feat(ha-commit-durability): publish durable floor from recovered WAL tip (task 3.4)

src/include/persist.h

@@ -307,6 +307,29 @@ int persist_flush(persist_t* p);
  * any thread. Returns 0 when nothing is yet durable. */
 uint64_t persist_durable_lsn(persist_t* p);
 
+/* Durable freshness floor (ha-commit-durability task 3.4, Req 2.3).
+ *
+ * The member's durably-backed last-log index (WAL tip): the highest LSN that
+ * is on stable storage locally. persist_recover re-derives it from the
+ * recovered WAL tip (the highest INTACT replayed LSN) so the post-recovery
+ * value is backed by durable on-disk state, NOT a volatile in-memory
+ * applied_lsn / last_known_committed_lsn. The Raft freshness gate (task 4.2,
+ * ha.c / cluster.c) consumes this so a truncated member cannot over-advertise
+ * a tip it does not durably hold.
+ *
+ * Precision: this is the durable LAST-LOG INDEX, NOT the commit position
+ * (committed_lsn). The post-election safe-commit point still comes from voter
+ * replies, never from this floor (CLAUDE.md). After a truncating restart the
+ * floor equals the lower intact tip, never a stale higher in-memory value and
+ * never the commit position.
+ *
+ * Thin wrapper over persist_durable_lsn: at and after recovery the durable
+ * watermark IS the recovered WAL tip (recovered on-disk entries are genuinely
+ * durable), so a separate field would be redundant. Lock-free atomic read;
+ * safe from any thread. Returns 0 when nothing is durable (empty first-boot
+ * WAL). */
+uint64_t persist_durable_floor(persist_t* p);
+
 /* Recovery-integrity verdict + flag (ha-commit-durability task 3.1, Req 2.1).
  * persist_recovery_verdict returns the RECOVER_CLEAN / RECOVER_TRUNCATED
  * verdict computed by the last persist_recover (RECOVER_CLEAN on a fresh