@codemem/server 0.47.1 → 0.47.3

package/dist/index.js

@@ -1,6 +1,6 @@
 import { closeSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorAccountLinkError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, FILE_CONTEXT_TRANSPORT_MAX_BYTES, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RICH_TIER_ANTHROPIC_DEFAULTS, RICH_TIER_DEFAULTS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SIMPLE_TIER_ANTHROPIC_DEFAULTS, SIMPLE_TIER_DEFAULTS, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyLocalIdentitySwitch, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, assertNoLocalIdentityOverride, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterBranchesWithContext, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, captureAccountOwnerProfilePins, changeCoordinatorAccount, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, completeLocalIdentitySwitch, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorAuthControllerReviewAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, dispatchFileContextTransport, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, generateWithOpenCodeV2, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getEffectiveCachedScopeAuthorization, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyDecisionCountsAsOwner, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, linkCoordinatorAccount, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listOpenCodeV2Models, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadPublicKey, loadReplicationOpsForPeer, loadRuntimeSigningPublicKey, lookupCoordinatorPeers, markLocalIdentitySwitchBound, markLocalIdentitySwitchNotCommitted, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeCoordinatorAccountLinkOrigin, normalizeCoordinatorLegacyTeamCompletionManifest, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseBootstrapExpiry, parseFileContextTransportRequest, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readAccountLinkDevice, readAccountOwnerAssociation, readAccountOwnerAssociationRetainedAtMs, readCodememConfigFile, readCompletedLocalIdentitySwitches, readCoordinatorAccountChangeCapabilities, readCoordinatorAccountLinkStatus, readCoordinatorResolvedAccountOwnerReceiptStatus, readCoordinatorResolvedAccountOwnerStatus, readCoordinatorSyncConfig, readOpenLocalIdentitySwitch, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordLocalIdentitySwitch, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveCodememConfigPath, resolveDbPath, resolveObserverDefaultModel, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, resolveVisibleScopeIds, resumeDeviceRebind, runDeviceRebind, runSyncPass, schema, scopeAuthorizationFailureReason, searchPiSessions, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorAccountLinkError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, FILE_CONTEXT_TRANSPORT_MAX_BYTES, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RICH_TIER_ANTHROPIC_DEFAULTS, RICH_TIER_DEFAULTS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SIMPLE_TIER_ANTHROPIC_DEFAULTS, SIMPLE_TIER_DEFAULTS, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyLocalIdentitySwitch, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, assertNoLocalIdentityOverride, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterBranchesWithContext, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, captureAccountOwnerProfilePins, changeCoordinatorAccount, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, completeLocalIdentitySwitch, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorAuthControllerReviewAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, dispatchFileContextTransport, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, generateWithOpenCodeV2, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getEffectiveCachedScopeAuthorization, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyDecisionCountsAsOwner, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, legacyTeamSetupCompletionActorIds, legacyTeamSetupFailureCheck, linkCoordinatorAccount, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listOpenCodeV2Models, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadPublicKey, loadReplicationOpsForPeer, loadRuntimeSigningPublicKey, lookupCoordinatorPeers, markLocalIdentitySwitchBound, markLocalIdentitySwitchNotCommitted, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeCoordinatorAccountLinkOrigin, normalizeCoordinatorLegacyTeamCompletionManifest, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseBootstrapExpiry, parseFileContextTransportRequest, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readAccountLinkDevice, readAccountOwnerAssociation, readAccountOwnerAssociationRetainedAtMs, readCodememConfigFile, readCompletedLocalIdentitySwitches, readCoordinatorAccountChangeCapabilities, readCoordinatorAccountLinkStatus, readCoordinatorResolvedAccountOwnerReceiptStatus, readCoordinatorResolvedAccountOwnerStatus, readCoordinatorSyncConfig, readOpenLocalIdentitySwitch, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordLocalIdentitySwitch, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveCodememConfigPath, resolveDbPath, resolveObserverDefaultModel, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, resolveVisibleScopeIds, resumeDeviceRebind, runDeviceRebind, runSyncPass, schema, scopeAuthorizationFailureReason, searchPiSessions, serializeRecipientPolicyActorMutations, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -435,11 +435,13 @@ var InProcessAccountLinkRegistry = class {
 			};
 			const intent = job.operation.intent ?? "connect";
 			if (intent === "sign_in") return await this.#runSignIn(job, options.onBrowserStart);
-			if (intent === "connect") await (this.#options.link ?? linkCoordinatorAccount)({
-				...options,
-				expectedAuthority
-			});
-			else {
+			if (intent === "connect") {
+				if (expectedAuthority === null) throw new CoordinatorAccountLinkError("invalid_options");
+				await (this.#options.link ?? linkCoordinatorAccount)({
+					...options,
+					expectedAuthority
+				});
+			} else {
 				const result = await (this.#options.change ?? changeCoordinatorAccount)({
 					...options,
 					intent,
@@ -481,6 +483,7 @@ var InProcessAccountLinkRegistry = class {
 	}
 	start({ intent = "connect", context, expectedCoordinatorId, expectedAuthority, expectedLifecycleToken, expectedLinkId }) {
 		if (this.#shuttingDown) return { error: "account_shutting_down" };
+		if (expectedAuthority !== "controller_attestation" && expectedAuthority !== "device_claim" && !(intent === "sign_in" && expectedAuthority === null)) return { error: "account_context_changed" };
 		const pending = this.#inProgress();
 		if (pending) return pending;
 		if (expectedLifecycleToken && expectedLifecycleToken !== this.lifecycleToken()) return { error: "account_context_changed" };
@@ -791,11 +794,11 @@ function associatedOwnerView(view, context, association, remote) {
 //#region src/account/status.ts
 /**
 * The owner-only state offers sign-in when the owner's Google account is
-* linked and this device's own Identity has none: signing in switches the
-* device to the owner's Identity.
+* linked and this device is unlinked or still needs enrollment review.
+* Rebind verifies the Google account before switching the device's Identity.
 */
 function withOwnerSignIn(owner, own, context, remote) {
-	if (owner.ownerProjection?.status.profileState !== "linked" || own.canSignIn !== true || own.remote.kind !== "status" || own.remote.state !== "unlinked") return owner;
+	if (owner.ownerProjection?.status.profileState !== "linked" || own.remote.kind !== "status" || own.remote.state !== "review_required" && !(own.canSignIn === true && own.remote.state === "unlinked")) return owner;
 	return {
 		...owner,
 		canSignIn: true,
@@ -1010,7 +1013,10 @@ async function finishAccountStatus(options, context, fresh, remote, read) {
 		const associated = await readAssociatedOwner(options, context, currentView, remote, signal);
 		if (associated) {
 			const owner = withOwnerSignIn(associated, currentView, context, remote);
-			if (read.ownIdentityOnly && owner.signIn?.contextId === context.contextId) return attachOperation(currentView, options.registry);
+			if (read.ownIdentityOnly && owner.signIn?.contextId === context.contextId) return attachOperation({
+				...currentView,
+				canSignIn: true
+			}, options.registry);
 			return attachOperation(owner, options.registry, context.contextId);
 		}
 	}
@@ -1147,7 +1153,7 @@ function isCurrent(options, operation) {
 	return !("error" in fresh) && fresh.setup === "ready" && fresh.context?.groupId === operation.groupId && fresh.context.contextId === operation.contextId;
 }
 function validStartBody(body) {
-	return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect" || body.intent === "sign_in") && (body.authority === "controller_attestation" || body.authority === "device_claim");
+	return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect" || body.intent === "sign_in") && (body.authority === "controller_attestation" || body.authority === "device_claim" || body.intent === "sign_in" && body.authority === null);
 }
 function unlinkTargetChanged(body, view) {
 	return body.intent === "disconnect" && body.expectedLinkId !== view.unlinkTarget;
@@ -6354,6 +6360,23 @@ var MAX_PROJECT_MAPPING_METADATA_ROWS = 1e4;
 var MAX_MUTATION_BODY_BYTES = 8192;
 var SUMMARY_SNAPSHOT_CACHE_TTL_MS = 3e4;
 var COORDINATOR_ROSTER_READ_BUDGET_MS = 6e4;
+function serializeCanonicalManifestMutation(store, groupId, manifest, operation) {
+	return serializeRecipientPolicyPublicationMutation(store.db, () => {
+		const actorIds = legacyTeamSetupCompletionActorIds(store.db, manifest);
+		return serializeRecipientPolicyActorMutations(store.db, actorIds, () => serializeRecipientPolicyTeamMutation(store.db, manifest.team_id, () => serializeRecipientPolicyCoordinatorGroupMutation(store.db, groupId, () => operation(actorIds))));
+	});
+}
+function finishDraftActorIds(draft) {
+	return draft.devices.flatMap((device) => [...device.decision === "included" && device.targetIdentityId ? [device.targetIdentityId] : [], ...device.existingIdentityId ? [device.existingIdentityId] : []]);
+}
+function completionRecipientPolicyLocksHeld(actorIds) {
+	return {
+		publication: true,
+		actors: actorIds,
+		team: true,
+		coordinatorGroup: true
+	};
+}
 var TEAM_SETUP_ROUTE_PREFIX = "/api/sync/team-setup/v1";
 var CANDIDATE_REF_PATTERN = /^legacy-team-candidate:[0-9a-f]{32}$/u;
 var DEVICE_REF_PATTERN = /^legacy-team-device-ref-v1:[0-9a-f]{64}$/u;
@@ -6399,6 +6422,47 @@ async function runCandidateMutation(db, candidateRef, operation) {
 		release();
 	}
 }
+function completionFailureHandlers(options) {
+	const handledGroupIds = /* @__PURE__ */ new Set();
+	const reportFailure = (group, error) => {
+		handledGroupIds.add(group.groupId);
+		options.onFailure?.(group, error);
+	};
+	const handleFailure = (group, error) => {
+		if (!options.isolateApplyFailures) throw error;
+		reportFailure(group, error);
+	};
+	return {
+		handledGroupIds,
+		handleFailure,
+		reportFailure
+	};
+}
+function completionConflictError(cause) {
+	return new Error("team_setup_completion_conflict", { cause });
+}
+function addFreshCompletionGroups(index, groups, keyOf) {
+	for (const group of groups) {
+		if (!group) continue;
+		const key = keyOf(group);
+		if (index.has(key)) throw new Error("team_setup_completion_invalid");
+		index.set(key, group);
+	}
+}
+function groupCompletionFailureHandler(groups, handleFailure) {
+	return (groupId, error) => {
+		const group = groups.get(groupId);
+		if (group) handleFailure(group, error);
+	};
+}
+function summaryReconciliationOptions(blockingErrors) {
+	return {
+		isolateApplyFailures: true,
+		onFailure: (group, error) => {
+			blockingErrors.set(legacyTeamCandidateId(group.coordinatorId, group.groupId), apiErrorCode(new Error(completionApiError(error))));
+		}
+	};
+}
 var defaultCompletionDependencies = {
 	create: coordinatorCreateLegacyTeamCompletionAction,
 	get: coordinatorGetLegacyTeamCompletionAction,
@@ -6490,13 +6554,17 @@ function isUnsupportedCompletionQuery(error) {
 function isUnattributableCompletionBatchError(error) {
 	return error instanceof Error && (error.message === "coordinator_completion_response_malformed" || error.message === "coordinator_completion_group_mismatch");
 }
-async function listCompletionRecordsPerGroup(groupIds, list) {
-	if (groupIds.length < 2) return [];
+async function listCompletionRecordsPerGroup(groupIds, list, onFailure, batchError) {
+	if (groupIds.length === 1) {
+		onFailure(groupIds[0], batchError);
+		return [];
+	}
 	const records = [];
 	for (const groupId of groupIds) try {
 		records.push(...await list([groupId]));
 	} catch (error) {
 		if (!isUnattributableCompletionBatchError(error)) throw error;
+		onFailure(groupId, error);
 	}
 	return records;
 }
@@ -6730,6 +6798,55 @@ function candidateFromDraft(draft) {
 		unresolvedProjectCount: draft.unresolvedProjectCount
 	};
 }
+function blockedCandidateSummary(store, group, blockingError) {
+	const candidateRef = legacyTeamCandidateId(group.coordinatorId, group.groupId);
+	const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+	if (draft) return {
+		...candidateSummary(candidateFromDraft(draft)),
+		status: "stale",
+		blockingError
+	};
+	const forbiddenIds = [
+		group.coordinatorId,
+		group.groupId,
+		candidateRef,
+		...group.devices.flatMap((device) => [
+			device.deviceId,
+			device.fingerprint,
+			...device.labelRedactionIds ?? []
+		])
+	];
+	return {
+		candidateRef,
+		displayName: safeChoiceLabel(group.displayName, "Legacy Team", forbiddenIds),
+		status: "stale",
+		blockingError,
+		deviceCount: group.devices.length,
+		projectCount: 0,
+		unresolvedDeviceCount: 0,
+		unresolvedProjectCount: 0
+	};
+}
+function pendingCandidateSummaries(store, groups, blockingErrors) {
+	const pending = readPureCandidateViews(store, groups.filter((group) => !blockingErrors.has(legacyTeamCandidateId(group.coordinatorId, group.groupId)))).map(candidateSummary).filter((candidate) => candidate.status !== "ready");
+	const blocked = groups.flatMap((group) => {
+		const error = blockingErrors.get(legacyTeamCandidateId(group.coordinatorId, group.groupId));
+		return error ? [blockedCandidateSummary(store, group, error)] : [];
+	});
+	return [...pending, ...blocked].toSorted((left, right) => {
+		if (left.candidateRef < right.candidateRef) return -1;
+		return left.candidateRef > right.candidateRef ? 1 : 0;
+	});
+}
+async function reconcileSummaryCandidates(store, groups, reconcile) {
+	readPureCandidateViews(store, groups);
+	const blockingErrors = /* @__PURE__ */ new Map();
+	await reconcile(store, groups, summaryReconciliationOptions(blockingErrors));
+	return {
+		version: TEAM_SETUP_VERSION,
+		candidates: pendingCandidateSummaries(store, groups, blockingErrors)
+	};
+}
 function readPureCandidateViews(store, groups) {
 	const existing = [];
 	const discoverable = [];
@@ -7094,6 +7211,20 @@ function apiErrorCode(error) {
 	const code = legacyTeamSetupApiErrorCode(error);
 	return code === "team_setup_projection_changed" ? "team_setup_conflict" : code;
 }
+/**
+* Maps a setup failure to its API code and logs the internal check that raised
+* it. Dozens of checks share each public code, so the log is the only place an
+* operator can see which one failed.
+*/
+function teamSetupFailure(error, route) {
+	const code = apiErrorCode(error);
+	const check = legacyTeamSetupFailureCheck(error);
+	console.warn(`[team-setup] route=${route} apiCode=${code}${check ? ` check=${check}` : ""}`);
+	return {
+		code,
+		status: errorStatus$1(code)
+	};
+}
 function completionApiError(error) {
 	const code = legacyTeamSetupApiErrorCode(error);
 	return code === "team_setup_failed" ? "team_setup_completion_unavailable" : code;
@@ -7432,29 +7563,26 @@ function teamSetupRoutes(options) {
 	*/
 	async function applyCanonicalManifestIfStillAuthorized(store, authorization, group, manifest, freshRoster) {
 		let outcome = "unauthorized";
-		return await runCandidateMutation(store.db, legacyTeamCandidateId(group.coordinatorId, group.groupId), () => serializeRecipientPolicyPublicationMutation(store.db, () => serializeRecipientPolicyTeamMutation(store.db, manifest.team_id, () => serializeRecipientPolicyCoordinatorGroupMutation(store.db, group.groupId, async () => {
+		return await runCandidateMutation(store.db, legacyTeamCandidateId(group.coordinatorId, group.groupId), () => serializeCanonicalManifestMutation(store, group.groupId, manifest, async (actorIds) => {
 			if (!stillAuthorizesGroup(authorization, group)) return;
 			await applyLegacyTeamSetupCompletionManifest(store.db, {
 				coordinatorId: group.coordinatorId,
 				groupId: group.groupId,
 				manifest,
 				freshRoster,
-				recipientPolicyLocksHeld: {
-					publication: true,
-					team: true,
-					coordinatorGroup: true
-				}
+				recipientPolicyLocksHeld: completionRecipientPolicyLocksHeld(actorIds)
 			});
 			outcome = "applied";
-		})))) ? outcome : "claimed";
+		})) ? outcome : "claimed";
 	}
 	async function reconcileCompletions(store, groups, reconciliationOptions = {}) {
+		const { handledGroupIds, handleFailure, reportFailure } = completionFailureHandlers(reconciliationOptions);
 		if (!completionDependencies || groups.length === 0) return;
 		let authorization;
 		try {
 			authorization = currentCompletionAuthorization();
 		} catch (error) {
-			throw new Error(completionApiError(error));
+			throw new Error(completionApiError(error), { cause: error });
 		}
 		if (!authorization) return;
 		const { config, remoteUrl } = authorization;
@@ -7476,30 +7604,25 @@ function teamSetupRoutes(options) {
 				records = await listCompletionRecords(scopedGroupIds);
 			} catch (error) {
 				if (isUnsupportedCompletionQuery(error)) records = [];
-				else if (reconciliationOptions.isolateApplyFailures && isUnattributableCompletionBatchError(error)) records = await listCompletionRecordsPerGroup(scopedGroupIds, listCompletionRecords);
+				else if (reconciliationOptions.isolateApplyFailures && isUnattributableCompletionBatchError(error)) records = await listCompletionRecordsPerGroup(scopedGroupIds, listCompletionRecords, groupCompletionFailureHandler(groupById, handleFailure), error);
 				else throw error;
 			}
 			const freshGroupByKey = /* @__PURE__ */ new Map();
 			if (records.length > 0) try {
 				const onlyGroup = scopedGroups.length === 1 ? scopedGroups[0] : void 0;
-				const freshGroups = onlyGroup ? [await loadFreshGroupSnapshot(onlyGroup, remoteUrl, reconciliationDeadlineMs)] : await loadedSnapshots(void 0, reconciliationDeadlineMs);
-				for (const freshGroup of freshGroups) {
-					if (!freshGroup) continue;
-					const key = freshGroupKey(freshGroup);
-					if (freshGroupByKey.has(key)) throw new Error("team_setup_completion_invalid");
-					freshGroupByKey.set(key, freshGroup);
-				}
+				addFreshCompletionGroups(freshGroupByKey, onlyGroup ? [await loadFreshGroupSnapshot(onlyGroup, remoteUrl, reconciliationDeadlineMs)] : await loadedSnapshots(void 0, reconciliationDeadlineMs), freshGroupKey);
 			} catch (error) {
 				for (const record of records) {
 					const group = groupById.get(record.group_id);
 					if (!group || !belongsToGroupCandidate(record, group)) continue;
+					reportFailure(group, error);
 					try {
 						validateLegacyTeamSetupCompletionManifestBinding(record.manifest, {
 							coordinatorId: group.coordinatorId,
 							groupId: group.groupId
 						});
 					} catch (bindingError) {
-						if (!reconciliationOptions.isolateApplyFailures) throw bindingError;
+						handleFailure(group, bindingError);
 						continue;
 					}
 					let canonicalManifest;
@@ -7509,16 +7632,17 @@ function teamSetupRoutes(options) {
 							groupId: group.groupId
 						});
 					} catch (validationError) {
+						reportFailure(group, validationError);
 						try {
 							if (!await runCandidateMutation(store.db, legacyTeamCandidateId(group.coordinatorId, group.groupId), () => containLegacyTeamSetupCompletionConflict(store.db, {
 								coordinatorId: group.coordinatorId,
 								groupId: group.groupId
 							}))) {
-								if (!reconciliationOptions.isolateApplyFailures) throw validationError;
+								handleFailure(group, validationError);
 								continue;
 							}
 						} catch (containmentError) {
-							if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+							handleFailure(group, containmentError);
 						}
 						if (!reconciliationOptions.isolateApplyFailures) throw validationError;
 						continue;
@@ -7534,13 +7658,12 @@ function teamSetupRoutes(options) {
 							groupId: group.groupId
 						}));
 					} catch (containmentError) {
-						if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+						handleFailure(group, containmentError);
 					}
 				}
 				if (!reconciliationOptions.isolateApplyFailures) throw error;
 				return;
 			}
-			const coordinatorCompletionGroupIds = /* @__PURE__ */ new Set();
 			for (const record of records) {
 				const group = groupById.get(record.group_id);
 				if (!group) throw new Error("team_setup_completion_invalid");
@@ -7551,7 +7674,7 @@ function teamSetupRoutes(options) {
 						groupId: group.groupId
 					});
 				} catch (bindingError) {
-					if (!reconciliationOptions.isolateApplyFailures) throw bindingError;
+					handleFailure(group, bindingError);
 					continue;
 				}
 				let canonicalManifest;
@@ -7561,18 +7684,19 @@ function teamSetupRoutes(options) {
 						groupId: group.groupId
 					});
 				} catch (validationError) {
+					reportFailure(group, validationError);
 					try {
 						await runCandidateMutation(store.db, legacyTeamCandidateId(group.coordinatorId, group.groupId), () => containLegacyTeamSetupCompletionConflict(store.db, {
 							coordinatorId: group.coordinatorId,
 							groupId: group.groupId
 						}));
 					} catch (containmentError) {
-						if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+						handleFailure(group, containmentError);
 					}
 					if (!reconciliationOptions.isolateApplyFailures) throw validationError;
 					continue;
 				}
-				coordinatorCompletionGroupIds.add(record.group_id);
+				handledGroupIds.add(record.group_id);
 				try {
 					let freshGroup = freshGroupByKey.get(freshGroupKey(group));
 					if (!freshGroup && scopedGroups.length > 1) {
@@ -7584,18 +7708,18 @@ function teamSetupRoutes(options) {
 							coordinatorId: group.coordinatorId,
 							groupId: group.groupId
 						}))) {
-							if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_invalid");
+							handleFailure(group, /* @__PURE__ */ new Error("team_setup_completion_invalid"));
 							continue;
 						}
 						throw new Error("team_setup_completion_invalid");
 					}
 					if (await applyCanonicalManifestIfStillAuthorized(store, authorization, group, canonicalManifest, freshGroup.devices) !== "applied") continue;
 				} catch (error) {
-					if (!reconciliationOptions.isolateApplyFailures) throw error;
+					handleFailure(group, error);
 				}
 			}
 			for (const group of scopedGroups) {
-				if (coordinatorCompletionGroupIds.has(group.groupId)) continue;
+				if (handledGroupIds.has(group.groupId)) continue;
 				const publicationTimeoutS = remainingCoordinatorTimeoutS(timeoutS, reconciliationDeadlineMs);
 				if (publicationTimeoutS == null) break;
 				if (!hasCompletedLegacyTeamSetup(store, legacyTeamCandidateId(group.coordinatorId, group.groupId))) continue;
@@ -7642,14 +7766,14 @@ function teamSetupRoutes(options) {
 								coordinatorId: group.coordinatorId,
 								groupId: group.groupId
 							}))) {
-								if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_conflict");
+								handleFailure(group, /* @__PURE__ */ new Error("team_setup_completion_conflict"));
 								continue;
 							}
 						} catch (containmentError) {
-							if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+							handleFailure(group, containmentError);
 							continue;
 						}
-						if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_conflict");
+						handleFailure(group, /* @__PURE__ */ new Error("team_setup_completion_conflict"));
 						continue;
 					}
 					try {
@@ -7658,7 +7782,7 @@ function teamSetupRoutes(options) {
 						if (await applyCanonicalManifestIfStillAuthorized(store, authorization, group, canonicalManifest, freshGroup.devices) !== "applied") continue;
 					} catch (applyError) {
 						if (applyError instanceof LegacyTeamSetupAdditiveConvergenceError) {
-							if (!reconciliationOptions.isolateApplyFailures) throw applyError;
+							handleFailure(group, applyError);
 							continue;
 						}
 						try {
@@ -7666,19 +7790,19 @@ function teamSetupRoutes(options) {
 								coordinatorId: group.coordinatorId,
 								groupId: group.groupId
 							}))) {
-								if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_conflict", { cause: applyError });
+								handleFailure(group, completionConflictError(applyError));
 								continue;
 							}
 						} catch (containmentError) {
-							if (!reconciliationOptions.isolateApplyFailures) throw containmentError;
+							handleFailure(group, containmentError);
 							continue;
 						}
-						if (!reconciliationOptions.isolateApplyFailures) throw new Error("team_setup_completion_conflict", { cause: applyError });
+						handleFailure(group, completionConflictError(applyError));
 					}
 				}
 			}
 		} catch (error) {
-			throw new Error(completionApiError(error));
+			throw new Error(completionApiError(error), { cause: error });
 		}
 	}
 	async function loadedCandidateSnapshots(candidateRef, loadOptions = {}) {
@@ -7712,21 +7836,15 @@ function teamSetupRoutes(options) {
 		try {
 			groups = await loadedSummarySnapshots();
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 		try {
-			const store = options.getStore();
-			readPureCandidateViews(store, groups);
-			await reconcileCompletions(store, groups, { isolateApplyFailures: true });
-			const response = {
-				version: TEAM_SETUP_VERSION,
-				candidates: readPureCandidateViews(store, groups).map(candidateSummary).filter((candidate) => candidate.status !== "ready")
-			};
+			const response = await reconcileSummaryCandidates(options.getStore(), groups, reconcileCompletions);
 			return c.json(response);
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 	});
 	app.get("/api/sync/team-setup/v1/:candidateRef", async (c) => {
@@ -7772,8 +7890,8 @@ function teamSetupRoutes(options) {
 			if (completionGroups) candidate = candidateFromDraft(draft);
 			return c.json(detailResponse(store, draft, candidate));
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 	});
 	app.put("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/assignment", async (c) => {
@@ -7818,8 +7936,8 @@ function teamSetupRoutes(options) {
 				releaseMutation();
 			}
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 	});
 	app.put("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/decision", async (c) => {
@@ -7860,8 +7978,8 @@ function teamSetupRoutes(options) {
 				releaseMutation();
 			}
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 	});
 	app.delete("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/decision", async (c) => {
@@ -7891,8 +8009,8 @@ function teamSetupRoutes(options) {
 				releaseMutation();
 			}
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 	});
 	app.put("/api/sync/team-setup/v1/:candidateRef/projects/:projectRef/mapping", async (c) => {
@@ -7927,8 +8045,8 @@ function teamSetupRoutes(options) {
 				releaseMutation();
 			}
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 	});
 	app.post("/api/sync/team-setup/v1/:candidateRef/refresh", async (c) => {
@@ -7941,15 +8059,15 @@ function teamSetupRoutes(options) {
 			store = options.getStore();
 			if (getLegacyTeamSetupDraft(store.db, candidateRef)?.state === "completed" || hasCompletedLegacyTeamSetup(store, candidateRef)) return c.json({ error: "team_setup_confirmation_stale" }, 409);
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 		let groups;
 		try {
 			groups = await loadMutableCandidateSnapshots(store, candidateRef, () => loadedCandidateSnapshots(candidateRef));
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 		if (groups.filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef).length === 0) return c.json({ error: "team_setup_confirmation_stale" }, 404);
 		try {
@@ -7967,8 +8085,8 @@ function teamSetupRoutes(options) {
 				releaseMutation();
 			}
 		} catch (error) {
-			const code = apiErrorCode(error);
-			return c.json({ error: code }, errorStatus$1(code));
+			const failure = teamSetupFailure(error, `${c.req.method} ${c.req.routePath}`);
+			return c.json({ error: failure.code }, failure.status);
 		}
 	});
 	app.post("/api/sync/team-setup/v1/:candidateRef/finish", async (c) => {
@@ -8040,13 +8158,14 @@ function teamSetupRoutes(options) {
 			if (!claimedDraft || claimedDraft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
 			const publicationDeadlineMs = Date.now() + COORDINATOR_ROSTER_READ_BUDGET_MS;
 			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
-			releaseActorMutations = await claimRecipientPolicyActorMutations(store.db, claimedDraft.devices.flatMap((device) => [...device.decision === "included" && device.targetIdentityId ? [device.targetIdentityId] : [], ...device.existingIdentityId ? [device.existingIdentityId] : []]));
+			const claimedActorIds = finishDraftActorIds(claimedDraft);
+			releaseActorMutations = await claimRecipientPolicyActorMutations(store.db, claimedActorIds);
 			return await serializeRecipientPolicyTeamMutation(store.db, deterministicPolicyTeamId(candidateRef), () => serializeRecipientPolicyCoordinatorGroupMutation(store.db, group.groupId, async () => {
 				let authorization;
 				try {
 					authorization = currentCompletionAuthorization();
 				} catch (error) {
-					throw new Error(completionApiError(error));
+					throw new Error(completionApiError(error), { cause: error });
 				}
 				if (!completionDependencies || !authorization) throw new Error("team_setup_completion_unavailable");
 				if (!authorizesGroup(authorization, group)) throw new Error("team_setup_completion_invalid");
@@ -8137,11 +8256,7 @@ function teamSetupRoutes(options) {
 					freshRoster: postPublicationGroup.devices,
 					manifest: canonicalManifest,
 					expectedDraftManifest: proposedManifest,
-					recipientPolicyLocksHeld: {
-						publication: true,
-						team: true,
-						coordinatorGroup: true
-					}
+					recipientPolicyLocksHeld: completionRecipientPolicyLocksHeld(claimedActorIds)
 				});
 				return c.json(finishResponse(candidateRef, result));
 			}));