Durability classes

A contract declares when its writes are acknowledged, in its front matter:

---
namespace: sam.social.like
version: 1.0.0
durability: buffered(100ms)
---

Class	Acknowledged when	Lost by a crash	For
`confirmed` (default)	On disk, by its own sync or a shared one	Nothing	Payments, stock, orders, approvals, identity, outward effects
`grouped`	On disk, after waiting up to 2 ms to share a sync	Nothing	Most business writes
`buffered(window)`	At once; on disk within the window	At most the last window	Likes, views, presence, conversation traces

The window is 1 ms to 10 s: buffered(100ms), buffered(2s). A buffered write's receipt says saved instead of confirmed. A stronger write carries every weaker one written before it.

What can never be buffered

The compiler refuses buffered when:

a word of the namespace names money (payment, payable, invoice, ledger, finance, wallet, checkout…), stock (stock, inventory, reservation, order, lot…), identity and authority (identity, root, credential, certificate, device, ownership, role, key…), approvals, outward effects (effect, outbox) or inbound messages (inbox);
any field or argument holds a Currency;
any action changes other records (requires).

Good to know

The class is not part of the artifact: changing it does not change the artifact id or fork any history. It is still a reviewed change of the contract's source.
On several voters (a cluster), buffered behaves as confirmed for now.
Measured on a single node: a buffered write about 1.6 ms, a confirmed one 5–8 ms, dominated by the disk sync.