@optimystic/db-p2p 1.0.0-beta.1 → 1.0.0-beta.3

package/dist/src/cluster/cluster-repo.d.ts

@@ -223,13 +223,15 @@ export declare class ClusterMember implements ICluster {
      */
     getExecutedPendResult(messageHash: string): PendResult | undefined;
     /**
-     * Commit-shaped sibling of {@link getExecutedPendResult}: local storage's verdict for a commit
-     * operation applied during consensus, when this member retained one. `CoordinatorRepo.commit`
-     * consults it after a locally-executed commit-consensus — a retained refusal whose cause a local
-     * re-read confirms as a rival holding the requested revision is returned to the writer as a
-     * retryable conflict instead of the fabricated success the ahead-divergence tolerance would
-     * otherwise imply. Same availability caveats as the pend accessor: in-memory only, absent for
-     * pre-restart applies, pruned on the executed-transaction TTL.
+     * Commit-shaped sibling of {@link getExecutedPendResult}: this member's post-reconcile durable
+     * verdict for a commit operation applied during consensus, when it retained one — `success: true`
+     * iff local storage holds the committed revision under the record's action for every block the
+     * commit named, after the apply and any behind-reconcile it triggered. `CoordinatorRepo.commit`
+     * reads it after a locally-executed commit-consensus, both as this node's own contribution to the
+     * durable-holder count its durability gate needs, and — for a retained refusal whose cause a
+     * local re-read confirms as a rival holding the requested revision — as the trigger for a
+     * retryable conflict answer. Same availability caveats as the pend accessor: in-memory only,
+     * absent for pre-restart applies, pruned on the executed-transaction TTL.
      */
     getExecutedCommitResult(messageHash: string): CommitResult | undefined;
     /**
@@ -247,10 +249,12 @@ export declare class ClusterMember implements ICluster {
     update(record: ClusterRecord): Promise<ClusterRecord>;
     private processUpdate;
     /**
-     * Add this member's own conflict-shaped pend verdict to a record's {@link ClusterRecord.applyOutcomes},
-     * when storage produced one for this transaction. A success, a bare-reason fault, or no retained
-     * verdict at all leaves the record untouched — the coordinator's rule is "an entry means retry",
-     * so an entry that does not mean retry must not exist.
+     * Add this member's own apply verdicts to a record's {@link ClusterRecord.applyOutcomes}, when
+     * storage produced any for this transaction. The two arms follow the rules on
+     * {@link MemberApplyOutcome}: the pend arm carries ONLY a conflict-shaped refusal (a success, a
+     * bare-reason fault, or no retained verdict leaves it off — the coordinator's rule is "an entry
+     * means retry", so an entry that does not mean retry must not exist); the commit arm carries the
+     * retained durable verdict whatever it says, because the coordinator counts the successes.
      *
      * The member never signs this and never writes another peer's entry.
      */
@@ -585,8 +589,39 @@ export declare class ClusterMember implements ICluster {
      * mid-commit `internalCommit` fault (`success:false` with a bare `reason`, no
      * `missing`) is propagated so {@link handleConsensus} rolls back the executed marker
      * and rethrows — exactly like an unexpected thrown fault.
+     *
+     * Tolerated is not the same as acknowledged. Whatever shape a commit's apply took, this
+     * member retains one post-reconcile durable verdict for it ({@link durableCommitVerdict}) and
+     * reports it to the coordinator, whose durability gate (`CoordinatorRepo.commit`) acknowledges
+     * the writer only when a majority of the cohort reports holding the revision.
      */
     private applyConsensusOperation;
+    /**
+     * Apply one consensus commit to local storage, tolerating every divergence shape the way the
+     * doc comment on {@link applyConsensusOperation} describes and reconciling the behind ones.
+     * Returns storage's own result — or, for the thrown missing-pend shape, which produces no
+     * `CommitResult` at all, a refusal built from the throw — so {@link durableCommitVerdict} works
+     * from one uniform shape. Genuine faults (a bare-reason returned failure, an unrecognized throw)
+     * propagate so {@link handleConsensus} rolls back the executed marker and rethrows.
+     */
+    private applyCommitToStorage;
+    /**
+     * The durable verdict for a consensus commit: `applied` itself when storage landed it (a
+     * success from `StorageRepo.commit` means every block is committed, or already was, under this
+     * action), otherwise a fresh look at what local storage holds NOW — after the reconcile the
+     * refusal triggered. Durable means every block in `commit.blockIds` records `commit.rev` under
+     * `commit.actionId`. A refusal that is not durable is returned as-is, so the coordinating node
+     * can still classify its own member's ahead-shaped refusal against a rival. A read fault counts
+     * as not durable: the gate this feeds fails toward retry.
+     */
+    private durableCommitVerdict;
+    /**
+     * True when local storage records `commit.rev` of `blockId` under `commit.actionId`. Read from
+     * the revision index (the {@link IRevisionActionReader} capability) so a member whose `latest` has
+     * since moved past the revision still counts as holding it; a repo without the capability is
+     * judged on `latest` alone.
+     */
+    private holdsCommittedRevision;
     /**
      * Applies a consensus-ordered invalidation on this member: dedup → certificate verification →
      * capture the invalidation's commit cert (for reactivity reuse) → delegate the compensating write +

package/dist/src/cluster/cluster-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-repo.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAa,WAAW,EAAE,qBAAqB,EAAE,sBAAsB,EAA2B,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAiB,UAAU,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpR,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAiC,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAK7E,OAAO,EAA8C,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA+CtG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IACjC,wGAAwG;IACxG,KAAK,EAAE,YAAY,CAAC;IACpB,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAyB/F,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;;GAMG;AACH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE9E,UAAU,uBAAuB;IAChC,WAAW,EAAE,KAAK,CAAC;IACnB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,oGAAoG;IACpG,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,oHAAoH;IACpH,sBAAsB,CAAC,EAAE,gCAAgC,CAAC;IAC1D,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,uBAAuB,GAAG,aAAa,CAoBhF;AAKD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAkBhD;;;GAGG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAoE5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAlFxC,OAAO,CAAC,kBAAkB,CAA4C;IAEtE,OAAO,CAAC,oBAAoB,CAAkC;IAK9D,OAAO,CAAC,mBAAmB,CAAsC;IAQjE,OAAO,CAAC,qBAAqB,CAAwC;IAQrE,OAAO,CAAC,kBAAkB,CAAoC;IAK9D,OAAO,CAAC,oBAAoB,CAAkC;IAE9D,OAAO,CAAC,YAAY,CAAgB;IAEpC,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IAEjD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAO;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAGhD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;IACvD;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAGjB,WAAW,EAAE,KAAK,EAClB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,MAAM,YAAA,EAExC,kBAAkB,CAAC,EAAE,iBAAiB,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,SAAS,CAAC,EAAE,qBAAqB,YAAA,EACjC,UAAU,CAAC,EAAE,eAAe,YAAA,EAC7C,eAAe,CAAC,EAAE,sBAAsB,EACvB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,cAAc,CAAC,EAAE,sBAAsB,YAAA,EACvC,mBAAmB,CAAC,EAAE,qBAAqB,YAAA,EAC3C,YAAY,CAAC,EAAE,qBAAqB,YAAA,EACpC,sBAAsB,CAAC,EAAE,gCAAgC,YAAA,EACzD,qBAAqB,CAAC,EAAE,6BAA6B,YAAA,EACtE,GAAG,CAAC,EAAE,MAAM,MAAM;IA2BnB;;;;;OAKG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED;;;OAGG;IACH,OAAO,IAAI,IAAI;IAcf;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;;;OASG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIlE;;;;;;;;OAQG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAItE;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI1E;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAyB7C,aAAa;IAgM3B;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;OAGG;YACW,YAAY;IAgE1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;YAyCZ,cAAc;IAmC5B;;;;OAIG;YACW,kBAAkB;YAIlB,kBAAkB;IA4BhC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,kBAAkB;YAIlB,iBAAiB;YAIjB,QAAQ;IAKtB;;;;;;;;;;;OAWG;YACW,eAAe;YAqCf,mBAAmB;IAkFjC,OAAO,CAAC,WAAW;YAIL,mBAAmB;IAgCjC;;;;;;;;OAQG;YACW,wBAAwB;IAkBtC;;;;;;;;OAQG;YACW,eAAe;IA4B7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;YACW,eAAe;IAgJ7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;;;;;;;;OAYG;YACW,yBAAyB;IAoEvC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC;;;;;OAKG;YACW,sBAAsB;IAqHpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;YACW,uBAAuB;IA0ErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,gCAAgC;IA0B9C;;;;OAIG;YACW,kCAAkC;IAyBhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,wBAAwB;YA0FxB,kBAAkB;IAoBhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IA0D7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;YACW,uBAAuB;IA+JrC;;;;;;;;;;OAUG;YACW,0BAA0B;IAwExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;;;;;OAMG;YACW,wBAAwB;IAgBtC,uFAAuF;YACzE,iBAAiB;IAmB/B,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;YAcd,eAAe;IAI7B,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;YAuEN,iBAAiB;YAejB,gBAAgB;YA+BhB,gBAAgB;IAM9B,OAAO,CAAC,wBAAwB;YAgClB,mBAAmB;IAqBjC,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,gBAAgB;IAqBxB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAS/B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC1C;;;OAGG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}
+{"version":3,"file":"cluster-repo.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAa,WAAW,EAAE,qBAAqB,EAAE,sBAAsB,EAA2B,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAiB,UAAU,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACxS,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAiC,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAK7E,OAAO,EAA8C,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA+CtG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IACjC,wGAAwG;IACxG,KAAK,EAAE,YAAY,CAAC;IACpB,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAyB/F,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;;GAMG;AACH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE9E,UAAU,uBAAuB;IAChC,WAAW,EAAE,KAAK,CAAC;IACnB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,oGAAoG;IACpG,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,oHAAoH;IACpH,sBAAsB,CAAC,EAAE,gCAAgC,CAAC;IAC1D,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,uBAAuB,GAAG,aAAa,CAoBhF;AAKD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAkBhD;;;GAGG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAwE5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAtFxC,OAAO,CAAC,kBAAkB,CAA4C;IAEtE,OAAO,CAAC,oBAAoB,CAAkC;IAK9D,OAAO,CAAC,mBAAmB,CAAsC;IAYjE,OAAO,CAAC,qBAAqB,CAAwC;IAQrE,OAAO,CAAC,kBAAkB,CAAoC;IAK9D,OAAO,CAAC,oBAAoB,CAAkC;IAE9D,OAAO,CAAC,YAAY,CAAgB;IAEpC,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IAEjD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAO;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAGhD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;IACvD;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAGjB,WAAW,EAAE,KAAK,EAClB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,MAAM,YAAA,EAExC,kBAAkB,CAAC,EAAE,iBAAiB,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,SAAS,CAAC,EAAE,qBAAqB,YAAA,EACjC,UAAU,CAAC,EAAE,eAAe,YAAA,EAC7C,eAAe,CAAC,EAAE,sBAAsB,EACvB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,cAAc,CAAC,EAAE,sBAAsB,YAAA,EACvC,mBAAmB,CAAC,EAAE,qBAAqB,YAAA,EAC3C,YAAY,CAAC,EAAE,qBAAqB,YAAA,EACpC,sBAAsB,CAAC,EAAE,gCAAgC,YAAA,EACzD,qBAAqB,CAAC,EAAE,6BAA6B,YAAA,EACtE,GAAG,CAAC,EAAE,MAAM,MAAM;IA2BnB;;;;;OAKG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED;;;OAGG;IACH,OAAO,IAAI,IAAI;IAcf;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;;;OASG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIlE;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAItE;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI1E;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAyB7C,aAAa;IAgM3B;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;OAGG;YACW,YAAY;IAgE1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;YAyCZ,cAAc;IAmC5B;;;;OAIG;YACW,kBAAkB;YAIlB,kBAAkB;IA4BhC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,kBAAkB;YAIlB,iBAAiB;YAIjB,QAAQ;IAKtB;;;;;;;;;;;OAWG;YACW,eAAe;YAqCf,mBAAmB;IAkFjC,OAAO,CAAC,WAAW;YAIL,mBAAmB;IAgCjC;;;;;;;;OAQG;YACW,wBAAwB;IAkBtC;;;;;;;;OAQG;YACW,eAAe;IA4B7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;YACW,eAAe;IAgJ7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;;;;;;;;OAYG;YACW,yBAAyB;IAoEvC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC;;;;;OAKG;YACW,sBAAsB;IAqHpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;YACW,uBAAuB;IA0ErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,gCAAgC;IA0B9C;;;;OAIG;YACW,kCAAkC;IAyBhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,wBAAwB;YA0FxB,kBAAkB;IAoBhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IA0D7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uBAAuB;IAkGrC;;;;;;;OAOG;YACW,oBAAoB;IA4ElC;;;;;;;;OAQG;YACW,oBAAoB;IAsBlC;;;;;OAKG;YACW,sBAAsB;IASpC;;;;;;;;;;OAUG;YACW,0BAA0B;IAwExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;;;;;OAMG;YACW,wBAAwB;IAgBtC,uFAAuF;YACzE,iBAAiB;IAmB/B,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;YAcd,eAAe;IAI7B,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;YAuEN,iBAAiB;YAejB,gBAAgB;YA+BhB,gBAAgB;IAM9B,OAAO,CAAC,wBAAwB;YAgClB,mBAAmB;IAqBjC,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,gBAAgB;IAqBxB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAS/B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC1C;;;OAGG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}

package/dist/src/cluster/cluster-repo.js

@@ -99,13 +99,17 @@ export class ClusterMember {
     // a pend that every member refused (rival pending action, or the revision already taken) must
     // reach the writer as a conflict, not a win. Pruned alongside executedTransactions (same TTL).
     executedPendResults = new Map();
-    // Local storage's verdict for a COMMIT operation applied during consensus (messageHash ->
-    // CommitResult). Retained so the coordinator can detect when the ahead-divergence tolerance in
+    // This member's POST-RECONCILE durable verdict for a COMMIT operation applied during consensus
+    // (messageHash -> CommitResult): whether local storage holds the committed revision under the
+    // record's action once the apply — and any behind-reconcile it triggered — has run. Two readers,
+    // which must see the same answer: the coordinating node reads its own member's directly
+    // (getExecutedCommitResult), every other member's reaches the coordinator on the response record
+    // (withOwnApplyOutcome → ClusterRecord.applyOutcomes[peer].commit). Together they feed the
+    // durability gate in CoordinatorRepo.commit, which acknowledges a commit only when a majority of
+    // the cohort reports holding it — consensus votes were never evidence of storage. A retained
+    // refusal also lets the coordinator detect when the ahead-divergence tolerance in
     // applyConsensusOperation swallowed a refusal whose real cause was a RIVAL action holding the
-    // requested revision — the commit-tier acknowledgement hole: a commit that assembled consensus
-    // inside every member's signed-but-not-yet-applied window is refused by every member's storage
-    // at apply, and without this verdict the coordinator fabricates a success no member durably
-    // stored. Pruned alongside executedTransactions (same TTL).
+    // requested revision. Pruned alongside executedTransactions (same TTL).
     executedCommitResults = new Map();
     // Conflict-shaped pend refusals this member's storage produced at consensus-apply, keyed by the
     // refused action's id rather than by messageHash. The messageHash-keyed map above cannot serve the
@@ -243,13 +247,15 @@ export class ClusterMember {
         return this.executedPendResults.get(messageHash);
     }
     /**
-     * Commit-shaped sibling of {@link getExecutedPendResult}: local storage's verdict for a commit
-     * operation applied during consensus, when this member retained one. `CoordinatorRepo.commit`
-     * consults it after a locally-executed commit-consensus — a retained refusal whose cause a local
-     * re-read confirms as a rival holding the requested revision is returned to the writer as a
-     * retryable conflict instead of the fabricated success the ahead-divergence tolerance would
-     * otherwise imply. Same availability caveats as the pend accessor: in-memory only, absent for
-     * pre-restart applies, pruned on the executed-transaction TTL.
+     * Commit-shaped sibling of {@link getExecutedPendResult}: this member's post-reconcile durable
+     * verdict for a commit operation applied during consensus, when it retained one — `success: true`
+     * iff local storage holds the committed revision under the record's action for every block the
+     * commit named, after the apply and any behind-reconcile it triggered. `CoordinatorRepo.commit`
+     * reads it after a locally-executed commit-consensus, both as this node's own contribution to the
+     * durable-holder count its durability gate needs, and — for a retained refusal whose cause a
+     * local re-read confirms as a rival holding the requested revision — as the trigger for a
+     * retryable conflict answer. Same availability caveats as the pend accessor: in-memory only,
+     * absent for pre-restart applies, pruned on the executed-transaction TTL.
      */
     getExecutedCommitResult(messageHash) {
         return this.executedCommitResults.get(messageHash);
@@ -472,21 +478,28 @@ export class ClusterMember {
         return currentRecord;
     }
     /**
-     * Add this member's own conflict-shaped pend verdict to a record's {@link ClusterRecord.applyOutcomes},
-     * when storage produced one for this transaction. A success, a bare-reason fault, or no retained
-     * verdict at all leaves the record untouched — the coordinator's rule is "an entry means retry",
-     * so an entry that does not mean retry must not exist.
+     * Add this member's own apply verdicts to a record's {@link ClusterRecord.applyOutcomes}, when
+     * storage produced any for this transaction. The two arms follow the rules on
+     * {@link MemberApplyOutcome}: the pend arm carries ONLY a conflict-shaped refusal (a success, a
+     * bare-reason fault, or no retained verdict leaves it off — the coordinator's rule is "an entry
+     * means retry", so an entry that does not mean retry must not exist); the commit arm carries the
+     * retained durable verdict whatever it says, because the coordinator counts the successes.
      *
      * The member never signs this and never writes another peer's entry.
      */
     withOwnApplyOutcome(record) {
-        const verdict = this.executedPendResults.get(record.messageHash);
-        if (verdict === undefined || verdict.success || !isConflictFailure(verdict)) {
+        const pend = this.executedPendResults.get(record.messageHash);
+        const commit = this.executedCommitResults.get(record.messageHash);
+        const own = {
+            ...(pend !== undefined && !pend.success && isConflictFailure(pend) ? { pend } : {}),
+            ...(commit !== undefined ? { commit } : {})
+        };
+        if (Object.keys(own).length === 0) {
             return record;
         }
         return {
             ...record,
-            applyOutcomes: { ...record.applyOutcomes, [this.peerId.toString()]: { pend: verdict } }
+            applyOutcomes: { ...record.applyOutcomes, [this.peerId.toString()]: own }
         };
     }
     /**
@@ -1750,6 +1763,11 @@ export class ClusterMember {
      * mid-commit `internalCommit` fault (`success:false` with a bare `reason`, no
      * `missing`) is propagated so {@link handleConsensus} rolls back the executed marker
      * and rethrows — exactly like an unexpected thrown fault.
+     *
+     * Tolerated is not the same as acknowledged. Whatever shape a commit's apply took, this
+     * member retains one post-reconcile durable verdict for it ({@link durableCommitVerdict}) and
+     * reports it to the coordinator, whose durability gate (`CoordinatorRepo.commit`) acknowledges
+     * the writer only when a majority of the cohort reports holding the revision.
      */
     async applyConsensusOperation(record, operation) {
         const messageHash = record.messageHash;
@@ -1776,7 +1794,17 @@ export class ClusterMember {
             // conflict-shaped refusals are kept — a bare-reason fault is local trouble, not evidence
             // that a rival holds the blocks, and must not veto the cohort's commit.
             if (!result.success && isConflictFailure(result)) {
-                this.refusedPendActions.set(operation.pend.actionId, this.now());
+                // `Date.now()`, not the injected `this.now()`: the prune sweep and the executed-marker
+                // timestamps this retention shares a TTL with are both on the wall clock, and a mixed
+                // pair would prune on the first sweep (or never) under an injected clock.
+                this.refusedPendActions.set(operation.pend.actionId, Date.now());
+            }
+            else if (result.success) {
+                // A later apply of the SAME action that storage accepted retires the refusal: the
+                // retention means "the last thing my storage said about this action's pend was no",
+                // and a stale yes-then-no would veto the commit of an action this member now holds
+                // pended, whenever any unrelated rival happens to sit on one of its blocks.
+                this.refusedPendActions.delete(operation.pend.actionId);
             }
             if (!result.success) {
                 log('cluster-member:consensus-pend-diverged', {
@@ -1822,87 +1850,16 @@ export class ClusterMember {
                     membershipVersion: record.membershipVersion
                 });
             }
-            let result;
-            try {
-                result = await this.storageRepo.commit(commit, undefined, proof);
-            }
-            catch (err) {
-                // `StorageRepo.commit` throws (rather than returning success:false) when
-                // the pending action is missing — the canonical "behind" signal: this
-                // member reached commit-consensus without the matching pend (cohort drift).
-                if (isMissingPendingActionError(err)) {
-                    log('cluster-member:consensus-commit-diverged', {
-                        messageHash,
-                        actionId: commit.actionId,
-                        divergence: 'behind',
-                        reason: err.message
-                    });
-                    // We hold no revision of these blocks; pull the committed revision from a
-                    // cohort peer so the block is no longer under-replicated. Best-effort:
-                    // failures are logged inside, never thrown (a throw would reset the stream).
-                    await this.reconcileDivergentCommit(record, commit);
-                    return;
-                }
-                throw err;
-            }
-            // Retain the verdict either way (see getExecutedCommitResult): a success confirms local
-            // durability, and an ahead-shaped refusal is the only evidence the coordinator has that
-            // the tolerance below swallowed a rival's win at the requested revision. The
-            // missing-pending throw path above retains nothing — no CommitResult exists there, and
-            // the coordinator's fabricated-success fallback plus cohort reconcile is the right shape
-            // for a member that is genuinely behind.
-            this.executedCommitResults.set(messageHash, result);
-            if (!result.success) {
-                // success:false is a StaleFailure. `missing` ⇒ ahead/stale divergence
-                // (we already hold ≥ this rev): tolerate, do NOT reconcile downward. A
-                // missing-base reason ⇒ behind divergence, reconcile (below). Any other bare
-                // `reason` with no `missing` ⇒ a genuine internalCommit fault: propagate so
-                // handleConsensus rolls back the executed marker and rethrows.
-                //
-                // NOTE: this 'ahead' tolerance is what turns a rival's commit that somehow reaches
-                // consensus into a reported success no member durably stored (consensus without
-                // durability — the commit-tier acknowledgement hole). It must stay: a member
-                // genuinely ahead of a redelivered/lagging commit is the common, correct case. The
-                // guards live UPSTREAM: `validateCommitRevisions` rejects the rival at the promise
-                // round, `CoordinatorRepo.commit` returns lost races as retryable conflicts instead
-                // of re-driving them, and the verdict retained just above (getExecutedCommitResult)
-                // lets the coordinating node convert its OWN member's rival-confirmed refusal into a
-                // conflict answer — that last guard is what closes the signed-but-not-yet-applied
-                // window, where two commits for one revision both assemble consensus because signing
-                // drops each member's reservation before applying advances its storage —
-                // `validateCommitAgainstRefusedPend` now refuses to sign that commit in the first
-                // place on any member that refused its pend. If consensus-without-durability is ever
-                // observed again, look at those guards' remaining abstain residuals (capability-less
-                // or history-truncated storage; a member whose refusal has aged out of retention),
-                // not at this branch.
-                if (result.missing?.length) {
-                    log('cluster-member:consensus-commit-diverged', {
-                        messageHash,
-                        actionId: commit.actionId,
-                        divergence: 'ahead',
-                        reason: result.reason,
-                        hasMissing: true
-                    });
-                    return;
-                }
-                // This member holds no materializable base for one of the blocks, so
-                // `StorageRepo.commit` REFUSED rather than record a revision it could never serve.
-                // Same "behind" divergence as a missing pend — and the same cure: pull the committed
-                // revision from a cohort peer. Reconciling here (after commit released its per-block
-                // latches) is what makes refusing safe; fetching inside the commit path would deadlock
-                // against the latch `saveReplicatedBlock` needs to persist what it fetched.
-                if (isMissingBaseRevisionFailure(result)) {
-                    log('cluster-member:consensus-commit-diverged', {
-                        messageHash,
-                        actionId: commit.actionId,
-                        divergence: 'behind',
-                        reason: result.reason
-                    });
-                    await this.reconcileDivergentCommit(record, commit);
-                    return;
-                }
-                throw new Error(`Consensus commit for action ${commit.actionId} failed: ${result.reason ?? 'unknown reason'}`);
-            }
+            const applied = await this.applyCommitToStorage(record, commit, proof);
+            // Retain the POST-RECONCILE durable verdict (see getExecutedCommitResult and
+            // withOwnApplyOutcome): what this member's storage holds NOW, after any behind-reconcile the
+            // apply triggered — not what the first apply attempt said. A member that pulled the
+            // revision from a cohort peer is a durable holder and reports one; a member that could not
+            // is not, whichever shape its refusal took. The coordinator's durability gate counts these
+            // verdicts — its own member's through getExecutedCommitResult, every other member's off the
+            // response record — and the two readers must see the same answer, hence one verdict,
+            // computed once, retained here for both.
+            this.executedCommitResults.set(messageHash, await this.durableCommitVerdict(commit, applied));
             return;
         }
         if ('invalidate' in operation) {
@@ -1910,6 +1867,135 @@ export class ClusterMember {
             return;
         }
     }
+    /**
+     * Apply one consensus commit to local storage, tolerating every divergence shape the way the
+     * doc comment on {@link applyConsensusOperation} describes and reconciling the behind ones.
+     * Returns storage's own result — or, for the thrown missing-pend shape, which produces no
+     * `CommitResult` at all, a refusal built from the throw — so {@link durableCommitVerdict} works
+     * from one uniform shape. Genuine faults (a bare-reason returned failure, an unrecognized throw)
+     * propagate so {@link handleConsensus} rolls back the executed marker and rethrows.
+     */
+    async applyCommitToStorage(record, commit, proof) {
+        const messageHash = record.messageHash;
+        let result;
+        try {
+            result = await this.storageRepo.commit(commit, undefined, proof);
+        }
+        catch (err) {
+            // `StorageRepo.commit` throws (rather than returning success:false) when
+            // the pending action is missing — the canonical "behind" signal: this
+            // member reached commit-consensus without the matching pend (cohort drift).
+            if (isMissingPendingActionError(err)) {
+                log('cluster-member:consensus-commit-diverged', {
+                    messageHash,
+                    actionId: commit.actionId,
+                    divergence: 'behind',
+                    reason: err.message
+                });
+                // We hold no revision of these blocks; pull the committed revision from a
+                // cohort peer so the block is no longer under-replicated. Best-effort:
+                // failures are logged inside, never thrown (a throw would reset the stream).
+                await this.reconcileDivergentCommit(record, commit);
+                return { success: false, reason: err.message };
+            }
+            throw err;
+        }
+        if (result.success) {
+            return result;
+        }
+        // success:false is a StaleFailure. `missing` ⇒ ahead/stale divergence
+        // (we already hold ≥ this rev): tolerate, do NOT reconcile downward. A
+        // missing-base reason ⇒ behind divergence, reconcile (below). Any other bare
+        // `reason` with no `missing` ⇒ a genuine internalCommit fault: propagate so
+        // handleConsensus rolls back the executed marker and rethrows.
+        //
+        // NOTE: this 'ahead' tolerance is what turns a rival's commit that somehow reaches
+        // consensus into a member-side no-op rather than a stream reset. It must stay: a member
+        // genuinely ahead of a redelivered/lagging commit is the common, correct case. What keeps
+        // the tolerance from turning into an acknowledged write no member stored is downstream:
+        // the durable verdict retained by the caller reports this member as NOT holding the
+        // revision (unless the revision index names this very action — an ahead member that did
+        // land it), and `CoordinatorRepo.commit`'s durability gate acknowledges only a majority of
+        // such reports; a retained refusal whose cause a local re-read confirms as a rival at the
+        // requested revision is answered as a retryable conflict there. Upstream,
+        // `validateCommitRevisions` rejects the rival at the promise round and
+        // `validateCommitAgainstRefusedPend` refuses to sign the commit of a pend this member
+        // refused. If consensus-without-durability is ever observed again, look at the gate's
+        // inputs (a member reporting a durable success it does not hold, or a majority that is
+        // genuinely durable on a forked lineage), not at this branch.
+        if (result.missing?.length) {
+            log('cluster-member:consensus-commit-diverged', {
+                messageHash,
+                actionId: commit.actionId,
+                divergence: 'ahead',
+                reason: result.reason,
+                hasMissing: true
+            });
+            return result;
+        }
+        // This member holds no materializable base for one of the blocks, so
+        // `StorageRepo.commit` REFUSED rather than record a revision it could never serve.
+        // Same "behind" divergence as a missing pend — and the same cure: pull the committed
+        // revision from a cohort peer. Reconciling here (after commit released its per-block
+        // latches) is what makes refusing safe; fetching inside the commit path would deadlock
+        // against the latch `saveReplicatedBlock` needs to persist what it fetched.
+        if (isMissingBaseRevisionFailure(result)) {
+            log('cluster-member:consensus-commit-diverged', {
+                messageHash,
+                actionId: commit.actionId,
+                divergence: 'behind',
+                reason: result.reason
+            });
+            await this.reconcileDivergentCommit(record, commit);
+            return result;
+        }
+        throw new Error(`Consensus commit for action ${commit.actionId} failed: ${result.reason ?? 'unknown reason'}`);
+    }
+    /**
+     * The durable verdict for a consensus commit: `applied` itself when storage landed it (a
+     * success from `StorageRepo.commit` means every block is committed, or already was, under this
+     * action), otherwise a fresh look at what local storage holds NOW — after the reconcile the
+     * refusal triggered. Durable means every block in `commit.blockIds` records `commit.rev` under
+     * `commit.actionId`. A refusal that is not durable is returned as-is, so the coordinating node
+     * can still classify its own member's ahead-shaped refusal against a rival. A read fault counts
+     * as not durable: the gate this feeds fails toward retry.
+     */
+    async durableCommitVerdict(commit, applied) {
+        if (applied.success) {
+            return applied;
+        }
+        try {
+            for (const blockId of commit.blockIds) {
+                if (!(await this.holdsCommittedRevision(blockId, commit))) {
+                    return applied;
+                }
+            }
+        }
+        catch (err) {
+            log('cluster-member:consensus-commit-durability-read-error', {
+                actionId: commit.actionId,
+                rev: commit.rev,
+                error: err.message
+            });
+            return applied;
+        }
+        log('cluster-member:consensus-commit-durable-after-reconcile', { actionId: commit.actionId, rev: commit.rev });
+        return { success: true };
+    }
+    /**
+     * True when local storage records `commit.rev` of `blockId` under `commit.actionId`. Read from
+     * the revision index (the {@link IRevisionActionReader} capability) so a member whose `latest` has
+     * since moved past the revision still counts as holding it; a repo without the capability is
+     * judged on `latest` alone.
+     */
+    async holdsCommittedRevision(blockId, commit) {
+        const reader = this.storageRepo;
+        if (typeof reader.getRevisionAction === 'function') {
+            return await reader.getRevisionAction(blockId, commit.rev) === commit.actionId;
+        }
+        const latest = (await this.storageRepo.get({ blockIds: [blockId] }))[blockId]?.state?.latest;
+        return latest?.rev === commit.rev && latest.actionId === commit.actionId;
+    }
     /**
      * Applies a consensus-ordered invalidation on this member: dedup → certificate verification →
      * capture the invalidation's commit cert (for reactivity reuse) → delegate the compensating write +