@agentunion/fastaun-browser 0.5.19 → 0.5.20

package/dist/bundle.js

@@ -64,19 +64,18 @@ function p1363ToDer(p1363) {
   return der;
 }
 function derToP1363(der, coordLen = 32) {
-  if (der[0] !== 48) throw new Error("invalid DER signature: missing SEQUENCE");
+  if (der.length < 8 || der[0] !== 48 || der[1] > 127 || der[1] !== der.length - 2) throw new Error("invalid DER signature: invalid SEQUENCE");
   let offset = 2;
-  if (der[1] & 128) {
-    const lenBytes = der[1] & 127;
-    offset = 2 + lenBytes;
-  }
   if (der[offset] !== 2) throw new Error("invalid DER signature: missing r");
   const rLen = der[offset + 1];
   let r = der.slice(offset + 2, offset + 2 + rLen);
+  if (!rLen || rLen > 33 || offset + 2 + rLen > der.length) throw new Error("invalid DER signature: invalid r");
   offset += 2 + rLen;
   if (der[offset] !== 2) throw new Error("invalid DER signature: missing s");
   const sLen = der[offset + 1];
   let s = der.slice(offset + 2, offset + 2 + sLen);
+  if (!sLen || sLen > 33 || offset + 2 + sLen !== der.length) throw new Error("invalid DER signature: invalid s");
+  if (r.every((byte) => byte === 0) || s.every((byte) => byte === 0) || r[0] === 0 && r.length > 1 && !(r[1] & 128) || s[0] === 0 && s.length > 1 && !(s[1] & 128) || r[0] & 128 || s[0] & 128) throw new Error("invalid DER signature: non-canonical integer");
   while (r.length > 1 && r[0] === 0) r = r.slice(1);
   while (s.length > 1 && s[0] === 0) s = s.slice(1);
   if (r.length > coordLen || s.length > coordLen) {
@@ -460,7 +459,7 @@ var init_indexeddb_store = __esm({
 });
 
 // src/version.ts
-var VERSION = "0.5.19";
+var VERSION = "0.5.20";
 
 // src/types.ts
 var ConnectionState = /* @__PURE__ */ ((ConnectionState2) => {
@@ -828,7 +827,8 @@ var Subscription = class {
   }
 };
 var EventDispatcher = class {
-  constructor() {
+  constructor(_readStateIdentity = () => "") {
+    this._readStateIdentity = _readStateIdentity;
     __publicField(this, "_organizationEventIds", /* @__PURE__ */ new Set());
     __publicField(this, "_eventIdentity", "");
     __publicField(this, "_log", _noopLog);
@@ -841,6 +841,9 @@ var EventDispatcher = class {
   setEventIdentity(aid2) {
     this._eventIdentity = aid2;
   }
+  _identityScoped(event) {
+    return event === "read_state_sync" || event === "message.read_changed" || event === "group.read_changed" || event === "_raw.message.read_changed" || event === "_raw.group.read_changed";
+  }
   /**
    * 订阅事件，返回订阅句柄。
    *
@@ -898,7 +901,9 @@ var EventDispatcher = class {
       reject = fail;
     });
     const queuedPayload = cloneEventPayload(payload);
-    state.queue.push({ run: () => this.dispatchNow(state, event, queuedPayload, true), resolve, reject });
+    const identity = this._identityScoped(event) ? this._readStateIdentity() : null;
+    const guard = identity === null ? void 0 : () => this._readStateIdentity() === identity;
+    state.queue.push({ run: () => this.dispatchNow(state, event, queuedPayload, true, guard), resolve, reject, guard });
     if (state.drainPromise === null) {
       state.drainPromise = new Promise((done) => {
         state.drainResolve = done;
@@ -907,7 +912,7 @@ var EventDispatcher = class {
     this.scheduleDrain(state);
     await completed;
   }
-  async _publish(state, event, payload) {
+  async _publish(state, event, payload, guard) {
     if (state.closed || state.closing) return;
     if (state === this._app && (event.startsWith("org.member.") || event.startsWith("org.lifecycle.") || event.startsWith("credential.")) && payload && typeof payload === "object" && !Array.isArray(payload)) {
       const value = payload;
@@ -922,9 +927,12 @@ var EventDispatcher = class {
     const itemDone = new Promise((resolve) => {
       resolveItem = resolve;
     });
+    const identity = this._identityScoped(event) ? this._readStateIdentity() : null;
+    const effectiveGuard = guard ?? (identity === null ? void 0 : () => this._readStateIdentity() === identity);
     state.queue.push({
-      run: () => this.dispatchNow(state, event, payload),
-      resolve: resolveItem
+      run: () => this.dispatchNow(state, event, payload, false, effectiveGuard),
+      resolve: resolveItem,
+      guard: effectiveGuard
     });
     if (state.handlerDepth > 0) return;
     if (state.drainPromise === null) {
@@ -937,15 +945,15 @@ var EventDispatcher = class {
     await itemDone;
   }
   /** 将事件放入异步 FIFO 队列，不等待处理器执行完成。 */
-  enqueue(event, payload) {
-    this._enqueue(this._app, event, payload);
+  enqueue(event, payload, guard) {
+    this._enqueue(this._app, event, payload, guard);
   }
   /** 将协议事件放入独立异步 FIFO 队列，不等待处理器执行完成。 */
-  enqueueProtocol(event, payload) {
-    this._enqueue(this._protocol, event, payload);
+  enqueueProtocol(event, payload, guard) {
+    this._enqueue(this._protocol, event, payload, guard);
   }
-  _enqueue(state, event, payload) {
-    const publish = state === this._protocol ? this.publishProtocol(event, payload) : this.publish(event, payload);
+  _enqueue(state, event, payload, guard) {
+    const publish = guard !== void 0 ? this._publish(state, event, payload, guard) : state === this._protocol ? this.publishProtocol(event, payload) : this.publish(event, payload);
     void publish.catch((exc) => {
       this._log.warn(`event ${event} enqueue failed:`, exc);
     });
@@ -1020,7 +1028,7 @@ var EventDispatcher = class {
       while (state.queue.length > 0) {
         const item = state.queue.shift();
         try {
-          await item.run();
+          if (!item.guard || item.guard()) await item.run();
         } catch (exc) {
           this._log.warn("event dispatch failed:", exc);
           item.reject?.(exc);
@@ -1070,12 +1078,13 @@ var EventDispatcher = class {
       state.handlerDepth -= 1;
     }
   }
-  async dispatchNow(state, event, payload, strict = false) {
+  async dispatchNow(state, event, payload, strict = false, guard) {
     const handlers = [...state.handlers.get(event) ?? []];
     const applicationPayload = state === this._protocol && this._app.handlers.has(event) ? cloneEventPayload(payload) : void 0;
     let failed = false;
     let failure2;
     for (const handler of handlers) {
+      if (guard && !guard()) break;
       let result;
       state.handlerDepth += 1;
       try {
@@ -1101,7 +1110,7 @@ var EventDispatcher = class {
       }
     }
     if (applicationPayload !== void 0) {
-      this.enqueue(event, applicationPayload);
+      this._enqueue(this._app, event, applicationPayload, guard);
     }
     if (strict && failed) throw failure2;
   }
@@ -1434,6 +1443,292 @@ var PRIVATE_KEY_NOT_VALID = "PRIVATE_KEY_NOT_VALID";
 
 // src/cert-utils.ts
 init_crypto();
+var AGENT_MD_SIGNATURE_RE = /^<!-- AUN-SIGNATURE(?:-[A-Z0-9-]+)?(?:\r\n|\n|\r)(?<body>[\s\S]*?)(?:\r\n|\n|\r)-->\s*$/;
+var FINGERPRINT_HEX_RE = /^[0-9a-f]+$/;
+function isStrictBase64(value) {
+  const text3 = String(value ?? "");
+  if (!text3 || text3.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(text3)) return false;
+  try {
+    return btoa(atob(text3)) === text3;
+  } catch {
+    return false;
+  }
+}
+function normalizeFingerprintHex(value) {
+  let text3 = String(value ?? "").trim().toLowerCase();
+  if (text3.startsWith("sha256:")) text3 = text3.slice("sha256:".length);
+  text3 = text3.replace(/:/g, "");
+  if (![16, 64].includes(text3.length) || !FINGERPRINT_HEX_RE.test(text3)) return "";
+  return text3;
+}
+async function publicKeyFingerprint(certPem) {
+  const spkiB64 = publicKeyDerB64(certPem);
+  if (!spkiB64) return "";
+  const spkiBytes = base64ToUint8(spkiB64);
+  const spkiInput = spkiBytes.buffer.slice(
+    spkiBytes.byteOffset,
+    spkiBytes.byteOffset + spkiBytes.byteLength
+  );
+  const digest2 = await crypto.subtle.digest("SHA-256", spkiInput);
+  const hex = Array.from(new Uint8Array(digest2)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `sha256:${hex}`;
+}
+async function certMatchesFingerprint(certPem, fingerprint) {
+  const expected = normalizeFingerprintHex(fingerprint);
+  if (!expected) return false;
+  const derHex = (await certificateSha256Fingerprint(certPem)).slice("sha256:".length);
+  const spkiHex = (await publicKeyFingerprint(certPem)).slice("sha256:".length);
+  if (expected.length === 16) {
+    return derHex.slice(0, 16) === expected || spkiHex.slice(0, 16) === expected;
+  }
+  return derHex === expected || spkiHex === expected;
+}
+async function publicKeyMatchesFingerprint(certPem, fingerprint) {
+  const expected = normalizeFingerprintHex(fingerprint);
+  if (!expected) return false;
+  const spki = await publicKeyFingerprint(certPem);
+  const spkiHex = spki ? spki.slice("sha256:".length) : "";
+  if (expected.length === 16) return spkiHex.slice(0, 16) === expected;
+  return spkiHex === expected;
+}
+function parseAgentMdTailSignature(content) {
+  return parseAgentMdTailSignatureForPurpose(content);
+}
+function parseAgentMdTailSignatureForRead(content) {
+  return parseAgentMdTailSignatureForPurpose(content, true);
+}
+function parseAgentMdTailSignatureForPurpose(content, reading = false) {
+  if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(content)) !== content) return { payload: content, fields: null, signatures: [], parseError: "document must be valid UTF-8" };
+  const positions = Array.from(content.matchAll(/<!-- AUN-SIGNATURE/g), (match) => match.index);
+  const result = { payload: positions.length ? content.slice(0, positions[0]) : content, fields: null, signatures: [] };
+  const fail = (reason) => ({ ...result, fields: null, parseError: reason });
+  for (let index = 0; index < positions.length; index++) {
+    const start = positions[index];
+    if (start > 0 && !/[\r\n]/.test(content[start - 1])) return fail("agent.md signature block must start on a new line");
+    const tail = content.slice(start, positions[index + 1] ?? content.length), match = tail.match(AGENT_MD_SIGNATURE_RE);
+    if (!match) return fail("malformed signature block");
+    const fields = {};
+    for (const rawLine of match.groups?.body?.split(/\r\n|\n|\r/) ?? []) {
+      const line = rawLine.trim();
+      if (!line) continue;
+      const colon = line.indexOf(":");
+      if (colon < 0) return fail("malformed signature field");
+      const key = line.slice(0, colon).trim().toLowerCase();
+      if (Object.hasOwn(fields, key)) return fail(`duplicate signature field: ${key}`);
+      fields[key] = line.slice(colon + 1).trim();
+    }
+    for (const field of ["cert_fingerprint", "timestamp", "signature"]) if (!fields[field]) return fail(`signature block missing ${field}`);
+    if (Object.keys(fields).some((key) => !["cert_fingerprint", "public_key_fingerprint", "timestamp", "signature", "signer_aid"].includes(key))) return fail("signature block contains unknown fields");
+    if (index > 0 && !fields.signer_aid) return fail("additional signature requires signer_aid");
+    if (fields.signer_aid !== void 0 && !/^[A-Za-z0-9_][A-Za-z0-9_-]*(?:\.[A-Za-z0-9_][A-Za-z0-9_-]*)+$/.test(fields.signer_aid)) return fail("invalid signer_aid");
+    const compatible = reading && index === 0;
+    if (compatible ? !normalizeFingerprintHex(fields.cert_fingerprint) : !/^sha256:[0-9a-f]{64}$/.test(fields.cert_fingerprint)) return fail("invalid cert_fingerprint");
+    if (fields.public_key_fingerprint !== void 0 && (compatible ? !normalizeFingerprintHex(fields.public_key_fingerprint) : !/^sha256:[0-9a-f]{64}$/.test(fields.public_key_fingerprint))) return fail("invalid public_key_fingerprint");
+    if (!(compatible ? /^[0-9]+$/ : /^[1-9][0-9]*$/).test(fields.timestamp) || !Number.isSafeInteger(Number(fields.timestamp)) || Number(fields.timestamp) <= 0) return fail("invalid timestamp");
+    if (!isStrictBase64(fields.signature)) return fail("invalid signature base64");
+    result.signatures.push({ ...fields, fields, tag: tail.slice("<!-- AUN-SIGNATURE".length, tail.search(/[\r\n]/)).replace(/^-/, ""), start, end: start + tail.lastIndexOf("-->") + 3, signedPayload: content.slice(0, start) });
+  }
+  if (new TextEncoder().encode(content.slice(positions[0] ?? content.length)).length > 2048) return fail("document signatures exceed 2048 bytes");
+  result.fields = result.signatures[0]?.fields ?? null;
+  return result;
+}
+async function signDocument(identity, content, options = {}) {
+  if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(content)) !== content) throw new Error("document must be valid UTF-8");
+  const parsed = parseAgentMdTailSignature(content);
+  if (parsed.parseError) throw new Error(parsed.parseError);
+  const now = Math.trunc(options.now ?? Date.now() / 1e3), meta = parseCertMetadata(identity.certPem);
+  if (meta.subject.trim().toLowerCase() !== identity.aid.trim().toLowerCase()) throw new Error("signing certificate subject does not match AID");
+  if (!identity.isCertValid() || !identity.isPrivateKeyValid() || !identity.privateKeyPem || now < meta.notBefore.getTime() / 1e3 || now > meta.notAfter.getTime() / 1e3) throw new Error("signing identity is not currently valid");
+  let prefix = options.append ? content : parsed.payload;
+  if (prefix && !/[\r\n]$/.test(prefix)) {
+    if (!options.append || !parsed.signatures.length) throw new Error("document payload must end with a newline before signature");
+    prefix += "\n";
+  }
+  const signature2 = await signBytes(identity.privateKeyPem, new TextEncoder().encode(prefix));
+  const tag = options.tag ? `AUN-SIGNATURE-${options.tag}` : "AUN-SIGNATURE";
+  let block = buildAgentMdSignatureBlock(identity.certFingerprint, now, signature2, await publicKeyFingerprint(identity.certPem), tag);
+  if (options.signerAid || options.append && parsed.signatures.length) block = block.replace("cert_fingerprint:", `signer_aid: ${identity.aid}
+cert_fingerprint:`);
+  const signed = prefix + block, result = parseAgentMdTailSignature(signed);
+  if (result.parseError) throw new Error(result.parseError);
+  return { signed, signature: signature2, signatures: result.signatures };
+}
+async function verifyDocument(content, resolver, options = {}) {
+  if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(content)) !== content) return { valid: false, status: "invalid", payload: content, signatures: [], reason: "document must be valid UTF-8" };
+  const parsed = options.reading ? parseAgentMdTailSignatureForRead(content) : parseAgentMdTailSignature(content);
+  const output = { valid: false, status: "invalid", payload: parsed.payload, signatures: parsed.signatures, reason: parsed.parseError };
+  if (parsed.parseError) return output;
+  if (!parsed.signatures.length) return { ...output, status: "unsigned" };
+  const now = options.now ?? Date.now() / 1e3;
+  for (let index = 0; index < parsed.signatures.length; index++) {
+    const block = parsed.signatures[index], fields = block.fields, signer = fields.signer_aid ?? options.expectedAid ?? extractAgentMdAid(parsed.payload);
+    const material = await resolver(signer, fields.cert_fingerprint, Number(fields.timestamp)), certPem = typeof material === "string" ? material : material.certPem;
+    const meta = parseCertMetadata(certPem), timestamp2 = Number(fields.timestamp);
+    const subjectMatches = (index !== 0 || !options.expectedAid || signer.toLowerCase() === options.expectedAid.toLowerCase()) && (!signer || meta.subject.trim().toLowerCase() === signer.trim().toLowerCase());
+    const certMatches = options.reading && index === 0 ? await certMatchesFingerprint(certPem, fields.cert_fingerprint) : await certificateSha256Fingerprint(certPem) === fields.cert_fingerprint;
+    block.valid = subjectMatches && certMatches && timestamp2 >= meta.notBefore.getTime() / 1e3 && timestamp2 <= meta.notAfter.getTime() / 1e3 && timestamp2 <= now + 300 && (!options.requireCurrentValidity || now >= meta.notBefore.getTime() / 1e3 && now <= meta.notAfter.getTime() / 1e3) && (!fields.public_key_fingerprint || await publicKeyMatchesFingerprint(certPem, fields.public_key_fingerprint)) && await verifySignatureWithCert(certPem, fields.signature, new TextEncoder().encode(block.signedPayload));
+    if (!block.valid) block.reason = timestamp2 < meta.notBefore.getTime() / 1e3 || timestamp2 > meta.notAfter.getTime() / 1e3 ? "signature timestamp is outside certificate validity" : "signature verification failed";
+  }
+  output.valid = parsed.signatures.every((block) => block.valid);
+  output.status = output.valid ? "verified" : "invalid";
+  output.reason = parsed.signatures.find((block) => !block.valid)?.reason;
+  return output;
+}
+function buildAgentMdSignatureBlock(certFingerprint, timestamp2, signatureB64, publicKeyFp = "", tag = "AUN-SIGNATURE") {
+  if (!/^AUN-SIGNATURE(?:-[A-Z0-9-]+)?$/.test(tag)) throw new Error("invalid signature TAG");
+  const lines = [
+    `<!-- ${tag}`,
+    `cert_fingerprint: ${certFingerprint}`
+  ];
+  if (publicKeyFp) lines.push(`public_key_fingerprint: ${publicKeyFp}`);
+  lines.push(`timestamp: ${Math.trunc(timestamp2)}`, `signature: ${signatureB64}`, "-->");
+  return lines.join("\n");
+}
+function extractAgentMdAid(payload) {
+  const lines = payload.replace(/^\ufeff/, "").split(/\r?\n/);
+  if (!lines.length || lines[0].trim() !== "---") return "";
+  for (const line of lines.slice(1)) {
+    const t = line.trim();
+    if (t === "---") break;
+    if (t.startsWith("aid:")) {
+      let v = t.slice(4).trim();
+      if (v.length >= 2 && v[0] === v[v.length - 1] && (v[0] === '"' || v[0] === "'")) v = v.slice(1, -1);
+      return v.trim();
+    }
+  }
+  return "";
+}
+function readDerLength(data, offset) {
+  if (offset >= data.length) return null;
+  const first = data[offset];
+  if (first < 128) return { value: first, lenBytes: 1 };
+  const numBytes = first & 127;
+  if (numBytes === 0 || numBytes > 4) return null;
+  let value = 0;
+  for (let i = 0; i < numBytes; i++) value = value << 8 | data[offset + 1 + i];
+  return { value, lenBytes: 1 + numBytes };
+}
+function readDerTlv(data, offset) {
+  const len = readDerLength(data, offset + 1);
+  if (!len) return null;
+  const valueStart = offset + 1 + len.lenBytes;
+  const valueEnd = valueStart + len.value;
+  if (valueEnd > data.length) return null;
+  return { tag: data[offset], valueStart, valueEnd, fullEnd: valueEnd };
+}
+function publicKeyDerB64(certPem) {
+  const certDer = new Uint8Array(pemToArrayBuffer(certPem));
+  const cert = readDerTlv(certDer, 0);
+  if (!cert || cert.tag !== 48) return "";
+  const tbs = readDerTlv(certDer, cert.valueStart);
+  if (!tbs || tbs.tag !== 48) return "";
+  let pos = tbs.valueStart;
+  if (certDer[pos] === 160) pos = readDerTlv(certDer, pos)?.fullEnd ?? pos;
+  for (let i = 0; i < 5; i++) pos = readDerTlv(certDer, pos)?.fullEnd ?? pos;
+  const spki = readDerTlv(certDer, pos);
+  if (!spki || spki.tag !== 48) return "";
+  return uint8ToBase64(certDer.slice(pos, spki.fullEnd));
+}
+function extractCommonName(der, nameStart, nameEnd) {
+  let pos = nameStart;
+  while (pos < nameEnd) {
+    const set2 = readDerTlv(der, pos);
+    if (!set2 || set2.tag !== 49) break;
+    let rpos = set2.valueStart;
+    while (rpos < set2.valueEnd) {
+      const seq2 = readDerTlv(der, rpos);
+      if (!seq2 || seq2.tag !== 48) break;
+      const oid = readDerTlv(der, seq2.valueStart);
+      if (oid && oid.tag === 6) {
+        const isCN = oid.valueEnd - oid.valueStart === 3 && der[oid.valueStart] === 85 && der[oid.valueStart + 1] === 4 && der[oid.valueStart + 2] === 3;
+        if (isCN) {
+          const val = readDerTlv(der, oid.fullEnd);
+          if (val) return new TextDecoder().decode(der.slice(val.valueStart, val.valueEnd));
+        }
+      }
+      rpos = seq2.fullEnd;
+    }
+    pos = set2.fullEnd;
+  }
+  return "";
+}
+function parseDerTime(der, offset) {
+  const tlv = readDerTlv(der, offset);
+  if (!tlv) return null;
+  const raw = new TextDecoder().decode(der.slice(tlv.valueStart, tlv.valueEnd));
+  if (tlv.tag === 23) {
+    const yy = parseInt(raw.slice(0, 2), 10);
+    const year = yy >= 50 ? 1900 + yy : 2e3 + yy;
+    const ms = Date.UTC(
+      year,
+      parseInt(raw.slice(2, 4), 10) - 1,
+      parseInt(raw.slice(4, 6), 10),
+      parseInt(raw.slice(6, 8), 10),
+      parseInt(raw.slice(8, 10), 10),
+      parseInt(raw.slice(10, 12), 10)
+    );
+    return Number.isNaN(ms) ? null : new Date(ms);
+  }
+  if (tlv.tag === 24) {
+    const ms = Date.UTC(
+      parseInt(raw.slice(0, 4), 10),
+      parseInt(raw.slice(4, 6), 10) - 1,
+      parseInt(raw.slice(6, 8), 10),
+      parseInt(raw.slice(8, 10), 10),
+      parseInt(raw.slice(10, 12), 10),
+      parseInt(raw.slice(12, 14), 10)
+    );
+    return Number.isNaN(ms) ? null : new Date(ms);
+  }
+  return null;
+}
+function parseCertMetadata(certPem) {
+  const fallback = { subject: "", issuer: "", notBefore: /* @__PURE__ */ new Date(0), notAfter: /* @__PURE__ */ new Date(0) };
+  try {
+    const der = new Uint8Array(pemToArrayBuffer(certPem));
+    const cert = readDerTlv(der, 0);
+    if (!cert || cert.tag !== 48) return fallback;
+    const tbs = readDerTlv(der, cert.valueStart);
+    if (!tbs || tbs.tag !== 48) return fallback;
+    let pos = tbs.valueStart;
+    if (der[pos] === 160) pos = readDerTlv(der, pos)?.fullEnd ?? pos;
+    pos = readDerTlv(der, pos)?.fullEnd ?? pos;
+    pos = readDerTlv(der, pos)?.fullEnd ?? pos;
+    const issuer = readDerTlv(der, pos);
+    if (!issuer || issuer.tag !== 48) return fallback;
+    const issuerCN = extractCommonName(der, issuer.valueStart, issuer.valueEnd);
+    pos = issuer.fullEnd;
+    const validity = readDerTlv(der, pos);
+    if (!validity || validity.tag !== 48) return fallback;
+    const notBefore = parseDerTime(der, validity.valueStart);
+    const nb = readDerTlv(der, validity.valueStart);
+    const notAfter = nb ? parseDerTime(der, nb.fullEnd) : null;
+    pos = validity.fullEnd;
+    const subject = readDerTlv(der, pos);
+    if (!subject || subject.tag !== 48) return fallback;
+    const subjectCN = extractCommonName(der, subject.valueStart, subject.valueEnd);
+    return {
+      subject: subjectCN,
+      issuer: issuerCN,
+      notBefore: notBefore ?? /* @__PURE__ */ new Date(0),
+      notAfter: notAfter ?? /* @__PURE__ */ new Date(0)
+    };
+  } catch {
+    return fallback;
+  }
+}
+async function signBytes(privateKeyPem, payload) {
+  const key = await importPrivateKeyEcdsa(privateKeyPem);
+  return uint8ToBase64(await ecdsaSignDer(key, payload));
+}
+async function verifySignatureWithCert(certPem, signatureB64, data) {
+  try {
+    const key = await importCertPublicKeyEcdsa(certPem);
+    return await ecdsaVerifyDer(key, base64ToUint8(signatureB64), data);
+  } catch {
+    return false;
+  }
+}
 
 // node_modules/yaml/browser/dist/nodes/identity.js
 var ALIAS = Symbol.for("yaml.alias");
@@ -7683,265 +7978,6 @@ function parseDocument(source, options = {}) {
   return doc;
 }
 
-// src/cert-utils.ts
-var AGENT_MD_SIGNATURE_MARKER = "<!-- AUN-SIGNATURE";
-var AGENT_MD_SIGNATURE_RE = /^<!-- AUN-SIGNATURE(?:-[A-Z0-9][A-Z0-9-]*)?(?:\r\n|\n|\r)(?<body>[\s\S]*?)(?:\r\n|\n|\r)-->\s*$/;
-var FINGERPRINT_HEX_RE = /^[0-9a-f]+$/;
-function isStrictBase64(value) {
-  const text3 = String(value ?? "");
-  if (!text3 || text3.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(text3)) return false;
-  try {
-    return btoa(atob(text3)) === text3;
-  } catch {
-    return false;
-  }
-}
-function normalizeFingerprintHex(value) {
-  let text3 = String(value ?? "").trim().toLowerCase();
-  if (text3.startsWith("sha256:")) text3 = text3.slice("sha256:".length);
-  text3 = text3.replace(/:/g, "");
-  if (![16, 64].includes(text3.length) || !FINGERPRINT_HEX_RE.test(text3)) return "";
-  return text3;
-}
-async function publicKeyFingerprint(certPem) {
-  const spkiB64 = publicKeyDerB64(certPem);
-  if (!spkiB64) return "";
-  const spkiBytes = base64ToUint8(spkiB64);
-  const spkiInput = spkiBytes.buffer.slice(
-    spkiBytes.byteOffset,
-    spkiBytes.byteOffset + spkiBytes.byteLength
-  );
-  const digest2 = await crypto.subtle.digest("SHA-256", spkiInput);
-  const hex = Array.from(new Uint8Array(digest2)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return `sha256:${hex}`;
-}
-async function certMatchesFingerprint(certPem, fingerprint) {
-  const expected = normalizeFingerprintHex(fingerprint);
-  if (!expected) return false;
-  const derHex = (await certificateSha256Fingerprint(certPem)).slice("sha256:".length);
-  const spkiHex = (await publicKeyFingerprint(certPem)).slice("sha256:".length);
-  if (expected.length === 16) {
-    return derHex.slice(0, 16) === expected || spkiHex.slice(0, 16) === expected;
-  }
-  return derHex === expected || spkiHex === expected;
-}
-async function publicKeyMatchesFingerprint(certPem, fingerprint) {
-  const expected = normalizeFingerprintHex(fingerprint);
-  if (!expected) return false;
-  const spki = await publicKeyFingerprint(certPem);
-  const spkiHex = spki ? spki.slice("sha256:".length) : "";
-  if (expected.length === 16) return spkiHex.slice(0, 16) === expected;
-  return spkiHex === expected;
-}
-function parseAgentMdTailSignature(content) {
-  const idx = content.lastIndexOf(AGENT_MD_SIGNATURE_MARKER);
-  if (idx < 0) return { payload: content, fields: null };
-  if (content.indexOf(AGENT_MD_SIGNATURE_MARKER) !== idx) {
-    return { payload: content.slice(0, idx), fields: null, parseError: "agent.md must contain exactly one signature block" };
-  }
-  if (idx > 0 && content[idx - 1] !== "\n" && content[idx - 1] !== "\r") {
-    return { payload: content.slice(0, idx), fields: null, parseError: "agent.md signature block must start on a new line" };
-  }
-  const tail = content.slice(idx);
-  const match = tail.match(AGENT_MD_SIGNATURE_RE);
-  if (!match) return { payload: content.slice(0, idx), fields: null, parseError: "malformed signature block" };
-  const fields = {};
-  for (const rawLine of match.groups?.body?.split(/\r\n|\n|\r/) ?? []) {
-    const line = rawLine.trim();
-    if (!line) continue;
-    const colon = line.indexOf(":");
-    if (colon < 0) return { payload: content.slice(0, idx), fields: null, parseError: `malformed signature field: ${line}` };
-    const key = line.slice(0, colon).trim().toLowerCase();
-    if (Object.prototype.hasOwnProperty.call(fields, key)) {
-      return { payload: content.slice(0, idx), fields: null, parseError: `duplicate signature field: ${key}` };
-    }
-    fields[key] = line.slice(colon + 1).trim();
-  }
-  for (const req of ["cert_fingerprint", "timestamp", "signature"]) {
-    if (!fields[req]) return { payload: content.slice(0, idx), fields: null, parseError: `signature block missing ${req}` };
-  }
-  let entity = false;
-  const frontmatter = content.slice(0, idx).replace(/^\ufeff/, "").match(/^---(?:\r\n|\n|\r)([\s\S]*?)(?:\r\n|\n|\r)---(?:\r\n|\n|\r)/);
-  if (frontmatter) {
-    try {
-      const doc = parseDocument(frontmatter[1]);
-      entity = !doc.errors.length && ["group", "org"].includes(String(doc.get("type")));
-    } catch {
-    }
-  }
-  if (Object.keys(fields).some((key) => !["cert_fingerprint", "public_key_fingerprint", "timestamp", "signature", ...entity ? ["signer_aid"] : []].includes(key))) {
-    return { payload: content.slice(0, idx), fields: null, parseError: "signature block contains unknown fields" };
-  }
-  if (!/^sha256:[0-9a-f]{64}$/.test(fields.cert_fingerprint)) {
-    return { payload: content.slice(0, idx), fields: null, parseError: "invalid cert_fingerprint" };
-  }
-  if (fields.public_key_fingerprint !== void 0 && !/^sha256:[0-9a-f]{64}$/.test(fields.public_key_fingerprint)) {
-    return { payload: content.slice(0, idx), fields: null, parseError: "invalid public_key_fingerprint" };
-  }
-  if (!/^[1-9][0-9]*$/.test(fields.timestamp) || !Number.isSafeInteger(Number(fields.timestamp))) {
-    return { payload: content.slice(0, idx), fields: null, parseError: "invalid timestamp" };
-  }
-  if (!isStrictBase64(fields.signature)) {
-    return { payload: content.slice(0, idx), fields: null, parseError: "invalid signature base64" };
-  }
-  return { payload: content.slice(0, idx), fields };
-}
-function buildAgentMdSignatureBlock(certFingerprint, timestamp2, signatureB64, publicKeyFp = "", tag = "AUN-SIGNATURE") {
-  if (!/^AUN-SIGNATURE(?:-[A-Z0-9][A-Z0-9-]*)?$/.test(tag)) throw new Error("invalid signature TAG");
-  const lines = [
-    `<!-- ${tag}`,
-    `cert_fingerprint: ${certFingerprint}`
-  ];
-  if (publicKeyFp) lines.push(`public_key_fingerprint: ${publicKeyFp}`);
-  lines.push(`timestamp: ${Math.trunc(timestamp2)}`, `signature: ${signatureB64}`, "-->");
-  return lines.join("\n");
-}
-function extractAgentMdAid(payload) {
-  const lines = payload.replace(/^\ufeff/, "").split(/\r?\n/);
-  if (!lines.length || lines[0].trim() !== "---") return "";
-  for (const line of lines.slice(1)) {
-    const t = line.trim();
-    if (t === "---") break;
-    if (t.startsWith("aid:")) {
-      let v = t.slice(4).trim();
-      if (v.length >= 2 && v[0] === v[v.length - 1] && (v[0] === '"' || v[0] === "'")) v = v.slice(1, -1);
-      return v.trim();
-    }
-  }
-  return "";
-}
-function readDerLength(data, offset) {
-  if (offset >= data.length) return null;
-  const first = data[offset];
-  if (first < 128) return { value: first, lenBytes: 1 };
-  const numBytes = first & 127;
-  if (numBytes === 0 || numBytes > 4) return null;
-  let value = 0;
-  for (let i = 0; i < numBytes; i++) value = value << 8 | data[offset + 1 + i];
-  return { value, lenBytes: 1 + numBytes };
-}
-function readDerTlv(data, offset) {
-  const len = readDerLength(data, offset + 1);
-  if (!len) return null;
-  const valueStart = offset + 1 + len.lenBytes;
-  const valueEnd = valueStart + len.value;
-  if (valueEnd > data.length) return null;
-  return { tag: data[offset], valueStart, valueEnd, fullEnd: valueEnd };
-}
-function publicKeyDerB64(certPem) {
-  const certDer = new Uint8Array(pemToArrayBuffer(certPem));
-  const cert = readDerTlv(certDer, 0);
-  if (!cert || cert.tag !== 48) return "";
-  const tbs = readDerTlv(certDer, cert.valueStart);
-  if (!tbs || tbs.tag !== 48) return "";
-  let pos = tbs.valueStart;
-  if (certDer[pos] === 160) pos = readDerTlv(certDer, pos)?.fullEnd ?? pos;
-  for (let i = 0; i < 5; i++) pos = readDerTlv(certDer, pos)?.fullEnd ?? pos;
-  const spki = readDerTlv(certDer, pos);
-  if (!spki || spki.tag !== 48) return "";
-  return uint8ToBase64(certDer.slice(pos, spki.fullEnd));
-}
-function extractCommonName(der, nameStart, nameEnd) {
-  let pos = nameStart;
-  while (pos < nameEnd) {
-    const set2 = readDerTlv(der, pos);
-    if (!set2 || set2.tag !== 49) break;
-    let rpos = set2.valueStart;
-    while (rpos < set2.valueEnd) {
-      const seq2 = readDerTlv(der, rpos);
-      if (!seq2 || seq2.tag !== 48) break;
-      const oid = readDerTlv(der, seq2.valueStart);
-      if (oid && oid.tag === 6) {
-        const isCN = oid.valueEnd - oid.valueStart === 3 && der[oid.valueStart] === 85 && der[oid.valueStart + 1] === 4 && der[oid.valueStart + 2] === 3;
-        if (isCN) {
-          const val = readDerTlv(der, oid.fullEnd);
-          if (val) return new TextDecoder().decode(der.slice(val.valueStart, val.valueEnd));
-        }
-      }
-      rpos = seq2.fullEnd;
-    }
-    pos = set2.fullEnd;
-  }
-  return "";
-}
-function parseDerTime(der, offset) {
-  const tlv = readDerTlv(der, offset);
-  if (!tlv) return null;
-  const raw = new TextDecoder().decode(der.slice(tlv.valueStart, tlv.valueEnd));
-  if (tlv.tag === 23) {
-    const yy = parseInt(raw.slice(0, 2), 10);
-    const year = yy >= 50 ? 1900 + yy : 2e3 + yy;
-    const ms = Date.UTC(
-      year,
-      parseInt(raw.slice(2, 4), 10) - 1,
-      parseInt(raw.slice(4, 6), 10),
-      parseInt(raw.slice(6, 8), 10),
-      parseInt(raw.slice(8, 10), 10),
-      parseInt(raw.slice(10, 12), 10)
-    );
-    return Number.isNaN(ms) ? null : new Date(ms);
-  }
-  if (tlv.tag === 24) {
-    const ms = Date.UTC(
-      parseInt(raw.slice(0, 4), 10),
-      parseInt(raw.slice(4, 6), 10) - 1,
-      parseInt(raw.slice(6, 8), 10),
-      parseInt(raw.slice(8, 10), 10),
-      parseInt(raw.slice(10, 12), 10),
-      parseInt(raw.slice(12, 14), 10)
-    );
-    return Number.isNaN(ms) ? null : new Date(ms);
-  }
-  return null;
-}
-function parseCertMetadata(certPem) {
-  const fallback = { subject: "", issuer: "", notBefore: /* @__PURE__ */ new Date(0), notAfter: /* @__PURE__ */ new Date(0) };
-  try {
-    const der = new Uint8Array(pemToArrayBuffer(certPem));
-    const cert = readDerTlv(der, 0);
-    if (!cert || cert.tag !== 48) return fallback;
-    const tbs = readDerTlv(der, cert.valueStart);
-    if (!tbs || tbs.tag !== 48) return fallback;
-    let pos = tbs.valueStart;
-    if (der[pos] === 160) pos = readDerTlv(der, pos)?.fullEnd ?? pos;
-    pos = readDerTlv(der, pos)?.fullEnd ?? pos;
-    pos = readDerTlv(der, pos)?.fullEnd ?? pos;
-    const issuer = readDerTlv(der, pos);
-    if (!issuer || issuer.tag !== 48) return fallback;
-    const issuerCN = extractCommonName(der, issuer.valueStart, issuer.valueEnd);
-    pos = issuer.fullEnd;
-    const validity = readDerTlv(der, pos);
-    if (!validity || validity.tag !== 48) return fallback;
-    const notBefore = parseDerTime(der, validity.valueStart);
-    const nb = readDerTlv(der, validity.valueStart);
-    const notAfter = nb ? parseDerTime(der, nb.fullEnd) : null;
-    pos = validity.fullEnd;
-    const subject = readDerTlv(der, pos);
-    if (!subject || subject.tag !== 48) return fallback;
-    const subjectCN = extractCommonName(der, subject.valueStart, subject.valueEnd);
-    return {
-      subject: subjectCN,
-      issuer: issuerCN,
-      notBefore: notBefore ?? /* @__PURE__ */ new Date(0),
-      notAfter: notAfter ?? /* @__PURE__ */ new Date(0)
-    };
-  } catch {
-    return fallback;
-  }
-}
-async function signBytes(privateKeyPem, payload) {
-  const key = await importPrivateKeyEcdsa(privateKeyPem);
-  return uint8ToBase64(await ecdsaSignDer(key, payload));
-}
-async function verifySignatureWithCert(certPem, signatureB64, data) {
-  try {
-    const key = await importCertPublicKeyEcdsa(certPem);
-    return await ecdsaVerifyDer(key, base64ToUint8(signatureB64), data);
-  } catch {
-    return false;
-  }
-}
-
 // src/v2/crypto/canonical.ts
 var encoder = new TextEncoder();
 var MAX_SAFE_JSON_INTEGER = 9007199254740991;
@@ -9108,7 +9144,7 @@ var AgentMdManager = class _AgentMdManager {
     const target = this._safeAid(aid2);
     const gatewayUrl = await this._resolveGateway(target);
     const viaGatewayHost = this._uploadViaGatewayHost && nodeBuiltin("node:http") !== null;
-    const headers = { Accept: "text/markdown", "X-AUN-Ownership-Check": "1", ...viaGatewayHost ? { Host: target } : {} };
+    const headers = { "X-AUN-Signature-Format": "multi-v1", Accept: "text/markdown", "Cache-Control": "no-cache", "X-AUN-Ownership-Check": "1", ...viaGatewayHost ? { Host: target } : {} };
     let url = this._url(target, gatewayUrl);
     if (viaGatewayHost) {
       const parsed = new URL(gatewayUrl);
@@ -9158,6 +9194,7 @@ var AgentMdManager = class _AgentMdManager {
       redirect: "error",
       body: content,
       headers: {
+        "X-AUN-Signature-Format": "multi-v1",
         "Content-Type": "text/markdown; charset=utf-8",
         Authorization: `Bearer ${token}`,
         ...condition.if_match ? { "If-Match": condition.if_match } : { "If-None-Match": "*" }
@@ -9188,45 +9225,50 @@ var AgentMdManager = class _AgentMdManager {
     if (!current.isPrivateKeyValid()) {
       throw new StateError("uploadAgentMd requires loaded AID with a valid private key");
     }
-    if (content !== void 0 && content !== null) {
-      const text3 = String(content ?? "");
-      if (text3.length === 0) throw new ValidationError("uploadAgentMd requires non-empty content");
-      validateAgentMdDocument(text3, { expectedAid: target });
-      await this.saveRecord(target, {
-        content: text3,
-        local_etag: await _AgentMdManager.contentEtag(text3),
-        fetched_at: Date.now()
-      });
-    }
-    const localContent = await this.readContent(target);
+    const localContent = content ?? (String((await this.loadRecord(target, true))?.local_draft_content ?? "") || await this.readContent(target));
     if (localContent === null || localContent.length === 0) {
       throw new ValidationError("uploadAgentMd requires local agent.md content");
     }
-    const parsed = validateAgentMdDocument(localContent, { expectedAid: target });
+    const parsed = this._parseBodyUpdate(localContent, target);
     if (["group", "org"].includes(String(parsed.frontmatter.type))) return await this.uploadAs(target, localContent, current);
-    const signedResult = await current.signAgentMd(localContent);
+    if (parsed.signatures.length > 1) {
+      await this._verifyBodyUpload(target, localContent, current);
+      return await this._uploadPrepared(target, localContent, current);
+    }
+    const signedResult = await current.signAgentMd(this._isLegacyBodyRelation(parsed.frontmatter) ? parsed.payload : localContent);
     if (!signedResult.ok) {
       throw new ClientSignatureError(signedResult.error.message || "agent.md signing failed");
     }
     const signed = signedResult.data.signed;
-    await verifyAgentMdUpload(signed, current.certPem, target);
+    await this._verifyBodyUpload(target, signed, current);
     return await this._uploadPrepared(target, signed, current);
   }
   async uploadAs(targetAid, content, signer) {
     const target = this._safeAid(String(targetAid ?? "").trim());
     const rawContent = String(content ?? "");
     if (!rawContent.trim()) throw new ValidationError("uploadAgentMd requires non-empty content");
-    const parsed = validateAgentMdDocument(rawContent, { expectedAid: target });
+    const parsed = this._parseBodyUpdate(rawContent, target);
+    if (!["group", "org"].includes(String(parsed.frontmatter.type)) && parsed.signatures.length > 1) {
+      await this._verifyBodyUpload(target, rawContent, signer);
+      return await this._uploadPrepared(target, rawContent, signer);
+    }
     if (["group", "org"].includes(String(parsed.frontmatter.type)) && parsed.signature) {
-      const identity = await this._entityDocumentSigner(target, rawContent);
-      await verifyAgentMdUpload(rawContent, identity.certPem, target);
-      return await this._uploadPrepared(target, rawContent, identity);
+      await verifyAgentMdUpload(rawContent, signer.certPem, target, void 0, async (aid2, fingerprint) => {
+        if (!this._entitySignerResolver) throw new StateError("entity additional signing certificate resolver is unavailable", { stringCode: "unavailable", retryable: true });
+        return await this._entitySignerResolver(aid2, fingerprint);
+      });
+      return await this._uploadPrepared(target, rawContent, signer);
+    }
+    if (["group", "org"].includes(String(parsed.frontmatter.type)) && signer.aid !== target) {
+      if (!this._entityIdentityGetter) throw new StateError("entity signing identity is unavailable");
+      signer = await this._entityIdentityGetter(target, String(parsed.frontmatter.type));
+      if (signer.aid !== target) throw new StateError("entity signing identity does not match target");
     }
     if (!signer?.isPrivateKeyValid()) throw new StateError("uploadAgentMd requires a valid signer identity");
-    const signedResult = await signer.signAgentMd(rawContent);
+    const signedResult = await signer.signAgentMd(this._isLegacyBodyRelation(parsed.frontmatter) ? parsed.payload : rawContent);
     if (!signedResult.ok) throw new ClientSignatureError(signedResult.error.message || "agent.md signing failed");
     const signed = signedResult.data.signed;
-    await verifyAgentMdUpload(signed, signer.certPem, target);
+    await this._verifyBodyUpload(target, signed, signer);
     return await this._uploadPrepared(target, signed, signer);
   }
   async pendingUpload(aid2) {
@@ -9239,9 +9281,28 @@ var AgentMdManager = class _AgentMdManager {
     if (!pending) return false;
     const condition = pending.condition;
     if (!condition || Object.keys(condition).length !== 1 || !(typeof condition.if_match === "string" && condition.if_match || condition.if_none_match === "*")) throw new StateError("pending agent.md requires its original document condition", { stringCode: "persistence_unavailable" });
-    const meta = validateAgentMdDocument(pending.content, { expectedAid: aid2, validateOwnership: false }).frontmatter;
-    if ("ownership_proof" in meta || "ownership_release" in meta) throw new StateError("legacy ownership pending agent.md cannot be recovered through ordinary upload", { stringCode: "unsupported_protocol" });
+    const pendingDocument = validateAgentMdDocument(pending.content, { expectedAid: aid2, validateOwnership: false });
+    const meta = pendingDocument.frontmatter;
+    if (this._isLegacyBodyRelation(meta) && pending.relation?.protocol !== "legacy") throw new StateError("legacy ownership pending agent.md requires its original relationship snapshot", { stringCode: "unsupported_protocol" });
     try {
+      if (pending.relation?.protocol === "legacy") {
+        const relation2 = pending.relation;
+        if (!condition.if_match || condition.if_match !== relation2.original_etag || typeof relation2.original_content !== "string" || relation2.original_content_etag !== await _AgentMdManager.contentEtag(relation2.original_content) || pending.content_etag !== await _AgentMdManager.contentEtag(pending.content)) throw new StateError("pending legacy original bytes or document condition are corrupt", { stringCode: "persistence_unavailable" });
+        const original = await this._verifyLegacyBodyOriginal(aid2, relation2.original_content);
+        if (!this._isLegacyBodyRelation(original) || !this._sameBodyRelation(this._bodyRelationFields(original), relation2.fields)) throw new StateError("pending legacy original relationship snapshot is corrupt", { stringCode: "persistence_unavailable" });
+        if (!this._sameBodyRelation(this._bodyRelationFields(meta), relation2.fields)) throw new StateError("legacy relationship changes require their original protocol", { stringCode: "unsupported_protocol" });
+        const identity2 = signer ?? this._currentAid();
+        if (!identity2 || identity2.aid.toLowerCase() !== aid2.toLowerCase() || this._currentAid()?.aid.toLowerCase() !== aid2.toLowerCase()) throw new StateError("legacy body recovery requires its current subject identity", { stringCode: "forbidden" });
+        await this._verifyBodyUpload(aid2, pending.content, identity2);
+        const remote2 = await this._readLegacyBodyFresh(aid2);
+        if (remote2.content === pending.content && remote2.etag === pending.content_etag) {
+          await this.saveRecord(aid2, { content: pending.content, remote_etag: remote2.etag, local_draft_content: "", pending_operation: "", pending_content: "", pending_content_etag: "", pending_error: "", pending_condition: {}, pending_relation: {}, pending_authorization: "" });
+          return true;
+        }
+        if (remote2.etag !== condition.if_match || remote2.content !== relation2.original_content) throw new StateError("pending legacy original document changed", { stringCode: "conflict" });
+        await this._uploadPrepared(aid2, pending.content, identity2, condition);
+        return true;
+      }
       if (["group", "org"].includes(String(meta.type))) {
         const identity2 = signer ?? this._currentAid();
         if (!identity2) throw new StateError("entity upload recovery requires current owner", { stringCode: "forbidden" });
@@ -9251,17 +9312,21 @@ var AgentMdManager = class _AgentMdManager {
         if (pending.relation.entity_cert_fingerprint !== context.entity_cert_fingerprint) throw new StateError("pending entity upload belongs to an old rekey generation", { stringCode: "conflict" });
         if (pending.content_etag !== await _AgentMdManager.contentEtag(pending.content)) throw new StateError("pending entity original bytes are corrupt", { stringCode: "persistence_unavailable" });
         const documentSigner = await this._entityDocumentSigner(aid2, pending.content);
-        await verifyAgentMdUpload(pending.content, documentSigner.certPem, aid2);
-        if (identity2.aid.toLowerCase() !== aid2.toLowerCase()) await this._validateEntityUploadAuthorization(pending.authorization, aid2, pending.content, identity2, String(context.entity_cert_fingerprint));
+        await this._verifyEntityDocument(aid2, pending.content);
         const remote2 = await this._readEntityFresh(aid2);
         if (remote2.exists && remote2.content === pending.content && remote2.etag === pending.content_etag) {
-          await this.saveRecord(aid2, { content: pending.content, remote_etag: remote2.etag, pending_operation: "", pending_content: "", pending_content_etag: "", pending_error: "", pending_condition: {}, pending_relation: {}, pending_authorization: "" });
+          await this.saveRecord(aid2, { content: pending.content, remote_etag: remote2.etag, local_draft_content: "", pending_operation: "", pending_content: "", pending_content_etag: "", pending_error: "", pending_condition: {}, pending_relation: {}, pending_authorization: "" });
           return true;
         }
         if (condition.if_match && (!remote2.exists || remote2.etag !== condition.if_match) || condition.if_none_match === "*" && remote2.exists) throw new StateError("pending agent.md original document condition changed", { stringCode: "conflict" });
         await this._uploadPrepared(aid2, pending.content, identity2, condition);
         return true;
       }
+      const identity = signer ?? this._currentAid();
+      if (pendingDocument.signatures.length > 1) {
+        if (!identity) throw new StateError("pending agent.md requires a signer identity");
+        await this._verifyBodyUpload(aid2, pending.content, identity);
+      }
       const remote = await this.readOwnershipFresh(aid2);
       const fail = (code, reason, retryable = false) => new StateError(reason, { stringCode: code, retryable });
       const candidate = parseOwnershipFile(pending.content, "agent", { expectedSubAid: aid2 });
@@ -9278,14 +9343,13 @@ var AgentMdManager = class _AgentMdManager {
       }
       if (!relation && (remote.relation_version !== 0 || remote.lock !== "unlocked")) throw fail("unavailable", "pending agent.md cannot overwrite relationship history", true);
       if (remote.exists && remote.etag === pending.content_etag && remote.content === pending.content) {
-        const saved = await this.saveRecord(aid2, { content: pending.content, remote_etag: remote.etag, pending_operation: "", pending_content: "", pending_content_etag: "", pending_error: "", pending_condition: {}, pending_relation: {}, pending_authorization: "" });
+        const saved = await this.saveRecord(aid2, { content: pending.content, remote_etag: remote.etag, local_draft_content: "", pending_operation: "", pending_content: "", pending_content_etag: "", pending_error: "", pending_condition: {}, pending_relation: {}, pending_authorization: "" });
         if (!saved.aid) throw new StateError("agent.md pending completion persistence failed");
         return true;
       }
       if (condition.if_match && (!remote.exists || remote.etag !== condition.if_match) || condition.if_none_match === "*" && remote.exists) throw new StateError("pending agent.md original document condition changed", { stringCode: "conflict" });
-      const identity = signer ?? this._currentAid();
       if (!identity) throw new StateError("pending agent.md requires a signer identity");
-      await verifyAgentMdUpload(pending.content, identity.certPem, aid2);
+      if (pendingDocument.signatures.length <= 1) await this._verifyBodyUpload(aid2, pending.content, identity);
       await this._uploadPrepared(aid2, pending.content, identity, condition);
       return true;
     } catch (error) {
@@ -9293,44 +9357,134 @@ var AgentMdManager = class _AgentMdManager {
       throw error;
     }
   }
+  _parseBodyUpdate(content, target) {
+    const parsed = validateAgentMdDocumentForRead(content, { expectedAid: target, validateOwnership: false });
+    return validateAgentMdDocument(this._isLegacyBodyRelation(parsed.frontmatter) && parsed.signatures.length <= 1 ? parsed.payload : content, { expectedAid: target, validateOwnership: false });
+  }
+  _isLegacyBodyRelation(meta) {
+    if (["group", "org"].includes(String(meta.type))) return false;
+    if (Object.hasOwn(meta, "ownership")) {
+      const ownership = meta.ownership;
+      const statement = isJsonObject(ownership) ? ownership.statement : void 0;
+      return isJsonObject(statement) && statement.version === 2 && !Object.hasOwn(statement, "relation_version");
+    }
+    return ["owner", "ownership_proof", "ownership_release"].some((field) => Object.hasOwn(meta, field));
+  }
+  _bodyRelationFields(meta) {
+    return Object.fromEntries(["owner", "ownership", "ownership_proof", "ownership_release"].filter((field) => Object.hasOwn(meta, field)).map((field) => [field, meta[field]]));
+  }
+  _sameBodyRelation(first, second) {
+    const stable = (value) => Array.isArray(value) ? value.map(stable) : isJsonObject(value) ? Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])])) : value;
+    return JSON.stringify(stable(first)) === JSON.stringify(stable(second));
+  }
+  async _readLegacyBodyFresh(target) {
+    const gateway = await this._resolveGateway(target);
+    const response = await fetchWithTimeout(this._url(target, gateway), { method: "GET", headers: { "X-AUN-Signature-Format": "multi-v1", Accept: "text/markdown", "Cache-Control": "no-cache" }, cache: "no-store", redirect: "error" });
+    if (response.status === 404) throw new StateError("legacy relationship cannot be created by an ordinary body update", { stringCode: "unsupported_protocol" });
+    const etag = headerValue(response.headers, "ETag");
+    if (response.status !== 200 || !etag) throw new StateError("legacy original document or ETag is unavailable", { stringCode: "unavailable", retryable: true });
+    let content;
+    try {
+      content = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(await response.arrayBuffer());
+    } catch {
+      throw new ValidationError("agent.md must be valid UTF-8", { stringCode: "invalid" });
+    }
+    return { content, etag, last_modified: headerValue(response.headers, "Last-Modified"), status: response.status };
+  }
+  async _verifyLegacyBodyOriginal(target, content) {
+    const parsed = validateAgentMdDocumentForRead(content, { expectedAid: target, validateOwnership: false, requireSignature: true });
+    const peer = await this._resolvePeer(target, parsed.signature.cert_fingerprint, Number(parsed.signature.timestamp));
+    const verified = await this._verifyPeerDocument(peer, content);
+    if (!verified.ok || verified.data.status !== "verified") throw new ClientSignatureError("legacy original agent.md signature verification failed", { stringCode: "invalid" });
+    return parsed.frontmatter;
+  }
+  async _verifyPeerDocument(peer, content) {
+    const parsed = parseAgentMdTailSignatureForRead(content);
+    const additionalCertificates = /* @__PURE__ */ new Map();
+    if (parsed.fields) additionalCertificates.set(`${parsed.fields.signer_aid ?? peer.aid};${parsed.fields.cert_fingerprint}`, peer);
+    for (const block of parsed.signatures.slice(1)) additionalCertificates.set(`${block.fields.signer_aid};${block.fields.cert_fingerprint}`, await this._resolvePeer(block.fields.signer_aid, block.fields.cert_fingerprint, Number(block.fields.timestamp)));
+    return await peer.verifyAgentMd(content, (signer, fingerprint) => {
+      const certificate = additionalCertificates.get(`${signer};${fingerprint}`);
+      if (!certificate) throw new StateError("additional signing certificate is unavailable", { stringCode: "unavailable", retryable: true });
+      return certificate;
+    });
+  }
+  async _verifyBodyUpload(target, content, signer) {
+    const meta = validateAgentMdDocument(content, { expectedAid: target, validateOwnership: false }).frontmatter;
+    await (this._isLegacyBodyRelation(meta) ? verifyAgentMdLegacyBodyUpload : verifyAgentMdUpload)(content, signer.certPem, target, void 0, async (aid2, fingerprint, timestamp2) => {
+      if (this._entitySignerResolver) return await this._entitySignerResolver(aid2, fingerprint);
+      return await this._resolvePeer(aid2, fingerprint, timestamp2);
+    });
+  }
   async _uploadPrepared(target, signed, signer, originalCondition) {
-    const meta = validateAgentMdDocument(signed, { expectedAid: target }).frontmatter;
+    const meta = validateAgentMdDocument(signed, { expectedAid: target, validateOwnership: false }).frontmatter;
+    if (this._isLegacyBodyRelation(meta)) validateOwnershipFrontmatter(Object.fromEntries(["aid", "type", "owner"].filter((field) => Object.hasOwn(meta, field)).map((field) => [field, meta[field]])), target);
+    if (!["group", "org"].includes(String(meta.type))) await this._verifyBodyUpload(target, signed, signer);
+    if (!originalCondition) {
+      const draft = await this.saveRecord(target, { local_draft_content: signed });
+      if (draft.local_draft_content !== signed) throw new StateError("agent.md local draft persistence failed", { stringCode: "persistence_unavailable" });
+    }
     const entity = ["group", "org"].includes(String(meta.type));
     const uploader = entity ? this._currentAid() ?? signer : signer;
     const entityContext = entity ? await this._entityContext(target, meta, uploader) : void 0;
-    if (entity) await verifyAgentMdUpload(signed, (await this._entityDocumentSigner(target, signed)).certPem, target);
+    if (entity) await this._verifyEntityDocument(target, signed);
     let condition = originalCondition;
     let relation = entityContext ?? (await this.pendingUpload(target))?.relation;
     if (!condition) {
-      const fresh = entity ? await this._readEntityFresh(target) : await this.readOwnershipFresh(target);
-      condition = fresh.exists ? { if_match: fresh.etag } : { if_none_match: "*" };
-      if (!entity) {
+      let fresh;
+      if (!entity && this._isLegacyBodyRelation(meta)) fresh = await this._readLegacyBodyFresh(target);
+      else {
+        try {
+          fresh = entity ? await this._readEntityFresh(target) : await this.readOwnershipFresh(target);
+        } catch (error) {
+          if (entity || !["unavailable", "unsupported_protocol"].includes(String(error?.stringCode))) throw error;
+          const legacy2 = await this._readLegacyBodyFresh(target);
+          const legacyMeta = validateAgentMdDocumentForRead(legacy2.content, { expectedAid: target, validateOwnership: false }).frontmatter;
+          if (!this._isLegacyBodyRelation(legacyMeta)) throw error;
+          fresh = legacy2;
+        }
+      }
+      const freshMeta = !entity && (!("exists" in fresh) || fresh.exists) && fresh.content ? validateAgentMdDocumentForRead(fresh.content, { expectedAid: target, validateOwnership: false }).frontmatter : void 0;
+      const legacy = !entity && (this._isLegacyBodyRelation(meta) || freshMeta && this._isLegacyBodyRelation(freshMeta));
+      if (legacy) {
+        if (!freshMeta || !this._isLegacyBodyRelation(freshMeta) || !this._sameBodyRelation(this._bodyRelationFields(meta), this._bodyRelationFields(freshMeta))) throw new StateError("legacy relationship changes require their original protocol", { stringCode: "unsupported_protocol" });
+        if (!fresh.etag) throw new StateError("legacy original document ETag is unavailable", { stringCode: "unavailable", retryable: true });
+        await this._verifyLegacyBodyOriginal(target, fresh.content);
+        condition = { if_match: fresh.etag };
+        relation = { protocol: "legacy", original_content: fresh.content, original_content_etag: await _AgentMdManager.contentEtag(fresh.content), original_etag: fresh.etag, fields: this._bodyRelationFields(freshMeta) };
+      } else {
         const authority = fresh;
-        const candidate = parseOwnershipFile(signed, "agent", { expectedSubAid: target });
-        const statement = fresh.exists && (authority.relation_version > 0 || candidate.statement) ? parseOwnershipFile(fresh.content, "agent", { expectedSubAid: target }).statement : void 0;
-        relation = { relation_version: authority.relation_version, lock: authority.lock, owner_aid: authority.owner_aid ?? statement?.owner_aid ?? null, statement: statement ?? null };
+        condition = authority.exists ? { if_match: fresh.etag } : { if_none_match: "*" };
+        if (!entity) {
+          const candidate = parseOwnershipFile(signed, "agent", { expectedSubAid: target });
+          const statement = authority.exists && (authority.relation_version > 0 || candidate.statement) ? parseOwnershipFile(fresh.content, "agent", { expectedSubAid: target }).statement : void 0;
+          relation = { relation_version: authority.relation_version, lock: authority.lock, owner_aid: authority.owner_aid ?? statement?.owner_aid ?? null, statement: statement ?? null };
+        }
       }
     }
-    const ownerUpload = entity && uploader.aid.toLowerCase() !== target.toLowerCase();
-    const entityAuthorization = ownerUpload ? originalCondition ? (await this.pendingUpload(target))?.authorization : await this._ownerUploadAuthorization(target, signed, uploader, String(entityContext.entity_cert_fingerprint)) : "";
-    if (ownerUpload) {
-      const timestamp2 = await this._validateEntityUploadAuthorization(entityAuthorization, target, signed, uploader, String(entityContext.entity_cert_fingerprint));
-      if (Math.abs(Math.floor(Date.now() / 1e3) - timestamp2) > 300) throw new StateError("pending entity V2 authorization expired; explicit upload is required", { stringCode: "conflict" });
+    if (relation?.protocol === "legacy") {
+      if (signer.aid.toLowerCase() !== target.toLowerCase() || this._currentAid()?.aid.toLowerCase() !== target.toLowerCase() || this._currentAid()?.certFingerprint !== signer.certFingerprint) throw new StateError("legacy body update requires its current subject identity", { stringCode: "forbidden" });
+      if (!this._isLegacyBodyRelation(meta) || !this._sameBodyRelation(this._bodyRelationFields(meta), relation.fields)) throw new StateError("legacy relationship changes require their original protocol", { stringCode: "unsupported_protocol" });
+      await this._verifyBodyUpload(target, signed, signer);
     }
+    const entityAuthorization = "";
     const pending = await this.saveRecord(target, { pending_operation: "replace", pending_target_aid: target, pending_content: signed, pending_content_etag: await _AgentMdManager.contentEtag(signed), pending_error: "", pending_condition: condition, pending_relation: relation, pending_authorization: entityAuthorization });
+    if (relation?.protocol === "legacy" && !this._sameBodyRelation(pending.pending_relation, relation)) throw new StateError("legacy original relationship snapshot persistence failed", { stringCode: "persistence_unavailable" });
     const savedCondition = pending.pending_condition;
     if (pending.pending_content !== signed || savedCondition?.if_match !== condition.if_match || savedCondition?.if_none_match !== condition.if_none_match || pending.pending_authorization !== entityAuthorization) throw new StateError("agent.md pending upload persistence failed");
     try {
       const owner = this._currentAid();
       const delegated = target.toLowerCase() !== this._ownerAid().toLowerCase();
       if (delegated && !owner?.isPrivateKeyValid()) throw new StateError("owner agent.md upload requires a loaded owner identity");
-      const authorization = entity ? entityAuthorization : delegated ? await this._ownerUploadAuthorization(target, signed, owner) : "";
-      const result = await this._uploadHttp(target, signed, authorization, condition);
+      const authorization = entity ? "" : delegated ? await this._ownerUploadAuthorization(target, signed, owner) : "";
+      const result = await this._uploadHttp(target, signed, authorization, condition, relation?.protocol === "legacy");
       const remoteEtag = String(result.etag ?? "").trim();
+      const contentEtag = await _AgentMdManager.contentEtag(signed);
       const saved = await this.saveRecord(target, {
         content: signed,
-        local_etag: await _AgentMdManager.contentEtag(signed),
+        local_etag: contentEtag,
         remote_etag: remoteEtag || void 0,
+        ...remoteEtag === contentEtag ? { local_draft_content: "" } : {},
         last_modified: String(result.last_modified ?? result.lastModified ?? "").trim(),
         fetched_at: Date.now(),
         checked_at: Date.now(),
@@ -9354,12 +9508,16 @@ var AgentMdManager = class _AgentMdManager {
   async readEntityAuthorityFresh(target) {
     const fresh = await this._readEntityFresh(this._safeAid(target));
     if (fresh.ownership_status !== "not_applicable" || !["current", "stale"].includes(fresh.entity_status ?? "") || !fresh.owner_aid || !/^sha256:[0-9a-f]{64}$/.test(fresh.entity_cert_fingerprint ?? "")) throw new StateError("entity current owner authority is unavailable", { stringCode: "unavailable", retryable: true });
-    return { owner_aid: this._safeAid(fresh.owner_aid), entity_cert_fingerprint: fresh.entity_cert_fingerprint };
+    try {
+      return { owner_aid: this._safeAid(ownershipAid(fresh.owner_aid, "owner_aid")), entity_cert_fingerprint: fresh.entity_cert_fingerprint };
+    } catch {
+      throw new StateError("entity current owner authority is unavailable", { stringCode: "unavailable", retryable: true });
+    }
   }
   async _readEntityFresh(target) {
     const gateway = await this._resolveGateway(target);
     const viaGatewayHost = this._uploadViaGatewayHost && nodeBuiltin("node:http") !== null;
-    const headers = { "Cache-Control": "no-cache", ...viaGatewayHost ? { Host: target } : {} };
+    const headers = { "X-AUN-Signature-Format": "multi-v1", "X-AUN-Ownership-Check": "1", "Cache-Control": "no-cache", ...viaGatewayHost ? { Host: target } : {} };
     let url = this._url(target, gateway);
     if (viaGatewayHost) {
       const parsed = new URL(gateway);
@@ -9404,7 +9562,7 @@ var AgentMdManager = class _AgentMdManager {
   }
   async _entityContext(target, meta, signer) {
     const owner = String(meta.owner ?? "").trim().toLowerCase();
-    if (![owner, target.toLowerCase()].includes(signer.aid.toLowerCase()) || signer.aid.toLowerCase() !== this._ownerAid().toLowerCase()) throw new StateError("group/org agent.md requires entity or current owner uploader", { stringCode: "forbidden" });
+    if (signer.aid.toLowerCase() !== owner || signer.aid.toLowerCase() !== this._ownerAid().toLowerCase()) throw new StateError("group/org agent.md requires current owner uploader", { stringCode: "forbidden" });
     const context = await this._entityCurrentContext(target, meta, true);
     if (signer.aid.toLowerCase() === owner) await this._verifyEntityOwnerSigner(signer);
     else if (signer.certFingerprint !== context.entity_cert_fingerprint) throw new StateError("entity uploader certificate generation changed", { stringCode: "conflict" });
@@ -9424,6 +9582,15 @@ var AgentMdManager = class _AgentMdManager {
     if (signer.aid.toLowerCase() !== signerAid.toLowerCase() || signer.certFingerprint !== parsed.signature.cert_fingerprint) throw new StateError("entity signing certificate changed", { stringCode: "conflict" });
     return signer;
   }
+  async _verifyEntityDocument(target, content) {
+    const primary = await this._entityDocumentSigner(target, content);
+    await verifyAgentMdUpload(content, primary.certPem, target, void 0, async (signer, fingerprint) => {
+      if (!this._entitySignerResolver) throw new StateError("entity additional signing certificate resolver is unavailable", { stringCode: "unavailable", retryable: true });
+      const material = await this._entitySignerResolver(signer, fingerprint);
+      if (material.aid !== signer || material.certFingerprint !== fingerprint) throw new StateError("entity additional signing certificate changed", { stringCode: "conflict" });
+      return material;
+    });
+  }
   async _verifyEntityOwnerSigner(owner) {
     if (!this._entitySignerResolver) throw new StateError("entity owner signing certificate resolver is unavailable", { stringCode: "unavailable", retryable: true });
     const fresh = await this._entitySignerResolver(owner.aid, owner.certFingerprint);
@@ -9434,23 +9601,23 @@ var AgentMdManager = class _AgentMdManager {
   async download(aid2, timeoutMs = DEFAULT_HTTP_TIMEOUT_MS) {
     const target = this._safeAid(String(aid2 ?? this._ownerAid() ?? "").trim());
     const contentResult = await this._downloadHttp(target, timeoutMs);
-    const parsed = parseAgentMdTailSignature(contentResult.content);
+    const parsed = parseAgentMdTailSignatureForRead(contentResult.content);
     let entity = false;
     try {
-      entity = ["group", "org"].includes(String(parseFileFrontmatter(parsed.payload).type));
+      entity = ["group", "org"].includes(String(parseFileFrontmatter(parsed.payload, false, false).type));
     } catch {
     }
     let frontmatter;
     try {
-      frontmatter = validateAgentMdDocument(contentResult.content, { expectedAid: target, validateOwnership: false, ...entity ? { requireSignature: true } : {} }).frontmatter;
+      frontmatter = validateAgentMdDocumentForRead(contentResult.content, { expectedAid: target, validateOwnership: false, ...entity ? { requireSignature: true } : {} }).frontmatter;
     } catch (error) {
       if (entity) throw new ValidationError(error instanceof Error ? error.message : String(error), { stringCode: "invalid" });
       throw error;
     }
     const expectedFp = parsed.fields?.cert_fingerprint || parsed.fields?.public_key_fingerprint || null;
-    if (entity) await this._entityCurrentContext(target, frontmatter);
-    const peer = entity ? await this._entityDocumentSigner(target, contentResult.content) : await this._resolvePeer(target, expectedFp, parsed.fields?.timestamp ? Number(parsed.fields.timestamp) : void 0);
-    const verified = await peer.verifyAgentMd(contentResult.content);
+    const signerAid = entity ? parsed.fields?.signer_aid ?? target : target;
+    const peer = await this._resolvePeer(signerAid, expectedFp, parsed.fields?.timestamp ? Number(parsed.fields.timestamp) : void 0);
+    const verified = await this._verifyPeerDocument(peer, contentResult.content);
     if (!verified.ok) throw new AUNError(verified.error.message);
     const signature2 = { ...verified.data };
     const statusText = String(signature2.status ?? "invalid");
@@ -9704,14 +9871,14 @@ var AgentMdManager = class _AgentMdManager {
     const root = this.root;
     await this._writeStorage(this._contentKey(aid2), String(content ?? ""), root);
   }
-  async loadRecord(aid2) {
+  async loadRecord(aid2, strict = false) {
     const target = String(aid2 ?? "").trim();
     if (!target) return null;
     const root = this.root;
     const generation = this._storageGeneration;
     try {
       const loaded = await this._withLock(async () => {
-        const record = await this._readRecordUnlocked(target, root);
+        const record = await this._readRecordUnlocked(target, root, strict);
         const next = Object.keys(record).length > 0 ? { ...record, aid: target } : { aid: target };
         try {
           const content = await this._readStorage(this._contentKey(target), root);
@@ -9731,6 +9898,7 @@ var AgentMdManager = class _AgentMdManager {
       if (generation === this._storageGeneration) this._cache.set(target, { ...loaded });
       return { ...loaded };
     } catch (err) {
+      if (strict) throw err;
       this._log.debug(`agent.md cache load skipped: aid=${target} err=${err instanceof Error ? err.message : String(err)}`);
       return null;
     }
@@ -9740,10 +9908,12 @@ var AgentMdManager = class _AgentMdManager {
     if (!target) return {};
     const root = this.root;
     const generation = this._storageGeneration;
+    let strictDraft = false;
     try {
       const inputFields = { ...fields };
+      strictDraft = typeof inputFields.local_draft_content === "string";
       const hasContent = Object.prototype.hasOwnProperty.call(inputFields, "content") && inputFields.content !== void 0 && inputFields.content !== null;
-      if (hasContent) {
+      if (hasContent && !strictDraft) {
         const text3 = String(inputFields.content ?? "");
         await this._writeStorage(this._contentKey(target), text3, root);
         if (!inputFields.local_etag) inputFields.local_etag = await _AgentMdManager.contentEtag(text3);
@@ -9751,8 +9921,15 @@ var AgentMdManager = class _AgentMdManager {
       }
       delete inputFields.content;
       const record = await this._withLock(async () => {
-        const next = { ...await this._readRecordUnlocked(target, root), aid: target };
+        const next = { ...await this._readRecordUnlocked(target, root, strictDraft), aid: target };
+        if (hasContent && strictDraft) {
+          const text3 = String(fields.content ?? "");
+          await this._writeStorage(this._contentKey(target), text3, root);
+          if (!inputFields.local_etag) inputFields.local_etag = await _AgentMdManager.contentEtag(text3);
+          if (!inputFields.fetched_at) inputFields.fetched_at = Date.now();
+        }
         for (const [key, value] of Object.entries(inputFields)) {
+          if (key === "local_draft_content" && value === "" && hasContent && next.local_draft_content !== fields.content) continue;
           if (value !== void 0 && value !== null) next[key] = value;
         }
         next.updated_at = Date.now();
@@ -9764,6 +9941,7 @@ var AgentMdManager = class _AgentMdManager {
       if (generation === this._storageGeneration) this._cache.set(target, { ...loaded });
       return { ...loaded };
     } catch (err) {
+      if (strictDraft) throw err;
       this._log.debug(`agent.md cache save skipped: aid=${target} err=${err instanceof Error ? err.message : String(err)}`);
       return {};
     }
@@ -9820,7 +9998,8 @@ var AgentMdManager = class _AgentMdManager {
     return String(await this._gatewayResolver?.(aid2) ?? "");
   }
   async _resolvePeer(aid2, certFingerprint, signedAt) {
-    const expectedFp = String(certFingerprint ?? "").trim().toLowerCase();
+    const normalizedFp = normalizeFingerprintHex(certFingerprint);
+    const expectedFp = normalizedFp ? `sha256:${normalizedFp}` : String(certFingerprint ?? "").trim().toLowerCase();
     const current = this._currentAid();
     if (current && current.aid.toLowerCase() === aid2.toLowerCase()) {
       if (!expectedFp || await certMatchesFingerprint(current.certPem, expectedFp)) return current;
@@ -9829,6 +10008,7 @@ var AgentMdManager = class _AgentMdManager {
     if (!(peer instanceof AID)) {
       throw new StateError(`agent.md peer resolver did not return AID for ${aid2}`);
     }
+    if (peer.aid.toLowerCase() !== aid2.toLowerCase()) throw new ClientSignatureError(`agent.md signer does not match requested AID: ${aid2}`, { stringCode: "invalid" });
     return peer;
   }
   async _accessToken(aid2, gatewayUrl) {
@@ -9842,44 +10022,21 @@ var AgentMdManager = class _AgentMdManager {
     if (!token) throw new StateError("authenticate did not return access_token");
     return token;
   }
-  async _validateEntityUploadAuthorization(authorization, target, content, owner, entityFingerprint) {
-    const invalid2 = new StateError("pending entity original V2 authorization is missing or invalid", { stringCode: "persistence_unavailable" });
-    try {
-      if (typeof authorization !== "string" || !/^[A-Za-z0-9_-]+={0,2}$/.test(authorization) || authorization.includes("=") && authorization.length % 4 !== 0) throw invalid2;
-      const binary2 = globalThis.atob(authorization.replace(/-/g, "+").replace(/_/g, "/"));
-      const text3 = new TextDecoder("utf-8", { fatal: true }).decode(Uint8Array.from(binary2, (char) => char.charCodeAt(0)));
-      if (base64UrlEncode(text3) !== authorization.replace(/=+$/, "")) throw invalid2;
-      const value = JSON.parse(text3);
-      const lexical = parseDocument(text3, { uniqueKeys: true });
-      if (lexical.errors.length || lexical.get("version", true)?.source !== "2" || !/^[1-9][0-9]*$/.test(lexical.get("timestamp", true)?.source ?? "")) throw invalid2;
-      const fields = ["version", "target_aid", "uploader_aid", "body_sha256", "entity_cert_fingerprint", "timestamp", "nonce", "cert_fingerprint", "signature"];
-      if (!isJsonObject(value) || Object.keys(value).length !== fields.length || fields.some((field) => !(field in value)) || value.version !== 2) throw invalid2;
-      const timestamp2 = value.timestamp, nonce = value.nonce;
-      if (typeof timestamp2 !== "number" || !Number.isSafeInteger(timestamp2) || timestamp2 <= 0 || typeof nonce !== "string" || !nonce.trim() || new TextEncoder().encode(nonce).length > 128) throw invalid2;
-      if (value.target_aid !== target.toLowerCase() || value.uploader_aid !== owner.aid.toLowerCase() || value.body_sha256 !== await sha256Hex2(content) || value.entity_cert_fingerprint !== entityFingerprint || value.cert_fingerprint !== owner.certFingerprint || typeof value.signature !== "string") throw invalid2;
-      const verified = await owner.verify(`AUN-AGENTMD-OWNER-AUTH-V2;${value.uploader_aid};${value.target_aid};${value.body_sha256};${entityFingerprint};${timestamp2};${nonce}`, value.signature);
-      if (!verified.ok || !verified.data?.valid) throw invalid2;
-      return timestamp2;
-    } catch {
-      throw invalid2;
-    }
-  }
-  async _ownerUploadAuthorization(target, content, owner, entityFingerprint = "") {
+  async _ownerUploadAuthorization(target, content, owner) {
     const bodySha256 = await sha256Hex2(content);
     const timestamp2 = Math.floor(Date.now() / 1e3);
     const nonce = randomOwnerAuthorizationNonce();
-    const canonical = entityFingerprint ? `AUN-AGENTMD-OWNER-AUTH-V2;${owner.aid.toLowerCase()};${target.toLowerCase()};${bodySha256};${entityFingerprint};${timestamp2};${nonce}` : `AUN-AGENT-MD-UPLOAD-V1;${owner.aid.toLowerCase()};${target.toLowerCase()};${bodySha256};${timestamp2};${nonce}`;
+    const canonical = `AUN-AGENT-MD-UPLOAD-V1;${owner.aid.toLowerCase()};${target.toLowerCase()};${bodySha256};${timestamp2};${nonce}`;
     const signed = await owner.sign(canonical);
     if (!signed.ok || !signed.data) {
       const message = signed.error?.message || "owner authorization signing failed";
       throw new ClientSignatureError(message);
     }
     return base64UrlEncode(JSON.stringify({
-      version: entityFingerprint ? 2 : 1,
+      version: 1,
       target_aid: target.toLowerCase(),
       uploader_aid: owner.aid.toLowerCase(),
       body_sha256: bodySha256,
-      ...entityFingerprint ? { entity_cert_fingerprint: entityFingerprint } : {},
       timestamp: timestamp2,
       nonce,
       cert_fingerprint: owner.certFingerprint,
@@ -9889,18 +10046,20 @@ var AgentMdManager = class _AgentMdManager {
   _url(aid2, gatewayUrl) {
     return `${agentMdHttpScheme(gatewayUrl)}://${this._safeAid(aid2)}/agent.md`;
   }
-  async _uploadHttp(aid2, content, ownerAuthorization = "", condition) {
+  async _uploadHttp(aid2, content, ownerAuthorization = "", condition, legacyBodyUpdate = false) {
     if (!condition || Object.keys(condition).length !== 1 || !(typeof condition.if_match === "string" && condition.if_match || condition.if_none_match === "*")) throw new StateError("agent.md upload requires its original document condition", { stringCode: "persistence_unavailable" });
     const gatewayUrl = await this._resolveGateway(aid2);
     const authorization = String(ownerAuthorization ?? "").trim();
-    const entity = ["group", "org"].includes(String(validateAgentMdDocument(content, { expectedAid: aid2 }).frontmatter.type));
+    const meta = validateAgentMdDocument(content, { expectedAid: aid2, validateOwnership: false }).frontmatter;
+    const entity = ["group", "org"].includes(String(meta.type));
     const viaGatewayHost = this._uploadViaGatewayHost && nodeBuiltin("node:http") !== null;
     const headers = {
+      "X-AUN-Signature-Format": "multi-v1",
       "Content-Type": "text/markdown; charset=utf-8",
-      ...!entity ? { "X-AUN-Ownership-Check": "1" } : {},
+      ...!entity && !(legacyBodyUpdate && this._isLegacyBodyRelation(meta)) ? { "X-AUN-Ownership-Check": "1" } : {},
       ...condition.if_match ? { "If-Match": condition.if_match } : { "If-None-Match": "*" },
       ...viaGatewayHost ? { Host: this._safeAid(aid2) } : {},
-      ...authorization ? { [entity ? "AUN-AGENTMD-OWNER-AUTHORIZATION" : "X-AUN-AgentMD-Owner-Authorization"]: authorization } : {}
+      ...!entity && authorization ? { "X-AUN-AgentMD-Owner-Authorization": authorization } : {}
     };
     if (!authorization || entity) {
       const token = await this._uploadAccessToken(aid2, gatewayUrl);
@@ -9921,17 +10080,17 @@ var AgentMdManager = class _AgentMdManager {
     }
     let response;
     try {
-      response = await fetchWithTimeout(url, { method: "PUT", headers, body: content });
+      response = await fetchWithTimeout(url, { method: "PUT", headers, body: content, redirect: "error" });
     } catch (error) {
       if (!viaGatewayHost) throw error;
       const fallbackUrl = nameServiceAgentMdUrl(aid2, gatewayUrl);
       if (!fallbackUrl || fallbackUrl === url) throw error;
-      response = await fetchWithTimeout(fallbackUrl, { method: "PUT", headers, body: content });
+      response = await fetchWithTimeout(fallbackUrl, { method: "PUT", headers, body: content, redirect: "error" });
     }
     if (response.status === 404 && viaGatewayHost) {
       const fallbackUrl = nameServiceAgentMdUrl(aid2, gatewayUrl);
       if (fallbackUrl && fallbackUrl !== url) {
-        response = await fetchWithTimeout(fallbackUrl, { method: "PUT", headers, body: content });
+        response = await fetchWithTimeout(fallbackUrl, { method: "PUT", headers, body: content, redirect: "error" });
       }
     }
     if (response.status === 404) {
@@ -9954,13 +10113,13 @@ var AgentMdManager = class _AgentMdManager {
     const cached = await this.loadRecord(target) ?? {};
     const gatewayUrl = await this._resolveGateway(target);
     const url = this._url(target, gatewayUrl);
-    const headers = { Accept: "text/markdown" };
+    const headers = { "X-AUN-Signature-Format": "multi-v1", Accept: "text/markdown" };
     const cachedEtag = String(cached.remote_etag ?? cached.etag ?? cached.local_etag ?? "").trim();
     const cachedLastModified = String(cached.last_modified ?? "").trim();
     let response = await fetchWithTimeout(url, {
       method: "GET",
       headers,
-      redirect: "follow"
+      redirect: "error"
     }, timeoutMs);
     if (response.status === 304 && cached.content !== void 0 && cached.content !== null) {
       return {
@@ -9973,8 +10132,8 @@ var AgentMdManager = class _AgentMdManager {
     if (response.status === 304) {
       response = await fetchWithTimeout(url, {
         method: "GET",
-        headers: { Accept: "text/markdown" },
-        redirect: "follow"
+        headers: { "X-AUN-Signature-Format": "multi-v1", Accept: "text/markdown" },
+        redirect: "error"
       }, timeoutMs);
     }
     if (response.status === 404) {
@@ -10003,7 +10162,7 @@ var AgentMdManager = class _AgentMdManager {
     const gatewayUrl = await this._resolveGateway(target);
     const response = await fetchWithTimeout(this._url(target, gatewayUrl), {
       method: "HEAD",
-      headers: { Accept: "text/markdown" }
+      headers: { "X-AUN-Signature-Format": "multi-v1", Accept: "text/markdown" }
     }, HEAD_HTTP_TIMEOUT_MS);
     const etag = headerValue(response.headers, "ETag");
     const lastModified = headerValue(response.headers, "Last-Modified");
@@ -10095,12 +10254,18 @@ var AgentMdManager = class _AgentMdManager {
     await this._writeStorage(this._metaKey(aid2), `${JSON.stringify(payload, null, 2)}
 `, root);
   }
-  async _readRecordUnlocked(aid2, root = this.root) {
-    const raw = await this._readStorage(this._metaKey(aid2), root);
-    if (raw === null) return {};
+  async _readRecordUnlocked(aid2, root = this.root, strict = false) {
     try {
-      return this._normalizeRecord(aid2, JSON.parse(raw));
+      const raw = await this._readStorage(this._metaKey(aid2), root);
+      if (raw === null) return {};
+      const parsed = JSON.parse(raw);
+      if (strict && !isRecord(parsed)) throw new StateError("agent.md metadata is damaged", { stringCode: "persistence_unavailable" });
+      return this._normalizeRecord(aid2, parsed);
     } catch (err) {
+      if (strict) {
+        if (err instanceof StateError) throw err;
+        throw new StateError("agent.md metadata is damaged", { stringCode: "persistence_unavailable" });
+      }
       this._log.warn(`agent.md metadata damaged, ignoring: aid=${aid2} err=${err instanceof Error ? err.message : String(err)}`);
       return {};
     }
@@ -10215,10 +10380,11 @@ function parseOwnershipFile(content, role, context = {}) {
   if (new TextEncoder().encode(parsed.payload).length > 4096) throw new ValidationError("ownership file payload exceeds 4096 bytes");
   if (raw.length - new TextEncoder().encode(parsed.payload).length > 2048) throw new ValidationError("ownership file signature exceeds 2048 bytes");
   const fields = parsed.fields;
-  if (fields) {
-    if (!/^sha256:[0-9a-f]{64}$/.test(fields.cert_fingerprint) || fields.public_key_fingerprint !== void 0 && !/^sha256:[0-9a-f]{64}$/.test(fields.public_key_fingerprint)) throw new ValidationError("ownership file fingerprint is invalid");
-    if (!/^[1-9][0-9]*$/.test(fields.timestamp) || !Number.isSafeInteger(Number(fields.timestamp))) throw new ValidationError("ownership file timestamp must be a positive integer");
-    if (!strictDerSignature(fields.signature)) throw new ValidationError("ownership file signature must be strict Base64 DER");
+  if (fields?.signer_aid !== void 0) throw new ValidationError("ownership main signature contains unknown signer_aid");
+  for (const { fields: fields2 } of parsed.signatures) {
+    if (!/^sha256:[0-9a-f]{64}$/.test(fields2.cert_fingerprint) || fields2.public_key_fingerprint !== void 0 && !/^sha256:[0-9a-f]{64}$/.test(fields2.public_key_fingerprint)) throw new ValidationError("ownership file fingerprint is invalid");
+    if (!/^[1-9][0-9]*$/.test(fields2.timestamp) || !Number.isSafeInteger(Number(fields2.timestamp))) throw new ValidationError("ownership file timestamp must be a positive integer");
+    if (!strictDerSignature(fields2.signature)) throw new ValidationError("ownership file signature must be strict Base64 DER");
   }
   let frontmatter;
   let statement;
@@ -10249,7 +10415,7 @@ function parseOwnershipFile(content, role, context = {}) {
       transfer = value;
     }
   } else throw new ValidationError("ownership file role is invalid");
-  return { raw, payload: parsed.payload, frontmatter, signature: fields, statement, action, transfer };
+  return { raw, payload: parsed.payload, frontmatter, signature: fields, signatures: parsed.signatures, statement, action, transfer };
 }
 async function verifyOwnershipFile(content, role, certificate, context = {}) {
   const parsed = parseOwnershipFile(content, role, { ...context, requireSignature: true });
@@ -10259,13 +10425,17 @@ async function verifyOwnershipFile(content, role, certificate, context = {}) {
   const storagePath = role === "agent" ? "agent.md" : `sub_aids/${sub}/owner.md`;
   if (context.expectedTargetAid && context.expectedTargetAid !== sub || context.authenticatedAid && context.authenticatedAid !== signer || context.certificateAid && context.certificateAid !== signer || context.resourcePath && context.resourcePath !== `${signer}:/${storagePath}` || context.storagePath && context.storagePath !== storagePath) throw new ValidationError("ownership file resource or authenticated identity mismatch");
   const now = Math.trunc(context.now ?? Date.now() / 1e3);
-  if (Number(fields.timestamp) > now + 300) throw new ValidationError("ownership file timestamp is too far in the future");
-  if (certificate.chain_valid === false || certificate.revoked === true || typeof certificate.state === "string" && certificate.state !== "active_signing") throw new ValidationError("ownership signing certificate is not currently verified and active_signing", { stringCode: "invalid" });
-  if (certificate.chain_valid !== true || certificate.state !== "active_signing" || certificate.revoked !== false || certificate.revocation_checked !== true || !Number.isSafeInteger(certificate.observed_at) || certificate.observed_at <= 0 || certificate.observed_at > now + 5 || certificate.observed_at < now - 30) throw new StateError("ownership certificate current status is unavailable", { stringCode: "unavailable", retryable: true });
-  validateAgentMdCertificate(certificate.cert_pem, signer, Number(fields.timestamp), now);
-  if (await certificateSha256Fingerprint(certificate.cert_pem) !== fields.cert_fingerprint) throw new ValidationError("ownership certificate fingerprint mismatch");
-  if (fields.public_key_fingerprint && !await publicKeyMatchesFingerprint(certificate.cert_pem, fields.public_key_fingerprint)) throw new ValidationError("ownership public key fingerprint mismatch");
-  if (!await verifySignatureWithCert(certificate.cert_pem, fields.signature, new TextEncoder().encode(parsed.payload))) throw new ValidationError("ownership file signature verification failed");
+  const verified = await verifyDocument(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(parsed.raw), async (blockSigner, fingerprint, timestamp2) => {
+    const material = blockSigner === signer && fingerprint === fields.cert_fingerprint ? certificate : context.certificateResolver ? await context.certificateResolver(blockSigner, fingerprint) : null;
+    if (!material) throw new StateError("ownership additional signing certificate is unavailable", { stringCode: "unavailable", retryable: true });
+    if (material.chain_valid === false || material.revoked === true || typeof material.state === "string" && material.state !== "active_signing") throw new ValidationError("ownership signing certificate is not currently verified and active_signing", { stringCode: "invalid" });
+    if (material.chain_valid !== true || material.state !== "active_signing" || material.revoked !== false || material.revocation_checked !== true || !Number.isSafeInteger(material.observed_at) || material.observed_at <= 0 || material.observed_at > now + 5 || material.observed_at < now - 30) throw new StateError("ownership certificate current status is unavailable", { stringCode: "unavailable", retryable: true });
+    validateAgentMdCertificate(material.cert_pem, blockSigner, timestamp2, now);
+    return material.cert_pem;
+  }, { expectedAid: signer, now, requireCurrentValidity: true });
+  if (!verified.valid) {
+    throw new ValidationError(verified.reason || "ownership file signature verification failed");
+  }
   return parsed;
 }
 async function signOwnershipFile(identity, content, role, context = {}) {
@@ -10277,8 +10447,7 @@ async function signOwnershipFile(identity, content, role, context = {}) {
   if (!parsed.payload.endsWith("\n") && !parsed.payload.endsWith("\r")) throw new ValidationError("ownership payload must end with a newline before signature");
   const now = Math.trunc(context.now ?? Date.now() / 1e3);
   validateAgentMdCertificate(identity.certPem, identity.aid, now, now);
-  const signature2 = await signBytes(identity.privateKeyPem, new TextEncoder().encode(parsed.payload));
-  return parsed.payload + buildAgentMdSignatureBlock(identity.certFingerprint, now, signature2, await publicKeyFingerprint(identity.certPem), role === "agent" ? "AUN-SIGNATURE-AGENTMD-V2" : "AUN-SIGNATURE-OWNERSHIP-V2");
+  return (await signDocument(identity, parsed.payload, { now, tag: role === "agent" ? "AGENTMD-V2" : "OWNERSHIP-V2" })).signed;
 }
 async function ownershipSha256(content) {
   const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
@@ -10301,9 +10470,9 @@ var OwnershipStorageAdapter = class {
       if (!result || typeof result !== "object" || Array.isArray(result)) throw this.error("unavailable", "Storage authoritative result unavailable");
       return result;
     } catch (error) {
-      if (error instanceof StateError && error.stringCode) throw error;
+      if (error instanceof StateError && error.stringCode) throw error.stringCode === "forbidden" && (method === "storage.head_object" || method === "storage.get_object") ? this.error("unavailable", error.message) : error;
       const code = error?.code;
-      throw this.error(code === -32009 ? "conflict" : code === -32004 ? "forbidden" : code === -32601 || code === -32602 ? "unsupported_protocol" : "unavailable", `Storage ownership request failed: ${String(error)}`);
+      throw this.error(code === -32009 ? "conflict" : code === -32004 ? method === "storage.head_object" || method === "storage.get_object" ? "unavailable" : "forbidden" : code === -32601 ? "unsupported_protocol" : code === -32602 ? "invalid" : "unavailable", `Storage ownership request failed: ${String(error)}`);
     }
   }
   metadata(value, ownerAid, path) {
@@ -10311,20 +10480,20 @@ var OwnershipStorageAdapter = class {
     const observed = value.observed_at;
     const service = `st.${ownerAid.slice(ownerAid.indexOf(".") + 1)}`;
     if (Object.hasOwn(value, "service_aid") && value.service_aid !== service || Object.hasOwn(value, "authenticated_service_aid") && value.authenticated_service_aid !== service) throw this.error("unavailable", "Storage authoritative service identity unavailable");
-    if (value.consistency !== "authoritative" || Object.hasOwn(value, "recovery_ready") && value.recovery_ready !== true || value.owner_aid !== ownerAid || value.bucket !== "default" || value.path !== path || typeof value.exists !== "boolean" || typeof value.revision !== "string" || !value.revision || !Number.isSafeInteger(observed) || observed < now - 30 || observed > now + 5 || observed <= 0) throw this.error("unavailable", "Storage authoritative namespace, revision or freshness unavailable");
-    if (value.exists && (typeof value.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(value.sha256) || typeof value.object_id !== "string" || !value.object_id || !Number.isSafeInteger(value.version) || Number(value.version) <= 0)) throw this.error("unavailable", "Storage authoritative object metadata unavailable");
+    if (value.consistency !== "authoritative" || Object.hasOwn(value, "recovery_ready") && value.recovery_ready !== true || value.owner_aid !== ownerAid || value.bucket !== "default" || value.path !== path || typeof value.exists !== "boolean" || !Number.isSafeInteger(observed) || observed < now - 30 || observed > now + 5 || observed <= 0) throw this.error("unavailable", "Storage authoritative namespace or freshness unavailable");
+    if (value.exists && (typeof value.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(value.sha256))) throw this.error("unavailable", "Storage authoritative object metadata unavailable");
     return {
       owner_aid: ownerAid,
       bucket: "default",
       path,
       exists: value.exists,
-      revision: value.revision,
       observed_at: observed,
       sha256: value.exists ? String(value.sha256) : "",
       content: "",
       authoritative: true,
       service_aid: service,
-      authenticated_service_aid: service
+      authenticated_service_aid: service,
+      version: value.exists && Number.isSafeInteger(value.version) && Number(value.version) > 0 ? Number(value.version) : void 0
     };
   }
   async readFile(ownerAid, path) {
@@ -10334,9 +10503,9 @@ var OwnershipStorageAdapter = class {
     const beforeRaw = await this.request("storage.head_object", params2);
     const before = this.metadata(beforeRaw, ownerAid, path);
     if (!before.exists) return before;
-    const body = await this.request("storage.get_object", { ...params2, expected_revision: before.revision });
+    const body = await this.request("storage.get_object", params2);
     const current = this.metadata(body, ownerAid, path);
-    if (!current.exists || current.revision !== before.revision || current.sha256 !== before.sha256 || body.object_id !== beforeRaw.object_id || body.version !== beforeRaw.version) throw this.error("unavailable", "Storage ownership body revision changed");
+    if (!current.exists || current.sha256 !== before.sha256) throw this.error("unavailable", "Storage ownership body changed");
     if (typeof body.content !== "string") throw this.error("unavailable", "Storage ownership body is unavailable");
     if (body.content !== "" && !isStrictBase64(body.content)) throw this.error("unavailable", "Storage ownership body is not strict Base64");
     const bytes = base64ToUint8(body.content);
@@ -10349,28 +10518,43 @@ var OwnershipStorageAdapter = class {
     }
     const afterRaw = await this.request("storage.head_object", params2);
     const after = this.metadata(afterRaw, ownerAid, path);
-    if (!after.exists || after.revision !== before.revision || after.sha256 !== before.sha256 || afterRaw.object_id !== beforeRaw.object_id || afterRaw.version !== beforeRaw.version || Math.trunc(this.deps.now?.() ?? Date.now() / 1e3) - began > 30) throw this.error("unavailable", "Storage ownership changed during authoritative read");
+    if (!after.exists || after.sha256 !== before.sha256 || Math.trunc(this.deps.now?.() ?? Date.now() / 1e3) - began > 30) throw this.error("unavailable", "Storage ownership changed during authoritative read");
     return { ...after, content };
   }
   async readOwnerMd(ownerAid, subAid) {
     return await this.readFile(ownerAid, `sub_aids/${ownershipAid(subAid, "sub_aid")}/owner.md`);
   }
-  async writeOwnerMd(ownerAid, subAid, raw, expectedRevision) {
+  async writeOwnerMd(ownerAid, subAid, raw) {
     if (ownerAid !== this.deps.currentAid()) throw this.error("forbidden", "only the authenticated owner may publish owner.md");
-    if (typeof expectedRevision !== "string" || !expectedRevision) throw this.error("invalid", "ownership expected_revision is required");
+    const path = `sub_aids/${ownershipAid(subAid, "sub_aid")}/owner.md`;
+    const before = await this.readOwnerMd(ownerAid, subAid);
     const bytes = new TextEncoder().encode(raw);
-    let binary2 = "";
-    for (const byte of bytes) binary2 += String.fromCharCode(byte);
-    await this.request("storage.put_object", { owner_aid: ownershipAid(ownerAid, "owner_aid"), bucket: "default", object_key: `sub_aids/${ownershipAid(subAid, "sub_aid")}/owner.md`, content: btoa(binary2), content_type: "text/markdown", is_private: false, overwrite: true, expected_revision: expectedRevision });
+    const expectedVersion = before.exists ? before.version : 0;
+    if (typeof expectedVersion !== "number" || !Number.isSafeInteger(expectedVersion) || expectedVersion < (before.exists ? 1 : 0)) throw this.error("unavailable", "Storage owner.md version is unavailable");
+    const session = await this.request("storage.create_upload_session", { owner_aid: ownershipAid(ownerAid, "owner_aid"), bucket: "default", object_key: path, size_bytes: bytes.length, content_type: "text/markdown; charset=utf-8", expected_version: expectedVersion, overwrite: true });
+    const uploadURL = String(session.upload_url ?? ""), sessionID = String(session.session_id ?? "");
+    if (!uploadURL || !sessionID) throw this.error("unavailable", "Storage owner.md upload session is incomplete");
+    const headers = {};
+    if (session.headers && typeof session.headers === "object") {
+      for (const [key, value] of Object.entries(session.headers)) if (value !== void 0 && value !== null && key.toLowerCase() !== "content-type") headers[key] = String(value);
+    }
+    headers["Content-Type"] = "text/markdown; charset=utf-8";
+    if (this.deps.httpPut) await this.deps.httpPut(uploadURL, bytes, headers);
+    else {
+      const response = await fetch(uploadURL, { method: "PUT", body: bytes, headers });
+      if (!response.ok) throw this.error("unavailable", `Storage owner.md HTTP PUT failed: ${response.status}`);
+    }
+    const complete = { owner_aid: ownerAid, bucket: "default", object_key: path, session_id: sessionID, size_bytes: bytes.length, sha256: await ownershipSha256(bytes), content_type: "text/markdown; charset=utf-8", is_private: false, overwrite: true };
+    complete.expected_version = expectedVersion;
+    await this.request("storage.complete_upload", complete);
     return await this.readOwnerMd(ownerAid, subAid);
   }
-  async deleteOwnerMd(ownerAid, subAid, expectedRevision) {
+  async deleteOwnerMd(ownerAid, subAid) {
     if (ownerAid !== this.deps.currentAid()) throw this.error("forbidden", "only the authenticated owner may delete owner.md");
-    if (typeof expectedRevision !== "string" || !expectedRevision) throw this.error("invalid", "ownership expected_revision is required");
     const path = `sub_aids/${ownershipAid(subAid, "sub_aid")}/owner.md`;
-    await this.request("storage.delete_object", { owner_aid: ownershipAid(ownerAid, "owner_aid"), bucket: "default", object_key: path, expected_revision: expectedRevision });
+    await this.request("storage.delete_object", { owner_aid: ownershipAid(ownerAid, "owner_aid"), bucket: "default", object_key: path });
     const after = this.metadata(await this.request("storage.head_object", { owner_aid: ownerAid, bucket: "default", object_key: path, consistency: "authoritative" }), ownerAid, path);
-    if (after.exists || after.revision === expectedRevision) throw this.error("conflict", "Storage ownership deletion could not be confirmed");
+    if (after.exists) throw this.error("conflict", "Storage ownership deletion could not be confirmed");
   }
 };
 function requireOwnershipApplicable(type) {
@@ -10390,12 +10574,12 @@ var OwnershipFiles = class {
   validateAgentSnapshot(snapshot, subAid) {
     if (snapshot.protocol !== "2.1") throw new StateError("NS ownership 2.1 protocol capability is unavailable", { stringCode: "unsupported_protocol", retryable: true });
     if (snapshot.sub_aid !== subAid || Object.hasOwn(snapshot, "recovery_ready") && snapshot.recovery_ready !== true || !["locked", "unlocked"].includes(snapshot.lock) || typeof snapshot.exists !== "boolean" || !Number.isSafeInteger(snapshot.relation_version) || snapshot.relation_version < 0) throw new StateError("NS ownership 2.1 authoritative metadata is unavailable", { stringCode: "unavailable", retryable: true });
-    if (snapshot.exists && !snapshot.etag || !snapshot.exists && (snapshot.lock !== "unlocked" || snapshot.relation_version !== 0)) throw new StateError("NS ownership document or ledger is unavailable");
+    if (snapshot.exists && !snapshot.etag || !snapshot.exists && (snapshot.lock !== "unlocked" || snapshot.relation_version !== 0)) throw new StateError("NS ownership document metadata is unavailable");
     this.fresh(snapshot.observed_at);
   }
   async validateOwnerSnapshot(snapshot, ownerAid, subAid) {
     const expectedService = `st.${ownerAid.slice(ownerAid.indexOf(".") + 1)}`;
-    if (snapshot.error || snapshot.authoritative !== true || Object.hasOwn(snapshot, "recovery_ready") && snapshot.recovery_ready !== true || snapshot.owner_aid !== ownerAid || snapshot.bucket !== "default" || snapshot.path !== `sub_aids/${subAid}/owner.md` || snapshot.service_aid !== expectedService || snapshot.authenticated_service_aid !== expectedService || typeof snapshot.revision !== "string" || !snapshot.revision || typeof snapshot.exists !== "boolean") throw new StateError("Storage authoritative ownership object is unavailable");
+    if (snapshot.error || snapshot.authoritative !== true || Object.hasOwn(snapshot, "recovery_ready") && snapshot.recovery_ready !== true || snapshot.owner_aid !== ownerAid || snapshot.bucket !== "default" || snapshot.path !== `sub_aids/${subAid}/owner.md` || snapshot.service_aid !== expectedService || snapshot.authenticated_service_aid !== expectedService || typeof snapshot.exists !== "boolean") throw new StateError("Storage authoritative ownership object is unavailable");
     this.fresh(snapshot.observed_at);
     if (snapshot.exists && (!/^[0-9a-f]{64}$/.test(snapshot.sha256) || await ownershipSha256(snapshot.content) !== snapshot.sha256)) throw new StateError("Storage ownership body and metadata differ", { stringCode: "unavailable", retryable: true });
   }
@@ -10420,32 +10604,35 @@ var OwnershipFiles = class {
     const file = parseOwnershipFile(content, role, { expectedSubAid: subAid, expectedOwnerAid: role === "owner" ? ownerAid : void 0, now: this.now() });
     const signer = role === "agent" ? subAid : ownerAid;
     const certificate = await this.deps.resolveCertificate(signer, file.signature.cert_fingerprint, role === "agent" && file.frontmatter.type === "group" ? "group_identity" : void 0);
-    return await verifyOwnershipFile(content, role, certificate, { expectedSubAid: subAid, expectedOwnerAid: role === "owner" ? ownerAid : void 0, certificateAid: signer, now: this.now() });
+    return await verifyOwnershipFile(content, role, certificate, { expectedSubAid: subAid, expectedOwnerAid: role === "owner" ? ownerAid : void 0, certificateAid: signer, certificateResolver: (aid2, fingerprint) => this.deps.resolveCertificate(aid2, fingerprint), now: this.now() });
   }
   async checkConsensus(subAid = this.deps.currentAid().aid, pendingTarget) {
     const began = this.now();
-    const result = { status: "unavailable", sub_aid: subAid, owner_aid: null, relation_version: 0, lock: "unlocked", agent_md_etag: "", agent_md_sha256: "", owner_md_revision: "", owner_md_sha256: "" };
+    const result = { status: "unavailable", sub_aid: subAid, owner_aid: null, relation_version: 0, lock: "unlocked", agent_md_etag: "", agent_md_sha256: "", owner_md_sha256: "" };
     try {
       const first = await this.readAgent(subAid);
       Object.assign(result, { relation_version: first.relation_version, lock: first.lock, agent_md_etag: first.etag, agent_md_sha256: first.exists ? await ownershipSha256(first.content) : "" });
-      const released = first.lock === "unlocked" && first.relation_version > 0;
-      const agent = !released && first.exists ? await this.verify(first.content, "agent", subAid) : null;
-      if (first.lock === "unlocked" && first.relation_version === 0 && agent?.statement) throw new StateError("NS relation metadata does not match agent.md", { stringCode: "unavailable", retryable: true });
-      const ownerAid = released ? void 0 : agent?.statement?.owner_aid ?? pendingTarget?.owner_aid;
+      const agent = first.exists ? await this.verify(first.content, "agent", subAid) : null;
+      if ((agent?.statement?.relation_version ?? 0) !== first.relation_version) throw new StateError("NS relation metadata does not match agent.md", { stringCode: "unavailable", retryable: true });
+      const ownerAid = agent?.statement?.owner_aid ?? pendingTarget?.owner_aid;
       let owner = null;
       let object = null;
       if (ownerAid) {
         object = await this.readOwner(ownerAid, subAid);
-        result.owner_md_revision = object.revision;
         result.owner_md_sha256 = object.exists ? object.sha256 : "";
         if (object.exists) owner = await this.verify(object.content, "owner", subAid, ownerAid);
       }
       const last = await this.readAgent(subAid);
       if (last.relation_version !== first.relation_version || last.etag !== first.etag || last.lock !== first.lock || last.exists !== first.exists || last.owner_aid !== first.owner_aid || first.exists && await ownershipSha256(last.content) !== result.agent_md_sha256) throw new StateError("NS ownership changed during verification");
+      if (object && ownerAid) {
+        const current = await this.readOwner(ownerAid, subAid);
+        if (current.exists !== object.exists || current.sha256 !== object.sha256 || current.content !== object.content) throw new StateError("Storage ownership changed during verification", { stringCode: "unavailable", retryable: true });
+      }
       this.fresh(began);
       this.fresh(first.observed_at);
       if (object) this.fresh(object.observed_at);
-      if (released) {
+      if (first.lock === "unlocked" && agent?.statement) {
+        if (!object || object.exists && (!owner?.statement || owner.action !== "release" || !ownershipStatementsMatch(agent.statement, owner.statement))) throw new StateError("current ownership files do not confirm release", { stringCode: "unavailable", retryable: true });
         result.status = "released";
       } else if (first.lock === "locked") {
         if (!agent?.statement || agent.statement.relation_version !== first.relation_version || first.owner_aid !== void 0 && first.owner_aid !== agent.statement.owner_aid) throw new StateError("ownership current files do not match the NS lock", { stringCode: "unavailable", retryable: true });
@@ -10479,9 +10666,21 @@ var OwnershipFiles = class {
     if (snapshot.relation_version !== task.base_relation_version || snapshot.lock !== (task.operation === "bind" ? "unlocked" : "locked")) throw new StateError("ownership relation version conflict", { stringCode: "ownership_conflict", retryable: false });
     if (!snapshot.exists) throw new StateError("initial agent.md is not published", { stringCode: "unavailable", retryable: true });
     if (snapshot.exists) {
-      const file = task.operation === "bind" && snapshot.relation_version > 0 ? parseOwnershipFile(snapshot.content, "agent", { expectedSubAid: task.sub_aid }) : await this.verify(snapshot.content, "agent", task.sub_aid);
+      const file = await this.verify(snapshot.content, "agent", task.sub_aid);
+      const base = task.base_agent_md;
+      if (base && (base.exists !== snapshot.exists || (base.statement ? !file.statement || !["version", "declaration_id", "owner_aid", "sub_aid", "relation_version", "declared_at"].every((key) => base.statement[key] === file.statement[key]) : file.statement || base.raw !== snapshot.content || base.etag !== snapshot.etag || base.sha256 !== await ownershipSha256(snapshot.content)))) throw new StateError("ownership original relation was replaced", { stringCode: "conflict", retryable: false });
+      if (!base) {
+        task.base_agent_md = { exists: true, raw: snapshot.content, sha256: await ownershipSha256(snapshot.content), etag: snapshot.etag, statement: file.statement ?? null };
+        await task.persist();
+      }
       if (snapshot.lock === "unlocked" && snapshot.relation_version === 0 && file.statement) throw new StateError("NS relation metadata does not match agent.md", { stringCode: "unavailable", retryable: true });
-      if (task.operation !== "bind" && file.statement?.owner_aid !== task.owner_aid || task.operation === "bind" && file.statement && file.statement.relation_version >= snapshot.relation_version) throw new StateError("ownership current owner mismatch", { stringCode: "conflict", retryable: false });
+      if ((file.statement?.relation_version ?? 0) !== snapshot.relation_version || task.operation !== "bind" && file.statement?.owner_aid !== task.owner_aid) throw new StateError("ownership current owner mismatch", { stringCode: "conflict", retryable: false });
+      if (task.operation === "bind" && file.statement?.owner_aid === task.owner_aid) throw new StateError("current owner release requires sub cleanup before binding again", { stringCode: "conflict", retryable: false });
+      if (task.operation === "bind" && base?.statement && task.base_owner_md) {
+        const original = await this.readOwner(base.statement.owner_aid, task.sub_aid), expected = task.base_owner_md;
+        if (original.exists !== expected.exists || original.content !== expected.raw || original.sha256 !== expected.sha256) throw new StateError("ownership original released owner file was replaced", { stringCode: "conflict", retryable: false });
+      }
+      if (task.operation === "bind" && file.statement && (await this.checkConsensus(task.sub_aid)).status !== "released") throw new StateError("current ownership files do not confirm release", { stringCode: "unavailable", retryable: true });
     }
     return snapshot;
   }
@@ -10491,6 +10690,10 @@ var OwnershipFiles = class {
     if (!object.exists) throw new StateError("ownership transfer authorization is unavailable");
     const file = await this.verify(object.content, "owner", task.sub_aid, task.owner_aid);
     if (file.action !== "transfer_owner" || file.statement?.relation_version !== task.base_relation_version || !file.transfer || file.transfer.new_owner_aid !== task.new_owner_aid || file.transfer.target_relation_version !== task.target_relation_version) throw new StateError("ownership transfer authorization target changed", { stringCode: "conflict", retryable: false });
+    if (task.base_owner_md?.exists) {
+      const original = parseOwnershipFile(task.base_owner_md.raw, "owner", { expectedSubAid: task.sub_aid, expectedOwnerAid: task.owner_aid }).statement;
+      if (!original || !["version", "declaration_id", "owner_aid", "sub_aid", "relation_version", "declared_at"].every((key) => original[key] === file.statement[key])) throw new StateError("ownership original transfer relation changed", { stringCode: "conflict", retryable: false });
+    }
     if (file.transfer.expires_at <= this.now()) throw new StateError("ownership transfer authorization expired", { stringCode: "conflict", retryable: false });
     if (task.authorization_sha256 !== void 0 && task.authorization_sha256 !== object.sha256 || task.expires_at !== void 0 && task.expires_at !== file.transfer.expires_at) throw new StateError("ownership transfer authorization changed", { stringCode: "conflict", retryable: false });
     if (task.authorization_sha256 === void 0 || task.expires_at === void 0) {
@@ -10505,11 +10708,21 @@ var OwnershipFiles = class {
     await this.readAgent(task.sub_aid);
     const current = await this.readOwner(ownerAid, task.sub_aid);
     let prepared = task.files[key];
+    if (!prepared && action !== "declare" && !current.exists) throw new StateError("ownership original owner file is unavailable", { stringCode: "unavailable", retryable: true });
+    if (!prepared && !task.base_owner_md && action !== "declare") {
+      const snapshot = current;
+      task.base_owner_md = { exists: snapshot.exists, raw: snapshot.content, sha256: snapshot.sha256 };
+      await task.persist();
+    }
     if (!prepared) {
       await this.requireBase(task);
+      const base2 = task.base_owner_md;
+      if (ownerAid === task.base_agent_md?.statement?.owner_aid && base2 && (current.exists !== base2.exists || current.content !== base2.raw || current.sha256 !== base2.sha256)) throw new StateError("ownership original owner file was replaced", { stringCode: "conflict", retryable: false });
       if (action === "transfer_owner") task.expires_at = this.now() + 3600;
+      const original = action === "declare" || !current.exists ? null : await this.verify(current.content, "owner", task.sub_aid, ownerAid);
+      if (original && (!original.statement || original.statement.relation_version !== task.base_relation_version)) throw new StateError("ownership original owner relation changed", { stringCode: "conflict", retryable: false });
       const ownership = {
-        statement: this.statement(ownerAid, task.sub_aid, version),
+        statement: original?.statement ?? this.statement(ownerAid, task.sub_aid, version),
         action,
         ...action === "transfer_owner" ? { transfer: { new_owner_aid: task.new_owner_aid, target_relation_version: task.target_relation_version, expires_at: task.expires_at } } : {}
       };
@@ -10521,27 +10734,24 @@ ownership: ${JSON.stringify(ownership)}
 `;
       const raw = await signOwnershipFile(identity, payload, "owner", { now: this.now() });
       await this.verify(raw, "owner", task.sub_aid, ownerAid);
-      prepared = { raw, sha256: await ownershipSha256(raw), condition: { expected_revision: current.revision } };
+      prepared = { raw, sha256: await ownershipSha256(raw), condition: {}, original_owner: { exists: current.exists, raw: current.content, sha256: current.sha256 } };
       if (action === "transfer_owner") prepared.expires_at = task.expires_at;
       task.files[key] = prepared;
       await task.persist();
     }
-    if (!prepared.condition || typeof prepared.condition.expected_revision !== "string" || !prepared.condition.expected_revision) throw new StateError("ownership original Storage revision is unavailable", { stringCode: "ownership_conflict" });
+    if (!prepared.condition || Object.keys(prepared.condition).length !== 0 || !prepared.original_owner) throw new StateError("ownership original owner.md context is unavailable", { stringCode: "ownership_conflict" });
     if (current.exists && current.sha256 === prepared.sha256 && current.content === prepared.raw) {
-      if (prepared.published_revision !== void 0 && prepared.published_revision !== current.revision) throw new StateError("ownership published file revision changed", { stringCode: "ownership_conflict" });
-      prepared.published_revision = current.revision;
-      await task.persist();
       return prepared;
     }
     await this.requireBase(task);
-    if (current.revision !== prepared.condition.expected_revision) throw new StateError("ownership Storage revision conflict", { stringCode: "ownership_conflict" });
     if (action === "transfer_owner" && (!task.expires_at || task.expires_at <= this.now())) throw new StateError("ownership transfer authorization expired", { stringCode: "conflict", retryable: false });
     await this.verify(prepared.raw, "owner", task.sub_aid, ownerAid);
     await task.guard?.();
-    await this.deps.writeOwnerMd(ownerAid, task.sub_aid, prepared.raw, prepared.condition.expected_revision);
+    const latest = await this.readOwner(ownerAid, task.sub_aid), base = prepared.original_owner;
+    if (latest.exists !== base.exists || latest.content !== base.raw || latest.sha256 !== base.sha256) throw new StateError("ownership original owner file was replaced", { stringCode: "conflict", retryable: false });
+    await this.deps.writeOwnerMd(ownerAid, task.sub_aid, prepared.raw);
     const saved = await this.readOwner(ownerAid, task.sub_aid);
     if (!saved.exists || saved.sha256 !== prepared.sha256 || saved.content !== prepared.raw) throw new StateError("ownership published file could not be confirmed");
-    prepared.published_revision = saved.revision;
     await task.persist();
     return prepared;
   }
@@ -10565,6 +10775,7 @@ ownership: ${JSON.stringify(ownership)}
       if (cleanup) {
         if (current.lock !== "unlocked" || current.relation_version !== task.target_relation_version) throw new StateError("owner_locked or ownership cleanup version conflict");
         const prior = current.exists ? parseOwnershipFile(current.content, "agent", { expectedSubAid: task.sub_aid, now: this.now() }) : null;
+        if (task.expected_agent_statement && (!prior?.statement || !["version", "declaration_id", "owner_aid", "sub_aid", "relation_version", "declared_at"].every((field) => prior.statement[field] === task.expected_agent_statement[field]))) throw new StateError("ownership cleanup historical declaration changed", { stringCode: "conflict", retryable: false });
         if (prior?.statement && (prior.statement.owner_aid !== task.owner_aid || prior.statement.relation_version !== task.base_relation_version)) throw new StateError("ownership cleanup historical authorization mismatch", { stringCode: "conflict", retryable: false });
       } else {
         await this.requireBase(task);
@@ -10584,7 +10795,7 @@ ownership: ${JSON.stringify(ownership)}
       await task.persist();
     }
     if (!prepared.condition || !(typeof prepared.condition.if_match === "string" && prepared.condition.if_match || prepared.condition.if_none_match === "*")) throw new StateError("ownership original agent.md condition is unavailable", { stringCode: "ownership_conflict" });
-    if (current.exists && await ownershipSha256(current.content) === prepared.sha256 && current.content === prepared.raw && current.relation_version === task.target_relation_version) {
+    if (current.exists && await ownershipSha256(current.content) === prepared.sha256 && current.content === prepared.raw && current.relation_version === (cleanup ? 0 : task.target_relation_version)) {
       if (prepared.published_etag !== void 0 && prepared.published_etag !== current.etag) throw new StateError("ownership published agent ETag changed", { stringCode: "ownership_conflict" });
       prepared.published_etag = current.etag;
       await task.persist();
@@ -10601,7 +10812,7 @@ ownership: ${JSON.stringify(ownership)}
     await task.guard?.();
     const saved = await this.deps.submitAgentMdRaw(task.sub_aid, prepared.raw, prepared.condition);
     this.validateAgentSnapshot(saved, task.sub_aid);
-    if (!saved.exists || await ownershipSha256(saved.content) !== prepared.sha256 || saved.relation_version !== task.target_relation_version) throw new StateError("NS ownership submitted file could not be confirmed");
+    if (!saved.exists || await ownershipSha256(saved.content) !== prepared.sha256 || saved.relation_version !== (cleanup ? 0 : task.target_relation_version)) throw new StateError("NS ownership submitted file could not be confirmed");
     prepared.published_etag = saved.etag;
     await task.persist();
     return prepared;
@@ -10616,21 +10827,32 @@ ownership: ${JSON.stringify(ownership)}
     this.local(task.owner_aid);
     await this.readAgent(task.sub_aid);
     const prepared = task.files[task.operation === "release" ? "release" : "transfer"];
-    if (!prepared?.published_revision || prepared.cleaned) return;
+    if (!prepared || prepared.cleaned) return;
+    const began = this.now();
     const consensus = await this.checkConsensus(task.sub_aid);
     if (consensus.status === "not_applicable") throw new StateError(consensus.reason || "group/org use their dedicated lifecycle ownership", { stringCode: "not_applicable", retryable: false });
     if (consensus.status === "invalid" || consensus.status === "unavailable") throw new StateError(consensus.reason || "ownership cleanup verification failed", { stringCode: consensus.status, retryable: consensus.status === "unavailable" });
-    if (consensus.relation_version !== task.target_relation_version || (task.operation === "release" ? consensus.status !== "released" : consensus.status !== "consensus" || consensus.owner_aid !== task.new_owner_aid)) throw new StateError("ownership cleanup relation is not confirmed", { stringCode: "conflict", retryable: false });
+    if (task.operation === "release" ? !(consensus.status === "unbound" && consensus.relation_version === 0 || consensus.status === "consensus") : consensus.relation_version !== task.target_relation_version || consensus.status !== "consensus" || consensus.owner_aid !== task.new_owner_aid) throw new StateError("ownership cleanup relation is not confirmed", { stringCode: "conflict", retryable: false });
     const object = await this.readOwner(task.owner_aid, task.sub_aid);
     if (!object.exists) {
       prepared.cleaned = true;
       await task.persist();
       return;
     }
-    if (object.revision !== prepared.published_revision || object.sha256 !== prepared.sha256) throw new StateError("ownership cleanup revision conflict");
-    if (!this.deps.deleteOwnerMd) throw new StateError("ownership conditional delete unsupported");
+    if (object.content !== prepared.raw || object.sha256 !== prepared.sha256) throw new StateError("ownership cleanup original owner file was replaced", { stringCode: "conflict", retryable: false });
+    const agent = await this.readAgent(task.sub_aid);
+    if (this.now() - began > 30 || agent.etag !== consensus.agent_md_etag || await ownershipSha256(agent.content) !== consensus.agent_md_sha256 || agent.lock !== consensus.lock || agent.relation_version !== consensus.relation_version) throw new StateError("ownership cleanup current files changed", { stringCode: "unavailable", retryable: true });
+    if (!this.deps.deleteOwnerMd) throw new StateError("ownership owner file delete unsupported");
     await task.guard?.();
-    await this.deps.deleteOwnerMd(task.owner_aid, task.sub_aid, prepared.published_revision);
+    const latest = await this.readOwner(task.owner_aid, task.sub_aid);
+    if (!latest.exists) {
+      prepared.cleaned = true;
+      await task.persist();
+      return;
+    }
+    if (latest.content !== prepared.raw || latest.sha256 !== prepared.sha256) throw new StateError("ownership cleanup original owner file was replaced", { stringCode: "conflict", retryable: false });
+    this.fresh(began);
+    await this.deps.deleteOwnerMd(task.owner_aid, task.sub_aid);
     prepared.cleaned = true;
     await task.persist();
   }
@@ -10640,13 +10862,16 @@ ownership: ${JSON.stringify(ownership)}
 var AID_RE2 = /^[A-Za-z0-9_][A-Za-z0-9_-]*(?:\.[A-Za-z0-9_][A-Za-z0-9_-]*)+$/;
 var SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var AGENT_MD_MAX_SIGNATURE_BYTES = 2048;
+function aidEqual(left, right) {
+  return typeof left === "string" && typeof right === "string" && left.toLowerCase() === right.toLowerCase();
+}
 function assertValidUtf8Text(content) {
   const encoded = new TextEncoder().encode(content);
   if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== content) {
     throw new ValidationError("agent.md must be valid UTF-8 text");
   }
 }
-function parseFileFrontmatter(payload) {
+function parseFileFrontmatter(payload, allowEmpty = false, validateOwnershipNumbers = true) {
   const lines = payload.replace(/^\ufeff/, "").split(/\r\n|\n|\r/);
   if (lines[0]?.trim() !== "---") throw new ValidationError("agent.md must start with YAML frontmatter");
   const end = lines.slice(1).findIndex((line) => line.trim() === "---");
@@ -10657,30 +10882,44 @@ function parseFileFrontmatter(payload) {
     if (node && typeof node === "object" && (isAlias(node) || "anchor" in node && node.anchor || "tag" in node && node.tag)) throw new ValidationError("YAML tags, anchors and aliases are forbidden");
   });
   if (doc.warnings.length) throw new ValidationError(`agent.md frontmatter is invalid: ${doc.warnings[0].message}`);
-  for (const path of [
+  for (const path of validateOwnershipNumbers ? [
     ["ownership", "statement", "version"],
     ["ownership", "statement", "relation_version"],
     ["ownership", "statement", "declared_at"],
     ["ownership", "transfer", "target_relation_version"],
     ["ownership", "transfer", "expires_at"]
-  ]) {
+  ] : []) {
     const scalar = doc.getIn(path, true);
     if (scalar && typeof scalar.value === "number" && !/^(?:0|[1-9][0-9]*)$/.test(scalar.source ?? "")) throw new ValidationError(`${path.join(".")} must be a YAML integer`);
   }
   const result = doc.toJS();
+  if (allowEmpty && doc.contents === null) return {};
   if (!result || typeof result !== "object" || Array.isArray(result)) throw new ValidationError("agent.md frontmatter must be a mapping");
   return result;
 }
 function validateAgentMdDocument(content, opts = {}) {
+  return validateAgentMdDocumentForPurpose(content, opts);
+}
+function validateAgentMdDocumentForRead(content, opts = {}, fallbackAid = opts.expectedAid) {
+  const parsed = validateAgentMdDocumentForPurpose(content, opts, true, fallbackAid);
+  if (["group", "org"].includes(String(parsed.frontmatter.type)) && !(parsed.frontmatter.type === "group" && parsed.signatures.length === 1 && !Object.hasOwn(parsed.frontmatter, "entity_cert_fingerprint") && (parsed.signature?.signer_aid === void 0 || aidEqual(parsed.signature.signer_aid, parsed.frontmatter.aid)))) return validateAgentMdDocument(content, opts);
+  return parsed;
+}
+function validateAgentMdDocumentForPurpose(content, opts, reading = false, fallbackAid) {
   if (!String(content ?? "").trim()) throw new ValidationError("agent.md content cannot be empty");
   assertValidUtf8Text(String(content));
-  if ((String(content).match(/<!-- AUN-SIGNATURE/g) ?? []).length > 1) throw new ValidationError("agent.md must contain exactly one signature block");
-  const parsed = parseAgentMdTailSignature(String(content));
+  const parsed = (reading ? parseAgentMdTailSignatureForRead : parseAgentMdTailSignature)(String(content));
   if (parsed.parseError) throw new ValidationError(parsed.parseError);
   if (opts.requireSignature && !parsed.fields) throw new ValidationError("agent.md signature is required");
   if (new TextEncoder().encode(parsed.payload).byteLength > (opts.maxPayloadBytes ?? 4096)) throw new ValidationError("agent.md payload exceeds 4096 bytes");
   if (parsed.fields && new TextEncoder().encode(String(content)).byteLength - new TextEncoder().encode(parsed.payload).byteLength > AGENT_MD_MAX_SIGNATURE_BYTES) throw new ValidationError(`agent.md signature block exceeds ${AGENT_MD_MAX_SIGNATURE_BYTES} bytes`);
-  const meta = parseFileFrontmatter(parsed.payload);
+  const meta = reading && parsed.fields && parsed.payload.replace(/^\ufeff/, "").split(/\r\n|\n|\r/, 1)[0]?.trim() !== "---" ? { aid: fallbackAid } : parseFileFrontmatter(parsed.payload, reading && !!parsed.fields, !reading);
+  if (reading && parsed.fields) {
+    if (!Object.hasOwn(meta, "aid")) meta.aid = fallbackAid;
+    if (!Object.hasOwn(meta, "name")) meta.name = meta.aid;
+    if (!Object.hasOwn(meta, "type")) meta.type = "agent";
+    if (!Object.hasOwn(meta, "version")) meta.version = "1.0.0";
+  }
   for (const key of ["aid", "name", "type", "version"]) if (!(key in meta)) throw new ValidationError(`agent.md frontmatter missing ${key}`);
   if (typeof meta.aid !== "string" || !AID_RE2.test(meta.aid)) throw new ValidationError("agent.md frontmatter aid has invalid format");
   if (opts.expectedAid && meta.aid.toLowerCase() !== opts.expectedAid.trim().toLowerCase()) throw new ValidationError("agent.md frontmatter aid does not match local AID");
@@ -10697,36 +10936,49 @@ function validateAgentMdDocument(content, opts = {}) {
   if ("exttype" in meta && typeof meta.exttype !== "string") throw new ValidationError("agent.md frontmatter exttype must be a string");
   if (meta.tags !== void 0 && (!Array.isArray(meta.tags) || meta.tags.some((item) => typeof item !== "string"))) throw new ValidationError("agent.md tags must be an array of strings");
   const entity = ["group", "org"].includes(String(meta.type));
+  const legacyEntity = reading && meta.type === "group" && !Object.hasOwn(meta, "entity_cert_fingerprint") && parsed.signatures.length === 1 && parsed.fields && (parsed.fields.signer_aid === void 0 || aidEqual(parsed.fields.signer_aid, meta.aid));
   if (entity) {
-    if (typeof meta.owner !== "string" || !AID_RE2.test(meta.owner)) throw new ValidationError("group/org agent.md requires owner");
-    if (typeof meta.entity_cert_fingerprint !== "string" || !/^sha256:[0-9a-f]{64}$/.test(meta.entity_cert_fingerprint)) throw new ValidationError("group/org agent.md requires entity_cert_fingerprint");
-    if (["ownership", "ownership_proof", "ownership_release"].some((field) => Object.hasOwn(meta, field))) throw new ValidationError("group/org agent.md cannot use Ownership 2.1");
+    if ((!legacyEntity || Object.hasOwn(meta, "owner")) && (typeof meta.owner !== "string" || !AID_RE2.test(meta.owner))) throw new ValidationError("group/org agent.md requires owner");
+    if ((!legacyEntity || Object.hasOwn(meta, "entity_cert_fingerprint")) && (typeof meta.entity_cert_fingerprint !== "string" || !/^sha256:[0-9a-f]{64}$/.test(meta.entity_cert_fingerprint))) throw new ValidationError("group/org agent.md requires entity_cert_fingerprint");
+    if (!legacyEntity && ["ownership", "ownership_proof", "ownership_release"].some((field) => Object.hasOwn(meta, field))) throw new ValidationError("group/org agent.md cannot use Ownership 2.1");
   } else if (opts.validateOwnership ?? true) {
     if ("ownership" in meta || "owner" in meta && !("ownership_proof" in meta)) validateOwnershipAgentFrontmatter(meta, opts.expectedAid);
     else validateOwnershipFrontmatter(meta, opts.expectedAid);
   }
   const fields = parsed.fields;
   if (fields) {
-    if (Object.keys(fields).some((key) => !["cert_fingerprint", "public_key_fingerprint", "timestamp", "signature", ...entity ? ["signer_aid"] : []].includes(key))) throw new ValidationError("agent.md signature contains unknown fields");
-    if (entity && ![meta.aid, meta.owner].includes(fields.signer_aid ?? meta.aid)) throw new ValidationError("group/org agent.md signer must be entity or owner");
-    if (!/^sha256:[0-9a-f]{64}$/.test(fields.cert_fingerprint)) throw new ValidationError("agent.md cert_fingerprint is invalid");
-    if (fields.public_key_fingerprint !== void 0 && !/^sha256:[0-9a-f]{64}$/.test(fields.public_key_fingerprint)) throw new ValidationError("agent.md public_key_fingerprint is invalid");
-    if (!/^[1-9][0-9]*$/.test(fields.timestamp) || !Number.isSafeInteger(Number(fields.timestamp)) || !isStrictBase64(fields.signature)) throw new ValidationError("agent.md signature fields are invalid");
+    if (Object.keys(fields).some((key) => !["cert_fingerprint", "public_key_fingerprint", "timestamp", "signature", "signer_aid"].includes(key))) throw new ValidationError("agent.md signature contains unknown fields");
+    if (!entity && fields.signer_aid !== void 0) throw new ValidationError("ordinary agent.md main signature contains unknown signer_aid");
+    if (entity && (legacyEntity ? fields.signer_aid !== void 0 && !aidEqual(fields.signer_aid, meta.aid) : !aidEqual(fields.signer_aid, meta.aid) || fields.cert_fingerprint !== meta.entity_cert_fingerprint)) throw new ValidationError("group/org agent.md primary signer must be entity");
+    if (entity && parsed.signatures.slice(1).some((block) => !aidEqual(block.fields.signer_aid, meta.owner))) throw new ValidationError("group/org agent.md additional signer must be current owner");
+    const fingerprintPattern = /^sha256:[0-9a-f]{64}$/;
+    if (reading ? !normalizeFingerprintHex(fields.cert_fingerprint) : !fingerprintPattern.test(fields.cert_fingerprint)) throw new ValidationError("agent.md cert_fingerprint is invalid");
+    if (fields.public_key_fingerprint !== void 0 && (reading ? !normalizeFingerprintHex(fields.public_key_fingerprint) : !fingerprintPattern.test(fields.public_key_fingerprint))) throw new ValidationError("agent.md public_key_fingerprint is invalid");
+    if (!(reading ? /^[0-9]+$/ : /^[1-9][0-9]*$/).test(fields.timestamp) || !Number.isSafeInteger(Number(fields.timestamp)) || Number(fields.timestamp) <= 0 || !isStrictBase64(fields.signature)) throw new ValidationError("agent.md signature fields are invalid");
     const now = Math.trunc(opts.now ?? Date.now() / 1e3);
     const ts = Number(fields.timestamp);
     if ((opts.checkTimestamp ?? true) && ts > now + 300) throw new ValidationError("agent.md signature timestamp is too far in the future");
   }
-  return { payload: parsed.payload, frontmatter: meta, signature: fields };
+  return { payload: parsed.payload, frontmatter: meta, signature: fields, signatures: parsed.signatures };
+}
+async function verifyAgentMdUpload(content, certPem, expectedAid, now, resolver) {
+  return verifyAgentMdUploadForPurpose(content, certPem, expectedAid, now, true, resolver);
 }
-async function verifyAgentMdUpload(content, certPem, expectedAid, now) {
-  const parsed = validateAgentMdDocument(content, { expectedAid, requireSignature: true, now });
+async function verifyAgentMdLegacyBodyUpload(content, certPem, expectedAid, now, resolver) {
+  return verifyAgentMdUploadForPurpose(content, certPem, expectedAid, now, false, resolver);
+}
+async function verifyAgentMdUploadForPurpose(content, certPem, expectedAid, now, validateOwnership = true, resolver) {
+  const parsed = validateAgentMdDocument(content, { expectedAid, requireSignature: true, now, validateOwnership });
   const fields = parsed.signature;
-  const signer = ["group", "org"].includes(String(parsed.frontmatter.type)) ? fields.signer_aid ?? expectedAid : expectedAid;
-  validateAgentMdCertificate(certPem, signer, Number(fields.timestamp), now);
-  const actualCertFingerprint = (await certificateSha256Fingerprint(certPem)).toLowerCase();
-  if (actualCertFingerprint !== fields.cert_fingerprint.trim().toLowerCase()) throw new ValidationError("agent.md certificate fingerprint mismatch");
-  if (fields.public_key_fingerprint && !await publicKeyMatchesFingerprint(certPem, fields.public_key_fingerprint)) throw new ValidationError("agent.md public key fingerprint mismatch");
-  if (!await verifySignatureWithCert(certPem, fields.signature, new TextEncoder().encode(parsed.payload))) throw new ValidationError("agent.md signature verification failed");
+  const verified = await verifyDocument(content, async (signer, fingerprint, timestamp2) => {
+    const material = signer.toLowerCase() === expectedAid.toLowerCase() && await certificateSha256Fingerprint(certPem) === fingerprint ? certPem : resolver ? await resolver(signer, fingerprint, timestamp2) : "";
+    const pem = typeof material === "string" ? material : material.certPem;
+    validateAgentMdCertificate(pem, signer, timestamp2, now);
+    return pem;
+  }, { expectedAid, now, requireCurrentValidity: true });
+  if (!verified.valid) {
+    throw new ValidationError(verified.reason || "agent.md signature verification failed");
+  }
 }
 function validateAgentMdCertificate(certPem, expectedAid, timestamp2, now, requireCurrentValidity = true) {
   const metadata = parseCertMetadata(certPem);
@@ -10735,7 +10987,7 @@ function validateAgentMdCertificate(certPem, expectedAid, timestamp2, now, requi
   const current = Math.trunc(now ?? Date.now() / 1e3);
   if (![notBefore, notAfter, current, timestamp2].every(Number.isFinite)) throw new ValidationError("agent.md signing certificate is invalid");
   if (requireCurrentValidity && (current < notBefore || current > notAfter)) throw new ValidationError("agent.md signing certificate is expired or not yet valid");
-  if (metadata.subject.trim().toLowerCase() !== expectedAid.trim().toLowerCase()) throw new ValidationError("agent.md signing certificate subject does not match AID");
+  if (requireCurrentValidity ? !aidEqual(metadata.subject, expectedAid) : !aidEqual(metadata.subject.trim(), expectedAid.trim())) throw new ValidationError("agent.md signing certificate subject does not match AID");
   if (timestamp2 < notBefore || timestamp2 > notAfter) throw new ValidationError("agent.md signature timestamp is outside certificate validity");
 }
 
@@ -10834,23 +11086,13 @@ var AID = class _AID {
       if (payload && !payload.endsWith("\n") && !payload.endsWith("\r")) {
         return resultErr(SIGNATURE_OPERATION_ERROR, "agent.md payload must end with a newline before signature");
       }
-      const signature2 = await signBytes(this.privateKeyPem, new TextEncoder().encode(payload));
       let frontmatter = {};
       try {
-        frontmatter = parseFileFrontmatter(payload);
+        frontmatter = parseFileFrontmatter(payload, true, false);
       } catch {
       }
-      const entity = ["group", "org"].includes(String(frontmatter.type));
-      if (entity && ![frontmatter.aid, frontmatter.owner].includes(this.aid)) return resultErr(SIGNATURE_OPERATION_ERROR, "group/org agent.md requires entity or current owner signer");
-      let block = buildAgentMdSignatureBlock(
-        this.certFingerprint,
-        Date.now() / 1e3,
-        signature2,
-        await publicKeyFingerprint(this.certPem)
-      );
-      if (entity) block = block.replace("cert_fingerprint:", `signer_aid: ${this.aid}
-cert_fingerprint:`);
-      return resultOk({ signed: payload + block });
+      if (["group", "org"].includes(String(frontmatter.type)) && frontmatter.aid !== this.aid) return resultErr(SIGNATURE_OPERATION_ERROR, "group/org agent.md requires entity primary signer");
+      return resultOk(await signDocument(this, payload, { signerAid: ["group", "org"].includes(String(frontmatter.type)) }));
     } catch (exc) {
       return resultErr(SIGNATURE_OPERATION_ERROR, String(exc), exc);
     }
@@ -10889,37 +11131,26 @@ cert_fingerprint:`);
       return resultErr(VERIFICATION_OPERATION_ERROR, String(exc), exc);
     }
   }
-  async verifyAgentMd(content) {
+  async verifyAgentMd(content, certificateResolver) {
     try {
       const rawContent = String(content ?? "");
       let parsed;
       try {
-        parsed = validateAgentMdDocument(rawContent, { validateOwnership: false });
-        const signer = ["group", "org"].includes(String(parsed.frontmatter.type)) ? parsed.signature?.signer_aid ?? parsed.frontmatter.aid : parsed.frontmatter.aid;
-        if (String(signer).toLowerCase() !== this.aid.toLowerCase()) throw new Error("agent.md signer does not match certificate identity");
-      } catch (exc) {
-        const payload2 = parseAgentMdTailSignature(rawContent).payload;
-        return resultOk({ status: "invalid", payload: payload2, aid: this.aid, reason: exc instanceof Error ? exc.message : String(exc) });
-      }
-      const { payload, signature: fields } = parsed;
-      if (!fields) return resultOk({ status: "unsigned", payload });
-      try {
-        validateAgentMdCertificate(this.certPem, this.aid, Number(fields.timestamp), void 0, false);
+        parsed = validateAgentMdDocumentForRead(rawContent, { validateOwnership: false }, this.aid);
       } catch (exc) {
-        return resultOk({ status: "invalid", payload, aid: this.aid, reason: exc instanceof Error ? exc.message : String(exc) });
-      }
-      const payloadAid = extractAgentMdAid(payload);
-      const entity = ["group", "org"].includes(String(parsed.frontmatter.type));
-      if (!entity && payloadAid && payloadAid.toLowerCase() !== this.aid.toLowerCase()) return resultOk({ status: "invalid", payload, aid: payloadAid, reason: "aid mismatch" });
-      if (!await certMatchesFingerprint(this.certPem, fields.cert_fingerprint)) {
-        return resultOk({ status: "invalid", payload, aid: this.aid, reason: "certificate fingerprint mismatch" });
-      }
-      const publicKeyFp = String(fields.public_key_fingerprint ?? "").trim();
-      if (publicKeyFp && !await publicKeyMatchesFingerprint(this.certPem, publicKeyFp)) {
-        return resultOk({ status: "invalid", payload, aid: this.aid, reason: "public key fingerprint mismatch" });
-      }
-      const valid = await verifySignatureWithCert(this.certPem, fields.signature, new TextEncoder().encode(payload));
-      return resultOk(valid ? { status: "verified", payload, aid: entity ? String(parsed.frontmatter.aid) : this.aid, cert_fingerprint: fields.cert_fingerprint, public_key_fingerprint: publicKeyFp, timestamp: Number(fields.timestamp) } : { status: "invalid", payload, aid: this.aid, cert_fingerprint: fields.cert_fingerprint, timestamp: Number(fields.timestamp), reason: "signature verification failed" });
+        return resultOk({ status: "invalid", payload: parseAgentMdTailSignature(rawContent).payload, aid: this.aid, reason: exc instanceof Error ? exc.message : String(exc) });
+      }
+      const resolver = async (signer, fingerprint, timestamp2) => {
+        if (signer.toLowerCase() === this.aid.toLowerCase() && (await certMatchesFingerprint(this.certPem, fingerprint) || !certificateResolver)) return this.certPem;
+        if (certificateResolver) return await certificateResolver(signer, fingerprint, timestamp2);
+        const store = this._aidStore;
+        const resolved = await store?.resolve?.(signer, { skipAgentMd: true });
+        if (!resolved?.ok) throw new Error("additional signing certificate is unavailable");
+        return resolved.data.aid;
+      };
+      const verified = await verifyDocument(rawContent, resolver, { expectedAid: this.aid, reading: !["group", "org"].includes(String(parsed.frontmatter.type)) || parsed.frontmatter.type === "group" && !Object.hasOwn(parsed.frontmatter, "entity_cert_fingerprint") && parsed.signatures.length === 1 });
+      const fields = parsed.signature;
+      return resultOk({ ...verified, aid: this.aid, cert_fingerprint: fields?.cert_fingerprint, public_key_fingerprint: fields?.public_key_fingerprint, timestamp: fields ? Number(fields.timestamp) : void 0 });
     } catch (exc) {
       return resultErr(VERIFICATION_OPERATION_ERROR, String(exc), exc);
     }
@@ -11125,6 +11356,19 @@ var REPRESENTATION_FIELDS = /* @__PURE__ */ new Set([
 ]);
 var REPRESENTATION_SIGNATURE_FIELDS = /* @__PURE__ */ new Set(["cert_fingerprint", "public_key_fingerprint", "timestamp", "signature"]);
 var FINGERPRINT_RE2 = /^sha256:[0-9a-f]{64}$/i;
+var SERVICE_EVENTS = /* @__PURE__ */ new Set([
+  "org.member.join_requested",
+  "org.member.join_approved",
+  "org.member.join_rejected",
+  "org.member.invite_created",
+  "org.member.invite_accepted",
+  "org.member.invite_rejected",
+  "org.member.changed",
+  "org.lifecycle.created",
+  "org.lifecycle.dissolving",
+  "org.lifecycle.dissolved",
+  "credential.revoked"
+]);
 var ProtocolError = class extends Error {
   constructor(code, message = code) {
     super(`${code}: ${message}`);
@@ -11137,20 +11381,24 @@ var ProtocolError = class extends Error {
 };
 async function verifyServiceEvent(eventName, payload, context) {
   const event = eventName.startsWith("event/") ? eventName.slice(6) : eventName;
-  if (!isRecord2(payload) || !context || !["type", "event", "event_id", "responder", "target_aids", "as_of", "expires_at", "signature"].every((field) => field in payload) || payload.type !== event || payload.event !== event || typeof payload.event_id !== "string" || !payload.event_id || ["_route", "_federation", "_trace", "member_aids", "inline_message"].some((field) => field in payload)) throw invalid("service event payload is invalid");
+  if (!SERVICE_EVENTS.has(event) || !isRecord2(payload) || !context || !["type", "event", "event_id", "responder", "target_aids", "as_of", "expires_at", "signature"].every((field) => field in payload) || payload.type !== event || payload.event !== event || typeof payload.event_id !== "string" || !payload.event_id || ["_route", "_federation", "_trace", "member_aids", "inline_message"].some((field) => field in payload)) throw invalid("service event payload is invalid");
   normalizeNfc(payload);
   aid(context.targetAid, "event target");
   aid(payload.responder, "event responder");
-  if (!Array.isArray(payload.target_aids) || !payload.target_aids.length || payload.target_aids.some((target) => typeof target !== "string" || !AID_RE3.test(target)) || new Set(payload.target_aids).size !== payload.target_aids.length || !payload.target_aids.includes(context.targetAid)) throw invalid("service event audience is invalid");
+  if (!Array.isArray(payload.target_aids) || !payload.target_aids.length || payload.target_aids.some((target) => typeof target !== "string" || !AID_RE3.test(target))) throw invalid("service event audience is invalid");
+  const targetAids = new Set(payload.target_aids.map((target) => aidKey(target)));
+  if (targetAids.size !== payload.target_aids.length || !targetAids.has(aidKey(context.targetAid))) throw invalid("service event audience is invalid");
+  const responder = payload.responder;
+  const responderKey = aidKey(responder);
   const now = context.now ?? Math.trunc(Date.now() / 1e3);
   if (!isInt(now) || !isInt(payload.as_of) || !isInt(payload.expires_at) || payload.as_of <= 0 || payload.expires_at <= payload.as_of || payload.expires_at > payload.as_of + 300 || payload.as_of > now + 300 || now >= payload.expires_at) throw invalid("service event time window is invalid");
   let known = true;
   if (event.startsWith("org.")) {
     aid(payload.org_id, "event organization");
-    if (payload.responder !== "org." + String(payload.org_id).slice(String(payload.org_id).indexOf(".") + 1)) throw invalid("organization event authority is invalid");
+    if (responderKey !== aidKey("org." + String(payload.org_id).slice(String(payload.org_id).indexOf(".") + 1))) throw invalid("organization event authority is invalid");
   } else if (event.startsWith("credential.")) {
     const cid = payload.credentialCid ?? payload.credential_cid;
-    if (!String(payload.responder).startsWith("credential.") || typeof payload.target !== "string" || !payload.target_aids.includes(payload.target) || typeof cid !== "string" || !cid || payload.credentialCid !== void 0 && payload.credential_cid !== void 0 && payload.credentialCid !== payload.credential_cid) throw invalid("credential event authority or target is invalid");
+    if (!responderKey.startsWith("credential.") || typeof payload.target !== "string" || !targetAids.has(aidKey(payload.target)) || typeof cid !== "string" || !cid || payload.credentialCid !== void 0 && payload.credential_cid !== void 0 && payload.credentialCid !== payload.credential_cid) throw invalid("credential event authority or target is invalid");
     let service;
     try {
       service = await context.resolveCredentialService?.(cid);
@@ -11158,7 +11406,7 @@ async function verifyServiceEvent(eventName, payload, context) {
       throw invalid("trusted credential authority is unavailable");
     }
     known = service != null;
-    if (known && (typeof service !== "string" || !service.startsWith("credential.") || service !== payload.responder)) throw invalid("credential event authority differs from the trusted provider");
+    if (known && (typeof service !== "string" || !AID_RE3.test(service) || !aidKey(service).startsWith("credential.") || aidKey(service) !== responderKey)) throw invalid("credential event authority differs from the trusted provider");
   } else throw invalid("service event namespace is invalid");
   try {
     signature(payload.signature);
@@ -11166,14 +11414,17 @@ async function verifyServiceEvent(eventName, payload, context) {
     if (signed.timestamp !== payload.as_of || typeof context.resolveEventCertificate !== "function") throw new Error("service event signature context is invalid");
     const body = { ...payload };
     delete body.signature;
-    const certificate = await context.resolveEventCertificate(payload.responder, signed.cert_fingerprint);
-    await verifyAgentSignature(signed, body, payload.responder, () => certificate, context.now ?? Math.trunc(Date.now() / 1e3), false);
+    const certificate = await context.resolveEventCertificate(responderKey, signed.cert_fingerprint);
+    await verifyAgentSignature(signed, body, responder, () => certificate, context.now ?? Math.trunc(Date.now() / 1e3), false);
   } catch {
     throw new ProtocolError("CREDENTIAL_SIGNATURE_INVALID", "service event signature verification failed");
   }
   if ((context.now ?? Math.trunc(Date.now() / 1e3)) >= payload.expires_at) throw invalid("service event time window is invalid");
   return { signature_valid: true, credential_known: known };
 }
+function aidKey(value) {
+  return value.trim().toLowerCase();
+}
 function protocolErrorRetryable(code) {
   return ERROR_RETRYABLE[String(code)] === true;
 }
@@ -11512,6 +11763,7 @@ function validateCredential(credential, chainDepth = 0, externalProofChain) {
   const delegationDepth = "delegation_depth" in credential ? credential.delegation_depth : 0;
   if (!isInt(delegationDepth) || delegationDepth < 0) throw invalid("delegation_depth is invalid");
   const parent = credential.parent;
+  if (credential.proof_chain !== void 0 && externalProofChain !== void 0 && canonicalText(credential.proof_chain) !== canonicalText(externalProofChain)) throw new ProtocolError("CREDENTIAL_CHAIN_INVALID", "embedded proof_chain conflicts with external proof_chain");
   if (parent == null && delegationDepth !== 0) throw invalid("root credential must have delegation_depth 0");
   if (parent != null) {
     if (!("delegation_depth" in credential)) throw invalid("child delegation_depth is required");
@@ -11754,6 +12006,7 @@ async function prepareOrganizationRequest(method, params2, target, signer, optio
     if (!binding || !isRecord2(binding.member_signature) || ("for" in value ? value.for : signer.aid) !== binding.member_aid || value.member_aid !== binding.member_aid || binding.org_id !== value.org_id || target !== "org." + String(binding.org_id).slice(String(binding.org_id).indexOf(".") + 1)) throw representationBindingInvalid("admission target must match the signed membership binding");
     value.credentials = credentials;
     const now = Math.trunc(Date.now() / 1e3);
+    if (now >= Number(binding.exp)) throw representationBindingInvalid("membership binding has expired");
     let maximum = Math.min(now + 300, Number(binding.exp));
     for (const field of ["credential_template", "registration_authorization"]) if (field in value) {
       const material = value[field];
@@ -11819,6 +12072,18 @@ async function verifyCredential(credential, context) {
   if (value.sub !== context.subject) throw invalid("credential subject does not match holder");
   const now = context.now ?? Math.trunc(Date.now() / 1e3);
   const documents = credentialChainDocuments(credential, context.proofChain);
+  const resolvedCertificates = [];
+  const resolveCertificate = async (fingerprint) => {
+    const material = await context.resolveCertificate(fingerprint);
+    if (material != null) resolvedCertificates.push(material);
+    return material;
+  };
+  const resolveActorCertificate = context.resolveActorCertificate ? async (fingerprint) => {
+    const material = await context.resolveActorCertificate(fingerprint);
+    if (material != null) resolvedCertificates.push(material);
+    return material;
+  } : resolveCertificate;
+  const statusProofs = [];
   const status = async (cid) => {
     const document2 = documents.find((item) => item.cid === cid);
     let proof;
@@ -11829,6 +12094,7 @@ async function verifyCredential(credential, context) {
       throw new ProtocolError("CREDENTIAL_STATUS_UNKNOWN", "trusted credential status is unavailable");
     }
     if (isRecord2(proof)) {
+      statusProofs.push(proof);
       if (typeof proof.credentialCid === "string" && proof.credentialCid !== cid) throw new ProtocolError("CREDENTIAL_CHAIN_INVALID", "registered credential cid differs from the signed document");
       if (proof.ver !== "aun-credential-status/1" || proof.credentialCid !== cid || typeof proof.credential_hash !== "string" || !DIGEST_RE.test(proof.credential_hash) || !isInt(proof.asOf) || !isInt(proof.proofExpiresAt) || proof.asOf > now + 300 || proof.proofExpiresAt <= proof.asOf || proof.proofExpiresAt > proof.asOf + 300 || now >= proof.proofExpiresAt || typeof proof.responder !== "string" || !proof.responder.startsWith("credential.") || !AID_RE3.test(proof.responder.slice(11)) || typeof proof.request_id !== "string" || !proof.request_id || typeof proof.nonce !== "string" || !proof.nonce || typeof proof.target !== "string" || !AID_RE3.test(proof.target)) throw new ProtocolError("CREDENTIAL_STATUS_UNKNOWN", "trusted credential status proof is unavailable");
       try {
@@ -11843,7 +12109,7 @@ async function verifyCredential(credential, context) {
     if (document2 !== value) throw new ProtocolError("CREDENTIAL_STATUS_UNKNOWN", "parent credential status proof is required");
     return typeof proof === "string" ? proof : void 0;
   };
-  await verifyCredentialChain(credential, context.resolveCertificate, status, now, context.audience, context.proofChain);
+  await verifyCredentialChain(credential, resolveCertificate, status, now, context.audience, context.proofChain);
   if (credentialChainDocuments(credential, context.proofChain).at(-1).iss !== (context.rootIssuer ?? context.audience)) throw invalid("credential root issuer is not trusted for this resource");
   const rate = context.checkRateLimit ? (field, unit, limit) => context.checkRateLimit(String(value.cid), String(value.sub), field, unit, limit) : void 0;
   await validateCredentialCapability(credential, { ns: context.ns, action: context.action, resource: context.resource, params: context.params, units: context.units, now, client_ip: context.clientIp, proof_chain: context.proofChain }, rate);
@@ -11858,13 +12124,14 @@ async function verifyCredential(credential, context) {
       const caps = value.cap;
       if (value.iss !== binding.org_id || !value.aud.includes(binding.org_id) || caps.length !== 1 || caps[0].ns !== "org" || caps[0].action !== "role." + String(binding.role) || caps[0].resource !== binding.org_id) throw invalid("member credential capability does not match binding role");
     }
-    await verifyMembershipBinding(binding, context.resolveCertificate, now, context.orgSigner, true);
+    await verifyMembershipBinding(binding, resolveCertificate, now, context.orgSigner, true);
     if (!context.resolveMembershipStatus || await context.resolveMembershipStatus(binding, value) !== true) throw new ProtocolError("MEMBERSHIP_STATE_INVALID", "trusted current membership status does not permit this operation");
   }
   const result = { signature_valid: true, chain_valid: true, status_checked: true, capability_checked: true, request_bound: true };
   const params2 = context.params ?? {};
   const target = context.for ?? params2.for;
   const actor = context.actor ?? context.subject;
+  let verifiedRepresentation;
   if (typeof actor !== "string" || !AID_RE3.test(actor)) throw new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", "authenticated actor is invalid");
   if (target !== void 0 && (typeof target !== "string" || !target || !context.actor || Object.hasOwn(params2, "for") && params2.for !== target)) throw new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", "authenticated representation context is required");
   if (target !== void 0 && target !== actor || actor !== context.subject) {
@@ -11872,7 +12139,9 @@ async function verifyCredential(credential, context) {
     const packaged = isRecord2(params2.credentials) ? params2.credentials.representation_proof : void 0;
     const proof = context.representationProof ?? packaged;
     if (packaged !== void 0 && canonicalText(packaged) !== canonicalText(proof)) throw new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", "representation proof differs from the request");
-    await verifyRepresentationProof(proof, credential, { from: actor, for: target, audience: context.target, resource: target, params: params2, binding: context.requestBinding }, context.resolveActorCertificate ?? context.resolveCertificate, now, context.proofChain);
+    const representationRequest = { from: actor, for: target, audience: context.target, resource: target, params: params2, binding: context.requestBinding };
+    await verifyRepresentationProof(proof, credential, representationRequest, resolveActorCertificate, now, context.proofChain);
+    verifiedRepresentation = { proof, request: representationRequest };
     const subjects = [String(target), ...context.subject !== actor && context.subject !== target ? [context.subject] : []];
     let allowed = Boolean(context.resolveOwnership);
     try {
@@ -11884,6 +12153,24 @@ async function verifyCredential(credential, context) {
     if (!allowed) throw new ProtocolError("ROLE_ACCESS_DENIED", "trusted current ownership does not permit representation");
     result.representation_checked = true;
   }
+  if (context.now === void 0) {
+    const completedAt = Math.trunc(Date.now() / 1e3);
+    for (const document2 of documents) validateCredentialAt(document2, completedAt, context.audience);
+    await validateCredentialCapability(credential, { ns: context.ns, action: context.action, resource: context.resource, params: context.params, units: context.units, now: completedAt, client_ip: context.clientIp, proof_chain: context.proofChain }, () => true);
+    validateRequestBinding(context.requestBinding, context.method, context.target, context.params ?? {}, String(value.cid), context.nonce ?? "", context.requestId ?? "", completedAt);
+    for (const proof of statusProofs) {
+      if (proof.asOf > completedAt + 300 || completedAt >= proof.proofExpiresAt) throw new ProtocolError("CREDENTIAL_STATUS_UNKNOWN", "trusted credential status proof is unavailable");
+    }
+    for (const material of resolvedCertificates) {
+      const metadata = parseCertMetadata(certificatePem(material));
+      if (completedAt < metadata.notBefore.getTime() / 1e3 || completedAt > metadata.notAfter.getTime() / 1e3) throw new ProtocolError("CREDENTIAL_SIGNATURE_INVALID", "certificate is not valid");
+    }
+    if (verifiedRepresentation) {
+      const { proof, request } = verifiedRepresentation;
+      if (completedAt < proof.iat || completedAt >= proof.exp) throw representationBindingInvalid("representation time window is invalid");
+      validateRepresentationContext(proof, value, request, completedAt);
+    }
+  }
   return result;
 }
 function validateCredentialAt(credential, now, audience, proofChain) {
@@ -12270,7 +12557,7 @@ function orgRequestBindingParams(method, params2) {
 }
 function buildRequestBinding(method, target, params2, credentialCid, nonce, requestId, iat, exp) {
   if (![method, target, nonce, requestId].every((value) => typeof value === "string" && value.length > 0) || typeof credentialCid !== "string" || !credentialCid !== (method === "credential.revocationList")) throw invalid("request binding identity is invalid");
-  if (!isInt(iat) || !isInt(exp) || exp <= iat) throw invalid("request binding time window is invalid");
+  if (!isInt(iat) || !isInt(exp) || exp <= iat || exp > iat + 300) throw invalid("request binding time window is invalid");
   return { request_id: requestId, nonce, target, method, params_hash: digest(orgRequestBindingParams(method, params2)), iat, exp, credential_cid: credentialCid };
 }
 function validateRequestBinding(binding, method, target, params2, credentialCid, nonce, requestId, now) {
@@ -12278,7 +12565,7 @@ function validateRequestBinding(binding, method, target, params2, credentialCid,
   if (!isRecord2(binding) || Object.keys(binding).length !== fields.length || Object.keys(binding).some((key) => !fields.includes(key))) throw new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", "request binding is invalid");
   if (![binding.request_id, binding.nonce, binding.target, binding.method, binding.params_hash].every((value) => typeof value === "string" && value.length > 0) || typeof binding.credential_cid !== "string" || !binding.credential_cid !== (method === "credential.revocationList")) throw new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", "request binding is invalid");
   if (binding.request_id !== requestId || binding.nonce !== nonce || binding.target !== target || binding.method !== method || binding.credential_cid !== credentialCid || binding.params_hash !== digest(orgRequestBindingParams(method, params2))) throw new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", "request binding does not match request");
-  if (!isInt(binding.iat) || !isInt(binding.exp) || binding.exp <= binding.iat || !isInt(now) || now < binding.iat || now >= binding.exp) throw new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", "request binding is outside its validity window");
+  if (!isInt(binding.iat) || !isInt(binding.exp) || binding.exp <= binding.iat || binding.exp > binding.iat + 300 || !isInt(now) || now < binding.iat || now >= binding.exp) throw new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", "request binding is outside its validity window");
 }
 function representationBindingInvalid(message) {
   return new ProtocolError("CREDENTIAL_REQUEST_BINDING_INVALID", message);
@@ -13010,6 +13297,7 @@ var RPCTransport = class {
     __publicField(this, "_backgroundRpcQueue", []);
     __publicField(this, "_drainingRpcQueue", false);
     __publicField(this, "_onForegroundDrained");
+    __publicField(this, "_onRpcResponse");
     __publicField(this, "_sendChain", Promise.resolve());
     // Gateway 在 RPC envelope 注入 _meta 字段（与 result 同级），由 client 层 observer 接收。
     // 注入失败 / 字段缺失时 observer 不会被调用，不影响业务路径。
@@ -13748,6 +14036,7 @@ var RPCTransport = class {
         this._pendingBackground.delete(rpcId);
         pending.resolve(message);
         this._drainRpcQueue();
+        this._onRpcResponse?.();
       } else {
         withLogContext(this._log, { direction: "inbound", peerAid: "" }).warn("[aun_core.transport] recv unknown rpc response (maybe arrived after timeout): id=" + rpcId);
       }
@@ -15836,19 +16125,68 @@ function parseCertDer(pem) {
   const spkiBytes = der.slice(spkiFullStart, spkiFullEnd);
   pos = spkiFullEnd;
   let isCA = false;
-  const extensionsSearchStart = pos;
-  const extensionsSearchEnd = tbsEnd;
-  const bcOidBytes = new Uint8Array([85, 29, 19]);
-  for (let i = extensionsSearchStart; i < extensionsSearchEnd - 3; i++) {
-    if (der[i] === bcOidBytes[0] && der[i + 1] === bcOidBytes[1] && der[i + 2] === bcOidBytes[2]) {
-      const searchEnd = Math.min(i + 20, extensionsSearchEnd);
-      for (let j = i + 3; j < searchEnd - 2; j++) {
-        if (der[j] === 1 && der[j + 1] === 1 && der[j + 2] === 255) {
+  let pathLenConstraint;
+  let keyCertSign;
+  const extensionTlv = (offset, end, tag) => {
+    if (offset + 2 > end || der[offset + 1] === 128 || der[offset + 1] > 132) throw new AuthError("invalid certificate extension DER");
+    const value = readTlv(der, offset);
+    if (value[1] + value[2] > end || value[2] < 0 || tag !== void 0 && value[0] !== tag) throw new AuthError("invalid certificate extension DER");
+    return value;
+  };
+  const seenExtensions = /* @__PURE__ */ new Set();
+  while (pos < tbsEnd) {
+    const [tag, start, length] = extensionTlv(pos, tbsEnd);
+    pos = start + length;
+    if (tag === 129 || tag === 130) continue;
+    if (tag !== 163) throw new AuthError("invalid certificate extensions");
+    const [, sequenceStart, sequenceLength] = extensionTlv(start, pos, 48);
+    if (sequenceStart + sequenceLength !== pos) throw new AuthError("invalid certificate extensions");
+    let extensionPos = sequenceStart;
+    while (extensionPos < pos) {
+      const [, extensionStart, extensionLength] = extensionTlv(extensionPos, pos, 48);
+      const extensionEnd = extensionStart + extensionLength;
+      const [, oidStart, oidLength] = extensionTlv(extensionStart, extensionEnd, 6);
+      const oid = parseOid(der.slice(oidStart, oidStart + oidLength));
+      if (seenExtensions.has(oid)) throw new AuthError("duplicate certificate extension");
+      seenExtensions.add(oid);
+      let valuePos = oidStart + oidLength;
+      let critical = false;
+      if (der[valuePos] === 1) {
+        const [, boolStart, boolLength] = extensionTlv(valuePos, extensionEnd, 1);
+        if (boolLength !== 1 || der[boolStart] !== 255) throw new AuthError("invalid certificate extension critical flag");
+        critical = true;
+        valuePos = boolStart + boolLength;
+      }
+      const [, valueStart, valueLength] = extensionTlv(valuePos, extensionEnd, 4);
+      if (valueStart + valueLength !== extensionEnd) throw new AuthError("invalid certificate extension value");
+      if (oid === "2.5.29.19") {
+        const [, constraintStart, constraintLength] = extensionTlv(valueStart, extensionEnd, 48);
+        const constraintEnd = constraintStart + constraintLength;
+        if (constraintEnd !== extensionEnd) throw new AuthError("invalid BasicConstraints");
+        let constraintPos = constraintStart;
+        if (der[constraintPos] === 1) {
+          const [, boolStart, boolLength] = extensionTlv(constraintPos, constraintEnd, 1);
+          if (boolLength !== 1 || der[boolStart] !== 255) throw new AuthError("invalid BasicConstraints CA flag");
           isCA = true;
-          break;
+          constraintPos = boolStart + boolLength;
+        }
+        if (constraintPos < constraintEnd) {
+          const [, integerStart, integerLength] = extensionTlv(constraintPos, constraintEnd, 2);
+          if (!isCA || !integerLength || der[integerStart] & 128 || integerLength > 1 && der[integerStart] === 0 && !(der[integerStart + 1] & 128)) throw new AuthError("invalid BasicConstraints path length");
+          pathLenConstraint = 0;
+          for (let index = integerStart; index < integerStart + integerLength; index++) pathLenConstraint = pathLenConstraint * 256 + der[index];
+          if (!Number.isSafeInteger(pathLenConstraint)) throw new AuthError("invalid BasicConstraints path length");
+          constraintPos = integerStart + integerLength;
         }
+        if (constraintPos !== constraintEnd) throw new AuthError("invalid BasicConstraints");
+      } else if (oid === "2.5.29.15") {
+        const [, bitsStart, bitsLength] = extensionTlv(valueStart, extensionEnd, 3);
+        if (bitsStart + bitsLength !== extensionEnd || bitsLength < 2 || der[bitsStart] > 7 || der[bitsStart + bitsLength - 1] & (1 << der[bitsStart]) - 1) throw new AuthError("invalid KeyUsage");
+        keyCertSign = Boolean(der[bitsStart + 1] & 4);
+      } else if (critical) {
+        throw new AuthError(`unsupported critical certificate extension: ${oid}`);
       }
-      break;
+      extensionPos = extensionEnd;
     }
   }
   const sigAlg2Pos = tbsEnd;
@@ -15868,6 +16206,8 @@ function parseCertDer(pem) {
     notBefore,
     notAfter,
     isCA,
+    pathLenConstraint,
+    keyCertSign,
     spkiBytes
   };
 }
@@ -16448,7 +16788,7 @@ var _AuthFlow = class _AuthFlow {
       clearTimeout(timeout);
     }
   }
-  async verifyPeerCertificate(gatewayUrl, certPem, expectedAid, signedAt, strictRevocation = false) {
+  async verifyPeerCertificate(gatewayUrl, certPem, expectedAid, signedAt, strictRevocation = false, agentMdRead = false) {
     const tStart = Date.now();
     this._log.debug(`verifyPeerCertificate enter: aid=${expectedAid} gateway=${gatewayUrl}`);
     try {
@@ -16456,7 +16796,7 @@ var _AuthFlow = class _AuthFlow {
       if (signedAt !== void 0) {
         ensureCertTimeValid(cert, "peer certificate", signedAt);
         await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, signedAt);
-        if (cert.subjectCN !== expectedAid) throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}`);
+        if (agentMdRead ? cert.subjectCN.trim().toLowerCase() !== expectedAid.trim().toLowerCase() : cert.subjectCN !== expectedAid) throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}`);
         return;
       }
       const now = Date.now() / 1e3;
@@ -16863,7 +17203,7 @@ var _AuthFlow = class _AuthFlow {
     if (!fresh && this._gatewayCaVerified.get(cacheKey)) {
       const issuer = chain[0];
       ensureCertTimeValid(issuer, "Issuer CA", now);
-      if (!issuer.isCA) throw new AuthError("Issuer CA is not marked as CA (fast path)");
+      if (!issuer.isCA || issuer.keyCertSign === false) throw new AuthError("Issuer CA is not marked as CA (fast path)");
       if (!arraysEqual(authCert.issuerRaw, issuer.subjectRaw)) {
         throw new AuthError("auth certificate issuer mismatch");
       }
@@ -16878,9 +17218,11 @@ var _AuthFlow = class _AuthFlow {
       if (!arraysEqual(current.issuerRaw, caCert.subjectRaw)) {
         throw new AuthError(`auth certificate issuer mismatch at chain level ${i}`);
       }
-      if (!caCert.isCA) {
+      if (!caCert.isCA || caCert.keyCertSign === false) {
         throw new AuthError(`CA certificate[${i}] is not marked as CA`);
       }
+      const subordinateCas = chain.slice(0, i).filter((cert) => cert.isCA).length;
+      if (caCert.pathLenConstraint !== void 0 && subordinateCas > caCert.pathLenConstraint) throw new AuthError(`CA certificate[${i}] path length constraint exceeded`);
       await verifyCertSignature(caCert.spkiBytes, current);
       current = caCert;
     }
@@ -17413,7 +17755,7 @@ function parseOwnershipMessage(content) {
   ownershipAid(message.sub_aid, "sub_aid");
   ownershipAid(message.owner_aid, "owner_aid");
   ownershipInteger(message.base_relation_version, "base_relation_version", 0);
-  if (ownershipInteger(message.target_relation_version, "target_relation_version") !== message.base_relation_version + 1) throw new ValidationError("ownership target version must be base plus one");
+  if (ownershipInteger(message.target_relation_version, "target_relation_version") !== message.base_relation_version + (message.operation === "release" ? 0 : 1)) throw new ValidationError("ownership target version does not match operation");
   if (message.operation === "transfer") {
     if (ownershipAid(message.new_owner_aid, "new_owner_aid") === message.owner_aid) throw new ValidationError("transfer target must differ from current owner");
   } else if ("new_owner_aid" in message) throw new ValidationError("new_owner_aid is only allowed for transfer");
@@ -17470,7 +17812,8 @@ function validateOwnershipMessage(message, context) {
     if (ns.protocol !== "2.1") throw failure("unsupported_protocol", "NS ownership protocol is unavailable");
     const base = ns.relation_version === message.base_relation_version && (message.operation === "bind" ? ns.lock === "unlocked" && !ns.owner_aid : ns.lock === "locked" && ns.owner_aid === message.owner_aid);
     const target = ns.relation_version === message.target_relation_version && (message.operation === "release" ? ns.lock === "unlocked" && !ns.owner_aid : ns.lock === "locked" && ns.owner_aid === targetOwner(message));
-    if (message.action !== "operation.stopped" && (["relation.confirmed", "sub.cleaned"].includes(message.action) ? !target : !base && !target)) throw failure("conflict", "ownership current NS relation does not match this task");
+    const cleaned = message.action === "sub.cleaned" && Boolean(task) && ns.relation_version === 0 && ns.lock === "unlocked" && !ns.owner_aid;
+    if (message.action !== "operation.stopped" && (["relation.confirmed", "sub.cleaned"].includes(message.action) ? !target && !cleaned : !base && !target)) throw failure("conflict", "ownership current NS relation does not match this task");
   }
 }
 function ownershipTaskResult(task) {
@@ -17531,12 +17874,30 @@ var OwnershipWorkflow = class {
     const task = snapshot.record;
     const localAid = this.deps.currentAid();
     try {
+      if (!Number.isSafeInteger(snapshot.revision) || snapshot.revision < 1) throw new Error("invalid persisted task revision");
       if (task.schema_version !== 1 || !["pending", "completed", "rejected", "stopped", "error"].includes(task.status) || !["pending", "accept", "reject"].includes(task.local_decision) || typeof task.step !== "string") throw new Error("invalid task state");
       parseOwnershipMessage({ ...this.message(task, task.operation === "bind" ? "bind.request" : task.operation === "transfer" ? "transfer.request" : "relation.confirmed") });
-      if (!participants(task).includes(task.initiator_aid) || JSON.stringify(task.local_roles) !== JSON.stringify(ownershipLocalRoles(task, localAid)) || !task.local_roles.length) throw new Error("invalid local task identity");
+      if (!participants(task).includes(task.initiator_aid) || task.operation !== "bind" && task.initiator_aid !== task.owner_aid || JSON.stringify(task.local_roles) !== JSON.stringify(ownershipLocalRoles(task, localAid)) || !task.local_roles.length) throw new Error("invalid local task identity");
       if (!task.approvals || typeof task.approvals !== "object" || Array.isArray(task.approvals) || Object.entries(task.approvals).some(([aid2, decision]) => !participants(task).includes(aid2) || !["pending", "accept", "reject"].includes(decision))) throw new Error("invalid task approvals");
       if (JSON.stringify(Object.keys(task.approvals).sort()) !== JSON.stringify(participants(task).sort()) || task.approvals[task.initiator_aid] !== "accept") throw new Error("incomplete task approvals or initiator decision");
       if (!task.files || typeof task.files !== "object" || Array.isArray(task.files) || !Array.isArray(task.inbox) || !Array.isArray(task.received) || !Array.isArray(task.outbox) || !Array.isArray(task.sent) || !task.hints || typeof task.hints !== "object" || typeof task.request_validated !== "boolean") throw new Error("invalid task journals");
+      const base = task.base_agent_md;
+      if (!base && (task.request_validated || Object.keys(task.files).length || task.local_decision !== "pending")) throw new Error("missing original agent.md context");
+      if (base) {
+        if (typeof base.exists !== "boolean" || typeof base.raw !== "string" || typeof base.etag !== "string" || base.exists && !base.etag || base.sha256 !== await ownershipSha256(base.raw)) throw new Error("invalid original agent.md bytes or ETag");
+        const statement = base.exists ? parseOwnershipFile(base.raw, "agent", { expectedSubAid: task.sub_aid }).statement : void 0;
+        if ((statement?.relation_version ?? 0) !== task.base_relation_version || statement && task.operation !== "bind" && statement.owner_aid !== task.owner_aid || (statement ? !this.sameStatement(statement, base.statement ?? void 0) : base.statement !== null)) throw new Error("invalid original agent.md statement");
+      }
+      if (task.base_owner_md) {
+        const prior = task.base_owner_md;
+        if (typeof prior.exists !== "boolean" || typeof prior.raw !== "string" || prior.sha256 !== (prior.exists ? await ownershipSha256(prior.raw) : "") || !prior.exists && prior.raw !== "") throw new Error("invalid original owner.md context");
+        if (base?.statement && !prior.exists && (task.operation === "transfer" || task.operation === "release" && task.local_roles.includes("owner"))) throw new Error("missing original owner.md relation");
+        if (prior.exists) {
+          const file = parseOwnershipFile(prior.raw, "owner", { expectedSubAid: task.sub_aid });
+          if (!file.statement || file.statement.owner_aid !== base?.statement?.owner_aid || file.statement.relation_version !== base?.statement?.relation_version) throw new Error("invalid original owner.md statement");
+        }
+      }
+      if (base?.statement && !task.base_owner_md && !(task.operation === "release" && task.local_roles.includes("sub") && !task.local_roles.includes("owner") && task.cleanup_authorization_operation_id && !task.files.cleanup)) throw new Error("missing original owner.md context");
       if (task.approvals[localAid] !== task.local_decision) throw new Error("task decision and approval differ");
       if (task.status === "completed" && (task.verified_relation_version !== task.target_relation_version || task.operation !== "release" && task.local_decision !== "accept")) throw new Error("invalid completion evidence or local approval");
       const transferEvidenceRequired = task.operation === "transfer" && task.local_roles.some((role) => role === "sub" || role === "new_owner") && (task.status === "completed" || this.ongoing(task) && (Boolean(task.files.owner || task.files.agent || task.hints["transfer.ready"]) || task.authorization_sha256 !== void 0));
@@ -17546,7 +17907,9 @@ var OwnershipWorkflow = class {
         const agentFile = key === "agent" || key === "cleanup";
         if (!["agent", "owner", "release", "transfer", "cleanup"].includes(key) || !prepared || typeof prepared.raw !== "string" || !/^[0-9a-f]{64}$/.test(prepared.sha256) || await ownershipSha256(prepared.raw) !== prepared.sha256 || !prepared.condition || typeof prepared.condition !== "object" || Array.isArray(prepared.condition)) throw new Error("invalid prepared file bytes");
         const condition = prepared.condition;
-        if (Object.keys(condition).length !== 1 || (agentFile ? !(typeof condition.if_match === "string" && condition.if_match || condition.if_none_match === "*") : typeof condition.expected_revision !== "string" || !condition.expected_revision)) throw new Error("invalid prepared file condition");
+        if (agentFile ? Object.keys(condition).length !== 1 || !(typeof condition.if_match === "string" && condition.if_match || condition.if_none_match === "*") : Object.keys(condition).length !== 0) throw new Error("invalid prepared file condition");
+        const original = prepared.original_owner;
+        if (!agentFile && (!original || typeof original.exists !== "boolean" || typeof original.raw !== "string" || original.sha256 !== (original.exists ? await ownershipSha256(original.raw) : "") || !original.exists && original.raw !== "")) throw new Error("invalid prepared owner original");
         if (key === "cleanup" && task.operation !== "release" || key === "release" && task.operation !== "release" || key === "transfer" && task.operation !== "transfer" || ["agent", "owner"].includes(key) && task.operation === "release") throw new Error("invalid prepared file operation");
         const ownerAid = key === "owner" || key === "agent" ? targetOwner(task) : task.owner_aid;
         const file = parseOwnershipFile(prepared.raw, agentFile ? "agent" : "owner", { expectedSubAid: task.sub_aid, expectedOwnerAid: key === "cleanup" ? void 0 : ownerAid });
@@ -17554,7 +17917,7 @@ var OwnershipWorkflow = class {
         if (key === "cleanup" ? Boolean(file.statement) : file.statement?.relation_version !== (key === "owner" || key === "agent" ? task.target_relation_version : task.base_relation_version)) throw new Error("invalid prepared file generation");
         const fileExpiry = prepared.expires_at;
         if (!agentFile && file.action !== (key === "owner" ? "declare" : key === "release" ? "release" : "transfer_owner") || key === "transfer" && (typeof fileExpiry !== "number" || !Number.isSafeInteger(fileExpiry) || fileExpiry <= 0 || fileExpiry !== task.expires_at || file.transfer?.new_owner_aid !== task.new_owner_aid || file.transfer?.target_relation_version !== task.target_relation_version || file.transfer?.expires_at !== fileExpiry) || key !== "transfer" && fileExpiry !== void 0) throw new Error("invalid prepared file authorization");
-        if (prepared.published_revision !== void 0 && (agentFile || typeof prepared.published_revision !== "string" || !prepared.published_revision) || prepared.published_etag !== void 0 && (!agentFile || typeof prepared.published_etag !== "string" || !prepared.published_etag) || prepared.cleaned !== void 0 && typeof prepared.cleaned !== "boolean") throw new Error("invalid prepared file result");
+        if (prepared.published_etag !== void 0 && (!agentFile || typeof prepared.published_etag !== "string" || !prepared.published_etag) || prepared.cleaned !== void 0 && typeof prepared.cleaned !== "boolean") throw new Error("invalid prepared file result");
       }
       if (task.release_cleanup !== void 0) {
         const cleanup = task.release_cleanup;
@@ -17565,14 +17928,21 @@ var OwnershipWorkflow = class {
       }
       if (task.status === "completed") {
         const consensus = task.verified_consensus;
-        if (!consensus || consensus.protocol !== "2.1" || consensus.sub_aid !== task.sub_aid || consensus.relation_version !== task.target_relation_version || typeof consensus.agent_md_etag !== "string" || !consensus.agent_md_etag || !/^[0-9a-f]{64}$/.test(consensus.agent_md_sha256)) throw new Error("invalid persisted consensus evidence");
+        const cleaned = task.operation === "release" && consensus?.status === "unbound" && consensus.relation_version === 0 && Boolean(await this.cleanupEvidence(task, consensus));
+        if (!consensus || consensus.protocol !== "2.1" || consensus.sub_aid !== task.sub_aid || !cleaned && consensus.relation_version !== task.target_relation_version || typeof consensus.agent_md_etag !== "string" || !consensus.agent_md_etag || !/^[0-9a-f]{64}$/.test(consensus.agent_md_sha256)) throw new Error("invalid persisted consensus evidence");
         if (task.operation === "release") {
-          if (consensus.status !== "released" || consensus.lock !== "unlocked" || consensus.owner_aid !== null || task.local_roles.includes("owner") && !task.files.release) throw new Error("invalid persisted release evidence");
+          if (!cleaned && consensus.status !== "released" || consensus.lock !== "unlocked" || consensus.owner_aid !== null || task.local_roles.includes("owner") && !task.files.release) throw new Error("invalid persisted release evidence");
         } else {
-          if (consensus.status !== "consensus" || consensus.lock !== "locked" || consensus.owner_aid !== targetOwner(task) || typeof consensus.owner_md_revision !== "string" || !consensus.owner_md_revision || !/^[0-9a-f]{64}$/.test(consensus.owner_md_sha256)) throw new Error("invalid persisted binding evidence");
+          if (consensus.status !== "consensus" || consensus.lock !== "locked" || consensus.owner_aid !== targetOwner(task) || !/^[0-9a-f]{64}$/.test(consensus.owner_md_sha256)) throw new Error("invalid persisted binding evidence");
           if (task.local_roles.includes("sub") && task.files.agent?.sha256 !== consensus.agent_md_sha256 || task.local_roles.includes(task.operation === "transfer" ? "new_owner" : "owner") && task.files.owner?.sha256 !== consensus.owner_md_sha256 || task.operation === "transfer" && task.local_roles.includes("owner") && !task.files.transfer) throw new Error("persisted consensus differs from local original files");
         }
       }
+      for (const key of task.received) {
+        if (typeof key !== "string" || key.split("|").length !== 2) throw new Error("invalid received journal");
+        const [fromAid, action] = key.split("|");
+        const message = parseOwnershipMessage(this.message(task, action));
+        validateOwnershipMessage(message, { authenticated_from_aid: fromAid, local_aid: localAid, task });
+      }
       for (const item of task.inbox) {
         parseOwnershipMessage(item.payload);
         validateOwnershipMessage(item.payload, { authenticated_from_aid: item.from_aid, local_aid: localAid, task });
@@ -17580,6 +17950,9 @@ var OwnershipWorkflow = class {
       }
       for (const item of task.outbox) {
         parseOwnershipMessage(item.payload);
+        const action = item.payload.action;
+        if (["bind.accept", "transfer.accept", "owner.ready", "transfer.ready"].includes(action) && task.local_decision !== "accept" || ["bind.reject", "transfer.reject"].includes(action) && task.local_decision !== "reject") throw new Error("invalid outbox local approval");
+        if (["bind.accept", "transfer.accept", "bind.reject", "transfer.reject"].includes(action) && !task.request_validated) throw new Error("invalid outbox received request");
         validateOwnershipMessage(item.payload, { authenticated_from_aid: localAid, local_aid: item.to_aid, task });
         if (item.key !== `${item.to_aid}|${item.payload.action}` || typeof item.message_id !== "string" || !/^m-[0-9a-f]{32}$/.test(item.message_id)) throw new Error("invalid outbox target");
       }
@@ -17705,7 +18078,7 @@ var OwnershipWorkflow = class {
         const saved = await this.load(operationId, aid2);
         if (!saved && !initial) throw failure("operation_not_found", "ownership operation was not found");
         if (!saved && initial) {
-          const existing = (await this.records(aid2)).find((task) => task.sub_aid === subAid && this.ongoing(task));
+          const existing = (await this.records(aid2, subAid)).find((task) => task.sub_aid === subAid && this.ongoing(task));
           if (existing) {
             if (!this.sameIntent(existing, initial) || existing.base_relation_version !== initial.base_relation_version || existing.target_relation_version !== initial.target_relation_version) throw failure("conflict", "another local operation for this sub is pending");
             try {
@@ -17741,42 +18114,55 @@ var OwnershipWorkflow = class {
   sameIntent(task, intent) {
     return task.initiator_aid === intent.initiator_aid && task.operation === intent.operation && task.sub_aid === intent.sub_aid && task.owner_aid === intent.owner_aid && task.new_owner_aid === intent.new_owner_aid;
   }
-  async records(aid2) {
+  async records(aid2, subAid) {
     let snapshots;
     try {
       snapshots = await this.storage().listOwnershipTasks(aid2);
     } catch (error) {
       throw failure("persistence_unavailable", `ownership task list failed: ${String(error)}`);
     }
-    return await Promise.all(snapshots.map((snapshot) => this.record(snapshot)));
+    return await Promise.all(snapshots.filter((snapshot) => !subAid || typeof snapshot.record.sub_aid !== "string" || snapshot.record.sub_aid === subAid).map((snapshot) => this.record(snapshot)));
   }
   async observe(subAid) {
     this.requireApplicable(subAid);
     const snapshot = await this.deps.files.readAgent(subAid);
-    const file = snapshot.exists ? snapshot.lock === "unlocked" && snapshot.relation_version > 0 ? parseOwnershipFile(snapshot.content, "agent", { expectedSubAid: subAid }) : await this.deps.files.verify(snapshot.content, "agent", subAid) : null;
+    const file = snapshot.exists ? await this.deps.files.verify(snapshot.content, "agent", subAid) : null;
     if (file) requireOwnershipApplicable(file.frontmatter.type);
-    if (snapshot.lock === "unlocked" && snapshot.relation_version === 0 && file?.statement) throw failure("unavailable", "NS relation metadata does not match agent.md", true);
+    if ((file?.statement?.relation_version ?? 0) !== snapshot.relation_version) throw failure("unavailable", "NS relation metadata does not match agent.md", true);
     if (snapshot.lock === "locked" && (!file?.statement || file.statement.relation_version !== snapshot.relation_version || snapshot.owner_aid !== void 0 && snapshot.owner_aid !== file.statement.owner_aid)) throw failure("unavailable", "NS lock and current signed agent.md differ", true);
     return { ...snapshot, file, owner_aid: snapshot.lock === "locked" ? file.statement.owner_aid : null };
   }
   isBase(task, ns) {
-    return ns.relation_version === task.base_relation_version && (task.operation === "bind" ? ns.lock === "unlocked" : ns.lock === "locked" && ns.owner_aid === task.owner_aid);
+    const base = task.base_agent_md;
+    return ns.relation_version === task.base_relation_version && (task.operation === "bind" ? ns.lock === "unlocked" : ns.lock === "locked" && ns.owner_aid === task.owner_aid) && (!base || base.exists === ns.exists && (base.statement ? this.sameStatement(base.statement, ns.file?.statement) : !ns.file?.statement && base.raw === ns.content && base.etag === ns.etag));
+  }
+  async captureBase(task, ns) {
+    if (!task.base_agent_md) task.base_agent_md = { exists: ns.exists, raw: ns.content, sha256: await ownershipSha256(ns.content), etag: ns.etag, statement: ns.file?.statement ?? null };
+    if (!task.base_owner_md) {
+      const prior = ns.file?.statement ? await this.deps.files.readOwner(ns.file.statement.owner_aid, task.sub_aid) : null;
+      task.base_owner_md = prior ? { exists: prior.exists, raw: prior.content, sha256: prior.sha256 } : { exists: false, raw: "", sha256: "" };
+    }
   }
   isTarget(task, ns) {
     return ns.relation_version === task.target_relation_version && (task.operation === "release" ? ns.lock === "unlocked" : ns.lock === "locked" && ns.owner_aid === targetOwner(task));
   }
-  fileTask(context) {
+  fileTask(context, expectedStatement) {
     const task = {
       ...context.task,
       files: context.task.files,
+      expected_agent_statement: expectedStatement,
       persist: async () => {
         context.task.expires_at = task.expires_at;
         context.task.authorization_sha256 = task.authorization_sha256;
+        context.task.base_agent_md = task.base_agent_md;
+        context.task.base_owner_md = task.base_owner_md;
         await this.save(context);
       },
       guard: async () => {
         context.task.expires_at = task.expires_at;
         context.task.authorization_sha256 = task.authorization_sha256;
+        context.task.base_agent_md = task.base_agent_md;
+        context.task.base_owner_md = task.base_owner_md;
         await this.save(context);
       }
     };
@@ -17808,7 +18194,7 @@ var OwnershipWorkflow = class {
       }
     }
     const intent = { initiator_aid: aid2, operation, sub_aid: subAid, owner_aid: ownerAid, new_owner_aid: newOwnerAid };
-    for (const pending of (await this.records(aid2)).filter((task2) => task2.sub_aid === subAid && this.ongoing(task2))) {
+    for (const pending of (await this.records(aid2, subAid)).filter((task2) => task2.sub_aid === subAid && this.ongoing(task2))) {
       if (this.sameIntent(pending, intent)) {
         const result = await this.advance(subAid, pending.operation_id, void 0, events, void 0, guard);
         if (result.status !== "stopped" || result.code !== "conflict" || !/relation version or target was replaced/.test(result.reason ?? "")) return result;
@@ -17824,15 +18210,17 @@ var OwnershipWorkflow = class {
       if (!ns.exists) throw failure("unavailable", "initial agent.md is not published", true);
       if (ns.lock === "locked") throw failure("owner_locked", "the sub AID has a current owner lock");
       if (ns.file?.frontmatter.type === "human") throw failure("invalid", "human cannot declare an owner");
+      if (ns.file?.statement?.owner_aid === ownerAid) throw failure("conflict", "current owner release requires sub cleanup before binding again");
     } else {
       if (aid2 !== ownerAid || ns.lock !== "locked" || ns.owner_aid !== aid2) throw failure("forbidden", "only the current original owner may release or transfer");
       const consensus = await this.deps.files.checkConsensus(subAid);
       if (consensus.status !== "consensus" || consensus.owner_aid !== aid2 || consensus.relation_version !== ns.relation_version) throw failure(consensus.status === "invalid" ? "invalid" : "unavailable", "the current owner relation could not be verified", consensus.status !== "invalid");
     }
-    ownershipInteger(ns.relation_version + 1, "target_relation_version");
+    const targetVersion = ownershipInteger(ns.relation_version + (operation === "release" ? 0 : 1), "target_relation_version");
     const operationId = requestedId ?? crypto.randomUUID();
-    const payload = { type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: operationId, operation, action: operation === "bind" ? "bind.request" : operation === "transfer" ? "transfer.request" : "relation.confirmed", sub_aid: subAid, owner_aid: ownerAid, ...newOwnerAid ? { new_owner_aid: newOwnerAid } : {}, base_relation_version: ns.relation_version, target_relation_version: ns.relation_version + 1 };
+    const payload = { type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: operationId, operation, action: operation === "bind" ? "bind.request" : operation === "transfer" ? "transfer.request" : "relation.confirmed", sub_aid: subAid, owner_aid: ownerAid, ...newOwnerAid ? { new_owner_aid: newOwnerAid } : {}, base_relation_version: ns.relation_version, target_relation_version: targetVersion };
     const task = this.create(payload, aid2, "accept");
+    await this.captureBase(task, ns);
     if (!task.local_roles.length) throw failure("forbidden", "the local AID is not an ownership participant");
     if (aid2 !== this.deps.currentAid()) throw failure("forbidden", "ownership current identity changed");
     return await this.advance(subAid, operationId, task, events, async (context) => {
@@ -17953,11 +18341,23 @@ var OwnershipWorkflow = class {
     return true;
   }
   async confirmSubCleaned(task) {
-    const began = this.now(), before = await this.deps.files.readAgent(task.sub_aid), after = await this.deps.files.readAgent(task.sub_aid);
-    if (this.now() - began > 30 || before.exists !== after.exists || before.etag !== after.etag || before.relation_version !== after.relation_version || before.lock !== after.lock || before.owner_aid !== after.owner_aid || await ownershipSha256(before.content) !== await ownershipSha256(after.content)) throw failure("unavailable", "NS changed during sub cleanup verification", true);
-    if (!before.exists || before.relation_version !== task.target_relation_version || before.lock !== "unlocked" || before.owner_aid || !before.etag) return false;
+    const began = this.now(), before = await this.deps.files.readAgent(task.sub_aid);
+    if (!before.exists || before.relation_version !== 0 || before.lock !== "unlocked" || before.owner_aid || !before.etag) return false;
     const file = parseOwnershipFile(before.content, "agent", { expectedSubAid: task.sub_aid });
-    return !Object.hasOwn(file.frontmatter, "owner") && !Object.hasOwn(file.frontmatter, "ownership");
+    if (Object.hasOwn(file.frontmatter, "owner") || Object.hasOwn(file.frontmatter, "ownership")) return false;
+    if (!task.base_agent_md?.statement || task.base_agent_md.statement.owner_aid !== task.owner_aid || task.base_agent_md.statement.sub_aid !== task.sub_aid || task.base_agent_md.statement.relation_version !== task.base_relation_version) return false;
+    let ownerHash = "";
+    if (task.local_roles.includes("owner") && task.files.release) {
+      const original = task.files.release, object = await this.deps.files.readOwner(task.owner_aid, task.sub_aid);
+      if (object.exists && object.content === original.raw && object.sha256 === original.sha256) {
+        const file2 = await this.deps.files.verify(object.content, "owner", task.sub_aid, task.owner_aid);
+        if (file2.action === "release" && file2.statement && ["version", "owner_aid", "sub_aid", "relation_version"].every((key) => file2.statement[key] === task.base_agent_md.statement[key])) ownerHash = object.sha256;
+      }
+    }
+    const confirmed = Boolean(await this.cleanupEvidence(task, { agent_md_etag: before.etag, agent_md_sha256: await ownershipSha256(before.content), owner_md_sha256: ownerHash }, before.content));
+    const after = await this.deps.files.readAgent(task.sub_aid);
+    if (this.now() - began > 30 || before.exists !== after.exists || before.etag !== after.etag || before.relation_version !== after.relation_version || before.lock !== after.lock || before.owner_aid !== after.owner_aid || before.content !== after.content) throw failure("unavailable", "NS changed during sub cleanup verification", true);
+    return confirmed;
   }
   async resume(guard) {
     guard?.();
@@ -17969,12 +18369,13 @@ var OwnershipWorkflow = class {
     }
     for (const snapshot of snapshots) {
       guard?.();
-      const task = await this.record(snapshot);
-      if (["rejected", "stopped"].includes(task.status) && !task.outbox.length && !task.inbox.length || task.status === "completed" && !task.cleanup_pending && !task.outbox.length && !task.inbox.length && !(["bind", "transfer"].includes(task.operation) && task.local_roles.includes("sub") && task.local_decision === "accept" && !task.release_cleanup?.cleaned)) continue;
       try {
+        const task = await this.record(snapshot);
+        if (["rejected", "stopped"].includes(task.status) && !task.outbox.length && !task.inbox.length || task.status === "completed" && !task.cleanup_pending && !task.outbox.length && !task.inbox.length && !(["bind", "transfer"].includes(task.operation) && task.local_roles.includes("sub") && task.local_decision === "accept" && !task.release_cleanup?.cleaned)) continue;
         await this.execute(task.sub_aid, task.operation_id, void 0, void 0, guard);
       } catch (error) {
-        if (ownershipErrorCode(error) !== "conflict") throw error;
+        guard?.();
+        if (ownershipErrorCode(error) !== "conflict") await this.deps.emit("ownership.error", { operation_id: snapshot.record.operation_id, sub_aid: snapshot.record.sub_aid, code: ownershipErrorCode(error), reason: String(error), retryable: false });
       }
     }
   }
@@ -17988,6 +18389,21 @@ var OwnershipWorkflow = class {
       }
       const entry = task.inbox[0];
       const ns = await this.observe(task.sub_aid);
+      if (!task.base_agent_md && !task.request_validated && task.local_decision === "pending" && !Object.keys(task.files).length) {
+        if (this.isBase(task, ns) || task.operation === "release" && ns.relation_version === task.base_relation_version && ns.file?.statement?.owner_aid === task.owner_aid) await this.captureBase(task, ns);
+        else if (task.operation === "release" && ns.relation_version === 0 && !ns.file?.statement && task.local_roles.includes("sub")) {
+          for (const candidate of await this.records(context.aid, task.sub_aid)) {
+            const original = candidate.files.agent, cleanup = candidate.release_cleanup?.files.cleanup;
+            if (!["bind", "transfer"].includes(candidate.operation) || candidate.local_decision !== "accept" || !candidate.local_roles.includes("sub") || targetOwner(candidate) !== task.owner_aid || candidate.target_relation_version !== task.base_relation_version || !original || !cleanup || cleanup.raw !== ns.content || cleanup.sha256 !== await ownershipSha256(ns.content) || cleanup.published_etag !== void 0 && cleanup.published_etag !== ns.etag) continue;
+            const statement = parseOwnershipFile(original.raw, "agent", { expectedSubAid: task.sub_aid }).statement;
+            if (!statement || !cleanup.condition?.if_match) continue;
+            task.base_agent_md = { exists: true, raw: original.raw, sha256: original.sha256, etag: cleanup.condition.if_match, statement };
+            task.cleanup_authorization_operation_id = candidate.operation_id;
+            break;
+          }
+        }
+        if (task.base_agent_md) await this.save(context);
+      }
       try {
         validateOwnershipMessage(entry.payload, { authenticated_from_aid: entry.from_aid, local_aid: context.aid, task, ns });
       } catch {
@@ -18002,6 +18418,11 @@ var OwnershipWorkflow = class {
           task.request_validated = true;
         } else if (["bind.accept", "transfer.accept", "bind.reject", "transfer.reject"].includes(action)) {
           const decision = action.endsWith(".accept") ? "accept" : "reject";
+          if (decision === "reject" && await this.complete(context, ns)) {
+            task.inbox.shift();
+            await this.save(context);
+            continue;
+          }
           if (!task.approvals[entry.from_aid] || task.approvals[entry.from_aid] === "pending") {
             task.approvals[entry.from_aid] = decision;
             if (decision === "reject") {
@@ -18032,7 +18453,7 @@ var OwnershipWorkflow = class {
         }
       } else if (action === "sub.cleaned") {
         const file = ns.file;
-        if (ns.relation_version === task.target_relation_version && ns.lock === "unlocked" && !ns.owner_aid && file && !file.statement && !Object.hasOwn(file.frontmatter, "owner") && !Object.hasOwn(file.frontmatter, "ownership")) task.hints[action] = true;
+        if (ns.relation_version === 0 && ns.lock === "unlocked" && !ns.owner_aid && file && !file.statement && !Object.hasOwn(file.frontmatter, "owner") && !Object.hasOwn(file.frontmatter, "ownership")) task.hints[action] = true;
       }
       task.inbox.shift();
       await this.save(context);
@@ -18044,7 +18465,8 @@ var OwnershipWorkflow = class {
       const action = item.payload.action;
       const notification = ["relation.confirmed", "sub.cleaned"].includes(action);
       const terminal = ["bind.reject", "transfer.reject", "operation.stopped"].includes(action);
-      if (!terminal && (notification ? !this.isTarget(task, ns) : !this.isBase(task, ns) || task.status === "completed" || task.status === "rejected" || task.status === "stopped")) {
+      const cleaned = action === "sub.cleaned" && task.status === "completed" && await this.confirmSubCleaned(task);
+      if (!terminal && (notification ? !this.isTarget(task, ns) && !cleaned : !this.isBase(task, ns) || task.status === "completed" || task.status === "rejected" || task.status === "stopped")) {
         task.outbox = task.outbox.filter((row) => row.key !== item.key);
         await this.save(context);
         continue;
@@ -18065,15 +18487,35 @@ var OwnershipWorkflow = class {
   }
   async complete(context, ns) {
     const task = context.task;
-    if (!this.isTarget(task, ns)) return false;
+    const began = Date.now(), cleaned = task.operation === "release" && ns.exists && ns.relation_version === 0 && ns.lock === "unlocked" && !ns.file?.statement;
+    if (!this.isTarget(task, ns) && !cleaned) return false;
     let consensus;
     if (task.operation === "release") {
       consensus = await this.deps.files.checkConsensus(task.sub_aid);
-      if (consensus.status !== "released" || consensus.relation_version !== task.target_relation_version || consensus.lock !== ns.lock || consensus.owner_aid !== ns.owner_aid || consensus.agent_md_etag !== ns.etag) throw failure(consensus.status === "invalid" ? "invalid" : "unavailable", "ownership release could not be freshly confirmed", consensus.status !== "invalid");
+      if ((cleaned ? consensus.status !== "unbound" || consensus.relation_version !== 0 : consensus.status !== "released" || consensus.relation_version !== task.target_relation_version) || consensus.lock !== ns.lock || consensus.owner_aid !== ns.owner_aid || consensus.agent_md_etag !== ns.etag || consensus.agent_md_sha256 !== await ownershipSha256(ns.content)) throw failure(consensus.status === "invalid" ? "invalid" : "unavailable", "ownership release could not be freshly confirmed", consensus.status !== "invalid");
+      if (!cleaned && task.files.release && consensus.owner_md_sha256) {
+        const source = task.files.release;
+        if (source.sha256 !== consensus.owner_md_sha256) throw failure("conflict", "current release material does not belong to this task");
+      }
+      if (cleaned) {
+        const source = task.files.release;
+        if (task.local_roles.includes("owner") && source) {
+          const object = await this.deps.files.readOwner(task.owner_aid, task.sub_aid);
+          if (object.exists && object.content === source.raw && object.sha256 === source.sha256) {
+            await this.deps.files.verify(object.content, "owner", task.sub_aid, task.owner_aid);
+            consensus.owner_md_sha256 = object.sha256;
+          }
+        }
+        const authorization = await this.cleanupEvidence(task, consensus, ns.content);
+        if (!authorization) throw failure("conflict", "no local cleanup original can confirm this release task");
+        const after = await this.observe(task.sub_aid);
+        if (Date.now() - began > 3e4 || after.etag !== ns.etag || after.content !== ns.content || !after.exists || after.relation_version !== 0 || after.lock !== "unlocked" || after.owner_aid) throw failure("unavailable", "NS changed during cleanup confirmation", true);
+        if (authorization !== task.operation_id) task.cleanup_authorization_operation_id = authorization;
+      }
       const prior = ns.file?.statement;
-      if (prior && (prior.owner_aid !== task.owner_aid || prior.relation_version !== task.base_relation_version)) throw failure("conflict", "ownership released document does not match this generation");
+      if (prior && (prior.owner_aid !== task.owner_aid || prior.relation_version !== task.base_relation_version || !this.sameStatement(prior, task.base_agent_md?.statement ?? void 0))) throw failure("conflict", "ownership released document does not match this generation");
       if (task.local_roles.includes("owner") && !task.files.release) throw failure("conflict", "ownership completion lacks this task original owner file");
-      if (prior && task.local_roles.includes("sub") && !task.local_roles.includes("owner") && !await this.authorizeCleanup(context)) {
+      if (prior && task.local_roles.includes("sub") && !task.local_roles.includes("owner") && !await this.authorizeCleanup(context, prior)) {
         task.status = "pending";
         task.step = "cleanup_action_required";
         task.cleanup_pending = true;
@@ -18090,11 +18532,10 @@ var OwnershipWorkflow = class {
       if (task.local_roles.includes("sub") && (!task.files.agent || task.files.agent.sha256 !== consensus.agent_md_sha256)) throw failure("conflict", "NS accepted agent.md does not match this task original bytes");
       if (task.local_roles.includes(task.operation === "transfer" ? "new_owner" : "owner") && task.files.owner?.sha256 !== consensus.owner_md_sha256) throw failure("conflict", "Storage owner.md does not match this task original bytes");
       if (task.local_roles.includes("sub") && task.files.agent.published_etag !== void 0 && task.files.agent.published_etag !== consensus.agent_md_etag && task.verified_relation_version === void 0) throw failure("conflict", "NS accepted agent.md revision changed");
-      if (task.local_roles.includes(task.operation === "transfer" ? "new_owner" : "owner") && task.files.owner.published_revision !== void 0 && task.files.owner.published_revision !== consensus.owner_md_revision && task.verified_relation_version === void 0) throw failure("conflict", "Storage owner.md revision changed");
     }
     task.status = "completed";
     task.step = task.operation === "release" ? "released" : "confirmed";
-    task.verified_relation_version = consensus.relation_version;
+    task.verified_relation_version = task.target_relation_version;
     task.verified_consensus = { ...consensus, protocol: "2.1" };
     delete task.code;
     delete task.reason;
@@ -18109,9 +18550,34 @@ var OwnershipWorkflow = class {
     } else await this.save(context);
     return true;
   }
-  async authorizeCleanup(context) {
+  async cleanupEvidence(task, evidence, raw) {
+    const release = task.files.release;
+    if (task.local_roles.includes("owner") && release && release.sha256 === evidence.owner_md_sha256 && release.sha256 === await ownershipSha256(release.raw)) return task.operation_id;
+    if (!task.local_roles.includes("sub")) return void 0;
+    const matches = async (prepared) => Boolean(prepared && prepared.sha256 === evidence.agent_md_sha256 && prepared.sha256 === await ownershipSha256(prepared.raw) && (raw === void 0 || prepared.raw === raw) && (prepared.published_etag === void 0 || prepared.published_etag === evidence.agent_md_etag));
+    if (await matches(task.files.cleanup)) return task.operation_id;
+    let history;
+    try {
+      history = await this.storage().listOwnershipTasks(this.deps.currentAid());
+    } catch (error) {
+      throw failure("persistence_unavailable", `ownership cleanup history read failed: ${String(error)}`);
+    }
+    for (const snapshot of history) {
+      if (!["bind", "transfer"].includes(String(snapshot.record.operation))) continue;
+      if (snapshot.record.sub_aid !== task.sub_aid) continue;
+      const candidate = await this.record(snapshot);
+      if (task.cleanup_authorization_operation_id && candidate.operation_id !== task.cleanup_authorization_operation_id || candidate.local_decision !== "accept" || !candidate.local_roles.includes("sub") || candidate.sub_aid !== task.sub_aid || targetOwner(candidate) !== task.owner_aid || candidate.target_relation_version !== task.base_relation_version || !await matches(candidate.release_cleanup?.files.cleanup)) continue;
+      const statement = candidate.files.agent && parseOwnershipFile(candidate.files.agent.raw, "agent", { expectedSubAid: task.sub_aid }).statement;
+      if (statement?.owner_aid === task.owner_aid && statement.sub_aid === task.sub_aid && statement.relation_version === task.base_relation_version && this.sameStatement(statement, task.base_agent_md?.statement ?? void 0)) return candidate.operation_id;
+    }
+    return void 0;
+  }
+  sameStatement(left, right) {
+    return Boolean(left && right && ["version", "declaration_id", "owner_aid", "sub_aid", "relation_version", "declared_at"].every((key) => left[key] === right[key]));
+  }
+  async authorizeCleanup(context, statement) {
     const task = context.task;
-    const matches = (record) => ["bind", "transfer"].includes(record.operation) && record.sub_aid === task.sub_aid && record.target_relation_version === task.base_relation_version && record.local_decision === "accept" && record.local_roles.includes("sub") && targetOwner(record) === task.owner_aid;
+    const matches = (record) => ["bind", "transfer"].includes(record.operation) && record.sub_aid === task.sub_aid && record.target_relation_version === task.base_relation_version && record.local_decision === "accept" && record.local_roles.includes("sub") && targetOwner(record) === task.owner_aid && Boolean(record.files.agent && this.sameStatement(parseOwnershipFile(record.files.agent.raw, "agent", { expectedSubAid: task.sub_aid }).statement, statement));
     if (task.cleanup_authorization_operation_id) {
       const saved = await this.load(task.cleanup_authorization_operation_id);
       if (!saved || !matches(await this.record(saved))) throw failure("persistence_unavailable", "ownership cleanup historical authorization is damaged");
@@ -18123,7 +18589,7 @@ var OwnershipWorkflow = class {
     } catch (error) {
       throw failure("persistence_unavailable", `ownership cleanup history read failed: ${String(error)}`);
     }
-    const authorized = (await Promise.all(history.map((row) => this.record(row)))).find(matches);
+    const authorized = (await Promise.all(history.filter((row) => row.record.sub_aid === task.sub_aid).map((row) => this.record(row)))).find(matches);
     if (!authorized) return false;
     task.cleanup_authorization_operation_id = authorized.operation_id;
     await this.save(context);
@@ -18131,11 +18597,19 @@ var OwnershipWorkflow = class {
   }
   async resumeSubCleanup(context, ns) {
     const task = context.task;
-    if (!["bind", "transfer"].includes(task.operation) || !task.local_roles.includes("sub") || task.local_decision !== "accept" || ns.lock !== "unlocked" || ns.relation_version !== task.target_relation_version + 1 || task.release_cleanup?.cleaned) return;
+    if (!["bind", "transfer"].includes(task.operation) || !task.local_roles.includes("sub") || task.local_decision !== "accept" || ns.lock !== "unlocked" || task.release_cleanup?.cleaned) return;
+    if (ns.relation_version === 0 && !ns.file?.statement) {
+      const prepared = task.release_cleanup?.files.cleanup;
+      if (!prepared || !prepared.condition?.if_match || prepared.raw !== ns.content || prepared.sha256 !== await ownershipSha256(ns.content) || prepared.published_etag !== void 0 && prepared.published_etag !== ns.etag) throw failure("conflict", "historical cleanup original file was not confirmed");
+      task.release_cleanup.cleaned = true;
+      await this.save(context);
+      return;
+    }
+    if (ns.relation_version !== task.target_relation_version) return;
     const consensus = await this.deps.files.checkConsensus(task.sub_aid);
     if (consensus.status !== "released" || consensus.relation_version !== ns.relation_version || consensus.agent_md_etag !== ns.etag || consensus.agent_md_sha256 !== await ownershipSha256(ns.content)) throw failure(consensus.status === "invalid" ? "invalid" : "unavailable", "NS changed during historical cleanup observation", consensus.status !== "invalid");
     const statement = ns.file?.statement;
-    if (statement && (statement.owner_aid !== targetOwner(task) || statement.relation_version !== task.target_relation_version)) throw failure("conflict", "historical cleanup fields belong to another relation");
+    if (!statement || !task.files.agent || !this.sameStatement(statement, parseOwnershipFile(task.files.agent.raw, "agent", { expectedSubAid: task.sub_aid }).statement)) throw failure("conflict", "historical cleanup fields belong to another relation");
     if (!task.release_cleanup) {
       task.release_cleanup = { files: {}, cleaned: false };
       await this.save(context);
@@ -18147,6 +18621,7 @@ var OwnershipWorkflow = class {
       base_relation_version: task.target_relation_version,
       target_relation_version: ns.relation_version,
       files: task.release_cleanup.files,
+      expected_agent_statement: statement,
       persist: () => this.save(context),
       guard: () => this.save(context)
     });
@@ -18157,7 +18632,9 @@ var OwnershipWorkflow = class {
   async cleanup(context, ns) {
     const task = context.task;
     if (!task.cleanup_pending || task.cleanup_done) return;
-    if (!this.isTarget(task, ns)) {
+    const releaseOwner = task.operation === "release" && task.local_roles.includes("owner");
+    const cleaned = task.operation === "release" && ns.relation_version === 0 && ns.lock === "unlocked" && !ns.file?.statement;
+    if (!this.isTarget(task, ns) && !cleaned && !releaseOwner) {
       task.cleanup_pending = false;
       task.step = "cleanup_superseded";
       await this.save(context);
@@ -18165,24 +18642,23 @@ var OwnershipWorkflow = class {
     }
     if (task.operation === "release" && task.local_roles.includes("sub")) {
       const prior = ns.file?.statement;
-      if (prior && !await this.authorizeCleanup(context)) {
+      if (prior && !this.sameStatement(prior, task.base_agent_md?.statement ?? void 0)) throw failure("conflict", "ownership cleanup original relation was replaced");
+      if (prior && !await this.authorizeCleanup(context, prior)) {
         task.step = "cleanup_action_required";
         await this.save(context);
         this.event(context, "ownership.action_required");
         return;
       }
       if (prior && (prior.owner_aid !== task.owner_aid || prior.relation_version !== task.base_relation_version)) throw failure("conflict", "ownership cleanup current fields differ");
-      if (prior) await this.deps.files.revokeOwneraid(this.fileTask(context));
+      if (prior || task.files.cleanup) await this.deps.files.revokeOwneraid(this.fileTask(context, prior));
       this.enqueue(task, task.owner_aid, "sub.cleaned");
     }
     if (task.local_roles.includes("owner") && (task.operation === "release" || task.operation === "transfer")) {
+      if (releaseOwner && this.isTarget(task, ns) && ns.file?.statement) return;
       const prepared = task.files[task.operation === "release" ? "release" : "transfer"];
-      if (prepared && !prepared.published_revision) {
+      if (prepared) {
         const object = await this.deps.files.readOwner(task.owner_aid, task.sub_aid);
-        if (object.exists && object.sha256 === prepared.sha256 && object.content === prepared.raw) {
-          prepared.published_revision = object.revision;
-          await this.save(context);
-        }
+        if (object.exists && (object.sha256 !== prepared.sha256 || object.content !== prepared.raw)) throw failure("conflict", "ownership cleanup original owner file has been replaced");
       }
       await this.deps.files.cleanupOwnerFile(this.fileTask(context));
     }
@@ -18216,7 +18692,7 @@ var OwnershipWorkflow = class {
       delete task.reason;
       task.retryable = true;
       if (await this.complete(context, ns)) {
-        if (task.status === "completed" && task.operation === "release" && task.local_roles.includes("sub")) {
+        if (task.status === "completed" && task.operation === "release") {
           await this.cleanup(context, ns);
           ns = await this.observe(task.sub_aid);
         }
@@ -18303,6 +18779,21 @@ var OwnershipWorkflow = class {
 };
 
 // src/aid-store.ts
+async function readSigningInput(input, inputType = "text") {
+  if (inputType === "text") {
+    if (typeof input === "string" || input instanceof Uint8Array) return input;
+    throw new Error("text input requires a string or Uint8Array");
+  }
+  if (typeof input === "string" || input instanceof Uint8Array) throw new Error("browser file input does not support filesystem paths");
+  const file = "getFile" in input ? await input.getFile() : input;
+  if (typeof file.arrayBuffer === "function") return new Uint8Array(await file.arrayBuffer());
+  return await new Promise((resolve, reject) => {
+    const reader = new FileReader();
+    reader.onload = () => resolve(new Uint8Array(reader.result));
+    reader.onerror = () => reject(reader.error);
+    reader.readAsArrayBuffer(file);
+  });
+}
 function _derReadLength(data, offset) {
   if (offset >= data.length) return null;
   const first = data[offset];
@@ -18573,6 +19064,8 @@ var AIDStore = class {
         const fp = String(certFingerprint ?? "").trim().toLowerCase();
         const cachedCert = await this._keystore.loadCert(target, fp || void 0);
         if (cachedCert) {
+          const gatewayUrl2 = await this._resolveGateway(target);
+          await this._verifyDownloadedPeerCertificate(gatewayUrl2, target, cachedCert, fp, signedAt);
           return await AID.create({ aid: target, aunPath: this.aunPath, certPem: cachedCert, privateKeyPem: null, certValid: true, privateKeyValid: false });
         }
         if (fp) {
@@ -18599,6 +19092,58 @@ var AIDStore = class {
     const closeTokens = this._tokenStore.close;
     if (typeof closeTokens === "function") closeTokens.call(this._tokenStore);
   }
+  async sign(aid2, input, options = {}) {
+    try {
+      if (options.inputType !== void 0 && !["text", "file"].includes(options.inputType) || options.format !== void 0 && !["raw", "document"].includes(options.format)) throw new Error("unsupported signing inputType or format");
+      if (options.append && options.format !== "document") throw new Error("append requires document format");
+      if (options.inPlace && (options.inputType !== "file" || options.format !== "document" || typeof input !== "object" || !("createWritable" in input) || typeof input.createWritable !== "function")) throw new Error("inPlace document signing requires a writable file handle");
+      const loaded = options.identity ? resultOk({ aid: options.identity }) : await this.load(aid2);
+      if (!loaded.ok) return loaded;
+      if (loaded.data.aid.aid !== aid2 || parseCertMetadata(loaded.data.aid.certPem).subject.toLowerCase() !== aid2.toLowerCase()) throw new Error("signing identity does not match AID");
+      const raw = await readSigningInput(input, options.inputType);
+      if (typeof raw === "string" && new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(raw)) !== raw) throw new Error("signing input must be valid UTF-8");
+      if (options.format !== "document") return await loaded.data.aid.sign(raw);
+      const content = typeof raw === "string" ? raw : new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+      const result = await signDocument(loaded.data.aid, content, options);
+      if (options.inPlace) {
+        const writable = await input.createWritable();
+        await writable.write(result.signed);
+        await writable.close();
+      }
+      return resultOk(result);
+    } catch (exc) {
+      return resultErr(SIGNATURE_OPERATION_ERROR, String(exc), exc);
+    }
+  }
+  async verify(aid2, input, signatureOrOptions = {}, options = {}) {
+    try {
+      const opts = typeof signatureOrOptions === "string" ? options : signatureOrOptions;
+      if (opts.inputType !== void 0 && !["text", "file"].includes(opts.inputType) || opts.format !== void 0 && !["raw", "document"].includes(opts.format)) throw new Error("unsupported verification inputType or format");
+      if (opts.identity && (opts.identity.aid !== aid2 || parseCertMetadata(opts.identity.certPem).subject.toLowerCase() !== aid2.toLowerCase())) throw new Error("verification identity does not match AID");
+      const raw = await readSigningInput(input, opts.inputType);
+      if (typeof raw === "string" && new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(raw)) !== raw) throw new Error("verification input must be valid UTF-8");
+      if (opts.format === "document") {
+        const content = typeof raw === "string" ? raw : new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+        const resolver = opts.certificateResolver ?? (async (signer, fingerprint) => {
+          if (opts.identity?.aid === signer) return opts.identity;
+          const resolved = await this.load(signer);
+          if (!resolved.ok) throw new Error(resolved.error.message);
+          return resolved.data.aid;
+        });
+        return resultOk(await verifyDocument(content, resolver, { expectedAid: aid2 }));
+      }
+      if (typeof signatureOrOptions !== "string") throw new Error("raw verification requires a detached signature");
+      const supplied = !opts.identity && opts.certificateResolver ? await opts.certificateResolver(aid2, "", 0) : void 0;
+      if (supplied && typeof supplied !== "string" && "aid" in supplied && supplied.aid !== aid2) throw new Error("verification certificate identity does not match AID");
+      const suppliedPem = typeof supplied === "string" ? supplied : supplied?.certPem;
+      const loaded = opts.identity ? resultOk({ aid: opts.identity }) : suppliedPem ? resultOk({ aid: await AID.create({ aid: aid2, aunPath: this.aunPath, certPem: suppliedPem, privateKeyPem: null, certValid: true, privateKeyValid: false }) }) : await this.load(aid2);
+      if (!loaded.ok) return loaded;
+      if (loaded.data.aid.aid !== aid2 || parseCertMetadata(loaded.data.aid.certPem).subject.toLowerCase() !== aid2.toLowerCase()) throw new Error("verification identity does not match AID");
+      return await loaded.data.aid.verify(raw, signatureOrOptions);
+    } catch (exc) {
+      return resultErr(VERIFICATION_OPERATION_ERROR, String(exc), exc);
+    }
+  }
   async load(aid2) {
     const target = String(aid2 ?? "").trim();
     const certPem = await this._keystore.loadCert(target);
@@ -18717,14 +19262,14 @@ var AIDStore = class {
       this._registerFlow.validateAidName(target);
       const type = String(options?.type ?? "").trim(), owner = String(options?.owner ?? "").trim().toLowerCase();
       const entity = ["group", "org"].includes(type);
-      if (!type || type === "human" && owner || (type === "agent" || entity) && !owner) throw new ValidationError("register requires type; human forbids owner; agent/group/org requires owner");
+      if (!type || type === "human" && owner || entity && !owner) throw new ValidationError("register requires type; human forbids owner; group/org requires owner");
       if (owner) validateAIDFormat(owner, "owner");
       const previousRaw = await this._tokenStore.getMetadata(target, "registration_intent");
       const previous = previousRaw ? parseOwnershipRegistrationIntent(previousRaw, target) : null;
       const exttype = String(options?.exttype ?? "").trim();
       if (previous && (previous.type !== type || previous.owner !== owner || previous.exttype !== exttype)) throw new StateError("ownership registration intent changed", { stringCode: "conflict" });
       const intent = previous ?? (entity ? { schema_version: 1, sub_aid: target, type, owner, exttype, protocol: "entity", pending: false } : { schema_version: 1, sub_aid: target, type, owner, exttype, operation_id: crypto.randomUUID(), pending: Boolean(owner) });
-      await this._tokenStore.setMetadata(target, "registration_intent", JSON.stringify(intent));
+      if (type !== "agent" || owner) await this._tokenStore.setMetadata(target, "registration_intent", JSON.stringify(intent));
       const gatewayUrl = await this._resolveGateway(target);
       const result = await this._registerFlow.registerAid(gatewayUrl, target);
       if (result.cert) {
@@ -18780,7 +19325,11 @@ var AIDStore = class {
       let peer;
       let certFromCache = false;
       const cached = await this.load(target);
-      if (cached.ok && !forceRefresh) {
+      const localIdentity = !cached.ok && cached.error.code === CERT_EXPIRED && !forceRefresh && !skipAgentMd ? await this._expiredIdentityForAgentMdRead(target) : null;
+      if (localIdentity) {
+        peer = localIdentity;
+        certFromCache = true;
+      } else if (cached.ok && !forceRefresh) {
         peer = cached.data.aid;
         certFromCache = true;
       } else {
@@ -18796,6 +19345,15 @@ var AIDStore = class {
       }
       const source = { cert_from_cache: certFromCache, agent_md_fetched: false };
       if (skipAgentMd) return resultOk({ aid: peer, source });
+      if (!forceRefresh && (localIdentity || peer.isPrivateKeyValid() && peer.privateKeyPem)) {
+        const record = await this._agentMdManager.loadRecord(target, true);
+        const draft = String(record?.local_draft_content ?? "");
+        const local = draft || await this._agentMdManager.readContent(target);
+        if (local) {
+          const etag = await AgentMdManager.contentEtag(local);
+          return resultOk({ aid: peer, source, agent_md: { aid: target, content: local, verification: { status: "unverified" }, signature: { status: "unverified" }, cert_pem: peer.certPem, etag: draft ? "" : etag, last_modified: String(record?.last_modified ?? ""), status: 0, in_sync: draft ? false : etag === record?.remote_etag, saved_to: null, save_error: null } });
+        }
+      }
       const agentMd = await this.downloadAgentMd(target, opts?.timeout);
       if (!agentMd.ok) return agentMd;
       source.agent_md_fetched = true;
@@ -18804,6 +19362,21 @@ var AIDStore = class {
       return resultErr(NETWORK_ERROR, String(exc), exc);
     }
   }
+  async _expiredIdentityForAgentMdRead(target) {
+    const record = await this._agentMdManager.loadRecord(target, true);
+    if (!String(record?.local_draft_content ?? "") && !await this._agentMdManager.readContent(target)) return null;
+    const certPem = await this._keystore.loadCert(target);
+    const keyPair = await this._keystore.loadKeyPair(target);
+    if (!certPem || !keyPair?.private_key_pem || parseCertCN(certPem) !== target) return null;
+    try {
+      const privateKey = await importPrivateKeyEcdsa(String(keyPair.private_key_pem));
+      const probe = new TextEncoder().encode("aun-aidstore-private-key-self-test");
+      if (!await ecdsaVerifyDer(await importCertPublicKeyEcdsa(certPem), await ecdsaSignDer(privateKey, probe), probe)) return null;
+      return await AID.create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: false, privateKeyValid: false, deviceId: this.deviceId, slotId: this.slotId, verifySsl: this._verifySsl, aidStore: this });
+    } catch {
+      return null;
+    }
+  }
   async downloadAgentMd(aid2, timeoutMs = 3e4) {
     try {
       return resultOk(await this._agentMdManager.download(aid2, timeoutMs));
@@ -18824,7 +19397,7 @@ var AIDStore = class {
       throw new ValidationError(`certificate fingerprint mismatch for aid: ${aid2}`);
     }
     if (signedAt === void 0) await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid2);
-    else await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid2, signedAt);
+    else await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid2, signedAt, false, true);
   }
   async _resolveEntityAgentMdOwner(aid2, type) {
     const authority = await this._agentMdManager.readEntityAuthorityFresh(aid2);
@@ -18873,10 +19446,13 @@ var AIDStore = class {
         return resultErr(loaded.error.code, loaded.error.message);
       }
       const current = loaded.data.aid;
-      const raw = content ?? await this._agentMdManager.readContent(target);
-      const parsed = validateAgentMdDocument(String(raw ?? ""), { expectedAid: target });
+      const raw = content ?? (String((await this._agentMdManager.loadRecord(target, true))?.local_draft_content ?? "") || await this._agentMdManager.readContent(target));
+      const tail = parseAgentMdTailSignatureForRead(String(raw ?? ""));
+      if (tail.parseError) throw new ValidationError(tail.parseError);
+      const base = validateAgentMdDocument(tail.payload, { expectedAid: target, validateOwnership: false });
+      const entity = ["group", "org"].includes(String(base.frontmatter.type));
+      const parsed = entity ? validateAgentMdDocument(String(raw ?? ""), { expectedAid: target }) : base;
       const meta = parsed.frontmatter;
-      const entity = ["group", "org"].includes(String(meta.type));
       if ((!current.isPrivateKeyValid() || !current.privateKeyPem) && !(entity && parsed.signature)) {
         return resultErr(PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires local AID with a valid private key: ${target}`);
       }
@@ -18906,7 +19482,16 @@ var AIDStore = class {
         accessTokenResolver: async () => this._uploadAgentMdToken(uploader, await this._resolveGateway(uploaderTarget)),
         aidValidator: (value) => this._registerFlow.validateAidName(value)
       });
-      return resultOk(entity ? await manager.uploadAs(target, String(raw), current) : await manager.upload(raw));
+      if (entity) {
+        let signed = String(raw);
+        if (!parsed.signature) signed = (await signDocument(current, signed, { signerAid: true })).signed;
+        if (options.coSignerAid) {
+          if (options.coSignerAid !== meta.owner) throw new ValidationError("entity additional signer must be current owner");
+          signed = (await signDocument(uploader, signed, { append: true })).signed;
+        }
+        return resultOk(await manager.uploadAs(target, signed, current));
+      }
+      return resultOk(await manager.upload(raw));
     } catch (exc) {
       return agentMdFailure(exc);
     }
@@ -20182,6 +20767,9 @@ var MessageDeliveryEngine = class {
     __publicField(this, "pendingPullNoProgressAcks", null);
     __publicField(this, "onlineUnreadHintTargets", null);
     __publicField(this, "onlineUnreadHintOwners", null);
+    __publicField(this, "backgroundPullDemands", /* @__PURE__ */ new Map());
+    __publicField(this, "backgroundPullTimer", null);
+    __publicField(this, "backgroundPullRecoveryQueued", false);
     __publicField(this, "realtimeAcking", null);
     __publicField(this, "pendingP2PInlineAcks", null);
     __publicField(this, "pendingGroupInlineAcks", null);
@@ -20209,6 +20797,10 @@ var MessageDeliveryEngine = class {
     this.pendingPullNoProgressAcks = null;
     this.onlineUnreadHintTargets = null;
     this.onlineUnreadHintOwners = null;
+    this.backgroundPullDemands.clear();
+    if (this.backgroundPullTimer !== null) clearTimeout(this.backgroundPullTimer);
+    this.backgroundPullTimer = null;
+    this.backgroundPullRecoveryQueued = false;
     this.realtimeTailResults = null;
     this.realtimeAcking = null;
     this.pendingP2PInlineAcks = null;
@@ -20362,8 +20954,94 @@ var MessageDeliveryEngine = class {
   onPullGateIdle(ns) {
     if (!ns) return;
     this.schedulePendingPullIfNeeded(ns, "pull-gate-idle");
+    this.requestBackgroundPullRecovery();
+  }
+  recordBackgroundPullDemand(ns, throughSeq = 0, probe = false) {
+    const demand = this.backgroundPullDemands.get(ns) ?? {
+      throughSeq: 0,
+      hasMore: false,
+      probe: false,
+      afterSeq: -1,
+      retryAt: 0
+    };
+    demand.throughSeq = Math.max(demand.throughSeq, positiveSafeSequenceHint(throughSeq));
+    demand.probe || (demand.probe = probe);
+    this.backgroundPullDemands.set(ns, demand);
+    return demand;
+  }
+  observeBackgroundPullResponse(ns, afterSeq, result, limit = 50) {
+    if (!ns || this.runtime.client._sessionOptions?.background_sync === false) return;
+    const cursor = isJsonObject(result.cursor) ? result.cursor : null;
+    const rows = Array.isArray(result.messages) ? result.messages : Array.isArray(result.events) ? result.events : [];
+    let throughSeq = Math.max(
+      positiveSafeSequenceHint(cursor?.latest_seq),
+      positiveSafeSequenceHint(result.latest_seq),
+      positiveSafeSequenceHint(result.latest_message_seq),
+      positiveSafeSequenceHint(result.latest_event_seq)
+    );
+    for (const row of rows) {
+      if (!isJsonObject(row) || this.isVolatileMessage(row)) continue;
+      throughSeq = Math.max(throughSeq, positiveSafeSequenceHint(row.seq ?? row.event_seq));
+    }
+    const demand = this.recordBackgroundPullDemand(ns, throughSeq);
+    if (afterSeq >= demand.afterSeq) {
+      demand.afterSeq = afterSeq;
+      demand.hasMore = result.has_more === true || positiveSafeSequenceHint(result.remaining) > 0 || !Object.prototype.hasOwnProperty.call(result, "has_more") && limit > 0 && rows.length >= limit;
+      demand.probe = false;
+    }
+    this.requestBackgroundPullRecovery();
+  }
+  finishBackgroundPull(ns, afterSeq, failed) {
+    const demand = this.backgroundPullDemands.get(ns);
+    if (demand) {
+      const state = this.syncState(ns);
+      const ack = state.ack;
+      if (ack < state.tail - 1) demand.throughSeq = Math.max(demand.throughSeq, state.tail - 1);
+      demand.probe = failed;
+      if (!demand.probe && !demand.hasMore && ack >= demand.throughSeq) this.backgroundPullDemands.delete(ns);
+      else demand.retryAt = failed || ack <= afterSeq || ack <= (this.pendingPullNoProgressAcks?.get(ns) ?? -1) ? Date.now() + P2P_GAP_FILL_RETRY_BASE_MS : 0;
+    }
+    this.requestBackgroundPullRecovery();
+  }
+  requestBackgroundPullRecovery() {
+    if (this.backgroundPullRecoveryQueued) return;
+    const generation = this.captureInlineGeneration();
+    this.backgroundPullRecoveryQueued = true;
+    void Promise.resolve().then(() => {
+      if (!this.isInlineGenerationCurrent(generation)) return;
+      this.backgroundPullRecoveryQueued = false;
+      const client = this.runtime.client;
+      if (!client._aid || client._sessionOptions?.background_sync === false || client.state !== "ready" /* READY */ || client._closing) return;
+      if (this.backgroundPullTimer !== null) clearTimeout(this.backgroundPullTimer);
+      this.backgroundPullTimer = null;
+      let retryAt = 0;
+      for (const [ns, demand] of this.backgroundPullDemands) {
+        if (ns.startsWith("p2p:") && ns !== `p2p:${client._aid}`) continue;
+        const dedupKey = ns.startsWith("p2p:") ? `p2p_pull:${ns}` : ns.startsWith("group_event:") ? `group_event_pull:${ns}` : `group_pull:${ns}`;
+        if (client._gapFillDone.has(dedupKey) || this.onlineUnreadHintOwners?.has(ns) || this.realtimeSyncing?.has(ns) || client._rpcPipeline?.hasPullActivity?.(ns, false)) continue;
+        const ack = this.syncState(ns).ack;
+        if (!demand.probe && !demand.hasMore && ack >= demand.throughSeq) {
+          this.backgroundPullDemands.delete(ns);
+          continue;
+        }
+        if (demand.retryAt > Date.now()) {
+          retryAt = retryAt === 0 ? demand.retryAt : Math.min(retryAt, demand.retryAt);
+          continue;
+        }
+        if (ns.startsWith("p2p:")) client._safeAsync(this.fillP2pGap());
+        else if (ns.startsWith("group_event:")) client._safeAsync(this.fillGroupEventGap(ns.slice("group_event:".length)));
+        else if (ns.startsWith("group:")) client._safeAsync(this.fillGroupGap(ns.slice("group:".length)));
+      }
+      if (retryAt > 0) {
+        this.backgroundPullTimer = globalThis.setTimeout(() => {
+          this.backgroundPullTimer = null;
+          if (this.isInlineGenerationCurrent(generation)) this.requestBackgroundPullRecovery();
+        }, Math.max(0, retryAt - Date.now()));
+      }
+    });
   }
   onForegroundPullsDrained() {
+    this.requestBackgroundPullRecovery();
     const client = this.runtime.client;
     if (!client._aid || client._sessionOptions?.background_sync === false || client.state !== "ready" /* READY */ || client._closing) return;
     const ns = `p2p:${client._aid}`;
@@ -20373,6 +21051,7 @@ var MessageDeliveryEngine = class {
     client._safeAsync(this.fillP2pGap());
   }
   onPullWorkSettled() {
+    this.requestBackgroundPullRecovery();
     const pipeline = this.runtime.client._rpcPipeline;
     if (pipeline?.hasAnyPullActivity?.() === true) return;
     void this.flushPullDeliveryChanges().finally(() => this.syncStopped("pull_drained"));
@@ -21974,7 +22653,13 @@ var MessageDeliveryEngine = class {
         return;
       }
     }
+    const generation = this.captureInlineGeneration();
+    const dedupKey = `group_pull:${ns}`;
+    this.recordBackgroundPullDemand(ns, positiveSafeSequenceHint(notification.seq), true);
+    if (client._gapFillDone.has(dedupKey)) return;
+    client._gapFillDone.add(dedupKey);
     let rawCompleted = false;
+    let failed = false;
     try {
       const key = client._rpcPipeline.pullGateKeyForCall("group.pull", {
         group_id: groupId,
@@ -21990,15 +22675,23 @@ var MessageDeliveryEngine = class {
           limit: 50,
           _rpc_background: true
         }, { background: true });
+        if (!this.isInlineGenerationCurrent(generation)) throw new Error("pull invalidated");
         rawCompleted = true;
+        if (isJsonObject(result)) this.observeBackgroundPullResponse(ns, afterSeq, result, 50);
         await this.commitPlainForwardPage(ns, afterSeq, "group.pull", result, groupId);
         this.prunePushedSeqs(ns);
       }, true);
     } catch (exc) {
+      failed = true;
       client._clientLog.warn(`auto pull group message commit/ack failed:${String(exc)}`);
       if (!rawCompleted) {
         await client._publishAppEvent("group.message_created", notification, "push");
       }
+    } finally {
+      if (this.isInlineGenerationCurrent(generation)) {
+        client._gapFillDone.delete(dedupKey);
+        this.finishBackgroundPull(ns, afterSeq, failed);
+      }
     }
   }
   scheduleP2pGapRetry(ns, retryAttempt) {
@@ -22025,6 +22718,7 @@ var MessageDeliveryEngine = class {
   }
   async fillP2pGap(retryAttempt = 0) {
     const client = this.runtime.client;
+    const generation = this.captureInlineGeneration();
     if (client._sessionOptions?.background_sync === false) return;
     if (client.state !== "ready" /* READY */ || client._closing) return;
     if (!client._aid) return;
@@ -22032,9 +22726,11 @@ var MessageDeliveryEngine = class {
     const afterSeq = client._seqTracker.getContiguousSeq(ns);
     const dedupKey = `p2p_pull:${ns}`;
     if (client._gapFillDone.has(dedupKey)) return;
+    this.recordBackgroundPullDemand(ns, 0, true);
     client._gapFillDone.add(dedupKey);
     this.runtime.delivery.setGapFillActive(true);
     let filled = 0;
+    let failed = false;
     try {
       const key = client._rpcPipeline.pullGateKeyForCall("message.pull", { after_seq: afterSeq, limit: 50 });
       const messages = await client._rpcPipeline.runPullSerialized(
@@ -22052,20 +22748,25 @@ var MessageDeliveryEngine = class {
           this.prunePushedSeqs(ns);
           client._clientLog.warn(`P2P message gap-fill V2 unavailable, used plain pull fallback:${String(formatDeliveryError(exc))}`);
         } catch (fallbackExc) {
+          failed = true;
           client._clientLog.warn(`P2P message gap-fill plain fallback failed:${String(formatDeliveryError(fallbackExc))}`);
-          this.scheduleP2pGapRetry(ns, retryAttempt + 1);
         }
       } else {
+        failed = true;
         client._clientLog.warn(`P2P message gap-fill failed:${String(formatDeliveryError(exc))}`);
       }
     } finally {
-      client._gapFillDone.delete(dedupKey);
-      this.runtime.delivery.setGapFillActive(false);
-      this.schedulePendingPullIfNeeded(ns, "gap-fill-complete");
+      if (this.isInlineGenerationCurrent(generation)) {
+        client._gapFillDone.delete(dedupKey);
+        this.runtime.delivery.setGapFillActive(false);
+        this.schedulePendingPullIfNeeded(ns, "gap-fill-complete");
+        this.finishBackgroundPull(ns, afterSeq, failed);
+      }
     }
   }
   async fillP2pGapWithPlainPull(ns, afterSeq) {
     const client = this.runtime.client;
+    const generation = this.captureInlineGeneration();
     const params2 = {
       after_seq: afterSeq,
       limit: 50,
@@ -22074,11 +22775,14 @@ var MessageDeliveryEngine = class {
       _rpc_background: true
     };
     const raw = await client._rpcPipeline.rawCall("message.pull", params2, { background: true });
+    if (!this.isInlineGenerationCurrent(generation)) throw new Error("pull invalidated");
+    if (isJsonObject(raw)) this.observeBackgroundPullResponse(ns, afterSeq, raw, 50);
     const page = await this.commitPlainForwardPage(ns, afterSeq, "message.pull", raw);
     return page.publishedCount;
   }
   async fillGroupGap(groupId) {
     const client = this.runtime.client;
+    const generation = this.captureInlineGeneration();
     if (client._sessionOptions?.background_sync === false) return;
     if (client.state !== "ready" /* READY */ || client._closing) return;
     groupId = String(groupId ?? "").trim();
@@ -22087,27 +22791,47 @@ var MessageDeliveryEngine = class {
     const afterSeq = client._seqTracker.getContiguousSeq(ns);
     const dedupKey = `group_pull:${ns}`;
     if (client._gapFillDone.has(dedupKey)) return;
+    this.recordBackgroundPullDemand(ns, 0, true);
     client._gapFillDone.add(dedupKey);
     this.runtime.delivery.setGapFillActive(true);
     let filled = 0;
+    let failed = false;
     try {
       const key = client._rpcPipeline.pullGateKeyForCall("group.pull", { group_id: groupId, after_seq: afterSeq, limit: 50 });
       const messages = await client._rpcPipeline.runPullSerialized(
         key,
-        () => client._pullGroupV2(groupId, afterSeq, 50, { gateLocked: true }),
+        async () => {
+          if (client._v2Session) return await client._pullGroupV2(groupId, afterSeq, 50, { gateLocked: true });
+          const result = await client._rpcPipeline.rawCall("group.pull", {
+            group_id: groupId,
+            after_message_seq: afterSeq,
+            device_id: client._deviceId,
+            slot_id: client._slotId,
+            limit: 50,
+            _rpc_background: true
+          }, { background: true });
+          if (!this.isInlineGenerationCurrent(generation)) throw new Error("pull invalidated");
+          if (isJsonObject(result)) this.observeBackgroundPullResponse(ns, afterSeq, result, 50);
+          await this.commitPlainForwardPage(ns, afterSeq, "group.pull", result, groupId);
+          return isJsonObject(result) && Array.isArray(result.messages) ? result.messages : [];
+        },
         true
       );
       filled = messages.length;
       this.prunePushedSeqs(ns);
     } catch (exc) {
+      failed = true;
       client._clientLog.warn(`group message gap-fill failed:${String(exc)}`);
     } finally {
-      client._gapFillDone.delete(dedupKey);
-      this.runtime.delivery.setGapFillActive(false);
-      if (filled > 0 && client._seqTracker.getContiguousSeq(ns) > afterSeq) {
-        client._safeAsync(this.fillGroupGap(groupId));
+      if (this.isInlineGenerationCurrent(generation)) {
+        client._gapFillDone.delete(dedupKey);
+        this.runtime.delivery.setGapFillActive(false);
+        if (filled > 0 && client._seqTracker.getContiguousSeq(ns) > afterSeq) {
+          this.recordBackgroundPullDemand(ns, 0, true);
+        }
+        this.schedulePendingPullIfNeeded(ns, "gap-fill-complete");
+        this.finishBackgroundPull(ns, afterSeq, failed);
       }
-      this.schedulePendingPullIfNeeded(ns, "gap-fill-complete");
     }
   }
   async fillGroupEventGap(groupId, options) {
@@ -22123,6 +22847,7 @@ var MessageDeliveryEngine = class {
     const singlePage = options?.singlePage === true;
     const dedupKey = `group_event_pull:${ns}`;
     if (client._gapFillDone.has(dedupKey)) return;
+    this.recordBackgroundPullDemand(ns, 0, true);
     client._gapFillDone.add(dedupKey);
     this.runtime.delivery.setGapFillActive(true);
     let continuationAfterSeq = 0;
@@ -22142,6 +22867,8 @@ var MessageDeliveryEngine = class {
           _rpc_background: true
         };
         const result = await client.call("group.pull_events", request);
+        if (!this.isInlineGenerationCurrent(generation)) throw new Error("pull invalidated");
+        if (isJsonObject(result)) this.observeBackgroundPullResponse(ns, nextAfterSeq, result, 50);
         if (!isJsonObject(result)) return;
         const events = result.events;
         if (!Array.isArray(events)) return;
@@ -22191,7 +22918,10 @@ var MessageDeliveryEngine = class {
         const deliveryThrough = Math.max(pageContigBefore, contiguousSeq ?? 0, effectiveFloor, ...eventSeqs);
         await this.drainOrderedMessages(ns, void 0, false, false, void 0, "pull", deliveryThrough);
         if (!this.isInlineGenerationCurrent(generation)) throw new Error("pull invalidated");
-        if (hasDissolvedEvent) break;
+        if (hasDissolvedEvent) {
+          this.backgroundPullDemands.delete(ns);
+          break;
+        }
         if (contiguousSeq === void 0) client._seqTracker.onPullResult(ns, eventObjects, nextAfterSeq);
         else client._seqTracker.onPullResult(ns, eventObjects, nextAfterSeq, contiguousSeq);
         if (effectiveFloor > client._seqTracker.getContiguousSeq(ns)) {
@@ -22242,14 +22972,11 @@ var MessageDeliveryEngine = class {
       failed = true;
       client._clientLog.warn(`group event gap-fill failed:${String(exc)}`);
     } finally {
-      client._gapFillDone.delete(dedupKey);
-      this.runtime.delivery.setGapFillActive(false);
-      if (!client._rpcPipeline) this.syncStopped(failed ? "aborted" : "pull_drained");
-      if (singlePage && continuationAfterSeq > afterSeq) {
-        this.enqueueOnlineUnreadEventHint({
-          group_id: groupId,
-          _online_hint_after_event_seq: continuationAfterSeq
-        });
+      if (this.isInlineGenerationCurrent(generation)) {
+        client._gapFillDone.delete(dedupKey);
+        this.runtime.delivery.setGapFillActive(false);
+        if (!client._rpcPipeline) this.syncStopped(failed ? "aborted" : "pull_drained");
+        this.finishBackgroundPull(ns, afterSeq, failed);
       }
     }
   }
@@ -22301,6 +23028,9 @@ var MessageDeliveryEngine = class {
     const groupId = String(data.group_id ?? "").trim();
     if (!groupId) return;
     const ns = `group:${groupId}`;
+    const generation = this.captureInlineGeneration();
+    const afterSeq = this.syncState(ns).ack;
+    this.recordBackgroundPullDemand(ns, positiveSafeSequenceHint(data.seq), true);
     const targets = this.onlineUnreadHintTargets ?? /* @__PURE__ */ new Map();
     const owners = this.onlineUnreadHintOwners ?? /* @__PURE__ */ new Set();
     this.onlineUnreadHintTargets = targets;
@@ -22309,20 +23039,26 @@ var MessageDeliveryEngine = class {
     if (owners.has(ns)) return;
     owners.add(ns);
     client._safeAsync((async () => {
+      let failed = false;
+      let attemptAfterSeq = afterSeq;
       try {
         while (true) {
           const throughSeq = targets.get(ns) ?? 0;
           const ackBefore = this.syncState(ns).ack;
+          attemptAfterSeq = ackBefore;
           await this.runGroupForwardRecovery(groupId, ns, 50, true, throughSeq);
+          if (!this.isInlineGenerationCurrent(generation)) return;
           const ackAfter = this.syncState(ns).ack;
           const target = targets.get(ns) ?? 0;
           if (ackAfter >= target || ackAfter <= ackBefore) return;
         }
       } catch (exc) {
+        failed = true;
         client._clientLog?.debug(`online unread hint background Forward failed: ns=${ns} err=${formatDeliveryError(exc)}`);
       } finally {
         if (this.onlineUnreadHintTargets === targets) targets.delete(ns);
         if (this.onlineUnreadHintOwners === owners) owners.delete(ns);
+        if (this.isInlineGenerationCurrent(generation)) this.finishBackgroundPull(ns, attemptAfterSeq, failed);
       }
     })());
   }
@@ -22330,6 +23066,7 @@ var MessageDeliveryEngine = class {
     const client = this.runtime.client;
     const groupId = String(data.group_id ?? "").trim();
     if (!groupId || client._sessionOptions?.background_sync === false) return;
+    this.recordBackgroundPullDemand(`group_event:${groupId}`, positiveSafeSequenceHint(data.event_seq), true);
     const rawAfter = Number(data._online_hint_after_event_seq ?? 0);
     const afterSeq = Number.isSafeInteger(rawAfter) && rawAfter > 0 ? rawAfter : 0;
     client._safeAsync(this.fillGroupEventGap(groupId, {
@@ -22917,19 +23654,26 @@ var MessageDeliveryEngine = class {
       }
       return;
     }
+    if (client._sessionOptions?.background_sync !== false) this.recordBackgroundPullDemand(ns, seq2);
     const pullActive = client._rpcPipeline?.hasPullActivity?.(ns) === true;
     if (pullActive || !this.beginRealtimeSync(ns)) {
       this.recordPendingPull(ns, seq2);
       client._clientLog?.debug(`V2 group push queued behind in-flight realtime sync: ns=${ns} seq=${seq2}`);
       return;
     }
+    const generation = this.captureInlineGeneration();
+    let failed = false;
     try {
       await this.runGroupRealtimeSync(groupId, ns, seq2, 50, false);
     } catch (exc) {
+      failed = true;
       client._clientLog.warn(`V2 group push auto-sync failed: group=${groupId} err=${formatDeliveryError(exc)}`);
     } finally {
-      this.endRealtimeSync(ns);
-      this.schedulePendingPullIfNeeded(ns, "push-auto-pull-complete");
+      if (this.isInlineGenerationCurrent(generation)) {
+        this.endRealtimeSync(ns);
+        this.schedulePendingPullIfNeeded(ns, "push-auto-pull-complete");
+        this.finishBackgroundPull(ns, before.ack, failed);
+      }
     }
   }
   async onV2PushNotification(data) {
@@ -22995,28 +23739,51 @@ var MessageDeliveryEngine = class {
       }
       return;
     }
+    if (client._sessionOptions?.background_sync !== false) this.recordBackgroundPullDemand(ns, pushSeq);
     const pullActive = client._rpcPipeline?.hasPullActivity?.(ns) === true;
     if (pullActive || !this.beginRealtimeSync(ns)) {
       this.recordPendingPull(ns, pushSeq);
       client._clientLog?.debug(`V2 P2P push queued behind in-flight realtime sync: ns=${ns} seq=${pushSeq}`);
       return;
     }
+    const generation = this.captureInlineGeneration();
+    let failed = false;
     try {
       await this.runP2PRealtimeSync(ns, pushSeq, 50, false);
     } catch (exc) {
+      failed = true;
       client._clientLog.warn(`V2 P2P push auto-sync failed: ${formatDeliveryError(exc)}`);
     } finally {
-      this.endRealtimeSync(ns);
-      this.schedulePendingPullIfNeeded(ns, "push-auto-pull-complete");
+      if (this.isInlineGenerationCurrent(generation)) {
+        this.endRealtimeSync(ns);
+        this.schedulePendingPullIfNeeded(ns, "push-auto-pull-complete");
+        this.finishBackgroundPull(ns, before.ack, failed);
+      }
     }
   }
   enqueueOnlineUnreadP2pHint(data) {
     const client = this.runtime.client;
-    if (!client._aid || !client._v2Session) return;
+    if (!client._aid || !client._v2Session || client._sessionOptions?.background_sync === false) return;
     const ns = `p2p:${client._aid}`;
-    client._safeAsync(this.runP2PForwardRecovery(ns, 50, true).catch((exc) => {
-      client._clientLog?.debug(`P2P online unread hint background Forward failed: ns=${ns} err=${formatDeliveryError(exc)}`);
-    }));
+    const generation = this.captureInlineGeneration();
+    const afterSeq = this.syncState(ns).ack;
+    this.recordBackgroundPullDemand(ns, positiveSafeSequenceHint(data.seq), true);
+    const owners = this.onlineUnreadHintOwners ?? /* @__PURE__ */ new Set();
+    this.onlineUnreadHintOwners = owners;
+    if (owners.has(ns)) return;
+    owners.add(ns);
+    client._safeAsync((async () => {
+      let failed = false;
+      try {
+        await this.runP2PForwardRecovery(ns, 50, true);
+      } catch (exc) {
+        failed = true;
+        client._clientLog?.debug(`P2P online unread hint background Forward failed: ns=${ns} err=${formatDeliveryError(exc)}`);
+      } finally {
+        if (this.onlineUnreadHintOwners === owners) owners.delete(ns);
+        if (this.isInlineGenerationCurrent(generation)) this.finishBackgroundPull(ns, afterSeq, failed);
+      }
+    })());
   }
   async restoreSeqTrackerState() {
     const client = this.runtime.client;
@@ -24382,6 +25149,7 @@ async function signingCertFingerprint(certPem) {
 }
 var PULL_GATE_STALE_MS = 35e3;
 var PULL_GATE_OPERATION_TIMEOUT_MS = 35e3;
+var PULL_GATE_MAX_ACTIVE = 4;
 function sameIdentityAdmissionRejection(error, original) {
   const errorCode2 = Number(error?.code);
   const originalCode = Number(original?.code);
@@ -24880,6 +25648,11 @@ var RpcPipeline = class {
         new TextEncoder().encode(paramsJson)
       );
       const paramsHash = Array.from(new Uint8Array(paramsHashBuf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+      if (params2.client_signature !== void 0) {
+        const existing = params2.client_signature;
+        if (!isJsonObject(existing) || existing.aid !== aid2 || existing.cert_fingerprint !== await signingCertFingerprint(certPem) || existing.params_hash !== paramsHash || typeof existing.timestamp !== "string" || !/^\d+$/.test(existing.timestamp) || typeof existing.signature !== "string" || !await verifySignatureWithCert(certPem, existing.signature, new TextEncoder().encode(`${method}|${aid2}|${existing.timestamp}|${paramsHash}`))) throw new Error("\u5DF2\u6709\u5BA2\u6237\u7AEF\u7B7E\u540D\u4E0E\u8BF7\u6C42\u5185\u5BB9\u4E0D\u4E00\u81F4");
+        return;
+      }
       const signData = new TextEncoder().encode(`${method}|${aid2}|${ts}|${paramsHash}`);
       const cryptoKey = await signingPrivateKey(currentAid.privateKeyPem);
       const sigP1363 = await crypto.subtle.sign(
@@ -24943,7 +25716,7 @@ var RpcPipeline = class {
     const name = this.pullGateName(key);
     let state = this.pullGateStates.get(name);
     if (!state) {
-      state = { active: null, foreground: [], background: [], byKey: /* @__PURE__ */ new Map(), lifecycle: /* @__PURE__ */ new Map(), watchdog: null };
+      state = { activeByNamespace: /* @__PURE__ */ new Map(), foreground: [], background: [], byKey: /* @__PURE__ */ new Map(), lifecycle: /* @__PURE__ */ new Map(), watchdog: null };
       this.pullGateStates.set(name, state);
     }
     this.startPullGateWatchdog(state, name);
@@ -24971,19 +25744,21 @@ var RpcPipeline = class {
     }
   }
   checkPullGate(state, name) {
-    const active = state.active;
-    if (!active) {
+    const activeJobs = [...state.activeByNamespace.values()];
+    if (activeJobs.length === 0) {
       this.drainPullGate(state);
       return;
     }
-    if (!active.pullingStartedAt || Date.now() - active.pullingStartedAt < this.pullGateOperationTimeoutMs()) return;
-    if (active.timedOut) return;
-    active.timedOut = true;
-    active.invalidated = true;
-    active.cancel?.();
-    const err = new TimeoutError(`pull gate timeout: ${active.namespace}`, { retryable: true });
-    this.runtime.client._clientLog?.warn(`pull gate watchdog timeout: gate=${name} key=${active.key}`);
-    active.reject(err);
+    for (const active of activeJobs) {
+      if (!active.pullingStartedAt || Date.now() - active.pullingStartedAt < this.pullGateOperationTimeoutMs()) continue;
+      if (active.timedOut) continue;
+      active.timedOut = true;
+      active.invalidated = true;
+      active.cancel?.();
+      const err = new TimeoutError(`pull gate timeout: ${active.namespace}`, { retryable: true });
+      this.runtime.client._clientLog?.warn(`pull gate watchdog timeout: gate=${name} key=${active.key}`);
+      active.reject(err);
+    }
   }
   realtimePullNamespace(key) {
     for (const marker of ["|tail|", "|forward|"]) {
@@ -25001,7 +25776,7 @@ var RpcPipeline = class {
     const key = gateKey || this.pullGateKeyForCall(method, params2);
     if (typeof cancel !== "function" || !key) return request;
     const state = this.pullGateStates.get(this.pullGateName(key));
-    const active = state?.active;
+    const active = [...state?.activeByNamespace.values() ?? []].find((candidate) => candidate.key === key);
     if (!active || active.key !== key || active.timedOut || active.invalidated) return request;
     const boundCancel = () => cancel.call(request);
     active.cancel = boundCancel;
@@ -25027,7 +25802,7 @@ var RpcPipeline = class {
       if (!job) return false;
       return this.realtimePullNamespace(job.key) === normalized;
     };
-    return matches(state.active) || state.foreground.some(matches) || state.background.some(matches);
+    return [...state.activeByNamespace.values()].some(matches) || state.foreground.some(matches) || state.background.some(matches);
   }
   hasPullActivity(namespace, includePending = true) {
     const ns = String(namespace ?? "").trim();
@@ -25048,12 +25823,12 @@ var RpcPipeline = class {
     const state = this.pullGateStates.get(this.pullGateName(ns));
     if (!state) return false;
     const matches = (job) => job !== null && job.namespace === ns;
-    return matches(state.active) || state.foreground.some(matches) || state.background.some(matches);
+    return [...state.activeByNamespace.values()].some(matches) || state.foreground.some(matches) || state.background.some(matches);
   }
   hasAnyPullActivity() {
     if (this.pullWorkTokens.size > 0) return true;
     for (const state of this.pullGateStates.values()) {
-      if (state.active || state.foreground.length > 0 || state.background.length > 0) return true;
+      if (state.activeByNamespace.size > 0 || state.foreground.length > 0 || state.background.length > 0) return true;
     }
     return false;
   }
@@ -25089,7 +25864,7 @@ var RpcPipeline = class {
     }
     const key = `${normalized}|inline|seq=${seq2}`;
     const state = this.pullGateState(key);
-    if (state.active !== null || state.foreground.length > 0 || state.background.length > 0) {
+    if (state.activeByNamespace.has(normalized) || state.foreground.some((job) => job.namespace === normalized) || state.background.some((job) => job.namespace === normalized)) {
       return { acquired: false };
     }
     const guard = {
@@ -25121,7 +25896,7 @@ var RpcPipeline = class {
       return { acquired: true, value: await operation() };
     } finally {
       this.inlineRealtimeScopes.delete(normalized);
-      if (state.active === guard) state.active = null;
+      if (state.activeByNamespace.get(normalized) === guard) state.activeByNamespace.delete(normalized);
       this.drainPullGate(state);
       this.runtime.client._delivery?.onPullGateIdle?.(normalized);
       this.armQueuedPullTimers(state);
@@ -25131,7 +25906,7 @@ var RpcPipeline = class {
     if (!key) return 0;
     if (this.inlineRealtimeScopes.has(this.pullScopeKey(key))) return null;
     const serialized = this.pullGateStates.get(this.pullGateName(key));
-    if (serialized?.active?.inline === true) return null;
+    if ([...serialized?.activeByNamespace.values() ?? []].some((job) => job.inline === true)) return null;
     const client = this.runtime.client;
     const now = Date.now();
     const gate = client._pullGates.get(key) ?? { inflight: false, startedAt: 0, token: 0 };
@@ -25157,7 +25932,7 @@ var RpcPipeline = class {
   isPullNamespaceCurrent(namespace) {
     const ns = this.pullScopeKey(namespace);
     if (!ns) return true;
-    const active = this.pullGateStates.get(this.pullGateName(ns))?.active;
+    const active = this.pullGateStates.get(this.pullGateName(ns))?.activeByNamespace.get(ns);
     return !active || active.namespace !== ns || !active.timedOut && !active.invalidated;
   }
   invalidatePulls() {
@@ -25166,7 +25941,7 @@ var RpcPipeline = class {
     const waits = [];
     for (const state of this.pullGateStates.values()) {
       const jobs = /* @__PURE__ */ new Set();
-      if (state.active) jobs.add(state.active);
+      for (const active of state.activeByNamespace.values()) jobs.add(active);
       for (const job of state.foreground) jobs.add(job);
       for (const job of state.background) jobs.add(job);
       for (const job of jobs) {
@@ -25223,7 +25998,7 @@ var RpcPipeline = class {
     const candidate = state.byKey.get(key);
     const existing = candidate && !candidate.timedOut && !candidate.invalidated ? candidate : null;
     if (existing) {
-      if (!background && existing.background && existing !== state.active) {
+      if (!background && existing.background && ![...state.activeByNamespace.values()].includes(existing)) {
         const index = state.background.indexOf(existing);
         if (index >= 0) state.background.splice(index, 1);
         existing.background = false;
@@ -25284,8 +26059,8 @@ var RpcPipeline = class {
     if (!key) return;
     const state = this.pullGateState(key);
     const namespace = this.pullScopeKey(key);
-    const job = state.active?.key === key ? state.active : null;
-    if (!job || state.active !== job) return;
+    const job = [...state.activeByNamespace.values()].find((candidate) => candidate.key === key) ?? null;
+    if (!job) return;
     const replacementKey = String(nextKey || key);
     if (state.byKey.get(job.key) === job) state.byKey.delete(job.key);
     job.key = replacementKey;
@@ -25297,7 +26072,7 @@ var RpcPipeline = class {
     job.resume = new Promise((resolve) => {
       job.resumeResolve = resolve;
     });
-    state.active = null;
+    state.activeByNamespace.delete(namespace);
     (job.background ? state.background : state.foreground).push(job);
     this.drainPullGate(state);
     if (job.resume) {
@@ -25314,56 +26089,57 @@ var RpcPipeline = class {
     const ns = this.pullScopeKey(namespace);
     if (!ns) return;
     const state = this.pullGateStates.get(this.pullGateName(ns));
-    if (!state || state.active?.namespace !== ns) return;
+    if (!state || !state.activeByNamespace.has(ns)) return;
     state.lifecycle.set(ns, lifecycle);
   }
   drainPullGate(state) {
-    if (state.active) return;
     const takeRunnable = (queue) => {
-      const index = queue.findIndex((candidate) => !this.inlineRealtimeScopes.has(candidate.namespace));
+      const index = queue.findIndex((candidate) => !this.inlineRealtimeScopes.has(candidate.namespace) && !state.activeByNamespace.has(candidate.namespace));
       return index >= 0 ? queue.splice(index, 1)[0] : void 0;
     };
-    const foregroundJob = takeRunnable(state.foreground);
-    const foregroundDrained = foregroundJob !== void 0 && state.foreground.length === 0;
-    const job = foregroundJob ?? takeRunnable(state.background);
-    if (!job) return;
-    state.active = job;
-    this.runtime.client._delivery?.onPullStarted?.(job.namespace);
-    if (foregroundDrained) this.runtime.client._delivery?.onForegroundPullsDrained?.();
-    if (job.timer) clearTimeout(job.timer);
-    job.pullingStartedAt = Date.now();
-    job.timedOut = false;
-    state.lifecycle.set(job.namespace, "pulling");
-    const resumeResolve = job.resumeResolve;
-    job.resume = null;
-    job.resumeResolve = null;
-    if (job.suspended) {
-      job.suspended = false;
-      resumeResolve?.();
-      return;
-    }
-    job.running = true;
-    let failed = false;
-    void this.executePullOperation(job.operation, job.background).then(
-      (value) => {
-        if (!job.timedOut && !job.invalidated) job.resolve(value);
-      },
-      (error) => {
-        failed = true;
-        if (!job.timedOut && !job.invalidated) job.reject(error);
+    while (state.activeByNamespace.size < PULL_GATE_MAX_ACTIVE) {
+      const foregroundJob = takeRunnable(state.foreground);
+      const foregroundDrained = foregroundJob !== void 0 && state.foreground.length === 0;
+      const job = foregroundJob ?? takeRunnable(state.background);
+      if (!job) break;
+      state.activeByNamespace.set(job.namespace, job);
+      this.runtime.client._delivery?.onPullStarted?.(job.namespace);
+      if (foregroundDrained) this.runtime.client._delivery?.onForegroundPullsDrained?.();
+      if (job.timer) clearTimeout(job.timer);
+      job.pullingStartedAt = Date.now();
+      job.timedOut = false;
+      state.lifecycle.set(job.namespace, "pulling");
+      const resumeResolve = job.resumeResolve;
+      job.resume = null;
+      job.resumeResolve = null;
+      if (job.suspended) {
+        job.suspended = false;
+        resumeResolve?.();
+        continue;
       }
-    ).finally(() => {
-      this.pullWorkTokens.delete(job.workToken);
-      state.lifecycle.set(job.namespace, "idle");
-      if (state.active === job) state.active = null;
-      if (state.byKey.get(job.key) === job) state.byKey.delete(job.key);
-      this.drainPullGate(state);
-      job.settledResolve?.();
-      job.settledResolve = null;
-      if (!job.invalidated) this.runtime.client._delivery?.onPullGateIdle?.(job.namespace);
-      if (failed || job.invalidated) this.runtime.client._delivery?.onPullAborted?.();
-      this.runtime.client._delivery?.onPullWorkSettled?.();
-    });
+      job.running = true;
+      let failed = false;
+      void this.executePullOperation(job.operation, job.background).then(
+        (value) => {
+          if (!job.timedOut && !job.invalidated) job.resolve(value);
+        },
+        (error) => {
+          failed = true;
+          if (!job.timedOut && !job.invalidated) job.reject(error);
+        }
+      ).finally(() => {
+        this.pullWorkTokens.delete(job.workToken);
+        state.lifecycle.set(job.namespace, "idle");
+        if (state.activeByNamespace.get(job.namespace) === job) state.activeByNamespace.delete(job.namespace);
+        if (state.byKey.get(job.key) === job) state.byKey.delete(job.key);
+        this.drainPullGate(state);
+        job.settledResolve?.();
+        job.settledResolve = null;
+        if (!job.invalidated) this.runtime.client._delivery?.onPullGateIdle?.(job.namespace);
+        if (failed || job.invalidated) this.runtime.client._delivery?.onPullAborted?.();
+        this.runtime.client._delivery?.onPullWorkSettled?.();
+      });
+    }
   }
   armQueuedPullTimers(_state) {
   }
@@ -27499,8 +28275,8 @@ function stripNil2(params2, keepNull = false) {
   }
   return out;
 }
-function splitAidStore(params2) {
-  const out = stripNil2(params2);
+function splitAidStore(params2, keepNull = false) {
+  const out = stripNil2(params2, keepNull);
   const aidStore = out.aidStore ?? out.aid_store;
   delete out.aidStore;
   delete out.aid_store;
@@ -28230,7 +29006,7 @@ var CredentialFacade = class extends RpcFacade {
 };
 var OrgLifecycleFacade = class extends RpcFacade {
   create(params2) {
-    const split = splitAidStore(params2);
+    const split = splitAidStore(params2, true);
     return split.aidStore && this.client.createOrg ? this.client.createOrg(split.params, { aidStore: split.aidStore }) : this.call("org.lifecycle.create", split.params);
   }
   get(params2) {
@@ -28249,14 +29025,14 @@ var OrgLifecycleFacade = class extends RpcFacade {
     return this.call("org.lifecycle.resume", params2);
   }
   dissolve(params2) {
-    const split = splitAidStore(params2);
+    const split = splitAidStore(params2, true);
     return split.aidStore && this.client.dissolveOrg ? this.client.dissolveOrg(split.params, { aidStore: split.aidStore }) : this.call("org.lifecycle.dissolve", split.params);
   }
   transfer(params2) {
     return this.call("org.lifecycle.transfer", params2);
   }
   transferAccept(params2) {
-    const split = splitAidStore(params2);
+    const split = splitAidStore(params2, true);
     return split.aidStore && this.client.completeOrgTransfer ? this.client.completeOrgTransfer(split.params, { aidStore: split.aidStore }) : this.call("org.lifecycle.transferAccept", split.params);
   }
   signTransferAcceptance(proposal, signer) {
@@ -32371,10 +33147,8 @@ function deduplicateForwardPageMessages(value, afterSeq) {
   }
   return [...bySeq.entries()].sort(([a], [b]) => a - b).map(([, row]) => row);
 }
-function contiguousPullSeq(afterSeq, seqs, proof) {
-  let contiguous = seqs.length > 0 ? Math.max(afterSeq, ...seqs) : afterSeq;
-  const serverProof = safeNonNegativeSeq(proof);
-  return serverProof !== null ? Math.max(contiguous, serverProof) : contiguous;
+function contiguousPullSeq(afterSeq, seqs, _proof) {
+  return seqs.length > 0 ? Math.max(afterSeq, ...seqs) : afterSeq;
 }
 function deduplicatePulledResults(messages) {
   const seen = /* @__PURE__ */ new Set();
@@ -32399,7 +33173,7 @@ function shouldContinueForwardPage({
   observedUpper
 }) {
   if (rawCount <= 0 || nextAfter <= nextAfterSeq) return false;
-  if (hasMore || serverHead > nextAfter || pendingAckSeq > 0 || observedUpper > nextAfter) return true;
+  if (hasMore || serverHead > nextAfter || observedUpper > nextAfter) return true;
   return !hasMoreField && limit > 0 && rawCount >= limit;
 }
 function validateTailPage(result, afterSeq, pageLimit) {
@@ -33565,13 +34339,13 @@ var V2E2EECoordinator = class {
     let pageCount = 0;
     let lastAutoAckSeq = 0;
     let pendingAckSeq = deferredForwardAck;
+    let committedAckSeq = ns ? client._seqTracker.getContiguousSeq(ns) : 0;
     const maxPages = Math.max(1, Math.min(100, Math.trunc(Number(opts?.maxPages ?? 100) || 100)));
     let pipelineRunning = false;
     let pipelineError = null;
-    const pipelineQueue = new V2PullPageQueue(V2_PULL_PIPELINE_QUEUE_CAPACITY);
+    let pipelineQueue = new V2PullPageQueue(V2_PULL_PIPELINE_QUEUE_CAPACITY);
     let pipelineProducer = null;
     let pipelineStopped = false;
-    let pipelineResume = null;
     const startPipeline = (startAfterSeq, startVolatileCursor) => {
       if (pipelineRunning || pageCount >= maxPages || limit < V2_PULL_MAX_PAGE_LIMIT) return;
       pipelineRunning = true;
@@ -33580,29 +34354,29 @@ var V2E2EECoordinator = class {
         let producerVolatileCursor = startVolatileCursor;
         for (let produced = pageCount; produced < maxPages; produced += 1) {
           if (pipelineStopped) break;
+          this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
           const requestedVolatileCursor = producerVolatileCursor;
+          const ackUpToSeq = Math.min(pendingAckSeq, committedAckSeq);
+          const inlineAckGeneration = ackUpToSeq > 0 ? client._delivery?.pendingP2PInlineAckGeneration?.(ns) ?? null : null;
           const result = await client._callRawV2Rpc("message.v2.pull", {
             after_seq: producerAfterSeq,
             limit,
             ...producerVolatileCursor ? { after_volatile_cursor: producerVolatileCursor } : {},
-            ...opts?.force ? { force: true } : {}
+            ...opts?.force ? { force: true } : {},
+            ...ackUpToSeq > 0 ? { ack_up_to_seq: ackUpToSeq } : {}
           }, pullGateKey);
           if (pipelineStopped) break;
+          this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
           const rawPageMessages = Array.isArray(result?.messages) ? result.messages : [];
-          const completed = new Promise((resolve) => {
-            pipelineResume = resolve;
-          });
           const enqueued = await pipelineQueue.put({
             result,
             afterSeq: producerAfterSeq,
-            ackUpToSeq: 0,
-            inlineAckGeneration: null,
+            ackUpToSeq,
+            inlineAckGeneration,
             requestedVolatileCursor,
             weight: rawPageMessages.length
           }, rawPageMessages.length);
           if (!enqueued || pipelineStopped) break;
-          await completed;
-          if (pipelineStopped) break;
           const volatileMessages = client._delivery.volatileMessages(rawPageMessages);
           if (volatileMessages.length > 0) break;
           const messages = deduplicateForwardPageMessages(rawPageMessages, producerAfterSeq);
@@ -33632,8 +34406,6 @@ var V2E2EECoordinator = class {
     };
     const stopPipeline = async () => {
       pipelineStopped = true;
-      pipelineResume?.();
-      pipelineResume = null;
       pipelineQueue.close();
       if (pipelineProducer) {
         const producer = pipelineProducer;
@@ -33679,20 +34451,21 @@ var V2E2EECoordinator = class {
             continue;
           }
         }
+        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+        if (!opts?.force) client._delivery.observeBackgroundPullResponse?.(ns, nextAfterSeq, result, limit);
         if (ackUpToSeq > 0) {
           const actualAckSeq = client._delivery?.resolveP2PPullAckSeq?.(result, ackUpToSeq) ?? 0;
           if (actualAckSeq >= ackUpToSeq) {
             if (pendingInlineGeneration !== null) {
               client._delivery?.completePendingP2PInlineAckUpTo?.(ns, actualAckSeq, pendingInlineGeneration);
             }
-            pendingAckSeq = 0;
+            if (pendingAckSeq <= ackUpToSeq) pendingAckSeq = 0;
             lastAutoAckSeq = Math.max(lastAutoAckSeq, ackUpToSeq);
             this.clearForwardAck(ns, ackUpToSeq);
           } else {
             client._clientLog.warn(`message.v2.pull piggyback ACK below target: requested=${ackUpToSeq}, actual=${actualAckSeq}; fallback terminal ACK`);
-            await this.confirmForwardP2PAck(ackUpToSeq, pendingInlineGeneration ?? void 0);
-            pendingAckSeq = 0;
-            lastAutoAckSeq = Math.max(lastAutoAckSeq, ackUpToSeq);
+            pendingAckSeq = Math.max(pendingAckSeq, ackUpToSeq);
+            this.recordForwardAck(ns, ackUpToSeq);
           }
         }
         const pageMessages = Array.isArray(result?.messages) ? result.messages : [];
@@ -33717,6 +34490,17 @@ var V2E2EECoordinator = class {
           seqs,
           result.contiguous_seq
         );
+        if (!pipelineRunning && volatileMessages.length === 0 && shouldContinueForwardPage({
+          rawCount: messages.length,
+          nextAfterSeq,
+          nextAfter: pageMaxSeq,
+          limit,
+          hasMoreField,
+          hasMore,
+          serverHead,
+          pendingAckSeq: 0,
+          observedUpper: typeof client._seqTracker.getMaxSeenSeq === "function" ? client._seqTracker.getMaxSeenSeq(ns) : pageMaxSeq
+        })) startPipeline(pageMaxSeq, volatileCursor);
         const deferredKeyFetches = /* @__PURE__ */ new Map();
         let blockedSeq = 0;
         const pageDecryptedBefore = decrypted.length;
@@ -33855,6 +34639,7 @@ var V2E2EECoordinator = class {
               if (pageCount === 1 && deferredServerCursor > 0) this.clearForwardCursor(ns, ackSeq);
             }
             client._delivery.completePendingTailWindow?.(ns);
+            committedAckSeq = ackSeq;
           } catch (exc) {
             if (Number(client._v2RuntimeGeneration ?? 0) === generation && (inlineGeneration === void 0 || client._delivery.isInlineGenerationCurrent(inlineGeneration)) && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false && pageTrackerSnapshot !== void 0 && typeof client._seqTracker.restoreNamespaceSnapshot === "function") {
               client._seqTracker._restoreNamespaceSnapshotPreservingPush(ns, pageTrackerSnapshot);
@@ -33872,15 +34657,7 @@ var V2E2EECoordinator = class {
           const ackNeeded = ackSeq > 0 && ackSeq > lastAutoAckSeq && (hasServerAckSeq && ackSeq > serverAckSeq || contigAdvanced && ackSeq > knownServerAckSeq);
           if (ackNeeded) {
             this.recordForwardAck(ns, ackSeq);
-            const nextAfter2 = Math.max(pageContiguousSeq, nextAfterSeq);
-            const canContinuePage = blockedSeq <= 0 && messages.length > 0 && nextAfter2 > nextAfterSeq;
-            if (canContinuePage && !pipelineRunning) {
-              pendingAckSeq = Math.max(pendingAckSeq, ackSeq);
-              lastAutoAckSeq = Math.max(lastAutoAckSeq, ackSeq);
-            } else {
-              await this.confirmForwardP2PAck(ackSeq);
-              lastAutoAckSeq = Math.max(lastAutoAckSeq, ackSeq);
-            }
+            pendingAckSeq = Math.max(pendingAckSeq, ackSeq);
           }
         }
         if (ns) client._delivery.onPullPage?.(
@@ -33924,15 +34701,14 @@ var V2E2EECoordinator = class {
           observedUpper: typeof client._seqTracker.getMaxSeenSeq === "function" ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter
         });
         if (!shouldContinue) break;
-        if (pipelinePage) {
-          pipelineResume?.();
-          pipelineResume = null;
+        if (pipelinePage && volatileMessages.length > 0) {
+          await stopPipeline();
+          this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+          pipelineQueue = new V2PullPageQueue(V2_PULL_PIPELINE_QUEUE_CAPACITY);
+          pipelineStopped = false;
+          pipelineError = null;
         }
         if (shouldContinueForPipeline && !volatileAdvanced && !pipelineRunning && limit >= V2_PULL_MAX_PAGE_LIMIT) {
-          if (pendingAckSeq > 0) {
-            await this.confirmForwardP2PAck(pendingAckSeq);
-            pendingAckSeq = 0;
-          }
           startPipeline(nextAfter, volatileCursor);
         }
         if (!pipelineRunning && pullGateKey && opts?.gateLocked && client._rpcPipeline?.yieldPullGate) {
@@ -33946,7 +34722,7 @@ var V2E2EECoordinator = class {
           pullGateKey = nextKey;
         }
         const tailDelayMs = v2PullTailDelayMs(rawCount, limit);
-        if (tailDelayMs > 0) await v2Sleep(tailDelayMs);
+        if (!pipelineRunning && tailDelayMs > 0) await v2Sleep(tailDelayMs);
         nextAfterSeq = nextAfter;
       }
     } finally {
@@ -33954,10 +34730,11 @@ var V2E2EECoordinator = class {
     }
     if (pageCount >= maxPages) {
       client._clientLog.warn(`message.v2.pull reached max_pages=${maxPages} after_seq=${nextAfterSeq}`);
-      if (pendingAckSeq > 0) {
-        await this.confirmForwardP2PAck(pendingAckSeq);
-        pendingAckSeq = 0;
-      }
+    }
+    if (pendingAckSeq > 0) {
+      this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+      await this.confirmForwardP2PAck(pendingAckSeq);
+      pendingAckSeq = 0;
     }
     client._delivery.onPullWorkSettled?.();
     return deduplicatePulledResults(decrypted);
@@ -34027,15 +34804,18 @@ var V2E2EECoordinator = class {
   }
   async confirmForwardP2PAck(upToSeq, inlineGeneration) {
     const ns = this.client._aid ? `p2p:${this.client._aid}` : "";
+    const generation = Number(this.client._v2RuntimeGeneration ?? 0);
+    const deliveryGeneration = this.client._delivery.captureInlineGeneration?.();
     try {
       const result = await this.ackV2ForForward(upToSeq, inlineGeneration);
+      this.ensureDeliveryCurrent(ns, generation, deliveryGeneration);
       const actualAckSeq = this.client._delivery?.resolveForwardAckSeq?.(result, upToSeq) ?? 0;
       if (actualAckSeq < upToSeq) {
         throw new E2EEError(`message.v2.ack server ACK watermark ${actualAckSeq} is below requested ${upToSeq}`);
       }
       this.clearForwardAck(ns, upToSeq);
     } catch (exc) {
-      this.recordForwardAck(ns, upToSeq);
+      if (Number(this.client._v2RuntimeGeneration ?? 0) === generation && (deliveryGeneration === void 0 || this.client._delivery.isInlineGenerationCurrent(deliveryGeneration)) && this.client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false) this.recordForwardAck(ns, upToSeq);
       throw exc;
     }
   }
@@ -34323,13 +35103,13 @@ var V2E2EECoordinator = class {
     let pageCount = 0;
     let lastAutoAckSeq = 0;
     let pendingAckSeq = deferredForwardAck;
+    let committedAckSeq = ownsCursor ? client._seqTracker.getContiguousSeq(ns) : 0;
     const maxPages = Math.max(1, Math.min(100, Math.trunc(Number(opts?.maxPages ?? 100) || 100)));
     let pipelineRunning = false;
     let pipelineError = null;
     const pipelineQueue = new V2PullPageQueue(V2_PULL_PIPELINE_QUEUE_CAPACITY);
     let pipelineProducer = null;
     let pipelineStopped = false;
-    let pipelineResume = null;
     const startPipeline = (startAfterSeq) => {
       if (pipelineRunning || pageCount >= maxPages || limit < V2_PULL_MAX_PAGE_LIMIT || !ownsCursor) return;
       pipelineRunning = true;
@@ -34337,29 +35117,29 @@ var V2E2EECoordinator = class {
         let producerAfterSeq = startAfterSeq;
         for (let produced = pageCount; produced < maxPages; produced += 1) {
           if (pipelineStopped) break;
+          this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+          const ackUpToSeq = Math.min(pendingAckSeq, committedAckSeq);
+          const inlineAckGeneration = ackUpToSeq > 0 ? client._delivery?.pendingGroupInlineAckGeneration?.(ns) ?? null : null;
           const result = await client._callRawV2Rpc("group.v2.pull", withExplicitGroupAid({
             group_id: wireGroupId,
             after_seq: producerAfterSeq,
             limit,
             ...cursorParams,
-            ...opts?.force ? { force: true } : {}
+            ...opts?.force ? { force: true } : {},
+            ...ackUpToSeq > 0 ? { ack_up_to_seq: ackUpToSeq } : {}
           }, groupAid), pullGateKey);
           if (pipelineStopped) break;
+          this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
           const pageMessages = Array.isArray(result?.messages) ? result.messages : [];
-          const completed = new Promise((resolve) => {
-            pipelineResume = resolve;
-          });
           const enqueued = await pipelineQueue.put({
             result,
             afterSeq: producerAfterSeq,
-            ackUpToSeq: 0,
-            inlineAckGeneration: null,
+            ackUpToSeq,
+            inlineAckGeneration,
             requestedVolatileCursor: "",
             weight: pageMessages.length
           }, pageMessages.length);
           if (!enqueued || pipelineStopped) break;
-          await completed;
-          if (pipelineStopped) break;
           const messages = deduplicateForwardPageMessages(pageMessages, producerAfterSeq);
           const seqs = messages.map((msg) => Number(msg.seq ?? 0)).filter((seq2) => Number.isFinite(seq2) && seq2 > 0);
           const nextAfter = Math.max(contiguousPullSeq(producerAfterSeq, seqs, result.contiguous_seq), producerAfterSeq);
@@ -34386,8 +35166,6 @@ var V2E2EECoordinator = class {
     };
     const stopPipeline = async () => {
       pipelineStopped = true;
-      pipelineResume?.();
-      pipelineResume = null;
       pipelineQueue.close();
       if (pipelineProducer) {
         const producer = pipelineProducer;
@@ -34424,20 +35202,21 @@ var V2E2EECoordinator = class {
             ...ackUpToSeq > 0 ? { ack_up_to_seq: ackUpToSeq } : {}
           }, groupAid), pullGateKey);
         }
+        this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+        if (ownsCursor && !opts?.force) client._delivery.observeBackgroundPullResponse?.(ns, nextAfterSeq, result, limit);
         if (ackUpToSeq > 0) {
           const actualAckSeq = client._delivery?.resolveGroupPullAckSeq?.(result, ackUpToSeq) ?? 0;
           if (actualAckSeq >= ackUpToSeq) {
             if (pendingInlineGeneration !== null) {
               client._delivery?.completePendingGroupInlineAckUpTo?.(ns, actualAckSeq, pendingInlineGeneration);
             }
-            pendingAckSeq = 0;
+            if (pendingAckSeq <= ackUpToSeq) pendingAckSeq = 0;
             lastAutoAckSeq = Math.max(lastAutoAckSeq, ackUpToSeq);
             this.clearForwardAck(ns, ackUpToSeq);
           } else {
             client._clientLog.warn(`group.v2.pull piggyback ACK below target: group=${gid}, requested=${ackUpToSeq}, actual=${actualAckSeq}; fallback terminal ACK`);
-            await this.confirmForwardGroupAck(gid, ackUpToSeq, groupAid);
-            pendingAckSeq = 0;
-            lastAutoAckSeq = Math.max(lastAutoAckSeq, ackUpToSeq);
+            pendingAckSeq = Math.max(pendingAckSeq, ackUpToSeq);
+            this.recordForwardAck(ns, ackUpToSeq);
           }
         }
         const resultGroupAid = String(result.group_aid ?? result.groupAid ?? "").trim();
@@ -34461,6 +35240,17 @@ var V2E2EECoordinator = class {
           seqs,
           result.contiguous_seq
         );
+        if (!pipelineRunning && shouldContinueForwardPage({
+          rawCount: messages.length,
+          nextAfterSeq,
+          nextAfter: pageMaxSeq,
+          limit,
+          hasMoreField,
+          hasMore,
+          serverHead,
+          pendingAckSeq: 0,
+          observedUpper: typeof client._seqTracker.getMaxSeenSeq === "function" ? client._seqTracker.getMaxSeenSeq(ns) : pageMaxSeq
+        })) startPipeline(pageMaxSeq);
         const deferredKeyFetches = /* @__PURE__ */ new Map();
         let blockedSeq = 0;
         const pageDecryptedBefore = decrypted.length;
@@ -34642,6 +35432,7 @@ var V2E2EECoordinator = class {
               if (pageCount === 1 && deferredServerCursor > 0) this.clearForwardCursor(ns, ackSeq);
             }
             client._delivery.completePendingTailWindow?.(ns);
+            committedAckSeq = ackSeq;
           } catch (exc) {
             if (Number(client._v2RuntimeGeneration ?? 0) === generation && (inlineGeneration === void 0 || client._delivery.isInlineGenerationCurrent(inlineGeneration)) && client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false && pageTrackerSnapshot !== void 0 && typeof client._seqTracker.restoreNamespaceSnapshot === "function") {
               client._seqTracker._restoreNamespaceSnapshotPreservingPush(ns, pageTrackerSnapshot);
@@ -34670,15 +35461,7 @@ var V2E2EECoordinator = class {
         const ackNeeded = ackSeq > 0 && ackSeq > lastAutoAckSeq && ownsCursor && (hasServerCursor && ackSeq > cursorCurrentSeq || contigAdvanced && ackSeq > knownServerCursorSeq);
         if (ackNeeded) {
           this.recordForwardAck(ns, ackSeq);
-          const nextAfter2 = Math.max(pageContiguousSeq, nextAfterSeq);
-          const canContinuePage = blockedSeq <= 0 && messages.length > 0 && nextAfter2 > nextAfterSeq && ownsCursor;
-          if (canContinuePage && !pipelineRunning) {
-            pendingAckSeq = Math.max(pendingAckSeq, ackSeq);
-            lastAutoAckSeq = Math.max(lastAutoAckSeq, ackSeq);
-          } else {
-            await this.confirmForwardGroupAck(gid, ackSeq, groupAid);
-            lastAutoAckSeq = Math.max(lastAutoAckSeq, ackSeq);
-          }
+          pendingAckSeq = Math.max(pendingAckSeq, ackSeq);
         }
         const nextAfter = Math.max(pageContiguousSeq, nextAfterSeq);
         if (!ownsCursor) break;
@@ -34707,15 +35490,7 @@ var V2E2EECoordinator = class {
           observedUpper: typeof client._seqTracker.getMaxSeenSeq === "function" ? client._seqTracker.getMaxSeenSeq(ns) : nextAfter
         });
         if (!shouldContinue) break;
-        if (pipelinePage) {
-          pipelineResume?.();
-          pipelineResume = null;
-        }
         if (shouldContinueForPipeline && !pipelineRunning && limit >= V2_PULL_MAX_PAGE_LIMIT) {
-          if (pendingAckSeq > 0) {
-            await this.confirmForwardGroupAck(gid, pendingAckSeq, groupAid);
-            pendingAckSeq = 0;
-          }
           startPipeline(nextAfter);
         }
         if (!pipelineRunning && pullGateKey && opts?.gateLocked && client._rpcPipeline?.yieldPullGate) {
@@ -34730,7 +35505,7 @@ var V2E2EECoordinator = class {
           pullGateKey = nextKey;
         }
         const tailDelayMs = v2PullTailDelayMs(rawCount, limit);
-        if (tailDelayMs > 0) await v2Sleep(tailDelayMs);
+        if (!pipelineRunning && tailDelayMs > 0) await v2Sleep(tailDelayMs);
         nextAfterSeq = nextAfter;
       }
     } finally {
@@ -34738,25 +35513,29 @@ var V2E2EECoordinator = class {
     }
     if (pageCount >= maxPages) {
       client._clientLog.warn(`group.v2.pull reached max_pages=${maxPages} group=${gid} after_seq=${nextAfterSeq}`);
-      if (pendingAckSeq > 0) {
-        await this.confirmForwardGroupAck(gid, pendingAckSeq, groupAid);
-        pendingAckSeq = 0;
-      }
+    }
+    if (pendingAckSeq > 0) {
+      this.ensureDeliveryCurrent(ns, generation, inlineGeneration);
+      await this.confirmForwardGroupAck(gid, pendingAckSeq, groupAid);
+      pendingAckSeq = 0;
     }
     client._delivery.onPullWorkSettled?.();
     return deduplicatePulledResults(decrypted);
   }
   async confirmForwardGroupAck(groupId, upToSeq, groupAid) {
     const ns = `group:${String(groupId ?? "").trim()}`;
+    const generation = Number(this.client._v2RuntimeGeneration ?? 0);
+    const deliveryGeneration = this.client._delivery.captureInlineGeneration?.();
     try {
       const result = await this.ackGroupV2ForForward(groupId, upToSeq, groupAid);
+      this.ensureDeliveryCurrent(ns, generation, deliveryGeneration);
       const actualAckSeq = this.client._delivery?.resolveForwardAckSeq?.(result, upToSeq) ?? 0;
       if (actualAckSeq < upToSeq) {
         throw new E2EEError(`group.v2.ack server ACK watermark ${actualAckSeq} is below requested ${upToSeq}`);
       }
       this.clearForwardAck(ns, upToSeq);
     } catch (exc) {
-      this.recordForwardAck(ns, upToSeq);
+      if (Number(this.client._v2RuntimeGeneration ?? 0) === generation && (deliveryGeneration === void 0 || this.client._delivery.isInlineGenerationCurrent(deliveryGeneration)) && this.client._rpcPipeline?.isPullNamespaceCurrent?.(ns) !== false) this.recordForwardAck(ns, upToSeq);
       throw exc;
     }
   }
@@ -35292,11 +36071,19 @@ var V2E2EECoordinator = class {
         });
       }
     }
+    const targetDeviceId = String(opts.deviceId ?? "").trim();
     if (peerDevices.length === 0) {
+      if (targetDeviceId && useCache) {
+        this.deleteBootstrapCacheEntry(to);
+        return this.buildV2P2PEnvelope({ ...opts, useCache: false });
+      }
       throw new E2EEError(`V2 bootstrap: no devices found for ${to}`);
     }
-    const targetDeviceId = String(opts.deviceId ?? "").trim();
     if (targetDeviceId && !peerDevices.some((dev) => String(dev.device_id ?? "").trim() === targetDeviceId)) {
+      if (useCache) {
+        this.deleteBootstrapCacheEntry(to);
+        return this.buildV2P2PEnvelope({ ...opts, useCache: false });
+      }
       throw new E2EEError(`V2 bootstrap: target device ${targetDeviceId} not found for ${to}`);
     }
     let targetSet = useCache ? this.getTargetSetCache(to) : void 0;
@@ -35377,6 +36164,10 @@ var V2E2EECoordinator = class {
         return isPeerTarget || target.role === "self_sync";
       });
       if (!peerTargetFound) {
+        if (useCache) {
+          this.deleteBootstrapCacheEntry(to);
+          return this.buildV2P2PEnvelope({ ...opts, useCache: false });
+        }
         throw new E2EEError(`V2 bootstrap: target device ${targetDeviceId} not found for ${to}`);
       }
     }
@@ -37074,7 +37865,7 @@ var _AUNClient = class _AUNClient {
     this._logDiscovery = this._logger.for("aun_core.discovery");
     this._logEvents = this._logger.for("aun_core.events");
     this._clientLog.info(`AUNClient initialized: debug=${_debug} aunPath=${this.configModel.aunPath} aid=${initAid ?? "-"}`);
-    this._dispatcher = new EventDispatcher();
+    this._dispatcher = new EventDispatcher(() => this._ensureReadStateIdentity());
     this._discovery = new GatewayDiscovery();
     this._tokenStore = new IndexedDBTokenStore();
     this._slotId = inputAid?.slotId || "default";
@@ -37113,7 +37904,7 @@ var _AUNClient = class _AUNClient {
       },
       auth: () => this._auth,
       tokenStore: () => this._tokenStore,
-      fetchPeerCert: (target, certFingerprint, signedAt) => this._fetchPeerCert(target, certFingerprint || void 0, void 0, signedAt),
+      fetchPeerCert: (target, certFingerprint, signedAt) => this._fetchPeerCert(target, certFingerprint || void 0, void 0, signedAt, true),
       entityOwnerResolver: (target, type) => this._resolveEntityAgentMdOwner(target, type),
       entityIdentityGetter: (target, type) => this._freshEntityCertificate(target, type),
       entitySignerResolver: (target, fingerprint) => this._freshEntitySigner(target, fingerprint)
@@ -37125,6 +37916,7 @@ var _AUNClient = class _AUNClient {
     this._transport.setServiceEventVerifier((event, payload) => this._verifyIncomingServiceEvent(event, payload));
     this._transport.setProtocolDisconnectCallback((error, closeCode) => this._handleTransportDisconnect(error, closeCode));
     this._transport._onForegroundDrained = () => this._delivery.onForegroundPullsDrained();
+    this._transport._onRpcResponse = () => this._delivery.requestBackgroundPullRecovery();
     this._transport.setProtocolMetaObserver(
       (meta) => this._observeRpcMeta(meta).catch((exc) => {
         this._clientLog.debug(`rpc meta observer skipped: ${String(exc)}`);
@@ -37522,7 +38314,7 @@ var _AUNClient = class _AUNClient {
   }
   _ownershipV21() {
     if (!this._ownershipWorkflow) {
-      const storage = new OwnershipStorageAdapter({ currentAid: () => this._aid ?? "", call: (method, params2) => this.call(method, params2) });
+      const storage = new OwnershipStorageAdapter({ currentAid: () => this._aid ?? "", call: (method, params2) => this.call(method, params2), httpPut: (url, data, headers) => this.storage.lowlevel.httpPut(url, data, headers) });
       const files = new OwnershipFiles({
         currentAidType: () => this.getType(),
         currentAid: () => {
@@ -37532,8 +38324,8 @@ var _AUNClient = class _AUNClient {
         readAgentMdFresh: (aid2) => this._agentMdManager.readOwnershipFresh(aid2),
         submitAgentMdRaw: (aid2, raw, condition) => this._agentMdManager.submitOwnershipRaw(aid2, raw, condition),
         readOwnerMd: (owner, sub) => storage.readOwnerMd(owner, sub),
-        writeOwnerMd: (owner, sub, raw, revision) => storage.writeOwnerMd(owner, sub, raw, revision),
-        deleteOwnerMd: (owner, sub, revision) => storage.deleteOwnerMd(owner, sub, revision),
+        writeOwnerMd: (owner, sub, raw) => storage.writeOwnerMd(owner, sub, raw),
+        deleteOwnerMd: (owner, sub) => storage.deleteOwnerMd(owner, sub),
         resolveCertificate: async (aid2, fingerprint, keyPurpose) => this._auth.resolveOwnershipCertificate(await this._resolveOwnershipCertificateGateway(aid2), aid2, fingerprint, keyPurpose)
       });
       this._ownershipWorkflow = new OwnershipWorkflow({
@@ -38065,7 +38857,7 @@ var _AUNClient = class _AUNClient {
       },
       auth: () => this._auth,
       tokenStore: () => this._tokenStore,
-      fetchPeerCert: (target, certFingerprint, signedAt) => this._fetchPeerCert(target, certFingerprint || void 0, void 0, signedAt),
+      fetchPeerCert: (target, certFingerprint, signedAt) => this._fetchPeerCert(target, certFingerprint || void 0, void 0, signedAt, true),
       entityOwnerResolver: (target, type) => this._resolveEntityAgentMdOwner(target, type),
       entityIdentityGetter: (target, type) => this._freshEntityCertificate(target, type),
       entitySignerResolver: (target, fingerprint) => this._freshEntitySigner(target, fingerprint)
@@ -38077,6 +38869,7 @@ var _AUNClient = class _AUNClient {
     this._transport.setServiceEventVerifier((event, payload) => this._verifyIncomingServiceEvent(event, payload));
     this._transport.setProtocolDisconnectCallback((error, closeCode) => this._handleTransportDisconnect(error, closeCode));
     this._transport._onForegroundDrained = () => this._delivery.onForegroundPullsDrained();
+    this._transport._onRpcResponse = () => this._delivery.requestBackgroundPullRecovery();
     this._transport.setProtocolMetaObserver(
       (meta) => this._observeRpcMeta(meta).catch((exc) => {
         this._clientLog.debug(`rpc meta observer skipped: ${String(exc)}`);
@@ -38206,6 +38999,7 @@ var _AUNClient = class _AUNClient {
       const groupAid = message.slice(groupMDPrefix.length).trim();
       const store = this._aidStore;
       if (!groupAid || !store) return false;
+      if (String((await (store._agentMdManager ?? this._agentMdManager).loadRecord(groupAid, true))?.local_draft_content ?? "").trim()) return false;
       const loaded = await store.load(groupAid);
       if (!loaded.ok || !loaded.data?.aid?.isPrivateKeyValid()) return false;
       const ownerAid = String(this._aid ?? this._currentAid?.aid ?? "").trim();
@@ -38220,6 +39014,7 @@ var _AUNClient = class _AUNClient {
     if (!message.toLowerCase().startsWith(agentPrefix)) return false;
     const target = message.slice(agentPrefix.length).trim();
     if (!target || target.toLowerCase() !== String(this._aid ?? "").trim().toLowerCase()) return false;
+    if (String((await this._agentMdManager.loadRecord(target, true))?.local_draft_content ?? "").trim()) return false;
     const content = await this._agentMdManager.readContent(target) ?? buildDefaultAgentMd(target);
     if (!this._ordinaryAdmissionAgentMd(content, target)) return false;
     await this._agentMdManager.upload(content);
@@ -38233,10 +39028,11 @@ var _AUNClient = class _AUNClient {
     const aid2 = String(this._aid ?? this._currentAid?.aid ?? "").trim();
     if (!aid2) return;
     try {
-      const pending = await this._agentMdManager.pendingUpload(aid2);
-      if (pending) {
+      const draft = String((await this._agentMdManager.loadRecord(aid2, true))?.local_draft_content ?? "").trim();
+      const pending = draft ? null : await this._agentMdManager.pendingUpload(aid2);
+      if (!draft && pending) {
         if (this._ordinaryAdmissionAgentMd(pending.content, aid2)) await this._agentMdManager.resumePendingUpload(aid2);
-      } else {
+      } else if (!draft) {
         const checked = await this._agentMdManager.check(aid2, 0);
         if (!checked.remote_found) {
           const content = await this._agentMdManager.readContent(aid2) ?? buildDefaultAgentMd(aid2);
@@ -38280,6 +39076,7 @@ var _AUNClient = class _AUNClient {
             await this.bindGroupAid({ group_id: groupId, group_aid: groupAid }, { aidStore: store });
             return;
           }
+          if (String((await (store._agentMdManager ?? this._agentMdManager).loadRecord(groupAid, true))?.local_draft_content ?? "").trim()) return;
           if (await this._resumeGroupAgentMdUpload(store, groupAid)) return;
           const checked = await this._agentMdManager.check(groupAid);
           if (!checked.remote_found) {
@@ -38358,6 +39155,7 @@ var _AUNClient = class _AUNClient {
           await this.completeOrgTransfer(transfer.source_params, { aidStore: store });
           continue;
         }
+        if (String((await (store._agentMdManager ?? this._agentMdManager).loadRecord(aid2, true))?.local_draft_content ?? "").trim()) continue;
         const pending = await store._agentMdManager.pendingUpload(aid2);
         if (!pending) continue;
         const fields = validateAgentMdDocument(pending.content, { expectedAid: aid2 }).frontmatter;
@@ -38373,6 +39171,10 @@ var _AUNClient = class _AUNClient {
     const orgAid = String(params2.org_id ?? "").trim();
     const transferId = String(params2.transfer_id ?? "").trim();
     if (!store || !owner?.isPrivateKeyValid() || !orgAid || !transferId) throw new ValidationError("completeOrgTransfer requires aidStore, org_id, transfer_id and current accepting owner");
+    for (const field of ["previous_owner", "new_owner"]) {
+      const material = params2[field];
+      if (!isJsonObject(material) || !isJsonObject(material.membership_binding) || !isJsonObject(material.terms) || field === "previous_owner" && !isJsonObject(material.credential_template)) throw new StateError("Org transfer requires both replacement membership bindings, terms and previous-owner credential", { stringCode: "invalid", retryable: false });
+    }
     this._aidStore = store;
     const localStore = store._keystore;
     const tokenStore = store._tokenStore;
@@ -38380,10 +39182,6 @@ var _AUNClient = class _AUNClient {
     const raw = await tokenStore.getMetadata(orgAid, "org_identity_transfer");
     let pending = raw ? JSON.parse(raw) : void 0;
     if (pending && (pending.transfer_id !== transferId || pending.owner_aid !== owner.aid || pending.input_hash !== inputHash)) throw new StateError("pending Org transfer context changed", { stringCode: "conflict", retryable: false });
-    for (const field of ["previous_owner", "new_owner"]) {
-      const material = params2[field];
-      if (!isJsonObject(material) || !isJsonObject(material.membership_binding) || !isJsonObject(material.terms) || field === "previous_owner" && !isJsonObject(material.credential_template)) throw new StateError("Org transfer requires both replacement membership bindings, terms and previous-owner credential", { stringCode: "invalid", retryable: false });
-    }
     const pendingKey = `org-transfer:${orgAid}:${transferId}`;
     let keyPair = await localStore.loadPendingGroupBind(pendingKey);
     if (!keyPair) {
@@ -38726,7 +39524,8 @@ var _AUNClient = class _AUNClient {
       { uploaderAid, entityOwnerResolver: (aid2, type) => this._resolveEntityAgentMdOwner(aid2, type), entityIdentityGetter: (aid2, type) => this._freshEntityCertificate(aid2, type), entitySignerResolver: (aid2, fingerprint) => this._freshEntitySigner(aid2, fingerprint) }
     );
     if (!uploaded.ok) {
-      throw new ValidationError(`group agent.md upload failed: ${uploaded.error.message}`);
+      const code = ["invalid", "unavailable", "forbidden", "conflict", "persistence_unavailable"].includes(uploaded.error.code) ? uploaded.error.code : uploaded.error.code === "NETWORK_ERROR" ? "unavailable" : "invalid";
+      throw new StateError(`group agent.md upload failed: ${uploaded.error.message}`, { stringCode: code, retryable: code === "unavailable" });
     }
   }
   async _freshEntityCertificate(aid2, type = "group") {
@@ -39806,11 +40605,11 @@ ${invitee}` : "";
     if (version !== this._serviceEventIdentityVersion || targetAid !== (this._aid || this._currentAid?.aid || "")) throw new ValidationError("service event receiver identity changed");
     return verified;
   }
-  async _fetchPeerCert(aid2, certFingerprint, timeoutMs = 5e3, signedAt) {
+  async _fetchPeerCert(aid2, certFingerprint, timeoutMs = 5e3, signedAt, agentMdRead = false) {
     const tStart = Date.now();
     this._clientLog.debug(`_fetchPeerCert enter: aid=${aid2} fingerprint=${certFingerprint ?? "<none>"}`);
     try {
-      const cacheKey = certCacheKey(aid2, certFingerprint) + (signedAt === void 0 ? "" : `:signed:${signedAt}`);
+      const cacheKey = certCacheKey(aid2, certFingerprint) + (signedAt === void 0 ? "" : `:signed:${signedAt}`) + (agentMdRead ? ":agentmd" : "");
       const cached = this._certCache.get(cacheKey);
       const now = Date.now() / 1e3;
       if (cached && now < cached.refreshAfter) {
@@ -39848,6 +40647,7 @@ ${invitee}` : "";
       }
       try {
         if (signedAt === void 0) await this._auth.verifyPeerCertificate(peerGatewayUrl, certPem, aid2);
+        else if (agentMdRead) await this._auth.verifyPeerCertificate(peerGatewayUrl, certPem, aid2, signedAt, false, true);
         else await this._auth.verifyPeerCertificate(peerGatewayUrl, certPem, aid2, signedAt);
       } catch (exc) {
         throw new ValidationError(`peer cert verification failed for ${aid2}: ${exc}`);