@optimystic/db-p2p 1.0.0-beta.2 → 1.0.0

package/dist/src/repo/coordinator-repo.js

@@ -1,5 +1,5 @@
-import { LruMap, blockIdsForTransforms, highestStaleAt, isConflictFailure, isOwnRevision, DEFAULT_SUPER_MAJORITY_THRESHOLD } from "@optimystic/db-core";
-import { ClusterCoordinator, ConflictRaceLostError, ValidatorRejectionError } from "./cluster-coordinator.js";
+import { LruMap, blockIdsForTransforms, transformForBlockId, highestStaleAt, isConflictFailure, isOwnRevision, DEFAULT_SUPER_MAJORITY_THRESHOLD, routingKeyForBlock, localDurability, unroutedDurability } from "@optimystic/db-core";
+import { BlocksHeldError, ClusterCoordinator, ConflictRaceLostError, ValidatorRejectionError } from "./cluster-coordinator.js";
 import { peerIdFromString } from "@libp2p/peer-id";
 import { createLogger } from '../logger.js';
 import { PenaltyReason } from "../reputation/types.js";
@@ -7,8 +7,11 @@ import { quorumSize, corroboratorCapacity, selectQuorumRev, certifiedEquivocatio
 import { certifyClaim, isAttributableProofFailure, proofThresholds } from "../cluster/certified-claims.js";
 import { DEFAULT_CLUSTER_SIZE, resolveRepairCorroborationClusterSize } from "../cluster/cluster-policy.js";
 import { RECONCILE_TIMEOUT_MS } from "../cluster/reconcile-block.js";
-import { isMissingBaseRevisionFailure, MISSING_BASE_REVISION_REASON } from "../storage/storage-repo.js";
+import { isMissingBaseRevisionFailure, COMMIT_NOT_DURABLE_REASON, MISSING_BASE_REVISION_REASON } from "../storage/storage-repo.js";
+import { isReservationAgainst, reservationRequestFor, cohortCanMissAPend } from "../storage/pending-claim.js";
 import { buildBlockCommitProof } from "../cluster/commit-proof.js";
+import { RESPONSIBILITY_TTL_MS, ResponsibilityRefusalError } from "./responsibility.js";
+import { StuckReservationTracker } from "./stuck-reservation.js";
 /** How long one cohort peer gets to answer the latest-revision consult before it counts as silent. */
 const LATEST_QUERY_TIMEOUT_MS = 1000;
 /** True when a freshly-read local revision is strictly ahead of the baseline the repair started from. */
@@ -76,80 +79,8 @@ function soleHolderMessage(cohortPeers) {
         `second voter — reaching this message means the one holder attached no such proof, or one that did not ` +
         `verify.)`;
 }
-/**
- * How many DISTINCT later actions one unchanged holder must refuse on a block before the refusals are
- * named as a stuck reservation rather than as an ordinary lost race.
- *
- * **Why a count of distinct actions and not something else.** Elapsed time answers the wrong question
- * — a slow writer is not a stuck one, and a holder legitimately keeps its reservation for as long as
- * its own commit takes. A raw refusal count answers the wrong question too: a single writer retrying
- * a lost race produces a run of refusals under ONE action id (see {@link StuckReservationWatch.refused}).
- * What no healthy holder can produce is an unbounded stream of *different* writers all losing to it,
- * because a healthy holder's reservation lasts one pend-to-commit window.
- *
- * **Why 8.** The bound to clear is how many distinct actions can honestly be refused inside one such
- * window. Measured on the in-process mesh, in the healthy-contention arm of
- * `test/stuck-reservation-named.spec.ts`: a holder that pends, is raced by other writers, and then
- * commits refuses **2** distinct actions per episode — the two rivals — and the count resets on every
- * holder change. `concurrent-diary-append-acknowledgement.spec.ts` races three writers at one diary
- * and cannot exceed that either, for the same reason: at most (writers - 1) rivals can lose to one
- * winner. 8 is four times the measured healthy figure, and it is a floor a genuinely stuck block
- * clears trivially (the field instance refused hundreds).
- *
- * **The bound stated exactly.** It is distinct SYNC CYCLES, not distinct writers: one writer that
- * exhausts a sync's retry budget and is re-driven by its caller mints a fresh id for the next cycle,
- * so it can contribute more than one. That does not widen the window much — a cycle only ends in
- * exhaustion after `DefaultMaxAttempts` (10) attempts of backoff, roughly 21s (see the exhaustion
- * NOTE in `Collection.syncAttempts`), so a lone writer needs a holder to keep the block for upwards
- * of two and a half minutes before it reaches 8 by itself, which is not a healthy holder.
- *
- * **What the margin does NOT cover, stated honestly.** A block with more than 8 distinct writers
- * racing it inside a single pend-to-commit round trip could reach 8 with a perfectly healthy holder.
- * That is a diagnostic false positive on a log line and nothing else — this counter never refuses,
- * expires, or deletes anything (see {@link CoordinatorRepo.noteStuckReservation}) — and the remedy if
- * a deployment ever hits it is to raise this number, not to add a control path. Raising it costs
- * detection latency on low-traffic blocks, which need this many distinct write ATTEMPTS before the
- * condition can be named at all.
- */
-const STUCK_RESERVATION_DISTINCT_ACTIONS = 8;
-/** Whether two sorted holder lists name the same reservation — i.e. whether a refusal continues an
- *  existing episode or starts a new one. Both sides come from the same sort, so this is a plain
- *  element-wise comparison; a block normally has exactly one holder, since a member's own pend refuses
- *  a second one (`ClusterMember.validatePendOperations`). */
-function sameHolders(a, b) {
-    return a.length === b.length && a.every((id, i) => id === b[i]);
-}
-/**
- * The stuck-reservation wording: written for an operator reading logs, in the same register as
- * {@link cohortTooSmallMessage} and {@link soleHolderMessage} — what is stuck, what will and will not
- * clear it, and what to do next.
- *
- * The claim is deliberately about the RESERVATION, not about the writer's intent: this node cannot
- * see whether the holding process is alive, only that it has held the block across enough unrelated
- * later actions that no retry is going to win. So the line says what is provable (the block accepts
- * no writes while this record stands, and nothing on the node removes it) and points at the one check
- * that settles the rest.
- */
-function stuckReservationMessage(holders, refusedActions) {
-    const held = holders.join(', ');
-    return `This block is WEDGED BEHIND A PENDING WRITE THAT IS NOT COMPLETING, and retrying will never ` +
-        `clear it: action(s) ${held} reserved the block and have now refused ${refusedActions} DISTINCT, ` +
-        `unrelated later actions. Each of those refusals on its own looks exactly like an ordinary ` +
-        `optimistic-concurrency loss, which is normal and healthy — the repetition is what is not. A ` +
-        `healthy rival holds a block only for its own pend-to-commit window and then releases it by ` +
-        `committing or cancelling; a reservation that keeps refusing NEW writers is holding the block ` +
-        `against every writer on every machine, and each of them loses again identically. EXACTLY TWO ` +
-        `THINGS CLEAR IT: a cancel for action(s) ${held} on this block (route it through the cohort so ` +
-        `every member drops the record), or that same action's own commit landing. Nothing on the node ` +
-        `expires it — there is no sweep for abandoned pending records — so until one of those two happens ` +
-        `the block takes NO writes while continuing to serve reads and to look healthy in every other ` +
-        `respect. The usual cause is a writer that went away between a failed or half-applied commit and ` +
-        `the cancel it owed, so check whether whatever ran ${held} still exists before cancelling on its ` +
-        `behalf. This line is a diagnosis and nothing more: this node does not expire, refuse, or delete ` +
-        `the record on the strength of it.`;
-}
 export function coordinatorRepo(keyNetwork, createClusterClient, cfg, fretService, reputation, stateStore) {
-    return (components) => new CoordinatorRepo(keyNetwork, createClusterClient, components.storageRepo, cfg, components.localCluster, components.localPeerId, fretService, components.clusterLatestCallback, reputation, stateStore, components.acquireBlockFromCohort, components.proofAnchoring);
+    return (components) => new CoordinatorRepo(keyNetwork, createClusterClient, components.storageRepo, cfg, components.localCluster, components.localPeerId, fretService, components.clusterLatestCallback, reputation, stateStore, components.acquireBlockFromCohort, components.proofAnchoring, components.underReplicationLedger, components.onCommittedHolders);
 }
 /** Cluster coordination repo - uses local store, as well as distributes changes to other nodes using cluster consensus. */
 export class CoordinatorRepo {
@@ -160,11 +91,12 @@ export class CoordinatorRepo {
     clusterLatestCallback;
     acquireBlockFromCohort;
     proofAnchoring;
+    underReplicationLedger;
+    onCommittedHolders;
     coordinator;
     DEFAULT_TIMEOUT = 30000; // 30 seconds default timeout
     localPeerId;
     responsibilityCache = new LruMap(1000);
-    static RESPONSIBILITY_TTL_MS = 60_000;
     lastSeenCommitMs = new LruMap(1000);
     /** Per block, what earlier repair passes left unresolved — see {@link AheadClaimState}.
      *  Outlives the consult on purpose: the read-repair window skips consults for blocks checked
@@ -174,14 +106,14 @@ export class CoordinatorRepo {
      *  {@link reportRepairDeadlock} say its piece a second time. */
     unsettledAheadClaims = new LruMap(1000);
     /**
-     * Per block, what its pending-conflict refusals have added up to — see {@link StuckReservationWatch}
-     * and {@link noteStuckReservation}. Deliberately its OWN map rather than a third fact hung off
-     * {@link unsettledAheadClaims}: that entry belongs to the read-repair path and is cleared by a block
-     * converging on a revision, whereas this one belongs to the write path and is cleared by the block
-     * accepting a write. Sharing the entry would mean teaching both of those lifetimes about a fact
-     * neither owns (backlog `debt-freshness-state-scattered-across-coordinator-repo` is the standing
-     * argument for collapsing all of this per-block state behind one collaborator; adding a fourth
-     * carve-out to the freshness entry would have made that harder, not easier).
+     * Per block, what its pending-conflict refusals have added up to — see {@link StuckReservationTracker}
+     * and {@link noteStuckReservation}. Deliberately its OWN collaborator rather than a third fact hung
+     * off {@link unsettledAheadClaims}: that entry belongs to the read-repair path and is cleared by a
+     * block converging on a revision, whereas this one belongs to the write path and is cleared by the
+     * block accepting a write. Sharing the entry would mean teaching both of those lifetimes about a
+     * fact neither owns (backlog `debt-freshness-state-scattered-across-coordinator-repo` is the
+     * standing argument for collapsing all of this per-block state behind one collaborator; adding a
+     * fourth carve-out to the freshness entry would have made that harder, not easier).
      *
      * NOTE: LRU-bounded like its siblings. An eviction under >1000 conflicted blocks loses an episode's
      * say-once flag, so the line can repeat once for that block — the same bounded duplication
@@ -190,12 +122,11 @@ export class CoordinatorRepo {
      * NOTE: per COORDINATOR, and a block's coordinator is whichever peer the writer's key lookup
      * resolved — normally stable, but cohort churn or a routing change moves it. When it moves, the
      * count restarts on the new coordinator (the condition is named later) and the old one may name the
-     * same episode again (the condition is named twice). Fine while a wedged block is diagnosed by
-     * searching for its id; if a churning deployment ever makes duplicate lines the noisy failure this
-     * one exists to replace, the say-once state has to move to where the record lives (the member's own
-     * storage) rather than to where the refusal was classified.
+     * same episode again (the condition is named twice). Each MEMBER now keeps its own tracker as well
+     * (`ClusterMember.validatePendOperations`), fed by its own `held` votes, so the episode is also
+     * named where the record lives, by a count that does not move with the coordinator.
      */
-    stuckReservations = new LruMap(1000);
+    stuckReservations = new StuckReservationTracker(1000);
     readRepairMode;
     readRepairWindowMs;
     readRepairSampleRate;
@@ -217,7 +148,7 @@ export class CoordinatorRepo {
     now = () => Date.now();
     /** Test seam: overridable RNG (0..1) for sample-rate gating. */
     rand = () => Math.random();
-    constructor(keyNetwork, createClusterClient, storageRepo, cfg, localCluster, localPeerId, fretService, clusterLatestCallback, reputation, stateStore, acquireBlockFromCohort, proofAnchoring) {
+    constructor(keyNetwork, createClusterClient, storageRepo, cfg, localCluster, localPeerId, fretService, clusterLatestCallback, reputation, stateStore, acquireBlockFromCohort, proofAnchoring, underReplicationLedger, onCommittedHolders) {
         this.keyNetwork = keyNetwork;
         this.createClusterClient = createClusterClient;
         this.storageRepo = storageRepo;
@@ -225,6 +156,8 @@ export class CoordinatorRepo {
         this.clusterLatestCallback = clusterLatestCallback;
         this.acquireBlockFromCohort = acquireBlockFromCohort;
         this.proofAnchoring = proofAnchoring;
+        this.underReplicationLedger = underReplicationLedger;
+        this.onCommittedHolders = onCommittedHolders;
         this.localPeerId = localPeerId;
         this.log = createLogger('coordinator-repo', localPeerId?.toString());
         const policy = {
@@ -291,67 +224,103 @@ export class CoordinatorRepo {
         await this.coordinator.recoverTransactions();
     }
     /**
-     * Check if this node is in the cluster for a given block.
-     * Uses findCluster membership — in the real network layer, self is always
-     * included in the cohort when this node is responsible. This serves as a
-     * defense-in-depth guard for requests that arrive at the wrong node.
-     * Returns true if localPeerId is not set (backward compat for single-node/test setups).
+     * Whether this node is in the cohort for a block. Uses `findCluster` membership — in the real network
+     * layer, self is in the cohort exactly when this node is among the nearest `clusterSize` serving peers
+     * for the block, so a request that reaches a node outside it was sent to the wrong machine.
+     *
+     * Three answers, because a lookup that THREW is not an answer: `undetermined` is never cached (routing
+     * can recover on the next request) and never read as `responsible` — what each caller does with it is
+     * that caller's posture (see {@link verifyResponsibility} and `get`).
+     *
+     * With no `localPeerId` the check is skipped and the answer is `responsible`. That bypass exists for
+     * wiring without an identity (direct constructors, single-node and test setups), never for production,
+     * where `libp2p-node-base` always passes the node's peer id.
+     *
+     * NOTE: a cached answer stands for up to {@link RESPONSIBILITY_TTL_MS} after the cohort changes, so a
+     * node can still say `responsible` for a minute after it stops being so. {@link soloCohortDurability}'s
+     * `unrouted` class and `ClusterCoordinator.executeClusterTransaction`'s cohort-membership guard are what
+     * keep that window honest; if churn ever makes the window matter, shorten the TTL rather than
+     * re-looking-up on every write.
      */
-    async isResponsibleForBlock(blockId) {
+    async responsibilityFor(blockId) {
         if (!this.localPeerId)
-            return true;
+            return 'responsible';
         const cached = this.responsibilityCache.get(blockId);
         if (cached && cached.expires > Date.now()) {
-            return cached.inCluster;
+            return cached.inCluster ? 'responsible' : 'not-responsible';
         }
-        const blockIdBytes = new TextEncoder().encode(blockId);
         let inCluster;
         try {
-            const peers = await this.keyNetwork.findCluster(blockIdBytes);
+            const peers = await this.keyNetwork.findCluster(routingKeyForBlock(blockId));
             inCluster = this.localPeerId.toString() in peers;
         }
         catch (err) {
             this.log('proximity:check-error', { blockId, error: err.message });
-            // On failure, assume responsible to avoid false rejections
-            return true;
+            return 'undetermined';
         }
-        this.responsibilityCache.set(blockId, { inCluster, expires: Date.now() + CoordinatorRepo.RESPONSIBILITY_TTL_MS });
+        this.responsibilityCache.set(blockId, { inCluster, expires: Date.now() + RESPONSIBILITY_TTL_MS });
         this.log('proximity:checked', { blockId, inCluster });
-        return inCluster;
+        return inCluster ? 'responsible' : 'not-responsible';
     }
     /**
-     * Verify this node is responsible for all given block IDs. Throws if not.
+     * The write path's gate (`pend`, `cancel`, `commit`): refuse unless this node is responsible for EVERY
+     * block, and refuse too when it cannot tell — fail CLOSED. A write accepted on a thrown lookup commits
+     * where the network was never consulted (GitHub #19); refusing hands it back to the writer's transactor,
+     * which excludes this peer and re-picks inside the cohort.
+     *
+     * Every block is checked so the error names all of them. When the blocks split between the two kinds,
+     * `not-responsible` is the one thrown: it is a settled answer that the request is misrouted, which no
+     * recovery of the lookup would change; the undetermined blocks are still logged.
+     *
+     * For `cancel`, a refusal on a transient lookup fault leaves the pending record standing on this node
+     * until the writer's cancel retry lands on another cohort member — and this node is still discharged
+     * then, since as a member it judges the cancel against the record's own `peers`, not against a lookup.
      */
     async verifyResponsibility(blockIds) {
         const notResponsible = [];
+        const undetermined = [];
         for (const blockId of blockIds) {
-            if (!await this.isResponsibleForBlock(blockId)) {
+            const verdict = await this.responsibilityFor(blockId);
+            if (verdict === 'not-responsible')
                 notResponsible.push(blockId);
-            }
-        }
-        if (notResponsible.length > 0) {
-            this.log('proximity:rejected', { blockIds: notResponsible });
-            throw new Error(`Not responsible for block(s): ${notResponsible.join(', ')}`);
+            else if (verdict === 'undetermined')
+                undetermined.push(blockId);
         }
+        if (notResponsible.length === 0 && undetermined.length === 0)
+            return;
+        this.log('proximity:rejected', { notResponsible, undetermined });
+        throw notResponsible.length > 0
+            ? new ResponsibilityRefusalError('not-responsible', notResponsible)
+            : new ResponsibilityRefusalError('undetermined', undetermined, 'cohort lookup failed; refusing the write rather than accepting it unrouted');
     }
     async get(blockGets, options) {
-        // Soft proximity check — warn but still serve reads for graceful degradation
-        // NOTE: a soft-served read now also *acquires* the block durably (see restoreCorroborated), where
-        // before it could at most promote a pending this node already held. So a soft serve leaves behind
-        // a replica of a block this node is not responsible for, and nothing sweeps those: ring-shift
-        // sheds a keyspace RANGE, not "blocks outside my cohort". Fine while soft serves are what they
-        // are meant to be — a rare degradation during routing churn — since routing already placed this
-        // node near the block. If they ever become routine, gate acquisition (not the serve itself) on
-        // isResponsibleForBlock.
+        // Soft proximity check — warn but still serve reads for graceful degradation. Unlike the write
+        // path it stays OPEN when the lookup throws: a read is best-effort, and the consult below flags
+        // whatever it could not confirm (`unavailable`, `unconfirmedAheadRev`) rather than posing as sure.
+        // NOTE: a soft-served read also *acquires* the block durably (see restoreCorroborated), so a soft
+        // serve leaves behind a replica of a block this node is not responsible for, and nothing sweeps
+        // those: ring-shift sheds a keyspace RANGE, not "blocks outside my cohort". Soft serves are now
+        // confined to the responsibility caches' staleness window: a remote read for a block this node is
+        // not responsible for is redirected by `RepoService.checkRedirect` before it gets here, and this
+        // node's own transactor routes a read here only when self is in the block's cohort. If soft serves
+        // ever become routine (steady `proximity:get-warning` lines while the network's membership is not
+        // changing), gate acquisition (not the serve itself) on `responsibilityFor`.
+        //
+        // NOTE: accepted tradeoff — this check and `fetchBlockFromCluster` below each run their own
+        // `findCluster` for the same block, so a cold read costs two cohort lookups where one shared
+        // lookup would do. Declined 2026-09-11: at 0.009 ms per solo lookup there is nothing to win,
+        // and this check's future is open (blocked `writer-and-servers-disagree-on-where-a-block-lives`,
+        // option D2(b)). Revisit if a device profile shows `findCluster` as material.
         for (const blockId of blockGets.blockIds) {
-            if (!await this.isResponsibleForBlock(blockId)) {
+            if (await this.responsibilityFor(blockId) === 'not-responsible') {
                 this.log('proximity:get-warning', { blockId, msg: 'serving read for non-responsible block' });
             }
         }
         // First try local storage
         const localResult = await this.storageRepo.get(blockGets, options);
         // Decide per-block whether to consult cluster peers. Two triggers:
-        //   (a) Missing — block isn't present locally at all (legacy behavior).
+        //   (a) Missing — block isn't present locally at all. Consults on every read: an absence is
+        //       never remembered (see the accepted-tradeoff NOTE below).
         //   (b) Stale-by-policy — block is present but read-repair policy says verify.
         // Skip cluster fetch if this is already a sync request (to prevent recursive queries).
         // A sync read is also never marked `unavailable` here — the consult it skips is the
@@ -361,7 +330,8 @@ export class CoordinatorRepo {
         const skipClusterFetch = options?.skipClusterFetch;
         // NOTE: NetworkTransactor.get treats an authoritative "absent" ({ state: {} })
         // as final and no longer retries it (ticket txn-perf-authoritative-notfound),
-        // relying on this cluster reconciliation to have already run. When the consult
+        // relying on this cluster reconciliation to have already run — for THIS read: an
+        // unflagged absent means the cohort was consulted before answering. When the consult
         // FAILS outright — or runs without ruling the block out and the block stays
         // missing — the entry is flagged `unavailable` below with a reason naming what
         // the consult established (see AbsenceVerdict and the mapping in the loop body),
@@ -371,6 +341,17 @@ export class CoordinatorRepo {
         // no flag and no transactor-level retry to compensate. That is fine (such a
         // coordinator has no cluster to reconcile against), but keep this coupling in
         // mind if a partial-cluster read path is added.
+        //
+        // NOTE: accepted tradeoff — a block missing locally consults on EVERY read, even on a cohort
+        // of one, where the consult is one `findCluster` (0.009 ms measured) and a once-per-window log
+        // line (see the solo-self exit). Remembering an absence was tried and removed (GitHub issue
+        // #20, ticket drop-the-settled-absence-memo): a cohort-of-one memo outlived the view it was
+        // settled under, and a node whose view then grew served a block another coordinator had just
+        // committed as never created. Cohort-member writes (`ClusterRepo` → storage) never pass
+        // through this class, so nothing here could clear such a memo either. Revisit only with a memo
+        // bound to the cohort view it was settled under AND cleared by every writer of local storage;
+        // `coordinator-repo-absence-write-bypass.spec.ts` is the gate, and backlog
+        // `feat-a-cohort-member-remembers-a-settled-absence` holds the design notes.
         if (this.clusterLatestCallback && !skipClusterFetch) {
             for (const blockId of blockGets.blockIds) {
                 const localEntry = localResult[blockId];
@@ -397,7 +378,12 @@ export class CoordinatorRepo {
                 }
                 try {
                     const { absence, currency } = await this.fetchBlockFromCluster(blockId, blockGets.context, localRev);
-                    const refreshed = await this.storageRepo.get({ blockIds: [blockId], context: blockGets.context }, options);
+                    // `lineageOf` rides along: the refreshed entry REPLACES the local one below, and an
+                    // entry that lost its lineage answer would read to the asker as "could not say".
+                    const refreshed = await this.storageRepo.get({
+                        blockIds: [blockId], context: blockGets.context,
+                        ...(blockGets.lineageOf === undefined ? {} : { lineageOf: blockGets.lineageOf })
+                    }, options);
                     const newRev = refreshed[blockId]?.state?.latest?.rev;
                     if (refreshed[blockId]) {
                         localResult[blockId] = refreshed[blockId];
@@ -667,6 +653,28 @@ export class CoordinatorRepo {
         const lastSeen = this.lastSeenCommitMs.get(blockId);
         return lastSeen == null ? undefined : this.now() - lastSeen;
     }
+    /**
+     * Whether the solo-self exit of {@link fetchBlockFromCluster} has already named `blockId` inside
+     * the current read-repair window, for a block this node does NOT hold (`localRev` undefined). Such
+     * a block reaches that exit on every read, because `get` never remembers an absence (GitHub
+     * issue #20). So its `cluster-fetch:solo-self-skip` line and its stamp are both skipped while the
+     * stamp is at most one `readRepairWindowMs` old. An unconditional line would bring back issue #8's
+     * log volume for a probed but never-written collection. Re-stamping on every read would keep the
+     * stamp fresh and silence the line for good on a block read more often than once a window.
+     *
+     * Withholding the stamp never skips a consult: `get` asks {@link shouldReadRepair} only about
+     * present blocks. A HELD block reaches the exit only when read-repair already chose to consult, so
+     * this is always false for one. Its line and stamp are unchanged, and the line keeps pairing with
+     * `cluster-tx:read-repair-triggered`.
+     *
+     * NOTE: the stamp is shared with every exit that marks a block seen, so a missing block one of
+     * them stamped inside the window is not named until that stamp lapses. Fine for a diagnostic
+     * line; if anything ever needs "first answer from a self-only view" exactly, give the line its own
+     * per-block stamp.
+     */
+    soloAbsenceNamedThisWindow(blockId, localRev) {
+        return localRev === undefined && (this.ageMs(blockId) ?? Infinity) <= this.readRepairWindowMs;
+    }
     /** Mark blocks as freshly observed from cluster authority (post-commit or post-fetch). */
     markBlocksSeen(blockIds) {
         const now = this.now();
@@ -733,17 +741,21 @@ export class CoordinatorRepo {
      *    retire it when the memo's claimants are among the peers that answered), `no-evidence`
      *    leaves it standing untouched. Required, not optional, so an exit added later has to say
      *    which it means.
+     *
+     * Nothing is remembered about an absence: `get` runs this pass on every read of a block missing
+     * locally (see the accepted-tradeoff NOTE there).
      */
     async fetchBlockFromCluster(blockId, context, localRev) {
         if (!this.clusterLatestCallback)
             return { absence: 'confirmed', currency: { kind: 'no-evidence' } };
-        const blockIdBytes = new TextEncoder().encode(blockId);
-        const peers = await this.keyNetwork.findCluster(blockIdBytes);
+        const peers = await this.keyNetwork.findCluster(routingKeyForBlock(blockId));
         const peerIds = peers ? Object.keys(peers) : [];
         // NOTE: deliberately does NOT call `markBlocksSeen` — unlike the solo-self exit below.
-        // An empty cohort is a ROUTING FAILURE, not a settled answer, and `Libp2pKeyPeerNetwork`
-        // cannot even produce one (its `findCluster` always includes self); the only producer
-        // today is the mesh harness's injected `findClusterFails`. Arming the read-repair window
+        // An empty cohort is a ROUTING FAILURE, not a settled answer. A serving node's
+        // `Libp2pKeyPeerNetwork.findCluster` cannot produce one: it always holds at least this
+        // node when no nearer serving peer is known. Only a node that serves no storage (a
+        // client-only libp2p node, which runs no CoordinatorRepo today) can see an empty cohort;
+        // the only producer here is the mesh harness's injected `findClusterFails`. Arming the read-repair window
         // here would suppress a genuine repair for a whole `readRepairWindowMs` after a transient
         // blip, and re-entering costs no network work beyond the `findCluster` the read already
         // makes. Do not "fix" this by symmetry with the solo-self exit.
@@ -757,7 +769,11 @@ export class CoordinatorRepo {
         if (peerIds.length === 1
             && this.localPeerId
             && peerIds[0] === this.localPeerId.toString()) {
-            this.log('cluster-fetch:solo-self-skip', { blockId });
+            // The line and the stamp below go together: both are skipped for a missing block this exit
+            // already named inside the window (see `soloAbsenceNamedThisWindow`).
+            const namedThisWindow = this.soloAbsenceNamedThisWindow(blockId, localRev);
+            if (!namedThisWindow)
+                this.log('cluster-fetch:solo-self-skip', { blockId });
             // Arm the lazy read-repair window. Without this the window is never stamped,
             // `shouldReadRepair` reads `lastSeen == null` forever, and every read re-enters this
             // exit — read -> stale -> consult -> solo skip -> no-op -> still stale, unbounded
@@ -775,7 +791,8 @@ export class CoordinatorRepo {
             // Deliberately opposite to the commit-side rule that withholds arming from a commit
             // whose quorum proves nothing about rivals: that damps nothing, this bounds an
             // otherwise unbounded loop. Landing both, keep both — see the specs for each.
-            this.markBlocksSeen([blockId]);
+            if (!namedThisWindow)
+                this.markBlocksSeen([blockId]);
             // Currency: this exit queried NOBODY, so it refutes nothing — an earlier pass's unsettled
             // claim survives it. Note the coupling with the arming just above: retained doubt now
             // persists for up to `readRepairWindowMs` before a consult can refute it. That is correct
@@ -949,12 +966,12 @@ export class CoordinatorRepo {
         // unsettled claim (`recordAheadClaim`) and keeps stamping reads served below it while the
         // window suppresses the retry — the window damps repair effort, not honesty.
         // NOTE: that damping covers only a block this node holds at an OLDER revision. A block entirely
-        // missing locally never consults the window (`get` triggers on `isMissing` before
-        // `shouldReadRepair`), so a persistently failing acquisition — e.g. a two-node deployment that
-        // never set `assumedClusterSize`, where the content quorum can never be met — re-fetches an
+        // missing locally never consults the window (`get` consults on every read of a missing block,
+        // before `shouldReadRepair`), so a persistently failing acquisition — e.g. a two-node deployment
+        // that never set `assumedClusterSize`, where the content quorum can never be met — re-fetches an
         // archive on every read of that block. Correct, and self-limiting once the cohort can agree; if
         // it ever shows as read amplification, gate the acquisition step (not the latest-query) on the
-        // same window rather than widening `isMissing`.
+        // same window rather than remembering the absence (GitHub issue #20).
         this.markBlocksSeen([blockId]);
         // Converged: the corroboration is itself the evidence that nothing is ahead, and it came from
         // peers that answered — the shared verdict resolves to `nothing-ahead`, and the memo retires
@@ -1514,12 +1531,14 @@ export class CoordinatorRepo {
         return result;
     }
     /** The cluster half of {@link pend}, after responsibility is verified: consensus, the local-verdict
-     *  arms, and the two optimistic-concurrency classifiers a rejection is run through. */
+     *  arms, and the catch that turns each optimistic-concurrency refusal into a retryable answer —
+     *  the two signed-evidence ones ({@link ConflictRaceLostError}, {@link BlocksHeldError}) directly,
+     *  and a validator rejection only through {@link classifyStaleRejection}. */
     async pendThroughCluster(request, allBlockIds, options) {
         const coordinatingBlockIds = options?.coordinatingBlockIds ?? allBlockIds;
-        const peerCount = await this.coordinator.getClusterSize(coordinatingBlockIds[0]);
-        if (peerCount <= 1) {
-            return await this.storageRepo.pend(request, options);
+        const cohort = await this.coordinator.resolveCohort(coordinatingBlockIds[0]);
+        if (!cohort.resolved || cohort.peerIds.length <= 1) {
+            return await this.pendSolo(request, cohort, options);
         }
         const message = {
             operations: [{ pend: request }],
@@ -1527,7 +1546,13 @@ export class CoordinatorRepo {
             coordinatingBlockIds
         };
         try {
-            const { localExecuted, localPendResult, cohortPendRefusals } = await this.coordinator.executeClusterTransaction(coordinatingBlockIds[0], message, options);
+            const { record, localExecuted, localPendResult, cohortPendRefusals } = await this.coordinator.executeClusterTransaction(coordinatingBlockIds[0], message, options);
+            // Who ACCEPTED the pending record — the cohort members whose promise vote approved it, plus
+            // or minus this node's own member per exit below. A pend's `confirmed` is not a commit's:
+            // accepting a pending record confers no storage durability (a pend that reached
+            // pend-consensus may still have been stored by nobody — see the local-verdict arm below),
+            // so the two numbers are never comparable, and the field says so.
+            const pendDurability = (selfAccepted) => pendCohortDurability(record, selfAccepted, this.localPeerId?.toString());
             // The first cohort refusal in peer-id order, so two coordinators facing the same cohort
             // answer with the same one. Which refusal is reported does not change the outcome — every
             // entry is conflict-shaped and every one means "rebase and retry" — only which `pending` /
@@ -1578,7 +1603,9 @@ export class CoordinatorRepo {
                     hasMissing: !!result.missing?.length,
                     hasPending: !!result.pending?.length
                 });
-                return answerWithCohortRefusal(result);
+                // Storage's own answer is `local`; the cohort's answer replaces it — this node accepted
+                // the record iff its fallback pend succeeded.
+                return answerWithCohortRefusal(result.success ? { ...result, durability: pendDurability(true) } : result);
             }
             // Local cluster already executed during consensus — return storage's own verdict rather
             // than fabricating a success (the peerCount <= 1 path above returns storage's real result
@@ -1591,7 +1618,10 @@ export class CoordinatorRepo {
             // commit that reached commit-consensus IS the authoritative commit (Theorem 9), whereas a
             // pend that reached pend-consensus may still have been stored by nobody.
             if (localPendResult !== undefined) {
-                if (localPendResult.success || isConflictFailure(localPendResult)) {
+                if (localPendResult.success) {
+                    return answerWithCohortRefusal({ ...localPendResult, durability: pendDurability(true) });
+                }
+                if (isConflictFailure(localPendResult)) {
                     return answerWithCohortRefusal(localPendResult);
                 }
                 // A bare-reason refusal (no pending/missing — e.g. a local validation-hook fault)
@@ -1605,11 +1635,14 @@ export class CoordinatorRepo {
             }
             // No verdict retained (member predates retention, restart, or TTL): the prior shape,
             // still subject to the cohort-refusal rule — a lost local verdict must not resurrect the
-            // fabricated success this ticket exists to remove.
+            // fabricated success this ticket exists to remove. For the durability class, a tolerated
+            // local fault means this node did NOT accept (`false`: its approve vote is withdrawn from the
+            // count), and an absent verdict says nothing either way (`undefined`: the vote stands).
             return answerWithCohortRefusal({
                 success: true,
                 pending: [],
-                blockIds: allBlockIds
+                blockIds: allBlockIds,
+                durability: pendDurability(localPendResult === undefined ? undefined : false)
             });
         }
         catch (error) {
@@ -1631,6 +1664,14 @@ export class CoordinatorRepo {
             // each member compares the rivals as IT holds them, so a member that already approved X
             // keeps X while a member that approved Y first keeps Y, and no rival reaches a promise
             // supermajority. (The hash tie-break is already symmetric — it cannot be the fix.)
+            // TWO contenders coordinated by different nodes reach an all-lose round by another route,
+            // and not by this catch: both collect their promises in parallel, so BOTH reach pend
+            // consensus; each coordinator's own member applies its own pend first (local-first
+            // delivery), every other member's storage refuses whichever arrived second, and each writer
+            // is downgraded by `answerWithCohortRefusal` above. Measured by
+            // `test/transaction-node-count-sweep.spec.ts` on the in-process mesh: round one lost by both
+            // writers in 20 of 20 races across two to five machines (2026-09-16). Same cost and same
+            // revisit condition as below.
             // Fine as it stands: since the torn-action fixes landed, an all-lose round costs one
             // retry cycle rather than wedging, and the contenders are separated next round by the
             // jittered backoff plus the aged retry priority carried on the re-pend
@@ -1644,13 +1685,49 @@ export class CoordinatorRepo {
             if (error instanceof ConflictRaceLostError) {
                 return { success: false, conflict: true, reason: error.message };
             }
-            const stale = await this.classifyStaleRejection(error, request, allBlockIds)
-                ?? await this.classifyPendingConflictRejection(error, request, allBlockIds);
+            if (error instanceof BlocksHeldError) {
+                return await this.answerBlocksHeld(error, request, allBlockIds, cohort.peerIds.length);
+            }
+            const stale = await this.classifyStaleRejection(error, request, allBlockIds);
             if (stale)
                 return stale;
             throw error;
         }
     }
+    /**
+     * The solo short-circuit of {@link pend}: a cohort of at most one peer runs no consensus, and the
+     * pend goes straight to local storage exactly as before. What changes is the answer's class —
+     * see {@link soloCohortDurability} for the four-way split. A refusal is returned untouched.
+     */
+    async pendSolo(request, cohort, options) {
+        const result = await this.storageRepo.pend(request, options);
+        return result.success ? { ...result, durability: this.soloCohortDurability(cohort) } : result;
+    }
+    /**
+     * The class of a write that took the solo short-circuit, from the cohort resolution that put it
+     * there. Policy-free: the write already happened, this only says what it was.
+     *  - not resolved (the lookup threw, or named nobody) → `unrouted`;
+     *  - resolved to exactly this node → `local`, a correct and complete one-machine write;
+     *  - resolved to exactly one peer that is NOT this node → `unrouted` — this node wrote somewhere
+     *    the cohort does not look, which is a write whose destination is wrong, not a solo write.
+     * With no local peer id (direct constructors, single-node and test wiring) a resolved cohort of
+     * one reads as `local`: the same posture `responsibilityFor` takes for a node with no
+     * identity, and a node with no identity cannot be in any cohort but its own.
+     *
+     * Both `unrouted` arms are defence in depth now, not the main guard: {@link verifyResponsibility}
+     * refuses a write whose lookup throws and a write for a cohort that excludes this node before the
+     * short-circuit is reached. A write lands here unrouted only inside the responsibility cache's
+     * staleness window, or when a second lookup fails moments after the first succeeded — and then it
+     * still reports honestly rather than posing as `local`.
+     */
+    soloCohortDurability(cohort) {
+        if (!cohort.resolved)
+            return unroutedDurability();
+        const sole = cohort.peerIds[0];
+        if (this.localPeerId !== undefined && sole !== this.localPeerId.toString())
+            return unroutedDurability();
+        return localDurability(sole);
+    }
     /**
      * Decide whether a cluster validator rejection was an optimistic-concurrency loss — the block
      * already advanced past the requested revision — rather than a genuine validation fault.
@@ -1722,51 +1799,56 @@ export class CoordinatorRepo {
             };
         }
         // NOTE: conservative — when only remote members saw the newer revision (local storage still
-        // behind), staleness can't be confirmed locally and the rejection stays a throw. If that
-        // shows up in practice, extend confirmation with a quorum read; never trust the reject text.
-        // `staleAt` is absent on this path for the same reason, and deliberately so — there is no
-        // confirmed number to report, and the field's contract forbids inferring one from that text.
+        // behind), staleness can't be confirmed locally and the rejection stays a throw. That revisit
+        // condition HAS now tripped, for this method's former sibling: the pending-conflict refusal hit
+        // exactly this window under delivery latency (the refusing member ahead of the coordinator) and
+        // escaped as a permanent-looking throw. Its cure was not the quorum read suggested here but a
+        // signed `held` vote — the member's own refusal, carried as evidence, so retryability stopped
+        // depending on a local re-read at all (see {@link answerBlocksHeld}).
+        //
+        // The stale arm is deliberately LEFT on local corroboration. Its refusal is a revision claim,
+        // and `staleAt` — the only place a losing writer learns the revision it lost to — can only be
+        // reported from a revision this node read itself. Moving it to a non-counting vote would take
+        // that number away, so it is its own ticket, not a rider on this one. Never trust the reject
+        // text; `staleAt` is absent on the unconfirmed path for the same reason, and deliberately so.
         return undefined;
     }
     /**
-     * Sibling of {@link classifyStaleRejection} for the OTHER optimistic-concurrency refusal shape:
-     * the promise-phase pending-conflict vote (`validatePendOperations` rejecting a pend whose
-     * blocks are held by a different unresolved pending action). That vote surfaces here as a
-     * {@link ValidatorRejectionError}, and without classification it would escape as a throw —
-     * splitting multi-tree pends mid-batch instead of taking the retry path a lost race deserves.
+     * Answer a pend the cohort refused with signed `held` votes: the blocks are reserved by a different
+     * unresolved action on one or more members ({@link BlocksHeldError}). Always a retryable
+     * {@link StaleFailure} with `conflict: true`, so the caller's normal retry path
+     * (`Collection.sync`, and the multi-collection pendPhase via `isConflictFailure`) absorbs it
+     * instead of a thrown error escaping mid-batch and splitting multi-tree pends.
      *
-     * Same confirmation discipline as the stale classifier: purely local. Re-read the affected
-     * blocks from our own storage and require some block's `state.pendings` to carry a rival
-     * actionId; the signed reject text is never consulted. A confirmed rival returns a
-     * {@link StaleFailure} with `conflict: true` and the rivals as `pending` (`ActionPending`
-     * without `transform` — the type allows it, and no consumer rebases from it). Unconfirmed —
-     * including read errors during confirmation — stays a throw, preserving fail-fast for genuine
-     * validation faults. Checked after `classifyStaleRejection` so a confirmed committed loss
-     * (which carries the sharper `staleAt`) wins when both hold.
+     * The local re-read is an ENRICHER, not a gate. It used to be the gate — this refusal arrived as a
+     * `ValidatorRejectionError` and was only converted when the coordinator's own storage corroborated
+     * the rival — and under latency the refusing member is routinely ahead of the coordinator, so the
+     * corroboration missed and a transient refusal escaped as a permanent-looking throw. The `held`
+     * vote is already signed evidence from the member that holds the rival, so retryability no longer
+     * depends on a local re-read at all. What the re-read still buys, when it succeeds, is the concrete
+     * rival list for {@link StaleFailure.pending} and the input {@link noteStuckReservation} needs to
+     * name a block wedged behind a reservation that will never clear.
+     *
+     * NOTE: `error.heldBy` (peerId → holding action id) is dropped at this boundary, the same deliberate
+     * drop the {@link ConflictRaceLostError} arm of {@link pendThroughCluster} documents: `StaleFailure`
+     * has no field for it, and the members' action ids are not the same claim as the rivals this node
+     * read out of its own storage, so they must not be folded into `pending`. A caller that wants to
+     * WAIT on the holder rather than re-race it needs a typed field added here; never recover the ids
+     * by parsing `reason`.
      */
-    async classifyPendingConflictRejection(error, request, blockIds) {
-        if (!(error instanceof ValidatorRejectionError))
-            return undefined;
-        let results;
-        try {
-            results = await this.storageRepo.get({ blockIds });
-        }
-        catch (readError) {
-            this.log('coordinator-repo:pend-conflict-classify-read-error', {
+    async answerBlocksHeld(error, request, blockIds, peerCount) {
+        const pending = await this.corroborateHeldBlocks(request, blockIds, peerCount);
+        if (pending.length === 0) {
+            // The member that refused is ahead of us — the normal shape under latency. Still a conflict:
+            // the refusal is signed, and the un-enriched answer is exactly the shape the lost-race arm
+            // returns. `noteStuckReservation` is deliberately not fed here; it counts refusals whose
+            // holder THIS node can name, and a guess would poison its holder comparison.
+            this.log('coordinator-repo:pend-held-uncorroborated', {
                 actionId: request.actionId,
-                error: readError.message
+                heldBy: error.heldBy
             });
-            return undefined;
-        }
-        const pending = [];
-        for (const blockId of blockIds) {
-            for (const actionId of results[blockId]?.state?.pendings ?? []) {
-                if (actionId !== request.actionId)
-                    pending.push({ blockId, actionId });
-            }
+            return { success: false, conflict: true, reason: error.message };
         }
-        if (pending.length === 0)
-            return undefined;
         // Counted as its own statement, never inside the log payload below: this call is the detection
         // mechanism, not a formatting step, and payload expressions in this repo are fair game to wrap
         // in an `enabled` gate (`Collection.advanceContext` does exactly that). A gate added there
@@ -1791,45 +1873,86 @@ export class CoordinatorRepo {
         };
     }
     /**
-     * Count one confirmed pending-conflict refusal against the holder(s) of each block it names, and say
-     * ONCE — in words, at the moment it becomes provable — when a block is wedged behind a reservation
-     * that is not going to clear.
-     *
-     * **Why this needs saying at all.** Every individual refusal here is indistinguishable from an
-     * ordinary lost race, which is a normal and healthy event, so the logs of a permanently wedged block
-     * read exactly like the logs of a busy one. Finding the difference today means noticing that the
-     * SAME rival action id keeps appearing across unrelated writers for as long as the process lives —
-     * a pattern nothing points at, and one that cost a downstream project several tickets and weeks to
-     * re-derive from raw traces. The node has the fact in hand at every refusal; this makes it sayable.
+     * The rival unresolved actions THIS node's own storage says hold `blockIds`, excluding the request's
+     * own action (a redelivered pend must not corroborate against itself). Empty when nothing is found
+     * — including when the read itself fails, which is reported and then treated as "nothing to add",
+     * since the caller's answer does not depend on it.
      *
-     * **The signal, and the two things that are NOT the signal.** The discriminator is repetition
-     * against an unchanged holder — see {@link STUCK_RESERVATION_DISTINCT_ACTIONS} for why distinct
-     * refused actions is the right counter and for the measured threshold. Two cheaper-looking tests
-     * were tried and do not work: the members' in-memory reservation table
-     * (`ClusterMember.activeTransactions`) clears the moment a rival's pend reaches consensus, so a
-     * perfectly healthy rival inside its pend-to-commit window is absent from it too and absence there
-     * says nothing; and "the block already passed this pending record's revision" catches a different
-     * orphan class entirely — in the verified instance the wedged block sat at revision 1 while the
-     * orphaned record was for revision 2, still nominally promotable.
+     * Carries no `transform`, which {@link ActionPending} allows and no consumer rebases from.
      *
-     * **Never a control path.** This classifies and logs; it never refuses, expires, or deletes
-     * anything. Deciding when a durable pending record may be removed is precisely the hard problem
-     * backlog `debt-unpromotable-pending-records-need-a-sweep` exists for — deleting a live reservation
-     * is worse than the leak — and a counter accurate enough for a log line is not evidence enough to
-     * destroy state.
+     * Diagnostic enrichment only, never a gate: the refusal it corroborates was already cast and signed
+     * by a member, and nothing here can turn an admission into a refusal or the reverse.
+     */
+    async corroborateHeldBlocks(request, blockIds, peerCount) {
+        const pending = [];
+        // The refusing member reads the request's base only in a cohort that can leave a member out
+        // (`ClusterMember.reservationRequestOf`); read it here under the same condition.
+        const readsBase = cohortCanMissAPend(peerCount, this.superMajorityThreshold);
+        try {
+            for (const blockId of blockIds) {
+                // The request's base for the block, read exactly as the refusing member read it (the
+                // malformed-base log line is that member's, so none is repeated here).
+                const reservation = readsBase
+                    ? reservationRequestFor(request, blockId, transformForBlockId(request.transforms, blockId)).request
+                    : { rev: request.rev };
+                for (const claim of await this.pendingClaimsOf(blockId)) {
+                    // The same rule, on the same inputs, as the refusing member (`isReservationAgainst`): a
+                    // record this request's writer has built on is not the rival it was refused on, and
+                    // naming it would feed a superseded action into the writer's `pending` list and into
+                    // the stuck-reservation holder comparison; and, where the base is read, a record
+                    // claiming a slot past the request's declared base IS one, even when the requested
+                    // revision has moved beyond it — the revision rule alone would leave that refusal
+                    // uncorroborated.
+                    if (claim.actionId !== request.actionId && isReservationAgainst(claim, reservation)) {
+                        pending.push({ blockId, actionId: claim.actionId });
+                    }
+                }
+            }
+        }
+        catch (readError) {
+            this.log('coordinator-repo:pend-conflict-classify-read-error', {
+                actionId: request.actionId,
+                error: readError.message
+            });
+            return [];
+        }
+        return pending;
+    }
+    /**
+     * This node's pending records on `blockId`, each with the slot it claims when storage can say
+     * (`IPendingClaimReader`, which `StorageRepo` implements). A repo without the capability answers
+     * with `state.pendings` alone, every record read as an unknown claim — which reserves, so the
+     * corroboration can only over-name, never under-name.
+     */
+    async pendingClaimsOf(blockId) {
+        const reader = this.storageRepo;
+        if (typeof reader.listPendingClaims === 'function') {
+            return await reader.listPendingClaims(blockId);
+        }
+        const results = await this.storageRepo.get({ blockIds: [blockId] });
+        return (results[blockId]?.state?.pendings ?? []).map(actionId => ({ actionId }));
+    }
+    /**
+     * Count one confirmed pending-conflict refusal against the holder(s) of each block it names, and say
+     * ONCE — in words, at the moment it becomes provable — when a block is wedged behind a reservation
+     * that is not going to clear. The counting, the threshold and the wording live in
+     * {@link StuckReservationTracker}; this node's part is the corroborated holder list and the tag.
      *
      * Returns the highest distinct-refusal count any of this refusal's blocks has now reached, for the
      * classification line to carry; it saturates at the threshold once an episode has been reported,
      * since the ids are dropped at that point.
      *
-     * NOTE: fed only by {@link classifyPendingConflictRejection}, i.e. by refusals that arrive as a
-     * cohort-wide validator rejection. A block only PART of whose cohort holds the stranded record can
+     * NOTE: fed only by {@link answerBlocksHeld}, i.e. by cohort-wide `held`-answered refusals that this
+     * node's own storage can corroborate. A block only PART of whose cohort holds the stranded record can
      * still reach approval super-majority, and its refusal then comes back through the retained local
-     * apply verdict (`getExecutedPendResult`) instead, which this never sees — so a partially wedged
-     * block goes unnamed. That is the weaker condition (the write does land on the healthy members),
-     * and instrumenting the second path would count a refusal that the cohort as a whole did not make.
-     * If partial strands ever turn out to be the common shape in the field, the counter belongs on the
-     * member side (`ClusterMember.validatePendOperations`), where each member sees its own votes.
+     * apply verdict (`getExecutedPendResult`) instead, which this never sees. The un-corroborated arm of
+     * {@link answerBlocksHeld} is likewise unfed: this node cannot name the holder, and feeding it a
+     * guess would poison the holder comparison, which is what separates a wedge from healthy
+     * contention. Neither gap goes unnamed any more: every MEMBER keeps its own tracker, fed by its own
+     * `held` votes (`ClusterMember.validatePendOperations`, tag `cluster-member:stuck-reservation`), so
+     * a reservation only some members hold — the shape `a-member-that-missed-a-commit-refuses-every-
+     * later-write` measured, before the member stopped refusing on a superseded record at all — is
+     * named by the members that hold it.
      */
     noteStuckReservation(pending, refusedActionId) {
         const rivalsByBlock = new Map();
@@ -1840,38 +1963,9 @@ export class CoordinatorRepo {
             else
                 rivalsByBlock.set(blockId, [actionId]);
         }
-        let highest = 0;
-        for (const [blockId, rivals] of rivalsByBlock) {
-            const holders = [...new Set(rivals)].sort();
-            const prior = this.stuckReservations.get(blockId);
-            // A different holder set is a DIFFERENT episode — the block changed hands, which is the
-            // healthy cycle — so the count starts over and the new holder gets its own chance to speak.
-            const watch = prior !== undefined && sameHolders(prior.holders, holders)
-                ? prior
-                : { holders, refused: new Set(), reported: false };
-            if (watch !== prior)
-                this.stuckReservations.set(blockId, watch);
-            if (watch.reported) {
-                highest = Math.max(highest, STUCK_RESERVATION_DISTINCT_ACTIONS);
-                continue;
-            }
-            watch.refused.add(refusedActionId);
-            highest = Math.max(highest, watch.refused.size);
-            if (watch.refused.size < STUCK_RESERVATION_DISTINCT_ACTIONS)
-                continue;
-            this.log('coordinator-repo:stuck-reservation', {
-                blockId,
-                // The ids an operator needs to grep for and to cancel, kept as data beside the prose so a
-                // log search finds the block and the action without parsing English.
-                holdingActionIds: holders,
-                distinctRefusedActions: watch.refused.size,
-                message: stuckReservationMessage(holders, watch.refused.size)
-            });
-            watch.reported = true;
-            // Said once per episode: from here the flag alone suppresses, and the ids have done their
-            // work (their count is in the line above), so drop them rather than growing a set for the
-            // unbounded remainder of a permanent condition.
-            watch.refused.clear();
+        const { highest, named } = this.stuckReservations.note(rivalsByBlock, refusedActionId);
+        for (const episode of named) {
+            this.log('coordinator-repo:stuck-reservation', episode);
         }
         return highest;
     }
@@ -1889,11 +1983,7 @@ export class CoordinatorRepo {
      * episode holding an LRU slot can only evict a live one.
      */
     clearStuckReservations(blockIds, holderActionId) {
-        for (const blockId of blockIds) {
-            if (holderActionId !== undefined && !this.stuckReservations.peek(blockId)?.holders.includes(holderActionId))
-                continue;
-            this.stuckReservations.delete(blockId);
-        }
+        this.stuckReservations.forget(blockIds, holderActionId);
     }
     async cancel(actionRef, options) {
         const blockIds = actionRef.blockIds;
@@ -1914,11 +2004,12 @@ export class CoordinatorRepo {
             //
             // NOTE: `getClusterSize` is a second `findCluster` for the same key that
             // `executeClusterTransaction` is about to look up again, so a cancel over N blocks now
-            // costs 2N cohort lookups instead of N. Same shape `pend` and `commit` already pay, but
-            // they pay it once (they only ever consult `blockIds[0]`) where this scales with N. Fine
-            // while cancels span a handful of blocks; if wide multi-block cancels ever show up hot,
-            // have `executeClusterTransaction` return the cohort it already fetched (or own the
-            // short-circuit itself) rather than adding a cache here.
+            // costs 2N cohort lookups instead of N. `pend` and `commit` pay the same doubled lookup
+            // for a multi-peer cohort, but theirs is CONSTANT — they only ever consult `blockIds[0]`
+            // — where this scales with N. Fine while cancels span a handful of blocks; if wide
+            // multi-block cancels ever show up hot, have `executeClusterTransaction` return the
+            // cohort it already fetched (or own the short-circuit itself) rather than adding a cache
+            // here.
             const results = await Promise.all(blockIds.map(async (blockId) => {
                 const peerCount = await this.coordinator.getClusterSize(blockId);
                 if (peerCount <= 1)
@@ -1945,57 +2036,17 @@ export class CoordinatorRepo {
     async commit(request, options) {
         const blockIds = request.blockIds;
         await this.verifyResponsibility(blockIds);
-        const cohortPeerIds = await this.coordinator.getClusterPeerIds(blockIds[0]);
-        const peerCount = cohortPeerIds.length;
-        if (peerCount <= 1) {
-            // Solo cohort: consensus never runs, so no ClusterRecord exists to project a proof from —
-            // the lone member self-signs a one-peer proof instead (mintSoloCommitProof), which is what
-            // lets a block born on a cohort of one ever gain a second holder under the certified-push
-            // default (handlePush refuses a proof-less block). Minted even when peerCount is 0 or the
-            // sole peer is not self — findCluster failing (getClusterPeerIds returns []) puts the
-            // DEGRADED-ROUTING case in this same branch, and self genuinely committed these bytes
-            // either way; a proof's peer list is already not evidence of cohort membership by design
-            // (caller obligation #1 on verifyBlockCommitProofClaim), so gating the mint on cohort
-            // composition would buy no safety while opening a silent no-proof hole exactly when
-            // routing is degraded. The log line is how an operator tells a real cohort of one
-            // (cohortSize 1, soleIsSelf true) from a routing failure (cohortSize 0, or a sole peer
-            // that is not this node).
-            this.log('commit:solo-cohort', {
-                blockId: blockIds[0],
-                cohortSize: peerCount,
-                soleIsSelf: peerCount === 1 && this.localPeerId !== undefined
-                    && cohortPeerIds[0] === this.localPeerId.toString()
-            });
-            // Same message shape the multi-peer path produces — executeClusterTransaction stamps
-            // coordinatingBlockIds at its choke point, so the solo artifact must carry it too or a
-            // solo proof's message is distinguishable from every other proof's.
-            const message = {
-                operations: [{ commit: request }],
-                coordinatingBlockIds: [blockIds[0]],
-                expiration: options?.expiration ?? Date.now() + this.DEFAULT_TIMEOUT
-            };
-            // `undefined` when no local cluster is wired (direct constructors, unit-test doubles) —
-            // then the commit lands proof-less, exactly the pre-mint behavior. The cast is the named
-            // ICommitProofPersister contract; a plain IRepo double ignores the extra argument.
-            const proof = await this.localCluster?.mintSoloCommitProof?.(message);
-            const result = await this.storageRepo.commit(request, options, proof);
-            // One self-approval arms the read-repair window only where the DECLARED cohort is also one
-            // — then no rival quorum can exist to be missed. At any larger declared size (including
-            // an undeclared one, which resolves to the replication factor, and including degraded
-            // routing where peerCount is 0) this commit proves nothing about rival quorums — see
-            // commitQuorumRulesOutRivals — so the window stays unarmed and the read path's
-            // solo-self-skip exit re-arms it once per consult instead (which keeps GitHub issue #8's
-            // consult storm bounded at one per window).
-            if (result.success && this.commitQuorumRulesOutRivals(1, peerCount))
-                this.markBlocksSeen(blockIds);
-            return result;
+        const cohort = await this.coordinator.resolveCohort(blockIds[0]);
+        if (!cohort.resolved || cohort.peerIds.length <= 1) {
+            return await this.commitSolo(request, blockIds, cohort, options);
         }
+        const peerCount = cohort.peerIds.length;
         const message = {
             operations: [{ commit: request }],
             expiration: options?.expiration ?? Date.now() + this.DEFAULT_TIMEOUT
         };
         try {
-            const { record, localExecuted, localCommitResult } = await this.coordinator.executeClusterTransaction(blockIds[0], message, options);
+            const { record, localExecuted, localCommitResult, cohortCommitOutcomes } = await this.coordinator.executeClusterTransaction(blockIds[0], message, options);
             // Decided once for every success shape below (local-executed, local fallback, tolerated
             // divergence): whether this commit's quorum is freshness evidence or merely a commit.
             // NOTE: one verdict covers every block in `blockIds`, though it is measured against
@@ -2004,20 +2055,54 @@ export class CoordinatorRepo {
             // quorum that never voted. If commits ever coordinate per-block cohorts separately (see
             // `debt-sender-side-coordinating-block-binding-is-unchecked`), this must follow them.
             const armFreshness = this.commitQuorumRulesOutRivals(countApprovingCommitVotes(record), peerCount);
+            // THE DURABILITY GATE. A commit is acknowledged to the writer only when more than half of
+            // the cohort it ran on (`record.peers`) reports that its storage durably holds the
+            // committed revision under this action, each member measured after its own reconcile.
+            // Consensus votes are necessary for the commit to be authoritative; they were never
+            // evidence that it was stored — every member can sign, then refuse at apply (no base for
+            // the block, a missed pend), and the coordinator used to count the votes as success. The
+            // same strict majority `clusterReachedCommitConsensus` measures votes against; the
+            // freshness verdict above stays tied to the vote count, the two quorums are not
+            // conflated. Other members' reports arrive as `cohortCommitOutcomes`; this node's own
+            // member is added per arm below — its retained verdict when it executed, its fallback
+            // commit when it did not.
+            //
+            // NOTE: a refusal here means "not confirmed durable at a quorum", never "guaranteed
+            // absent" — the two-phase ambiguity. Members that refused with `missing-base-revision`
+            // have already dropped their pending records, so the writer must cancel and re-drive at a
+            // fresh revision, which is what the `conflict: true` shape makes `Collection.syncAttempts`
+            // and the multi-collection `pendPhase` do. But a member reached only by
+            // `scheduleCommitRetry` can still land the refused revision later, and this node's own
+            // member (or its fallback commit) may hold it already. When the refused block is the
+            // action's LOG TAIL, that matters beyond this block: `NetworkTransactor.commit` stops at a
+            // refused tail and never sweeps the action's other blocks, so the writer can then read
+            // its own log entry back while none of the data it describes was committed anywhere.
+            // The writer's retry with the SAME action id is what converges that, and only because it
+            // does two things: `isOwnRevision` in `StorageRepo.pend` and `commit` treats an
+            // already-landed own revision as satisfied, and `Collection.completeOwnEntry` — on
+            // finding that entry — re-sends the refused attempt at the same revision to land the
+            // blocks left behind BEFORE the write is reported saved. Seeing its own log entry is
+            // never, on its own, the writer's proof of durability.
+            const durability = cohortDurability(record, cohortCommitOutcomes);
             if (localExecuted) {
                 // Our own member applied this commit during consensus. Its retained storage verdict is
                 // the one honest signal we have about durability: the member-side apply tolerates an
-                // "ahead" refusal as divergence (see the NOTE in ClusterMember.applyConsensusOperation),
+                // "ahead" refusal as divergence (see the NOTE in ClusterMember.applyCommitToStorage),
                 // which is correct for a redelivered or lagging commit — but when the refusal's real
-                // cause is a RIVAL action holding the requested revision, that tolerance turns a commit
-                // no member durably stored into a fabricated success. This is the
+                // cause is a RIVAL action holding the requested revision, that tolerance would turn a
+                // commit no member durably stored into a fabricated success. This is the
                 // signed-but-not-yet-applied window: two commits for one revision can BOTH assemble
                 // consensus when every member signs the second after signing (but before applying) the
                 // first, because signing drops the member's reservation. Confirm the rival against local
                 // storage (never the verdict's prose) and answer the writer with a retryable conflict so
-                // it re-drives at a fresh revision. Own-action or unconfirmed refusals keep the
-                // prior fabricated-success shape: consensus is authoritative and this member converges
-                // via replication.
+                // it re-drives at a fresh revision. An own-action confirmation only clears the conflict
+                // answer; it does NOT make this node a holder for the gate below. The confirmation fires
+                // on the FIRST block found held under this action, and a multi-block commit torn locally
+                // (`StorageRepo.commit` lands blocks in order and stops at the first refusal) holds some
+                // blocks and not others — whereas the member's retained verdict is already a success
+                // whenever EVERY block is held (`ClusterMember.durableCommitVerdict`, measured after its
+                // reconcile). So the retained verdict is the only local contribution the gate counts;
+                // a refused one, confirmed or not, leaves it to the rest of the cohort.
                 //
                 // NOTE: a CONFIRMED rival is trusted over the consensus outcome here. That is right in
                 // the window this closes (the cohort refused the loser too), but it inverts if the two
@@ -2028,6 +2113,7 @@ export class CoordinatorRepo {
                 // after a fork; that is partition-healing scope (docs/partition-healing.md). If forks
                 // are ever observed here, weigh the retained verdict against the cohort's votes instead
                 // of trusting the local re-read alone.
+                const localDurable = localCommitResult?.success === true;
                 if (localCommitResult !== undefined && !localCommitResult.success) {
                     const rival = await this.confirmCommitRivalAgainstLocal(request);
                     if (typeof rival === 'object')
@@ -2038,23 +2124,45 @@ export class CoordinatorRepo {
                         reason: localCommitResult.reason
                     });
                 }
+                // An absent verdict (a member that predates retention, a restart, the TTL) is not
+                // evidence of holding anything: it is simply not counted — so the class below reads
+                // LOWER than reality for such a member, never higher.
+                const durableHolders = durability.remoteHolders.length + (localDurable ? 1 : 0);
+                if (!isDurableMajority(durableHolders, durability.cohortPeerIds.length)) {
+                    return this.refuseCommitNotDurable(request, durableHolders, durability, 'local-executed');
+                }
                 if (armFreshness)
                     this.markBlocksSeen(blockIds);
-                return { success: true };
+                return await this.acknowledgeCommit(request, { success: true, durability: this.cohortWriteDurability(durability, localDurable) }, localDurable, record);
             }
             // Local cluster didn't execute during consensus. Attempt a local commit, but tolerate
-            // local divergence when the cluster already reached consensus — this coordinator was
-            // likely picked for commit after missing the pend phase (unreachable during pend, fresh
-            // join, etc.). The cluster's majority is authoritative; this peer catches up via sync.
+            // local divergence when the cluster already reached consensus AND a durable majority of
+            // the cohort reports holding the revision — this coordinator was likely picked for commit
+            // after missing the pend phase (unreachable during pend, fresh join, etc.), and it catches
+            // up via replication.
             //
-            // Divergence reaches us in BOTH shapes and both must be tolerated identically:
+            // Divergence reaches us in BOTH shapes and both are handled identically:
             //   - a THROW ("Pending action … not found"), when we never saw the pend;
             //   - a RETURNED `success:false` carrying `missing-base-revision`, when we saw the pend
             //     but not the revision that created the block (see StorageRepo.internalCommit).
-            // Only the throw was tolerated before the refusal existed. Reporting the refusal to the
-            // caller instead would surface a committed transaction as a stale loss: db-core's
-            // commitPhase treats any returned `success:false` as a permanent stale failure, so the
-            // client would retry an action the cluster already landed until it exhausted its budget.
+            // Reporting a tolerated divergence to the caller as the raw refusal would surface a
+            // committed transaction as a stale loss: db-core's commitPhase treats any returned
+            // `success:false` as a stale loss, and its coordinator re-drives the refused collection
+            // (alone, even after a sibling collection committed) until its retry budget is spent. So
+            // a divergence on a durable majority is reported as success, and one WITHOUT a durable
+            // majority as the durability gate's retryable refusal (`tolerateLocalCommitDivergence`),
+            // which that re-drive is what clears.
+            //
+            // The gate is evaluated BEFORE the local fallback commit, and a failing gate skips it.
+            // This node counts toward the majority only when it is in the cohort the commit ran on;
+            // an off-cohort coordinator's copy is a lone holder no cohort member will ever reconcile
+            // from (members reconcile from `record.peers`), and a refused commit must not create one —
+            // that lone off-cohort copy is exactly the seed of the "revision exists on one node that
+            // is not responsible for it" placement the durability gate exists to prevent.
+            const selfInCohort = this.localPeerId !== undefined && this.localPeerId.toString() in record.peers;
+            if (!isDurableMajority(durability.remoteHolders.length + (selfInCohort ? 1 : 0), durability.cohortPeerIds.length)) {
+                return this.refuseCommitNotDurable(request, durability.remoteHolders.length, durability, 'fallback-skipped');
+            }
             //
             // Deliberately NOT self-signed here (unlike the solo short-circuit above): consensus for
             // this commit ran on the cohort, so a one-peer minted proof would be a FALSE statement
@@ -2068,18 +2176,24 @@ export class CoordinatorRepo {
             try {
                 const result = await this.storageRepo.commit(request, options, consensusProof);
                 if (result.success) {
+                    // The gate above already admitted this shape: the remote holders plus this node
+                    // (when it is in the cohort) form the majority, and this node now holds it.
+                    // Storage's own `local` answer is replaced by the cohort's — this node counts exactly
+                    // as the gate counted it, i.e. only when it is a cohort member.
                     if (armFreshness)
                         this.markBlocksSeen(blockIds);
-                    return result;
+                    // The fallback commit landed every block, so this node holds them — whether or not
+                    // it is a cohort member — and can source a push to whoever the class names as missing.
+                    return await this.acknowledgeCommit(request, { ...result, durability: this.cohortWriteDurability(durability, selfInCohort) }, true, record);
                 }
                 if (isMissingBaseRevisionFailure(result) && clusterReachedCommitConsensus(record)) {
-                    return this.tolerateLocalCommitDivergence(request, blockIds, result.reason ?? MISSING_BASE_REVISION_REASON, armFreshness);
+                    return await this.tolerateLocalCommitDivergence(request, blockIds, result.reason ?? MISSING_BASE_REVISION_REASON, armFreshness, durability);
                 }
                 return result;
             }
             catch (err) {
                 if (clusterReachedCommitConsensus(record)) {
-                    return this.tolerateLocalCommitDivergence(request, blockIds, err.message, armFreshness);
+                    return await this.tolerateLocalCommitDivergence(request, blockIds, err.message, armFreshness, durability);
                 }
                 throw err;
             }
@@ -2224,20 +2338,294 @@ export class CoordinatorRepo {
         };
     }
     /**
-     * Report success for a commit the cluster carried but this peer could not apply locally.
-     * Convergence comes from replication (cohort reconcile, or read-driven acquisition), not from
-     * replay here. `armFreshness` says whether the commit's quorum was strong enough
-     * ({@link commitQuorumRulesOutRivals}) for the read path to treat the blocks as
-     * freshness-checked; a divergence tolerated on a downsized quorum leaves the window unarmed —
-     * this peer is known to be behind here, the last place a self-referential freshness stamp
-     * belongs.
+     * A commit the cluster carried but this peer could not apply locally. Reported as success only
+     * when a durable majority of the OTHER cohort members holds it (this node, having diverged, is
+     * not a holder) — convergence then comes from replication (cohort reconcile, or read-driven
+     * acquisition), not from replay here. Without that majority it is the durability gate's
+     * retryable refusal: nothing is known to hold the revision. `armFreshness` says whether the
+     * commit's quorum was strong enough ({@link commitQuorumRulesOutRivals}) for the read path to
+     * treat the blocks as freshness-checked; a divergence tolerated on a downsized quorum leaves the
+     * window unarmed — this peer is known to be behind here, the last place a self-referential
+     * freshness stamp belongs.
      */
-    tolerateLocalCommitDivergence(request, blockIds, detail, armFreshness) {
+    async tolerateLocalCommitDivergence(request, blockIds, detail, armFreshness, durability) {
+        if (!isDurableMajority(durability.remoteHolders.length, durability.cohortPeerIds.length)) {
+            return this.refuseCommitNotDurable(request, durability.remoteHolders.length, durability, `fallback-diverged: ${detail}`);
+        }
         this.log('coordinator-repo:commit-local-failed-cluster-succeeded', { actionId: request.actionId, error: detail });
         if (armFreshness)
             this.markBlocksSeen(blockIds);
-        return { success: true };
+        // This node holds nothing: it is an UNCONFIRMED member when it is in the cohort (so the class
+        // is `majority`), and simply absent from the count when it is not (so the class can be `full`
+        // when every member confirmed). Both fall out of the one rule in `cohortWriteDurability`.
+        // Holding nothing, it is also no source for a push, so no shortfall is recorded here.
+        return await this.acknowledgeCommit(request, { success: true, durability: this.cohortWriteDurability(durability, false) }, false);
+    }
+    /**
+     * The one way a success leaves {@link commit}: record the replication shortfall the answer
+     * describes, then return the answer unchanged. Every success exit — solo, local-executed, local
+     * fallback, tolerated divergence — runs after the durability gate admitted it, so a refused
+     * commit never reaches the ledger.
+     *
+     * `localHolds` is whether this node's own storage durably holds every block of the commit, which
+     * is what makes it a source for the missing copies — not whether the class counted it. `record`
+     * is the consensus the commit ran on, absent for the solo short-circuit (no cohort ran, so no
+     * holders to report).
+     */
+    async acknowledgeCommit(request, answer, localHolds, record) {
+        if (localHolds && record !== undefined)
+            this.reportCommittedHolders(request, answer.durability, record);
+        await this.noteReplicationShortfall(request, answer.durability, localHolds);
+        return answer;
+    }
+    /**
+     * Tell the {@link CommittedHoldersSink} who holds a cohort commit this node holds, so its rebalance
+     * monitor does not push the blocks back to members that stored them. A holder is a member the
+     * durability class confirmed AND that signed an approving commit vote: the confirmation rests on
+     * the member's unsigned apply report, and requiring the signature too means a member lying in that
+     * report can only misstate its own copy — a member already trusted with the commit. The members
+     * the class names unconfirmed are reported as such, which withdraws any earlier record of them
+     * (including the signer list this node's own member reported at apply), so they are pushed the
+     * block. Never throws: the commit is already acknowledged.
+     */
+    reportCommittedHolders(request, durability, record) {
+        if (!this.onCommittedHolders)
+            return;
+        const self = this.localPeerId?.toString();
+        const unconfirmed = durability.unconfirmed ?? [];
+        const holders = (durability.cohortPeerIds ?? [])
+            .filter(peerId => !unconfirmed.includes(peerId))
+            .filter(peerId => peerId === self || record.commits[peerId]?.type === 'approve');
+        try {
+            this.onCommittedHolders({ blockIds: request.blockIds, holders, unconfirmed });
+        }
+        catch (err) {
+            this.log('coordinator-repo:committed-holders-sink-error', { actionId: request.actionId, error: err.message });
+        }
+    }
+    /**
+     * Write down who is still missing an acknowledged commit, while this node still knows — the
+     * cohort's answer is gone the moment the writer is answered, and the in-memory commit retry does
+     * not survive a restart. One entry per block, all sharing this commit's one cohort answer
+     * (consensus ran on `blockIds[0]`'s cohort for the whole request):
+     * - `full` settles any older entry for the block, whether or not this node holds it;
+     * - `majority` records the unconfirmed members by name;
+     * - `local` and `unrouted` record an EMPTY missing set, meaning "unknown" — nobody could be named.
+     * A shortfall is recorded only when `localHolds`: a node holding nothing has nothing to push, and
+     * the remote majority that admitted the commit already holds it.
+     *
+     * NEVER throws, and that asymmetry is deliberate: by the time this runs the commit is already
+     * durable at the class the answer states, so a ledger fault must not turn an acknowledged write
+     * into a reported failure. A failure is logged per block and the answer still goes out; the
+     * block's copy is then owed with nobody tracking it, exactly as before the ledger existed.
+     *
+     * NOTE: one ledger read and write per block per below-full commit, awaited before the writer is
+     * answered — on a node that is genuinely alone that is every commit (a `full` commit settles from
+     * the ledger's in-memory index and touches the store only when an entry exists). If it shows in
+     * commit latency, coalesce the writes rather than answering first: an entry written after the
+     * answer can be lost to a crash in between, which is the one case the ledger exists for.
+     */
+    async noteReplicationShortfall(request, durability, localHolds) {
+        const ledger = this.underReplicationLedger;
+        if (ledger === undefined)
+            return;
+        // Blocks a torn commit abandoned were cancelled and hold nothing at this revision: there is no
+        // copy to push, and an entry would have a drain repeatedly read a block that is not there.
+        // No answer built in this class names `torn` today — the writer's transactor derives it after
+        // every coordinator has answered — so this guards against a future producer, not a current one.
+        const torn = new Set(durability.torn ?? []);
+        const blockIds = request.blockIds.filter(blockId => !torn.has(blockId));
+        const outcomes = await Promise.allSettled(blockIds.map(blockId => this.noteBlockShortfall(ledger, request, blockId, durability, localHolds)));
+        outcomes.forEach((outcome, i) => {
+            if (outcome.status === 'fulfilled')
+                return;
+            this.log('coordinator-repo:under-replication-record-failed', {
+                actionId: request.actionId,
+                blockId: blockIds[i],
+                rev: request.rev,
+                quorum: durability.quorum,
+                error: outcome.reason instanceof Error ? outcome.reason.message : String(outcome.reason)
+            });
+        });
+    }
+    async noteBlockShortfall(ledger, request, blockId, durability, localHolds) {
+        if (durability.quorum === 'full') {
+            await ledger.settle(blockId, request.rev);
+            return;
+        }
+        if (!localHolds)
+            return;
+        await ledger.record({
+            blockId,
+            rev: request.rev,
+            actionId: request.actionId,
+            quorum: durability.quorum,
+            missingPeerIds: durability.quorum === 'majority' ? durability.unconfirmed ?? [] : [],
+            recordedAt: this.now(),
+            attempts: 0
+        });
+    }
+    /**
+     * The durability class beside the gate: derived from the SAME sets {@link isDurableMajority} was
+     * just measured on, with this node's own contribution passed per arm exactly as the gate counted
+     * it, so the class and the gate can never disagree. One rule for all three success exits of
+     * {@link commit}: `full` iff every cohort member is confirmed, otherwise `majority` (the gate
+     * already refused anything below that). Never `local` or `unrouted` here — those belong to the
+     * solo short-circuit, where no cohort ran.
+     */
+    cohortWriteDurability(durability, selfHolds) {
+        return cohortWriteDurability(durability, selfHolds, this.localPeerId?.toString());
+    }
+    /**
+     * The solo short-circuit of {@link commit}: consensus never runs, so no ClusterRecord exists to
+     * project a proof from — the lone member self-signs a one-peer proof instead (mintSoloCommitProof),
+     * which is what lets a block born on a cohort of one ever gain a second holder under the
+     * certified-push default (handlePush refuses a proof-less block). Minted even when the cohort did
+     * not resolve or the sole peer is not self — a failed `findCluster` puts the DEGRADED-ROUTING case
+     * in this same branch, and self genuinely committed these bytes either way; a proof's peer list is
+     * already not evidence of cohort membership by design (caller obligation #1 on
+     * verifyBlockCommitProofClaim), so gating the mint on cohort composition would buy no safety while
+     * opening a silent no-proof hole exactly when routing is degraded.
+     *
+     * The policy is unchanged — every write accepted here before is accepted now. What changes is
+     * that the answer says which situation it was: the `commit:solo-cohort` log line (how an operator
+     * tells a real cohort of one — cohortSize 1, soleIsSelf true — from a routing failure) now also
+     * carries the `quorum` the writer is told, and both come from {@link soloCohortDurability}, so the
+     * log and the answer cannot disagree.
+     */
+    async commitSolo(request, blockIds, cohort, options) {
+        const cohortPeerIds = cohort.resolved ? cohort.peerIds : [];
+        const peerCount = cohortPeerIds.length;
+        const soloDurability = this.soloCohortDurability(cohort);
+        this.log('commit:solo-cohort', {
+            blockId: blockIds[0],
+            cohortSize: peerCount,
+            soleIsSelf: peerCount === 1 && this.localPeerId !== undefined
+                && cohortPeerIds[0] === this.localPeerId.toString(),
+            quorum: soloDurability.quorum,
+            ...(cohort.resolved ? {} : { reason: cohort.reason })
+        });
+        // Same message shape the multi-peer path produces — executeClusterTransaction stamps
+        // coordinatingBlockIds at its choke point, so the solo artifact must carry it too or a
+        // solo proof's message is distinguishable from every other proof's.
+        const message = {
+            operations: [{ commit: request }],
+            coordinatingBlockIds: [blockIds[0]],
+            expiration: options?.expiration ?? Date.now() + this.DEFAULT_TIMEOUT
+        };
+        // `undefined` when no local cluster is wired (direct constructors, unit-test doubles) —
+        // then the commit lands proof-less, exactly the pre-mint behavior. The cast is the named
+        // ICommitProofPersister contract; a plain IRepo double ignores the extra argument.
+        const proof = await this.localCluster?.mintSoloCommitProof?.(message);
+        const result = await this.storageRepo.commit(request, options, proof);
+        if (!result.success)
+            return result;
+        // One self-approval arms the read-repair window only where the DECLARED cohort is also one
+        // — then no rival quorum can exist to be missed. At any larger declared size (including
+        // an undeclared one, which resolves to the replication factor, and including degraded
+        // routing where peerCount is 0) this commit proves nothing about rival quorums — see
+        // commitQuorumRulesOutRivals — so the window stays unarmed and the read path's
+        // solo-self-skip exit re-arms it once per consult instead (which keeps GitHub issue #8's
+        // consult storm bounded at one per window).
+        if (this.commitQuorumRulesOutRivals(1, peerCount))
+            this.markBlocksSeen(blockIds);
+        return await this.acknowledgeCommit(request, { ...result, durability: soloDurability }, true);
     }
+    /**
+     * The durability gate's answer: a retryable refusal ({@link COMMIT_NOT_DURABLE_REASON}) naming how
+     * many of the cohort reported holding the revision. `conflict: true` because the members that
+     * refused have dropped their pending records, so the writer's only way forward is to cancel and
+     * re-drive at a fresh revision — the path a conflict-shaped answer already puts it on. The
+     * read-repair window is deliberately NOT armed: nothing about this commit is freshness evidence.
+     */
+    refuseCommitNotDurable(request, durableHolders, durability, arm) {
+        const cohortSize = durability.cohortPeerIds.length;
+        this.log('coordinator-repo:commit-not-durable', {
+            actionId: request.actionId,
+            rev: request.rev,
+            durableHolders,
+            cohortSize,
+            remoteHolders: durability.remoteHolders,
+            remoteRefusals: durability.remoteRefusals,
+            arm
+        });
+        // A failure carries no durability, and no "unknown" class stands in for one.
+        return {
+            success: false,
+            conflict: true,
+            reason: `${COMMIT_NOT_DURABLE_REASON}: ${durableHolders} of ${cohortSize} cohort member(s) report holding rev ${request.rev} of action ${request.actionId} (${arm})`
+        };
+    }
+}
+function cohortDurability(record, outcomes) {
+    const reports = Object.entries(outcomes ?? {});
+    return {
+        cohortPeerIds: Object.keys(record.peers),
+        remoteHolders: reports.filter(([, report]) => report.success).map(([peerId]) => peerId),
+        remoteRefusals: reports.filter(([, report]) => !report.success).map(([peerId]) => peerId)
+    };
+}
+/**
+ * The commit-tier durability class, from the gate's own sets. `confirmed` is counted exactly as the
+ * gate counted it (remote holders, plus one for this node when `selfHolds`), and `unconfirmed` is
+ * every cohort member outside that set — so a `full` answer names nobody as missing, and a
+ * `majority` answer names exactly who. The class is `full` iff no cohort member is unconfirmed;
+ * anything below `majority` never reaches here (the gate refused it).
+ */
+function cohortWriteDurability(durability, selfHolds, selfPeerId) {
+    const holders = new Set(durability.remoteHolders);
+    if (selfHolds && selfPeerId !== undefined)
+        holders.add(selfPeerId);
+    const unconfirmed = durability.cohortPeerIds.filter(peerId => !holders.has(peerId));
+    return {
+        quorum: unconfirmed.length === 0 ? 'full' : 'majority',
+        confirmed: durability.remoteHolders.length + (selfHolds ? 1 : 0),
+        cohort: durability.cohortPeerIds.length,
+        unconfirmed,
+        cohortPeerIds: durability.cohortPeerIds
+    };
+}
+/**
+ * The pend-tier durability class: who ACCEPTED the pending record, read off the record's approving
+ * promise votes. This node's own member is added when `selfAccepted` is true, removed when it is
+ * false (its member applied and refused, so its approve vote no longer describes what it holds),
+ * and left to its vote when `undefined` (no retained verdict — the vote is the only evidence there
+ * is). This node counts only when it is IN the cohort, as the commit tier counts it: a coordinator
+ * outside `record.peers` whose fallback pend landed holds a copy no cohort member will ever look
+ * for, and counting it would let `confirmed` exceed `cohort`. NOT comparable to the commit-tier
+ * count: accepting a pending record confers no storage durability, and the field's own
+ * documentation says so.
+ * NOTE: a REMOTE member's vote is never withdrawn here. The pend arm of `ClusterRecord.applyOutcomes`
+ * reports only conflict-shaped refusals (which downgrade the whole pend to a retryable conflict
+ * before this runs), so a remote member that promised and then faulted at apply keeps its approve
+ * vote and a pend's `full` can overstate by that member. Harmless while nothing reads a pend's
+ * class for repair; if that changes, widen the member's report to carry bare faults too.
+ */
+function pendCohortDurability(record, selfAccepted, selfPeerId) {
+    const cohortPeerIds = Object.keys(record.peers);
+    const accepted = new Set(Object.entries(record.promises).filter(([, vote]) => vote.type === 'approve').map(([peerId]) => peerId));
+    if (selfPeerId !== undefined && cohortPeerIds.includes(selfPeerId)) {
+        if (selfAccepted === true)
+            accepted.add(selfPeerId);
+        if (selfAccepted === false)
+            accepted.delete(selfPeerId);
+    }
+    const unconfirmed = cohortPeerIds.filter(peerId => !accepted.has(peerId));
+    return {
+        quorum: unconfirmed.length === 0 ? 'full' : 'majority',
+        confirmed: accepted.size,
+        cohort: cohortPeerIds.length,
+        unconfirmed,
+        cohortPeerIds
+    };
+}
+/**
+ * The durability gate's rule: a STRICT majority of the cohort the commit ran on — the same majority
+ * {@link clusterReachedCommitConsensus} measures votes against, applied to durable holders instead
+ * of approving votes.
+ */
+function isDurableMajority(durableHolders, cohortSize) {
+    return cohortSize > 0 && durableHolders > cohortSize / 2;
 }
 /** True if a simple majority of cluster peers signed an approving commit. */
 function clusterReachedCommitConsensus(record) {