@optimystic/db-p2p 1.0.0-beta.3 → 1.0.0

package/dist/src/repo/coordinator-repo.js

@@ -1,5 +1,5 @@
-import { LruMap, blockIdsForTransforms, highestStaleAt, isConflictFailure, isOwnRevision, DEFAULT_SUPER_MAJORITY_THRESHOLD } from "@optimystic/db-core";
-import { ClusterCoordinator, ConflictRaceLostError, ValidatorRejectionError } from "./cluster-coordinator.js";
+import { LruMap, blockIdsForTransforms, transformForBlockId, highestStaleAt, isConflictFailure, isOwnRevision, DEFAULT_SUPER_MAJORITY_THRESHOLD, routingKeyForBlock, localDurability, unroutedDurability } from "@optimystic/db-core";
+import { BlocksHeldError, ClusterCoordinator, ConflictRaceLostError, ValidatorRejectionError } from "./cluster-coordinator.js";
 import { peerIdFromString } from "@libp2p/peer-id";
 import { createLogger } from '../logger.js';
 import { PenaltyReason } from "../reputation/types.js";
@@ -8,7 +8,10 @@ import { certifyClaim, isAttributableProofFailure, proofThresholds } from "../cl
 import { DEFAULT_CLUSTER_SIZE, resolveRepairCorroborationClusterSize } from "../cluster/cluster-policy.js";
 import { RECONCILE_TIMEOUT_MS } from "../cluster/reconcile-block.js";
 import { isMissingBaseRevisionFailure, COMMIT_NOT_DURABLE_REASON, MISSING_BASE_REVISION_REASON } from "../storage/storage-repo.js";
+import { isReservationAgainst, reservationRequestFor, cohortCanMissAPend } from "../storage/pending-claim.js";
 import { buildBlockCommitProof } from "../cluster/commit-proof.js";
+import { RESPONSIBILITY_TTL_MS, ResponsibilityRefusalError } from "./responsibility.js";
+import { StuckReservationTracker } from "./stuck-reservation.js";
 /** How long one cohort peer gets to answer the latest-revision consult before it counts as silent. */
 const LATEST_QUERY_TIMEOUT_MS = 1000;
 /** True when a freshly-read local revision is strictly ahead of the baseline the repair started from. */
@@ -76,80 +79,8 @@ function soleHolderMessage(cohortPeers) {
         `second voter — reaching this message means the one holder attached no such proof, or one that did not ` +
         `verify.)`;
 }
-/**
- * How many DISTINCT later actions one unchanged holder must refuse on a block before the refusals are
- * named as a stuck reservation rather than as an ordinary lost race.
- *
- * **Why a count of distinct actions and not something else.** Elapsed time answers the wrong question
- * — a slow writer is not a stuck one, and a holder legitimately keeps its reservation for as long as
- * its own commit takes. A raw refusal count answers the wrong question too: a single writer retrying
- * a lost race produces a run of refusals under ONE action id (see {@link StuckReservationWatch.refused}).
- * What no healthy holder can produce is an unbounded stream of *different* writers all losing to it,
- * because a healthy holder's reservation lasts one pend-to-commit window.
- *
- * **Why 8.** The bound to clear is how many distinct actions can honestly be refused inside one such
- * window. Measured on the in-process mesh, in the healthy-contention arm of
- * `test/stuck-reservation-named.spec.ts`: a holder that pends, is raced by other writers, and then
- * commits refuses **2** distinct actions per episode — the two rivals — and the count resets on every
- * holder change. `concurrent-diary-append-acknowledgement.spec.ts` races three writers at one diary
- * and cannot exceed that either, for the same reason: at most (writers - 1) rivals can lose to one
- * winner. 8 is four times the measured healthy figure, and it is a floor a genuinely stuck block
- * clears trivially (the field instance refused hundreds).
- *
- * **The bound stated exactly.** It is distinct SYNC CYCLES, not distinct writers: one writer that
- * exhausts a sync's retry budget and is re-driven by its caller mints a fresh id for the next cycle,
- * so it can contribute more than one. That does not widen the window much — a cycle only ends in
- * exhaustion after `DefaultMaxAttempts` (10) attempts of backoff, roughly 21s (see the exhaustion
- * NOTE in `Collection.syncAttempts`), so a lone writer needs a holder to keep the block for upwards
- * of two and a half minutes before it reaches 8 by itself, which is not a healthy holder.
- *
- * **What the margin does NOT cover, stated honestly.** A block with more than 8 distinct writers
- * racing it inside a single pend-to-commit round trip could reach 8 with a perfectly healthy holder.
- * That is a diagnostic false positive on a log line and nothing else — this counter never refuses,
- * expires, or deletes anything (see {@link CoordinatorRepo.noteStuckReservation}) — and the remedy if
- * a deployment ever hits it is to raise this number, not to add a control path. Raising it costs
- * detection latency on low-traffic blocks, which need this many distinct write ATTEMPTS before the
- * condition can be named at all.
- */
-const STUCK_RESERVATION_DISTINCT_ACTIONS = 8;
-/** Whether two sorted holder lists name the same reservation — i.e. whether a refusal continues an
- *  existing episode or starts a new one. Both sides come from the same sort, so this is a plain
- *  element-wise comparison; a block normally has exactly one holder, since a member's own pend refuses
- *  a second one (`ClusterMember.validatePendOperations`). */
-function sameHolders(a, b) {
-    return a.length === b.length && a.every((id, i) => id === b[i]);
-}
-/**
- * The stuck-reservation wording: written for an operator reading logs, in the same register as
- * {@link cohortTooSmallMessage} and {@link soleHolderMessage} — what is stuck, what will and will not
- * clear it, and what to do next.
- *
- * The claim is deliberately about the RESERVATION, not about the writer's intent: this node cannot
- * see whether the holding process is alive, only that it has held the block across enough unrelated
- * later actions that no retry is going to win. So the line says what is provable (the block accepts
- * no writes while this record stands, and nothing on the node removes it) and points at the one check
- * that settles the rest.
- */
-function stuckReservationMessage(holders, refusedActions) {
-    const held = holders.join(', ');
-    return `This block is WEDGED BEHIND A PENDING WRITE THAT IS NOT COMPLETING, and retrying will never ` +
-        `clear it: action(s) ${held} reserved the block and have now refused ${refusedActions} DISTINCT, ` +
-        `unrelated later actions. Each of those refusals on its own looks exactly like an ordinary ` +
-        `optimistic-concurrency loss, which is normal and healthy — the repetition is what is not. A ` +
-        `healthy rival holds a block only for its own pend-to-commit window and then releases it by ` +
-        `committing or cancelling; a reservation that keeps refusing NEW writers is holding the block ` +
-        `against every writer on every machine, and each of them loses again identically. EXACTLY TWO ` +
-        `THINGS CLEAR IT: a cancel for action(s) ${held} on this block (route it through the cohort so ` +
-        `every member drops the record), or that same action's own commit landing. Nothing on the node ` +
-        `expires it — there is no sweep for abandoned pending records — so until one of those two happens ` +
-        `the block takes NO writes while continuing to serve reads and to look healthy in every other ` +
-        `respect. The usual cause is a writer that went away between a failed or half-applied commit and ` +
-        `the cancel it owed, so check whether whatever ran ${held} still exists before cancelling on its ` +
-        `behalf. This line is a diagnosis and nothing more: this node does not expire, refuse, or delete ` +
-        `the record on the strength of it.`;
-}
 export function coordinatorRepo(keyNetwork, createClusterClient, cfg, fretService, reputation, stateStore) {
-    return (components) => new CoordinatorRepo(keyNetwork, createClusterClient, components.storageRepo, cfg, components.localCluster, components.localPeerId, fretService, components.clusterLatestCallback, reputation, stateStore, components.acquireBlockFromCohort, components.proofAnchoring);
+    return (components) => new CoordinatorRepo(keyNetwork, createClusterClient, components.storageRepo, cfg, components.localCluster, components.localPeerId, fretService, components.clusterLatestCallback, reputation, stateStore, components.acquireBlockFromCohort, components.proofAnchoring, components.underReplicationLedger, components.onCommittedHolders);
 }
 /** Cluster coordination repo - uses local store, as well as distributes changes to other nodes using cluster consensus. */
 export class CoordinatorRepo {
@@ -160,37 +91,13 @@ export class CoordinatorRepo {
     clusterLatestCallback;
     acquireBlockFromCohort;
     proofAnchoring;
+    underReplicationLedger;
+    onCommittedHolders;
     coordinator;
     DEFAULT_TIMEOUT = 30000; // 30 seconds default timeout
     localPeerId;
     responsibilityCache = new LruMap(1000);
-    static RESPONSIBILITY_TTL_MS = 60_000;
     lastSeenCommitMs = new LruMap(1000);
-    /**
-     * Per block, when (`this.now()` at the consult's start) a consult last SETTLED that this node's
-     * absence of it is the cohort's answer too — see `absenceSettled` on {@link fetchBlockFromCluster}'s
-     * result. Only the solo-self exit settles today: when this node is the block's whole cohort, every
-     * acknowledged commit of it lands in this node's storage before the writer hears success, so the
-     * block reads present and the memo dies. Read only for a block still missing locally
-     * ({@link absenceIsSettled}); cleared by any pend or commit this node coordinates for the block, by
-     * seeing it present, and by any later consult of it that does not settle.
-     *
-     * Deliberately its OWN map rather than `lastSeenCommitMs`: that one is also stamped for missing
-     * blocks at exits whose verdict is NOT a confirmed absence (the `cohort-too-small` arm when a peer
-     * claimed a revision, the post-restore arm when acquisition failed), so reading it here would turn
-     * a `claimed-elsewhere` absence into an authoritative one for a whole window.
-     *
-     * NOTE: accepted tradeoff — a cohort-of-one view can be transient (peers still mid-identify; see
-     * the solo exit), and a block another node creates through the cohort it sees is then reported
-     * absent here for up to one `readRepairWindowMs` after this node's view grows — the same one-window
-     * cost the held-block window pays for a growing cohort. Revisit if a caller ever needs
-     * create-visibility across coordinators tighter than one window — such a caller needs a revision
-     * floor (backlog `feat-refresh-can-demand-a-revision-floor`), not a shorter window.
-     *
-     * NOTE: LRU-bounded like its siblings; an eviction under >1000 settled blocks loses a memo and
-     * costs one extra consult — the safe direction.
-     */
-    settledAbsences = new LruMap(1000);
     /** Per block, what earlier repair passes left unresolved — see {@link AheadClaimState}.
      *  Outlives the consult on purpose: the read-repair window skips consults for blocks checked
      *  recently, and a doubt dropped there is a stale answer served as confirmed again.
@@ -199,14 +106,14 @@ export class CoordinatorRepo {
      *  {@link reportRepairDeadlock} say its piece a second time. */
     unsettledAheadClaims = new LruMap(1000);
     /**
-     * Per block, what its pending-conflict refusals have added up to — see {@link StuckReservationWatch}
-     * and {@link noteStuckReservation}. Deliberately its OWN map rather than a third fact hung off
-     * {@link unsettledAheadClaims}: that entry belongs to the read-repair path and is cleared by a block
-     * converging on a revision, whereas this one belongs to the write path and is cleared by the block
-     * accepting a write. Sharing the entry would mean teaching both of those lifetimes about a fact
-     * neither owns (backlog `debt-freshness-state-scattered-across-coordinator-repo` is the standing
-     * argument for collapsing all of this per-block state behind one collaborator; adding a fourth
-     * carve-out to the freshness entry would have made that harder, not easier).
+     * Per block, what its pending-conflict refusals have added up to — see {@link StuckReservationTracker}
+     * and {@link noteStuckReservation}. Deliberately its OWN collaborator rather than a third fact hung
+     * off {@link unsettledAheadClaims}: that entry belongs to the read-repair path and is cleared by a
+     * block converging on a revision, whereas this one belongs to the write path and is cleared by the
+     * block accepting a write. Sharing the entry would mean teaching both of those lifetimes about a
+     * fact neither owns (backlog `debt-freshness-state-scattered-across-coordinator-repo` is the
+     * standing argument for collapsing all of this per-block state behind one collaborator; adding a
+     * fourth carve-out to the freshness entry would have made that harder, not easier).
      *
      * NOTE: LRU-bounded like its siblings. An eviction under >1000 conflicted blocks loses an episode's
      * say-once flag, so the line can repeat once for that block — the same bounded duplication
@@ -215,12 +122,11 @@ export class CoordinatorRepo {
      * NOTE: per COORDINATOR, and a block's coordinator is whichever peer the writer's key lookup
      * resolved — normally stable, but cohort churn or a routing change moves it. When it moves, the
      * count restarts on the new coordinator (the condition is named later) and the old one may name the
-     * same episode again (the condition is named twice). Fine while a wedged block is diagnosed by
-     * searching for its id; if a churning deployment ever makes duplicate lines the noisy failure this
-     * one exists to replace, the say-once state has to move to where the record lives (the member's own
-     * storage) rather than to where the refusal was classified.
+     * same episode again (the condition is named twice). Each MEMBER now keeps its own tracker as well
+     * (`ClusterMember.validatePendOperations`), fed by its own `held` votes, so the episode is also
+     * named where the record lives, by a count that does not move with the coordinator.
      */
-    stuckReservations = new LruMap(1000);
+    stuckReservations = new StuckReservationTracker(1000);
     readRepairMode;
     readRepairWindowMs;
     readRepairSampleRate;
@@ -242,7 +148,7 @@ export class CoordinatorRepo {
     now = () => Date.now();
     /** Test seam: overridable RNG (0..1) for sample-rate gating. */
     rand = () => Math.random();
-    constructor(keyNetwork, createClusterClient, storageRepo, cfg, localCluster, localPeerId, fretService, clusterLatestCallback, reputation, stateStore, acquireBlockFromCohort, proofAnchoring) {
+    constructor(keyNetwork, createClusterClient, storageRepo, cfg, localCluster, localPeerId, fretService, clusterLatestCallback, reputation, stateStore, acquireBlockFromCohort, proofAnchoring, underReplicationLedger, onCommittedHolders) {
         this.keyNetwork = keyNetwork;
         this.createClusterClient = createClusterClient;
         this.storageRepo = storageRepo;
@@ -250,6 +156,8 @@ export class CoordinatorRepo {
         this.clusterLatestCallback = clusterLatestCallback;
         this.acquireBlockFromCohort = acquireBlockFromCohort;
         this.proofAnchoring = proofAnchoring;
+        this.underReplicationLedger = underReplicationLedger;
+        this.onCommittedHolders = onCommittedHolders;
         this.localPeerId = localPeerId;
         this.log = createLogger('coordinator-repo', localPeerId?.toString());
         const policy = {
@@ -316,58 +224,87 @@ export class CoordinatorRepo {
         await this.coordinator.recoverTransactions();
     }
     /**
-     * Check if this node is in the cluster for a given block.
-     * Uses findCluster membership — in the real network layer, self is always
-     * included in the cohort when this node is responsible. This serves as a
-     * defense-in-depth guard for requests that arrive at the wrong node.
-     * Returns true if localPeerId is not set (backward compat for single-node/test setups).
+     * Whether this node is in the cohort for a block. Uses `findCluster` membership — in the real network
+     * layer, self is in the cohort exactly when this node is among the nearest `clusterSize` serving peers
+     * for the block, so a request that reaches a node outside it was sent to the wrong machine.
+     *
+     * Three answers, because a lookup that THREW is not an answer: `undetermined` is never cached (routing
+     * can recover on the next request) and never read as `responsible` — what each caller does with it is
+     * that caller's posture (see {@link verifyResponsibility} and `get`).
+     *
+     * With no `localPeerId` the check is skipped and the answer is `responsible`. That bypass exists for
+     * wiring without an identity (direct constructors, single-node and test setups), never for production,
+     * where `libp2p-node-base` always passes the node's peer id.
+     *
+     * NOTE: a cached answer stands for up to {@link RESPONSIBILITY_TTL_MS} after the cohort changes, so a
+     * node can still say `responsible` for a minute after it stops being so. {@link soloCohortDurability}'s
+     * `unrouted` class and `ClusterCoordinator.executeClusterTransaction`'s cohort-membership guard are what
+     * keep that window honest; if churn ever makes the window matter, shorten the TTL rather than
+     * re-looking-up on every write.
      */
-    async isResponsibleForBlock(blockId) {
+    async responsibilityFor(blockId) {
         if (!this.localPeerId)
-            return true;
+            return 'responsible';
         const cached = this.responsibilityCache.get(blockId);
         if (cached && cached.expires > Date.now()) {
-            return cached.inCluster;
+            return cached.inCluster ? 'responsible' : 'not-responsible';
         }
-        const blockIdBytes = new TextEncoder().encode(blockId);
         let inCluster;
         try {
-            const peers = await this.keyNetwork.findCluster(blockIdBytes);
+            const peers = await this.keyNetwork.findCluster(routingKeyForBlock(blockId));
             inCluster = this.localPeerId.toString() in peers;
         }
         catch (err) {
             this.log('proximity:check-error', { blockId, error: err.message });
-            // On failure, assume responsible to avoid false rejections
-            return true;
+            return 'undetermined';
         }
-        this.responsibilityCache.set(blockId, { inCluster, expires: Date.now() + CoordinatorRepo.RESPONSIBILITY_TTL_MS });
+        this.responsibilityCache.set(blockId, { inCluster, expires: Date.now() + RESPONSIBILITY_TTL_MS });
         this.log('proximity:checked', { blockId, inCluster });
-        return inCluster;
+        return inCluster ? 'responsible' : 'not-responsible';
     }
     /**
-     * Verify this node is responsible for all given block IDs. Throws if not.
+     * The write path's gate (`pend`, `cancel`, `commit`): refuse unless this node is responsible for EVERY
+     * block, and refuse too when it cannot tell — fail CLOSED. A write accepted on a thrown lookup commits
+     * where the network was never consulted (GitHub #19); refusing hands it back to the writer's transactor,
+     * which excludes this peer and re-picks inside the cohort.
+     *
+     * Every block is checked so the error names all of them. When the blocks split between the two kinds,
+     * `not-responsible` is the one thrown: it is a settled answer that the request is misrouted, which no
+     * recovery of the lookup would change; the undetermined blocks are still logged.
+     *
+     * For `cancel`, a refusal on a transient lookup fault leaves the pending record standing on this node
+     * until the writer's cancel retry lands on another cohort member — and this node is still discharged
+     * then, since as a member it judges the cancel against the record's own `peers`, not against a lookup.
      */
     async verifyResponsibility(blockIds) {
         const notResponsible = [];
+        const undetermined = [];
         for (const blockId of blockIds) {
-            if (!await this.isResponsibleForBlock(blockId)) {
+            const verdict = await this.responsibilityFor(blockId);
+            if (verdict === 'not-responsible')
                 notResponsible.push(blockId);
-            }
-        }
-        if (notResponsible.length > 0) {
-            this.log('proximity:rejected', { blockIds: notResponsible });
-            throw new Error(`Not responsible for block(s): ${notResponsible.join(', ')}`);
+            else if (verdict === 'undetermined')
+                undetermined.push(blockId);
         }
+        if (notResponsible.length === 0 && undetermined.length === 0)
+            return;
+        this.log('proximity:rejected', { notResponsible, undetermined });
+        throw notResponsible.length > 0
+            ? new ResponsibilityRefusalError('not-responsible', notResponsible)
+            : new ResponsibilityRefusalError('undetermined', undetermined, 'cohort lookup failed; refusing the write rather than accepting it unrouted');
     }
     async get(blockGets, options) {
-        // Soft proximity check — warn but still serve reads for graceful degradation
-        // NOTE: a soft-served read now also *acquires* the block durably (see restoreCorroborated), where
-        // before it could at most promote a pending this node already held. So a soft serve leaves behind
-        // a replica of a block this node is not responsible for, and nothing sweeps those: ring-shift
-        // sheds a keyspace RANGE, not "blocks outside my cohort". Fine while soft serves are what they
-        // are meant to be — a rare degradation during routing churn — since routing already placed this
-        // node near the block. If they ever become routine, gate acquisition (not the serve itself) on
-        // isResponsibleForBlock.
+        // Soft proximity check — warn but still serve reads for graceful degradation. Unlike the write
+        // path it stays OPEN when the lookup throws: a read is best-effort, and the consult below flags
+        // whatever it could not confirm (`unavailable`, `unconfirmedAheadRev`) rather than posing as sure.
+        // NOTE: a soft-served read also *acquires* the block durably (see restoreCorroborated), so a soft
+        // serve leaves behind a replica of a block this node is not responsible for, and nothing sweeps
+        // those: ring-shift sheds a keyspace RANGE, not "blocks outside my cohort". Soft serves are now
+        // confined to the responsibility caches' staleness window: a remote read for a block this node is
+        // not responsible for is redirected by `RepoService.checkRedirect` before it gets here, and this
+        // node's own transactor routes a read here only when self is in the block's cohort. If soft serves
+        // ever become routine (steady `proximity:get-warning` lines while the network's membership is not
+        // changing), gate acquisition (not the serve itself) on `responsibilityFor`.
         //
         // NOTE: accepted tradeoff — this check and `fetchBlockFromCluster` below each run their own
         // `findCluster` for the same block, so a cold read costs two cohort lookups where one shared
@@ -375,16 +312,15 @@ export class CoordinatorRepo {
         // and this check's future is open (blocked `writer-and-servers-disagree-on-where-a-block-lives`,
         // option D2(b)). Revisit if a device profile shows `findCluster` as material.
         for (const blockId of blockGets.blockIds) {
-            if (!await this.isResponsibleForBlock(blockId)) {
+            if (await this.responsibilityFor(blockId) === 'not-responsible') {
                 this.log('proximity:get-warning', { blockId, msg: 'serving read for non-responsible block' });
             }
         }
         // First try local storage
         const localResult = await this.storageRepo.get(blockGets, options);
         // Decide per-block whether to consult cluster peers. Two triggers:
-        //   (a) Missing — block isn't present locally at all. Consults unless an earlier consult
-        //       SETTLED its absence within the last `readRepairWindowMs` (see `settledAbsences` and
-        //       `absenceIsSettled`) — today only when this node is the block's whole cohort.
+        //   (a) Missing — block isn't present locally at all. Consults on every read: an absence is
+        //       never remembered (see the accepted-tradeoff NOTE below).
         //   (b) Stale-by-policy — block is present but read-repair policy says verify.
         // Skip cluster fetch if this is already a sync request (to prevent recursive queries).
         // A sync read is also never marked `unavailable` here — the consult it skips is the
@@ -394,38 +330,33 @@ export class CoordinatorRepo {
         const skipClusterFetch = options?.skipClusterFetch;
         // NOTE: NetworkTransactor.get treats an authoritative "absent" ({ state: {} })
         // as final and no longer retries it (ticket txn-perf-authoritative-notfound),
-        // relying on this cluster reconciliation to have already run — within the last
-        // `readRepairWindowMs`: an unflagged absent means the cohort confirmed this absence
-        // at most one window ago (a read inside the window serves the memo of that
-        // confirmation, see `settledAbsences`), the same currency guarantee a held block's
-        // content already carries. When the consult FAILS outright — or runs without ruling
-        // the block out and the block stays missing — the entry is flagged `unavailable`
-        // below with a reason naming what the consult established (see AbsenceVerdict and
-        // the mapping in the loop body), which re-enables the transactor-level retry against
-        // a different peer; none of those outcomes is ever remembered. If a coordinator is
-        // configured WITHOUT clusterLatestCallback, there is no cohort to consult and the
-        // local answer IS the whole truth — it stays authoritative, with no flag and no
-        // transactor-level retry to compensate. That is fine (such a coordinator has no
-        // cluster to reconcile against), but keep this coupling in mind if a partial-cluster
-        // read path is added.
+        // relying on this cluster reconciliation to have already run — for THIS read: an
+        // unflagged absent means the cohort was consulted before answering. When the consult
+        // FAILS outright — or runs without ruling the block out and the block stays
+        // missing — the entry is flagged `unavailable` below with a reason naming what
+        // the consult established (see AbsenceVerdict and the mapping in the loop body),
+        // which re-enables the transactor-level retry against a different peer. If a
+        // coordinator is configured WITHOUT clusterLatestCallback, there is no cohort to
+        // consult and the local answer IS the whole truth — it stays authoritative, with
+        // no flag and no transactor-level retry to compensate. That is fine (such a
+        // coordinator has no cluster to reconcile against), but keep this coupling in
+        // mind if a partial-cluster read path is added.
+        //
+        // NOTE: accepted tradeoff — a block missing locally consults on EVERY read, even on a cohort
+        // of one, where the consult is one `findCluster` (0.009 ms measured) and a once-per-window log
+        // line (see the solo-self exit). Remembering an absence was tried and removed (GitHub issue
+        // #20, ticket drop-the-settled-absence-memo): a cohort-of-one memo outlived the view it was
+        // settled under, and a node whose view then grew served a block another coordinator had just
+        // committed as never created. Cohort-member writes (`ClusterRepo` → storage) never pass
+        // through this class, so nothing here could clear such a memo either. Revisit only with a memo
+        // bound to the cohort view it was settled under AND cleared by every writer of local storage;
+        // `coordinator-repo-absence-write-bypass.spec.ts` is the gate, and backlog
+        // `feat-a-cohort-member-remembers-a-settled-absence` holds the design notes.
         if (this.clusterLatestCallback && !skipClusterFetch) {
             for (const blockId of blockGets.blockIds) {
                 const localEntry = localResult[blockId];
                 const localRev = localEntry?.state?.latest?.rev;
                 const isMissing = !localEntry?.state?.latest;
-                if (!isMissing) {
-                    // Present: any remembered absence is dead. Dropped now rather than left to age out,
-                    // so a block that vanishes again inside the same window consults instead of being
-                    // served the old memo.
-                    this.settledAbsences.delete(blockId);
-                }
-                else if (this.absenceIsSettled(blockId)) {
-                    // An earlier consult settled this absence within one window: serve the local entry
-                    // as it stands — an authoritative absent, or pending-only content — with no flag and
-                    // no log line. The held-block skip below logs nothing either, and a per-read line
-                    // here would recreate the volume this skip exists to remove.
-                    continue;
-                }
                 const isStale = !isMissing && this.shouldReadRepair(blockId);
                 if (!isMissing && !isStale) {
                     // No consult this pass — the read-repair window says this block was checked
@@ -445,33 +376,18 @@ export class CoordinatorRepo {
                         localRev
                     });
                 }
-                // Evidence gathered during the consult is at least this old, so a memo stamped with it never
-                // outlives "confirmed within one window" by the consult's own duration.
-                const consultStartedAt = this.now();
                 try {
-                    const { absence, currency, absenceSettled } = await this.fetchBlockFromCluster(blockId, blockGets.context, localRev);
-                    const refreshed = await this.storageRepo.get({ blockIds: [blockId], context: blockGets.context }, options);
+                    const { absence, currency } = await this.fetchBlockFromCluster(blockId, blockGets.context, localRev);
+                    // `lineageOf` rides along: the refreshed entry REPLACES the local one below, and an
+                    // entry that lost its lineage answer would read to the asker as "could not say".
+                    const refreshed = await this.storageRepo.get({
+                        blockIds: [blockId], context: blockGets.context,
+                        ...(blockGets.lineageOf === undefined ? {} : { lineageOf: blockGets.lineageOf })
+                    }, options);
                     const newRev = refreshed[blockId]?.state?.latest?.rev;
                     if (refreshed[blockId]) {
                         localResult[blockId] = refreshed[blockId];
                     }
-                    // Remember a settled absence for one window; forget it after every other outcome. A
-                    // consult that ended `unconfirmed`, `isolated` or `claimed`, that asked a multi-peer
-                    // cohort, or that rested on no real cohort view, leaves no memo, so the next read consults (and flags) exactly as before —
-                    // including after a sampled or paranoid re-consult of a block whose memo was still fresh.
-                    // NOTE: a local pend/commit that clears the memo WHILE this consult is in flight is undone
-                    // by the stamp below — one read inside the window can then serve an absent the refused
-                    // writer knows is wrong. Bounded: that writer's next pend clears the memo again. If it ever
-                    // shows as a stuck writer, skip this stamp when a clear of this block landed after
-                    // `consultStartedAt`.
-                    if (isMissing) {
-                        if (!refreshed[blockId]?.state?.latest && absence === 'confirmed' && absenceSettled) {
-                            this.settledAbsences.set(blockId, consultStartedAt);
-                        }
-                        else {
-                            this.settledAbsences.delete(blockId);
-                        }
-                    }
                     if (isStale) {
                         if (typeof newRev === 'number' && typeof localRev === 'number' && newRev > localRev) {
                             this.log('cluster-tx:read-repair-applied', { blockId, oldRev: localRev, newRev });
@@ -523,9 +439,6 @@ export class CoordinatorRepo {
                     // rather than return a stale cohort view, revisit — that would put the
                     // isolated case back under this vaguer reason.
                     if (isMissing) {
-                        // A consult that threw settled nothing — not even a memo that was still fresh
-                        // before a sampled or paranoid re-consult.
-                        this.settledAbsences.delete(blockId);
                         this.flagUnconfirmedAbsence(localResult, blockId, 'peers-unreachable');
                     }
                     else {
@@ -735,33 +648,33 @@ export class CoordinatorRepo {
             }
         }
     }
-    /**
-     * Decide whether a block MISSING locally may skip its consult: an earlier consult settled its
-     * absence within one read-repair window (see {@link settledAbsences}). The absence counterpart of
-     * {@link shouldReadRepair}, giving absence the guarantee the window already gives content —
-     * "checked with the cohort within one window" — and nothing weaker.
-     *
-     * Modes: `paranoid` never skips ("verify every read" means every read). `lazy` uses the window and
-     * the sample rate, exactly as {@link shouldReadRepair} does. `off` uses the window but not the
-     * sample rate (a `lazy`-only knob, as it is for content): `off` disables STALE-CONTENT repair, and
-     * the absence consult is not that — it is what makes an absent answer authoritative at all — so
-     * leaving it unbounded would make the mode meant to do less network work do more.
-     */
-    absenceIsSettled(blockId) {
-        if (this.readRepairMode === 'paranoid')
-            return false;
-        const at = this.settledAbsences.get(blockId);
-        if (at == null || this.now() - at > this.readRepairWindowMs)
-            return false;
-        if (this.readRepairMode === 'lazy' && this.readRepairSampleRate > 0 && this.rand() < this.readRepairSampleRate)
-            return false;
-        return true;
-    }
     /** Milliseconds since we last marked this block fresh, or undefined if never. */
     ageMs(blockId) {
         const lastSeen = this.lastSeenCommitMs.get(blockId);
         return lastSeen == null ? undefined : this.now() - lastSeen;
     }
+    /**
+     * Whether the solo-self exit of {@link fetchBlockFromCluster} has already named `blockId` inside
+     * the current read-repair window, for a block this node does NOT hold (`localRev` undefined). Such
+     * a block reaches that exit on every read, because `get` never remembers an absence (GitHub
+     * issue #20). So its `cluster-fetch:solo-self-skip` line and its stamp are both skipped while the
+     * stamp is at most one `readRepairWindowMs` old. An unconditional line would bring back issue #8's
+     * log volume for a probed but never-written collection. Re-stamping on every read would keep the
+     * stamp fresh and silence the line for good on a block read more often than once a window.
+     *
+     * Withholding the stamp never skips a consult: `get` asks {@link shouldReadRepair} only about
+     * present blocks. A HELD block reaches the exit only when read-repair already chose to consult, so
+     * this is always false for one. Its line and stamp are unchanged, and the line keeps pairing with
+     * `cluster-tx:read-repair-triggered`.
+     *
+     * NOTE: the stamp is shared with every exit that marks a block seen, so a missing block one of
+     * them stamped inside the window is not named until that stamp lapses. Fine for a diagnostic
+     * line; if anything ever needs "first answer from a self-only view" exactly, give the line its own
+     * per-block stamp.
+     */
+    soloAbsenceNamedThisWindow(blockId, localRev) {
+        return localRev === undefined && (this.ageMs(blockId) ?? Infinity) <= this.readRepairWindowMs;
+    }
     /** Mark blocks as freshly observed from cluster authority (post-commit or post-fetch). */
     markBlocksSeen(blockIds) {
         const now = this.now();
@@ -769,16 +682,6 @@ export class CoordinatorRepo {
             this.lastSeenCommitMs.set(id, now);
         }
     }
-    /**
-     * Drop any settled-absence memo for `blockIds` ({@link settledAbsences}) — called at the top of a
-     * local pend or commit, before routing and whatever the outcome. Clearing is always the safe
-     * direction: the most it can cost is one extra consult.
-     */
-    forgetSettledAbsences(blockIds) {
-        for (const id of blockIds) {
-            this.settledAbsences.delete(id);
-        }
-    }
     /**
      * True when a commit's approve votes form a strict majority of the FULL cohort — the only case
      * where "this node committed" is evidence that no rival commit moved past it. Two strict
@@ -838,35 +741,27 @@ export class CoordinatorRepo {
      *    retire it when the memo's claimants are among the peers that answered), `no-evidence`
      *    leaves it standing untouched. Required, not optional, so an exit added later has to say
      *    which it means.
-     *  - `absenceSettled` — whether this pass SETTLED the block's absence for one read-repair window:
-     *    no write of it this node has not seen can exist. Only the solo-self exit can say that today
-     *    (this node is the whole cohort, so every acknowledged commit lands here). `get` remembers a
-     *    settled absence ({@link settledAbsences}) and skips the consult while the block stays missing.
-     *    `absence === 'confirmed'` alone is not enough — the empty-cohort exit reports it without
-     *    asking anyone, and a multi-peer cohort's unanimous "nothing" can be overtaken by a commit
-     *    still on its way to this node. Required, like
-     *    `currency`, so an exit added later has to say which side it falls on rather than
-     *    remembering (or forgetting) to arm something.
+     *
+     * Nothing is remembered about an absence: `get` runs this pass on every read of a block missing
+     * locally (see the accepted-tradeoff NOTE there).
      */
     async fetchBlockFromCluster(blockId, context, localRev) {
-        // Unreachable from `get` (it guards on the callback); nothing to settle against.
         if (!this.clusterLatestCallback)
-            return { absence: 'confirmed', currency: { kind: 'no-evidence' }, absenceSettled: false };
-        const blockIdBytes = new TextEncoder().encode(blockId);
-        const peers = await this.keyNetwork.findCluster(blockIdBytes);
+            return { absence: 'confirmed', currency: { kind: 'no-evidence' } };
+        const peers = await this.keyNetwork.findCluster(routingKeyForBlock(blockId));
         const peerIds = peers ? Object.keys(peers) : [];
         // NOTE: deliberately does NOT call `markBlocksSeen` — unlike the solo-self exit below.
-        // An empty cohort is a ROUTING FAILURE, not a settled answer, and `Libp2pKeyPeerNetwork`
-        // cannot even produce one (its `findCluster` always includes self); the only producer
-        // today is the mesh harness's injected `findClusterFails`. Arming the read-repair window
+        // An empty cohort is a ROUTING FAILURE, not a settled answer. A serving node's
+        // `Libp2pKeyPeerNetwork.findCluster` cannot produce one: it always holds at least this
+        // node when no nearer serving peer is known. Only a node that serves no storage (a
+        // client-only libp2p node, which runs no CoordinatorRepo today) can see an empty cohort;
+        // the only producer here is the mesh harness's injected `findClusterFails`. Arming the read-repair window
         // here would suppress a genuine repair for a whole `readRepairWindowMs` after a transient
         // blip, and re-entering costs no network work beyond the `findCluster` the read already
         // makes. Do not "fix" this by symmetry with the solo-self exit.
-        // For the same reason it returns `absenceSettled: false`: remembering the absence would serve an
-        // authoritative absent for a whole window on the strength of a lookup that returned nobody.
         // Currency: nobody was asked, so nothing was refuted — an earlier pass's unsettled claim stands.
         if (peerIds.length === 0)
-            return { absence: 'confirmed', currency: { kind: 'no-evidence' }, absenceSettled: false };
+            return { absence: 'confirmed', currency: { kind: 'no-evidence' } };
         // Solo-cluster short-circuit: the only responsible peer is us. There is no
         // remote to sync from, so skip the callback entirely. Querying ourselves
         // would dial self via SyncClient — pointless at best, and on nodes without
@@ -874,7 +769,11 @@ export class CoordinatorRepo {
         if (peerIds.length === 1
             && this.localPeerId
             && peerIds[0] === this.localPeerId.toString()) {
-            this.log('cluster-fetch:solo-self-skip', { blockId });
+            // The line and the stamp below go together: both are skipped for a missing block this exit
+            // already named inside the window (see `soloAbsenceNamedThisWindow`).
+            const namedThisWindow = this.soloAbsenceNamedThisWindow(blockId, localRev);
+            if (!namedThisWindow)
+                this.log('cluster-fetch:solo-self-skip', { blockId });
             // Arm the lazy read-repair window. Without this the window is never stamped,
             // `shouldReadRepair` reads `lastSeen == null` forever, and every read re-enters this
             // exit — read -> stale -> consult -> solo skip -> no-op -> still stale, unbounded
@@ -892,18 +791,15 @@ export class CoordinatorRepo {
             // Deliberately opposite to the commit-side rule that withholds arming from a commit
             // whose quorum proves nothing about rivals: that damps nothing, this bounds an
             // otherwise unbounded loop. Landing both, keep both — see the specs for each.
-            this.markBlocksSeen([blockId]);
+            if (!namedThisWindow)
+                this.markBlocksSeen([blockId]);
             // Currency: this exit queried NOBODY, so it refutes nothing — an earlier pass's unsettled
             // claim survives it. Note the coupling with the arming just above: retained doubt now
             // persists for up to `readRepairWindowMs` before a consult can refute it. That is correct
             // and deliberate — the window damps repair EFFORT, not honesty — and it is the same
             // coupling the comment at the final exit below describes. Arming the window and keeping
             // the memo are answers to different questions; do not collapse them.
-            // Absence: settled. Nobody else could hold the block, and re-asking inside one window learns
-            // nothing the next `findCluster` would not — the same argument, with the same one-window
-            // self-heal when a cohort appears, as the arming above. (That arming's stamp is NOT what
-            // suppresses the next read of a missing block: `get` reads `settledAbsences` for those.)
-            return { absence: 'confirmed', currency: { kind: 'no-evidence' }, absenceSettled: true };
+            return { absence: 'confirmed', currency: { kind: 'no-evidence' } };
         }
         const { corroborated, corroboration, local, silent, answered, claims, uncorroboratedRev, deadlock } = await this.queryClusterForLatest(peerIds, blockId, context);
         // Any silence taints the WHOLE consult, not a fraction of it (fail-closed): one silent
@@ -991,14 +887,7 @@ export class CoordinatorRepo {
             if (deadlock === 'cohort-too-small') {
                 this.markBlocksSeen([blockId]);
             }
-            // Absence NOT settled, even when every cohort member answered "I hold nothing". This node
-            // takes part in other coordinators' writes as a cohort member through ClusterRepo, straight
-            // into storage and never through this class's pend/commit, so nothing here would clear the
-            // memo; and a commit acknowledged at super-majority reaches the remaining members in the
-            // background. Remembering this answer served a writer's own create as absent through a
-            // lagging member (fresh-node-ddl-multi Scenario B, 5 of 20 runs). Only the solo exit
-            // settles — see backlog `feat-a-cohort-member-remembers-a-settled-absence`.
-            return { absence, currency, absenceSettled: false };
+            return { absence, currency };
         }
         // The self answer is the sharper baseline (same storage, same context, read alongside the
         // cohort's), but it exists only when `findCluster` returned this node. A soft serve for a
@@ -1049,8 +938,7 @@ export class CoordinatorRepo {
             // ahead. Only reachable when a peer answered (a corroboration requires claims), so the
             // shared verdict resolves to `nothing-ahead` and a memo whose claimants are among those
             // answers is cleared.
-            // `absenceSettled`: never read for a held block; false for the same reason as the exit above.
-            return { absence: silenceVerdict, currency: nothingAheadVerdict, absenceSettled: false };
+            return { absence: silenceVerdict, currency: nothingAheadVerdict };
         }
         // Corroborated revision is ahead of ours — converge onto it.
         const rev = await this.restoreCorroborated(blockId, corroborated, baselineRev, peerIds);
@@ -1078,13 +966,12 @@ export class CoordinatorRepo {
         // unsettled claim (`recordAheadClaim`) and keeps stamping reads served below it while the
         // window suppresses the retry — the window damps repair effort, not honesty.
         // NOTE: that damping covers only a block this node holds at an OLDER revision. A block entirely
-        // missing locally is suppressed only by its own absence memo (`settledAbsences`), and this exit
-        // never arms it (`absenceSettled: false` below — a failed acquisition is `claimed`). So a
-        // persistently failing acquisition — e.g. a two-node deployment that never set
-        // `assumedClusterSize`, where the content quorum can never be met — still re-fetches an archive
-        // on every read of that block. Correct, and self-limiting once the cohort can agree; if it ever
-        // shows as read amplification, gate the acquisition step (not the latest-query) on the same
-        // window rather than letting a `claimed` absence settle.
+        // missing locally never consults the window (`get` consults on every read of a missing block,
+        // before `shouldReadRepair`), so a persistently failing acquisition — e.g. a two-node deployment
+        // that never set `assumedClusterSize`, where the content quorum can never be met — re-fetches an
+        // archive on every read of that block. Correct, and self-limiting once the cohort can agree; if
+        // it ever shows as read amplification, gate the acquisition step (not the latest-query) on the
+        // same window rather than remembering the absence (GitHub issue #20).
         this.markBlocksSeen([blockId]);
         // Converged: the corroboration is itself the evidence that nothing is ahead, and it came from
         // peers that answered — the shared verdict resolves to `nothing-ahead`, and the memo retires
@@ -1092,9 +979,7 @@ export class CoordinatorRepo {
         const currency = converged
             ? nothingAheadVerdict
             : { kind: 'unsettled-claim', rev: corroborated.rev, claimants: claimantsAtOrAbove(corroborated.rev), silent };
-        // Never settles an absence: restored → the block is now present (nothing to remember); not
-        // restored → `claimed`.
-        return { absence, currency, absenceSettled: false };
+        return { absence, currency };
     }
     /**
      * Bring this node up to the cohort-corroborated `corroborated`, returning the revision it holds
@@ -1632,12 +1517,6 @@ export class CoordinatorRepo {
     }
     async pend(request, options) {
         const allBlockIds = blockIdsForTransforms(request.transforms);
-        // Forget any settled absence of these blocks FIRST — before responsibility, routing, or the
-        // outcome is known. A pend refused because a block already exists somewhere is the strongest
-        // evidence there is that the memo was wrong, and the writer's retry re-reads: that read must
-        // consult (and restore) rather than serve the memo's authoritative absent for the rest of the
-        // window. After a success the block is present and the memo is dead anyway.
-        this.forgetSettledAbsences(allBlockIds);
         await this.verifyResponsibility(allBlockIds);
         const result = await this.pendThroughCluster(request, allBlockIds, options);
         // A pend the blocks ACCEPTED is the proof that no reservation is holding them any more — the
@@ -1652,12 +1531,14 @@ export class CoordinatorRepo {
         return result;
     }
     /** The cluster half of {@link pend}, after responsibility is verified: consensus, the local-verdict
-     *  arms, and the two optimistic-concurrency classifiers a rejection is run through. */
+     *  arms, and the catch that turns each optimistic-concurrency refusal into a retryable answer —
+     *  the two signed-evidence ones ({@link ConflictRaceLostError}, {@link BlocksHeldError}) directly,
+     *  and a validator rejection only through {@link classifyStaleRejection}. */
     async pendThroughCluster(request, allBlockIds, options) {
         const coordinatingBlockIds = options?.coordinatingBlockIds ?? allBlockIds;
-        const peerCount = await this.coordinator.getClusterSize(coordinatingBlockIds[0]);
-        if (peerCount <= 1) {
-            return await this.storageRepo.pend(request, options);
+        const cohort = await this.coordinator.resolveCohort(coordinatingBlockIds[0]);
+        if (!cohort.resolved || cohort.peerIds.length <= 1) {
+            return await this.pendSolo(request, cohort, options);
         }
         const message = {
             operations: [{ pend: request }],
@@ -1665,7 +1546,13 @@ export class CoordinatorRepo {
             coordinatingBlockIds
         };
         try {
-            const { localExecuted, localPendResult, cohortPendRefusals } = await this.coordinator.executeClusterTransaction(coordinatingBlockIds[0], message, options);
+            const { record, localExecuted, localPendResult, cohortPendRefusals } = await this.coordinator.executeClusterTransaction(coordinatingBlockIds[0], message, options);
+            // Who ACCEPTED the pending record — the cohort members whose promise vote approved it, plus
+            // or minus this node's own member per exit below. A pend's `confirmed` is not a commit's:
+            // accepting a pending record confers no storage durability (a pend that reached
+            // pend-consensus may still have been stored by nobody — see the local-verdict arm below),
+            // so the two numbers are never comparable, and the field says so.
+            const pendDurability = (selfAccepted) => pendCohortDurability(record, selfAccepted, this.localPeerId?.toString());
             // The first cohort refusal in peer-id order, so two coordinators facing the same cohort
             // answer with the same one. Which refusal is reported does not change the outcome — every
             // entry is conflict-shaped and every one means "rebase and retry" — only which `pending` /
@@ -1716,7 +1603,9 @@ export class CoordinatorRepo {
                     hasMissing: !!result.missing?.length,
                     hasPending: !!result.pending?.length
                 });
-                return answerWithCohortRefusal(result);
+                // Storage's own answer is `local`; the cohort's answer replaces it — this node accepted
+                // the record iff its fallback pend succeeded.
+                return answerWithCohortRefusal(result.success ? { ...result, durability: pendDurability(true) } : result);
             }
             // Local cluster already executed during consensus — return storage's own verdict rather
             // than fabricating a success (the peerCount <= 1 path above returns storage's real result
@@ -1729,7 +1618,10 @@ export class CoordinatorRepo {
             // commit that reached commit-consensus IS the authoritative commit (Theorem 9), whereas a
             // pend that reached pend-consensus may still have been stored by nobody.
             if (localPendResult !== undefined) {
-                if (localPendResult.success || isConflictFailure(localPendResult)) {
+                if (localPendResult.success) {
+                    return answerWithCohortRefusal({ ...localPendResult, durability: pendDurability(true) });
+                }
+                if (isConflictFailure(localPendResult)) {
                     return answerWithCohortRefusal(localPendResult);
                 }
                 // A bare-reason refusal (no pending/missing — e.g. a local validation-hook fault)
@@ -1743,11 +1635,14 @@ export class CoordinatorRepo {
             }
             // No verdict retained (member predates retention, restart, or TTL): the prior shape,
             // still subject to the cohort-refusal rule — a lost local verdict must not resurrect the
-            // fabricated success this ticket exists to remove.
+            // fabricated success this ticket exists to remove. For the durability class, a tolerated
+            // local fault means this node did NOT accept (`false`: its approve vote is withdrawn from the
+            // count), and an absent verdict says nothing either way (`undefined`: the vote stands).
             return answerWithCohortRefusal({
                 success: true,
                 pending: [],
-                blockIds: allBlockIds
+                blockIds: allBlockIds,
+                durability: pendDurability(localPendResult === undefined ? undefined : false)
             });
         }
         catch (error) {
@@ -1769,6 +1664,14 @@ export class CoordinatorRepo {
             // each member compares the rivals as IT holds them, so a member that already approved X
             // keeps X while a member that approved Y first keeps Y, and no rival reaches a promise
             // supermajority. (The hash tie-break is already symmetric — it cannot be the fix.)
+            // TWO contenders coordinated by different nodes reach an all-lose round by another route,
+            // and not by this catch: both collect their promises in parallel, so BOTH reach pend
+            // consensus; each coordinator's own member applies its own pend first (local-first
+            // delivery), every other member's storage refuses whichever arrived second, and each writer
+            // is downgraded by `answerWithCohortRefusal` above. Measured by
+            // `test/transaction-node-count-sweep.spec.ts` on the in-process mesh: round one lost by both
+            // writers in 20 of 20 races across two to five machines (2026-09-16). Same cost and same
+            // revisit condition as below.
             // Fine as it stands: since the torn-action fixes landed, an all-lose round costs one
             // retry cycle rather than wedging, and the contenders are separated next round by the
             // jittered backoff plus the aged retry priority carried on the re-pend
@@ -1782,13 +1685,49 @@ export class CoordinatorRepo {
             if (error instanceof ConflictRaceLostError) {
                 return { success: false, conflict: true, reason: error.message };
             }
-            const stale = await this.classifyStaleRejection(error, request, allBlockIds)
-                ?? await this.classifyPendingConflictRejection(error, request, allBlockIds);
+            if (error instanceof BlocksHeldError) {
+                return await this.answerBlocksHeld(error, request, allBlockIds, cohort.peerIds.length);
+            }
+            const stale = await this.classifyStaleRejection(error, request, allBlockIds);
             if (stale)
                 return stale;
             throw error;
         }
     }
+    /**
+     * The solo short-circuit of {@link pend}: a cohort of at most one peer runs no consensus, and the
+     * pend goes straight to local storage exactly as before. What changes is the answer's class —
+     * see {@link soloCohortDurability} for the four-way split. A refusal is returned untouched.
+     */
+    async pendSolo(request, cohort, options) {
+        const result = await this.storageRepo.pend(request, options);
+        return result.success ? { ...result, durability: this.soloCohortDurability(cohort) } : result;
+    }
+    /**
+     * The class of a write that took the solo short-circuit, from the cohort resolution that put it
+     * there. Policy-free: the write already happened, this only says what it was.
+     *  - not resolved (the lookup threw, or named nobody) → `unrouted`;
+     *  - resolved to exactly this node → `local`, a correct and complete one-machine write;
+     *  - resolved to exactly one peer that is NOT this node → `unrouted` — this node wrote somewhere
+     *    the cohort does not look, which is a write whose destination is wrong, not a solo write.
+     * With no local peer id (direct constructors, single-node and test wiring) a resolved cohort of
+     * one reads as `local`: the same posture `responsibilityFor` takes for a node with no
+     * identity, and a node with no identity cannot be in any cohort but its own.
+     *
+     * Both `unrouted` arms are defence in depth now, not the main guard: {@link verifyResponsibility}
+     * refuses a write whose lookup throws and a write for a cohort that excludes this node before the
+     * short-circuit is reached. A write lands here unrouted only inside the responsibility cache's
+     * staleness window, or when a second lookup fails moments after the first succeeded — and then it
+     * still reports honestly rather than posing as `local`.
+     */
+    soloCohortDurability(cohort) {
+        if (!cohort.resolved)
+            return unroutedDurability();
+        const sole = cohort.peerIds[0];
+        if (this.localPeerId !== undefined && sole !== this.localPeerId.toString())
+            return unroutedDurability();
+        return localDurability(sole);
+    }
     /**
      * Decide whether a cluster validator rejection was an optimistic-concurrency loss — the block
      * already advanced past the requested revision — rather than a genuine validation fault.
@@ -1860,51 +1799,56 @@ export class CoordinatorRepo {
             };
         }
         // NOTE: conservative — when only remote members saw the newer revision (local storage still
-        // behind), staleness can't be confirmed locally and the rejection stays a throw. If that
-        // shows up in practice, extend confirmation with a quorum read; never trust the reject text.
-        // `staleAt` is absent on this path for the same reason, and deliberately so — there is no
-        // confirmed number to report, and the field's contract forbids inferring one from that text.
+        // behind), staleness can't be confirmed locally and the rejection stays a throw. That revisit
+        // condition HAS now tripped, for this method's former sibling: the pending-conflict refusal hit
+        // exactly this window under delivery latency (the refusing member ahead of the coordinator) and
+        // escaped as a permanent-looking throw. Its cure was not the quorum read suggested here but a
+        // signed `held` vote — the member's own refusal, carried as evidence, so retryability stopped
+        // depending on a local re-read at all (see {@link answerBlocksHeld}).
+        //
+        // The stale arm is deliberately LEFT on local corroboration. Its refusal is a revision claim,
+        // and `staleAt` — the only place a losing writer learns the revision it lost to — can only be
+        // reported from a revision this node read itself. Moving it to a non-counting vote would take
+        // that number away, so it is its own ticket, not a rider on this one. Never trust the reject
+        // text; `staleAt` is absent on the unconfirmed path for the same reason, and deliberately so.
         return undefined;
     }
     /**
-     * Sibling of {@link classifyStaleRejection} for the OTHER optimistic-concurrency refusal shape:
-     * the promise-phase pending-conflict vote (`validatePendOperations` rejecting a pend whose
-     * blocks are held by a different unresolved pending action). That vote surfaces here as a
-     * {@link ValidatorRejectionError}, and without classification it would escape as a throw —
-     * splitting multi-tree pends mid-batch instead of taking the retry path a lost race deserves.
+     * Answer a pend the cohort refused with signed `held` votes: the blocks are reserved by a different
+     * unresolved action on one or more members ({@link BlocksHeldError}). Always a retryable
+     * {@link StaleFailure} with `conflict: true`, so the caller's normal retry path
+     * (`Collection.sync`, and the multi-collection pendPhase via `isConflictFailure`) absorbs it
+     * instead of a thrown error escaping mid-batch and splitting multi-tree pends.
+     *
+     * The local re-read is an ENRICHER, not a gate. It used to be the gate — this refusal arrived as a
+     * `ValidatorRejectionError` and was only converted when the coordinator's own storage corroborated
+     * the rival — and under latency the refusing member is routinely ahead of the coordinator, so the
+     * corroboration missed and a transient refusal escaped as a permanent-looking throw. The `held`
+     * vote is already signed evidence from the member that holds the rival, so retryability no longer
+     * depends on a local re-read at all. What the re-read still buys, when it succeeds, is the concrete
+     * rival list for {@link StaleFailure.pending} and the input {@link noteStuckReservation} needs to
+     * name a block wedged behind a reservation that will never clear.
      *
-     * Same confirmation discipline as the stale classifier: purely local. Re-read the affected
-     * blocks from our own storage and require some block's `state.pendings` to carry a rival
-     * actionId; the signed reject text is never consulted. A confirmed rival returns a
-     * {@link StaleFailure} with `conflict: true` and the rivals as `pending` (`ActionPending`
-     * without `transform` — the type allows it, and no consumer rebases from it). Unconfirmed —
-     * including read errors during confirmation — stays a throw, preserving fail-fast for genuine
-     * validation faults. Checked after `classifyStaleRejection` so a confirmed committed loss
-     * (which carries the sharper `staleAt`) wins when both hold.
+     * NOTE: `error.heldBy` (peerId → holding action id) is dropped at this boundary, the same deliberate
+     * drop the {@link ConflictRaceLostError} arm of {@link pendThroughCluster} documents: `StaleFailure`
+     * has no field for it, and the members' action ids are not the same claim as the rivals this node
+     * read out of its own storage, so they must not be folded into `pending`. A caller that wants to
+     * WAIT on the holder rather than re-race it needs a typed field added here; never recover the ids
+     * by parsing `reason`.
      */
-    async classifyPendingConflictRejection(error, request, blockIds) {
-        if (!(error instanceof ValidatorRejectionError))
-            return undefined;
-        let results;
-        try {
-            results = await this.storageRepo.get({ blockIds });
-        }
-        catch (readError) {
-            this.log('coordinator-repo:pend-conflict-classify-read-error', {
+    async answerBlocksHeld(error, request, blockIds, peerCount) {
+        const pending = await this.corroborateHeldBlocks(request, blockIds, peerCount);
+        if (pending.length === 0) {
+            // The member that refused is ahead of us — the normal shape under latency. Still a conflict:
+            // the refusal is signed, and the un-enriched answer is exactly the shape the lost-race arm
+            // returns. `noteStuckReservation` is deliberately not fed here; it counts refusals whose
+            // holder THIS node can name, and a guess would poison its holder comparison.
+            this.log('coordinator-repo:pend-held-uncorroborated', {
                 actionId: request.actionId,
-                error: readError.message
+                heldBy: error.heldBy
             });
-            return undefined;
-        }
-        const pending = [];
-        for (const blockId of blockIds) {
-            for (const actionId of results[blockId]?.state?.pendings ?? []) {
-                if (actionId !== request.actionId)
-                    pending.push({ blockId, actionId });
-            }
+            return { success: false, conflict: true, reason: error.message };
         }
-        if (pending.length === 0)
-            return undefined;
         // Counted as its own statement, never inside the log payload below: this call is the detection
         // mechanism, not a formatting step, and payload expressions in this repo are fair game to wrap
         // in an `enabled` gate (`Collection.advanceContext` does exactly that). A gate added there
@@ -1929,45 +1873,86 @@ export class CoordinatorRepo {
         };
     }
     /**
-     * Count one confirmed pending-conflict refusal against the holder(s) of each block it names, and say
-     * ONCE — in words, at the moment it becomes provable — when a block is wedged behind a reservation
-     * that is not going to clear.
+     * The rival unresolved actions THIS node's own storage says hold `blockIds`, excluding the request's
+     * own action (a redelivered pend must not corroborate against itself). Empty when nothing is found
+     * — including when the read itself fails, which is reported and then treated as "nothing to add",
+     * since the caller's answer does not depend on it.
      *
-     * **Why this needs saying at all.** Every individual refusal here is indistinguishable from an
-     * ordinary lost race, which is a normal and healthy event, so the logs of a permanently wedged block
-     * read exactly like the logs of a busy one. Finding the difference today means noticing that the
-     * SAME rival action id keeps appearing across unrelated writers for as long as the process lives —
-     * a pattern nothing points at, and one that cost a downstream project several tickets and weeks to
-     * re-derive from raw traces. The node has the fact in hand at every refusal; this makes it sayable.
+     * Carries no `transform`, which {@link ActionPending} allows and no consumer rebases from.
      *
-     * **The signal, and the two things that are NOT the signal.** The discriminator is repetition
-     * against an unchanged holder — see {@link STUCK_RESERVATION_DISTINCT_ACTIONS} for why distinct
-     * refused actions is the right counter and for the measured threshold. Two cheaper-looking tests
-     * were tried and do not work: the members' in-memory reservation table
-     * (`ClusterMember.activeTransactions`) clears the moment a rival's pend reaches consensus, so a
-     * perfectly healthy rival inside its pend-to-commit window is absent from it too and absence there
-     * says nothing; and "the block already passed this pending record's revision" catches a different
-     * orphan class entirely — in the verified instance the wedged block sat at revision 1 while the
-     * orphaned record was for revision 2, still nominally promotable.
-     *
-     * **Never a control path.** This classifies and logs; it never refuses, expires, or deletes
-     * anything. Deciding when a durable pending record may be removed is precisely the hard problem
-     * backlog `debt-unpromotable-pending-records-need-a-sweep` exists for — deleting a live reservation
-     * is worse than the leak — and a counter accurate enough for a log line is not evidence enough to
-     * destroy state.
+     * Diagnostic enrichment only, never a gate: the refusal it corroborates was already cast and signed
+     * by a member, and nothing here can turn an admission into a refusal or the reverse.
+     */
+    async corroborateHeldBlocks(request, blockIds, peerCount) {
+        const pending = [];
+        // The refusing member reads the request's base only in a cohort that can leave a member out
+        // (`ClusterMember.reservationRequestOf`); read it here under the same condition.
+        const readsBase = cohortCanMissAPend(peerCount, this.superMajorityThreshold);
+        try {
+            for (const blockId of blockIds) {
+                // The request's base for the block, read exactly as the refusing member read it (the
+                // malformed-base log line is that member's, so none is repeated here).
+                const reservation = readsBase
+                    ? reservationRequestFor(request, blockId, transformForBlockId(request.transforms, blockId)).request
+                    : { rev: request.rev };
+                for (const claim of await this.pendingClaimsOf(blockId)) {
+                    // The same rule, on the same inputs, as the refusing member (`isReservationAgainst`): a
+                    // record this request's writer has built on is not the rival it was refused on, and
+                    // naming it would feed a superseded action into the writer's `pending` list and into
+                    // the stuck-reservation holder comparison; and, where the base is read, a record
+                    // claiming a slot past the request's declared base IS one, even when the requested
+                    // revision has moved beyond it — the revision rule alone would leave that refusal
+                    // uncorroborated.
+                    if (claim.actionId !== request.actionId && isReservationAgainst(claim, reservation)) {
+                        pending.push({ blockId, actionId: claim.actionId });
+                    }
+                }
+            }
+        }
+        catch (readError) {
+            this.log('coordinator-repo:pend-conflict-classify-read-error', {
+                actionId: request.actionId,
+                error: readError.message
+            });
+            return [];
+        }
+        return pending;
+    }
+    /**
+     * This node's pending records on `blockId`, each with the slot it claims when storage can say
+     * (`IPendingClaimReader`, which `StorageRepo` implements). A repo without the capability answers
+     * with `state.pendings` alone, every record read as an unknown claim — which reserves, so the
+     * corroboration can only over-name, never under-name.
+     */
+    async pendingClaimsOf(blockId) {
+        const reader = this.storageRepo;
+        if (typeof reader.listPendingClaims === 'function') {
+            return await reader.listPendingClaims(blockId);
+        }
+        const results = await this.storageRepo.get({ blockIds: [blockId] });
+        return (results[blockId]?.state?.pendings ?? []).map(actionId => ({ actionId }));
+    }
+    /**
+     * Count one confirmed pending-conflict refusal against the holder(s) of each block it names, and say
+     * ONCE — in words, at the moment it becomes provable — when a block is wedged behind a reservation
+     * that is not going to clear. The counting, the threshold and the wording live in
+     * {@link StuckReservationTracker}; this node's part is the corroborated holder list and the tag.
      *
      * Returns the highest distinct-refusal count any of this refusal's blocks has now reached, for the
      * classification line to carry; it saturates at the threshold once an episode has been reported,
      * since the ids are dropped at that point.
      *
-     * NOTE: fed only by {@link classifyPendingConflictRejection}, i.e. by refusals that arrive as a
-     * cohort-wide validator rejection. A block only PART of whose cohort holds the stranded record can
+     * NOTE: fed only by {@link answerBlocksHeld}, i.e. by cohort-wide `held`-answered refusals that this
+     * node's own storage can corroborate. A block only PART of whose cohort holds the stranded record can
      * still reach approval super-majority, and its refusal then comes back through the retained local
-     * apply verdict (`getExecutedPendResult`) instead, which this never sees — so a partially wedged
-     * block goes unnamed. That is the weaker condition (the write does land on the healthy members),
-     * and instrumenting the second path would count a refusal that the cohort as a whole did not make.
-     * If partial strands ever turn out to be the common shape in the field, the counter belongs on the
-     * member side (`ClusterMember.validatePendOperations`), where each member sees its own votes.
+     * apply verdict (`getExecutedPendResult`) instead, which this never sees. The un-corroborated arm of
+     * {@link answerBlocksHeld} is likewise unfed: this node cannot name the holder, and feeding it a
+     * guess would poison the holder comparison, which is what separates a wedge from healthy
+     * contention. Neither gap goes unnamed any more: every MEMBER keeps its own tracker, fed by its own
+     * `held` votes (`ClusterMember.validatePendOperations`, tag `cluster-member:stuck-reservation`), so
+     * a reservation only some members hold — the shape `a-member-that-missed-a-commit-refuses-every-
+     * later-write` measured, before the member stopped refusing on a superseded record at all — is
+     * named by the members that hold it.
      */
     noteStuckReservation(pending, refusedActionId) {
         const rivalsByBlock = new Map();
@@ -1978,38 +1963,9 @@ export class CoordinatorRepo {
             else
                 rivalsByBlock.set(blockId, [actionId]);
         }
-        let highest = 0;
-        for (const [blockId, rivals] of rivalsByBlock) {
-            const holders = [...new Set(rivals)].sort();
-            const prior = this.stuckReservations.get(blockId);
-            // A different holder set is a DIFFERENT episode — the block changed hands, which is the
-            // healthy cycle — so the count starts over and the new holder gets its own chance to speak.
-            const watch = prior !== undefined && sameHolders(prior.holders, holders)
-                ? prior
-                : { holders, refused: new Set(), reported: false };
-            if (watch !== prior)
-                this.stuckReservations.set(blockId, watch);
-            if (watch.reported) {
-                highest = Math.max(highest, STUCK_RESERVATION_DISTINCT_ACTIONS);
-                continue;
-            }
-            watch.refused.add(refusedActionId);
-            highest = Math.max(highest, watch.refused.size);
-            if (watch.refused.size < STUCK_RESERVATION_DISTINCT_ACTIONS)
-                continue;
-            this.log('coordinator-repo:stuck-reservation', {
-                blockId,
-                // The ids an operator needs to grep for and to cancel, kept as data beside the prose so a
-                // log search finds the block and the action without parsing English.
-                holdingActionIds: holders,
-                distinctRefusedActions: watch.refused.size,
-                message: stuckReservationMessage(holders, watch.refused.size)
-            });
-            watch.reported = true;
-            // Said once per episode: from here the flag alone suppresses, and the ids have done their
-            // work (their count is in the line above), so drop them rather than growing a set for the
-            // unbounded remainder of a permanent condition.
-            watch.refused.clear();
+        const { highest, named } = this.stuckReservations.note(rivalsByBlock, refusedActionId);
+        for (const episode of named) {
+            this.log('coordinator-repo:stuck-reservation', episode);
         }
         return highest;
     }
@@ -2027,11 +1983,7 @@ export class CoordinatorRepo {
      * episode holding an LRU slot can only evict a live one.
      */
     clearStuckReservations(blockIds, holderActionId) {
-        for (const blockId of blockIds) {
-            if (holderActionId !== undefined && !this.stuckReservations.peek(blockId)?.holders.includes(holderActionId))
-                continue;
-            this.stuckReservations.delete(blockId);
-        }
+        this.stuckReservations.forget(blockIds, holderActionId);
     }
     async cancel(actionRef, options) {
         const blockIds = actionRef.blockIds;
@@ -2083,54 +2035,12 @@ export class CoordinatorRepo {
     }
     async commit(request, options) {
         const blockIds = request.blockIds;
-        // Same as `pend`: forget any settled absence of these blocks before routing, whatever the outcome.
-        this.forgetSettledAbsences(blockIds);
         await this.verifyResponsibility(blockIds);
-        const cohortPeerIds = await this.coordinator.getClusterPeerIds(blockIds[0]);
-        const peerCount = cohortPeerIds.length;
-        if (peerCount <= 1) {
-            // Solo cohort: consensus never runs, so no ClusterRecord exists to project a proof from —
-            // the lone member self-signs a one-peer proof instead (mintSoloCommitProof), which is what
-            // lets a block born on a cohort of one ever gain a second holder under the certified-push
-            // default (handlePush refuses a proof-less block). Minted even when peerCount is 0 or the
-            // sole peer is not self — findCluster failing (getClusterPeerIds returns []) puts the
-            // DEGRADED-ROUTING case in this same branch, and self genuinely committed these bytes
-            // either way; a proof's peer list is already not evidence of cohort membership by design
-            // (caller obligation #1 on verifyBlockCommitProofClaim), so gating the mint on cohort
-            // composition would buy no safety while opening a silent no-proof hole exactly when
-            // routing is degraded. The log line is how an operator tells a real cohort of one
-            // (cohortSize 1, soleIsSelf true) from a routing failure (cohortSize 0, or a sole peer
-            // that is not this node).
-            this.log('commit:solo-cohort', {
-                blockId: blockIds[0],
-                cohortSize: peerCount,
-                soleIsSelf: peerCount === 1 && this.localPeerId !== undefined
-                    && cohortPeerIds[0] === this.localPeerId.toString()
-            });
-            // Same message shape the multi-peer path produces — executeClusterTransaction stamps
-            // coordinatingBlockIds at its choke point, so the solo artifact must carry it too or a
-            // solo proof's message is distinguishable from every other proof's.
-            const message = {
-                operations: [{ commit: request }],
-                coordinatingBlockIds: [blockIds[0]],
-                expiration: options?.expiration ?? Date.now() + this.DEFAULT_TIMEOUT
-            };
-            // `undefined` when no local cluster is wired (direct constructors, unit-test doubles) —
-            // then the commit lands proof-less, exactly the pre-mint behavior. The cast is the named
-            // ICommitProofPersister contract; a plain IRepo double ignores the extra argument.
-            const proof = await this.localCluster?.mintSoloCommitProof?.(message);
-            const result = await this.storageRepo.commit(request, options, proof);
-            // One self-approval arms the read-repair window only where the DECLARED cohort is also one
-            // — then no rival quorum can exist to be missed. At any larger declared size (including
-            // an undeclared one, which resolves to the replication factor, and including degraded
-            // routing where peerCount is 0) this commit proves nothing about rival quorums — see
-            // commitQuorumRulesOutRivals — so the window stays unarmed and the read path's
-            // solo-self-skip exit re-arms it once per consult instead (which keeps GitHub issue #8's
-            // consult storm bounded at one per window).
-            if (result.success && this.commitQuorumRulesOutRivals(1, peerCount))
-                this.markBlocksSeen(blockIds);
-            return result;
+        const cohort = await this.coordinator.resolveCohort(blockIds[0]);
+        if (!cohort.resolved || cohort.peerIds.length <= 1) {
+            return await this.commitSolo(request, blockIds, cohort, options);
         }
+        const peerCount = cohort.peerIds.length;
         const message = {
             operations: [{ commit: request }],
             expiration: options?.expiration ?? Date.now() + this.DEFAULT_TIMEOUT
@@ -2163,10 +2073,16 @@ export class CoordinatorRepo {
             // fresh revision, which is what the `conflict: true` shape makes `Collection.syncAttempts`
             // and the multi-collection `pendPhase` do. But a member reached only by
             // `scheduleCommitRetry` can still land the refused revision later, and this node's own
-            // member (or its fallback commit) may hold it already. The writer's retry with the SAME
-            // action id converges either way: `isOwnRevision` in `StorageRepo.pend` and `commit`
-            // treats an already-landed own revision as satisfied, and `inFlightActionId` in
-            // `Collection.updateInternal` keeps the retry on the same action.
+            // member (or its fallback commit) may hold it already. When the refused block is the
+            // action's LOG TAIL, that matters beyond this block: `NetworkTransactor.commit` stops at a
+            // refused tail and never sweeps the action's other blocks, so the writer can then read
+            // its own log entry back while none of the data it describes was committed anywhere.
+            // The writer's retry with the SAME action id is what converges that, and only because it
+            // does two things: `isOwnRevision` in `StorageRepo.pend` and `commit` treats an
+            // already-landed own revision as satisfied, and `Collection.completeOwnEntry` — on
+            // finding that entry — re-sends the refused attempt at the same revision to land the
+            // blocks left behind BEFORE the write is reported saved. Seeing its own log entry is
+            // never, on its own, the writer's proof of durability.
             const durability = cohortDurability(record, cohortCommitOutcomes);
             if (localExecuted) {
                 // Our own member applied this commit during consensus. Its retained storage verdict is
@@ -2209,14 +2125,15 @@ export class CoordinatorRepo {
                     });
                 }
                 // An absent verdict (a member that predates retention, a restart, the TTL) is not
-                // evidence of holding anything: it is simply not counted.
-                const durableHolders = durability.remoteHolders + (localDurable ? 1 : 0);
-                if (!isDurableMajority(durableHolders, durability.cohortSize)) {
+                // evidence of holding anything: it is simply not counted — so the class below reads
+                // LOWER than reality for such a member, never higher.
+                const durableHolders = durability.remoteHolders.length + (localDurable ? 1 : 0);
+                if (!isDurableMajority(durableHolders, durability.cohortPeerIds.length)) {
                     return this.refuseCommitNotDurable(request, durableHolders, durability, 'local-executed');
                 }
                 if (armFreshness)
                     this.markBlocksSeen(blockIds);
-                return { success: true };
+                return await this.acknowledgeCommit(request, { success: true, durability: this.cohortWriteDurability(durability, localDurable) }, localDurable, record);
             }
             // Local cluster didn't execute during consensus. Attempt a local commit, but tolerate
             // local divergence when the cluster already reached consensus AND a durable majority of
@@ -2230,9 +2147,11 @@ export class CoordinatorRepo {
             //     but not the revision that created the block (see StorageRepo.internalCommit).
             // Reporting a tolerated divergence to the caller as the raw refusal would surface a
             // committed transaction as a stale loss: db-core's commitPhase treats any returned
-            // `success:false` as a permanent stale failure. So a divergence on a durable majority is
-            // reported as success, and one WITHOUT a durable majority as the durability gate's
-            // retryable refusal (`tolerateLocalCommitDivergence`).
+            // `success:false` as a stale loss, and its coordinator re-drives the refused collection
+            // (alone, even after a sibling collection committed) until its retry budget is spent. So
+            // a divergence on a durable majority is reported as success, and one WITHOUT a durable
+            // majority as the durability gate's retryable refusal (`tolerateLocalCommitDivergence`),
+            // which that re-drive is what clears.
             //
             // The gate is evaluated BEFORE the local fallback commit, and a failing gate skips it.
             // This node counts toward the majority only when it is in the cohort the commit ran on;
@@ -2241,8 +2160,8 @@ export class CoordinatorRepo {
             // that lone off-cohort copy is exactly the seed of the "revision exists on one node that
             // is not responsible for it" placement the durability gate exists to prevent.
             const selfInCohort = this.localPeerId !== undefined && this.localPeerId.toString() in record.peers;
-            if (!isDurableMajority(durability.remoteHolders + (selfInCohort ? 1 : 0), durability.cohortSize)) {
-                return this.refuseCommitNotDurable(request, durability.remoteHolders, durability, 'fallback-skipped');
+            if (!isDurableMajority(durability.remoteHolders.length + (selfInCohort ? 1 : 0), durability.cohortPeerIds.length)) {
+                return this.refuseCommitNotDurable(request, durability.remoteHolders.length, durability, 'fallback-skipped');
             }
             //
             // Deliberately NOT self-signed here (unlike the solo short-circuit above): consensus for
@@ -2259,18 +2178,22 @@ export class CoordinatorRepo {
                 if (result.success) {
                     // The gate above already admitted this shape: the remote holders plus this node
                     // (when it is in the cohort) form the majority, and this node now holds it.
+                    // Storage's own `local` answer is replaced by the cohort's — this node counts exactly
+                    // as the gate counted it, i.e. only when it is a cohort member.
                     if (armFreshness)
                         this.markBlocksSeen(blockIds);
-                    return result;
+                    // The fallback commit landed every block, so this node holds them — whether or not
+                    // it is a cohort member — and can source a push to whoever the class names as missing.
+                    return await this.acknowledgeCommit(request, { ...result, durability: this.cohortWriteDurability(durability, selfInCohort) }, true, record);
                 }
                 if (isMissingBaseRevisionFailure(result) && clusterReachedCommitConsensus(record)) {
-                    return this.tolerateLocalCommitDivergence(request, blockIds, result.reason ?? MISSING_BASE_REVISION_REASON, armFreshness, durability);
+                    return await this.tolerateLocalCommitDivergence(request, blockIds, result.reason ?? MISSING_BASE_REVISION_REASON, armFreshness, durability);
                 }
                 return result;
             }
             catch (err) {
                 if (clusterReachedCommitConsensus(record)) {
-                    return this.tolerateLocalCommitDivergence(request, blockIds, err.message, armFreshness, durability);
+                    return await this.tolerateLocalCommitDivergence(request, blockIds, err.message, armFreshness, durability);
                 }
                 throw err;
             }
@@ -2425,14 +2348,188 @@ export class CoordinatorRepo {
      * window unarmed — this peer is known to be behind here, the last place a self-referential
      * freshness stamp belongs.
      */
-    tolerateLocalCommitDivergence(request, blockIds, detail, armFreshness, durability) {
-        if (!isDurableMajority(durability.remoteHolders, durability.cohortSize)) {
-            return this.refuseCommitNotDurable(request, durability.remoteHolders, durability, `fallback-diverged: ${detail}`);
+    async tolerateLocalCommitDivergence(request, blockIds, detail, armFreshness, durability) {
+        if (!isDurableMajority(durability.remoteHolders.length, durability.cohortPeerIds.length)) {
+            return this.refuseCommitNotDurable(request, durability.remoteHolders.length, durability, `fallback-diverged: ${detail}`);
         }
         this.log('coordinator-repo:commit-local-failed-cluster-succeeded', { actionId: request.actionId, error: detail });
         if (armFreshness)
             this.markBlocksSeen(blockIds);
-        return { success: true };
+        // This node holds nothing: it is an UNCONFIRMED member when it is in the cohort (so the class
+        // is `majority`), and simply absent from the count when it is not (so the class can be `full`
+        // when every member confirmed). Both fall out of the one rule in `cohortWriteDurability`.
+        // Holding nothing, it is also no source for a push, so no shortfall is recorded here.
+        return await this.acknowledgeCommit(request, { success: true, durability: this.cohortWriteDurability(durability, false) }, false);
+    }
+    /**
+     * The one way a success leaves {@link commit}: record the replication shortfall the answer
+     * describes, then return the answer unchanged. Every success exit — solo, local-executed, local
+     * fallback, tolerated divergence — runs after the durability gate admitted it, so a refused
+     * commit never reaches the ledger.
+     *
+     * `localHolds` is whether this node's own storage durably holds every block of the commit, which
+     * is what makes it a source for the missing copies — not whether the class counted it. `record`
+     * is the consensus the commit ran on, absent for the solo short-circuit (no cohort ran, so no
+     * holders to report).
+     */
+    async acknowledgeCommit(request, answer, localHolds, record) {
+        if (localHolds && record !== undefined)
+            this.reportCommittedHolders(request, answer.durability, record);
+        await this.noteReplicationShortfall(request, answer.durability, localHolds);
+        return answer;
+    }
+    /**
+     * Tell the {@link CommittedHoldersSink} who holds a cohort commit this node holds, so its rebalance
+     * monitor does not push the blocks back to members that stored them. A holder is a member the
+     * durability class confirmed AND that signed an approving commit vote: the confirmation rests on
+     * the member's unsigned apply report, and requiring the signature too means a member lying in that
+     * report can only misstate its own copy — a member already trusted with the commit. The members
+     * the class names unconfirmed are reported as such, which withdraws any earlier record of them
+     * (including the signer list this node's own member reported at apply), so they are pushed the
+     * block. Never throws: the commit is already acknowledged.
+     */
+    reportCommittedHolders(request, durability, record) {
+        if (!this.onCommittedHolders)
+            return;
+        const self = this.localPeerId?.toString();
+        const unconfirmed = durability.unconfirmed ?? [];
+        const holders = (durability.cohortPeerIds ?? [])
+            .filter(peerId => !unconfirmed.includes(peerId))
+            .filter(peerId => peerId === self || record.commits[peerId]?.type === 'approve');
+        try {
+            this.onCommittedHolders({ blockIds: request.blockIds, holders, unconfirmed });
+        }
+        catch (err) {
+            this.log('coordinator-repo:committed-holders-sink-error', { actionId: request.actionId, error: err.message });
+        }
+    }
+    /**
+     * Write down who is still missing an acknowledged commit, while this node still knows — the
+     * cohort's answer is gone the moment the writer is answered, and the in-memory commit retry does
+     * not survive a restart. One entry per block, all sharing this commit's one cohort answer
+     * (consensus ran on `blockIds[0]`'s cohort for the whole request):
+     * - `full` settles any older entry for the block, whether or not this node holds it;
+     * - `majority` records the unconfirmed members by name;
+     * - `local` and `unrouted` record an EMPTY missing set, meaning "unknown" — nobody could be named.
+     * A shortfall is recorded only when `localHolds`: a node holding nothing has nothing to push, and
+     * the remote majority that admitted the commit already holds it.
+     *
+     * NEVER throws, and that asymmetry is deliberate: by the time this runs the commit is already
+     * durable at the class the answer states, so a ledger fault must not turn an acknowledged write
+     * into a reported failure. A failure is logged per block and the answer still goes out; the
+     * block's copy is then owed with nobody tracking it, exactly as before the ledger existed.
+     *
+     * NOTE: one ledger read and write per block per below-full commit, awaited before the writer is
+     * answered — on a node that is genuinely alone that is every commit (a `full` commit settles from
+     * the ledger's in-memory index and touches the store only when an entry exists). If it shows in
+     * commit latency, coalesce the writes rather than answering first: an entry written after the
+     * answer can be lost to a crash in between, which is the one case the ledger exists for.
+     */
+    async noteReplicationShortfall(request, durability, localHolds) {
+        const ledger = this.underReplicationLedger;
+        if (ledger === undefined)
+            return;
+        // Blocks a torn commit abandoned were cancelled and hold nothing at this revision: there is no
+        // copy to push, and an entry would have a drain repeatedly read a block that is not there.
+        // No answer built in this class names `torn` today — the writer's transactor derives it after
+        // every coordinator has answered — so this guards against a future producer, not a current one.
+        const torn = new Set(durability.torn ?? []);
+        const blockIds = request.blockIds.filter(blockId => !torn.has(blockId));
+        const outcomes = await Promise.allSettled(blockIds.map(blockId => this.noteBlockShortfall(ledger, request, blockId, durability, localHolds)));
+        outcomes.forEach((outcome, i) => {
+            if (outcome.status === 'fulfilled')
+                return;
+            this.log('coordinator-repo:under-replication-record-failed', {
+                actionId: request.actionId,
+                blockId: blockIds[i],
+                rev: request.rev,
+                quorum: durability.quorum,
+                error: outcome.reason instanceof Error ? outcome.reason.message : String(outcome.reason)
+            });
+        });
+    }
+    async noteBlockShortfall(ledger, request, blockId, durability, localHolds) {
+        if (durability.quorum === 'full') {
+            await ledger.settle(blockId, request.rev);
+            return;
+        }
+        if (!localHolds)
+            return;
+        await ledger.record({
+            blockId,
+            rev: request.rev,
+            actionId: request.actionId,
+            quorum: durability.quorum,
+            missingPeerIds: durability.quorum === 'majority' ? durability.unconfirmed ?? [] : [],
+            recordedAt: this.now(),
+            attempts: 0
+        });
+    }
+    /**
+     * The durability class beside the gate: derived from the SAME sets {@link isDurableMajority} was
+     * just measured on, with this node's own contribution passed per arm exactly as the gate counted
+     * it, so the class and the gate can never disagree. One rule for all three success exits of
+     * {@link commit}: `full` iff every cohort member is confirmed, otherwise `majority` (the gate
+     * already refused anything below that). Never `local` or `unrouted` here — those belong to the
+     * solo short-circuit, where no cohort ran.
+     */
+    cohortWriteDurability(durability, selfHolds) {
+        return cohortWriteDurability(durability, selfHolds, this.localPeerId?.toString());
+    }
+    /**
+     * The solo short-circuit of {@link commit}: consensus never runs, so no ClusterRecord exists to
+     * project a proof from — the lone member self-signs a one-peer proof instead (mintSoloCommitProof),
+     * which is what lets a block born on a cohort of one ever gain a second holder under the
+     * certified-push default (handlePush refuses a proof-less block). Minted even when the cohort did
+     * not resolve or the sole peer is not self — a failed `findCluster` puts the DEGRADED-ROUTING case
+     * in this same branch, and self genuinely committed these bytes either way; a proof's peer list is
+     * already not evidence of cohort membership by design (caller obligation #1 on
+     * verifyBlockCommitProofClaim), so gating the mint on cohort composition would buy no safety while
+     * opening a silent no-proof hole exactly when routing is degraded.
+     *
+     * The policy is unchanged — every write accepted here before is accepted now. What changes is
+     * that the answer says which situation it was: the `commit:solo-cohort` log line (how an operator
+     * tells a real cohort of one — cohortSize 1, soleIsSelf true — from a routing failure) now also
+     * carries the `quorum` the writer is told, and both come from {@link soloCohortDurability}, so the
+     * log and the answer cannot disagree.
+     */
+    async commitSolo(request, blockIds, cohort, options) {
+        const cohortPeerIds = cohort.resolved ? cohort.peerIds : [];
+        const peerCount = cohortPeerIds.length;
+        const soloDurability = this.soloCohortDurability(cohort);
+        this.log('commit:solo-cohort', {
+            blockId: blockIds[0],
+            cohortSize: peerCount,
+            soleIsSelf: peerCount === 1 && this.localPeerId !== undefined
+                && cohortPeerIds[0] === this.localPeerId.toString(),
+            quorum: soloDurability.quorum,
+            ...(cohort.resolved ? {} : { reason: cohort.reason })
+        });
+        // Same message shape the multi-peer path produces — executeClusterTransaction stamps
+        // coordinatingBlockIds at its choke point, so the solo artifact must carry it too or a
+        // solo proof's message is distinguishable from every other proof's.
+        const message = {
+            operations: [{ commit: request }],
+            coordinatingBlockIds: [blockIds[0]],
+            expiration: options?.expiration ?? Date.now() + this.DEFAULT_TIMEOUT
+        };
+        // `undefined` when no local cluster is wired (direct constructors, unit-test doubles) —
+        // then the commit lands proof-less, exactly the pre-mint behavior. The cast is the named
+        // ICommitProofPersister contract; a plain IRepo double ignores the extra argument.
+        const proof = await this.localCluster?.mintSoloCommitProof?.(message);
+        const result = await this.storageRepo.commit(request, options, proof);
+        if (!result.success)
+            return result;
+        // One self-approval arms the read-repair window only where the DECLARED cohort is also one
+        // — then no rival quorum can exist to be missed. At any larger declared size (including
+        // an undeclared one, which resolves to the replication factor, and including degraded
+        // routing where peerCount is 0) this commit proves nothing about rival quorums — see
+        // commitQuorumRulesOutRivals — so the window stays unarmed and the read path's
+        // solo-self-skip exit re-arms it once per consult instead (which keeps GitHub issue #8's
+        // consult storm bounded at one per window).
+        if (this.commitQuorumRulesOutRivals(1, peerCount))
+            this.markBlocksSeen(blockIds);
+        return await this.acknowledgeCommit(request, { ...result, durability: soloDurability }, true);
     }
     /**
      * The durability gate's answer: a retryable refusal ({@link COMMIT_NOT_DURABLE_REASON}) naming how
@@ -2442,28 +2539,84 @@ export class CoordinatorRepo {
      * read-repair window is deliberately NOT armed: nothing about this commit is freshness evidence.
      */
     refuseCommitNotDurable(request, durableHolders, durability, arm) {
+        const cohortSize = durability.cohortPeerIds.length;
         this.log('coordinator-repo:commit-not-durable', {
             actionId: request.actionId,
             rev: request.rev,
             durableHolders,
-            cohortSize: durability.cohortSize,
+            cohortSize,
             remoteHolders: durability.remoteHolders,
             remoteRefusals: durability.remoteRefusals,
             arm
         });
+        // A failure carries no durability, and no "unknown" class stands in for one.
         return {
             success: false,
             conflict: true,
-            reason: `${COMMIT_NOT_DURABLE_REASON}: ${durableHolders} of ${durability.cohortSize} cohort member(s) report holding rev ${request.rev} of action ${request.actionId} (${arm})`
+            reason: `${COMMIT_NOT_DURABLE_REASON}: ${durableHolders} of ${cohortSize} cohort member(s) report holding rev ${request.rev} of action ${request.actionId} (${arm})`
         };
     }
 }
 function cohortDurability(record, outcomes) {
-    const reports = Object.values(outcomes ?? {});
+    const reports = Object.entries(outcomes ?? {});
+    return {
+        cohortPeerIds: Object.keys(record.peers),
+        remoteHolders: reports.filter(([, report]) => report.success).map(([peerId]) => peerId),
+        remoteRefusals: reports.filter(([, report]) => !report.success).map(([peerId]) => peerId)
+    };
+}
+/**
+ * The commit-tier durability class, from the gate's own sets. `confirmed` is counted exactly as the
+ * gate counted it (remote holders, plus one for this node when `selfHolds`), and `unconfirmed` is
+ * every cohort member outside that set — so a `full` answer names nobody as missing, and a
+ * `majority` answer names exactly who. The class is `full` iff no cohort member is unconfirmed;
+ * anything below `majority` never reaches here (the gate refused it).
+ */
+function cohortWriteDurability(durability, selfHolds, selfPeerId) {
+    const holders = new Set(durability.remoteHolders);
+    if (selfHolds && selfPeerId !== undefined)
+        holders.add(selfPeerId);
+    const unconfirmed = durability.cohortPeerIds.filter(peerId => !holders.has(peerId));
+    return {
+        quorum: unconfirmed.length === 0 ? 'full' : 'majority',
+        confirmed: durability.remoteHolders.length + (selfHolds ? 1 : 0),
+        cohort: durability.cohortPeerIds.length,
+        unconfirmed,
+        cohortPeerIds: durability.cohortPeerIds
+    };
+}
+/**
+ * The pend-tier durability class: who ACCEPTED the pending record, read off the record's approving
+ * promise votes. This node's own member is added when `selfAccepted` is true, removed when it is
+ * false (its member applied and refused, so its approve vote no longer describes what it holds),
+ * and left to its vote when `undefined` (no retained verdict — the vote is the only evidence there
+ * is). This node counts only when it is IN the cohort, as the commit tier counts it: a coordinator
+ * outside `record.peers` whose fallback pend landed holds a copy no cohort member will ever look
+ * for, and counting it would let `confirmed` exceed `cohort`. NOT comparable to the commit-tier
+ * count: accepting a pending record confers no storage durability, and the field's own
+ * documentation says so.
+ * NOTE: a REMOTE member's vote is never withdrawn here. The pend arm of `ClusterRecord.applyOutcomes`
+ * reports only conflict-shaped refusals (which downgrade the whole pend to a retryable conflict
+ * before this runs), so a remote member that promised and then faulted at apply keeps its approve
+ * vote and a pend's `full` can overstate by that member. Harmless while nothing reads a pend's
+ * class for repair; if that changes, widen the member's report to carry bare faults too.
+ */
+function pendCohortDurability(record, selfAccepted, selfPeerId) {
+    const cohortPeerIds = Object.keys(record.peers);
+    const accepted = new Set(Object.entries(record.promises).filter(([, vote]) => vote.type === 'approve').map(([peerId]) => peerId));
+    if (selfPeerId !== undefined && cohortPeerIds.includes(selfPeerId)) {
+        if (selfAccepted === true)
+            accepted.add(selfPeerId);
+        if (selfAccepted === false)
+            accepted.delete(selfPeerId);
+    }
+    const unconfirmed = cohortPeerIds.filter(peerId => !accepted.has(peerId));
     return {
-        cohortSize: Object.keys(record.peers).length,
-        remoteHolders: reports.filter(report => report.success).length,
-        remoteRefusals: reports.filter(report => !report.success).length
+        quorum: unconfirmed.length === 0 ? 'full' : 'majority',
+        confirmed: accepted.size,
+        cohort: cohortPeerIds.length,
+        unconfirmed,
+        cohortPeerIds
     };
 }
 /**