@optimystic/db-p2p 1.0.0-beta.3 → 1.1.0

package/src/repo/coordinator-repo.ts

@@ -1,6 +1,6 @@
-import type { PendRequest, ActionBlocks, IRepo, MessageOptions, CommitResult, GetBlockResults, PendResult, StaleFailure, BlockGets, CommitRequest, RepoMessage, IKeyNetwork, ICluster, ClusterConsensusConfig, BlockId, ActionId, ActionRev, ActionContext, ClusterRecord, BlockUnavailableReason, ActionPending } from "@optimystic/db-core";
-import { LruMap, blockIdsForTransforms, highestStaleAt, isConflictFailure, isOwnRevision, DEFAULT_SUPER_MAJORITY_THRESHOLD } from "@optimystic/db-core";
-import { ClusterCoordinator, ConflictRaceLostError, ValidatorRejectionError } from "./cluster-coordinator.js";
+import type { WriteDurability, PendRequest, ActionBlocks, IRepo, MessageOptions, CommitResult, CommitSuccess, GetBlockResults, PendResult, StaleFailure, BlockGets, CommitRequest, RepoMessage, IKeyNetwork, ICluster, ClusterConsensusConfig, BlockId, ActionId, ActionRev, ActionContext, ClusterRecord, BlockUnavailableReason, ActionPending } from "@optimystic/db-core";
+import { LruMap, blockIdsForTransforms, transformForBlockId, highestStaleAt, isConflictFailure, isOwnRevision, DEFAULT_SUPER_MAJORITY_THRESHOLD, routingKeyForBlock, localDurability, unroutedDurability } from "@optimystic/db-core";
+import { BlocksHeldError, ClusterCoordinator, ConflictRaceLostError, ValidatorRejectionError, type CohortResolution } from "./cluster-coordinator.js";
 import type { PeerId } from "@libp2p/interface";
 import { peerIdFromString } from "@libp2p/peer-id";
 import type { FretService } from "p2p-fret";
@@ -12,10 +12,14 @@ import { quorumSize, corroboratorCapacity, selectQuorumRev, certifiedEquivocatio
 import { certifyClaim, isAttributableProofFailure, proofThresholds, type ProofAnchoring } from "../cluster/certified-claims.js";
 import { DEFAULT_CLUSTER_SIZE, resolveRepairCorroborationClusterSize } from "../cluster/cluster-policy.js";
 import { RECONCILE_TIMEOUT_MS } from "../cluster/reconcile-block.js";
-import { isMissingBaseRevisionFailure, COMMIT_NOT_DURABLE_REASON, MISSING_BASE_REVISION_REASON, type ICommitProofPersister, type IRevisionActionReader } from "../storage/storage-repo.js";
+import { isMissingBaseRevisionFailure, COMMIT_NOT_DURABLE_REASON, MISSING_BASE_REVISION_REASON, type ICommitProofPersister, type IRevisionActionReader, type IPendingClaimReader } from "../storage/storage-repo.js";
+import { isReservationAgainst, reservationRequestFor, cohortCanMissAPend, type PendingClaim } from "../storage/pending-claim.js";
 import { buildBlockCommitProof, type BlockCommitProof } from "../cluster/commit-proof.js";
-import type { ReconcileBlockCallback } from "../cluster/cluster-repo.js";
+import type { ReconcileBlockCallback, CommittedHoldersSink } from "../cluster/cluster-repo.js";
 import type { CertifiedActionRev } from "../storage/block-archive.js";
+import type { IUnderReplicationLedger } from "./i-under-replication-ledger.js";
+import { RESPONSIBILITY_TTL_MS, ResponsibilityRefusalError } from "./responsibility.js";
+import { StuckReservationTracker } from "./stuck-reservation.js";
 
 /**
  * Acquire a block's content for a cohort-corroborated revision, from the cohort, and persist it.
@@ -266,111 +270,6 @@ function soleHolderMessage(cohortPeers: number): string {
 		`verify.)`;
 }
 
-/**
- * What one block's pending-conflict refusals have added up to, for ONE unchanged set of holders.
- *
- * A block is reserved by an unresolved pending action for the span between that action's pend and
- * its commit or cancel, and while the reservation stands every OTHER writer's pend for the block is
- * refused. That is the healthy optimistic-concurrency loss. The unhealthy case has the identical
- * per-refusal shape and differs only in repetition: the same holder refusing DISTINCT later actions
- * without end, because the holder is never going to commit or cancel (see
- * {@link CoordinatorRepo.noteStuckReservation}).
- *
- * Counted per (block, holders) rather than per block: a holder that changes is the healthy cycle —
- * the previous reservation resolved and another writer took the block — so a new holder starts a new
- * count and gets its own chance to speak.
- */
-interface StuckReservationWatch {
-	/** The rival action ids the refusals in this episode named, sorted so the comparison is stable. */
-	holders: readonly ActionId[];
-	/**
-	 * Distinct action ids these holders have refused. Distinct ACTIONS, not refusals: one writer
-	 * retrying is one writer, because a sync reuses a single action id across all of its retry
-	 * attempts (`Collection.syncInternal` mints the id once and `syncAttempts` reuses it for every
-	 * attempt of that cycle). Emptied at the
-	 * moment the episode is reported — the count is in the line, and nothing reads the ids again —
-	 * so the set is bounded by {@link STUCK_RESERVATION_DISTINCT_ACTIONS}.
-	 */
-	refused: Set<ActionId>;
-	/** True once this episode has been named; suppresses every later refusal against these holders. */
-	reported: boolean;
-}
-
-/**
- * How many DISTINCT later actions one unchanged holder must refuse on a block before the refusals are
- * named as a stuck reservation rather than as an ordinary lost race.
- *
- * **Why a count of distinct actions and not something else.** Elapsed time answers the wrong question
- * — a slow writer is not a stuck one, and a holder legitimately keeps its reservation for as long as
- * its own commit takes. A raw refusal count answers the wrong question too: a single writer retrying
- * a lost race produces a run of refusals under ONE action id (see {@link StuckReservationWatch.refused}).
- * What no healthy holder can produce is an unbounded stream of *different* writers all losing to it,
- * because a healthy holder's reservation lasts one pend-to-commit window.
- *
- * **Why 8.** The bound to clear is how many distinct actions can honestly be refused inside one such
- * window. Measured on the in-process mesh, in the healthy-contention arm of
- * `test/stuck-reservation-named.spec.ts`: a holder that pends, is raced by other writers, and then
- * commits refuses **2** distinct actions per episode — the two rivals — and the count resets on every
- * holder change. `concurrent-diary-append-acknowledgement.spec.ts` races three writers at one diary
- * and cannot exceed that either, for the same reason: at most (writers - 1) rivals can lose to one
- * winner. 8 is four times the measured healthy figure, and it is a floor a genuinely stuck block
- * clears trivially (the field instance refused hundreds).
- *
- * **The bound stated exactly.** It is distinct SYNC CYCLES, not distinct writers: one writer that
- * exhausts a sync's retry budget and is re-driven by its caller mints a fresh id for the next cycle,
- * so it can contribute more than one. That does not widen the window much — a cycle only ends in
- * exhaustion after `DefaultMaxAttempts` (10) attempts of backoff, roughly 21s (see the exhaustion
- * NOTE in `Collection.syncAttempts`), so a lone writer needs a holder to keep the block for upwards
- * of two and a half minutes before it reaches 8 by itself, which is not a healthy holder.
- *
- * **What the margin does NOT cover, stated honestly.** A block with more than 8 distinct writers
- * racing it inside a single pend-to-commit round trip could reach 8 with a perfectly healthy holder.
- * That is a diagnostic false positive on a log line and nothing else — this counter never refuses,
- * expires, or deletes anything (see {@link CoordinatorRepo.noteStuckReservation}) — and the remedy if
- * a deployment ever hits it is to raise this number, not to add a control path. Raising it costs
- * detection latency on low-traffic blocks, which need this many distinct write ATTEMPTS before the
- * condition can be named at all.
- */
-const STUCK_RESERVATION_DISTINCT_ACTIONS = 8;
-
-/** Whether two sorted holder lists name the same reservation — i.e. whether a refusal continues an
- *  existing episode or starts a new one. Both sides come from the same sort, so this is a plain
- *  element-wise comparison; a block normally has exactly one holder, since a member's own pend refuses
- *  a second one (`ClusterMember.validatePendOperations`). */
-function sameHolders(a: readonly ActionId[], b: readonly ActionId[]): boolean {
-	return a.length === b.length && a.every((id, i) => id === b[i]);
-}
-
-/**
- * The stuck-reservation wording: written for an operator reading logs, in the same register as
- * {@link cohortTooSmallMessage} and {@link soleHolderMessage} — what is stuck, what will and will not
- * clear it, and what to do next.
- *
- * The claim is deliberately about the RESERVATION, not about the writer's intent: this node cannot
- * see whether the holding process is alive, only that it has held the block across enough unrelated
- * later actions that no retry is going to win. So the line says what is provable (the block accepts
- * no writes while this record stands, and nothing on the node removes it) and points at the one check
- * that settles the rest.
- */
-function stuckReservationMessage(holders: readonly ActionId[], refusedActions: number): string {
-	const held = holders.join(', ');
-	return `This block is WEDGED BEHIND A PENDING WRITE THAT IS NOT COMPLETING, and retrying will never ` +
-		`clear it: action(s) ${held} reserved the block and have now refused ${refusedActions} DISTINCT, ` +
-		`unrelated later actions. Each of those refusals on its own looks exactly like an ordinary ` +
-		`optimistic-concurrency loss, which is normal and healthy — the repetition is what is not. A ` +
-		`healthy rival holds a block only for its own pend-to-commit window and then releases it by ` +
-		`committing or cancelling; a reservation that keeps refusing NEW writers is holding the block ` +
-		`against every writer on every machine, and each of them loses again identically. EXACTLY TWO ` +
-		`THINGS CLEAR IT: a cancel for action(s) ${held} on this block (route it through the cohort so ` +
-		`every member drops the record), or that same action's own commit landing. Nothing on the node ` +
-		`expires it — there is no sweep for abandoned pending records — so until one of those two happens ` +
-		`the block takes NO writes while continuing to serve reads and to look healthy in every other ` +
-		`respect. The usual cause is a writer that went away between a failed or half-applied commit and ` +
-		`the cancel it owed, so check whether whatever ran ${held} still exists before cancelling on its ` +
-		`behalf. This line is a diagnosis and nothing more: this node does not expire, refuse, or delete ` +
-		`the record on the strength of it.`;
-}
-
 /**
  * What one repair pass established about a block that is still MISSING locally after it.
  * Ordered by how firmly the block is ruled out; `get` consults it only on the missing path.
@@ -438,6 +337,8 @@ interface LocalClusterWithExecutionTracking extends ICluster {
 	getExecutedPendResult?(messageHash: string): PendResult | undefined;
 	/** Local storage's verdict for a commit applied during consensus; see ClusterMember.getExecutedCommitResult. */
 	getExecutedCommitResult?(messageHash: string): CommitResult | undefined;
+	/** One more reconcile for a behind-refused commit, once remote members hold it; see ClusterMember.reconcileRefusedCommit. */
+	reconcileRefusedCommit?(record: ClusterRecord): Promise<void>;
 	/** Self-sign a one-peer commit proof for the solo-cohort commit path; see ClusterMember.mintSoloCommitProof.
 	 *  Optional like its siblings: absent on a bare ICluster double, and then the solo path simply
 	 *  commits proof-less — exactly the pre-mint behavior. */
@@ -492,6 +393,17 @@ interface CoordinatorRepoComponents {
 	 * acceptance internally regardless.
 	 */
 	proofAnchoring?: ProofAnchoring;
+	/**
+	 * Optional durable record of commits acknowledged below full replication, and who is still
+	 * missing each block — see {@link CoordinatorRepo.noteReplicationShortfall}. Absent → nothing is
+	 * recorded and commit behaves exactly as without it.
+	 */
+	underReplicationLedger?: IUnderReplicationLedger;
+	/**
+	 * Optional: told who holds each cohort commit this node acknowledges and holds — see
+	 * {@link CoordinatorRepo.reportCommittedHolders}. Absent → commit behaves exactly as without it.
+	 */
+	onCommittedHolders?: CommittedHoldersSink;
 }
 
 /**
@@ -526,7 +438,9 @@ export function coordinatorRepo(
 		reputation,
 		stateStore,
 		components.acquireBlockFromCohort,
-		components.proofAnchoring
+		components.proofAnchoring,
+		components.underReplicationLedger,
+		components.onCommittedHolders
 	);
 }
 
@@ -546,8 +460,11 @@ export function coordinatorRepo(
  * revert to being ignored. If that field is ever renamed, grep the specs for `coordinator:`.
  */
 export interface ICoordinatorClusterSeam {
+	/** Used by `cancel` alone; `pend` and `commit` read {@link resolveCohort}. */
 	getClusterSize(blockId: BlockId): Promise<number>;
-	getClusterPeerIds(blockId: BlockId): Promise<string[]>;
+	/** Whether the cohort could be established at all, and who it is — the primitive
+	 *  `getClusterSize` derives from. `pend` and `commit` classify their solo short-circuit on it. */
+	resolveCohort(blockId: BlockId): Promise<CohortResolution>;
 	executeClusterTransaction(blockId: BlockId, message: RepoMessage, options?: MessageOptions): Promise<{
 		record: ClusterRecord;
 		localExecuted: boolean;
@@ -567,33 +484,7 @@ export class CoordinatorRepo implements IRepo {
 	private readonly DEFAULT_TIMEOUT = 30000; // 30 seconds default timeout
 	private readonly localPeerId?: PeerId;
 	private readonly responsibilityCache = new LruMap<string, { inCluster: boolean, expires: number }>(1000);
-	private static readonly RESPONSIBILITY_TTL_MS = 60_000;
 	private readonly lastSeenCommitMs = new LruMap<string, number>(1000);
-	/**
-	 * Per block, when (`this.now()` at the consult's start) a consult last SETTLED that this node's
-	 * absence of it is the cohort's answer too — see `absenceSettled` on {@link fetchBlockFromCluster}'s
-	 * result. Only the solo-self exit settles today: when this node is the block's whole cohort, every
-	 * acknowledged commit of it lands in this node's storage before the writer hears success, so the
-	 * block reads present and the memo dies. Read only for a block still missing locally
-	 * ({@link absenceIsSettled}); cleared by any pend or commit this node coordinates for the block, by
-	 * seeing it present, and by any later consult of it that does not settle.
-	 *
-	 * Deliberately its OWN map rather than `lastSeenCommitMs`: that one is also stamped for missing
-	 * blocks at exits whose verdict is NOT a confirmed absence (the `cohort-too-small` arm when a peer
-	 * claimed a revision, the post-restore arm when acquisition failed), so reading it here would turn
-	 * a `claimed-elsewhere` absence into an authoritative one for a whole window.
-	 *
-	 * NOTE: accepted tradeoff — a cohort-of-one view can be transient (peers still mid-identify; see
-	 * the solo exit), and a block another node creates through the cohort it sees is then reported
-	 * absent here for up to one `readRepairWindowMs` after this node's view grows — the same one-window
-	 * cost the held-block window pays for a growing cohort. Revisit if a caller ever needs
-	 * create-visibility across coordinators tighter than one window — such a caller needs a revision
-	 * floor (backlog `feat-refresh-can-demand-a-revision-floor`), not a shorter window.
-	 *
-	 * NOTE: LRU-bounded like its siblings; an eviction under >1000 settled blocks loses a memo and
-	 * costs one extra consult — the safe direction.
-	 */
-	private readonly settledAbsences = new LruMap<string, number>(1000);
 	/** Per block, what earlier repair passes left unresolved — see {@link AheadClaimState}.
 	 *  Outlives the consult on purpose: the read-repair window skips consults for blocks checked
 	 *  recently, and a doubt dropped there is a stale answer served as confirmed again.
@@ -602,14 +493,14 @@ export class CoordinatorRepo implements IRepo {
 	 *  {@link reportRepairDeadlock} say its piece a second time. */
 	private readonly unsettledAheadClaims = new LruMap<string, AheadClaimState>(1000);
 	/**
-	 * Per block, what its pending-conflict refusals have added up to — see {@link StuckReservationWatch}
-	 * and {@link noteStuckReservation}. Deliberately its OWN map rather than a third fact hung off
-	 * {@link unsettledAheadClaims}: that entry belongs to the read-repair path and is cleared by a block
-	 * converging on a revision, whereas this one belongs to the write path and is cleared by the block
-	 * accepting a write. Sharing the entry would mean teaching both of those lifetimes about a fact
-	 * neither owns (backlog `debt-freshness-state-scattered-across-coordinator-repo` is the standing
-	 * argument for collapsing all of this per-block state behind one collaborator; adding a fourth
-	 * carve-out to the freshness entry would have made that harder, not easier).
+	 * Per block, what its pending-conflict refusals have added up to — see {@link StuckReservationTracker}
+	 * and {@link noteStuckReservation}. Deliberately its OWN collaborator rather than a third fact hung
+	 * off {@link unsettledAheadClaims}: that entry belongs to the read-repair path and is cleared by a
+	 * block converging on a revision, whereas this one belongs to the write path and is cleared by the
+	 * block accepting a write. Sharing the entry would mean teaching both of those lifetimes about a
+	 * fact neither owns (backlog `debt-freshness-state-scattered-across-coordinator-repo` is the
+	 * standing argument for collapsing all of this per-block state behind one collaborator; adding a
+	 * fourth carve-out to the freshness entry would have made that harder, not easier).
 	 *
 	 * NOTE: LRU-bounded like its siblings. An eviction under >1000 conflicted blocks loses an episode's
 	 * say-once flag, so the line can repeat once for that block — the same bounded duplication
@@ -618,12 +509,11 @@ export class CoordinatorRepo implements IRepo {
 	 * NOTE: per COORDINATOR, and a block's coordinator is whichever peer the writer's key lookup
 	 * resolved — normally stable, but cohort churn or a routing change moves it. When it moves, the
 	 * count restarts on the new coordinator (the condition is named later) and the old one may name the
-	 * same episode again (the condition is named twice). Fine while a wedged block is diagnosed by
-	 * searching for its id; if a churning deployment ever makes duplicate lines the noisy failure this
-	 * one exists to replace, the say-once state has to move to where the record lives (the member's own
-	 * storage) rather than to where the refusal was classified.
+	 * same episode again (the condition is named twice). Each MEMBER now keeps its own tracker as well
+	 * (`ClusterMember.validatePendOperations`), fed by its own `held` votes, so the episode is also
+	 * named where the record lives, by a count that does not move with the coordinator.
 	 */
-	private readonly stuckReservations = new LruMap<string, StuckReservationWatch>(1000);
+	private readonly stuckReservations = new StuckReservationTracker(1000);
 	private readonly readRepairMode: 'off' | 'lazy' | 'paranoid';
 	private readonly readRepairWindowMs: number;
 	private readonly readRepairSampleRate: number;
@@ -658,7 +548,9 @@ export class CoordinatorRepo implements IRepo {
 		reputation?: IPeerReputation,
 		stateStore?: ITransactionStateStore,
 		private readonly acquireBlockFromCohort?: AcquireBlockCallback,
-		private readonly proofAnchoring?: ProofAnchoring
+		private readonly proofAnchoring?: ProofAnchoring,
+		private readonly underReplicationLedger?: IUnderReplicationLedger,
+		private readonly onCommittedHolders?: CommittedHoldersSink
 	) {
 		this.localPeerId = localPeerId;
 		this.log = createLogger('coordinator-repo', localPeerId?.toString());
@@ -710,7 +602,8 @@ export class CoordinatorRepo implements IRepo {
 			peerId: localPeerId,
 			wasTransactionExecuted: localCluster.wasTransactionExecuted?.bind(localCluster),
 			getExecutedPendResult: localCluster.getExecutedPendResult?.bind(localCluster),
-			getExecutedCommitResult: localCluster.getExecutedCommitResult?.bind(localCluster)
+			getExecutedCommitResult: localCluster.getExecutedCommitResult?.bind(localCluster),
+			reconcileRefusedCommit: localCluster.reconcileRefusedCommit?.bind(localCluster)
 		} : undefined;
 		this.coordinator = new ClusterCoordinator(keyNetwork, createClusterClient, policy, localClusterRef, fretService, reputation, stateStore);
 	}
@@ -730,61 +623,87 @@ export class CoordinatorRepo implements IRepo {
 	}
 
 	/**
-	 * Check if this node is in the cluster for a given block.
-	 * Uses findCluster membership — in the real network layer, self is always
-	 * included in the cohort when this node is responsible. This serves as a
-	 * defense-in-depth guard for requests that arrive at the wrong node.
-	 * Returns true if localPeerId is not set (backward compat for single-node/test setups).
+	 * Whether this node is in the cohort for a block. Uses `findCluster` membership — in the real network
+	 * layer, self is in the cohort exactly when this node is among the nearest `clusterSize` serving peers
+	 * for the block, so a request that reaches a node outside it was sent to the wrong machine.
+	 *
+	 * Three answers, because a lookup that THREW is not an answer: `undetermined` is never cached (routing
+	 * can recover on the next request) and never read as `responsible` — what each caller does with it is
+	 * that caller's posture (see {@link verifyResponsibility} and `get`).
+	 *
+	 * With no `localPeerId` the check is skipped and the answer is `responsible`. That bypass exists for
+	 * wiring without an identity (direct constructors, single-node and test setups), never for production,
+	 * where `libp2p-node-base` always passes the node's peer id.
+	 *
+	 * NOTE: a cached answer stands for up to {@link RESPONSIBILITY_TTL_MS} after the cohort changes, so a
+	 * node can still say `responsible` for a minute after it stops being so. {@link soloCohortDurability}'s
+	 * `unrouted` class and `ClusterCoordinator.executeClusterTransaction`'s cohort-membership guard are what
+	 * keep that window honest; if churn ever makes the window matter, shorten the TTL rather than
+	 * re-looking-up on every write.
 	 */
-	private async isResponsibleForBlock(blockId: BlockId): Promise<boolean> {
-		if (!this.localPeerId) return true;
+	private async responsibilityFor(blockId: BlockId): Promise<'responsible' | 'not-responsible' | 'undetermined'> {
+		if (!this.localPeerId) return 'responsible';
 
 		const cached = this.responsibilityCache.get(blockId);
 		if (cached && cached.expires > Date.now()) {
-			return cached.inCluster;
+			return cached.inCluster ? 'responsible' : 'not-responsible';
 		}
 
-		const blockIdBytes = new TextEncoder().encode(blockId);
 		let inCluster: boolean;
 		try {
-			const peers = await this.keyNetwork.findCluster(blockIdBytes);
+			const peers = await this.keyNetwork.findCluster(routingKeyForBlock(blockId));
 			inCluster = this.localPeerId.toString() in peers;
 		} catch (err) {
 			this.log('proximity:check-error', { blockId, error: (err as Error).message });
-			// On failure, assume responsible to avoid false rejections
-			return true;
+			return 'undetermined';
 		}
 
-		this.responsibilityCache.set(blockId, { inCluster, expires: Date.now() + CoordinatorRepo.RESPONSIBILITY_TTL_MS });
+		this.responsibilityCache.set(blockId, { inCluster, expires: Date.now() + RESPONSIBILITY_TTL_MS });
 		this.log('proximity:checked', { blockId, inCluster });
-		return inCluster;
+		return inCluster ? 'responsible' : 'not-responsible';
 	}
 
 	/**
-	 * Verify this node is responsible for all given block IDs. Throws if not.
+	 * The write path's gate (`pend`, `cancel`, `commit`): refuse unless this node is responsible for EVERY
+	 * block, and refuse too when it cannot tell — fail CLOSED. A write accepted on a thrown lookup commits
+	 * where the network was never consulted (GitHub #19); refusing hands it back to the writer's transactor,
+	 * which excludes this peer and re-picks inside the cohort.
+	 *
+	 * Every block is checked so the error names all of them. When the blocks split between the two kinds,
+	 * `not-responsible` is the one thrown: it is a settled answer that the request is misrouted, which no
+	 * recovery of the lookup would change; the undetermined blocks are still logged.
+	 *
+	 * For `cancel`, a refusal on a transient lookup fault leaves the pending record standing on this node
+	 * until the writer's cancel retry lands on another cohort member — and this node is still discharged
+	 * then, since as a member it judges the cancel against the record's own `peers`, not against a lookup.
 	 */
 	private async verifyResponsibility(blockIds: BlockId[]): Promise<void> {
 		const notResponsible: BlockId[] = [];
+		const undetermined: BlockId[] = [];
 		for (const blockId of blockIds) {
-			if (!await this.isResponsibleForBlock(blockId)) {
-				notResponsible.push(blockId);
-			}
-		}
-		if (notResponsible.length > 0) {
-			this.log('proximity:rejected', { blockIds: notResponsible });
-			throw new Error(`Not responsible for block(s): ${notResponsible.join(', ')}`);
+			const verdict = await this.responsibilityFor(blockId);
+			if (verdict === 'not-responsible') notResponsible.push(blockId);
+			else if (verdict === 'undetermined') undetermined.push(blockId);
 		}
+		if (notResponsible.length === 0 && undetermined.length === 0) return;
+		this.log('proximity:rejected', { notResponsible, undetermined });
+		throw notResponsible.length > 0
+			? new ResponsibilityRefusalError('not-responsible', notResponsible)
+			: new ResponsibilityRefusalError('undetermined', undetermined, 'cohort lookup failed; refusing the write rather than accepting it unrouted');
 	}
 
 	async get(blockGets: BlockGets, options?: MessageOptions): Promise<GetBlockResults> {
-		// Soft proximity check — warn but still serve reads for graceful degradation
-		// NOTE: a soft-served read now also *acquires* the block durably (see restoreCorroborated), where
-		// before it could at most promote a pending this node already held. So a soft serve leaves behind
-		// a replica of a block this node is not responsible for, and nothing sweeps those: ring-shift
-		// sheds a keyspace RANGE, not "blocks outside my cohort". Fine while soft serves are what they
-		// are meant to be — a rare degradation during routing churn — since routing already placed this
-		// node near the block. If they ever become routine, gate acquisition (not the serve itself) on
-		// isResponsibleForBlock.
+		// Soft proximity check — warn but still serve reads for graceful degradation. Unlike the write
+		// path it stays OPEN when the lookup throws: a read is best-effort, and the consult below flags
+		// whatever it could not confirm (`unavailable`, `unconfirmedAheadRev`) rather than posing as sure.
+		// NOTE: a soft-served read also *acquires* the block durably (see restoreCorroborated), so a soft
+		// serve leaves behind a replica of a block this node is not responsible for, and nothing sweeps
+		// those: ring-shift sheds a keyspace RANGE, not "blocks outside my cohort". Soft serves are now
+		// confined to the responsibility caches' staleness window: a remote read for a block this node is
+		// not responsible for is redirected by `RepoService.checkRedirect` before it gets here, and this
+		// node's own transactor routes a read here only when self is in the block's cohort. If soft serves
+		// ever become routine (steady `proximity:get-warning` lines while the network's membership is not
+		// changing), gate acquisition (not the serve itself) on `responsibilityFor`.
 		//
 		// NOTE: accepted tradeoff — this check and `fetchBlockFromCluster` below each run their own
 		// `findCluster` for the same block, so a cold read costs two cohort lookups where one shared
@@ -792,7 +711,7 @@ export class CoordinatorRepo implements IRepo {
 		// and this check's future is open (blocked `writer-and-servers-disagree-on-where-a-block-lives`,
 		// option D2(b)). Revisit if a device profile shows `findCluster` as material.
 		for (const blockId of blockGets.blockIds) {
-			if (!await this.isResponsibleForBlock(blockId)) {
+			if (await this.responsibilityFor(blockId) === 'not-responsible') {
 				this.log('proximity:get-warning', { blockId, msg: 'serving read for non-responsible block' });
 			}
 		}
@@ -801,9 +720,8 @@ export class CoordinatorRepo implements IRepo {
 		const localResult = await this.storageRepo.get(blockGets, options);
 
 		// Decide per-block whether to consult cluster peers. Two triggers:
-		//   (a) Missing — block isn't present locally at all. Consults unless an earlier consult
-		//       SETTLED its absence within the last `readRepairWindowMs` (see `settledAbsences` and
-		//       `absenceIsSettled`) — today only when this node is the block's whole cohort.
+		//   (a) Missing — block isn't present locally at all. Consults on every read: an absence is
+		//       never remembered (see the accepted-tradeoff NOTE below).
 		//   (b) Stale-by-policy — block is present but read-repair policy says verify.
 		// Skip cluster fetch if this is already a sync request (to prevent recursive queries).
 		// A sync read is also never marked `unavailable` here — the consult it skips is the
@@ -813,37 +731,33 @@ export class CoordinatorRepo implements IRepo {
 		const skipClusterFetch = (options as any)?.skipClusterFetch;
 		// NOTE: NetworkTransactor.get treats an authoritative "absent" ({ state: {} })
 		// as final and no longer retries it (ticket txn-perf-authoritative-notfound),
-		// relying on this cluster reconciliation to have already run — within the last
-		// `readRepairWindowMs`: an unflagged absent means the cohort confirmed this absence
-		// at most one window ago (a read inside the window serves the memo of that
-		// confirmation, see `settledAbsences`), the same currency guarantee a held block's
-		// content already carries. When the consult FAILS outright — or runs without ruling
-		// the block out and the block stays missing — the entry is flagged `unavailable`
-		// below with a reason naming what the consult established (see AbsenceVerdict and
-		// the mapping in the loop body), which re-enables the transactor-level retry against
-		// a different peer; none of those outcomes is ever remembered. If a coordinator is
-		// configured WITHOUT clusterLatestCallback, there is no cohort to consult and the
-		// local answer IS the whole truth — it stays authoritative, with no flag and no
-		// transactor-level retry to compensate. That is fine (such a coordinator has no
-		// cluster to reconcile against), but keep this coupling in mind if a partial-cluster
-		// read path is added.
+		// relying on this cluster reconciliation to have already run — for THIS read: an
+		// unflagged absent means the cohort was consulted before answering. When the consult
+		// FAILS outright — or runs without ruling the block out and the block stays
+		// missing — the entry is flagged `unavailable` below with a reason naming what
+		// the consult established (see AbsenceVerdict and the mapping in the loop body),
+		// which re-enables the transactor-level retry against a different peer. If a
+		// coordinator is configured WITHOUT clusterLatestCallback, there is no cohort to
+		// consult and the local answer IS the whole truth — it stays authoritative, with
+		// no flag and no transactor-level retry to compensate. That is fine (such a
+		// coordinator has no cluster to reconcile against), but keep this coupling in
+		// mind if a partial-cluster read path is added.
+		//
+		// NOTE: accepted tradeoff — a block missing locally consults on EVERY read, even on a cohort
+		// of one, where the consult is one `findCluster` (0.009 ms measured) and a once-per-window log
+		// line (see the solo-self exit). Remembering an absence was tried and removed (GitHub issue
+		// #20, ticket drop-the-settled-absence-memo): a cohort-of-one memo outlived the view it was
+		// settled under, and a node whose view then grew served a block another coordinator had just
+		// committed as never created. Cohort-member writes (`ClusterRepo` → storage) never pass
+		// through this class, so nothing here could clear such a memo either. Revisit only with a memo
+		// bound to the cohort view it was settled under AND cleared by every writer of local storage;
+		// `coordinator-repo-absence-write-bypass.spec.ts` is the gate, and backlog
+		// `feat-a-cohort-member-remembers-a-settled-absence` holds the design notes.
 		if (this.clusterLatestCallback && !skipClusterFetch) {
 			for (const blockId of blockGets.blockIds) {
 				const localEntry = localResult[blockId];
 				const localRev = localEntry?.state?.latest?.rev;
 				const isMissing = !localEntry?.state?.latest;
-				if (!isMissing) {
-					// Present: any remembered absence is dead. Dropped now rather than left to age out,
-					// so a block that vanishes again inside the same window consults instead of being
-					// served the old memo.
-					this.settledAbsences.delete(blockId);
-				} else if (this.absenceIsSettled(blockId)) {
-					// An earlier consult settled this absence within one window: serve the local entry
-					// as it stands — an authoritative absent, or pending-only content — with no flag and
-					// no log line. The held-block skip below logs nothing either, and a per-read line
-					// here would recreate the volume this skip exists to remove.
-					continue;
-				}
 				const isStale = !isMissing && this.shouldReadRepair(blockId);
 				if (!isMissing && !isStale) {
 					// No consult this pass — the read-repair window says this block was checked
@@ -865,32 +779,18 @@ export class CoordinatorRepo implements IRepo {
 					});
 				}
 
-				// Evidence gathered during the consult is at least this old, so a memo stamped with it never
-				// outlives "confirmed within one window" by the consult's own duration.
-				const consultStartedAt = this.now();
 				try {
-					const { absence, currency, absenceSettled } = await this.fetchBlockFromCluster(blockId, blockGets.context, localRev);
-					const refreshed = await this.storageRepo.get({ blockIds: [blockId], context: blockGets.context }, options);
+					const { absence, currency } = await this.fetchBlockFromCluster(blockId, blockGets.context, localRev);
+					// `lineageOf` rides along: the refreshed entry REPLACES the local one below, and an
+					// entry that lost its lineage answer would read to the asker as "could not say".
+					const refreshed = await this.storageRepo.get({
+						blockIds: [blockId], context: blockGets.context,
+						...(blockGets.lineageOf === undefined ? {} : { lineageOf: blockGets.lineageOf })
+					}, options);
 					const newRev = refreshed[blockId]?.state?.latest?.rev;
 					if (refreshed[blockId]) {
 						localResult[blockId] = refreshed[blockId];
 					}
-					// Remember a settled absence for one window; forget it after every other outcome. A
-					// consult that ended `unconfirmed`, `isolated` or `claimed`, that asked a multi-peer
-					// cohort, or that rested on no real cohort view, leaves no memo, so the next read consults (and flags) exactly as before —
-					// including after a sampled or paranoid re-consult of a block whose memo was still fresh.
-					// NOTE: a local pend/commit that clears the memo WHILE this consult is in flight is undone
-					// by the stamp below — one read inside the window can then serve an absent the refused
-					// writer knows is wrong. Bounded: that writer's next pend clears the memo again. If it ever
-					// shows as a stuck writer, skip this stamp when a clear of this block landed after
-					// `consultStartedAt`.
-					if (isMissing) {
-						if (!refreshed[blockId]?.state?.latest && absence === 'confirmed' && absenceSettled) {
-							this.settledAbsences.set(blockId, consultStartedAt);
-						} else {
-							this.settledAbsences.delete(blockId);
-						}
-					}
 					if (isStale) {
 						if (typeof newRev === 'number' && typeof localRev === 'number' && newRev > localRev) {
 							this.log('cluster-tx:read-repair-applied', { blockId, oldRev: localRev, newRev });
@@ -941,9 +841,6 @@ export class CoordinatorRepo implements IRepo {
 					// rather than return a stale cohort view, revisit — that would put the
 					// isolated case back under this vaguer reason.
 					if (isMissing) {
-						// A consult that threw settled nothing — not even a memo that was still fresh
-						// before a sampled or paranoid re-consult.
-						this.settledAbsences.delete(blockId);
 						this.flagUnconfirmedAbsence(localResult, blockId, 'peers-unreachable');
 					} else {
 						// It told us nothing, so it refutes nothing: an earlier pass's unsettled
@@ -1146,32 +1043,35 @@ export class CoordinatorRepo implements IRepo {
 		}
 	}
 
-	/**
-	 * Decide whether a block MISSING locally may skip its consult: an earlier consult settled its
-	 * absence within one read-repair window (see {@link settledAbsences}). The absence counterpart of
-	 * {@link shouldReadRepair}, giving absence the guarantee the window already gives content —
-	 * "checked with the cohort within one window" — and nothing weaker.
-	 *
-	 * Modes: `paranoid` never skips ("verify every read" means every read). `lazy` uses the window and
-	 * the sample rate, exactly as {@link shouldReadRepair} does. `off` uses the window but not the
-	 * sample rate (a `lazy`-only knob, as it is for content): `off` disables STALE-CONTENT repair, and
-	 * the absence consult is not that — it is what makes an absent answer authoritative at all — so
-	 * leaving it unbounded would make the mode meant to do less network work do more.
-	 */
-	private absenceIsSettled(blockId: BlockId): boolean {
-		if (this.readRepairMode === 'paranoid') return false;
-		const at = this.settledAbsences.get(blockId);
-		if (at == null || this.now() - at > this.readRepairWindowMs) return false;
-		if (this.readRepairMode === 'lazy' && this.readRepairSampleRate > 0 && this.rand() < this.readRepairSampleRate) return false;
-		return true;
-	}
-
 	/** Milliseconds since we last marked this block fresh, or undefined if never. */
 	private ageMs(blockId: BlockId): number | undefined {
 		const lastSeen = this.lastSeenCommitMs.get(blockId);
 		return lastSeen == null ? undefined : this.now() - lastSeen;
 	}
 
+	/**
+	 * Whether the solo-self exit of {@link fetchBlockFromCluster} has already named `blockId` inside
+	 * the current read-repair window, for a block this node does NOT hold (`localRev` undefined). Such
+	 * a block reaches that exit on every read, because `get` never remembers an absence (GitHub
+	 * issue #20). So its `cluster-fetch:solo-self-skip` line and its stamp are both skipped while the
+	 * stamp is at most one `readRepairWindowMs` old. An unconditional line would bring back issue #8's
+	 * log volume for a probed but never-written collection. Re-stamping on every read would keep the
+	 * stamp fresh and silence the line for good on a block read more often than once a window.
+	 *
+	 * Withholding the stamp never skips a consult: `get` asks {@link shouldReadRepair} only about
+	 * present blocks. A HELD block reaches the exit only when read-repair already chose to consult, so
+	 * this is always false for one. Its line and stamp are unchanged, and the line keeps pairing with
+	 * `cluster-tx:read-repair-triggered`.
+	 *
+	 * NOTE: the stamp is shared with every exit that marks a block seen, so a missing block one of
+	 * them stamped inside the window is not named until that stamp lapses. Fine for a diagnostic
+	 * line; if anything ever needs "first answer from a self-only view" exactly, give the line its own
+	 * per-block stamp.
+	 */
+	private soloAbsenceNamedThisWindow(blockId: BlockId, localRev: number | undefined): boolean {
+		return localRev === undefined && (this.ageMs(blockId) ?? Infinity) <= this.readRepairWindowMs;
+	}
+
 	/** Mark blocks as freshly observed from cluster authority (post-commit or post-fetch). */
 	private markBlocksSeen(blockIds: BlockId[]): void {
 		const now = this.now();
@@ -1180,17 +1080,6 @@ export class CoordinatorRepo implements IRepo {
 		}
 	}
 
-	/**
-	 * Drop any settled-absence memo for `blockIds` ({@link settledAbsences}) — called at the top of a
-	 * local pend or commit, before routing and whatever the outcome. Clearing is always the safe
-	 * direction: the most it can cost is one extra consult.
-	 */
-	private forgetSettledAbsences(blockIds: BlockId[]): void {
-		for (const id of blockIds) {
-			this.settledAbsences.delete(id);
-		}
-	}
-
 	/**
 	 * True when a commit's approve votes form a strict majority of the FULL cohort — the only case
 	 * where "this node committed" is evidence that no rival commit moved past it. Two strict
@@ -1252,34 +1141,26 @@ export class CoordinatorRepo implements IRepo {
 	 *    retire it when the memo's claimants are among the peers that answered), `no-evidence`
 	 *    leaves it standing untouched. Required, not optional, so an exit added later has to say
 	 *    which it means.
-	 *  - `absenceSettled` — whether this pass SETTLED the block's absence for one read-repair window:
-	 *    no write of it this node has not seen can exist. Only the solo-self exit can say that today
-	 *    (this node is the whole cohort, so every acknowledged commit lands here). `get` remembers a
-	 *    settled absence ({@link settledAbsences}) and skips the consult while the block stays missing.
-	 *    `absence === 'confirmed'` alone is not enough — the empty-cohort exit reports it without
-	 *    asking anyone, and a multi-peer cohort's unanimous "nothing" can be overtaken by a commit
-	 *    still on its way to this node. Required, like
-	 *    `currency`, so an exit added later has to say which side it falls on rather than
-	 *    remembering (or forgetting) to arm something.
+	 *
+	 * Nothing is remembered about an absence: `get` runs this pass on every read of a block missing
+	 * locally (see the accepted-tradeoff NOTE there).
 	 */
-	private async fetchBlockFromCluster(blockId: BlockId, context?: ActionContext, localRev?: number): Promise<{ absence: AbsenceVerdict; currency: CurrencyVerdict; absenceSettled: boolean }> {
-		// Unreachable from `get` (it guards on the callback); nothing to settle against.
-		if (!this.clusterLatestCallback) return { absence: 'confirmed', currency: { kind: 'no-evidence' }, absenceSettled: false };
+	private async fetchBlockFromCluster(blockId: BlockId, context?: ActionContext, localRev?: number): Promise<{ absence: AbsenceVerdict; currency: CurrencyVerdict }> {
+		if (!this.clusterLatestCallback) return { absence: 'confirmed', currency: { kind: 'no-evidence' } };
 
-		const blockIdBytes = new TextEncoder().encode(blockId);
-		const peers = await this.keyNetwork.findCluster(blockIdBytes);
+		const peers = await this.keyNetwork.findCluster(routingKeyForBlock(blockId));
 		const peerIds = peers ? Object.keys(peers) : [];
 		// NOTE: deliberately does NOT call `markBlocksSeen` — unlike the solo-self exit below.
-		// An empty cohort is a ROUTING FAILURE, not a settled answer, and `Libp2pKeyPeerNetwork`
-		// cannot even produce one (its `findCluster` always includes self); the only producer
-		// today is the mesh harness's injected `findClusterFails`. Arming the read-repair window
+		// An empty cohort is a ROUTING FAILURE, not a settled answer. A serving node's
+		// `Libp2pKeyPeerNetwork.findCluster` cannot produce one: it always holds at least this
+		// node when no nearer serving peer is known. Only a node that serves no storage (a
+		// client-only libp2p node, which runs no CoordinatorRepo today) can see an empty cohort;
+		// the only producer here is the mesh harness's injected `findClusterFails`. Arming the read-repair window
 		// here would suppress a genuine repair for a whole `readRepairWindowMs` after a transient
 		// blip, and re-entering costs no network work beyond the `findCluster` the read already
 		// makes. Do not "fix" this by symmetry with the solo-self exit.
-		// For the same reason it returns `absenceSettled: false`: remembering the absence would serve an
-		// authoritative absent for a whole window on the strength of a lookup that returned nobody.
 		// Currency: nobody was asked, so nothing was refuted — an earlier pass's unsettled claim stands.
-		if (peerIds.length === 0) return { absence: 'confirmed', currency: { kind: 'no-evidence' }, absenceSettled: false };
+		if (peerIds.length === 0) return { absence: 'confirmed', currency: { kind: 'no-evidence' } };
 
 		// Solo-cluster short-circuit: the only responsible peer is us. There is no
 		// remote to sync from, so skip the callback entirely. Querying ourselves
@@ -1290,7 +1171,10 @@ export class CoordinatorRepo implements IRepo {
 			&& this.localPeerId
 			&& peerIds[0] === this.localPeerId.toString()
 		) {
-			this.log('cluster-fetch:solo-self-skip', { blockId });
+			// The line and the stamp below go together: both are skipped for a missing block this exit
+			// already named inside the window (see `soloAbsenceNamedThisWindow`).
+			const namedThisWindow = this.soloAbsenceNamedThisWindow(blockId, localRev);
+			if (!namedThisWindow) this.log('cluster-fetch:solo-self-skip', { blockId });
 			// Arm the lazy read-repair window. Without this the window is never stamped,
 			// `shouldReadRepair` reads `lastSeen == null` forever, and every read re-enters this
 			// exit — read -> stale -> consult -> solo skip -> no-op -> still stale, unbounded
@@ -1308,18 +1192,14 @@ export class CoordinatorRepo implements IRepo {
 			// Deliberately opposite to the commit-side rule that withholds arming from a commit
 			// whose quorum proves nothing about rivals: that damps nothing, this bounds an
 			// otherwise unbounded loop. Landing both, keep both — see the specs for each.
-			this.markBlocksSeen([blockId]);
+			if (!namedThisWindow) this.markBlocksSeen([blockId]);
 			// Currency: this exit queried NOBODY, so it refutes nothing — an earlier pass's unsettled
 			// claim survives it. Note the coupling with the arming just above: retained doubt now
 			// persists for up to `readRepairWindowMs` before a consult can refute it. That is correct
 			// and deliberate — the window damps repair EFFORT, not honesty — and it is the same
 			// coupling the comment at the final exit below describes. Arming the window and keeping
 			// the memo are answers to different questions; do not collapse them.
-			// Absence: settled. Nobody else could hold the block, and re-asking inside one window learns
-			// nothing the next `findCluster` would not — the same argument, with the same one-window
-			// self-heal when a cohort appears, as the arming above. (That arming's stamp is NOT what
-			// suppresses the next read of a missing block: `get` reads `settledAbsences` for those.)
-			return { absence: 'confirmed', currency: { kind: 'no-evidence' }, absenceSettled: true };
+			return { absence: 'confirmed', currency: { kind: 'no-evidence' } };
 		}
 
 		const { corroborated, corroboration, local, silent, answered, claims, uncorroboratedRev, deadlock } = await this.queryClusterForLatest(peerIds, blockId, context);
@@ -1412,14 +1292,7 @@ export class CoordinatorRepo implements IRepo {
 			if (deadlock === 'cohort-too-small') {
 				this.markBlocksSeen([blockId]);
 			}
-			// Absence NOT settled, even when every cohort member answered "I hold nothing". This node
-			// takes part in other coordinators' writes as a cohort member through ClusterRepo, straight
-			// into storage and never through this class's pend/commit, so nothing here would clear the
-			// memo; and a commit acknowledged at super-majority reaches the remaining members in the
-			// background. Remembering this answer served a writer's own create as absent through a
-			// lagging member (fresh-node-ddl-multi Scenario B, 5 of 20 runs). Only the solo exit
-			// settles — see backlog `feat-a-cohort-member-remembers-a-settled-absence`.
-			return { absence, currency, absenceSettled: false };
+			return { absence, currency };
 		}
 
 		// The self answer is the sharper baseline (same storage, same context, read alongside the
@@ -1472,8 +1345,7 @@ export class CoordinatorRepo implements IRepo {
 			// ahead. Only reachable when a peer answered (a corroboration requires claims), so the
 			// shared verdict resolves to `nothing-ahead` and a memo whose claimants are among those
 			// answers is cleared.
-			// `absenceSettled`: never read for a held block; false for the same reason as the exit above.
-			return { absence: silenceVerdict, currency: nothingAheadVerdict, absenceSettled: false };
+			return { absence: silenceVerdict, currency: nothingAheadVerdict };
 		}
 
 		// Corroborated revision is ahead of ours — converge onto it.
@@ -1502,13 +1374,12 @@ export class CoordinatorRepo implements IRepo {
 		// unsettled claim (`recordAheadClaim`) and keeps stamping reads served below it while the
 		// window suppresses the retry — the window damps repair effort, not honesty.
 		// NOTE: that damping covers only a block this node holds at an OLDER revision. A block entirely
-		// missing locally is suppressed only by its own absence memo (`settledAbsences`), and this exit
-		// never arms it (`absenceSettled: false` below — a failed acquisition is `claimed`). So a
-		// persistently failing acquisition — e.g. a two-node deployment that never set
-		// `assumedClusterSize`, where the content quorum can never be met — still re-fetches an archive
-		// on every read of that block. Correct, and self-limiting once the cohort can agree; if it ever
-		// shows as read amplification, gate the acquisition step (not the latest-query) on the same
-		// window rather than letting a `claimed` absence settle.
+		// missing locally never consults the window (`get` consults on every read of a missing block,
+		// before `shouldReadRepair`), so a persistently failing acquisition — e.g. a two-node deployment
+		// that never set `assumedClusterSize`, where the content quorum can never be met — re-fetches an
+		// archive on every read of that block. Correct, and self-limiting once the cohort can agree; if
+		// it ever shows as read amplification, gate the acquisition step (not the latest-query) on the
+		// same window rather than remembering the absence (GitHub issue #20).
 		this.markBlocksSeen([blockId]);
 		// Converged: the corroboration is itself the evidence that nothing is ahead, and it came from
 		// peers that answered — the shared verdict resolves to `nothing-ahead`, and the memo retires
@@ -1516,9 +1387,7 @@ export class CoordinatorRepo implements IRepo {
 		const currency: CurrencyVerdict = converged
 			? nothingAheadVerdict
 			: { kind: 'unsettled-claim', rev: corroborated.rev, claimants: claimantsAtOrAbove(corroborated.rev), silent };
-		// Never settles an absence: restored → the block is now present (nothing to remember); not
-		// restored → `claimed`.
-		return { absence, currency, absenceSettled: false };
+		return { absence, currency };
 	}
 
 	/**
@@ -2079,12 +1948,6 @@ export class CoordinatorRepo implements IRepo {
 
 	async pend(request: PendRequest, options?: MessageOptions): Promise<PendResult> {
 		const allBlockIds = blockIdsForTransforms(request.transforms);
-		// Forget any settled absence of these blocks FIRST — before responsibility, routing, or the
-		// outcome is known. A pend refused because a block already exists somewhere is the strongest
-		// evidence there is that the memo was wrong, and the writer's retry re-reads: that read must
-		// consult (and restore) rather than serve the memo's authoritative absent for the rest of the
-		// window. After a success the block is present and the memo is dead anyway.
-		this.forgetSettledAbsences(allBlockIds);
 		await this.verifyResponsibility(allBlockIds);
 		const result = await this.pendThroughCluster(request, allBlockIds, options);
 		// A pend the blocks ACCEPTED is the proof that no reservation is holding them any more — the
@@ -2099,13 +1962,15 @@ export class CoordinatorRepo implements IRepo {
 	}
 
 	/** The cluster half of {@link pend}, after responsibility is verified: consensus, the local-verdict
-	 *  arms, and the two optimistic-concurrency classifiers a rejection is run through. */
+	 *  arms, and the catch that turns each optimistic-concurrency refusal into a retryable answer —
+	 *  the two signed-evidence ones ({@link ConflictRaceLostError}, {@link BlocksHeldError}) directly,
+	 *  and a validator rejection only through {@link classifyStaleRejection}. */
 	private async pendThroughCluster(request: PendRequest, allBlockIds: BlockId[], options?: MessageOptions): Promise<PendResult> {
 		const coordinatingBlockIds = options?.coordinatingBlockIds ?? allBlockIds;
 
-		const peerCount = await this.coordinator.getClusterSize(coordinatingBlockIds[0]!);
-		if (peerCount <= 1) {
-			return await this.storageRepo.pend(request, options);
+		const cohort = await this.coordinator.resolveCohort(coordinatingBlockIds[0]!);
+		if (!cohort.resolved || cohort.peerIds.length <= 1) {
+			return await this.pendSolo(request, cohort, options);
 		}
 
 		const message: RepoMessage = {
@@ -2115,7 +1980,14 @@ export class CoordinatorRepo implements IRepo {
 		};
 
 		try {
-			const { localExecuted, localPendResult, cohortPendRefusals } = await this.coordinator.executeClusterTransaction(coordinatingBlockIds[0]!, message, options);
+			const { record, localExecuted, localPendResult, cohortPendRefusals } = await this.coordinator.executeClusterTransaction(coordinatingBlockIds[0]!, message, options);
+			// Who ACCEPTED the pending record — the cohort members whose promise vote approved it, plus
+			// or minus this node's own member per exit below. A pend's `confirmed` is not a commit's:
+			// accepting a pending record confers no storage durability (a pend that reached
+			// pend-consensus may still have been stored by nobody — see the local-verdict arm below),
+			// so the two numbers are never comparable, and the field says so.
+			const pendDurability = (selfAccepted: boolean | undefined): WriteDurability =>
+				pendCohortDurability(record, selfAccepted, this.localPeerId?.toString());
 			// The first cohort refusal in peer-id order, so two coordinators facing the same cohort
 			// answer with the same one. Which refusal is reported does not change the outcome — every
 			// entry is conflict-shaped and every one means "rebase and retry" — only which `pending` /
@@ -2166,7 +2038,9 @@ export class CoordinatorRepo implements IRepo {
 					hasMissing: !!(result as any).missing?.length,
 					hasPending: !!(result as any).pending?.length
 				});
-				return answerWithCohortRefusal(result);
+				// Storage's own answer is `local`; the cohort's answer replaces it — this node accepted
+				// the record iff its fallback pend succeeded.
+				return answerWithCohortRefusal(result.success ? { ...result, durability: pendDurability(true) } : result);
 			}
 			// Local cluster already executed during consensus — return storage's own verdict rather
 			// than fabricating a success (the peerCount <= 1 path above returns storage's real result
@@ -2179,7 +2053,10 @@ export class CoordinatorRepo implements IRepo {
 			// commit that reached commit-consensus IS the authoritative commit (Theorem 9), whereas a
 			// pend that reached pend-consensus may still have been stored by nobody.
 			if (localPendResult !== undefined) {
-				if (localPendResult.success || isConflictFailure(localPendResult)) {
+				if (localPendResult.success) {
+					return answerWithCohortRefusal({ ...localPendResult, durability: pendDurability(true) });
+				}
+				if (isConflictFailure(localPendResult)) {
 					return answerWithCohortRefusal(localPendResult);
 				}
 				// A bare-reason refusal (no pending/missing — e.g. a local validation-hook fault)
@@ -2193,11 +2070,14 @@ export class CoordinatorRepo implements IRepo {
 			}
 			// No verdict retained (member predates retention, restart, or TTL): the prior shape,
 			// still subject to the cohort-refusal rule — a lost local verdict must not resurrect the
-			// fabricated success this ticket exists to remove.
+			// fabricated success this ticket exists to remove. For the durability class, a tolerated
+			// local fault means this node did NOT accept (`false`: its approve vote is withdrawn from the
+			// count), and an absent verdict says nothing either way (`undefined`: the vote stands).
 			return answerWithCohortRefusal({
 				success: true,
 				pending: [],
-				blockIds: allBlockIds
+				blockIds: allBlockIds,
+				durability: pendDurability(localPendResult === undefined ? undefined : false)
 			});
 		} catch (error) {
 			this.log('coordinator-repo:pend-error', { actionId: request.actionId, error: (error as Error).message });
@@ -2218,6 +2098,14 @@ export class CoordinatorRepo implements IRepo {
 			// each member compares the rivals as IT holds them, so a member that already approved X
 			// keeps X while a member that approved Y first keeps Y, and no rival reaches a promise
 			// supermajority. (The hash tie-break is already symmetric — it cannot be the fix.)
+			// TWO contenders coordinated by different nodes reach an all-lose round by another route,
+			// and not by this catch: both collect their promises in parallel, so BOTH reach pend
+			// consensus; each coordinator's own member applies its own pend first (local-first
+			// delivery), every other member's storage refuses whichever arrived second, and each writer
+			// is downgraded by `answerWithCohortRefusal` above. Measured by
+			// `test/transaction-node-count-sweep.spec.ts` on the in-process mesh: round one lost by both
+			// writers in 20 of 20 races across two to five machines (2026-09-16). Same cost and same
+			// revisit condition as below.
 			// Fine as it stands: since the torn-action fixes landed, an all-lose round costs one
 			// retry cycle rather than wedging, and the contenders are separated next round by the
 			// jittered backoff plus the aged retry priority carried on the re-pend
@@ -2231,13 +2119,49 @@ export class CoordinatorRepo implements IRepo {
 			if (error instanceof ConflictRaceLostError) {
 				return { success: false, conflict: true, reason: error.message };
 			}
-			const stale = await this.classifyStaleRejection(error, request, allBlockIds)
-				?? await this.classifyPendingConflictRejection(error, request, allBlockIds);
+			if (error instanceof BlocksHeldError) {
+				return await this.answerBlocksHeld(error, request, allBlockIds, cohort.peerIds.length);
+			}
+			const stale = await this.classifyStaleRejection(error, request, allBlockIds);
 			if (stale) return stale;
 			throw error;
 		}
 	}
 
+	/**
+	 * The solo short-circuit of {@link pend}: a cohort of at most one peer runs no consensus, and the
+	 * pend goes straight to local storage exactly as before. What changes is the answer's class —
+	 * see {@link soloCohortDurability} for the four-way split. A refusal is returned untouched.
+	 */
+	private async pendSolo(request: PendRequest, cohort: CohortResolution, options?: MessageOptions): Promise<PendResult> {
+		const result = await this.storageRepo.pend(request, options);
+		return result.success ? { ...result, durability: this.soloCohortDurability(cohort) } : result;
+	}
+
+	/**
+	 * The class of a write that took the solo short-circuit, from the cohort resolution that put it
+	 * there. Policy-free: the write already happened, this only says what it was.
+	 *  - not resolved (the lookup threw, or named nobody) → `unrouted`;
+	 *  - resolved to exactly this node → `local`, a correct and complete one-machine write;
+	 *  - resolved to exactly one peer that is NOT this node → `unrouted` — this node wrote somewhere
+	 *    the cohort does not look, which is a write whose destination is wrong, not a solo write.
+	 * With no local peer id (direct constructors, single-node and test wiring) a resolved cohort of
+	 * one reads as `local`: the same posture `responsibilityFor` takes for a node with no
+	 * identity, and a node with no identity cannot be in any cohort but its own.
+	 *
+	 * Both `unrouted` arms are defence in depth now, not the main guard: {@link verifyResponsibility}
+	 * refuses a write whose lookup throws and a write for a cohort that excludes this node before the
+	 * short-circuit is reached. A write lands here unrouted only inside the responsibility cache's
+	 * staleness window, or when a second lookup fails moments after the first succeeded — and then it
+	 * still reports honestly rather than posing as `local`.
+	 */
+	private soloCohortDurability(cohort: CohortResolution): WriteDurability {
+		if (!cohort.resolved) return unroutedDurability();
+		const sole = cohort.peerIds[0]!;
+		if (this.localPeerId !== undefined && sole !== this.localPeerId.toString()) return unroutedDurability();
+		return localDurability(sole);
+	}
+
 	/**
 	 * Decide whether a cluster validator rejection was an optimistic-concurrency loss — the block
 	 * already advanced past the requested revision — rather than a genuine validation fault.
@@ -2305,48 +2229,57 @@ export class CoordinatorRepo implements IRepo {
 			};
 		}
 		// NOTE: conservative — when only remote members saw the newer revision (local storage still
-		// behind), staleness can't be confirmed locally and the rejection stays a throw. If that
-		// shows up in practice, extend confirmation with a quorum read; never trust the reject text.
-		// `staleAt` is absent on this path for the same reason, and deliberately so — there is no
-		// confirmed number to report, and the field's contract forbids inferring one from that text.
+		// behind), staleness can't be confirmed locally and the rejection stays a throw. That revisit
+		// condition HAS now tripped, for this method's former sibling: the pending-conflict refusal hit
+		// exactly this window under delivery latency (the refusing member ahead of the coordinator) and
+		// escaped as a permanent-looking throw. Its cure was not the quorum read suggested here but a
+		// signed `held` vote — the member's own refusal, carried as evidence, so retryability stopped
+		// depending on a local re-read at all (see {@link answerBlocksHeld}).
+		//
+		// The stale arm is deliberately LEFT on local corroboration. Its refusal is a revision claim,
+		// and `staleAt` — the only place a losing writer learns the revision it lost to — can only be
+		// reported from a revision this node read itself. Moving it to a non-counting vote would take
+		// that number away, so it is its own ticket, not a rider on this one. Never trust the reject
+		// text; `staleAt` is absent on the unconfirmed path for the same reason, and deliberately so.
 		return undefined;
 	}
 
 	/**
-	 * Sibling of {@link classifyStaleRejection} for the OTHER optimistic-concurrency refusal shape:
-	 * the promise-phase pending-conflict vote (`validatePendOperations` rejecting a pend whose
-	 * blocks are held by a different unresolved pending action). That vote surfaces here as a
-	 * {@link ValidatorRejectionError}, and without classification it would escape as a throw —
-	 * splitting multi-tree pends mid-batch instead of taking the retry path a lost race deserves.
+	 * Answer a pend the cohort refused with signed `held` votes: the blocks are reserved by a different
+	 * unresolved action on one or more members ({@link BlocksHeldError}). Always a retryable
+	 * {@link StaleFailure} with `conflict: true`, so the caller's normal retry path
+	 * (`Collection.sync`, and the multi-collection pendPhase via `isConflictFailure`) absorbs it
+	 * instead of a thrown error escaping mid-batch and splitting multi-tree pends.
+	 *
+	 * The local re-read is an ENRICHER, not a gate. It used to be the gate — this refusal arrived as a
+	 * `ValidatorRejectionError` and was only converted when the coordinator's own storage corroborated
+	 * the rival — and under latency the refusing member is routinely ahead of the coordinator, so the
+	 * corroboration missed and a transient refusal escaped as a permanent-looking throw. The `held`
+	 * vote is already signed evidence from the member that holds the rival, so retryability no longer
+	 * depends on a local re-read at all. What the re-read still buys, when it succeeds, is the concrete
+	 * rival list for {@link StaleFailure.pending} and the input {@link noteStuckReservation} needs to
+	 * name a block wedged behind a reservation that will never clear.
 	 *
-	 * Same confirmation discipline as the stale classifier: purely local. Re-read the affected
-	 * blocks from our own storage and require some block's `state.pendings` to carry a rival
-	 * actionId; the signed reject text is never consulted. A confirmed rival returns a
-	 * {@link StaleFailure} with `conflict: true` and the rivals as `pending` (`ActionPending`
-	 * without `transform` — the type allows it, and no consumer rebases from it). Unconfirmed —
-	 * including read errors during confirmation — stays a throw, preserving fail-fast for genuine
-	 * validation faults. Checked after `classifyStaleRejection` so a confirmed committed loss
-	 * (which carries the sharper `staleAt`) wins when both hold.
+	 * NOTE: `error.heldBy` (peerId → holding action id) is dropped at this boundary, the same deliberate
+	 * drop the {@link ConflictRaceLostError} arm of {@link pendThroughCluster} documents: `StaleFailure`
+	 * has no field for it, and the members' action ids are not the same claim as the rivals this node
+	 * read out of its own storage, so they must not be folded into `pending`. A caller that wants to
+	 * WAIT on the holder rather than re-race it needs a typed field added here; never recover the ids
+	 * by parsing `reason`.
 	 */
-	private async classifyPendingConflictRejection(error: unknown, request: PendRequest, blockIds: BlockId[]): Promise<StaleFailure | undefined> {
-		if (!(error instanceof ValidatorRejectionError)) return undefined;
-		let results: GetBlockResults;
-		try {
-			results = await this.storageRepo.get({ blockIds });
-		} catch (readError) {
-			this.log('coordinator-repo:pend-conflict-classify-read-error', {
+	private async answerBlocksHeld(error: BlocksHeldError, request: PendRequest, blockIds: BlockId[], peerCount: number): Promise<StaleFailure> {
+		const pending = await this.corroborateHeldBlocks(request, blockIds, peerCount);
+		if (pending.length === 0) {
+			// The member that refused is ahead of us — the normal shape under latency. Still a conflict:
+			// the refusal is signed, and the un-enriched answer is exactly the shape the lost-race arm
+			// returns. `noteStuckReservation` is deliberately not fed here; it counts refusals whose
+			// holder THIS node can name, and a guess would poison its holder comparison.
+			this.log('coordinator-repo:pend-held-uncorroborated', {
 				actionId: request.actionId,
-				error: (readError as Error).message
+				heldBy: error.heldBy
 			});
-			return undefined;
+			return { success: false, conflict: true, reason: error.message };
 		}
-		const pending: ActionPending[] = [];
-		for (const blockId of blockIds) {
-			for (const actionId of results[blockId]?.state?.pendings ?? []) {
-				if (actionId !== request.actionId) pending.push({ blockId, actionId });
-			}
-		}
-		if (pending.length === 0) return undefined;
 		// Counted as its own statement, never inside the log payload below: this call is the detection
 		// mechanism, not a formatting step, and payload expressions in this repo are fair game to wrap
 		// in an `enabled` gate (`Collection.advanceContext` does exactly that). A gate added there
@@ -2372,45 +2305,87 @@ export class CoordinatorRepo implements IRepo {
 	}
 
 	/**
-	 * Count one confirmed pending-conflict refusal against the holder(s) of each block it names, and say
-	 * ONCE — in words, at the moment it becomes provable — when a block is wedged behind a reservation
-	 * that is not going to clear.
+	 * The rival unresolved actions THIS node's own storage says hold `blockIds`, excluding the request's
+	 * own action (a redelivered pend must not corroborate against itself). Empty when nothing is found
+	 * — including when the read itself fails, which is reported and then treated as "nothing to add",
+	 * since the caller's answer does not depend on it.
 	 *
-	 * **Why this needs saying at all.** Every individual refusal here is indistinguishable from an
-	 * ordinary lost race, which is a normal and healthy event, so the logs of a permanently wedged block
-	 * read exactly like the logs of a busy one. Finding the difference today means noticing that the
-	 * SAME rival action id keeps appearing across unrelated writers for as long as the process lives —
-	 * a pattern nothing points at, and one that cost a downstream project several tickets and weeks to
-	 * re-derive from raw traces. The node has the fact in hand at every refusal; this makes it sayable.
+	 * Carries no `transform`, which {@link ActionPending} allows and no consumer rebases from.
 	 *
-	 * **The signal, and the two things that are NOT the signal.** The discriminator is repetition
-	 * against an unchanged holder — see {@link STUCK_RESERVATION_DISTINCT_ACTIONS} for why distinct
-	 * refused actions is the right counter and for the measured threshold. Two cheaper-looking tests
-	 * were tried and do not work: the members' in-memory reservation table
-	 * (`ClusterMember.activeTransactions`) clears the moment a rival's pend reaches consensus, so a
-	 * perfectly healthy rival inside its pend-to-commit window is absent from it too and absence there
-	 * says nothing; and "the block already passed this pending record's revision" catches a different
-	 * orphan class entirely — in the verified instance the wedged block sat at revision 1 while the
-	 * orphaned record was for revision 2, still nominally promotable.
-	 *
-	 * **Never a control path.** This classifies and logs; it never refuses, expires, or deletes
-	 * anything. Deciding when a durable pending record may be removed is precisely the hard problem
-	 * backlog `debt-unpromotable-pending-records-need-a-sweep` exists for — deleting a live reservation
-	 * is worse than the leak — and a counter accurate enough for a log line is not evidence enough to
-	 * destroy state.
+	 * Diagnostic enrichment only, never a gate: the refusal it corroborates was already cast and signed
+	 * by a member, and nothing here can turn an admission into a refusal or the reverse.
+	 */
+	private async corroborateHeldBlocks(request: PendRequest, blockIds: BlockId[], peerCount: number): Promise<ActionPending[]> {
+		const pending: ActionPending[] = [];
+		// The refusing member reads the request's base only in a cohort that can leave a member out
+		// (`ClusterMember.reservationRequestOf`); read it here under the same condition.
+		const readsBase = cohortCanMissAPend(peerCount, this.superMajorityThreshold);
+		try {
+			for (const blockId of blockIds) {
+				// The request's base for the block, read exactly as the refusing member read it (the
+				// malformed-base log line is that member's, so none is repeated here).
+				const reservation = readsBase
+					? reservationRequestFor(request, blockId, transformForBlockId(request.transforms, blockId)).request
+					: { rev: request.rev };
+				for (const claim of await this.pendingClaimsOf(blockId)) {
+					// The same rule, on the same inputs, as the refusing member (`isReservationAgainst`): a
+					// record this request's writer has built on is not the rival it was refused on, and
+					// naming it would feed a superseded action into the writer's `pending` list and into
+					// the stuck-reservation holder comparison; and, where the base is read, a record
+					// claiming a slot past the request's declared base IS one, even when the requested
+					// revision has moved beyond it — the revision rule alone would leave that refusal
+					// uncorroborated.
+					if (claim.actionId !== request.actionId && isReservationAgainst(claim, reservation)) {
+						pending.push({ blockId, actionId: claim.actionId });
+					}
+				}
+			}
+		} catch (readError) {
+			this.log('coordinator-repo:pend-conflict-classify-read-error', {
+				actionId: request.actionId,
+				error: (readError as Error).message
+			});
+			return [];
+		}
+		return pending;
+	}
+
+	/**
+	 * This node's pending records on `blockId`, each with the slot it claims when storage can say
+	 * (`IPendingClaimReader`, which `StorageRepo` implements). A repo without the capability answers
+	 * with `state.pendings` alone, every record read as an unknown claim — which reserves, so the
+	 * corroboration can only over-name, never under-name.
+	 */
+	private async pendingClaimsOf(blockId: BlockId): Promise<PendingClaim[]> {
+		const reader = this.storageRepo as IRepo & Partial<IPendingClaimReader>;
+		if (typeof reader.listPendingClaims === 'function') {
+			return await reader.listPendingClaims(blockId);
+		}
+		const results: GetBlockResults = await this.storageRepo.get({ blockIds: [blockId] });
+		return (results[blockId]?.state?.pendings ?? []).map(actionId => ({ actionId }));
+	}
+
+	/**
+	 * Count one confirmed pending-conflict refusal against the holder(s) of each block it names, and say
+	 * ONCE — in words, at the moment it becomes provable — when a block is wedged behind a reservation
+	 * that is not going to clear. The counting, the threshold and the wording live in
+	 * {@link StuckReservationTracker}; this node's part is the corroborated holder list and the tag.
 	 *
 	 * Returns the highest distinct-refusal count any of this refusal's blocks has now reached, for the
 	 * classification line to carry; it saturates at the threshold once an episode has been reported,
 	 * since the ids are dropped at that point.
 	 *
-	 * NOTE: fed only by {@link classifyPendingConflictRejection}, i.e. by refusals that arrive as a
-	 * cohort-wide validator rejection. A block only PART of whose cohort holds the stranded record can
+	 * NOTE: fed only by {@link answerBlocksHeld}, i.e. by cohort-wide `held`-answered refusals that this
+	 * node's own storage can corroborate. A block only PART of whose cohort holds the stranded record can
 	 * still reach approval super-majority, and its refusal then comes back through the retained local
-	 * apply verdict (`getExecutedPendResult`) instead, which this never sees — so a partially wedged
-	 * block goes unnamed. That is the weaker condition (the write does land on the healthy members),
-	 * and instrumenting the second path would count a refusal that the cohort as a whole did not make.
-	 * If partial strands ever turn out to be the common shape in the field, the counter belongs on the
-	 * member side (`ClusterMember.validatePendOperations`), where each member sees its own votes.
+	 * apply verdict (`getExecutedPendResult`) instead, which this never sees. The un-corroborated arm of
+	 * {@link answerBlocksHeld} is likewise unfed: this node cannot name the holder, and feeding it a
+	 * guess would poison the holder comparison, which is what separates a wedge from healthy
+	 * contention. Neither gap goes unnamed any more: every MEMBER keeps its own tracker, fed by its own
+	 * `held` votes (`ClusterMember.validatePendOperations`, tag `cluster-member:stuck-reservation`), so
+	 * a reservation only some members hold — the shape `a-member-that-missed-a-commit-refuses-every-
+	 * later-write` measured, before the member stopped refusing on a superseded record at all — is
+	 * named by the members that hold it.
 	 */
 	private noteStuckReservation(pending: ActionPending[], refusedActionId: ActionId): number {
 		const rivalsByBlock = new Map<BlockId, ActionId[]>();
@@ -2419,36 +2394,9 @@ export class CoordinatorRepo implements IRepo {
 			if (rivals) rivals.push(actionId);
 			else rivalsByBlock.set(blockId, [actionId]);
 		}
-		let highest = 0;
-		for (const [blockId, rivals] of rivalsByBlock) {
-			const holders = [...new Set(rivals)].sort();
-			const prior = this.stuckReservations.get(blockId);
-			// A different holder set is a DIFFERENT episode — the block changed hands, which is the
-			// healthy cycle — so the count starts over and the new holder gets its own chance to speak.
-			const watch: StuckReservationWatch = prior !== undefined && sameHolders(prior.holders, holders)
-				? prior
-				: { holders, refused: new Set<ActionId>(), reported: false };
-			if (watch !== prior) this.stuckReservations.set(blockId, watch);
-			if (watch.reported) {
-				highest = Math.max(highest, STUCK_RESERVATION_DISTINCT_ACTIONS);
-				continue;
-			}
-			watch.refused.add(refusedActionId);
-			highest = Math.max(highest, watch.refused.size);
-			if (watch.refused.size < STUCK_RESERVATION_DISTINCT_ACTIONS) continue;
-			this.log('coordinator-repo:stuck-reservation', {
-				blockId,
-				// The ids an operator needs to grep for and to cancel, kept as data beside the prose so a
-				// log search finds the block and the action without parsing English.
-				holdingActionIds: holders,
-				distinctRefusedActions: watch.refused.size,
-				message: stuckReservationMessage(holders, watch.refused.size)
-			});
-			watch.reported = true;
-			// Said once per episode: from here the flag alone suppresses, and the ids have done their
-			// work (their count is in the line above), so drop them rather than growing a set for the
-			// unbounded remainder of a permanent condition.
-			watch.refused.clear();
+		const { highest, named } = this.stuckReservations.note(rivalsByBlock, refusedActionId);
+		for (const episode of named) {
+			this.log('coordinator-repo:stuck-reservation', episode);
 		}
 		return highest;
 	}
@@ -2467,10 +2415,7 @@ export class CoordinatorRepo implements IRepo {
 	 * episode holding an LRU slot can only evict a live one.
 	 */
 	private clearStuckReservations(blockIds: BlockId[], holderActionId?: ActionId): void {
-		for (const blockId of blockIds) {
-			if (holderActionId !== undefined && !this.stuckReservations.peek(blockId)?.holders.includes(holderActionId)) continue;
-			this.stuckReservations.delete(blockId);
-		}
+		this.stuckReservations.forget(blockIds, holderActionId);
 	}
 
 	async cancel(actionRef: ActionBlocks, options?: MessageOptions): Promise<void> {
@@ -2525,54 +2470,13 @@ export class CoordinatorRepo implements IRepo {
 
 	async commit(request: CommitRequest, options?: MessageOptions): Promise<CommitResult> {
 		const blockIds = request.blockIds;
-		// Same as `pend`: forget any settled absence of these blocks before routing, whatever the outcome.
-		this.forgetSettledAbsences(blockIds);
 		await this.verifyResponsibility(blockIds);
 
-		const cohortPeerIds = await this.coordinator.getClusterPeerIds(blockIds[0]!);
-		const peerCount = cohortPeerIds.length;
-		if (peerCount <= 1) {
-			// Solo cohort: consensus never runs, so no ClusterRecord exists to project a proof from —
-			// the lone member self-signs a one-peer proof instead (mintSoloCommitProof), which is what
-			// lets a block born on a cohort of one ever gain a second holder under the certified-push
-			// default (handlePush refuses a proof-less block). Minted even when peerCount is 0 or the
-			// sole peer is not self — findCluster failing (getClusterPeerIds returns []) puts the
-			// DEGRADED-ROUTING case in this same branch, and self genuinely committed these bytes
-			// either way; a proof's peer list is already not evidence of cohort membership by design
-			// (caller obligation #1 on verifyBlockCommitProofClaim), so gating the mint on cohort
-			// composition would buy no safety while opening a silent no-proof hole exactly when
-			// routing is degraded. The log line is how an operator tells a real cohort of one
-			// (cohortSize 1, soleIsSelf true) from a routing failure (cohortSize 0, or a sole peer
-			// that is not this node).
-			this.log('commit:solo-cohort', {
-				blockId: blockIds[0],
-				cohortSize: peerCount,
-				soleIsSelf: peerCount === 1 && this.localPeerId !== undefined
-					&& cohortPeerIds[0] === this.localPeerId.toString()
-			});
-			// Same message shape the multi-peer path produces — executeClusterTransaction stamps
-			// coordinatingBlockIds at its choke point, so the solo artifact must carry it too or a
-			// solo proof's message is distinguishable from every other proof's.
-			const message: RepoMessage = {
-				operations: [{ commit: request }],
-				coordinatingBlockIds: [blockIds[0]!],
-				expiration: options?.expiration ?? Date.now() + this.DEFAULT_TIMEOUT
-			};
-			// `undefined` when no local cluster is wired (direct constructors, unit-test doubles) —
-			// then the commit lands proof-less, exactly the pre-mint behavior. The cast is the named
-			// ICommitProofPersister contract; a plain IRepo double ignores the extra argument.
-			const proof = await this.localCluster?.mintSoloCommitProof?.(message);
-			const result = await (this.storageRepo as IRepo & ICommitProofPersister).commit(request, options, proof);
-			// One self-approval arms the read-repair window only where the DECLARED cohort is also one
-			// — then no rival quorum can exist to be missed. At any larger declared size (including
-			// an undeclared one, which resolves to the replication factor, and including degraded
-			// routing where peerCount is 0) this commit proves nothing about rival quorums — see
-			// commitQuorumRulesOutRivals — so the window stays unarmed and the read path's
-			// solo-self-skip exit re-arms it once per consult instead (which keeps GitHub issue #8's
-			// consult storm bounded at one per window).
-			if (result.success && this.commitQuorumRulesOutRivals(1, peerCount)) this.markBlocksSeen(blockIds);
-			return result;
+		const cohort = await this.coordinator.resolveCohort(blockIds[0]!);
+		if (!cohort.resolved || cohort.peerIds.length <= 1) {
+			return await this.commitSolo(request, blockIds, cohort, options);
 		}
+		const peerCount = cohort.peerIds.length;
 
 		const message: RepoMessage = {
 			operations: [{ commit: request }],
@@ -2607,10 +2511,16 @@ export class CoordinatorRepo implements IRepo {
 			// fresh revision, which is what the `conflict: true` shape makes `Collection.syncAttempts`
 			// and the multi-collection `pendPhase` do. But a member reached only by
 			// `scheduleCommitRetry` can still land the refused revision later, and this node's own
-			// member (or its fallback commit) may hold it already. The writer's retry with the SAME
-			// action id converges either way: `isOwnRevision` in `StorageRepo.pend` and `commit`
-			// treats an already-landed own revision as satisfied, and `inFlightActionId` in
-			// `Collection.updateInternal` keeps the retry on the same action.
+			// member (or its fallback commit) may hold it already. When the refused block is the
+			// action's LOG TAIL, that matters beyond this block: `NetworkTransactor.commit` stops at a
+			// refused tail and never sweeps the action's other blocks, so the writer can then read
+			// its own log entry back while none of the data it describes was committed anywhere.
+			// The writer's retry with the SAME action id is what converges that, and only because it
+			// does two things: `isOwnRevision` in `StorageRepo.pend` and `commit` treats an
+			// already-landed own revision as satisfied, and `Collection.completeOwnEntry` — on
+			// finding that entry — re-sends the refused attempt at the same revision to land the
+			// blocks left behind BEFORE the write is reported saved. Seeing its own log entry is
+			// never, on its own, the writer's proof of durability.
 			const durability = cohortDurability(record, cohortCommitOutcomes);
 			if (localExecuted) {
 				// Our own member applied this commit during consensus. Its retained storage verdict is
@@ -2652,13 +2562,14 @@ export class CoordinatorRepo implements IRepo {
 					});
 				}
 				// An absent verdict (a member that predates retention, a restart, the TTL) is not
-				// evidence of holding anything: it is simply not counted.
-				const durableHolders = durability.remoteHolders + (localDurable ? 1 : 0);
-				if (!isDurableMajority(durableHolders, durability.cohortSize)) {
+				// evidence of holding anything: it is simply not counted — so the class below reads
+				// LOWER than reality for such a member, never higher.
+				const durableHolders = durability.remoteHolders.length + (localDurable ? 1 : 0);
+				if (!isDurableMajority(durableHolders, durability.cohortPeerIds.length)) {
 					return this.refuseCommitNotDurable(request, durableHolders, durability, 'local-executed');
 				}
 				if (armFreshness) this.markBlocksSeen(blockIds);
-				return { success: true };
+				return await this.acknowledgeCommit(request, { success: true, durability: this.cohortWriteDurability(durability, localDurable) }, localDurable, record);
 			}
 			// Local cluster didn't execute during consensus. Attempt a local commit, but tolerate
 			// local divergence when the cluster already reached consensus AND a durable majority of
@@ -2672,9 +2583,11 @@ export class CoordinatorRepo implements IRepo {
 			//     but not the revision that created the block (see StorageRepo.internalCommit).
 			// Reporting a tolerated divergence to the caller as the raw refusal would surface a
 			// committed transaction as a stale loss: db-core's commitPhase treats any returned
-			// `success:false` as a permanent stale failure. So a divergence on a durable majority is
-			// reported as success, and one WITHOUT a durable majority as the durability gate's
-			// retryable refusal (`tolerateLocalCommitDivergence`).
+			// `success:false` as a stale loss, and its coordinator re-drives the refused collection
+			// (alone, even after a sibling collection committed) until its retry budget is spent. So
+			// a divergence on a durable majority is reported as success, and one WITHOUT a durable
+			// majority as the durability gate's retryable refusal (`tolerateLocalCommitDivergence`),
+			// which that re-drive is what clears.
 			//
 			// The gate is evaluated BEFORE the local fallback commit, and a failing gate skips it.
 			// This node counts toward the majority only when it is in the cohort the commit ran on;
@@ -2683,8 +2596,8 @@ export class CoordinatorRepo implements IRepo {
 			// that lone off-cohort copy is exactly the seed of the "revision exists on one node that
 			// is not responsible for it" placement the durability gate exists to prevent.
 			const selfInCohort = this.localPeerId !== undefined && this.localPeerId.toString() in record.peers;
-			if (!isDurableMajority(durability.remoteHolders + (selfInCohort ? 1 : 0), durability.cohortSize)) {
-				return this.refuseCommitNotDurable(request, durability.remoteHolders, durability, 'fallback-skipped');
+			if (!isDurableMajority(durability.remoteHolders.length + (selfInCohort ? 1 : 0), durability.cohortPeerIds.length)) {
+				return this.refuseCommitNotDurable(request, durability.remoteHolders.length, durability, 'fallback-skipped');
 			}
 			//
 			// Deliberately NOT self-signed here (unlike the solo short-circuit above): consensus for
@@ -2701,16 +2614,20 @@ export class CoordinatorRepo implements IRepo {
 				if (result.success) {
 					// The gate above already admitted this shape: the remote holders plus this node
 					// (when it is in the cohort) form the majority, and this node now holds it.
+					// Storage's own `local` answer is replaced by the cohort's — this node counts exactly
+					// as the gate counted it, i.e. only when it is a cohort member.
 					if (armFreshness) this.markBlocksSeen(blockIds);
-					return result;
+					// The fallback commit landed every block, so this node holds them — whether or not
+					// it is a cohort member — and can source a push to whoever the class names as missing.
+					return await this.acknowledgeCommit(request, { ...result, durability: this.cohortWriteDurability(durability, selfInCohort) }, true, record);
 				}
 				if (isMissingBaseRevisionFailure(result) && clusterReachedCommitConsensus(record)) {
-					return this.tolerateLocalCommitDivergence(request, blockIds, result.reason ?? MISSING_BASE_REVISION_REASON, armFreshness, durability);
+					return await this.tolerateLocalCommitDivergence(request, blockIds, result.reason ?? MISSING_BASE_REVISION_REASON, armFreshness, durability);
 				}
 				return result;
 			} catch (err) {
 				if (clusterReachedCommitConsensus(record)) {
-					return this.tolerateLocalCommitDivergence(request, blockIds, (err as Error).message, armFreshness, durability);
+					return await this.tolerateLocalCommitDivergence(request, blockIds, (err as Error).message, armFreshness, durability);
 				}
 				throw err;
 			}
@@ -2859,15 +2776,190 @@ export class CoordinatorRepo implements IRepo {
 	 * window unarmed — this peer is known to be behind here, the last place a self-referential
 	 * freshness stamp belongs.
 	 */
-	private tolerateLocalCommitDivergence(
+	private async tolerateLocalCommitDivergence(
 		request: CommitRequest, blockIds: BlockId[], detail: string, armFreshness: boolean, durability: CohortDurability
-	): CommitResult {
-		if (!isDurableMajority(durability.remoteHolders, durability.cohortSize)) {
-			return this.refuseCommitNotDurable(request, durability.remoteHolders, durability, `fallback-diverged: ${detail}`);
+	): Promise<CommitResult> {
+		if (!isDurableMajority(durability.remoteHolders.length, durability.cohortPeerIds.length)) {
+			return this.refuseCommitNotDurable(request, durability.remoteHolders.length, durability, `fallback-diverged: ${detail}`);
 		}
 		this.log('coordinator-repo:commit-local-failed-cluster-succeeded', { actionId: request.actionId, error: detail });
 		if (armFreshness) this.markBlocksSeen(blockIds);
-		return { success: true };
+		// This node holds nothing: it is an UNCONFIRMED member when it is in the cohort (so the class
+		// is `majority`), and simply absent from the count when it is not (so the class can be `full`
+		// when every member confirmed). Both fall out of the one rule in `cohortWriteDurability`.
+		// Holding nothing, it is also no source for a push, so no shortfall is recorded here.
+		return await this.acknowledgeCommit(request, { success: true, durability: this.cohortWriteDurability(durability, false) }, false);
+	}
+
+	/**
+	 * The one way a success leaves {@link commit}: record the replication shortfall the answer
+	 * describes, then return the answer unchanged. Every success exit — solo, local-executed, local
+	 * fallback, tolerated divergence — runs after the durability gate admitted it, so a refused
+	 * commit never reaches the ledger.
+	 *
+	 * `localHolds` is whether this node's own storage durably holds every block of the commit, which
+	 * is what makes it a source for the missing copies — not whether the class counted it. `record`
+	 * is the consensus the commit ran on, absent for the solo short-circuit (no cohort ran, so no
+	 * holders to report).
+	 */
+	private async acknowledgeCommit(request: CommitRequest, answer: CommitSuccess, localHolds: boolean, record?: ClusterRecord): Promise<CommitSuccess> {
+		if (localHolds && record !== undefined) this.reportCommittedHolders(request, answer.durability, record);
+		await this.noteReplicationShortfall(request, answer.durability, localHolds);
+		return answer;
+	}
+
+	/**
+	 * Tell the {@link CommittedHoldersSink} who holds a cohort commit this node holds, so its rebalance
+	 * monitor does not push the blocks back to members that stored them. A holder is a member the
+	 * durability class confirmed AND that signed an approving commit vote: the confirmation rests on
+	 * the member's unsigned apply report, and requiring the signature too means a member lying in that
+	 * report can only misstate its own copy — a member already trusted with the commit. The members
+	 * the class names unconfirmed are reported as such, which withdraws any earlier record of them
+	 * (including the signer list this node's own member reported at apply), so they are pushed the
+	 * block. Never throws: the commit is already acknowledged.
+	 */
+	private reportCommittedHolders(request: CommitRequest, durability: WriteDurability, record: ClusterRecord): void {
+		if (!this.onCommittedHolders) return;
+		const self = this.localPeerId?.toString();
+		const unconfirmed = durability.unconfirmed ?? [];
+		const holders = (durability.cohortPeerIds ?? [])
+			.filter(peerId => !unconfirmed.includes(peerId))
+			.filter(peerId => peerId === self || record.commits[peerId]?.type === 'approve');
+		try {
+			this.onCommittedHolders({ blockIds: request.blockIds, holders, unconfirmed });
+		} catch (err) {
+			this.log('coordinator-repo:committed-holders-sink-error', { actionId: request.actionId, error: (err as Error).message });
+		}
+	}
+
+	/**
+	 * Write down who is still missing an acknowledged commit, while this node still knows — the
+	 * cohort's answer is gone the moment the writer is answered, and the in-memory commit retry does
+	 * not survive a restart. One entry per block, all sharing this commit's one cohort answer
+	 * (consensus ran on `blockIds[0]`'s cohort for the whole request):
+	 * - `full` settles any older entry for the block, whether or not this node holds it;
+	 * - `majority` records the unconfirmed members by name;
+	 * - `local` and `unrouted` record an EMPTY missing set, meaning "unknown" — nobody could be named.
+	 * A shortfall is recorded only when `localHolds`: a node holding nothing has nothing to push, and
+	 * the remote majority that admitted the commit already holds it.
+	 *
+	 * NEVER throws, and that asymmetry is deliberate: by the time this runs the commit is already
+	 * durable at the class the answer states, so a ledger fault must not turn an acknowledged write
+	 * into a reported failure. A failure is logged per block and the answer still goes out; the
+	 * block's copy is then owed with nobody tracking it, exactly as before the ledger existed.
+	 *
+	 * NOTE: one ledger read and write per block per below-full commit, awaited before the writer is
+	 * answered — on a node that is genuinely alone that is every commit (a `full` commit settles from
+	 * the ledger's in-memory index and touches the store only when an entry exists). If it shows in
+	 * commit latency, coalesce the writes rather than answering first: an entry written after the
+	 * answer can be lost to a crash in between, which is the one case the ledger exists for.
+	 */
+	private async noteReplicationShortfall(request: CommitRequest, durability: WriteDurability, localHolds: boolean): Promise<void> {
+		const ledger = this.underReplicationLedger;
+		if (ledger === undefined) return;
+		// Blocks a torn commit abandoned were cancelled and hold nothing at this revision: there is no
+		// copy to push, and an entry would have a drain repeatedly read a block that is not there.
+		// No answer built in this class names `torn` today — the writer's transactor derives it after
+		// every coordinator has answered — so this guards against a future producer, not a current one.
+		const torn = new Set(durability.torn ?? []);
+		const blockIds = request.blockIds.filter(blockId => !torn.has(blockId));
+		const outcomes = await Promise.allSettled(blockIds.map(blockId =>
+			this.noteBlockShortfall(ledger, request, blockId, durability, localHolds)));
+		outcomes.forEach((outcome, i) => {
+			if (outcome.status === 'fulfilled') return;
+			this.log('coordinator-repo:under-replication-record-failed', {
+				actionId: request.actionId,
+				blockId: blockIds[i],
+				rev: request.rev,
+				quorum: durability.quorum,
+				error: outcome.reason instanceof Error ? outcome.reason.message : String(outcome.reason)
+			});
+		});
+	}
+
+	private async noteBlockShortfall(
+		ledger: IUnderReplicationLedger, request: CommitRequest, blockId: BlockId, durability: WriteDurability, localHolds: boolean
+	): Promise<void> {
+		if (durability.quorum === 'full') {
+			await ledger.settle(blockId, request.rev);
+			return;
+		}
+		if (!localHolds) return;
+		await ledger.record({
+			blockId,
+			rev: request.rev,
+			actionId: request.actionId,
+			quorum: durability.quorum,
+			missingPeerIds: durability.quorum === 'majority' ? durability.unconfirmed ?? [] : [],
+			recordedAt: this.now(),
+			attempts: 0
+		});
+	}
+
+	/**
+	 * The durability class beside the gate: derived from the SAME sets {@link isDurableMajority} was
+	 * just measured on, with this node's own contribution passed per arm exactly as the gate counted
+	 * it, so the class and the gate can never disagree. One rule for all three success exits of
+	 * {@link commit}: `full` iff every cohort member is confirmed, otherwise `majority` (the gate
+	 * already refused anything below that). Never `local` or `unrouted` here — those belong to the
+	 * solo short-circuit, where no cohort ran.
+	 */
+	private cohortWriteDurability(durability: CohortDurability, selfHolds: boolean): WriteDurability {
+		return cohortWriteDurability(durability, selfHolds, this.localPeerId?.toString());
+	}
+
+	/**
+	 * The solo short-circuit of {@link commit}: consensus never runs, so no ClusterRecord exists to
+	 * project a proof from — the lone member self-signs a one-peer proof instead (mintSoloCommitProof),
+	 * which is what lets a block born on a cohort of one ever gain a second holder under the
+	 * certified-push default (handlePush refuses a proof-less block). Minted even when the cohort did
+	 * not resolve or the sole peer is not self — a failed `findCluster` puts the DEGRADED-ROUTING case
+	 * in this same branch, and self genuinely committed these bytes either way; a proof's peer list is
+	 * already not evidence of cohort membership by design (caller obligation #1 on
+	 * verifyBlockCommitProofClaim), so gating the mint on cohort composition would buy no safety while
+	 * opening a silent no-proof hole exactly when routing is degraded.
+	 *
+	 * The policy is unchanged — every write accepted here before is accepted now. What changes is
+	 * that the answer says which situation it was: the `commit:solo-cohort` log line (how an operator
+	 * tells a real cohort of one — cohortSize 1, soleIsSelf true — from a routing failure) now also
+	 * carries the `quorum` the writer is told, and both come from {@link soloCohortDurability}, so the
+	 * log and the answer cannot disagree.
+	 */
+	private async commitSolo(request: CommitRequest, blockIds: BlockId[], cohort: CohortResolution, options?: MessageOptions): Promise<CommitResult> {
+		const cohortPeerIds = cohort.resolved ? cohort.peerIds : [];
+		const peerCount = cohortPeerIds.length;
+		const soloDurability = this.soloCohortDurability(cohort);
+		this.log('commit:solo-cohort', {
+			blockId: blockIds[0],
+			cohortSize: peerCount,
+			soleIsSelf: peerCount === 1 && this.localPeerId !== undefined
+				&& cohortPeerIds[0] === this.localPeerId.toString(),
+			quorum: soloDurability.quorum,
+			...(cohort.resolved ? {} : { reason: cohort.reason })
+		});
+		// Same message shape the multi-peer path produces — executeClusterTransaction stamps
+		// coordinatingBlockIds at its choke point, so the solo artifact must carry it too or a
+		// solo proof's message is distinguishable from every other proof's.
+		const message: RepoMessage = {
+			operations: [{ commit: request }],
+			coordinatingBlockIds: [blockIds[0]!],
+			expiration: options?.expiration ?? Date.now() + this.DEFAULT_TIMEOUT
+		};
+		// `undefined` when no local cluster is wired (direct constructors, unit-test doubles) —
+		// then the commit lands proof-less, exactly the pre-mint behavior. The cast is the named
+		// ICommitProofPersister contract; a plain IRepo double ignores the extra argument.
+		const proof = await this.localCluster?.mintSoloCommitProof?.(message);
+		const result = await (this.storageRepo as IRepo & ICommitProofPersister).commit(request, options, proof);
+		if (!result.success) return result;
+		// One self-approval arms the read-repair window only where the DECLARED cohort is also one
+		// — then no rival quorum can exist to be missed. At any larger declared size (including
+		// an undeclared one, which resolves to the replication factor, and including degraded
+		// routing where peerCount is 0) this commit proves nothing about rival quorums — see
+		// commitQuorumRulesOutRivals — so the window stays unarmed and the read path's
+		// solo-self-skip exit re-arms it once per consult instead (which keeps GitHub issue #8's
+		// consult storm bounded at one per window).
+		if (this.commitQuorumRulesOutRivals(1, peerCount)) this.markBlocksSeen(blockIds);
+		return await this.acknowledgeCommit(request, { ...result, durability: soloDurability }, true);
 	}
 
 	/**
@@ -2878,19 +2970,21 @@ export class CoordinatorRepo implements IRepo {
 	 * read-repair window is deliberately NOT armed: nothing about this commit is freshness evidence.
 	 */
 	private refuseCommitNotDurable(request: CommitRequest, durableHolders: number, durability: CohortDurability, arm: string): StaleFailure {
+		const cohortSize = durability.cohortPeerIds.length;
 		this.log('coordinator-repo:commit-not-durable', {
 			actionId: request.actionId,
 			rev: request.rev,
 			durableHolders,
-			cohortSize: durability.cohortSize,
+			cohortSize,
 			remoteHolders: durability.remoteHolders,
 			remoteRefusals: durability.remoteRefusals,
 			arm
 		});
+		// A failure carries no durability, and no "unknown" class stands in for one.
 		return {
 			success: false,
 			conflict: true,
-			reason: `${COMMIT_NOT_DURABLE_REASON}: ${durableHolders} of ${durability.cohortSize} cohort member(s) report holding rev ${request.rev} of action ${request.actionId} (${arm})`
+			reason: `${COMMIT_NOT_DURABLE_REASON}: ${durableHolders} of ${cohortSize} cohort member(s) report holding rev ${request.rev} of action ${request.actionId} (${arm})`
 		};
 	}
 }
@@ -2898,23 +2992,79 @@ export class CoordinatorRepo implements IRepo {
 /**
  * What the cohort reported about durably holding a commit, read off the consensus responses
  * (`ClusterRecord.applyOutcomes[peer].commit`, threaded as `cohortCommitOutcomes`). Self is never in
- * it: the coordinating node adds itself per arm of `CoordinatorRepo.commit`.
+ * it: the coordinating node adds itself per arm of `CoordinatorRepo.commit`. Carries the peer-id
+ * SETS, not counts: the durability gate needs only the sizes, but the answer to the writer names
+ * the members that did not confirm (`WriteDurability.unconfirmed`), which is what a later repair
+ * has to know.
  */
 interface CohortDurability {
 	/** Members of `record.peers` — the cohort the commit ran on, and the denominator of the majority. */
-	cohortSize: number;
+	cohortPeerIds: readonly string[];
 	/** OTHER members whose post-reconcile verdict was a success. */
-	remoteHolders: number;
+	remoteHolders: readonly string[];
 	/** OTHER members that reported a refusal — logged for the operator, never counted. */
-	remoteRefusals: number;
+	remoteRefusals: readonly string[];
 }
 
 function cohortDurability(record: ClusterRecord, outcomes: { [peerId: string]: CommitResult } | undefined): CohortDurability {
-	const reports = Object.values(outcomes ?? {});
+	const reports = Object.entries(outcomes ?? {});
+	return {
+		cohortPeerIds: Object.keys(record.peers),
+		remoteHolders: reports.filter(([, report]) => report.success).map(([peerId]) => peerId),
+		remoteRefusals: reports.filter(([, report]) => !report.success).map(([peerId]) => peerId)
+	};
+}
+
+/**
+ * The commit-tier durability class, from the gate's own sets. `confirmed` is counted exactly as the
+ * gate counted it (remote holders, plus one for this node when `selfHolds`), and `unconfirmed` is
+ * every cohort member outside that set — so a `full` answer names nobody as missing, and a
+ * `majority` answer names exactly who. The class is `full` iff no cohort member is unconfirmed;
+ * anything below `majority` never reaches here (the gate refused it).
+ */
+function cohortWriteDurability(durability: CohortDurability, selfHolds: boolean, selfPeerId: string | undefined): WriteDurability {
+	const holders = new Set(durability.remoteHolders);
+	if (selfHolds && selfPeerId !== undefined) holders.add(selfPeerId);
+	const unconfirmed = durability.cohortPeerIds.filter(peerId => !holders.has(peerId));
+	return {
+		quorum: unconfirmed.length === 0 ? 'full' : 'majority',
+		confirmed: durability.remoteHolders.length + (selfHolds ? 1 : 0),
+		cohort: durability.cohortPeerIds.length,
+		unconfirmed,
+		cohortPeerIds: durability.cohortPeerIds
+	};
+}
+
+/**
+ * The pend-tier durability class: who ACCEPTED the pending record, read off the record's approving
+ * promise votes. This node's own member is added when `selfAccepted` is true, removed when it is
+ * false (its member applied and refused, so its approve vote no longer describes what it holds),
+ * and left to its vote when `undefined` (no retained verdict — the vote is the only evidence there
+ * is). This node counts only when it is IN the cohort, as the commit tier counts it: a coordinator
+ * outside `record.peers` whose fallback pend landed holds a copy no cohort member will ever look
+ * for, and counting it would let `confirmed` exceed `cohort`. NOT comparable to the commit-tier
+ * count: accepting a pending record confers no storage durability, and the field's own
+ * documentation says so.
+ * NOTE: a REMOTE member's vote is never withdrawn here. The pend arm of `ClusterRecord.applyOutcomes`
+ * reports only conflict-shaped refusals (which downgrade the whole pend to a retryable conflict
+ * before this runs), so a remote member that promised and then faulted at apply keeps its approve
+ * vote and a pend's `full` can overstate by that member. Harmless while nothing reads a pend's
+ * class for repair; if that changes, widen the member's report to carry bare faults too.
+ */
+function pendCohortDurability(record: ClusterRecord, selfAccepted: boolean | undefined, selfPeerId: string | undefined): WriteDurability {
+	const cohortPeerIds = Object.keys(record.peers);
+	const accepted = new Set(Object.entries(record.promises).filter(([, vote]) => vote.type === 'approve').map(([peerId]) => peerId));
+	if (selfPeerId !== undefined && cohortPeerIds.includes(selfPeerId)) {
+		if (selfAccepted === true) accepted.add(selfPeerId);
+		if (selfAccepted === false) accepted.delete(selfPeerId);
+	}
+	const unconfirmed = cohortPeerIds.filter(peerId => !accepted.has(peerId));
 	return {
-		cohortSize: Object.keys(record.peers).length,
-		remoteHolders: reports.filter(report => report.success).length,
-		remoteRefusals: reports.filter(report => !report.success).length
+		quorum: unconfirmed.length === 0 ? 'full' : 'majority',
+		confirmed: accepted.size,
+		cohort: cohortPeerIds.length,
+		unconfirmed,
+		cohortPeerIds
 	};
 }