@optimystic/db-p2p 1.0.0-beta.2 → 1.0.0

package/dist/src/cluster/cluster-repo.js

@@ -1,4 +1,4 @@
-import { blockIdsForTransforms, isOwnRevision, isConflictFailure, DEFAULT_SUPER_MAJORITY_THRESHOLD } from "@optimystic/db-core";
+import { blockIdsForTransforms, transformForBlockId, isOwnRevision, isConflictFailure, DEFAULT_SUPER_MAJORITY_THRESHOLD, localDurability } from "@optimystic/db-core";
 import { computeClusterCommitHash, computeClusterMessageHash, computeClusterPromiseHash, membershipDigest, recordMembershipDigest, clusterVoteSigningPayload, clusterVoteVerificationPayload } from "@optimystic/db-core";
 import { verifyInvalidationCertificate } from "../dispute/invalidation.js";
 import { buildCommitCert, invalidationActionId } from "./commit-cert.js";
@@ -10,6 +10,8 @@ import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } fr
 import { createLogger } from '../logger.js';
 import { PenaltyReason } from "../reputation/types.js";
 import { isMissingBaseRevisionFailure } from "../storage/storage-repo.js";
+import { isReservationAgainst, reservationRequestFor, cohortCanMissAPend } from "../storage/pending-claim.js";
+import { StuckReservationTracker } from "../repo/stuck-reservation.js";
 import { checkPendValidation } from "../pend-validation.js";
 import { getAffectedBlockIds } from "./record-operations.js";
 import { operationsConflict, resolveRace } from "./race-resolution.js";
@@ -28,6 +30,19 @@ var TransactionPhase;
     TransactionPhase[TransactionPhase["ConflictSuperseded"] = 6] = "ConflictSuperseded";
     TransactionPhase[TransactionPhase["Propagating"] = 7] = "Propagating"; // Transaction is being propagated
 })(TransactionPhase || (TransactionPhase = {}));
+/** A refusal that judges the record invalid — the permanent kind, and every kind but the pending-conflict one. */
+function invalidVerdict(reason) {
+    return { valid: false, kind: 'invalid', reason };
+}
+/**
+ * Widen a boolean-plus-prose check into a {@link PromiseVerdict}. Every check written this way judges
+ * validity, so its refusal is the permanent kind; only the pending-conflict branch of
+ * {@link ClusterMember.validatePendOperations} produces the transient one, and it builds its verdict
+ * directly.
+ */
+function verdictOf(result) {
+    return result.valid ? { valid: true } : invalidVerdict(result.reason);
+}
 /** Stable reject reason a member emits when a declared peer set fails the membership admission gate. */
 export const MEMBERSHIP_NOT_ADMITTED = 'membership-not-admitted';
 /**
@@ -37,6 +52,13 @@ export const MEMBERSHIP_NOT_ADMITTED = 'membership-not-admitted';
  * so the rejection itself is integrity-protected.
  */
 export const CONTENT_DIGEST_MISMATCH = 'content-digest-mismatch';
+/**
+ * Stable reject reason a member emits when a commit declares, for a block, a base revision
+ * (`CommitRequest.blockDigests[id].baseRev`) other than the one the same action's pend carried to
+ * this member (`PendRequest.baseRevs`, kept with the pending record) — see
+ * `ClusterMember.validateCommitBaseDeclarations`. Signed like its sibling above.
+ */
+export const BASE_DECLARATION_DISAGREES = 'base-declaration-disagrees';
 /**
  * The two stable reject reasons a validator-configured member emits from the shared
  * {@link checkPendValidation}: `PEND_NOT_VALIDATABLE` for a pend carrying no `validation` payload
@@ -46,7 +68,7 @@ export const CONTENT_DIGEST_MISMATCH = 'content-digest-mismatch';
  */
 export { PEND_NOT_VALIDATABLE, VALIDATOR_FAULT } from "../pend-validation.js";
 export function clusterMember(components) {
-    return new ClusterMember(components.storageRepo, components.peerNetwork, components.peerId, components.privateKey, components.protocolPrefix, components.partitionDetector, components.fretService, components.validator, components.reputation, components.consensusConfig, components.stateStore, components.reconcileBlock, components.onCommitCertificate, components.onInvalidate, components.recomputeArbitratorSet, components.deriveExpectedCluster, components.now);
+    return new ClusterMember(components.storageRepo, components.peerNetwork, components.peerId, components.privateKey, components.protocolPrefix, components.partitionDetector, components.fretService, components.validator, components.reputation, components.consensusConfig, components.stateStore, components.reconcileBlock, components.onCommitCertificate, components.onInvalidate, components.recomputeArbitratorSet, components.deriveExpectedCluster, components.now, components.onCommittedHolders);
 }
 // How long to keep executed transaction records (10 minutes)
 const ExecutedTransactionTtlMs = 10 * 60 * 1000;
@@ -90,6 +112,7 @@ export class ClusterMember {
     onInvalidate;
     recomputeArbitratorSet;
     deriveExpectedCluster;
+    onCommittedHolders;
     // Track active transactions by their message hash
     activeTransactions = new Map();
     // Track executed consensus transactions to prevent duplicate execution (messageHash -> executedAt timestamp)
@@ -99,13 +122,17 @@ export class ClusterMember {
     // a pend that every member refused (rival pending action, or the revision already taken) must
     // reach the writer as a conflict, not a win. Pruned alongside executedTransactions (same TTL).
     executedPendResults = new Map();
-    // Local storage's verdict for a COMMIT operation applied during consensus (messageHash ->
-    // CommitResult). Retained so the coordinator can detect when the ahead-divergence tolerance in
+    // This member's POST-RECONCILE durable verdict for a COMMIT operation applied during consensus
+    // (messageHash -> CommitResult): whether local storage holds the committed revision under the
+    // record's action once the apply — and any behind-reconcile it triggered — has run. Two readers,
+    // which must see the same answer: the coordinating node reads its own member's directly
+    // (getExecutedCommitResult), every other member's reaches the coordinator on the response record
+    // (withOwnApplyOutcome → ClusterRecord.applyOutcomes[peer].commit). Together they feed the
+    // durability gate in CoordinatorRepo.commit, which acknowledges a commit only when a majority of
+    // the cohort reports holding it — consensus votes were never evidence of storage. A retained
+    // refusal also lets the coordinator detect when the ahead-divergence tolerance in
     // applyConsensusOperation swallowed a refusal whose real cause was a RIVAL action holding the
-    // requested revision — the commit-tier acknowledgement hole: a commit that assembled consensus
-    // inside every member's signed-but-not-yet-applied window is refused by every member's storage
-    // at apply, and without this verdict the coordinator fabricates a success no member durably
-    // stored. Pruned alongside executedTransactions (same TTL).
+    // requested revision. Pruned alongside executedTransactions (same TTL).
     executedCommitResults = new Map();
     // Conflict-shaped pend refusals this member's storage produced at consensus-apply, keyed by the
     // refused action's id rather than by messageHash. The messageHash-keyed map above cannot serve the
@@ -120,6 +147,14 @@ export class ClusterMember {
     // inside the sink); this map only spares redundant work when the same invalidation reaches
     // consensus twice (rebroadcast / sync) under different message hashes. (-> appliedAt timestamp)
     appliedInvalidations = new Map();
+    /**
+     * Per block, what this member's own `held` votes have added up to — the member-side instance of
+     * the counter `CoordinatorRepo.noteStuckReservation` keeps from the coordinator's vantage. Fed by
+     * every `held` verdict {@link validatePendOperations} casts, so a reservation only THIS member
+     * holds (one the coordinator's storage cannot corroborate) is still named, once, where the record
+     * lives. Forgotten for a block the moment a vote finds it no longer reserved.
+     */
+    stuckReservations = new StuckReservationTracker(1000);
     // Queue of transactions to clean up
     cleanupQueue = [];
     // Serialize concurrent updates for the same transaction
@@ -155,7 +190,7 @@ export class ClusterMember {
     now;
     constructor(storageRepo, peerNetwork, peerId, privateKey, protocolPrefix, 
     // Reserved for partition-healing (backlog ticket 6.5-partition-healing); held but not yet consumed.
-    _partitionDetector, fretService, validator, reputation, consensusConfig, stateStore, reconcileBlock, onCommitCertificate, onInvalidate, recomputeArbitratorSet, deriveExpectedCluster, now) {
+    _partitionDetector, fretService, validator, reputation, consensusConfig, stateStore, reconcileBlock, onCommitCertificate, onInvalidate, recomputeArbitratorSet, deriveExpectedCluster, now, onCommittedHolders) {
         this.storageRepo = storageRepo;
         this.peerNetwork = peerNetwork;
         this.peerId = peerId;
@@ -170,6 +205,7 @@ export class ClusterMember {
         this.onInvalidate = onInvalidate;
         this.recomputeArbitratorSet = recomputeArbitratorSet;
         this.deriveExpectedCluster = deriveExpectedCluster;
+        this.onCommittedHolders = onCommittedHolders;
         this.now = now ?? (() => Date.now());
         this.superMajorityThreshold = consensusConfig?.superMajorityThreshold ?? DEFAULT_SUPER_MAJORITY_THRESHOLD;
         this.minAbsoluteClusterSize = consensusConfig?.minAbsoluteClusterSize ?? 3;
@@ -243,13 +279,15 @@ export class ClusterMember {
         return this.executedPendResults.get(messageHash);
     }
     /**
-     * Commit-shaped sibling of {@link getExecutedPendResult}: local storage's verdict for a commit
-     * operation applied during consensus, when this member retained one. `CoordinatorRepo.commit`
-     * consults it after a locally-executed commit-consensus — a retained refusal whose cause a local
-     * re-read confirms as a rival holding the requested revision is returned to the writer as a
-     * retryable conflict instead of the fabricated success the ahead-divergence tolerance would
-     * otherwise imply. Same availability caveats as the pend accessor: in-memory only, absent for
-     * pre-restart applies, pruned on the executed-transaction TTL.
+     * Commit-shaped sibling of {@link getExecutedPendResult}: this member's post-reconcile durable
+     * verdict for a commit operation applied during consensus, when it retained one — `success: true`
+     * iff local storage holds the committed revision under the record's action for every block the
+     * commit named, after the apply and any behind-reconcile it triggered. `CoordinatorRepo.commit`
+     * reads it after a locally-executed commit-consensus, both as this node's own contribution to the
+     * durable-holder count its durability gate needs, and — for a retained refusal whose cause a
+     * local re-read confirms as a rival holding the requested revision — as the trigger for a
+     * retryable conflict answer. Same availability caveats as the pend accessor: in-memory only,
+     * absent for pre-restart applies, pruned on the executed-transaction TTL.
      */
     getExecutedCommitResult(messageHash) {
         return this.executedCommitResults.get(messageHash);
@@ -371,6 +409,15 @@ export class ClusterMember {
                     });
                     // Our own vote can be terminal (a reject where maxAllowedRejections is 0) or complete
                     // the super-majority — recompute rather than guess which.
+                    //
+                    // Deliberately NOT the conflict vote's `shouldPersist = false`, for a `held` vote or
+                    // any other. A conflict vote clears the record because this member holds the WINNER
+                    // in `activeTransactions` and persisting the loser would reserve the same blocks a
+                    // second time. A `held` vote has no such twin: the rival lives in durable storage,
+                    // not in that table, so this record's entry is the only one and dropping it would
+                    // only make this member forget a transaction the rest of the cohort may still
+                    // carry to super-majority. Where one `held` vote IS terminal (a small cohort), the
+                    // recomputed phase is `ConflictSuperseded`, which clears the record anyway.
                     continue;
                 case TransactionPhase.OurConflictVoteNeeded:
                     currentRecord = await this.handleConflictVoteNeeded(currentRecord, phaseResult.conflictsWith);
@@ -423,7 +470,7 @@ export class ClusterMember {
                     shouldPersist = false;
                     break phaseLoop;
                 case TransactionPhase.Promising:
-                    // We have already voted (approve, reject, or conflict); the record is still
+                    // We have already voted (approve, reject, conflict, or held); the record is still
                     // collecting promises from the rest of the cohort. Nothing to add — retain the
                     // record only if our vote wasn't a conflict (`shouldPersist` already reflects that).
                     log('cluster-member:phase-promising-waiting', {
@@ -472,21 +519,28 @@ export class ClusterMember {
         return currentRecord;
     }
     /**
-     * Add this member's own conflict-shaped pend verdict to a record's {@link ClusterRecord.applyOutcomes},
-     * when storage produced one for this transaction. A success, a bare-reason fault, or no retained
-     * verdict at all leaves the record untouched — the coordinator's rule is "an entry means retry",
-     * so an entry that does not mean retry must not exist.
+     * Add this member's own apply verdicts to a record's {@link ClusterRecord.applyOutcomes}, when
+     * storage produced any for this transaction. The two arms follow the rules on
+     * {@link MemberApplyOutcome}: the pend arm carries ONLY a conflict-shaped refusal (a success, a
+     * bare-reason fault, or no retained verdict leaves it off — the coordinator's rule is "an entry
+     * means retry", so an entry that does not mean retry must not exist); the commit arm carries the
+     * retained durable verdict whatever it says, because the coordinator counts the successes.
      *
      * The member never signs this and never writes another peer's entry.
      */
     withOwnApplyOutcome(record) {
-        const verdict = this.executedPendResults.get(record.messageHash);
-        if (verdict === undefined || verdict.success || !isConflictFailure(verdict)) {
+        const pend = this.executedPendResults.get(record.messageHash);
+        const commit = this.executedCommitResults.get(record.messageHash);
+        const own = {
+            ...(pend !== undefined && !pend.success && isConflictFailure(pend) ? { pend } : {}),
+            ...(commit !== undefined ? { commit } : {})
+        };
+        if (Object.keys(own).length === 0) {
             return record;
         }
         return {
             ...record,
-            applyOutcomes: { ...record.applyOutcomes, [this.peerId.toString()]: { pend: verdict } }
+            applyOutcomes: { ...record.applyOutcomes, [this.peerId.toString()]: own }
         };
     }
     /**
@@ -552,8 +606,9 @@ export class ClusterMember {
     }
     /**
      * Compares existing vs incoming signatures for the same peers.
-     * If a peer's vote type changed (approve↔reject), that's equivocation:
-     * report a penalty and keep the first-seen signature.
+     * ANY change of vote type is equivocation — the comparison is over `Signature['type']`, so it
+     * covers every kind without enumerating them (a new kind joins the check by existing): report a
+     * penalty and keep the first-seen signature.
      * New peers are accepted normally.
      */
     detectEquivocation(existing, incoming, phase, messageHash) {
@@ -729,18 +784,20 @@ export class ClusterMember {
         const superMajority = Math.ceil(peerCount * this.superMajorityThreshold);
         const maxAllowedRejections = peerCount - superMajority;
         // Check for rejections — rejected if too many rejections to ever reach super-majority.
-        // ONLY `reject` votes count here: a `conflict` vote is "not now", never a validity
-        // judgement, so it must not push a record into the permanent `Rejected` phase.
+        // ONLY `reject` votes count here: `conflict` and `held` both mean "not now", never a validity
+        // judgement, so neither may push a record into the permanent `Rejected` phase.
         const rejectedPromises = Object.values(record.promises).filter(s => s.type === 'reject');
-        const conflictPromises = Object.values(record.promises).filter(s => s.type === 'conflict');
+        const retryableRefusals = Object.values(record.promises).filter(s => s.type === 'conflict' || s.type === 'held');
         const rejectedCommits = Object.values(record.commits).filter(s => s.type === 'reject');
         if (rejectedPromises.length > maxAllowedRejections || this.hasMajority(rejectedCommits.length, peerCount)) {
             return { phase: TransactionPhase.Rejected };
         }
-        // Conflict votes don't judge validity, but enough of them still make super-majority
+        // Retryable refusals don't judge validity, but enough of them still make super-majority
         // unreachable — a distinct terminal outcome (retryable as a fresh transaction) so logs and
-        // reputation-adjacent paths keep meaning what they say.
-        if (conflictPromises.length > 0 && rejectedPromises.length + conflictPromises.length > maxAllowedRejections) {
+        // reputation-adjacent paths keep meaning what they say. `held` joins `conflict` here for the
+        // same reason `conflict` clears its record: a member that keeps reserving the blocks of a
+        // transaction that provably cannot win holds them against the very retry meant to win.
+        if (retryableRefusals.length > 0 && rejectedPromises.length + retryableRefusals.length > maxAllowedRejections) {
             return { phase: TransactionPhase.ConflictSuperseded };
         }
         // Check if we need to vote. A lost race is answered with a conflict vote, not silence:
@@ -803,20 +860,17 @@ export class ClusterMember {
         // peer set is a legitimate cluster it belongs to, and refuses (reject vote) rather than rubber-stamping
         // a set the coordinator chose (e.g. a self-shrunk minority-partition set). On admission failure we skip
         // pend validation entirely and emit the membership rejection.
-        const validationResult = await this.evaluatePromise(record);
-        const promiseHash = await this.computePromiseHash(record);
-        const type = validationResult.valid ? 'approve' : 'reject';
-        const rejectReason = validationResult.valid ? undefined : validationResult.reason;
-        const sig = await this.signVote(promiseHash, type, rejectReason);
-        const signature = validationResult.valid
-            ? { type: 'approve', signature: sig }
-            : { type: 'reject', signature: sig, rejectReason };
-        if (!validationResult.valid) {
-            log('cluster-member:validation-rejected', {
+        const verdict = await this.evaluatePromise(record);
+        if (!verdict.valid) {
+            // Two tags, because the two refusals are two different events for an operator: one says the
+            // cohort judged a write invalid, the other says a write queued behind a live reservation.
+            log(verdict.kind === 'held' ? 'cluster-member:validation-held' : 'cluster-member:validation-rejected', {
                 messageHash: record.messageHash,
-                reason: validationResult.reason
+                reason: verdict.reason
             });
         }
+        const promiseHash = await this.computePromiseHash(record);
+        const signature = await this.signPromiseVerdict(promiseHash, verdict);
         return {
             ...record,
             promises: {
@@ -825,6 +879,22 @@ export class ClusterMember {
             }
         };
     }
+    /**
+     * Turn a {@link PromiseVerdict} into this member's signed promise vote — one vote kind per refusal
+     * kind. The single place the mapping lives, so a new refusal kind cannot reach the wire as the
+     * wrong vote: the coordinator's thresholds read only `Signature.type`, and until `held` existed the
+     * transient refusal had nowhere to go but `reject`.
+     */
+    async signPromiseVerdict(promiseHash, verdict) {
+        if (verdict.valid) {
+            return { type: 'approve', signature: await this.signVote(promiseHash, 'approve') };
+        }
+        if (verdict.kind === 'held') {
+            return { type: 'held', signature: await this.signVote(promiseHash, 'held', verdict.heldBy), heldBy: verdict.heldBy };
+        }
+        const rejectReason = verdict.reason;
+        return { type: 'reject', signature: await this.signVote(promiseHash, 'reject', rejectReason), rejectReason };
+    }
     /**
      * Answer a record that lost the deterministic race to a transaction this member already holds
      * (`docs/correctness.md` Theorems 1 & 9: the loser is TOLD it lost, not ignored — an unanswered
@@ -852,8 +922,10 @@ export class ClusterMember {
     }
     /**
      * The full promise-phase decision for a record: admit the declared membership FIRST, then (only if
-     * admitted) validate its pend operations, then its commit operations. Failing any yields a
-     * `{ valid:false, reason }` the caller turns into a `reject` vote. Keeping the three separate keeps
+     * admitted) validate its pend operations, then its commit operations. Failing any yields a refusal
+     * the caller turns into a vote — a `reject` for every validity judgement here, and a `held` for the
+     * one transient refusal {@link validatePendOperations} can make (see {@link PromiseVerdict}).
+     * Keeping the checks separate keeps
      * the reason strings distinct — a `membership-not-admitted` reject is a different signal (feeds the
      * dispute path) than a stale-revision / custom-validator reject, which is different again from a
      * `content-digest-mismatch` (see {@link validateCommitOperations}). A record carries pend OR commit
@@ -862,7 +934,7 @@ export class ClusterMember {
     async evaluatePromise(record) {
         const admission = await this.admitMembership(record);
         if (!admission.admit) {
-            return { valid: false, reason: admission.reason ?? MEMBERSHIP_NOT_ADMITTED };
+            return invalidVerdict(admission.reason ?? MEMBERSHIP_NOT_ADMITTED);
         }
         const pendValidation = await this.validatePendOperations(record);
         if (!pendValidation.valid) {
@@ -874,7 +946,7 @@ export class ClusterMember {
         // declared one).
         const commitRevValidation = await this.validateCommitRevisions(record);
         if (!commitRevValidation.valid) {
-            return commitRevValidation;
+            return verdictOf(commitRevValidation);
         }
         // Then our own refusal history: a commit whose pend THIS member refused, where local state
         // still corroborates the refusal. Runs after the revision check because that one is sharper
@@ -882,9 +954,16 @@ export class ClusterMember {
         // applied here; this arm covers the window where it has not.
         const refusedPendValidation = await this.validateCommitAgainstRefusedPend(record);
         if (!refusedPendValidation.valid) {
-            return refusedPendValidation;
+            return verdictOf(refusedPendValidation);
+        }
+        // The declared base before the declared content: it needs no materialization, and when the two
+        // disagree the digest check would be previewing operations computed against a different base
+        // than the one declared — its verdict names the symptom, this one names the cause.
+        const baseDeclarationValidation = await this.validateCommitBaseDeclarations(record);
+        if (!baseDeclarationValidation.valid) {
+            return verdictOf(baseDeclarationValidation);
         }
-        return await this.validateCommitOperations(record);
+        return verdictOf(await this.validateCommitOperations(record));
     }
     /**
      * Membership admission gate. Decides whether the coordinator-declared peer set (`record.peers`, call it
@@ -1172,9 +1251,19 @@ export class ClusterMember {
     }
     /**
      * Validates pend operations in a cluster record using the transaction validator.
-     * Also checks for stale revisions, and for blocks held by a different unresolved pending
+     * Also checks for stale revisions, and for blocks RESERVED by a different unresolved pending
      * action, to prevent consensus on operations that storage would refuse at apply.
      * Returns success if no validator is configured (backwards compatibility).
+     *
+     * Every refusal here is a validity judgement EXCEPT the pending-conflict one, which is transient by
+     * construction and returns the `held` kind — see {@link PromiseVerdict}. Transient means the
+     * reservation it answers is one its holder is still going to commit or cancel: a record claiming
+     * the slot this pend wants, or a later one. A record claiming a slot the collection has already
+     * moved past is NOT a reservation against this pend and is not refused on — see
+     * {@link reservingRivals} — because its holder is never going to remove it: the holder either
+     * committed at that slot on the rest of the cohort (this member missed the commit) or lost the
+     * slot, and in both cases the record would otherwise refuse every later write to the block, from
+     * every writer, for as long as this member lives.
      */
     async validatePendOperations(record) {
         // Find pend operations in the message
@@ -1201,7 +1290,7 @@ export class ClusterMember {
                                 blockId,
                                 reason: blockResult.unavailable
                             });
-                            return { valid: false, reason: `block ${blockId} unavailable (${blockResult.unavailable}): cannot verify revision` };
+                            return invalidVerdict(`block ${blockId} unavailable (${blockResult.unavailable}): cannot verify revision`);
                         }
                         const latest = blockResult?.state?.latest;
                         if (latest !== undefined && latest.rev >= pendRequest.rev) {
@@ -1224,18 +1313,18 @@ export class ClusterMember {
                             // is NOT a StaleFailure producer, so StaleFailure.staleAt does not apply; the
                             // coordinator's own local re-read (CoordinatorRepo.classifyStaleRejection)
                             // supplies that number when it can confirm the revision itself.
-                            return { valid: false, reason: `stale revision: block ${blockId} at rev ${latest.rev}, requested rev ${pendRequest.rev}` };
+                            return invalidVerdict(`stale revision: block ${blockId} at rev ${latest.rev}, requested rev ${pendRequest.rev}`);
                         }
                     }
                 }
-                // Reject a pend whose blocks are held by a DIFFERENT unresolved pending action. This is
-                // the durable reservation the in-memory table (`findConflict` / `activeTransactions`)
+                // Refuse a pend whose blocks are RESERVED by a DIFFERENT unresolved pending action. This
+                // is the durable reservation the in-memory table (`findConflict` / `activeTransactions`)
                 // cannot provide: that table clears the moment the rival's PEND record reaches
                 // consensus, but the rival's storage pending record — written at pend-apply, removed at
                 // commit or cancel — spans exactly the pend→commit window in which `latest.rev` has not
                 // yet advanced. Storage's own pend would refuse this request at consensus-apply for the
-                // same reason (`StorageRepo.pend`'s listPendingTransactions scan); voting reject here
-                // moves that verdict into the phase where the cohort aggregates it, so the loser is
+                // same reason (`StorageRepo.pend`'s pending-claim scan, under the same rule); voting
+                // here moves that verdict into the phase where the cohort aggregates it, so the loser is
                 // refused with a real answer instead of burning a consensus round it cannot win. A
                 // member that has not yet applied the rival's pend has no record and simply abstains
                 // from this reason; the apply-time verdict catches that residual — retained locally
@@ -1244,19 +1333,53 @@ export class ClusterMember {
                 // member. Self is excluded so a redelivered pend
                 // for this same action stays approvable. An unavailable block carries no `pendings` and
                 // abstains (the rev branch above already fail-closes when a revision claim is at stake).
-                // Reason stays plain prose: it is fed to computeSigningPayload and carried as
-                // Signature.rejectReason, exactly like the stale-revision reason above.
+                //
+                // This is the ONE refusal in this method that is not a validity judgement: a RESERVING
+                // rival's record is removed the moment it commits or cancels, so the very same pend
+                // succeeds on retry. It therefore returns the `held` kind, which becomes a `held` vote
+                // the coordinator counts toward neither approvals nor rejections. `heldBy` carries the
+                // first rival as signed structured data; the prose reason names the same one, and stays
+                // prose because it is fed to computeSigningPayload exactly like the reasons above.
+                //
+                // Which rivals reserve is decided by the slot each record claims against what the
+                // incoming writer built on, not by the record's presence (`reservingRivals`): a record
+                // whose slot is at or below the base this pend declares for the block — or, for a pend
+                // naming no base, below the revision it requests — belongs to a commit this member missed
+                // or a race its holder lost, and would never clear on its own; refusing on it wedged the
+                // block for every writer (ticket `a-member-that-missed-a-commit-refuses-every-later-write`).
+                // Approving over it is safe because the incoming writer's operations were computed
+                // against a version of the block that already holds that record's change. This member
+                // comes current when the approved pend's own commit applies here — through
+                // `internalCommit`, or through the behind-reconcile its fork guard triggers. In a cohort
+                // that can reach its promise bar without one member (`cohortCanMissAPend`: four members up
+                // at the default threshold), a record claiming a slot PAST the declared base still
+                // reserves even when the requested revision has moved beyond it: that is a writer that
+                // read the block without the record's change — served by a member that never held the
+                // rival's pend — and admitting it would lose the change. See `isReservationAgainst`.
                 for (const blockId of blockIds) {
-                    const rivals = (blockResults[blockId]?.state?.pendings ?? []).filter(actionId => actionId !== pendRequest.actionId);
-                    if (rivals.length > 0) {
-                        log('cluster-member:validation-pending-conflict', {
-                            messageHash: record.messageHash,
-                            blockId,
-                            actionId: pendRequest.actionId,
-                            rivals
-                        });
-                        return { valid: false, reason: `pending conflict: block ${blockId} held by unresolved action(s) ${rivals.join(', ')}` };
+                    const rivalIds = (blockResults[blockId]?.state?.pendings ?? []).filter(actionId => actionId !== pendRequest.actionId);
+                    const rivals = rivalIds.length === 0 ? [] : await this.reservingRivals(record, blockId, rivalIds, pendRequest);
+                    if (rivals.length === 0) {
+                        // Not reserved (any more): whatever episode this member was counting on the block
+                        // has ended, so a later wedge gets its own count.
+                        this.stuckReservations.forget([blockId]);
+                        continue;
                     }
+                    const heldBy = rivals[0];
+                    log('cluster-member:validation-pending-conflict', {
+                        messageHash: record.messageHash,
+                        blockId,
+                        actionId: pendRequest.actionId,
+                        requestedRev: pendRequest.rev,
+                        rivals
+                    });
+                    this.nameStuckReservation(blockId, rivals, pendRequest.actionId);
+                    return {
+                        valid: false,
+                        kind: 'held',
+                        heldBy,
+                        reason: `pending conflict: block ${blockId} held by unresolved action(s) ${rivals.join(', ')}`
+                    };
                 }
                 // Re-check the transaction when a validator is configured. The unvalidatable-pend
                 // policy and the throwing-validator catch live in the shared `checkPendValidation`,
@@ -1277,12 +1400,94 @@ export class ClusterMember {
                         error: event.error
                     }));
                 if (!validation.valid) {
-                    return { valid: false, reason: validation.reason };
+                    return invalidVerdict(validation.reason);
                 }
             }
         }
         return { valid: true };
     }
+    /**
+     * Of the rival pending records `get` listed on `blockId`, the ones that RESERVE the block against
+     * `pendRequest` — see `isReservationAgainst` for the rule, fed the pend's revision and the base it
+     * declares for this block (`reservationRequestFor`, the same reading storage applies at apply).
+     * Asks storage's {@link IPendingClaimReader} for the slot each record claims; a repo without that
+     * capability (a plain `IRepo` mock) or a read that fails degrades to "every rival reserves", which
+     * is the refusal this member cast before claims were recorded — never to silently admitting one. A
+     * rival that `get` listed but that is gone by the time the claims are read has resolved in
+     * between, and is not a rival any more.
+     */
+    async reservingRivals(record, blockId, rivalIds, pendRequest) {
+        const reader = this.storageRepo;
+        if (typeof reader.listPendingClaims !== 'function') {
+            return rivalIds;
+        }
+        let claims;
+        try {
+            claims = await reader.listPendingClaims(blockId);
+        }
+        catch (err) {
+            log('cluster-member:pending-claims-read-error', { messageHash: record.messageHash, blockId, error: err.message });
+            return rivalIds;
+        }
+        const reservation = this.reservationRequestOf(record, pendRequest, blockId);
+        const claimOf = new Map(claims.map(claim => [claim.actionId, claim]));
+        const reserving = [];
+        for (const actionId of rivalIds) {
+            const claim = claimOf.get(actionId);
+            if (claim === undefined)
+                continue;
+            if (isReservationAgainst(claim, reservation)) {
+                reserving.push(actionId);
+            }
+            else {
+                log('cluster-member:validation-pending-superseded', {
+                    messageHash: record.messageHash,
+                    blockId,
+                    actionId: pendRequest.actionId,
+                    requestedRev: pendRequest.rev,
+                    baseRev: reservation.baseRev,
+                    rival: actionId,
+                    claimedRev: claim.rev
+                });
+            }
+        }
+        return reserving;
+    }
+    /** `pendRequest`'s {@link ReservationRequest} for `blockId`, logging a base the rule cannot read —
+     *  never a refusal: `baseRevs` is untrusted wire data, and a malformed entry only drops that block
+     *  back to the revision rule. The base is read only when `record`'s cohort can reach its promise
+     *  super-majority without one of its members (`cohortCanMissAPend`); in a cohort that needs every
+     *  member, a stray record on one member (a cancel that never reached it) would otherwise refuse
+     *  every later writer for good, and no member can have missed the pend the base arm guards against. */
+    reservationRequestOf(record, pendRequest, blockId) {
+        if (!cohortCanMissAPend(Object.keys(record.peers).length, this.superMajorityThreshold)) {
+            return { rev: pendRequest.rev };
+        }
+        const { request, ignoredBase } = reservationRequestFor(pendRequest, blockId, transformForBlockId(pendRequest.transforms, blockId));
+        if (ignoredBase !== undefined) {
+            log('cluster-member:pend-base-ignored', {
+                messageHash: record.messageHash,
+                blockId,
+                actionId: pendRequest.actionId,
+                requestedRev: pendRequest.rev,
+                base: ignoredBase
+            });
+        }
+        return request;
+    }
+    /**
+     * Feed this member's own `held` vote to its {@link stuckReservations} counter and say, once per
+     * episode and in words, when a block is wedged behind a reservation that is not going to clear —
+     * the member-side twin of `CoordinatorRepo.noteStuckReservation`, for the reservations that
+     * node cannot corroborate from its own storage. `peerId` is carried because this logger is not
+     * suffixed with one and several members can share a process.
+     */
+    nameStuckReservation(blockId, holders, refusedActionId) {
+        const { named } = this.stuckReservations.note(new Map([[blockId, holders]]), refusedActionId);
+        for (const episode of named) {
+            log('cluster-member:stuck-reservation', { peerId: this.peerId.toString(), ...episode });
+        }
+    }
     /**
      * Promise-round check that a commit record's requested revision is not already committed HERE
      * under a different action. This is the member-side arm that keeps a DEAD rival's re-broadcast
@@ -1496,6 +1701,113 @@ export class ClusterMember {
         }
         return undefined;
     }
+    /**
+     * Promise-round check that a commit declares, for each block, the base revision the same action's
+     * PEND carried to this member. The author says the base twice — `PendRequest.baseRevs[id]`, kept
+     * with this member's pending record as `PendingClaim.baseRev`, and
+     * `CommitRequest.blockDigests[id].baseRev` — and an honest author says the same thing both times
+     * (`Tracker` pins the base at staging; the pend and the digest both read that pin). When they
+     * differ, this member's record holds operations computed against a base other than the one the
+     * commit is about to be applied as, so vote reject with {@link BASE_DECLARATION_DISAGREES}.
+     * `StorageRepo.internalCommit` refuses the same shape at apply (`guardCommitBase`); refusing here
+     * too puts a signed verdict on the record one round earlier, and when the cohort's records agree
+     * with each other but not with the commit (a writer whose commit contradicts its own pend) the
+     * whole cohort refuses at the vote, where the apply-time refusal alone would have every member
+     * refuse after consensus and reconcile against a revision nobody holds.
+     *
+     * Needs no preview, so it runs on a repo that can read one record's claim
+     * ({@link IPendingClaimReader}`.pendingClaimOf`) whether or not it can materialize. Abstains — votes
+     * as it would without the check — whenever it cannot compare: the commit declares nothing, an entry
+     * is surplus to `blockIds` or carries no numeric `baseRev` (untrusted wire data, same posture as the
+     * digest check), this member holds no record for the action on the block, the record carries no
+     * base (an inserted or deleted block, a base-less sender, or a record written before bases were
+     * kept), the read fails — or this member does not hold the declared base as its latest.
+     *
+     * That last abstain is what keeps an HONEST retry off this reject. The one disagreement an honest
+     * writer can meet here is a stale record from an earlier attempt of a retried action (same action
+     * id) meeting the retry's commit, when the retry's pend — which would have overwritten the record
+     * — never reached this member. Such a member is typically behind: it missed a pend, and the retry
+     * declares a base the rest of the cohort moved to. At three members one reject sinks the commit
+     * record (the default super-majority allows none), where abstaining lets the others commit and
+     * leaves this member to `guardCommitBase`, which refuses to apply the stale record and reconciles.
+     * When this member's latest IS the declared base, the stale operations are exactly what it would
+     * apply over it, and the digest check below rejects the same shape whenever they materialize
+     * differently; rejecting here names the cause instead.
+     */
+    async validateCommitBaseDeclarations(record) {
+        const reader = this.storageRepo;
+        if (typeof reader.pendingClaimOf !== 'function') {
+            return { valid: true };
+        }
+        for (const operation of record.message.operations) {
+            if (!('commit' in operation)) {
+                continue;
+            }
+            const commit = operation.commit;
+            if (!commit.blockDigests) {
+                continue;
+            }
+            const committedIds = new Set(commit.blockIds);
+            for (const [blockId, declared] of Object.entries(commit.blockDigests)) {
+                const declaredBaseRev = declared?.baseRev;
+                if (!committedIds.has(blockId) || typeof declaredBaseRev !== 'number') {
+                    continue;
+                }
+                let storedBaseRev;
+                try {
+                    storedBaseRev = (await reader.pendingClaimOf(blockId, commit.actionId))?.baseRev;
+                }
+                catch (err) {
+                    log('cluster-member:base-declaration-read-error', {
+                        messageHash: record.messageHash,
+                        blockId,
+                        error: err instanceof Error ? err.message : String(err)
+                    });
+                    continue; // a local read fault is an abstain, never a verdict
+                }
+                if (storedBaseRev === undefined || storedBaseRev === declaredBaseRev) {
+                    continue;
+                }
+                const latestRev = await this.latestRevOf(record, blockId);
+                if (latestRev !== declaredBaseRev) {
+                    log('cluster-member:base-declaration-disagrees-abstained', {
+                        messageHash: record.messageHash,
+                        blockId,
+                        actionId: commit.actionId,
+                        storedBaseRev,
+                        declaredBaseRev,
+                        latestRev
+                    });
+                    continue;
+                }
+                log('cluster-member:base-declaration-disagrees', {
+                    messageHash: record.messageHash,
+                    blockId,
+                    actionId: commit.actionId,
+                    rev: commit.rev,
+                    storedBaseRev,
+                    declaredBaseRev
+                });
+                return { valid: false, reason: BASE_DECLARATION_DISAGREES };
+            }
+        }
+        return { valid: true };
+    }
+    /** This member's own committed revision of `blockId` (raw storage, no cluster recursion), or
+     *  `undefined` when it holds none or the read fails — a fault reads as "cannot judge". */
+    async latestRevOf(record, blockId) {
+        try {
+            return (await this.storageRepo.get({ blockIds: [blockId] }))[blockId]?.state?.latest?.rev;
+        }
+        catch (err) {
+            log('cluster-member:base-declaration-read-error', {
+                messageHash: record.messageHash,
+                blockId,
+                error: err instanceof Error ? err.message : String(err)
+            });
+            return undefined;
+        }
+    }
     /**
      * Promise-round check of a commit record's declared content digests
      * (`CommitRequest.blockDigests`) against what this member's OWN pended copy of each transform
@@ -1750,6 +2062,11 @@ export class ClusterMember {
      * mid-commit `internalCommit` fault (`success:false` with a bare `reason`, no
      * `missing`) is propagated so {@link handleConsensus} rolls back the executed marker
      * and rethrows — exactly like an unexpected thrown fault.
+     *
+     * Tolerated is not the same as acknowledged. Whatever shape a commit's apply took, this
+     * member retains one post-reconcile durable verdict for it ({@link durableCommitVerdict}) and
+     * reports it to the coordinator, whose durability gate (`CoordinatorRepo.commit`) acknowledges
+     * the writer only when a majority of the cohort reports holding the revision.
      */
     async applyConsensusOperation(record, operation) {
         const messageHash = record.messageHash;
@@ -1832,87 +2149,19 @@ export class ClusterMember {
                     membershipVersion: record.membershipVersion
                 });
             }
-            let result;
-            try {
-                result = await this.storageRepo.commit(commit, undefined, proof);
-            }
-            catch (err) {
-                // `StorageRepo.commit` throws (rather than returning success:false) when
-                // the pending action is missing — the canonical "behind" signal: this
-                // member reached commit-consensus without the matching pend (cohort drift).
-                if (isMissingPendingActionError(err)) {
-                    log('cluster-member:consensus-commit-diverged', {
-                        messageHash,
-                        actionId: commit.actionId,
-                        divergence: 'behind',
-                        reason: err.message
-                    });
-                    // We hold no revision of these blocks; pull the committed revision from a
-                    // cohort peer so the block is no longer under-replicated. Best-effort:
-                    // failures are logged inside, never thrown (a throw would reset the stream).
-                    await this.reconcileDivergentCommit(record, commit);
-                    return;
-                }
-                throw err;
-            }
-            // Retain the verdict either way (see getExecutedCommitResult): a success confirms local
-            // durability, and an ahead-shaped refusal is the only evidence the coordinator has that
-            // the tolerance below swallowed a rival's win at the requested revision. The
-            // missing-pending throw path above retains nothing — no CommitResult exists there, and
-            // the coordinator's fabricated-success fallback plus cohort reconcile is the right shape
-            // for a member that is genuinely behind.
-            this.executedCommitResults.set(messageHash, result);
-            if (!result.success) {
-                // success:false is a StaleFailure. `missing` ⇒ ahead/stale divergence
-                // (we already hold ≥ this rev): tolerate, do NOT reconcile downward. A
-                // missing-base reason ⇒ behind divergence, reconcile (below). Any other bare
-                // `reason` with no `missing` ⇒ a genuine internalCommit fault: propagate so
-                // handleConsensus rolls back the executed marker and rethrows.
-                //
-                // NOTE: this 'ahead' tolerance is what turns a rival's commit that somehow reaches
-                // consensus into a reported success no member durably stored (consensus without
-                // durability — the commit-tier acknowledgement hole). It must stay: a member
-                // genuinely ahead of a redelivered/lagging commit is the common, correct case. The
-                // guards live UPSTREAM: `validateCommitRevisions` rejects the rival at the promise
-                // round, `CoordinatorRepo.commit` returns lost races as retryable conflicts instead
-                // of re-driving them, and the verdict retained just above (getExecutedCommitResult)
-                // lets the coordinating node convert its OWN member's rival-confirmed refusal into a
-                // conflict answer — that last guard is what closes the signed-but-not-yet-applied
-                // window, where two commits for one revision both assemble consensus because signing
-                // drops each member's reservation before applying advances its storage —
-                // `validateCommitAgainstRefusedPend` now refuses to sign that commit in the first
-                // place on any member that refused its pend. If consensus-without-durability is ever
-                // observed again, look at those guards' remaining abstain residuals (capability-less
-                // or history-truncated storage; a member whose refusal has aged out of retention),
-                // not at this branch.
-                if (result.missing?.length) {
-                    log('cluster-member:consensus-commit-diverged', {
-                        messageHash,
-                        actionId: commit.actionId,
-                        divergence: 'ahead',
-                        reason: result.reason,
-                        hasMissing: true
-                    });
-                    return;
-                }
-                // This member holds no materializable base for one of the blocks, so
-                // `StorageRepo.commit` REFUSED rather than record a revision it could never serve.
-                // Same "behind" divergence as a missing pend — and the same cure: pull the committed
-                // revision from a cohort peer. Reconciling here (after commit released its per-block
-                // latches) is what makes refusing safe; fetching inside the commit path would deadlock
-                // against the latch `saveReplicatedBlock` needs to persist what it fetched.
-                if (isMissingBaseRevisionFailure(result)) {
-                    log('cluster-member:consensus-commit-diverged', {
-                        messageHash,
-                        actionId: commit.actionId,
-                        divergence: 'behind',
-                        reason: result.reason
-                    });
-                    await this.reconcileDivergentCommit(record, commit);
-                    return;
-                }
-                throw new Error(`Consensus commit for action ${commit.actionId} failed: ${result.reason ?? 'unknown reason'}`);
-            }
+            const applied = await this.applyCommitToStorage(record, commit, proof);
+            // Retain the POST-RECONCILE durable verdict (see getExecutedCommitResult and
+            // withOwnApplyOutcome): what this member's storage holds NOW, after any behind-reconcile the
+            // apply triggered — not what the first apply attempt said. A member that pulled the
+            // revision from a cohort peer is a durable holder and reports one; a member that could not
+            // is not, whichever shape its refusal took. The coordinator's durability gate counts these
+            // verdicts — its own member's through getExecutedCommitResult, every other member's off the
+            // response record — and the two readers must see the same answer, hence one verdict,
+            // computed once, retained here for both.
+            const verdict = await this.durableCommitVerdict(commit, applied);
+            this.executedCommitResults.set(messageHash, verdict);
+            if (verdict.success)
+                this.reportCommittedHolders(record, commit);
             return;
         }
         if ('invalidate' in operation) {
@@ -1920,6 +2169,138 @@ export class ClusterMember {
             return;
         }
     }
+    /**
+     * Apply one consensus commit to local storage, tolerating every divergence shape the way the
+     * doc comment on {@link applyConsensusOperation} describes and reconciling the behind ones.
+     * Returns storage's own result — or, for the thrown missing-pend shape, which produces no
+     * `CommitResult` at all, a refusal built from the throw — so {@link durableCommitVerdict} works
+     * from one uniform shape. Genuine faults (a bare-reason returned failure, an unrecognized throw)
+     * propagate so {@link handleConsensus} rolls back the executed marker and rethrows.
+     */
+    async applyCommitToStorage(record, commit, proof) {
+        const messageHash = record.messageHash;
+        let result;
+        try {
+            result = await this.storageRepo.commit(commit, undefined, proof);
+        }
+        catch (err) {
+            // `StorageRepo.commit` throws (rather than returning success:false) when
+            // the pending action is missing — the canonical "behind" signal: this
+            // member reached commit-consensus without the matching pend (cohort drift).
+            if (isMissingPendingActionError(err)) {
+                log('cluster-member:consensus-commit-diverged', {
+                    messageHash,
+                    actionId: commit.actionId,
+                    divergence: 'behind',
+                    reason: err.message
+                });
+                // We hold no revision of these blocks; pull the committed revision from a
+                // cohort peer so the block is no longer under-replicated. Best-effort:
+                // failures are logged inside, never thrown (a throw would reset the stream).
+                await this.reconcileDivergentCommit(record, commit);
+                return { success: false, reason: err.message };
+            }
+            throw err;
+        }
+        if (result.success) {
+            return result;
+        }
+        // success:false is a StaleFailure. `missing` ⇒ ahead/stale divergence
+        // (we already hold ≥ this rev): tolerate, do NOT reconcile downward. A
+        // missing-base reason ⇒ behind divergence, reconcile (below). Any other bare
+        // `reason` with no `missing` ⇒ a genuine internalCommit fault: propagate so
+        // handleConsensus rolls back the executed marker and rethrows.
+        //
+        // NOTE: this 'ahead' tolerance is what turns a rival's commit that somehow reaches
+        // consensus into a member-side no-op rather than a stream reset. It must stay: a member
+        // genuinely ahead of a redelivered/lagging commit is the common, correct case. What keeps
+        // the tolerance from turning into an acknowledged write no member stored is downstream:
+        // the durable verdict retained by the caller reports this member as NOT holding the
+        // revision (unless the revision index names this very action — an ahead member that did
+        // land it), and `CoordinatorRepo.commit`'s durability gate acknowledges only a majority of
+        // such reports; a retained refusal whose cause a local re-read confirms as a rival at the
+        // requested revision is answered as a retryable conflict there. Upstream,
+        // `validateCommitRevisions` rejects the rival at the promise round and
+        // `validateCommitAgainstRefusedPend` refuses to sign the commit of a pend this member
+        // refused. If consensus-without-durability is ever observed again, look at the gate's
+        // inputs (a member reporting a durable success it does not hold, or a majority that is
+        // genuinely durable on a forked lineage), not at this branch.
+        if (result.missing?.length) {
+            log('cluster-member:consensus-commit-diverged', {
+                messageHash,
+                actionId: commit.actionId,
+                divergence: 'ahead',
+                reason: result.reason,
+                hasMissing: true
+            });
+            return result;
+        }
+        // This member holds no materializable base for one of the blocks, so
+        // `StorageRepo.commit` REFUSED rather than record a revision it could never serve.
+        // Same "behind" divergence as a missing pend — and the same cure: pull the committed
+        // revision from a cohort peer. Reconciling here (after commit released its per-block
+        // latches) is what makes refusing safe; fetching inside the commit path would deadlock
+        // against the latch `saveReplicatedBlock` needs to persist what it fetched.
+        if (isMissingBaseRevisionFailure(result)) {
+            log('cluster-member:consensus-commit-diverged', {
+                messageHash,
+                actionId: commit.actionId,
+                divergence: 'behind',
+                reason: result.reason
+            });
+            await this.reconcileDivergentCommit(record, commit);
+            return result;
+        }
+        throw new Error(`Consensus commit for action ${commit.actionId} failed: ${result.reason ?? 'unknown reason'}`);
+    }
+    /**
+     * The durable verdict for a consensus commit: `applied` itself when storage landed it (a
+     * success from `StorageRepo.commit` means every block is committed, or already was, under this
+     * action), otherwise a fresh look at what local storage holds NOW — after the reconcile the
+     * refusal triggered. Durable means every block in `commit.blockIds` records `commit.rev` under
+     * `commit.actionId`. A refusal that is not durable is returned as-is, so the coordinating node
+     * can still classify its own member's ahead-shaped refusal against a rival. A read fault counts
+     * as not durable: the gate this feeds fails toward retry.
+     */
+    async durableCommitVerdict(commit, applied) {
+        if (applied.success) {
+            return applied;
+        }
+        try {
+            for (const blockId of commit.blockIds) {
+                if (!(await this.holdsCommittedRevision(blockId, commit))) {
+                    return applied;
+                }
+            }
+        }
+        catch (err) {
+            log('cluster-member:consensus-commit-durability-read-error', {
+                actionId: commit.actionId,
+                rev: commit.rev,
+                error: err.message
+            });
+            return applied;
+        }
+        log('cluster-member:consensus-commit-durable-after-reconcile', { actionId: commit.actionId, rev: commit.rev });
+        // A member's own verdict about its own storage: `local`. Read by the coordinator for its
+        // `success` flag only (`cohortCommitOutcomes`, `localCommitResult`) — it never becomes the
+        // answer handed to the writer; `CoordinatorRepo.commit` computes the cohort's own on every exit.
+        return { success: true, durability: localDurability() };
+    }
+    /**
+     * True when local storage records `commit.rev` of `blockId` under `commit.actionId`. Read from
+     * the revision index (the {@link IRevisionActionReader} capability) so a member whose `latest` has
+     * since moved past the revision still counts as holding it; a repo without the capability is
+     * judged on `latest` alone.
+     */
+    async holdsCommittedRevision(blockId, commit) {
+        const reader = this.storageRepo;
+        if (typeof reader.getRevisionAction === 'function') {
+            return await reader.getRevisionAction(blockId, commit.rev) === commit.actionId;
+        }
+        const latest = (await this.storageRepo.get({ blockIds: [blockId] }))[blockId]?.state?.latest;
+        return latest?.rev === commit.rev && latest.actionId === commit.actionId;
+    }
     /**
      * Applies a consensus-ordered invalidation on this member: dedup → certificate verification →
      * capture the invalidation's commit cert (for reactivity reuse) → delegate the compensating write +
@@ -2018,6 +2399,29 @@ export class ClusterMember {
             log('cluster-member:commit-cert-sink-error', { actionId, error: err.message });
         }
     }
+    /**
+     * Tell the {@link CommittedHoldersSink} which cohort members hold a commit this member just
+     * durably applied. A member learns nothing about the others' storage at apply time, so the
+     * evidence is the record's approving commit signers: each is a cohort member that signed to apply
+     * this commit. A signer that then failed to apply is wrongly recorded, which only spares it a
+     * rebalance push; its own reconcile, read-repair, and — on the coordinating node — the
+     * coordinator's durability-checked report (which lands after this one and overrides it) still
+     * reach it.
+     */
+    reportCommittedHolders(record, commit) {
+        if (!this.onCommittedHolders) {
+            return;
+        }
+        const holders = Object.entries(record.commits)
+            .filter(([peerId, vote]) => vote.type === 'approve' && peerId in record.peers)
+            .map(([peerId]) => peerId);
+        try {
+            this.onCommittedHolders({ blockIds: commit.blockIds, holders });
+        }
+        catch (err) {
+            log('cluster-member:committed-holders-sink-error', { actionId: commit.actionId, error: err.message });
+        }
+    }
     /**
      * After tolerating a "behind" commit divergence, pull the committed revision of
      * each block from a cohort peer that holds it and restore it locally. Best-effort: