@codemem/server 0.43.2 → 0.44.0-alpha.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, PROMPT_TRANSPORT_PROTOCOL_RANGE, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildViewerIdentityTarget, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, finishLegacyTeamSetupActivation, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectLegacyTeamSetupActivation, inviteTokenDigest, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, requestJson, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, MemoryStore, PROMPT_TRANSPORT_PROTOCOL_RANGE, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -10,7 +10,7 @@ import { drizzle } from "drizzle-orm/better-sqlite3";
 import { homedir, hostname, networkInterfaces } from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/middleware.ts
-var LOOPBACK_HOSTS = new Set([
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"127.0.0.1",
 	"localhost",
 	"::1"
@@ -32,7 +32,7 @@ function isLoopbackOrigin(origin) {
 	return LOOPBACK_HOSTS.has(hostname);
 }
 /** HTTP methods that mutate state and require origin validation. */
-var UNSAFE_METHODS = new Set([
+var UNSAFE_METHODS = /* @__PURE__ */ new Set([
 	"POST",
 	"DELETE",
 	"PATCH",
@@ -167,20 +167,20 @@ function createInMemoryRequestRateLimiter(windowMs = 6e4) {
 * codemem/viewer_routes/config.py, scoped to the TS runtime's current needs.
 */
 var REDACTED_VALUE = "[redacted]";
-var RUNTIMES = new Set([
+var RUNTIMES = /* @__PURE__ */ new Set([
 	"api_http",
 	"claude_sidecar",
 	"codex_sidecar"
 ]);
-var AUTH_SOURCES = new Set([
+var AUTH_SOURCES = /* @__PURE__ */ new Set([
 	"auto",
 	"env",
 	"file",
 	"command",
 	"none"
 ]);
-var HOT_RELOAD_KEYS = new Set(["raw_events_sweeper_interval_s"]);
-var PROTECTED_WRITE_KEYS = new Set([
+var HOT_RELOAD_KEYS = /* @__PURE__ */ new Set(["raw_events_sweeper_interval_s"]);
+var PROTECTED_WRITE_KEYS = /* @__PURE__ */ new Set([
 	"claude_command",
 	"codex_command",
 	"observer_base_url",
@@ -189,13 +189,13 @@ var PROTECTED_WRITE_KEYS = new Set([
 	"observer_headers",
 	"sync_coordinator_url"
 ]);
-var SECRET_CONFIG_KEYS = new Set([
+var SECRET_CONFIG_KEYS = /* @__PURE__ */ new Set([
 	"observer_auth_file",
 	"observer_auth_command",
 	"observer_headers",
 	"sync_coordinator_admin_secret"
 ]);
-var REMOVED_CONFIG_KEYS = new Set(["observer_rich_openai_use_responses"]);
+var REMOVED_CONFIG_KEYS = /* @__PURE__ */ new Set(["observer_rich_openai_use_responses"]);
 var ALLOWED_KEYS = [
 	"claude_command",
 	"codex_command",
@@ -489,7 +489,7 @@ function configRoutes(opts = {}) {
 		const effectiveChangedKeys = ALLOWED_KEYS.filter((key) => !configValuesEqual(beforeEffective[key], afterEffective[key]));
 		const envOverrides = getCodememEnvOverrides();
 		const ignoredByEnvKeys = savedChangedKeys.filter((key) => !effectiveChangedKeys.includes(key) && key in envOverrides);
-		const hotReloadedKeys = applyRuntimeEffects([...new Set([
+		const hotReloadedKeys = applyRuntimeEffects([.../* @__PURE__ */ new Set([
 			...touchedKeys,
 			...savedChangedKeys,
 			...effectiveChangedKeys
@@ -689,7 +689,7 @@ function attachResolvedIdentityFieldsUnsafe(store, items) {
 		   AND TRIM(COALESCE(pinned_fingerprint, '')) <> ''`);
 	const peerByDevice = new Map(peers.map((peer) => [peer.peer_device_id, peer]));
 	const peerActorIds = peers.map((peer) => String(peer.actor_id ?? "").trim()).filter((actorId) => actorId.length > 0);
-	const actorRows = batchedLookup(store, [...new Set([...actorIds, ...peerActorIds])], (placeholders) => `SELECT actor_id, display_name, status, merged_into_actor_id FROM actors
+	const actorRows = batchedLookup(store, [.../* @__PURE__ */ new Set([...actorIds, ...peerActorIds])], (placeholders) => `SELECT actor_id, display_name, status, merged_into_actor_id FROM actors
 			 WHERE actor_id IN (${placeholders})`);
 	const devices = batchedLookup(store, deviceIds, (placeholders) => `SELECT device_id, display_name FROM identity_devices
 		 WHERE device_id IN (${placeholders}) AND status = 'active'`);
@@ -1266,7 +1266,11 @@ function observerStatusRoutes(deps) {
 //#endregion
 //#region src/routes/target-validation.ts
 var IDENTITY_TARGET_KEYS = new Set(VIEWER_IDENTITY_TARGET_KEYS);
-var BOOLEAN_IDENTITY_TARGET_KEYS = new Set(["actor_id_present", "embedding_disabled"]);
+var BOOLEAN_IDENTITY_TARGET_KEYS = /* @__PURE__ */ new Set([
+	"actor_id_present",
+	"embedding_disabled",
+	"embedding_offline"
+]);
 function invalidRequest$1(message) {
 	return {
 		ok: false,
@@ -1330,12 +1334,12 @@ function validateViewerTarget(store, payload, options = {}) {
 }
 //#endregion
 //#region src/routes/pack.ts
-var MAX_LEDGER_PAYLOAD_BYTES = 16 * 1024;
+var MAX_LEDGER_PAYLOAD_BYTES = 16384;
 var MAX_METADATA_FIELD_CHARS = 512;
 var MAX_WORKING_SET_FILES = 50;
 var MAX_WORKING_SET_PATH_CHARS = 512;
 var INVALID_JSON = Symbol("invalid-json");
-var PACK_KEYS = new Set([
+var PACK_KEYS = /* @__PURE__ */ new Set([
 	"context",
 	"limit",
 	"token_budget",
@@ -1349,7 +1353,7 @@ var PACK_KEYS = new Set([
 	"identity_target",
 	"attempt"
 ]);
-var LEDGER_KEYS = new Set([
+var LEDGER_KEYS = /* @__PURE__ */ new Set([
 	"action",
 	"attempt_id",
 	"started_at",
@@ -1366,7 +1370,7 @@ var LEDGER_KEYS = new Set([
 	"db_path",
 	"identity_target"
 ]);
-var ATTEMPT_KEYS = new Set([
+var ATTEMPT_KEYS = /* @__PURE__ */ new Set([
 	"attempt_id",
 	"started_at",
 	"source",
@@ -1375,7 +1379,7 @@ var ATTEMPT_KEYS = new Set([
 	"prompt_number",
 	"request_id"
 ]);
-var FORBIDDEN_LEDGER_KEYS = new Set([
+var FORBIDDEN_LEDGER_KEYS = /* @__PURE__ */ new Set([
 	"body",
 	"context",
 	"pack",
@@ -1698,7 +1702,7 @@ function isClaudeBoundaryEnvelope(envelope) {
 	const hookEventName = meta.hook_event_name;
 	return hookEventName === "SessionEnd" || hookEventName === "Stop";
 }
-var SAFE_INGEST_VALIDATION_ERRORS = new Set([
+var SAFE_INGEST_VALIDATION_ERRORS = /* @__PURE__ */ new Set([
 	"source must be string",
 	"source is required",
 	"source must use 1-64 letters, digits, dots, underscores, or hyphens",
@@ -2295,7 +2299,6 @@ var MAX_CONFIGURED_GROUPS = 25;
 var MAX_SCOPE_EVIDENCE_COORDINATORS = 100;
 var MAX_DEVICES = 500;
 var MAX_PROJECTS = 500;
-var MAX_ACCESS_DELTA_ENTRIES = 1e4;
 var MAX_IDENTITY_CHOICES = 500;
 var MAX_COMPLETED_IDENTITY_CHOICES = MAX_DEVICES * 4;
 var MAX_PROJECT_MAPPING_CHOICES = 500;
@@ -2315,6 +2318,46 @@ var ATTEMPT_ID_PATTERN = /^legacy-team-attempt:[0-9a-f-]{36}$/u;
 var FINISH_DIGEST_PATTERN = /^legacy-team-activation-finish-v1:[0-9a-f]{64}$/u;
 var ACCESS_DELTA_DIGEST_PATTERN = /^legacy-team-access-delta:[0-9a-f]{64}$/u;
 var VIEWER_ACCESS_DELTA_DIGEST_PATTERN = /^legacy-team-viewer-access-delta-v1:[0-9a-f]{64}$/u;
+var activeCandidateMutations = /* @__PURE__ */ new WeakMap();
+function claimCandidateMutation(db, candidateRef) {
+	let active = activeCandidateMutations.get(db);
+	if (!active) {
+		active = /* @__PURE__ */ new Map();
+		activeCandidateMutations.set(db, active);
+	}
+	if (active.has(candidateRef)) return null;
+	let settle = () => void 0;
+	const settled = new Promise((resolve) => {
+		settle = resolve;
+	});
+	active.set(candidateRef, settled);
+	let released = false;
+	return () => {
+		if (released) return;
+		released = true;
+		active?.delete(candidateRef);
+		settle();
+	};
+}
+/** Resolves once the current holder of the candidate claim (if any) releases it. */
+function candidateMutationSettled(db, candidateRef) {
+	return activeCandidateMutations.get(db)?.get(candidateRef) ?? Promise.resolve();
+}
+async function runCandidateMutation(db, candidateRef, operation) {
+	const release = claimCandidateMutation(db, candidateRef);
+	if (!release) return false;
+	try {
+		await operation();
+		return true;
+	} finally {
+		release();
+	}
+}
+var defaultCompletionDependencies = {
+	create: coordinatorCreateLegacyTeamCompletionAction,
+	get: coordinatorGetLegacyTeamCompletionAction,
+	list: coordinatorListLegacyTeamCompletionsAction
+};
 var defaultSnapshotLoaderDependencies = {
 	readConfig: readCoordinatorSyncConfig,
 	listGroups: coordinatorListGroupsAction,
@@ -2326,19 +2369,45 @@ function safeCoordinatorError() {
 function isCoordinatorRosterTooLargeError(error) {
 	return error instanceof Error && error.message === "coordinator_response_too_large";
 }
+function remoteCoordinatorHttpStatus(error) {
+	if (!(error instanceof Error)) return null;
+	const status = /Remote coordinator request failed \((\d{3})\):/u.exec(error.message)?.[1];
+	return status ? Number(status) : null;
+}
 function isTransientCoordinatorReadError(error) {
 	if (!(error instanceof Error)) return false;
-	const remoteStatus = /Remote coordinator request failed \((\d{3})\):/u.exec(error.message)?.[1];
+	const remoteStatus = remoteCoordinatorHttpStatus(error);
 	if (remoteStatus) return [
-		"408",
-		"429",
-		"500",
-		"502",
-		"503",
-		"504"
+		408,
+		429,
+		500,
+		502,
+		503,
+		504
 	].includes(remoteStatus);
 	return error.name === "TimeoutError" || error.name === "AbortError" || /request_timeout|fetch failed|timed out|timeout/iu.test(error.message);
 }
+function isUnsupportedCompletionQuery(error) {
+	const status = remoteCoordinatorHttpStatus(error);
+	return status === 404 || status === 405;
+}
+/**
+* Batch completion decoding rejects the whole payload when any one record is
+* malformed or misattributed, so the failure cannot be pinned to a group.
+*/
+function isUnattributableCompletionBatchError(error) {
+	return error instanceof Error && (error.message === "coordinator_completion_response_malformed" || error.message === "coordinator_completion_group_mismatch");
+}
+async function listCompletionRecordsPerGroup(groupIds, list) {
+	if (groupIds.length < 2) return [];
+	const records = [];
+	for (const groupId of groupIds) try {
+		records.push(...await list([groupId]));
+	} catch (error) {
+		if (!isUnattributableCompletionBatchError(error)) throw error;
+	}
+	return records;
+}
 async function retryTransientCoordinatorRead(read, configuredTimeoutS, deadlineMs) {
 	let lastError;
 	for (let attempt = 0; attempt < 8; attempt += 1) {
@@ -2356,6 +2425,10 @@ async function retryTransientCoordinatorRead(read, configuredTimeoutS, deadlineM
 	}
 	throw lastError;
 }
+function remainingCoordinatorTimeoutS(configuredTimeoutS, deadlineMs, nowMs = Date.now()) {
+	const remainingMs = deadlineMs - nowMs;
+	return remainingMs <= 0 ? null : Math.max(.1, Math.min(configuredTimeoutS, remainingMs / 1e3));
+}
 function configuredGroupIds(groups) {
 	const unique = [...new Set(groups.map((group) => group.trim()).filter(Boolean))];
 	if (unique.length > MAX_CONFIGURED_GROUPS) throw safeCoordinatorError();
@@ -2456,7 +2529,7 @@ async function loadConfiguredLegacyTeamGroupSnapshotsWith(dependencies, options
 		const groupDescriptors = legacyTeamCandidateGroupDescriptors(store, config.syncCoordinatorUrl, config.syncCoordinatorGroups);
 		if (groupDescriptors.length === 0) throw safeCoordinatorError();
 		const timeoutS = Math.max(1, config.syncCoordinatorTimeoutS);
-		const deadlineMs = Date.now() + COORDINATOR_ROSTER_READ_BUDGET_MS;
+		const deadlineMs = options.deadlineMs ?? Date.now() + COORDINATOR_ROSTER_READ_BUDGET_MS;
 		const requestedGroupDescriptors = options.candidateRef ? groupDescriptors.filter(({ coordinatorId, groupId }) => legacyTeamCandidateId(coordinatorId, groupId) === options.candidateRef) : groupDescriptors;
 		const groups = await retryTransientCoordinatorRead((attemptTimeoutS) => dependencies.listGroups({
 			remoteUrl,
@@ -2712,10 +2785,6 @@ function viewerSafeAccessDelta(candidateRef, delta, labels) {
 function viewerAccessDeltaDigest(delta) {
 	return recipientPolicyDigest("legacy-team-viewer-access-delta-v1", delta);
 }
-function requireBoundedAccessDelta(delta) {
-	const total = delta.teamChanges.length + delta.membershipChanges.length + delta.projectChanges.length + delta.recipientChanges.length + delta.deviceAccessChanges.length;
-	if (delta.teamChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.membershipChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.projectChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.recipientChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.deviceAccessChanges.length > MAX_ACCESS_DELTA_ENTRIES || total > MAX_ACCESS_DELTA_ENTRIES) throw new Error("legacy_team_setup_roster_too_large");
-}
 var SAFE_CHOICE_LABEL_PATTERN = /^[\p{L}\p{N} '&,.()_-]*$/u;
 function normalizeChoiceLabelText(value) {
 	return value.normalize("NFKC").replace(/\p{Cf}/gu, "").replace(/\p{Cc}/gu, " ").replace(/\s+/gu, " ").trim();
@@ -2919,7 +2988,7 @@ function viewerSafePreview(draft, safeDraft, preview) {
 	};
 }
 function errorStatus$1(code) {
-	if (code === "team_setup_roster_unavailable") return 503;
+	if (code === "team_setup_roster_unavailable" || code === "team_setup_completion_unavailable") return 503;
 	if (code === "team_setup_failed") return 503;
 	if (code === "team_setup_incomplete") return 400;
 	return 409;
@@ -2928,6 +2997,10 @@ function apiErrorCode(error) {
 	const code = legacyTeamSetupApiErrorCode(error);
 	return code === "team_setup_projection_changed" ? "team_setup_conflict" : code;
 }
+function completionApiError(error) {
+	const code = legacyTeamSetupApiErrorCode(error);
+	return code === "team_setup_failed" ? "team_setup_completion_unavailable" : code;
+}
 async function parseBoundedJsonObject(c) {
 	if (c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return { ok: false };
 	const lengthHeader = c.req.header("content-length");
@@ -2991,7 +3064,7 @@ function detailResponse(store, draft, candidate = candidateFromDraft(draft)) {
 		if (code === "team_setup_projection_changed") unavailableReason = "team_setup_conflict";
 		else if (code !== "team_setup_incomplete") unavailableReason = code;
 	}
-	if (preview) requireBoundedAccessDelta(preview.accessDelta);
+	if (preview) requireLegacyTeamSetupAccessDeltaWithinLimit(preview.accessDelta);
 	const safeDraft = viewerSafeDraft(store, draft);
 	const safePreview = preview ? viewerSafePreview(draft, safeDraft, preview) : null;
 	return projectLegacyTeamSetupView({
@@ -3019,9 +3092,12 @@ function finishResponse(candidateRef, result) {
 function teamSetupRoutes(options) {
 	const app = new Hono();
 	const loadSnapshots = options.loadLegacyTeamConfiguredGroupSnapshots ?? ((loadOptions) => loadConfiguredLegacyTeamGroupSnapshotsWith(options.snapshotLoaderDependencies ?? defaultSnapshotLoaderDependencies, loadOptions, options.getStore));
-	async function loadedSnapshots(candidateRef) {
+	async function loadedSnapshots(candidateRef, deadlineMs) {
 		try {
-			return await loadSnapshots(candidateRef ? { candidateRef } : void 0);
+			return await loadSnapshots(candidateRef || deadlineMs != null ? {
+				candidateRef,
+				deadlineMs
+			} : void 0);
 		} catch (error) {
 			if (error instanceof Error && error.message === "legacy_team_setup_roster_too_large") throw error;
 			throw safeCoordinatorError();
@@ -3029,12 +3105,341 @@ function teamSetupRoutes(options) {
 	}
 	const loadedSummarySnapshots = createCachedSnapshotLoader(() => loadedSnapshots(), SUMMARY_SNAPSHOT_CACHE_TTL_MS);
 	options.registerSummaryInvalidator?.(() => loadedSummarySnapshots.invalidate());
+	const completionDependencies = options.completionDependencies === void 0 ? defaultCompletionDependencies : options.completionDependencies;
+	/**
+	* Reads the live coordinator configuration and the groups it currently
+	* authorizes. Returns null when completion I/O is not configured or current
+	* authorization cannot be proven.
+	*/
+	function currentCompletionAuthorization() {
+		const config = (options.readCoordinatorConfig ?? options.snapshotLoaderDependencies?.readConfig ?? readCoordinatorSyncConfig)();
+		const remoteUrl = buildBaseUrl(config.syncCoordinatorUrl);
+		if (!remoteUrl || !config.syncCoordinatorAdminSecret) return null;
+		const configuredCoordinatorId = normalizedCoordinatorId(remoteUrl);
+		if (!configuredCoordinatorId) return null;
+		let currentGroupIds;
+		try {
+			currentGroupIds = new Set(configuredGroupIds(config.syncCoordinatorGroups));
+		} catch {
+			return null;
+		}
+		return {
+			config,
+			remoteUrl,
+			configuredCoordinatorId,
+			currentGroupIds
+		};
+	}
+	function authorizesGroup(authorization, group) {
+		return authorization.currentGroupIds.has(group.groupId) && normalizedCoordinatorId(group.coordinatorId) === authorization.configuredCoordinatorId;
+	}
+	/**
+	* Configuration may change while completion-list or roster requests are in
+	* flight. Re-prove authorization for the exact coordinator and group right
+	* before applying canonical policy, as the finish publication path does.
+	*/
+	function stillAuthorizesGroup(initial, group) {
+		let current;
+		try {
+			current = currentCompletionAuthorization();
+		} catch {
+			return false;
+		}
+		return current !== null && current.configuredCoordinatorId === initial.configuredCoordinatorId && current.remoteUrl === initial.remoteUrl && current.config.syncCoordinatorAdminSecret === initial.config.syncCoordinatorAdminSecret && authorizesGroup(current, group);
+	}
+	function matchesGroupSnapshot(snapshot, group) {
+		return snapshot.groupId === group.groupId && normalizedCoordinatorId(snapshot.coordinatorId) === normalizedCoordinatorId(group.coordinatorId);
+	}
+	function freshGroupKey(group) {
+		return `${normalizedCoordinatorId(group.coordinatorId) ?? group.coordinatorId}\0${group.groupId}`;
+	}
+	/**
+	* The snapshot loader keys candidates by the configured coordinator spelling,
+	* while a persisted group may carry an equivalent but different spelling.
+	* Ask for the roster under each spelling and match on normalized identity,
+	* preserving the persisted candidate identity for everything else.
+	*/
+	async function loadFreshGroupSnapshot(group, remoteUrl, deadlineMs) {
+		const candidateRefs = [.../* @__PURE__ */ new Set([legacyTeamCandidateId(remoteUrl, group.groupId), legacyTeamCandidateId(group.coordinatorId, group.groupId)])];
+		for (const candidateRef of candidateRefs) {
+			const matches = (await loadedSnapshots(candidateRef, deadlineMs)).filter((snapshot) => matchesGroupSnapshot(snapshot, group));
+			if (matches.length > 1) throw new Error("team_setup_completion_invalid");
+			if (matches[0]) return matches[0];
+		}
+	}
+	function completionRecordCandidateRef(record) {
+		const manifest = record.manifest;
+		if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) return null;
+		const candidateRef = manifest.candidate_ref;
+		return typeof candidateRef === "string" ? candidateRef : null;
+	}
+	function belongsToGroupCandidate(record, group) {
+		const candidateRef = completionRecordCandidateRef(record);
+		return candidateRef === null || candidateRef === legacyTeamCandidateId(group.coordinatorId, group.groupId);
+	}
+	/**
+	* Applies a canonical manifest with authorization re-proven inside the same
+	* serialized section that guards the apply. Checking before the locks would
+	* let a group removed while reconciliation waited on another policy
+	* mutation still be applied once the queues open.
+	*/
+	async function applyCanonicalManifestIfStillAuthorized(store, authorization, group, manifest, freshRoster) {
+		let outcome = "unauthorized";
+		return await runCandidateMutation(store.db, legacyTeamCandidateId(group.coordinatorId, group.groupId), () => serializeRecipientPolicyPublicationMutation(store.db, () => serializeRecipientPolicyTeamMutation(store.db, manifest.team_id, () => serializeRecipientPolicyCoordinatorGroupMutation(store.db, group.groupId, async () => {
+			if (!stillAuthorizesGroup(authorization, group)) return;
+			await applyLegacyTeamSetupCompletionManifest(store.db, {
+				coordinatorId: group.coordinatorId,
+				groupId: group.groupId,
+				manifest,
+				freshRoster,
+				recipientPolicyLocksHeld: {
+					publication: true,
+					team: true,
+					coordinatorGroup: true
+				}
+			});
+			outcome = "applied";
+		})))) ? outcome : "claimed";
+	}
+	async function reconcileCompletions(store, groups, reconciliationOptions = {}) {
+		if (!completionDependencies || groups.length === 0) return;
+		let authorization;
+		try {
+			authorization = currentCompletionAuthorization();
+		} catch (error) {
+			throw new Error(completionApiError(error));
+		}
+		if (!authorization) return;
+		const { config, remoteUrl } = authorization;
+		const scopedGroups = groups.filter((group) => authorizesGroup(authorization, group));
+		if (scopedGroups.length === 0) return;
+		const timeoutS = Math.max(1, config.syncCoordinatorTimeoutS);
+		try {
+			const reconciliationDeadlineMs = Date.now() + COORDINATOR_ROSTER_READ_BUDGET_MS;
+			const groupById = new Map(scopedGroups.map((group) => [group.groupId, group]));
+			const listCompletionRecords = (groupIds) => retryTransientCoordinatorRead((attemptTimeoutS) => completionDependencies.list({
+				groupIds,
+				remoteUrl,
+				adminSecret: config.syncCoordinatorAdminSecret,
+				timeoutS: attemptTimeoutS
+			}), timeoutS, reconciliationDeadlineMs);
+			const scopedGroupIds = [...new Set(scopedGroups.map((group) => group.groupId))];
+			let records;
+			try {
+				records = await listCompletionRecords(scopedGroupIds);
+			} catch (error) {
+				if (isUnsupportedCompletionQuery(error)) records = [];
+				else if (reconciliationOptions.isolateApplyFailures && isUnattributableCompletionBatchError(error)) records = await listCompletionRecordsPerGroup(scopedGroupIds, listCompletionRecords);
+				else throw error;
+			}
+			const freshGroupByKey = /* @__PURE__ */ new Map();
+			if (records.length > 0) try {
+				const onlyGroup = scopedGroups.length === 1 ? scopedGroups[0] : void 0;
+				const freshGroups = onlyGroup ? [await loadFreshGroupSnapshot(onlyGroup, remoteUrl, reconciliationDeadlineMs)] : await loadedSnapshots(void 0, reconciliationDeadlineMs);
+				for (const freshGroup of freshGroups) {
+					if (!freshGroup) continue;
+					const key = freshGroupKey(freshGroup);
+					if (freshGroupByKey.has(key)) throw new Error("team_setup_completion_invalid");
+					freshGroupByKey.set(key, freshGroup);
+				}
+			} catch (error) {
+				for (const record of records) {
+					const group = groupById.get(record.group_id);
+					if (!group || !belongsToGroupCandidate(record, group)) continue;
+					try {
+						validateLegacyTeamSetupCompletionManifestBinding(record.manifest, {
+							coordinatorId: group.coordinatorId,
+							groupId: group.groupId
+						});
+					} catch (bindingError) {
+						if (!reconciliationOptions.isolateApplyFailures) throw bindingError;
+						continue;
+					}
+					let canonicalManifest;
+					try {
+						canonicalManifest = validateLegacyTeamSetupCompletionManifest(record.manifest, {
+							coordinatorId: group.coordinatorId,
+							groupId: group.groupId
+						});
+					} catch (validationError) {
+						try {
+							if (!await runCandidateMutation(store.db, legacyTeamCandidateId(group.coordinatorId, group.groupId), () => containLegacyTeamSetupCompletionConflict(store.db, {
+								coordinatorId: group.coordinatorId,
+								groupId: group.groupId
+							}))) {
+								if (!reconciliationOptions.isolateApplyFailures) throw validationError;
+								continue;
+							}
+						} catch (containmentError) {
+							if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+						}
+						if (!reconciliationOptions.isolateApplyFailures) throw validationError;
+						continue;
+					}
+					try {
+						const localManifest = reconstructLegacyTeamSetupCompletionManifest(store.db, { candidateRef: canonicalManifest.candidate_ref });
+						if (canonicalCoordinatorLegacyTeamCompletionManifestJson(localManifest) === canonicalCoordinatorLegacyTeamCompletionManifestJson(canonicalManifest)) continue;
+						if (areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible(localManifest, canonicalManifest)) continue;
+					} catch {}
+					try {
+						await runCandidateMutation(store.db, canonicalManifest.candidate_ref, () => containLegacyTeamSetupCompletionConflict(store.db, {
+							coordinatorId: group.coordinatorId,
+							groupId: group.groupId
+						}));
+					} catch (containmentError) {
+						if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+					}
+				}
+				if (!reconciliationOptions.isolateApplyFailures) throw error;
+				return;
+			}
+			const coordinatorCompletionGroupIds = /* @__PURE__ */ new Set();
+			for (const record of records) {
+				const group = groupById.get(record.group_id);
+				if (!group) throw new Error("team_setup_completion_invalid");
+				if (!belongsToGroupCandidate(record, group)) continue;
+				try {
+					validateLegacyTeamSetupCompletionManifestBinding(record.manifest, {
+						coordinatorId: group.coordinatorId,
+						groupId: group.groupId
+					});
+				} catch (bindingError) {
+					if (!reconciliationOptions.isolateApplyFailures) throw bindingError;
+					continue;
+				}
+				let canonicalManifest;
+				try {
+					canonicalManifest = validateLegacyTeamSetupCompletionManifest(record.manifest, {
+						coordinatorId: group.coordinatorId,
+						groupId: group.groupId
+					});
+				} catch (validationError) {
+					try {
+						await runCandidateMutation(store.db, legacyTeamCandidateId(group.coordinatorId, group.groupId), () => containLegacyTeamSetupCompletionConflict(store.db, {
+							coordinatorId: group.coordinatorId,
+							groupId: group.groupId
+						}));
+					} catch (containmentError) {
+						if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+					}
+					if (!reconciliationOptions.isolateApplyFailures) throw validationError;
+					continue;
+				}
+				coordinatorCompletionGroupIds.add(record.group_id);
+				try {
+					let freshGroup = freshGroupByKey.get(freshGroupKey(group));
+					if (!freshGroup && scopedGroups.length > 1) {
+						if (remainingCoordinatorTimeoutS(timeoutS, reconciliationDeadlineMs) == null) throw new Error("team_setup_roster_unavailable");
+						freshGroup = await loadFreshGroupSnapshot(group, remoteUrl, reconciliationDeadlineMs);
+					}
+					if (!freshGroup) {
+						if (!await runCandidateMutation(store.db, legacyTeamCandidateId(group.coordinatorId, group.groupId), () => containLegacyTeamSetupCompletionConflict(store.db, {
+							coordinatorId: group.coordinatorId,
+							groupId: group.groupId
+						}))) {
+							if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_invalid");
+							continue;
+						}
+						throw new Error("team_setup_completion_invalid");
+					}
+					if (await applyCanonicalManifestIfStillAuthorized(store, authorization, group, canonicalManifest, freshGroup.devices) !== "applied") continue;
+				} catch (error) {
+					if (!reconciliationOptions.isolateApplyFailures) throw error;
+				}
+			}
+			for (const group of scopedGroups) {
+				if (coordinatorCompletionGroupIds.has(group.groupId)) continue;
+				const publicationTimeoutS = remainingCoordinatorTimeoutS(timeoutS, reconciliationDeadlineMs);
+				if (publicationTimeoutS == null) break;
+				if (!hasCompletedLegacyTeamSetup(store, legacyTeamCandidateId(group.coordinatorId, group.groupId))) continue;
+				const candidateRef = legacyTeamCandidateId(group.coordinatorId, group.groupId);
+				let reconstructionFailed = false;
+				try {
+					if (!await runCandidateMutation(store.db, candidateRef, () => serializeRecipientPolicyPublicationMutation(store.db, () => serializeRecipientPolicyTeamMutation(store.db, deterministicPolicyTeamId(candidateRef), async () => {
+						let manifest;
+						try {
+							manifest = reconstructLegacyTeamSetupCompletionManifest(store.db, { candidateRef });
+						} catch {
+							reconstructionFailed = true;
+							return;
+						}
+						if (!stillAuthorizesGroup(authorization, group)) {
+							reconstructionFailed = true;
+							return;
+						}
+						await completionDependencies.create({
+							groupId: group.groupId,
+							manifest,
+							remoteUrl,
+							adminSecret: config.syncCoordinatorAdminSecret,
+							timeoutS: publicationTimeoutS
+						});
+					}))) || reconstructionFailed) continue;
+				} catch (error) {
+					if (completionApiError(error) !== "team_setup_completion_conflict") continue;
+					const getCompletion = completionDependencies.get;
+					let canonicalManifest = null;
+					try {
+						if (!getCompletion) throw new Error("team_setup_completion_conflict");
+						canonicalManifest = await retryTransientCoordinatorRead((attemptTimeoutS) => getCompletion({
+							groupId: group.groupId,
+							candidateRef,
+							remoteUrl,
+							adminSecret: config.syncCoordinatorAdminSecret,
+							timeoutS: attemptTimeoutS
+						}), timeoutS, reconciliationDeadlineMs);
+						if (!canonicalManifest) throw new Error("team_setup_completion_conflict");
+					} catch {
+						try {
+							if (!await runCandidateMutation(store.db, candidateRef, () => containLegacyTeamSetupCompletionConflict(store.db, {
+								coordinatorId: group.coordinatorId,
+								groupId: group.groupId
+							}))) {
+								if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_conflict");
+								continue;
+							}
+						} catch (containmentError) {
+							if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+							continue;
+						}
+						if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_conflict");
+						continue;
+					}
+					try {
+						const freshGroup = await loadFreshGroupSnapshot(group, remoteUrl, reconciliationDeadlineMs);
+						if (!freshGroup) throw new Error("team_setup_roster_unavailable");
+						if (await applyCanonicalManifestIfStillAuthorized(store, authorization, group, canonicalManifest, freshGroup.devices) !== "applied") continue;
+					} catch (applyError) {
+						if (applyError instanceof LegacyTeamSetupAdditiveConvergenceError) {
+							if (!reconciliationOptions.isolateApplyFailures) throw applyError;
+							continue;
+						}
+						try {
+							if (!await runCandidateMutation(store.db, candidateRef, () => containLegacyTeamSetupCompletionConflict(store.db, {
+								coordinatorId: group.coordinatorId,
+								groupId: group.groupId
+							}))) {
+								if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_conflict", { cause: applyError });
+								continue;
+							}
+						} catch (containmentError) {
+							if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+							continue;
+						}
+						if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_conflict", { cause: applyError });
+					}
+				}
+			}
+		} catch (error) {
+			throw new Error(completionApiError(error));
+		}
+	}
 	async function loadedCandidateSnapshots(candidateRef, loadOptions = {}) {
 		const allowCachedSummaryFallback = loadOptions.allowCachedSummaryFallback ?? false;
 		const invalidateSummaryCache = loadOptions.invalidateSummaryCache ?? true;
 		if (invalidateSummaryCache) loadedSummarySnapshots.invalidate();
 		try {
-			return await loadedSnapshots(candidateRef);
+			return await loadedSnapshots(candidateRef, loadOptions.deadlineMs);
 		} catch (error) {
 			if (!allowCachedSummaryFallback) throw error;
 			const cachedGroups = loadedSummarySnapshots.peek();
@@ -3046,6 +3451,15 @@ function teamSetupRoutes(options) {
 			if (invalidateSummaryCache) loadedSummarySnapshots.invalidate();
 		}
 	}
+	function persistedCompletionGroup(store, candidateRef) {
+		const row = store.db.prepare(`SELECT coordinator_id, group_id FROM legacy_team_setup_drafts
+				 WHERE candidate_id = ? ORDER BY rowid DESC LIMIT 1`).get(candidateRef);
+		if (!row || legacyTeamCandidateId(row.coordinator_id, row.group_id) !== candidateRef) return null;
+		return {
+			coordinatorId: row.coordinator_id,
+			groupId: row.group_id
+		};
+	}
 	app.get("/api/sync/team-setup/v1", async (c) => {
 		let groups;
 		try {
@@ -3055,9 +3469,12 @@ function teamSetupRoutes(options) {
 			return c.json({ error: code }, errorStatus$1(code));
 		}
 		try {
+			const store = options.getStore();
+			readPureCandidateViews(store, groups);
+			await reconcileCompletions(store, groups, { isolateApplyFailures: true });
 			const response = {
 				version: TEAM_SETUP_VERSION,
-				candidates: readPureCandidateViews(options.getStore(), groups).map(candidateSummary).filter((candidate) => candidate.status !== "ready")
+				candidates: readPureCandidateViews(store, groups).map(candidateSummary).filter((candidate) => candidate.status !== "ready")
 			};
 			return c.json(response);
 		} catch (error) {
@@ -3072,6 +3489,7 @@ function teamSetupRoutes(options) {
 			const store = options.getStore();
 			let draft = getLegacyTeamSetupDraft(store.db, candidateRef);
 			const terminal = hasCompletedLegacyTeamSetup(store, candidateRef);
+			let candidateGroupsForCompletion = null;
 			if (terminal && draft?.state !== "completed") return c.json({ error: "team_setup_confirmation_stale" }, 404);
 			let candidate;
 			if (draft && (draft.state !== "completed" || terminal)) candidate = candidateFromDraft(draft);
@@ -3080,6 +3498,7 @@ function teamSetupRoutes(options) {
 					allowCachedSummaryFallback: draft == null,
 					invalidateSummaryCache: false
 				})).filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef);
+				candidateGroupsForCompletion = candidateGroups;
 				const postLoadDraft = getLegacyTeamSetupDraft(store.db, candidateRef);
 				if (hasCompletedLegacyTeamSetup(store, candidateRef)) {
 					if (postLoadDraft?.state !== "completed") return c.json({ error: "team_setup_confirmation_stale" }, 404);
@@ -3093,6 +3512,17 @@ function teamSetupRoutes(options) {
 				}
 			}
 			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			const cachedCandidateGroups = loadedSummarySnapshots.peek()?.filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef);
+			let completionGroups = candidateGroupsForCompletion ?? (cachedCandidateGroups?.length ? cachedCandidateGroups : null);
+			if (!completionGroups) {
+				const persistedGroup = persistedCompletionGroup(store, candidateRef);
+				completionGroups = persistedGroup ? [persistedGroup] : null;
+			}
+			const terminalBeforeReconciliation = hasCompletedLegacyTeamSetup(store, candidateRef);
+			if (completionGroups) await reconcileCompletions(store, completionGroups);
+			draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft || !terminalBeforeReconciliation && hasCompletedLegacyTeamSetup(store, candidateRef)) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (completionGroups) candidate = candidateFromDraft(draft);
 			return c.json(detailResponse(store, draft, candidate));
 		} catch (error) {
 			const code = apiErrorCode(error);
@@ -3128,12 +3558,18 @@ function teamSetupRoutes(options) {
 			]) && submittedExpectation.kind === "existing" && submittedExpectation.assignmentVersion === device.expectation.assignmentVersion && submittedExpectation.identityRef === requiredIdentityRef(candidateRef, device.expectation.identityId))) return c.json({ error: "team_setup_assignment_changed" }, 409);
 			const target = identityChoices(store, candidateRef).find((choice) => choice.identityRef === targetIdentityRef);
 			if (!target) return c.json({ error: "team_setup_confirmation_stale" }, 404);
-			return c.json(projectMutationAtomically(store, () => setLegacyTeamSetupDeviceAssignment(store.db, {
-				attemptId,
-				deviceRef,
-				targetIdentityId: target.identityId,
-				expectation: device.expectation
-			}), (draft) => detailResponse(store, draft)));
+			const releaseMutation = claimCandidateMutation(store.db, candidateRef);
+			if (!releaseMutation) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			try {
+				return c.json(projectMutationAtomically(store, () => setLegacyTeamSetupDeviceAssignment(store.db, {
+					attemptId,
+					deviceRef,
+					targetIdentityId: target.identityId,
+					expectation: device.expectation
+				}), (draft) => detailResponse(store, draft)));
+			} finally {
+				releaseMutation();
+			}
 		} catch (error) {
 			const code = apiErrorCode(error);
 			return c.json({ error: code }, errorStatus$1(code));
@@ -3165,11 +3601,17 @@ function teamSetupRoutes(options) {
 			const device = draft.devices.find((item) => item.deviceRef === deviceRef);
 			if (!device) return c.json({ error: "team_setup_confirmation_stale" }, 404);
 			if (decision === "included" && (device.targetIdentityId === null || requiredIdentityRef(candidateRef, device.targetIdentityId) !== expectedTargetIdentityRef)) return c.json({ error: "team_setup_assignment_changed" }, 409);
-			return c.json(projectMutationAtomically(store, () => setLegacyTeamSetupDeviceDecision(store.db, {
-				attemptId,
-				deviceRef,
-				decision
-			}), (draft) => detailResponse(store, draft)));
+			const releaseMutation = claimCandidateMutation(store.db, candidateRef);
+			if (!releaseMutation) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			try {
+				return c.json(projectMutationAtomically(store, () => setLegacyTeamSetupDeviceDecision(store.db, {
+					attemptId,
+					deviceRef,
+					decision
+				}), (draft) => detailResponse(store, draft)));
+			} finally {
+				releaseMutation();
+			}
 		} catch (error) {
 			const code = apiErrorCode(error);
 			return c.json({ error: code }, errorStatus$1(code));
@@ -3191,10 +3633,16 @@ function teamSetupRoutes(options) {
 			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
 			if (draft.state === "completed") return c.json({ error: "team_setup_confirmation_stale" }, 409);
 			if (!draft.devices.some((item) => item.deviceRef === deviceRef)) return c.json({ error: "team_setup_confirmation_stale" }, 404);
-			return c.json(projectMutationAtomically(store, () => clearLegacyTeamSetupDeviceDecision(store.db, {
-				attemptId,
-				deviceRef
-			}), (draft) => detailResponse(store, draft)));
+			const releaseMutation = claimCandidateMutation(store.db, candidateRef);
+			if (!releaseMutation) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			try {
+				return c.json(projectMutationAtomically(store, () => clearLegacyTeamSetupDeviceDecision(store.db, {
+					attemptId,
+					deviceRef
+				}), (draft) => detailResponse(store, draft)));
+			} finally {
+				releaseMutation();
+			}
 		} catch (error) {
 			const code = apiErrorCode(error);
 			return c.json({ error: code }, errorStatus$1(code));
@@ -3220,11 +3668,17 @@ function teamSetupRoutes(options) {
 			if (project.resolution === "deterministic") return c.json({ error: "team_setup_incomplete" }, 400);
 			const target = projectMappingChoices(store).find((choice) => legacyTeamResolvedProjectRef(projectRef, choice.projectIdentity) === resolvedProjectRef);
 			if (!target) return c.json({ error: "team_setup_confirmation_stale" }, 404);
-			return c.json(projectMutationAtomically(store, () => setLegacyTeamSetupProjectMapping(store.db, {
-				attemptId,
-				projectRef,
-				resolvedProjectIdentity: target.projectIdentity
-			}), (draft) => detailResponse(store, draft)));
+			const releaseMutation = claimCandidateMutation(store.db, candidateRef);
+			if (!releaseMutation) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			try {
+				return c.json(projectMutationAtomically(store, () => setLegacyTeamSetupProjectMapping(store.db, {
+					attemptId,
+					projectRef,
+					resolvedProjectIdentity: target.projectIdentity
+				}), (draft) => detailResponse(store, draft)));
+			} finally {
+				releaseMutation();
+			}
 		} catch (error) {
 			const code = apiErrorCode(error);
 			return c.json({ error: code }, errorStatus$1(code));
@@ -3252,13 +3706,19 @@ function teamSetupRoutes(options) {
 		}
 		if (groups.filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef).length === 0) return c.json({ error: "team_setup_confirmation_stale" }, 404);
 		try {
-			return c.json(projectMutationAtomically(store, () => {
-				if (getLegacyTeamSetupDraft(store.db, candidateRef)?.state === "completed" || hasCompletedLegacyTeamSetup(store, candidateRef)) throw new Error("team_setup_confirmation_stale");
-				return refreshLegacyTeamCandidate(store.db, {
-					projection: projectionOptions(store),
-					groups
-				}, candidateRef);
-			}, (draft) => detailResponse(store, draft)));
+			const releaseMutation = claimCandidateMutation(store.db, candidateRef);
+			if (!releaseMutation) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			try {
+				return c.json(projectMutationAtomically(store, () => {
+					if (getLegacyTeamSetupDraft(store.db, candidateRef)?.state === "completed" || hasCompletedLegacyTeamSetup(store, candidateRef)) throw new Error("team_setup_confirmation_stale");
+					return refreshLegacyTeamCandidate(store.db, {
+						projection: projectionOptions(store),
+						groups
+					}, candidateRef);
+				}, (draft) => detailResponse(store, draft)));
+			} finally {
+				releaseMutation();
+			}
 		} catch (error) {
 			const code = apiErrorCode(error);
 			return c.json({ error: code }, errorStatus$1(code));
@@ -3278,50 +3738,162 @@ function teamSetupRoutes(options) {
 		if (!hasExactKeys(parsed.value, finishKeys)) return Object.keys(parsed.value).every((key) => finishKeys.includes(key)) ? c.json({ error: "team_setup_confirmation_stale" }, 409) : c.json({ error: "team_setup_incomplete" }, 400);
 		const { attemptId, confirmedAccessDeltaDigest, confirmedViewerAccessDeltaDigest, finishDigest } = parsed.value;
 		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || typeof finishDigest !== "string" || !FINISH_DIGEST_PATTERN.test(finishDigest) || typeof confirmedAccessDeltaDigest !== "string" || !ACCESS_DELTA_DIGEST_PATTERN.test(confirmedAccessDeltaDigest) || typeof confirmedViewerAccessDeltaDigest !== "string" || !VIEWER_ACCESS_DELTA_DIGEST_PATTERN.test(confirmedViewerAccessDeltaDigest)) return c.json({ error: "team_setup_incomplete" }, 400);
+		let releaseMutation;
+		let releasePublicationMutation;
+		let releaseActorMutations;
 		try {
 			const store = options.getStore();
 			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
 			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
 			if (draft.state !== "completed" && hasCompletedLegacyTeamSetup(store, candidateRef)) return c.json({ error: "team_setup_confirmation_stale" }, 409);
 			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
-			if (draft.state !== "completed") {
-				const preview = previewLegacyTeamSetupActivation(store.db, {
+			const replay = replayLegacyTeamSetupActivation(store.db, {
+				candidateRef,
+				attemptId,
+				finishDigest,
+				confirmedAccessDeltaDigest
+			});
+			if (replay) return c.json(finishResponse(candidateRef, replay));
+			if (draft.state === "completed") return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const preview = previewLegacyTeamSetupActivation(store.db, {
+				candidateRef,
+				attemptId: draft.attemptId
+			});
+			requireLegacyTeamSetupAccessDeltaWithinLimit(preview.accessDelta);
+			const safeDraft = viewerSafeDraft(store, draft);
+			if (viewerAccessDeltaDigest(viewerSafeAccessDelta(candidateRef, preview.accessDelta, {
+				teamDisplayName: draft.displayName,
+				...safeDraft
+			})) !== confirmedViewerAccessDeltaDigest) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const matchingGroups = (await loadedCandidateSnapshots(candidateRef)).filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef);
+			if (matchingGroups.length !== 1) throw safeCoordinatorError();
+			const group = matchingGroups[0];
+			if (!group) throw safeCoordinatorError();
+			releaseMutation = claimCandidateMutation(store.db, candidateRef) ?? void 0;
+			if (!releaseMutation) {
+				await candidateMutationSettled(store.db, candidateRef);
+				const overlappingReplay = replayLegacyTeamSetupActivation(store.db, {
 					candidateRef,
-					attemptId: draft.attemptId
+					attemptId,
+					finishDigest,
+					confirmedAccessDeltaDigest
 				});
-				requireBoundedAccessDelta(preview.accessDelta);
-				const safeDraft = viewerSafeDraft(store, draft);
-				if (viewerAccessDeltaDigest(viewerSafeAccessDelta(candidateRef, preview.accessDelta, {
-					teamDisplayName: draft.displayName,
-					...safeDraft
-				})) !== confirmedViewerAccessDeltaDigest) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+				if (overlappingReplay) return c.json(finishResponse(candidateRef, overlappingReplay));
+				return c.json({ error: "team_setup_confirmation_stale" }, 409);
 			}
-			const result = await finishLegacyTeamSetupActivation(store.db, {
+			const claimedReplay = replayLegacyTeamSetupActivation(store.db, {
 				candidateRef,
 				attemptId,
 				finishDigest,
-				confirmedAccessDeltaDigest,
-				loadFreshRoster: async () => {
-					const matching = (await loadedCandidateSnapshots(candidateRef)).filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef);
-					if (matching.length !== 1) throw safeCoordinatorError();
-					return matching[0]?.devices ?? [];
-				},
-				loadProjectInventory: () => legacyTeamCandidateProjectInventory(store.db, projectionOptions(store), candidateRef),
-				validateLockedPreview: (lockedPreview) => {
-					requireBoundedAccessDelta(lockedPreview.accessDelta);
-					const lockedDraft = getLegacyTeamSetupDraft(store.db, candidateRef);
-					if (!lockedDraft || lockedDraft.attemptId !== attemptId) return false;
-					const safeDraft = viewerSafeDraft(store, lockedDraft);
-					return viewerAccessDeltaDigest(viewerSafeAccessDelta(candidateRef, lockedPreview.accessDelta, {
-						teamDisplayName: lockedDraft.displayName,
-						...safeDraft
-					})) === confirmedViewerAccessDeltaDigest;
-				}
+				confirmedAccessDeltaDigest
 			});
-			return c.json(finishResponse(candidateRef, result));
+			if (claimedReplay) return c.json(finishResponse(candidateRef, claimedReplay));
+			const claimedDraft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!claimedDraft || claimedDraft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const publicationDeadlineMs = Date.now() + COORDINATOR_ROSTER_READ_BUDGET_MS;
+			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
+			releaseActorMutations = await claimRecipientPolicyActorMutations(store.db, claimedDraft.devices.flatMap((device) => [...device.decision === "included" && device.targetIdentityId ? [device.targetIdentityId] : [], ...device.existingIdentityId ? [device.existingIdentityId] : []]));
+			return await serializeRecipientPolicyTeamMutation(store.db, deterministicPolicyTeamId(candidateRef), () => serializeRecipientPolicyCoordinatorGroupMutation(store.db, group.groupId, async () => {
+				let authorization;
+				try {
+					authorization = currentCompletionAuthorization();
+				} catch (error) {
+					throw new Error(completionApiError(error));
+				}
+				if (!completionDependencies || !authorization) throw new Error("team_setup_completion_unavailable");
+				if (!authorizesGroup(authorization, group)) throw new Error("team_setup_completion_invalid");
+				const { config, remoteUrl } = authorization;
+				const freshGroup = await loadFreshGroupSnapshot(group, remoteUrl, publicationDeadlineMs);
+				if (!freshGroup) throw new Error("team_setup_roster_unavailable");
+				if (!stillAuthorizesGroup(authorization, group)) throw new Error("team_setup_completion_invalid");
+				const projectInventory = legacyTeamCandidateProjectInventory(store.db, projectionOptions(store), candidateRef);
+				const freshPreview = inspectFreshLegacyTeamSetupActivation(store.db, {
+					candidateRef,
+					attemptId,
+					freshRoster: freshGroup.devices,
+					projectInventory
+				});
+				if (freshPreview.finishDigest !== finishDigest || freshPreview.accessDeltaDigest !== confirmedAccessDeltaDigest) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+				const freshDraft = getLegacyTeamSetupDraft(store.db, candidateRef);
+				if (!freshDraft || freshDraft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+				const safeFreshDraft = viewerSafeDraft(store, freshDraft);
+				if (viewerAccessDeltaDigest(viewerSafeAccessDelta(candidateRef, freshPreview.accessDelta, {
+					teamDisplayName: freshDraft.displayName,
+					...safeFreshDraft
+				})) !== confirmedViewerAccessDeltaDigest) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+				const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+				const proposedManifest = deriveLegacyTeamSetupCompletionManifest(store.db, {
+					candidateRef,
+					attemptId,
+					completedAt
+				});
+				const timeoutS = Math.max(1, config.syncCoordinatorTimeoutS);
+				const publicationTimeoutS = remainingCoordinatorTimeoutS(timeoutS, publicationDeadlineMs);
+				if (publicationTimeoutS == null) throw new Error("team_setup_completion_unavailable");
+				let canonicalManifest;
+				try {
+					canonicalManifest = validateLegacyTeamSetupCompletionManifest((await completionDependencies.create({
+						groupId: group.groupId,
+						manifest: proposedManifest,
+						remoteUrl,
+						adminSecret: config.syncCoordinatorAdminSecret,
+						timeoutS: publicationTimeoutS
+					})).manifest, {
+						coordinatorId: group.coordinatorId,
+						groupId: group.groupId
+					});
+					if (canonicalCoordinatorLegacyTeamCompletionManifestJson(canonicalManifest) !== canonicalCoordinatorLegacyTeamCompletionManifestJson(proposedManifest)) throw new Error("team_setup_completion_conflict");
+				} catch (error) {
+					const code = completionApiError(error);
+					const getCompletion = completionDependencies.get;
+					if (code !== "team_setup_completion_conflict" || !getCompletion) throw new Error(code);
+					try {
+						const existing = await retryTransientCoordinatorRead((attemptTimeoutS) => getCompletion({
+							groupId: group.groupId,
+							candidateRef,
+							remoteUrl,
+							adminSecret: config.syncCoordinatorAdminSecret,
+							timeoutS: attemptTimeoutS
+						}), timeoutS, publicationDeadlineMs);
+						if (!existing) throw new Error("team_setup_completion_conflict");
+						canonicalManifest = validateLegacyTeamSetupCompletionManifest(existing, {
+							coordinatorId: group.coordinatorId,
+							groupId: group.groupId
+						});
+						if (canonicalManifest.finish_digest !== proposedManifest.finish_digest) throw new Error("team_setup_completion_conflict");
+					} catch (recoveryError) {
+						throw new Error(completionApiError(recoveryError));
+					}
+				}
+				let postPublicationGroup;
+				try {
+					postPublicationGroup = await loadFreshGroupSnapshot(group, remoteUrl, publicationDeadlineMs);
+				} catch (error) {
+					if (legacyTeamSetupApiErrorCode(error) === "team_setup_completion_invalid") throw new Error("team_setup_roster_unavailable");
+					throw error;
+				}
+				if (!postPublicationGroup) throw new Error("team_setup_roster_unavailable");
+				const result = await applyLegacyTeamSetupCompletionManifestAndReturnActivation(store.db, {
+					coordinatorId: group.coordinatorId,
+					groupId: group.groupId,
+					freshRoster: postPublicationGroup.devices,
+					manifest: canonicalManifest,
+					expectedDraftManifest: proposedManifest,
+					recipientPolicyLocksHeld: {
+						publication: true,
+						team: true,
+						coordinatorGroup: true
+					}
+				});
+				return c.json(finishResponse(candidateRef, result));
+			}));
 		} catch (error) {
 			const code = apiErrorCode(error);
 			return c.json({ error: code }, errorStatus$1(code));
+		} finally {
+			releaseActorMutations?.();
+			releasePublicationMutation?.();
+			releaseMutation?.();
 		}
 	});
 	return app;
@@ -3670,7 +4242,7 @@ function projectInviteAcceptanceFailure(error) {
 }
 var PROJECT_INVITE_TTL_HOURS = 168;
 var PROJECT_INVITE_OWNER_FALLBACK = "Project owner";
-var PROJECT_INVITE_BODY_KEYS = new Set([
+var PROJECT_INVITE_BODY_KEYS = /* @__PURE__ */ new Set([
 	"teammate_name",
 	"project_ids",
 	"reviewed_project_set_digest"
@@ -3695,7 +4267,7 @@ function projectInviteStringList(body, key) {
 	return items;
 }
 function assertProjectInviteBody(body, creating) {
-	const allowed = creating ? PROJECT_INVITE_BODY_KEYS : new Set(["teammate_name", "project_ids"]);
+	const allowed = creating ? PROJECT_INVITE_BODY_KEYS : /* @__PURE__ */ new Set(["teammate_name", "project_ids"]);
 	if (Object.keys(body).some((key) => !allowed.has(key))) throw new Error("unexpected_project_invite_fields");
 	if (typeof body.teammate_name !== "string") throw new Error("teammate_name_must_be_string");
 	if (creating && typeof body.reviewed_project_set_digest !== "string") throw new Error("reviewed_project_set_digest_required");
@@ -3807,7 +4379,7 @@ function recipientInviteOnboardingPreviewFromReviewedIntent(store, body, invitat
 		...binding
 	});
 }
-var SAFE_RECIPIENT_INVITE_ERRORS = new Set([
+var SAFE_RECIPIENT_INVITE_ERRORS = /* @__PURE__ */ new Set([
 	"device_display_name_invalid",
 	"device_display_name_required",
 	"device_display_name_too_long",
@@ -3841,20 +4413,21 @@ async function peerSupportsSyncRequirements(store, deviceId, requirements) {
 	const addresses = safeJsonList(row?.addresses_json ?? null);
 	for (const address of addresses) try {
 		const url = `${buildBaseUrl(address)}/v1/status`;
+		const headers = {
+			...buildDirectPeerAuthHeaders({
+				deviceId: localDeviceId,
+				recipientId: deviceId,
+				dbPath: store.dbPath,
+				method: "GET",
+				url,
+				bodyBytes: Buffer.alloc(0),
+				keysDir: syncKeysDir()
+			}),
+			[SYNC_CAPABILITY_HEADER]: LOCAL_SYNC_CAPABILITY,
+			[SYNC_FEATURES_HEADER]: LOCAL_SYNC_FEATURES.join(",")
+		};
 		const [status, payload] = await requestJson("GET", url, {
-			headers: {
-				...buildDirectPeerAuthHeaders({
-					deviceId: localDeviceId,
-					recipientId: deviceId,
-					dbPath: store.dbPath,
-					method: "GET",
-					url,
-					bodyBytes: Buffer.alloc(0),
-					keysDir: syncKeysDir()
-				}),
-				[SYNC_CAPABILITY_HEADER]: LOCAL_SYNC_CAPABILITY,
-				[SYNC_FEATURES_HEADER]: LOCAL_SYNC_FEATURES.join(",")
-			},
+			headers,
 			timeoutS: 5
 		});
 		if (status < 200 || status >= 300) continue;
@@ -4226,9 +4799,9 @@ var AUTOMATIC_SHARE_OPERATION_STATES = [
 	"initial_sync",
 	"waiting_for_device"
 ];
-var AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS = 30 * 1e3;
-var AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS = 300 * 1e3;
-var TERMINAL_SHARE_MAINTENANCE_ERRORS = new Set([
+var AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS = 3e4;
+var AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS = 3e5;
+var TERMINAL_SHARE_MAINTENANCE_ERRORS = /* @__PURE__ */ new Set([
 	"coordinator_not_configured",
 	"team_sharing_not_configured",
 	"team_selection_ambiguous",
@@ -4242,7 +4815,7 @@ var TERMINAL_SHARE_MAINTENANCE_ERRORS = new Set([
 	"intent_conflict",
 	"inviter_identity_conflict"
 ]);
-var PROJECT_INVITE_OWNER_CONFLICT_ERRORS = new Set([
+var PROJECT_INVITE_OWNER_CONFLICT_ERRORS = /* @__PURE__ */ new Set([
 	"operation_scope_mismatch",
 	"operation_state_invalid",
 	"operation_acceptance_invalid",
@@ -4257,7 +4830,7 @@ var PROJECT_INVITE_OWNER_CONFLICT_ERRORS = new Set([
 	"intent_conflict",
 	"inviter_identity_conflict"
 ]);
-var TERMINAL_RECONCILIATION_ERRORS = new Set([
+var TERMINAL_RECONCILIATION_ERRORS = /* @__PURE__ */ new Set([
 	"coordinator_not_configured",
 	"team_sharing_not_configured",
 	"team_selection_ambiguous",
@@ -4451,7 +5024,7 @@ function coordinatorEnrollmentFailureCode(error) {
 	const message = (error instanceof Error ? error.message : String(error)).trim();
 	const httpStatus = message.match(/\((\d{3})(?::|\))/u)?.[1];
 	if (httpStatus) return `http_${httpStatus}`;
-	if (new Set([
+	if ((/* @__PURE__ */ new Set([
 		"coordinator_consumed_team_invite_invalid",
 		"coordinator_device_list_malformed",
 		"coordinator_group_id_invalid",
@@ -4459,7 +5032,7 @@ function coordinatorEnrollmentFailureCode(error) {
 		"coordinator_invite_group_mismatch",
 		"coordinator_invite_list_malformed",
 		"reconciliation_time_invalid"
-	]).has(message)) return message;
+	])).has(message)) return message;
 	if (/timeout|timed out|abort/iu.test(message)) return "request_timeout";
 	if (/fetch failed|network|econn|enotfound/iu.test(message)) return "network_error";
 	return "unexpected_error";
@@ -4517,7 +5090,7 @@ async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
 			continue;
 		}
 		try {
-			const result = reconcileSnapshot({
+			const result = await reconcileSnapshot({
 				coordinatorId: buildBaseUrl(remoteUrl),
 				groupId,
 				enrollments: enrollmentsResult.value,
@@ -4540,7 +5113,7 @@ async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
 var RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT = 10;
 var RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT = 3;
 var RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS = 6e4;
-var RECIPIENT_POLICY_WAITING_ERRORS = new Set([
+var RECIPIENT_POLICY_WAITING_ERRORS = /* @__PURE__ */ new Set([
 	"recipient_policy_capability_undetermined",
 	"recipient_policy_parity_incomplete",
 	"recipient_policy_snapshot_not_fresh"
@@ -5709,7 +6282,7 @@ function mapSyncAttemptRow(row, showDiag, addresses) {
 		address: showDiag && addresses?.length ? addresses[0] : null
 	};
 }
-var SYNC_SCOPE_REJECTION_WINDOW_SECONDS = 1440 * 60;
+var SYNC_SCOPE_REJECTION_WINDOW_SECONDS = 86400;
 var CLEANUP_DIAGNOSTICS_MAX_ROWS = 250;
 function recentScopeRejectionsByPeer(store) {
 	const cutoff = (/* @__PURE__ */ new Date(Date.now() - SYNC_SCOPE_REJECTION_WINDOW_SECONDS * 1e3)).toISOString();
@@ -6017,7 +6590,7 @@ function reassignLegacySharedReviewGroup(store, input) {
 		legacy_shared_review: legacySharedReviewSummary(store)
 	};
 }
-var SYNC_DIRECTION_WINDOW_SECONDS = 1440 * 60;
+var SYNC_DIRECTION_WINDOW_SECONDS = 86400;
 function recentPeerOps(store) {
 	const cutoff = (/* @__PURE__ */ new Date(Date.now() - SYNC_DIRECTION_WINDOW_SECONDS * 1e3)).toISOString();
 	const rows = store.db.prepare(`SELECT peer_device_id,
@@ -6112,7 +6685,8 @@ var PEERS_QUERY = `
 * scope contents.
 */
 function negotiatedSyncCapability(c) {
-	return negotiateSyncCapability(LOCAL_SYNC_CAPABILITY, normalizeSyncCapability(c.req.header(SYNC_CAPABILITY_HEADER) ?? null));
+	const header = c.req.header(SYNC_CAPABILITY_HEADER) ?? null;
+	return negotiateSyncCapability(LOCAL_SYNC_CAPABILITY, normalizeSyncCapability(header));
 }
 /**
 * Peer-to-peer sync protocol routes (/v1/*).
@@ -6173,7 +6747,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 				});
 				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				const syncReset = getSyncResetState(store.db);
-				const authorizedScopes = isScopedSyncCapability(negotiatedSyncCapability(c)) ? listAuthorizedScopesForPeer(store.db, {
+				const negotiated = negotiatedSyncCapability(c);
+				const authorizedScopes = isScopedSyncCapability(negotiated) ? listAuthorizedScopesForPeer(store.db, {
 					localDeviceId: deviceId,
 					peerDeviceId: auth.deviceId
 				}) : null;
@@ -6560,7 +7135,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		const bindings = body.bindings.map((value) => {
 			if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 			const binding = value;
-			const bindingKeys = new Set([
+			const bindingKeys = /* @__PURE__ */ new Set([
 				"deviceId",
 				"targetIdentityId",
 				"confirmed",
@@ -6604,7 +7179,9 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		const body = parseDeviceBindingRequest(await parseViewerJsonBody(c), true);
 		if (!body || !("reviewedInventoryDigest" in body)) return c.json({ error: "binding_request_invalid" }, 400);
 		const store = getStore();
+		let releasePublicationMutation;
 		try {
+			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
 			ensureStableStoreIdentity(store);
 			const result = commitDeviceIdentityBindings(store.db, {
 				localActorId: store.actorId,
@@ -6620,6 +7197,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				return c.json({ error: "binding_commit_busy" }, 503);
 			}
 			return c.json({ error: "binding_commit_failed" }, 500);
+		} finally {
+			releasePublicationMutation?.();
 		}
 	});
 	app.get("/api/sync/status", async (c) => {
@@ -6758,7 +7337,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				if (addrs.length) peerAddressMap.set(String(peerRow.peer_device_id ?? ""), addrs);
 			});
 			const attemptsItems = attemptRows.map((row) => {
-				return mapSyncAttemptRow(row, showDiag, showDiag ? peerAddressMap.get(String(row.peer_device_id ?? "")) : void 0);
+				const addrs = showDiag ? peerAddressMap.get(String(row.peer_device_id ?? "")) : void 0;
+				return mapSyncAttemptRow(row, showDiag, addrs);
 			});
 			const latestAttemptError = String(attemptRows[0]?.error || "").trim();
 			const statusBlock = {
@@ -6837,7 +7417,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		const limit = queryInt(c.req.query("limit"), 100);
 		if (limit <= 0) return c.json({ error: "invalid_limit" }, 400);
 		const sinceMinutesRaw = queryInt(c.req.query("sinceMinutes"), 1440);
-		const sinceMinutes = Math.min(Math.max(sinceMinutesRaw, 0), 10 * 365 * 24 * 60);
+		const sinceMinutes = Math.min(Math.max(sinceMinutesRaw, 0), 5256e3);
 		const sinceIso = sinceMinutes > 0 ? (/* @__PURE__ */ new Date(Date.now() - sinceMinutes * 6e4)).toISOString() : void 0;
 		const records = listInboundScopeRejections(store.db, {
 			peerDeviceId,
@@ -7064,7 +7644,14 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		const store = getStore();
 		const body = await parseViewerJsonBody(c);
 		try {
-			const result = commitRecipientPolicyEdges(store.db, body);
+			const request = parseRecipientPolicyEdgeCommitRequest(body);
+			const teamIds = request ? [...new Set(request.changes.flatMap((change) => change.recipient.recipientKind === "team" ? [change.recipient.teamId] : []))].toSorted() : [];
+			const commit = async (index) => {
+				const teamId = teamIds[index];
+				if (!teamId) return commitRecipientPolicyEdges(store.db, request ?? body);
+				return serializeRecipientPolicyTeamMutation(store.db, teamId, () => commit(index + 1));
+			};
+			const result = await commit(0);
 			if (result.status === "invalid") return c.json(result, 400);
 			if (result.status === "not_found") return c.json(result, 404);
 			if (result.status === "stale" || result.status === "conflict") return c.json(result, 409);
@@ -7187,7 +7774,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 	const parseReviewRequest = (value) => {
 		if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 		const body = value;
-		const allowedKeys = new Set([
+		const allowedKeys = /* @__PURE__ */ new Set([
 			"reviewItemId",
 			"sourceFingerprint",
 			"decision",
@@ -7203,7 +7790,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 	};
 	app.post("/api/sync/recipient-policy/v1/review/resolve", async (c) => {
 		const store = getStore();
-		const request = parseReviewRequest(await parseViewerJsonBody(c));
+		const body = await parseViewerJsonBody(c);
+		const request = parseReviewRequest(body);
 		if (!request) return c.json({ error: "request_invalid" }, 400);
 		ensureLocalActorRecord(store);
 		const result = resolveRecipientPolicyReview(store.db, {
@@ -7518,9 +8106,11 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		const store = getStore();
 		const body = await parseViewerJsonBody(c);
 		if (!body) return c.json({ error: "invalid json" }, 400);
+		let releasePublicationMutation;
 		try {
 			const confirmedGuardrailTokens = optionalViewerStringList(body, "confirmed_guardrail_tokens");
 			const mappingInput = parseViewerProjectMappingInput(body);
+			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
 			const analysis = analyzeProjectScopeMappingChangeGuardrails(store.db, mappingInput);
 			if (analysis.requested_workspace_identity?.startsWith("unmapped:")) return c.json({
 				error: "unmapped_project_local_only",
@@ -7550,12 +8140,15 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			});
 		} catch (error) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		} finally {
+			releasePublicationMutation?.();
 		}
 	});
 	app.put("/api/sync/sharing-domains/project-mappings/bulk", async (c) => {
 		const store = getStore();
 		const body = await parseViewerJsonBody(c);
 		if (!body) return c.json({ error: "invalid json" }, 400);
+		let releasePublicationMutation;
 		try {
 			const rawMappings = body.mappings;
 			if (!Array.isArray(rawMappings) || rawMappings.length === 0) return c.json({ error: "mappings must be a non-empty array" }, 400);
@@ -7563,6 +8156,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				if (raw == null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("each mapping must be an object");
 				return parseViewerProjectMappingInput(raw);
 			});
+			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
 			const analyses = mappingInputs.map((mappingInput) => analyzeProjectScopeMappingChangeGuardrails(store.db, mappingInput));
 			const unmapped = analyses.find((analysis) => analysis.requested_workspace_identity?.startsWith("unmapped:"));
 			if (unmapped) return c.json({
@@ -7593,12 +8187,16 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			});
 		} catch (error) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		} finally {
+			releasePublicationMutation?.();
 		}
 	});
-	app.delete("/api/sync/sharing-domains/project-mappings/:id", (c) => {
+	app.delete("/api/sync/sharing-domains/project-mappings/:id", async (c) => {
 		const store = getStore();
 		const id = Number(c.req.param("id"));
+		let releasePublicationMutation;
 		try {
+			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
 			const deleted = deleteProjectScopeSettingsMapping(store.db, id);
 			return c.json({
 				ok: true,
@@ -7606,6 +8204,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			});
 		} catch (error) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		} finally {
+			releasePublicationMutation?.();
 		}
 	});
 	app.post("/api/sync/peers/identity", async (c) => {
@@ -7734,6 +8334,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		if (!secondaryActorId) return c.json({ error: "secondary_actor_id required" }, 400);
 		if (primaryActorId === secondaryActorId) return c.json({ error: "actor ids must differ" }, 400);
 		const d = drizzle(store.db, { schema });
+		const releaseActorMutations = await claimRecipientPolicyActorMutations(store.db, [primaryActorId, secondaryActorId]);
+		queueMicrotask(releaseActorMutations);
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const result = store.db.transaction(() => {
 			const primary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, primaryActorId)).get();
@@ -7884,6 +8486,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		const actorId = String(body.actor_id ?? "").trim();
 		if (!actorId) return c.json({ error: "actor_id required" }, 400);
 		if (actorId === store.actorId) return c.json({ error: "cannot deactivate this device's own local actor" }, 409);
+		const releaseActorMutations = await claimRecipientPolicyActorMutations(store.db, [actorId]);
+		queueMicrotask(releaseActorMutations);
 		const d = drizzle(store.db, { schema });
 		const actor = d.select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
 		if (!actor) return c.json({ error: "actor not found" }, 404);
@@ -9114,7 +9718,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			const publicKey = String(body.peer_public_key ?? "").trim();
 			const name = String(body.name ?? "").trim() || null;
 			const requestedFingerprint = String(body.fingerprint ?? "").trim();
-			const addresses = mergeAddresses([], (Array.isArray(body.peer_addresses) ? body.peer_addresses : []).map((item) => String(item ?? "").trim()).filter((item) => item.length > 0));
+			const addressesInput = Array.isArray(body.peer_addresses) ? body.peer_addresses : [];
+			const addresses = mergeAddresses([], addressesInput.map((item) => String(item ?? "").trim()).filter((item) => item.length > 0));
 			if (!peerDeviceId || !publicKey) return c.json({ error: "peer_device_id_and_public_key_required" }, 400);
 			const fingerprint = requestedFingerprint || fingerprintPublicKey(publicKey);
 			if (fingerprintPublicKey(publicKey) !== fingerprint) return c.json({ error: "fingerprint_mismatch" }, 400);
@@ -9203,7 +9808,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			error: "coordinator_not_configured",
 			status
 		}, 400);
-		const existing = getCoordinatorGroupPreference(getStore().db, coordinatorId, groupId);
+		const store = getStore();
+		const existing = getCoordinatorGroupPreference(store.db, coordinatorId, groupId);
 		if (existing) return c.json({
 			preferences: existing,
 			status
@@ -9389,12 +9995,13 @@ function updateStatusRoutes(options = {}) {
 	const app = new Hono();
 	app.get("/api/update-status", async (c) => {
 		try {
+			const installKind = detectInstallKind({
+				entryPath: process.argv[1] ?? "",
+				env: process.env
+			});
 			const status = await getUpdateStatus$1({
 				currentVersion: VERSION$1,
-				installKind: detectInstallKind({
-					entryPath: process.argv[1] ?? "",
-					env: process.env
-				})
+				installKind
 			});
 			return c.json(status);
 		} catch {
@@ -9455,6 +10062,8 @@ function createApp(opts) {
 	app.route("/", teamSetupRoutes({
 		getStore: storeFactory,
 		loadLegacyTeamConfiguredGroupSnapshots: opts?.loadLegacyTeamConfiguredGroupSnapshots,
+		completionDependencies: opts?.teamSetupCompletionDependencies,
+		readCoordinatorConfig: opts?.readCoordinatorConfig,
 		registerSummaryInvalidator: (invalidate) => {
 			invalidateTeamSetupSummary = invalidate;
 		}