# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-happens-when-an-instance-acknowledges-a-task-commit-before-its-quorum-slice-has-durably-persisted-the-intent-log.md
# Remnant Warrant:    https://corpusfetch.com/c/what-happens-when-an-instance-acknowledges-a-task-commit-before-its-quorum-slice-has-durably-persisted-the-intent-log.warrant.json
# Markdown SHA-256:   53997f781ad334776c988824a8383e764ced2f3b73da48a47e2afa6440e32d2d
# Code AST SHA-256:   bf7fcc971338ff12f896820390b33962303eeaecadf54ea725394dc533dd8d28
# Verified Classes:   UnbackedCommitAckError
# Defensive Guards:   2 fail-closed invariants (zero external deps)

class UnbackedCommitAckError(RuntimeError):
    """Raised when an external commit acknowledgement is emitted without a durable quorum."""
    pass


def emit_task_committed(
    task_id: str,
    vote_quorum_size: int,
    f: int,
    durable_fsync_acks: int,
    crosses_trust_boundary: bool,
) -> str:
    """
    Emit TASK_COMMITTED for task_id.

    Invariant: if the acknowledgement crosses a trust boundary, it must be
    backed by a durable write-quorum of 2f+1 fsynced replicas. Vote quorum
    (f+1) alone is sufficient only for internal signals.
    """
    required_votes = f + 1
    required_durable = 2 * f + 1

    if vote_quorum_size < required_votes:
        raise UnbackedCommitAckError(
            f"task {task_id}: vote quorum {vote_quorum_size} < required {required_votes}"
        )

    if crosses_trust_boundary and durable_fsync_acks < required_durable:
        raise UnbackedCommitAckError(
            f"task {task_id}: external ack attempted with only "
            f"{durable_fsync_acks} durable fsync acks; required {required_durable} "
            f"(vote quorum {vote_quorum_size} is insufficient across a trust boundary)"
        )

    return f"TASK_COMMITTED:{task_id}:durable={durable_fsync_acks}"