@cotal-ai/auth 0.91.0 → 0.92.1

package/dist/service-host-ops.js

@@ -0,0 +1,2180 @@
+/** Package-internal service host operations: register admission, decide (approve or refuse),
+ * revoke, create-only name binding, the operation and proposal reads and one owner's assignment
+ * state, over closed per-key records in the auth bucket. The index does not export it; only the
+ * owner-proved public authority door calls register. It grants no serving, registration, caller
+ * policy, restore, terminal retirement or KICK.
+ *
+ * Every write is one zero-history create or one exact-revision CAS on one key, issued through the
+ * shared custody writer (service-write.ts) under the same plane-claim hold check and fatal latch as
+ * native custody, and only inside the invocation's write scope: the keys discovery located before
+ * its effect connection opened. That connection's credential publishes only those keys and expires
+ * at the invocation's original deadline. A step that needs a key outside it holds before anything is issued. No record carries a TTL and none is ever deleted or purged. There are no
+ * multi-key batches: every window between two writes is either fenced on its key or settled from
+ * what a later invocation reads. The invocation limit and the original deadline are limits, never
+ * waits, fences or proof that an earlier write cannot still land. */
+import { createHash } from "node:crypto";
+import { EpEnvelopeError, GOVERN_HEAD, RECORD_KINDS, assertDerivedOwnerToken, assertLifecycleToken, canonicalJson, contractArtifactCanonicalBytes, contractDigest, contractStoreContext, endpointRegistrationBarrier, endpointToken, epgateKey, isContractDigest, mintLifecycleUid, parseEndpointCapabilities, parseNativeUidCustody, parseServiceSpec, parseServiceStatus, publishContractArtifact, recordAtomicKey, recordSpecKey, recordStatusKey, registerServiceInstance, serviceEndpointActor, serviceGateApprovalLive, serviceWitnessDigest, verifyClusterManifest, verifyClusterRoot, writeServiceStatus, } from "@cotal-ai/core";
+import { SERVICE_HOST_INVOCATION_MS, openAuthorityClient, serviceHostEffectGrants, serviceHostEffectLabel } from "./authority-client.js";
+import { findInteractiveActor } from "./ledger.js";
+import { openLifecycleRegistry, registryStores } from "./lifecycle-registry.js";
+import { activatedServiceGateRow, approvedServiceGateRow, assertApprovableServiceGate } from "./native-service-gate.js";
+import { nativeServiceNameAuthority, readNativeServiceName, serviceNameKey, serviceNameRowBytes } from "./native-service-name.js";
+import { encodeRoundTrip } from "./service-custody-shapes.js";
+import { cancelServiceCustody, runServiceBootstrap, sealServiceBootstrapIntent, sealServiceCancelIntent, serviceAssignmentGate, serviceCustodyKeys, serviceReservationKeys, } from "./service-custody.js";
+import { parseServiceHostRequest, parseServiceProposalClusters, parseServiceProposalCommands, } from "./service-host-contract.js";
+import { readRegistryServiceRoot } from "./service-root-reader.js";
+import { HOSTS, Held, bounded, context, endpoint, held, leader, message, openServiceCustodyHost, readyAfter, readyBefore, scopeCovers, write, } from "./service-write.js";
+/** Original authority limit of one approve, refuse or register, from its admission. */
+export const S2A_OPERATION_TTL_MS = 600_000;
+/** Per-invocation limit for reads, bookkeeping, settlement and native cancellation, and the
+ *  longest window an invocation's effect credential may cover. */
+export const S2A_INVOCATION_MS = SERVICE_HOST_INVOCATION_MS;
+/** A proposal's canonical lifetime (canon:203). */
+export const S2A_PROPOSAL_LIFETIME_MS = 86_400_000;
+export const S2A_MAX_PENDING = 256;
+export const S2A_MAX_PENDING_PER_OWNER = 32;
+export const S2A_MAX_PROPOSAL_BYTES = 256 * 1024;
+/** Fresh decisions after a CAS loss before a step holds. */
+export const S2A_MAX_REDECIDE = 4;
+/** Serving request intents one instance keeps (SPEC 13.1): never pruned or reused in this cut. */
+export const S3_MAX_INTENTS_PER_INSTANCE = 64;
+const ADMISSION_KEY = "svchost.admission";
+const CAPACITY_KEY = "svccap.space";
+const opKey = (operationId) => `svcop.${operationId}`;
+const proposalKey = (proposalId) => `svcprop.${proposalId}`;
+const assignmentKey = (endpoint, instanceId) => `svcasg.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}`;
+const intentKey = (operationId) => `svcint.${hexN(operationId, 32)}`;
+const intentIndexKey = (endpoint, instanceId) => `svcintx.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}`;
+const enc = new TextEncoder();
+const seconds = (ms) => Math.floor(ms / 1000);
+// ---- identities ---------------------------------------------------------------------------------
+const hex32 = (tag, space, value) => createHash("sha256").update(`${tag}\0${space}\0${value}`, "utf8").digest("hex").slice(0, 32);
+/** One id namespace for every host request in a space; a valid lifecycle token. */
+export const serviceHostOperationId = (space, requestId) => hex32("cotal-service-host-op", space, requestId);
+/** The native cancel identity an expiry settlement derives from recorded facts only. */
+const expiryOperationId = (space, approveOperationId) => hex32("cotal-service-host-expiry", space, approveOperationId);
+const expiryRequestDigest = (operationId, assignmentDigest) => contractDigest({ v: 1, kind: "service-approval-expiry", operationId, assignmentDigest });
+const requestDigestOf = (r) => contractDigest({ v: r.v, kind: r.kind, requestId: r.requestId, operation: r.operation, input: r.input, granter: r.granter });
+const proposalIdOf = (proposalDigest, registerRequestId) => contractDigest({ v: 1, kind: "service-proposal-id", proposalDigest, registerRequestId }).slice("sha256:".length);
+const approvalDigestOf = (a) => contractDigest({ v: 1, kind: "service-approval", ...a });
+class Malformed extends Error {
+}
+function bad(detail) { throw new Malformed(detail); }
+function closed(raw, fields, optional = []) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        bad("expected an object");
+    const proto = Object.getPrototypeOf(raw);
+    if (proto !== Object.prototype && proto !== null)
+        bad("expected a plain object");
+    const o = raw;
+    if (fields.some((k) => !Object.hasOwn(o, k)) || Reflect.ownKeys(o).some((k) => typeof k !== "string" || (!fields.includes(k) && !optional.includes(k))))
+        bad("missing or unsupported fields");
+    return o;
+}
+const hexN = (raw, n) => { if (typeof raw !== "string" || !new RegExp(`^[0-9a-f]{${n}}$`).test(raw))
+    bad(`expected ${n} hex characters`); return raw; };
+const digest = (raw) => { if (typeof raw !== "string" || !isContractDigest(raw))
+    bad("expected a canonical digest"); return raw; };
+const ms = (raw) => { if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0)
+    bad("expected an unsigned safe integer"); return raw; };
+const word = (raw, max = 64) => { if (typeof raw !== "string" || !raw || raw.length > max || /[\u0000-\u001f]/.test(raw))
+    bad("expected bounded text"); return raw; };
+const pick = (raw, values) => { if (typeof raw !== "string" || !values.includes(raw))
+    bad(`expected one of ${values.join(", ")}`); return raw; };
+const grammar = (f) => { try {
+    return f();
+}
+catch (e) {
+    return bad(message(e));
+} };
+const owner = (raw) => grammar(() => assertDerivedOwnerToken(raw));
+const endpointName = (raw) => { if (typeof raw !== "string")
+    bad("expected an endpoint"); grammar(() => endpointToken(raw)); return raw; };
+const token = (raw, what) => { if (typeof raw !== "string")
+    bad(`expected ${what}`); return grammar(() => assertLifecycleToken(raw, what)); };
+const CAUSES = ["owner-request", "membership-removal", "operator-request", "restore-quarantine", "approval-expired"];
+const REFUSALS = ["conflict", "expired", "revoked", "superseded", "custody-refused", "admission-closed",
+    "resource-exhausted", "selector-pending", "selector-bound", "name-owned", "restore", "owner", "operator"];
+const CLOSE_REASONS = ["owner", "operator", "revoked", "expired", "selector-bound", "restore", "custody-refused"];
+function account(raw) {
+    const o = closed(raw, ["accountPublicKey", "space"]);
+    return { accountPublicKey: word(o.accountPublicKey, 64), space: word(o.space, 128) };
+}
+function granter(raw) {
+    const o = raw;
+    if (o?.kind === "owner") {
+        closed(raw, ["kind", "owner"]);
+        return { kind: "owner", owner: owner(o.owner) };
+    }
+    closed(raw, ["kind", "auditId"]);
+    pick(o.kind, ["operator"]);
+    return { kind: "operator", auditId: word(o.auditId, 128) };
+}
+function projection(raw) {
+    const o = closed(raw, ["subjectOwner", "endpoint", "instanceId", "proposalId"]);
+    return { subjectOwner: owner(o.subjectOwner), endpoint: endpointName(o.endpoint), instanceId: token(o.instanceId, "instanceId"),
+        proposalId: o.proposalId === null ? null : hexN(o.proposalId, 64) };
+}
+/** A service reservation that native custody's own parser accepts for its lifecycle UID. */
+function reservation(raw) {
+    const r = structuredClone(raw);
+    const lifecycleUid = token(r?.native?.lifecycleUid, "lifecycleUid");
+    if (grammar(() => parseNativeUidCustody(enc.encode(canonicalJson(r)), lifecycleUid)).kind !== "service")
+        bad("expected a service reservation");
+    return r;
+}
+function debt(raw) {
+    if (!Array.isArray(raw) || raw.length > 2)
+        bad("invalid debt");
+    return raw.map((d) => { const o = closed(d, ["kind", "proposalId"]); return { kind: pick(o.kind, ["capacity-release", "proposal-close"]), proposalId: hexN(o.proposalId, 64) }; });
+}
+function cancelOf(raw) {
+    const o = closed(raw, ["operationId", "requestDigest", "cause"]);
+    return { operationId: token(o.operationId, "operationId"), requestDigest: digest(o.requestDigest), cause: pick(o.cause, CAUSES) };
+}
+function plan(raw) {
+    const o = raw;
+    switch (o?.kind) {
+        case "register":
+            closed(raw, ["kind", "proposalId", "proposalDigest", "createdAtMs", "expiresAtMs"]);
+            return { kind: "register", proposalId: hexN(o.proposalId, 64), proposalDigest: digest(o.proposalDigest), createdAtMs: ms(o.createdAtMs), expiresAtMs: ms(o.expiresAtMs) };
+        case "approve":
+            closed(raw, ["kind", "proposalId", "proposalDigest", "proposalRevision", "nameRevision", "reservation", "callerCeiling", "approvalExpiresAt"]);
+            return { kind: "approve", proposalId: hexN(o.proposalId, 64), proposalDigest: digest(o.proposalDigest), proposalRevision: ms(o.proposalRevision),
+                nameRevision: ms(o.nameRevision), reservation: reservation(o.reservation), callerCeiling: grammar(() => parseEndpointCapabilities(o.callerCeiling)),
+                approvalExpiresAt: o.approvalExpiresAt === null ? null : ms(o.approvalExpiresAt) };
+        case "refuse":
+            closed(raw, ["kind", "proposalId", "proposalRevision"]);
+            return { kind: "refuse", proposalId: hexN(o.proposalId, 64), proposalRevision: ms(o.proposalRevision) };
+        case "revoke":
+            closed(raw, ["kind", "endpoint", "instanceId", "expectedAssignmentDigest", "cause"]);
+            return { kind: "revoke", endpoint: endpointName(o.endpoint), instanceId: token(o.instanceId, "instanceId"), expectedAssignmentDigest: digest(o.expectedAssignmentDigest), cause: pick(o.cause, CAUSES) };
+        default: return bad("unknown plan");
+    }
+}
+function tombstoneView(raw) {
+    const o = closed(raw, ["proposalId", "proposalDigest", "owner", "endpoint", "instanceId", "register", "state", "operationId", "approvalDigest", "reason", "at"]);
+    const r = closed(o.register, ["requestId", "requestDigest", "operationId"]);
+    return { proposalId: hexN(o.proposalId, 64), proposalDigest: digest(o.proposalDigest), owner: owner(o.owner), endpoint: endpointName(o.endpoint),
+        instanceId: token(o.instanceId, "instanceId"), register: { requestId: hexN(r.requestId, 32), requestDigest: digest(r.requestDigest), operationId: hexN(r.operationId, 32) },
+        state: pick(o.state, ["approved", "refused", "expired"]), operationId: o.operationId === null ? null : hexN(o.operationId, 32),
+        approvalDigest: o.approvalDigest === null ? null : digest(o.approvalDigest), reason: o.reason === null ? null : pick(o.reason, CLOSE_REASONS), at: ms(o.at) };
+}
+function approvalResult(raw) {
+    const o = closed(raw, ["proposalId", "proposalDigest", "operationId", "assignment", "approvalDigest", "approvalExpiresAt", "callerCeiling",
+        "nameAuthorityRevision", "rootCredentialId", "rootExpiresAt", "approvedGateRevision"]);
+    const a = closed(o.assignment, ["endpoint", "instanceId", "assignmentDigest", "lifecycleUid"]);
+    return { proposalId: hexN(o.proposalId, 64), proposalDigest: digest(o.proposalDigest), operationId: hexN(o.operationId, 32),
+        assignment: { endpoint: endpointName(a.endpoint), instanceId: token(a.instanceId, "instanceId"), assignmentDigest: digest(a.assignmentDigest), lifecycleUid: token(a.lifecycleUid, "lifecycleUid") },
+        approvalDigest: digest(o.approvalDigest), approvalExpiresAt: o.approvalExpiresAt === null ? null : ms(o.approvalExpiresAt),
+        callerCeiling: grammar(() => parseEndpointCapabilities(o.callerCeiling)), nameAuthorityRevision: ms(o.nameAuthorityRevision),
+        rootCredentialId: token(o.rootCredentialId, "rootCredentialId"), rootExpiresAt: ms(o.rootExpiresAt),
+        approvedGateRevision: o.approvedGateRevision === null ? null : ms(o.approvedGateRevision) };
+}
+function result(raw, operation, decision) {
+    if (operation === "register") {
+        const o = closed(raw, ["proposalId", "revision", "expiresAtMs"]);
+        return { proposalId: hexN(o.proposalId, 64), revision: ms(o.revision), expiresAtMs: ms(o.expiresAtMs) };
+    }
+    if (operation === "decide" && decision === "approve")
+        return approvalResult(raw);
+    if (operation === "decide" && decision === "refuse") {
+        const o = closed(raw, ["proposal", "revision"]);
+        return { proposal: tombstoneView(o.proposal), revision: ms(o.revision) };
+    }
+    return bad("this operation stores no result");
+}
+/** A complete outcome is parsed by the shape it stores; a terminal op has no plan, so its result is told apart by its fields. */
+function final(raw, operation, decision) {
+    const o = raw;
+    if (o?.state === "complete") {
+        closed(raw, ["state", "result"]);
+        return { state: "complete", result: result(o.result, operation, decision) };
+    }
+    if (o?.state === "refused") {
+        closed(raw, ["state", "reason"]);
+        return { state: "refused", reason: pick(o.reason, REFUSALS) };
+    }
+    closed(raw, ["state", "boundOperationId"]);
+    pick(o.state, ["superseded"]);
+    return { state: "superseded", boundOperationId: hexN(o.boundOperationId, 32) };
+}
+const terminalDecision = (operation, outcome) => operation !== "decide" ? null : outcome?.result && Object.hasOwn(outcome.result, "proposal") ? "refuse" : "approve";
+export function parseServiceHostOperationRecord(raw) {
+    const o = raw;
+    const common = (x) => ({ operationId: token(x.operationId, "operationId"), requestId: hexN(x.requestId, 32), requestDigest: digest(x.requestDigest),
+        operation: pick(x.operation, ["register", "decide", "revoke"]), account: account(x.account), granter: granter(x.granter), admittedAtMs: ms(x.admittedAtMs), projection: projection(x.projection) });
+    if (o?.kind === "service-host-operation") {
+        closed(raw, ["v", "kind", "operationId", "requestId", "requestDigest", "operation", "account", "granter", "admittedAtMs", "notAfterMs", "admissionEpoch", "projection", "plan", "progress", "debt"]);
+        if (o.v !== 1)
+            bad("unknown version");
+        const c = common(o), p = plan(o.plan);
+        if ((c.operation === "register") !== (p.kind === "register") || (c.operation === "revoke") !== (p.kind === "revoke"))
+            bad("plan does not match its operation");
+        const g = o.progress;
+        let progress;
+        if (g?.state === "admitted") {
+            closed(g, ["state"]);
+            progress = { state: "admitted" };
+        }
+        else if (g?.state === "custody") {
+            closed(g, ["state", "step"]);
+            progress = { state: "custody", step: word(g.step) };
+        }
+        else if (g?.state === "held") {
+            closed(g, ["state", "reason", "phase"]);
+            progress = { state: "held", reason: word(g.reason), phase: word(g.phase) };
+        }
+        else
+            progress = final(g, c.operation, p.kind === "approve" || p.kind === "refuse" ? p.kind : null);
+        return { v: 1, kind: "service-host-operation", ...c, notAfterMs: ms(o.notAfterMs), admissionEpoch: ms(o.admissionEpoch), plan: p, progress, debt: debt(o.debt) };
+    }
+    closed(raw, ["v", "kind", "operationId", "requestId", "requestDigest", "operation", "account", "granter", "admittedAtMs", "projection", "outcome"]);
+    if (o.v !== 1 || o.kind !== "service-host-operation-terminal")
+        bad("unknown version or kind");
+    const c = common(o);
+    return { v: 1, kind: "service-host-operation-terminal", ...c, outcome: final(o.outcome, c.operation, terminalDecision(c.operation, o.outcome)) };
+}
+const registerRef = (raw) => { const r = closed(raw, ["requestId", "requestDigest", "operationId"]); return { requestId: hexN(r.requestId, 32), requestDigest: digest(r.requestDigest), operationId: hexN(r.operationId, 32) }; };
+export function parseServiceProposalRecord(raw) {
+    const o = raw;
+    if (o?.kind === "service-proposal") {
+        closed(raw, ["v", "kind", "proposalId", "proposalDigest", "account", "owner", "endpoint", "instanceId", "register", "createdAtMs", "expiresAtMs", "clusterDigests", "commands", "state"]);
+        if (o.v !== 1)
+            bad("unknown version");
+        const s = o.state;
+        const state = s?.state === "proposed" ? (closed(s, ["state"]), { state: "proposed" })
+            : (closed(s, ["state", "operationId", "assignmentDigest"]), pick(s.state, ["approving"]), { state: "approving", operationId: hexN(s.operationId, 32), assignmentDigest: digest(s.assignmentDigest) });
+        return { v: 1, kind: "service-proposal", proposalId: hexN(o.proposalId, 64), proposalDigest: digest(o.proposalDigest), account: account(o.account),
+            owner: owner(o.owner), endpoint: endpointName(o.endpoint), instanceId: token(o.instanceId, "instanceId"), register: registerRef(o.register),
+            createdAtMs: ms(o.createdAtMs), expiresAtMs: ms(o.expiresAtMs), clusterDigests: grammar(() => parseServiceProposalClusters(o.clusterDigests)),
+            commands: grammar(() => parseServiceProposalCommands(o.commands)), state };
+    }
+    closed(raw, ["v", "kind", "proposalId", "proposalDigest", "owner", "endpoint", "instanceId", "register", "state", "operationId", "approvalDigest", "reason", "atMs"]);
+    if (o.v !== 1 || o.kind !== "service-proposal-terminal")
+        bad("unknown version or kind");
+    const t = { v: 1, kind: "service-proposal-terminal", proposalId: hexN(o.proposalId, 64), proposalDigest: digest(o.proposalDigest), owner: owner(o.owner),
+        endpoint: endpointName(o.endpoint), instanceId: token(o.instanceId, "instanceId"), register: registerRef(o.register), state: pick(o.state, ["approved", "refused", "expired"]),
+        operationId: o.operationId === null ? null : hexN(o.operationId, 32), approvalDigest: o.approvalDigest === null ? null : digest(o.approvalDigest),
+        reason: o.reason === null ? null : pick(o.reason, CLOSE_REASONS), atMs: ms(o.atMs) };
+    if ((t.state === "approved") !== (t.approvalDigest !== null) || (t.state === "approved") === (t.reason !== null))
+        bad("terminal proposal fields do not match its state");
+    return t;
+}
+export function parseServiceCapacityRecord(raw) {
+    const o = closed(raw, ["v", "kind", "pending"]);
+    if (o.v !== 1 || o.kind !== "service-proposal-capacity" || !Array.isArray(o.pending) || o.pending.length > S2A_MAX_PENDING)
+        bad("invalid capacity row");
+    const pending = o.pending.map((e) => {
+        const x = closed(e, ["proposalId", "owner", "endpoint", "instanceId", "registerRequestId", "expiresAtMs"]);
+        return { proposalId: hexN(x.proposalId, 64), owner: owner(x.owner), endpoint: endpointName(x.endpoint), instanceId: token(x.instanceId, "instanceId"), registerRequestId: hexN(x.registerRequestId, 32), expiresAtMs: ms(x.expiresAtMs) };
+    });
+    if (pending.some((e, i) => i > 0 && !(pending[i - 1].proposalId < e.proposalId)))
+        bad("capacity entries must be unique and sorted by proposalId");
+    const perOwner = new Map();
+    for (const e of pending)
+        perOwner.set(e.owner, (perOwner.get(e.owner) ?? 0) + 1);
+    if ([...perOwner.values()].some((n) => n > S2A_MAX_PENDING_PER_OWNER))
+        bad("capacity entries exceed the per-owner bound");
+    return { v: 1, kind: "service-proposal-capacity", pending };
+}
+export function parseServiceAssignmentRecord(raw) {
+    const o = raw;
+    const base = (x) => ({ v: 1, kind: "service-assignment", endpoint: endpointName(x.endpoint), instanceId: token(x.instanceId, "instanceId"),
+        owner: owner(x.owner), proposalId: hexN(x.proposalId, 64), assignmentDigest: digest(x.assignmentDigest) });
+    if (o?.v !== 1 || o?.kind !== "service-assignment")
+        bad("unknown version or kind");
+    if (o.state === "bound") {
+        closed(raw, ["v", "kind", "state", "endpoint", "instanceId", "owner", "proposalId", "assignmentDigest", "reservation", "creation", "cancel"]);
+        const r = reservation(o.reservation), c = closed(o.creation, ["operationId"]);
+        if (contractDigest(r) !== o.assignmentDigest || r.assignment.endpoint !== o.endpoint || r.assignment.instanceId !== o.instanceId || r.assignment.owner !== o.owner)
+            bad("the bound reservation does not match its assignment");
+        return { ...base(o), state: "bound", reservation: r, creation: { operationId: token(c.operationId, "operationId") }, cancel: o.cancel === null ? null : cancelOf(o.cancel) };
+    }
+    closed(raw, ["v", "kind", "state", "endpoint", "instanceId", "owner", "proposalId", "assignmentDigest", "cancel"]);
+    pick(o.state, ["fenced"]);
+    return { ...base(o), state: "fenced", cancel: cancelOf(o.cancel) };
+}
+const SERVE_OPERATIONS = ["register", "activate", "renew", "ready"];
+export function parseServiceRequestIntentRecord(raw) {
+    const o = closed(raw, ["v", "kind", "operationId", "operation", "account", "owner", "endpoint", "instanceId", "requestId", "requestDigest",
+        "registrationRequestId", "witnessDigest", "admittedAtMs"]);
+    if (o.v !== 1 || o.kind !== "service-request-intent")
+        bad("unknown version or kind");
+    const operation = pick(o.operation, SERVE_OPERATIONS);
+    const registrationRequestId = o.registrationRequestId === null ? null : hexN(o.registrationRequestId, 32);
+    const witnessDigest = o.witnessDigest === null ? null : digest(o.witnessDigest);
+    if ((registrationRequestId === null) !== (witnessDigest === null) || (operation !== "register" && witnessDigest === null))
+        bad("a request intent names its registration exactly when it has a witness");
+    return { v: 1, kind: "service-request-intent", operationId: hexN(o.operationId, 32), operation, account: account(o.account),
+        owner: owner(o.owner), endpoint: endpointName(o.endpoint), instanceId: token(o.instanceId, "instanceId"), requestId: hexN(o.requestId, 32),
+        requestDigest: digest(o.requestDigest), registrationRequestId, witnessDigest, admittedAtMs: ms(o.admittedAtMs) };
+}
+export function parseServiceRequestIntentIndexRecord(raw) {
+    const o = closed(raw, ["v", "kind", "owner", "endpoint", "instanceId", "intents"]);
+    if (o.v !== 1 || o.kind !== "service-request-intent-index")
+        bad("unknown version or kind");
+    if (!Array.isArray(o.intents) || o.intents.length === 0 || o.intents.length > S3_MAX_INTENTS_PER_INSTANCE)
+        bad("invalid intent list");
+    const intents = o.intents.map((x) => { const e = closed(x, ["operationId", "operation"]); return { operationId: hexN(e.operationId, 32), operation: pick(e.operation, SERVE_OPERATIONS) }; });
+    if (intents.some((x, i) => i > 0 && intents[i - 1].operationId >= x.operationId))
+        bad("intents must be sorted and unique");
+    return { v: 1, kind: "service-request-intent-index", owner: owner(o.owner), endpoint: endpointName(o.endpoint), instanceId: token(o.instanceId, "instanceId"), intents };
+}
+export function parseServiceAdmissionRecord(raw) {
+    const o = closed(raw, ["v", "kind", "state", "epoch", "restoreId"]);
+    if (o.v !== 1 || o.kind !== "service-host-admission")
+        bad("unknown version or kind");
+    const epoch = ms(o.epoch);
+    if (epoch < 1)
+        bad("admission epochs start at 1");
+    return { v: 1, kind: "service-host-admission", state: pick(o.state, ["open", "quarantined"]), epoch, restoreId: o.restoreId === null ? null : hexN(o.restoreId, 32) };
+}
+/** Leader-read one S2-A key. A deletion marker or spent tombstone holds under a key-specific
+ *  reason and is never recreated; anything its closed parser refuses holds as malformed. */
+async function read(ctx, key, what, parse) {
+    const cur = await leader(ctx, "auth", key);
+    if (cur.state === "absent")
+        return cur;
+    if (cur.state === "marker")
+        return held(`${what}-tombstone`, ctx.step, `${key} carries a ${cur.op} marker; a spent key is never recreated`);
+    if (cur.state === "malformed")
+        return held(`${what}-malformed`, ctx.step, `${key} is not JSON`);
+    try {
+        return { state: "value", row: parse(cur.value), bytes: cur.bytes, revision: cur.revision };
+    }
+    catch (e) {
+        return held(`${what}-malformed`, ctx.step, message(e));
+    }
+}
+const readOp = (ctx, id) => read(ctx, opKey(id), "operation", parseServiceHostOperationRecord);
+const readProposal = (ctx, id) => read(ctx, proposalKey(id), "proposal", parseServiceProposalRecord);
+const readCapacity = (ctx) => read(ctx, CAPACITY_KEY, "capacity", parseServiceCapacityRecord);
+const readAssignment = (ctx, endpointName, instanceId) => read(ctx, assignmentKey(endpointName, instanceId), "assignment", parseServiceAssignmentRecord);
+const readAdmission = (ctx) => read(ctx, ADMISSION_KEY, "admission", parseServiceAdmissionRecord);
+const readIntent = (ctx, id) => read(ctx, intentKey(id), "intent", parseServiceRequestIntentRecord);
+const readIntentIndex = (ctx, endpointName, instanceId) => read(ctx, intentIndexKey(endpointName, instanceId), "intent-index", parseServiceRequestIntentIndexRecord);
+/** One zero-history create (no prior) or exact-revision CAS of a closed record. */
+function put(ctx, key, row, parse, prior) {
+    return write(ctx, "auth", key, encodeRoundTrip(row, parse), prior ? { revision: prior.revision, preimage: prior.bytes } : { create: true });
+}
+const byProposal = (a, b) => (a.proposalId < b.proposalId ? -1 : a.proposalId > b.proposalId ? 1 : 0);
+const putCapacity = (ctx, cap, pending) => put(ctx, CAPACITY_KEY, { v: 1, kind: "service-proposal-capacity", pending: [...pending].sort(byProposal) }, parseServiceCapacityRecord, cap.state === "value" ? cap : undefined);
+const isEntry = (proposalId, registerRequestId) => (e) => e.proposalId === proposalId && e.registerRequestId === registerRequestId;
+/** Canonical expiry only: an entry past `expiresAtMs` is ineligible. No grace is temporal proof. */
+const eligible = (cap, now) => (cap.state === "value" ? cap.row.pending.filter((e) => e.expiresAtMs > now) : []);
+async function nameOf(ctx, endpointName) {
+    const r = await bounded(ctx, () => readNativeServiceName(ctx.h.registry, { accountPublicKey: ctx.h.accountPublicKey, space: ctx.h.space }, endpointName));
+    if (!r.ok)
+        return held("unavailable", ctx.step, "timedOut" in r ? "the service name read timed out" : message(r.error));
+    return r.value;
+}
+/** Remove one proposal's capacity entry. True only when a read or this CAS observed it gone; an
+ *  unobserved release is debt, never success. */
+async function release(ctx, proposalId, registerRequestId) {
+    try {
+        for (let i = 0; i < S2A_MAX_REDECIDE; i++) {
+            const cap = await readCapacity(ctx);
+            if (cap.state === "absent" || !cap.row.pending.some(isEntry(proposalId, registerRequestId)))
+                return true;
+            if ((await putCapacity(ctx, cap, cap.row.pending.filter((e) => !isEntry(proposalId, registerRequestId)(e)))) !== "moved")
+                return true;
+        }
+        return false;
+    }
+    catch (e) {
+        if (e instanceof Held && e.reason !== "readiness" && e.reason !== "post-write-readiness")
+            return false;
+        throw e;
+    }
+}
+const isFinal = (p) => p.state === "complete" || p.state === "refused" || p.state === "superseded";
+const sameDebt = (a, b) => canonicalJson(a) === canonicalJson(b);
+/** Re-read and CAS the live operation until `next` is durable or reports nothing to change. A
+ *  terminal record is returned as stored. */
+async function updateOp(ctx, operationId, next) {
+    for (let i = 0; i < S2A_MAX_REDECIDE; i++) {
+        const cur = await readOp(ctx, operationId);
+        if (cur.state === "absent")
+            return held("reference-unavailable", ctx.step, "the operation binding is not readable");
+        if (cur.row.kind !== "service-host-operation")
+            return { op: cur.row, wrote: false };
+        const n = next(cur.row);
+        if (n === undefined)
+            return { op: cur.row, wrote: false };
+        if ((await put(ctx, opKey(operationId), n, parseServiceHostOperationRecord, cur)) !== "moved")
+            return { op: n, wrote: true };
+    }
+    return held("contention", ctx.step);
+}
+/** Record an outcome (a stored one wins), keep any debt, then compact once no debt remains.
+ *  `wrote` is whether this invocation recorded the outcome. */
+async function settle(ctx, operationId, outcome, debts) {
+    const step = await updateOp(ctx, operationId, (cur) => {
+        const progress = isFinal(cur.progress) ? cur.progress : outcome;
+        if (progress === undefined || (progress === cur.progress && sameDebt(cur.debt, debts)))
+            return undefined;
+        return { ...cur, progress, debt: debts };
+    });
+    const wrote = step.wrote && step.op.kind === "service-host-operation" && outcome !== undefined && step.op.progress === outcome;
+    if (step.op.kind !== "service-host-operation" || !isFinal(step.op.progress) || step.op.debt.length)
+        return { op: step.op, wrote };
+    for (let i = 0; i < S2A_MAX_REDECIDE; i++) {
+        const cur = await readOp(ctx, operationId);
+        if (cur.state === "absent")
+            return held("reference-unavailable", ctx.step, "the operation binding is not readable");
+        if (cur.row.kind !== "service-host-operation")
+            return { op: cur.row, wrote };
+        const live = cur.row;
+        if (!isFinal(live.progress) || live.debt.length)
+            return { op: live, wrote };
+        const terminal = { v: 1, kind: "service-host-operation-terminal", operationId: live.operationId, requestId: live.requestId,
+            requestDigest: live.requestDigest, operation: live.operation, account: live.account, granter: live.granter, admittedAtMs: live.admittedAtMs,
+            projection: live.projection, outcome: live.progress };
+        if ((await put(ctx, opKey(operationId), terminal, parseServiceHostOperationRecord, cur)) !== "moved")
+            return { op: terminal, wrote };
+    }
+    return held("contention", ctx.step);
+}
+const outcomeOf = (op) => (op.kind === "service-host-operation-terminal" ? op.outcome : isFinal(op.progress) ? op.progress : undefined);
+const debtOf = (op) => (op.kind === "service-host-operation" ? op.debt : []);
+/** Retry recorded capacity debt; returns the debt that remains. */
+async function retryDebt(ctx, op, registerRequestIdOf) {
+    const left = [];
+    for (const d of debtOf(op)) {
+        const reg = await registerRequestIdOf(d.proposalId);
+        if (d.kind !== "capacity-release" || reg === undefined || !(await release(ctx, d.proposalId, reg)))
+            left.push(d);
+    }
+    return left;
+}
+/** The one key source for an invocation's writes: its own S2-A records, plus native custody's keys
+ *  for the located reservation. A decide with a reservation can bootstrap it; a revoke only cancels. */
+export function serviceHostScopeKeys(account, t) {
+    const auth = [], records = [], authFamilies = [];
+    const opKeyOf = () => opKey(hexN(t.operationId, 32));
+    const custody = (run) => {
+        if (t.owner === null || t.endpoint === null || t.instanceId === null || t.lifecycleUid === null)
+            return;
+        const actor = serviceEndpointActor({ ...account, owner: t.owner, endpoint: t.endpoint, instanceId: t.instanceId });
+        const k = serviceCustodyKeys({ owner: t.owner, actor, endpoint: t.endpoint, instanceId: t.instanceId, lifecycleUid: t.lifecycleUid }, run);
+        records.push(...k.records);
+        auth.push(...k.auth);
+        authFamilies.push(...k.authFamilies);
+    };
+    switch (t.operation) {
+        case "startup":
+            auth.push(ADMISSION_KEY);
+            break;
+        case "register":
+            auth.push(opKeyOf(), proposalKey(hexN(t.proposalId, 64)), CAPACITY_KEY);
+            break;
+        case "decide":
+            auth.push(opKeyOf(), proposalKey(hexN(t.proposalId, 64)), CAPACITY_KEY);
+            if (t.lifecycleUid !== null && t.endpoint !== null && t.instanceId !== null) {
+                auth.push(assignmentKey(t.endpoint, t.instanceId));
+                custody("bootstrap");
+            }
+            break;
+        case "revoke":
+            if (t.endpoint === null || t.instanceId === null)
+                bad("a revoke scope names its selector");
+            auth.push(opKeyOf(), assignmentKey(t.endpoint, t.instanceId), CAPACITY_KEY, ...(t.proposalId === null ? [] : [proposalKey(hexN(t.proposalId, 64))]));
+            custody("cancel");
+            break;
+        case "name-bind":
+            if (t.endpoint === null)
+                bad("a name binding scope names its endpoint");
+            auth.push(serviceNameKey(t.endpoint));
+            break;
+        case "serve": {
+            // A serving request writes its intent and its instance's index, then only its own effect's keys.
+            if (t.endpoint === null || t.instanceId === null || t.serve === undefined)
+                bad("a serving scope names its selector and operation");
+            auth.push(intentKey(hexN(t.operationId, 32)), intentIndexKey(t.endpoint, t.instanceId));
+            if (t.serve === "register" || t.serve === "activate")
+                auth.push(epgateKey(t.endpoint, t.instanceId));
+            records.push(...serveRecordKeys(t).writes);
+            break;
+        }
+    }
+    const uniq = (a) => Object.freeze([...new Set(a)]);
+    return Object.freeze({ records: uniq(records), auth: uniq(auth), authFamilies: uniq(authFamilies) });
+}
+/** A native registration writes and reads the spec and the endpoint's governance head; readiness
+ *  writes the status and reads it with the spec. */
+function serveRecordKeys(t) {
+    if (t.operation !== "serve" || t.endpoint === null || t.instanceId === null)
+        return { writes: [], reads: [] };
+    const sel = [t.endpoint, assertLifecycleToken(t.instanceId, "instanceId")];
+    const spec = recordSpecKey(RECORD_KINDS.svc, sel), status = recordStatusKey(RECORD_KINDS.svc, sel), govern = recordAtomicKey(GOVERN_HEAD, [t.endpoint]);
+    if (t.serve === "register")
+        return { writes: [spec, govern], reads: [spec, govern] };
+    if (t.serve === "ready")
+        return { writes: [status], reads: [spec, status] };
+    return { writes: [], reads: [] };
+}
+/** What one invocation's effect credential may read by Direct Get and publish to the contract store. */
+export function serviceHostScopeReads(t) {
+    const contract = t.operation === "serve" && t.serve === "register" ? [...(t.contract ?? [])] : [];
+    return Object.freeze({ records: Object.freeze([...new Set(serveRecordKeys(t).reads)]), contract: Object.freeze([...new Set(contract)]) });
+}
+const NO_WRITES = Object.freeze({ records: Object.freeze([]), auth: Object.freeze([]), authFamilies: Object.freeze([]) });
+/** Open one invocation's effect connection: a fresh identity whose credential publishes exactly
+ *  `scope.keys`, never reconnects or renews, and expires at `scope.deadlineMs` rounded up to the
+ *  whole second. The registry over it is the effect registry. */
+export async function openServiceHostEffect(opts, scope) {
+    const client = await openAuthorityClient({
+        server: opts.server, space: opts.space, dataAccount: opts.dataAccount, log: opts.log, label: serviceHostEffectLabel(opts.space),
+        grants: (connId) => serviceHostEffectGrants(opts.space, connId, scope.keys, scope.reads), noReconnect: true, serviceHostInvocation: { deadlineMs: scope.deadlineMs },
+        ...(opts.onConnection ? { onConnection: opts.onConnection } : {}),
+    });
+    try {
+        return { registry: await openLifecycleRegistry(client.nc, opts.space), gone: client.gone, close: () => client.close(),
+            contract: await contractStoreContext(client.nc, opts.space) };
+    }
+    catch (e) {
+        await client.close().catch(() => { });
+        throw e;
+    }
+}
+const denied = (reason, boundOperationId) => ({ state: "denied", reason, ...(boundOperationId ? { boundOperationId } : {}) });
+const refusedArm = (operationId, reason, debts, boundOperationId) => ({ state: "refused", operationId, reason, ...(boundOperationId ? { boundOperationId } : {}), ...(debts.length ? { debt: debts } : {}) });
+const finalArm = (operationId, f, debts) => f.state === "refused" ? refusedArm(operationId, f.reason, debts) : refusedArm(operationId, "superseded", debts, f.boundOperationId);
+function badRequest(detail) { throw new EpEnvelopeError("bad-request", `service host request: ${detail}`); }
+/** The host register request a public register's proposal phase admits. Serving recomputes it, so
+ *  one public request key binds one body across both phases. */
+export function serviceRegisterHostRequest(r) {
+    return { v: 1, kind: "service-endpoint-host", requestId: r.engineRequestId, operation: "register", granter: { kind: "owner", owner: r.owner },
+        input: { owner: r.owner, endpoint: r.endpoint, instanceId: r.instanceId, clusterDigests: r.clusterDigests, commands: r.commands,
+            publicRequest: { requestId: r.requestId, requestDigest: r.requestDigest } } };
+}
+/** Structural admission of the internal register request. */
+export function parseServiceRegisterRequest(raw) {
+    let o, input, g;
+    try {
+        o = closed(raw, ["v", "kind", "requestId", "operation", "input", "granter"]);
+        if (o.v !== 1 || o.kind !== "service-endpoint-host" || o.operation !== "register")
+            bad("unknown version, kind or operation");
+        hexN(o.requestId, 32);
+        g = closed(o.granter, ["kind", "owner"]);
+        pick(g.kind, ["owner"]);
+        owner(g.owner);
+        input = closed(o.input, ["owner", "endpoint", "instanceId", "clusterDigests", "commands"], ["publicRequest"]);
+        owner(input.owner);
+        endpointName(input.endpoint);
+        token(input.instanceId, "instanceId");
+        if (Object.hasOwn(input, "publicRequest")) {
+            const pr = closed(input.publicRequest, ["requestId", "requestDigest"]);
+            hexN(pr.requestId, 32);
+            digest(pr.requestDigest);
+        }
+    }
+    catch (e) {
+        return badRequest(message(e));
+    }
+    const clusterDigests = parseServiceProposalClusters(input.clusterDigests), commands = parseServiceProposalCommands(input.commands);
+    if (commands.some((c) => !clusterDigests.includes(c.clusterDigest)))
+        badRequest("every command must come from a submitted cluster");
+    return structuredClone(o);
+}
+export async function openServiceHostOperations(opts) {
+    if (opts.startup === undefined)
+        throw new EpEnvelopeError("failed-precondition", "service host operations require an explicit startup kind");
+    if (opts.startup.kind !== "normal")
+        throw new EpEnvelopeError("unimplemented", "restore startup is not supported; a restored store stays closed");
+    // Discovery only reads: its host writes nothing at all.
+    const discovery = openServiceCustodyHost({ registry: opts.discovery, hold: opts.hold, accountPublicKey: opts.accountPublicKey, writes: NO_WRITES });
+    const space = discovery.host.space, accountPublicKey = opts.accountPublicKey;
+    const live = new Set();
+    let tripped, closed = false;
+    /** Every register and handle call, from entry until it returns. */
+    const entered = new Set();
+    const tracked = (p) => {
+        entered.add(p);
+        p.then(() => entered.delete(p), () => entered.delete(p));
+        return p;
+    };
+    const discoveryCtx = (step) => { const c = context(HOSTS.get(discovery.host), Date.now() + S2A_INVOCATION_MS); c.step = step; return c; };
+    /** One invocation: an effect connection for the discovered scope and its original deadline, one
+     *  custody host over it sharing the process hold and writing only the scope's keys, and the
+     *  engine latch. The connection's loss trips the host. Every awaited call returns before close. */
+    async function invoke(target, run) {
+        if (tripped !== undefined)
+            throw new Held("readiness", "open", `the service host is fenced: ${tripped}`);
+        const keys = serviceHostScopeKeys({ accountPublicKey, space }, target), reads = serviceHostScopeReads(target);
+        const deadlineMs = Date.now() + S2A_INVOCATION_MS;
+        const scope = Object.freeze({ ...target, keys, reads, deadlineMs });
+        let effect;
+        try {
+            effect = await opts.openEffect(scope);
+        }
+        catch (e) {
+            throw new Held("unavailable", "effect-open", `the invocation's effect connection did not open: ${message(e)}`);
+        }
+        try {
+            const opened = openServiceCustodyHost({ registry: effect.registry, hold: opts.hold, accountPublicKey, writes: keys }), host = opened.host;
+            if (host.space !== space)
+                throw new EpEnvelopeError("permission-denied", "the effect registry belongs to another space");
+            // A native registration and a ready status write through their own client, not the custody
+            // writer: a trip also closes their connection, so none of their requests is issued after the
+            // fence. A request already issued stays unknown.
+            const native = target.operation === "serve" && (target.serve === "register" || target.serve === "ready");
+            const trip = (reason) => { opened.trip(reason); if (native)
+                void effect.close().catch(() => { }); };
+            live.add(trip);
+            if (tripped !== undefined)
+                trip(tripped);
+            // Attached before the first request: a write issued after the loss holds, one in flight across it reports held.
+            void effect.gone.then(() => trip("the invocation's effect connection is gone"));
+            const h = HOSTS.get(host);
+            try {
+                return await run({ host, h, writes: h.writes, endMs: deadlineMs, operationId: target.operationId ?? "", bound: true, ...(effect.contract ? { contract: effect.contract } : {}) });
+            }
+            finally {
+                live.delete(trip);
+            }
+        }
+        finally {
+            await effect.close();
+        }
+    }
+    const readCtx = (inv, step) => { const c = context(inv.h, inv.endMs); c.step = step; return c; };
+    /** Hold before a native custody run whose keys this invocation's scope does not cover. A replay
+     *  of the same request discovers the stored reservation and scopes it. */
+    const coverCustody = (inv, ctx, reservation, run) => {
+        const need = serviceReservationKeys(inv.host, reservation, run);
+        const gap = [...need.records.filter((k) => !scopeCovers(inv.writes, "records", k)), ...need.auth.filter((k) => !scopeCovers(inv.writes, "auth", k)),
+            ...need.authFamilies.filter((f) => !inv.writes.authFamilies.includes(f))];
+        if (gap.length)
+            held("scope-mismatch", ctx.step, `native custody needs ${gap.join(", ")} outside this invocation's write scope`);
+    };
+    /** Normal advancement only, and only before the original deadline. */
+    const authorityCtx = (inv, notAfterMs, step) => { const c = context(inv.h, Math.min(inv.endMs, notAfterMs)); c.step = step; return c; };
+    /** A held step names its operation whenever the request may be bound: until this invocation's own
+     *  binding read finds the key absent, and again once its create may be issued. Only a step after
+     *  that absence is a zero-write denial, and the absence is point-in-time: another invocation of
+     *  the same request already in flight can still bind it later. */
+    const heldArm = (inv, e) => {
+        const reason = e.reason === "deadline" && Date.now() >= inv.endMs ? "reconcile-pending" : e.reason;
+        return inv.bound ? { state: "held", operationId: inv.operationId, reason, phase: e.step, ...(inv.assignmentDigest ? { assignmentDigest: inv.assignmentDigest } : {}) } : denied("unavailable");
+    };
+    /** A discovery read failed. A request that is or may be bound is never a zero-write denial; one
+     *  bound to another body is a conflict, as its admission would answer. */
+    const discoveryHeld = (operationId, requestDigest, found, e, assignmentDigest) => {
+        if (found?.state === "absent")
+            return denied("unavailable");
+        if (found?.state === "value" && found.row.requestDigest !== requestDigest)
+            return denied("conflict");
+        return { state: "held", operationId, reason: e.reason, phase: e.step, ...(assignmentDigest ? { assignmentDigest } : {}) };
+    };
+    /** The held arm of a request this invocation read nothing about: its deterministic operation
+     *  coordinate, the same whether or not the request is bound or its granter authorized. */
+    const unread = (requestId, reason, phase, assignmentDigest) => ({ state: "held", operationId: serviceHostOperationId(space, requestId), reason, phase, ...(assignmentDigest ? { assignmentDigest } : {}) });
+    const interactive = (o) => {
+        try {
+            return (findInteractiveActor(opts.ledgerDir, o, "cli") ?? findInteractiveActor(opts.ledgerDir, o, "web")) !== undefined;
+        }
+        catch {
+            return false;
+        }
+    };
+    // Normal-startup admission: absent creates `open` epoch 1; `open` is used; `quarantined` stays.
+    // An unknown or unavailable create fails construction closed.
+    await invoke({ operation: "startup", operationId: null, proposalId: null, owner: null, endpoint: null, instanceId: null, lifecycleUid: null }, async (inv) => {
+        const ctx = readCtx(inv, "admission");
+        for (let i = 0; i < S2A_MAX_REDECIDE; i++) {
+            const a = await readAdmission(ctx);
+            if (a.state === "value")
+                return;
+            await put(ctx, ADMISSION_KEY, { v: 1, kind: "service-host-admission", state: "open", epoch: 1, restoreId: null }, parseServiceAdmissionRecord);
+        }
+        held("contention", ctx.step);
+    });
+    // ---- register (R1-R7) ---------------------------------------------------------------------------
+    const proposalBodyDigest = (sel, clusterDigests, commands) => contractDigest({ v: 1, kind: "service-proposal-body", accountPublicKey, space, ...sel, clusterDigests, commands });
+    /** R3: the initial refusal reasons, from one read of each authority. */
+    async function registerRefusal(ctx, sel, cap, now, epoch) {
+        const adm = await readAdmission(ctx);
+        if (adm.state === "absent" || adm.row.state !== "open" || (epoch !== undefined && adm.row.epoch !== epoch))
+            return { reason: "admission-closed", epoch: adm.state === "value" ? adm.row.epoch : 0 };
+        const live = eligible(cap, now);
+        if (live.some((e) => e.endpoint === sel.endpoint && e.instanceId === sel.instanceId))
+            return { reason: "selector-pending", epoch: adm.row.epoch };
+        if (live.length >= S2A_MAX_PENDING || live.filter((e) => e.owner === sel.owner).length >= S2A_MAX_PENDING_PER_OWNER)
+            return { reason: "resource-exhausted", epoch: adm.row.epoch };
+        if ((await readAssignment(ctx, sel.endpoint, sel.instanceId)).state === "value")
+            return { reason: "selector-bound", epoch: adm.row.epoch };
+        const name = await nameOf(ctx, sel.endpoint);
+        if (name !== undefined && name.owner !== sel.owner)
+            return { reason: "name-owned", epoch: adm.row.epoch };
+        return { epoch: adm.row.epoch };
+    }
+    async function register(raw) {
+        const req = parseServiceRegisterRequest(raw);
+        const env = { v: 1, kind: "service-endpoint-host", operation: "register", requestId: req.requestId, space, accountPublicKey };
+        const out = (a) => ({ ...env, ...a });
+        // The latch comes before the ledger and every broker read; a tripped engine cannot tell a bound request.
+        if (tripped !== undefined || closed)
+            return out(unread(req.requestId, "readiness", "open"));
+        const { owner: o, endpoint: e, instanceId: i, clusterDigests, commands } = req.input;
+        if (req.granter.owner !== o)
+            return out(denied("permission-denied")); // never binds
+        // Authorization precedes every request-key read, and its refusal is one answer whether or not the request is bound.
+        if (!interactive(o))
+            return out(unread(req.requestId, "permission-denied", "authorize"));
+        // A native control endpoint is never a service name: refused before any effect, like a name binding.
+        try {
+            serviceNameKey(e);
+        }
+        catch (err) {
+            if (err instanceof EpEnvelopeError && err.code === "permission-denied")
+                return out(denied("permission-denied"));
+            throw err;
+        } // never binds
+        const operationId = serviceHostOperationId(space, req.requestId), requestDigest = requestDigestOf(req);
+        const proposalDigest = proposalBodyDigest({ owner: o, endpoint: e, instanceId: i }, clusterDigests, commands);
+        const proposalId = proposalIdOf(proposalDigest, req.requestId);
+        const proposalRow = (p) => ({ v: 1, kind: "service-proposal", proposalId, proposalDigest, account: { accountPublicKey, space },
+            owner: o, endpoint: e, instanceId: i, register: { requestId: req.requestId, requestDigest, operationId }, createdAtMs: p.createdAtMs, expiresAtMs: p.expiresAtMs,
+            clusterDigests, commands, state: { state: "proposed" } });
+        if (enc.encode(JSON.stringify(proposalRow({ kind: "register", proposalId, proposalDigest, createdAtMs: 0, expiresAtMs: 0 }))).length > S2A_MAX_PROPOSAL_BYTES)
+            return out(denied("bad-request"));
+        const sel = { owner: o, endpoint: e, instanceId: i };
+        try {
+            return out(await invoke({ operation: "register", operationId, proposalId, owner: o, endpoint: e, instanceId: i, lifecycleUid: null }, async (inv) => {
+                try {
+                    const ctx = readCtx(inv, "R2-binding");
+                    for (let n = 0;; n++) {
+                        if (n >= S2A_MAX_REDECIDE)
+                            held("contention", ctx.step);
+                        const op = await readOp(ctx, operationId);
+                        if (op.state === "value") {
+                            if (op.row.requestDigest !== requestDigest)
+                                return denied("conflict");
+                            return await advanceRegister(inv, op.row);
+                        }
+                        inv.bound = false;
+                        ctx.step = "R3-decide";
+                        const now = Date.now(), cap = await readCapacity(ctx);
+                        const decision = await registerRefusal(ctx, sel, cap, now);
+                        if (decision.reason !== undefined)
+                            return denied(decision.reason);
+                        ctx.step = "R4-binding";
+                        const binding = { v: 1, kind: "service-host-operation", operationId, requestId: req.requestId, requestDigest, operation: "register",
+                            account: { accountPublicKey, space }, granter: req.granter, admittedAtMs: now, notAfterMs: now + S2A_OPERATION_TTL_MS, admissionEpoch: decision.epoch,
+                            projection: { subjectOwner: o, endpoint: e, instanceId: i, proposalId },
+                            plan: { kind: "register", proposalId, proposalDigest, createdAtMs: now, expiresAtMs: now + S2A_PROPOSAL_LIFETIME_MS }, progress: { state: "admitted" }, debt: [] };
+                        // The create may be issued from here, so a held step names the operation.
+                        inv.bound = true;
+                        if ((await put(ctx, opKey(operationId), binding, parseServiceHostOperationRecord)) !== "moved")
+                            return await advanceRegister(inv, binding);
+                        // A lost create is a concurrent first use, so the request stays possibly bound: re-read, then conflict or replay.
+                    }
+                }
+                catch (err) {
+                    if (err instanceof Held)
+                        return heldArm(inv, err);
+                    throw err;
+                }
+            }));
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return out(unread(req.requestId, err.reason, err.step));
+            throw err;
+        }
+        async function advanceRegister(inv, first) {
+            const ctx = readCtx(inv, "R-replay");
+            // The digest is the binding's own: a matching request digest fixes the same proposal body.
+            const registered = (r, outcome, debts = []) => ({ state: "registered", outcome, operationId, proposalDigest, ...r, ...(debts.length ? { debt: debts } : {}) });
+            const recorded = async (op) => {
+                const f = outcomeOf(op), left = await retryDebt(ctx, op, async () => req.requestId);
+                const s = await settle(ctx, operationId, undefined, left);
+                return f.state === "complete" ? registered(f.result, "recorded", debtOf(s.op)) : finalArm(operationId, f, debtOf(s.op));
+            };
+            if (outcomeOf(first) !== undefined)
+                return recorded(first);
+            const op = first, p = op.plan;
+            /** Close the op: release my entry first, then record the outcome with any debt. */
+            const close = async (f) => {
+                const debts = (await release(ctx, proposalId, req.requestId)) ? [] : [{ kind: "capacity-release", proposalId }];
+                const s = await settle(ctx, operationId, f, debts), stored = outcomeOf(s.op);
+                if (stored.state === "complete")
+                    return registered(stored.result, s.wrote ? "applied" : "recorded", debtOf(s.op));
+                return finalArm(operationId, stored, debtOf(s.op));
+            };
+            /** R6's one rule for a present proposal. */
+            const fromProposal = async (prop) => {
+                const r = prop.row;
+                if (r.proposalDigest !== proposalDigest || r.register.operationId !== operationId || r.register.requestId !== req.requestId || r.register.requestDigest !== requestDigest)
+                    return close({ state: "refused", reason: "conflict" });
+                if (r.kind === "service-proposal-terminal" && r.state === "expired")
+                    return close({ state: "refused", reason: "expired" });
+                const done = { state: "complete", result: { proposalId, revision: prop.revision, expiresAtMs: p.expiresAtMs } };
+                if (r.kind === "service-proposal") {
+                    const s = await settle(ctx, operationId, done, []), stored = outcomeOf(s.op);
+                    return stored.state === "complete" ? registered(stored.result, s.wrote ? "applied" : "recorded") : finalArm(operationId, stored, debtOf(s.op));
+                }
+                return close(done);
+            };
+            /** Past the register bound with the proposal absent: same-key fence, release, refuse. */
+            const bound = async () => {
+                ctx.step = "R-bound";
+                const fence = { v: 1, kind: "service-proposal-terminal", proposalId, proposalDigest, owner: o, endpoint: e, instanceId: i,
+                    register: { requestId: req.requestId, requestDigest, operationId }, state: "expired", operationId: null, approvalDigest: null, reason: "expired", atMs: Date.now() };
+                await put(ctx, proposalKey(proposalId), fence, parseServiceProposalRecord);
+                const prop = await readProposal(ctx, proposalId);
+                if (prop.state === "absent")
+                    return held("proposal-unreadable", ctx.step, "the fenced proposal key is not readable");
+                return fromProposal(prop);
+            };
+            ctx.step = "R6-proposal";
+            let prop = await readProposal(ctx, proposalId);
+            if (prop.state === "value")
+                return fromProposal(prop);
+            if (Date.now() >= op.notAfterMs)
+                return bound();
+            for (let n = 0;; n++) {
+                if (n >= S2A_MAX_REDECIDE)
+                    held("contention", "R5-capacity");
+                ctx.step = "R5-capacity";
+                const now = Date.now(), cap = await readCapacity(ctx);
+                if (cap.state === "value" && cap.row.pending.some(isEntry(proposalId, req.requestId)))
+                    break;
+                const decision = await registerRefusal(ctx, sel, cap, now, op.admissionEpoch);
+                if (decision.reason !== undefined)
+                    return close({ state: "refused", reason: decision.reason });
+                if (Date.now() >= op.notAfterMs)
+                    return bound();
+                const entry = { proposalId, owner: o, endpoint: e, instanceId: i, registerRequestId: req.requestId, expiresAtMs: p.expiresAtMs };
+                if ((await putCapacity(authorityCtx(inv, op.notAfterMs, "R5-capacity"), cap, [...eligible(cap, now), entry])) !== "moved")
+                    break;
+            }
+            if (Date.now() >= op.notAfterMs)
+                return bound();
+            await put(authorityCtx(inv, op.notAfterMs, "R6-proposal"), proposalKey(proposalId), proposalRow(p), parseServiceProposalRecord);
+            ctx.step = "R6-proposal";
+            prop = await readProposal(ctx, proposalId);
+            if (prop.state === "absent")
+                return held("proposal-unreadable", ctx.step, "the created proposal is not readable");
+            return fromProposal(prop);
+        }
+    }
+    const tombstone = (p, state, operationId, approvalDigest, reason) => ({
+        v: 1, kind: "service-proposal-terminal", proposalId: p.proposalId, proposalDigest: p.proposalDigest, owner: p.owner, endpoint: p.endpoint, instanceId: p.instanceId,
+        register: p.register, state, operationId, approvalDigest, reason, atMs: Date.now()
+    });
+    const causeReason = (c) => (c?.cause === "approval-expired" ? "expired" : "revoked");
+    const toRefusal = (t) => t.state === "approved" ? { reason: "superseded", bound: t.operationId ?? undefined } : { reason: t.reason ?? "expired" };
+    /** Close a live proposal with a terminal CAS when `matches` still holds; re-read on a loss.
+     *  Returns the proposal as finally read. Proposal-first: callers release only after this. */
+    async function closeProposal(ctx, proposalId, matches) {
+        for (let i = 0; i < S2A_MAX_REDECIDE; i++) {
+            const prop = await readProposal(ctx, proposalId);
+            if (prop.state === "absent")
+                return held("proposal-unreadable", ctx.step, "the proposal record is not readable");
+            if (prop.row.kind !== "service-proposal")
+                return prop;
+            const next = matches(prop.row, prop.revision);
+            if (next === undefined)
+                return prop;
+            await put(ctx, proposalKey(proposalId), next, parseServiceProposalRecord, prop);
+        }
+        return held("contention", ctx.step);
+    }
+    /** Release a terminal proposal's entry; the debt it leaves when unobserved. */
+    const releaseFor = async (ctx, p) => (await release(ctx, p.proposalId, p.register.requestId)) ? [] : [{ kind: "capacity-release", proposalId: p.proposalId }];
+    /** V4: once deny-new has landed (or the assignment is fenced), close an `approving` proposal of
+     *  this assignment truthfully from the gate, then release its capacity. */
+    async function v4(ctx, asg, gate) {
+        ctx.step = "V4-close";
+        const landed = gate && (gate.kind === "approved" || gate.kind === "revoked") ? gate.row.serviceAuthority.approvalDigest : null;
+        const prop = await closeProposal(ctx, asg.proposalId, (p) => p.state.state === "approving" && p.state.assignmentDigest === asg.assignmentDigest
+            ? (landed ? tombstone(p, "approved", p.state.operationId, landed, null) : tombstone(p, "refused", p.state.operationId, null, causeReason(asg.cancel)))
+            : undefined);
+        return prop.row.kind === "service-proposal-terminal" ? releaseFor(ctx, prop.row) : [];
+    }
+    /** Deny-new from one read of this assignment's endpoint gate, on every revoke path that reads it. Another
+     *  assignment's row at the key is no evidence about this one's deny-new: `unknown`, as a failed read. */
+    const denyNewOf = (gate) => (gate.kind === "revoked" ? "landed" : gate.kind === "foreign" ? "unknown" : "not-landed");
+    /** V3: native cancellation of a bound assignment with the material recorded in `svcasg`, then
+     *  the endpoint gate read that decides whether deny-new landed. S1 is awaited, never raced. */
+    async function nativeCancel(inv, ctx, asg, cancel) {
+        coverCustody(inv, ctx, asg.reservation, "cancel");
+        let s1;
+        try {
+            const intent = sealServiceCancelIntent(inv.host, { reservation: asg.reservation, opId: cancel.operationId, requestDigest: cancel.requestDigest });
+            s1 = await cancelServiceCustody(intent, { deadlineMs: ctx.deadlineMs });
+        }
+        catch (e) {
+            if (!(e instanceof EpEnvelopeError))
+                throw e;
+            s1 = { kind: "seal-refused", detail: e.message };
+        }
+        ctx.step = "V3-gate";
+        try {
+            const gate = await endpoint(ctx, serviceAssignmentGate(inv.host, asg.reservation));
+            return { s1, gate, denyNew: denyNewOf(gate) };
+        }
+        catch (e) {
+            if (e instanceof Held || e instanceof EpEnvelopeError)
+                return { s1, denyNew: "unknown" };
+            throw e;
+        }
+    }
+    const view = (t) => ({ proposalId: t.proposalId, proposalDigest: t.proposalDigest, owner: t.owner, endpoint: t.endpoint,
+        instanceId: t.instanceId, register: t.register, state: t.state, operationId: t.operationId, approvalDigest: t.approvalDigest, reason: t.reason, at: seconds(t.atMs) });
+    async function decide(req, authorized) {
+        // Authorization precedes every request-key read, and its refusal is one answer whether or not the request is bound.
+        if (!authorized)
+            return unread(req.requestId, "permission-denied", "authorize");
+        const operationId = serviceHostOperationId(space, req.requestId), requestDigest = requestDigestOf(req), { proposalId } = req.input;
+        const approve = req.input.decision === "approve";
+        const out = (o) => ({ kind: "out", out: o });
+        const granterOwner = req.granter.kind === "owner" ? req.granter.owner : null;
+        const scope = { operation: "decide", operationId, proposalId, owner: null, endpoint: null, instanceId: null, lifecycleUid: null };
+        let found;
+        try {
+            const dctx = discoveryCtx("discover");
+            const op = found = await readOp(dctx, operationId), prop = await readProposal(dctx, proposalId);
+            // A stored approve scopes its own reservation; a first use scopes the one it is about to admit.
+            if (op.state === "value" && op.row.kind === "service-host-operation" && op.row.plan.kind === "approve") {
+                const a = op.row.plan.reservation.assignment;
+                Object.assign(scope, { owner: a.owner, endpoint: a.endpoint, instanceId: a.instanceId, lifecycleUid: op.row.plan.reservation.native.lifecycleUid });
+            }
+            else if (op.state === "absent" && approve) {
+                scope.lifecycleUid = mintLifecycleUid();
+                if (prop.state === "value")
+                    Object.assign(scope, { owner: prop.row.owner, endpoint: prop.row.endpoint, instanceId: prop.row.instanceId });
+            }
+        }
+        catch (e) {
+            if (e instanceof Held)
+                return discoveryHeld(operationId, requestDigest, found, e);
+            throw e;
+        }
+        try {
+            return await invoke(scope, async (inv) => {
+                inv.operationId = operationId;
+                try {
+                    const ctx = readCtx(inv, "admit");
+                    for (let n = 0;; n++) {
+                        if (n >= S2A_MAX_REDECIDE)
+                            held("contention", ctx.step);
+                        const op = await readOp(ctx, operationId);
+                        if (op.state === "value" && op.row.requestDigest === requestDigest) {
+                            if (req.granter.kind === "owner" && op.row.projection.subjectOwner !== req.granter.owner)
+                                return { state: "held", operationId, reason: "permission-denied", phase: "authorize" };
+                            return approve ? await advanceApprove(inv, op.row) : await advanceRefuse(inv, op.row);
+                        }
+                        if (op.state === "value")
+                            return denied("conflict");
+                        inv.bound = false;
+                        const admitted = approve ? await admitApprove(inv, ctx, scope.lifecycleUid) : await admitRefuse(inv, ctx);
+                        if (admitted.kind === "out")
+                            return admitted.out;
+                        inv.bound = true;
+                        if ((await put(ctx, opKey(operationId), admitted.binding, parseServiceHostOperationRecord)) !== "moved")
+                            return approve ? await advanceApprove(inv, admitted.binding) : await advanceRefuse(inv, admitted.binding);
+                    }
+                }
+                catch (err) {
+                    if (err instanceof Held)
+                        return heldArm(inv, err);
+                    throw err;
+                }
+            });
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return discoveryHeld(operationId, requestDigest, found, err);
+            throw err;
+        }
+        async function admitApprove(inv, ctx, lifecycleUid) {
+            ctx.step = "A0-admit";
+            const adm = await readAdmission(ctx);
+            if (adm.state === "absent" || adm.row.state !== "open")
+                return out(denied("admission-closed"));
+            const prop = await readProposal(ctx, proposalId);
+            if (prop.state === "absent" || prop.row.owner !== granterOwner)
+                return out(denied("not-found"));
+            if (prop.row.kind !== "service-proposal")
+                return out(denied("conflict"));
+            const p = prop.row;
+            if (p.state.state === "approving")
+                return out(denied("approval-in-progress", p.state.operationId));
+            if (prop.revision !== req.input.expectedProposalRevision)
+                return out(denied("conflict"));
+            const now = Date.now();
+            if (p.expiresAtMs <= now)
+                return out(denied("expired"));
+            if (!eligible(await readCapacity(ctx), now).some(isEntry(proposalId, p.register.requestId)))
+                return out(denied("expired"));
+            const name = await nameOf(ctx, p.endpoint);
+            if (name === undefined || name.owner !== p.owner)
+                return out(denied("name-claim-required"));
+            if (name.revision !== req.input.expectedNameRevision)
+                return out(denied("conflict"));
+            const ceiling = parseEndpointCapabilities(req.input.callerCeiling);
+            if (ceiling.some((c) => c.endpoint !== p.endpoint || !p.commands.some((k) => k.name === c.command) || (c.instanceId !== undefined && c.instanceId !== p.instanceId)))
+                return out(denied("bad-request"));
+            const reservation = { v: 1, kind: "native-service-uid", native: { accountPublicKey, space, lifecycleUid },
+                assignment: { owner: p.owner, actor: serviceEndpointActor({ accountPublicKey, space, owner: p.owner, endpoint: p.endpoint, instanceId: p.instanceId }),
+                    endpoint: p.endpoint, instanceId: p.instanceId, duty: "serve" },
+                creation: { operationId, requestDigest } };
+            serviceAssignmentGate(inv.host, reservation);
+            ctx.step = "A-binding";
+            return { kind: "bind", binding: { v: 1, kind: "service-host-operation", operationId, requestId: req.requestId, requestDigest, operation: "decide",
+                    account: { accountPublicKey, space }, granter: req.granter, admittedAtMs: now, notAfterMs: Math.min(now + S2A_OPERATION_TTL_MS, p.expiresAtMs),
+                    admissionEpoch: adm.row.epoch, projection: { subjectOwner: p.owner, endpoint: p.endpoint, instanceId: p.instanceId, proposalId },
+                    plan: { kind: "approve", proposalId, proposalDigest: p.proposalDigest, proposalRevision: prop.revision, nameRevision: name.revision, reservation,
+                        callerCeiling: ceiling, approvalExpiresAt: null }, progress: { state: "admitted" }, debt: [] } };
+        }
+        async function advanceApprove(inv, first) {
+            const ctx = readCtx(inv, "A-replay");
+            const stored = outcomeOf(first);
+            if (stored !== undefined && stored.state === "complete")
+                return finishApproved(inv, ctx, stored.result, "recorded");
+            if (stored !== undefined) {
+                const left = await retryDebt(ctx, first, async (pid) => { const p = await readProposal(ctx, pid); return p.state === "value" ? p.row.register.requestId : undefined; });
+                const s = await settle(ctx, operationId, undefined, left);
+                return finalArm(operationId, stored, debtOf(s.op));
+            }
+            const op = first, plan = op.plan, res = plan.reservation;
+            const { binding, epgate } = serviceAssignmentGate(inv.host, res);
+            const assignmentDigest = binding.assignmentDigest;
+            inv.assignmentDigest = assignmentDigest;
+            const approvalDigest = approvalDigestOf({ proposalDigest: plan.proposalDigest, assignmentDigest, callerCeiling: plan.callerCeiling,
+                approvalExpiresAt: plan.approvalExpiresAt, nameAuthorityRevision: plan.nameRevision, operationId });
+            const mine = (g) => (g.kind === "approved" || g.kind === "revoked") && g.row.serviceAuthority.approvalDigest === approvalDigest;
+            /** Row 3: my approval CAS landed, possibly before a later revoke. A historical fact only. */
+            const landed = async (g, approvedGateRevision) => {
+                if (g.kind !== "approved" && g.kind !== "revoked")
+                    return held("approval-unreadable", ctx.step);
+                const sa = g.row.serviceAuthority;
+                const result = { proposalId, proposalDigest: plan.proposalDigest, operationId,
+                    assignment: { endpoint: res.assignment.endpoint, instanceId: res.assignment.instanceId, assignmentDigest, lifecycleUid: res.native.lifecycleUid },
+                    approvalDigest, approvalExpiresAt: plan.approvalExpiresAt, callerCeiling: plan.callerCeiling, nameAuthorityRevision: plan.nameRevision,
+                    rootCredentialId: sa.rootCredentialId, rootExpiresAt: sa.rootExpiresAt, approvedGateRevision };
+                ctx.step = "A5a-result";
+                const a5a = await updateOp(ctx, operationId, (cur) => (isFinal(cur.progress) ? undefined : { ...cur, progress: { state: "complete", result } }));
+                const kept = outcomeOf(a5a.op);
+                if (kept?.state !== "complete")
+                    return finalArm(operationId, kept, debtOf(a5a.op));
+                return finishApproved(inv, ctx, kept.result, a5a.wrote ? "applied" : "recorded");
+            };
+            /** Proposal-first refusal: close my approving proposal, release, then record. R-bound also
+             *  closes a still-proposed target, by a CAS pinned to the revision this approval admitted. */
+            const refuseWith = async (close, reason, target = false) => {
+                ctx.step = `R-${reason}`;
+                const prop = await closeProposal(ctx, proposalId, (p, revision) => (p.state.state === "approving" && p.state.operationId === operationId)
+                    || (target && p.state.state === "proposed" && revision === plan.proposalRevision) ? tombstone(p, "refused", operationId, null, close) : undefined);
+                const debts = prop.row.kind === "service-proposal-terminal" ? await releaseFor(ctx, prop.row) : [];
+                const s = await settle(ctx, operationId, { state: "refused", reason }, debts);
+                return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+            };
+            for (let n = 0;; n++) {
+                if (n >= 2 * S2A_MAX_REDECIDE)
+                    held("contention", ctx.step);
+                ctx.step = "A-table";
+                const gate = await endpoint(ctx, { epgate });
+                if (mine(gate))
+                    return landed(gate, null); // row 3
+                const prop = await readProposal(ctx, proposalId);
+                if (prop.state === "absent")
+                    return held("proposal-unreadable", ctx.step, "the approved proposal record is not readable");
+                if (prop.row.kind === "service-proposal-terminal") {
+                    if (prop.row.state === "approved" && prop.row.operationId === operationId)
+                        return held("approval-unreadable", ctx.step, "the proposal records my approval but the gate does not"); // row 4
+                    const debts = await releaseFor(ctx, prop.row), why = toRefusal(prop.row); // row 5
+                    const s = await settle(ctx, operationId, why.reason === "superseded" ? { state: "superseded", boundOperationId: why.bound } : { state: "refused", reason: why.reason }, debts);
+                    return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+                }
+                const p = prop.row;
+                if (p.state.state === "approving" && p.state.operationId !== operationId) { // row 9
+                    const s = await settle(ctx, operationId, { state: "superseded", boundOperationId: p.state.operationId }, []);
+                    return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+                }
+                const asg = await readAssignment(ctx, res.assignment.endpoint, res.assignment.instanceId);
+                if (asg.state === "value" && asg.row.assignmentDigest !== assignmentDigest)
+                    return refuseWith("selector-bound", "conflict", true); // R-bound
+                if (asg.state === "value" && asg.row.state === "fenced")
+                    return refuseWith(causeReason(asg.row.cancel), causeReason(asg.row.cancel)); // row 11, R-fence
+                const bound = asg.state === "value" ? asg.row : undefined;
+                if (bound && gate.kind === "revoked")
+                    return refuseWith(causeReason(bound.cancel), causeReason(bound.cancel)); // R-revoked: deny-new landed without my digest
+                if (Date.now() >= op.notAfterMs)
+                    return expirySettle(p, bound, gate); // row 6
+                // Normal advancement (rows 7, 8, 10) only inside the original authority.
+                const adm = await readAdmission(ctx);
+                if (adm.state === "absent" || adm.row.state !== "open" || adm.row.epoch !== op.admissionEpoch)
+                    return { state: "held", operationId, reason: "admission-held", phase: "admission", assignmentDigest };
+                if (p.state.state === "proposed") {
+                    if (prop.revision !== plan.proposalRevision)
+                        return held("proposal-moved", ctx.step, "the proposal moved from the revision this approval admitted");
+                    await put(authorityCtx(inv, op.notAfterMs, "A1-approving"), proposalKey(proposalId), { ...p, state: { state: "approving", operationId, assignmentDigest } }, parseServiceProposalRecord, prop);
+                    continue;
+                }
+                if (!bound) {
+                    if (op.progress.state !== "admitted")
+                        return held("reference-unavailable", ctx.step, "the assignment row is missing after custody began"); // row 12
+                    const row = { v: 1, kind: "service-assignment", state: "bound", endpoint: p.endpoint, instanceId: p.instanceId, owner: p.owner, proposalId,
+                        assignmentDigest, reservation: res, creation: { operationId }, cancel: null };
+                    await put(authorityCtx(inv, op.notAfterMs, "A2-assignment"), assignmentKey(p.endpoint, p.instanceId), row, parseServiceAssignmentRecord);
+                    continue;
+                }
+                if (bound.cancel !== null)
+                    return { state: "held", operationId, reason: "revoke-in-progress", phase: "A3-bootstrap", assignmentDigest };
+                ctx.step = "A3-bootstrap";
+                coverCustody(inv, ctx, res, "bootstrap");
+                if (op.progress.state === "admitted")
+                    await updateOp(ctx, operationId, (cur) => (cur.progress.state === "admitted" ? { ...cur, progress: { state: "custody", step: "A3-bootstrap" } } : undefined));
+                ctx.step = "A3-bootstrap";
+                const boot = await runServiceBootstrap(sealServiceBootstrapIntent(inv.host, { reservation: res, notAfterMs: op.notAfterMs }));
+                if (boot.kind === "held") {
+                    await updateOp(ctx, operationId, (cur) => (isFinal(cur.progress) ? undefined : { ...cur, progress: { state: "held", reason: boot.reason, phase: boot.step } })).catch((e) => { if (!(e instanceof Held))
+                        throw e; });
+                    return { state: "held", operationId, reason: boot.reason, phase: boot.step, assignmentDigest };
+                }
+                if (boot.kind === "cancelled" || boot.kind === "endpoint-revoked")
+                    continue; // the gate read decides R-revoked
+                if (boot.kind !== "active")
+                    return refuseWith("custody-refused", "custody-refused");
+                // A4: recheck by read, then the one approval-row builder at the gate revision read now.
+                const actx = authorityCtx(inv, op.notAfterMs, "A4-approve");
+                const name = await nameOf(actx, p.endpoint);
+                if (name === undefined || name.owner !== p.owner || name.revision !== plan.nameRevision)
+                    return { state: "held", operationId, reason: "name-changed", phase: actx.step, assignmentDigest };
+                const p4 = await readProposal(actx, proposalId), a4 = await readAssignment(actx, p.endpoint, p.instanceId), adm4 = await readAdmission(actx);
+                if (p4.state !== "value" || p4.row.kind !== "service-proposal" || p4.row.state.state !== "approving" || p4.row.state.operationId !== operationId)
+                    continue;
+                if (a4.state !== "value" || a4.row.state !== "bound" || a4.row.cancel !== null)
+                    continue;
+                if (adm4.state === "absent" || adm4.row.state !== "open" || adm4.row.epoch !== op.admissionEpoch)
+                    return { state: "held", operationId, reason: "admission-held", phase: actx.step, assignmentDigest };
+                const g4 = await endpoint(actx, { epgate });
+                if (g4.kind !== "pending")
+                    continue;
+                const args = { rootCredentialId: boot.root.credentialId, approvalDigest, nameAuthorityRevision: plan.nameRevision, approvalExpiresAt: plan.approvalExpiresAt, callerCeiling: plan.callerCeiling };
+                let next;
+                try {
+                    assertApprovableServiceGate(g4.row, args);
+                    const proof = await bounded(actx, () => readRegistryServiceRoot(inv.h.registry, binding, boot.root.credentialId, Date.now()));
+                    if (!proof.ok)
+                        return held("unavailable", actx.step, "timedOut" in proof ? "the root proof timed out" : message(proof.error));
+                    next = approvedServiceGateRow(g4.row, args, proof.value.expiresAt, Date.now());
+                }
+                catch (e) {
+                    if (e instanceof EpEnvelopeError)
+                        return { state: "held", operationId, reason: e.code, phase: actx.step, assignmentDigest };
+                    throw e;
+                }
+                const w = await write(actx, "auth", epgate.key, enc.encode(JSON.stringify(next)), { revision: g4.revision, preimage: g4.bytes });
+                if (w !== "moved")
+                    return landed(await endpoint(ctx, { epgate }), w);
+            }
+            /** Row 6: after the original deadline only bookkeeping and authority-reducing steps run. */
+            async function expirySettle(p, bound, gate) {
+                ctx.step = "settle-expired";
+                if (p.state.state === "proposed") {
+                    const s = await settle(ctx, operationId, { state: "refused", reason: "expired" }, []);
+                    return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+                }
+                if (bound === undefined)
+                    return refuseWith("expired", "expired");
+                let asg = bound;
+                for (let i = 0; asg.cancel === null; i++) {
+                    if (i >= S2A_MAX_REDECIDE)
+                        held("contention", ctx.step);
+                    const cancel = { operationId: expiryOperationId(space, operationId), requestDigest: expiryRequestDigest(operationId, assignmentDigest), cause: "approval-expired" };
+                    const cur = await readAssignment(ctx, asg.endpoint, asg.instanceId);
+                    if (cur.state !== "value" || cur.row.state !== "bound" || cur.row.assignmentDigest !== assignmentDigest)
+                        return held("assignment-moved", ctx.step);
+                    if (cur.row.cancel !== null) {
+                        asg = cur.row;
+                        break;
+                    }
+                    await put(ctx, assignmentKey(asg.endpoint, asg.instanceId), { ...cur.row, cancel }, parseServiceAssignmentRecord, cur);
+                    const again = await readAssignment(ctx, asg.endpoint, asg.instanceId);
+                    if (again.state === "value" && again.row.state === "bound")
+                        asg = again.row;
+                }
+                const run = gate.kind === "revoked" ? { s1: undefined, denyNew: "landed", gate } : await nativeCancel(inv, ctx, asg, asg.cancel);
+                if (run.denyNew !== "landed") {
+                    const reason = run.s1 === undefined ? "cancel-pending" : run.s1.kind === "held" ? run.s1.reason : run.s1.kind === "seal-refused" ? "cancel-intent-refused" : run.s1.kind;
+                    return { state: "held", operationId, reason, phase: "settle-expired", assignmentDigest, denyNew: run.denyNew };
+                }
+                const debts = await v4(ctx, asg, run.gate);
+                if (run.gate && mine(run.gate))
+                    return landed(run.gate, null);
+                const s = await settle(ctx, operationId, { state: "refused", reason: causeReason(asg.cancel) }, debts);
+                return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+            }
+        }
+        /** A5b-A5d after A5a: proposal terminal, capacity release, then compaction once no debt remains. */
+        async function finishApproved(inv, ctx, result, outcome) {
+            ctx.step = "A5b-proposal";
+            const prop = await closeProposal(ctx, result.proposalId, (p) => p.state.state === "approving" && p.state.operationId === result.operationId
+                ? tombstone(p, "approved", result.operationId, result.approvalDigest, null) : undefined);
+            ctx.step = "A5c-release";
+            const debts = prop.row.kind === "service-proposal-terminal" ? await releaseFor(ctx, prop.row) : [];
+            ctx.step = "A5d-compact";
+            const s = await settle(ctx, operationId, undefined, debts), left = debtOf(s.op);
+            void inv;
+            return { state: "approved", outcome, approval: result, ...(left.length ? { debt: left } : {}) };
+        }
+        async function admitRefuse(inv, ctx) {
+            ctx.step = "F0-admit";
+            const prop = await readProposal(ctx, proposalId);
+            if (prop.state === "absent" || (granterOwner !== null && prop.row.owner !== granterOwner))
+                return out(denied("not-found"));
+            if (prop.row.kind !== "service-proposal")
+                return out(denied("conflict"));
+            const p = prop.row;
+            if (p.state.state === "approving") {
+                // A stale approving{X}: X is terminal and did not complete, so it holds no native authority.
+                const x = await readOp(ctx, p.state.operationId);
+                if (x.state !== "value" || x.row.kind !== "service-host-operation-terminal" || x.row.outcome.state === "complete")
+                    return out(denied("approval-in-progress", p.state.operationId));
+            }
+            if (prop.revision !== req.input.expectedProposalRevision)
+                return out(denied("conflict"));
+            const adm = await readAdmission(ctx), now = Date.now();
+            void inv;
+            ctx.step = "F-binding";
+            return { kind: "bind", binding: { v: 1, kind: "service-host-operation", operationId, requestId: req.requestId, requestDigest, operation: "decide",
+                    account: { accountPublicKey, space }, granter: req.granter, admittedAtMs: now, notAfterMs: now + S2A_OPERATION_TTL_MS,
+                    admissionEpoch: adm.state === "value" ? adm.row.epoch : 0, projection: { subjectOwner: p.owner, endpoint: p.endpoint, instanceId: p.instanceId, proposalId },
+                    plan: { kind: "refuse", proposalId, proposalRevision: prop.revision }, progress: { state: "admitted" }, debt: [] } };
+        }
+        async function advanceRefuse(inv, first) {
+            const ctx = readCtx(inv, "F-replay");
+            const refused = (r, outcome, debts = []) => ({ state: "refused", outcome, proposal: r.proposal, revision: r.revision, ...(debts.length ? { debt: debts } : {}) });
+            const stored = outcomeOf(first);
+            if (stored !== undefined) {
+                const left = await retryDebt(ctx, first, async (pid) => { const p = await readProposal(ctx, pid); return p.state === "value" ? p.row.register.requestId : undefined; });
+                const s = await settle(ctx, operationId, undefined, left);
+                return stored.state === "complete" ? refused(stored.result, "recorded", debtOf(s.op)) : finalArm(operationId, stored, debtOf(s.op));
+            }
+            const op = first, plan = op.plan;
+            const closeReason = req.granter.kind === "owner" ? "owner" : "operator";
+            for (let n = 0;; n++) {
+                if (n >= S2A_MAX_REDECIDE)
+                    held("contention", ctx.step);
+                ctx.step = "F-table";
+                const prop = await readProposal(ctx, proposalId);
+                if (prop.state === "absent")
+                    return held("proposal-unreadable", ctx.step);
+                if (prop.row.kind === "service-proposal-terminal") {
+                    const t = prop.row, debts = await releaseFor(ctx, t);
+                    if (t.state === "refused" && t.operationId === operationId) {
+                        const s = await settle(ctx, operationId, { state: "complete", result: { proposal: view(t), revision: prop.revision } }, debts);
+                        const kept = outcomeOf(s.op);
+                        return kept.state === "complete" ? refused(kept.result, s.wrote ? "applied" : "recorded", debtOf(s.op)) : finalArm(operationId, kept, debtOf(s.op));
+                    }
+                    const why = toRefusal(t);
+                    const s = await settle(ctx, operationId, why.reason === "superseded" ? { state: "superseded", boundOperationId: why.bound } : { state: "refused", reason: why.reason }, debts);
+                    return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+                }
+                if (prop.revision !== plan.proposalRevision) {
+                    const s = await settle(ctx, operationId, { state: "refused", reason: "conflict" }, []);
+                    return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+                }
+                if (Date.now() >= op.notAfterMs) {
+                    const s = await settle(ctx, operationId, { state: "refused", reason: "expired" }, []);
+                    return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+                }
+                await put(authorityCtx(inv, op.notAfterMs, "F-refuse"), proposalKey(proposalId), tombstone(prop.row, "refused", operationId, null, closeReason), parseServiceProposalRecord, prop);
+            }
+        }
+    }
+    // ---- revoke (V0-V5) -----------------------------------------------------------------------------
+    async function revoke(req, authorized) {
+        const operationId = serviceHostOperationId(space, req.requestId), requestDigest = requestDigestOf(req);
+        const { endpoint: e, instanceId: i, expectedAssignmentDigest, cause } = req.input;
+        const ownerCause = cause === "owner-request";
+        if ((req.granter.kind === "owner") !== ownerCause)
+            return denied("permission-denied"); // never binds
+        // Authorization precedes every request-key read, and its refusal is one answer whether or not the request is bound.
+        if (!authorized)
+            return unread(req.requestId, "permission-denied", "authorize", expectedAssignmentDigest);
+        const scope = { operation: "revoke", operationId, proposalId: null, owner: null, endpoint: e, instanceId: i, lifecycleUid: null };
+        let found;
+        try {
+            const dctx = discoveryCtx("discover");
+            found = await readOp(dctx, operationId);
+            const asg = await readAssignment(dctx, e, i);
+            if (asg.state === "value") {
+                Object.assign(scope, { proposalId: asg.row.proposalId, owner: asg.row.owner });
+                if (asg.row.state === "bound")
+                    scope.lifecycleUid = asg.row.reservation.native.lifecycleUid;
+            }
+            else {
+                const entry = eligible(await readCapacity(dctx), Date.now()).find((x) => x.endpoint === e && x.instanceId === i);
+                if (entry !== undefined)
+                    Object.assign(scope, { proposalId: entry.proposalId, owner: entry.owner });
+            }
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return discoveryHeld(operationId, requestDigest, found, err, expectedAssignmentDigest);
+            throw err;
+        }
+        try {
+            return await invoke(scope, async (inv) => {
+                inv.operationId = operationId;
+                inv.assignmentDigest = expectedAssignmentDigest;
+                try {
+                    const ctx = readCtx(inv, "V0-read");
+                    for (let n = 0;; n++) {
+                        if (n >= S2A_MAX_REDECIDE)
+                            held("contention", ctx.step);
+                        const op = await readOp(ctx, operationId);
+                        if (op.state === "value" && op.row.requestDigest === requestDigest) {
+                            if (req.granter.kind === "owner" && op.row.projection.subjectOwner !== req.granter.owner)
+                                return { state: "held", operationId, reason: "permission-denied", phase: "authorize", assignmentDigest: expectedAssignmentDigest };
+                            return await advanceRevoke(inv, op.row);
+                        }
+                        if (op.state === "value")
+                            return denied("conflict");
+                        inv.bound = false;
+                        // V0: the assignment, else an approving proposal at the selector, then the assignment again.
+                        let asg = await readAssignment(ctx, e, i);
+                        let prop = { state: "absent" };
+                        if (asg.state === "absent") {
+                            const entry = eligible(await readCapacity(ctx), Date.now()).find((x) => x.endpoint === e && x.instanceId === i);
+                            if (entry !== undefined)
+                                prop = await readProposal(ctx, entry.proposalId);
+                            asg = await readAssignment(ctx, e, i);
+                        }
+                        const subjectOwner = asg.state === "value" ? asg.row.owner : prop.state === "value" ? prop.row.owner : undefined;
+                        if (subjectOwner === undefined || (req.granter.kind === "owner" && req.granter.owner !== subjectOwner))
+                            return denied("not-found");
+                        if (asg.state === "value" && asg.row.assignmentDigest !== expectedAssignmentDigest)
+                            return denied("conflict");
+                        if (asg.state === "absent" && !(prop.state === "value" && prop.row.kind === "service-proposal" && prop.row.state.state === "approving"
+                            && prop.row.state.assignmentDigest === expectedAssignmentDigest))
+                            return denied("not-found");
+                        const proposalId = asg.state === "value" ? asg.row.proposalId : prop.row.proposalId;
+                        const adm = await readAdmission(ctx), now = Date.now();
+                        ctx.step = "V1-binding";
+                        const binding = { v: 1, kind: "service-host-operation", operationId, requestId: req.requestId, requestDigest, operation: "revoke",
+                            account: { accountPublicKey, space }, granter: req.granter, admittedAtMs: now, notAfterMs: now + S2A_OPERATION_TTL_MS,
+                            admissionEpoch: adm.state === "value" ? adm.row.epoch : 0, projection: { subjectOwner, endpoint: e, instanceId: i, proposalId },
+                            plan: { kind: "revoke", endpoint: e, instanceId: i, expectedAssignmentDigest, cause }, progress: { state: "admitted" }, debt: [] };
+                        inv.bound = true;
+                        if ((await put(ctx, opKey(operationId), binding, parseServiceHostOperationRecord)) !== "moved")
+                            return await advanceRevoke(inv, binding);
+                    }
+                }
+                catch (err) {
+                    if (err instanceof Held)
+                        return heldArm(inv, err);
+                    throw err;
+                }
+            });
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return discoveryHeld(operationId, requestDigest, found, err, expectedAssignmentDigest);
+            throw err;
+        }
+        async function advanceRevoke(inv, first) {
+            const ctx = readCtx(inv, "V-replay");
+            const stored = outcomeOf(first);
+            if (stored !== undefined)
+                return stored.state === "complete" ? held("operation-malformed", ctx.step, "a revoke never completes") : finalArm(operationId, stored, debtOf(first));
+            const op = first;
+            const a = expectedAssignmentDigest;
+            const progress = async (phase) => {
+                await updateOp(ctx, operationId, (cur) => (cur.progress.state === "custody" && cur.progress.step === phase ? undefined : { ...cur, progress: { state: "custody", step: phase } }))
+                    .catch((err) => { if (!(err instanceof Held))
+                    throw err; });
+            };
+            /** The release debt this revoke owes: as stored until V4 observes again, then kept by a guarded
+             *  CAS whether it grows or clears. Every result reports it. */
+            let owed = op.debt;
+            const keepDebt = async (debts) => {
+                owed = debts;
+                await updateOp(ctx, operationId, (cur) => (sameDebt(cur.debt, debts) ? undefined : { ...cur, debt: debts }));
+            };
+            const owing = () => (owed.length ? { debt: owed } : {});
+            for (let n = 0;; n++) {
+                if (n >= S2A_MAX_REDECIDE)
+                    held("contention", ctx.step);
+                ctx.step = "V0-read";
+                const asg = await readAssignment(ctx, e, i);
+                if (asg.state === "absent") {
+                    const prop = op.projection.proposalId === null ? undefined : await readProposal(ctx, op.projection.proposalId);
+                    if (prop?.state !== "value" || prop.row.kind !== "service-proposal" || prop.row.state.state !== "approving" || prop.row.state.assignmentDigest !== a) {
+                        const s = await settle(ctx, operationId, { state: "refused", reason: "conflict" }, []);
+                        return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+                    }
+                    if (Date.now() >= op.notAfterMs)
+                        return { state: "held", operationId, reason: "expired", phase: "V2-fence", assignmentDigest: a, ...owing() };
+                    ctx.step = "V2-fence";
+                    const fence = { v: 1, kind: "service-assignment", state: "fenced", endpoint: e, instanceId: i, owner: prop.row.owner, proposalId: prop.row.proposalId,
+                        assignmentDigest: a, cancel: { operationId, requestDigest, cause } };
+                    await put(ctx, assignmentKey(e, i), fence, parseServiceAssignmentRecord);
+                    continue;
+                }
+                const row = asg.row;
+                if (row.assignmentDigest !== a) {
+                    const s = await settle(ctx, operationId, { state: "refused", reason: "conflict" }, []);
+                    return finalArm(operationId, outcomeOf(s.op), debtOf(s.op));
+                }
+                if (row.state === "fenced") {
+                    await keepDebt(await v4(ctx, row, undefined));
+                    await progress("assignment-fenced");
+                    return { state: "pending", operationId, phase: "assignment-fenced", assignmentDigest: a, denyNew: "landed", ...owing() };
+                }
+                if (row.cancel === null) {
+                    if (Date.now() >= op.notAfterMs)
+                        return { state: "held", operationId, reason: "expired", phase: "V2-cancel", assignmentDigest: a, ...owing() };
+                    ctx.step = "V2-cancel";
+                    await put(ctx, assignmentKey(e, i), { ...row, cancel: { operationId, requestDigest, cause } }, parseServiceAssignmentRecord, asg);
+                    continue;
+                }
+                if (Date.now() >= op.notAfterMs) {
+                    // Spent: no further native step under this request; a new revoke adopts the binding.
+                    let denyNew = "unknown";
+                    try {
+                        denyNew = denyNewOf(await endpoint(ctx, serviceAssignmentGate(inv.host, row.reservation)));
+                    }
+                    catch (err) {
+                        if (!(err instanceof Held) && !(err instanceof EpEnvelopeError))
+                            throw err;
+                    }
+                    return { state: "held", operationId, reason: "expired", phase: "spent", assignmentDigest: a, denyNew, ...owing() };
+                }
+                ctx.step = "V3-cancel";
+                const run = await nativeCancel(inv, ctx, row, row.cancel);
+                if (run.denyNew === "landed")
+                    await keepDebt(await v4(ctx, row, run.gate));
+                const s1 = run.s1;
+                if (s1.kind === "pending" && run.denyNew === "landed") {
+                    await progress("cancelled-nonterminal");
+                    return { state: "pending", operationId, phase: "cancelled-nonterminal", assignmentDigest: a, denyNew: "landed", root: s1.root, ...owing() };
+                }
+                if (s1.kind === "uid-unconfirmed" && run.denyNew === "landed") {
+                    await progress("uid-unconfirmed");
+                    return { state: "pending", operationId, phase: "uid-unconfirmed", assignmentDigest: a, denyNew: "landed", ...owing() };
+                }
+                const reason = s1.kind === "held" ? s1.reason : s1.kind === "seal-refused" ? "cancel-intent-refused" : s1.kind === "pending" || s1.kind === "uid-unconfirmed" ? "deny-new-unconfirmed" : s1.kind;
+                const phase = s1.kind === "held" ? s1.step : s1.kind === "uid-foreign" ? "U-uid" : "V3-cancel";
+                return { state: "held", operationId, reason, phase, assignmentDigest: a, denyNew: run.denyNew, ...owing() };
+            }
+        }
+    }
+    async function operationRead(req) {
+        try {
+            const ctx = discoveryCtx("operation-read");
+            const op = await readOp(ctx, req.input.operationId);
+            if (op.state === "absent")
+                return { state: "absent" };
+            const g = req.granter, o = op.row;
+            if (g.kind === "owner" && !((o.granter.kind === "owner" && o.granter.owner === g.owner) || o.projection.subjectOwner === g.owner))
+                return { state: "absent" };
+            const projection = { ...o.projection };
+            if (o.kind === "service-host-operation-terminal")
+                return { state: "present", record: { value: { operationId: o.operationId, requestDigest: o.requestDigest, operation: o.operation, projection, outcome: finalView(o.outcome) }, revision: op.revision } };
+            const p = o.plan, assignmentDigest = p.kind === "approve" ? serviceAssignmentGate(discovery.host, p.reservation).binding.assignmentDigest : p.kind === "revoke" ? p.expectedAssignmentDigest : null;
+            const g2 = o.progress;
+            const progress = g2.state === "admitted" ? { state: "pending", phase: "admitted" } : g2.state === "custody" ? { state: "pending", phase: g2.step }
+                : g2.state === "held" ? { state: "held", reason: g2.reason, phase: g2.phase } : finalView(g2);
+            return { state: "present", record: { value: { operationId: o.operationId, requestDigest: o.requestDigest, operation: o.operation,
+                        target: { kind: "service", endpoint: o.projection.endpoint, instanceId: o.projection.instanceId, assignmentDigest }, projection, progress, debt: o.debt.map((d) => ({ ...d })) }, revision: op.revision } };
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return denied("unavailable");
+            throw err;
+        }
+    }
+    const finalView = (f) => f.state === "complete" ? { state: "complete", resultDigest: contractDigest(f.result) } : f.state === "refused" ? { state: "refused", reason: f.reason } : { state: "superseded", boundOperationId: f.boundOperationId };
+    async function proposalRead(req) {
+        try {
+            const ctx = discoveryCtx("proposal-read");
+            const prop = await readProposal(ctx, req.input.proposalId);
+            if (prop.state === "absent" || (req.granter.kind === "owner" && prop.row.owner !== req.granter.owner))
+                return { state: "absent" };
+            const p = prop.row;
+            if (p.kind === "service-proposal-terminal")
+                return { state: "present", record: { value: view(p), revision: prop.revision } };
+            const name = await nameOf(ctx, p.endpoint);
+            return { state: "present", record: { value: { proposalId: p.proposalId, proposalDigest: p.proposalDigest, owner: p.owner, endpoint: p.endpoint, instanceId: p.instanceId,
+                        state: p.state.state, createdAt: seconds(p.createdAtMs), expiresAt: seconds(p.expiresAtMs), clusterDigests: [...p.clusterDigests], commands: structuredClone(p.commands),
+                        nameBinding: name ?? null, decision: p.state.state === "approving" ? { operationId: p.state.operationId, assignmentDigest: p.state.assignmentDigest } : null }, revision: prop.revision } };
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return denied("unavailable");
+            throw err;
+        }
+    }
+    /** One zero-history create of the endpoint's name row through this invocation's custody host. Only
+     *  the identical request recovers an existing row; transfer, release and update do not exist. */
+    async function nameBind(req) {
+        const { endpoint: e, owner: o, expectedRevision, claimReference } = req.input;
+        if (expectedRevision !== 0)
+            return denied("unsupported"); // never binds
+        let key;
+        try {
+            key = serviceNameKey(e);
+        }
+        catch (err) {
+            if (err instanceof EpEnvelopeError && err.code === "permission-denied")
+                return denied("permission-denied");
+            throw err;
+        }
+        const bytes = serviceNameRowBytes({ accountPublicKey, space }, req), requestDigest = contractDigest(req);
+        const operationId = serviceHostOperationId(space, req.requestId);
+        try {
+            return await invoke({ operation: "name-bind", operationId: null, proposalId: null, owner: null, endpoint: e, instanceId: null, lifecycleUid: null }, async (inv) => {
+                inv.operationId = operationId;
+                try {
+                    const ctx = readCtx(inv, "N-read");
+                    for (let n = 0;; n++) {
+                        if (n >= S2A_MAX_REDECIDE)
+                            held("contention", ctx.step);
+                        const found = await nameOf(ctx, e);
+                        if (found !== undefined) {
+                            if (found.requestId === req.requestId && found.requestDigest === requestDigest && found.owner === o && found.claimReference === claimReference)
+                                return { state: "bound", binding: found };
+                            return denied(found.requestId === req.requestId ? "conflict" : "name-bound");
+                        }
+                        ctx.step = "N-create";
+                        await write(ctx, "auth", key, bytes, { create: true });
+                        ctx.step = "N-read";
+                    }
+                }
+                catch (err) {
+                    if (err instanceof Held)
+                        return heldArm(inv, err);
+                    throw err;
+                }
+            });
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return unread(req.requestId, err.reason, err.step);
+            throw err;
+        }
+    }
+    const deniedServe = (reason) => ({ state: "denied", reason });
+    /** The owner's own assignment at a selector; another owner's reads absent. */
+    async function bindingOf(ctx, o, e, i) {
+        const asg = await readAssignment(ctx, e, i);
+        if (asg.state === "absent" || asg.row.owner !== o)
+            return { state: "absent" };
+        if (asg.row.state === "fenced")
+            return { state: "fenced", row: asg.row };
+        return { state: "bound", row: asg.row, ...serviceAssignmentGate(discovery.host, asg.row.reservation) };
+    }
+    /** A witness is a public coordinate: it must name this selector, owner, actor and lifecycle. */
+    const namesBinding = (w, b) => namesSelector(w, b) && w.principal.actor === serviceEndpointActor(b) && w.principal.lifecycleUid === b.lifecycleUid;
+    /** The part of {@link namesBinding} a selector alone decides, before anything is read. */
+    const namesSelector = (w, s) => w.accountPublicKey === accountPublicKey && w.space === space && w.endpoint === s.endpoint && w.instanceId === s.instanceId && w.principal.owner === s.owner;
+    /** The witness of a gate's current registration stamp, or undefined when the gate has none. A stamp
+     *  whose coordinates disagree with the gate's is inconsistent and holds. */
+    function stampWitness(ctx, b, row) {
+        const a = row.serviceAuthority, stamp = a.registration;
+        if (stamp === undefined)
+            return undefined;
+        if (a.rootCredentialId === null || a.approvalDigest === null || stamp.processEpoch !== row.processEpoch
+            || stamp.registrationRevision !== row.registrationRevision || stamp.nameAuthorityRevision !== row.nameAuthorityRevision)
+            return held("registration-inconsistent", ctx.step, "the registration stamp disagrees with its endpoint gate");
+        return { accountPublicKey, space, endpoint: b.endpoint, instanceId: b.instanceId,
+            principal: { owner: b.owner, actor: serviceEndpointActor(b), lifecycleUid: b.lifecycleUid },
+            rootCredentialId: a.rootCredentialId, approvalDigest: a.approvalDigest, processEpoch: stamp.processEpoch,
+            registrationRevision: stamp.registrationRevision, nameAuthorityRevision: stamp.nameAuthorityRevision,
+            registrationRequestId: stamp.requestId, registrationProof: stamp.registrationProof };
+    }
+    /** The closures' manifest and root documents, each verified against its digest. */
+    async function closureArtifacts(ctx, clusterDigests) {
+        const reader = opts.serving?.readContractArtifact;
+        if (reader === undefined)
+            return held("unavailable", ctx.step, "this host has no contract store reader");
+        const get = async (d) => {
+            const r = await bounded(ctx, () => reader(d));
+            if (!r.ok)
+                return held("unavailable", ctx.step, "timedOut" in r ? `the contract artifact ${d} read timed out` : message(r.error));
+            return r.value;
+        };
+        const out = [];
+        for (const closure of clusterDigests) {
+            const manifest = await get(closure);
+            const document = await grammarHeld(ctx, async () => { const { root } = verifyClusterManifest(closure, manifest); const raw = await get(root); verifyClusterRoot(root, raw); return raw; });
+            out.push(manifest, document);
+        }
+        return out;
+    }
+    /** A read that its own parser or verifier refuses holds as inconsistent, never as absence. */
+    async function grammarHeld(ctx, f) {
+        try {
+            return await f();
+        }
+        catch (e) {
+            if (e instanceof Held)
+                throw e;
+            return held("registration-inconsistent", ctx.step, message(e));
+        }
+    }
+    /** The registered spec at the witness revision, the name revision and the closures' artifacts. */
+    async function snapshotOf(ctx, w, artifacts) {
+        const cur = await leader(ctx, "records", recordSpecKey(RECORD_KINDS.svc, [w.endpoint, w.instanceId]));
+        if (cur.state !== "value" || cur.revision !== w.registrationRevision)
+            return held("registration-inconsistent", ctx.step, "the registered spec is not readable at the witness revision");
+        const spec = await grammarHeld(ctx, () => parseServiceSpec(cur.value, { endpoint: w.endpoint }));
+        if (spec.owner !== w.principal.owner)
+            return held("registration-inconsistent", ctx.step, "the registered spec names another owner");
+        return { spec: { value: spec, revision: cur.revision }, name: { authorized: true, revision: w.nameAuthorityRevision }, processEpoch: w.processEpoch,
+            contractArtifacts: artifacts ?? await closureArtifacts(ctx, spec.clusterDigests) };
+    }
+    /** The service-reported ready status at the witness's epoch and spec revision, if recorded. */
+    async function reportedAt(ctx, w) {
+        const cur = await leader(ctx, "records", recordStatusKey(RECORD_KINDS.svc, [w.endpoint, w.instanceId]));
+        if (cur.state === "absent" || cur.state === "marker")
+            return undefined;
+        if (cur.state === "malformed")
+            return held("registration-inconsistent", ctx.step, "the service status is not JSON");
+        const status = await grammarHeld(ctx, () => parseServiceStatus(cur.value));
+        const at = status.reportedAt;
+        return status.state === "ready" && status.epoch === w.processEpoch && status.observedSpecRevision === w.registrationRevision
+            && typeof at === "number" && Number.isSafeInteger(at) && at >= 0 ? at : undefined;
+    }
+    /** The live native root's expiry in Unix seconds; a refused proof is a definite refusal. */
+    async function rootExpiresAt(ctx, inv, b, rootCredentialId) {
+        const r = await bounded(ctx, () => readRegistryServiceRoot(inv.h.registry, b, rootCredentialId, Date.now()));
+        if (r.ok)
+            return r.value.expiresAt;
+        if ("error" in r && r.error instanceof EpEnvelopeError && r.error.code === "permission-denied")
+            return deniedServe("root-revoked");
+        return held("unavailable", ctx.step, "timedOut" in r ? "the native root read timed out" : message(r.error));
+    }
+    /** Run one native multi-request step to completion or the invocation's original deadline, which
+     *  ends the step held; the step's own later requests then fail on the closed connection. */
+    async function native(ctx, start) {
+        const remaining = ctx.deadlineMs - Date.now();
+        if (remaining <= 0)
+            return held("deadline", ctx.step, "the original deadline has passed; no request starts");
+        let timer;
+        const timeout = new Promise((r) => { timer = setTimeout(() => r("timeout"), remaining); });
+        const settled = start().then((value) => ({ value }), (error) => ({ error }));
+        let r;
+        try {
+            r = await Promise.race([settled, timeout]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (r === "timeout")
+            return held("deadline", ctx.step, "the original deadline was reached during a native step");
+        if ("error" in r)
+            return held("unknown", ctx.step, `the native step did not complete: ${message(r.error)}`);
+        return r.value;
+    }
+    /** Classify the assignment's endpoint gate; anything but an approved or revoked service gate is
+     *  inconsistent for a bound selector past approval. */
+    async function servedGate(ctx, b) {
+        const g = await endpoint(ctx, b);
+        if (g.kind !== "approved" && g.kind !== "revoked")
+            return held("registration-inconsistent", ctx.step, `the endpoint gate is ${g.kind}`);
+        return g;
+    }
+    const sameIntent = (a, b) => canonicalJson({ ...a, admittedAtMs: 0 }) === canonicalJson({ ...b, admittedAtMs: 0 });
+    /** A register key the proposal phase already admitted stays bound to that admission's body and
+     *  proposal: a changed body is a conflict, and a key of another proposal answers that proposal's
+     *  own refusal, or a conflict. */
+    async function keyHistory(ctx, req, b, id) {
+        ctx.step = "S-key";
+        const op = await readOp(ctx, id);
+        if (op.state === "absent")
+            return undefined;
+        const r = req.register;
+        const admitted = serviceRegisterHostRequest({ owner: req.owner, endpoint: req.endpoint, instanceId: req.instanceId, engineRequestId: req.engineRequestId,
+            requestId: req.requestId, requestDigest: req.requestDigest, clusterDigests: r.clusterDigests, commands: r.commands });
+        if (op.row.operation !== "register" || op.row.requestDigest !== requestDigestOf(admitted))
+            return deniedServe("conflict");
+        const proposalId = op.row.projection.proposalId;
+        if (proposalId === b.row.proposalId)
+            return undefined;
+        const p = proposalId === null ? undefined : await readProposal(ctx, proposalId);
+        if (p?.state === "value") {
+            if (p.row.kind === "service-proposal-terminal" && (p.row.state === "refused" || p.row.state === "expired"))
+                return deniedServe(p.row.state === "expired" ? "proposal-expired" : "proposal-refused");
+            if (p.row.kind === "service-proposal" && p.row.state.state === "proposed" && Date.now() >= p.row.expiresAtMs)
+                return deniedServe("proposal-expired");
+        }
+        return deniedServe("conflict");
+    }
+    /** R1 §A: a new admission's key history and state check, read before anything is written. */
+    async function admissible(ctx, req, b, id) {
+        if (req.operation === "register") {
+            const k = await keyHistory(ctx, req, b, id);
+            if (k !== undefined)
+                return k;
+        }
+        ctx.step = "S-state";
+        if (b.row.cancel !== null)
+            return deniedServe("approval-revoked");
+        const g = await servedGate(ctx, b);
+        if (g.kind === "revoked")
+            return deniedServe("approval-revoked");
+        const a = g.row.serviceAuthority, current = stampWitness(ctx, b.binding, g.row);
+        if (req.operation === "register") {
+            if (a.activationIssued)
+                return deniedServe("registration-active");
+            const p = await readProposal(ctx, b.row.proposalId);
+            if (p.state !== "value" || p.row.kind !== "service-proposal-terminal" || p.row.state !== "approved" || p.row.approvalDigest !== a.approvalDigest)
+                return held("registration-inconsistent", ctx.step, "the assignment's approved proposal is not readable");
+            const r = req.register;
+            if (proposalBodyDigest({ owner: b.binding.owner, endpoint: b.binding.endpoint, instanceId: b.binding.instanceId }, r.clusterDigests, r.commands) !== p.row.proposalDigest)
+                return deniedServe("approval-mismatch");
+            const expected = req.witness === null ? undefined : serviceWitnessDigest(req.witness);
+            if ((current === undefined) !== (expected === undefined) || (current !== undefined && serviceWitnessDigest(current) !== expected))
+                return deniedServe("conflict");
+            return undefined;
+        }
+        if (current === undefined || serviceWitnessDigest(current) !== serviceWitnessDigest(req.witness))
+            return deniedServe("stale-witness");
+        return undefined;
+    }
+    /** Append the request to its instance's index, or find it listed. */
+    async function listIntent(ctx, b, id, operation) {
+        ctx.step = "S-index";
+        const { owner: o, endpoint: e, instanceId: i } = b.binding;
+        for (let n = 0; n < S2A_MAX_REDECIDE; n++) {
+            const cur = await readIntentIndex(ctx, e, i);
+            if (cur.state === "value") {
+                if (cur.row.owner !== o || cur.row.endpoint !== e || cur.row.instanceId !== i)
+                    return held("intent-index-inconsistent", ctx.step, "the intent index names another assignment");
+                if (cur.row.intents.some((x) => x.operationId === id))
+                    return undefined;
+                if (cur.row.intents.length >= S3_MAX_INTENTS_PER_INSTANCE)
+                    return deniedServe("resource-exhausted");
+            }
+            const intents = [...(cur.state === "value" ? cur.row.intents : []), { operationId: id, operation }]
+                .sort((x, y) => (x.operationId < y.operationId ? -1 : 1));
+            const row = { v: 1, kind: "service-request-intent-index", owner: o, endpoint: e, instanceId: i, intents };
+            if ((await put(ctx, intentIndexKey(e, i), row, parseServiceRequestIntentIndexRecord, cur.state === "value" ? cur : undefined)) !== "moved")
+                return undefined;
+        }
+        return held("contention", ctx.step);
+    }
+    async function serve(req) {
+        if (tripped !== undefined || closed)
+            return { state: "unavailable", detail: "the service host is fenced or closing" };
+        const { owner: o, endpoint: e, instanceId: i } = req;
+        if (req.caller === "owner" && !interactive(o))
+            return deniedServe("permission-denied");
+        const id = serviceHostOperationId(space, req.engineRequestId);
+        let b;
+        try {
+            b = await bindingOf(discoveryCtx("S-binding"), o, e, i);
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return { state: "unavailable", detail: `the assignment is not readable (${err.reason})` };
+            throw err;
+        }
+        if (b.state === "absent")
+            return deniedServe("permission-denied");
+        if (b.state === "fenced")
+            return deniedServe("approval-revoked");
+        if (req.witness !== null && !namesBinding(req.witness, b.binding))
+            return deniedServe("permission-denied");
+        const intent = { v: 1, kind: "service-request-intent", operationId: id, operation: req.operation, account: { accountPublicKey, space },
+            owner: o, endpoint: e, instanceId: i, requestId: req.requestId, requestDigest: req.requestDigest,
+            registrationRequestId: req.witness?.registrationRequestId ?? null, witnessDigest: req.witness === null ? null : serviceWitnessDigest(req.witness),
+            admittedAtMs: Date.now() };
+        const contract = req.register?.artifacts.map((a) => contractDigest(a).slice("sha256:".length)) ?? [];
+        const bound = b;
+        try {
+            return await invoke({ operation: "serve", serve: req.operation, operationId: id, proposalId: null, owner: o, endpoint: e, instanceId: i,
+                lifecycleUid: b.binding.lifecycleUid, contract }, async (inv) => {
+                const ctx = readCtx(inv, "S-intent");
+                const found = await readIntent(ctx, id);
+                if (found.state === "value") {
+                    if (!sameIntent(found.row, intent))
+                        return deniedServe("conflict");
+                }
+                else {
+                    const refusal = (await admissible(ctx, req, bound, id)) ?? (await listIntent(ctx, bound, id, req.operation));
+                    if (refusal !== undefined)
+                        return refusal;
+                    ctx.step = "S-intent-create";
+                    if ((await put(ctx, intentKey(id), intent, parseServiceRequestIntentRecord)) === "moved") {
+                        const again = await readIntent(ctx, id);
+                        if (again.state !== "value")
+                            return held("unknown", ctx.step, "the intent create lost but no intent is readable");
+                        if (!sameIntent(again.row, intent))
+                            return deniedServe("conflict");
+                    }
+                }
+                switch (req.operation) {
+                    case "register": return registerEffect(ctx, inv, req, bound, id);
+                    case "activate":
+                    case "renew": return credentialEffect(ctx, inv, req, bound);
+                    case "ready": return readyEffect(ctx, inv, req, bound);
+                }
+            });
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return { state: "unavailable", detail: `${req.operation} held (${err.reason} at ${err.step})` };
+            throw err;
+        }
+    }
+    /** Same-request recovery first, from the stamp alone; otherwise publish, barrier, spec and stamp. */
+    async function registerEffect(ctx, inv, req, b, id) {
+        ctx.step = "R-gate";
+        const r = req.register;
+        const stampedHere = (row) => {
+            const stamp = row.serviceAuthority.registration;
+            return stamp?.requestId === req.requestId && stamp.requestDigest === req.requestDigest;
+        };
+        const frozenHere = (row) => {
+            const pending = row.serviceAuthority.pendingRegistration;
+            return row.state === "frozen" && pending?.operationId === id && pending.requestId === req.requestId && pending.requestDigest === req.requestDigest;
+        };
+        const recovered = async (g) => {
+            if (!stampedHere(g.row))
+                return undefined;
+            const witness = stampWitness(ctx, b.binding, g.row);
+            return { state: "registered", witness, snapshot: await snapshotOf(ctx, witness, r.artifacts) };
+        };
+        // Revocation answers first, as status does; then a completed same request recovers from its
+        // stamp before any expected or activation check, with no barrier and no epoch advance.
+        const g = await servedGate(ctx, b);
+        if (g.kind === "revoked" || b.row.cancel !== null)
+            return deniedServe("approval-revoked");
+        const done = await recovered(g);
+        if (done !== undefined)
+            return done;
+        const a = g.row.serviceAuthority;
+        if (a.activationIssued)
+            return deniedServe("registration-active");
+        const resuming = frozenHere(g.row);
+        const expected = req.witness === null ? undefined : serviceWitnessDigest(req.witness);
+        const expectationHolds = (row) => {
+            const current = stampWitness(ctx, b.binding, row);
+            return current === undefined ? expected === undefined : serviceWitnessDigest(current) === expected;
+        };
+        if (!resuming) {
+            if (g.row.state !== "open")
+                return deniedServe("registration-pending");
+            if (!expectationHolds(g.row))
+                return deniedServe("conflict");
+            if (!serviceGateApprovalLive(a, seconds(Date.now())))
+                return deniedServe("expired");
+        }
+        if (inv.contract === undefined)
+            return held("unavailable", ctx.step, "the effect connection has no contract store");
+        ctx.step = "R-publish";
+        for (const artifact of r.artifacts) {
+            await readyBefore(ctx);
+            const p = await bounded(ctx, () => publishContractArtifact(inv.contract, contractArtifactCanonicalBytes(artifact)));
+            if (!p.ok)
+                return held("unknown", ctx.step, "timedOut" in p ? "a contract artifact publish timed out" : message(p.error));
+        }
+        ctx.step = "R-register";
+        const stores = registryStores(inv.h.registry), artifacts = new Map(r.artifacts.map((v) => [contractDigest(v), v]));
+        // A service family is empty before activation, so the barrier keeps no repair cursor.
+        const { progress: _progress, ...observed } = endpointRegistrationBarrier(stores.authKv, space, { endpoint: b.binding.endpoint, instanceId: b.binding.instanceId, opId: id, serviceRegistration: { requestId: req.requestId, requestDigest: req.requestDigest } });
+        void _progress;
+        // The barrier freezes the gate revision it observes after the publishes above, whenever it does
+        // not find the gate frozen by this operation: also for a request that read it frozen and finds
+        // it reopened. The checks above ran on an earlier read, so they are made again on exactly the
+        // revision being frozen, and nothing is frozen or written unless they hold. A stamp that already
+        // names this request was completed by another invocation of it and answers as a replay does; a
+        // freeze of this operation with no stamp yet is that invocation still running, so this one holds.
+        let decided;
+        const barrier = { ...observed, freeze: async (revision) => {
+                const now = await servedGate(ctx, b);
+                if (now.kind === "revoked")
+                    decided = "approval-revoked";
+                else if (stampedHere(now.row))
+                    decided = "stamped";
+                else if (frozenHere(now.row))
+                    decided = "running";
+                else if (now.revision !== revision || now.row.state !== "open" || !expectationHolds(now.row))
+                    decided = "conflict";
+                return decided === undefined ? await observed.freeze(revision) : null;
+            } };
+        await readyBefore(ctx);
+        try {
+            await native(ctx, () => registerServiceInstance(stores.recordsKv, { space, instanceId: b.binding.instanceId, registrant: { owner: b.binding.owner },
+                spec: { endpoint: b.binding.endpoint, owner: b.binding.owner, clusterDigests: [...r.clusterDigests], protocol: { v: 1 } },
+                authority: nativeServiceNameAuthority(inv.h.registry, { space, accountPublicKey }), barrier, readClusterArtifact: (d) => artifacts.get(d) }));
+        }
+        catch (err) {
+            if (decided === undefined || !(err instanceof Held))
+                throw err;
+            if (decided === "running")
+                return held("unknown", ctx.step, "another invocation of this request froze the gate and has not completed");
+            if (decided !== "stamped")
+                return deniedServe(decided);
+            ctx.step = "R-confirm";
+            const now = await servedGate(ctx, b);
+            if (now.kind === "revoked")
+                return deniedServe("approval-revoked");
+            return (await recovered(now)) ?? held("unknown", ctx.step, "this request's registration was replaced while it was confirmed");
+        }
+        await readyAfter(ctx);
+        ctx.step = "R-confirm";
+        const after = await recovered(await servedGate(ctx, b));
+        return after ?? held("unknown", ctx.step, "the registration completed but its stamp does not name this request");
+    }
+    /** activate: the monotonic activation CAS at the current witness; renew: the same checks with no
+     *  write. Either returns the bounds fresh material must keep; no material is minted here. */
+    async function credentialEffect(ctx, inv, req, b) {
+        for (let n = 0; n < S2A_MAX_REDECIDE; n++) {
+            ctx.step = req.operation === "activate" ? "A-gate" : "W-gate";
+            const g = await servedGate(ctx, b);
+            if (g.kind === "revoked" || b.row.cancel !== null)
+                return deniedServe("approval-revoked");
+            const a = g.row.serviceAuthority, current = stampWitness(ctx, b.binding, g.row);
+            if (current === undefined || serviceWitnessDigest(current) !== serviceWitnessDigest(req.witness))
+                return deniedServe("stale-witness");
+            if (g.row.state !== "open")
+                return deniedServe("registration-pending");
+            if (!serviceGateApprovalLive(a, seconds(Date.now())))
+                return deniedServe("expired");
+            const root = await rootExpiresAt(ctx, inv, b.binding, current.rootCredentialId);
+            if (typeof root !== "number")
+                return root;
+            if (!a.activationIssued) {
+                if (req.operation === "renew")
+                    return deniedServe("stale-witness");
+                ctx.step = "A-activate";
+                const next = await grammarHeld(ctx, () => activatedServiceGateRow(g.row, b.binding, current, Date.now()));
+                if (next !== undefined) {
+                    const bytes = enc.encode(JSON.stringify(next));
+                    await grammarHeld(ctx, () => b.epgate.parse(bytes));
+                    if ((await write(ctx, "auth", b.epgate.key, bytes, { revision: g.revision, preimage: g.bytes })) === "moved")
+                        continue;
+                }
+            }
+            return { state: "current", witness: current, snapshot: await snapshotOf(ctx, current), rootExpiresAt: root, approvalExpiresAt: a.approvalExpiresAt };
+        }
+        return held("contention", ctx.step);
+    }
+    /** ready: the service-reported status at the current activated witness, fenced on its epoch. */
+    async function readyEffect(ctx, inv, req, b) {
+        ctx.step = "Y-gate";
+        const g = await servedGate(ctx, b);
+        if (g.kind === "revoked" || b.row.cancel !== null)
+            return deniedServe("approval-revoked");
+        const a = g.row.serviceAuthority, current = stampWitness(ctx, b.binding, g.row);
+        if (current === undefined || serviceWitnessDigest(current) !== serviceWitnessDigest(req.witness) || !a.activationIssued)
+            return deniedServe("stale-witness");
+        if (g.row.state !== "open")
+            return deniedServe("registration-pending");
+        if (!serviceGateApprovalLive(a, seconds(Date.now())))
+            return deniedServe("expired");
+        const root = await rootExpiresAt(ctx, inv, b.binding, current.rootCredentialId);
+        if (typeof root !== "number")
+            return root;
+        const name = await nameOf(ctx, b.binding.endpoint);
+        if (name === undefined || name.owner !== b.binding.owner || name.revision !== current.nameAuthorityRevision)
+            return deniedServe("stale-witness");
+        ctx.step = "Y-status";
+        const at = seconds(Date.now()), stores = registryStores(inv.h.registry);
+        await readyBefore(ctx);
+        await native(ctx, () => writeServiceStatus(stores.recordsKv, { endpoint: b.binding.endpoint, instanceId: b.binding.instanceId, epoch: current.processEpoch,
+            status: { epoch: current.processEpoch, state: "ready", observedSpecRevision: current.registrationRevision, reportedAt: at },
+            readProcessEpoch: async () => {
+                const now = await servedGate(ctx, b);
+                if (now.row.state !== "open" || stampWitness(ctx, b.binding, now.row)?.registrationRequestId !== current.registrationRequestId)
+                    throw new EpEnvelopeError("conflict", "the registration changed before the ready status was written");
+                return now.row.processEpoch;
+            } }));
+        await readyAfter(ctx);
+        return { state: "ready", witness: current, reportedAt: at };
+    }
+    // ---- serving status (SPEC 13.1 precedence) ------------------------------------------------------
+    async function serveStatus(q) {
+        if (tripped !== undefined || closed)
+            return { kind: "unavailable", detail: "the service host is fenced or closing" };
+        // An owner reads only while it holds an interactive row, as for every owner request; a service
+        // reads only its own selector. Both are refused before any read.
+        if (q.reader.kind === "owner" && !interactive(q.owner))
+            return { kind: "denied", reason: "permission-denied" };
+        if (q.reader.kind === "service" && !namesSelector(q.reader.witness, q))
+            return { kind: "not-found" };
+        try {
+            return await statusOf(discoveryCtx("T-read"), q);
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return { kind: "unavailable", detail: `status held (${err.reason} at ${err.step})` };
+            throw err;
+        }
+    }
+    async function statusOf(ctx, q) {
+        const status = (s) => ({ kind: "status", status: s });
+        const unavailable = (detail) => ({ kind: "unavailable", detail });
+        const readerDigest = q.reader.kind === "service" ? serviceWitnessDigest(q.reader.witness) : null;
+        let intent;
+        if (q.target.kind === "operation") {
+            const id = serviceHostOperationId(space, q.target.engineRequestId);
+            const found = await readIntent(ctx, id);
+            if (found.state === "absent") {
+                const idx = await readIntentIndex(ctx, q.endpoint, q.instanceId);
+                if (idx.state === "value" && idx.row.owner === q.owner && idx.row.intents.some((x) => x.operationId === id))
+                    return unavailable("the request is listed without its intent; replay it");
+                return q.target.operation === "register" && readerDigest === null ? { kind: "proposal-phase" } : { kind: "not-found" };
+            }
+            intent = found.row;
+            if (intent.owner !== q.owner || (readerDigest !== null && intent.witnessDigest !== readerDigest))
+                return { kind: "not-found" };
+        }
+        const b = await bindingOf(ctx, q.owner, q.endpoint, q.instanceId);
+        if (b.state === "absent")
+            return intent === undefined ? { kind: "not-found" } : unavailable("the intent's assignment is not readable");
+        // A service reader's own incarnation before any precedence rule. A fenced assignment keeps no
+        // lifecycle, so only the selector check above applies to it.
+        if (b.state === "bound" && q.reader.kind === "service" && !namesBinding(q.reader.witness, b.binding))
+            return { kind: "not-found" };
+        // Rule 3: cancellation and revocation first.
+        if (b.state === "fenced")
+            return status({ state: "revoking", operationId: b.row.cancel.operationId, phase: "deny-new-landed" });
+        const g = await endpoint(ctx, b);
+        if (b.row.cancel !== null)
+            return status({ state: "revoking", operationId: b.row.cancel.operationId, phase: g.kind === "revoked" ? "deny-new-landed" : "deny-new-pending" });
+        if (g.kind === "revoked" || g.kind === "foreign")
+            return unavailable(`the endpoint gate is ${g.kind} without a bound cancel`);
+        if (g.kind === "absent" || g.kind === "pending") {
+            if (intent !== undefined)
+                return unavailable("the intent's approval is not readable");
+            return status({ state: "registering", operationId: b.row.creation.operationId, phase: "approving" });
+        }
+        const a = g.row.serviceAuthority, stamp = a.registration, pending = a.pendingRegistration;
+        const current = stampWitness(ctx, b.binding, g.row);
+        const live = async (w) => {
+            const snapshot = await snapshotOf(ctx, w), at = await reportedAt(ctx, w);
+            return status(at === undefined ? { state: "registered", witness: w, snapshot } : { state: "ready", witness: w, snapshot, reportedAt: at });
+        };
+        if (intent === undefined) {
+            // The instance: the reader's own incarnation, or the owner's current state.
+            if (q.reader.kind === "service") {
+                if (stamp === undefined)
+                    return unavailable("the reader's registration has no stamp");
+                if (stamp.requestId !== q.reader.witness.registrationRequestId)
+                    return status({ state: "superseded", registrationRequestId: q.reader.witness.registrationRequestId, currentRegistrationRequestId: stamp.requestId });
+            }
+            if (g.row.state === "frozen")
+                return pending ? status({ state: "registering", operationId: pending.operationId, phase: "barrier" }) : unavailable("the gate is frozen without a pending registration");
+            if (current === undefined)
+                return status({ state: "approved-unregistered", approvalDigest: a.approvalDigest });
+            if (readerDigest !== null && serviceWitnessDigest(current) !== readerDigest)
+                return unavailable("the reader's witness disagrees with the current stamp");
+            return live(current);
+        }
+        if (intent.operation === "register") {
+            // Rule 5: the permanent answers before the transient ones.
+            if (stamp?.requestId === intent.requestId && stamp.requestDigest === intent.requestDigest)
+                return live(current);
+            if (stamp !== undefined && (stamp.requestId !== intent.registrationRequestId || a.activationIssued))
+                return status({ state: "superseded", registrationRequestId: intent.requestId, currentRegistrationRequestId: stamp.requestId });
+            if (pending?.requestId === intent.requestId && pending.requestDigest === intent.requestDigest)
+                return status({ state: "registering", operationId: intent.operationId, phase: "barrier" });
+            if ((stamp === undefined && intent.registrationRequestId === null) || (stamp?.requestId === intent.registrationRequestId && !a.activationIssued))
+                return status({ state: "registering", operationId: intent.operationId, phase: "admitted" });
+            return unavailable("the register intent matches no registration state");
+        }
+        // Rule 6: activate, renew and ready name a registration.
+        if (stamp === undefined)
+            return unavailable("the intent's registration has no stamp");
+        if (stamp.requestId !== intent.registrationRequestId)
+            return status({ state: "superseded", registrationRequestId: intent.registrationRequestId, currentRegistrationRequestId: stamp.requestId });
+        if (g.row.state === "frozen")
+            return pending ? status({ state: "registering", operationId: pending.operationId, phase: "barrier" }) : unavailable("the gate is frozen without a pending registration");
+        if (current !== undefined && serviceWitnessDigest(current) === intent.witnessDigest)
+            return live(current);
+        return unavailable("the intent's witness disagrees with the current stamp");
+    }
+    /** The callout's assignment: the current bound assignment the witness names, never a guess. */
+    async function serviceBinding(w) {
+        if (tripped !== undefined || closed)
+            throw new EpEnvelopeError("unavailable", "the service host is fenced or closing");
+        const b = await bindingOf(discoveryCtx("C-binding"), w.principal.owner, w.endpoint, w.instanceId);
+        if (b.state !== "bound" || b.row.cancel !== null || !namesBinding(w, b.binding))
+            throw new EpEnvelopeError("permission-denied", "the service witness names no current bound assignment");
+        return { ...b.binding };
+    }
+    // ---- one owner's assignment state (read only) ---------------------------------------------------
+    async function serviceState(o, e, i) {
+        if (tripped !== undefined || closed)
+            return { state: "unavailable" };
+        try {
+            const ctx = discoveryCtx("state-read");
+            const asg = await readAssignment(ctx, e, i);
+            if (asg.state === "absent" || asg.row.owner !== o)
+                return { state: "absent" };
+            const a = asg.row, ids = { proposalId: a.proposalId, assignmentDigest: a.assignmentDigest };
+            if (a.state === "fenced")
+                return { state: "revoking", ...ids, operationId: a.cancel.operationId, denyNew: "landed" };
+            const gate = await endpoint(ctx, serviceAssignmentGate(discovery.host, a.reservation));
+            if (a.cancel !== null)
+                return { state: "revoking", ...ids, operationId: a.cancel.operationId, denyNew: denyNewOf(gate) };
+            const approvalDigest = gate.kind === "approved" ? gate.row.serviceAuthority.approvalDigest : null;
+            if (approvalDigest !== null && gate.kind === "approved")
+                return { state: "approved", ...ids, approvalDigest, registrationRequestId: gate.row.serviceAuthority.registration?.requestId ?? null };
+            if (gate.kind === "absent" || gate.kind === "pending")
+                return { state: "pending-root", ...ids };
+            // A revoked gate without a bound cancel identity, an approved gate without its digest, or another assignment's row.
+            return { state: "unavailable" };
+        }
+        catch (err) {
+            if (err instanceof Held || err instanceof EpEnvelopeError)
+                return { state: "unavailable" };
+            throw err;
+        }
+    }
+    // ---- dispatch -----------------------------------------------------------------------------------
+    async function handle(raw) {
+        const req = parseServiceHostRequest(raw);
+        const env = { v: 1, kind: "service-endpoint-host", operation: req.operation, requestId: req.requestId, space, accountPublicKey };
+        const out = (r) => ({ ...env, ...r });
+        // The latch comes before the ledger and every broker read. A request that could bind holds under its
+        // operation coordinate, with no deny-new claim because no gate was read; a read never binds.
+        if (tripped !== undefined || closed)
+            return out(req.operation === "decide" || req.operation === "revoke" || req.operation === "name-bind"
+                ? unread(req.requestId, "readiness", "open", req.operation === "revoke" ? req.input.expectedAssignmentDigest : undefined) : denied("unavailable"));
+        const authorized = req.granter.kind === "operator" || interactive(req.granter.owner);
+        switch (req.operation) {
+            case "decide": return out(await decide(req, authorized));
+            case "revoke": return out(await revoke(req, authorized));
+            case "name-bind": return out(await nameBind(req));
+            case "operation-read": return out(authorized ? await operationRead(req) : denied("permission-denied"));
+            case "proposal-read": return out(authorized ? await proposalRead(req) : denied("permission-denied"));
+            default: return out(denied("unsupported"));
+        }
+    }
+    return Object.freeze({
+        space, accountPublicKey,
+        register: (raw) => tracked(register(raw)),
+        handle: (raw) => tracked(handle(raw)),
+        serviceState: (owner, endpoint, instanceId) => tracked(serviceState(owner, endpoint, instanceId)),
+        serve: (request) => tracked(serve(request)),
+        serveStatus: (query) => tracked(serveStatus(query)),
+        serviceBinding: (witness) => tracked(serviceBinding(witness)),
+        refuse() { closed = true; },
+        async close() {
+            closed = true;
+            while (entered.size > 0)
+                await Promise.allSettled([...entered]);
+        },
+        trip(reason) {
+            if (tripped === undefined)
+                tripped = reason;
+            discovery.trip(tripped);
+            for (const t of live)
+                t(tripped);
+        },
+    });
+}
+//# sourceMappingURL=service-host-ops.js.map