,6EAA6E;IAC7E,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAC3C,OAAO,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAClF,CAAC;IAED,4DAA4D;IAC5D,OAAO,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB;IACnD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAClB,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,4EAA4E;YAC5E,OAAO,aAAa,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACF,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA+B,EAAE,IAA+B;IAClG,gFAAgF;IAChF,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvD,8DAA8D;QAC9D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,kCAAkC,EAAE;gBACvC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC5B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC5B,gBAAgB,EAAE,KAAK;aACvB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/src/cluster/reconcile-block.d.ts

@@ -52,8 +52,11 @@ export interface ReconcileBlockDeps {
  *
  * Peer-attached cohort commit proofs are verified first ({@link certifyCandidates}) and both gates
  * weigh the verdicts: a claim — and, separately, the bytes — that a verified proof certifies is
- * accepted with no second peer at any cohort size, and the proof that certified the bytes is
- * persisted alongside them so the repaired replica serves it onward.
+ * accepted with no second peer where nothing multi-peer contests it. The proof's signer count is
+ * weighed too: a SINGLE-SIGNER proof (a solo cohort's self-signed receipt) never outranks several
+ * distinct peers agreeing at the same revision or on the same bytes — see `quorum-restore.ts`. The
+ * proof that certified the agreed bytes is persisted alongside them so the repaired replica serves
+ * it onward.
  *
  * Both quorums are capped by {@link corroboratorCapacity} for the claims that still need
  * corroboration: demanding two corroborators from a cohort that contains exactly one other peer is
@@ -69,8 +72,10 @@ export interface ReconcileBlockDeps {
  * no honest majority to appeal to in the first place. It is closed for a candidate that carries a
  * verified cohort commit proof — {@link certifyCandidates} binds the proof's declared digest to the
  * served bytes, which is a check against the *cohort's own signatures* rather than against other
- * peers, so a certified carrier wins the content gate outright and this exposure never applies to
- * it. It remains open for a proof-less candidate, and for the residual that layer 1 proves only
+ * peers, so a certified carrier wins the content gate with no second carrier and this exposure
+ * never applies to it. (Weighing still applies at larger widths: a SINGLE-SIGNER certified carrier
+ * does not displace a multi-peer hash quorum — see `selectQuorumBlock` — but at the capacity-one
+ * width this paragraph describes there is no multi-peer group to lose to.) It remains open for a proof-less candidate, and for the residual that layer 1 proves only
  * that the listed signers signed (`feat-cluster-membership-threshold-cert-anchoring`).
  *
  * Declines are cheap and retryable: nothing is persisted, nothing is marked, and the next commit

package/dist/src/cluster/reconcile-block.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-block.d.ts","sourceRoot":"","sources":["../../../src/cluster/reconcile-block.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EACqE,KAAK,cAAc,EAC9F,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AA6BzC,wGAAwG;AACxG,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACtF;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,oFAAoF;IACpF,uBAAuB,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,CAAC;IACvC,iFAAiF;IACjF,UAAU,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACjD;AA4LD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,sBAAsB,CAgGrF"}
+{"version":3,"file":"reconcile-block.d.ts","sourceRoot":"","sources":["../../../src/cluster/reconcile-block.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EACqE,KAAK,cAAc,EAC9F,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAmCzC,wGAAwG;AACxG,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACtF;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,oFAAoF;IACpF,uBAAuB,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,CAAC;IACvC,iFAAiF;IACjF,UAAU,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACjD;AAqMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,sBAAsB,CAmGrF"}