# Brief: ha-commit-barrier-rollout

> Sub-spec 2 of 4 implementing the **ha-consistency-invariants** umbrella contract.
> Authoritative requirements/design/research: `.kiro/specs/ha-consistency-invariants/` (design.md §Write-Path Classification + §Config Barrier + §Idempotency Guards). This brief scopes the slice; do not re-derive decisions.

## Problem
Only WAL_JOB_SUBMIT goes through a commit barrier. Job state changes, queue control, and worker control apply locally with fire-and-forget replication; job/queue control replies before any durability; config push ignores its majority-ACK result; worker-reported facts are silently lost on rejection (bug-396); `mark_job_*` have no idempotency guards.

## Desired Outcome
Every state-changing WAL type routed per the design's classification table: request-shaped → WAIT mode with **commit-first-then-reply** (validate → mutate provisional → append → commit_submit → reply); fact-shaped → RETAIN mode (log-is-the-queue, appended + retried until committed, no timeout, never dropped while running+leading). Config upgrade fails to the requester on missed majority. `mark_job_*` transitions are idempotent and ordered.

## Scope
- **In**: classification table + dispatch in `persist.c` (debug assert on unclassified types); reply-ordering sweep of all control handlers in `job.c` (incl. `do_jobcontrol_op`), queue and worker join/update paths; `handle_jobdispatch` classification (per design Reply-Ordering Contract); RETAIN routing for fact WAL types; `push_config_to_standbys` error propagation + caller failure; `mark_job_*` state-machine guards; integration tests (no success reply observable before commit; fact retention across quorum loss).
- **Out**: the commit engine itself (ha-commit-engine); promotion/COMMITTING (ha-single-leader-role); egress filter and demotion (ha-convergence-recovery); worker protocol changes (worker-rejoin-resync backlog).

## Requirements (umbrella IDs)
2.1 (all operation types), 2.2, 2.8, 5.1, 5.2, 5.3.

## Upstream / Downstream
- **Upstream**: ha-commit-engine (WAIT/RETAIN API).
- **Downstream**: ha-single-leader-role (must land after this — barrier before state removal); worker-rejoin-resync (shares idempotency guards).

## Constraints
Commit-first-then-reply is non-negotiable for request-shaped ops; a missed handler silently violates umbrella Req 2.1 — the sweep must be exhaustive (grep all xce_reply sites in control paths). Crash-loss of uncommitted facts accepted until worker-rejoin-resync lands.