feat(ha-commit-durability): cap commit self-contribution at durable_lsn + durable-advance commit wake (task 2.2)

src/controller/testsuite/test_demotion_convergence.c

@@ -151,6 +151,11 @@ static void dc_setup(const char *suffix, int n_peers, int n_standbys,
     g_dc.persist.current_lsn = appended_lsn + 1;
     pthread_mutex_unlock(&g_dc.persist.lock);
     atomic_store(&g_dc.persist.committed_lsn, 0);
+    /* ha-commit-durability 2.2: self caps at durable_lsn. This fixture primes
+     * the WAL tip in-memory (no bytes written → the flusher can't advance
+     * durable_lsn itself), so mark the primed log durable up front to preserve
+     * the pre-durability "self covers every appended entry" commit model. */
+    atomic_store(&g_dc.persist.durable_lsn, appended_lsn);
 
     for (int i = 0; i < n_standbys; i++) {
         snprintf(name, sizeof(name), "dcsb%d", i);
@@ -570,6 +575,9 @@ static void rj_set_local_state(uint64_t tip_lsn, uint64_t committed)
     g_dc.persist.current_lsn = tip_lsn + 1;
     pthread_mutex_unlock(&g_dc.persist.lock);
     atomic_store(&g_dc.persist.committed_lsn, committed);
+    /* ha-commit-durability 2.2: keep durable_lsn at the primed tip so the
+     * commit-majority self-cap matches this in-memory-primed WAL state. */
+    atomic_store(&g_dc.persist.durable_lsn, tip_lsn);
 }
 
 /* Demote the fixture to STANDBY (the role rejoin reconciliation runs in) and