@peerbit/shared-log 13.2.5 → 13.2.7

package/dist/src/index.js

@@ -40,7 +40,7 @@ import { AccessError, Ed25519Keypair, Ed25519PublicKey, PublicSignKey, Secp256k1
 import { And, ByteMatchQuery, NotStartedError as IndexNotStartedError, Or, Sort, StringMatch, toId, } from "@peerbit/indexer-interface";
 import { Entry, EntryType, LamportClock, Log, Meta, ShallowEntry, ShallowMeta, Timestamp, verifyEd25519Batch, verifyEntryV0Ed25519BatchFromEntries, } from "@peerbit/log";
 import { logger as loggerFn } from "@peerbit/logger";
-import { ClosedError, Program } from "@peerbit/program";
+import { ClosedError, Program, TerminalOperationNotStartedError, } from "@peerbit/program";
 import { FanoutChannel, waitForSubscribers, } from "@peerbit/pubsub";
 import { SubscriptionEvent, UnsubcriptionEvent, } from "@peerbit/pubsub-interface";
 import { RPC } from "@peerbit/rpc";
@@ -53,8 +53,8 @@ import { BlocksMessage } from "./blocks.js";
 import { CheckedPruneCoordinator, } from "./checked-prune.js";
 import { CPUUsageIntervalLag } from "./cpu.js";
 import { debouncedAccumulatorMap, } from "./debounce.js";
-import { NoPeersError } from "./errors.js";
-import { EXCHANGE_HEADS_REPAIR_HINT, EntryWithRefs, ExchangeHeadsMessage, MAX_RAW_EXCHANGE_MESSAGE_SIZE, RawEntryWithRefs, RawExchangeHeadsMessage, RequestIPrune, ResponseIPrune, SYNC_CAPABILITY_RAW_EXCHANGE_HEADS, StashBackedRawExchangeHeadsMessage, SyncCapabilitiesMessage, collectRawExchangeHeadSendPlan, createExchangeHeadsMessages, createRawExchangeHeadsMessages, getExchangeHeadHash, getPreparedRawExchangeGid, getPreparedRawExchangeHashNumber, getPreparedRawExchangeHeadAppendFacts, getPreparedRawExchangeHeadGid, getPreparedRawExchangeHeadRequestedReplicas, getPreparedRawExchangeHeadSignatureVerified, getPreparedRawExchangeHeadShallowEntry, getPreparedRawExchangeNext, getPreparedRawExchangeRequestedReplicas, getPreparedRawExchangeTimestamp, getRawExchangeHeadByteLength, getRawExchangeHeadStashIndexes, initExchangeHeadEntry, isPreparedRawEntryWithRefs, isStashBackedRawExchangeHeadsMessage, materializeVerifiedRawExchangeHeadsMessage, } from "./exchange-heads.js";
+import { NativeDurableCommitError, NoPeersError } from "./errors.js";
+import { EXCHANGE_HEADS_REPAIR_HINT, EntryWithRefs, ExchangeHeadsMessage, MAX_RAW_EXCHANGE_MESSAGE_SIZE, RawEntryWithRefs, RawExchangeHeadsMessage, RequestIPrune, ResponseIPrune, SYNC_CAPABILITY_RAW_EXCHANGE_HEADS, StashBackedRawExchangeHeadsMessage, SyncCapabilitiesMessage, collectRawExchangeHeadSendPlan, createExchangeHeadsMessages, createRawExchangeHeadsMessages, getExchangeHeadHash, getPreparedRawExchangeGid, getPreparedRawExchangeHashNumber, getPreparedRawExchangeHeadAppendFacts, getPreparedRawExchangeHeadGid, getPreparedRawExchangeHeadRequestedReplicas, getPreparedRawExchangeHeadShallowEntry, getPreparedRawExchangeHeadSignatureVerified, getPreparedRawExchangeNext, getPreparedRawExchangeRequestedReplicas, getPreparedRawExchangeTimestamp, getRawExchangeHeadByteLength, getRawExchangeHeadStashIndexes, initExchangeHeadEntry, isPreparedRawEntryWithRefs, isStashBackedRawExchangeHeadsMessage, materializeVerifiedRawExchangeHeadsMessage, } from "./exchange-heads.js";
 import { FanoutEnvelope } from "./fanout-envelope.js";
 import { MAX_U32, MAX_U64, createNumbers, } from "./integers.js";
 import { TransportMessage } from "./message.js";
@@ -105,9 +105,9 @@ const toLocalPublicSignKey = (key) => {
 export { createReplicationDomainHash, createReplicationDomainTime, };
 export { CPUUsageIntervalLag };
 export * from "./replication.js";
-export { ReplicationRangeIndexableU32, ReplicationRangeIndexableU64, EntryReplicatedU32, EntryReplicatedU64, NoPeersError, };
+export { ReplicationRangeIndexableU32, ReplicationRangeIndexableU64, EntryReplicatedU32, EntryReplicatedU64, NativeDurableCommitError, NoPeersError, };
 export { MAX_U32, MAX_U64 };
-export { ExchangeHeadsMessage, RawExchangeHeadsMessage };
+export { ExchangeHeadsMessage, RawExchangeHeadsMessage, StashBackedRawExchangeHeadsMessage, };
 export const logger = loggerFn("peerbit:shared-log");
 const warn = logger.newScope("warn");
 const traceLogger = logger.trace;
@@ -129,6 +129,21 @@ const canUseOptionalNativeModuleImports = () => {
  * to avoid doubled slashes.
  */
 const joinNativeCoordinateDirectory = (nodeDirectory, fsSafeLogId) => `${nodeDirectory.replace(/[/\\]+$/, "")}/coordinates/${fsSafeLogId}`;
+const createNativeDurableBlockStore = async (storage) => new AnyBlockStore(await storage.sublevel("blocks", {
+    // Strict mirrors remain WAL-backed across close. The available snapshot
+    // rewrite is not a crash-atomic generation protocol, so thresholds must
+    // not re-enable it behind this acknowledgement boundary.
+    compactOnClose: false,
+    // A native append is acknowledged only after this mirror resolves. The
+    // Rust store's normal immutable fast path may resolve before its WAL write;
+    // strict mode waits for the journal write and sync, closing the SIGKILL gap.
+    durability: "strict",
+}));
+const createDefaultDurableBlockStore = async (storage) => new AnyBlockStore(await storage.sublevel("blocks", {
+    // State this default explicitly so a cached child created by the native
+    // path cannot silently carry its deferred-close policy into this path.
+    compactOnClose: true,
+}));
 /**
  * Write-through block store bridging the native backbone's in-wasm-memory block
  * store to a durable per-program {@link AnyBlockStore}.
@@ -148,11 +163,12 @@ const joinNativeCoordinateDirectory = (nodeDirectory, fsSafeLogId) => `${nodeDir
  * METHOD SURFACE (see #1006): `RemoteBlocks` and the log feature-detect the
  * optional batch methods (`putMany`/`putKnown`/`putKnownMany`/
  * `putKnownManyColumns`/`rmMany`). To keep the receive-fusion / columnar fast
- * paths engaged this wrapper exposes EXACTLY the methods the native store
- * exposes — including `putKnownManyColumns`, which `AnyBlockStore` does not have
- * — and delegates each. It deliberately does not add methods the native store
- * lacks (`getBlockResponsePayload`/`getNativeLogBlockStoreHandle` stay absent so
- * the optional-chained probes in `RemoteBlocks` behave exactly as today).
+ * paths engaged this wrapper preserves the native store's optional write
+ * methods — including `putKnownManyColumns`, which `AnyBlockStore` does not have
+ * — and delegates each. It adds only local durability/trim coordination hooks
+ * consumed by `RemoteBlocks` and the log; protocol/native-handle capabilities
+ * such as `getBlockResponsePayload`/`getNativeLogBlockStoreHandle` stay absent,
+ * so their optional-chained probes keep the existing fallback behavior.
  */
 class NativeBackboneWriteThroughBlockStore {
     native;
@@ -170,8 +186,302 @@ class NativeBackboneWriteThroughBlockStore {
     // vanishing and leaving the block out of durable while native/log report
     // success. `.catch` also prevents unhandled-rejection noise.
     pendingDurableWrites = new Set();
-    durableWriteError;
-    trackDurable(result) {
+    nativeDurableCommitFailure;
+    stopCompleted = false;
+    nativeDeleteTombstones = new Map();
+    nativeDeleteEpoch = 0;
+    nativeBlockWriteGenerations = new Map();
+    pendingNativeDeleteCleanup = new Map();
+    stagedNativeDeleteCleanups = new Map();
+    nextNativeDeleteCleanupToken = 0;
+    nativeDeleteCleanupRunning;
+    nextNativeCommitOwnershipToken = 0;
+    nativeCommitOwnerships = new Map();
+    nativeCommitOwnershipsByCid = new Map();
+    getNativeDurableCommitFailure() {
+        return this.nativeDurableCommitFailure;
+    }
+    recordNativeDurableCommitFailure(cause, options) {
+        if (this.nativeDurableCommitFailure) {
+            this.nativeDurableCommitFailure.addCommitContext(options);
+            return this.nativeDurableCommitFailure;
+        }
+        this.nativeDurableCommitFailure =
+            cause instanceof NativeDurableCommitError
+                ? cause
+                : new NativeDurableCommitError(cause, options);
+        if (cause instanceof NativeDurableCommitError) {
+            cause.addCommitContext(options);
+        }
+        return this.nativeDurableCommitFailure;
+    }
+    throwIfNativeDurableCommitFailed() {
+        if (this.nativeDurableCommitFailure) {
+            throw this.nativeDurableCommitFailure;
+        }
+    }
+    throwIfDurableWritesFailed() {
+        this.throwIfNativeDurableCommitFailed();
+    }
+    async commitDurableMutation(operation, committedCids, failedCids) {
+        this.throwIfNativeDurableCommitFailed();
+        const committedCidList = [...committedCids];
+        const failedCidList = failedCids ? [...failedCids] : committedCidList;
+        let result;
+        const operationResult = Promise.resolve().then(operation);
+        this.trackAwaitedDurable(operationResult);
+        try {
+            result = await operationResult;
+        }
+        catch (error) {
+            throw this.recordNativeDurableCommitFailure(error, {
+                committedCids: committedCidList,
+                failedCids: failedCidList,
+            });
+        }
+        // A different concurrent native mutation may have poisoned the wrapper
+        // while this durable call was in flight. Include this operation among the
+        // native-applied facts, but not among durable calls that actually failed.
+        if (this.nativeDurableCommitFailure) {
+            this.nativeDurableCommitFailure.addCommitContext({
+                committedCids: committedCidList,
+                failedCids: [],
+            });
+            throw this.nativeDurableCommitFailure;
+        }
+        return result;
+    }
+    beginNativeDelete(cids) {
+        this.nativeDeleteEpoch++;
+        for (const cid of cids) {
+            this.nativeDeleteTombstones.set(cid, (this.nativeDeleteTombstones.get(cid) ?? 0) + 1);
+        }
+    }
+    endNativeDelete(cids) {
+        for (const cid of cids) {
+            const remaining = (this.nativeDeleteTombstones.get(cid) ?? 1) - 1;
+            if (remaining <= 0) {
+                this.nativeDeleteTombstones.delete(cid);
+            }
+            else {
+                this.nativeDeleteTombstones.set(cid, remaining);
+            }
+        }
+    }
+    isNativeDeletePending(cid) {
+        return this.nativeDeleteTombstones.has(cid);
+    }
+    // A CID can be legitimately re-added after a native trim (content addressing
+    // makes the bytes identical, but its liveness is new). Cancel any queued trim
+    // for that CID and advance its generation before the write is exposed. An
+    // already-running cleanup uses the generation/pending map to avoid deleting
+    // the new native value; synchronous columnar writes also chain their durable
+    // mirror behind that cleanup below.
+    noteNativeBlockWrite(cids) {
+        const generations = new Map();
+        for (const cid of new Set(cids)) {
+            const generation = (this.nativeBlockWriteGenerations.get(cid) ?? 0) + 1;
+            this.nativeBlockWriteGenerations.set(cid, generation);
+            generations.set(cid, generation);
+            if (this.pendingNativeDeleteCleanup.delete(cid)) {
+                this.endNativeDelete([cid]);
+            }
+            for (const staged of this.stagedNativeDeleteCleanups.values()) {
+                if (staged.delete(cid)) {
+                    this.endNativeDelete([cid]);
+                }
+            }
+        }
+        return generations;
+    }
+    beginNativeCommitOwnership(generations) {
+        if (generations.size === 0) {
+            return undefined;
+        }
+        const token = {
+            id: ++this.nextNativeCommitOwnershipToken,
+            rows: new Map(),
+        };
+        for (const [cid, generation] of generations) {
+            const owners = this.nativeCommitOwnershipsByCid.get(cid) ?? new Set();
+            const shared = owners.size > 0;
+            for (const ownerId of owners) {
+                const owner = this.nativeCommitOwnerships.get(ownerId);
+                const row = owner?.rows.get(cid);
+                if (row)
+                    row.shared = true;
+            }
+            owners.add(token.id);
+            this.nativeCommitOwnershipsByCid.set(cid, owners);
+            token.rows.set(cid, { generation, shared });
+        }
+        this.nativeCommitOwnerships.set(token.id, token);
+        return token;
+    }
+    releaseNativeCommitOwnership(token) {
+        if (!token ||
+            typeof token !== "object" ||
+            typeof token.id !== "number") {
+            return;
+        }
+        const owned = this.nativeCommitOwnerships.get(token.id);
+        if (owned !== token) {
+            return;
+        }
+        this.nativeCommitOwnerships.delete(owned.id);
+        for (const cid of owned.rows.keys()) {
+            const owners = this.nativeCommitOwnershipsByCid.get(cid);
+            owners?.delete(owned.id);
+            if (owners?.size === 0) {
+                this.nativeCommitOwnershipsByCid.delete(cid);
+            }
+        }
+    }
+    acknowledgeNativeCommitOwnership(token) {
+        this.releaseNativeCommitOwnership(token);
+    }
+    enqueueNativeDeleteCleanup(cids) {
+        for (const cid of new Set(cids)) {
+            if (!this.pendingNativeDeleteCleanup.has(cid)) {
+                this.pendingNativeDeleteCleanup.set(cid, this.nativeBlockWriteGenerations.get(cid) ?? 0);
+                this.beginNativeDelete([cid]);
+            }
+        }
+    }
+    releaseStagedNativeDeleteCleanup(token) {
+        const staged = this.stagedNativeDeleteCleanups.get(token);
+        if (!staged) {
+            return false;
+        }
+        this.stagedNativeDeleteCleanups.delete(token);
+        for (const [cid] of staged) {
+            this.endNativeDelete([cid]);
+        }
+        return true;
+    }
+    discardStagedNativeDeleteCleanups() {
+        for (const token of [...this.stagedNativeDeleteCleanups.keys()]) {
+            this.releaseStagedNativeDeleteCleanup(token);
+        }
+    }
+    // Native commit callbacks call this immediately after the native transaction
+    // returns, before awaiting the new block's durable mirror. This stages read
+    // tombstones only. Durable deletion is promoted later by the exact EntryIndex
+    // consume token, so an unacknowledged/failed append cannot delete the old
+    // durable head that the lower log still publishes.
+    beginNativeDeleteCleanup(cids) {
+        this.throwIfNativeDurableCommitFailed();
+        const uniqueCids = [...new Set(cids)];
+        if (uniqueCids.length === 0) {
+            return undefined;
+        }
+        const token = ++this.nextNativeDeleteCleanupToken;
+        const staged = new Map(uniqueCids.map((cid) => [
+            cid,
+            this.nativeBlockWriteGenerations.get(cid) ?? 0,
+        ]));
+        this.stagedNativeDeleteCleanups.set(token, staged);
+        this.beginNativeDelete(uniqueCids);
+        return token;
+    }
+    cancelNativeDeleteCleanup(cleanupToken) {
+        if (typeof cleanupToken === "number") {
+            this.releaseStagedNativeDeleteCleanup(cleanupToken);
+        }
+    }
+    async waitForNativeDeleteCleanup() {
+        while (this.nativeDeleteCleanupRunning) {
+            await this.nativeDeleteCleanupRunning;
+        }
+    }
+    async waitForTrackedDurableWrites() {
+        while (this.pendingDurableWrites.size > 0) {
+            await Promise.allSettled([...this.pendingDurableWrites]);
+        }
+    }
+    async retryNativeDeleteCleanup(options) {
+        await this.waitForNativeDeleteCleanup();
+        if (this.nativeDurableCommitFailure && !options?.allowPoisoned) {
+            throw this.nativeDurableCommitFailure;
+        }
+        // A synchronous columnar write may already have scheduled its durable
+        // mirror. Let it settle before deleting queued CIDs, but leave any recorded
+        // error for drainDurable() to surface to its owning operation/stop.
+        await this.waitForTrackedDurableWrites();
+        await this.waitForNativeDeleteCleanup();
+        // A tracked mirror or the cleanup we just waited for may have poisoned the
+        // wrapper. Do not begin another durable mutation on the ordinary path after
+        // that asynchronous boundary. stop() alone opts into one cleanup retry so a
+        // transient delete failure can still release its tombstones and resources.
+        if (this.nativeDurableCommitFailure && !options?.allowPoisoned) {
+            throw this.nativeDurableCommitFailure;
+        }
+        if (this.pendingNativeDeleteCleanup.size === 0) {
+            return;
+        }
+        const cleanupEntries = [...this.pendingNativeDeleteCleanup].filter(([cid, generation]) => (this.nativeBlockWriteGenerations.get(cid) ?? 0) === generation);
+        if (cleanupEntries.length === 0) {
+            return;
+        }
+        const cids = cleanupEntries.map(([cid]) => cid);
+        let cleanupFailure;
+        const running = (async () => {
+            let durableRemoved = false;
+            let nativeRemoved = false;
+            try {
+                await this.durable.rmMany(cids);
+                durableRemoved = true;
+            }
+            catch (error) {
+                cleanupFailure = error;
+                // The new entry blocks are already durable at this point and the native
+                // transaction has selected the new graph/index state. Old content-addressed
+                // blocks are therefore harmless unreachable orphans. Keep this cleanup as
+                // retryable debt instead of poisoning/rolling back a fully durable append;
+                // a partial rmMany is safe for the same reason.
+                warn(`Failed durable native-trim cleanup; retaining retry debt: ${String(error)}`);
+            }
+            finally {
+                // A read that began in the native-transaction -> cleanup-hook gap may
+                // have repopulated native. Always repeat the native removal, even when
+                // durable rm failed. Exclude CIDs re-added while durable IO was pending;
+                // their generation change cancelled the queued delete.
+                const stillDeleted = cids.filter((cid) => this.pendingNativeDeleteCleanup.has(cid));
+                try {
+                    if (stillDeleted.length > 0) {
+                        await this.native.rmMany(stillDeleted);
+                    }
+                    nativeRemoved = true;
+                }
+                catch (error) {
+                    cleanupFailure ??= error;
+                    warn(`Failed to repeat native-trim hot block removal: ${String(error)}`);
+                }
+            }
+            if (durableRemoved && nativeRemoved) {
+                for (const [cid, generation] of cleanupEntries) {
+                    if (this.pendingNativeDeleteCleanup.get(cid) === generation) {
+                        this.pendingNativeDeleteCleanup.delete(cid);
+                        this.nativeBlockWriteGenerations.delete(cid);
+                        this.endNativeDelete([cid]);
+                    }
+                }
+            }
+        })();
+        this.nativeDeleteCleanupRunning = running;
+        try {
+            await running;
+        }
+        finally {
+            if (this.nativeDeleteCleanupRunning === running) {
+                this.nativeDeleteCleanupRunning = undefined;
+            }
+        }
+        if (options?.throwOnFailure && cleanupFailure !== undefined) {
+            throw cleanupFailure;
+        }
+    }
+    trackDurable(result, cids) {
         // The durable store may answer synchronously (an in-memory or already
         // resolved store); only a real pending promise needs tracking. A sync
         // success is already durable; a sync throw would have propagated already.
@@ -182,9 +492,22 @@ class NativeBackboneWriteThroughBlockStore {
             this.pendingDurableWrites.delete(tracked);
         }, (error) => {
             this.pendingDurableWrites.delete(tracked);
-            if (this.durableWriteError === undefined) {
-                this.durableWriteError = error;
-            }
+            this.recordNativeDurableCommitFailure(error, {
+                committedCids: cids,
+                failedCids: cids,
+            });
+        });
+        this.pendingDurableWrites.add(tracked);
+    }
+    // Awaited mirror writes surface their own rejection to the append that
+    // created them. Track a non-rejecting settlement companion as well so stop()
+    // and later wrapper operations cannot close/use durable storage while that
+    // append barrier is still in flight.
+    trackAwaitedDurable(result) {
+        const tracked = result.then(() => {
+            this.pendingDurableWrites.delete(tracked);
+        }, () => {
+            this.pendingDurableWrites.delete(tracked);
         });
         this.pendingDurableWrites.add(tracked);
     }
@@ -192,14 +515,8 @@ class NativeBackboneWriteThroughBlockStore {
     // the first failure. Awaited methods call this so a prior columnar durable
     // failure propagates as back-pressure to the next caller.
     async drainDurable() {
-        while (this.pendingDurableWrites.size > 0) {
-            await Promise.allSettled([...this.pendingDurableWrites]);
-        }
-        if (this.durableWriteError !== undefined) {
-            const error = this.durableWriteError;
-            this.durableWriteError = undefined;
-            throw error;
-        }
+        await this.waitForTrackedDurableWrites();
+        this.throwIfNativeDurableCommitFailed();
     }
     // --- lifecycle -------------------------------------------------------
     // The native store's lifecycle hooks are no-ops; only the durable store
@@ -213,12 +530,55 @@ class NativeBackboneWriteThroughBlockStore {
     // persisted coordinate + signer facts without resolving the entry block.
     async start() {
         await this.durable.start();
+        this.stopCompleted = false;
     }
     async stop() {
+        if (this.stopCompleted) {
+            return;
+        }
         // Surface any tracked (sync-path) durable write failure and ensure all
-        // mirror writes have settled before the durable store is torn down.
-        await this.drainDurable();
-        await this.durable.stop();
+        // mirror writes have settled before the durable store is torn down. Closing
+        // the durable store is unconditional: a prior columnar mirror failure must
+        // not leak the store lifecycle resource.
+        let firstError;
+        let shutdownError;
+        try {
+            await this.drainDurable();
+        }
+        catch (error) {
+            firstError = error;
+        }
+        // Tokens not consumed by EntryIndex belong to native prepares that never
+        // published their lower-log trim. Release their read tombstones, but never
+        // promote them to durable deletion during shutdown.
+        this.discardStagedNativeDeleteCleanups();
+        try {
+            await this.retryNativeDeleteCleanup({ allowPoisoned: true });
+        }
+        catch (error) {
+            firstError ??= error;
+            shutdownError ??= error;
+        }
+        try {
+            await this.durable.stop();
+        }
+        catch (error) {
+            firstError ??= error;
+            shutdownError ??= error;
+        }
+        if (shutdownError === undefined) {
+            // A durable poison belongs to the generation being closed. Report it once
+            // so the owning terminal call observes the failed append, but remember that
+            // every mandatory shutdown stage completed. Conservative content-addressed
+            // trim debt may remain in this retired wrapper after best-effort cleanup; a
+            // fresh generation gets a new wrapper and must not be wedged by that debt.
+            // The exact terminal retry may therefore finish parent bookkeeping without
+            // rethrowing the same latched poison forever.
+            this.stopCompleted = true;
+        }
+        if (firstError !== undefined) {
+            throw firstError;
+        }
     }
     status() {
         return this.durable.status();
@@ -226,6 +586,12 @@ class NativeBackboneWriteThroughBlockStore {
     waitFor() {
         return Promise.resolve([]);
     }
+    // Native commit APIs must keep their block-store callback synchronous. The
+    // lower log calls this barrier after that callback reports committed blocks
+    // and before publishing index/head facts.
+    waitForDurableWrites() {
+        return this.drainDurable();
+    }
     // Mirror a single already-committed block (present in the wasm map) to the
     // durable store ONLY. Used by the native commit-only append fast path: the
     // native prepare commits the entry block into the wasm map and returns no raw
@@ -233,11 +599,157 @@ class NativeBackboneWriteThroughBlockStore {
     // route the block through the log's finishBlocks/putKnown* (that would disturb
     // the commit-only append path the RCS optimization depends on). Instead the
     // caller reads the committed bytes back and calls this so the block lands in
-    // durable directly. Like putKnownManyColumns' durable mirror, the write is
-    // tracked (not fire-and-forget) so an IO/disk-full failure surfaces on the
-    // next awaited wrapper method / stop() rather than being swallowed.
-    mirrorToDurable(cid, bytes) {
-        this.trackDurable(this.durable.putKnown(cid, bytes));
+    // durable directly. The caller awaits this method before acknowledging its
+    // append, so a failed write rejects the append that produced the block.
+    async mirrorToDurable(cid, bytes, options) {
+        this.throwIfNativeDurableCommitFailed();
+        // The native commit happened before this call. Mark the CID live before
+        // awaiting anything so a concurrent retry of an older trim cannot remove
+        // the newly committed hot block.
+        let ownership;
+        if (options?.nativeTrimmed !== true) {
+            ownership = this.beginNativeCommitOwnership(this.noteNativeBlockWrite([cid]));
+            await this.waitForNativeDeleteCleanup();
+        }
+        try {
+            await this.drainDurable();
+            if (ownership) {
+                const existed = await this.durable.hasMany([...ownership.rows.keys()]);
+                let index = 0;
+                for (const row of ownership.rows.values()) {
+                    row.durableExistedBefore = existed[index++] === true;
+                }
+            }
+            const result = this.commitDurableMutation(() => this.durable.putKnown(cid, bytes), [cid]);
+            await result;
+            await this.retryNativeDeleteCleanup();
+            this.throwIfNativeDurableCommitFailed();
+            return ownership;
+        }
+        catch (error) {
+            // The caller never receives an ownership token for an indeterminate write.
+            // Release the in-memory claim and preserve any bytes the backend may have
+            // applied before rejecting.
+            this.releaseNativeCommitOwnership(ownership);
+            throw error;
+        }
+    }
+    async mirrorManyToDurable(blocks, options) {
+        this.throwIfNativeDurableCommitFailed();
+        const cids = blocks.map(([cid]) => cid);
+        // Rows trimmed later in the same native batch deliberately remain owned by
+        // that batch's staged cleanup; only mark surviving rows live.
+        const liveCids = cids.filter((cid) => !options?.nativeTrimmedCids?.has(cid));
+        const ownership = this.beginNativeCommitOwnership(this.noteNativeBlockWrite(liveCids));
+        if (liveCids.length > 0) {
+            await this.waitForNativeDeleteCleanup();
+        }
+        try {
+            await this.drainDurable();
+            if (ownership) {
+                const existed = await this.durable.hasMany([...ownership.rows.keys()]);
+                let index = 0;
+                for (const row of ownership.rows.values()) {
+                    row.durableExistedBefore = existed[index++] === true;
+                }
+            }
+            if (blocks.length > 0) {
+                await this.commitDurableMutation(() => this.durable.putKnownMany(blocks), cids);
+            }
+            await this.retryNativeDeleteCleanup();
+            this.throwIfNativeDurableCommitFailed();
+            return ownership;
+        }
+        catch (error) {
+            this.releaseNativeCommitOwnership(ownership);
+            throw error;
+        }
+    }
+    async rollbackFailedNativeCommits(cids, restoreNativeCids = [], ownershipToken) {
+        // This is the sole mutation allowed after poison: it removes a native
+        // transaction that the lower log never published. Do not route through the
+        // guarded rmMany path, and settle the failed mirror before compensating it.
+        await this.waitForTrackedDurableWrites();
+        // A failed replacement never published its trim. Reassert the restored CIDs
+        // as live before any compensation IO so staged/pending delete intents cannot
+        // remove the last acknowledged blocks during stop or reopen.
+        const ownership = ownershipToken && typeof ownershipToken === "object"
+            ? this.nativeCommitOwnerships.get(ownershipToken.id)
+            : undefined;
+        const verifiedOwnership = ownership && ownership === ownershipToken ? ownership : undefined;
+        const restoreSet = new Set(restoreNativeCids);
+        const safeDurableDeletes = verifiedOwnership
+            ? [...new Set(cids)].filter((cid) => {
+                const row = verifiedOwnership.rows.get(cid);
+                const owners = this.nativeCommitOwnershipsByCid.get(cid);
+                return (!restoreSet.has(cid) &&
+                    row?.durableExistedBefore === false &&
+                    row.shared === false &&
+                    (this.nativeBlockWriteGenerations.get(cid) ?? 0) ===
+                        row.generation &&
+                    owners?.size === 1 &&
+                    owners.has(verifiedOwnership.id));
+            })
+            : [];
+        this.noteNativeBlockWrite(restoreNativeCids);
+        let firstError;
+        try {
+            if (safeDurableDeletes.length > 0) {
+                await this.durable.rmMany(safeDurableDeletes);
+            }
+        }
+        catch (error) {
+            firstError = error;
+        }
+        // A native prepare runs before ownership can observe the hot map, so it cannot
+        // prove that a CID was absent there before this operation. Keep native bytes as
+        // unreachable orphans rather than deleting acknowledged/shared/restored data.
+        if (restoreNativeCids.length > 0) {
+            try {
+                const values = await this.durable.getMany(restoreNativeCids);
+                const restore = [];
+                for (let index = 0; index < restoreNativeCids.length; index++) {
+                    const value = values[index];
+                    if (value)
+                        restore.push([restoreNativeCids[index], value]);
+                }
+                if (restore.length > 0) {
+                    this.native.putKnownMany(restore);
+                }
+            }
+            catch (error) {
+                firstError ??= error;
+            }
+        }
+        this.releaseNativeCommitOwnership(ownershipToken);
+        if (firstError !== undefined)
+            throw firstError;
+    }
+    /**
+     * Compensate a native prepare that failed before its durable mirror began.
+     * Durable presence proves a same-CID acknowledged owner; an active ownership
+     * token proves a concurrent mirror. Only an unowned, non-durable hot block is
+     * exclusively attributable to the failed prepare and safe to remove.
+     */
+    async rollbackUnmirroredNativeCommits(cids, restoreNativeCids = []) {
+        const unique = [...new Set(cids)];
+        // Native prepares bypass this wrapper. Any observed wrapper generation is
+        // therefore evidence of a generic/same-CID writer, not of the failed prepare.
+        // Snapshot before the first await and require both absence and stability so a
+        // write starting before or during durable.hasMany cannot lose its hot value to
+        // a stale `false` result.
+        const genericWriteGenerations = new Map(unique.map((cid) => [cid, this.nativeBlockWriteGenerations.get(cid)]));
+        await this.rollbackFailedNativeCommits(cids, restoreNativeCids);
+        const durablePresence = await this.durable.hasMany(unique);
+        const restore = new Set(restoreNativeCids);
+        const safeNativeDeletes = unique.filter((cid, index) => !restore.has(cid) &&
+            durablePresence[index] !== true &&
+            genericWriteGenerations.get(cid) === undefined &&
+            this.nativeBlockWriteGenerations.get(cid) === undefined &&
+            (this.nativeCommitOwnershipsByCid.get(cid)?.size ?? 0) === 0);
+        if (safeNativeDeletes.length > 0) {
+            await this.native.rmMany(safeNativeDeletes);
+        }
     }
     // --- writes (apply to BOTH: native first for the hot path, then durable) ---
     async put(data) {
@@ -250,7 +762,13 @@ class NativeBackboneWriteThroughBlockStore {
         const value = data instanceof Uint8Array
             ? data
             : data.block.bytes;
-        await this.durable.putKnown(cid, value);
+        this.noteNativeBlockWrite([cid]);
+        await this.waitForNativeDeleteCleanup();
+        // put() may have yielded while calculating the CID. Restore the hot value
+        // after any older cleanup that was already in flight.
+        this.throwIfNativeDurableCommitFailed();
+        this.native.putKnown(cid, value);
+        await this.commitDurableMutation(() => this.durable.putKnown(cid, value), [cid]);
         return cid;
     }
     async putMany(blocks) {
@@ -263,7 +781,11 @@ class NativeBackboneWriteThroughBlockStore {
                 : block.block.bytes;
             return [cid, value];
         });
-        await this.durable.putKnownMany(durableBlocks);
+        this.noteNativeBlockWrite(cids);
+        await this.waitForNativeDeleteCleanup();
+        this.throwIfNativeDurableCommitFailed();
+        this.native.putKnownMany(durableBlocks);
+        await this.commitDurableMutation(() => this.durable.putKnownMany(durableBlocks), cids);
         return cids;
     }
     // Native put is synchronous (the authoritative hot store); the durable mirror
@@ -273,18 +795,30 @@ class NativeBackboneWriteThroughBlockStore {
     // both await this method, so returning a promise is compatible.
     async putKnown(cid, bytes) {
         await this.drainDurable();
+        await this.waitForNativeDeleteCleanup();
+        this.throwIfNativeDurableCommitFailed();
         const stored = this.native.putKnown(cid, bytes);
-        await this.durable.putKnown(cid, bytes);
+        this.noteNativeBlockWrite([cid]);
+        await this.commitDurableMutation(() => this.durable.putKnown(cid, bytes), [cid]);
         return stored;
     }
     async putKnownMany(blocks) {
         await this.drainDurable();
+        await this.waitForNativeDeleteCleanup();
+        this.throwIfNativeDurableCommitFailed();
         const cids = this.native.putKnownMany(blocks);
-        await this.durable.putKnownMany(blocks);
+        this.noteNativeBlockWrite(cids);
+        await this.commitDurableMutation(() => this.durable.putKnownMany(blocks), cids);
         return cids;
     }
     putKnownManyColumns(cids, bytes) {
+        this.throwIfNativeDurableCommitFailed();
+        if (cids.length !== bytes.length) {
+            throw new Error("Expected equal block column lengths");
+        }
+        const cleanupBarrier = this.nativeDeleteCleanupRunning;
         const stored = this.native.putKnownManyColumns(cids, bytes);
+        this.noteNativeBlockWrite(cids);
         // AnyBlockStore has no columnar method; mirror via putKnownMany, which
         // takes [cid, bytes] tuples and hits the same batched store path.
         // This method must return a synchronous string[] (RemoteBlocks.putKnownManyColumns
@@ -292,7 +826,19 @@ class NativeBackboneWriteThroughBlockStore {
         // inline. Track it instead of `void`ing it so a durable rejection surfaces
         // on the next awaited wrapper method / stop() rather than being swallowed.
         const durableBlocks = cids.map((cid, index) => [cid, bytes[index]]);
-        this.trackDurable(this.durable.putKnownMany(durableBlocks));
+        let durableResult;
+        try {
+            durableResult = cleanupBarrier
+                ? cleanupBarrier.then(() => this.durable.putKnownMany(durableBlocks))
+                : this.durable.putKnownMany(durableBlocks);
+        }
+        catch (error) {
+            throw this.recordNativeDurableCommitFailure(error, {
+                committedCids: cids,
+                failedCids: cids,
+            });
+        }
+        this.trackDurable(durableResult, cids);
         return stored;
     }
     // --- reads (native/wasm first; on miss, durable fallback + repopulate) ---
@@ -302,11 +848,28 @@ class NativeBackboneWriteThroughBlockStore {
     // avoids a spurious miss (which would otherwise fall through to a remote
     // read) for a block that is present on disk.
     async get(cid, _options) {
+        if (this.nativeDurableCommitFailure) {
+            // After poison, durable storage is the last acknowledged authority. Do not
+            // repopulate or otherwise mutate the native store until reopen.
+            return this.isNativeDeletePending(cid)
+                ? undefined
+                : this.durable.get(cid);
+        }
+        const deleteEpoch = this.nativeDeleteEpoch;
+        if (this.isNativeDeletePending(cid)) {
+            return undefined;
+        }
         const local = this.native.get(cid);
         if (local != null) {
-            return local;
+            return deleteEpoch === this.nativeDeleteEpoch ? local : this.get(cid);
         }
         const durableValue = await this.durable.get(cid);
+        if (this.nativeDurableCommitFailure) {
+            return this.isNativeDeletePending(cid) ? undefined : durableValue;
+        }
+        if (deleteEpoch !== this.nativeDeleteEpoch) {
+            return this.get(cid);
+        }
         if (durableValue != null) {
             // Repopulate the native map so the native graph reads it next time.
             this.native.putKnownManyColumns([cid], [durableValue]);
@@ -315,25 +878,52 @@ class NativeBackboneWriteThroughBlockStore {
         return undefined;
     }
     async getMany(cids) {
+        if (this.nativeDurableCommitFailure) {
+            const values = await this.durable.getMany(cids);
+            for (let index = 0; index < cids.length; index++) {
+                if (this.isNativeDeletePending(cids[index])) {
+                    values[index] = undefined;
+                }
+            }
+            return values;
+        }
+        const deleteEpoch = this.nativeDeleteEpoch;
         const results = await this.native.getMany(cids);
+        if (deleteEpoch !== this.nativeDeleteEpoch) {
+            return this.getMany(cids);
+        }
         const missing = [];
+        const missingIndexes = [];
         for (let i = 0; i < results.length; i++) {
-            if (results[i] == null) {
+            if (this.isNativeDeletePending(cids[i])) {
+                results[i] = undefined;
+            }
+            else if (results[i] == null) {
                 missing.push(cids[i]);
+                missingIndexes.push(i);
             }
         }
         if (missing.length === 0) {
             return results;
         }
         const durableValues = await this.durable.getMany(missing);
+        if (this.nativeDurableCommitFailure) {
+            const values = await this.durable.getMany(cids);
+            for (let index = 0; index < cids.length; index++) {
+                if (this.isNativeDeletePending(cids[index])) {
+                    values[index] = undefined;
+                }
+            }
+            return values;
+        }
+        if (deleteEpoch !== this.nativeDeleteEpoch) {
+            return this.getMany(cids);
+        }
         const repopulateCids = [];
         const repopulateBytes = [];
-        let missingIndex = 0;
-        for (let i = 0; i < results.length; i++) {
-            if (results[i] != null) {
-                continue;
-            }
-            const value = durableValues[missingIndex++];
+        for (let missingIndex = 0; missingIndex < missingIndexes.length; missingIndex++) {
+            const i = missingIndexes[missingIndex];
+            const value = durableValues[missingIndex];
             if (value != null) {
                 results[i] = value;
                 repopulateCids.push(cids[i]);
@@ -347,8 +937,15 @@ class NativeBackboneWriteThroughBlockStore {
         return results;
     }
     async has(cid) {
+        if (this.nativeDurableCommitFailure) {
+            return this.isNativeDeletePending(cid) ? false : this.durable.has(cid);
+        }
+        const deleteEpoch = this.nativeDeleteEpoch;
+        if (this.isNativeDeletePending(cid)) {
+            return false;
+        }
         if (this.native.has(cid)) {
-            return true;
+            return deleteEpoch === this.nativeDeleteEpoch ? true : this.has(cid);
         }
         // Mirror getMany/hasMany: a block absent from the native wasm map may still
         // be present in the durable store (e.g. persisted on disk but not yet
@@ -356,25 +953,44 @@ class NativeBackboneWriteThroughBlockStore {
         // checks agree with the resolves that getMany/hasMany already durable-fall
         // back on. `Blocks.has` is declared `MaybePromise<boolean>`, so returning a
         // promise here is contract-compatible.
-        return this.durable.has(cid);
+        const durableHas = await this.durable.has(cid);
+        return deleteEpoch === this.nativeDeleteEpoch ? durableHas : this.has(cid);
     }
     async hasMany(cids) {
+        if (this.nativeDurableCommitFailure) {
+            const values = await this.durable.hasMany(cids);
+            for (let index = 0; index < cids.length; index++) {
+                if (this.isNativeDeletePending(cids[index])) {
+                    values[index] = false;
+                }
+            }
+            return values;
+        }
+        const deleteEpoch = this.nativeDeleteEpoch;
         const nativeHas = await this.native.hasMany(cids);
+        if (deleteEpoch !== this.nativeDeleteEpoch) {
+            return this.hasMany(cids);
+        }
         const missing = [];
+        const missingIndexes = [];
         for (let i = 0; i < nativeHas.length; i++) {
-            if (!nativeHas[i]) {
+            if (this.isNativeDeletePending(cids[i])) {
+                nativeHas[i] = false;
+            }
+            else if (!nativeHas[i]) {
                 missing.push(cids[i]);
+                missingIndexes.push(i);
             }
         }
         if (missing.length === 0) {
             return nativeHas;
         }
         const durableHas = await this.durable.hasMany(missing);
-        let missingIndex = 0;
-        for (let i = 0; i < nativeHas.length; i++) {
-            if (!nativeHas[i]) {
-                nativeHas[i] = durableHas[missingIndex++];
-            }
+        if (deleteEpoch !== this.nativeDeleteEpoch) {
+            return this.hasMany(cids);
+        }
+        for (let missingIndex = 0; missingIndex < missingIndexes.length; missingIndex++) {
+            nativeHas[missingIndexes[missingIndex]] = durableHas[missingIndex];
         }
         return nativeHas;
     }
@@ -383,25 +999,128 @@ class NativeBackboneWriteThroughBlockStore {
     // resolves only after both succeed and a durable failure rejects here rather
     // than being swallowed. All rm callers (RemoteBlocks.rm, the log) await it.
     async rm(cid) {
-        await this.drainDurable();
-        this.native.rm(cid);
-        await this.durable.rm(cid);
+        this.throwIfNativeDurableCommitFailed();
+        const writeGeneration = this.nativeBlockWriteGenerations.get(cid);
+        this.beginNativeDelete([cid]);
+        try {
+            await this.drainDurable();
+            this.native.rm(cid);
+            await this.commitDurableMutation(() => this.durable.rm(cid), [cid]);
+            // A durable read that began before the tombstone may have repopulated
+            // native while durable rm was pending. Remove it idempotently again.
+            this.native.rm(cid);
+            if (this.nativeBlockWriteGenerations.get(cid) === writeGeneration &&
+                !this.pendingNativeDeleteCleanup.has(cid)) {
+                this.nativeBlockWriteGenerations.delete(cid);
+            }
+        }
+        finally {
+            this.endNativeDelete([cid]);
+        }
     }
     del(cid) {
-        void this.rm(cid);
+        return this.rm(cid);
     }
     async rmMany(cids) {
-        await this.drainDurable();
-        const removed = await this.native.rmMany(cids);
-        await this.durable.rmMany(cids);
-        return removed;
+        this.throwIfNativeDurableCommitFailed();
+        const writeGenerations = new Map(cids.map((cid) => [cid, this.nativeBlockWriteGenerations.get(cid)]));
+        this.beginNativeDelete(cids);
+        try {
+            await this.drainDurable();
+            const removed = await this.native.rmMany(cids);
+            await this.commitDurableMutation(() => this.durable.rmMany(cids), cids);
+            await this.native.rmMany(cids);
+            for (const cid of cids) {
+                if (this.nativeBlockWriteGenerations.get(cid) ===
+                    writeGenerations.get(cid) &&
+                    !this.pendingNativeDeleteCleanup.has(cid)) {
+                    this.nativeBlockWriteGenerations.delete(cid);
+                }
+            }
+            return removed;
+        }
+        finally {
+            this.endNativeDelete(cids);
+        }
+    }
+    // Native trim may already have removed the hot wasm blocks. Queue the durable
+    // copy for cleanup, retaining read tombstones until removal succeeds; a
+    // cleanup failure is retried and never fed into ordinary append rollback.
+    // EntryIndex feature-detects this hook.
+    async rmManyAfterNativeDelete(cids, cleanupToken) {
+        if (this.nativeDurableCommitFailure) {
+            this.cancelNativeDeleteCleanup(cleanupToken);
+            throw this.nativeDurableCommitFailure;
+        }
+        let preannounced = false;
+        if (typeof cleanupToken === "number") {
+            const staged = this.stagedNativeDeleteCleanups.get(cleanupToken);
+            if (staged) {
+                preannounced = true;
+                this.stagedNativeDeleteCleanups.delete(cleanupToken);
+                for (const [cid, generation] of staged) {
+                    if ((this.nativeBlockWriteGenerations.get(cid) ?? 0) !== generation) {
+                        this.endNativeDelete([cid]);
+                        continue;
+                    }
+                    if (this.pendingNativeDeleteCleanup.has(cid)) {
+                        // Another delete already owns a tombstone for this CID.
+                        this.endNativeDelete([cid]);
+                    }
+                    else {
+                        // Transfer the staged tombstone to the now-published cleanup.
+                        this.pendingNativeDeleteCleanup.set(cid, generation);
+                    }
+                }
+            }
+        }
+        if (!preannounced) {
+            this.enqueueNativeDeleteCleanup(cids);
+        }
+        await this.retryNativeDeleteCleanup();
+    }
+    /** Finish committed trim GC before its durable recovery intent is retired. */
+    async completeCommittedNativeDeleteCleanup(cids, options) {
+        this.throwIfNativeDurableCommitFailed();
+        const uniqueCids = [...new Set(cids.filter(Boolean))];
+        if (uniqueCids.length === 0) {
+            return;
+        }
+        // Only restart recovery reconstructs missing debt. On the live path, an
+        // absent row may mean the CID was legitimately re-added after its original
+        // generation-owned trim completed or was cancelled; re-enqueueing it here
+        // would capture the new generation and delete live content.
+        if (options?.reconstructMissing) {
+            this.enqueueNativeDeleteCleanup(uniqueCids);
+        }
+        if (!uniqueCids.some((cid) => this.pendingNativeDeleteCleanup.has(cid))) {
+            return;
+        }
+        await this.retryNativeDeleteCleanup({ throwOnFailure: true });
+        const remaining = uniqueCids.filter((cid) => this.pendingNativeDeleteCleanup.has(cid));
+        if (remaining.length > 0) {
+            throw new Error(`Committed native trim cleanup remains incomplete: ${remaining.join(", ")}`);
+        }
     }
     // --- misc ------------------------------------------------------------
     async *iterator() {
+        if (this.nativeDurableCommitFailure) {
+            for await (const block of this.durable.iterator()) {
+                if (!this.isNativeDeletePending(block[0])) {
+                    yield block;
+                }
+            }
+            return;
+        }
         yield* this.native.iterator();
     }
-    size() {
-        return this.native.size();
+    async size() {
+        // The hot wasm map is intentionally cold after reopen, so it cannot be the
+        // storage-budget authority. Settle synchronous columnar mirrors first, then
+        // report durable bytes; pending trim cleanup remains conservatively counted
+        // until its durable deletion succeeds.
+        await this.drainDurable();
+        return this.durable.size();
     }
     persisted() {
         // The blocks are now mirrored to a durable store, so report persisted so
@@ -473,6 +1192,29 @@ const canConfirmNativeRequestPruneBatch = (hints, hashCount) => {
     }
     return true;
 };
+const NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_FILE = "strict-durable-transaction-intent.json";
+const NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_BACKUP_FILE = "strict-durable-transaction-intent.backup.json";
+const NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_FILES = [
+    NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_FILE,
+    NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_BACKUP_FILE,
+];
+const NATIVE_STRICT_DURABLE_TRANSACTION_JOURNAL_FORMAT = "peerbit-native-strict-durable-transaction";
+const nativeStrictDurableTransactionJournalBody = (sequence, intent) => ({
+    format: NATIVE_STRICT_DURABLE_TRANSACTION_JOURNAL_FORMAT,
+    version: 1,
+    sequence,
+    state: intent ? "intent" : "cleared",
+    intent: intent ?? null,
+});
+const nativeStrictDurableTransactionJournalBodyBytes = (body) => new TextEncoder().encode(JSON.stringify(body));
+const nativeStrictDurableTransactionJournalRecordBytes = (sequence, intent) => {
+    const body = nativeStrictDurableTransactionJournalBody(sequence, intent);
+    const record = {
+        ...body,
+        checksum: toHexString(sha256Sync(nativeStrictDurableTransactionJournalBodyBytes(body))),
+    };
+    return new TextEncoder().encode(JSON.stringify(record));
+};
 const getLatestEntry = (entries) => {
     let latest = undefined;
     for (const element of entries) {
@@ -602,6 +1344,43 @@ const isNotStartedError = (e) => {
     }
     return false;
 };
+/**
+ * Replication announcements are best-effort convergence messages. A detached
+ * fanout shard can time out even though the shared log itself remains open.
+ * Keep retries deliberately limited to concrete TimeoutErrors: abort/close and
+ * unexpected programming/data errors must retain their existing semantics.
+ *
+ * Exact constructor/name checks complement `instanceof` for errors crossing
+ * worker or duplicate-package boundaries in browsers.
+ */
+const isTransientReplicationAnnouncementError = (error, seen = new Set()) => {
+    if (error != null &&
+        (typeof error === "object" || typeof error === "function")) {
+        if (seen.has(error)) {
+            return false;
+        }
+        seen.add(error);
+    }
+    if (error instanceof TimeoutError) {
+        return true;
+    }
+    const nested = error?.errors;
+    if (Array.isArray(nested) && nested.length > 0) {
+        return nested.every((item) => isTransientReplicationAnnouncementError(item, new Set(seen)));
+    }
+    const cause = error?.cause;
+    if (cause != null && isTransientReplicationAnnouncementError(cause, seen)) {
+        return true;
+    }
+    const constructorName = typeof error?.constructor
+        ?.name === "string"
+        ? error.constructor.name
+        : "";
+    const name = typeof error?.name === "string"
+        ? error.name
+        : "";
+    return constructorName === "TimeoutError" || name === "TimeoutError";
+};
 const EMPTY_HASHES = [];
 const normalizedHashValues = (hashes) => {
     if (Array.isArray(hashes)) {
@@ -698,6 +1477,7 @@ const CHECKED_PRUNE_RETRY_MAX_ATTEMPTS = 3;
 const CHECKED_PRUNE_RETRY_MAX_DELAY_MS = 30_000;
 // DONT SET THIS ANY LOWER, because it will make the pid controller unstable as the system responses are not fast enough to updates from the pid controller
 const RECALCULATE_PARTICIPATION_DEBOUNCE_INTERVAL = 1000;
+const REPLICATION_ANNOUNCEMENT_RETRY_INTERVAL = 1000;
 const RECALCULATE_PARTICIPATION_MIN_RELATIVE_CHANGE = 0.01;
 const RECALCULATE_PARTICIPATION_MIN_RELATIVE_CHANGE_WITH_CPU_LIMIT = 0.005;
 const RECALCULATE_PARTICIPATION_MIN_RELATIVE_CHANGE_WITH_MEMORY_LIMIT = 0.001;
@@ -876,11 +1656,23 @@ let SharedLog = (() => {
         _nativeRangePlanner;
         _nativeSharedLogState;
         _nativeBackbone;
+        _nativeDurableCommitFailure;
+        _nativeDurableRecoveryReadyForReopen = false;
+        _nativeDurableRecoveryCids = new Set();
         _wireSyncSession;
         _nativeBackboneCoordinatePersistence;
+        _nativeBackboneCoordinatePersistenceStore;
+        _nativeBackboneDropStarted = false;
         _nativeBackboneCoordinateJournalLastFlushMs = 0;
+        _nativeStrictDurableTransactionTail;
+        _nativeStrictDurableTransactions;
+        _nativeStrictDurableTransactionJournalState;
+        _nativeStrictDurableDocumentRecoveryDeferred = false;
+        _nativeStrictDurableTransactionsClosing = false;
+        _nativeStrictDurableTransactionFailure;
         _defaultAppendReplicaMetadataCache;
         _residentEntryCoordinatesByHash;
+        _nativeCoordinateMutationGenerations;
         coordinateToHash;
         recentlyRebalanced;
         uniqueReplicators;
@@ -923,77 +1715,816 @@ let SharedLog = (() => {
         _replicatorLivenessFailures;
         _replicatorLastActivityAt;
         remoteBlocks;
-        openTime;
-        oldestOpenTime;
-        keep;
-        // A fn that we can call many times that recalculates the participation role
-        rebalanceParticipationDebounced;
-        // A fn for debouncing the calls for pruning
-        pruneDebouncedFn;
-        responseToPruneDebouncedFn;
-        get _requestIPruneSent() {
-            return this._checkedPrune.requestIPruneSent;
+        throwIfNativeDurableCommitFailed() {
+            if (this._nativeStrictDurableTransactionFailure !== undefined) {
+                throw new Error("Native durable transaction recovery is required before another mutation", { cause: this._nativeStrictDurableTransactionFailure });
+            }
+            const wrapperFailure = this.remoteBlocks?.localStore?.getNativeDurableCommitFailure?.();
+            if (wrapperFailure) {
+                this._nativeDurableCommitFailure ??= wrapperFailure;
+            }
+            if (this._nativeDurableCommitFailure) {
+                throw this._nativeDurableCommitFailure;
+            }
         }
-        get _requestIPruneResponseReplicatorSet() {
-            return this._checkedPrune.responseReplicatorSet;
+        poisonNativeStrictDurableTransaction(cause) {
+            this._nativeStrictDurableTransactionFailure ??= cause;
+            this.log?.entryIndex?.poisonNativeDurableTransactionMutations(this._nativeStrictDurableTransactionFailure);
         }
-        get _checkedPruneRetries() {
-            return this._checkedPrune.retries;
+        clearNativeStrictDurableTransactionFailure() {
+            this._nativeStrictDurableTransactionFailure = undefined;
+            this.log?.entryIndex?.clearNativeDurableTransactionMutationFailure();
         }
-        replicationChangeDebounceFn;
-        _repairRetryTimers;
-        _recentRepairDispatch;
-        _repairSweepRunning;
-        _repairSweepPendingModes;
-        _repairSweepPendingPeersByMode;
-        _repairFrontierByMode;
-        _repairFrontierActiveTargetsByMode;
-        _repairFrontierBypassKnownPeersByMode;
-        _repairSweepOptimisticGidPeersPending;
-        _entryKnownPeers;
-        _entryKnownPeerObservedAt;
-        _joinAuthoritativeRepairTimersByDelay;
-        _joinAuthoritativeRepairPeersByDelay;
-        _assumeSyncedRepairSuppressedUntil;
-        _appendBackfillTimer;
-        _appendBackfillPendingByTarget;
-        _repairMetrics;
-        _topicSubscribersCache;
-        _leaderSelectionContextCache;
-        // Sync capability bits advertised by peers (SyncCapabilitiesMessage), keyed
-        // by public key hash. Entries are dropped on unsubscribe/disconnect.
-        _peerSyncCapabilities;
-        // Pending live raw exchange-head gossip, coalesced per recipient set and
-        // flushed at the end of the current event-loop turn (or when a batch cap
-        // is hit). Only used when every recipient advertised raw capability.
-        _liveRawGossipBatches;
-        _liveRawGossipFlushScheduled;
-        // regular distribution checks
-        distributeQueue;
-        syncronizer;
-        replicas;
-        cpuUsage;
-        _lastLocalAppendAt;
-        adaptiveRebalanceIdleMs;
-        timeUntilRoleMaturity;
-        waitForReplicatorTimeout;
-        waitForReplicatorRequestIntervalMs;
-        waitForReplicatorRequestMaxAttempts;
-        waitForPruneDelay;
-        distributionDebounceTime;
-        repairSweepTargetBufferSize;
-        replicationController;
-        history;
-        domain;
-        indexableDomain;
-        interval;
-        constructor(properties) {
-            super();
-            this.log = new Log(properties);
-            this.rpc = new RPC();
-            this._checkedPrune = new CheckedPruneCoordinator();
-            this._pendingIHave = new Map();
-            this.latestReplicationInfoMessage = new Map();
+        failNativeDurableCommit(cause, options) {
+            this.ensureNativeDurabilityRuntimeState();
+            for (const cid of options?.committedCids ?? []) {
+                this._nativeDurableRecoveryCids.add(cid);
+            }
+            if (cause instanceof NativeDurableCommitError) {
+                cause.addCommitContext(options, { preferIncomingOrder: true });
+            }
+            this._nativeDurableCommitFailure ??=
+                cause instanceof NativeDurableCommitError
+                    ? cause
+                    : new NativeDurableCommitError(cause, options);
+            this._nativeDurableCommitFailure.addCommitContext(options, {
+                preferIncomingOrder: true,
+            });
+            throw this._nativeDurableCommitFailure;
+        }
+        snapshotNativeBackboneDocument(input) {
+            const backbone = this._nativeBackbone;
+            if (!backbone || !input)
+                return undefined;
+            const value = backbone.documentValueBytes(input.key);
+            return {
+                key: input.key,
+                value: value ? new Uint8Array(value) : undefined,
+                byteElementIndexLimit: input.byteElementIndexLimit ?? 0,
+            };
+        }
+        restoreNativeBackboneDocument(rollback) {
+            const backbone = this._nativeBackbone;
+            if (!backbone)
+                return;
+            backbone.deleteDocument(rollback.key);
+            if (rollback.value) {
+                // documentValueBytes returns the complete stored encoding, so it can be
+                // restored as one prefix with an empty suffix.
+                backbone.putDocumentEncodedPartsStored(rollback.key, rollback.value, new Uint8Array(), rollback.byteElementIndexLimit);
+            }
+        }
+        parseNativeStrictDurableTransactionJournalRecord(bytes, slot) {
+            if (bytes === undefined) {
+                return undefined;
+            }
+            // The pre-journal implementation represented a cleared intent as an empty
+            // primary file. Treat it as generation zero so the first framed update is
+            // written to the other slot and can never destroy the only valid state.
+            if (bytes.byteLength === 0) {
+                return { sequence: 0, slot };
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(new TextDecoder().decode(bytes));
+            }
+            catch (error) {
+                throw new Error("Invalid native durable transaction journal JSON", {
+                    cause: error,
+                });
+            }
+            if (!parsed || typeof parsed !== "object") {
+                throw new Error("Invalid native durable transaction journal record");
+            }
+            const candidate = parsed;
+            if (candidate.format === NATIVE_STRICT_DURABLE_TRANSACTION_JOURNAL_FORMAT) {
+                if (candidate.version !== 1 ||
+                    !Number.isSafeInteger(candidate.sequence) ||
+                    (candidate.sequence ?? -1) < 1 ||
+                    (candidate.state !== "intent" && candidate.state !== "cleared") ||
+                    typeof candidate.checksum !== "string") {
+                    throw new Error("Invalid native durable transaction journal frame");
+                }
+                const intent = candidate.intent ?? null;
+                if ((candidate.state === "intent" && intent?.version !== 1) ||
+                    (candidate.state === "cleared" && intent !== null)) {
+                    throw new Error("Invalid native durable transaction journal state");
+                }
+                const body = nativeStrictDurableTransactionJournalBody(candidate.sequence, intent ?? undefined);
+                const checksum = toHexString(sha256Sync(nativeStrictDurableTransactionJournalBodyBytes(body)));
+                if (checksum !== candidate.checksum) {
+                    throw new Error("Native durable transaction journal checksum mismatch");
+                }
+                return {
+                    sequence: candidate.sequence,
+                    slot,
+                    intent: intent ?? undefined,
+                };
+            }
+            // Backward compatibility with the original single raw-JSON intent. A
+            // framed generation always sorts after this synthetic generation zero.
+            const legacy = parsed;
+            if (legacy.version !== 1) {
+                throw new Error("Unsupported native durable transaction recovery intent");
+            }
+            return {
+                sequence: 0,
+                slot,
+                intent: legacy,
+            };
+        }
+        async loadNativeStrictDurableTransactionJournalState() {
+            if (this._nativeStrictDurableTransactionJournalState) {
+                return this._nativeStrictDurableTransactionJournalState;
+            }
+            const store = this._nativeBackboneCoordinatePersistenceStore;
+            if (!store) {
+                return (this._nativeStrictDurableTransactionJournalState = {
+                    sequence: 0,
+                    slot: 0,
+                });
+            }
+            const bytes = await Promise.all(NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_FILES.map((name) => store.read(name)));
+            const valid = [];
+            const errors = [];
+            for (let index = 0; index < bytes.length; index++) {
+                try {
+                    const state = this.parseNativeStrictDurableTransactionJournalRecord(bytes[index], index);
+                    if (state)
+                        valid.push(state);
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+            }
+            if (valid.length === 0) {
+                if (errors.length > 0) {
+                    throw new AggregateError(errors, "No valid native durable transaction journal generation remains");
+                }
+                // A completely new store has an implicit cleared generation. Before the
+                // first intent is written we materialize this baseline in one slot, so a
+                // corrupt sole slot can never be confused with a safe first-write tear (or
+                // with a torn legacy single-file intent).
+                return (this._nativeStrictDurableTransactionJournalState = {
+                    sequence: 0,
+                    slot: 0,
+                    implicit: true,
+                });
+            }
+            valid.sort((left, right) => left.sequence - right.sequence || left.slot - right.slot);
+            return (this._nativeStrictDurableTransactionJournalState = valid.at(-1));
+        }
+        async writeNativeStrictDurableTransactionIntent(intent) {
+            const store = this._nativeBackboneCoordinatePersistenceStore;
+            if (!store) {
+                return;
+            }
+            let previous = await this.loadNativeStrictDurableTransactionJournalState();
+            if (previous.implicit) {
+                const baselineSequence = previous.sequence + 1;
+                const baselineSlot = (previous.slot === 0 ? 1 : 0);
+                const baselineFile = NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_FILES[baselineSlot];
+                await store.write(baselineFile, nativeStrictDurableTransactionJournalRecordBytes(baselineSequence, undefined));
+                await this.barrierNativeStrictDurableStore(store, baselineFile);
+                previous = {
+                    sequence: baselineSequence,
+                    slot: baselineSlot,
+                };
+                this._nativeStrictDurableTransactionJournalState = previous;
+            }
+            const sequence = previous.sequence + 1;
+            const slot = (previous.slot === 0 ? 1 : 0);
+            const bytes = nativeStrictDurableTransactionJournalRecordBytes(sequence, intent);
+            const file = NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_FILES[slot];
+            // Alternate slots. If this write is interrupted or torn, the previous
+            // checksummed generation remains untouched and recovery ignores the invalid
+            // newer slot. A durable shared-log generation requires an explicit physical
+            // barrier before this generation can become recovery-authoritative.
+            await store.write(file, bytes);
+            await this.barrierNativeStrictDurableStore(store, file);
+            this._nativeStrictDurableTransactionJournalState = {
+                sequence,
+                slot,
+                intent,
+            };
+        }
+        async barrierNativeStrictDurableStore(store, file) {
+            if (this.node.directory != null) {
+                if (typeof store.durableBarrier !== "function") {
+                    throw new Error("Durable native coordinate persistence does not expose a physical durability barrier");
+                }
+                await store.durableBarrier(file);
+                return;
+            }
+            // Memory-only operation has no durable lower marker. Preserve compatibility
+            // for transient adapters while still using a real barrier when they expose it.
+            if (store.durableBarrier) {
+                await store.durableBarrier(file);
+            }
+            else {
+                await store.flush?.(file);
+            }
+        }
+        async beginNativeStrictDurableTransaction(documents) {
+            this.throwIfNativeDurableCommitFailed();
+            if (this._nativeStrictDurableTransactionsClosing) {
+                throw new Error("Shared log is closing");
+            }
+            const previous = this._nativeStrictDurableTransactionTail ?? Promise.resolve();
+            let release;
+            const held = new Promise((resolve) => {
+                release = resolve;
+            });
+            this._nativeStrictDurableTransactionTail = previous.then(() => held);
+            await previous;
+            try {
+                this.throwIfNativeDurableCommitFailed();
+                if (this._nativeStrictDurableTransactionsClosing) {
+                    throw new Error("Shared log is closing");
+                }
+            }
+            catch (error) {
+                release();
+                throw error;
+            }
+            const handle = {
+                intent: {
+                    version: 1,
+                    lowerMarkerCommitted: false,
+                    appendHashes: [],
+                    trimHashes: [],
+                    coordinateDeleteHashes: [],
+                    lowerIndexRows: [],
+                    coordinates: [],
+                    documents: documents.map((document) => ({
+                        key: document.key,
+                        value: document.value ? [...document.value] : undefined,
+                        byteElementIndexLimit: document.byteElementIndexLimit,
+                    })),
+                },
+                release,
+                released: false,
+            };
+            (this._nativeStrictDurableTransactions ??= new Set()).add(handle);
+            try {
+                await this.writeNativeStrictDurableTransactionIntent(handle.intent);
+                return handle;
+            }
+            catch (error) {
+                handle.released = true;
+                this._nativeStrictDurableTransactions.delete(handle);
+                handle.release();
+                throw error;
+            }
+        }
+        async setNativeStrictDurableTransactionOperation(handle, appendHashes, trimHashes, coordinateRollback, coordinateDeleteHashes = []) {
+            if (!handle) {
+                return;
+            }
+            handle.intent.appendHashes = [...new Set(appendHashes.filter(Boolean))];
+            handle.intent.trimHashes = [...new Set(trimHashes.filter(Boolean))];
+            handle.intent.coordinateDeleteHashes = [
+                ...new Set(coordinateDeleteHashes.filter(Boolean)),
+            ];
+            const lowerHashes = [
+                ...new Set([
+                    ...handle.intent.appendHashes,
+                    ...handle.intent.trimHashes,
+                    ...(coordinateRollback?.hashes ?? []),
+                    ...handle.intent.coordinateDeleteHashes,
+                ]),
+            ];
+            if (handle.lowerHashMutationLockOwner) {
+                throw new Error("Native durable transaction operation is already locked");
+            }
+            // This lease is shared with the lower native transaction and every ordinary
+            // EntryIndex mutation. Acquire it before reading any before-image, then hold
+            // it through marker acknowledgement or exact compensation.
+            handle.lowerHashMutationLockOwner =
+                await this.log.entryIndex.acquireHashMutationLocks(lowerHashes);
+            handle.intent.lowerIndexRows = await Promise.all(lowerHashes.map(async (hash) => {
+                // EntryIndex publication may still live only in its pending generation.
+                // Snapshot the exact logical row that the marker phase will consume,
+                // rather than only the durable index, so a pre-marker crash can restore a
+                // pending external-next head instead of treating it as previously absent.
+                const previous = (await this.log.entryIndex.getShallow(hash))?.value;
+                return {
+                    hash,
+                    before: previous ? [...serialize(previous)] : undefined,
+                };
+            }));
+            handle.intent.coordinates = coordinateRollback
+                ? [...coordinateRollback.hashes].map((hash) => {
+                    const previous = coordinateRollback.entries.get(hash);
+                    if (!previous) {
+                        return { hash };
+                    }
+                    const materialized = this.materializeResidentCoordinateEntry(previous);
+                    return {
+                        hash,
+                        value: {
+                            hashNumber: materialized.hashNumber.toString(),
+                            gid: materialized.gid,
+                            coordinates: materialized.coordinates.map((value) => value.toString()),
+                            wallTime: materialized.wallTime.toString(),
+                            assignedToRangeBoundary: materialized.assignedToRangeBoundary,
+                            metaBytes: [...materialized.getMetaBytes()],
+                        },
+                    };
+                })
+                : [];
+            await this.writeNativeStrictDurableTransactionIntent(handle.intent);
+        }
+        async setNativeStrictDurableTransactionExpectedRows(handle, rows) {
+            if (!handle) {
+                return;
+            }
+            if (!handle.lowerHashMutationLockOwner) {
+                throw new Error("Native durable transaction has no lower hash lock owner");
+            }
+            this.log.entryIndex.assertHashMutationLocks(handle.lowerHashMutationLockOwner, rows.flatMap((row) => [row.hash, ...row.meta.next]));
+            const rowsByHash = new Map(handle.intent.lowerIndexRows.map((row) => [row.hash, row]));
+            for (const row of rows) {
+                const intentRow = rowsByHash.get(row.hash);
+                if (intentRow) {
+                    intentRow.after = [...serialize(row)];
+                }
+            }
+            for (const nextHash of new Set(rows.flatMap((row) => row.meta.next))) {
+                const existingIntentRow = rowsByHash.get(nextHash);
+                if (existingIntentRow) {
+                    if (!existingIntentRow.after && existingIntentRow.before) {
+                        const after = deserialize(Uint8Array.from(existingIntentRow.before), ShallowEntry);
+                        after.head = false;
+                        existingIntentRow.after = [...serialize(after)];
+                    }
+                    continue;
+                }
+                const previous = (await this.log.entryIndex.getShallow(nextHash))?.value;
+                if (!previous) {
+                    continue;
+                }
+                const after = deserialize(serialize(previous), ShallowEntry);
+                after.head = false;
+                const intentRow = {
+                    hash: nextHash,
+                    before: [...serialize(previous)],
+                    after: [...serialize(after)],
+                };
+                handle.intent.lowerIndexRows.push(intentRow);
+                rowsByHash.set(nextHash, intentRow);
+            }
+            handle.intent.coordinateDeleteHashes = [
+                ...new Set([
+                    ...(handle.intent.coordinateDeleteHashes ?? []),
+                    ...handle.intent.trimHashes,
+                    ...rows.flatMap((row) => row.meta.next),
+                ]),
+            ];
+            await this.writeNativeStrictDurableTransactionIntent(handle.intent);
+        }
+        async markNativeStrictDurableTransactionLowerMarker(handle) {
+            if (!handle || handle.released) {
+                return;
+            }
+            handle.intent.lowerMarkerCommitted = true;
+            await this.writeNativeStrictDurableTransactionIntent(handle.intent);
+        }
+        async markNativeStrictDurableTransactionRollback(handle) {
+            if (!handle || handle.released) {
+                return;
+            }
+            const previousMarker = handle.intent.lowerMarkerCommitted;
+            handle.intent.lowerMarkerCommitted = false;
+            try {
+                await this.writeNativeStrictDurableTransactionIntent(handle.intent);
+            }
+            catch (error) {
+                // The last valid generation may still contain a true marker. Preserve
+                // that in-memory knowledge and keep the handle held until the caller has
+                // retained the lower finalizer. Releasing first would let concurrent close
+                // compensate lower facts while recovery still sees a committed marker.
+                handle.intent.lowerMarkerCommitted = previousMarker;
+                this.poisonNativeStrictDurableTransaction(error);
+                throw error;
+            }
+        }
+        async completeNativeStrictDurableTrimCleanup(intent, committed = intent.lowerMarkerCommitted === true, reconstructMissing = false) {
+            if (!committed || intent.trimHashes.length === 0) {
+                return;
+            }
+            const localStore = this.remoteBlocks?.localStore;
+            if (typeof localStore?.completeCommittedNativeDeleteCleanup === "function") {
+                await localStore.completeCommittedNativeDeleteCleanup(intent.trimHashes, {
+                    reconstructMissing,
+                });
+            }
+        }
+        async completeNativeStrictDurableCoordinateCleanup(intent, committed = intent.lowerMarkerCommitted === true) {
+            const hashes = intent.coordinateDeleteHashes ?? [];
+            if (!committed || hashes.length === 0) {
+                return;
+            }
+            await this.deleteCoordinatesForHashes(hashes);
+            const flushed = this.flushNativeBackboneCoordinateJournal();
+            if (isPromiseLike(flushed)) {
+                await flushed;
+            }
+        }
+        async completeNativeStrictDurableTransaction(handle) {
+            if (!handle || handle.released) {
+                return;
+            }
+            try {
+                await this.completeNativeStrictDurableCoordinateCleanup(handle.intent);
+                await this.completeNativeStrictDurableTrimCleanup(handle.intent);
+                await this.writeNativeStrictDurableTransactionIntent(undefined);
+                this.clearNativeStrictDurableTransactionFailure();
+            }
+            catch (error) {
+                // The lower marker may already be acknowledged. Retain the intent and
+                // reject every later mutation until reopen can finish recovery; allowing a
+                // new transaction to overwrite this generation would make rollback/GC debt
+                // ambiguous and can erase acknowledged data.
+                this.poisonNativeStrictDurableTransaction(error);
+                throw error;
+            }
+            finally {
+                if (handle.lowerHashMutationLockOwner) {
+                    this.log.entryIndex.releaseHashMutationLocks(handle.lowerHashMutationLockOwner);
+                    handle.lowerHashMutationLockOwner = undefined;
+                }
+                handle.released = true;
+                this._nativeStrictDurableTransactions?.delete(handle);
+                handle.release();
+            }
+        }
+        releaseNativeStrictDurableTransaction(handle, cause = new Error("Native durable transaction intent was retained for recovery")) {
+            if (!handle || handle.released) {
+                return;
+            }
+            this.poisonNativeStrictDurableTransaction(cause);
+            if (handle.lowerHashMutationLockOwner) {
+                this.log.entryIndex.releaseHashMutationLocks(handle.lowerHashMutationLockOwner);
+                handle.lowerHashMutationLockOwner = undefined;
+            }
+            handle.released = true;
+            this._nativeStrictDurableTransactions?.delete(handle);
+            handle.release();
+        }
+        retainNativeStrictDurableTransactionAfterMarkerFailure(handle, finalizer, cause) {
+            const failures = [cause];
+            try {
+                finalizer?.retainForRecovery();
+            }
+            catch (error) {
+                failures.push(error);
+            }
+            finally {
+                // retainForRecovery finalizes its lower transaction even when one of its
+                // internal cleanup steps reports an error. Only release the strict handle
+                // after that synchronous state transition has been attempted.
+                this.releaseNativeStrictDurableTransaction(handle, cause);
+            }
+            return failures;
+        }
+        async settleNativeStrictDurableTransactionsForClose() {
+            while ((this._nativeStrictDurableTransactions?.size ?? 0) > 0) {
+                const tail = this._nativeStrictDurableTransactionTail;
+                if (!tail) {
+                    throw new Error("Native strict durable transaction has no settlement tail");
+                }
+                // A close racing an acknowledged lower marker must not release the strict
+                // handle and let Log.close() compensate while the on-disk intent still says
+                // committed. Wait until the owner either retires the intent or deliberately
+                // retains it for recovery before closing the lower log or persistence stores.
+                await tail;
+            }
+        }
+        async recoverNativeStrictDurableTransactionIntent(documentIndexReady = false) {
+            const store = this._nativeBackboneCoordinatePersistenceStore;
+            if (!store || !this._nativeBackbone) {
+                this._nativeStrictDurableDocumentRecoveryDeferred = false;
+                return true;
+            }
+            const journalState = await this.loadNativeStrictDurableTransactionJournalState();
+            const intent = journalState.intent;
+            if (!intent) {
+                this._nativeStrictDurableDocumentRecoveryDeferred = false;
+                this.clearNativeStrictDurableTransactionFailure();
+                return true;
+            }
+            if (intent.version !== 1) {
+                throw new Error("Unsupported native durable transaction recovery intent");
+            }
+            intent.trimHashes ??= [];
+            intent.coordinateDeleteHashes ??= [];
+            intent.lowerIndexRows ??= [];
+            intent.coordinates ??= [];
+            const bytesEqual = (left, right) => {
+                if (!left || !right) {
+                    return left === undefined && right === undefined;
+                }
+                if (left.byteLength !== right.length) {
+                    return false;
+                }
+                for (let index = 0; index < left.byteLength; index++) {
+                    if (left[index] !== right[index]) {
+                        return false;
+                    }
+                }
+                return true;
+            };
+            const immutableRowEquals = (current, expected) => {
+                if (!current || !expected) {
+                    return current === undefined && expected === undefined;
+                }
+                const currentRow = deserialize(current, ShallowEntry);
+                const expectedRow = deserialize(Uint8Array.from(expected), ShallowEntry);
+                // `head` is a mutable graph projection. Hash, payload size, and metadata
+                // are content-addressed append identity and are safe marker evidence even
+                // when a later acknowledged entry has demoted this row.
+                currentRow.head = false;
+                expectedRow.head = false;
+                return bytesEqual(serialize(currentRow), [...serialize(expectedRow)]);
+            };
+            const currentLowerRows = new Map();
+            for (const row of intent.lowerIndexRows) {
+                const current = (await this.log.entryIndex.properties.index.get(toId(row.hash)))?.value;
+                currentLowerRows.set(row.hash, current ? serialize(current) : undefined);
+            }
+            const trimHashes = new Set(intent.trimHashes);
+            const retainedMarkerRows = intent.lowerIndexRows.filter((row) => intent.appendHashes.includes(row.hash) &&
+                !trimHashes.has(row.hash) &&
+                row.after !== undefined);
+            // Only a row known absent in the before-image is an unambiguous lower commit
+            // marker. An existing content-addressed row can equal the after-image once
+            // mutable `head` is ignored even before this transaction mutated anything.
+            const expectedMarkerRows = retainedMarkerRows.filter((row) => row.before === undefined);
+            let lowerMarkerCommitted = intent.lowerMarkerCommitted === true ||
+                (expectedMarkerRows.length > 0 &&
+                    expectedMarkerRows.every((row) => immutableRowEquals(currentLowerRows.get(row.hash), row.after)));
+            if (!lowerMarkerCommitted &&
+                !documentIndexReady &&
+                intent.documents.some((document) => document.value !== undefined)) {
+                // SharedLog opens before Documents can attach its schema-aware native
+                // index. Restoring an encoded before-image requires that schema. Keep the
+                // intent authoritative and mutations poisoned until Documents has attached
+                // the index and explicitly resumes recovery.
+                this._nativeStrictDurableDocumentRecoveryDeferred = true;
+                this.poisonNativeStrictDurableTransaction(new Error("Native strict durable document recovery is waiting for its document index"));
+                return false;
+            }
+            const lowerIndex = this.log.entryIndex.properties
+                .index;
+            const deleteLowerIndexHash = async (hash) => {
+                if (lowerIndex.delIds) {
+                    await lowerIndex.delIds([hash]);
+                }
+                else if (lowerIndex.delIdsNoReturn) {
+                    await lowerIndex.delIdsNoReturn([hash]);
+                }
+                else {
+                    await lowerIndex.del({ query: { hash } });
+                }
+            };
+            let lowerIndexChanged = false;
+            if (lowerMarkerCommitted) {
+                for (const row of intent.lowerIndexRows) {
+                    if (trimHashes.has(row.hash) || !row.after) {
+                        continue;
+                    }
+                    const current = currentLowerRows.get(row.hash);
+                    if (immutableRowEquals(current, row.after)) {
+                        // Preserve the current mutable head projection. It may include a later
+                        // acknowledged Y -> X demotion that must survive recovery.
+                        continue;
+                    }
+                    if (!intent.appendHashes.includes(row.hash) || current !== undefined) {
+                        // External-next rows are not resurrected over a later delete, and a
+                        // conflicting present content-addressed row is never overwritten.
+                        continue;
+                    }
+                    await lowerIndex.put(deserialize(Uint8Array.from(row.after), ShallowEntry));
+                    lowerIndexChanged = true;
+                }
+                for (const hash of intent.trimHashes) {
+                    const current = await lowerIndex.get(toId(hash));
+                    const intentRow = intent.lowerIndexRows.find((row) => row.hash === hash);
+                    if (current &&
+                        intentRow?.before &&
+                        bytesEqual(serialize(current.value), intentRow.before)) {
+                        await deleteLowerIndexHash(hash);
+                        lowerIndexChanged = true;
+                    }
+                }
+            }
+            else {
+                for (const row of intent.lowerIndexRows) {
+                    const current = currentLowerRows.get(row.hash);
+                    if (bytesEqual(current, row.before)) {
+                        continue;
+                    }
+                    // Exact after-image CAS: a later mutation (including only a `head`
+                    // change) owns the row and must not be erased or overwritten by recovery.
+                    if (!bytesEqual(current, row.after)) {
+                        continue;
+                    }
+                    if (row.before) {
+                        await lowerIndex.put(deserialize(Uint8Array.from(row.before), ShallowEntry));
+                    }
+                    else {
+                        await deleteLowerIndexHash(row.hash);
+                    }
+                    lowerIndexChanged = true;
+                }
+            }
+            if (lowerIndexChanged) {
+                await this.log.entryIndex.init();
+            }
+            if (!lowerMarkerCommitted) {
+                if (intent.coordinates.length > 0) {
+                    const mutationGenerations = (this._nativeCoordinateMutationGenerations ??= new Map());
+                    const rollback = {
+                        hashes: new Set(),
+                        entries: new Map(),
+                        generations: new Map(),
+                    };
+                    for (const coordinate of intent.coordinates) {
+                        rollback.hashes.add(coordinate.hash);
+                        const generation = (mutationGenerations.get(coordinate.hash) ?? 0) + 1;
+                        mutationGenerations.set(coordinate.hash, generation);
+                        rollback.generations.set(coordinate.hash, generation);
+                        if (coordinate.value) {
+                            const number = (value) => (this.domain.resolution === "u32"
+                                ? Number(value)
+                                : BigInt(value));
+                            rollback.entries.set(coordinate.hash, new this.indexableDomain.constructorEntry({
+                                hash: coordinate.hash,
+                                hashNumber: number(coordinate.value.hashNumber),
+                                gid: coordinate.value.gid,
+                                coordinates: coordinate.value.coordinates.map(number),
+                                wallTime: BigInt(coordinate.value.wallTime),
+                                assignedToRangeBoundary: coordinate.value.assignedToRangeBoundary,
+                                metaBytes: Uint8Array.from(coordinate.value.metaBytes),
+                            }));
+                        }
+                    }
+                    await this.rollbackNativeBackboneCoordinateAppendDurably("", rollback);
+                }
+                for (const document of intent.documents) {
+                    this.restoreNativeBackboneDocument({
+                        key: document.key,
+                        value: document.value ? Uint8Array.from(document.value) : undefined,
+                        byteElementIndexLimit: document.byteElementIndexLimit,
+                    });
+                }
+                const flushed = this.flushNativeBackboneCoordinateJournal();
+                if (isPromiseLike(flushed)) {
+                    await flushed;
+                }
+            }
+            if (lowerMarkerCommitted) {
+                await this.completeNativeStrictDurableCoordinateCleanup(intent, true);
+                await this.completeNativeStrictDurableTrimCleanup(intent, true, true);
+            }
+            await this.writeNativeStrictDurableTransactionIntent(undefined);
+            this._nativeStrictDurableDocumentRecoveryDeferred = false;
+            this.clearNativeStrictDurableTransactionFailure();
+            return true;
+        }
+        /** @internal Complete a deferred rollback after Documents attaches its schema. */
+        async finishNativeStrictDurableDocumentRecovery() {
+            if (!this._nativeStrictDurableDocumentRecoveryDeferred) {
+                return;
+            }
+            const completed = await this.recoverNativeStrictDurableTransactionIntent(true);
+            if (!completed) {
+                throw new Error("Native strict durable document recovery did not complete");
+            }
+            await this.reconcileNativeCoordinatesWithLowerCommitMarkers();
+        }
+        async rollbackFailedNativeBackboneTransaction(properties) {
+            const backbone = this._nativeBackbone;
+            if (!backbone)
+                return;
+            for (let index = properties.committedHashes.length - 1; index >= 0; index--) {
+                const hash = properties.committedHashes[index];
+                backbone.graph.delete(hash);
+                this.rollbackNativeBackboneCoordinateAppend(hash, properties.coordinateEntries);
+            }
+            if (properties.restoreGraphFromIndex) {
+                await this.log.entryIndex.restoreNativeGraphFromIndex();
+            }
+            else {
+                if (properties.trimmedEntries?.length) {
+                    backbone.graph.putBatch(properties.trimmedEntries);
+                }
+            }
+            for (const document of properties.documents ?? []) {
+                this.restoreNativeBackboneDocument(document);
+            }
+            const flushed = this.flushNativeBackboneCoordinateJournal();
+            if (isPromiseLike(flushed)) {
+                await flushed;
+            }
+            if (properties.skipBlockCompensation) {
+                return;
+            }
+            let compensated = false;
+            try {
+                if (properties.unmirroredBlockCompensation &&
+                    properties.durableWrapper?.rollbackUnmirroredNativeCommits) {
+                    await properties.durableWrapper.rollbackUnmirroredNativeCommits(properties.committedHashes, properties.trimmedEntries?.map((entry) => entry.hash));
+                }
+                else if (properties.durableWrapper?.rollbackFailedNativeCommits) {
+                    await properties.durableWrapper.rollbackFailedNativeCommits(properties.committedHashes, properties.trimmedEntries?.map((entry) => entry.hash));
+                }
+                else {
+                    await backbone.blocks.rmMany(properties.committedHashes);
+                }
+                compensated = true;
+            }
+            finally {
+                this._nativeDurableRecoveryReadyForReopen = compensated;
+            }
+        }
+        openTime;
+        oldestOpenTime;
+        keep;
+        // A fn that we can call many times that recalculates the participation role
+        rebalanceParticipationDebounced;
+        replicationAnnouncementRetryDebounced;
+        _replicationAnnouncementRetryPending;
+        _replicationAnnouncementRetryGeneration;
+        _replicationAnnouncementRetryController;
+        // A fn for debouncing the calls for pruning
+        pruneDebouncedFn;
+        responseToPruneDebouncedFn;
+        get _requestIPruneSent() {
+            return this._checkedPrune.requestIPruneSent;
+        }
+        get _requestIPruneResponseReplicatorSet() {
+            return this._checkedPrune.responseReplicatorSet;
+        }
+        get _checkedPruneRetries() {
+            return this._checkedPrune.retries;
+        }
+        replicationChangeDebounceFn;
+        _repairRetryTimers;
+        _recentRepairDispatch;
+        _repairSweepRunning;
+        _repairSweepPendingModes;
+        _repairSweepPendingPeersByMode;
+        _repairFrontierByMode;
+        _repairFrontierActiveTargetsByMode;
+        _repairFrontierBypassKnownPeersByMode;
+        _repairSweepOptimisticGidPeersPending;
+        _entryKnownPeers;
+        _entryKnownPeerObservedAt;
+        _joinAuthoritativeRepairTimersByDelay;
+        _joinAuthoritativeRepairPeersByDelay;
+        _assumeSyncedRepairSuppressedUntil;
+        _appendBackfillTimer;
+        _appendBackfillPendingByTarget;
+        _repairMetrics;
+        _topicSubscribersCache;
+        _leaderSelectionContextCache;
+        // Sync capability bits advertised by peers (SyncCapabilitiesMessage), keyed
+        // by public key hash. Entries are dropped on unsubscribe/disconnect.
+        _peerSyncCapabilities;
+        // Pending live raw exchange-head gossip, coalesced per recipient set and
+        // flushed at the end of the current event-loop turn (or when a batch cap
+        // is hit). Only used when every recipient advertised raw capability.
+        _liveRawGossipBatches;
+        _liveRawGossipFlushScheduled;
+        // regular distribution checks
+        distributeQueue;
+        syncronizer;
+        replicas;
+        cpuUsage;
+        _lastLocalAppendAt;
+        adaptiveRebalanceIdleMs;
+        timeUntilRoleMaturity;
+        waitForReplicatorTimeout;
+        waitForReplicatorRequestIntervalMs;
+        waitForReplicatorRequestMaxAttempts;
+        waitForPruneDelay;
+        distributionDebounceTime;
+        repairSweepTargetBufferSize;
+        replicationController;
+        history;
+        domain;
+        indexableDomain;
+        interval;
+        constructor(properties) {
+            super();
+            this.ensureNativeDurabilityRuntimeState();
+            this.log = new Log(properties);
+            this.rpc = new RPC();
+            this._checkedPrune = new CheckedPruneCoordinator();
+            this._pendingIHave = new Map();
+            this.latestReplicationInfoMessage = new Map();
             this._replicationInfoBlockedPeers = new Set();
             this._replicationInfoRequestByPeer = new Map();
             this._replicationInfoApplyQueueByPeer = new Map();
@@ -1025,9 +2556,23 @@ let SharedLog = (() => {
             this._replicatorLivenessCursor = 0;
             this._replicatorLivenessFailures = new Map();
             this._replicatorLastActivityAt = new Map();
+            this._replicationAnnouncementRetryPending = false;
+            this._replicationAnnouncementRetryGeneration = 0;
+            this._replicationAnnouncementRetryController = new AbortController();
             this.pendingMaturity = new Map();
             this._closeController = new AbortController();
         }
+        ensureNativeDurabilityRuntimeState() {
+            // Program clones are borsh-created without running class field initializers.
+            // Keep recovery state from an existing generation, while supplying fresh
+            // defaults only when the runtime-only fields are absent.
+            this._nativeDurableRecoveryReadyForReopen ??= false;
+            this._nativeDurableRecoveryCids ??= new Set();
+            this._nativeBackboneDropStarted ??= false;
+            this._nativeBackboneCoordinateJournalLastFlushMs ??= 0;
+            this._nativeStrictDurableDocumentRecoveryDeferred ??= false;
+            this._nativeStrictDurableTransactionsClosing ??= false;
+        }
         get compatibility() {
             return this._logProperties?.compatibility;
         }
@@ -2031,6 +3576,7 @@ let SharedLog = (() => {
             return undefined;
         }
         setupRebalanceDebounceFunction(interval = RECALCULATE_PARTICIPATION_DEBOUNCE_INTERVAL) {
+            this.rebalanceParticipationDebounced?.close();
             this.rebalanceParticipationDebounced = undefined;
             this.rebalanceParticipationDebounced = debounceFixedInterval(() => this.rebalanceParticipation(), 
             /* Math.max(
@@ -2040,7 +3586,133 @@ let SharedLog = (() => {
                     REBALANCE_DEBOUNCE_INTERVAL
                 )
             ) */
-            interval);
+            interval, // TODO make this dynamic on the number of replicators
+            {
+                onError: (error) => this.onRebalanceParticipationError(error),
+            });
+        }
+        queueCurrentReplicationStateAnnouncementRetry(error) {
+            if (this.closed ||
+                this._closeController.signal.aborted ||
+                this._replicationAnnouncementRetryController.signal.aborted ||
+                !isTransientReplicationAnnouncementError(error)) {
+                return false;
+            }
+            this._replicationAnnouncementRetryPending = true;
+            void this.replicationAnnouncementRetryDebounced?.call();
+            return true;
+        }
+        onRebalanceParticipationError(error) {
+            if (this.closed ||
+                isNotStartedError(error) ||
+                (isTransientReplicationAnnouncementError(error) &&
+                    this._replicationAnnouncementRetryPending)) {
+                return;
+            }
+            // Debounced invocations run from an un-awaited timer. Throwing here would
+            // create an unhandled rejection (and a browser pageerror), so surface
+            // unexpected failures through the logger instead.
+            logger.error(error);
+        }
+        setupReplicationAnnouncementRetryFunction(interval = REPLICATION_ANNOUNCEMENT_RETRY_INTERVAL) {
+            this.replicationAnnouncementRetryDebounced?.close();
+            this._replicationAnnouncementRetryController?.abort();
+            this._replicationAnnouncementRetryController = new AbortController();
+            this.replicationAnnouncementRetryDebounced = debounceFixedInterval(() => this.retryCurrentReplicationStateAnnouncement(), interval, {
+                leading: false,
+                onError: (error) => {
+                    if (this.closed ||
+                        this._closeController.signal.aborted ||
+                        isNotStartedError(error)) {
+                        return;
+                    }
+                    logger.error(error);
+                },
+            });
+        }
+        cancelCurrentReplicationStateAnnouncementRetry() {
+            this._replicationAnnouncementRetryGeneration += 1;
+            this._replicationAnnouncementRetryPending = false;
+            this._replicationAnnouncementRetryController?.abort();
+            this.replicationAnnouncementRetryDebounced?.close();
+        }
+        async sendReplicationAnnouncement(message) {
+            // Advance before every post-mutation send, including successful ones. An
+            // authoritative retry already in flight may have captured the previous
+            // local state; the generation mismatch forces one more current snapshot
+            // after that stale send settles.
+            this._replicationAnnouncementRetryGeneration += 1;
+            try {
+                await this.rpc.send(message, {
+                    priority: CONVERGENCE_MESSAGE_PRIORITY,
+                });
+            }
+            catch (error) {
+                // The local replication-index mutation precedes all calls to this
+                // wrapper. Preserve the explicit caller's rejection, but independently
+                // schedule an authoritative snapshot so peers eventually observe the
+                // already-committed local state.
+                this.queueCurrentReplicationStateAnnouncementRetry(error);
+                throw error;
+            }
+        }
+        async retryCurrentReplicationStateAnnouncement() {
+            const generation = this._replicationAnnouncementRetryGeneration;
+            const controller = this._replicationAnnouncementRetryController;
+            try {
+                const segments = (await this.getMyReplicationSegments()).map((range) => range.toReplicationRange());
+                if (this.closed ||
+                    this._closeController.signal.aborted ||
+                    controller.signal.aborted) {
+                    return;
+                }
+                if (generation !== this._replicationAnnouncementRetryGeneration) {
+                    void this.replicationAnnouncementRetryDebounced?.call();
+                    return;
+                }
+                await this.rpc.send(new AllReplicatingSegmentsMessage({ segments }), {
+                    priority: CONVERGENCE_MESSAGE_PRIORITY,
+                    signal: controller.signal,
+                });
+            }
+            catch (error) {
+                if (this.closed ||
+                    this._closeController.signal.aborted ||
+                    controller.signal.aborted) {
+                    return;
+                }
+                if (this.queueCurrentReplicationStateAnnouncementRetry(error)) {
+                    return;
+                }
+                if (generation === this._replicationAnnouncementRetryGeneration) {
+                    this._replicationAnnouncementRetryPending = false;
+                }
+                else {
+                    void this.replicationAnnouncementRetryDebounced?.call();
+                }
+                throw error;
+            }
+            if (this.closed ||
+                this._closeController.signal.aborted ||
+                controller.signal.aborted) {
+                return;
+            }
+            // A newer mutation announcement may have started while this snapshot was
+            // in flight. In that case keep the repair pending so the newer current
+            // state is also announced in full, regardless of whether its incremental
+            // send succeeded or failed.
+            if (generation === this._replicationAnnouncementRetryGeneration) {
+                this._replicationAnnouncementRetryPending = false;
+                if (!this.closed &&
+                    !this._closeController.signal.aborted &&
+                    !controller.signal.aborted &&
+                    this._isAdaptiveReplicating) {
+                    void this.rebalanceParticipationDebounced?.call();
+                }
+            }
+            else {
+                void this.replicationAnnouncementRetryDebounced?.call();
+            }
         }
         markLocalAppendActivity(timestamp = Date.now()) {
             this._lastLocalAppendAt = Math.max(this._lastLocalAppendAt ?? 0, timestamp);
@@ -2278,11 +3950,9 @@ let SharedLog = (() => {
                 rebalance,
             });
             if (rangesToUnreplicate.length > 0) {
-                await this.rpc.send(new StoppedReplicating({
+                await this.sendReplicationAnnouncement(new StoppedReplicating({
                     segmentIds: rangesToUnreplicate.map((x) => x.id),
-                }), {
-                    priority: CONVERGENCE_MESSAGE_PRIORITY,
-                });
+                }));
             }
             return rangesToReplicate;
         }
@@ -2406,9 +4076,7 @@ let SharedLog = (() => {
             }
             const rangesToRemove = await this.resolveReplicationRangesFromIdsAndKey(segmentIds, this.node.identity.publicKey);
             await this.removeReplicationRanges(rangesToRemove, this.node.identity.publicKey);
-            await this.rpc.send(new StoppedReplicating({ segmentIds }), {
-                priority: CONVERGENCE_MESSAGE_PRIORITY,
-            });
+            await this.sendReplicationAnnouncement(new StoppedReplicating({ segmentIds }));
         }
         async removeReplicator(key, options) {
             const keyHash = typeof key === "string" ? key : key.hashcode();
@@ -2427,9 +4095,7 @@ let SharedLog = (() => {
             const isMe = this.node.identity.publicKey.hashcode() === keyHash;
             if (isMe) {
                 // announce that we are no longer replicating
-                await this.rpc.send(new AllReplicatingSegmentsMessage({ segments: [] }), {
-                    priority: CONVERGENCE_MESSAGE_PRIORITY,
-                });
+                await this.sendReplicationAnnouncement(new AllReplicatingSegmentsMessage({ segments: [] }));
             }
             if (options?.noEvent !== true) {
                 const publicKey = toLocalPublicSignKey(key);
@@ -2803,9 +4469,7 @@ let SharedLog = (() => {
                         return options.announce(message);
                     }
                     else {
-                        await this.rpc.send(message, {
-                            priority: CONVERGENCE_MESSAGE_PRIORITY,
-                        });
+                        await this.sendReplicationAnnouncement(message);
                     }
                 }
             }
@@ -4055,6 +5719,7 @@ let SharedLog = (() => {
             }
         }
         async append(data, options) {
+            this.throwIfNativeDurableCommitFailed();
             if (this._isAdaptiveReplicating) {
                 this.markLocalAppendActivity();
             }
@@ -4067,6 +5732,7 @@ let SharedLog = (() => {
         }
         // Trusted local append path for callers that already validated the entry.
         async appendLocallyValidated(data, options) {
+            this.throwIfNativeDurableCommitFailed();
             if (options?.canAppend || options?.onChange) {
                 throw new Error("appendLocallyValidated does not accept canAppend or onChange hooks");
             }
@@ -4084,6 +5750,7 @@ let SharedLog = (() => {
         }
         // Trusted local append path that lets the shared log own change application.
         async appendLocallyPrepared(data, options, properties) {
+            this.throwIfNativeDurableCommitFailed();
             if (options?.canAppend || options?.onChange) {
                 throw new Error("appendLocallyPrepared does not accept canAppend or onChange hooks");
             }
@@ -4221,6 +5888,7 @@ let SharedLog = (() => {
         }
         // Trusted local payload append path that keeps the public Entry lazy.
         appendLocallyPreparedPayloadCommitOnly(payloadData, options, properties) {
+            this.throwIfNativeDurableCommitFailed();
             if (options?.canAppend || options?.onChange) {
                 throw new Error("appendLocallyPreparedPayloadCommitOnly does not accept canAppend or onChange hooks");
             }
@@ -4250,6 +5918,7 @@ let SharedLog = (() => {
         }
         // Strict native document path. Never falls back to compatibility append.
         appendStrictNativeDocumentPayloadCommitOnly(payloadData, options, properties) {
+            this.throwIfNativeDurableCommitFailed();
             if (options?.canAppend || options?.onChange) {
                 throw new Error("appendStrictNativeDocumentPayloadCommitOnly does not accept canAppend or onChange hooks");
             }
@@ -4316,116 +5985,300 @@ let SharedLog = (() => {
             // commit-only block can be mirrored to durable WITHOUT routing it through
             // the log's finishBlocks/putKnown* (which would disturb the strict-native
             // resident-coordinate append path). `mirrorToDurable` writes to the durable
-            // side only and tracks the write for error-surfacing.
+            // side only; the lower-log result is held behind that durability barrier.
             const durableWrapper = durableWrapperActive
                 ? this.remoteBlocks?.localStore
                 : undefined;
             let nativeBackboneDocumentIndexCommitted = false;
-            let committedNativeBackboneDocumentIndex;
+            let nativeDeleteCleanupToken;
+            let nativeDocumentRollback;
+            let nativeStrictTransaction;
+            let lowerPublicationRollback;
             const nativeCommitProperties = {
                 payloadData,
                 resolveTrimmedEntries: properties?.resolveTrimmedEntries,
             };
-            nativeCommitProperties.skipMissingNextJoin =
-                properties?.skipMissingNextJoin;
-            nativeCommitProperties.retainMaterializationBytes =
-                this._logProperties?.trim != null;
-            const result = asTrustedLowerLog(this.log).appendLocallyPreparedNativeNoNextCommitOnly(undefined, appendOptions, nativeCommitProperties, (input) => {
-                const next = "next" in input && Array.isArray(input.next) ? input.next : [];
-                const nativeBackboneDocumentIndex = properties?.nativeBackboneDocumentIndex ??
-                    properties?.prepareNativeBackboneDocumentIndex?.({
-                        wallTime: input.wallTime,
-                        gid: input.gid,
-                        payloadSize: input.payloadData.byteLength,
-                    });
-                const nativeBackboneDocumentIndexForAppend = nativeBackboneDocumentIndex &&
-                    input.trimLengthTo == null &&
-                    nativeBackboneDocumentIndex.deleteTrimmedHeads === true
-                    ? {
-                        ...nativeBackboneDocumentIndex,
-                        deleteTrimmedHeads: false,
-                    }
-                    : nativeBackboneDocumentIndex;
-                if (nativeBackboneDocumentIndex) {
-                    nativeBackboneDocumentIndexCommitted = true;
-                    committedNativeBackboneDocumentIndex = nativeBackboneDocumentIndex;
-                }
-                const useLatestDocumentContext = properties?.useNativeExistingDocumentContext === true;
-                const prepared = backbone.graph.prepareEntryV0PlainEntryCommit({
-                    ...input,
-                    next,
-                    includeMaterializationBytes: false,
-                    includeAppendFactsBytes: true,
-                    trimLengthTo: input.trimLengthTo,
-                    ...(nativeBackboneDocumentIndexForAppend
+            nativeCommitProperties.skipMissingNextJoin =
+                properties?.skipMissingNextJoin;
+            nativeCommitProperties.retainMaterializationBytes =
+                this._logProperties?.trim != null;
+            nativeCommitProperties.deferNativeTransactionAcknowledgement = true;
+            const rollbackLowerPublication = async (error) => {
+                durableWrapper?.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                const rollbackFailures = [];
+                if (lowerPublicationRollback &&
+                    !(error instanceof NativeDurableCommitError)) {
+                    try {
+                        const lowerPublicationStarted = lowerPublicationRollback.lowerPublicationStarted;
+                        await this.rollbackFailedNativeBackboneTransaction({
+                            committedHashes: lowerPublicationRollback.committedHashes,
+                            trimmedEntries: lowerPublicationRollback.trimmedEntries,
+                            coordinateEntries: lowerPublicationRollback.coordinateEntries,
+                            documents: lowerPublicationRollback.documents,
+                            durableWrapper: lowerPublicationStarted
+                                ? undefined
+                                : lowerPublicationRollback.durableWrapper,
+                            skipBlockCompensation: lowerPublicationStarted,
+                            unmirroredBlockCompensation: !lowerPublicationStarted,
+                            restoreGraphFromIndex: true,
+                        });
+                    }
+                    catch (rollbackError) {
+                        rollbackFailures.push(rollbackError);
+                    }
+                }
+                else if (nativeDocumentRollback &&
+                    !(error instanceof NativeDurableCommitError)) {
+                    try {
+                        this.restoreNativeBackboneDocument(nativeDocumentRollback);
+                        const flushed = this.flushNativeBackboneCoordinateJournal();
+                        if (isPromiseLike(flushed)) {
+                            await flushed;
+                        }
+                    }
+                    catch (rollbackError) {
+                        rollbackFailures.push(rollbackError);
+                    }
+                }
+                if (rollbackFailures.length > 0) {
+                    this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                    throw new AggregateError([error, ...rollbackFailures], "Lower-log publication and native compensation both failed");
+                }
+                await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                throw error;
+            };
+            let result;
+            try {
+                result = asTrustedLowerLog(this.log).appendLocallyPreparedNativeNoNextCommitOnly(undefined, appendOptions, nativeCommitProperties, async (input) => {
+                    const next = "next" in input && Array.isArray(input.next) ? input.next : [];
+                    const nativeBackboneDocumentIndex = properties?.nativeBackboneDocumentIndex ??
+                        properties?.prepareNativeBackboneDocumentIndex?.({
+                            wallTime: input.wallTime,
+                            gid: input.gid,
+                            payloadSize: input.payloadData.byteLength,
+                        });
+                    const nativeBackboneDocumentIndexForAppend = nativeBackboneDocumentIndex &&
+                        input.trimLengthTo == null &&
+                        nativeBackboneDocumentIndex.deleteTrimmedHeads === true
                         ? {
-                            documentIndex: {
-                                ...nativeBackboneDocumentIndexForAppend,
-                                ...(useLatestDocumentContext
-                                    ? { useLatestContext: true }
-                                    : {}),
-                            },
+                            ...nativeBackboneDocumentIndex,
+                            deleteTrimmedHeads: false,
                         }
-                        : {}),
-                }, backbone.blocks);
-                if (prepared && !prepared.bytes) {
-                    if (durableWrapper) {
-                        // The durable write-through wrapper is active, so the block store
-                        // the log writes through (this.remoteBlocks.localStore) is the
-                        // wrapper, NOT the raw wasm block map. prepareEntryV0PlainEntryCommit
-                        // committed the block into the wasm map ONLY and returned no raw
-                        // bytes, so on its own the block would never reach durable (log's
-                        // finishBlocks only calls putKnown* when prepared.bytes is set) and
-                        // a non-replicating native node would lose it on restart.
-                        //
-                        // Mirror the just-committed block (read back from the wasm store)
-                        // straight to the DURABLE side of the wrapper. Crucially we do NOT
-                        // attach prepared.bytes: doing so would make the log's finishBlocks
-                        // call putKnown*, which changes the commit-only append path and
-                        // breaks the strict-native resident-coordinate optimization (the
-                        // reopen tests assert the append stays native and resolves no entry
-                        // block). Instead the prepared result is returned exactly as the
-                        // memory-only branch below (getBytes only, no bytes), so the log's
-                        // finishBlocks path is UNCHANGED, and the block is made durable
-                        // out-of-band here. mirrorToDurable tracks the write so an IO/
-                        // disk-full failure surfaces on a later awaited wrapper method.
+                        : nativeBackboneDocumentIndex;
+                    if (nativeBackboneDocumentIndex) {
+                        nativeBackboneDocumentIndexCommitted = true;
+                    }
+                    const useLatestDocumentContext = properties?.useNativeExistingDocumentContext === true;
+                    nativeDocumentRollback = this.snapshotNativeBackboneDocument(nativeBackboneDocumentIndexForAppend);
+                    nativeStrictTransaction =
+                        await this.beginNativeStrictDurableTransaction(nativeDocumentRollback ? [nativeDocumentRollback] : []);
+                    const prepared = backbone.graph.prepareEntryV0PlainEntryCommit({
+                        ...input,
+                        next,
+                        includeMaterializationBytes: false,
+                        includeAppendFactsBytes: true,
+                        trimLengthTo: input.trimLengthTo,
+                        ...(nativeBackboneDocumentIndexForAppend
+                            ? {
+                                documentIndex: {
+                                    ...nativeBackboneDocumentIndexForAppend,
+                                    ...(useLatestDocumentContext
+                                        ? { useLatestContext: true }
+                                        : {}),
+                                },
+                            }
+                            : {}),
+                    }, backbone.blocks);
+                    if (prepared) {
                         const preparedHash = prepared.cid ?? prepared.hash;
-                        const committedBytes = preparedHash
-                            ? backbone.blocks.get(preparedHash)
-                            : undefined;
-                        if (committedBytes && durableWrapper.mirrorToDurable) {
-                            durableWrapper.mirrorToDurable(preparedHash, committedBytes);
+                        const preparedNext = prepared.next ?? next;
+                        const nativeTrimmedHashes = prepared.trimmedEntryHashes ??
+                            prepared.trimmedEntries?.flatMap((entry) => (entry.hash ? [entry.hash] : [])) ??
+                            [];
+                        const coordinateRollback = this.snapshotResidentCoordinateEntries([
+                            ...(preparedHash ? [preparedHash] : []),
+                            ...preparedNext,
+                            ...nativeTrimmedHashes,
+                        ]);
+                        lowerPublicationRollback = {
+                            committedHashes: preparedHash ? [preparedHash] : [],
+                            trimmedEntries: prepared.trimmedEntries,
+                            coordinateEntries: coordinateRollback,
+                            documents: nativeDocumentRollback
+                                ? [nativeDocumentRollback]
+                                : undefined,
+                            durableWrapper,
+                            lowerPublicationStarted: false,
+                        };
+                        await this.setNativeStrictDurableTransactionOperation(nativeStrictTransaction, preparedHash ? [preparedHash] : [], nativeTrimmedHashes, coordinateRollback, combineCoordinateDeleteHashes(preparedNext, nativeTrimmedHashes));
+                        if (prepared.bytes) {
+                            lowerPublicationRollback.lowerPublicationStarted = true;
+                            return {
+                                ...prepared,
+                                nativeIndexMutationLockOwner: nativeStrictTransaction?.lowerHashMutationLockOwner,
+                            };
+                        }
+                        const rollbackCommitted = async (cause, committedCids) => {
+                            durableWrapper?.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                            let compensated = false;
+                            try {
+                                await this.rollbackFailedNativeBackboneTransaction({
+                                    committedHashes: committedCids,
+                                    trimmedEntries: prepared.trimmedEntries,
+                                    coordinateEntries: coordinateRollback,
+                                    documents: nativeDocumentRollback
+                                        ? [nativeDocumentRollback]
+                                        : undefined,
+                                    durableWrapper,
+                                });
+                                compensated = true;
+                            }
+                            catch {
+                                // Keep recovery marked incomplete; close will discard pending native
+                                // journals. Reopen preserves uncertain content-addressed bytes and
+                                // recovers liveness from the authoritative lower-log facts.
+                            }
+                            if (compensated) {
+                                await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                            }
+                            else {
+                                this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                            }
+                            return this.failNativeDurableCommit(cause, {
+                                committedCids,
+                                failedCids: committedCids,
+                            });
+                        };
+                        if (durableWrapper &&
+                            nativeTrimmedHashes.length > 0 &&
+                            !durableWrapper.beginNativeDeleteCleanup) {
+                            return rollbackCommitted(new Error("Native durable block wrapper cannot preannounce trim cleanup"), preparedHash ? [preparedHash] : []);
+                        }
+                        nativeDeleteCleanupToken =
+                            durableWrapper?.beginNativeDeleteCleanup?.(nativeTrimmedHashes);
+                        const preparedResult = {
+                            ...prepared,
+                            nativeIndexMutationLockOwner: nativeStrictTransaction?.lowerHashMutationLockOwner,
+                            getBytes: (hash) => backbone.blocks.get(hash),
+                            nativeBlocksDeleted: true,
+                            nativeDeleteCleanupToken,
+                        };
+                        if (durableWrapper) {
+                            // The durable write-through wrapper is active, so the block store
+                            // the log writes through (this.remoteBlocks.localStore) is the
+                            // wrapper, NOT the raw wasm block map. prepareEntryV0PlainEntryCommit
+                            // committed the block into the wasm map ONLY and returned no raw
+                            // bytes, so on its own the block would never reach durable (log's
+                            // finishBlocks only calls putKnown* when prepared.bytes is set) and
+                            // a non-replicating native node would lose it on restart.
+                            //
+                            // Mirror the just-committed block (read back from the wasm store)
+                            // straight to the DURABLE side of the wrapper. Crucially we do NOT
+                            // attach prepared.bytes: doing so would make the log's finishBlocks
+                            // call putKnown*, which changes the commit-only append path and
+                            // breaks the strict-native resident-coordinate optimization (the
+                            // reopen tests assert the append stays native and resolves no entry
+                            // block). Instead the prepared result is returned exactly as the
+                            // memory-only branch below (getBytes only, no bytes), so the log's
+                            // finishBlocks path is UNCHANGED. Returning the mirror promise from
+                            // this prepare callback holds lower-log index/head/trim publication
+                            // until durable succeeds.
+                            if (!preparedHash) {
+                                durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                                return rollbackCommitted(new Error("Native commit returned no entry CID to mirror"), []);
+                            }
+                            if (!durableWrapper.mirrorToDurable) {
+                                durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                                return rollbackCommitted(new Error("Native durable block wrapper has no mirror method"), [preparedHash]);
+                            }
+                            const committedBytes = backbone.blocks.get(preparedHash);
+                            if (!committedBytes) {
+                                durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                                return rollbackCommitted(new Error(`Native committed block ${preparedHash} is missing from the hot store`), [preparedHash]);
+                            }
+                            return durableWrapper
+                                .mirrorToDurable(preparedHash, committedBytes, {
+                                nativeTrimmed: nativeTrimmedHashes.includes(preparedHash),
+                            })
+                                .then((nativeCommitOwnershipToken) => {
+                                lowerPublicationRollback.lowerPublicationStarted = true;
+                                return {
+                                    ...preparedResult,
+                                    nativeCommitOwnershipToken,
+                                };
+                            }, (error) => {
+                                durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                                return rollbackCommitted(error, [preparedHash]);
+                            });
                         }
+                        lowerPublicationRollback.lowerPublicationStarted = true;
+                        return preparedResult;
                     }
-                    // The block lives in the wasm map; expose getBytes for materialization
-                    // (identical to the memory-only native node path). When the durable
-                    // wrapper is active the durable copy was mirrored just above.
-                    return {
-                        ...prepared,
-                        getBytes: (hash) => backbone.blocks.get(hash),
-                    };
+                    await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                    return prepared;
+                });
+                if (isPromiseLike(result)) {
+                    result = result.catch(rollbackLowerPublication);
                 }
-                return prepared;
-            });
+            }
+            catch (error) {
+                return rollbackLowerPublication(error);
+            }
             if (!result) {
-                return undefined;
+                return this.completeNativeStrictDurableTransaction(nativeStrictTransaction).then(() => undefined);
             }
-            return mapMaybePromise(result, (prepared) => {
+            return mapMaybePromise(result, async (prepared) => {
                 if (!prepared) {
+                    await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
                     return undefined;
                 }
-                const rollback = (error) => {
-                    if (committedNativeBackboneDocumentIndex) {
-                        backbone.deleteDocument(committedNativeBackboneDocumentIndex.key);
+                const rollback = async (error) => {
+                    const rollbackFailures = [];
+                    try {
+                        await this.markNativeStrictDurableTransactionRollback(nativeStrictTransaction);
+                    }
+                    catch (rollbackError) {
+                        const retentionFailures = this.retainNativeStrictDurableTransactionAfterMarkerFailure(nativeStrictTransaction, prepared.nativeCommittedAppendFinalizer, rollbackError);
+                        throw new AggregateError([error, ...retentionFailures], "Native rollback marker could not be persisted; recovery is required");
+                    }
+                    try {
+                        await prepared.nativeCommittedAppendFinalizer?.rollback();
+                    }
+                    catch (rollbackError) {
+                        rollbackFailures.push(rollbackError);
+                    }
+                    try {
+                        await this.rollbackNativeBackboneCoordinateAppendDurably(prepared.appendFacts.hash, lowerPublicationRollback?.coordinateEntries);
+                        for (const document of lowerPublicationRollback?.documents ?? []) {
+                            this.restoreNativeBackboneDocument(document);
+                        }
+                        const flushed = this.flushNativeBackboneCoordinateJournal();
+                        if (isPromiseLike(flushed)) {
+                            await flushed;
+                        }
+                    }
+                    catch (rollbackError) {
+                        rollbackFailures.push(rollbackError);
+                    }
+                    if (rollbackFailures.length === 0) {
+                        try {
+                            await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                        }
+                        catch (rollbackError) {
+                            rollbackFailures.push(rollbackError);
+                        }
+                    }
+                    else {
+                        this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                    }
+                    if (rollbackFailures.length > 0) {
+                        throw new AggregateError([error, ...rollbackFailures], "Shared-log append and compensation both failed");
                     }
                     throw error;
                 };
+                let finishResult;
                 try {
-                    const deferredCoordinateDeleteHashes = this.applyPreparedAppendFactsWithDeferredCoordinateDeletes(prepared.appendFacts, prepared.removed, prepared.materializeEntry, { removedHashes: prepared.removedHashes });
-                    const deleteHashes = deferredCoordinateDeleteHashes &&
-                        deferredCoordinateDeleteHashes.length > 0
-                        ? deferredCoordinateDeleteHashes
-                        : [];
+                    await this.setNativeStrictDurableTransactionExpectedRows(nativeStrictTransaction, [prepared.shallowEntry]);
                     const finish = () => {
                         const appendCommit = this.createPreparedLocalAppendCommitFromFacts(prepared.appendFacts);
                         if (nativeBackboneDocumentIndexCommitted) {
@@ -4442,16 +6295,27 @@ let SharedLog = (() => {
                             appendCommit,
                         };
                     };
-                    const completed = deleteHashes.length === 0
-                        ? finish()
-                        : mapMaybePromise(this.deleteCoordinatesForHashes(deleteHashes), finish);
-                    return isPromiseLike(completed)
-                        ? completed.catch((error) => rollback(error))
-                        : completed;
+                    if (!prepared.nativeCommittedAppendFinalizer) {
+                        throw new Error("Missing deferred native append finalizer");
+                    }
+                    // Strict success cannot honor batching thresholds: native
+                    // coordinate/document/signer facts must be physically durable before
+                    // the lower commit marker is acknowledged and its intent is retired.
+                    await this.flushNativeBackboneCoordinateJournal();
+                    await prepared.nativeCommittedAppendFinalizer.acknowledge(() => this.markNativeStrictDurableTransactionLowerMarker(nativeStrictTransaction));
+                    finishResult = finish();
                 }
                 catch (error) {
                     return rollback(error);
                 }
+                this.applyPreparedAppendFactsWithDeferredCoordinateDeletes(prepared.appendFacts, prepared.removed, prepared.materializeEntry, { removedHashes: prepared.removedHashes });
+                try {
+                    await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                }
+                catch (error) {
+                    warn(`Failed to retire committed native intent: ${String(error)}`);
+                }
+                return finishResult;
             });
         }
         appendLocallyPreparedPayloadNativeBackboneStorageTransaction(payloadData, appendOptions, properties, minReplicasValue, runtimeOnlyCoordinates) {
@@ -4484,8 +6348,11 @@ let SharedLog = (() => {
                     durableWrapperActive;
                 let nativeBackboneDocumentIndexCommitted = false;
                 let nativeBackboneDocumentDeleteCommitted = false;
-                let committedNativeBackboneDocumentIndex;
-                const prepareBackboneAppend = (input) => {
+                let nativeDocumentRollback;
+                let nativeCoordinateRollback;
+                let nativeDeleteCleanupToken;
+                let nativeStrictTransaction;
+                const prepareBackboneAppend = async (input) => {
                     const next = input.next ?? [];
                     const appendInput = {
                         wallTime: input.wallTime,
@@ -4536,6 +6403,12 @@ let SharedLog = (() => {
                                 documentDeleteKey: nativeBackboneDocumentDeleteKey,
                             }
                             : appendInput;
+                    nativeDocumentRollback = this.snapshotNativeBackboneDocument(nativeBackboneDocumentIndexForAppend ??
+                        (nativeBackboneDocumentDeleteKey
+                            ? { key: nativeBackboneDocumentDeleteKey }
+                            : undefined));
+                    nativeStrictTransaction =
+                        await this.beginNativeStrictDurableTransaction(nativeDocumentRollback ? [nativeDocumentRollback] : []);
                     if (next.length === 0) {
                         if (commitBlocksInBackbone) {
                             if (nativeBackboneDocumentIndex &&
@@ -4568,29 +6441,61 @@ let SharedLog = (() => {
                     }
                     if (nativeBackboneDocumentIndex) {
                         nativeBackboneDocumentIndexCommitted = true;
-                        committedNativeBackboneDocumentIndex = nativeBackboneDocumentIndex;
                     }
                     nativeBackboneDocumentDeleteCommitted =
                         !!nativeBackboneDocumentDeleteKey;
                     const useTrimmedHashesOnly = properties?.resolveTrimmedEntries === false;
-                    if (durableWrapper?.mirrorToDurable) {
-                        // The block was committed into the wasm map (commitBlocksInBackbone is
-                        // true) but not into durable, because the log's finishBlocks path is
-                        // left UNCHANGED for strict-native mode (getBytes only, no bytes, so
-                        // no putKnown* through the wrapper). Mirror the just-committed block
-                        // straight to the durable side so a non-replicating native node keeps
-                        // it across a restart. mirrorToDurable tracks the write for
-                        // error-surfacing.
-                        const committedHash = backboneAppend.entry.cid ?? backboneAppend.entry.hash;
-                        const committedBytes = committedHash
-                            ? backbone.blocks.get(committedHash)
-                            : undefined;
-                        if (committedBytes) {
-                            durableWrapper.mirrorToDurable(committedHash, committedBytes);
+                    const nativeTrimmedHashes = backboneAppend.trimmedHashes ??
+                        backboneAppend.trimmed.map((entry) => entry.hash);
+                    const committedHash = backboneAppend.entry.cid ?? backboneAppend.entry.hash;
+                    const committedNext = backboneAppend.entry.next ?? next;
+                    nativeCoordinateRollback = this.snapshotResidentCoordinateEntries([
+                        ...(committedHash ? [committedHash] : []),
+                        ...committedNext,
+                        ...nativeTrimmedHashes,
+                    ]);
+                    await this.setNativeStrictDurableTransactionOperation(nativeStrictTransaction, committedHash ? [committedHash] : [], nativeTrimmedHashes, nativeCoordinateRollback, combineCoordinateDeleteHashes(committedNext, nativeTrimmedHashes));
+                    const rollbackCommitted = async (cause, committedCids) => {
+                        durableWrapper?.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                        let compensated = false;
+                        try {
+                            await this.rollbackFailedNativeBackboneTransaction({
+                                committedHashes: committedCids,
+                                trimmedEntries: backboneAppend?.trimmed,
+                                coordinateEntries: nativeCoordinateRollback,
+                                documents: nativeDocumentRollback
+                                    ? [nativeDocumentRollback]
+                                    : undefined,
+                                durableWrapper,
+                            });
+                            compensated = true;
                         }
-                    }
-                    return {
+                        catch {
+                            // close/reopen completes recovery if durable compensation failed
+                        }
+                        if (compensated) {
+                            await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                        }
+                        else {
+                            this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                        }
+                        return this.failNativeDurableCommit(cause, {
+                            committedCids,
+                            failedCids: committedCids,
+                        });
+                    };
+                    if (durableWrapper &&
+                        commitBlocksInBackbone &&
+                        nativeTrimmedHashes.length > 0 &&
+                        !durableWrapper.beginNativeDeleteCleanup) {
+                        return rollbackCommitted(new Error("Native durable block wrapper cannot preannounce trim cleanup"), committedHash ? [committedHash] : []);
+                    }
+                    nativeDeleteCleanupToken = commitBlocksInBackbone
+                        ? durableWrapper?.beginNativeDeleteCleanup?.(nativeTrimmedHashes)
+                        : undefined;
+                    const preparedResult = {
                         ...backboneAppend.entry,
+                        nativeIndexMutationLockOwner: nativeStrictTransaction?.lowerHashMutationLockOwner,
                         gid: backboneAppend.coordinate.gid,
                         getBytes: commitBlocksInBackbone
                             ? (hash) => backbone.blocks.get(hash)
@@ -4601,8 +6506,42 @@ let SharedLog = (() => {
                         trimmedEntryHashes: useTrimmedHashesOnly
                             ? backboneAppend.trimmedHashes
                             : undefined,
+                        nativeBlocksDeleted: commitBlocksInBackbone,
+                        nativeDeleteCleanupToken,
                         documentPreviousContext: backboneAppend.documentPreviousContext,
                     };
+                    if (durableWrapper?.mirrorToDurable) {
+                        // The block was committed into the wasm map (commitBlocksInBackbone is
+                        // true) but not into durable, because the log's finishBlocks path is
+                        // left UNCHANGED for strict-native mode (getBytes only, no bytes, so
+                        // no putKnown* through the wrapper). Returning the promise here prevents
+                        // lower-log index/head/trim publication until the mirror settles.
+                        if (!committedHash) {
+                            durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                            return rollbackCommitted(new Error("Native commit returned no entry CID to mirror"), []);
+                        }
+                        const committedBytes = backboneAppend.entry.bytes ?? backbone.blocks.get(committedHash);
+                        if (!committedBytes) {
+                            durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                            return rollbackCommitted(new Error(`Native committed block ${committedHash} is missing from the hot store`), [committedHash]);
+                        }
+                        return durableWrapper
+                            .mirrorToDurable(committedHash, committedBytes, {
+                            nativeTrimmed: nativeTrimmedHashes.includes(committedHash),
+                        })
+                            .then((nativeCommitOwnershipToken) => ({
+                            ...preparedResult,
+                            nativeCommitOwnershipToken,
+                        }), (error) => {
+                            durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                            return rollbackCommitted(error, [committedHash]);
+                        });
+                    }
+                    if (durableWrapper) {
+                        durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                        return rollbackCommitted(new Error("Native durable block wrapper has no mirror method"), committedHash ? [committedHash] : []);
+                    }
+                    return preparedResult;
                 };
                 const hasKnownNoNext = appendOptions.meta?.next != null &&
                     appendOptions.meta.next.length === 0;
@@ -4611,19 +6550,62 @@ let SharedLog = (() => {
                     resolveTrimmedEntries: properties?.resolveTrimmedEntries,
                     skipMissingNextJoin: properties?.skipMissingNextJoin,
                     retainMaterializationBytes: this._logProperties?.trim != null,
+                    deferNativeTransactionAcknowledgement: true,
                 }, prepareBackboneAppend);
-                const directNoNextResult = hasKnownNoNext
-                    ? asTrustedLowerLog(this.log).appendLocallyPreparedNativeKnownNoNextCommitOnly(undefined, appendOptions, {
-                        payloadData,
-                        resolveTrimmedEntries: properties?.resolveTrimmedEntries,
-                        retainMaterializationBytes: this._logProperties?.trim != null,
-                    }, prepareBackboneAppend)
-                    : undefined;
-                const result = directNoNextResult === undefined
-                    ? appendGenericNativeCommit()
-                    : directNoNextResult;
-                return mapMaybePromise(result, (prepared) => {
+                const rollbackLowerPublication = async (error) => {
+                    durableWrapper?.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                    let compensated = !backboneAppend;
+                    if (backboneAppend && !(error instanceof NativeDurableCommitError)) {
+                        const committedHash = backboneAppend.entry.cid ?? backboneAppend.entry.hash;
+                        try {
+                            await this.rollbackFailedNativeBackboneTransaction({
+                                committedHashes: committedHash ? [committedHash] : [],
+                                coordinateEntries: nativeCoordinateRollback,
+                                documents: nativeDocumentRollback
+                                    ? [nativeDocumentRollback]
+                                    : undefined,
+                                skipBlockCompensation: true,
+                                restoreGraphFromIndex: true,
+                            });
+                            compensated = true;
+                        }
+                        catch {
+                            // Lower-log compensation already handled durable/native blocks.
+                            // Preserve the index publication error for this caller.
+                        }
+                    }
+                    if (compensated) {
+                        await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                    }
+                    else {
+                        this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                    }
+                    throw error;
+                };
+                let result;
+                try {
+                    const directNoNextResult = hasKnownNoNext
+                        ? asTrustedLowerLog(this.log).appendLocallyPreparedNativeKnownNoNextCommitOnly(undefined, appendOptions, {
+                            payloadData,
+                            resolveTrimmedEntries: properties?.resolveTrimmedEntries,
+                            retainMaterializationBytes: this._logProperties?.trim != null,
+                            deferNativeTransactionAcknowledgement: true,
+                        }, prepareBackboneAppend)
+                        : undefined;
+                    result =
+                        directNoNextResult === undefined
+                            ? appendGenericNativeCommit()
+                            : directNoNextResult;
+                    if (isPromiseLike(result)) {
+                        result = result.catch(rollbackLowerPublication);
+                    }
+                }
+                catch (error) {
+                    return rollbackLowerPublication(error);
+                }
+                return mapMaybePromise(result, async (prepared) => {
                     if (!prepared || !backboneAppend) {
+                        await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
                         return undefined;
                     }
                     const coordinateFields = this.createCoordinateFieldsFromNativePlanFacts({
@@ -4639,11 +6621,11 @@ let SharedLog = (() => {
                         fields: coordinateFields,
                     });
                     const plannedCoordinateDeleteHashes = combineCoordinateDeleteHashes(prepared.appendFacts.next, prepared.removedHashes ?? prepared.removed.map((entry) => entry.hash));
-                    const rollbackCoordinateEntries = this.snapshotResidentCoordinateEntries(plannedCoordinateDeleteHashes);
-                    const deferredCoordinateDeleteHashes = this.applyPreparedAppendFactsWithDeferredCoordinateDeletes(prepared.appendFacts, prepared.removed, prepared.materializeEntry, {
-                        forgetNativeCoordinates: false,
-                        removedHashes: prepared.removedHashes,
-                    });
+                    const rollbackCoordinateEntries = nativeCoordinateRollback ??
+                        this.snapshotResidentCoordinateEntries([
+                            prepared.appendFacts.hash,
+                            ...plannedCoordinateDeleteHashes,
+                        ]);
                     const finish = () => {
                         const appendCommit = this.createPreparedLocalAppendCommitFromFacts(prepared.appendFacts, {
                             hashNumber: backboneAppend.coordinate
@@ -4671,14 +6653,48 @@ let SharedLog = (() => {
                         };
                     };
                     const coordinateIndex = this.entryCoordinatesIndex;
-                    const rollback = (error) => {
-                        this.rollbackNativeBackboneCoordinateAppend(prepared.appendFacts.hash, rollbackCoordinateEntries);
-                        if (committedNativeBackboneDocumentIndex) {
-                            backbone.deleteDocument(committedNativeBackboneDocumentIndex.key);
+                    const rollback = async (error) => {
+                        const rollbackFailures = [];
+                        try {
+                            await this.markNativeStrictDurableTransactionRollback(nativeStrictTransaction);
+                        }
+                        catch (rollbackError) {
+                            const retentionFailures = this.retainNativeStrictDurableTransactionAfterMarkerFailure(nativeStrictTransaction, prepared.nativeCommittedAppendFinalizer, rollbackError);
+                            throw new AggregateError([error, ...retentionFailures], "Native rollback marker could not be persisted; recovery is required");
+                        }
+                        try {
+                            await prepared.nativeCommittedAppendFinalizer?.rollback();
+                        }
+                        catch (rollbackError) {
+                            rollbackFailures.push(rollbackError);
+                        }
+                        try {
+                            await this.rollbackNativeBackboneCoordinateAppendDurably(prepared.appendFacts.hash, rollbackCoordinateEntries);
+                        }
+                        catch (rollbackError) {
+                            rollbackFailures.push(rollbackError);
+                        }
+                        if (nativeDocumentRollback) {
+                            try {
+                                this.restoreNativeBackboneDocument(nativeDocumentRollback);
+                                const flushed = this.flushNativeBackboneCoordinateJournal();
+                                if (isPromiseLike(flushed)) {
+                                    await flushed;
+                                }
+                            }
+                            catch (rollbackError) {
+                                rollbackFailures.push(rollbackError);
+                            }
                         }
+                        if (rollbackFailures.length > 0) {
+                            this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                            throw new AggregateError([error, ...rollbackFailures], "Shared-log append and compensation both failed");
+                        }
+                        await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
                         throw error;
                     };
                     try {
+                        await this.setNativeStrictDurableTransactionExpectedRows(nativeStrictTransaction, [prepared.shallowEntry]);
                         const hasNativeCoordinatePut = this.canUseBackboneOnlyCoordinatePersistence() ||
                             coordinateIndex.putSharedLogCoordinateFieldsEncodedAndDeleteHashesNoReturn ||
                             coordinateIndex.putSharedLogCoordinateFieldsAndDeleteHashesNoReturn;
@@ -4687,7 +6703,7 @@ let SharedLog = (() => {
                                 coordinateIndex,
                                 fields: coordinateFields,
                                 hash: prepared.appendFacts.hash,
-                                deleteHashes: plannedCoordinateDeleteHashes,
+                                deleteHashes: [],
                                 coordinates: backboneAppend.coordinate
                                     .coordinates,
                                 skipGenericTransientCoordinateIndex: runtimeOnlyCoordinates,
@@ -4695,43 +6711,56 @@ let SharedLog = (() => {
                             : this.persistPreparedCoordinate({
                                 prepared: getPreparedCoordinate(),
                                 hash: prepared.appendFacts.hash,
-                                nextHashes: prepared.appendFacts.next,
-                                deleteHashes: deferredCoordinateDeleteHashes,
+                                nextHashes: [],
+                                deleteHashes: [],
                                 coordinates: backboneAppend.coordinate
                                     .coordinates,
                                 replicas: backboneAppend.coordinate.coordinates.length,
                                 commitNative: true,
                                 commitNativeBackbone: false,
                             });
-                        const completed = mapMaybePromise(persisted, () => {
-                            if (commitBlocksInBackbone &&
-                                !runtimeOnlyCoordinates &&
-                                this.remoteBlocks.hasNotifyStoredHook()) {
-                                this.remoteBlocks.notifyStoredDeferred(prepared.appendFacts.hash);
-                            }
-                            const delayAdaptiveRebalance = this.shouldDelayAdaptiveRebalance();
-                            if (!backboneAppend.isLeader && !delayAdaptiveRebalance) {
-                                const leaders = backboneAppend.leaders;
-                                if (leaders) {
-                                    const pruneEntry = this.materializePreparedCoordinateEntry(getPreparedCoordinate());
-                                    this.pruneDebouncedFnAddIfNotKeeping({
-                                        key: pruneEntry.hash,
-                                        value: { entry: pruneEntry, leaders },
-                                    });
-                                }
-                            }
-                            if (!delayAdaptiveRebalance) {
-                                this.rebalanceParticipationDebounced?.call();
-                            }
-                            return finish();
-                        });
-                        return isPromiseLike(completed)
-                            ? completed.catch((error) => rollback(error))
-                            : completed;
+                        if (isPromiseLike(persisted)) {
+                            await persisted;
+                        }
+                        if (!prepared.nativeCommittedAppendFinalizer) {
+                            throw new Error("Missing deferred native append finalizer");
+                        }
+                        await this.flushNativeBackboneCoordinateJournal();
+                        await prepared.nativeCommittedAppendFinalizer.acknowledge(() => this.markNativeStrictDurableTransactionLowerMarker(nativeStrictTransaction));
                     }
                     catch (error) {
                         return rollback(error);
                     }
+                    this.applyPreparedAppendFactsWithDeferredCoordinateDeletes(prepared.appendFacts, prepared.removed, prepared.materializeEntry, {
+                        forgetNativeCoordinates: false,
+                        removedHashes: prepared.removedHashes,
+                    });
+                    try {
+                        await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                    }
+                    catch (error) {
+                        warn(`Failed to retire committed native intent: ${String(error)}`);
+                    }
+                    if (commitBlocksInBackbone &&
+                        !runtimeOnlyCoordinates &&
+                        this.remoteBlocks.hasNotifyStoredHook()) {
+                        this.remoteBlocks.notifyStoredDeferred(prepared.appendFacts.hash);
+                    }
+                    const delayAdaptiveRebalance = this.shouldDelayAdaptiveRebalance();
+                    if (!backboneAppend.isLeader && !delayAdaptiveRebalance) {
+                        const leaders = backboneAppend.leaders;
+                        if (leaders) {
+                            const pruneEntry = this.materializePreparedCoordinateEntry(getPreparedCoordinate());
+                            this.pruneDebouncedFnAddIfNotKeeping({
+                                key: pruneEntry.hash,
+                                value: { entry: pruneEntry, leaders },
+                            });
+                        }
+                    }
+                    if (!delayAdaptiveRebalance) {
+                        this.rebalanceParticipationDebounced?.call();
+                    }
+                    return finish();
                 });
             });
         }
@@ -4985,16 +7014,27 @@ let SharedLog = (() => {
             const context = await this.createLeaderSelectionContext();
             const nativeLeaderOptions = this.createNativeLeaderOptions(context);
             let backboneAppends;
-            const appended = await asTrustedLowerLog(this.log).appendLocallyPreparedNativeKnownNoNextCommitOnlyBatch(data, appendOptions, {
-                payloadDatas,
-                resolveTrimmedEntries: properties?.resolveTrimmedEntries,
-                allowPreparedNexts: usesLatestDocumentContext,
-                retainMaterializationBytes: properties?.retainMaterializationBytes === true ||
-                    this._logProperties?.trim != null,
-            }, (inputs) => {
-                const documentDeleteTrimmedHeadsForAppend = deleteTrimmedHeads && inputs[0]?.trimLengthTo != null;
-                backboneAppends =
-                    usesLatestDocumentContext
+            let batchDocumentRollbacks = [];
+            let batchCoordinateRollback;
+            let nativeDeleteCleanupToken;
+            let nativeStrictTransaction;
+            let appended;
+            try {
+                appended = await asTrustedLowerLog(this.log).appendLocallyPreparedNativeKnownNoNextCommitOnlyBatch(data, appendOptions, {
+                    payloadDatas,
+                    resolveTrimmedEntries: properties?.resolveTrimmedEntries,
+                    allowPreparedNexts: usesLatestDocumentContext,
+                    retainMaterializationBytes: properties?.retainMaterializationBytes === true ||
+                        this._logProperties?.trim != null,
+                    deferNativeTransactionAcknowledgement: true,
+                }, async (inputs) => {
+                    batchDocumentRollbacks = documentIndexes
+                        .map((index) => this.snapshotNativeBackboneDocument(index))
+                        .filter((value) => !!value);
+                    nativeStrictTransaction =
+                        await this.beginNativeStrictDurableTransaction(batchDocumentRollbacks);
+                    const documentDeleteTrimmedHeadsForAppend = deleteTrimmedHeads && inputs[0]?.trimLengthTo != null;
+                    backboneAppends = usesLatestDocumentContext
                         ? backbone.preparePlainCommittedStorageAppendDocumentIndexLatestBatchTransaction({
                             entries: inputs.map((input, index) => ({
                                 wallTime: input.wallTime,
@@ -5034,72 +7074,294 @@ let SharedLog = (() => {
                             documentDeleteTrimmedHeads: documentDeleteTrimmedHeadsForAppend,
                             trimLengthTo: inputs[0]?.trimLengthTo,
                         });
-                return backboneAppends?.map((append) => ({
-                    cid: append.entry.hash,
-                    hash: append.entry.hash,
-                    gid: append.coordinate.gid,
-                    next: append.entry.next,
-                    bytes: append.entry.bytes,
-                    byteLength: append.entry.byteLength,
-                    metaBytes: append.entry.metaBytes,
-                    hashDigestBytes: append.entry.hashDigestBytes,
-                    getBytes: (hash) => backbone.blocks.get(hash),
-                    trimmedEntryHashes: append.trimmedHashes,
-                    documentTrimmedHeadsProcessed: append.documentTrimmedHeadsProcessed,
-                    documentPreviousContext: append.documentPreviousContext,
-                }));
-            });
+                    if (!backboneAppends) {
+                        await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                        return undefined;
+                    }
+                    const committedAppends = backboneAppends;
+                    const committedCids = committedAppends
+                        .map((append) => append.entry.cid ?? append.entry.hash)
+                        .filter((cid) => !!cid);
+                    const nativeTrimmedHashSet = new Set(committedAppends.flatMap((append) => append.trimmedHashes ??
+                        append.trimmed.map((entry) => entry.hash)));
+                    const nativeTrimmedHashes = [...nativeTrimmedHashSet];
+                    batchCoordinateRollback = this.snapshotResidentCoordinateEntries(committedAppends.flatMap((append) => [
+                        ...((append.entry.cid ?? append.entry.hash)
+                            ? [append.entry.cid ?? append.entry.hash]
+                            : []),
+                        ...append.entry.next,
+                        ...(append.trimmedHashes ??
+                            append.trimmed.map((entry) => entry.hash)),
+                    ]));
+                    await this.setNativeStrictDurableTransactionOperation(nativeStrictTransaction, committedCids, nativeTrimmedHashes, batchCoordinateRollback, committedAppends.flatMap((append) => [
+                        ...append.entry.next,
+                        ...(append.trimmedHashes ??
+                            append.trimmed.map((entry) => entry.hash)),
+                    ]));
+                    const rollbackCommitted = async (cause) => {
+                        durableWrapper?.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                        let compensated = false;
+                        try {
+                            await this.rollbackFailedNativeBackboneTransaction({
+                                committedHashes: committedCids,
+                                trimmedEntries: committedAppends.flatMap((append) => append.trimmed),
+                                coordinateEntries: batchCoordinateRollback,
+                                documents: batchDocumentRollbacks,
+                                durableWrapper,
+                            });
+                            compensated = true;
+                        }
+                        catch {
+                            // close/reopen completes recovery if durable compensation failed
+                        }
+                        if (compensated) {
+                            await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                        }
+                        else {
+                            this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                        }
+                        return this.failNativeDurableCommit(cause, {
+                            committedCids,
+                            failedCids: committedCids,
+                        });
+                    };
+                    if (durableWrapper &&
+                        nativeTrimmedHashes.length > 0 &&
+                        !durableWrapper.beginNativeDeleteCleanup) {
+                        return rollbackCommitted(new Error("Native durable block wrapper cannot preannounce trim cleanup"));
+                    }
+                    nativeDeleteCleanupToken =
+                        durableWrapper?.beginNativeDeleteCleanup?.(nativeTrimmedHashes);
+                    const preparedRows = committedAppends.map((append) => ({
+                        cid: append.entry.hash,
+                        hash: append.entry.hash,
+                        gid: append.coordinate.gid,
+                        next: append.entry.next,
+                        bytes: append.entry.bytes,
+                        byteLength: append.entry.byteLength,
+                        metaBytes: append.entry.metaBytes,
+                        hashDigestBytes: append.entry.hashDigestBytes,
+                        getBytes: (hash) => backbone.blocks.get(hash),
+                        nativeIndexMutationLockOwner: nativeStrictTransaction?.lowerHashMutationLockOwner,
+                        trimmedEntryHashes: append.trimmedHashes,
+                        nativeBlocksDeleted: true,
+                        nativeDeleteCleanupToken,
+                        documentTrimmedHeadsProcessed: append.documentTrimmedHeadsProcessed,
+                        documentPreviousContext: append.documentPreviousContext,
+                    }));
+                    if (!durableWrapper) {
+                        return preparedRows;
+                    }
+                    if (!durableWrapper.mirrorManyToDurable) {
+                        durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                        return rollbackCommitted(new Error("Native durable block wrapper has no batch mirror method"));
+                    }
+                    const durableMirrorBlocks = [];
+                    const missingCommittedCids = [];
+                    let missingCommittedHash = false;
+                    for (const backboneAppend of committedAppends) {
+                        const committedHash = backboneAppend.entry.cid ?? backboneAppend.entry.hash;
+                        if (!committedHash) {
+                            missingCommittedHash = true;
+                            continue;
+                        }
+                        // Earlier rows can be trimmed by later rows in this one native batch.
+                        // The native result retains their bytes even though the final hot map
+                        // no longer does; mirror those bytes, then let the explicit trim cleanup
+                        // remove the durable copy.
+                        const committedBytes = backboneAppend.entry.bytes ?? backbone.blocks.get(committedHash);
+                        if (!committedBytes) {
+                            missingCommittedCids.push(committedHash);
+                            continue;
+                        }
+                        durableMirrorBlocks.push([committedHash, committedBytes]);
+                    }
+                    // One strict putKnownMany WAL mutation gives the whole native batch one
+                    // durability barrier instead of issuing and fsyncing one record per row.
+                    const durableMirror = durableMirrorBlocks.length > 0
+                        ? durableWrapper.mirrorManyToDurable(durableMirrorBlocks, {
+                            nativeTrimmedCids: nativeTrimmedHashSet,
+                        })
+                        : Promise.resolve();
+                    return Promise.allSettled([durableMirror]).then(async (settled) => {
+                        const rejected = settled[0]?.status === "rejected"
+                            ? settled[0].reason
+                            : undefined;
+                        if (missingCommittedHash ||
+                            missingCommittedCids.length > 0 ||
+                            rejected !== undefined) {
+                            durableWrapper.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                            const cause = rejected === undefined
+                                ? new Error(missingCommittedHash
+                                    ? "Native batch commit returned an entry with no CID to mirror"
+                                    : `Native committed blocks are missing from the hot store: ${missingCommittedCids.join(", ")}`)
+                                : rejected;
+                            const rejectedCids = cause instanceof NativeDurableCommitError
+                                ? cause.failedCids.filter((cid) => committedCids.includes(cid))
+                                : durableMirrorBlocks.map(([cid]) => cid);
+                            if (cause instanceof NativeDurableCommitError) {
+                                cause.addCommitContext({
+                                    committedCids,
+                                    failedCids: [...missingCommittedCids, ...rejectedCids],
+                                });
+                            }
+                            return rollbackCommitted(cause);
+                        }
+                        const nativeCommitOwnershipToken = settled[0]?.status === "fulfilled" ? settled[0].value : undefined;
+                        return preparedRows.map((row) => ({
+                            ...row,
+                            nativeCommitOwnershipToken,
+                        }));
+                    });
+                });
+            }
+            catch (error) {
+                durableWrapper?.cancelNativeDeleteCleanup?.(nativeDeleteCleanupToken);
+                let compensated = !backboneAppends;
+                if (backboneAppends && !(error instanceof NativeDurableCommitError)) {
+                    try {
+                        await this.rollbackFailedNativeBackboneTransaction({
+                            committedHashes: backboneAppends
+                                .map((append) => append.entry.cid ?? append.entry.hash)
+                                .filter((hash) => !!hash),
+                            coordinateEntries: batchCoordinateRollback,
+                            documents: batchDocumentRollbacks,
+                            skipBlockCompensation: true,
+                            restoreGraphFromIndex: true,
+                        });
+                        compensated = true;
+                    }
+                    catch {
+                        // Preserve the lower index publication failure.
+                    }
+                }
+                if (!(error instanceof NativeDurableCommitError)) {
+                    if (compensated) {
+                        await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                    }
+                    else {
+                        this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                    }
+                }
+                throw error;
+            }
             if (!appended || !backboneAppends) {
+                await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
                 return undefined;
             }
-            const appendCommits = [];
             const runtimeOnlyCoordinates = options?.replicate === false;
-            for (let i = 0; i < appended.appendFacts.length; i++) {
-                const facts = appended.appendFacts[i];
-                const backboneAppend = backboneAppends[i];
-                if (durableWrapper?.mirrorToDurable) {
-                    // The batch prepare committed each block into the wasm map; the log's
-                    // finishBlocks path is left unchanged (getBytes only) to preserve
-                    // strict-native mode, so mirror the committed block straight to durable
-                    // so a non-replicating native node keeps it across a restart. Tracked
-                    // for error-surfacing by mirrorToDurable.
-                    const committedHash = backboneAppend.entry.cid ?? backboneAppend.entry.hash;
-                    const committedBytes = committedHash
-                        ? backbone.blocks.get(committedHash)
-                        : undefined;
-                    if (committedBytes) {
-                        durableWrapper.mirrorToDurable(committedHash, committedBytes);
+            const rollbackBatch = async (error) => {
+                const rollbackFailures = [];
+                try {
+                    await this.markNativeStrictDurableTransactionRollback(nativeStrictTransaction);
+                }
+                catch (rollbackError) {
+                    const retentionFailures = this.retainNativeStrictDurableTransactionAfterMarkerFailure(nativeStrictTransaction, appended.nativeCommittedAppendFinalizer, rollbackError);
+                    throw new AggregateError([error, ...retentionFailures], "Native rollback marker could not be persisted; recovery is required");
+                }
+                try {
+                    await appended.nativeCommittedAppendFinalizer?.rollback();
+                }
+                catch (rollbackError) {
+                    rollbackFailures.push(rollbackError);
+                }
+                try {
+                    await this.rollbackNativeBackboneCoordinateAppendDurably(appended.appendFacts[0]?.hash ?? "", batchCoordinateRollback);
+                }
+                catch (rollbackError) {
+                    rollbackFailures.push(rollbackError);
+                }
+                try {
+                    for (const document of batchDocumentRollbacks) {
+                        this.restoreNativeBackboneDocument(document);
+                    }
+                    const flushed = this.flushNativeBackboneCoordinateJournal();
+                    if (isPromiseLike(flushed)) {
+                        await flushed;
+                    }
+                }
+                catch (rollbackError) {
+                    rollbackFailures.push(rollbackError);
+                }
+                if (rollbackFailures.length > 0) {
+                    this.releaseNativeStrictDurableTransaction(nativeStrictTransaction);
+                    throw new AggregateError([error, ...rollbackFailures], "Shared-log append batch and compensation both failed");
+                }
+                await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+                throw error;
+            };
+            const coordinateRows = [];
+            try {
+                const batchExternalNextHashes = new Set(appended.appendFacts.flatMap((facts) => facts.next));
+                await this.setNativeStrictDurableTransactionExpectedRows(nativeStrictTransaction, appended.appendFacts.map((facts) => new ShallowEntry({
+                    hash: facts.hash,
+                    payloadSize: facts.payloadSize,
+                    head: !batchExternalNextHashes.has(facts.hash),
+                    meta: new ShallowMeta({
+                        gid: facts.gid,
+                        clock: new LamportClock({
+                            id: facts.clockId ?? this.node.identity.publicKey.bytes,
+                            timestamp: new Timestamp({
+                                wallTime: facts.wallTime,
+                                logical: facts.logical,
+                            }),
+                        }),
+                        data: facts.metaData,
+                        next: facts.next,
+                        type: facts.type ?? EntryType.APPEND,
+                    }),
+                })));
+                for (let i = 0; i < appended.appendFacts.length; i++) {
+                    const facts = appended.appendFacts[i];
+                    const backboneAppend = backboneAppends[i];
+                    const coordinateFields = this.createCoordinateFieldsFromNativePlanFacts({
+                        appendFacts: facts,
+                        plan: backboneAppend.coordinate,
+                    });
+                    if (!coordinateFields) {
+                        throw new Error("Native backbone batch append transaction returned mismatched coordinate facts");
+                    }
+                    const plannedCoordinateDeleteHashes = combineCoordinateDeleteHashes(facts.next, backboneAppend.trimmedHashes ?? []);
+                    coordinateRows.push({
+                        facts,
+                        backboneAppend,
+                        coordinateFields,
+                        plannedCoordinateDeleteHashes,
+                    });
+                    const persisted = this.persistBackboneCoordinateFieldsNativeTransaction({
+                        coordinateIndex: this.entryCoordinatesIndex,
+                        fields: coordinateFields,
+                        hash: facts.hash,
+                        deleteHashes: [],
+                        coordinates: backboneAppend.coordinate
+                            .coordinates,
+                        skipGenericTransientCoordinateIndex: runtimeOnlyCoordinates,
+                    });
+                    if (isPromiseLike(persisted)) {
+                        await persisted;
                     }
                 }
-                const coordinateFields = this.createCoordinateFieldsFromNativePlanFacts({
-                    appendFacts: facts,
-                    plan: backboneAppend.coordinate,
-                });
-                if (!coordinateFields) {
-                    throw new Error("Native backbone batch append transaction returned mismatched coordinate facts");
+                if (!appended.nativeCommittedAppendFinalizer) {
+                    throw new Error("Missing deferred native append batch finalizer");
                 }
-                const plannedCoordinateDeleteHashes = combineCoordinateDeleteHashes(facts.next, backboneAppend.trimmedHashes ?? []);
+                await this.flushNativeBackboneCoordinateJournal();
+                await appended.nativeCommittedAppendFinalizer.acknowledge(() => this.markNativeStrictDurableTransactionLowerMarker(nativeStrictTransaction));
+            }
+            catch (error) {
+                return rollbackBatch(error);
+            }
+            const appendCommits = [];
+            for (let i = 0; i < coordinateRows.length; i++) {
+                const { facts, backboneAppend, coordinateFields, plannedCoordinateDeleteHashes, } = coordinateRows[i];
                 this.applyPreparedAppendFactsWithDeferredCoordinateDeletes(facts, [], appended.materializeEntries[i], {
                     forgetNativeCoordinates: false,
                     removedHashes: plannedCoordinateDeleteHashes,
                 });
-                const persisted = this.persistBackboneCoordinateFieldsNativeTransaction({
-                    coordinateIndex: this.entryCoordinatesIndex,
-                    fields: coordinateFields,
-                    hash: facts.hash,
-                    deleteHashes: plannedCoordinateDeleteHashes,
-                    coordinates: backboneAppend.coordinate.coordinates,
-                    skipGenericTransientCoordinateIndex: runtimeOnlyCoordinates,
-                });
-                if (isPromiseLike(persisted)) {
-                    await persisted;
-                }
                 if (!runtimeOnlyCoordinates && this.remoteBlocks.hasNotifyStoredHook()) {
                     this.remoteBlocks.notifyStoredDeferred(facts.hash);
                 }
                 const appendCommit = this.createPreparedLocalAppendCommitFromFacts(facts, {
-                    hashNumber: backboneAppend.coordinate
-                        .hashNumber,
+                    hashNumber: backboneAppend.coordinate.hashNumber,
                     coordinateFields,
                 });
                 appendCommit.nativeBackboneDocumentIndexCommitted = true;
@@ -5109,6 +7371,12 @@ let SharedLog = (() => {
                     backboneAppend.documentPreviousContext;
                 appendCommits.push(appendCommit);
             }
+            try {
+                await this.completeNativeStrictDurableTransaction(nativeStrictTransaction);
+            }
+            catch (error) {
+                warn(`Failed to retire committed native intent: ${String(error)}`);
+            }
             const delayAdaptiveRebalance = this.shouldDelayAdaptiveRebalance();
             if (!delayAdaptiveRebalance) {
                 this.rebalanceParticipationDebounced?.call();
@@ -5123,6 +7391,7 @@ let SharedLog = (() => {
             };
         }
         async appendLocallyPreparedManyIndependent(data, options, properties) {
+            this.throwIfNativeDurableCommitFailed();
             if (data.length === 0) {
                 return { entries: [], removed: [], appendCommits: [] };
             }
@@ -5204,6 +7473,7 @@ let SharedLog = (() => {
             });
         }
         async appendMany(data, options) {
+            this.throwIfNativeDurableCommitFailed();
             if (data.length === 0) {
                 return { entries: [], removed: [] };
             }
@@ -5838,6 +8108,9 @@ let SharedLog = (() => {
             return this.createPreparedLocalAppendCommits(entries, nativeAppendPlans);
         }
         async open(options) {
+            this.ensureNativeDurabilityRuntimeState();
+            this._nativeStrictDurableTransactionsClosing = false;
+            const recoveringNativeDurableFailure = this._nativeDurableCommitFailure !== undefined;
             options = applySharedLogNativeDefaults(options, this.node
                 .sharedLogNativeDefaults);
             this.replicas = {
@@ -5900,6 +8173,8 @@ let SharedLog = (() => {
             this._replicatorLivenessFailures = new Map();
             this._replicatorLastActivityAt = new Map();
             this._lastLocalAppendAt = 0;
+            this._replicationAnnouncementRetryPending = false;
+            this._replicationAnnouncementRetryGeneration = 0;
             const adaptiveReplicateOptions = options?.replicate && isAdaptiveReplicatorOption(options.replicate)
                 ? options.replicate
                 : undefined;
@@ -5937,6 +8212,7 @@ let SharedLog = (() => {
                 throw new Error("waitForReplicatorRequestMaxAttempts must be a positive number");
             }
             this._closeController = new AbortController();
+            this.setupReplicationAnnouncementRetryFunction();
             this._closeController.signal.addEventListener("abort", () => {
                 for (const [_peer, state] of this._replicationInfoRequestByPeer) {
                     if (state.timer)
@@ -6002,7 +8278,7 @@ let SharedLog = (() => {
             let localBlocks;
             if (this._nativeBackbone) {
                 if (this.node.directory != null) {
-                    const durable = new AnyBlockStore(await storage.sublevel("blocks"));
+                    const durable = await createNativeDurableBlockStore(storage);
                     localBlocks = new NativeBackboneWriteThroughBlockStore(this._nativeBackbone.blocks, durable);
                 }
                 else {
@@ -6010,7 +8286,7 @@ let SharedLog = (() => {
                 }
             }
             else {
-                localBlocks = new AnyBlockStore(await storage.sublevel("blocks"));
+                localBlocks = await createDefaultDurableBlockStore(storage);
             }
             this.remoteBlocks = new RemoteBlocks({
                 local: localBlocks,
@@ -6160,6 +8436,10 @@ let SharedLog = (() => {
                 };
             }, PRUNE_DEBOUNCE_INTERVAL);
             await remoteBlocksStartPromise;
+            // Failed native prepares can leave content-addressed bytes behind. Recovery
+            // deliberately preserves them: the reopened lower log is the liveness
+            // authority, while these unreachable bytes are safer than deleting a CID that
+            // may also belong to an acknowledged, restored, or concurrent operation.
             const useNativeBackboneBlocks = this._nativeBackbone && this._logProperties?.replicate === false;
             const nativeBackboneGraph = this._nativeBackbone
                 ? useNativeBackboneBlocks
@@ -6202,6 +8482,29 @@ let SharedLog = (() => {
                 },
                 indexer: logIndex,
             });
+            try {
+                const recovered = await this.recoverNativeStrictDurableTransactionIntent();
+                if (recovered) {
+                    await this.reconcileNativeCoordinatesWithLowerCommitMarkers();
+                }
+            }
+            catch (error) {
+                this.poisonNativeStrictDurableTransaction(error);
+                throw error;
+            }
+            // A fresh wrapper alone is not proof of recovery. Clear the cached poison
+            // only after the failed native transaction was compensated (or its pending
+            // native journals were deliberately discarded during close) and the lower log
+            // reopened successfully. Unreferenced content-addressed bytes are preserved;
+            // the reopened lower-log facts, not block presence, determine liveness.
+            if (localBlocks instanceof NativeBackboneWriteThroughBlockStore &&
+                !localBlocks.getNativeDurableCommitFailure() &&
+                (!recoveringNativeDurableFailure ||
+                    this._nativeDurableRecoveryReadyForReopen)) {
+                this._nativeDurableCommitFailure = undefined;
+                this._nativeDurableRecoveryReadyForReopen = false;
+                this._nativeDurableRecoveryCids.clear();
+            }
             const resolveHashesForSymbols = (symbols) => {
                 const nativeState = this._nativeBackbone ?? this._nativeSharedLogState;
                 if (!nativeState) {
@@ -6410,6 +8713,10 @@ let SharedLog = (() => {
                 await rangeIterator.close();
             }
             if (this._nativeBackboneCoordinatePersistence) {
+                // A previous explicit drop may have been interrupted after its durable
+                // tombstone was written. Complete that erase before the adapter can expose
+                // any stale coordinate or document state to this backbone.
+                await this._nativeBackboneCoordinatePersistence.resumeDrop?.();
                 await this._nativeBackboneCoordinatePersistence.hydrate(backbone);
                 this._nativeBackboneCoordinateJournalLastFlushMs = Date.now();
                 this.hydrateNativeCoordinateStateFromBackbone(backbone);
@@ -6437,6 +8744,58 @@ let SharedLog = (() => {
                 await iterator.close();
             }
         }
+        async reconcileNativeCoordinatesWithLowerCommitMarkers() {
+            if (!this._nativeBackbone) {
+                return;
+            }
+            const hashes = new Set(this._residentEntryCoordinatesByHash?.keys() ?? []);
+            const iterator = this.entryCoordinatesIndex.iterate({});
+            try {
+                for (;;) {
+                    const batch = await iterator.next(256);
+                    if (batch.length === 0) {
+                        break;
+                    }
+                    for (const result of batch) {
+                        hashes.add(result.value.hash);
+                    }
+                }
+            }
+            finally {
+                await iterator.close();
+            }
+            if (hashes.size === 0) {
+                return;
+            }
+            const committed = await this.log.entryIndex.hasMany(hashes);
+            const orphaned = [...hashes].filter((hash) => !committed.has(hash));
+            if (orphaned.length === 0) {
+                return;
+            }
+            const coordinateIndex = this.entryCoordinatesIndex;
+            if (coordinateIndex.delIdsNoReturn) {
+                await coordinateIndex.delIdsNoReturn(orphaned);
+            }
+            else if (coordinateIndex.delIds) {
+                await coordinateIndex.delIds(orphaned);
+            }
+            else {
+                await coordinateIndex.del({
+                    query: orphaned.length === 1
+                        ? { hash: orphaned[0] }
+                        : new Or(orphaned.map((hash) => new StringMatch({ key: "hash", value: hash }))),
+                });
+            }
+            for (const hash of orphaned) {
+                this._nativeBackbone.deleteEntryCoordinates(hash);
+                this._nativeSharedLogState?.deleteEntryCoordinates(hash);
+                this._residentEntryCoordinatesByHash?.delete(hash);
+            }
+            const flushed = this.flushNativeBackboneCoordinateJournal();
+            if (isPromiseLike(flushed)) {
+                await flushed;
+            }
+        }
         hydrateNativeCoordinateStateFromBackbone(backbone) {
             const fields = backbone.getEntryCoordinateFields();
             this._nativeSharedLogState?.clearEntryCoordinates();
@@ -6511,7 +8870,10 @@ let SharedLog = (() => {
         }
         async openNativeBackbone(options) {
             this._nativeBackboneCoordinatePersistence = undefined;
+            this._nativeBackboneCoordinatePersistenceStore = undefined;
+            this._nativeBackboneDropStarted = false;
             this._nativeBackboneCoordinateJournalLastFlushMs = 0;
+            this._nativeStrictDurableTransactionJournalState = undefined;
             if (!options) {
                 return undefined;
             }
@@ -6548,6 +8910,17 @@ let SharedLog = (() => {
                 // peer to re-derive from. Memory-only nodes (no directory) keep the
                 // previous in-memory behavior.
                 if (options.coordinatePersistence) {
+                    if ("store" in options.coordinatePersistence) {
+                        this._nativeBackboneCoordinatePersistenceStore =
+                            options.coordinatePersistence.store;
+                    }
+                    else if (options.coordinatePersistence.intentStore) {
+                        this._nativeBackboneCoordinatePersistenceStore =
+                            options.coordinatePersistence.intentStore;
+                    }
+                    else if (this.node.directory != null) {
+                        throw new Error("Durable nativeBackbone.coordinatePersistence adapters must expose intentStore");
+                    }
                     this._nativeBackboneCoordinatePersistence =
                         createNativeBackboneCoordinatePersistence(options.coordinatePersistence);
                 }
@@ -6555,6 +8928,24 @@ let SharedLog = (() => {
                     this._nativeBackboneCoordinatePersistence =
                         await this.createAutoDerivedCoordinatePersistence(nativeBackboneModule);
                 }
+                if (this.node.directory != null &&
+                    this._nativeBackboneCoordinatePersistence) {
+                    if (this._nativeBackboneCoordinatePersistence.durableBarrier !== true ||
+                        typeof this._nativeBackboneCoordinatePersistenceStore
+                            ?.durableBarrier !== "function") {
+                        throw new Error("Durable nativeBackbone coordinate persistence requires an explicit physical durability barrier");
+                    }
+                }
+                if (this._nativeBackboneCoordinatePersistence &&
+                    (this._nativeBackboneCoordinatePersistence.compactMaxJournalBytes !=
+                        null ||
+                        this._nativeBackboneCoordinatePersistence.compactMaxJournalRecords !=
+                            null) &&
+                    this._nativeBackboneCoordinatePersistence.crashSafeCompaction !== true) {
+                    // Durable custom adapters must explicitly advertise an atomic generation
+                    // protocol before SharedLog permits automatic WAL compaction.
+                    throw new Error("Durable native coordinate persistence compaction thresholds require crashSafeCompaction");
+                }
                 return backbone;
             }
             catch (error) {
@@ -6605,6 +8996,7 @@ let SharedLog = (() => {
                     directory: ["coordinates", namespace],
                 });
             }
+            this._nativeBackboneCoordinatePersistenceStore = store;
             return createNativeBackboneCoordinatePersistence({
                 store,
                 buffered: true,
@@ -7563,115 +9955,167 @@ let SharedLog = (() => {
                 throw error;
             }
         }
-        async _close() {
-            if (!this._entryCoordinatesIndex && !this._replicationRangeIndex) {
-                return;
-            }
-            if (this._wireSyncSession) {
-                this._wireSyncSession.unregisterTopic(this.topic);
-                this._wireSyncSession = undefined;
-            }
-            await this.closeNativeBackboneCoordinatePersistence();
-            await this.syncronizer?.close();
-            for (const [_key, peerMap] of this.pendingMaturity ?? []) {
-                for (const [_key2, info] of peerMap) {
-                    clearTimeout(info.timeout);
+        async _close(options) {
+            const preserveDropRetryResources = options?.preserveDropRetryResources === true;
+            let firstError;
+            const capture = async (operation) => {
+                try {
+                    await operation();
                 }
-            }
-            this.pendingMaturity?.clear();
-            this.distributeQueue?.clear();
-            this._closeFanoutChannel();
-            try {
-                this._providerHandle?.close();
-            }
-            catch {
-                // ignore
-            }
+                catch (error) {
+                    firstError ??= error;
+                }
+            };
+            const captureSync = (operation) => {
+                try {
+                    operation();
+                }
+                catch (error) {
+                    firstError ??= error;
+                }
+            };
+            captureSync(() => this.cancelCurrentReplicationStateAnnouncementRetry());
+            this.replicationAnnouncementRetryDebounced = undefined;
+            captureSync(() => {
+                if (this._wireSyncSession) {
+                    this._wireSyncSession.unregisterTopic(this.topic);
+                    this._wireSyncSession = undefined;
+                }
+            });
+            await capture(() => this.closeNativeBackboneCoordinatePersistence());
+            await capture(() => this.syncronizer?.close());
+            captureSync(() => {
+                for (const [_key, peerMap] of this.pendingMaturity ?? []) {
+                    for (const [_key2, info] of peerMap)
+                        clearTimeout(info.timeout);
+                }
+                this.pendingMaturity?.clear();
+                this.distributeQueue?.clear();
+            });
+            captureSync(() => this._closeFanoutChannel());
+            captureSync(() => this._providerHandle?.close());
             this._providerHandle = undefined;
-            this.coordinateToHash?.clear();
-            this.recentlyRebalanced?.clear();
-            this.uniqueReplicators?.clear();
-            this._topicSubscribersCache?.clear();
-            this._closeController.abort();
-            clearInterval(this.interval);
-            this.stopReplicatorLivenessSweep();
-            this.node.services.pubsub.removeEventListener("subscribe", this._onSubscriptionFn);
-            this.node.services.pubsub.removeEventListener("unsubscribe", this._onUnsubscriptionFn);
-            for (const timer of this._repairRetryTimers ?? []) {
-                clearTimeout(timer);
-            }
-            this._repairRetryTimers?.clear();
-            this._recentRepairDispatch?.clear();
-            this._repairSweepRunning = false;
-            this._repairSweepPendingModes?.clear();
-            for (const peers of this._repairSweepPendingPeersByMode?.values() ?? []) {
-                peers.clear();
-            }
-            this._repairSweepOptimisticGidPeersPending?.clear();
-            this._entryKnownPeers?.clear();
-            this._entryKnownPeerObservedAt?.clear();
-            this._nativeSharedLogState?.clearEntryKnownPeers();
-            this._nativeBackbone?.clearEntryKnownPeers();
-            for (const timer of this._joinAuthoritativeRepairTimersByDelay?.values() ??
-                []) {
-                clearTimeout(timer);
-            }
-            this._joinAuthoritativeRepairTimersByDelay?.clear();
-            this._joinAuthoritativeRepairPeersByDelay?.clear();
-            for (const targets of this._repairFrontierByMode?.values() ?? []) {
-                targets.clear();
-            }
-            for (const targets of this._repairFrontierActiveTargetsByMode?.values() ??
-                []) {
-                targets.clear();
-            }
-            for (const targets of this._repairFrontierBypassKnownPeersByMode?.values() ??
-                []) {
-                targets.clear();
-            }
-            if (this._appendBackfillTimer) {
-                clearTimeout(this._appendBackfillTimer);
-                this._appendBackfillTimer = undefined;
-            }
-            this._appendBackfillPendingByTarget?.clear();
-            for (const [_k, v] of this._pendingIHave ?? []) {
-                v.clear();
-            }
-            if (this._pendingIHaveExpiryTimer) {
-                clearTimeout(this._pendingIHaveExpiryTimer);
-                this._pendingIHaveExpiryTimer = undefined;
-                this._pendingIHaveExpiryDeadline = Number.POSITIVE_INFINITY;
-            }
-            this._checkedPrune.close();
-            await this.remoteBlocks?.stop?.();
-            this._pendingIHave?.clear();
-            this.latestReplicationInfoMessage?.clear();
-            this._gidPeersHistory?.clear();
-            this._peerSyncCapabilities?.clear();
-            this._liveRawGossipBatches?.clear();
-            this._nativeSharedLogState?.clearGidPeers();
-            this._nativeBackbone?.clearGidPeers();
-            // Cancel any pending debounced timers so they can't fire after we've torn down
-            // indexes/RPC state.
-            this.rebalanceParticipationDebounced?.close();
-            this.replicationChangeDebounceFn?.close?.();
-            this.pruneDebouncedFn?.close?.();
-            this.responseToPruneDebouncedFn?.close?.();
+            captureSync(() => {
+                this.coordinateToHash?.clear();
+                this.recentlyRebalanced?.clear();
+                this.uniqueReplicators?.clear();
+                this._topicSubscribersCache?.clear();
+                this._closeController.abort();
+                clearInterval(this.interval);
+                this.stopReplicatorLivenessSweep();
+            });
+            captureSync(() => this.node.services.pubsub.removeEventListener("subscribe", this._onSubscriptionFn));
+            captureSync(() => this.node.services.pubsub.removeEventListener("unsubscribe", this._onUnsubscriptionFn));
+            captureSync(() => {
+                for (const timer of this._repairRetryTimers ?? [])
+                    clearTimeout(timer);
+                this._repairRetryTimers?.clear();
+                this._recentRepairDispatch?.clear();
+                this._repairSweepRunning = false;
+                this._repairSweepPendingModes?.clear();
+                for (const peers of this._repairSweepPendingPeersByMode?.values() ?? [])
+                    peers.clear();
+                this._repairSweepOptimisticGidPeersPending?.clear();
+                this._entryKnownPeers?.clear();
+                this._entryKnownPeerObservedAt?.clear();
+                this._nativeSharedLogState?.clearEntryKnownPeers();
+                this._nativeBackbone?.clearEntryKnownPeers();
+                for (const timer of this._joinAuthoritativeRepairTimersByDelay?.values() ??
+                    [])
+                    clearTimeout(timer);
+                this._joinAuthoritativeRepairTimersByDelay?.clear();
+                this._joinAuthoritativeRepairPeersByDelay?.clear();
+                for (const targets of this._repairFrontierByMode?.values() ?? [])
+                    targets.clear();
+                for (const targets of this._repairFrontierActiveTargetsByMode?.values() ??
+                    [])
+                    targets.clear();
+                for (const targets of this._repairFrontierBypassKnownPeersByMode?.values() ??
+                    [])
+                    targets.clear();
+                if (this._appendBackfillTimer) {
+                    clearTimeout(this._appendBackfillTimer);
+                    this._appendBackfillTimer = undefined;
+                }
+                this._appendBackfillPendingByTarget?.clear();
+                for (const [_key, value] of this._pendingIHave ?? [])
+                    value.clear();
+                if (this._pendingIHaveExpiryTimer) {
+                    clearTimeout(this._pendingIHaveExpiryTimer);
+                    this._pendingIHaveExpiryTimer = undefined;
+                    this._pendingIHaveExpiryDeadline = Number.POSITIVE_INFINITY;
+                }
+            });
+            captureSync(() => this._checkedPrune.close());
+            if (!preserveDropRetryResources) {
+                await capture(() => this.remoteBlocks?.stop?.());
+            }
+            captureSync(() => {
+                this._pendingIHave?.clear();
+                this.latestReplicationInfoMessage?.clear();
+                this._gidPeersHistory?.clear();
+                this._peerSyncCapabilities?.clear();
+                this._liveRawGossipBatches?.clear();
+                this._nativeSharedLogState?.clearGidPeers();
+                this._nativeBackbone?.clearGidPeers();
+            });
+            // Cancel every debounce independently so one faulty close hook cannot keep
+            // the remaining timers or indexes alive.
+            captureSync(() => this.rebalanceParticipationDebounced?.close());
+            captureSync(() => this.replicationChangeDebounceFn?.close?.());
+            captureSync(() => this.pruneDebouncedFn?.close?.());
+            captureSync(() => this.responseToPruneDebouncedFn?.close?.());
             this.pruneDebouncedFn = undefined;
             this.rebalanceParticipationDebounced = undefined;
-            await Promise.all([
-                this._replicationRangeIndex?.stop?.(),
-                this._entryCoordinatesIndex?.stop?.(),
-            ]);
-            this._replicationRangeIndex = undefined;
-            this._entryCoordinatesIndex = undefined;
+            if (!preserveDropRetryResources) {
+                const stopIndex = async (index, forget) => {
+                    if (!index) {
+                        return;
+                    }
+                    try {
+                        await index.stop?.();
+                        forget();
+                    }
+                    catch (error) {
+                        firstError ??= error;
+                    }
+                };
+                await stopIndex(this._replicationRangeIndex, () => {
+                    this._replicationRangeIndex = undefined;
+                });
+                await stopIndex(this._entryCoordinatesIndex, () => {
+                    this._entryCoordinatesIndex = undefined;
+                });
+            }
             this._nativeRangePlanner = undefined;
             this._nativeSharedLogState = undefined;
             this._residentEntryCoordinatesByHash = undefined;
-            this.cpuUsage?.stop?.();
-            /* this._totalParticipation = 0; */
+            captureSync(() => this.cpuUsage?.stop?.());
+            if (firstError !== undefined) {
+                throw firstError;
+            }
+        }
+        classifyTerminalOwnership(from) {
+            if (this.closed) {
+                return "terminal";
+            }
+            const parentIndex = this.parents?.findIndex((parent) => parent === from) ?? -1;
+            if (from && parentIndex === -1) {
+                throw new TerminalOperationNotStartedError("Could not find from in parents");
+            }
+            return parentIndex !== -1 && (this.parents?.length ?? 0) > 1
+                ? "nonterminal"
+                : "terminal";
         }
         async close(from) {
+            if (this.classifyTerminalOwnership(from) === "nonterminal") {
+                return super.close(from);
+            }
+            // Match Program.end()'s synchronous terminal admission fence before any
+            // SharedLog-specific await or observable teardown can admit a new owner.
+            this.preventParentAttachments();
+            this.ensureNativeDurabilityRuntimeState();
+            this.cancelCurrentReplicationStateAnnouncementRetry();
             // Best-effort: announce that we are going offline before tearing down
             // RPC/subscription state.
             //
@@ -7724,15 +10168,71 @@ let SharedLog = (() => {
             catch {
                 // ignore: close should be resilient even if we were never fully started
             }
-            const superClosed = await super.close(from);
-            if (!superClosed) {
-                return superClosed;
+            let firstError;
+            let superClosed = false;
+            try {
+                superClosed = await super.close(from);
+            }
+            catch (error) {
+                if (!this.closed || this.pendingTerminalOperation !== "close") {
+                    // Child/base admission failed before Program committed this terminal
+                    // transition (including a cleanly closed instance). Lower resources are
+                    // still live data or belong to a completed generation, so do not mutate
+                    // them while merely propagating the base error.
+                    throw error;
+                }
+                firstError = error;
+            }
+            if (!superClosed && firstError === undefined) {
+                return false;
+            }
+            this._nativeStrictDurableTransactionsClosing = true;
+            let strictTransactionsSettled = false;
+            try {
+                await this.settleNativeStrictDurableTransactionsForClose();
+                strictTransactionsSettled = true;
+            }
+            catch (error) {
+                firstError ??= error;
+            }
+            if (!strictTransactionsSettled) {
+                throw firstError;
+            }
+            try {
+                await this.log.close();
+            }
+            catch (error) {
+                firstError ??= error;
+            }
+            try {
+                await this._close();
+            }
+            catch (error) {
+                firstError ??= error;
+            }
+            if (firstError !== undefined) {
+                throw firstError;
             }
-            await this._close();
-            await this.log.close();
             return true;
         }
         async drop(from) {
+            if (this.classifyTerminalOwnership(from) === "nonterminal") {
+                return super.drop(from);
+            }
+            this.ensureNativeDurabilityRuntimeState();
+            const nativePersistence = this._nativeBackboneCoordinatePersistence;
+            if (nativePersistence &&
+                (typeof nativePersistence.drop !== "function" ||
+                    typeof nativePersistence.resumeDrop !== "function" ||
+                    nativePersistence.supportsDrop !== true ||
+                    nativePersistence.dropIsTerminal !== true)) {
+                // Reject before `super.drop()` can drop child programs or any lower index.
+                throw new TerminalOperationNotStartedError("NativeBackbone coordinate persistence adapters must expose a terminal underlying drop capability and resumeDrop before SharedLog.drop() can erase their namespace");
+            }
+            // Adapter capability validation above is explicitly unstarted. Establish
+            // the terminal fence only after that precondition succeeds.
+            this.preventParentAttachments();
+            this.cancelCurrentReplicationStateAnnouncementRetry();
             // Best-effort: announce that we are going offline before tearing down
             // RPC/subscription state (same reasoning as in `close()`).
             try {
@@ -7769,14 +10269,132 @@ let SharedLog = (() => {
             catch {
                 // ignore: drop should be resilient even if we were never fully started
             }
-            const superDropped = await super.drop(from);
-            if (!superDropped) {
-                return superDropped;
+            let firstError;
+            let superDropped = false;
+            try {
+                superDropped = await super.drop(from);
+            }
+            catch (error) {
+                if (!this.closed || this.pendingTerminalOperation !== "drop") {
+                    // A fresh drop on a cleanly closed Program is an API rejection, not
+                    // permission to erase the already-closed lower log. Likewise, a child
+                    // failure before the base drop commits must leave all lower data intact.
+                    throw error;
+                }
+                firstError = error;
+            }
+            if (!superDropped && firstError === undefined) {
+                return false;
+            }
+            this._nativeStrictDurableTransactionsClosing = true;
+            const capture = async (operation) => {
+                try {
+                    await operation();
+                }
+                catch (error) {
+                    firstError ??= error;
+                }
+            };
+            let strictTransactionsSettled = false;
+            try {
+                await this.settleNativeStrictDurableTransactionsForClose();
+                strictTransactionsSettled = true;
+            }
+            catch (error) {
+                firstError ??= error;
+            }
+            if (!strictTransactionsSettled) {
+                throw firstError;
+            }
+            if (nativePersistence) {
+                try {
+                    const additionalFiles = this._nativeBackboneCoordinatePersistenceStore
+                        ? NATIVE_STRICT_DURABLE_TRANSACTION_INTENT_FILES
+                        : [];
+                    if (this._nativeBackboneDropStarted) {
+                        let resumed;
+                        try {
+                            resumed = await nativePersistence.resumeDrop();
+                        }
+                        catch (resumeError) {
+                            try {
+                                // A corrupt or partial tombstone deliberately restores the
+                                // adapter to active so explicit drop can overwrite it. For
+                                // transient read/remove failures the adapter stays dropping,
+                                // this fallback rejects, and the original recovery error wins.
+                                await nativePersistence.drop(additionalFiles);
+                                resumed = true;
+                            }
+                            catch (restartError) {
+                                throw new AggregateError([resumeError, restartError], "Failed to resume or restart native backbone drop");
+                            }
+                        }
+                        if (!resumed) {
+                            await nativePersistence.drop(additionalFiles);
+                        }
+                    }
+                    else {
+                        this._nativeBackboneDropStarted = true;
+                        await nativePersistence.drop(additionalFiles);
+                    }
+                }
+                catch (error) {
+                    firstError ??= error;
+                    // Quiesce the failed generation without closing the lower block/index
+                    // handles: exact drop retry still owns their destructive cleanup.
+                    await capture(() => this.log.close());
+                    await capture(() => this._close({ preserveDropRetryResources: true }));
+                    throw firstError;
+                }
+                // These in-memory states only stop being recovery-authoritative after all
+                // six persistence files and both alternating intent slots are durably gone.
+                this._nativeStrictDurableTransactionJournalState = undefined;
+                this._nativeStrictDurableDocumentRecoveryDeferred = false;
+                this._nativeStrictDurableTransactionTail = undefined;
+                this._nativeStrictDurableTransactions?.clear();
+                this.clearNativeStrictDurableTransactionFailure();
+                this._nativeDurableCommitFailure = undefined;
+                this._nativeDurableRecoveryReadyForReopen = false;
+                this._nativeDurableRecoveryCids.clear();
+            }
+            let destructiveCleanupFailed = false;
+            const dropIndex = async (index, forget) => {
+                if (!index) {
+                    return;
+                }
+                try {
+                    await index.drop();
+                    forget();
+                }
+                catch (error) {
+                    firstError ??= error;
+                    destructiveCleanupFailed = true;
+                }
+            };
+            await dropIndex(this._entryCoordinatesIndex, () => {
+                this._entryCoordinatesIndex = undefined;
+            });
+            await dropIndex(this._replicationRangeIndex, () => {
+                this._replicationRangeIndex = undefined;
+            });
+            try {
+                await this.log.drop();
+            }
+            catch (error) {
+                firstError ??= error;
+                destructiveCleanupFailed = true;
+            }
+            if (destructiveCleanupFailed) {
+                // Exact drop retry still owns every failed destructive handle. Quiesce
+                // the rest of the generation without turning an erase failure into a
+                // successful close or forgetting the only object that can retry it.
+                await capture(() => this._close({ preserveDropRetryResources: true }));
+                throw firstError;
+            }
+            await capture(() => this._close());
+            if (firstError !== undefined) {
+                throw firstError;
             }
-            await this._entryCoordinatesIndex.drop();
-            await this._replicationRangeIndex.drop();
-            await this.log.drop();
-            await this._close();
             return true;
         }
         async recover() {
@@ -7825,6 +10443,7 @@ let SharedLog = (() => {
                 ? msg
                 : undefined;
             try {
+                this.throwIfNativeDurableCommitFailed();
                 if (!context.from) {
                     throw new Error("Missing from in update role message");
                 }
@@ -7932,8 +10551,7 @@ let SharedLog = (() => {
                                 hashes,
                                 from: rawFrom,
                             });
-                        rawPreparedReceiveSelectionValue =
-                            await rawPreparedReceiveSelection;
+                        rawPreparedReceiveSelectionValue = await rawPreparedReceiveSelection;
                         return rawPreparedReceiveSelectionValue;
                     };
                     // Receive fusion: when this message was resolved from the wire
@@ -7995,8 +10613,7 @@ let SharedLog = (() => {
                                 if (!prepared) {
                                     return undefined;
                                 }
-                                rawPreparedReceiveSelectionValue =
-                                    prepared.selection;
+                                rawPreparedReceiveSelectionValue = prepared.selection;
                                 rawPreparedReceiveSelection = Promise.resolve(rawPreparedReceiveSelectionValue);
                                 return { columns: prepared.columns };
                             }
@@ -8081,9 +10698,7 @@ let SharedLog = (() => {
                         ? msg.preparedHashes
                         : heads.map(getExchangeHeadHash);
                     const isRepairHint = (msg.reserved[0] & EXCHANGE_HEADS_REPAIR_HINT) !== 0;
-                    logger.trace(`${this.node.identity.publicKey.hashcode()}: Recieved heads: ${heads.length === 1
-                        ? headHashes[0]
-                        : "#" + heads.length}, logId: ${this.log.idString}`);
+                    logger.trace(`${this.node.identity.publicKey.hashcode()}: Recieved heads: ${heads.length === 1 ? headHashes[0] : "#" + heads.length}, logId: ${this.log.idString}`);
                     if (heads) {
                         let filteredHeads;
                         let filteredHeadHashes;
@@ -8196,8 +10811,7 @@ let SharedLog = (() => {
                                 maxReplicas: this.replicas.max?.getValue(this),
                             };
                             if (!isReplicating &&
-                                rawPreparedReceiveSelectionValue
-                                    ?.retainedGroupLeaderPlans &&
+                                rawPreparedReceiveSelectionValue?.retainedGroupLeaderPlans &&
                                 rawPreparedReceiveSelectionValue.retainedHashes.length ===
                                     filteredHeadHashes.length &&
                                 rawPreparedReceiveSelectionValue.retainedHashes.every((hash, index) => hash === filteredHeadHashes[index])) {
@@ -8217,8 +10831,7 @@ let SharedLog = (() => {
                                             this._nativeBackbone.planPreparedRawReceiveGroupAssignments?.(filteredHeadHashes, replicaOptions, nativeLeaderOptions, contextFromHash);
                                         if (nativeRawGroupAssignmentPlans &&
                                             !nativeRawGroupAssignmentPlans.every((plan) => {
-                                                const keepAsLeader = plan.isLeader ||
-                                                    (isRepairHint && plan.fromIsLeader);
+                                                const keepAsLeader = plan.isLeader || (isRepairHint && plan.fromIsLeader);
                                                 const canKeepWithoutWait = isReplicating
                                                     ? plan.isLeader
                                                     : keepAsLeader;
@@ -8494,8 +11107,7 @@ let SharedLog = (() => {
                         }
                         let usedNativeReceiveGroupLeaderPlans = false;
                         if (!isReplicating) {
-                            let leaderPlans = usedNativeRawGroupLeaderPlans ||
-                                usedNativeRawGroupAssignmentPlans
+                            let leaderPlans = usedNativeRawGroupLeaderPlans || usedNativeRawGroupAssignmentPlans
                                 ? receiveGroups.map((group) => group.leaderPlan)
                                 : usedNativeRawGroups && this._nativeBackbone
                                     ? await this.planNativeBackboneReceiveGroupLeaders(receiveGroups)
@@ -8673,8 +11285,7 @@ let SharedLog = (() => {
                             for (const group of receiveGroups) {
                                 const fromIsLeader = group.fromIsLeader ?? false;
                                 const keepAsLeader = group.isLeader === true || (isRepairHint && fromIsLeader);
-                                if (group.maxReplicasFromNewEntries <
-                                    group.maxReplicasFromHead) {
+                                if (group.maxReplicasFromNewEntries < group.maxReplicasFromHead) {
                                     canUseAllKeptNativeJoinPlan = false;
                                     break;
                                 }
@@ -8757,8 +11368,7 @@ let SharedLog = (() => {
                                         if (fromIsLeader) {
                                             this.addPeersToGidPeerHistory(group.gid, [contextFromHash]);
                                         }
-                                        if (group.maxReplicasFromNewEntries <
-                                            group.maxReplicasFromHead) {
+                                        if (group.maxReplicasFromNewEntries < group.maxReplicasFromHead) {
                                             (maybeDelete || (maybeDelete = [])).push(group.entries);
                                         }
                                     }
@@ -8801,7 +11411,8 @@ let SharedLog = (() => {
                                                     isLeader =
                                                         isLeader ||
                                                             this.node.identity.publicKey.hashcode() === key;
-                                                    fromIsLeader = fromIsLeader || contextFromHash === key;
+                                                    fromIsLeader =
+                                                        fromIsLeader || contextFromHash === key;
                                                 },
                                             });
                                         }
@@ -8977,10 +11588,7 @@ let SharedLog = (() => {
                                 this._pendingIHave.size === 0;
                             let mergeEntryByHash;
                             const materializeMergedEntry = (hash) => {
-                                mergeEntryByHash ??= new Map(allToMerge.map((entry) => [
-                                    getExchangeHeadHash(entry),
-                                    entry,
-                                ]));
+                                mergeEntryByHash ??= new Map(allToMerge.map((entry) => [getExchangeHeadHash(entry), entry]));
                                 const entryRef = mergeEntryByHash.get(hash);
                                 if (!entryRef) {
                                     throw new Error("Missing merged entry for appended hash");
@@ -9471,18 +12079,20 @@ let SharedLog = (() => {
                                 }
                             }
                             else {
-                                const gid = nativeEntryGid ?? nativeEntry?.gid ?? indexedEntry.value.meta.gid;
+                                const gid = nativeEntryGid ??
+                                    nativeEntry?.gid ??
+                                    indexedEntry.value.meta.gid;
                                 const replicaCountByIndex = nativeLeaderHints.replicaCountsByIndex?.[i];
                                 const replicas = replicaCountByIndex != null && replicaCountByIndex > 0
                                     ? replicaCountByIndex
-                                    : nativeLeaderHints.replicaCounts.get(hash) ??
+                                    : (nativeLeaderHints.replicaCounts.get(hash) ??
                                         decodeReplicas({
                                             meta: {
                                                 data: nativeEntryData ??
                                                     nativeEntry?.data ??
                                                     indexedEntry.value.meta.data,
                                             },
-                                        }).getValue(this);
+                                        }).getValue(this));
                                 if (!nativeLeaderHints.peerHistoryRemovedFlags?.[i] &&
                                     !nativeLeaderHints.peerHistoryRemovedHashes.has(hash)) {
                                     this.removePeerFromGidPeerHistory(from, gid);
@@ -9740,6 +12350,9 @@ let SharedLog = (() => {
                 }
             }
             catch (e) {
+                if (e instanceof NativeDurableCommitError) {
+                    throw e;
+                }
                 if (e instanceof AbortError ||
                     e instanceof NotStartedError ||
                     e instanceof IndexNotStartedError) {
@@ -9756,20 +12369,28 @@ let SharedLog = (() => {
                 logger.error(e);
             }
             finally {
-                if (stashBackedRawMessage && stashBackedRawMessage.release()) {
-                    const syncProfile = this._logProperties?.sync?.profile;
-                    if (syncProfile) {
-                        emitSyncProfileEvent(syncProfile, {
-                            name: "sharedLog.rawReceive.wireStashRelease",
-                            component: "shared-log",
-                            entries: stashBackedRawMessage.heads.length,
-                            messages: 1,
-                            details: {
-                                bytesMaterialized: stashBackedRawMessage.bytesMaterializedCount,
-                            },
-                        });
+                try {
+                    if (stashBackedRawMessage && stashBackedRawMessage.release()) {
+                        const syncProfile = this._logProperties?.sync?.profile;
+                        if (syncProfile) {
+                            emitSyncProfileEvent(syncProfile, {
+                                name: "sharedLog.rawReceive.wireStashRelease",
+                                component: "shared-log",
+                                entries: stashBackedRawMessage.heads.length,
+                                messages: 1,
+                                details: {
+                                    bytesMaterialized: stashBackedRawMessage.bytesMaterializedCount,
+                                },
+                            });
+                        }
                     }
                 }
+                finally {
+                    // Every return and every locally swallowed receive error passes this
+                    // boundary. Release a native wire stash exactly once first, then surface
+                    // any durable mutation poison that arose while handling the message.
+                    this.throwIfNativeDurableCommitFailed();
+                }
             }
         }
         async calculateTotalParticipation(options) {
@@ -9880,6 +12501,7 @@ let SharedLog = (() => {
             return set;
         }
         async join(entries, options) {
+            this.throwIfNativeDurableCommitFailed();
             let entriesToReplicate = [];
             const localHashes = options?.replicate && this.log.length > 0
                 ? await this.log.entryIndex.hasMany(entries.map((element) => typeof element === "string" ? element : element.hash))
@@ -10007,9 +12629,7 @@ let SharedLog = (() => {
                     await persistCoordinate(entry);
                 }
                 if (messageToSend) {
-                    await this.rpc.send(messageToSend, {
-                        priority: CONVERGENCE_MESSAGE_PRIORITY,
-                    });
+                    await this.sendReplicationAnnouncement(messageToSend);
                 }
             }
         }
@@ -10431,7 +13051,8 @@ let SharedLog = (() => {
             const skipHashes = this._checkedPrune.pendingDeletes.size > 0
                 ? [...this._checkedPrune.pendingDeletes.keys()]
                 : [];
-            const nativeBackboneHintArrays = this._nativeBackbone;
+            const nativeBackboneHintArrays = this
+                ._nativeBackbone;
             if (skipHashes.length === 0) {
                 const allConfirmed = nativeBackboneHintArrays.planRequestPruneAllConfirmed?.(hashes, from, {
                     ...this.createNativeLeaderOptions(context),
@@ -10937,29 +13558,46 @@ let SharedLog = (() => {
             return materialized;
         }
         snapshotResidentCoordinateEntries(hashes) {
-            if (!this._residentEntryCoordinatesByHash) {
+            const uniqueHashes = new Set([...hashes].filter(Boolean));
+            if (uniqueHashes.size === 0) {
                 return undefined;
             }
-            const snapshot = new Map();
-            for (const hash of new Set([...hashes].filter(Boolean))) {
-                const entry = this._residentEntryCoordinatesByHash.get(hash);
+            const entries = new Map();
+            const generations = new Map();
+            const mutationGenerations = (this._nativeCoordinateMutationGenerations ??=
+                new Map());
+            for (const hash of uniqueHashes) {
+                const generation = (mutationGenerations.get(hash) ?? 0) + 1;
+                mutationGenerations.set(hash, generation);
+                generations.set(hash, generation);
+                const entry = this._residentEntryCoordinatesByHash?.get(hash);
                 if (entry) {
-                    snapshot.set(hash, entry);
+                    entries.set(hash, entry);
                 }
             }
-            return snapshot.size === 0 ? undefined : snapshot;
+            return { hashes: uniqueHashes, entries, generations };
         }
-        rollbackNativeBackboneCoordinateAppend(appendHash, previousEntries) {
+        rollbackNativeBackboneCoordinateAppend(appendHash, rollback) {
             const backbone = this._nativeBackbone;
             if (!backbone) {
                 return;
             }
-            backbone.deleteEntryCoordinates(appendHash);
-            this._residentEntryCoordinatesByHash?.delete(appendHash);
-            if (!previousEntries) {
-                return;
-            }
-            for (const [hash, entry] of previousEntries) {
+            const hashes = rollback?.hashes ?? new Set([appendHash]);
+            const mutationGenerations = (this._nativeCoordinateMutationGenerations ??=
+                new Map());
+            for (const hash of hashes) {
+                const expectedGeneration = rollback?.generations.get(hash);
+                if (expectedGeneration !== undefined &&
+                    mutationGenerations.get(hash) !== expectedGeneration) {
+                    continue;
+                }
+                backbone.deleteEntryCoordinates(hash);
+                this._nativeSharedLogState?.deleteEntryCoordinates(hash);
+                this._residentEntryCoordinatesByHash?.delete(hash);
+                const entry = rollback?.entries.get(hash);
+                if (!entry) {
+                    continue;
+                }
                 const fields = isEntryReplicated(entry)
                     ? {
                         hash: entry.hash,
@@ -10973,9 +13611,41 @@ let SharedLog = (() => {
                     ? decodeReplicas(entry).getValue(this)
                     : fields.coordinates.length;
                 backbone.putEntryCoordinates(fields.hash, fields.gid, fields.coordinates, fields.assignedToRangeBoundary, requestedReplicas, fields.hashNumber);
+                this._nativeSharedLogState?.putEntryCoordinates(fields.hash, fields.gid, fields.coordinates, fields.assignedToRangeBoundary, requestedReplicas, fields.hashNumber);
                 this._residentEntryCoordinatesByHash?.set(hash, entry);
             }
         }
+        async rollbackNativeBackboneCoordinateAppendDurably(appendHash, rollback) {
+            this.rollbackNativeBackboneCoordinateAppend(appendHash, rollback);
+            const coordinateIndex = this.entryCoordinatesIndex;
+            const hashes = rollback?.hashes ?? new Set([appendHash]);
+            const mutationGenerations = (this._nativeCoordinateMutationGenerations ??=
+                new Map());
+            for (const hash of hashes) {
+                const expectedGeneration = rollback?.generations.get(hash);
+                if (expectedGeneration !== undefined &&
+                    mutationGenerations.get(hash) !== expectedGeneration) {
+                    continue;
+                }
+                const previous = rollback?.entries.get(hash);
+                if (previous) {
+                    await coordinateIndex.put(this.materializeResidentCoordinateEntry(previous));
+                }
+                else if (coordinateIndex.delIds) {
+                    await coordinateIndex.delIds([hash]);
+                }
+                else if (coordinateIndex.delIdsNoReturn) {
+                    await coordinateIndex.delIdsNoReturn([hash]);
+                }
+                else {
+                    await coordinateIndex.del({ query: { hash } });
+                }
+            }
+            const flushed = this.flushNativeBackboneCoordinateJournal();
+            if (isPromiseLike(flushed)) {
+                await flushed;
+            }
+        }
         persistPreparedCoordinate(properties) {
             const { assignedToRangeBoundary, fields } = properties.prepared;
             const deleteHashes = combineCoordinateDeleteHashes(properties.nextHashes, properties.deleteHashes);
@@ -11112,7 +13782,12 @@ let SharedLog = (() => {
         flushNativeBackboneCoordinateJournal() {
             const backbone = this._nativeBackbone;
             const persistence = this._nativeBackboneCoordinatePersistence;
-            if (!backbone || !persistence) {
+            if (!backbone || !persistence || this._nativeBackboneDropStarted) {
+                return undefined;
+            }
+            if (backbone.coordinatePendingJournalLength === 0 &&
+                backbone.documentPendingJournalLength === 0 &&
+                backbone.documentSignerPendingJournalLength === 0) {
                 return undefined;
             }
             return mapMaybePromise(persistence.flushJournal(backbone), () => {
@@ -11123,7 +13798,7 @@ let SharedLog = (() => {
         flushNativeBackboneCoordinateJournalOnAppend() {
             const backbone = this._nativeBackbone;
             const persistence = this._nativeBackboneCoordinatePersistence;
-            if (!backbone || !persistence) {
+            if (!backbone || !persistence || this._nativeBackboneDropStarted) {
                 return undefined;
             }
             if (persistence.flushJournalOnAppend) {
@@ -11163,6 +13838,23 @@ let SharedLog = (() => {
             if (!persistence) {
                 return;
             }
+            if (this._nativeBackboneDropStarted) {
+                // `drop()` owns the durable namespace lifecycle. Never flush the live wasm
+                // journals or invoke an ordinary custom close after its tombstone/erase has
+                // started: a close implementation that rewrites cached state could resurrect
+                // files after a successful terminal drop.
+                return;
+            }
+            if (this._nativeDurableCommitFailure &&
+                !this._nativeDurableRecoveryReadyForReopen) {
+                // The failed native transaction was never published by the lower log.
+                // Its coordinate/document/signer records are still only in the wasm
+                // pending journals. Closing without flushing discards that generation;
+                // the next backbone hydrates the last acknowledged checkpoint.
+                await persistence.close?.();
+                this._nativeDurableRecoveryReadyForReopen = true;
+                return;
+            }
             await this.flushNativeBackboneCoordinateJournal();
             await persistence.close?.();
         }
@@ -12012,6 +14704,9 @@ let SharedLog = (() => {
         async findFullReplicaLeaders(replicas, roleAge, peerFilter) {
             const now = Date.now();
             const leaders = new Map();
+            // Strict-only peers are not global fallbacks, but may still own an entry's
+            // coordinates. Remember them so a partial fallback cannot bypass sampling.
+            const excludedStrictPeers = new Set();
             const includeStrict = this._logProperties?.strictFullReplicaFallback !== false;
             const iterator = this.replicationIndex.iterate({}, { shape: { hash: true, timestamp: true, mode: true } });
             try {
@@ -12025,10 +14720,11 @@ let SharedLog = (() => {
                         if (peerFilter && !peerFilter.has(range.hash)) {
                             continue;
                         }
-                        if (!isMatured(range, now, roleAge)) {
+                        if (range.mode === ReplicationIntent.Strict && !includeStrict) {
+                            excludedStrictPeers.add(range.hash);
                             continue;
                         }
-                        if (range.mode === ReplicationIntent.Strict && !includeStrict) {
+                        if (!isMatured(range, now, roleAge)) {
                             continue;
                         }
                         leaders.set(range.hash, { intersecting: true });
@@ -12041,6 +14737,11 @@ let SharedLog = (() => {
             finally {
                 await iterator.close();
             }
+            for (const hash of excludedStrictPeers) {
+                if (!leaders.has(hash)) {
+                    return undefined;
+                }
+            }
             return leaders.size > 0 ? leaders : undefined;
         }
         async findEntryReplicatedLeaderBatch(entries, options) {
@@ -13074,10 +15775,19 @@ let SharedLog = (() => {
                         if (!canReplicate) {
                             return false;
                         }
-                        await this.startAnnounceReplicating([dynamicRange], {
-                            checkDuplicates: false,
-                            reset: false,
-                        });
+                        try {
+                            await this.startAnnounceReplicating([dynamicRange], {
+                                checkDuplicates: false,
+                                reset: false,
+                            });
+                        }
+                        catch (error) {
+                            if (isTransientReplicationAnnouncementError(error) &&
+                                this._replicationAnnouncementRetryPending) {
+                                return false;
+                            }
+                            throw error;
+                        }
                         /* await this._updateRole(newRole, onRoleChange); */
                         this.rebalanceParticipationDebounced?.call();
                         return true;