@optimystic/db-p2p 0.29.0 → 1.0.0-beta.1

package/dist/src/cluster/cluster-repo.d.ts

@@ -163,6 +163,7 @@ export declare class ClusterMember implements ICluster {
     private executedTransactions;
     private executedPendResults;
     private executedCommitResults;
+    private refusedPendActions;
     private appliedInvalidations;
     private cleanupQueue;
     private pendingUpdates;
@@ -245,6 +246,15 @@ export declare class ClusterMember implements ICluster {
      */
     update(record: ClusterRecord): Promise<ClusterRecord>;
     private processUpdate;
+    /**
+     * Add this member's own conflict-shaped pend verdict to a record's {@link ClusterRecord.applyOutcomes},
+     * when storage produced one for this transaction. A success, a bare-reason fault, or no retained
+     * verdict at all leaves the record untouched — the coordinator's rule is "an entry means retry",
+     * so an entry that does not mean retry must not exist.
+     *
+     * The member never signs this and never writes another peer's entry.
+     */
+    private withOwnApplyOutcome;
     /**
      * Merges two records, validating that non-signature fields match.
      * Detects equivocation (same peer changing vote type) and applies penalties.
@@ -405,7 +415,10 @@ export declare class ClusterMember implements ICluster {
      * "I checked this". The four-way rule, per committed block:
      *  - no local `latest`, or `latest.rev < commit.rev` → abstain (approve). Preserves the
      *    lagging-member tolerance (`coordinator-repo-commit-divergence.spec.ts`): a member behind
-     *    the commit cannot judge it.
+     *    the commit cannot judge it. Abstaining is safe rather than merely tolerable: apply-time
+     *    catches the case the vote cannot, since `StorageRepo.internalCommit` refuses an update-only
+     *    transform whose declared `baseRev` is not this member's `latest.rev` and reconciles instead
+     *    of forking the block's content.
      *  - `latest.rev === commit.rev` with the SAME action → abstain (approve). Idempotent
      *    redelivery of an already-durable commit; rejecting would make the writer rebase and
      *    re-append an action that already landed — a duplicate entry. (Storage's `alreadyDone`
@@ -420,20 +433,64 @@ export declare class ClusterMember implements ICluster {
      * abstains. Reason stays plain prose — it is fed to computeSigningPayload and carried as
      * Signature.rejectReason, exactly like the stale-revision pend reject.
      *
-     * Residual (see the commit-tier handoff): a member that signed the winner's commit but has not
-     * yet APPLIED it sits in a window where it holds neither the winner's record (reservation
-     * dropped at commit-sign, `shouldPersist = false`) nor the winner's revision (storage still
-     * behind) — it abstains here. A capability-less member, or one with history truncated below
-     * `latest`, abstains at `latest.rev > commit.rev` too. A rival's commit can therefore still
-     * pass the promise round if EVERY member is simultaneously in one of those states — on a fast
-     * cohort that window is the COMMON case, not the corner. The backstop is downstream of
-     * consensus: every member's apply then refuses the rival as stale, the coordinating node's own
-     * member retains that refusal (`getExecutedCommitResult`), and `CoordinatorRepo.commit`
-     * confirms the rival against local storage and answers the writer with a retryable conflict
-     * instead of a fabricated success. `ConflictRaceLostError` conversion and classified
-     * rejections close the re-drive route the same way.
+     * Residual (narrowed, see below): a member that signed the winner's commit but has not yet
+     * APPLIED it sits in a window where it holds neither the winner's record (reservation dropped at
+     * commit-sign, `shouldPersist = false`) nor the winner's revision (storage still behind) — it
+     * abstains here. A capability-less member, or one with history truncated below `latest`, abstains
+     * at `latest.rev > commit.rev` too. A rival's commit can therefore still pass THIS check if every
+     * member is simultaneously in one of those states — on a fast cohort that window is the COMMON
+     * case, not the corner.
+     *
+     * What now covers it: {@link validateCommitAgainstRefusedPend} rejects the same commit from the
+     * other direction — not "did a rival take the revision" but "did I already refuse this action's
+     * pend" — which is precisely the state a member is left in when it lost the race in the
+     * promise→apply window. Downstream of consensus the backstop still stands: every member's apply
+     * refuses the rival as stale, the coordinating node's own member retains that refusal
+     * (`getExecutedCommitResult`), and `CoordinatorRepo.commit` confirms the rival against local
+     * storage and answers the writer with a retryable conflict instead of a fabricated success.
+     * `ConflictRaceLostError` conversion and classified rejections close the re-drive route the same
+     * way.
      */
     private validateCommitRevisions;
+    /**
+     * Promise-round check that this member is not about to co-sign the commit of an action whose PEND
+     * its own storage refused.
+     *
+     * The hole this closes: the commit-round vote is deliberately blind ({@link getTransactionPhase}
+     * signs whenever promise approvals reach super-majority), and both other commit-promise checks
+     * abstain for a member that holds no pend of the committing action — which is exactly the state a
+     * member is in *because* it refused that pend. So a member could refuse action X's pend as
+     * conflicting with a rival, and milliseconds later sign X's commit, letting X reach commit
+     * consensus at a revision this member will never durably hold.
+     *
+     * Two conditions, both required:
+     *  (a) this member retains a conflict-shaped pend refusal for `commit.actionId`
+     *      ({@link refusedPendActions}), and
+     *  (b) local storage STILL corroborates it — a rival pending action holds one of the commit's
+     *      blocks, or a different action already took `commit.rev`.
+     *
+     * (b) is what keeps this from regressing the lagging-member and cohort-drift tolerances that
+     * {@link validateCommitRevisions} documents. A member that merely *missed* the pend retains no
+     * refusal and abstains exactly as before. A member whose refusal has since been settled — the
+     * rival cancelled, the reservation released — abstains too, rather than vetoing a commit the rest
+     * of the cohort is holding perfectly well. The retention is in-memory and TTL'd, so a restart also
+     * degrades to the previous abstain behaviour rather than to a stuck veto.
+     *
+     * Effect on a small cohort: one reject makes super-majority unreachable, so the commit never
+     * assembles consensus and the write fails loudly instead of forking the block. That is the
+     * intended outcome here — a clean retryable conflict answer is {@link ClusterRecord.applyOutcomes}'
+     * job, and this arm is the backstop for the paths that channel cannot reach (a member that applies
+     * late, via the scheduled commit-retry timer, after the coordinator has already answered).
+     *
+     * Never throws out of the vote path: a read fault is an abstain, same rule as its two siblings.
+     */
+    private validateCommitAgainstRefusedPend;
+    /**
+     * Condition (b) of {@link validateCommitAgainstRefusedPend}: does local storage still back up a
+     * retained pend refusal for this commit? Returns a short prose fragment naming what corroborates
+     * it, or `undefined` for "no longer corroborated — abstain" (which a read fault also yields).
+     */
+    private refusedPendConflictsWithLocalState;
     /**
      * Promise-round check of a commit record's declared content digests
      * (`CommitRequest.blockDigests`) against what this member's OWN pended copy of each transform
@@ -450,9 +507,11 @@ export declare class ClusterMember implements ICluster {
      * authored, delivered at pend — a hostile declarer cannot force or dodge a check by mis-declaring
      * `baseRev`):
      *  - transform carries an `insert` → base-independent, ALWAYS check (declared `baseRev` ignored);
-     *  - `updates` only → check iff this member's local base rev equals the declared `baseRev`
-     *    (StorageRepo.commit accepts any `latest.rev < request.rev`, so a lagging member applying an
-     *    update-only transform to an older base legitimately materializes different bytes);
+     *  - `updates` only → check iff this member's local base rev equals the declared `baseRev`. A
+     *    member whose base does not match cannot JUDGE the content — it would preview the transform
+     *    against different bytes than the declarer used — so it abstains here. It never goes on to
+     *    materialize those bytes: `StorageRepo.internalCommit` refuses that same mismatch at apply
+     *    and reconciles from a cohort peer;
      *  - `delete` only / no base / unmaterializable base → materializes nothing to compare, abstain;
      *  - no pending transform for the action (this member never saw the pend) → abstain.
      * "Abstain" = contribute no content attestation: approve exactly as before this check existed.

package/dist/src/cluster/cluster-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-repo.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAa,WAAW,EAAE,qBAAqB,EAAE,sBAAsB,EAA2B,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAiB,UAAU,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpR,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAiC,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAK7E,OAAO,EAA8C,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA+CtG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IACjC,wGAAwG;IACxG,KAAK,EAAE,YAAY,CAAC;IACpB,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAyB/F,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;;GAMG;AACH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE9E,UAAU,uBAAuB;IAChC,WAAW,EAAE,KAAK,CAAC;IACnB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,oGAAoG;IACpG,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,oHAAoH;IACpH,sBAAsB,CAAC,EAAE,gCAAgC,CAAC;IAC1D,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,uBAAuB,GAAG,aAAa,CAoBhF;AAKD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAkBhD;;;GAGG;AACH,qBAAa,aAAc,YAAW,QAAQ;IA4D5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IA1ExC,OAAO,CAAC,kBAAkB,CAA4C;IAEtE,OAAO,CAAC,oBAAoB,CAAkC;IAK9D,OAAO,CAAC,mBAAmB,CAAsC;IAQjE,OAAO,CAAC,qBAAqB,CAAwC;IAKrE,OAAO,CAAC,oBAAoB,CAAkC;IAE9D,OAAO,CAAC,YAAY,CAAgB;IAEpC,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IAEjD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAO;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAGhD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;IACvD;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAGjB,WAAW,EAAE,KAAK,EAClB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,MAAM,YAAA,EAExC,kBAAkB,CAAC,EAAE,iBAAiB,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,SAAS,CAAC,EAAE,qBAAqB,YAAA,EACjC,UAAU,CAAC,EAAE,eAAe,YAAA,EAC7C,eAAe,CAAC,EAAE,sBAAsB,EACvB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,cAAc,CAAC,EAAE,sBAAsB,YAAA,EACvC,mBAAmB,CAAC,EAAE,qBAAqB,YAAA,EAC3C,YAAY,CAAC,EAAE,qBAAqB,YAAA,EACpC,sBAAsB,CAAC,EAAE,gCAAgC,YAAA,EACzD,qBAAqB,CAAC,EAAE,6BAA6B,YAAA,EACtE,GAAG,CAAC,EAAE,MAAM,MAAM;IA2BnB;;;;;OAKG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED;;;OAGG;IACH,OAAO,IAAI,IAAI;IAaf;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;;;OASG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIlE;;;;;;;;OAQG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAItE;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI1E;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAyB7C,aAAa;IAuL3B;;;OAGG;YACW,YAAY;IAwD1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;YAyCZ,cAAc;IAmC5B;;;;OAIG;YACW,kBAAkB;YAIlB,kBAAkB;IA4BhC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,kBAAkB;YAIlB,iBAAiB;YAIjB,QAAQ;IAKtB;;;;;;;;;;;OAWG;YACW,eAAe;YAqCf,mBAAmB;IAkFjC,OAAO,CAAC,WAAW;YAIL,mBAAmB;IAgCjC;;;;;;;;OAQG;YACW,wBAAwB;IAkBtC;;;;;;;;OAQG;YACW,eAAe;IAoB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;YACW,eAAe;IAgJ7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;;;;;;;;OAYG;YACW,yBAAyB;IAoEvC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC;;;;;OAKG;YACW,sBAAsB;IAmHpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;YACW,uBAAuB;IA0ErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,wBAAwB;YA0FxB,kBAAkB;IAoBhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IAqD7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;YACW,uBAAuB;IAqJrC;;;;;;;;;;OAUG;YACW,0BAA0B;IAwExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;;;;;OAMG;YACW,wBAAwB;IAgBtC,uFAAuF;YACzE,iBAAiB;IAmB/B,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;YAcd,eAAe;IAI7B,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;YAuEN,iBAAiB;YAejB,gBAAgB;YA+BhB,gBAAgB;IAM9B,OAAO,CAAC,wBAAwB;YA0BlB,mBAAmB;IAqBjC,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,gBAAgB;IAqBxB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAS/B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC1C;;;OAGG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}
+{"version":3,"file":"cluster-repo.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAa,WAAW,EAAE,qBAAqB,EAAE,sBAAsB,EAA2B,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAiB,UAAU,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpR,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAiC,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAK7E,OAAO,EAA8C,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA+CtG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IACjC,wGAAwG;IACxG,KAAK,EAAE,YAAY,CAAC;IACpB,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAyB/F,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;;GAMG;AACH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE9E,UAAU,uBAAuB;IAChC,WAAW,EAAE,KAAK,CAAC;IACnB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,oGAAoG;IACpG,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,oHAAoH;IACpH,sBAAsB,CAAC,EAAE,gCAAgC,CAAC;IAC1D,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,uBAAuB,GAAG,aAAa,CAoBhF;AAKD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAkBhD;;;GAGG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAoE5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAlFxC,OAAO,CAAC,kBAAkB,CAA4C;IAEtE,OAAO,CAAC,oBAAoB,CAAkC;IAK9D,OAAO,CAAC,mBAAmB,CAAsC;IAQjE,OAAO,CAAC,qBAAqB,CAAwC;IAQrE,OAAO,CAAC,kBAAkB,CAAoC;IAK9D,OAAO,CAAC,oBAAoB,CAAkC;IAE9D,OAAO,CAAC,YAAY,CAAgB;IAEpC,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IAEjD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAO;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAGhD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;IACvD;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAGjB,WAAW,EAAE,KAAK,EAClB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,MAAM,YAAA,EAExC,kBAAkB,CAAC,EAAE,iBAAiB,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,SAAS,CAAC,EAAE,qBAAqB,YAAA,EACjC,UAAU,CAAC,EAAE,eAAe,YAAA,EAC7C,eAAe,CAAC,EAAE,sBAAsB,EACvB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,cAAc,CAAC,EAAE,sBAAsB,YAAA,EACvC,mBAAmB,CAAC,EAAE,qBAAqB,YAAA,EAC3C,YAAY,CAAC,EAAE,qBAAqB,YAAA,EACpC,sBAAsB,CAAC,EAAE,gCAAgC,YAAA,EACzD,qBAAqB,CAAC,EAAE,6BAA6B,YAAA,EACtE,GAAG,CAAC,EAAE,MAAM,MAAM;IA2BnB;;;;;OAKG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED;;;OAGG;IACH,OAAO,IAAI,IAAI;IAcf;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;;;OASG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIlE;;;;;;;;OAQG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAItE;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI1E;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAyB7C,aAAa;IAgM3B;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;OAGG;YACW,YAAY;IAgE1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;YAyCZ,cAAc;IAmC5B;;;;OAIG;YACW,kBAAkB;YAIlB,kBAAkB;IA4BhC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,kBAAkB;YAIlB,iBAAiB;YAIjB,QAAQ;IAKtB;;;;;;;;;;;OAWG;YACW,eAAe;YAqCf,mBAAmB;IAkFjC,OAAO,CAAC,WAAW;YAIL,mBAAmB;IAgCjC;;;;;;;;OAQG;YACW,wBAAwB;IAkBtC;;;;;;;;OAQG;YACW,eAAe;IA4B7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;YACW,eAAe;IAgJ7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;;;;;;;;OAYG;YACW,yBAAyB;IAoEvC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC;;;;;OAKG;YACW,sBAAsB;IAqHpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;YACW,uBAAuB;IA0ErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,gCAAgC;IA0B9C;;;;OAIG;YACW,kCAAkC;IAyBhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,wBAAwB;YA0FxB,kBAAkB;IAoBhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IA0D7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;YACW,uBAAuB;IA+JrC;;;;;;;;;;OAUG;YACW,0BAA0B;IAwExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;;;;;OAMG;YACW,wBAAwB;IAgBtC,uFAAuF;YACzE,iBAAiB;IAmB/B,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;YAcd,eAAe;IAI7B,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;YAuEN,iBAAiB;YAejB,gBAAgB;YA+BhB,gBAAgB;IAM9B,OAAO,CAAC,wBAAwB;YAgClB,mBAAmB;IAqBjC,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,gBAAgB;IAqBxB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAS/B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC1C;;;OAGG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}

package/dist/src/cluster/cluster-repo.js

@@ -1,4 +1,4 @@
-import { blockIdsForTransforms, isOwnRevision, DEFAULT_SUPER_MAJORITY_THRESHOLD } from "@optimystic/db-core";
+import { blockIdsForTransforms, isOwnRevision, isConflictFailure, DEFAULT_SUPER_MAJORITY_THRESHOLD } from "@optimystic/db-core";
 import { computeClusterCommitHash, computeClusterMessageHash, computeClusterPromiseHash, membershipDigest, recordMembershipDigest, clusterVoteSigningPayload, clusterVoteVerificationPayload } from "@optimystic/db-core";
 import { verifyInvalidationCertificate } from "../dispute/invalidation.js";
 import { buildCommitCert, invalidationActionId } from "./commit-cert.js";
@@ -107,6 +107,14 @@ export class ClusterMember {
     // at apply, and without this verdict the coordinator fabricates a success no member durably
     // stored. Pruned alongside executedTransactions (same TTL).
     executedCommitResults = new Map();
+    // Conflict-shaped pend refusals this member's storage produced at consensus-apply, keyed by the
+    // refused action's id rather than by messageHash. The messageHash-keyed map above cannot serve the
+    // commit-promise guard: a commit is a DIFFERENT message with a different hash, so a member holding
+    // "I refused action X's pend" has no way to find that verdict when X's commit arrives to be voted
+    // on. Keyed by actionId, it does. Same TTL, pruning and rollback discipline as its sibling —
+    // see {@link refusedPendConflictsWithLocalState} for how a stale entry is prevented from vetoing a
+    // commit the rest of the cohort holds fine. (-> refusedAt timestamp)
+    refusedPendActions = new Map();
     // Fast in-memory dedup for applied invalidations, keyed `${invalidatedActionId}:${disputeId}`.
     // The durable source of truth is the invalidation log entry (Log.findInvalidation, re-checked
     // inside the sink); this map only spares redundant work when the same invalidation reaches
@@ -212,6 +220,7 @@ export class ClusterMember {
         this.cleanupQueue.length = 0;
         this.executedPendResults.clear();
         this.executedCommitResults.clear();
+        this.refusedPendActions.clear();
     }
     /**
      * Checks if a transaction's operations were already executed during consensus.
@@ -447,6 +456,14 @@ export class ClusterMember {
         }
         // Skip propagation - the coordinator manages distribution
         // await this.propagateIfNeeded(currentRecord);
+        // Stamp our own apply verdict on the response, AFTER the phase loop has run (and therefore
+        // after any consensus apply this delivery triggered). This is the return channel that closes
+        // the non-coordinating-member hole: a member that refused the pend at apply is the only node
+        // that knows it, and until now that verdict never left the member. Attached here rather than
+        // inside the Consensus branch so a redelivery of an already-applied record answers with the
+        // same verdict instead of an empty one. Deliberately not folded into the persisted state: it
+        // is a property of this response, not of the transaction the member is holding.
+        currentRecord = this.withOwnApplyOutcome(currentRecord);
         log('cluster-member:update-complete', {
             messageHash: record.messageHash,
             promiseCount: Object.keys(currentRecord.promises).length,
@@ -454,6 +471,24 @@ export class ClusterMember {
         });
         return currentRecord;
     }
+    /**
+     * Add this member's own conflict-shaped pend verdict to a record's {@link ClusterRecord.applyOutcomes},
+     * when storage produced one for this transaction. A success, a bare-reason fault, or no retained
+     * verdict at all leaves the record untouched — the coordinator's rule is "an entry means retry",
+     * so an entry that does not mean retry must not exist.
+     *
+     * The member never signs this and never writes another peer's entry.
+     */
+    withOwnApplyOutcome(record) {
+        const verdict = this.executedPendResults.get(record.messageHash);
+        if (verdict === undefined || verdict.success || !isConflictFailure(verdict)) {
+            return record;
+        }
+        return {
+            ...record,
+            applyOutcomes: { ...record.applyOutcomes, [this.peerId.toString()]: { pend: verdict } }
+        };
+    }
     /**
      * Merges two records, validating that non-signature fields match.
      * Detects equivocation (same peer changing vote type) and applies penalties.
@@ -502,10 +537,17 @@ export class ClusterMember {
         // Merge signatures with equivocation detection
         const mergedPromises = this.detectEquivocation(existing.promises, incoming.promises, 'promise', existing.messageHash);
         const mergedCommits = this.detectEquivocation(existing.commits, incoming.commits, 'commit', existing.messageHash);
+        // Union the advisory apply outcomes per peer, first-seen wins. A peer only ever writes its own
+        // entry, so "first-seen wins" is per-peer idempotence, not a conflict rule. Omitted entirely
+        // when neither side carries any, so an ordinary record gains no empty object.
+        const mergedOutcomes = (existing.applyOutcomes || incoming.applyOutcomes)
+            ? { ...incoming.applyOutcomes, ...existing.applyOutcomes }
+            : undefined;
         return {
             ...existing,
             promises: mergedPromises,
-            commits: mergedCommits
+            commits: mergedCommits,
+            ...(mergedOutcomes === undefined ? {} : { applyOutcomes: mergedOutcomes })
         };
     }
     /**
@@ -834,6 +876,14 @@ export class ClusterMember {
         if (!commitRevValidation.valid) {
             return commitRevValidation;
         }
+        // Then our own refusal history: a commit whose pend THIS member refused, where local state
+        // still corroborates the refusal. Runs after the revision check because that one is sharper
+        // (it names the rival revision) and catches the same commit whenever the rival has already
+        // applied here; this arm covers the window where it has not.
+        const refusedPendValidation = await this.validateCommitAgainstRefusedPend(record);
+        if (!refusedPendValidation.valid) {
+            return refusedPendValidation;
+        }
         return await this.validateCommitOperations(record);
     }
     /**
@@ -1188,8 +1238,10 @@ export class ClusterMember {
                 // moves that verdict into the phase where the cohort aggregates it, so the loser is
                 // refused with a real answer instead of burning a consensus round it cannot win. A
                 // member that has not yet applied the rival's pend has no record and simply abstains
-                // from this reason; the coordinator returning the retained apply verdict
-                // (getExecutedPendResult) catches that residual. Self is excluded so a redelivered pend
+                // from this reason; the apply-time verdict catches that residual — retained locally
+                // (getExecutedPendResult) for the coordinating node's own member, and returned to the
+                // coordinator on the response record (ClusterRecord.applyOutcomes) by every other
+                // member. Self is excluded so a redelivered pend
                 // for this same action stays approvable. An unavailable block carries no `pendings` and
                 // abstains (the rev branch above already fail-closes when a revision claim is at stake).
                 // Reason stays plain prose: it is fed to computeSigningPayload and carried as
@@ -1246,7 +1298,10 @@ export class ClusterMember {
      * "I checked this". The four-way rule, per committed block:
      *  - no local `latest`, or `latest.rev < commit.rev` → abstain (approve). Preserves the
      *    lagging-member tolerance (`coordinator-repo-commit-divergence.spec.ts`): a member behind
-     *    the commit cannot judge it.
+     *    the commit cannot judge it. Abstaining is safe rather than merely tolerable: apply-time
+     *    catches the case the vote cannot, since `StorageRepo.internalCommit` refuses an update-only
+     *    transform whose declared `baseRev` is not this member's `latest.rev` and reconciles instead
+     *    of forking the block's content.
      *  - `latest.rev === commit.rev` with the SAME action → abstain (approve). Idempotent
      *    redelivery of an already-durable commit; rejecting would make the writer rebase and
      *    re-append an action that already landed — a duplicate entry. (Storage's `alreadyDone`
@@ -1261,18 +1316,23 @@ export class ClusterMember {
      * abstains. Reason stays plain prose — it is fed to computeSigningPayload and carried as
      * Signature.rejectReason, exactly like the stale-revision pend reject.
      *
-     * Residual (see the commit-tier handoff): a member that signed the winner's commit but has not
-     * yet APPLIED it sits in a window where it holds neither the winner's record (reservation
-     * dropped at commit-sign, `shouldPersist = false`) nor the winner's revision (storage still
-     * behind) — it abstains here. A capability-less member, or one with history truncated below
-     * `latest`, abstains at `latest.rev > commit.rev` too. A rival's commit can therefore still
-     * pass the promise round if EVERY member is simultaneously in one of those states — on a fast
-     * cohort that window is the COMMON case, not the corner. The backstop is downstream of
-     * consensus: every member's apply then refuses the rival as stale, the coordinating node's own
-     * member retains that refusal (`getExecutedCommitResult`), and `CoordinatorRepo.commit`
-     * confirms the rival against local storage and answers the writer with a retryable conflict
-     * instead of a fabricated success. `ConflictRaceLostError` conversion and classified
-     * rejections close the re-drive route the same way.
+     * Residual (narrowed, see below): a member that signed the winner's commit but has not yet
+     * APPLIED it sits in a window where it holds neither the winner's record (reservation dropped at
+     * commit-sign, `shouldPersist = false`) nor the winner's revision (storage still behind) — it
+     * abstains here. A capability-less member, or one with history truncated below `latest`, abstains
+     * at `latest.rev > commit.rev` too. A rival's commit can therefore still pass THIS check if every
+     * member is simultaneously in one of those states — on a fast cohort that window is the COMMON
+     * case, not the corner.
+     *
+     * What now covers it: {@link validateCommitAgainstRefusedPend} rejects the same commit from the
+     * other direction — not "did a rival take the revision" but "did I already refuse this action's
+     * pend" — which is precisely the state a member is left in when it lost the race in the
+     * promise→apply window. Downstream of consensus the backstop still stands: every member's apply
+     * refuses the rival as stale, the coordinating node's own member retains that refusal
+     * (`getExecutedCommitResult`), and `CoordinatorRepo.commit` confirms the rival against local
+     * storage and answers the writer with a retryable conflict instead of a fabricated success.
+     * `ConflictRaceLostError` conversion and classified rejections close the re-drive route the same
+     * way.
      */
     async validateCommitRevisions(record) {
         for (const operation of record.message.operations) {
@@ -1349,6 +1409,93 @@ export class ClusterMember {
         }
         return { valid: true };
     }
+    /**
+     * Promise-round check that this member is not about to co-sign the commit of an action whose PEND
+     * its own storage refused.
+     *
+     * The hole this closes: the commit-round vote is deliberately blind ({@link getTransactionPhase}
+     * signs whenever promise approvals reach super-majority), and both other commit-promise checks
+     * abstain for a member that holds no pend of the committing action — which is exactly the state a
+     * member is in *because* it refused that pend. So a member could refuse action X's pend as
+     * conflicting with a rival, and milliseconds later sign X's commit, letting X reach commit
+     * consensus at a revision this member will never durably hold.
+     *
+     * Two conditions, both required:
+     *  (a) this member retains a conflict-shaped pend refusal for `commit.actionId`
+     *      ({@link refusedPendActions}), and
+     *  (b) local storage STILL corroborates it — a rival pending action holds one of the commit's
+     *      blocks, or a different action already took `commit.rev`.
+     *
+     * (b) is what keeps this from regressing the lagging-member and cohort-drift tolerances that
+     * {@link validateCommitRevisions} documents. A member that merely *missed* the pend retains no
+     * refusal and abstains exactly as before. A member whose refusal has since been settled — the
+     * rival cancelled, the reservation released — abstains too, rather than vetoing a commit the rest
+     * of the cohort is holding perfectly well. The retention is in-memory and TTL'd, so a restart also
+     * degrades to the previous abstain behaviour rather than to a stuck veto.
+     *
+     * Effect on a small cohort: one reject makes super-majority unreachable, so the commit never
+     * assembles consensus and the write fails loudly instead of forking the block. That is the
+     * intended outcome here — a clean retryable conflict answer is {@link ClusterRecord.applyOutcomes}'
+     * job, and this arm is the backstop for the paths that channel cannot reach (a member that applies
+     * late, via the scheduled commit-retry timer, after the coordinator has already answered).
+     *
+     * Never throws out of the vote path: a read fault is an abstain, same rule as its two siblings.
+     */
+    async validateCommitAgainstRefusedPend(record) {
+        for (const operation of record.message.operations) {
+            if (!('commit' in operation)) {
+                continue;
+            }
+            const commit = operation.commit;
+            if (!this.refusedPendActions.has(commit.actionId)) {
+                continue;
+            }
+            const corroboration = await this.refusedPendConflictsWithLocalState(commit);
+            if (corroboration === undefined) {
+                continue;
+            }
+            log('cluster-member:validation-refused-pend-commit', {
+                messageHash: record.messageHash,
+                actionId: commit.actionId,
+                rev: commit.rev,
+                corroboration
+            });
+            // Prose only, for the same reason every other vote reason here is: it is fed to
+            // computeSigningPayload and carried as Signature.rejectReason.
+            return { valid: false, reason: `refused pend: this member refused action ${commit.actionId}'s pend and ${corroboration}` };
+        }
+        return { valid: true };
+    }
+    /**
+     * Condition (b) of {@link validateCommitAgainstRefusedPend}: does local storage still back up a
+     * retained pend refusal for this commit? Returns a short prose fragment naming what corroborates
+     * it, or `undefined` for "no longer corroborated — abstain" (which a read fault also yields).
+     */
+    async refusedPendConflictsWithLocalState(commit) {
+        let blockResults;
+        try {
+            blockResults = await this.storageRepo.get({ blockIds: commit.blockIds });
+        }
+        catch (err) {
+            log('cluster-member:refused-pend-read-error', {
+                actionId: commit.actionId,
+                error: err instanceof Error ? err.message : String(err)
+            });
+            return undefined; // a local read fault is an abstain, never an escape out of the vote path
+        }
+        for (const blockId of commit.blockIds) {
+            const state = blockResults[blockId]?.state;
+            const rivals = (state?.pendings ?? []).filter(actionId => actionId !== commit.actionId);
+            if (rivals.length > 0) {
+                return `block ${blockId} is still held by unresolved action(s) ${rivals.join(', ')}`;
+            }
+            const latest = state?.latest;
+            if (latest?.rev === commit.rev && !isOwnRevision(latest, commit.rev, commit.actionId)) {
+                return `block ${blockId} rev ${commit.rev} is already committed by a different action`;
+            }
+        }
+        return undefined;
+    }
     /**
      * Promise-round check of a commit record's declared content digests
      * (`CommitRequest.blockDigests`) against what this member's OWN pended copy of each transform
@@ -1365,9 +1512,11 @@ export class ClusterMember {
      * authored, delivered at pend — a hostile declarer cannot force or dodge a check by mis-declaring
      * `baseRev`):
      *  - transform carries an `insert` → base-independent, ALWAYS check (declared `baseRev` ignored);
-     *  - `updates` only → check iff this member's local base rev equals the declared `baseRev`
-     *    (StorageRepo.commit accepts any `latest.rev < request.rev`, so a lagging member applying an
-     *    update-only transform to an older base legitimately materializes different bytes);
+     *  - `updates` only → check iff this member's local base rev equals the declared `baseRev`. A
+     *    member whose base does not match cannot JUDGE the content — it would preview the transform
+     *    against different bytes than the declarer used — so it abstains here. It never goes on to
+     *    materialize those bytes: `StorageRepo.internalCommit` refuses that same mismatch at apply
+     *    and reconciles from a cohort peer;
      *  - `delete` only / no base / unmaterializable base → materializes nothing to compare, abstain;
      *  - no pending transform for the action (this member never saw the pend) → abstain.
      * "Abstain" = contribute no content attestation: approve exactly as before this check existed.
@@ -1536,9 +1685,15 @@ export class ClusterMember {
             // divergence is absorbed inside applyConsensusOperation and never reaches here.
             // A retained pend verdict rolls back with the marker: it belongs to an apply
             // that is now considered not-executed, and a re-run will retain a fresh one.
+            // The actionId-keyed refusals for this record's pend operations go with it — leaving
+            // one behind would let a rolled-back apply veto that action's commit forever.
             this.executedTransactions.delete(record.messageHash);
             this.executedPendResults.delete(record.messageHash);
             this.executedCommitResults.delete(record.messageHash);
+            for (const operation of record.message.operations) {
+                if ('pend' in operation)
+                    this.refusedPendActions.delete(operation.pend.actionId);
+            }
             throw err;
         }
         // Persist the durable marker only now that apply has actually succeeded. Writing it
@@ -1615,6 +1770,14 @@ export class ClusterMember {
             // already committed) is the optimistic-concurrency verdict, and swallowing it acknowledged
             // writes that no member stored.
             this.executedPendResults.set(messageHash, result);
+            // Second, actionId-keyed retention for the commit tier: this same refusal must still be
+            // findable when THIS action's commit record (a different messageHash) arrives for a
+            // promise vote, so a member cannot co-sign the commit of a pend it just refused. Only
+            // conflict-shaped refusals are kept — a bare-reason fault is local trouble, not evidence
+            // that a rival holds the blocks, and must not veto the cohort's commit.
+            if (!result.success && isConflictFailure(result)) {
+                this.refusedPendActions.set(operation.pend.actionId, this.now());
+            }
             if (!result.success) {
                 log('cluster-member:consensus-pend-diverged', {
                     messageHash,
@@ -1706,10 +1869,12 @@ export class ClusterMember {
                 // lets the coordinating node convert its OWN member's rival-confirmed refusal into a
                 // conflict answer — that last guard is what closes the signed-but-not-yet-applied
                 // window, where two commits for one revision both assemble consensus because signing
-                // drops each member's reservation before applying advances its storage. If
-                // consensus-without-durability is ever observed again, look at those guards' abstain
-                // residuals (non-coordinating members' verdicts are not threaded back; capability-less
-                // or history-truncated storage abstains), not at this branch.
+                // drops each member's reservation before applying advances its storage —
+                // `validateCommitAgainstRefusedPend` now refuses to sign that commit in the first
+                // place on any member that refused its pend. If consensus-without-durability is ever
+                // observed again, look at those guards' remaining abstain residuals (capability-less
+                // or history-truncated storage; a member whose refusal has aged out of retention),
+                // not at this branch.
                 if (result.missing?.length) {
                     log('cluster-member:consensus-commit-diverged', {
                         messageHash,
@@ -2042,6 +2207,12 @@ export class ClusterMember {
                 this.executedCommitResults.delete(messageHash);
             }
         }
+        // Prune actionId-keyed pend refusals on the same TTL as the verdicts they were derived from.
+        for (const [actionId, refusedAt] of Array.from(this.refusedPendActions.entries())) {
+            if (refusedAt < expirationThreshold) {
+                this.refusedPendActions.delete(actionId);
+            }
+        }
         // Prune old applied-invalidation dedup markers on the same TTL.
         for (const [dedupKey, appliedAt] of Array.from(this.appliedInvalidations.entries())) {
             if (appliedAt < expirationThreshold) {