@optimystic/db-p2p 1.0.0-beta.3 → 1.1.0

package/dist/src/repo/coordinator-repo.d.ts

@@ -1,12 +1,14 @@
 import type { PendRequest, ActionBlocks, IRepo, MessageOptions, CommitResult, GetBlockResults, PendResult, StaleFailure, BlockGets, CommitRequest, RepoMessage, IKeyNetwork, ICluster, ClusterConsensusConfig, BlockId, ActionContext, ClusterRecord } from "@optimystic/db-core";
+import { type CohortResolution } from "./cluster-coordinator.js";
 import type { PeerId } from "@libp2p/interface";
 import type { FretService } from "p2p-fret";
 import type { IPeerReputation } from "../reputation/types.js";
 import type { ITransactionStateStore } from "../cluster/i-transaction-state-store.js";
 import { type ProofAnchoring } from "../cluster/certified-claims.js";
 import { type BlockCommitProof } from "../cluster/commit-proof.js";
-import type { ReconcileBlockCallback } from "../cluster/cluster-repo.js";
+import type { ReconcileBlockCallback, CommittedHoldersSink } from "../cluster/cluster-repo.js";
 import type { CertifiedActionRev } from "../storage/block-archive.js";
+import type { IUnderReplicationLedger } from "./i-under-replication-ledger.js";
 /**
  * Acquire a block's content for a cohort-corroborated revision, from the cohort, and persist it.
  *
@@ -28,6 +30,8 @@ interface LocalClusterWithExecutionTracking extends ICluster {
     getExecutedPendResult?(messageHash: string): PendResult | undefined;
     /** Local storage's verdict for a commit applied during consensus; see ClusterMember.getExecutedCommitResult. */
     getExecutedCommitResult?(messageHash: string): CommitResult | undefined;
+    /** One more reconcile for a behind-refused commit, once remote members hold it; see ClusterMember.reconcileRefusedCommit. */
+    reconcileRefusedCommit?(record: ClusterRecord): Promise<void>;
     /** Self-sign a one-peer commit proof for the solo-cohort commit path; see ClusterMember.mintSoloCommitProof.
      *  Optional like its siblings: absent on a bare ICluster double, and then the solo path simply
      *  commits proof-less — exactly the pre-mint behavior. */
@@ -79,6 +83,17 @@ interface CoordinatorRepoComponents {
      * acceptance internally regardless.
      */
     proofAnchoring?: ProofAnchoring;
+    /**
+     * Optional durable record of commits acknowledged below full replication, and who is still
+     * missing each block — see {@link CoordinatorRepo.noteReplicationShortfall}. Absent → nothing is
+     * recorded and commit behaves exactly as without it.
+     */
+    underReplicationLedger?: IUnderReplicationLedger;
+    /**
+     * Optional: told who holds each cohort commit this node acknowledges and holds — see
+     * {@link CoordinatorRepo.reportCommittedHolders}. Absent → commit behaves exactly as without it.
+     */
+    onCommittedHolders?: CommittedHoldersSink;
 }
 /**
  * Consensus config for the coordinator side, plus the repair yardstick the read-repair path measures
@@ -108,8 +123,11 @@ export declare function coordinatorRepo(keyNetwork: IKeyNetwork, createClusterCl
  * revert to being ignored. If that field is ever renamed, grep the specs for `coordinator:`.
  */
 export interface ICoordinatorClusterSeam {
+    /** Used by `cancel` alone; `pend` and `commit` read {@link resolveCohort}. */
     getClusterSize(blockId: BlockId): Promise<number>;
-    getClusterPeerIds(blockId: BlockId): Promise<string[]>;
+    /** Whether the cohort could be established at all, and who it is — the primitive
+     *  `getClusterSize` derives from. `pend` and `commit` classify their solo short-circuit on it. */
+    resolveCohort(blockId: BlockId): Promise<CohortResolution>;
     executeClusterTransaction(blockId: BlockId, message: RepoMessage, options?: MessageOptions): Promise<{
         record: ClusterRecord;
         localExecuted: boolean;
@@ -135,37 +153,13 @@ export declare class CoordinatorRepo implements IRepo {
     private readonly clusterLatestCallback?;
     private readonly acquireBlockFromCohort?;
     private readonly proofAnchoring?;
+    private readonly underReplicationLedger?;
+    private readonly onCommittedHolders?;
     private coordinator;
     private readonly DEFAULT_TIMEOUT;
     private readonly localPeerId?;
     private readonly responsibilityCache;
-    private static readonly RESPONSIBILITY_TTL_MS;
     private readonly lastSeenCommitMs;
-    /**
-     * Per block, when (`this.now()` at the consult's start) a consult last SETTLED that this node's
-     * absence of it is the cohort's answer too — see `absenceSettled` on {@link fetchBlockFromCluster}'s
-     * result. Only the solo-self exit settles today: when this node is the block's whole cohort, every
-     * acknowledged commit of it lands in this node's storage before the writer hears success, so the
-     * block reads present and the memo dies. Read only for a block still missing locally
-     * ({@link absenceIsSettled}); cleared by any pend or commit this node coordinates for the block, by
-     * seeing it present, and by any later consult of it that does not settle.
-     *
-     * Deliberately its OWN map rather than `lastSeenCommitMs`: that one is also stamped for missing
-     * blocks at exits whose verdict is NOT a confirmed absence (the `cohort-too-small` arm when a peer
-     * claimed a revision, the post-restore arm when acquisition failed), so reading it here would turn
-     * a `claimed-elsewhere` absence into an authoritative one for a whole window.
-     *
-     * NOTE: accepted tradeoff — a cohort-of-one view can be transient (peers still mid-identify; see
-     * the solo exit), and a block another node creates through the cohort it sees is then reported
-     * absent here for up to one `readRepairWindowMs` after this node's view grows — the same one-window
-     * cost the held-block window pays for a growing cohort. Revisit if a caller ever needs
-     * create-visibility across coordinators tighter than one window — such a caller needs a revision
-     * floor (backlog `feat-refresh-can-demand-a-revision-floor`), not a shorter window.
-     *
-     * NOTE: LRU-bounded like its siblings; an eviction under >1000 settled blocks loses a memo and
-     * costs one extra consult — the safe direction.
-     */
-    private readonly settledAbsences;
     /** Per block, what earlier repair passes left unresolved — see {@link AheadClaimState}.
      *  Outlives the consult on purpose: the read-repair window skips consults for blocks checked
      *  recently, and a doubt dropped there is a stale answer served as confirmed again.
@@ -174,14 +168,14 @@ export declare class CoordinatorRepo implements IRepo {
      *  {@link reportRepairDeadlock} say its piece a second time. */
     private readonly unsettledAheadClaims;
     /**
-     * Per block, what its pending-conflict refusals have added up to — see {@link StuckReservationWatch}
-     * and {@link noteStuckReservation}. Deliberately its OWN map rather than a third fact hung off
-     * {@link unsettledAheadClaims}: that entry belongs to the read-repair path and is cleared by a block
-     * converging on a revision, whereas this one belongs to the write path and is cleared by the block
-     * accepting a write. Sharing the entry would mean teaching both of those lifetimes about a fact
-     * neither owns (backlog `debt-freshness-state-scattered-across-coordinator-repo` is the standing
-     * argument for collapsing all of this per-block state behind one collaborator; adding a fourth
-     * carve-out to the freshness entry would have made that harder, not easier).
+     * Per block, what its pending-conflict refusals have added up to — see {@link StuckReservationTracker}
+     * and {@link noteStuckReservation}. Deliberately its OWN collaborator rather than a third fact hung
+     * off {@link unsettledAheadClaims}: that entry belongs to the read-repair path and is cleared by a
+     * block converging on a revision, whereas this one belongs to the write path and is cleared by the
+     * block accepting a write. Sharing the entry would mean teaching both of those lifetimes about a
+     * fact neither owns (backlog `debt-freshness-state-scattered-across-coordinator-repo` is the
+     * standing argument for collapsing all of this per-block state behind one collaborator; adding a
+     * fourth carve-out to the freshness entry would have made that harder, not easier).
      *
      * NOTE: LRU-bounded like its siblings. An eviction under >1000 conflicted blocks loses an episode's
      * say-once flag, so the line can repeat once for that block — the same bounded duplication
@@ -190,10 +184,9 @@ export declare class CoordinatorRepo implements IRepo {
      * NOTE: per COORDINATOR, and a block's coordinator is whichever peer the writer's key lookup
      * resolved — normally stable, but cohort churn or a routing change moves it. When it moves, the
      * count restarts on the new coordinator (the condition is named later) and the old one may name the
-     * same episode again (the condition is named twice). Fine while a wedged block is diagnosed by
-     * searching for its id; if a churning deployment ever makes duplicate lines the noisy failure this
-     * one exists to replace, the say-once state has to move to where the record lives (the member's own
-     * storage) rather than to where the refusal was classified.
+     * same episode again (the condition is named twice). Each MEMBER now keeps its own tracker as well
+     * (`ClusterMember.validatePendOperations`), fed by its own `held` votes, so the episode is also
+     * named where the record lives, by a count that does not move with the coordinator.
      */
     private readonly stuckReservations;
     private readonly readRepairMode;
@@ -217,7 +210,7 @@ export declare class CoordinatorRepo implements IRepo {
     now: () => number;
     /** Test seam: overridable RNG (0..1) for sample-rate gating. */
     rand: () => number;
-    constructor(keyNetwork: IKeyNetwork, createClusterClient: (peerId: PeerId) => ICluster, storageRepo: IRepo, cfg?: CoordinatorRepoConfig, localCluster?: LocalClusterWithExecutionTracking | undefined, localPeerId?: PeerId, fretService?: FretService, clusterLatestCallback?: ClusterLatestCallback | undefined, reputation?: IPeerReputation, stateStore?: ITransactionStateStore, acquireBlockFromCohort?: AcquireBlockCallback | undefined, proofAnchoring?: ProofAnchoring | undefined);
+    constructor(keyNetwork: IKeyNetwork, createClusterClient: (peerId: PeerId) => ICluster, storageRepo: IRepo, cfg?: CoordinatorRepoConfig, localCluster?: LocalClusterWithExecutionTracking | undefined, localPeerId?: PeerId, fretService?: FretService, clusterLatestCallback?: ClusterLatestCallback | undefined, reputation?: IPeerReputation, stateStore?: ITransactionStateStore, acquireBlockFromCohort?: AcquireBlockCallback | undefined, proofAnchoring?: ProofAnchoring | undefined, underReplicationLedger?: IUnderReplicationLedger | undefined, onCommittedHolders?: CommittedHoldersSink | undefined);
     /**
      * The resolved super-majority threshold this coordinator commits on. Exposed so the composition root
      * can fail-fast if the coordinator and the cluster member would run different thresholds (see the
@@ -227,15 +220,38 @@ export declare class CoordinatorRepo implements IRepo {
     /** Recover coordinator transactions from persistent store after a restart. */
     recoverTransactions(): Promise<void>;
     /**
-     * Check if this node is in the cluster for a given block.
-     * Uses findCluster membership — in the real network layer, self is always
-     * included in the cohort when this node is responsible. This serves as a
-     * defense-in-depth guard for requests that arrive at the wrong node.
-     * Returns true if localPeerId is not set (backward compat for single-node/test setups).
+     * Whether this node is in the cohort for a block. Uses `findCluster` membership — in the real network
+     * layer, self is in the cohort exactly when this node is among the nearest `clusterSize` serving peers
+     * for the block, so a request that reaches a node outside it was sent to the wrong machine.
+     *
+     * Three answers, because a lookup that THREW is not an answer: `undetermined` is never cached (routing
+     * can recover on the next request) and never read as `responsible` — what each caller does with it is
+     * that caller's posture (see {@link verifyResponsibility} and `get`).
+     *
+     * With no `localPeerId` the check is skipped and the answer is `responsible`. That bypass exists for
+     * wiring without an identity (direct constructors, single-node and test setups), never for production,
+     * where `libp2p-node-base` always passes the node's peer id.
+     *
+     * NOTE: a cached answer stands for up to {@link RESPONSIBILITY_TTL_MS} after the cohort changes, so a
+     * node can still say `responsible` for a minute after it stops being so. {@link soloCohortDurability}'s
+     * `unrouted` class and `ClusterCoordinator.executeClusterTransaction`'s cohort-membership guard are what
+     * keep that window honest; if churn ever makes the window matter, shorten the TTL rather than
+     * re-looking-up on every write.
      */
-    private isResponsibleForBlock;
+    private responsibilityFor;
     /**
-     * Verify this node is responsible for all given block IDs. Throws if not.
+     * The write path's gate (`pend`, `cancel`, `commit`): refuse unless this node is responsible for EVERY
+     * block, and refuse too when it cannot tell — fail CLOSED. A write accepted on a thrown lookup commits
+     * where the network was never consulted (GitHub #19); refusing hands it back to the writer's transactor,
+     * which excludes this peer and re-picks inside the cohort.
+     *
+     * Every block is checked so the error names all of them. When the blocks split between the two kinds,
+     * `not-responsible` is the one thrown: it is a settled answer that the request is misrouted, which no
+     * recovery of the lookup would change; the undetermined blocks are still logged.
+     *
+     * For `cancel`, a refusal on a transient lookup fault leaves the pending record standing on this node
+     * until the writer's cancel retry lands on another cohort member — and this node is still discharged
+     * then, since as a member it judges the cancel against the record's own `peers`, not against a lookup.
      */
     private verifyResponsibility;
     get(blockGets: BlockGets, options?: MessageOptions): Promise<GetBlockResults>;
@@ -327,29 +343,30 @@ export declare class CoordinatorRepo implements IRepo {
     private flagUnconfirmedCurrency;
     /** Decide whether the read-repair policy wants us to consult the cluster for a present-but-possibly-stale block. */
     private shouldReadRepair;
-    /**
-     * Decide whether a block MISSING locally may skip its consult: an earlier consult settled its
-     * absence within one read-repair window (see {@link settledAbsences}). The absence counterpart of
-     * {@link shouldReadRepair}, giving absence the guarantee the window already gives content —
-     * "checked with the cohort within one window" — and nothing weaker.
-     *
-     * Modes: `paranoid` never skips ("verify every read" means every read). `lazy` uses the window and
-     * the sample rate, exactly as {@link shouldReadRepair} does. `off` uses the window but not the
-     * sample rate (a `lazy`-only knob, as it is for content): `off` disables STALE-CONTENT repair, and
-     * the absence consult is not that — it is what makes an absent answer authoritative at all — so
-     * leaving it unbounded would make the mode meant to do less network work do more.
-     */
-    private absenceIsSettled;
     /** Milliseconds since we last marked this block fresh, or undefined if never. */
     private ageMs;
+    /**
+     * Whether the solo-self exit of {@link fetchBlockFromCluster} has already named `blockId` inside
+     * the current read-repair window, for a block this node does NOT hold (`localRev` undefined). Such
+     * a block reaches that exit on every read, because `get` never remembers an absence (GitHub
+     * issue #20). So its `cluster-fetch:solo-self-skip` line and its stamp are both skipped while the
+     * stamp is at most one `readRepairWindowMs` old. An unconditional line would bring back issue #8's
+     * log volume for a probed but never-written collection. Re-stamping on every read would keep the
+     * stamp fresh and silence the line for good on a block read more often than once a window.
+     *
+     * Withholding the stamp never skips a consult: `get` asks {@link shouldReadRepair} only about
+     * present blocks. A HELD block reaches the exit only when read-repair already chose to consult, so
+     * this is always false for one. Its line and stamp are unchanged, and the line keeps pairing with
+     * `cluster-tx:read-repair-triggered`.
+     *
+     * NOTE: the stamp is shared with every exit that marks a block seen, so a missing block one of
+     * them stamped inside the window is not named until that stamp lapses. Fine for a diagnostic
+     * line; if anything ever needs "first answer from a self-only view" exactly, give the line its own
+     * per-block stamp.
+     */
+    private soloAbsenceNamedThisWindow;
     /** Mark blocks as freshly observed from cluster authority (post-commit or post-fetch). */
     private markBlocksSeen;
-    /**
-     * Drop any settled-absence memo for `blockIds` ({@link settledAbsences}) — called at the top of a
-     * local pend or commit, before routing and whatever the outcome. Clearing is always the safe
-     * direction: the most it can cost is one extra consult.
-     */
-    private forgetSettledAbsences;
     /**
      * True when a commit's approve votes form a strict majority of the FULL cohort — the only case
      * where "this node committed" is evidence that no rival commit moved past it. Two strict
@@ -404,15 +421,9 @@ export declare class CoordinatorRepo implements IRepo {
      *    retire it when the memo's claimants are among the peers that answered), `no-evidence`
      *    leaves it standing untouched. Required, not optional, so an exit added later has to say
      *    which it means.
-     *  - `absenceSettled` — whether this pass SETTLED the block's absence for one read-repair window:
-     *    no write of it this node has not seen can exist. Only the solo-self exit can say that today
-     *    (this node is the whole cohort, so every acknowledged commit lands here). `get` remembers a
-     *    settled absence ({@link settledAbsences}) and skips the consult while the block stays missing.
-     *    `absence === 'confirmed'` alone is not enough — the empty-cohort exit reports it without
-     *    asking anyone, and a multi-peer cohort's unanimous "nothing" can be overtaken by a commit
-     *    still on its way to this node. Required, like
-     *    `currency`, so an exit added later has to say which side it falls on rather than
-     *    remembering (or forgetting) to arm something.
+     *
+     * Nothing is remembered about an absence: `get` runs this pass on every read of a block missing
+     * locally (see the accepted-tradeoff NOTE there).
      */
     private fetchBlockFromCluster;
     /**
@@ -600,8 +611,34 @@ export declare class CoordinatorRepo implements IRepo {
     private penalizeProofService;
     pend(request: PendRequest, options?: MessageOptions): Promise<PendResult>;
     /** The cluster half of {@link pend}, after responsibility is verified: consensus, the local-verdict
-     *  arms, and the two optimistic-concurrency classifiers a rejection is run through. */
+     *  arms, and the catch that turns each optimistic-concurrency refusal into a retryable answer —
+     *  the two signed-evidence ones ({@link ConflictRaceLostError}, {@link BlocksHeldError}) directly,
+     *  and a validator rejection only through {@link classifyStaleRejection}. */
     private pendThroughCluster;
+    /**
+     * The solo short-circuit of {@link pend}: a cohort of at most one peer runs no consensus, and the
+     * pend goes straight to local storage exactly as before. What changes is the answer's class —
+     * see {@link soloCohortDurability} for the four-way split. A refusal is returned untouched.
+     */
+    private pendSolo;
+    /**
+     * The class of a write that took the solo short-circuit, from the cohort resolution that put it
+     * there. Policy-free: the write already happened, this only says what it was.
+     *  - not resolved (the lookup threw, or named nobody) → `unrouted`;
+     *  - resolved to exactly this node → `local`, a correct and complete one-machine write;
+     *  - resolved to exactly one peer that is NOT this node → `unrouted` — this node wrote somewhere
+     *    the cohort does not look, which is a write whose destination is wrong, not a solo write.
+     * With no local peer id (direct constructors, single-node and test wiring) a resolved cohort of
+     * one reads as `local`: the same posture `responsibilityFor` takes for a node with no
+     * identity, and a node with no identity cannot be in any cohort but its own.
+     *
+     * Both `unrouted` arms are defence in depth now, not the main guard: {@link verifyResponsibility}
+     * refuses a write whose lookup throws and a write for a cohort that excludes this node before the
+     * short-circuit is reached. A write lands here unrouted only inside the responsibility cache's
+     * staleness window, or when a second lookup fails moments after the first succeeded — and then it
+     * still reports honestly rather than posing as `local`.
+     */
+    private soloCohortDurability;
     /**
      * Decide whether a cluster validator rejection was an optimistic-concurrency loss — the block
      * already advanced past the requested revision — rather than a genuine validation fault.
@@ -623,62 +660,69 @@ export declare class CoordinatorRepo implements IRepo {
      */
     private classifyStaleRejection;
     /**
-     * Sibling of {@link classifyStaleRejection} for the OTHER optimistic-concurrency refusal shape:
-     * the promise-phase pending-conflict vote (`validatePendOperations` rejecting a pend whose
-     * blocks are held by a different unresolved pending action). That vote surfaces here as a
-     * {@link ValidatorRejectionError}, and without classification it would escape as a throw —
-     * splitting multi-tree pends mid-batch instead of taking the retry path a lost race deserves.
+     * Answer a pend the cohort refused with signed `held` votes: the blocks are reserved by a different
+     * unresolved action on one or more members ({@link BlocksHeldError}). Always a retryable
+     * {@link StaleFailure} with `conflict: true`, so the caller's normal retry path
+     * (`Collection.sync`, and the multi-collection pendPhase via `isConflictFailure`) absorbs it
+     * instead of a thrown error escaping mid-batch and splitting multi-tree pends.
+     *
+     * The local re-read is an ENRICHER, not a gate. It used to be the gate — this refusal arrived as a
+     * `ValidatorRejectionError` and was only converted when the coordinator's own storage corroborated
+     * the rival — and under latency the refusing member is routinely ahead of the coordinator, so the
+     * corroboration missed and a transient refusal escaped as a permanent-looking throw. The `held`
+     * vote is already signed evidence from the member that holds the rival, so retryability no longer
+     * depends on a local re-read at all. What the re-read still buys, when it succeeds, is the concrete
+     * rival list for {@link StaleFailure.pending} and the input {@link noteStuckReservation} needs to
+     * name a block wedged behind a reservation that will never clear.
      *
-     * Same confirmation discipline as the stale classifier: purely local. Re-read the affected
-     * blocks from our own storage and require some block's `state.pendings` to carry a rival
-     * actionId; the signed reject text is never consulted. A confirmed rival returns a
-     * {@link StaleFailure} with `conflict: true` and the rivals as `pending` (`ActionPending`
-     * without `transform` — the type allows it, and no consumer rebases from it). Unconfirmed —
-     * including read errors during confirmation — stays a throw, preserving fail-fast for genuine
-     * validation faults. Checked after `classifyStaleRejection` so a confirmed committed loss
-     * (which carries the sharper `staleAt`) wins when both hold.
+     * NOTE: `error.heldBy` (peerId → holding action id) is dropped at this boundary, the same deliberate
+     * drop the {@link ConflictRaceLostError} arm of {@link pendThroughCluster} documents: `StaleFailure`
+     * has no field for it, and the members' action ids are not the same claim as the rivals this node
+     * read out of its own storage, so they must not be folded into `pending`. A caller that wants to
+     * WAIT on the holder rather than re-race it needs a typed field added here; never recover the ids
+     * by parsing `reason`.
      */
-    private classifyPendingConflictRejection;
+    private answerBlocksHeld;
+    /**
+     * The rival unresolved actions THIS node's own storage says hold `blockIds`, excluding the request's
+     * own action (a redelivered pend must not corroborate against itself). Empty when nothing is found
+     * — including when the read itself fails, which is reported and then treated as "nothing to add",
+     * since the caller's answer does not depend on it.
+     *
+     * Carries no `transform`, which {@link ActionPending} allows and no consumer rebases from.
+     *
+     * Diagnostic enrichment only, never a gate: the refusal it corroborates was already cast and signed
+     * by a member, and nothing here can turn an admission into a refusal or the reverse.
+     */
+    private corroborateHeldBlocks;
+    /**
+     * This node's pending records on `blockId`, each with the slot it claims when storage can say
+     * (`IPendingClaimReader`, which `StorageRepo` implements). A repo without the capability answers
+     * with `state.pendings` alone, every record read as an unknown claim — which reserves, so the
+     * corroboration can only over-name, never under-name.
+     */
+    private pendingClaimsOf;
     /**
      * Count one confirmed pending-conflict refusal against the holder(s) of each block it names, and say
      * ONCE — in words, at the moment it becomes provable — when a block is wedged behind a reservation
-     * that is not going to clear.
-     *
-     * **Why this needs saying at all.** Every individual refusal here is indistinguishable from an
-     * ordinary lost race, which is a normal and healthy event, so the logs of a permanently wedged block
-     * read exactly like the logs of a busy one. Finding the difference today means noticing that the
-     * SAME rival action id keeps appearing across unrelated writers for as long as the process lives —
-     * a pattern nothing points at, and one that cost a downstream project several tickets and weeks to
-     * re-derive from raw traces. The node has the fact in hand at every refusal; this makes it sayable.
-     *
-     * **The signal, and the two things that are NOT the signal.** The discriminator is repetition
-     * against an unchanged holder — see {@link STUCK_RESERVATION_DISTINCT_ACTIONS} for why distinct
-     * refused actions is the right counter and for the measured threshold. Two cheaper-looking tests
-     * were tried and do not work: the members' in-memory reservation table
-     * (`ClusterMember.activeTransactions`) clears the moment a rival's pend reaches consensus, so a
-     * perfectly healthy rival inside its pend-to-commit window is absent from it too and absence there
-     * says nothing; and "the block already passed this pending record's revision" catches a different
-     * orphan class entirely — in the verified instance the wedged block sat at revision 1 while the
-     * orphaned record was for revision 2, still nominally promotable.
-     *
-     * **Never a control path.** This classifies and logs; it never refuses, expires, or deletes
-     * anything. Deciding when a durable pending record may be removed is precisely the hard problem
-     * backlog `debt-unpromotable-pending-records-need-a-sweep` exists for — deleting a live reservation
-     * is worse than the leak — and a counter accurate enough for a log line is not evidence enough to
-     * destroy state.
+     * that is not going to clear. The counting, the threshold and the wording live in
+     * {@link StuckReservationTracker}; this node's part is the corroborated holder list and the tag.
      *
      * Returns the highest distinct-refusal count any of this refusal's blocks has now reached, for the
      * classification line to carry; it saturates at the threshold once an episode has been reported,
      * since the ids are dropped at that point.
      *
-     * NOTE: fed only by {@link classifyPendingConflictRejection}, i.e. by refusals that arrive as a
-     * cohort-wide validator rejection. A block only PART of whose cohort holds the stranded record can
+     * NOTE: fed only by {@link answerBlocksHeld}, i.e. by cohort-wide `held`-answered refusals that this
+     * node's own storage can corroborate. A block only PART of whose cohort holds the stranded record can
      * still reach approval super-majority, and its refusal then comes back through the retained local
-     * apply verdict (`getExecutedPendResult`) instead, which this never sees — so a partially wedged
-     * block goes unnamed. That is the weaker condition (the write does land on the healthy members),
-     * and instrumenting the second path would count a refusal that the cohort as a whole did not make.
-     * If partial strands ever turn out to be the common shape in the field, the counter belongs on the
-     * member side (`ClusterMember.validatePendOperations`), where each member sees its own votes.
+     * apply verdict (`getExecutedPendResult`) instead, which this never sees. The un-corroborated arm of
+     * {@link answerBlocksHeld} is likewise unfed: this node cannot name the holder, and feeding it a
+     * guess would poison the holder comparison, which is what separates a wedge from healthy
+     * contention. Neither gap goes unnamed any more: every MEMBER keeps its own tracker, fed by its own
+     * `held` votes (`ClusterMember.validatePendOperations`, tag `cluster-member:stuck-reservation`), so
+     * a reservation only some members hold — the shape `a-member-that-missed-a-commit-refuses-every-
+     * later-write` measured, before the member stopped refusing on a superseded record at all — is
+     * named by the members that hold it.
      */
     private noteStuckReservation;
     /**
@@ -742,6 +786,80 @@ export declare class CoordinatorRepo implements IRepo {
      * freshness stamp belongs.
      */
     private tolerateLocalCommitDivergence;
+    /**
+     * The one way a success leaves {@link commit}: record the replication shortfall the answer
+     * describes, then return the answer unchanged. Every success exit — solo, local-executed, local
+     * fallback, tolerated divergence — runs after the durability gate admitted it, so a refused
+     * commit never reaches the ledger.
+     *
+     * `localHolds` is whether this node's own storage durably holds every block of the commit, which
+     * is what makes it a source for the missing copies — not whether the class counted it. `record`
+     * is the consensus the commit ran on, absent for the solo short-circuit (no cohort ran, so no
+     * holders to report).
+     */
+    private acknowledgeCommit;
+    /**
+     * Tell the {@link CommittedHoldersSink} who holds a cohort commit this node holds, so its rebalance
+     * monitor does not push the blocks back to members that stored them. A holder is a member the
+     * durability class confirmed AND that signed an approving commit vote: the confirmation rests on
+     * the member's unsigned apply report, and requiring the signature too means a member lying in that
+     * report can only misstate its own copy — a member already trusted with the commit. The members
+     * the class names unconfirmed are reported as such, which withdraws any earlier record of them
+     * (including the signer list this node's own member reported at apply), so they are pushed the
+     * block. Never throws: the commit is already acknowledged.
+     */
+    private reportCommittedHolders;
+    /**
+     * Write down who is still missing an acknowledged commit, while this node still knows — the
+     * cohort's answer is gone the moment the writer is answered, and the in-memory commit retry does
+     * not survive a restart. One entry per block, all sharing this commit's one cohort answer
+     * (consensus ran on `blockIds[0]`'s cohort for the whole request):
+     * - `full` settles any older entry for the block, whether or not this node holds it;
+     * - `majority` records the unconfirmed members by name;
+     * - `local` and `unrouted` record an EMPTY missing set, meaning "unknown" — nobody could be named.
+     * A shortfall is recorded only when `localHolds`: a node holding nothing has nothing to push, and
+     * the remote majority that admitted the commit already holds it.
+     *
+     * NEVER throws, and that asymmetry is deliberate: by the time this runs the commit is already
+     * durable at the class the answer states, so a ledger fault must not turn an acknowledged write
+     * into a reported failure. A failure is logged per block and the answer still goes out; the
+     * block's copy is then owed with nobody tracking it, exactly as before the ledger existed.
+     *
+     * NOTE: one ledger read and write per block per below-full commit, awaited before the writer is
+     * answered — on a node that is genuinely alone that is every commit (a `full` commit settles from
+     * the ledger's in-memory index and touches the store only when an entry exists). If it shows in
+     * commit latency, coalesce the writes rather than answering first: an entry written after the
+     * answer can be lost to a crash in between, which is the one case the ledger exists for.
+     */
+    private noteReplicationShortfall;
+    private noteBlockShortfall;
+    /**
+     * The durability class beside the gate: derived from the SAME sets {@link isDurableMajority} was
+     * just measured on, with this node's own contribution passed per arm exactly as the gate counted
+     * it, so the class and the gate can never disagree. One rule for all three success exits of
+     * {@link commit}: `full` iff every cohort member is confirmed, otherwise `majority` (the gate
+     * already refused anything below that). Never `local` or `unrouted` here — those belong to the
+     * solo short-circuit, where no cohort ran.
+     */
+    private cohortWriteDurability;
+    /**
+     * The solo short-circuit of {@link commit}: consensus never runs, so no ClusterRecord exists to
+     * project a proof from — the lone member self-signs a one-peer proof instead (mintSoloCommitProof),
+     * which is what lets a block born on a cohort of one ever gain a second holder under the
+     * certified-push default (handlePush refuses a proof-less block). Minted even when the cohort did
+     * not resolve or the sole peer is not self — a failed `findCluster` puts the DEGRADED-ROUTING case
+     * in this same branch, and self genuinely committed these bytes either way; a proof's peer list is
+     * already not evidence of cohort membership by design (caller obligation #1 on
+     * verifyBlockCommitProofClaim), so gating the mint on cohort composition would buy no safety while
+     * opening a silent no-proof hole exactly when routing is degraded.
+     *
+     * The policy is unchanged — every write accepted here before is accepted now. What changes is
+     * that the answer says which situation it was: the `commit:solo-cohort` log line (how an operator
+     * tells a real cohort of one — cohortSize 1, soleIsSelf true — from a routing failure) now also
+     * carries the `quorum` the writer is told, and both come from {@link soloCohortDurability}, so the
+     * log and the answer cannot disagree.
+     */
+    private commitSolo;
     /**
      * The durability gate's answer: a retryable refusal ({@link COMMIT_NOT_DURABLE_REASON}) naming how
      * many of the cohort reported holding the revision. `conflict: true` because the members that

package/dist/src/repo/coordinator-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordinator-repo.d.ts","sourceRoot":"","sources":["../../../src/repo/coordinator-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAuB,aAAa,EAAE,aAAa,EAAyC,MAAM,qBAAqB,CAAC;AAG9U,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,OAAO,EAA6D,KAAK,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAIhI,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAiZ1D;;;GAGG;AACH,UAAU,iCAAkC,SAAQ,QAAQ;IAC3D,sBAAsB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,4GAA4G;IAC5G,qBAAqB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IACpE,gHAAgH;IAChH,uBAAuB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACxE;;8DAE0D;IAC1D,mBAAmB,CAAC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACtE;AAED;;;;;GAKG;AACH,YAAY,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;AAE3I,UAAU,yBAAyB;IAClC,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,CAAC,EAAE,iCAAiC,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,oBAAoB,CAAC;IAC9C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF,wBAAgB,eAAe,CAC9B,UAAU,EAAE,WAAW,EACvB,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,EACjD,GAAG,CAAC,EAAE,qBAAqB,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,UAAU,CAAC,EAAE,eAAe,EAC5B,UAAU,CAAC,EAAE,sBAAsB,GACjC,CAAC,UAAU,EAAE,yBAAyB,KAAK,eAAe,CAe5D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,uBAAuB;IACvC,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;QACpG,MAAM,EAAE,aAAa,CAAC;QACtB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,UAAU,CAAC;QAC7B,iBAAiB,CAAC,EAAE,YAAY,CAAC;QACjC,+GAA+G;QAC/G,kBAAkB,CAAC,EAAE;YAAE,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAA;SAAE,CAAC;QACxD,0HAA0H;QAC1H,oBAAoB,CAAC,EAAE;YAAE,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAA;SAAE,CAAC;KAC1D,CAAC,CAAC;IACH,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,2HAA2H;AAC3H,qBAAa,eAAgB,YAAW,KAAK;IAqF3C,QAAQ,CAAC,UAAU,EAAE,WAAW;IAChC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAG9B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAGvC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA/FjC,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqE;IACzG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoC;IACrE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE;;;;;oEAKgE;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6C;IAClF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmD;IACrF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAS;IACxD,qHAAqH;IACrH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAkB;IAC9C,oMAAoM;IACpM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkC;IACtD,wEAAwE;IACxE,GAAG,EAAE,MAAM,MAAM,CAAoB;IACrC,gEAAgE;IAChE,IAAI,EAAE,MAAM,MAAM,CAAuB;gBAG/B,UAAU,EAAE,WAAW,EACvB,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,EACzC,WAAW,EAAE,KAAK,EACnC,GAAG,CAAC,EAAE,qBAAqB,EACV,YAAY,CAAC,EAAE,iCAAiC,YAAA,EACjE,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,WAAW,EACR,qBAAqB,CAAC,EAAE,qBAAqB,YAAA,EAC9D,UAAU,CAAC,EAAE,eAAe,EAC5B,UAAU,CAAC,EAAE,sBAAsB,EAClB,sBAAsB,CAAC,EAAE,oBAAoB,YAAA,EAC7C,cAAc,CAAC,EAAE,cAAc,YAAA;IAyDjD;;;;OAIG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED,8EAA8E;IACxE,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;;;OAMG;YACW,qBAAqB;IAwBnC;;OAEG;YACW,oBAAoB;IAa5B,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAqLnF;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,OAAO,CAAC,gBAAgB;IA+DxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,uBAAuB;IAmB/B,oHAAoH;IACpH,OAAO,CAAC,gBAAgB;IAcxB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,gBAAgB;IAQxB,iFAAiF;IACjF,OAAO,CAAC,KAAK;IAKb,0FAA0F;IAC1F,OAAO,CAAC,cAAc;IAOtB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAM7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,0BAA0B;IAKlC;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAItD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,qBAAqB;IAmQnC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,mBAAmB;IAuCjC;;;;;;;;;;;;;OAaG;YACW,mBAAmB;IAcjC;6FACyF;YAC3E,cAAc;IAK5B,yGAAyG;YAC3F,YAAY;IAI1B;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,qBAAqB;IAyMnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4DG;IACH,OAAO,CAAC,oBAAoB;IA2C5B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,sBAAsB;IAgD9B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,8BAA8B;IAmBtC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAStB,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;IAqB/E;2FACuF;YACzE,kBAAkB;IA0IhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,sBAAsB;IAuDpC;;;;;;;;;;;;;;;OAeG;YACW,gCAAgC;IA2C9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CAAC,oBAAoB;IAyC5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAOxB,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAkDxE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC;IA2NrF;;;;;;;;;;;;;;;;;;OAkBG;YACW,4BAA4B;IAS1C;;;;;;;;;;;OAWG;YACW,8BAA8B;IAkE5C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,6BAA6B;IAWrC;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;CAgB9B"}
+{"version":3,"file":"coordinator-repo.d.ts","sourceRoot":"","sources":["../../../src/repo/coordinator-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAiB,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAuB,aAAa,EAAE,aAAa,EAAyC,MAAM,qBAAqB,CAAC;AAE9W,OAAO,EAAuF,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACtJ,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,OAAO,EAA6D,KAAK,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAKhI,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI/E;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAwS1D;;;GAGG;AACH,UAAU,iCAAkC,SAAQ,QAAQ;IAC3D,sBAAsB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,4GAA4G;IAC5G,qBAAqB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IACpE,gHAAgH;IAChH,uBAAuB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACxE,6HAA6H;IAC7H,sBAAsB,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;8DAE0D;IAC1D,mBAAmB,CAAC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACtE;AAED;;;;;GAKG;AACH,YAAY,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;AAE3I,UAAU,yBAAyB;IAClC,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,CAAC,EAAE,iCAAiC,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,oBAAoB,CAAC;IAC9C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;IACjD;;;OAGG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF,wBAAgB,eAAe,CAC9B,UAAU,EAAE,WAAW,EACvB,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,EACjD,GAAG,CAAC,EAAE,qBAAqB,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,UAAU,CAAC,EAAE,eAAe,EAC5B,UAAU,CAAC,EAAE,sBAAsB,GACjC,CAAC,UAAU,EAAE,yBAAyB,KAAK,eAAe,CAiB5D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,uBAAuB;IACvC,8EAA8E;IAC9E,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD;sGACkG;IAClG,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3D,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;QACpG,MAAM,EAAE,aAAa,CAAC;QACtB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,UAAU,CAAC;QAC7B,iBAAiB,CAAC,EAAE,YAAY,CAAC;QACjC,+GAA+G;QAC/G,kBAAkB,CAAC,EAAE;YAAE,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAA;SAAE,CAAC;QACxD,0HAA0H;QAC1H,oBAAoB,CAAC,EAAE;YAAE,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAA;SAAE,CAAC;KAC1D,CAAC,CAAC;IACH,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,2HAA2H;AAC3H,qBAAa,eAAgB,YAAW,KAAK;IA0D3C,QAAQ,CAAC,UAAU,EAAE,WAAW;IAChC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAG9B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAGvC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAtErC,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqE;IACzG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoC;IACrE;;;;;oEAKgE;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6C;IAClF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IACvE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAS;IACxD,qHAAqH;IACrH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAkB;IAC9C,oMAAoM;IACpM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkC;IACtD,wEAAwE;IACxE,GAAG,EAAE,MAAM,MAAM,CAAoB;IACrC,gEAAgE;IAChE,IAAI,EAAE,MAAM,MAAM,CAAuB;gBAG/B,UAAU,EAAE,WAAW,EACvB,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,EACzC,WAAW,EAAE,KAAK,EACnC,GAAG,CAAC,EAAE,qBAAqB,EACV,YAAY,CAAC,EAAE,iCAAiC,YAAA,EACjE,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,WAAW,EACR,qBAAqB,CAAC,EAAE,qBAAqB,YAAA,EAC9D,UAAU,CAAC,EAAE,eAAe,EAC5B,UAAU,CAAC,EAAE,sBAAsB,EAClB,sBAAsB,CAAC,EAAE,oBAAoB,YAAA,EAC7C,cAAc,CAAC,EAAE,cAAc,YAAA,EAC/B,sBAAsB,CAAC,EAAE,uBAAuB,YAAA,EAChD,kBAAkB,CAAC,EAAE,oBAAoB,YAAA;IA0D3D;;;;OAIG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED,8EAA8E;IACxE,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;;;;;;;;;;;;;;;OAkBG;YACW,iBAAiB;IAsB/B;;;;;;;;;;;;;OAaG;YACW,oBAAoB;IAe5B,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAkKnF;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,OAAO,CAAC,gBAAgB;IA+DxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,uBAAuB;IAmB/B,oHAAoH;IACpH,OAAO,CAAC,gBAAgB;IAcxB,iFAAiF;IACjF,OAAO,CAAC,KAAK;IAKb;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,0BAA0B;IAIlC,0FAA0F;IAC1F,OAAO,CAAC,cAAc;IAOtB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,0BAA0B;IAKlC;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAItD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,qBAAqB;IAqPnC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,mBAAmB;IAuCjC;;;;;;;;;;;;;OAaG;YACW,mBAAmB;IAcjC;6FACyF;YAC3E,cAAc;IAK5B,yGAAyG;YAC3F,YAAY;IAI1B;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,qBAAqB;IAyMnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4DG;IACH,OAAO,CAAC,oBAAoB;IA2C5B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,sBAAsB;IAgD9B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,8BAA8B;IAmBtC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAStB,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;IAe/E;;;iFAG6E;YAC/D,kBAAkB;IAmKhC;;;;OAIG;YACW,QAAQ;IAKtB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;;;;;;;;;;;;;;;;OAkBG;YACW,sBAAsB;IA+DpC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,gBAAgB;IAqC9B;;;;;;;;;;OAUG;YACW,qBAAqB;IAmCnC;;;;;OAKG;YACW,eAAe;IAS7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,oBAAoB;IAc5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAIxB,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAkDxE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC;IA+LrF;;;;;;;;;;;;;;;;;;OAkBG;YACW,4BAA4B;IAS1C;;;;;;;;;;;OAWG;YACW,8BAA8B;IAkE5C;;;;;;;;;;OAUG;YACW,6BAA6B;IAe3C;;;;;;;;;;OAUG;YACW,iBAAiB;IAM/B;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,wBAAwB;YAuBxB,kBAAkB;IAmBhC;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;;;;;;;;;;;;;;;OAgBG;YACW,UAAU;IAqCxB;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;CAkB9B"}