@optimystic/db-p2p 0.26.0 → 0.27.0

package/dist/src/cluster/quorum-restore.d.ts

@@ -15,8 +15,13 @@ import type { BlockCommitProof } from "./commit-proof.js";
  * caller has already verified (`cluster/certified-claims.ts`) and marked via the
  * injected `certified` flag — so a lone honest holder with a valid proof is
  * sufficient where uncertified claims still need distinct-peer corroboration.
- * Verification itself never happens here: both selectors stay pure and
- * synchronous; verdicts arrive as booleans.
+ * Certified claims are additionally weighed by the proof's SIGNER COUNT
+ * (`certifiedSignerCount`, injected alongside the flag): a single-signer proof —
+ * routine since solo cohorts mint their own commit receipts — is one machine's
+ * honest word about its own commit, so it wins only where nothing multi-peer
+ * contests it, and never outranks several distinct peers agreeing at the same
+ * revision. Verification itself never happens here: both selectors stay pure and
+ * synchronous; verdicts arrive as booleans and counts.
  */
 /** A single peer's self-reported (rev, actionId) for a block. */
 export interface RevClaim {
@@ -39,6 +44,16 @@ export interface RevClaim {
      * Never set this from the mere presence of {@link proof}.
      */
     certified?: boolean;
+    /**
+     * Distinct signers in the verified proof, injected by the caller from the certification verdict
+     * (`ClaimCertification.signerCount`, `cluster/certified-claims.ts`) — never read off
+     * {@link proof} here. Meaningful only when {@link certified} is set. Selection weighs a certified
+     * claim as SINGLE-SIGNER when this is absent or below two: the conservative direction, since a
+     * single-signer proof (a solo cohort's self-signed commit receipt) must never outrank multi-peer
+     * agreement, and a caller that forgot to plumb the count should degrade toward corroboration,
+     * not toward trusting one signature.
+     */
+    certifiedSignerCount?: number;
 }
 /** The (rev, actionId) pair a quorum agreed on, plus the peers that corroborated it. */
 export interface QuorumRev {
@@ -120,30 +135,40 @@ export declare function corroboratorCapacity(cohortPeerCount: number, repairCorr
  *
  * **Certified claims** (`certified === true`, injected by a caller that verified the claim's
  * cohort commit proof — see `cluster/certified-claims.ts`) short-circuit the distinct-peer rule,
- * because the proof's signature set IS the corroboration:
+ * because the proof's signature set IS the corroboration — weighed by how many signers that set
+ * actually holds ({@link RevClaim.certifiedSignerCount}):
  *
  *  - No certified claims → today's corroboration result, unchanged.
  *  - A corroborated pair at a HIGHER rev than every certified claim wins — corroboration stays a
  *    legitimate weaker path, so a legacy uncertified tail written after the last proven rev
  *    remains readable.
- *  - Otherwise the highest certified rev wins: this covers a certified rev beaten in raw rev only
- *    by an *uncorroborated* claim (which failed quorum and is no evidence), and the equal-rev
- *    tie, where the proof outweighs votes.
- *  - Except: two distinct `actionId`s certified at that top rev is equivocation — the cohort
- *    provably signed two different actions into one revision — and the whole selection declines
- *    (`undefined`). Callers distinguish this decline from a plain no-quorum via
+ *  - A MULTI-SIGNER certified claim (two-plus signers) at the top certified rev wins over an
+ *    equal-rev corroborated pair and over any uncorroborated claim: the proof outweighs votes.
+ *    Single-signer certified claims at that rev neither outrank it nor equivocate against it — a
+ *    solo cohort's self-signed receipt is one machine's word, not the cohort's second signature.
+ *  - A SINGLE-SIGNER-only certified rev still wins where nothing multi-peer contests it (a lone
+ *    holder with a solo proof stays repairable), but it never beats corroboration by
+ *    {@link CORROBORATION_FLOOR}-plus distinct peers at the SAME revision — one machine that was
+ *    briefly alone must not outrank the cohort that stayed together. A corroborated pair that
+ *    AGREES with the sole certified action is convergence, not a contest; the certified verdict
+ *    is kept.
+ *  - Two distinct `actionId`s still CONTENDING at the top certified rev is equivocation — the
+ *    same keys provably signed two different actions into one revision — and the whole selection
+ *    declines (`undefined`). Callers distinguish this decline from a plain no-quorum via
  *    {@link certifiedEquivocation}.
  */
 export declare function selectQuorumRev(claims: RevClaim[], simpleMajorityThreshold: number, corroboratorCapacity?: number): QuorumRev | undefined;
 /**
  * The conflicting certified set at the top certified rev, when there is one: two-plus distinct
- * `actionId`s each carrying a verified cohort commit proof for the SAME revision. It deserves a
- * distinct log line from a plain no-quorum — the cohort (or whoever holds its keys) provably
- * signed both sides. Selection stays pure, so callers do the logging with what this reports.
+ * `actionId`s that CONTEND there ({@link certifiedContenders}) — each carrying a verified cohort
+ * commit proof for the SAME revision, at comparable weight. It deserves a distinct log line from a
+ * plain no-quorum — whoever holds the signing keys provably signed both sides. Selection stays
+ * pure, so callers do the logging with what this reports.
  *
- * `undefined` when no certified claim exists or the top certified rev names a single action —
- * conflicts at LOWER certified revs are history already superseded, not equivocation worth
- * declining over.
+ * `undefined` when no certified claim exists or a single action contends at the top certified rev —
+ * conflicts at LOWER certified revs are history already superseded, and a single-signer proof
+ * disagreeing with a multi-signer one at the same rev is a solo machine's fork losing to the
+ * cohort, not equivocation worth declining over.
  *
  * **Ask this only on a decline.** A non-`undefined` result does NOT imply {@link selectQuorumRev}
  * returned `undefined`: a corroborated pair STRICTLY above the top certified rev still wins, and
@@ -166,6 +191,13 @@ export interface BlockHashCandidate {
      * bytes), so the cohort's signatures stand in for other peers serving the same hash.
      */
     certified?: boolean;
+    /**
+     * Distinct signers in the verified proof, from the certification verdict
+     * (`ContentCertification.signerCount`) — the content-side sibling of
+     * {@link RevClaim.certifiedSignerCount}, with the same weighing: meaningful only when
+     * {@link certified} is set, and absent or sub-two counts as single-signer.
+     */
+    certifiedSignerCount?: number;
 }
 /**
  * Among candidates already known to corroborate the target `(rev, actionId)`,
@@ -188,26 +220,47 @@ export interface BlockHashCandidate {
  * *genuinely* that small reaches this branch.
  *
  * **Certified candidates** (`certified === true` — a caller verified a cohort commit proof whose
- * declared digest matches these exact bytes) short-circuit the hash quorum: exactly one distinct
- * certified hash → that block wins outright, however many peers served it. Two-plus distinct
- * certified hashes is certified content equivocation → decline (`undefined`), mirroring the
- * existing unique-hash-tie decline; callers name that decline via
- * {@link certifiedContentEquivocation}. No certified candidate → the hash quorum below, unchanged.
+ * declared digest matches these exact bytes) are weighed by the proof's signer count, mirroring
+ * {@link selectQuorumRev}:
+ *
+ *  - Exactly one distinct MULTI-SIGNER certified hash → that block wins outright, however many
+ *    peers served anything else: the cohort's own signatures over the digest outweigh other
+ *    carriers' bytes. Two-plus distinct multi-signer certified hashes is certified content
+ *    equivocation → decline (`undefined`); a single-signer certified hash alongside a
+ *    multi-signer one neither wins nor forces that decline (a solo receipt cannot equivocate
+ *    against the cohort's proof).
+ *  - SINGLE-SIGNER-only certified hashes no longer short-circuit: a hash group carried by
+ *    {@link CORROBORATION_FLOOR}-plus distinct peers that meets the ordinary quorum displaces
+ *    them (two-plus such groups is a genuine content disagreement → decline, as ever). With no
+ *    multi-peer group to defer to, a sole single-signer certified hash still wins on its proof —
+ *    a lone certified holder stays repairable — and two-plus distinct ones decline.
+ *  - No certified candidate → the hash quorum below, unchanged.
+ *
+ * Callers name the certified declines via {@link certifiedContentEquivocation}.
  */
 export declare function selectQuorumBlock(candidates: BlockHashCandidate[], simpleMajorityThreshold: number, corroboratorCapacity?: number): {
     block: IBlock;
     hash: string;
 } | undefined;
 /**
- * The conflicting certified hashes when there are two or more — the content-side sibling of
- * {@link certifiedEquivocation}, and the reason {@link selectQuorumBlock} declines outright.
- * Candidates reaching that selector all carry the SAME `(rev, actionId)`, so two certified hashes
- * mean the cohort's keys signed two different digests into one revision: a provable compromise an
- * operator must be able to tell apart from the routine "not enough carriers agreed" decline. Both
- * declines return `undefined`, so without this they log identically.
- *
- * `undefined` when fewer than two distinct certified hashes exist — including the ordinary
+ * The conflicting certified hashes when there are two or more CONTENDING — the content-side
+ * sibling of {@link certifiedEquivocation}, and the reason {@link selectQuorumBlock} declines
+ * outright. Candidates reaching that selector all carry the SAME `(rev, actionId)`, so two
+ * contending certified hashes mean the same keys signed two different digests into one revision: a
+ * provable compromise an operator must be able to tell apart from the routine "not enough carriers
+ * agreed" decline. Both declines return `undefined`, so without this they log identically.
+ * Contention mirrors the selector: multi-signer certified hashes when any exist, else the
+ * single-signer ones among themselves — a solo receipt disagreeing with a cohort proof is a fork
+ * losing, not equivocation.
+ *
+ * `undefined` when fewer than two certified hashes contend — including the ordinary
  * no-certified-candidate case, where a decline really is a plain content-quorum shortfall.
+ *
+ * **Ask this only on a decline**, exactly as with {@link certifiedEquivocation}: a non-`undefined`
+ * result does NOT imply {@link selectQuorumBlock} returned `undefined`. Two contending
+ * single-signer certified hashes yield to a {@link CORROBORATION_FLOOR}-plus-carrier quorum group,
+ * so selection can succeed while the solo-versus-solo conflict is still reported here. Call it when
+ * selection declined, to say WHY.
  */
 export declare function certifiedContentEquivocation(candidates: BlockHashCandidate[]): {
     hashes: string[];

package/dist/src/cluster/quorum-restore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quorum-restore.d.ts","sourceRoot":"","sources":["../../../src/cluster/quorum-restore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AAEH,iEAAiE;AACjE,MAAM,WAAW,QAAQ;IACxB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yFAAyF;IACzF,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CACzB,cAAc,EAAE,MAAM,EACtB,uBAAuB,EAAE,MAAM,EAC/B,oBAAoB,GAAE,MAAiC,GACrD,MAAM,CAGR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,GAAG,MAAM,CAE5G;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,QAAQ,EAAE,EAClB,uBAAuB,EAAE,MAAM,EAC/B,oBAAoB,CAAC,EAAE,MAAM,GAC3B,SAAS,GAAG,SAAS,CA+CvB;AAsBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAI1G;AAED;wDACwD;AACxD,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAChC,UAAU,EAAE,kBAAkB,EAAE,EAChC,uBAAuB,EAAE,MAAM,EAC/B,oBAAoB,CAAC,EAAE,MAAM,GAC3B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA+B7C;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAG/G"}
+{"version":3,"file":"quorum-restore.d.ts","sourceRoot":"","sources":["../../../src/cluster/quorum-restore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,iEAAiE;AACjE,MAAM,WAAW,QAAQ;IACxB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wFAAwF;AACxF,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yFAAyF;IACzF,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CACzB,cAAc,EAAE,MAAM,EACtB,uBAAuB,EAAE,MAAM,EAC/B,oBAAoB,GAAE,MAAiC,GACrD,MAAM,CAGR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,GAAG,MAAM,CAE5G;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,QAAQ,EAAE,EAClB,uBAAuB,EAAE,MAAM,EAC/B,oBAAoB,CAAC,EAAE,MAAM,GAC3B,SAAS,GAAG,SAAS,CA8DvB;AAiDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAM1G;AAED;wDACwD;AACxD,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAChC,UAAU,EAAE,kBAAkB,EAAE,EAChC,uBAAuB,EAAE,MAAM,EAC/B,oBAAoB,CAAC,EAAE,MAAM,GAC3B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAmD7C;AAmBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAK/G"}

package/dist/src/cluster/quorum-restore.js

@@ -70,18 +70,26 @@ export function corroboratorCapacity(cohortPeerCount, repairCorroborationCluster
  *
  * **Certified claims** (`certified === true`, injected by a caller that verified the claim's
  * cohort commit proof — see `cluster/certified-claims.ts`) short-circuit the distinct-peer rule,
- * because the proof's signature set IS the corroboration:
+ * because the proof's signature set IS the corroboration — weighed by how many signers that set
+ * actually holds ({@link RevClaim.certifiedSignerCount}):
  *
  *  - No certified claims → today's corroboration result, unchanged.
  *  - A corroborated pair at a HIGHER rev than every certified claim wins — corroboration stays a
  *    legitimate weaker path, so a legacy uncertified tail written after the last proven rev
  *    remains readable.
- *  - Otherwise the highest certified rev wins: this covers a certified rev beaten in raw rev only
- *    by an *uncorroborated* claim (which failed quorum and is no evidence), and the equal-rev
- *    tie, where the proof outweighs votes.
- *  - Except: two distinct `actionId`s certified at that top rev is equivocation — the cohort
- *    provably signed two different actions into one revision — and the whole selection declines
- *    (`undefined`). Callers distinguish this decline from a plain no-quorum via
+ *  - A MULTI-SIGNER certified claim (two-plus signers) at the top certified rev wins over an
+ *    equal-rev corroborated pair and over any uncorroborated claim: the proof outweighs votes.
+ *    Single-signer certified claims at that rev neither outrank it nor equivocate against it — a
+ *    solo cohort's self-signed receipt is one machine's word, not the cohort's second signature.
+ *  - A SINGLE-SIGNER-only certified rev still wins where nothing multi-peer contests it (a lone
+ *    holder with a solo proof stays repairable), but it never beats corroboration by
+ *    {@link CORROBORATION_FLOOR}-plus distinct peers at the SAME revision — one machine that was
+ *    briefly alone must not outrank the cohort that stayed together. A corroborated pair that
+ *    AGREES with the sole certified action is convergence, not a contest; the certified verdict
+ *    is kept.
+ *  - Two distinct `actionId`s still CONTENDING at the top certified rev is equivocation — the
+ *    same keys provably signed two different actions into one revision — and the whole selection
+ *    declines (`undefined`). Callers distinguish this decline from a plain no-quorum via
  *    {@link certifiedEquivocation}.
  */
 export function selectQuorumRev(claims, simpleMajorityThreshold, corroboratorCapacity) {
@@ -124,15 +132,30 @@ export function selectQuorumRev(claims, simpleMajorityThreshold, corroboratorCap
     // `corroborated`), so it cannot outrank a proof.
     if (corroborated && corroborated.rev > certified.rev)
         return corroborated;
-    // Two actions provably signed into the same top revision: decline the whole selection rather
-    // than pick a side. Callers log via certifiedEquivocation.
-    if (certified.byAction.size !== 1)
+    const contenders = certifiedContenders(certified.byAction);
+    // A single-signer-only certified rev loses the equal-rev tie to genuinely multi-peer
+    // corroboration — unless the corroborated pair AGREES with the sole certified action, which is
+    // convergence rather than a contest and keeps the certified verdict (and its logging/penalty
+    // exemptions) intact.
+    // NOTE: the weighing reaches EQUAL revisions only. A solo fork that committed twice while its
+    // cohort committed once claims the higher rev and still wins above. That is not an oversight of
+    // this rule: a claim carries no lineage, so "one peer ahead of two" is identical whether it
+    // forked or the two are lagging, and refusing it would break ordinary lagging-cohort repair.
+    // Pinned by 'does NOT reach a solo fork one revision AHEAD' in quorum-restore-certified.spec.ts;
+    // closing it needs new evidence — debt-repair-cannot-tell-a-fork-from-a-lagging-cohort.
+    if (!contenders.multiSigner && corroborated && corroborated.rev === certified.rev
+        && corroborated.supporters.length >= CORROBORATION_FLOOR
+        && !(certified.byAction.size === 1 && certified.byAction.has(corroborated.actionId))) {
+        return corroborated;
+    }
+    // Two actions provably signed into the same top revision by contending proofs: decline the
+    // whole selection rather than pick a side. Callers log via certifiedEquivocation.
+    if (contenders.entries.length !== 1)
         return undefined;
-    const [entry] = certified.byAction;
-    const [actionId, supporters] = entry; // size === 1 checked above
-    return { rev: certified.rev, actionId, supporters: [...supporters], certified: true };
+    const [actionId, group] = contenders.entries[0];
+    return { rev: certified.rev, actionId, supporters: [...group.supporters], certified: true };
 }
-/** Certified claims at the top certified rev, keyed by actionId → distinct certified claimants. */
+/** Certified claims at the top certified rev, keyed by actionId → the claimants behind each. */
 function certifiedGroups(claims) {
     let top;
     for (const c of claims) {
@@ -145,24 +168,43 @@ function certifiedGroups(claims) {
     for (const c of claims) {
         if (c.certified !== true || c.rev !== top)
             continue;
-        let s = byAction.get(c.actionId);
-        if (!s) {
-            s = new Set();
-            byAction.set(c.actionId, s);
+        let g = byAction.get(c.actionId);
+        if (!g) {
+            g = { supporters: new Set(), multiSigner: false };
+            byAction.set(c.actionId, g);
         }
-        s.add(c.peerId);
+        g.supporters.add(c.peerId);
+        // Absent or sub-two count weighs as single-signer — see RevClaim.certifiedSignerCount.
+        if ((c.certifiedSignerCount ?? 1) >= 2)
+            g.multiSigner = true;
     }
     return { rev: top, byAction };
 }
+/**
+ * Which certified actions at the top rev actually CONTEND for selection. A multi-signer proof is
+ * the cohort's own signature set; a single-signer proof is one machine's word about its own solo
+ * commit — so when any action is multi-signer-backed, only the multi-signer-backed ones contend
+ * (a solo receipt can neither outrank nor equivocate against a cohort proof), and only with no
+ * multi-signer action anywhere do the single-signer ones contend among themselves. One helper so
+ * {@link selectQuorumRev} and {@link certifiedEquivocation} cannot drift on the rule.
+ */
+function certifiedContenders(byAction) {
+    const multi = [...byAction].filter(([, g]) => g.multiSigner);
+    return multi.length > 0
+        ? { entries: multi, multiSigner: true }
+        : { entries: [...byAction], multiSigner: false };
+}
 /**
  * The conflicting certified set at the top certified rev, when there is one: two-plus distinct
- * `actionId`s each carrying a verified cohort commit proof for the SAME revision. It deserves a
- * distinct log line from a plain no-quorum — the cohort (or whoever holds its keys) provably
- * signed both sides. Selection stays pure, so callers do the logging with what this reports.
+ * `actionId`s that CONTEND there ({@link certifiedContenders}) — each carrying a verified cohort
+ * commit proof for the SAME revision, at comparable weight. It deserves a distinct log line from a
+ * plain no-quorum — whoever holds the signing keys provably signed both sides. Selection stays
+ * pure, so callers do the logging with what this reports.
  *
- * `undefined` when no certified claim exists or the top certified rev names a single action —
- * conflicts at LOWER certified revs are history already superseded, not equivocation worth
- * declining over.
+ * `undefined` when no certified claim exists or a single action contends at the top certified rev —
+ * conflicts at LOWER certified revs are history already superseded, and a single-signer proof
+ * disagreeing with a multi-signer one at the same rev is a solo machine's fork losing to the
+ * cohort, not equivocation worth declining over.
  *
  * **Ask this only on a decline.** A non-`undefined` result does NOT imply {@link selectQuorumRev}
  * returned `undefined`: a corroborated pair STRICTLY above the top certified rev still wins, and
@@ -171,9 +213,12 @@ function certifiedGroups(claims) {
  */
 export function certifiedEquivocation(claims) {
     const groups = certifiedGroups(claims);
-    if (!groups || groups.byAction.size < 2)
+    if (!groups)
         return undefined;
-    return { rev: groups.rev, actionIds: [...groups.byAction.keys()] };
+    const contenders = certifiedContenders(groups.byAction);
+    if (contenders.entries.length < 2)
+        return undefined;
+    return { rev: groups.rev, actionIds: contenders.entries.map(([actionId]) => actionId) };
 }
 /**
  * Among candidates already known to corroborate the target `(rev, actionId)`,
@@ -196,22 +241,34 @@ export function certifiedEquivocation(claims) {
  * *genuinely* that small reaches this branch.
  *
  * **Certified candidates** (`certified === true` — a caller verified a cohort commit proof whose
- * declared digest matches these exact bytes) short-circuit the hash quorum: exactly one distinct
- * certified hash → that block wins outright, however many peers served it. Two-plus distinct
- * certified hashes is certified content equivocation → decline (`undefined`), mirroring the
- * existing unique-hash-tie decline; callers name that decline via
- * {@link certifiedContentEquivocation}. No certified candidate → the hash quorum below, unchanged.
+ * declared digest matches these exact bytes) are weighed by the proof's signer count, mirroring
+ * {@link selectQuorumRev}:
+ *
+ *  - Exactly one distinct MULTI-SIGNER certified hash → that block wins outright, however many
+ *    peers served anything else: the cohort's own signatures over the digest outweigh other
+ *    carriers' bytes. Two-plus distinct multi-signer certified hashes is certified content
+ *    equivocation → decline (`undefined`); a single-signer certified hash alongside a
+ *    multi-signer one neither wins nor forces that decline (a solo receipt cannot equivocate
+ *    against the cohort's proof).
+ *  - SINGLE-SIGNER-only certified hashes no longer short-circuit: a hash group carried by
+ *    {@link CORROBORATION_FLOOR}-plus distinct peers that meets the ordinary quorum displaces
+ *    them (two-plus such groups is a genuine content disagreement → decline, as ever). With no
+ *    multi-peer group to defer to, a sole single-signer certified hash still wins on its proof —
+ *    a lone certified holder stays repairable — and two-plus distinct ones decline.
+ *  - No certified candidate → the hash quorum below, unchanged.
+ *
+ * Callers name the certified declines via {@link certifiedContentEquivocation}.
  */
 export function selectQuorumBlock(candidates, simpleMajorityThreshold, corroboratorCapacity) {
     if (candidates.length === 0)
         return undefined;
     const certifiedByHash = certifiedHashes(candidates);
-    if (certifiedByHash.size === 1) {
-        const [entry] = certifiedByHash;
-        const [hash, block] = entry;
+    const multiSignerHashes = [...certifiedByHash].filter(([, v]) => v.multiSigner);
+    if (multiSignerHashes.length === 1) {
+        const [hash, { block }] = multiSignerHashes[0];
         return { block, hash };
     }
-    if (certifiedByHash.size > 1)
+    if (multiSignerHashes.length > 1)
         return undefined; // certified content equivocation — decline
     // One vote per distinct peer per hash group, matching selectQuorumRev — a peer appearing twice
     // must not be able to second itself into a content quorum.
@@ -228,34 +285,74 @@ export function selectQuorumBlock(candidates, simpleMajorityThreshold, corrobora
     }
     const quorum = quorumSize(voters.size, simpleMajorityThreshold, corroboratorCapacity);
     const meeting = [...groups.entries()].filter(([, g]) => g.supporters.size >= quorum);
-    // Exactly one hash may meet quorum; a tie is a genuine content disagreement → decline.
-    if (meeting.length !== 1)
+    if (certifiedByHash.size === 0) {
+        // Exactly one hash may meet quorum; a tie is a genuine content disagreement → decline.
+        if (meeting.length !== 1)
+            return undefined;
+        const [hash, group] = meeting[0];
+        return { block: group.block, hash };
+    }
+    // Only single-signer certified hashes remain. Genuinely multi-peer agreement — a quorum-meeting
+    // group of CORROBORATION_FLOOR-plus distinct carriers — outranks a solo proof, with the usual
+    // uniqueness rule among such groups. (A quorum-meeting group of ONE carrier, possible only on a
+    // capacity-one cohort, is a bare assertion and does not displace a verified proof.)
+    const multiPeer = meeting.filter(([, g]) => g.supporters.size >= CORROBORATION_FLOOR);
+    if (multiPeer.length > 1)
         return undefined;
-    const [hash, group] = meeting[0];
-    return { block: group.block, hash };
+    if (multiPeer.length === 1) {
+        const [hash, group] = multiPeer[0];
+        return { block: group.block, hash };
+    }
+    // No multi-peer agreement to defer to: a sole single-signer certified hash wins on its proof;
+    // two-plus distinct ones are solo-vs-solo equivocation → decline.
+    if (certifiedByHash.size > 1)
+        return undefined;
+    const [entry] = certifiedByHash;
+    const [hash, { block }] = entry;
+    return { block, hash };
 }
-/** Distinct hashes carried by certified candidates → the first block instance serving each. */
+/** Distinct hashes carried by certified candidates → the first block instance serving each, and
+ * whether any certified candidate at that hash carried a two-plus-signer proof. */
 function certifiedHashes(candidates) {
     const byHash = new Map();
     for (const c of candidates) {
-        if (c.certified === true && !byHash.has(c.hash))
-            byHash.set(c.hash, c.block);
+        if (c.certified !== true)
+            continue;
+        let entry = byHash.get(c.hash);
+        if (!entry) {
+            entry = { block: c.block, multiSigner: false };
+            byHash.set(c.hash, entry);
+        }
+        // Absent or sub-two count weighs as single-signer — see BlockHashCandidate.certifiedSignerCount.
+        if ((c.certifiedSignerCount ?? 1) >= 2)
+            entry.multiSigner = true;
     }
     return byHash;
 }
 /**
- * The conflicting certified hashes when there are two or more — the content-side sibling of
- * {@link certifiedEquivocation}, and the reason {@link selectQuorumBlock} declines outright.
- * Candidates reaching that selector all carry the SAME `(rev, actionId)`, so two certified hashes
- * mean the cohort's keys signed two different digests into one revision: a provable compromise an
- * operator must be able to tell apart from the routine "not enough carriers agreed" decline. Both
- * declines return `undefined`, so without this they log identically.
+ * The conflicting certified hashes when there are two or more CONTENDING — the content-side
+ * sibling of {@link certifiedEquivocation}, and the reason {@link selectQuorumBlock} declines
+ * outright. Candidates reaching that selector all carry the SAME `(rev, actionId)`, so two
+ * contending certified hashes mean the same keys signed two different digests into one revision: a
+ * provable compromise an operator must be able to tell apart from the routine "not enough carriers
+ * agreed" decline. Both declines return `undefined`, so without this they log identically.
+ * Contention mirrors the selector: multi-signer certified hashes when any exist, else the
+ * single-signer ones among themselves — a solo receipt disagreeing with a cohort proof is a fork
+ * losing, not equivocation.
  *
- * `undefined` when fewer than two distinct certified hashes exist — including the ordinary
+ * `undefined` when fewer than two certified hashes contend — including the ordinary
  * no-certified-candidate case, where a decline really is a plain content-quorum shortfall.
+ *
+ * **Ask this only on a decline**, exactly as with {@link certifiedEquivocation}: a non-`undefined`
+ * result does NOT imply {@link selectQuorumBlock} returned `undefined`. Two contending
+ * single-signer certified hashes yield to a {@link CORROBORATION_FLOOR}-plus-carrier quorum group,
+ * so selection can succeed while the solo-versus-solo conflict is still reported here. Call it when
+ * selection declined, to say WHY.
  */
 export function certifiedContentEquivocation(candidates) {
     const byHash = certifiedHashes(candidates);
-    return byHash.size < 2 ? undefined : { hashes: [...byHash.keys()] };
+    const multi = [...byHash].filter(([, v]) => v.multiSigner);
+    const contenders = multi.length > 0 ? multi : [...byHash];
+    return contenders.length < 2 ? undefined : { hashes: contenders.map(([hash]) => hash) };
 }
 //# sourceMappingURL=quorum-restore.js.map

package/dist/src/cluster/quorum-restore.js.map

@@ -1 +1 @@
-{"version":3,"file":"quorum-restore.js","sourceRoot":"","sources":["../../../src/cluster/quorum-restore.ts"],"names":[],"mappings":"AA2DA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACzB,cAAsB,EACtB,uBAA+B,EAC/B,uBAA+B,MAAM,CAAC,iBAAiB;IAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,cAAc,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAAuB,EAAE,8BAAsC;IACnG,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,8BAA8B,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAkB,EAClB,uBAA+B,EAC/B,oBAA6B;IAE7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsE,CAAC;IAC7F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IAE1F,iFAAiF;IACjF,mFAAmF;IACnF,iFAAiF;IACjF,oFAAoF;IACpF,iFAAiF;IACjF,qFAAqF;IACrF,QAAQ;IACR,IAAI,IAA4E,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,GAAG,CAAC,CAAC;QACV,CAAC;IACF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI;QACxB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEb,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC;IACpC,0FAA0F;IAC1F,0FAA0F;IAC1F,iDAAiD;IACjD,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC;IAC1E,6FAA6F;IAC7F,2DAA2D;IAC3D,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC;IACnC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,KAAM,CAAC,CAAC,2BAA2B;IAClE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACvF,CAAC;AAED,mGAAmG;AACnG,SAAS,eAAe,CAAC,MAAkB;IAC1C,IAAI,GAAuB,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACvD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACpE,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,iBAAiB,CAChC,UAAgC,EAChC,uBAA+B,EAC/B,oBAA6B;IAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC;QAChC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAM,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,2CAA2C;IAE3F,+FAA+F;IAC/F,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsD,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;IACrF,uFAAuF;IACvF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,+FAA+F;AAC/F,SAAS,eAAe,CAAC,UAAgC;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAgC;IAC5E,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC"}
+{"version":3,"file":"quorum-restore.js","sourceRoot":"","sources":["../../../src/cluster/quorum-restore.ts"],"names":[],"mappings":"AA0EA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACzB,cAAsB,EACtB,uBAA+B,EAC/B,uBAA+B,MAAM,CAAC,iBAAiB;IAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,cAAc,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAAuB,EAAE,8BAAsC;IACnG,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,8BAA8B,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAkB,EAClB,uBAA+B,EAC/B,oBAA6B;IAE7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsE,CAAC;IAC7F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IAE1F,iFAAiF;IACjF,mFAAmF;IACnF,iFAAiF;IACjF,oFAAoF;IACpF,iFAAiF;IACjF,qFAAqF;IACrF,QAAQ;IACR,IAAI,IAA4E,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,GAAG,CAAC,CAAC;QACV,CAAC;IACF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI;QACxB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEb,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC;IACpC,0FAA0F;IAC1F,0FAA0F;IAC1F,iDAAiD;IACjD,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC;IAC1E,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,qFAAqF;IACrF,+FAA+F;IAC/F,6FAA6F;IAC7F,sBAAsB;IACtB,8FAA8F;IAC9F,gGAAgG;IAChG,4FAA4F;IAC5F,6FAA6F;IAC7F,iGAAiG;IACjG,wFAAwF;IACxF,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG;WAC7E,YAAY,CAAC,UAAU,CAAC,MAAM,IAAI,mBAAmB;WACrD,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,2FAA2F;IAC3F,kFAAkF;IAClF,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7F,CAAC;AAUD,gGAAgG;AAChG,SAAS,eAAe,CAAC,MAAkB;IAC1C,IAAI,GAAuB,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAClD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3B,uFAAuF;QACvF,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC3B,QAA2C;IAE3C,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;QACvC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACvD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzF,CAAC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,iBAAiB,CAChC,UAAgC,EAChC,uBAA+B,EAC/B,oBAA6B;IAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAChF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,2CAA2C;IAE/F,+FAA+F;IAC/F,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsD,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;IAErF,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAChC,uFAAuF;QACvF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,gGAAgG;IAChG,8FAA8F;IAC9F,gGAAgG;IAChG,oFAAoF;IACpF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,mBAAmB,CAAC,CAAC;IACtF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,8FAA8F;IAC9F,kEAAkE;IAClE,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC;IAChC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,KAAM,CAAC;IACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;mFACmF;AACnF,SAAS,eAAe,CAAC,UAAgC;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAgC;IAC5E,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AACzF,CAAC"}

package/dist/src/cluster/reconcile-block.d.ts

@@ -52,8 +52,11 @@ export interface ReconcileBlockDeps {
  *
  * Peer-attached cohort commit proofs are verified first ({@link certifyCandidates}) and both gates
  * weigh the verdicts: a claim — and, separately, the bytes — that a verified proof certifies is
- * accepted with no second peer at any cohort size, and the proof that certified the bytes is
- * persisted alongside them so the repaired replica serves it onward.
+ * accepted with no second peer where nothing multi-peer contests it. The proof's signer count is
+ * weighed too: a SINGLE-SIGNER proof (a solo cohort's self-signed receipt) never outranks several
+ * distinct peers agreeing at the same revision or on the same bytes — see `quorum-restore.ts`. The
+ * proof that certified the agreed bytes is persisted alongside them so the repaired replica serves
+ * it onward.
  *
  * Both quorums are capped by {@link corroboratorCapacity} for the claims that still need
  * corroboration: demanding two corroborators from a cohort that contains exactly one other peer is
@@ -69,8 +72,10 @@ export interface ReconcileBlockDeps {
  * no honest majority to appeal to in the first place. It is closed for a candidate that carries a
  * verified cohort commit proof — {@link certifyCandidates} binds the proof's declared digest to the
  * served bytes, which is a check against the *cohort's own signatures* rather than against other
- * peers, so a certified carrier wins the content gate outright and this exposure never applies to
- * it. It remains open for a proof-less candidate, and for the residual that layer 1 proves only
+ * peers, so a certified carrier wins the content gate with no second carrier and this exposure
+ * never applies to it. (Weighing still applies at larger widths: a SINGLE-SIGNER certified carrier
+ * does not displace a multi-peer hash quorum — see `selectQuorumBlock` — but at the capacity-one
+ * width this paragraph describes there is no multi-peer group to lose to.) It remains open for a proof-less candidate, and for the residual that layer 1 proves only
  * that the listed signers signed (`feat-cluster-membership-threshold-cert-anchoring`).
  *
  * Declines are cheap and retryable: nothing is persisted, nothing is marked, and the next commit

package/dist/src/cluster/reconcile-block.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-block.d.ts","sourceRoot":"","sources":["../../../src/cluster/reconcile-block.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EACqE,KAAK,cAAc,EAC9F,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AA6BzC,wGAAwG;AACxG,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACtF;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,oFAAoF;IACpF,uBAAuB,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,CAAC;IACvC,iFAAiF;IACjF,UAAU,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACjD;AA4LD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,sBAAsB,CAgGrF"}
+{"version":3,"file":"reconcile-block.d.ts","sourceRoot":"","sources":["../../../src/cluster/reconcile-block.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EACqE,KAAK,cAAc,EAC9F,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAmCzC,wGAAwG;AACxG,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACtF;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,oFAAoF;IACpF,uBAAuB,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,CAAC;IACvC,iFAAiF;IACjF,UAAU,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACjD;AAqMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,sBAAsB,CAmGrF"}