Merge certified origin floors into a replication source's seq row, apart from its applied cursors

[kriszyp]

⊙ Problem

A replication source can report, per origin, the highest log key it has durably applied (originCursors, #3080), but no field on the [seq, peer] row can hold a proof that resume may start somewhere: an applied position can sit above a transaction still open at the origin, since a log is appended in commit order, not key order. harper-pro#922 item 2 carries the origin-closed timestamp floor that #3085 certifies (no later append below it) between peers, and needs core to persist it in the same row, under the same commit ordering and blob rule as the cursors.

❓ Your call: Is a second field warranted rather than letting the certificate advance originLogKey? Yes: the two quantities answer different questions (applied position vs. proven closure), and folding a floor into the position would let a later data frame bury it; harper-pro's resume reads both and takes the max, and its item-4 admission will read the floor alone.

💡 Solution

An end_txn may now carry originFloors: [nodeId, closedFloor, relayable][], read by updateRecordedSequenceId only from a tagged stream that passes onFailure — a stored floor is what resume trusts, so core enforces for floors what it documents for cursors (admitsOriginFloors). It merges each entry by max into nodes[].closedFloor, skipping a floor that is not a positive finite number, records nodes[].relayable (whether the source received that origin directly with full table coverage, which is what lets a relay forward the floor; an equal floor can turn it on), and treats a floor-only end_txn like a cursor-only one: the row is written when a floor rose or a relayable flag turned on, and not otherwise. The outer dispatch gate admits an end_txn that carries only floors by the same admission check, so an idle connection's floor-only updates reach the row. resources/DESIGN.md records the field, the separation from originLogKey, and the held-stream and onFailure rules.

⚠️ Look hardest: the admission check is the one place a floor could enter the row without the apply loop being able to hold it back on a failed segment.

⚖️ Alternatives

❓ Your call: The pre-push adjudicator's do-less alternative — fold the floor into originCursors as max(position, key below floor) with no new field — was rejected: harper-pro uses a stored floor only while the peer still certifies (a downgraded peer may write below a floor it saved), and relay forwarding needs the relayable bit; neither survives the fold.

❓ Your call: A higher floor replaces relayable with its own flag rather than keeping the highest relayable floor as a separate field: a relay stops forwarding an origin whose newest floor arrived non-relayable, although the older relayable floor is still true. Changing this later means adding a row field.

❓ Your call: Floors are merged only from a tagged stream that passes onFailure (round-1 finding): core enforces for floors what it only documents for cursors, because a stored floor is what resume trusts. A source without the tag gets its floors ignored rather than a failure.

❓ Your call: Two apply loops writing the same peer's seq row (the old and new worker during a handover) are a read-modify-write race that can overwrite a newer floor with an older certified one; seqId and originLogKey already share that shape, one apply loop serves a database per thread, and the next 5 s tick repairs it, so this PR keeps the inherited mechanism rather than making the three-field merge transactional.

✅ Verification

• unitTests/resources/replicationSeqCursor.test.js: a new case drives floor-only rises at an unchanged scalar (each writes), an equal floor whose relayable flag turns on (writes once), a lower floor, a repeated one, a stream without onFailure and a NaN floor (no write, checked after a later frame that does write), and a second origin, and asserts the data cursor is untouched — npx mocha unitTests/resources/replicationSeqCursor.test.js: 6 passing.
• npm run typecheck (harper-pro, which compiles this core): 0 errors; npm run check:design-docs: index complete, budgets met; oxlint clean on the touched files.
• End-to-end route: harper-pro's integrationTests/cluster/idleOriginFloorResume.test.mjs on the companion PR exercises this merge through a live A–B–C cluster (floors stored per origin on the [seq, peer] rows, read back through a fixture), 3/3 passing twice.

Refs harper-pro#922

_{🤖 Generated by Claude Fable 5.1; posted via @kriszyp.}

Related PRs: #3080 overlaps (the originCursors merge in updateRecordedSequenceId this extends), 1 other independent
Complexity: medium

_{Review-Coverage: authored=claude; ran=cursor-composer,gemini,codex; adjudicated=domain; declined=cursor-grok,cursor-kimi,cursor-muse; rounds=4; full=1 @ 7077108}

_{Review-Attention: study ~13m (critical: Table.ts; decisions: enforce-floors-document-cursors, relayable-follows-latest-floor, floors-in-seq-row, do-less-alternative) @ 7077108}

[gemini-code-assist]

Code Review

This pull request introduces support for merging certified origin floors apart from applied cursors during transaction replication, updating the design documentation, replication apply loop logic, and adding corresponding unit tests. The review feedback recommends enhancing robustness by explicitly verifying that originFloors is an array in the admitsOriginFloors helper, and adding defensive checks during the iteration of originFloors to prevent potential runtime TypeErrors from malformed entries.