@awiki/dsh-plugin 0.3.7 → 0.3.10

package/lib/types/index.js

@@ -1,4 +1,3 @@
-/** Unified AWiki identity, messaging, attachment, Remote, and model-tool service. */
 var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
     var useValue = arguments.length > 2;
     for (var i = 0; i < initializers.length; i++) {
@@ -33,9 +32,10 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
+import { decodeDesktopDistribution } from "./desktop-distribution.js";
+/** Unified AWiki identity, messaging, attachment, Remote, and model-tool service. */
 import { Context } from '@deepseek-ai/cordis';
-import { createHash } from 'node:crypto';
-import { existsSync } from 'node:fs';
+import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 import { homedir } from 'node:os';
 import { isAbsolute, join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
@@ -43,21 +43,29 @@ import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { settingsNamespace } from '@deepseek-ai/dsh-settings';
 import { AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION, AWIKI_LOGOUT_CONFIRMATION } from "./types.js";
 import { AwikiExternalHttpAuthError, createAwikiExternalHttpAuth, externalHttpAuthError, mapProviderError as mapExternalHttpProviderError, } from "./external-http-auth.js";
-import { downloadedAttachment } from "./sdk-adapter.js";
-import { standardBase64Syntax } from "./base64.js";
+import { AwikiIntegrationClient } from "./integration-client.js";
+import { clearLegacySentMailCache } from "./legacy-sent-mail-cache.js";
+import { AwikiMailListClient } from "./mail-list-client.js";
+import { AwikiSdkError, downloadedAttachment } from "./sdk-adapter.js";
+import { failedMailRecoveryObservability, fencedMailRecoveryObservability, successfulMailRecoveryObservability, } from "./mail-recovery-observability.js";
 import { registerAwikiTools } from "./tools.js";
-import { MAIL_ATTACHMENT_SERVICE_MAX_BYTES, MAIL_ATTACHMENT_SERVICE_MAX_COUNT, MAIL_ATTACHMENT_SERVICE_TOTAL_MAX_BYTES, mailAttachmentDownloadRequest, mailAttachmentContentType, mailAttachmentFileName, mailInboxRequest, mailMarkReadRequest, mailReadRequest, mailSendRequest, } from "./mail.js";
+import { mailInboxRequest, mailMarkReadRequest, mailReadRequest, mailSendRequest, } from "./mail.js";
 import { AwikiSettingsSchema, validateAwikiSettings, } from "./settings.js";
 import { AWIKI_SETTINGS_NAMESPACE, DEFAULT_AWIKI_DOMAIN, normalizeAwikiDomain } from "./domain.js";
+import { AWIKI_DEFAULT_BUILTIN_TENANT, } from "./builtin-tenant-config.js";
 import { AWIKI_SETTINGS_RPC_CHANNEL } from "./settings-rpc-contract.js";
 import { createAwikiSettingsRpcHandler } from "./settings-rpc.js";
 import { AwikiSessionStore } from "./session.js";
 import { AwikiImageAttachmentCache, minimumImageAttachmentCacheMaxBytes } from "./attachment-cache.js";
-import { AwikiSentMailStore, isLocalSentMailId } from "./sent-mail-store.js";
 import { AwikiConversationPreferenceStore, normalizeConversationPreferenceMutation, } from "./conversation-preferences.js";
 import { AwikiAgentListener, DshAwikiListenerAgentRuntime, } from "./listener.js";
-import { resolveAwikiProfileName, resolveAwikiStateRoot, resolveAwikiTenantStateRoot, } from "./profile-state.js";
+import { IdentityRealtimeSupervisor, } from "./realtime-supervisor.js";
+import { resolveAwikiStateRoot } from "./profile-state.js";
+import { AwikiTenantRegistry, } from "./tenant-registry.js";
+import { checkAwikiUpdatePolicy, readAwikiUpdatePolicyStatus, DSH_AWIKI_VERSION, } from "./update-policy.js";
 export { AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION, AWIKI_LOGOUT_CONFIRMATION } from "./types.js";
+export { AWIKI_CHINA_TENANT_ID, AWIKI_GLOBAL_TENANT_ID, AWIKI_OFFICIAL_CATALOG_VERSION, AWIKI_TENANT_REGISTRY_SCHEMA_VERSION, } from "./tenant-registry.js";
+export { DSH_AWIKI_MODEL_PROXY_VERSION, DSH_AWIKI_VERSION, compareVersions as compareAwikiPluginVersions, } from "./update-policy.js";
 export { AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES, AwikiExternalHttpAuthError, } from "./external-http-auth.js";
 export { AWIKI_DOMAIN_FIELD, AWIKI_SETTINGS_NAMESPACE, AwikiSettingsSchema, DEFAULT_AWIKI_DOMAIN, normalizeAwikiDomain, validateAwikiSettings, } from "./settings.js";
 export { AWIKI_HISTORY_TOOL, AWIKI_IDENTITY_STATUS_TOOL, AWIKI_LIST_CONVERSATIONS_TOOL, AWIKI_MAIL_ACCOUNT_TOOL, AWIKI_MAIL_INBOX_TOOL, AWIKI_MAIL_MARK_READ_TOOL, AWIKI_MAIL_READ_TOOL, AWIKI_MAIL_SEND_TOOL, AWIKI_SEND_ATTACHMENT_TOOL, AWIKI_SEND_MESSAGE_TOOL, } from "./tools.js";
@@ -67,37 +75,37 @@ export const DEFAULT_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
 export const DEFAULT_IMAGE_ATTACHMENT_CACHE_MAX_BYTES = 64 * 1024 * 1024;
 /** Default browser polling interval while the AWiki drawer is open. */
 export const DEFAULT_POLL_INTERVAL_MS = 3_000;
-/** Default AWiki production service origin. */
-export const DEFAULT_AWIKI_SERVICE_URL = 'https://awiki.ai';
-/** Default authoritative AWiki message-service DID. */
-export const DEFAULT_AWIKI_MESSAGE_SERVICE_DID = 'did:wba:awiki.ai';
+/** Package-configured primary AWiki service origin. */
+export const DEFAULT_AWIKI_SERVICE_URL = AWIKI_DEFAULT_BUILTIN_TENANT.backendOrigin;
+/** Package-configured primary authoritative AWiki message-service DID. */
+export const DEFAULT_AWIKI_MESSAGE_SERVICE_DID = `did:wba:${AWIKI_DEFAULT_BUILTIN_TENANT.didHost}`;
 /** Host-owned model input cap after message minimization. */
 export const DEFAULT_SUMMARY_MAX_INPUT_BYTES = 32 * 1024;
 /** Hard limit for one user-triggered conversation summary. */
 export const MAX_SUMMARY_MESSAGES = 50;
 /** Loader schema for the Host deployment configuration. */
 export const Config = z.object({
-    userServiceUrl: z.string(),
+    userServiceUrl: z.string().default(DEFAULT_AWIKI_SERVICE_URL),
     userServiceDomain: z.string().default(DEFAULT_AWIKI_DOMAIN),
-    messageServiceUrl: z.string(),
+    legacyTenantSlot: z.string(),
+    messageServiceUrl: z.string().default(DEFAULT_AWIKI_SERVICE_URL),
     mailServiceUrl: z.string(),
-    messageServicePublicUrl: z.string(),
-    messageServiceDid: z.string(),
+    messageServicePublicUrl: z.string().default(DEFAULT_AWIKI_SERVICE_URL),
+    messageServiceDid: z.string().default(DEFAULT_AWIKI_MESSAGE_SERVICE_DID),
     allowedAttachmentOrigins: z.array(z.string()).default([]),
     allowInsecureLoopbackForTesting: z.boolean().default(false),
     stateRoot: z.string(),
     attachmentMaxBytes: z.number().default(DEFAULT_ATTACHMENT_MAX_BYTES),
-    mailAttachmentMaxCount: z.number().default(MAIL_ATTACHMENT_SERVICE_MAX_COUNT),
-    mailAttachmentMaxBytes: z.number().default(MAIL_ATTACHMENT_SERVICE_MAX_BYTES),
-    mailAttachmentTotalMaxBytes: z.number().default(MAIL_ATTACHMENT_SERVICE_TOTAL_MAX_BYTES),
     imageAttachmentCacheMaxBytes: z.number().default(DEFAULT_IMAGE_ATTACHMENT_CACHE_MAX_BYTES),
     pollIntervalMs: z.number().default(DEFAULT_POLL_INTERVAL_MS),
+    realtimeEnabled: z.boolean().default(true),
     listenerEnabled: z.boolean().default(false),
     listenerAllowedPeers: z.array(z.string()).default([]),
     listenerWorkspacePath: z.string(),
     summaryMaxInputBytes: z.number().default(DEFAULT_SUMMARY_MAX_INPUT_BYTES),
 });
 const FAILURE_CODES = new Set([
+    'client-version-unsupported',
     'not-registered',
     'signed-out',
     'already-registered',
@@ -107,9 +115,9 @@ const FAILURE_CODES = new Set([
     'handle-unavailable',
     'not-found',
     'forbidden',
+    'device-rejoin-required',
     'identity-recovery-required',
     'conflict',
-    'state-in-use',
     'rate-limited',
     'group-membership-required',
     'group-identity-stale',
@@ -123,11 +131,18 @@ const FAILURE_CODES = new Set([
     'network',
     'remote',
 ]);
-const LISTENER_RESTART_BASE_DELAY_MS = 1_000;
-const LISTENER_RESTART_MAX_DELAY_MS = 30_000;
-const LISTENER_RESTART_MAX_ATTEMPT = 6;
-const LISTENER_STABLE_RESET_MS = 60_000;
+const DEVICE_JOIN_APPROVAL_CONFIRMATION = 'APPROVE';
+const DEVICE_REVOKE_CONFIRMATION = 'REVOKE';
+const DEVICE_JOIN_CHALLENGE_TTL_SECONDS = 240;
+const RESUMABLE_JOIN_PHASES = new Set([
+    'pending',
+    'challenge_prepared',
+    'response_prepared',
+    'response_verified',
+    'approval_prepared',
+]);
 const FAILURE_MESSAGES = {
+    'client-version-unsupported': 'This AWiki plugin version is not supported by the active tenant. Update the plugin or switch tenants.',
     'not-registered': 'No AWiki identity is registered for this deployment.',
     'signed-out': 'This installation is signed out of AWiki.',
     'already-registered': 'This deployment already has an AWiki identity.',
@@ -137,9 +152,9 @@ const FAILURE_MESSAGES = {
     'handle-unavailable': 'The requested AWiki handle is unavailable.',
     'not-found': 'The requested AWiki resource was not found.',
     'forbidden': 'The AWiki operation is not permitted.',
+    'device-rejoin-required': 'This device credential was revoked and must join the Handle again.',
     'identity-recovery-required': 'The local AWiki identity must be recovered before it can be used again.',
     'conflict': 'The AWiki operation conflicts with current state.',
-    'state-in-use': 'AWiki data is already open in another client.',
     'rate-limited': 'The AWiki service rate-limited the request.',
     'group-membership-required': 'The active AWiki identity is not a member of this group.',
     'group-identity-stale': 'The AWiki group identity binding is still recovering.',
@@ -157,6 +172,67 @@ class ProviderUnavailableError extends Error {
 }
 class SummaryProviderUnavailableError extends Error {
 }
+function candidateJoinPhase(value) {
+    if (value.remoteState === 'rejected')
+        return 'rejected';
+    if (value.remoteState === 'cancelled' || value.localPhase === 'cancelled')
+        return 'cancelled';
+    if (value.remoteState === 'expired' || value.localPhase === 'expired')
+        return 'expired';
+    if (value.localPhase === 'authorized'
+        && value.remoteState === 'consumed'
+        && value.completed
+        && value.identity !== undefined)
+        return 'authorized';
+    if (value.sas !== undefined) {
+        return value.remoteState === 'response_verified' && /^\d{6}$/u.test(value.sas)
+            ? 'sas-ready'
+            : undefined;
+    }
+    if (value.remoteState === 'challenge_sent'
+        || value.remoteState === 'response_verified'
+        || value.remoteState === 'consumed'
+        || value.localPhase !== 'pending')
+        return 'verifying';
+    return value.remoteState === 'pending' ? 'pending' : undefined;
+}
+function adminJoinPhase(value) {
+    if (value.remoteState === 'rejected')
+        return 'rejected';
+    if (value.remoteState === 'cancelled' || value.localPhase === 'cancelled')
+        return 'cancelled';
+    if (value.remoteState === 'expired' || value.localPhase === 'expired')
+        return 'expired';
+    if (value.localPhase === 'authorized' && value.remoteState === 'consumed')
+        return 'authorized';
+    if (value.sas !== undefined) {
+        return value.remoteState === 'response_verified' && /^\d{6}$/u.test(value.sas)
+            ? 'sas-ready'
+            : undefined;
+    }
+    if (value.remoteState === 'challenge_sent'
+        || value.remoteState === 'response_verified'
+        || value.remoteState === 'consumed'
+        || value.localPhase !== 'pending')
+        return 'verifying';
+    return value.remoteState === 'pending' ? 'pending' : undefined;
+}
+function requestJoinPhase(value) {
+    switch (value.state) {
+        case 'pending': return 'pending';
+        case 'challenge_sent':
+        case 'response_verified': return 'verifying';
+        case 'consumed': return 'authorized';
+        case 'cancelled': return 'cancelled';
+        case 'rejected': return 'rejected';
+        case 'expired': return 'expired';
+    }
+}
+function constantTimeSasMatches(expected, actual) {
+    if (!/^\d{6}$/u.test(expected) || !/^\d{6}$/u.test(actual))
+        return false;
+    return timingSafeEqual(Buffer.from(expected, 'ascii'), Buffer.from(actual, 'ascii'));
+}
 /** Validate and preserve one SDK service URL without accepting insecure remote HTTP. */
 function serviceUrl(field, raw, allowInsecureLoopbackForTesting) {
     let url;
@@ -175,17 +251,25 @@ function serviceUrl(field, raw, allowInsecureLoopbackForTesting) {
     }
     return raw;
 }
-/** Resolve the only supported post-recovery endpoint without accepting URL-carried state. */
-function recoveryReconciliationEndpoint(target, allowInsecureLoopbackForTesting) {
-    if (target?.kind !== 'model-proxy-v1' || typeof target.baseURL !== 'string') {
-        throw new TypeError('awiki: recovery reconciliation target is invalid');
+function publishedServiceBaseUrl(services, name, allowInsecureLoopbackForTesting) {
+    if (typeof services !== 'object' || services === null || Array.isArray(services))
+        return undefined;
+    const candidate = services[name];
+    if (typeof candidate !== 'object' || candidate === null || Array.isArray(candidate))
+        return undefined;
+    const value = candidate;
+    if (value.enabled !== true || typeof value.base_url !== 'string')
+        return undefined;
+    try {
+        const baseUrl = serviceUrl(`server-info.services.${name}.base_url`, value.base_url, allowInsecureLoopbackForTesting);
+        const parsed = new URL(baseUrl);
+        if (parsed.search !== '')
+            return undefined;
+        return baseUrl;
     }
-    const baseURL = serviceUrl('recoveryReconciliationTarget.baseURL', target.baseURL, allowInsecureLoopbackForTesting);
-    const parsed = new URL(baseURL);
-    if (parsed.search !== '') {
-        throw new TypeError('awiki: recovery reconciliation target must not contain a query');
+    catch {
+        return undefined;
     }
-    return new URL('/api/identity-recovery', parsed).toString();
 }
 /** Validate a provider domain without inferring it from an API endpoint. */
 function serviceDomain(raw, field = 'userServiceDomain') {
@@ -241,38 +325,15 @@ function resolveConfig(ctx, config) {
     const dshHome = configuredDshHome === undefined || configuredDshHome.length === 0
         ? join(homedir(), '.dsh')
         : configuredDshHome;
-    const profileName = configuredStateRoot === undefined || configuredStateRoot.length === 0
-        ? resolveAwikiProfileName(ctx, dshHome)
-        : undefined;
     const stateRoot = configuredStateRoot === undefined || configuredStateRoot.length === 0
         ? resolveAwikiStateRoot(ctx, dshHome)
         : configuredStateRoot;
-    const legacySharedStateDetected = profileName !== undefined
-        && existsSync(join(dshHome, 'awiki', 'im-core'));
     if (!isAbsolute(stateRoot))
         throw new TypeError('awiki: stateRoot must be an absolute path');
     const attachmentMaxBytes = config.attachmentMaxBytes ?? DEFAULT_ATTACHMENT_MAX_BYTES;
     if (!Number.isSafeInteger(attachmentMaxBytes) || attachmentMaxBytes < 1) {
         throw new TypeError('awiki: attachmentMaxBytes must be a positive safe integer');
     }
-    const mailAttachmentMaxCount = config.mailAttachmentMaxCount ?? MAIL_ATTACHMENT_SERVICE_MAX_COUNT;
-    if (!Number.isSafeInteger(mailAttachmentMaxCount)
-        || mailAttachmentMaxCount < 0
-        || mailAttachmentMaxCount > MAIL_ATTACHMENT_SERVICE_MAX_COUNT) {
-        throw new TypeError('awiki: mailAttachmentMaxCount must be an integer from 0 through 10');
-    }
-    const mailAttachmentMaxBytes = config.mailAttachmentMaxBytes ?? MAIL_ATTACHMENT_SERVICE_MAX_BYTES;
-    if (!Number.isSafeInteger(mailAttachmentMaxBytes)
-        || mailAttachmentMaxBytes < 1
-        || mailAttachmentMaxBytes > MAIL_ATTACHMENT_SERVICE_MAX_BYTES) {
-        throw new TypeError('awiki: mailAttachmentMaxBytes must be a positive safe integer no greater than 10 MiB');
-    }
-    const mailAttachmentTotalMaxBytes = config.mailAttachmentTotalMaxBytes ?? MAIL_ATTACHMENT_SERVICE_TOTAL_MAX_BYTES;
-    if (!Number.isSafeInteger(mailAttachmentTotalMaxBytes)
-        || mailAttachmentTotalMaxBytes < mailAttachmentMaxBytes
-        || mailAttachmentTotalMaxBytes > MAIL_ATTACHMENT_SERVICE_TOTAL_MAX_BYTES) {
-        throw new TypeError('awiki: mailAttachmentTotalMaxBytes must cover one attachment and not exceed 18 MiB');
-    }
     const imageAttachmentCacheMaxBytes = config.imageAttachmentCacheMaxBytes ?? DEFAULT_IMAGE_ATTACHMENT_CACHE_MAX_BYTES;
     if (!Number.isSafeInteger(imageAttachmentCacheMaxBytes)
         || imageAttachmentCacheMaxBytes < minimumImageAttachmentCacheMaxBytes(attachmentMaxBytes)) {
@@ -283,6 +344,10 @@ function resolveConfig(ctx, config) {
         throw new TypeError('awiki: pollIntervalMs must be a safe integer from 1000 through 60000');
     }
     const listenerEnabled = config.listenerEnabled ?? false;
+    const realtimeEnabled = config.realtimeEnabled ?? true;
+    if (listenerEnabled && !realtimeEnabled) {
+        throw new TypeError('awiki: listenerEnabled requires realtimeEnabled');
+    }
     const listenerWorkspacePath = config.listenerWorkspacePath?.trim() || join(dshHome, 'workspaces', 'awiki');
     if (!isAbsolute(listenerWorkspacePath)) {
         throw new TypeError('awiki: listenerWorkspacePath must be an absolute path');
@@ -296,10 +361,16 @@ function resolveConfig(ctx, config) {
     const messageServiceUrl = serviceUrl('messageServiceUrl', config.messageServiceUrl ?? DEFAULT_AWIKI_SERVICE_URL, allowInsecureLoopbackForTesting);
     const mailServiceUrl = serviceUrl('mailServiceUrl', config.mailServiceUrl ?? userServiceUrl, allowInsecureLoopbackForTesting);
     const messageServicePublicUrl = serviceUrl('messageServicePublicUrl', config.messageServicePublicUrl ?? DEFAULT_AWIKI_SERVICE_URL, allowInsecureLoopbackForTesting);
+    const legacyTenantSlot = config.legacyTenantSlot?.trim();
+    if (legacyTenantSlot !== undefined
+        && legacyTenantSlot !== 'primary'
+        && legacyTenantSlot !== 'secondary') {
+        throw new TypeError('awiki: legacyTenantSlot must be primary or secondary');
+    }
     return {
-        tenantDomain: serviceDomain(config.userServiceDomain ?? DEFAULT_AWIKI_DOMAIN),
         userServiceUrl,
         userServiceDomain: serviceDomain(config.userServiceDomain ?? DEFAULT_AWIKI_DOMAIN),
+        ...legacyTenantSlot === undefined ? {} : { legacyTenantSlot },
         messageServiceUrl,
         mailServiceUrl,
         messageServicePublicUrl,
@@ -308,12 +379,9 @@ function resolveConfig(ctx, config) {
         allowInsecureLoopbackForTesting,
         stateRoot,
         attachmentMaxBytes,
-        mailAttachmentMaxCount,
-        mailAttachmentMaxBytes,
-        mailAttachmentTotalMaxBytes,
         imageAttachmentCacheMaxBytes,
         pollIntervalMs,
-        ...profileName === undefined ? {} : { profileName, legacySharedStateDetected },
+        realtimeEnabled,
         listenerEnabled,
         listener: {
             allowedPeers,
@@ -321,48 +389,21 @@ function resolveConfig(ctx, config) {
             stateRoot,
         },
         summaryMaxInputBytes,
-        deriveUserServiceUrl: config.userServiceUrl === undefined,
-        deriveMessageServiceUrl: config.messageServiceUrl === undefined,
-        deriveMailServiceUrl: config.mailServiceUrl === undefined,
-        deriveMessageServicePublicUrl: config.messageServicePublicUrl === undefined,
-        deriveMessageServiceDid: config.messageServiceDid === undefined,
-        deriveAllowedAttachmentOrigins: config.allowedAttachmentOrigins === undefined
-            || config.allowedAttachmentOrigins.length === 0,
-    };
-}
-/** Resolve every tenant-sensitive endpoint and state path from one selected domain. */
-function activeTenantConfig(config, domain) {
-    const tenantOrigin = `https://${domain}`;
-    const userServiceUrl = config.deriveUserServiceUrl ? tenantOrigin : config.userServiceUrl;
-    const messageServiceUrl = config.deriveMessageServiceUrl ? tenantOrigin : config.messageServiceUrl;
-    const mailServiceUrl = config.deriveMailServiceUrl ? userServiceUrl : config.mailServiceUrl;
-    const messageServicePublicUrl = config.deriveMessageServicePublicUrl
-        ? tenantOrigin
-        : config.messageServicePublicUrl;
-    const messageServiceDid = config.deriveMessageServiceDid
-        ? `did:wba:${domain}`
-        : config.messageServiceDid;
-    const allowedAttachmentOrigins = config.deriveAllowedAttachmentOrigins
-        ? attachmentOrigins(undefined, messageServicePublicUrl, config.allowInsecureLoopbackForTesting)
-        : config.allowedAttachmentOrigins;
-    return {
-        domain,
-        userServiceUrl,
-        userServiceDomain: domain,
-        messageServiceUrl,
-        mailServiceUrl,
-        messageServicePublicUrl,
-        messageServiceDid,
-        allowedAttachmentOrigins,
-        attachmentMaxBytes: config.attachmentMaxBytes,
-        allowInsecureLoopbackForTesting: config.allowInsecureLoopbackForTesting,
-        stateRoot: resolveAwikiTenantStateRoot(config.stateRoot, domain, config.userServiceDomain),
     };
 }
 /** Return a public, fixed-message failure without retaining a thrown value. */
 function failure(code) {
     return { code, message: FAILURE_MESSAGES[code] };
 }
+function integrationUnavailable() {
+    return {
+        ok: false,
+        error: {
+            code: 'unavailable',
+            message: 'Guest messaging is not available for the active AWiki tenant.',
+        },
+    };
+}
 /** Normalize SDK and provider failures without returning remote bodies, credentials, or causes. */
 function normalizeFailure(error) {
     if (error instanceof ProviderUnavailableError) {
@@ -428,38 +469,6 @@ function normalizeGroupDid(value) {
         return undefined;
     return value;
 }
-/** Rebuild the browser-safe recovery DTO instead of trusting provider object shape. */
-function publicGroupRebindRecoverySummary(value) {
-    if (typeof value !== 'object' || value === null)
-        return undefined;
-    const candidate = value;
-    const counts = [candidate.processed, candidate.completed, candidate.pending, candidate.blocked];
-    if (counts.some(count => !Number.isSafeInteger(count) || count < 0 || count > 0xffff_ffff)) {
-        return undefined;
-    }
-    if (!Array.isArray(candidate.items) || candidate.items.length > 500)
-        return undefined;
-    const seen = new Set();
-    const items = [];
-    for (const value of candidate.items) {
-        if (typeof value !== 'object' || value === null)
-            return undefined;
-        const item = value;
-        const groupDid = normalizeGroupDid(item.groupDid);
-        if (groupDid === undefined || seen.has(groupDid) || (item.status !== 'pending' && item.status !== 'blocked')) {
-            return undefined;
-        }
-        seen.add(groupDid);
-        items.push({ groupDid, status: item.status });
-    }
-    return {
-        processed: candidate.processed,
-        completed: candidate.completed,
-        pending: candidate.pending,
-        blocked: candidate.blocked,
-        items,
-    };
-}
 function normalizeProfileRequest(request) {
     if (typeof request?.displayName !== 'string' || typeof request.bio !== 'string' || !Array.isArray(request.tags))
         return undefined;
@@ -510,6 +519,7 @@ function normalizeRecoveryPrepareRequest(request) {
     return { ...operation, phone, otp };
 }
 const IDENTITY_ACCESS_RESPONSE_MAX_BYTES = 64 * 1024;
+const SERVER_INFO_RESPONSE_MAX_BYTES = 64 * 1024;
 /** Read one untrusted discovery response without buffering beyond the fixed Host limit. */
 async function readBoundedResponseText(response, maxBytes) {
     const declaredLength = response.headers.get('content-length');
@@ -716,7 +726,7 @@ function decodeAttachment(bytesBase64, maxBytes) {
     const maxEncoded = Math.ceil(maxBytes / 3) * 4;
     if (bytesBase64.length > maxEncoded)
         return { ok: false, error: failure('attachment-too-large') };
-    if (bytesBase64.length % 4 !== 0 || !standardBase64Syntax(bytesBase64)) {
+    if (bytesBase64.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(bytesBase64)) {
         return { ok: false, error: failure('invalid-request') };
     }
     const bytes = Uint8Array.from(Buffer.from(bytesBase64, 'base64'));
@@ -731,6 +741,12 @@ let AwikiService = (() => {
     let _classSuper = TypertRemoteService;
     let _instanceExtraInitializers = [];
     let _getConfig_decorators;
+    let _getIntegration_decorators;
+    let _createIntegration_decorators;
+    let _updateIntegration_decorators;
+    let _rotateIntegrationId_decorators;
+    let _closeIntegration_decorators;
+    let _reopenIntegration_decorators;
     let _getIdentity_decorators;
     let _getSession_decorators;
     let _logout_decorators;
@@ -738,6 +754,18 @@ let AwikiService = (() => {
     let _inspectIdentityAccess_decorators;
     let _sendRegistrationOtp_decorators;
     let _registerIdentity_decorators;
+    let _retireDeviceIdentityForRejoin_decorators;
+    let _beginDeviceJoin_decorators;
+    let _getIdentityAccessState_decorators;
+    let _getDeviceJoinStatus_decorators;
+    let _cancelDeviceJoin_decorators;
+    let _refreshDeviceManagement_decorators;
+    let _startDeviceJoinVerification_decorators;
+    let _approveDeviceJoin_decorators;
+    let _rejectDeviceJoin_decorators;
+    let _revokeDevice_decorators;
+    let _prepareRootTransfer_decorators;
+    let _confirmRootTransfer_decorators;
     let _updateDisplayName_decorators;
     let _getProfile_decorators;
     let _updateProfile_decorators;
@@ -746,16 +774,17 @@ let AwikiService = (() => {
     let _activateRecovery_decorators;
     let _getRecoveryStatus_decorators;
     let _resumeRecovery_decorators;
+    let _enterRecoveredSession_decorators;
     let _discardRecovery_decorators;
     let _resolvePeer_decorators;
     let _createGroup_decorators;
     let _getGroup_decorators;
     let _joinGroup_decorators;
     let _leaveGroup_decorators;
+    let _getDisplayProfiles_decorators;
     let _listGroupMembers_decorators;
     let _addGroupMember_decorators;
     let _removeGroupMember_decorators;
-    let _resumeGroupRebindRecovery_decorators;
     let _getConversationPreferences_decorators;
     let _updateConversationPreference_decorators;
     let _listConversations_decorators;
@@ -771,12 +800,17 @@ let AwikiService = (() => {
     let _readMail_decorators;
     let _markMailRead_decorators;
     let _sendMail_decorators;
-    let _downloadMailAttachment_decorators;
     let _clearLocalData_decorators;
     return class AwikiService extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
             _getConfig_decorators = [Remote];
+            _getIntegration_decorators = [Remote];
+            _createIntegration_decorators = [Remote];
+            _updateIntegration_decorators = [Remote];
+            _rotateIntegrationId_decorators = [Remote];
+            _closeIntegration_decorators = [Remote];
+            _reopenIntegration_decorators = [Remote];
             _getIdentity_decorators = [Remote];
             _getSession_decorators = [Remote];
             _logout_decorators = [Remote];
@@ -784,6 +818,18 @@ let AwikiService = (() => {
             _inspectIdentityAccess_decorators = [Remote];
             _sendRegistrationOtp_decorators = [Remote];
             _registerIdentity_decorators = [Remote];
+            _retireDeviceIdentityForRejoin_decorators = [Remote];
+            _beginDeviceJoin_decorators = [Remote];
+            _getIdentityAccessState_decorators = [Remote];
+            _getDeviceJoinStatus_decorators = [Remote];
+            _cancelDeviceJoin_decorators = [Remote];
+            _refreshDeviceManagement_decorators = [Remote];
+            _startDeviceJoinVerification_decorators = [Remote];
+            _approveDeviceJoin_decorators = [Remote];
+            _rejectDeviceJoin_decorators = [Remote];
+            _revokeDevice_decorators = [Remote];
+            _prepareRootTransfer_decorators = [Remote];
+            _confirmRootTransfer_decorators = [Remote];
             _updateDisplayName_decorators = [Remote];
             _getProfile_decorators = [Remote];
             _updateProfile_decorators = [Remote];
@@ -792,16 +838,17 @@ let AwikiService = (() => {
             _activateRecovery_decorators = [Remote];
             _getRecoveryStatus_decorators = [Remote];
             _resumeRecovery_decorators = [Remote];
+            _enterRecoveredSession_decorators = [Remote];
             _discardRecovery_decorators = [Remote];
             _resolvePeer_decorators = [Remote];
             _createGroup_decorators = [Remote];
             _getGroup_decorators = [Remote];
             _joinGroup_decorators = [Remote];
             _leaveGroup_decorators = [Remote];
+            _getDisplayProfiles_decorators = [Remote];
             _listGroupMembers_decorators = [Remote];
             _addGroupMember_decorators = [Remote];
             _removeGroupMember_decorators = [Remote];
-            _resumeGroupRebindRecovery_decorators = [Remote];
             _getConversationPreferences_decorators = [Remote];
             _updateConversationPreference_decorators = [Remote];
             _listConversations_decorators = [Remote];
@@ -817,9 +864,14 @@ let AwikiService = (() => {
             _readMail_decorators = [Remote];
             _markMailRead_decorators = [Remote];
             _sendMail_decorators = [Remote];
-            _downloadMailAttachment_decorators = [Remote];
             _clearLocalData_decorators = [Remote];
             __esDecorate(this, null, _getConfig_decorators, { kind: "method", name: "getConfig", static: false, private: false, access: { has: obj => "getConfig" in obj, get: obj => obj.getConfig }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _getIntegration_decorators, { kind: "method", name: "getIntegration", static: false, private: false, access: { has: obj => "getIntegration" in obj, get: obj => obj.getIntegration }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _createIntegration_decorators, { kind: "method", name: "createIntegration", static: false, private: false, access: { has: obj => "createIntegration" in obj, get: obj => obj.createIntegration }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _updateIntegration_decorators, { kind: "method", name: "updateIntegration", static: false, private: false, access: { has: obj => "updateIntegration" in obj, get: obj => obj.updateIntegration }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _rotateIntegrationId_decorators, { kind: "method", name: "rotateIntegrationId", static: false, private: false, access: { has: obj => "rotateIntegrationId" in obj, get: obj => obj.rotateIntegrationId }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _closeIntegration_decorators, { kind: "method", name: "closeIntegration", static: false, private: false, access: { has: obj => "closeIntegration" in obj, get: obj => obj.closeIntegration }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _reopenIntegration_decorators, { kind: "method", name: "reopenIntegration", static: false, private: false, access: { has: obj => "reopenIntegration" in obj, get: obj => obj.reopenIntegration }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getIdentity_decorators, { kind: "method", name: "getIdentity", static: false, private: false, access: { has: obj => "getIdentity" in obj, get: obj => obj.getIdentity }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getSession_decorators, { kind: "method", name: "getSession", static: false, private: false, access: { has: obj => "getSession" in obj, get: obj => obj.getSession }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _logout_decorators, { kind: "method", name: "logout", static: false, private: false, access: { has: obj => "logout" in obj, get: obj => obj.logout }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -827,6 +879,18 @@ let AwikiService = (() => {
             __esDecorate(this, null, _inspectIdentityAccess_decorators, { kind: "method", name: "inspectIdentityAccess", static: false, private: false, access: { has: obj => "inspectIdentityAccess" in obj, get: obj => obj.inspectIdentityAccess }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _sendRegistrationOtp_decorators, { kind: "method", name: "sendRegistrationOtp", static: false, private: false, access: { has: obj => "sendRegistrationOtp" in obj, get: obj => obj.sendRegistrationOtp }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _registerIdentity_decorators, { kind: "method", name: "registerIdentity", static: false, private: false, access: { has: obj => "registerIdentity" in obj, get: obj => obj.registerIdentity }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _retireDeviceIdentityForRejoin_decorators, { kind: "method", name: "retireDeviceIdentityForRejoin", static: false, private: false, access: { has: obj => "retireDeviceIdentityForRejoin" in obj, get: obj => obj.retireDeviceIdentityForRejoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _beginDeviceJoin_decorators, { kind: "method", name: "beginDeviceJoin", static: false, private: false, access: { has: obj => "beginDeviceJoin" in obj, get: obj => obj.beginDeviceJoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _getIdentityAccessState_decorators, { kind: "method", name: "getIdentityAccessState", static: false, private: false, access: { has: obj => "getIdentityAccessState" in obj, get: obj => obj.getIdentityAccessState }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _getDeviceJoinStatus_decorators, { kind: "method", name: "getDeviceJoinStatus", static: false, private: false, access: { has: obj => "getDeviceJoinStatus" in obj, get: obj => obj.getDeviceJoinStatus }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _cancelDeviceJoin_decorators, { kind: "method", name: "cancelDeviceJoin", static: false, private: false, access: { has: obj => "cancelDeviceJoin" in obj, get: obj => obj.cancelDeviceJoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _refreshDeviceManagement_decorators, { kind: "method", name: "refreshDeviceManagement", static: false, private: false, access: { has: obj => "refreshDeviceManagement" in obj, get: obj => obj.refreshDeviceManagement }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _startDeviceJoinVerification_decorators, { kind: "method", name: "startDeviceJoinVerification", static: false, private: false, access: { has: obj => "startDeviceJoinVerification" in obj, get: obj => obj.startDeviceJoinVerification }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _approveDeviceJoin_decorators, { kind: "method", name: "approveDeviceJoin", static: false, private: false, access: { has: obj => "approveDeviceJoin" in obj, get: obj => obj.approveDeviceJoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _rejectDeviceJoin_decorators, { kind: "method", name: "rejectDeviceJoin", static: false, private: false, access: { has: obj => "rejectDeviceJoin" in obj, get: obj => obj.rejectDeviceJoin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _revokeDevice_decorators, { kind: "method", name: "revokeDevice", static: false, private: false, access: { has: obj => "revokeDevice" in obj, get: obj => obj.revokeDevice }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _prepareRootTransfer_decorators, { kind: "method", name: "prepareRootTransfer", static: false, private: false, access: { has: obj => "prepareRootTransfer" in obj, get: obj => obj.prepareRootTransfer }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _confirmRootTransfer_decorators, { kind: "method", name: "confirmRootTransfer", static: false, private: false, access: { has: obj => "confirmRootTransfer" in obj, get: obj => obj.confirmRootTransfer }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _updateDisplayName_decorators, { kind: "method", name: "updateDisplayName", static: false, private: false, access: { has: obj => "updateDisplayName" in obj, get: obj => obj.updateDisplayName }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getProfile_decorators, { kind: "method", name: "getProfile", static: false, private: false, access: { has: obj => "getProfile" in obj, get: obj => obj.getProfile }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _updateProfile_decorators, { kind: "method", name: "updateProfile", static: false, private: false, access: { has: obj => "updateProfile" in obj, get: obj => obj.updateProfile }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -835,16 +899,17 @@ let AwikiService = (() => {
             __esDecorate(this, null, _activateRecovery_decorators, { kind: "method", name: "activateRecovery", static: false, private: false, access: { has: obj => "activateRecovery" in obj, get: obj => obj.activateRecovery }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getRecoveryStatus_decorators, { kind: "method", name: "getRecoveryStatus", static: false, private: false, access: { has: obj => "getRecoveryStatus" in obj, get: obj => obj.getRecoveryStatus }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _resumeRecovery_decorators, { kind: "method", name: "resumeRecovery", static: false, private: false, access: { has: obj => "resumeRecovery" in obj, get: obj => obj.resumeRecovery }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _enterRecoveredSession_decorators, { kind: "method", name: "enterRecoveredSession", static: false, private: false, access: { has: obj => "enterRecoveredSession" in obj, get: obj => obj.enterRecoveredSession }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _discardRecovery_decorators, { kind: "method", name: "discardRecovery", static: false, private: false, access: { has: obj => "discardRecovery" in obj, get: obj => obj.discardRecovery }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _resolvePeer_decorators, { kind: "method", name: "resolvePeer", static: false, private: false, access: { has: obj => "resolvePeer" in obj, get: obj => obj.resolvePeer }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _createGroup_decorators, { kind: "method", name: "createGroup", static: false, private: false, access: { has: obj => "createGroup" in obj, get: obj => obj.createGroup }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getGroup_decorators, { kind: "method", name: "getGroup", static: false, private: false, access: { has: obj => "getGroup" in obj, get: obj => obj.getGroup }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _joinGroup_decorators, { kind: "method", name: "joinGroup", static: false, private: false, access: { has: obj => "joinGroup" in obj, get: obj => obj.joinGroup }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _leaveGroup_decorators, { kind: "method", name: "leaveGroup", static: false, private: false, access: { has: obj => "leaveGroup" in obj, get: obj => obj.leaveGroup }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _getDisplayProfiles_decorators, { kind: "method", name: "getDisplayProfiles", static: false, private: false, access: { has: obj => "getDisplayProfiles" in obj, get: obj => obj.getDisplayProfiles }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _listGroupMembers_decorators, { kind: "method", name: "listGroupMembers", static: false, private: false, access: { has: obj => "listGroupMembers" in obj, get: obj => obj.listGroupMembers }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _addGroupMember_decorators, { kind: "method", name: "addGroupMember", static: false, private: false, access: { has: obj => "addGroupMember" in obj, get: obj => obj.addGroupMember }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _removeGroupMember_decorators, { kind: "method", name: "removeGroupMember", static: false, private: false, access: { has: obj => "removeGroupMember" in obj, get: obj => obj.removeGroupMember }, metadata: _metadata }, null, _instanceExtraInitializers);
-            __esDecorate(this, null, _resumeGroupRebindRecovery_decorators, { kind: "method", name: "resumeGroupRebindRecovery", static: false, private: false, access: { has: obj => "resumeGroupRebindRecovery" in obj, get: obj => obj.resumeGroupRebindRecovery }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getConversationPreferences_decorators, { kind: "method", name: "getConversationPreferences", static: false, private: false, access: { has: obj => "getConversationPreferences" in obj, get: obj => obj.getConversationPreferences }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _updateConversationPreference_decorators, { kind: "method", name: "updateConversationPreference", static: false, private: false, access: { has: obj => "updateConversationPreference" in obj, get: obj => obj.updateConversationPreference }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _listConversations_decorators, { kind: "method", name: "listConversations", static: false, private: false, access: { has: obj => "listConversations" in obj, get: obj => obj.listConversations }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -860,28 +925,49 @@ let AwikiService = (() => {
             __esDecorate(this, null, _readMail_decorators, { kind: "method", name: "readMail", static: false, private: false, access: { has: obj => "readMail" in obj, get: obj => obj.readMail }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _markMailRead_decorators, { kind: "method", name: "markMailRead", static: false, private: false, access: { has: obj => "markMailRead" in obj, get: obj => obj.markMailRead }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _sendMail_decorators, { kind: "method", name: "sendMail", static: false, private: false, access: { has: obj => "sendMail" in obj, get: obj => obj.sendMail }, metadata: _metadata }, null, _instanceExtraInitializers);
-            __esDecorate(this, null, _downloadMailAttachment_decorators, { kind: "method", name: "downloadMailAttachment", static: false, private: false, access: { has: obj => "downloadMailAttachment" in obj, get: obj => obj.downloadMailAttachment }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _clearLocalData_decorators, { kind: "method", name: "clearLocalData", static: false, private: false, access: { has: obj => "clearLocalData" in obj, get: obj => obj.clearLocalData }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static inject = ['tools', 'settings'];
+        static inject = ['tools'];
         static Config = Config;
         resolved = __runInitializers(this, _instanceExtraInitializers);
-        tenantConfigCache;
-        tenantStateCache;
+        sessionStore;
+        imageAttachmentCache;
+        conversationPreferenceStore;
         startupUserServiceDomain;
         settingsProvider;
+        tenantRegistry;
+        activeTenant;
+        activeClientOptions;
+        clientFactory;
         provider;
+        runtimeGeneration = 0;
+        tenantSwitching = false;
+        tenantParticipants = new Set();
+        activeCapabilities;
+        updatePolicyStatus;
+        updatePolicyRequest;
+        updatePolicyTask;
+        updatePolicyTaskKey;
+        desktopDistribution;
         signedOut;
         sessionMutation = Promise.resolve();
         sessionRevision = 0;
         activeIdentityDid;
+        pendingDeviceJoin;
+        activeDeviceJoinSessionId;
+        requestRefs = new Map();
+        requestSessions = new Map();
+        deviceRefs = new Map();
+        deviceIds = new Map();
+        rootTransfers = new Map();
         activeSummaryRequests = new Set();
         summaryProvider;
-        recoveryReconciliationTarget;
         hostContext;
         /** Trusted same-process external HTTP authentication dispatcher. Never Remote. */
         externalHttpAuth;
+        integrationClient;
+        mailListClient;
         workspaceContext;
         /**
          * @param ctx - owning Host context.
@@ -893,39 +979,72 @@ let AwikiService = (() => {
             this.resolved = resolveConfig(ctx, config);
             this.externalHttpAuth = createAwikiExternalHttpAuth(() => this.acquireExternalHttpAuthSession());
             this.startupUserServiceDomain = this.resolved.userServiceDomain;
-            const provider = ctx.settings;
-            const settingsScope = provider.register(settingsNamespace(AWIKI_SETTINGS_NAMESPACE), AwikiSettingsSchema, {
-                base: { domain: this.resolved.userServiceDomain },
-                applies: 'restart',
-                validate: validateAwikiSettings,
+            ctx.inject(['settings'], (settingsCtx) => {
+                const provider = settingsCtx.settings;
+                const settingsScope = settingsCtx.settings.register(settingsNamespace(AWIKI_SETTINGS_NAMESPACE), AwikiSettingsSchema, {
+                    base: { domain: this.resolved.userServiceDomain },
+                    applies: 'restart',
+                    validate: validateAwikiSettings,
+                });
+                this.settingsProvider = provider;
+                this.startupUserServiceDomain = settingsScope.get().domain;
+                settingsCtx.effect(() => () => {
+                    if (this.settingsProvider === provider) {
+                        this.settingsProvider = undefined;
+                        this.startupUserServiceDomain = this.resolved.userServiceDomain;
+                    }
+                }, 'awiki: release settings namespace');
             });
-            this.settingsProvider = provider;
-            this.startupUserServiceDomain = settingsScope.get().domain;
-            ctx.effect(() => () => {
-                if (this.settingsProvider === provider) {
-                    this.settingsProvider = undefined;
-                    this.startupUserServiceDomain = this.resolved.userServiceDomain;
-                }
-            }, 'awiki: release settings namespace');
             ctx.inject(['connection'], (connectionCtx) => {
-                connectionCtx.connection.rpc.handle(AWIKI_SETTINGS_RPC_CHANNEL, createAwikiSettingsRpcHandler(() => this.settingsProvider), { authority: 'loopback' });
+                connectionCtx.connection.rpc.handle(AWIKI_SETTINGS_RPC_CHANNEL, createAwikiSettingsRpcHandler(() => this.settingsProvider, {
+                    describe: () => this.getTenantRegistryView(),
+                    create: (displayName, domain) => this.createCustomTenant(displayName, domain),
+                    rename: (tenantId, displayName) => this.renameCustomTenant(tenantId, displayName),
+                    switch: tenantId => this.switchTenant(tenantId),
+                    archive: tenantId => this.archiveCustomTenant(tenantId),
+                    describeUpdate: () => this.getUpdatePolicyStatus(),
+                    refreshUpdate: () => this.refreshUpdatePolicy(),
+                    describeDesktopUpdate: () => this.getDesktopUpdate(),
+                    refreshDesktopUpdate: () => this.refreshDesktopUpdate(),
+                }), { authority: 'loopback' });
             });
             ctx.inject(['workspaceRegistry'], (workspaceCtx) => {
                 this.workspaceContext = workspaceCtx;
                 const provider = this.provider;
                 if (provider !== undefined)
-                    void this.startListener(provider);
+                    this.ensureAgentConsumer(provider);
                 workspaceCtx.effect(() => async () => {
                     if (this.workspaceContext !== workspaceCtx)
                         return;
                     this.workspaceContext = undefined;
                     const current = this.provider;
                     if (current !== undefined)
-                        await this.stopListener(current);
+                        await this.stopAgentConsumer(current);
                 }, 'awiki: release Workspace listener composition');
             });
+            ctx.inject(['desktopDistribution'], desktopCtx => {
+                const service = desktopCtx.get('desktopDistribution');
+                if (typeof service !== 'object' || service === null
+                    || !('getSnapshot' in service) || typeof service.getSnapshot !== 'function'
+                    || !('check' in service) || typeof service.check !== 'function')
+                    return;
+                const candidate = service;
+                if (decodeDesktopDistribution(candidate.getSnapshot()) === undefined)
+                    return;
+                this.desktopDistribution = candidate;
+                desktopCtx.effect(() => () => {
+                    if (this.desktopDistribution === candidate)
+                        this.desktopDistribution = undefined;
+                });
+            });
+            ctx.effect(() => {
+                const timer = setInterval(() => { void this.refreshUpdatePolicy().catch(() => undefined); }, 6 * 60 * 60 * 1000);
+                timer.unref();
+                return () => { clearInterval(timer); };
+            });
             registerAwikiTools(ctx, this);
             ctx.effect(() => async () => {
+                this.updatePolicyRequest?.abort();
                 const provider = this.provider;
                 if (provider !== undefined)
                     await this.disposeProvider(provider);
@@ -942,36 +1061,351 @@ let AwikiService = (() => {
          * @returns asynchronous disposer for the exact registered client.
          */
         registerClientFactory(factory) {
-            if (this.provider !== undefined)
+            if (this.clientFactory !== undefined || this.provider !== undefined) {
                 throw new Error('awiki: a client provider is already registered');
-            const client = factory(this.activeTenant());
+            }
+            this.clientFactory = factory;
+            try {
+                this.openTenantProvider(this.ensureTenantRegistry().active(), factory);
+            }
+            catch (error) {
+                this.clientFactory = undefined;
+                throw error;
+            }
+            let active = true;
+            return async () => {
+                if (!active)
+                    return;
+                active = false;
+                this.clientFactory = undefined;
+                const current = this.provider;
+                if (current !== undefined)
+                    await this.disposeProvider(current);
+            };
+        }
+        ensureTenantRegistry() {
+            if (this.tenantRegistry !== undefined)
+                return this.tenantRegistry;
+            const domain = this.startupUserServiceDomain;
+            const configuredOrigin = `https://${this.resolved.userServiceDomain}`;
+            const tenantOrigin = `https://${domain}`;
+            const derive = (value) => value.replace(/\/$/u, '') === configuredOrigin ? tenantOrigin : value;
+            const seed = {
+                domain,
+                configured: domain !== DEFAULT_AWIKI_DOMAIN
+                    || this.resolved.userServiceUrl.replace(/\/$/u, '') !== configuredOrigin
+                    || this.resolved.messageServiceUrl.replace(/\/$/u, '') !== configuredOrigin,
+                ...this.resolved.legacyTenantSlot === undefined
+                    ? {}
+                    : { legacyTenantSlot: this.resolved.legacyTenantSlot },
+                userServiceUrl: derive(this.resolved.userServiceUrl),
+                messageServiceUrl: derive(this.resolved.messageServiceUrl),
+                mailServiceUrl: derive(this.resolved.mailServiceUrl),
+                messageServicePublicUrl: derive(this.resolved.messageServicePublicUrl),
+                messageServiceDid: this.resolved.messageServiceDid === `did:wba:${this.resolved.userServiceDomain}`
+                    ? `did:wba:${domain}`
+                    : this.resolved.messageServiceDid,
+            };
+            this.tenantRegistry = AwikiTenantRegistry.open(this.resolved.stateRoot, seed);
+            return this.tenantRegistry;
+        }
+        optionsForTenant(tenant) {
+            const endpoints = tenant.endpoints;
+            const messageServicePublicOrigin = new URL(endpoints.messageServicePublicUrl).origin;
+            return {
+                ...endpoints,
+                userServiceDomain: tenant.didHost,
+                allowedAttachmentOrigins: tenant.storageLayout === 'legacy-base'
+                    ? this.resolved.allowedAttachmentOrigins
+                    : [messageServicePublicOrigin],
+                attachmentMaxBytes: this.resolved.attachmentMaxBytes,
+                allowInsecureLoopbackForTesting: this.resolved.allowInsecureLoopbackForTesting,
+                stateRoot: this.ensureTenantRegistry().stateRoot(tenant),
+            };
+        }
+        ensureTenantOptions() {
+            if (this.activeClientOptions !== undefined)
+                return this.activeClientOptions;
+            const tenant = this.ensureTenantRegistry().active();
+            const options = this.optionsForTenant(tenant);
+            this.bindTenantState(tenant, options);
+            return options;
+        }
+        bindTenantState(tenant, options) {
+            this.updatePolicyRequest?.abort();
+            this.updatePolicyStatus = undefined;
+            this.updatePolicyTask = undefined;
+            this.activeTenant = tenant;
+            this.activeClientOptions = options;
+            this.startupUserServiceDomain = tenant.didHost;
+            this.sessionStore = new AwikiSessionStore(options.stateRoot);
+            this.imageAttachmentCache = new AwikiImageAttachmentCache(options.stateRoot, this.resolved.attachmentMaxBytes, this.resolved.imageAttachmentCacheMaxBytes);
+            this.conversationPreferenceStore = new AwikiConversationPreferenceStore(options.stateRoot);
+            this.mailListClient = new AwikiMailListClient(options.mailServiceUrl, this.externalHttpAuth);
+            this.integrationClient = undefined;
+            this.activeCapabilities = {
+                tenantId: tenant.tenantId,
+                generation: this.runtimeGeneration,
+                online: false,
+                handleRecoveryPhoneEnabled: false,
+            };
+            this.signedOut = undefined;
+            this.activeIdentityDid = undefined;
+            this.pendingDeviceJoin = undefined;
+            this.activeDeviceJoinSessionId = undefined;
+        }
+        openTenantProvider(tenant, factory, startRuntime = true) {
+            const options = this.optionsForTenant(tenant);
+            const client = factory(options);
             const provider = {
                 client,
-                listenerRestartAttempt: 0,
-                listenerGeneration: 0,
-                listenerRecoveryBlocked: false,
+                realtimeGeneration: 0,
+                agentConsumerGeneration: 0,
+                localDeviceJoinRequestCountAfterSync: 0,
             };
+            this.bindTenantState(tenant, options);
             this.provider = provider;
-            void this.startListener(provider);
-            return () => this.disposeProvider(provider);
+            void this.refreshUpdatePolicy().catch(() => undefined);
+            if (startRuntime)
+                this.ensureProviderRuntime(provider);
+            return provider;
+        }
+        /** Read the Host-owned catalog for trusted loopback settings surfaces. */
+        getTenantRegistryView() {
+            return this.ensureTenantRegistry().snapshot(this.tenantSwitching);
+        }
+        /** Browser-safe, same-process update state for Desktop and loopback settings. */
+        getUpdatePolicyStatus() {
+            const tenant = this.activeTenant ?? this.ensureTenantRegistry().active();
+            const modelProxyVersion = this.currentModelProxyVersion();
+            return this.updatePolicyStatus ?? readAwikiUpdatePolicyStatus({
+                tenant, generation: this.runtimeGeneration, stateRoot: this.resolved.stateRoot,
+                currentPluginVersion: DSH_AWIKI_VERSION,
+                ...modelProxyVersion === undefined ? {} : { currentModelProxyVersion: modelProxyVersion },
+            });
         }
-        /** Register the optional Model Proxy recovery target without exposing an arbitrary callback or token. */
-        registerRecoveryReconciliationTarget(target) {
-            if (this.recoveryReconciliationTarget !== undefined) {
-                throw new Error('awiki: a recovery reconciliation target is already registered');
-            }
-            const registered = Object.freeze({
-                endpoint: recoveryReconciliationEndpoint(target, this.resolved.allowInsecureLoopbackForTesting),
+        /** Only the Desktop provider owns its release source; tenants cannot override it. */
+        getDesktopUpdate() {
+            return decodeDesktopDistribution(this.desktopDistribution?.getSnapshot());
+        }
+        async refreshDesktopUpdate() {
+            const provider = this.desktopDistribution;
+            if (provider === undefined)
+                return undefined;
+            const value = await provider.check();
+            return provider === this.desktopDistribution ? decodeDesktopDistribution(value) : this.getDesktopUpdate();
+        }
+        /** Refresh only the active generation; late results from old tenants are discarded. */
+        refreshUpdatePolicy() {
+            const key = JSON.stringify([this.runtimeGeneration, this.currentModelProxyVersion()]);
+            if (this.updatePolicyTask !== undefined && this.updatePolicyTaskKey === key)
+                return this.updatePolicyTask;
+            const task = this.performUpdatePolicyRefresh().finally(() => {
+                if (this.updatePolicyTask === task)
+                    this.updatePolicyTask = undefined;
             });
-            this.recoveryReconciliationTarget = registered;
+            this.updatePolicyTask = task;
+            this.updatePolicyTaskKey = key;
+            return task;
+        }
+        async performUpdatePolicyRefresh() {
+            const tenant = this.activeTenant ?? this.ensureTenantRegistry().active();
+            const generation = this.runtimeGeneration;
+            this.updatePolicyRequest?.abort();
+            const request = new AbortController();
+            this.updatePolicyRequest = request;
+            const currentModelProxyVersion = this.currentModelProxyVersion();
+            const status = await checkAwikiUpdatePolicy({
+                tenant,
+                generation,
+                stateRoot: this.resolved.stateRoot,
+                currentPluginVersion: DSH_AWIKI_VERSION,
+                ...currentModelProxyVersion === undefined ? {} : { currentModelProxyVersion },
+                allowInsecureLoopback: this.resolved.allowInsecureLoopbackForTesting,
+                signal: request.signal,
+            });
+            if (this.updatePolicyRequest === request
+                && this.runtimeGeneration === generation
+                && this.activeTenant?.tenantId === tenant.tenantId) {
+                const wasRestricted = this.getUpdatePolicyStatus().restricted;
+                this.updatePolicyStatus = status;
+                this.hostContext.emit('awiki/update-policy', status);
+                if (status.restricted) {
+                    this.invalidateSummaries();
+                    const provider = this.provider;
+                    if (provider !== undefined) {
+                        try {
+                            await this.stopProviderRuntime(provider);
+                        }
+                        catch (error) {
+                            this.ctx.logger('awiki-update').warn('AWiki restricted-version runtime shutdown failed: %s', error instanceof Error ? error.message : 'unknown failure');
+                        }
+                    }
+                }
+                else if (wasRestricted && this.provider !== undefined && !this.tenantSwitching) {
+                    this.ensureProviderRuntime(this.provider);
+                }
+            }
+            return this.getUpdatePolicyStatus();
+        }
+        currentModelProxyVersion() {
+            for (const participant of this.tenantParticipants) {
+                if (participant.component?.product === 'dsh-awiki-model-proxy')
+                    return participant.component.version;
+            }
+            return undefined;
+        }
+        createCustomTenant(displayName, domain) {
+            this.assertVersionSupported();
+            this.ensureTenantRegistry().createCustom(displayName, domain);
+            return this.getTenantRegistryView();
+        }
+        renameCustomTenant(tenantId, displayName) {
+            this.assertVersionSupported();
+            this.ensureTenantRegistry().renameCustom(tenantId, displayName);
+            return this.getTenantRegistryView();
+        }
+        archiveCustomTenant(tenantId) {
+            this.assertVersionSupported();
+            this.ensureTenantRegistry().archiveCustom(tenantId);
+            return this.getTenantRegistryView();
+        }
+        /** Register one same-process resource owner in every transactional tenant change. */
+        registerTenantLifecycleParticipant(participant) {
+            if (this.tenantParticipants.has(participant))
+                throw new Error('awiki: tenant lifecycle participant is already registered');
+            this.tenantParticipants.add(participant);
+            if (participant.component !== undefined)
+                this.updatePolicyStatus = undefined;
+            void this.refreshUpdatePolicy().catch(() => undefined);
             let active = true;
             return () => {
                 if (!active)
                     return;
                 active = false;
-                if (this.recoveryReconciliationTarget === registered) {
-                    this.recoveryReconciliationTarget = undefined;
+                this.tenantParticipants.delete(participant);
+                if (participant.component !== undefined)
+                    this.updatePolicyStatus = undefined;
+                void this.refreshUpdatePolicy().catch(() => undefined);
+            };
+        }
+        /** Replace the complete Core runtime and commit the active tenant only after opening succeeds. */
+        async switchTenant(tenantId) {
+            if (this.tenantSwitching)
+                throw new Error('awiki: a tenant switch is already in progress');
+            const registry = this.ensureTenantRegistry();
+            const previousTenant = registry.active();
+            if (previousTenant.tenantId === tenantId)
+                return this.getTenantRegistryView();
+            const target = registry.find(tenantId);
+            if (target === undefined || target.lifecycle === 'archived')
+                throw new Error('awiki: target tenant is unavailable');
+            const factory = this.clientFactory;
+            const previousProvider = this.provider;
+            if (factory === undefined || previousProvider === undefined)
+                throw new Error('awiki: client provider is unavailable');
+            this.tenantSwitching = true;
+            this.updatePolicyRequest?.abort();
+            this.updatePolicyTask = undefined;
+            const context = {
+                from: previousTenant,
+                to: target,
+                generation: ++this.runtimeGeneration,
+            };
+            const prepared = [];
+            let targetOpened = false;
+            let committed = false;
+            try {
+                await this.sessionMutation;
+                this.invalidateSummaries();
+                for (const participant of this.tenantParticipants) {
+                    await participant.prepareSwitch(context);
+                    prepared.push(participant);
+                }
+                await this.disposeProvider(previousProvider);
+                const targetProvider = this.openTenantProvider(target, factory, false);
+                targetOpened = true;
+                // The factory returns an adapter immediately; its native Core opens asynchronously.
+                // A local identity read proves both open and Registry loading before committing the switch.
+                await targetProvider.client.getIdentity();
+                await Promise.all([this.discoverTenantCapabilities(3_000), this.refreshUpdatePolicy()]);
+                registry.commitActive(target.tenantId);
+                committed = true;
+                for (const participant of prepared)
+                    await participant.commitSwitch?.(context);
+                this.tenantSwitching = false;
+                this.ensureProviderRuntime(targetProvider);
+                const view = this.getTenantRegistryView();
+                this.hostContext.emit('awiki/tenant', view);
+                return view;
+            }
+            catch (error) {
+                const rollbackFailures = [];
+                if (targetOpened) {
+                    const current = this.provider;
+                    if (current !== undefined) {
+                        try {
+                            await this.disposeProvider(current);
+                        }
+                        catch (rollbackError) {
+                            rollbackFailures.push(rollbackError);
+                        }
+                    }
+                }
+                if (committed) {
+                    try {
+                        registry.commitActive(previousTenant.tenantId);
+                    }
+                    catch (rollbackError) {
+                        rollbackFailures.push(rollbackError);
+                    }
+                }
+                if (this.provider === undefined) {
+                    try {
+                        const restored = this.openTenantProvider(previousTenant, factory, false);
+                        await restored.client.getIdentity();
+                        this.ensureProviderRuntime(restored);
+                    }
+                    catch (rollbackError) {
+                        rollbackFailures.push(rollbackError);
+                    }
                 }
+                for (const participant of prepared.reverse()) {
+                    try {
+                        await participant.rollbackSwitch?.(context);
+                    }
+                    catch (rollbackError) {
+                        rollbackFailures.push(rollbackError);
+                    }
+                }
+                if (rollbackFailures.length > 0) {
+                    throw new AggregateError([error, ...rollbackFailures], 'awiki: tenant switch failed and rollback was incomplete');
+                }
+                this.tenantSwitching = false;
+                if (this.provider !== undefined)
+                    this.ensureProviderRuntime(this.provider);
+                throw new Error('awiki: tenant switch failed; the previous tenant was restored', { cause: error });
+            }
+            finally {
+                this.tenantSwitching = false;
+            }
+        }
+        /** Safe same-process diagnostics for focused E2E. Never exposed through Typert Remote. */
+        getRealtimeDiagnostics() {
+            const provider = this.provider;
+            const realtime = provider?.realtimeSupervisor?.diagnostics() ?? {
+                connected: false,
+                activeSessionCount: 0,
+                startCount: 0,
+                stopCount: 0,
+                maxActiveSessionCount: 0,
+                generation: 0,
+                retryCount: 0,
+                lifecyclePhase: 'idle',
+            };
+            return {
+                ...realtime,
+                localDeviceJoinRequestCountAfterSync: provider?.localDeviceJoinRequestCountAfterSync ?? 0,
             };
         }
         /** Register one replaceable conversation-summary provider for this deployment. */
@@ -992,58 +1426,145 @@ let AwikiService = (() => {
          * Read settings needed by the browser presentation.
          * @returns Browser-safe polling configuration without SDK endpoints or state paths.
          */
-        getConfig() {
-            return Promise.resolve({
+        async getConfig() {
+            this.ensureTenantOptions();
+            const capabilities = await this.discoverTenantCapabilities(10_000);
+            if (this.tenantSwitching
+                || capabilities.generation !== this.runtimeGeneration
+                || capabilities.tenantId !== this.activeTenant?.tenantId) {
+                return { ok: false, error: failure('conflict') };
+            }
+            return {
                 ok: true,
                 value: {
-                    tenantDomain: this.activeTenant().domain,
                     pollIntervalMs: this.resolved.pollIntervalMs,
                     attachmentMaxBytes: this.resolved.attachmentMaxBytes,
-                    mailAttachmentMaxCount: this.resolved.mailAttachmentMaxCount,
-                    mailAttachmentMaxBytes: this.resolved.mailAttachmentMaxBytes,
-                    mailAttachmentTotalMaxBytes: this.resolved.mailAttachmentTotalMaxBytes,
-                    ...this.resolved.profileName === undefined ? {} : {
-                        profileName: this.resolved.profileName,
-                        legacySharedStateDetected: this.resolved.legacySharedStateDetected,
+                    handleRecoveryPhoneEnabled: capabilities.handleRecoveryPhoneEnabled,
+                    ...capabilities.guestGatewayBaseUrl === undefined
+                        ? {}
+                        : { integrationGuideUrl: new URL('/guest/guide/integration', capabilities.guestGatewayBaseUrl).toString() },
+                    tenantId: capabilities.tenantId,
+                    tenantGeneration: capabilities.generation,
+                    tenantOnline: capabilities.online,
+                    services: {
+                        modelProxy: { enabled: capabilities.modelProxyBaseUrl !== undefined },
+                        guestGateway: { enabled: capabilities.guestGatewayBaseUrl !== undefined },
                     },
                 },
-            });
-        }
-        activeTenant() {
-            const cached = this.tenantConfigCache;
-            if (cached !== undefined)
-                return cached;
-            const value = Object.freeze(activeTenantConfig(this.resolved, this.startupUserServiceDomain));
-            this.tenantConfigCache = value;
-            return value;
-        }
-        activeTenantState() {
-            const cached = this.tenantStateCache;
-            if (cached !== undefined)
-                return cached;
-            const tenant = this.activeTenant();
-            const value = Object.freeze({
-                domain: tenant.domain,
-                stateRoot: tenant.stateRoot,
-                sessionStore: new AwikiSessionStore(tenant.stateRoot),
-                imageAttachmentCache: new AwikiImageAttachmentCache(tenant.stateRoot, this.resolved.attachmentMaxBytes, this.resolved.imageAttachmentCacheMaxBytes),
-                sentMailStore: new AwikiSentMailStore(tenant.stateRoot),
-                conversationPreferenceStore: new AwikiConversationPreferenceStore(tenant.stateRoot),
-            });
-            this.tenantStateCache = value;
-            return value;
-        }
-        get sessionStore() {
-            return this.activeTenantState().sessionStore;
-        }
-        get imageAttachmentCache() {
-            return this.activeTenantState().imageAttachmentCache;
+            };
         }
-        get sentMailStore() {
-            return this.activeTenantState().sentMailStore;
+        /** Trusted same-process capability binding for optional tenant participants. */
+        getTenantCapabilities() {
+            const capabilities = this.activeCapabilities;
+            if (capabilities === undefined)
+                throw new Error('awiki: tenant capabilities are unavailable');
+            return { ...capabilities };
+        }
+        /** Refresh the active tenant's optional service advertisement without affecting Core availability. */
+        refreshTenantCapabilities() {
+            this.ensureTenantOptions();
+            return this.discoverTenantCapabilities(10_000);
+        }
+        async discoverTenantCapabilities(timeoutMs) {
+            const options = this.activeClientOptions;
+            const tenant = this.activeTenant;
+            if (options === undefined || tenant === undefined)
+                throw new ProviderUnavailableError();
+            const generation = this.runtimeGeneration;
+            const fallback = {
+                tenantId: tenant.tenantId,
+                generation,
+                online: false,
+                handleRecoveryPhoneEnabled: false,
+            };
+            const publish = (capabilities) => {
+                if (this.runtimeGeneration === generation && this.activeTenant?.tenantId === tenant.tenantId) {
+                    this.activeCapabilities = capabilities;
+                    this.integrationClient = capabilities.guestGatewayBaseUrl === undefined
+                        ? undefined
+                        : new AwikiIntegrationClient(capabilities.guestGatewayBaseUrl, this.externalHttpAuth);
+                }
+                return capabilities;
+            };
+            const abort = new AbortController();
+            const timeout = setTimeout(() => { abort.abort(); }, timeoutMs);
+            try {
+                const endpoint = new URL('/user-service/v1/server-info', options.userServiceUrl);
+                endpoint.searchParams.set('client_platform', 'dsh');
+                const response = await fetch(endpoint, {
+                    method: 'GET',
+                    headers: { accept: 'application/json', 'cache-control': 'no-store' },
+                    cache: 'no-store',
+                    redirect: 'error',
+                    signal: abort.signal,
+                });
+                if (!response.ok)
+                    return publish(fallback);
+                const text = await readBoundedResponseText(response, SERVER_INFO_RESPONSE_MAX_BYTES);
+                const value = text === undefined ? undefined : JSON.parse(text);
+                if (typeof value !== 'object' || value === null || value.schema_version !== 1)
+                    return publish(fallback);
+                const methods = value.identity?.handle_recovery?.methods;
+                const handleRecoveryPhoneEnabled = Array.isArray(methods) && methods.some((method) => (typeof method === 'object' && method !== null
+                    && method.id === 'phone'
+                    && method.enabled === true
+                    && method.verification?.required === true
+                    && method.verification?.type === 'sms_otp'));
+                const services = value.services;
+                const modelProxyBaseUrl = publishedServiceBaseUrl(services, 'model_proxy', this.resolved.allowInsecureLoopbackForTesting);
+                const guestGatewayBaseUrl = publishedServiceBaseUrl(services, 'guest_gateway', false);
+                const capabilities = {
+                    tenantId: tenant.tenantId,
+                    generation,
+                    online: true,
+                    handleRecoveryPhoneEnabled,
+                    ...modelProxyBaseUrl === undefined ? {} : { modelProxyBaseUrl },
+                    ...guestGatewayBaseUrl === undefined ? {} : { guestGatewayBaseUrl },
+                };
+                return publish(capabilities);
+            }
+            catch {
+                return publish(fallback);
+            }
+            finally {
+                clearTimeout(timeout);
+            }
         }
-        get conversationPreferenceStore() {
-            return this.activeTenantState().conversationPreferenceStore;
+        /** Read the Integration owned by the active full Handle through the fixed Host client. */
+        getIntegration() {
+            if (this.getUpdatePolicyStatus().restricted)
+                return Promise.resolve(integrationUnavailable());
+            return this.integrationClient?.read() ?? Promise.resolve(integrationUnavailable());
+        }
+        /** Create the active full Handle's only Integration. */
+        createIntegration(request) {
+            if (this.getUpdatePolicyStatus().restricted)
+                return Promise.resolve(integrationUnavailable());
+            return this.integrationClient?.create(request) ?? Promise.resolve(integrationUnavailable());
+        }
+        /** Update editable Integration fields with optimistic concurrency. */
+        updateIntegration(request) {
+            if (this.getUpdatePolicyStatus().restricted)
+                return Promise.resolve(integrationUnavailable());
+            return this.integrationClient?.update(request) ?? Promise.resolve(integrationUnavailable());
+        }
+        /** Atomically replace the current public Integration id. */
+        rotateIntegrationId(request) {
+            if (this.getUpdatePolicyStatus().restricted)
+                return Promise.resolve(integrationUnavailable());
+            return this.integrationClient?.rotate(request) ?? Promise.resolve(integrationUnavailable());
+        }
+        /** Close the Integration and revoke its current public id. */
+        closeIntegration(request) {
+            if (this.getUpdatePolicyStatus().restricted)
+                return Promise.resolve(integrationUnavailable());
+            return this.integrationClient?.close(request) ?? Promise.resolve(integrationUnavailable());
+        }
+        /** Revalidate one closed Integration and issue a new public id. */
+        reopenIntegration(request) {
+            if (this.getUpdatePolicyStatus().restricted)
+                return Promise.resolve(integrationUnavailable());
+            return this.integrationClient?.reopen(request) ?? Promise.resolve(integrationUnavailable());
         }
         /**
          * Read the deployment's identity status.
@@ -1065,6 +1586,9 @@ let AwikiService = (() => {
             if (!identity.ok)
                 return identity;
             this.activeIdentityDid = identity.value?.did;
+            const provider = this.provider;
+            if (identity.value !== null && provider !== undefined)
+                this.ensureProviderRuntime(provider);
             return identity.value === null
                 ? { ok: true, value: { status: 'unregistered' } }
                 : { ok: true, value: { status: 'active', identity: identity.value } };
@@ -1074,6 +1598,8 @@ let AwikiService = (() => {
             if (request?.confirmation !== AWIKI_LOGOUT_CONFIRMATION) {
                 return Promise.resolve({ ok: false, error: failure('invalid-request') });
             }
+            // Fence pending post-Recovery work before the serialized sign-out reaches the head of the queue.
+            this.sessionRevision += 1;
             return this.mutateSession(async () => {
                 if (await this.isSignedOut())
                     return { ok: true, value: { status: 'signed-out' } };
@@ -1091,7 +1617,7 @@ let AwikiService = (() => {
                     this.publishSession(session);
                     const provider = this.provider;
                     if (provider !== undefined)
-                        await this.stopListener(provider);
+                        await this.stopProviderRuntime(provider);
                     return { ok: true, value: session };
                 }
                 catch {
@@ -1116,7 +1642,7 @@ let AwikiService = (() => {
                     this.publishSession(session);
                     const provider = this.provider;
                     if (provider !== undefined)
-                        void this.startListener(provider);
+                        this.ensureProviderRuntime(provider);
                     return { ok: true, value: session };
                 }
                 catch {
@@ -1126,10 +1652,13 @@ let AwikiService = (() => {
         }
         /** Classify one configured-domain Handle before selecting the registration or recovery OTP purpose. */
         async inspectIdentityAccess(request) {
-            const target = identityAccessTarget(request, this.startupUserServiceDomain);
+            const options = this.activeClientOptions;
+            if (options === undefined)
+                return { ok: false, error: normalizeFailure(new ProviderUnavailableError()) };
+            const target = identityAccessTarget(request, options.userServiceDomain);
             if (target === undefined)
                 return { ok: false, error: failure('invalid-request') };
-            const endpoint = new URL(`/.well-known/handle/${encodeURIComponent(target.localPart)}`, this.activeTenant().userServiceUrl);
+            const endpoint = new URL(`/.well-known/handle/${encodeURIComponent(target.localPart)}`, options.userServiceUrl);
             const abort = new AbortController();
             const timeout = setTimeout(() => { abort.abort(); }, 10_000);
             let response;
@@ -1174,8 +1703,14 @@ let AwikiService = (() => {
                 return { ok: false, error: failure('remote') };
             }
         }
-        sendRegistrationOtp(request) {
-            return this.run(client => client.sendRegistrationOtp(request));
+        async sendRegistrationOtp(request) {
+            this.pendingDeviceJoin = undefined;
+            return this.run(async (client) => {
+                if (await this.selectDeviceJoinSession(client) !== null) {
+                    throw Object.assign(new Error('join already exists'), { name: 'AwikiSdkError', code: 'conflict' });
+                }
+                return client.sendRegistrationOtp(request);
+            });
         }
         /**
          * Register and persist the deployment's only AWiki identity.
@@ -1183,10 +1718,306 @@ let AwikiService = (() => {
          * @returns The new public identity or a closed failure.
          */
         async registerIdentity(request) {
-            const result = await this.run(client => client.registerIdentity(request));
-            if (result.ok)
-                await this.activateRegisteredIdentity(result.value);
-            return result;
+            this.pendingDeviceJoin = undefined;
+            const result = await this.run(async (client) => {
+                if (await this.selectDeviceJoinSession(client) !== null) {
+                    throw Object.assign(new Error('join already exists'), { name: 'AwikiSdkError', code: 'conflict' });
+                }
+                return client.registerIdentity(request);
+            });
+            if (!result.ok)
+                return result;
+            if (result.value.status === 'registered') {
+                await this.activateRegisteredIdentity(result.value.identity);
+                return { ok: true, value: { status: 'registered', identity: result.value.identity } };
+            }
+            this.pendingDeviceJoin = {
+                continuationId: result.value.continuationId,
+                fullHandle: result.value.fullHandle,
+                mode: result.value.mode,
+                requiresUserPresence: result.value.requiresUserPresence,
+            };
+            return {
+                ok: true,
+                value: {
+                    status: 'join-required',
+                    fullHandle: result.value.fullHandle,
+                    mode: result.value.mode,
+                    requiresUserPresence: result.value.requiresUserPresence,
+                },
+            };
+        }
+        /** Retire only this revoked device credential; ordinary local messages remain for the rejoined identity. */
+        retireDeviceIdentityForRejoin() {
+            return this.mutateSession(async () => {
+                const provider = this.provider;
+                if (provider !== undefined)
+                    await this.stopProviderRuntime(provider);
+                const result = await this.run(client => client.retireDefaultIdentityForRejoin(), { allowSignedOut: true });
+                if (!result.ok) {
+                    if (provider !== undefined && this.provider === provider)
+                        this.ensureProviderRuntime(provider);
+                    return result;
+                }
+                try {
+                    await this.sessionStore.signIn();
+                }
+                catch {
+                    try {
+                        await this.sessionStore.signIn();
+                    }
+                    catch {
+                        this.ctx.logger('awiki').warn('AWiki local session marker could not be refreshed after device retirement');
+                    }
+                }
+                this.signedOut = false;
+                this.activeIdentityDid = undefined;
+                this.pendingDeviceJoin = undefined;
+                this.activeDeviceJoinSessionId = undefined;
+                this.invalidateSummaries();
+                this.publishSession({ status: 'unregistered' });
+                return { ok: true, value: { completed: true } };
+            });
+        }
+        /** Consume the exact in-memory continuation; ordinary Join never claims rebind user presence. */
+        async beginDeviceJoin() {
+            const continuation = this.pendingDeviceJoin;
+            if (continuation === undefined)
+                return { ok: false, error: failure('conflict') };
+            if ((continuation.mode === 'ordinary' && continuation.requiresUserPresence)
+                || (continuation.mode === 'handle-recovery-rebind' && !continuation.requiresUserPresence)) {
+                return { ok: false, error: failure('forbidden') };
+            }
+            const result = await this.run(async (client) => {
+                let userPresenceConfirmed = false;
+                if (continuation.mode === 'handle-recovery-rebind') {
+                    if (!client.trustedUserPresenceSupported) {
+                        throw Object.assign(new Error('trusted user presence unsupported'), { name: 'AwikiSdkError', code: 'forbidden' });
+                    }
+                    userPresenceConfirmed = await client.confirmUserPresence('Rejoin your recovered AWiki identity on this device');
+                    if (!userPresenceConfirmed) {
+                        throw Object.assign(new Error('user presence denied'), { name: 'AwikiSdkError', code: 'forbidden' });
+                    }
+                }
+                this.pendingDeviceJoin = undefined;
+                return client.beginDeviceJoin({
+                    continuationId: continuation.continuationId,
+                    operationId: `dsh-device-join-${randomUUID()}`,
+                    userPresenceConfirmed,
+                });
+            });
+            if (!result.ok)
+                return result;
+            this.activeDeviceJoinSessionId = result.value.joinSessionId;
+            return this.applyCandidateJoinProgress(result.value);
+        }
+        /** Read local workflow authority before offering a new login. No remote mutations. */
+        getIdentityAccessState() {
+            return this.run(async (client) => {
+                const joining = await this.selectDeviceJoinSession(client) !== null;
+                const recoveries = await client.listPendingRecoveries();
+                const domain = this.activeClientOptions?.userServiceDomain;
+                const choice = this.pendingDeviceJoin;
+                return {
+                    choice: joining || choice === undefined ? null : {
+                        status: 'join-required',
+                        fullHandle: choice.fullHandle,
+                        mode: choice.mode, requiresUserPresence: choice.requiresUserPresence,
+                    },
+                    joining,
+                    recoveries: recoveries.filter(value => domain !== undefined && value.fullHandle.slice(value.fullHandle.indexOf('.') + 1) === domain),
+                };
+            }, { allowSignedOut: true });
+        }
+        /** Restore from Core local_sessions and advance only the exact resumable Join. */
+        async getDeviceJoinStatus() {
+            const result = await this.run(async (client) => {
+                const joinSessionId = await this.selectDeviceJoinSession(client);
+                return joinSessionId === null ? null : client.getDeviceJoinStatus(joinSessionId);
+            });
+            if (!result.ok)
+                return result;
+            if (result.value === null)
+                return { ok: true, value: null };
+            this.activeDeviceJoinSessionId = result.value.joinSessionId;
+            return this.applyCandidateJoinProgress(result.value);
+        }
+        async cancelDeviceJoin() {
+            const result = await this.run(async (client) => {
+                const joinSessionId = await this.selectDeviceJoinSession(client);
+                if (joinSessionId === null)
+                    return null;
+                return client.cancelDeviceJoin(joinSessionId);
+            });
+            if (!result.ok)
+                return result;
+            this.pendingDeviceJoin = undefined;
+            this.activeDeviceJoinSessionId = undefined;
+            return { ok: true, value: { completed: true } };
+        }
+        /** Reliable-sync and project only Host-opaque device/request references. */
+        refreshDeviceManagement() {
+            return this.run(client => this.deviceManagementSnapshot(client));
+        }
+        async startDeviceJoinVerification(request) {
+            const joinSessionId = this.requestSessions.get(request?.requestRef);
+            if (joinSessionId === undefined)
+                return { ok: false, error: failure('invalid-request') };
+            const result = await this.run(async (client) => {
+                await this.requireDeviceManager(client);
+                await client.syncDeviceManagement();
+                let notice = (await client.listLocalDeviceJoinRequests())
+                    .find(value => value.joinSessionId === joinSessionId);
+                if (notice === undefined) {
+                    throw Object.assign(new Error('request not found'), { name: 'AwikiSdkError', code: 'not-found' });
+                }
+                const localProgress = await this.localAdminJoinProgress(client, notice);
+                if (localProgress !== undefined)
+                    return localProgress;
+                if (!notice.canStartVerification) {
+                    throw Object.assign(new Error('request unavailable'), { name: 'AwikiSdkError', code: 'forbidden' });
+                }
+                const operationId = `dsh-device-verify-${createHash('sha256').update(joinSessionId).digest('hex').slice(0, 32)}`;
+                let started;
+                try {
+                    started = await client.startDeviceJoinVerification({
+                        joinSessionId,
+                        operationId,
+                        challengeTtlSeconds: DEVICE_JOIN_CHALLENGE_TTL_SECONDS,
+                    });
+                }
+                catch (error) {
+                    await client.syncDeviceManagement();
+                    notice = (await client.listLocalDeviceJoinRequests())
+                        .find(value => value.joinSessionId === joinSessionId);
+                    const recovered = notice === undefined ? undefined : await this.localAdminJoinProgress(client, notice);
+                    if (recovered !== undefined)
+                        return recovered;
+                    throw error;
+                }
+                await client.syncDeviceManagement();
+                notice = (await client.listLocalDeviceJoinRequests())
+                    .find(value => value.joinSessionId === joinSessionId);
+                if (notice === undefined)
+                    return started;
+                return (await this.localAdminJoinProgress(client, notice)) ?? started;
+            });
+            return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
+        }
+        async approveDeviceJoin(request) {
+            if (request?.confirmation !== DEVICE_JOIN_APPROVAL_CONFIRMATION) {
+                return { ok: false, error: failure('invalid-request') };
+            }
+            const joinSessionId = this.requestSessions.get(request.requestRef);
+            if (joinSessionId === undefined || !/^\d{6}$/u.test(request.enteredSas)) {
+                return { ok: false, error: failure('invalid-request') };
+            }
+            const result = await this.run(async (client) => {
+                await this.requireDeviceManager(client);
+                const progress = await client.getLocalDeviceJoinVerificationProgress(joinSessionId);
+                if (progress.sas === undefined || !constantTimeSasMatches(progress.sas, request.enteredSas)) {
+                    throw Object.assign(new Error('sas mismatch'), { name: 'AwikiSdkError', code: 'forbidden' });
+                }
+                const prompt = await client.prepareDeviceJoinApproval(joinSessionId);
+                try {
+                    return await client.confirmDeviceJoinApproval(prompt.approvalHandle);
+                }
+                catch (error) {
+                    // Approval is a remote mutation: its response may fail after Core has
+                    // already committed both the provider document and the local terminal
+                    // Join state. Re-read the authoritative terminal state before exposing
+                    // a false failure to the administrator.
+                    try {
+                        await client.syncDeviceManagement();
+                    }
+                    catch { }
+                    try {
+                        const recovered = await client.getLocalDeviceJoinVerificationProgress(joinSessionId);
+                        if (adminJoinPhase(recovered) === 'authorized')
+                            return recovered;
+                    }
+                    catch { }
+                    throw error;
+                }
+            });
+            return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
+        }
+        async rejectDeviceJoin(request) {
+            const joinSessionId = this.requestSessions.get(request?.requestRef);
+            if (joinSessionId === undefined
+                || (request.reason !== 'user_rejected' && request.reason !== 'sas_mismatch')) {
+                return { ok: false, error: failure('invalid-request') };
+            }
+            const result = await this.run(async (client) => {
+                await this.requireDeviceManager(client);
+                return client.rejectDeviceJoin(joinSessionId, request.reason);
+            });
+            return result.ok ? this.publicAdminJoinProgress(request.requestRef, result.value) : result;
+        }
+        async revokeDevice(request) {
+            if (request?.confirmation !== DEVICE_REVOKE_CONFIRMATION) {
+                return { ok: false, error: failure('invalid-request') };
+            }
+            const deviceId = this.deviceIds.get(request.deviceRef);
+            if (deviceId === undefined)
+                return { ok: false, error: failure('invalid-request') };
+            return this.run(async (client) => {
+                await this.requireDeviceManager(client);
+                const devices = await client.getDeviceRegistry();
+                const target = devices.find(device => device.deviceId === deviceId);
+                if (target === undefined || target.isCurrent) {
+                    throw Object.assign(new Error('device unavailable'), { name: 'AwikiSdkError', code: 'forbidden' });
+                }
+                await client.revokeDevice(deviceId);
+                return this.deviceManagementSnapshot(client);
+            });
+        }
+        /** Prepare a short-lived Core authorization without exposing it to Browser. */
+        async prepareRootTransfer(request) {
+            const deviceId = this.deviceIds.get(request?.deviceRef);
+            if (deviceId === undefined)
+                return { ok: false, error: failure('invalid-request') };
+            return this.run(async (client) => {
+                const did = await this.requireRootTransferRecipient(client, deviceId);
+                const preparation = await client.prepareRootKeyTransfer(deviceId);
+                if (preparation.recipient.did !== did || preparation.recipient.deviceId !== deviceId) {
+                    throw Object.assign(new Error('root transfer recipient mismatch'), { name: 'AwikiSdkError', code: 'remote' });
+                }
+                for (const [reference, pending] of this.rootTransfers) {
+                    if (pending.deviceId === deviceId)
+                        this.rootTransfers.delete(reference);
+                }
+                const transferRef = `root-transfer-${randomUUID()}`;
+                this.rootTransfers.set(transferRef, {
+                    authorizationHandle: preparation.authorizationHandle,
+                    deviceId,
+                    deviceRef: request.deviceRef,
+                    did,
+                });
+                return { transferRef, deviceRef: request.deviceRef, expiresAt: preparation.expiresAt };
+            });
+        }
+        /** Authenticate locally, recheck fresh context, then consume one exact Core authorization. */
+        async confirmRootTransfer(request) {
+            const pending = this.rootTransfers.get(request?.transferRef);
+            if (pending === undefined)
+                return { ok: false, error: failure('invalid-request') };
+            this.rootTransfers.delete(request.transferRef);
+            return this.run(async (client) => {
+                const confirmed = await client.confirmUserPresence('Grant AWiki device management access');
+                if (!confirmed) {
+                    throw Object.assign(new Error('user presence denied'), { name: 'AwikiSdkError', code: 'forbidden' });
+                }
+                const did = await this.requireRootTransferRecipient(client, pending.deviceId);
+                if (did !== pending.did) {
+                    throw Object.assign(new Error('root transfer identity changed'), { name: 'AwikiSdkError', code: 'forbidden' });
+                }
+                const sent = await client.confirmAndSendRootKeyTransfer(pending.authorizationHandle);
+                if (sent.recipientDeviceId !== pending.deviceId) {
+                    throw Object.assign(new Error('root transfer receipt mismatch'), { name: 'AwikiSdkError', code: 'remote' });
+                }
+                return { deviceRef: pending.deviceRef, acceptedAt: sent.acceptedAt };
+            });
         }
         /**
          * Update the deployment identity's public WNS display name.
@@ -1212,10 +2043,16 @@ let AwikiService = (() => {
         }
         /** Start durable phone recovery for one existing full Handle. */
         sendRecoveryOtp(request) {
+            this.pendingDeviceJoin = undefined;
             const normalized = normalizeRecoveryOtpRequest(request);
             if (normalized === undefined)
                 return Promise.resolve({ ok: false, error: failure('invalid-request') });
-            return this.run(client => client.sendRecoveryOtp(normalized), { allowSignedOut: true });
+            return this.run(async (client) => {
+                if (await this.selectDeviceJoinSession(client) !== null) {
+                    throw Object.assign(new Error('join already exists'), { name: 'AwikiSdkError', code: 'conflict' });
+                }
+                return client.sendRecoveryOtp(normalized);
+            }, { allowSignedOut: true });
         }
         /** Verify a recovery OTP and freeze its exact intent before the remote commit. */
         prepareRecovery(request) {
@@ -1229,33 +2066,35 @@ let AwikiService = (() => {
             const normalized = normalizeRecoveryOperation(request);
             if (normalized === undefined)
                 return { ok: false, error: failure('invalid-request') };
-            const result = await this.run(client => client.activateRecovery(normalized), { allowSignedOut: true });
-            if (result.ok && !await this.applyRecoveredSession(result.value)) {
-                return { ok: false, error: failure('remote') };
-            }
-            return result;
+            return this.run(client => client.activateRecovery(normalized), { allowSignedOut: true });
         }
         /** Read durable recovery state before deciding whether a retry is valid. */
         async getRecoveryStatus(request) {
             const normalized = normalizeRecoveryOperation(request);
             if (normalized === undefined)
                 return { ok: false, error: failure('invalid-request') };
-            const result = await this.run(client => client.getRecoveryStatus(normalized), { allowSignedOut: true });
-            if (result.ok && !await this.applyRecoveredSession(result.value)) {
-                return { ok: false, error: failure('remote') };
-            }
-            return result;
+            return this.run(client => client.getRecoveryStatus(normalized), { allowSignedOut: true });
         }
         /** Resume only the exact Core-owned operation selected by the browser. */
         async resumeRecovery(request) {
             const normalized = normalizeRecoveryOperation(request);
             if (normalized === undefined)
                 return { ok: false, error: failure('invalid-request') };
-            const result = await this.run(client => client.resumeRecovery(normalized), { allowSignedOut: true });
-            if (result.ok && !await this.applyRecoveredSession(result.value)) {
-                return { ok: false, error: failure('remote') };
+            return this.run(client => client.resumeRecovery(normalized), { allowSignedOut: true });
+        }
+        /** Explicitly enter an applied identity; reads and late Core completions never sign in. */
+        async enterRecoveredSession(request) {
+            const normalized = normalizeRecoveryOperation(request);
+            if (normalized === undefined)
+                return { ok: false, error: failure('invalid-request') };
+            const requestGeneration = this.sessionRevision;
+            const result = await this.run(client => client.getRecoveryStatus(normalized), { allowSignedOut: true });
+            if (!result.ok)
+                return result;
+            if (result.value.phase !== 'applied' || !result.value.allowedActions?.includes('activate_identity')) {
+                return { ok: false, error: failure('conflict') };
             }
-            return result;
+            return this.applyRecoveredSession(result.value, requestGeneration);
         }
         /** Discard only a pre-attempt operation; Core rejects post-attempt deletion. */
         async discardRecovery(request) {
@@ -1322,6 +2161,12 @@ let AwikiService = (() => {
             return result.ok ? { ok: true, value: { completed: true } } : result;
         }
         /** Read one authoritative versioned member page. */
+        getDisplayProfiles(peers) {
+            if (!Array.isArray(peers) || peers.length > 100 || peers.some(peer => typeof peer !== 'string' || !peer.startsWith('did:'))) {
+                return Promise.resolve({ ok: false, error: failure('invalid-request') });
+            }
+            return this.run(client => client.getDisplayProfiles(peers));
+        }
         listGroupMembers(request) {
             const groupDid = normalizeGroupDid(request?.groupDid);
             if (groupDid === undefined
@@ -1353,16 +2198,6 @@ let AwikiService = (() => {
             }
             return this.run(client => client.removeGroupMember(groupDid, member));
         }
-        /** Resume durable group membership convergence after account sync restores old groups. */
-        async resumeGroupRebindRecovery() {
-            const result = await this.run(client => client.resumeGroupRebindRecovery());
-            if (!result.ok)
-                return result;
-            const summary = publicGroupRebindRecoverySummary(result.value);
-            return summary === undefined
-                ? { ok: false, error: failure('remote') }
-                : { ok: true, value: summary };
-        }
         /** Read presentation-only roster preferences for the active identity. */
         getConversationPreferences() {
             return this.run(async (client) => this.conversationPreferenceStore.get(await this.ownerDid(client)));
@@ -1583,7 +2418,7 @@ let AwikiService = (() => {
         }
         /** Return the deployment identity's public mailbox state. */
         getMailAccount() {
-            return this.run(client => client.getMailAccount(), { bindMailOwner: true });
+            return this.run(client => client.getMailAccount());
         }
         /** List one bounded mailbox page on explicit browser/tool demand. */
         async listMailInbox(request) {
@@ -1594,11 +2429,15 @@ let AwikiService = (() => {
             catch {
                 return { ok: false, error: failure('invalid-request') };
             }
-            return this.run(async (client, _provider, ownerDid) => {
-                if (normalized.folder !== 'sent')
-                    return client.listMailInbox(normalized);
-                return this.sentMailStore.list(ownerDid, normalized);
-            }, { bindMailOwner: true });
+            const requestGeneration = this.sessionRevision;
+            return this.run(async (client) => {
+                const page = normalized.folder === 'sent'
+                    ? await this.mailListClient.listOutbound(normalized)
+                    : await client.listMailInbox(normalized);
+                if (this.sessionRevision !== requestGeneration)
+                    throw new AwikiSdkError('network');
+                return page;
+            });
         }
         /** Read one bounded plain-text mail message. */
         async readMail(request) {
@@ -1609,116 +2448,22 @@ let AwikiService = (() => {
             catch {
                 return { ok: false, error: failure('invalid-request') };
             }
-            return this.run(async (client, _provider, ownerDid) => {
-                if (!isLocalSentMailId(normalized.messageId))
-                    return client.readMail(normalized);
-                const local = await this.sentMailStore.read(ownerDid, normalized.messageId);
-                if (local === undefined) {
-                    throw Object.assign(new Error('sent mail not found'), { name: 'AwikiSdkError', code: 'not-found' });
-                }
-                return local;
-            }, { bindMailOwner: true });
+            return this.run(client => client.readMail(normalized));
         }
         /** Mark explicitly selected mail messages read. Browser callers require an explicit click. */
         markMailRead(request) {
-            return this.runValidatedMail(() => mailMarkReadRequest(request), (client, normalized) => client.markMailRead(normalized), { bindMailOwner: true });
+            return this.runValidatedMail(() => mailMarkReadRequest(request), (client, normalized) => client.markMailRead(normalized));
         }
-        /** Send one mail once. Browser callers require an explicit confirmation. */
+        /** Send one plain-text mail once. Browser callers require an explicit confirmation. */
         async sendMail(request) {
             let normalized;
             try {
-                normalized = mailSendRequest(request, {
-                    maxCount: this.resolved.mailAttachmentMaxCount,
-                    maxBytes: this.resolved.mailAttachmentMaxBytes,
-                    totalMaxBytes: this.resolved.mailAttachmentTotalMaxBytes,
-                });
+                normalized = mailSendRequest(request);
             }
             catch {
                 return { ok: false, error: failure('invalid-request') };
             }
-            return this.run(async (client, _provider, ownerDid, assertActive) => {
-                const result = await client.sendMail({
-                    to: [...normalized.to],
-                    cc: [...normalized.cc],
-                    subject: normalized.subject,
-                    bodyText: normalized.bodyText,
-                    ...normalized.attachments.length === 0 ? {} : {
-                        attachments: normalized.attachments.map(attachment => ({
-                            fileName: attachment.fileName,
-                            contentType: attachment.contentType,
-                            bytes: attachment.bytes,
-                        })),
-                    },
-                });
-                assertActive();
-                if (!result.accepted)
-                    return result;
-                const settled = normalized.attachments.length > 0
-                    && result.messageId === undefined
-                    && result.warnings.length < 100
-                    ? { ...result, warnings: [...result.warnings, 'Sent attachment download is unavailable because the service returned no message id.'] }
-                    : result;
-                try {
-                    const account = await client.getMailAccount().catch(() => undefined);
-                    assertActive();
-                    await this.sentMailStore.append(ownerDid, normalized, settled, account);
-                    assertActive();
-                    return settled;
-                }
-                catch {
-                    assertActive();
-                    return settled.warnings.length >= 100
-                        ? settled
-                        : { ...settled, warnings: [...settled.warnings, 'Sent history could not be saved locally.'] };
-                }
-            }, { bindMailOwner: true });
-        }
-        /** Download one mail attachment only after an explicit browser action. */
-        async downloadMailAttachment(request) {
-            let normalized;
-            try {
-                normalized = mailAttachmentDownloadRequest(request);
-            }
-            catch {
-                return { ok: false, error: failure('invalid-request') };
-            }
-            return this.run(async (client, _provider, ownerDid, assertActive) => {
-                let serviceMessageId = normalized.localMessageId;
-                if (isLocalSentMailId(serviceMessageId)) {
-                    const resolved = await this.sentMailStore.resolveAttachment(ownerDid, serviceMessageId, normalized.attachmentIndex);
-                    if (resolved === undefined) {
-                        throw Object.assign(new Error('sent mail attachment is unavailable'), {
-                            name: 'AwikiSdkError', code: 'not-found',
-                        });
-                    }
-                    serviceMessageId = resolved;
-                }
-                const value = await client.downloadMailAttachment({
-                    messageId: serviceMessageId,
-                    attachmentIndex: normalized.attachmentIndex,
-                });
-                assertActive();
-                if (!Number.isSafeInteger(value.sizeBytes) || value.sizeBytes < 0)
-                    throw new TypeError('invalid mail attachment size');
-                if (value.sizeBytes > this.resolved.mailAttachmentMaxBytes) {
-                    throw Object.assign(new Error('mail attachment exceeds Host limit'), {
-                        name: 'AwikiSdkError', code: 'attachment-too-large',
-                    });
-                }
-                if (!(value.bytes instanceof Uint8Array) || value.bytes.byteLength !== value.sizeBytes) {
-                    throw new TypeError('invalid mail attachment bytes');
-                }
-                const fileName = mailAttachmentFileName(value.fileName);
-                const contentType = mailAttachmentContentType(value.contentType);
-                const bytes = value.bytes;
-                return {
-                    fileName,
-                    contentType,
-                    sizeBytes: bytes.byteLength,
-                    sha256: createHash('sha256').update(bytes).digest('hex'),
-                    bytesBase64: Buffer.from(bytes).toString('base64'),
-                };
-            }, { bindMailOwner: true });
+            return this.run(client => client.sendMail(normalized));
         }
         /**
          * Permanently remove the exact SDK-owned local state after an explicit browser acknowledgement.
@@ -1730,27 +2475,35 @@ let AwikiService = (() => {
             if (request?.confirmation !== AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION) {
                 return Promise.resolve({ ok: false, error: failure('invalid-request') });
             }
+            // Fence pending post-Recovery work before the serialized clear reaches the head of the queue.
+            this.sessionRevision += 1;
             return this.mutateSession(async () => {
                 const provider = this.provider;
                 if (provider !== undefined)
-                    await this.stopListener(provider);
-                const result = await this.run(client => client.clearLocalData(), { allowSignedOut: true });
+                    await this.stopProviderRuntime(provider);
+                let result = await this.run(client => client.clearLocalData(), { allowSignedOut: true });
+                // Core's clear is local and idempotent. A provider mutation that was still
+                // settling can surface once as the deliberately opaque `remote` failure.
+                // Retry only that class once after the runtime has already been stopped.
+                if (!result.ok && result.error.code === 'remote') {
+                    result = await this.run(client => client.clearLocalData(), { allowSignedOut: true });
+                }
                 if (!result.ok) {
                     if (provider !== undefined && this.provider === provider)
-                        void this.startListener(provider);
+                        this.ensureProviderRuntime(provider);
                     return result;
                 }
                 try {
                     await this.imageAttachmentCache.clear();
-                    await this.sentMailStore.clear();
+                    await clearLegacySentMailCache(this.activeClientOptions?.stateRoot ?? this.resolved.stateRoot);
                     await this.conversationPreferenceStore.clear();
                     await this.sessionStore.signIn();
                     this.signedOut = false;
                     this.activeIdentityDid = undefined;
+                    this.pendingDeviceJoin = undefined;
+                    this.activeDeviceJoinSessionId = undefined;
                     this.invalidateSummaries();
                     this.publishSession({ status: 'unregistered' });
-                    if (provider !== undefined && this.provider === provider)
-                        void this.startListener(provider);
                     return result;
                 }
                 catch {
@@ -1758,53 +2511,291 @@ let AwikiService = (() => {
                 }
             });
         }
-        /** Re-enter after Core applies the recovered identity without blocking on optional account restoration. */
-        async applyRecoveredSession(progress) {
+        /** Re-enter only after Core confirms that the exact recovered identity is applied locally. */
+        async applyRecoveredSession(progress, requestGeneration) {
             if (progress.phase !== 'applied')
-                return true;
+                return { ok: true, value: progress };
             return this.mutateSession(async () => {
                 const provider = this.provider;
                 if (provider === undefined)
-                    return false;
+                    return { ok: false, error: failure('remote') };
+                if (this.sessionRevision !== requestGeneration) {
+                    return {
+                        ok: false,
+                        error: {
+                            ...failure('remote'),
+                            mailRecoveryObservability: fencedMailRecoveryObservability(this.activeIdentityDid === progress.currentDid, 'replaced'),
+                        },
+                    };
+                }
                 try {
                     const identity = await provider.client.getIdentity();
-                    if (identity === null || identity.did !== progress.currentDid)
-                        return false;
+                    const currentPrincipalMatchesRecovery = identity !== null && identity.did === progress.currentDid;
+                    if (this.provider !== provider || this.sessionRevision !== requestGeneration) {
+                        return {
+                            ok: false,
+                            error: {
+                                ...failure('remote'),
+                                mailRecoveryObservability: fencedMailRecoveryObservability(currentPrincipalMatchesRecovery, 'replaced'),
+                            },
+                        };
+                    }
+                    if (!currentPrincipalMatchesRecovery) {
+                        return {
+                            ok: false,
+                            error: {
+                                ...failure('remote'),
+                                mailRecoveryObservability: fencedMailRecoveryObservability(false, 'current'),
+                            },
+                        };
+                    }
                     const alreadyActive = this.signedOut === false && this.activeIdentityDid === identity.did;
                     if (!alreadyActive) {
                         await this.sessionStore.signIn();
+                        if (this.provider !== provider || this.sessionRevision !== requestGeneration) {
+                            return {
+                                ok: false,
+                                error: {
+                                    ...failure('remote'),
+                                    mailRecoveryObservability: fencedMailRecoveryObservability(true, 'replaced'),
+                                },
+                            };
+                        }
                         this.signedOut = false;
                         this.activeIdentityDid = identity.did;
                         this.invalidateSummaries();
+                        requestGeneration = this.sessionRevision;
+                    }
+                    const mailRecoveryObservability = await this.reconcileRecoveredMailbox(provider);
+                    if (this.provider !== provider || this.sessionRevision !== requestGeneration) {
+                        return {
+                            ok: false,
+                            error: {
+                                ...failure('remote'),
+                                mailRecoveryObservability: fencedMailRecoveryObservability(true, 'replaced'),
+                            },
+                        };
                     }
-                    if (this.provider !== provider)
-                        return false;
                     if (!alreadyActive) {
                         const session = { status: 'active', identity };
                         this.publishSession(session);
-                        await provider.listenerStartup;
-                        await this.startListener(provider);
+                        this.ensureProviderRuntime(provider);
                     }
-                    return true;
+                    return { ok: true, value: { ...progress, mailRecoveryObservability } };
                 }
                 catch {
-                    return false;
+                    return { ok: false, error: failure('remote') };
                 }
             });
         }
-        /** Publish one newly registered identity and start its listener through the existing session path. */
+        /** Rebind Mail first-use ownership and retain only its closed, secret-free classification. */
+        async reconcileRecoveredMailbox(provider) {
+            try {
+                await provider.client.getMailAccount();
+                return successfulMailRecoveryObservability();
+            }
+            catch (error) {
+                return failedMailRecoveryObservability(error);
+            }
+        }
+        /** Select the only resumable new-device session; Core local_sessions is the sole restart SoT. */
+        async selectDeviceJoinSession(client) {
+            const sessions = await client.listLocalDeviceJoinSessions();
+            const resumable = sessions.filter(value => (value.side === 'new_device' && RESUMABLE_JOIN_PHASES.has(value.localPhase)));
+            if (this.activeDeviceJoinSessionId !== undefined) {
+                const tracked = resumable.find(value => value.joinSessionId === this.activeDeviceJoinSessionId);
+                if (tracked !== undefined)
+                    return tracked.joinSessionId;
+                this.activeDeviceJoinSessionId = undefined;
+            }
+            if (resumable.length > 1) {
+                throw Object.assign(new Error('multiple local joins'), { name: 'AwikiSdkError', code: 'conflict' });
+            }
+            const selected = resumable[0];
+            this.activeDeviceJoinSessionId = selected?.joinSessionId;
+            return selected?.joinSessionId ?? null;
+        }
+        async applyCandidateJoinProgress(value) {
+            const phase = candidateJoinPhase(value);
+            if (phase === undefined)
+                return { ok: false, error: failure('remote') };
+            if (phase === 'cancelled' || phase === 'rejected' || phase === 'expired') {
+                this.activeDeviceJoinSessionId = undefined;
+            }
+            if (phase === 'authorized') {
+                if (value.identity === undefined)
+                    return { ok: false, error: failure('remote') };
+                await this.activateRegisteredIdentity(value.identity);
+            }
+            return {
+                ok: true,
+                value: {
+                    phase,
+                    expiresAt: value.expiresAt,
+                    ...(phase === 'sas-ready' && value.sas !== undefined ? { sas: value.sas } : {}),
+                    completed: phase === 'authorized',
+                },
+            };
+        }
+        publicAdminJoinProgress(requestRef, value) {
+            const phase = adminJoinPhase(value);
+            if (phase === undefined)
+                return { ok: false, error: failure('remote') };
+            return {
+                ok: true,
+                value: {
+                    requestRef,
+                    phase,
+                    expiresAt: value.expiresAt,
+                    ...(phase === 'sas-ready' && value.sas !== undefined ? { sas: value.sas } : {}),
+                },
+            };
+        }
+        async localAdminJoinProgress(client, notice) {
+            const local = (await client.listLocalDeviceJoinSessions())
+                .find(session => session.side === 'admin' && session.joinSessionId === notice.joinSessionId);
+            if (local === undefined) {
+                return notice.claimedByCurrentDevice
+                    ? client.getLocalDeviceJoinVerificationProgress(notice.joinSessionId)
+                    : undefined;
+            }
+            if (local.localPhase === 'challenge_prepared') {
+                return {
+                    joinSessionId: notice.joinSessionId,
+                    localPhase: local.localPhase,
+                    remoteState: notice.state,
+                    expiresAt: local.expiresAt,
+                };
+            }
+            return client.getLocalDeviceJoinVerificationProgress(notice.joinSessionId);
+        }
+        async requireDeviceManager(client) {
+            const current = await client.getCurrentDeviceSummary();
+            if (!current.canManage || current.role !== 'admin' || current.readiness !== 'admin_ready') {
+                throw Object.assign(new Error('device manager required'), { name: 'AwikiSdkError', code: 'forbidden' });
+            }
+        }
+        async requireRootTransferRecipient(client, deviceId) {
+            if (!client.trustedUserPresenceSupported) {
+                throw Object.assign(new Error('trusted user presence unsupported'), { name: 'AwikiSdkError', code: 'forbidden' });
+            }
+            await this.requireDeviceManager(client);
+            await client.syncDeviceManagement();
+            const identity = await client.getIdentity();
+            if (identity === null) {
+                throw Object.assign(new Error('identity required'), { name: 'AwikiSdkError', code: 'not-registered' });
+            }
+            const target = (await client.getDeviceRegistry()).find(device => device.deviceId === deviceId);
+            if (target === undefined
+                || target.isCurrent
+                || target.status !== 'active'
+                || target.role !== 'member'
+                || target.managementReady) {
+                throw Object.assign(new Error('root transfer recipient unavailable'), { name: 'AwikiSdkError', code: 'forbidden' });
+            }
+            return identity.did;
+        }
+        requestRef(joinSessionId) {
+            const existing = this.requestRefs.get(joinSessionId);
+            if (existing !== undefined)
+                return existing;
+            const reference = `join-${randomUUID()}`;
+            this.requestRefs.set(joinSessionId, reference);
+            this.requestSessions.set(reference, joinSessionId);
+            return reference;
+        }
+        deviceRef(deviceId) {
+            const existing = this.deviceRefs.get(deviceId);
+            if (existing !== undefined)
+                return existing;
+            const reference = `device-${randomUUID()}`;
+            this.deviceRefs.set(deviceId, reference);
+            this.deviceIds.set(reference, deviceId);
+            return reference;
+        }
+        async deviceManagementSnapshot(client) {
+            await client.syncDeviceManagement();
+            const current = await client.getCurrentDeviceSummary();
+            if (!current.canManage || current.role !== 'admin' || current.readiness !== 'admin_ready') {
+                this.requestRefs.clear();
+                this.requestSessions.clear();
+                this.deviceRefs.clear();
+                this.deviceIds.clear();
+                this.rootTransfers.clear();
+                return {
+                    canManage: false,
+                    rootTransferSupported: client.trustedUserPresenceSupported,
+                    ...current.role === undefined ? {} : { role: current.role },
+                    readiness: current.readiness,
+                    devices: [],
+                    requests: [],
+                };
+            }
+            const requests = await client.listLocalDeviceJoinRequests();
+            await Promise.all(requests
+                .filter(request => request.claimedByCurrentDevice)
+                .map(request => client.getLocalDeviceJoinVerificationProgress(request.joinSessionId).catch(() => undefined)));
+            const devices = await client.getDeviceRegistry();
+            const identity = await client.getIdentity();
+            const joinedAtByDeviceId = new Map();
+            for (const request of requests) {
+                const previous = joinedAtByDeviceId.get(request.protocolDeviceId);
+                if (previous === undefined || request.issuedAt > previous) {
+                    joinedAtByDeviceId.set(request.protocolDeviceId, request.issuedAt);
+                }
+            }
+            const initialDeviceJoinedAt = identity === null
+                ? undefined
+                : new Date(identity.registeredAt).toISOString();
+            return {
+                canManage: true,
+                rootTransferSupported: client.trustedUserPresenceSupported,
+                role: 'admin',
+                readiness: 'admin_ready',
+                devices: devices
+                    .filter(device => device.status === 'active')
+                    .map(device => this.publicDevice(device, joinedAtByDeviceId.get(device.deviceId) ?? (device.isCurrent ? initialDeviceJoinedAt : undefined))),
+                requests: requests.map(request => ({
+                    requestRef: this.requestRef(request.joinSessionId),
+                    candidateKeyFingerprint: request.candidateKeyFingerprint,
+                    issuedAt: request.issuedAt,
+                    expiresAt: request.expiresAt,
+                    state: requestJoinPhase(request),
+                    claimedByCurrentDevice: request.claimedByCurrentDevice,
+                    canStartVerification: request.canStartVerification,
+                })),
+            };
+        }
+        publicDevice(device, joinedAt) {
+            const fingerprint = createHash('sha256').update(device.deviceId).digest('hex').slice(0, 8).toUpperCase();
+            return {
+                deviceRef: this.deviceRef(device.deviceId),
+                displayId: `${fingerprint.slice(0, 4)}-${fingerprint.slice(4)}`,
+                ...joinedAt === undefined ? {} : { joinedAt },
+                status: device.status,
+                role: device.role,
+                managementReady: device.managementReady,
+                isCurrent: device.isCurrent,
+            };
+        }
+        /** Publish one newly registered identity, then start realtime only in the background. */
         async activateRegisteredIdentity(identity) {
+            this.pendingDeviceJoin = undefined;
+            this.activeDeviceJoinSessionId = undefined;
             this.activeIdentityDid = identity.did;
             this.publishSession({ status: 'active', identity });
             const provider = this.provider;
-            if (provider !== undefined) {
-                await provider.listenerStartup;
-                await this.startListener(provider);
-            }
+            if (provider !== undefined)
+                this.ensureProviderRuntime(provider);
         }
         /** Invalidate cached session work and cancel every model request still owned by the old session. */
         invalidateSummaries() {
             this.sessionRevision += 1;
+            this.requestRefs.clear();
+            this.requestSessions.clear();
+            this.deviceRefs.clear();
+            this.deviceIds.clear();
+            this.rootTransfers.clear();
             for (const controller of this.activeSummaryRequests)
                 controller.abort();
             this.activeSummaryRequests.clear();
@@ -1815,40 +2806,31 @@ let AwikiService = (() => {
         }
         /** Resolve and cache the owner binding required by private Host-side projections. */
         async ownerDid(client) {
-            const identity = await client.getIdentity();
-            const ownerDid = identity?.did;
+            const identity = this.activeIdentityDid === undefined ? await client.getIdentity() : undefined;
+            const ownerDid = this.activeIdentityDid ?? identity?.did;
             if (ownerDid === undefined) {
                 throw Object.assign(new Error('not registered'), { name: 'AwikiSdkError', code: 'not-registered' });
             }
-            if (this.activeIdentityDid !== undefined && this.activeIdentityDid !== ownerDid) {
-                throw new ProviderUnavailableError();
-            }
             this.activeIdentityDid = ownerDid;
             return ownerDid;
         }
         /** Invoke the current client and normalize every rejection to a public result. */
         async run(operation, options = {}) {
             try {
-                const sessionRevision = this.sessionRevision;
+                const generation = this.runtimeGeneration;
+                if (this.getUpdatePolicyStatus().restricted) {
+                    return { ok: false, error: failure('client-version-unsupported') };
+                }
                 if (options.allowSignedOut !== true && await this.isSignedOut()) {
                     return { ok: false, error: failure('signed-out') };
                 }
                 const provider = this.provider;
                 if (provider === undefined)
                     throw new ProviderUnavailableError();
-                const ownerDid = options.bindMailOwner === true
-                    ? await this.ownerDid(provider.client)
-                    : undefined;
-                const assertActive = () => {
-                    if (this.provider !== provider
-                        || (options.bindMailOwner === true && (this.sessionRevision !== sessionRevision
-                            || this.signedOut === true
-                            || this.activeIdentityDid !== ownerDid)))
-                        throw new ProviderUnavailableError();
-                };
-                assertActive();
-                const value = await operation(provider.client, provider, ownerDid, assertActive);
-                assertActive();
+                const value = await operation(provider.client);
+                if (this.runtimeGeneration !== generation || this.provider !== provider) {
+                    return { ok: false, error: failure('conflict') };
+                }
                 if (options.skipAttachmentByteValidation !== true && containsUnexpectedBinary(value, new Set())) {
                     return { ok: false, error: failure('remote') };
                 }
@@ -1858,8 +2840,13 @@ let AwikiService = (() => {
                 return { ok: false, error: normalizeFailure(error) };
             }
         }
+        assertVersionSupported() {
+            if (this.getUpdatePolicyStatus().restricted) {
+                throw new Error('awiki: this plugin version must be updated before using the active tenant');
+            }
+        }
         /** Validate mail input before entering the provider and preserve fixed public failures. */
-        runValidatedMail(validate, operation, options = {}) {
+        runValidatedMail(validate, operation) {
             let request;
             try {
                 request = validate();
@@ -1867,7 +2854,7 @@ let AwikiService = (() => {
             catch {
                 return Promise.resolve({ ok: false, error: failure('invalid-request') });
             }
-            return this.run(client => operation(client, request), options);
+            return this.run(client => operation(client, request));
         }
         /** Read and cache the private Host-owned session marker. */
         async isSignedOut() {
@@ -1918,165 +2905,211 @@ let AwikiService = (() => {
         }
         /** Serialize sign-in, sign-out, and destructive clear transitions. */
         mutateSession(operation) {
-            const pending = this.sessionMutation.then(operation, operation);
+            const generation = this.runtimeGeneration;
+            if (this.tenantSwitching)
+                return Promise.resolve({ ok: false, error: failure('conflict') });
+            const invoke = () => this.tenantSwitching || generation !== this.runtimeGeneration
+                ? Promise.resolve({ ok: false, error: failure('conflict') })
+                : operation();
+            const pending = this.sessionMutation.then(invoke, invoke);
             this.sessionMutation = pending.then(() => undefined, () => undefined);
             return pending;
         }
-        /** Start one exact identity-bound listener, atomically releasing a failed startup. */
-        startListener(provider) {
-            if (!this.resolved.listenerEnabled
-                || provider.listener !== undefined
-                || provider.listenerRecoveryBlocked
-                || this.provider !== provider) {
-                return Promise.resolve();
-            }
-            if (provider.listenerStartup !== undefined)
-                return provider.listenerStartup;
-            if (provider.listenerCleanup !== undefined || provider.listenerRestartTimer !== undefined)
-                return Promise.resolve();
-            const workspaceContext = this.workspaceContext;
-            const source = provider.client.listener;
-            if (workspaceContext === undefined || source === undefined)
-                return Promise.resolve();
-            const generation = provider.listenerGeneration;
-            const logger = this.ctx.logger('awiki-listener');
+        /** Start identity realtime and the optional Agent consumer without blocking identity success. */
+        ensureProviderRuntime(provider) {
+            if (this.tenantSwitching)
+                return;
+            const identityDid = this.activeIdentityDid;
+            if (provider.runtimeReplacement !== undefined)
+                return;
+            if (identityDid !== undefined
+                && provider.realtimeIdentityDid !== undefined
+                && provider.realtimeIdentityDid !== identityDid) {
+                this.replaceProviderRuntime(provider, identityDid);
+                return;
+            }
+            this.ensureRealtimeSupervisor(provider);
+            this.ensureAgentConsumer(provider);
+        }
+        replaceProviderRuntime(provider, identityDid) {
+            if (provider.runtimeReplacement !== undefined || this.provider !== provider)
+                return;
+            const replacement = (async () => {
+                await this.stopProviderRuntime(provider);
+                if (this.provider !== provider || this.activeIdentityDid !== identityDid)
+                    return;
+                this.ensureRealtimeSupervisor(provider);
+                this.ensureAgentConsumer(provider);
+            })();
+            const observed = replacement
+                .catch((error) => {
+                this.ctx.logger('awiki-realtime').warn('AWiki identity realtime replacement failed: %s', error instanceof Error ? error.message : 'unknown failure');
+            })
+                .finally(() => {
+                if (provider.runtimeReplacement === observed)
+                    delete provider.runtimeReplacement;
+                if (this.provider === provider)
+                    this.ensureProviderRuntime(provider);
+            });
+            provider.runtimeReplacement = observed;
+        }
+        ensureRealtimeSupervisor(provider) {
+            if (this.getUpdatePolicyStatus().restricted)
+                return;
+            if (!this.resolved.realtimeEnabled
+                || provider.realtimeSupervisor !== undefined
+                || provider.realtimeStartup !== undefined
+                || this.provider !== provider
+                || (provider.client.realtime ?? provider.client.listener) === undefined)
+                return;
+            const generation = provider.realtimeGeneration;
+            const source = provider.client.realtime ?? provider.client.listener;
+            if (source === undefined)
+                return;
+            const logger = this.ctx.logger('awiki-realtime');
             const startup = (async () => {
                 if (await this.isSignedOut())
                     return;
-                if (await provider.client.getIdentity() === null)
-                    return;
-                if (!this.listenerFenceMatches(provider, workspaceContext, generation))
+                const identity = await provider.client.getIdentity();
+                if (identity === null || !this.realtimeFenceMatches(provider, generation))
                     return;
-                const agents = new DshAwikiListenerAgentRuntime(workspaceContext, this.resolved.listener.workspacePath);
-                const listener = new AwikiAgentListener(source, agents, {
-                    ...this.resolved.listener,
-                    stateRoot: this.activeTenant().stateRoot,
+                this.activeIdentityDid = identity.did;
+                const supervisor = new IdentityRealtimeSupervisor(source, {
+                    onSynchronized: cause => this.onRealtimeSynchronized(provider, generation, cause),
                 }, logger);
-                provider.listener = listener;
+                provider.realtimeSupervisor = supervisor;
+                provider.realtimeIdentityDid = identity.did;
+                supervisor.start();
+                this.ensureAgentConsumer(provider);
+            })();
+            const observed = startup
+                .catch((error) => {
+                logger.warn('AWiki realtime startup failed: %s', error instanceof Error ? error.message : 'unknown failure');
+            })
+                .finally(() => {
+                if (provider.realtimeStartup === observed)
+                    delete provider.realtimeStartup;
+            });
+            provider.realtimeStartup = observed;
+        }
+        realtimeFenceMatches(provider, generation) {
+            return this.provider === provider && provider.realtimeGeneration === generation;
+        }
+        async onRealtimeSynchronized(provider, generation, cause) {
+            if (!this.realtimeFenceMatches(provider, generation))
+                return;
+            if (cause === 'system_notification' || cause === 'stream_recovery') {
                 try {
-                    await listener.start();
+                    provider.localDeviceJoinRequestCountAfterSync = (await provider.client.listLocalDeviceJoinRequests()).length;
                 }
-                catch (error) {
-                    if (provider.listener === listener)
-                        delete provider.listener;
-                    try {
-                        await listener.dispose();
-                    }
-                    catch {
-                        provider.listenerRecoveryBlocked = true;
-                    }
-                    if (!provider.listenerRecoveryBlocked && provider.listenerRestartAttempt > 0) {
-                        this.scheduleListenerRestart(provider, workspaceContext, generation);
-                    }
-                    throw error;
+                catch {
+                    this.ctx.logger('awiki-realtime').debug('AWiki realtime could not observe local device Join requests');
                 }
-                if (!this.listenerFenceMatches(provider, workspaceContext, generation)) {
-                    if (provider.listener === listener)
-                        delete provider.listener;
-                    try {
-                        await listener.dispose();
-                    }
-                    catch (error) {
-                        provider.listenerRecoveryBlocked = true;
-                        throw error;
-                    }
+            }
+            if (!['session_start', 'connection_ready', 'reconnected', 'message', 'message_update'].includes(cause))
+                return;
+            this.ensureAgentConsumer(provider);
+            await provider.agentConsumerStartup;
+            if (!this.realtimeFenceMatches(provider, generation))
+                return;
+            await provider.agentConsumer?.reconcileOnce();
+        }
+        ensureAgentConsumer(provider) {
+            if (this.getUpdatePolicyStatus().restricted)
+                return;
+            const workspaceContext = this.workspaceContext;
+            const source = provider.client.agentInbox ?? provider.client.listener;
+            const identityDid = this.activeIdentityDid;
+            if (!this.resolved.listenerEnabled
+                || workspaceContext === undefined
+                || source === undefined
+                || identityDid === undefined
+                || this.provider !== provider)
+                return;
+            if (provider.agentConsumer !== undefined && provider.agentConsumerIdentityDid === identityDid)
+                return;
+            if (provider.agentConsumerStartup !== undefined)
+                return;
+            const generation = ++provider.agentConsumerGeneration;
+            const logger = this.ctx.logger('awiki-listener');
+            const startup = (async () => {
+                await this.detachAgentConsumer(provider);
+                if (!this.agentConsumerFenceMatches(provider, workspaceContext, identityDid, generation))
                     return;
-                }
-                provider.listenerStartedAt = Date.now();
-                void listener.whenTerminated().then((result) => {
-                    if (result.kind === 'failed') {
-                        this.releaseFailedListener(provider, listener, workspaceContext, generation, result.error);
-                    }
-                });
+                const agents = new DshAwikiListenerAgentRuntime(workspaceContext, this.resolved.listener.workspacePath);
+                const consumer = new AwikiAgentListener(source, agents, {
+                    ...this.resolved.listener,
+                    stateRoot: this.activeClientOptions?.stateRoot ?? this.resolved.listener.stateRoot,
+                    identityScope: identityDid,
+                }, logger);
+                provider.agentConsumer = consumer;
+                provider.agentConsumerIdentityDid = identityDid;
+                await consumer.reconcileOnce();
             })();
             const observed = startup
                 .catch((error) => {
-                logger.warn('AWiki listener startup failed: %s', error instanceof Error ? error.message : 'unknown failure');
+                logger.warn('AWiki Agent consumer startup failed: %s', error instanceof Error ? error.message : 'unknown failure');
             })
                 .finally(() => {
-                if (provider.listenerStartup === observed)
-                    delete provider.listenerStartup;
+                if (provider.agentConsumerStartup === observed)
+                    delete provider.agentConsumerStartup;
             });
-            provider.listenerStartup = observed;
-            return observed;
-        }
-        async stopListener(provider) {
-            provider.listenerGeneration += 1;
-            provider.listenerRestartAttempt = 0;
-            delete provider.listenerStartedAt;
-            const timer = provider.listenerRestartTimer;
-            if (timer !== undefined) {
-                delete provider.listenerRestartTimer;
-                clearTimeout(timer);
-            }
-            await provider.listenerStartup;
-            await provider.listenerCleanup;
-            const listener = provider.listener;
-            if (listener === undefined)
-                return;
-            delete provider.listener;
-            try {
-                await listener.dispose();
-            }
-            catch (error) {
-                provider.listenerRecoveryBlocked = true;
-                throw error;
-            }
+            provider.agentConsumerStartup = observed;
         }
-        listenerFenceMatches(provider, workspaceContext, generation) {
+        agentConsumerFenceMatches(provider, workspaceContext, identityDid, generation) {
             return this.provider === provider
                 && this.workspaceContext === workspaceContext
-                && provider.listenerGeneration === generation;
+                && this.activeIdentityDid === identityDid
+                && provider.agentConsumerGeneration === generation;
         }
-        releaseFailedListener(provider, listener, workspaceContext, generation, error) {
-            if (provider.listener !== listener)
+        async detachAgentConsumer(provider) {
+            const consumer = provider.agentConsumer;
+            if (consumer === undefined)
                 return;
-            delete provider.listener;
-            const startedAt = provider.listenerStartedAt;
-            delete provider.listenerStartedAt;
-            if (startedAt !== undefined && Date.now() - startedAt >= LISTENER_STABLE_RESET_MS) {
-                provider.listenerRestartAttempt = 0;
-            }
-            const logger = this.ctx.logger('awiki-listener');
-            logger.warn('AWiki listener lifecycle failed: %s', error instanceof Error ? error.message : 'unknown failure');
-            let disposed = false;
-            const cleanup = listener.dispose()
-                .then(() => { disposed = true; }, (cleanupError) => {
-                provider.listenerRecoveryBlocked = true;
-                logger.warn('AWiki listener cleanup failed: %s', cleanupError instanceof Error ? cleanupError.message : 'unknown failure');
-            });
+            delete provider.agentConsumer;
+            delete provider.agentConsumerIdentityDid;
+            const cleanup = consumer.dispose();
             const observed = cleanup.finally(() => {
-                if (provider.listenerCleanup === observed)
-                    delete provider.listenerCleanup;
-                if (disposed)
-                    this.scheduleListenerRestart(provider, workspaceContext, generation);
+                if (provider.agentConsumerCleanup === observed)
+                    delete provider.agentConsumerCleanup;
             });
-            provider.listenerCleanup = observed;
-        }
-        scheduleListenerRestart(provider, workspaceContext, generation) {
-            if (provider.listenerRestartTimer !== undefined
-                || !this.listenerFenceMatches(provider, workspaceContext, generation))
+            provider.agentConsumerCleanup = observed;
+            await observed;
+        }
+        async stopAgentConsumer(provider) {
+            provider.agentConsumerGeneration += 1;
+            await provider.agentConsumerStartup;
+            await provider.agentConsumerCleanup;
+            await this.detachAgentConsumer(provider);
+        }
+        async stopRealtimeSupervisor(provider) {
+            provider.realtimeGeneration += 1;
+            await provider.realtimeStartup;
+            const supervisor = provider.realtimeSupervisor;
+            if (supervisor === undefined)
                 return;
-            provider.listenerRestartAttempt = Math.min(provider.listenerRestartAttempt + 1, LISTENER_RESTART_MAX_ATTEMPT);
-            const exponent = provider.listenerRestartAttempt - 1;
-            const delay = Math.min(LISTENER_RESTART_BASE_DELAY_MS * 2 ** exponent, LISTENER_RESTART_MAX_DELAY_MS);
-            const timer = setTimeout(() => {
-                if (provider.listenerRestartTimer !== timer)
-                    return;
-                delete provider.listenerRestartTimer;
-                if (!this.listenerFenceMatches(provider, workspaceContext, generation))
-                    return;
-                void this.startListener(provider);
-            }, delay);
-            provider.listenerRestartTimer = timer;
+            delete provider.realtimeSupervisor;
+            delete provider.realtimeIdentityDid;
+            await supervisor.dispose();
+        }
+        async stopProviderRuntime(provider) {
+            await Promise.all([
+                this.stopRealtimeSupervisor(provider),
+                this.stopAgentConsumer(provider),
+            ]);
         }
         /** Clear one exact provider slot before joining its one shared disposal. */
         disposeProvider(provider) {
-            if (this.provider === provider)
+            if (this.provider === provider) {
                 this.provider = undefined;
+                this.pendingDeviceJoin = undefined;
+                this.activeDeviceJoinSessionId = undefined;
+                this.invalidateSummaries();
+            }
             provider.disposal ??= (async () => {
                 try {
-                    await this.stopListener(provider);
+                    await provider.runtimeReplacement;
+                    await this.stopProviderRuntime(provider);
                 }
                 finally {
                     await provider.client.dispose();