@optimystic/db-p2p 1.0.0 → 1.2.0

package/dist/src/cluster/cluster-repo.d.ts

@@ -182,6 +182,7 @@ export declare class ClusterMember implements ICluster {
     private executedTransactions;
     private executedPendResults;
     private executedCommitResults;
+    private behindCommitRefusals;
     private refusedPendActions;
     private appliedInvalidations;
     /**
@@ -276,12 +277,13 @@ export declare class ClusterMember implements ICluster {
     update(record: ClusterRecord): Promise<ClusterRecord>;
     private processUpdate;
     /**
-     * Add this member's own apply verdicts to a record's {@link ClusterRecord.applyOutcomes}, when
-     * storage produced any for this transaction. The two arms follow the rules on
-     * {@link MemberApplyOutcome}: the pend arm carries ONLY a conflict-shaped refusal (a success, a
-     * bare-reason fault, or no retained verdict leaves it off — the coordinator's rule is "an entry
-     * means retry", so an entry that does not mean retry must not exist); the commit arm carries the
-     * retained durable verdict whatever it says, because the coordinator counts the successes.
+     * Add this member's own apply report to a record's {@link ClusterRecord.applyOutcomes}, when it
+     * has anything to report for this transaction. The fields follow the rules on
+     * {@link MemberApplyOutcome}: `executed` is set once this member has run the consensus apply; the
+     * pend arm carries ONLY a conflict-shaped refusal (a success, a bare-reason fault, or no retained
+     * verdict leaves it off — the coordinator's rule is "an entry means retry", so an entry that does
+     * not mean retry must not exist); the commit arm carries the retained durable verdict whatever it
+     * says, because the coordinator counts the successes.
      *
      * The member never signs this and never writes another peer's entry.
      */
@@ -658,6 +660,16 @@ export declare class ClusterMember implements ICluster {
      * @see docs/internals.md "Check-Then-Act Race in Consensus" and "Independent Node Storage" pitfalls
      */
     private handleConsensus;
+    /**
+     * A delivery of a record this member already applied. Nothing is applied again, but a retained
+     * behind-shaped commit refusal gets one more reconcile ({@link reconcileRefusedCommit}, a no-op for
+     * every other verdict). This is how a behind remote member heals when it applied on receipt of the
+     * commit round, before the coordinating member held the revision: the coordinator re-sends it the
+     * merged record once its own member has applied, and this delivery's response carries the
+     * refreshed verdict (`withOwnApplyOutcome`), which the durability gate reads. A scheduled commit
+     * retry reaching such a member heals it the same way.
+     */
+    private handleAlreadyExecuted;
     /**
      * Applies one consensus-approved operation to local storage.
      *
@@ -709,12 +721,39 @@ export declare class ClusterMember implements ICluster {
     /**
      * Apply one consensus commit to local storage, tolerating every divergence shape the way the
      * doc comment on {@link applyConsensusOperation} describes and reconciling the behind ones.
-     * Returns storage's own result — or, for the thrown missing-pend shape, which produces no
+     * `applied` is storage's own result — or, for the thrown missing-pend shape, which produces no
      * `CommitResult` at all, a refusal built from the throw — so {@link durableCommitVerdict} works
-     * from one uniform shape. Genuine faults (a bare-reason returned failure, an unrecognized throw)
-     * propagate so {@link handleConsensus} rolls back the executed marker and rethrows.
+     * from one uniform shape. `behind` is true exactly when one of the two behind branches ran, which
+     * is what makes a refusal eligible for {@link reconcileRefusedCommit}. Genuine faults (a
+     * bare-reason returned failure, an unrecognized throw) propagate so {@link handleConsensus} rolls
+     * back the executed marker and rethrows.
      */
     private applyCommitToStorage;
+    /**
+     * Retain `verdict` as this member's durable verdict for `record`'s commit (see
+     * {@link executedCommitResults}), remember whether a refusal was the behind shape, and — once the
+     * verdict is a success — report the committed holders. Shared by the consensus apply and
+     * {@link reconcileRefusedCommit} so both leave the same state behind.
+     */
+    private retainCommitVerdict;
+    /**
+     * One more reconcile for a commit this member already applied at consensus but could not hold:
+     * its retained verdict is a BEHIND-shaped refusal (missing pend or missing base), and the
+     * reconcile that ran during the apply found no cohort peer holding the revision yet. Two callers.
+     * The coordinating node calls it for its own member once a remote member reports holding the
+     * revision (`ClusterCoordinator.broadcastMergedRecord`), for a cohort where the remote members
+     * applied after it did. And every member runs it on a redelivery of a record it already applied
+     * ({@link handleAlreadyExecuted}), which is how a remote member that applied on receipt of the
+     * commit round, before anyone held the revision, heals once the coordinator re-sends it the merged
+     * record. The holder's copy carries the cohort's commit proof, so the existing certified
+     * single-holder path adopts it; no new trust is involved.
+     *
+     * Does nothing unless the retained verdict for `record.messageHash` is a behind refusal; in
+     * particular an ahead-shaped refusal (`missing`) is never reconciled downward. Recomputes and
+     * re-retains the durable verdict afterwards, so `getExecutedCommitResult` then answers a success
+     * when the revision landed. Bounded by the same per-block reconcile timeout and never throws.
+     */
+    reconcileRefusedCommit(record: ClusterRecord): Promise<void>;
     /**
      * The durable verdict for a consensus commit: `applied` itself when storage landed it (a
      * success from `StorageRepo.commit` means every block is committed, or already was, under this
@@ -754,6 +793,16 @@ export declare class ClusterMember implements ICluster {
      * **synchronous** (no `await` here) so the cert is retained before `StorageRepo.commit` emits its
      * change event. No-op (zero cost) when no sink is configured; a throwing sink is isolated + logged so
      * it can never break consensus.
+     *
+     * A record carrying fewer approving commit signatures than `minSigs` retains no cert, so the bridge
+     * skips origination on this member rather than forwarding a cert below its own threshold. Consensus
+     * needs only a simple majority of commits, so a member can apply with fewer.
+     *
+     * NOTE: in a three-member cohort that is the ordinary case for the two remote members. Each applies
+     * on receipt of the commit round holding its own commit and the coordinator's (2 of `minSigs` 3), and
+     * the coordinator does not broadcast the full set to a member that already applied, so only the
+     * coordinating member, which applies with every commit merged, originates. If origination from the
+     * other members is ever needed, have the coordinator deliver the merged record to them too.
      */
     private captureCommitCert;
     /**

package/dist/src/cluster/cluster-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-repo.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAa,WAAW,EAAE,qBAAqB,EAAE,sBAAsB,EAA2B,YAAY,EAAE,UAAU,EAAe,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAiB,UAAU,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACrT,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAiC,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAO7E,OAAO,EAA8C,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEtG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAqF/D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IACjC,wGAAwG;IACxG,KAAK,EAAE,YAAY,CAAC;IACpB,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAyB/F,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE;;;;;;GAMG;AACH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE9E,UAAU,uBAAuB;IAChC,WAAW,EAAE,KAAK,CAAC;IACnB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,8GAA8G;IAC9G,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C,oGAAoG;IACpG,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,oHAAoH;IACpH,sBAAsB,CAAC,EAAE,gCAAgC,CAAC;IAC1D,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,uBAAuB,GAAG,aAAa,CAqBhF;AAKD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAkBhD;;;GAGG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAgF5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAEvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAhGrC,OAAO,CAAC,kBAAkB,CAA4C;IAEtE,OAAO,CAAC,oBAAoB,CAAkC;IAK9D,OAAO,CAAC,mBAAmB,CAAsC;IAYjE,OAAO,CAAC,qBAAqB,CAAwC;IAQrE,OAAO,CAAC,kBAAkB,CAAoC;IAK9D,OAAO,CAAC,oBAAoB,CAAkC;IAC9D;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IAEvE,OAAO,CAAC,YAAY,CAAgB;IAEpC,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IAEjD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAO;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAGhD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;IACvD;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAGjB,WAAW,EAAE,KAAK,EAClB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,MAAM,YAAA,EAExC,kBAAkB,CAAC,EAAE,iBAAiB,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,SAAS,CAAC,EAAE,qBAAqB,YAAA,EACjC,UAAU,CAAC,EAAE,eAAe,YAAA,EAC7C,eAAe,CAAC,EAAE,sBAAsB,EACvB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,cAAc,CAAC,EAAE,sBAAsB,YAAA,EACvC,mBAAmB,CAAC,EAAE,qBAAqB,YAAA,EAC3C,YAAY,CAAC,EAAE,qBAAqB,YAAA,EACpC,sBAAsB,CAAC,EAAE,gCAAgC,YAAA,EACzD,qBAAqB,CAAC,EAAE,6BAA6B,YAAA,EACtE,GAAG,CAAC,EAAE,MAAM,MAAM,EACD,kBAAkB,CAAC,EAAE,oBAAoB,YAAA;IA2B3D;;;;;OAKG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED;;;OAGG;IACH,OAAO,IAAI,IAAI;IAcf;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;;;OASG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIlE;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAItE;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI1E;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAyB7C,aAAa;IAyM3B;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;OAGG;YACW,YAAY;IAgE1B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;YAyCZ,cAAc;IAmC5B;;;;OAIG;YACW,kBAAkB;YAIlB,kBAAkB;IA4BhC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,kBAAkB;YAIlB,iBAAiB;YAIjB,QAAQ;IAKtB;;;;;;;;;;;OAWG;YACW,eAAe;YAqCf,mBAAmB;IAoFjC,OAAO,CAAC,WAAW;YAIL,mBAAmB;IA4BjC;;;;;OAKG;YACW,kBAAkB;IAWhC;;;;;;;;OAQG;YACW,wBAAwB;IAkBtC;;;;;;;;;;OAUG;YACW,eAAe;IAmC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;YACW,eAAe;IAgJ7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;;;;;;;;OAYG;YACW,yBAAyB;IAoEvC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;IAuJpC;;;;;;;;;OASG;YACW,eAAe;IAmC7B;;;;;2GAKuG;IACvG,OAAO,CAAC,oBAAoB;IAiB5B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;YACW,uBAAuB;IA0ErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,gCAAgC;IA0B9C;;;;OAIG;YACW,kCAAkC;IAyBhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,8BAA8B;IA2D5C;8FAC0F;YAC5E,WAAW;IAazB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,wBAAwB;YA0FxB,kBAAkB;IAoBhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IA0D7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uBAAuB;IAoGrC;;;;;;;OAOG;YACW,oBAAoB;IA4ElC;;;;;;;;OAQG;YACW,oBAAoB;IAyBlC;;;;;OAKG;YACW,sBAAsB;IASpC;;;;;;;;;;OAUG;YACW,0BAA0B;IAwExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;;;;;;;OAQG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;;OAMG;YACW,wBAAwB;IAgBtC,uFAAuF;YACzE,iBAAiB;IAmB/B,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;YAcd,eAAe;IAI7B,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;YAuEN,iBAAiB;YAejB,gBAAgB;YA+BhB,gBAAgB;IAM9B,OAAO,CAAC,wBAAwB;YAgClB,mBAAmB;IAqBjC,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,gBAAgB;IAqBxB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAS/B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC1C;;;OAGG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}
+{"version":3,"file":"cluster-repo.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-repo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAa,WAAW,EAAE,qBAAqB,EAAE,sBAAsB,EAA2B,YAAY,EAAE,UAAU,EAAe,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAiB,UAAU,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACrT,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAiC,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAO7E,OAAO,EAA8C,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEtG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAqF/D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IACjC,wGAAwG;IACxG,KAAK,EAAE,YAAY,CAAC;IACpB,yGAAyG;IACzG,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAyB/F,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE;;;;;;GAMG;AACH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE9E,UAAU,uBAAuB;IAChC,WAAW,EAAE,KAAK,CAAC;IACnB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,8GAA8G;IAC9G,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C,oGAAoG;IACpG,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,oHAAoH;IACpH,sBAAsB,CAAC,EAAE,gCAAgC,CAAC;IAC1D,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,uBAAuB,GAAG,aAAa,CAqBhF;AAKD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAkBhD;;;GAGG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAsF5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAEvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAtGrC,OAAO,CAAC,kBAAkB,CAA4C;IAEtE,OAAO,CAAC,oBAAoB,CAAkC;IAK9D,OAAO,CAAC,mBAAmB,CAAsC;IAYjE,OAAO,CAAC,qBAAqB,CAAwC;IAMrE,OAAO,CAAC,oBAAoB,CAA0B;IAQtD,OAAO,CAAC,kBAAkB,CAAoC;IAK9D,OAAO,CAAC,oBAAoB,CAAkC;IAC9D;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IAEvE,OAAO,CAAC,YAAY,CAAgB;IAEpC,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IAEjD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAO;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAGhD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAS;IACrD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;IACvD;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAGjB,WAAW,EAAE,KAAK,EAClB,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,MAAM,YAAA,EAExC,kBAAkB,CAAC,EAAE,iBAAiB,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,SAAS,CAAC,EAAE,qBAAqB,YAAA,EACjC,UAAU,CAAC,EAAE,eAAe,YAAA,EAC7C,eAAe,CAAC,EAAE,sBAAsB,EACvB,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,cAAc,CAAC,EAAE,sBAAsB,YAAA,EACvC,mBAAmB,CAAC,EAAE,qBAAqB,YAAA,EAC3C,YAAY,CAAC,EAAE,qBAAqB,YAAA,EACpC,sBAAsB,CAAC,EAAE,gCAAgC,YAAA,EACzD,qBAAqB,CAAC,EAAE,6BAA6B,YAAA,EACtE,GAAG,CAAC,EAAE,MAAM,MAAM,EACD,kBAAkB,CAAC,EAAE,oBAAoB,YAAA;IA2B3D;;;;;OAKG;IACH,IAAI,+BAA+B,IAAI,MAAM,CAE5C;IAED;;;OAGG;IACH,OAAO,IAAI,IAAI;IAef;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;;;OASG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIlE;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAItE;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI1E;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAyB7C,aAAa;IAyM3B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;OAGG;YACW,YAAY;IAgE1B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;YAyCZ,cAAc;IAmC5B;;;;OAIG;YACW,kBAAkB;YAIlB,kBAAkB;IA4BhC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;YAQd,kBAAkB;YAIlB,iBAAiB;YAIjB,QAAQ;IAKtB;;;;;;;;;;;OAWG;YACW,eAAe;YAqCf,mBAAmB;IAoFjC,OAAO,CAAC,WAAW;YAIL,mBAAmB;IA4BjC;;;;;OAKG;YACW,kBAAkB;IAWhC;;;;;;;;OAQG;YACW,wBAAwB;IAkBtC;;;;;;;;;;OAUG;YACW,eAAe;IAmC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;YACW,eAAe;IAgJ7B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;;;;;;;;OAYG;YACW,yBAAyB;IAoEvC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;IAuJpC;;;;;;;;;OASG;YACW,eAAe;IAmC7B;;;;;2GAKuG;IACvG,OAAO,CAAC,oBAAoB;IAiB5B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;YACW,uBAAuB;IA0ErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,gCAAgC;IA0B9C;;;;OAIG;YACW,kCAAkC;IAyBhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,8BAA8B;IA2D5C;8FAC0F;YAC5E,WAAW;IAazB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,wBAAwB;YA0FxB,kBAAkB;IAoBhC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IA2D7B;;;;;;;;OAQG;YACW,qBAAqB;IAKnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uBAAuB;IAkGrC;;;;;;;;;OASG;YACW,oBAAoB;IA4ElC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;;;;;;;;;;;;;OAgBG;IACG,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBlE;;;;;;;;OAQG;YACW,oBAAoB;IAyBlC;;;;;OAKG;YACW,sBAAsB;IASpC;;;;;;;;;;OAUG;YACW,0BAA0B;IAwExC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;;;;OAQG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;;OAMG;YACW,wBAAwB;IAgBtC,uFAAuF;YACzE,iBAAiB;IAmB/B,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;YAcd,eAAe;IAI7B,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;YAuEN,iBAAiB;YAejB,gBAAgB;YA+BhB,gBAAgB;IAM9B,OAAO,CAAC,wBAAwB;YAiClB,mBAAmB;IAqBjC,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,gBAAgB;IAqBxB,iEAAiE;IACjE,OAAO,CAAC,uBAAuB;IAS/B;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC1C;;;OAGG;IACG,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}

package/dist/src/cluster/cluster-repo.js

@@ -134,6 +134,12 @@ export class ClusterMember {
     // applyConsensusOperation swallowed a refusal whose real cause was a RIVAL action holding the
     // requested revision. Pruned alongside executedTransactions (same TTL).
     executedCommitResults = new Map();
+    // The messageHashes whose retained commit refusal above has the BEHIND shape (missing pend or
+    // missing base — this member held no usable revision), as opposed to the ahead shape, which must
+    // never be reconciled downward. Recorded from the apply branch that produced the refusal rather
+    // than read back from its prose. Only these are eligible for reconcileRefusedCommit. Same TTL,
+    // pruning and rollback as executedCommitResults.
+    behindCommitRefusals = new Set();
     // Conflict-shaped pend refusals this member's storage produced at consensus-apply, keyed by the
     // refused action's id rather than by messageHash. The messageHash-keyed map above cannot serve the
     // commit-promise guard: a commit is a DIFFERENT message with a different hash, so a member holding
@@ -256,6 +262,7 @@ export class ClusterMember {
         this.cleanupQueue.length = 0;
         this.executedPendResults.clear();
         this.executedCommitResults.clear();
+        this.behindCommitRefusals.clear();
         this.refusedPendActions.clear();
     }
     /**
@@ -519,12 +526,13 @@ export class ClusterMember {
         return currentRecord;
     }
     /**
-     * Add this member's own apply verdicts to a record's {@link ClusterRecord.applyOutcomes}, when
-     * storage produced any for this transaction. The two arms follow the rules on
-     * {@link MemberApplyOutcome}: the pend arm carries ONLY a conflict-shaped refusal (a success, a
-     * bare-reason fault, or no retained verdict leaves it off — the coordinator's rule is "an entry
-     * means retry", so an entry that does not mean retry must not exist); the commit arm carries the
-     * retained durable verdict whatever it says, because the coordinator counts the successes.
+     * Add this member's own apply report to a record's {@link ClusterRecord.applyOutcomes}, when it
+     * has anything to report for this transaction. The fields follow the rules on
+     * {@link MemberApplyOutcome}: `executed` is set once this member has run the consensus apply; the
+     * pend arm carries ONLY a conflict-shaped refusal (a success, a bare-reason fault, or no retained
+     * verdict leaves it off — the coordinator's rule is "an entry means retry", so an entry that does
+     * not mean retry must not exist); the commit arm carries the retained durable verdict whatever it
+     * says, because the coordinator counts the successes.
      *
      * The member never signs this and never writes another peer's entry.
      */
@@ -532,6 +540,7 @@ export class ClusterMember {
         const pend = this.executedPendResults.get(record.messageHash);
         const commit = this.executedCommitResults.get(record.messageHash);
         const own = {
+            ...(this.executedTransactions.has(record.messageHash) ? { executed: true } : {}),
             ...(pend !== undefined && !pend.success && isConflictFailure(pend) ? { pend } : {}),
             ...(commit !== undefined ? { commit } : {})
         };
@@ -1968,14 +1977,14 @@ export class ClusterMember {
         // Check persistent store first for post-recovery dedup (in-memory map is cleared on restart).
         // wasTransactionExecutedAsync also checks the in-memory map as a fast path.
         if (await this.wasTransactionExecutedAsync(record.messageHash)) {
-            log('cluster-member:consensus-already-executed', { messageHash: record.messageHash });
+            await this.handleAlreadyExecuted(record);
             return;
         }
         // Check-and-set ATOMICALLY to prevent race condition where multiple calls
         // pass the async check before any completes. Since JavaScript is single-threaded,
         // this synchronous check-and-set is atomic before any await.
         if (this.executedTransactions.has(record.messageHash)) {
-            log('cluster-member:consensus-already-executed', { messageHash: record.messageHash });
+            await this.handleAlreadyExecuted(record);
             return;
         }
         // Set the in-memory guard IMMEDIATELY, before any async operations: its synchronous
@@ -2002,6 +2011,7 @@ export class ClusterMember {
             this.executedTransactions.delete(record.messageHash);
             this.executedPendResults.delete(record.messageHash);
             this.executedCommitResults.delete(record.messageHash);
+            this.behindCommitRefusals.delete(record.messageHash);
             for (const operation of record.message.operations) {
                 if ('pend' in operation)
                     this.refusedPendActions.delete(operation.pend.actionId);
@@ -2021,6 +2031,19 @@ export class ClusterMember {
         this.stateStore?.markExecuted(record.messageHash, executedAt)
             .catch(err => log('cluster-member:persist-executed-error', { messageHash: record.messageHash, error: err.message }));
     }
+    /**
+     * A delivery of a record this member already applied. Nothing is applied again, but a retained
+     * behind-shaped commit refusal gets one more reconcile ({@link reconcileRefusedCommit}, a no-op for
+     * every other verdict). This is how a behind remote member heals when it applied on receipt of the
+     * commit round, before the coordinating member held the revision: the coordinator re-sends it the
+     * merged record once its own member has applied, and this delivery's response carries the
+     * refreshed verdict (`withOwnApplyOutcome`), which the durability gate reads. A scheduled commit
+     * retry reaching such a member heals it the same way.
+     */
+    async handleAlreadyExecuted(record) {
+        log('cluster-member:consensus-already-executed', { messageHash: record.messageHash });
+        await this.reconcileRefusedCommit(record);
+    }
     /**
      * Applies one consensus-approved operation to local storage.
      *
@@ -2149,7 +2172,7 @@ export class ClusterMember {
                     membershipVersion: record.membershipVersion
                 });
             }
-            const applied = await this.applyCommitToStorage(record, commit, proof);
+            const { applied, behind } = await this.applyCommitToStorage(record, commit, proof);
             // Retain the POST-RECONCILE durable verdict (see getExecutedCommitResult and
             // withOwnApplyOutcome): what this member's storage holds NOW, after any behind-reconcile the
             // apply triggered — not what the first apply attempt said. A member that pulled the
@@ -2158,10 +2181,7 @@ export class ClusterMember {
             // verdicts — its own member's through getExecutedCommitResult, every other member's off the
             // response record — and the two readers must see the same answer, hence one verdict,
             // computed once, retained here for both.
-            const verdict = await this.durableCommitVerdict(commit, applied);
-            this.executedCommitResults.set(messageHash, verdict);
-            if (verdict.success)
-                this.reportCommittedHolders(record, commit);
+            this.retainCommitVerdict(record, commit, await this.durableCommitVerdict(commit, applied), behind);
             return;
         }
         if ('invalidate' in operation) {
@@ -2172,10 +2192,12 @@ export class ClusterMember {
     /**
      * Apply one consensus commit to local storage, tolerating every divergence shape the way the
      * doc comment on {@link applyConsensusOperation} describes and reconciling the behind ones.
-     * Returns storage's own result — or, for the thrown missing-pend shape, which produces no
+     * `applied` is storage's own result — or, for the thrown missing-pend shape, which produces no
      * `CommitResult` at all, a refusal built from the throw — so {@link durableCommitVerdict} works
-     * from one uniform shape. Genuine faults (a bare-reason returned failure, an unrecognized throw)
-     * propagate so {@link handleConsensus} rolls back the executed marker and rethrows.
+     * from one uniform shape. `behind` is true exactly when one of the two behind branches ran, which
+     * is what makes a refusal eligible for {@link reconcileRefusedCommit}. Genuine faults (a
+     * bare-reason returned failure, an unrecognized throw) propagate so {@link handleConsensus} rolls
+     * back the executed marker and rethrows.
      */
     async applyCommitToStorage(record, commit, proof) {
         const messageHash = record.messageHash;
@@ -2198,12 +2220,12 @@ export class ClusterMember {
                 // cohort peer so the block is no longer under-replicated. Best-effort:
                 // failures are logged inside, never thrown (a throw would reset the stream).
                 await this.reconcileDivergentCommit(record, commit);
-                return { success: false, reason: err.message };
+                return { applied: { success: false, reason: err.message }, behind: true };
             }
             throw err;
         }
         if (result.success) {
-            return result;
+            return { applied: result, behind: false };
         }
         // success:false is a StaleFailure. `missing` ⇒ ahead/stale divergence
         // (we already hold ≥ this rev): tolerate, do NOT reconcile downward. A
@@ -2233,7 +2255,7 @@ export class ClusterMember {
                 reason: result.reason,
                 hasMissing: true
             });
-            return result;
+            return { applied: result, behind: false };
         }
         // This member holds no materializable base for one of the blocks, so
         // `StorageRepo.commit` REFUSED rather than record a revision it could never serve.
@@ -2249,10 +2271,64 @@ export class ClusterMember {
                 reason: result.reason
             });
             await this.reconcileDivergentCommit(record, commit);
-            return result;
+            return { applied: result, behind: true };
         }
         throw new Error(`Consensus commit for action ${commit.actionId} failed: ${result.reason ?? 'unknown reason'}`);
     }
+    /**
+     * Retain `verdict` as this member's durable verdict for `record`'s commit (see
+     * {@link executedCommitResults}), remember whether a refusal was the behind shape, and — once the
+     * verdict is a success — report the committed holders. Shared by the consensus apply and
+     * {@link reconcileRefusedCommit} so both leave the same state behind.
+     */
+    retainCommitVerdict(record, commit, verdict, behind) {
+        this.executedCommitResults.set(record.messageHash, verdict);
+        if (verdict.success) {
+            this.behindCommitRefusals.delete(record.messageHash);
+            this.reportCommittedHolders(record, commit);
+        }
+        else if (behind) {
+            this.behindCommitRefusals.add(record.messageHash);
+        }
+    }
+    /**
+     * One more reconcile for a commit this member already applied at consensus but could not hold:
+     * its retained verdict is a BEHIND-shaped refusal (missing pend or missing base), and the
+     * reconcile that ran during the apply found no cohort peer holding the revision yet. Two callers.
+     * The coordinating node calls it for its own member once a remote member reports holding the
+     * revision (`ClusterCoordinator.broadcastMergedRecord`), for a cohort where the remote members
+     * applied after it did. And every member runs it on a redelivery of a record it already applied
+     * ({@link handleAlreadyExecuted}), which is how a remote member that applied on receipt of the
+     * commit round, before anyone held the revision, heals once the coordinator re-sends it the merged
+     * record. The holder's copy carries the cohort's commit proof, so the existing certified
+     * single-holder path adopts it; no new trust is involved.
+     *
+     * Does nothing unless the retained verdict for `record.messageHash` is a behind refusal; in
+     * particular an ahead-shaped refusal (`missing`) is never reconciled downward. Recomputes and
+     * re-retains the durable verdict afterwards, so `getExecutedCommitResult` then answers a success
+     * when the revision landed. Bounded by the same per-block reconcile timeout and never throws.
+     */
+    async reconcileRefusedCommit(record) {
+        const messageHash = record.messageHash;
+        const refused = this.executedCommitResults.get(messageHash);
+        if (refused === undefined || refused.success || !this.behindCommitRefusals.has(messageHash)) {
+            return;
+        }
+        const operation = record.message.operations.find((op) => 'commit' in op);
+        if (operation === undefined) {
+            return;
+        }
+        const commit = operation.commit;
+        log('cluster-member:consensus-commit-reconcile-again', { messageHash, actionId: commit.actionId, rev: commit.rev });
+        await this.reconcileDivergentCommit(record, commit);
+        const verdict = await this.durableCommitVerdict(commit, refused);
+        // The apply's retention may have been pruned or rolled back while the reconcile ran; never
+        // resurrect it.
+        if (this.executedCommitResults.get(messageHash) !== refused) {
+            return;
+        }
+        this.retainCommitVerdict(record, commit, verdict, true);
+    }
     /**
      * The durable verdict for a consensus commit: `applied` itself when storage landed it (a
      * success from `StorageRepo.commit` means every block is committed, or already was, under this
@@ -2386,6 +2462,16 @@ export class ClusterMember {
      * **synchronous** (no `await` here) so the cert is retained before `StorageRepo.commit` emits its
      * change event. No-op (zero cost) when no sink is configured; a throwing sink is isolated + logged so
      * it can never break consensus.
+     *
+     * A record carrying fewer approving commit signatures than `minSigs` retains no cert, so the bridge
+     * skips origination on this member rather than forwarding a cert below its own threshold. Consensus
+     * needs only a simple majority of commits, so a member can apply with fewer.
+     *
+     * NOTE: in a three-member cohort that is the ordinary case for the two remote members. Each applies
+     * on receipt of the commit round holding its own commit and the coordinator's (2 of `minSigs` 3), and
+     * the coordinator does not broadcast the full set to a member that already applied, so only the
+     * coordinating member, which applies with every commit merged, originates. If origination from the
+     * other members is ever needed, have the coordinator deliver the merged record to them too.
      */
     captureCommitCert(record, actionId, signedPayload) {
         if (!this.onCommitCertificate) {
@@ -2393,7 +2479,12 @@ export class ClusterMember {
         }
         const minSigs = Math.ceil(Object.keys(record.peers).length * this.superMajorityThreshold);
         try {
-            this.onCommitCertificate(actionId, buildCommitCert(record, minSigs, signedPayload));
+            const cert = buildCommitCert(record, minSigs, signedPayload);
+            if (cert.signers.length < minSigs) {
+                log('cluster-member:commit-cert-below-threshold', { actionId, signers: cert.signers.length, minSigs });
+                return;
+            }
+            this.onCommitCertificate(actionId, cert);
         }
         catch (err) {
             log('cluster-member:commit-cert-sink-error', { actionId, error: err.message });
@@ -2619,6 +2710,7 @@ export class ClusterMember {
                 this.executedTransactions.delete(messageHash);
                 this.executedPendResults.delete(messageHash);
                 this.executedCommitResults.delete(messageHash);
+                this.behindCommitRefusals.delete(messageHash);
             }
         }
         // Prune actionId-keyed pend refusals on the same TTL as the verdicts they were derived from.