@dvmkit/sdk 0.1.2-rc.7 → 0.1.3-rc.7

package/dist/{credit-menu-BM4qCD5U.d.ts → credit-menu-C7zAJElJ.d.ts}

@@ -1,35 +1,15 @@
 import { Hono, Context } from 'hono';
 import { Pool } from 'pg';
-import { X as JsonValue, bR as CreditLedgerLike, b_ as CreditInvoiceRecord, d3 as CreditDepositEnqueue, b$ as InvoiceSettlement, Z as ZodLike, a as DVMDescriptor, K as KVStore, o as JobStore, ah as CashuMode, at as MppxServer, aa as X402Config, p as PaymentMethod, cu as ClientCompatibilityGate, a2 as Message, ap as FundingMethod, Y as FundingReceipt, bT as CreditSnapshot, d4 as TopUpCapUnenforcedReason, _ as JobReceipt, cn as AppendOutgoingOptions, S as SDKJobContext, aQ as StepCache, v as ResponseContent, P as PaymentContent, J as JobRecord, a3 as MessageType, ac as X402Receipt, ab as X402ExactVersionSupport, d5 as X402SettlementIntent, aE as PaymentRequirementsV2, c6 as CreditLedgerQuerier, d6 as X402SettlementCursor, bV as X402SettlementStatus, d7 as X402SettlementWriteOff, bS as X402RefundSettlementGate, d8 as X402FacilitatorAuth, d9 as X402BatchSettlementConfig, cK as PostgresX402ChannelStorage, da as X402PayoutObserver, db as X402SettlementReconciliationReason, aC as PaymentRequirements, a1 as MppxCredential, aj as CreditDepositPayload, bU as DrawResult, cA as CreditLedgerError, a7 as ReceiptCredit, al as DrainReceiptEvent, ak as DrainReceipt, z as SignedRequestAudience, dc as CreditDrawReleaseEnqueue, cM as RevenueSkippedNoRailPayload, cs as ClientCompatibility, aF as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './job-store-C53VQ5uu.js';
-import { F as FxFetcher, b as FxRateSnapshot } from './fx-C-liI3oY.js';
+import { a0 as Message, ag as FundingMethod, W as FundingReceipt, bN as CreditSnapshot, X as JobReceipt, S as SDKJobContext, av as StepCache, u as ResponseContent, P as PaymentContent, a1 as MessageType, bi as X402Receipt, aD as X402Config, bh as X402ExactVersionSupport, cQ as X402SettlementIntent, ap as PaymentRequirementsV2, c0 as CreditLedgerQuerier, cR as X402SettlementCursor, bP as X402SettlementStatus, cS as X402SettlementWriteOff, bM as X402RefundSettlementGate, cT as X402FacilitatorAuth, cU as X402BatchSettlementConfig, cw as PostgresX402ChannelStorage, cV as X402PayoutObserver, bq as MppxServer, aa as CashuMode, bL as CreditLedgerLike, cW as CreditDepositEnqueue, cX as X402SettlementReconciliationReason, an as PaymentRequirements, $ as MppxCredential, o as PaymentMethod, bl as CreditDepositPayload, bO as DrawResult, cm as CreditLedgerError, a5 as ReceiptCredit, ad as DrainReceiptEvent, ac as DrainReceipt, K as KVStore, y as SignedRequestAudience, cY as CreditDrawReleaseEnqueue, cy as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bU as CreditInvoiceRecord, bV as InvoiceSettlement, cg as ClientCompatibilityGate, ce as ClientCompatibility, bt as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-3cT4Shk0.js';
+import { b as FxRateSnapshot, F as FxFetcher } from './fx-BF_SG2i0.js';
+import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-C04nH94l.js';
+import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-Bn23V3QU.js';
 import { ProofLike, SerializedDLEQ } from '@cashu/cashu-ts';
 import { Challenge } from 'mppx';
 import { SettleResponse, SupportedResponse } from '@x402/core/types';
 import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server';
 import { FacilitatorClient } from '@x402/core/server';
 
-declare const lockPubkeyBrand: unique symbol;
-/**
- * NUT-11 P2PK lock pubkey, lowercase-by-construction. Hex-encoded compressed
- * secp256k1 pubkey (66 chars starting with `02` / `03`), normalised via
- * `toLockPubkey`. The brand exists so any in-memory site that compares
- * lock-pubkeys against each other — receive matching, monitor orphan/retired
- * lookups, melt-pending keypair maps — gets a compile-time guarantee that
- * both sides have been normalised. Raw strings off the wire or out of the DB
- * must pass through `toLockPubkey` before they're treated as one.
- */
-type LockPubkey = string & {
-    readonly [lockPubkeyBrand]: never;
-};
-/**
- * Brand a raw lock-pubkey string. Trims surrounding whitespace and lowercases
- * the hex so equality is structural. Idempotent on values that are already
- * lowercase. Does not validate the curve point — assertions about hex shape
- * live at the wire-validation layer (e.g. the `/admin/cashu/rotate-lock-pubkey`
- * regex in `admin-cashu.ts`).
- */
-declare function toLockPubkey(raw: string): LockPubkey;
-
 /** A row in the per-DVM `wallet_accumulator` table (internal-review). */
 interface WalletAccumulatorRow {
     id: string;
@@ -50,11 +30,10 @@ interface WalletAccumulatorRow {
     meltedAt: number | null;
     meltStatus: "melted" | "failed" | "drained" | null;
     /**
-     * Mint-issued melt-quote id captured at claim time so a crashed-mid-melt
-     * row can be auto-resolved on next scheduler boot via the mint's
-     * `checkMeltQuoteBolt11` endpoint (internal-review). Null on rows from before the
-     * column existed, or rows that crashed mid-melt before the quote id was
-     * persisted — those fall through to the manual-`UPDATE` hint path.
+     * Mint-issued melt-quote id recorded by the admin `mark-melted` endpoint
+     * alongside the payment preimage after an external payout completes. Null
+     * until payout audit data is recorded, including on pending rows and legacy
+     * rows created before the column existed.
      */
     meltQuoteId: string | null;
     /**
@@ -66,8 +45,8 @@ interface WalletAccumulatorRow {
 }
 /**
  * Subset of `pg.Pool` the store uses for queries. `Pool` and `PoolClient`
- * both satisfy this — important so the scheduler can run reads on a single
- * client that holds the advisory lock.
+ * both satisfy this — important so the accumulator monitor can run reads on a
+ * single client that holds the advisory lock.
  */
 interface AccumulatorQuerier {
     query: Pool["query"];
@@ -131,348 +110,6 @@ declare function clearAccumulatorForDvm(db: AccumulatorQuerier, dvmId: string):
  */
 declare function hashLockKey(input: string): bigint;
 
-/**
- * Canonical deploy-time attestation payload (internal-review). One signature serves
- * both auth-on-deploy and the `/v1/info#builder` attestation — the bytes the
- * builder signs are the canonical JSON of this object. Making a field required
- * also requires the coordinated fleet-before-caller release note in
- * `public compatibility guide`.
- */
-interface AttestationPayload {
-    /** Immutable platform or self-hosted DVM identifier this attestation applies to. */
-    dvm_id: string;
-    /** DVM slug the attestation applies to (must match the deploy request's slug). */
-    slug: string;
-    /** sha256(`canonicaliseForSigning(capabilities)`) hex. Binds the attestation
-     *  to the capability shape declared at deploy time. */
-    capabilities_hash: string;
-    /** Builder identity x-only secp256k1 pubkey, hex (32 bytes / 64 chars). */
-    builder_pubkey: string;
-    /**
-     * Per-DVM receipt-signing x-only pubkey, hex (internal-review). Binds the key the
-     * deployed DVM signs job receipts with to the cold builder identity: the
-     * builder signs this payload, so a receipt verifying under
-     * `receipt_pubkey` inherits the builder's authority.
-     *
-     * Optional: attestations signed before receipts shipped omit it and still
-     * verify byte-for-byte (canonical JSON drops absent keys), and deploy paths
-     * that can't provision the matching secret leave it unset rather than
-     * attesting a key the running process doesn't hold.
-     */
-    receipt_pubkey?: string;
-    /** Unix seconds at which the attestation was signed. */
-    deployed_at: number;
-}
-/** Result of {@link generateIdentity}: hex pubkey + hex secret. */
-interface BuilderIdentityKeypair {
-    /** secp256k1 BIP-340 x-only pubkey, 32 bytes hex (64 chars). */
-    pubkey: string;
-    /** secp256k1 secret, 32 bytes hex (64 chars). */
-    secret: string;
-}
-/** Generate a fresh BIP-340 Schnorr keypair for builder identity. */
-declare function generateIdentity(): BuilderIdentityKeypair;
-/**
- * Read the builder identity secret from `~/.dvmkit/builder.key`. Returns
- * `null` when absent so callers can surface an `identity_required` error.
- *
- * `writeIdentity` persists the key `0o600`, but a destination mode survives
- * `cp`/`scp`/git-checkout intact only by luck — those can land it `0o644`,
- * leaving the signing key world-readable on a multi-user box. On POSIX we
- * detect loose group/other bits, warn, and best-effort re-tighten to `0o600`
- * (same self-heal posture as `writeIdentity`) rather than throw — a hard
- * failure would brick a CLI whose key got widened in transit.
- */
-declare function loadIdentitySecret(): string | null;
-/**
- * Persist a builder identity keypair: pubkey into `~/.dvmkit/builder.json`
- * (top-level), secret into `~/.dvmkit/builder.key` (mode 0600 on POSIX).
- * Atomic tmp+rename on the secret file so a crash mid-write never leaves a
- * truncated key on disk — a torn write here is unrecoverable; the operator
- * loses the ability to re-sign attestations for every DVM under this key.
- *
- * Refuses to overwrite when an identity already exists unless `force` is
- * passed; the force path warns that any DVMs deployed under the old key
- * need to be re-deployed to refresh their attestations.
- */
-declare function writeIdentity(keypair: BuilderIdentityKeypair, opts?: {
-    force?: boolean;
-}): void;
-/**
- * Compute the canonical `capabilities_hash` (sha256-hex of canonical JSON)
- * for the supplied capabilities block. Shared between the CLI signer and any
- * future verifier so both compute identical bytes.
- */
-declare function hashCapabilities(capabilities: JsonValue): string;
-/**
- * Assemble the deploy-time attestation payload (internal-review). `deployedAt`
- * defaults to the current Unix second; tests can pin it for reproducibility.
- */
-declare function buildAttestation(args: {
-    dvmId: string;
-    slug: string;
-    capabilities: JsonValue;
-    builderPubkey: string;
-    /** Receipt-signing pubkey to attest (internal-review). Omitted when the deploy path
-     *  can't provision the matching `DVMKIT_RECEIPT_KEY`. */
-    receiptPubkey?: string;
-    deployedAt?: number;
-}): AttestationPayload;
-/**
- * Sign an attestation payload with the builder identity secret. Returns the
- * 64-byte Schnorr signature as hex. The canonical bytes are produced via the
- * same `canonicaliseForSigning` the verifier uses — both sides hash identical
- * input regardless of object key order.
- */
-declare function signAttestation(payload: AttestationPayload, secretHex: string): string;
-/**
- * Verify a deploy-time attestation. Returns `true` iff the signature is a
- * valid BIP-340 Schnorr signature of `canonicaliseForSigning(payload)` under
- * `pubkeyHex`. Independent of the platform binding — callers (the deploy
- * route, `/v1/info` clients) cross-check the pubkey against their trust root.
- */
-declare function verifyAttestation(payload: AttestationPayload, signatureHex: string, pubkeyHex: string): boolean;
-
-/**
- * Per-method amount limits a mint advertises on its NUT-4 / NUT-5 bolt11/sat
- * entry (internal-review). Both values are in the method's own unit — `sat` here,
- * never msats.
- *
- * `null` means the mint advertised nothing in that direction, which reads as
- * unbounded. A mint saying nothing is not a mint saying zero, so silence never
- * narrows what we'll attempt — same defensive posture as the absent-`disabled`
- * rule in {@link canMintBolt11Sat}.
- */
-interface MintAmountBounds {
-    /** Smallest amount the mint will quote, or `null` when unadvertised. */
-    minSats: number | null;
-    /** Largest amount the mint will quote, or `null` when unadvertised. */
-    maxSats: number | null;
-}
-/** Error categories returned when a mint health probe fails. */
-type HealthErrorCode = "timeout" | "http_error" | "network" | "parse_error" | "missing_fields";
-/** Outcome of a single health probe against one mint. */
-interface MintHealthCheckResult {
-    /** Mint URL exactly as passed in (not normalised). */
-    mintUrl: string;
-    /** True iff `/v1/info` returned 200, parsed as JSON, and had `pubkey` + `version`. */
-    ok: boolean;
-    /** Wall-clock duration of the successful (or final failed) attempt in ms. */
-    latencyMs: number;
-    /** NUT-06 mint pubkey when present. */
-    pubkey?: string;
-    /** NUT-06 mint version string (e.g. "Nutshell/0.20.0") when present. */
-    version?: string;
-    /** Sorted list of NUT keys the mint declares support for. */
-    supportedNuts?: string[];
-    /** Subset of `DEFAULT_REQUIRED_NUTS` the mint does not declare. Empty array when fully supported. */
-    missingRequiredNuts?: string[];
-    /** True when the mint advertises NUT-04 with method `bolt11` and unit `sat`. */
-    bolt11SatMintSupported?: boolean;
-    /** True when the mint advertises NUT-05 with method `bolt11` and unit `sat`. */
-    bolt11SatMeltSupported?: boolean;
-    /**
-     * True when the mint can currently *issue* — NUT-04 advertises bolt11/sat and
-     * is not switched off (`disabled: true`). Distinct from
-     * {@link bolt11SatMintSupported}, which only asks whether the method exists:
-     * a mint in melt-only recovery keeps advertising the method and turns the
-     * flag on. Consulted when picking a funding default (internal-review).
-     */
-    mintingEnabled?: boolean;
-    /** Same question for NUT-05 (melt) — whether the mint can currently pay out. */
-    meltingEnabled?: boolean;
-    /**
-     * True when the mint can currently serve `/v1/swap` — see {@link canSwap} for
-     * why an unadvertised NUT-3 reads as `true`. This is what a per-call spend
-     * needs, so a `false` here is the reason a spend routes around this mint
-     * (internal-review).
-     */
-    swapEnabled?: boolean;
-    /**
-     * Amount limits the mint advertises for issuing (NUT-04 bolt11/sat), in sats
-     * (internal-review). Consulted when picking a funding default and when refusing an
-     * amount locally, so a fund outside the range never opens a Lightning quote.
-     */
-    mintAmountBounds?: MintAmountBounds;
-    /** The NUT-05 twin — limits on a single payout, which `dvm wallet cash-out` sizes against. */
-    meltAmountBounds?: MintAmountBounds;
-    /**
-     * True when the mint passes the full {@link assertNutSupport} gate — every
-     * required NUT present (not `supported: false`) and bolt11/sat on NUT-4 +
-     * NUT-5. The runtime `MintHealthTracker` treats a mint as healthy only when
-     * this is true, reproducing the boot-time NUT gate post-`listen` (internal-review).
-     */
-    nutCompliant?: boolean;
-    /** Raw `nuts` object from the `/v1/info` response. Used by `assertNutSupport`. */
-    nutsRaw?: Record<string, unknown>;
-    /** Populated when `ok` is false. */
-    error?: {
-        code: HealthErrorCode;
-        message: string;
-    };
-}
-/** Tunables for `checkMintHealth`. */
-interface CheckMintHealthOptions {
-    /** Per-attempt timeout in ms. Default: 5000. */
-    timeoutMs?: number;
-    /** Total attempts including the first. Default: 3. */
-    retries?: number;
-    /** Inter-attempt backoff schedule in ms. Default: [200, 500, 1000]. */
-    backoffMs?: number[];
-    /** Injected `fetch` for tests. Default: global fetch. */
-    fetchImpl?: typeof fetch;
-}
-/**
- * Probe a Cashu mint's `/v1/info` endpoint with timeout + retries, and
- * report whether it serves the NUT-04 + NUT-05 capabilities first-party DVMs
- * depend on. Never throws — failures are returned as `{ ok: false, error }`.
- */
-declare function checkMintHealth(mintUrl: string, opts?: CheckMintHealthOptions): Promise<MintHealthCheckResult>;
-/**
- * Whether the mint can currently serve `/v1/swap` — the operation every
- * per-call Cashu payment depends on (internal-review).
- *
- * **An absent NUT-3 means yes.** Swap is a baseline mint operation and healthy
- * mints do not enumerate it — neither coinos nor lnvoltz advertises a `"3"` key
- * (see `public design rationale`).
- * Reading silence as "incapable" would rule out every working mint.
- *
- * A mint that has *switched swaps off* does say so: a mint in melt-only
- * recovery publishes a `"3"` entry flagged `disabled` / `supported: false`
- * alongside its live NUT-5. Both spellings are honoured because this is the
- * only signal distinguishing "can't swap" from "swap failed for some other
- * reason", and it costs nothing to accept either.
- *
- * Never a boot-time gate — like {@link canMintBolt11Sat}, this informs mint
- * *selection* only, so a mint that can still melt stays loadable for cash-out.
- */
-declare function canSwap(nuts: Record<string, unknown>): boolean;
-/** Whether `sats` falls inside a mint's advertised limits, and which end it broke. */
-type AmountBoundsVerdict = "ok" | "below_min" | "above_max";
-/**
- * Judge one amount against one direction's limits. The single predicate both
- * `dvm wallet fund` (mint selection, pre-quote refusal) and
- * `dvm wallet cash-out` (per-leg sizing) ask, so the two commands can't drift
- * on what "out of range" means.
- */
-declare function amountBoundsVerdict(sats: number, bounds?: MintAmountBounds): AmountBoundsVerdict;
-/**
- * Assert that a mint's NUT-06 `nuts` object advertises all required capabilities.
- * Two-phase check:
- *   1. Dict-level — each NUT in `requiredNuts` must be present and not have
- *      `supported: false`. Throws naming the missing NUT numbers and mint URL.
- *   2. Method-level — NUT-4 and NUT-5 must each advertise a `bolt11`/`sat`
- *      entry in their `methods` array (covers NUT-23). Throws naming the
- *      missing method.
- */
-declare function assertNutSupport(mintUrl: string, nuts: Record<string, unknown>, requiredNuts?: readonly number[]): void;
-
-/** A Lightning invoice created by the backend. */
-interface CreatedInvoice {
-    /** BOLT11 payment request string. */
-    bolt11: string;
-    /** Payment hash (hex) — primary key for looking up settlement. */
-    paymentHash: string;
-    /** Amount in millisatoshis. */
-    amountMsats: number;
-    /** Unix milliseconds when the invoice expires. */
-    expiresAt: number;
-}
-/** Result of looking up an invoice's settlement status. */
-interface InvoiceStatus {
-    /** True once the invoice has been paid and preimage is known. */
-    settled: boolean;
-    /** Preimage (hex) — present only after settlement. */
-    preimage?: string;
-    /** Unix milliseconds when the invoice settled (if settled). */
-    settledAt?: number;
-    /** Unix milliseconds when the invoice expires. */
-    expiresAt?: number;
-}
-/** How a payment reached a settled state — see `payInvoiceReconciling`. */
-type LightningPayOutcome = "paid" | "reconciled" | "republished";
-/** Settled payment plus the audit trail of how it got there. */
-interface LightningPayment {
-    /** Payment preimage (hex) — proof the invoice was paid. */
-    preimage: string;
-    /** Routing fee reported by the wallet, in millisatoshis. Absent means unknown. */
-    feesPaidMsats?: number;
-    /** Whether the wallet answered directly, or the outcome had to be reconciled. */
-    outcome: LightningPayOutcome;
-}
-/** Bounds for a read-only wallet transaction snapshot. */
-interface LightningTransactionListOptions {
-    /** Include transactions created at or after this Unix timestamp (seconds). */
-    from?: number;
-    /** Maximum number of transactions the wallet may return. */
-    limit?: number;
-}
-/**
- * Credential-safe transaction evidence used to account for a wallet debit.
- *
- * Invoice, payment hash and preimage are deliberately replaced by digests or
- * omitted. `fingerprint` identifies the complete reduced row; `invoiceHash`
- * lets a caller bind an outgoing row to the invoice it just paid.
- */
-interface LightningTransactionSnapshot {
-    fingerprint: string;
-    invoiceHash?: string;
-    type: "incoming" | "outgoing";
-    amountMsats: number;
-    /** Wallet-reported routing fee. Absent when the wallet omitted it. */
-    feesPaidMsats?: number;
-    createdAt: number;
-    settledAt?: number;
-}
-/** What a backend can tell us about the wallet behind it. */
-interface LightningWalletInfo {
-    /** Human-readable wallet name (e.g. "Alby Hub"). */
-    alias?: string;
-    /** Operations the wallet supports (e.g. `pay_invoice`, `lookup_invoice`). */
-    methods: string[];
-    /**
-     * Budget fields the wallet volunteered, if any.
-     *
-     * No rail behind this interface is required to expose a connection's
-     * spending cap, and NWC — today's only implementation — has no method that
-     * returns one. Present it when a wallet offers it, never infer it.
-     */
-    walletReportedBudget?: Record<string, unknown>;
-}
-/** Abstraction over Lightning wallet backends (NWC, future). */
-interface LightningBackend {
-    /**
-     * Pay a bolt11 invoice exactly once. Returns the preimage on success.
-     *
-     * Implementations must never re-send a payment on an unknown outcome without
-     * first reconciling against the wallet — the rails behind this interface have
-     * no idempotency key, so a blind retry is a second payment.
-     *
-     * `amountMsats` is passed when known (callers always have it from the
-     * provider's payment-request). Backends that don't need it may ignore the
-     * param.
-     */
-    payInvoice(bolt11: string, amountMsats?: number): Promise<LightningPayment>;
-    /** Get wallet balance in millisatoshis. */
-    getBalance(): Promise<number>;
-    /** Get wallet info (name, supported methods, any volunteered budget fields). */
-    getInfo(): Promise<LightningWalletInfo>;
-    /** Create a new incoming invoice for the given amount and description. */
-    createInvoice(params: {
-        amountMsats: number;
-        description?: string;
-        expirySeconds?: number;
-    }): Promise<CreatedInvoice>;
-    /** Look up an invoice's settlement status by payment hash. */
-    lookupInvoice(paymentHash: string): Promise<InvoiceStatus>;
-    /**
-     * Return a bounded, credential-safe transaction snapshot when supported.
-     * Optional so existing backends remain source-compatible; without it an
-     * exact total wallet debit cannot be attributed.
-     */
-    listTransactions?(options: LightningTransactionListOptions): Promise<LightningTransactionSnapshot[]>;
-}
-
 /**
  * Tracks MPP challenge ids that have already been consumed by an upfront-flow
  * request, scoped per-DVM realm. Entries auto-expire after a TTL and the store
@@ -525,230 +162,229 @@ interface CreditExpirySweepOpts {
     limit?: number;
 }
 
-/** Cached liveness signal for a platform-hosted DVM's Lightning receive rail. */
-interface LightningRailHealth {
-    /** Whether the receive rail may be advertised at this instant. */
-    available(): boolean;
-    /** Prime the cached signal at boot when the source supports it. */
-    refresh?(): Promise<void>;
+/** Promise resolver for a pending client prompt response. */
+interface PromptResolver {
+    resolve: (value: ResponseContent) => void;
+    reject: (reason: Error) => void;
 }
-
-/** Builder-facing wiring for the Lightning receive leg (internal-review). */
-interface LightningReceiveConfig {
+/** Promise resolver for a pending client payment. */
+interface PaymentResolver {
+    resolve: (value: PaymentContent) => void;
+    reject: (reason: Error) => void;
+}
+/** In-memory representation of a running job. */
+interface ServerJob {
+    id: string;
+    tags: string[];
     /**
-     * Receive-only NWC connection URI (`DVMKIT_NWC_RECEIVE_URI`). Validated at
-     * boot: a connection that can *spend* is refused outright.
+     * Capability name this job belongs to (internal-review). Set at submission from
+     * `POST /v1/job` body's `capability` field; routes the SDK runtime to the
+     * right `onJob` / `onResponse` / `onPayment` handler and the right input
+     * schema. Required — the wire layer rejects requests that omit it.
      */
-    uri?: string;
+    capability: string;
+    input: string;
+    params: Record<string, string>;
+    requesterId: string;
     /**
-     * Pre-built backend, bypassing URI parsing and the connect-time probe. Test
-     * seam only — production always goes through `uri` so the receive-only
-     * property is actually checked.
+     * SHA-256 hex of the per-job opaque `job_token` minted at creation for
+     * anonymous callers (internal-review). Mirror of `JobRecord.requesterTokenHash`;
+     * see that field for the wire-level gating semantics.
      */
-    backend?: LightningBackend;
-    /** Invoice lifetime in seconds. Defaults to {@link DEFAULT_INVOICE_TTL_SECONDS}. */
-    invoiceTtlSeconds?: number;
+    requesterTokenHash?: string;
     /**
-     * Smallest funding this deployment can receive over Lightning, in sats
-     * (`DVMKIT_LIGHTNING_FUNDING_MIN_SATS`). The floor is a property of the
-     * receive wallet's channel policy (`htlc_minimum_msat` upstream), so it is
-     * per-deployment and sats-physical — the menu renders it into fiat with a
-     * margin, but everything that *enforces* it compares raw sats. Defaults to
-     * {@link DEFAULT_LIGHTNING_FUNDING_MIN_SATS}.
+     * Submission provenance (internal-review) — mirrors `JobRecord.requesterToken` /
+     * `requestFingerprint` / `requesterPubkey`. Carried on the job purely so
+     * `toJobRecord` persists it; nothing in the runtime reads it. It's the
+     * replay gate: a retried paid submit that reproduces the fingerprint (and,
+     * on a signed DVM, the pubkey) is handed this token back.
      */
-    fundingMinSats?: number;
+    requesterToken?: string;
+    requestFingerprint?: string;
+    requesterPubkey?: string;
+    requestId?: string;
+    /** HTTP path independently recorded when the caller proof was accepted. */
+    authRequestPath?: string;
+    status: "processing" | "completed" | "failed" | "awaiting-input" | "cancelled" | "working";
+    summary?: string;
+    messages: Message[];
+    seq: number;
+    paidMsats: number;
+    paymentMint?: string;
+    /** Rail of the most recent successful credit. Set on each credit branch in payment processing. */
+    paymentRail?: FundingMethod;
     /**
-     * Optional platform-derived channel-liveness gate. Platform-hosted DVMs use
-     * it alongside their NWC reachability probe; self-hosted DVMs omit it.
+     * Settlement reference for the most-recent successful credit. Threaded
+     * into `onJobCompleted` so the platform revenue ledger can populate
+     * `revenue_events.tx_hash`. mpp/x402 carry the credential's `challenge.id`
+     * / EVM tx hash from the facilitator (internal-review); cashu accumulator carries
+     * the `X-Cashu-Request-Id` UUID (internal-review). Updated on every credit
+     * (upfront or mid-job via `processIncomingPayment`) — internal-review.
+     * Single-row-per-job accounting keeps the most recent credit's hash,
+     * mirroring `paymentRail`.
      */
-    railHealth?: LightningRailHealth;
-}
-/** Default bolt11 lifetime — long enough to pay by hand, short enough to retire. */
-declare const DEFAULT_INVOICE_TTL_SECONDS = 900;
-/**
- * Floor on the invoice lifetime: twice the signed-request drift window, so the
- * bolt11 always outlives the funding negotiation that produced it (the issue's
- * "invoice expiry ≥ the funding-negotiation window"). A shorter one would
- * expire inside the caller's own retry budget and strand them mid-top-up.
- */
-declare const MIN_INVOICE_TTL_SECONDS = 600;
-/**
- * The builder-side Lightning receive leg (internal-review, credits spec §4).
- *
- * Issues a bolt11 over a **receive-only** NWC connection while the DVM is
- * awake serving the 402, and credits the ledger when a later request observes
- * settlement. Two properties are load-bearing:
- *
- * - **It never holds a send credential.** `pay_invoice` on this connection is
- *   refused at construction, so a compromised DVM can mint invoices and
- *   nothing else. The drain/refund sender (internal-review) is a separate, budgeted
- *   connection by rule.
- * - **Crediting is pull-based — there is no settlement watcher.** The caller's
- *   next request drives `lookup_invoice`, which is what makes this work on a
- *   suspend-to-zero fleet: a machine that is asleep has nothing to miss.
- *   Wallet downtime at that moment delays crediting; it never loses money,
- *   because the invoice→credit binding is a durable row.
- *
- * Reachability is **cached**, never probed per request: the funding menu is
- * assembled on every quote and every 402, so a live NIP-47 round trip there
- * would put a nostr relay in the latency path of every priced call.
- */
-declare class LightningReceive {
-    private readonly source;
-    readonly invoiceTtlSeconds: number;
-    readonly fundingMinSats: number;
-    private health;
-    private checkedAtMs;
-    private refreshing;
-    private permissionRefusal;
-    private constructor();
-    private readonly railHealth;
+    paymentTxHash?: string;
+    /** Chain transaction returned to callers recovering x402 or Tempo acceptance. */
+    paymentTransactionHash?: string;
     /**
-     * Validate the configured connection and build the receive leg, or return
-     * `undefined` when this DVM didn't configure one.
-     *
-     * **Throws on a credential that is wrong, degrades on one that is merely
-     * unreachable.** A wallet outage at boot must not stop a DVM whose other
-     * rails are fine — the menu simply omits `lightning` until a later probe
-     * succeeds. A connection that can spend, or one that can't state what it can
-     * do, is a different thing entirely: it is a standing money risk that no
-     * amount of retrying fixes, so it fails the boot loudly with the fix in the
-     * message.
+     * Rail-native amount accumulated across all successful credits on this
+     * job (sats for mpp, USDC microunits for x402). The single
+     * `revenue_events` row written at completion uses this as `gross_native`,
+     * so multi-credit jobs sum the per-credit native amounts (internal-review).
+     * internal-review wired the upfront credit; mid-job credits accumulate same-rail
+     * and reset on a cross-rail switch (see `processIncomingPayment`).
      */
-    static create(config: LightningReceiveConfig): Promise<LightningReceive | undefined>;
+    nativeAmount?: number;
+    /** Native asset tag — paired with `nativeAmount`. internal-review. */
+    nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
+    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow` (internal-review). */
+    cashuFlow?: "p2pk_accumulator";
+    /** Credit the upfront payment funded/drew (internal-review). See `JobRecord.creditId`. */
+    creditId?: string;
+    /** The draw placed for this job on `creditId` (internal-review). */
+    drawId?: string;
+    /** Original funding artifact returned by an explicit fund-and-draw. */
+    fundingReceipt?: FundingReceipt;
+    fundingCredit?: CreditSnapshot;
+    receivedProofs: ProofLike[];
+    pendingPaymentMsats?: number;
     /**
-     * Whether `lightning` belongs on the funding menu right now.
-     *
-     * Reads the cached observation and never blocks; a stale one kicks off a
-     * background refresh and answers with what we last knew. Advertising a rail
-     * whose wallet is down would hand the caller an option that 402s on use —
-     * the §4 posture is to drop it and let the sale survive on the others.
+     * Per-job binding for MPP credentials. Contains the `challenge.id` of every
+     * mppx challenge issued in the most-recent `requestPayment` yield. mppx HMAC
+     * binds challenges to realm/method/amount/expiry, not to the dvmkit job-id;
+     * verifying the incoming credential's `challenge.id` is in this set blocks
+     * a credential lifted from a sibling job that requested the same fields.
+     * Cleared on successful credit (internal-review).
      */
-    available(): boolean;
+    pendingMppChallengeIds?: string[];
     /**
-     * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
-     *
-     * The invoice is minted **for** the credit and amount named in the caller's
-     * signed body — that binding is the internal-review condition-3 commitment on this
-     * rail, and it is why no artifact hash rides the request: there is no
-     * caller-supplied artifact to hash. A re-poll returns the stored row rather
-     * than minting again; a second bolt11 for one `fund_id` would leave two
-     * payable invoices against a funding that can only be credited once.
-     */
-    issue(ledger: CreditLedgerLike, args: {
-        creditId: string;
-        fundId: string;
-        callerPubkey: string;
-        currency: string;
-        amountMicro: number;
-        amountMsats: number;
-        description?: string;
-    }): Promise<CreditInvoiceRecord>;
+     * Per-job binding for x402 mid-job credentials (internal-review). 32-byte 0x-hex
+     * nonce issued by `requestPayment` and stamped onto the outbound x402
+     * envelope; the caller signs `TransferWithAuthorization` against this exact
+     * `bytes32`. Verification rejects an incoming `x402_payment` whose decoded
+     * authorization nonce differs, blocking a cross-job replay before the
+     * facilitator settles. Cleared on successful credit.
+     */
+    pendingX402Nonce?: string;
     /**
-     * Ask the wallet whether one payment hash is paid, and when (internal-review).
-     *
-     * The operator's reconcile verb runs this before it credits anything. A
-     * `blocked` row implies payment — {@link applyOne} returns above the block
-     * classification when the lookup says unpaid — but that is *this fleet's
-     * belief, recorded possibly weeks ago*, and the verb it gates mints balance
-     * against it. One round trip turns the belief into a fact and recovers the
-     * true settlement instant for `settled_at`, which a blocked row never got to
-     * write.
-     *
-     * Unlike {@link settlePending} this **throws**: there is no request whose
-     * latency it protects, and crediting on an unverifiable wallet is exactly
-     * what it exists to prevent. `NOT_FOUND` is the one exception, and it is not
-     * an outage — it is the wallet saying it has never seen this hash, the same
-     * reading {@link applyOne} and the caller-side reconcile in `src/lib/nwc.ts`
-     * take. It comes back as `known: false` because the operator's repair for it
-     * ("you are pointed at a different wallet than the one that minted this")
-     * is not the repair for an unpaid invoice, and certainly not for a retry.
+     * Exact USDC microunit amount paired with `pendingX402Nonce`. Kept as a
+     * decimal string so the EIP-3009 uint256 value remains lossless.
      */
-    lookupSettlement(paymentHash: string): Promise<{
-        settled: boolean;
-        settledAt?: number;
-        known: boolean;
-    }>;
+    pendingX402AmountUsdcMicro?: string;
     /**
-     * Consult the wallet about this caller's outstanding invoices and credit the
-     * ones that settled — the pull half of pull-based crediting.
-     *
-     * The pending rows are read locally first, so the common case (nothing
-     * outstanding) costs one indexed SELECT and no network at all. Bounded to
-     * {@link MAX_SETTLE_CHECKS} invoices on a short deadline, and **never throws
-     * into the request**: a wallet failure here means the caller's balance is
-     * merely not updated yet, which the ordinary `insufficient_credit` path
-     * already states honestly.
-     *
-     * **Each invoice gets its own failure boundary.** The sweep window is a few
-     * rows wide, so a row that fails on its own terms — a `fund_id` the caller
-     * reused on another rail, a credit someone else opened first — must not take
-     * the rest of the pass down with it: the next invoice in the window may be
-     * the paid one, and it would never be looked up. Only a transport failure
-     * ends the pass early, because there the wallet itself is gone and the
-     * remaining lookups would just spend the caller's latency confirming it.
+     * Fiat micro-units the outstanding `requestPayment` ask is worth, pinned when
+     * the payment-request was emitted (internal-review). See `JobRecord`.
      */
-    settlePending(ledger: CreditLedgerLike, args: {
-        callerPubkey: string;
-        creditId?: string;
-        creditTtlMs: number;
-        dvmId?: string;
-        enqueueCreditDeposit?: CreditDepositEnqueue;
-        nowMs?: number;
-    }): Promise<InvoiceSettlement[]>;
+    pendingPaymentFiatMicro?: number;
+    /** Currency of {@link pendingPaymentFiatMicro} (lowercase ISO-4217). */
+    pendingPaymentFiatCurrency?: string;
     /**
-     * One invoice's settlement check. Returns the applied settlement, or
-     * `undefined` when nothing changed (still unpaid, or retired unpaid).
-     *
-     * Throws whatever the wallet or the ledger threw — classifying that is
-     * {@link retireOrLog}'s job, so this stays one invoice's happy path.
+     * Cumulative fiat micro this job has asked for mid-job, the ceiling on its
+     * draw growth (internal-review). See `JobRecord.askedTopUpMicro` for the sentinel.
      */
-    private applyOne;
+    askedTopUpMicro?: number;
     /**
-     * Decide what one invoice's failure means, and retire the invoice when the
-     * answer is "this can never succeed".
-     *
-     * The split that matters is permanent-versus-transient, because it decides
-     * whether the row keeps a slot in the sweep window. A transient failure — the
-     * database blinked, the wallet answered oddly — leaves it `pending` and the
-     * caller's next request retries it. A **permanent** one means the ledger will
-     * refuse this invoice identically forever, so leaving it pending costs a
-     * `lookup_invoice` on every subsequent request and, at
-     * {@link MAX_SETTLE_CHECKS} of them, fills the window so a genuinely payable
-     * invoice behind them is never even looked up. Those get `blocked`, which
-     * drops them out of the sweep and hands the operator the payment hash.
+     * Currency of {@link askedTopUpMicro} — and this job's sticky ask
+     * denomination (internal-review). See `JobRecord.askedTopUpCurrency`.
      */
-    private retireOrLog;
+    askedTopUpCurrency?: string;
     /**
-     * The reason this invoice can never be credited, or `undefined` if the
-     * failure was transient.
-     *
-     * Every code here is decided by state a retry cannot move — a row the ledger
-     * has already committed (a `credit_fundings` entry at this
-     * `(credit_id, fund_id)`, or a `credits` row whose owner, denomination or
-     * rail disagrees with the invoice), or the basis this module rebuilds
-     * identically from the invoice row on every pass. None of them is a race.
+     * Why this job's draw growth is not capped, when it isn't (internal-review). Mirror
+     * of `JobRecord.topUpCapUnenforcedReason`.
+     */
+    topUpCapUnenforcedReason?: TopUpCapUnenforcedReason;
+    /** Price the job was charged at (msats). Used to detect overpayment for change/melt gating. */
+    requiredMsats?: number;
+    /**
+     * The signed receipt for this job's terminal outcome (internal-review). Mirror of
+     * `JobRecord.receipt`, set once the terminal funnel has signed and persisted
+     * it so the local read paths (which serve from `activeJobs` during the
+     * cleanup window) hand back the same bytes as a cross-machine re-read.
+     */
+    receipt?: JobReceipt;
+    /**
+     * The in-flight terminal chain — persist, then sign + store the receipt
+     * (internal-review). Assigned synchronously by `ctx.complete()` / `ctx.fail()` at
+     * the instant the job goes terminal, so the `POST /v1/job` fast path can
+     * await it (bounded) and put the receipt on the synchronous 200 rather than
+     * making the caller poll for it. Never rejects — the chain swallows its own
+     * failures.
+     */
+    terminalWork?: Promise<void>;
+    listeners: Set<(msg: Message) => void>;
+    /**
+     * Cancellation signal for the running handler (internal-review). Aborted whenever
+     * the job is cancelled on this process — caller cancel, idle timeout,
+     * stale-sweep teardown, supersession. Surfaced to builders as `ctx.signal`
+     * and auto-threaded into `ctx.fetch`, so an in-flight provider call
+     * (ElevenLabs, Scrapfly, …) is torn down instead of billing the caller for
+     * work they just cancelled. Per-process runtime state like `listeners` —
+     * never persisted, and re-created fresh on reactivation.
+     */
+    abort: AbortController;
+    /**
+     * Hook for cross-machine message persistence (Tx A, internal-review). Set by
+     * `JobManager` when the store is streamable. The appender runs the
+     * outgoing-message tx atomically with any payment-request counter bump so
+     * `(message, pending_payment_msats)` land together — never separately.
      *
-     * `funding_replayed` is the one that needs a second read to classify.
-     * Usually it *is* benign — a concurrent check won the race and the money is
-     * credited either way — but the key is `(credit_id, fund_id)` and `fund_id`
-     * is **caller-chosen**: reuse it on cashu or x402 after this bolt11 was
-     * minted and the row that collided is a different payment entirely, so the
-     * sats this invoice received have nowhere to land.
+     * Per-job serialised (internal-review): each call chains onto `messageAppenderTail`
+     * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
+     * `complete`) can't race for the DB-side seq allocation.
      */
-    private blockingReason;
-    private withBackend;
-    /** Record activity without letting it promote an unvalidated connection. */
-    private noteOperationOk;
-    private notePermissionsOk;
-    private notePermissionRefused;
+    messageAppender?: (msg: Message, opts?: AppendOutgoingOptions) => void;
     /**
-     * Only a *transport* failure from an ordinary invoice operation is a health
-     * signal. Permission-probe refusals are classified by {@link refresh}.
+     * Tail of the per-job appender chain (internal-review). `wireMessageAppender` updates
+     * this on every call so `persistJob` can await it before the terminal snapshot
+     * save runs `DELETE FROM job_messages`.
      */
-    private noteFailure;
-    private refresh;
+    messageAppenderTail?: Promise<unknown>;
+    sdkCtx?: SDKJobContext<unknown, unknown>;
+    stepCache: StepCache;
+    state: unknown;
+    pendingPrompts: Map<string, PromptResolver>;
+    pendingPayment: PaymentResolver | null;
+    /** When not null, indicates replay mode — prompt/payment scan message history for cached responses. */
+    replayHighSeq: number | null;
+    /** Number of provider messages to suppress during replay. Cleared on handler error. */
+    replayProviderSkip: number;
+    /** Index of the next payment to match during replay (for multi-payment handlers). */
+    replayPaymentIndex: number;
+    /**
+     * Set once Tx C applies the current payment ask during this reactivation.
+     * Runtime-only: replayed prompts may mutate `status`, but never clear this
+     * marker before the matching payment is consumed.
+     */
+    reactivationPaymentApplied?: true;
+    /** Unix ms timestamp of job creation. */
+    createdAt: number;
+    /** Unix ms timestamp of last activity (message, yield, terminal). */
+    lastActivityAt: number;
+}
+/** Extract the persistent fields from a ServerJob into a JobRecord. */
+declare function toJobRecord(job: ServerJob): JobRecord;
+/** Reconstitute a ServerJob from a persisted JobRecord with fresh runtime fields. */
+declare function fromJobRecord(record: JobRecord): ServerJob;
+/**
+ * Signal cancellation to a running handler (internal-review). Idempotent — aborting an
+ * already-aborted controller is a no-op, so the overlapping teardown paths
+ * (caller cancel then stale sweep, say) can each call it unconditionally.
+ */
+declare function abortJob(job: ServerJob, reason: string): void;
+/**
+ * Reason carried on `ctx.signal.reason` and thrown by post-terminal `ctx.prompt`
+ * / `ctx.requestPayment` calls. Builders can `instanceof`-check it to tell a
+ * cancellation apart from a provider-side abort.
+ */
+declare class JobCancelledError extends Error {
+    constructor(message?: string);
 }
+/** Append a provider-sent message to the job and notify SSE listeners. */
+declare function providerMessage(job: ServerJob, type: MessageType, content: Record<string, unknown> | object): void;
+/** Check if a job status is terminal (completed, failed, cancelled). */
+declare function isTerminal(status: ServerJob["status"]): boolean;
+/** Check if a message is a yield point (ends the provider's turn). */
+declare function isYieldMessage(msg: Message): boolean;
 
 /**
  * Per-DVM runtime mint-health tracker (internal-review). Alongside the platform's
@@ -894,419 +530,38 @@ declare class MintHealthTracker {
 }
 
 /**
- * Owner display identity surfaced on `/v1/info#owner` (internal-review). Personal orgs
- * resolve to the owner builder's profile; shared orgs resolve to the org's own
- * profile. Container DVMs read from env vars; isolate DVMs resolve from Postgres.
+ * Credit fields riding the signed request body (internal-review, spec §2).
+ *
+ * An explicit draw references the credit INSIDE the secp256k1/Schnorr-signed
+ * `body.data` — no new caller crypto. Wire field names (snake_case, matching
+ * the rest of the wire surface):
+ *
+ * - `credit_id` — the credit to draw against.
+ * - `draw_id`   — client-generated draw id; the ledger's idempotency key.
+ * - `fund`      — optional `{ amount_micro, commitment }` funding commitment:
+ *   present iff a funding artifact (X-Cashu / X-PAYMENT / mpp credential)
+ *   rides the same request. `commitment` is the SHA-256 hex over the raw
+ *   artifact bytes, binding the header-borne proof — which sits OUTSIDE the
+ *   signed body — to the credit its sender intended (spec §2 condition 3).
+ *
+ * These are envelope-level fields, not capability input: **the SDK** removes
+ * them before any builder-owned schema parses ({@link stripCreditEnvelope} in
+ * `JobManager.parseInput` and on the quote path; {@link
+ * creditEnvelopeIgnoreFields} feeding the auth verifier's own schema check), so
+ * handlers never see them and a top-level `.strict()` capability schema is
+ * fine (internal-review). Relying on Zod's default strip mode instead was the trap:
+ * `.strict()` rejects unknown keys, so an explicit draw 400'd at parse before
+ * the envelope was ever extracted.
+ *
+ * The strip never touches the canonical signing bytes. Every auth call site
+ * verifies the raw wire body (`signedRequestInput`, internal-review), so the credit
+ * fields are in the verified bytes because they were never taken out of them —
+ * the strip is only ever applied to what a schema is about to parse.
  */
-interface OwnerDisplay {
-    handle: string;
-    displayName?: string | null;
-    avatarUrl?: string | null;
-    type: "builder" | "org";
-}
-/** Optional builder identity surfaced on `/v1/info` (forward-compatible stub). */
-interface BuilderIdentity {
-    id?: string;
-    name?: string;
-    url?: string;
-    /**
-     * Builder identity x-only secp256k1 pubkey (internal-review). When populated, the
-     * `/v1/info#builder` block also carries `attestation` + `signature` so
-     * consumers can verify the deploy was signed by the holder of this key.
-     * Populated at deploy time from `DVMKIT_BUILDER_PUBKEY` (Fly secret); the
-     * SDK never re-signs at runtime.
-     */
-    pubkey?: string;
-    /** Canonical deploy-time attestation payload (internal-review). Served verbatim. */
-    attestation?: AttestationPayload;
-    /** Schnorr signature over `canonicaliseForSigning(attestation)` (internal-review). */
-    signature?: string;
-}
-/** Platform reporter overrides — the host falls back to env when omitted. */
-interface PlatformReporterOpts {
-    /** Bearer token. Defaults to `DVMKIT_PLATFORM_TOKEN` env. */
-    token?: string;
-    /** Platform internal URL. Defaults to `DVMKIT_PLATFORM_URL` env. */
-    url?: string;
-}
-/** Options for {@link createDVMHost}. */
-interface DVMHostOpts {
-    /**
-     * Postgres connection string. Defaults to `DATABASE_URL` env.
-     * Required at runtime (internal-review). Boot fails when missing unless `jobStore`
-     * is explicitly supplied or `devMode` is true (test/dev escape hatches).
-     */
-    database?: string;
-    /** Listen port. Defaults to `PORT` env or 8080. */
-    port?: number;
-    /** Environment variables. Defaults to `process.env`. */
-    env?: Record<string, string>;
-    /** Builder identity for `/v1/info` (forward-compatible). */
-    builder?: BuilderIdentity;
-    /** Owner display identity for `/v1/info#owner` (internal-review). Falls back to env vars. */
-    owner?: OwnerDisplay;
-    /** Platform reporter overrides. Defaults to env-derived values. */
-    platformReporter?: PlatformReporterOpts;
-    /** Override the SDK's fx fetcher. Defaults to env-configured CoinGecko. */
-    fx?: FxFetcher;
-    /**
-     * Custom `/health` handler. When set, the SDK installs this instead of the
-     * default `{ status: "ok" }` responder — useful for runtime-specific health
-     * (pool depth, draining state, 503 while draining).
-     */
-    healthHandler?: (c: Context) => Response | Promise<Response>;
-    /** KV store override. Defaults to PostgresKVStore (or MemoryKVStore in dev). */
-    store?: KVStore;
-    /** JobStore override. Takes precedence over `database`. */
-    jobStore?: JobStore;
-    /**
-     * Existing Postgres pool to reuse instead of opening one from `database`
-     * (internal-review test seam). When set, the host builds its JobStore / KVStore /
-     * cashu accumulator on this pool and leaves it open at shutdown — the caller
-     * owns it. Lets the e2e harness run DVMs in `p2pk-accumulator` mode against
-     * its single shared pool rather than spawning a pool per DVM.
-     */
-    pool?: Pool;
-    /** Cashu mints accepted. Defaults to env `DVMKIT_CASHU_MINTS`. */
-    mints?: string[];
-    /** Cashu receive mode override. */
-    cashuMode?: CashuMode;
-    /** MPP handle override. Defaults to env-resolved via `createMppFromOpts`. */
-    mpp?: MppxServer;
-    /** x402 stablecoin payment configuration. Defaults to env-resolved. */
-    x402?: X402Config;
-    /** Payment methods override. Defaults to derived from configured rails. */
-    paymentMethods?: PaymentMethod[];
-    /**
-     * Lightning receive leg for credit funding (internal-review). Defaults to the
-     * env-resolved `DVMKIT_NWC_RECEIVE_URI` /
-     * `DVMKIT_NWC_RECEIVE_INVOICE_TTL_SECONDS`. Pass `backend` to inject a
-     * wallet directly — a test seam that skips the connect-time probe, so
-     * production must always come through the URI.
-     */
-    lightningReceive?: LightningReceiveConfig;
-    /** When true, payment is skipped if no mints are configured (dev/test). */
-    devMode?: boolean;
-    /** Consumed-credential store override (test seam). */
-    consumedCredentialStore?: ConsumedCredentialStore;
-    /** Mint-health tracker override (test seam). */
-    mintHealthTracker?: MintHealthTracker;
-    /**
-     * Wrap the SDK compatibility gate before it is exposed to descriptor custom
-     * routes. Platform hosts use this to enforce their independently released
-     * caller rollout policy; self-hosted SDK consumers receive the default gate.
-     */
-    wrapRouteClientCompatibility?: (sdkGate: ClientCompatibilityGate) => ClientCompatibilityGate;
-}
-/** Per-mount options. Currently only `prefix` is supported. */
-interface MountOpts {
-    /** Path prefix for this DVM's protocol routes (e.g. `/delete-feed`). */
-    prefix?: string;
-}
-/** Live DVM host. Single wiring locus for the SDK (internal-review). */
-interface DVMHost {
-    /**
-     * Underlying Hono app for custom non-protocol routes that belong to the
-     * host (cross-DVM `/admin`, cron callbacks, etc.). For DVM-scoped routes,
-     * declare `routes(app)` on the descriptor.
-     */
-    readonly app: Hono;
-    /**
-     * Resolved Postgres pool — undefined before `host.serve()` completes
-     * database resolution, set thereafter. Exposed so DVM-local Postgres
-     * consumers (e.g. scrape's `ScrapeDb` per-fetch event store, internal-review)
-     * can reuse the host's pool rather than constructing their own. Wire
-     * inside descriptor `onBoot` (fires after pool init, before listener opens).
-     */
-    readonly pool: Pool | undefined;
-    /**
-     * Money-safe credit ledger (internal-review) — undefined before `host.serve()`
-     * resolves stores, set thereafter. Postgres-backed when a pool exists;
-     * pool-less hosts get a shared in-memory ledger so the internal-review fund+draw
-     * semantics hold everywhere. Same wiring window as `pool` (descriptor
-     * `onBoot` fires after init, before the listener opens).
-     */
-    readonly creditLedger: CreditLedgerLike | undefined;
-    /**
-     * Add a DVM to this host. Multiple mounts compose at distinct prefixes;
-     * a single mount with no prefix attaches at root.
-     */
-    mount<S, I extends ZodLike | undefined>(descriptor: DVMDescriptor<S, I>, opts?: MountOpts): void;
-    /** Start listening. Returns the live server handle. */
-    serve(opts?: {
-        port?: number;
-    }): Promise<{
-        url: string;
-        close: () => Promise<void>;
-    }>;
-    /** Graceful shutdown. Runs descriptor `onShutdown` hooks in reverse mount order. */
-    shutdown(): Promise<void>;
-}
-/**
- * Single wiring locus for SDK-side construction (internal-review). Replaces both the
- * `serve()` wrapper and the `createDVMServer` direct path. Reads env once,
- * resolves payment rails, owns the Postgres pool, and mounts each DVM
- * descriptor as a Hono sub-app on `host.app`.
- */
-declare function createDVMHost(opts?: DVMHostOpts): DVMHost;
-
-/** Promise resolver for a pending client prompt response. */
-interface PromptResolver {
-    resolve: (value: ResponseContent) => void;
-    reject: (reason: Error) => void;
-}
-/** Promise resolver for a pending client payment. */
-interface PaymentResolver {
-    resolve: (value: PaymentContent) => void;
-    reject: (reason: Error) => void;
-}
-/** In-memory representation of a running job. */
-interface ServerJob {
-    id: string;
-    tags: string[];
-    /**
-     * Capability name this job belongs to (internal-review). Set at submission from
-     * `POST /v1/job` body's `capability` field; routes the SDK runtime to the
-     * right `onJob` / `onResponse` / `onPayment` handler and the right input
-     * schema. Required — the wire layer rejects requests that omit it.
-     */
-    capability: string;
-    input: string;
-    params: Record<string, string>;
-    requesterId: string;
-    /**
-     * SHA-256 hex of the per-job opaque `job_token` minted at creation for
-     * anonymous callers (internal-review). Mirror of `JobRecord.requesterTokenHash`;
-     * see that field for the wire-level gating semantics.
-     */
-    requesterTokenHash?: string;
-    /**
-     * Submission provenance (internal-review) — mirrors `JobRecord.requesterToken` /
-     * `requestFingerprint` / `requesterPubkey`. Carried on the job purely so
-     * `toJobRecord` persists it; nothing in the runtime reads it. It's the
-     * replay gate: a retried paid submit that reproduces the fingerprint (and,
-     * on a signed DVM, the pubkey) is handed this token back.
-     */
-    requesterToken?: string;
-    requestFingerprint?: string;
-    requesterPubkey?: string;
-    requestId?: string;
-    /** HTTP path independently recorded when the caller proof was accepted. */
-    authRequestPath?: string;
-    status: "processing" | "completed" | "failed" | "awaiting-input" | "cancelled" | "working";
-    summary?: string;
-    messages: Message[];
-    seq: number;
-    paidMsats: number;
-    paymentMint?: string;
-    /** Rail of the most recent successful credit. Set on each credit branch in payment processing. */
-    paymentRail?: FundingMethod;
-    /**
-     * Settlement reference for the most-recent successful credit. Threaded
-     * into `onJobCompleted` so the platform revenue ledger can populate
-     * `revenue_events.tx_hash`. mpp/x402 carry the credential's `challenge.id`
-     * / EVM tx hash from the facilitator (internal-review); cashu accumulator carries
-     * the `X-Cashu-Request-Id` UUID (internal-review). Updated on every credit
-     * (upfront or mid-job via `processIncomingPayment`) — internal-review.
-     * Single-row-per-job accounting keeps the most recent credit's hash,
-     * mirroring `paymentRail`.
-     */
-    paymentTxHash?: string;
-    /** Chain transaction returned to callers recovering x402 or Tempo acceptance. */
-    paymentTransactionHash?: string;
-    /**
-     * Rail-native amount accumulated across all successful credits on this
-     * job (sats for mpp, USDC microunits for x402). The single
-     * `revenue_events` row written at completion uses this as `gross_native`,
-     * so multi-credit jobs sum the per-credit native amounts (internal-review).
-     * internal-review wired the upfront credit; mid-job credits accumulate same-rail
-     * and reset on a cross-rail switch (see `processIncomingPayment`).
-     */
-    nativeAmount?: number;
-    /** Native asset tag — paired with `nativeAmount`. internal-review. */
-    nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
-    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow` (internal-review). */
-    cashuFlow?: "p2pk_accumulator";
-    /** Credit the upfront payment funded/drew (internal-review). See `JobRecord.creditId`. */
-    creditId?: string;
-    /** The draw placed for this job on `creditId` (internal-review). */
-    drawId?: string;
-    /** Original funding artifact returned by an explicit fund-and-draw. */
-    fundingReceipt?: FundingReceipt;
-    fundingCredit?: CreditSnapshot;
-    receivedProofs: ProofLike[];
-    pendingPaymentMsats?: number;
-    /**
-     * Per-job binding for MPP credentials. Contains the `challenge.id` of every
-     * mppx challenge issued in the most-recent `requestPayment` yield. mppx HMAC
-     * binds challenges to realm/method/amount/expiry, not to the dvmkit job-id;
-     * verifying the incoming credential's `challenge.id` is in this set blocks
-     * a credential lifted from a sibling job that requested the same fields.
-     * Cleared on successful credit (internal-review).
-     */
-    pendingMppChallengeIds?: string[];
-    /**
-     * Per-job binding for x402 mid-job credentials (internal-review). 32-byte 0x-hex
-     * nonce issued by `requestPayment` and stamped onto the outbound x402
-     * envelope; the caller signs `TransferWithAuthorization` against this exact
-     * `bytes32`. Verification rejects an incoming `x402_payment` whose decoded
-     * authorization nonce differs, blocking a cross-job replay before the
-     * facilitator settles. Cleared on successful credit.
-     */
-    pendingX402Nonce?: string;
-    /**
-     * Exact USDC microunit amount paired with `pendingX402Nonce`. Kept as a
-     * decimal string so the EIP-3009 uint256 value remains lossless.
-     */
-    pendingX402AmountUsdcMicro?: string;
-    /**
-     * Fiat micro-units the outstanding `requestPayment` ask is worth, pinned when
-     * the payment-request was emitted (internal-review). See `JobRecord`.
-     */
-    pendingPaymentFiatMicro?: number;
-    /** Currency of {@link pendingPaymentFiatMicro} (lowercase ISO-4217). */
-    pendingPaymentFiatCurrency?: string;
-    /**
-     * Cumulative fiat micro this job has asked for mid-job, the ceiling on its
-     * draw growth (internal-review). See `JobRecord.askedTopUpMicro` for the sentinel.
-     */
-    askedTopUpMicro?: number;
-    /**
-     * Currency of {@link askedTopUpMicro} — and this job's sticky ask
-     * denomination (internal-review). See `JobRecord.askedTopUpCurrency`.
-     */
-    askedTopUpCurrency?: string;
-    /**
-     * Why this job's draw growth is not capped, when it isn't (internal-review). Mirror
-     * of `JobRecord.topUpCapUnenforcedReason`.
-     */
-    topUpCapUnenforcedReason?: TopUpCapUnenforcedReason;
-    /** Price the job was charged at (msats). Used to detect overpayment for change/melt gating. */
-    requiredMsats?: number;
-    /**
-     * The signed receipt for this job's terminal outcome (internal-review). Mirror of
-     * `JobRecord.receipt`, set once the terminal funnel has signed and persisted
-     * it so the local read paths (which serve from `activeJobs` during the
-     * cleanup window) hand back the same bytes as a cross-machine re-read.
-     */
-    receipt?: JobReceipt;
-    /**
-     * The in-flight terminal chain — persist, then sign + store the receipt
-     * (internal-review). Assigned synchronously by `ctx.complete()` / `ctx.fail()` at
-     * the instant the job goes terminal, so the `POST /v1/job` fast path can
-     * await it (bounded) and put the receipt on the synchronous 200 rather than
-     * making the caller poll for it. Never rejects — the chain swallows its own
-     * failures.
-     */
-    terminalWork?: Promise<void>;
-    listeners: Set<(msg: Message) => void>;
-    /**
-     * Cancellation signal for the running handler (internal-review). Aborted whenever
-     * the job is cancelled on this process — caller cancel, idle timeout,
-     * stale-sweep teardown, supersession. Surfaced to builders as `ctx.signal`
-     * and auto-threaded into `ctx.fetch`, so an in-flight provider call
-     * (ElevenLabs, Scrapfly, …) is torn down instead of billing the caller for
-     * work they just cancelled. Per-process runtime state like `listeners` —
-     * never persisted, and re-created fresh on reactivation.
-     */
-    abort: AbortController;
-    /**
-     * Hook for cross-machine message persistence (Tx A, internal-review). Set by
-     * `JobManager` when the store is streamable. The appender runs the
-     * outgoing-message tx atomically with any payment-request counter bump so
-     * `(message, pending_payment_msats)` land together — never separately.
-     *
-     * Per-job serialised (internal-review): each call chains onto `messageAppenderTail`
-     * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
-     * `complete`) can't race for the DB-side seq allocation.
-     */
-    messageAppender?: (msg: Message, opts?: AppendOutgoingOptions) => void;
-    /**
-     * Tail of the per-job appender chain (internal-review). `wireMessageAppender` updates
-     * this on every call so `persistJob` can await it before the terminal snapshot
-     * save runs `DELETE FROM job_messages`.
-     */
-    messageAppenderTail?: Promise<unknown>;
-    sdkCtx?: SDKJobContext<unknown, unknown>;
-    stepCache: StepCache;
-    state: unknown;
-    pendingPrompts: Map<string, PromptResolver>;
-    pendingPayment: PaymentResolver | null;
-    /** When not null, indicates replay mode — prompt/payment scan message history for cached responses. */
-    replayHighSeq: number | null;
-    /** Number of provider messages to suppress during replay. Cleared on handler error. */
-    replayProviderSkip: number;
-    /** Index of the next payment to match during replay (for multi-payment handlers). */
-    replayPaymentIndex: number;
-    /**
-     * Set once Tx C applies the current payment ask during this reactivation.
-     * Runtime-only: replayed prompts may mutate `status`, but never clear this
-     * marker before the matching payment is consumed.
-     */
-    reactivationPaymentApplied?: true;
-    /** Unix ms timestamp of job creation. */
-    createdAt: number;
-    /** Unix ms timestamp of last activity (message, yield, terminal). */
-    lastActivityAt: number;
-}
-/** Extract the persistent fields from a ServerJob into a JobRecord. */
-declare function toJobRecord(job: ServerJob): JobRecord;
-/** Reconstitute a ServerJob from a persisted JobRecord with fresh runtime fields. */
-declare function fromJobRecord(record: JobRecord): ServerJob;
-/**
- * Signal cancellation to a running handler (internal-review). Idempotent — aborting an
- * already-aborted controller is a no-op, so the overlapping teardown paths
- * (caller cancel then stale sweep, say) can each call it unconditionally.
- */
-declare function abortJob(job: ServerJob, reason: string): void;
-/**
- * Reason carried on `ctx.signal.reason` and thrown by post-terminal `ctx.prompt`
- * / `ctx.requestPayment` calls. Builders can `instanceof`-check it to tell a
- * cancellation apart from a provider-side abort.
- */
-declare class JobCancelledError extends Error {
-    constructor(message?: string);
-}
-/** Append a provider-sent message to the job and notify SSE listeners. */
-declare function providerMessage(job: ServerJob, type: MessageType, content: Record<string, unknown> | object): void;
-/** Check if a job status is terminal (completed, failed, cancelled). */
-declare function isTerminal(status: ServerJob["status"]): boolean;
-/** Check if a message is a yield point (ends the provider's turn). */
-declare function isYieldMessage(msg: Message): boolean;
-
-/**
- * Credit fields riding the signed request body (internal-review, spec §2).
- *
- * An explicit draw references the credit INSIDE the secp256k1/Schnorr-signed
- * `body.data` — no new caller crypto. Wire field names (snake_case, matching
- * the rest of the wire surface):
- *
- * - `credit_id` — the credit to draw against.
- * - `draw_id`   — client-generated draw id; the ledger's idempotency key.
- * - `fund`      — optional `{ amount_micro, commitment }` funding commitment:
- *   present iff a funding artifact (X-Cashu / X-PAYMENT / mpp credential)
- *   rides the same request. `commitment` is the SHA-256 hex over the raw
- *   artifact bytes, binding the header-borne proof — which sits OUTSIDE the
- *   signed body — to the credit its sender intended (spec §2 condition 3).
- *
- * These are envelope-level fields, not capability input: **the SDK** removes
- * them before any builder-owned schema parses ({@link stripCreditEnvelope} in
- * `JobManager.parseInput` and on the quote path; {@link
- * creditEnvelopeIgnoreFields} feeding the auth verifier's own schema check), so
- * handlers never see them and a top-level `.strict()` capability schema is
- * fine (internal-review). Relying on Zod's default strip mode instead was the trap:
- * `.strict()` rejects unknown keys, so an explicit draw 400'd at parse before
- * the envelope was ever extracted.
- *
- * The strip never touches the canonical signing bytes. Every auth call site
- * verifies the raw wire body (`signedRequestInput`, internal-review), so the credit
- * fields are in the verified bytes because they were never taken out of them —
- * the strip is only ever applied to what a schema is about to parse.
- */
-interface CreditEnvelope {
-    creditId: string;
-    drawId: string;
-    fund?: CreditFundCommitment;
+interface CreditEnvelope {
+    creditId: string;
+    drawId: string;
+    fund?: CreditFundCommitment;
 }
 /** The signed funding commitment for a fund-and-draw request. */
 interface CreditFundCommitment {
@@ -1620,16 +875,11 @@ declare function fundedMicroFor(priceFiat: PriceFiat, paidMsats: number, require
  * quote is 11 sats and the old advertisement demanded 10,718 µUSDC — 7% above
  * the price the caller was quoted and the ledger recorded.
  *
- * Both call sites — `buildX402Requirements` and the upfront verify branch —
- * MUST derive through here rather than recomputing. Two independent derivations
- * is exactly the shape that produced this bug.
- *
- * The rate-derived path survives for anything this rule can't express: a
- * non-USD `priceFiat` (the µUSDC figure is a real fx conversion there, and
- * still drifts — internal-review), and a host that verifies without a `priceFiat` at
- * all. Both keep today's behaviour rather than guessing a denomination.
+ * Every caller gates x402 on a USD-priced DVM before reaching this helper.
+ * Keeping the helper USD-only makes a future advertisement call site fail
+ * closed instead of quietly restoring the rate-derived non-USD path.
  */
-declare function x402RequiredUsdcMicro(priceFiat: PriceFiat | undefined, requiredMsats: number, btcUsdRate: number): number;
+declare function x402RequiredUsdcMicro(priceFiat: PriceFiat): number;
 /**
  * A settled x402 authorization's share of a quoted figure, taken against the
  * `maxAmountRequired` the 402 advertised (internal-review) — `quoted` unmodified when
@@ -1639,7 +889,7 @@ declare function x402RequiredUsdcMicro(priceFiat: PriceFiat | undefined, require
  *
  * x402 must NOT reach {@link fundedMicroFor} through `usdcToMsats`. The
  * advertised figure is stated in µUSDC by {@link x402RequiredUsdcMicro} — the
- * price verbatim for a USD job, a `Math.ceil` off the rate otherwise — and the
+ * price verbatim for a USD job — and the
  * receipt converts back with `usdcToMsats`, a `Math.round`, which is the
  * inverse of neither. The round trip lands at or above `requiredMsats`, which
  * took the pro-rata branch and valued a payment of exactly the advertised
@@ -2524,6 +1774,8 @@ interface PaymentInfo {
  */
 interface CreditFundingReport {
     creditId: string;
+    /** Canonical owner returned by the ledger after applying the funding. */
+    callerPubkey: string;
     /** The rail's own settlement reference — the deposit's idempotency key. */
     fundingId: string;
     rail: FundingMethod;
@@ -2931,7 +2183,7 @@ declare function verifyTempoSessionManagementCredential(args: {
  * here: the former is already complete, the latter is a challenge envelope, not
  * an error report.
  */
-type PaymentErrorCode = "payment_invalid" | "x402_settlement_ambiguous" | "cashu_unavailable" | "cashu_not_p2pk_locked" | "mint_health_pending" | "cashu_mint_sick" | "payment_insufficient" | "payment_unapplied" | "insufficient_credit" | "credit_expired" | "credit_unbacked" | "credit_not_found" | "tempo_channel_closing" | "settlement_pending" | "draw_conflict" | "funding_commitment_mismatch" | "credit_not_supported" | "one_shot_credit_not_supported" | "credit_below_min" | "below_rail_minimum" | "credit_over_max" | "credit_id_unavailable" | "nothing_to_drain" | "drain_below_dust" | "drain_not_found" | "drain_conflict" | "drain_method_unsupported" | "tempo_channel_exit_required" | "x402_settlement_submission_failed" | X402SettlementReconciliationReason | "lightning_settlement_pending" | "lightning_invoice_expired" | "lightning_unavailable" | AccumulatorRejectionCode;
+type PaymentErrorCode = "payment_invalid" | "x402_not_offered" | "x402_settlement_ambiguous" | "cashu_unavailable" | "cashu_not_p2pk_locked" | "mint_health_pending" | "cashu_mint_sick" | "payment_insufficient" | "payment_unapplied" | "insufficient_credit" | "credit_expired" | "credit_unbacked" | "credit_not_found" | "tempo_channel_closing" | "settlement_pending" | "draw_conflict" | "funding_commitment_mismatch" | "credit_not_supported" | "one_shot_credit_not_supported" | "credit_below_min" | "below_rail_minimum" | "credit_over_max" | "credit_id_unavailable" | "nothing_to_drain" | "drain_below_dust" | "drain_not_found" | "drain_conflict" | "drain_method_unsupported" | "tempo_channel_exit_required" | "x402_settlement_submission_failed" | X402SettlementReconciliationReason | "lightning_settlement_pending" | "lightning_invoice_expired" | "lightning_unavailable" | AccumulatorRejectionCode;
 /**
  * Build a flat payment-error body carrying the four agent-facing fields every
  * payment error must have (internal-review): the machine `code`, the operator-facing
@@ -2984,6 +2236,8 @@ declare function buildPaymentErrorResponse(body: Record<string, unknown>, challe
 interface IncomingPaymentOpts {
     mints?: string[];
     x402Config?: X402Config;
+    /** Declared DVM pricing currency. x402 is accepted only when this is USD. */
+    pricingCurrency?: string;
     /** Durable exact-settlement coordinator shared with the upfront path. */
     x402ExactSettlement?: X402ExactSettlementServer;
     /** Exact generations the facilitator currently advertises. Defaults to both. */
@@ -3312,1094 +2566,1522 @@ interface X402FacilitatorHealthOpts extends X402FacilitatorProbeOpts {
     refreshTtlMs?: number;
     maxStalenessMs?: number;
 }
-/** Live, synchronous capability view consumed while payment responses are rendered. */
-interface X402FacilitatorHealthLike {
-    /** Prime or refresh the capability observation. */
-    refresh(): Promise<void>;
-    /** Return current support and begin a background refresh when its TTL has elapsed. */
-    support(): X402FacilitatorSupport;
-    /** Last successful raw response, reused by batch initialization without another request. */
-    supportedResponse?(): SupportedResponse | undefined;
+/** Live, synchronous capability view consumed while payment responses are rendered. */
+interface X402FacilitatorHealthLike {
+    /** Prime or refresh the capability observation. */
+    refresh(): Promise<void>;
+    /** Return current support and begin a background refresh when its TTL has elapsed. */
+    support(): X402FacilitatorSupport;
+    /** Last successful raw response, reused by batch initialization without another request. */
+    supportedResponse?(): SupportedResponse | undefined;
+}
+/**
+ * TTL-cached facilitator capability gate. Failed refreshes retain the last
+ * successful observation until the same three-hour ceiling used by the
+ * Lightning rail; a cold-start failure temporarily assumes exact dual-serve
+ * so a facilitator blip does not suppress a healthy payment rail for a whole
+ * process lifetime. Batch settlement is never assumed without an observation.
+ */
+declare class X402FacilitatorHealth implements X402FacilitatorHealthLike {
+    private readonly config;
+    private readonly opts;
+    private readonly now;
+    private readonly refreshTtlMs;
+    private readonly maxStalenessMs;
+    private readonly startedAtMs;
+    private observation;
+    private lastAttemptAtMs;
+    private inFlight;
+    private ceilingLoggedForMs;
+    private lastSupportedResponse;
+    constructor(config: X402Config, opts?: X402FacilitatorHealthOpts);
+    /** Refresh the observation, coalescing concurrent requests. */
+    refresh(): Promise<void>;
+    /** Answer synchronously from cache and start a non-blocking refresh when due. */
+    support(): X402FacilitatorSupport;
+    /** Return the raw response paired with the last successful observation. */
+    supportedResponse(): SupportedResponse | undefined;
+    private get facilitator();
+    private get network();
+    private refreshOnce;
+}
+
+/** Options for creating a JobManager. */
+interface JobManagerOpts {
+    /** Environment variables for ctx.env. */
+    env: Record<string, string>;
+    /** KV store for ctx.store. */
+    store: KVStore;
+    /** Cashu mints accepted for payment. */
+    mints?: string[];
+    /** Persistent backing store for job records. Default: in-memory. */
+    jobStore?: JobStore;
+    /** When true, payment messages auto-credit without verification. */
+    devMode?: boolean;
+    /** Payment methods this DVM accepts. Default: derived by the server from configured rails. */
+    paymentMethods?: PaymentMethod[];
+    /** x402 stablecoin payment configuration. */
+    x402?: X402Config;
+    /** Durable exact-settlement coordinator shared with upfront verification. */
+    x402ExactSettlement?: X402ExactSettlementServer;
+    /** Live facilitator capabilities for version-specific mid-job payment handling. */
+    x402FacilitatorHealth?: X402FacilitatorHealthLike;
+    /** MPP multi-rail payment handle (built via `createMppFromOpts`). */
+    mpp?: MppxServer;
+    /** Cashu receive mode (internal-review). */
+    cashuMode?: CashuMode;
+    /** Builder's NUT-11 P2PK lock pubkey (internal-review). Required for accumulator mode. */
+    lockPubkey?: string;
+    /** Postgres pool for wallet accumulator persistence. */
+    db?: Pool;
+    /**
+     * Agent-wallet (internal-review): per-DVM identifier used for the scheduler advisory
+     * lock and the `(dvm_id, request_id)` replay key. Defaults to `DVMKIT_DVM_ID`
+     * env at boot in `createDVMHost()`.
+     */
+    dvmId?: string;
+    /** Audience expected by persisted v2 caller statements. */
+    authAudience?: SignedRequestAudience;
+    /**
+     * Shared fx fetcher used to convert USD-string descriptor prices and
+     * fiat-form `requestPayment` calls into sats (internal-review). The SDK server owns
+     * one per process so concurrent quotes share the 60s cache window.
+     */
+    fxFetcher: FxFetcher;
+    /**
+     * Signs a receipt at every terminal transition (internal-review). Absent when the
+     * DVM has no receipt key wired — jobs then terminate exactly as before and
+     * `/v1/info` doesn't advertise `receipts`.
+     */
+    receiptIssuer?: ReceiptIssuer;
+    /**
+     * Credit ledger for the terminal funnel (internal-review): a job carrying a
+     * `creditId`/`drawId` settles its draw on success and releases it on
+     * failure/cancel — this is how "no debit on job failure" is mechanically
+     * real. The resolution runs before receipt issuance so the receipt's
+     * `credit` block countersigns the post-resolution balance.
+     */
+    creditLedger?: CreditLedgerLike;
+    /**
+     * Durable processed-payment markers (internal-review), threaded through to the
+     * mid-job top-up path (internal-review) so an x402/mpp payment's marker, `fund`, and
+     * `growDraw` commit together.
+     */
+    processedPayments?: ProcessedPaymentStore;
+    /**
+     * Reporter-owned transactional deposit enqueue threaded into mid-job rail
+     * commits (internal-review).
+     */
+    enqueueCreditDeposit?: CreditDepositEnqueue;
+    /** Reporter outbox inserted atomically with a terminal draw release (internal-review). */
+    enqueueCreditDrawRelease?: CreditDrawReleaseEnqueue;
+    /** Credit lifetime a top-up mints with, from the DVM's advertised `credit.ttl`. */
+    creditTtlMs?: number;
+    /**
+     * The DVM's declared pricing currency (internal-review), which is the currency of
+     * every credit it opens. Threaded into the job context so a mid-job ask on a
+     * job that holds no credit yet is still pinned in the denomination its first
+     * payment will open the credit in (internal-review). `DVMServer` passes its resolved
+     * `pricingCurrency`; a host building a `JobManager` directly falls back to the
+     * descriptor, and then to `"usd"`.
+     */
+    pricingCurrency?: string;
+    /**
+     * Callback fired when a mid-job top-up moves money onto a credit (internal-review).
+     * The platform books it as a **deposit** — a liability until drawn, never
+     * summed into revenue — so a top-up that skipped this would leave the
+     * outstanding-liability view short. Mirrors `DVMServer.reportCreditDeposit`,
+     * which handles the upfront and `/v1/credit` legs.
+     */
+    onCreditFunded?: (info: CreditDepositPayload) => void | Promise<void>;
+    /**
+     * Callback fired when a paid job completes (internal-review). Container-runtime DVMs
+     * use this to report revenue to the platform via `RevenueReporter`. Mirrors
+     * the isolate path's `IsolateJobManager.opts.onJobCompleted`.
+     */
+    onJobCompleted?: (info: {
+        dvmId: string;
+        jobId: string;
+        paidMsats: number;
+        paymentMint?: string;
+        rail: string;
+        paymentTxHash?: string;
+        nativeAmount?: number;
+        nativeAsset?: string;
+        cashuFlow?: string;
+        creditId?: string;
+        drawId?: string;
+        drawAmountMicro?: number;
+        creditCurrency?: string;
+        settledAt?: number;
+        fundingRef?: string;
+        kind?: string;
+    }) => void | Promise<void>;
+    /**
+     * Callback fired when the stale-job reaper force-fails a *paid* job — its
+     * pending credit draw is released rather than settled, because only a
+     * completed job settles a draw (internal-review). Container-runtime DVMs wire this
+     * to a paid-job-death report → operator `notice` (internal-review). Never fires for
+     * free jobs (`paidMsats === 0`). Fired fire-and-forget so a throw or a slow
+     * report can't wedge the sweep.
+     */
+    onPaidJobDeath?: (info: {
+        dvmId: string;
+        jobId: string;
+        capability: string;
+        paidMsats: number;
+        rail: string;
+        reason: "worker_died_mid_job" | "stale_no_terminal_status";
+        nativeAmount?: number;
+        nativeAsset?: string;
+        paymentMint?: string;
+    }) => void | Promise<void>;
+    /**
+     * Callback fired when a settled credit draw cannot book a revenue event
+     * because no usable payment rail is available (internal-review). Container-runtime
+     * DVMs auto-wire this to the platform's deduped operator notice. Fired
+     * fire-and-forget so alert delivery cannot block terminal handling or draw
+     * reconciliation.
+     */
+    onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
+    /**
+     * Stale-job sweep threshold in ms (internal-review). Jobs in a non-terminal status
+     * (`processing` / `working` / `awaiting-input`) whose `lastActivityAt` is
+     * older than this are force-cancelled with reason `stale_no_terminal_status`,
+     * so callers always reach a terminal status instead of polling forever after
+     * a worker crash, OOM, or silent `messageAppender` failure. Default:
+     * `2 × descriptor.idleTimeout + STALE_JOB_WATCHDOG_HEADROOM_MS`, matching
+     * the internal-review acceptance criterion against scrape's `JOB_TIMEOUT_MS`.
+     * Builders whose per-handler wall-clock bound exceeds 90s must override
+     * this — otherwise the watchdog fires on a legitimate in-flight handler.
+     * Set to `0` to disable (test seam).
+     */
+    staleJobTimeoutMs?: number;
+    /**
+     * Sweep interval for the stale-job watchdog. Default: `min(60s, max(15s,
+     * tightestActiveTimeout / 4))`. Tests override to fire deterministically.
+     */
+    staleJobSweepIntervalMs?: number;
+    /**
+     * Worker-liveness watchdog in ms (internal-review). Jobs in `processing`/`working`
+     * whose `lastActivityAt` is older than this are marked `failed` (dead
+     * worker), separately from the longer `awaiting-input` idle timeout above.
+     * Default: `descriptor.processingWatchdog * 1000` or
+     * `DEFAULT_PROCESSING_WATCHDOG_MS`. Set to `0` to disable (test seam).
+     */
+    processingWatchdogMs?: number;
+    /**
+     * Interval at which locally-active `processing`/`working` jobs have their
+     * `lastActivityAt` bumped so the processing watchdog only fires on a truly
+     * dead worker (internal-review). Default: `DEFAULT_HEARTBEAT_INTERVAL_MS`. Set to
+     * `0` to disable (test seam). Also floors how far the internal-review clock guard
+     * may compensate a backwards step on the processing arm — a cadence close to
+     * `processingWatchdogMs` leaves it no room and it compensates nothing.
+     */
+    heartbeatIntervalMs?: number;
+    /**
+     * Age in ms at which a `pending` credit draw whose `job_id` matches no row in
+     * the job store is released as orphaned (internal-review). The draw commits before
+     * the job row is persisted, so a crash or a fail-closed refusal in that
+     * window strands a hold no terminal path can ever reach. Must stay
+     * comfortably above the submit path's draw→persist latency. Set to `0` to
+     * disable the watchdog entirely — stranded holds then stay stranded, so
+     * treat it as a money knob, not a tuning one. Default:
+     * {@link DEFAULT_ORPHAN_DRAW_AGE_MS}.
+     */
+    orphanDrawAgeMs?: number;
+    /**
+     * Age in ms at which a `pending` credit draw whose job row **is** terminal is
+     * reconciled against that row's outcome (internal-review) — settled for a
+     * `completed` job, released for a `failed`/`cancelled` one. Covers the hole
+     * `orphanDrawAgeMs` cannot: `resolveCreditDraw` throwing on a ledger error
+     * leaves a terminal job whose hold no later path retries.
+     *
+     * Rides the same scan as the orphan arm, which has two consequences for the
+     * value you set here. Setting `orphanDrawAgeMs` to `0` disables this arm too.
+     * And the effective gate is `max(orphanDrawAgeMs, terminalDrawReconcileAgeMs)`
+     * — the scan never returns a row younger than its own cutoff, so anything
+     * below `orphanDrawAgeMs` is silently clamped up to it. That floor is
+     * deliberate rather than a wart: honouring a narrower value would mean
+     * widening the scan, which hands the orphan arm rows younger than
+     * `orphanDrawAgeMs` that it must not release. It can only ever delay a
+     * settle, never advance one, which is the safe direction for a debit.
+     *
+     * Set to `0` to disable this arm alone — a money knob, not a tuning one.
+     * Default: {@link DEFAULT_TERMINAL_DRAW_RECONCILE_AGE_MS}.
+     */
+    terminalDrawReconcileAgeMs?: number;
+    /**
+     * Sweep interval for the orphan-draw watchdog. Default:
+     * {@link DEFAULT_ORPHAN_DRAW_SWEEP_INTERVAL_MS}. Set to `0` to disable — the
+     * test seam, since suites drive `sweepOrphanDraws()` directly.
+     */
+    orphanDrawSweepIntervalMs?: number;
+    /** Retention sweep cadence. Default: daily; `0` disables the interval. */
+    jobRetentionSweepIntervalMs?: number;
+    /** Delay before the first retention pass. Default: 30s; `0` disables it. */
+    jobRetentionSweepBootDelayMs?: number;
+    /** Operator-alert boundary invoked whenever a retention pass fails. */
+    onJobRetentionSweepFailed?: (info: {
+        dvmId: string;
+        dvmName: string;
+        retentionDays: number;
+        error: string;
+    }) => void | Promise<void>;
+    /** Clear-on-recovery boundary invoked after every complete, clean pass. */
+    onJobRetentionSweepRecovered?: (info: {
+        dvmId: string;
+        dvmName: string;
+        retentionDays: number;
+        examined: number;
+        redacted: number;
+    }) => void | Promise<void>;
+    /**
+     * Grace window in ms a reactivating machine waits for a live original handler
+     * to win the single-execution claim before replaying an `awaiting-input` job
+     * itself (internal-review). Default: `DEFAULT_REACTIVATION_CLAIM_GRACE_MS`. Widen if
+     * cross-machine NOTIFY latency causes spurious double executions; lower in
+     * tests for speed.
+     */
+    reactivationClaimGraceMs?: number;
+}
+type ResolvedInput<I extends ZodLike | undefined> = I extends ZodLike<infer O> ? O : string;
+/**
+ * A deposit this payment funded that the job row did **not** take (internal-review).
+ *
+ * Reached when two mid-job top-ups race on a free-then-paid job: each opens its
+ * own implicit credit, and `verifyAndCredit`'s set-if-null bind keeps one. The
+ * loser's money is real, owned by the caller, and reclaimable — but nothing
+ * named it, so the caller would have to derive `imp:<rail>:<payment_id>` to
+ * reach their own balance. This rides the 201 so they don't have to.
+ *
+ * The response is the fast surface, not the only one: the credit is opened
+ * under the caller's verified pubkey, so `POST /v1/credit` op `balance` lists
+ * it and op `drain` reclaims it once the hold resolves.
+ */
+interface UnappliedCredit {
+    credit_id: string;
+    credited_micro: number;
+    credit_currency: string;
+    display: string;
+    hint: string;
 }
 /**
- * TTL-cached facilitator capability gate. Failed refreshes retain the last
- * successful observation until the same three-hour ceiling used by the
- * Lightning rail; a cold-start failure temporarily assumes exact dual-serve
- * so a facilitator blip does not suppress a healthy payment rail for a whole
- * process lifetime. Batch settlement is never assumed without an observation.
+ * What {@link JobManager.processPayment} tells the route. `error` is a refusal
+ * to serialise verbatim; otherwise the payment was accepted, optionally
+ * carrying an {@link UnappliedCredit} to fold into the 201.
  */
-declare class X402FacilitatorHealth implements X402FacilitatorHealthLike {
-    private readonly config;
+type ProcessPaymentOutcome = {
+    error: {
+        body: Record<string, unknown>;
+        status: number;
+    };
+    unappliedCredit?: undefined;
+} | {
+    error?: undefined;
+    unappliedCredit?: UnappliedCredit;
+};
+/**
+ * Transport-agnostic job lifecycle manager.
+ *
+ * Handles job creation, handler invocation, message dispatch, persistence,
+ * idle timeout, and durable replay. Shared by both the HTTP server and
+ * relay provider.
+ */
+declare class JobManager<State, InputSchema extends ZodLike | undefined> {
+    private readonly descriptor;
     private readonly opts;
-    private readonly now;
-    private readonly refreshTtlMs;
-    private readonly maxStalenessMs;
-    private readonly startedAtMs;
-    private observation;
-    private lastAttemptAtMs;
-    private inFlight;
-    private ceilingLoggedForMs;
-    private lastSupportedResponse;
-    constructor(config: X402Config, opts?: X402FacilitatorHealthOpts);
-    /** Refresh the observation, coalescing concurrent requests. */
-    refresh(): Promise<void>;
-    /** Answer synchronously from cache and start a non-blocking refresh when due. */
-    support(): X402FacilitatorSupport;
-    /** Return the raw response paired with the last successful observation. */
-    supportedResponse(): SupportedResponse | undefined;
-    private get facilitator();
-    private get network();
-    private refreshOnce;
-}
-
-/** Options for creating a JobManager. */
-interface JobManagerOpts {
-    /** Environment variables for ctx.env. */
-    env: Record<string, string>;
-    /** KV store for ctx.store. */
-    store: KVStore;
-    /** Cashu mints accepted for payment. */
-    mints?: string[];
-    /** Persistent backing store for job records. Default: in-memory. */
-    jobStore?: JobStore;
-    /** When true, payment messages auto-credit without verification. */
-    devMode?: boolean;
-    /** Payment methods this DVM accepts. Default: derived by the server from configured rails. */
-    paymentMethods?: PaymentMethod[];
-    /** x402 stablecoin payment configuration. */
-    x402?: X402Config;
-    /** Durable exact-settlement coordinator shared with upfront verification. */
-    x402ExactSettlement?: X402ExactSettlementServer;
-    /** Live facilitator capabilities for version-specific mid-job payment handling. */
-    x402FacilitatorHealth?: X402FacilitatorHealthLike;
-    /** MPP multi-rail payment handle (built via `createMppFromOpts`). */
-    mpp?: MppxServer;
-    /** Cashu receive mode (internal-review). */
-    cashuMode?: CashuMode;
-    /** Builder's NUT-11 P2PK lock pubkey (internal-review). Required for accumulator mode. */
-    lockPubkey?: string;
-    /** Postgres pool for wallet accumulator persistence. */
-    db?: Pool;
+    private readonly _activeJobs;
+    private readonly jobStore;
+    private readonly idleTimers;
+    private readonly cleanupTimers;
+    /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
+    private readonly statusWatchers;
+    /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
+    private readonly statusChecksInFlight;
+    /** Job ids that were notified mid-re-read and must be re-checked (internal-review). */
+    private readonly statusChecksQueued;
+    private readonly sessionId;
+    private nextJobId;
+    private accumulatorMonitor?;
+    private readonly staleJobTimeoutMs;
+    private readonly processingWatchdogMs;
+    private readonly reactivationClaimGraceMs;
     /**
-     * Agent-wallet (internal-review): per-DVM identifier used for the scheduler advisory
-     * lock and the `(dvm_id, request_id)` replay key. Defaults to `DVMKIT_DVM_ID`
-     * env at boot in `createDVMHost()`.
+     * Worker-heartbeat cadence (internal-review). Also floors the internal-review clock
+     * guard's compensation on the processing arm — see
+     * {@link staleSweepCompensationCapMs}.
      */
-    dvmId?: string;
-    /** Audience expected by persisted v2 caller statements. */
-    authAudience?: SignedRequestAudience;
+    private readonly heartbeatIntervalMs;
+    private readonly orphanDrawAgeMs;
+    private readonly terminalDrawReconcileAgeMs;
+    private staleSweepTimer?;
+    private heartbeatTimer?;
+    private orphanDrawSweepTimer?;
+    private jobRetentionSweepTimer?;
+    private jobRetentionBootTimer?;
+    /** This manager holds {@link ORPHAN_SWEEP_CLAIMS} for its ledger. */
+    private orphanSweepClaimed;
+    /** Where a page-capped tick left off; cleared once a tick reaches the end. */
+    private orphanSweepResumeFrom?;
+    private jobRetentionResumeFrom?;
     /**
-     * Shared fx fetcher used to convert USD-string descriptor prices and
-     * fiat-form `requestPayment` calls into sats (internal-review). The SDK server owns
-     * one per process so concurrent quotes share the 60s cache window.
+     * A `Date.now()` reading that cannot regress within this manager's lifetime
+     * (internal-review). Anchored at construction, so a manager already running when
+     * the clock stepped is covered. The stale-job sweep's two cutoffs, the
+     * orphan-draw age gate and the reactivation claim grace all read it; see
+     * {@link createMonotonicClock} for what it costs and where it is clamped.
      */
-    fxFetcher: FxFetcher;
+    private readonly monotonicNowMs;
+    private sweepInFlight;
+    private orphanSweepInFlight;
+    private jobRetentionSweepInFlight;
+    private heartbeatInFlight;
     /**
-     * Signs a receipt at every terminal transition (internal-review). Absent when the
-     * DVM has no receipt key wired — jobs then terminate exactly as before and
-     * `/v1/info` doesn't advertise `receipts`.
+     * The denomination of every credit this DVM opens (internal-review). Resolved once,
+     * with the same boundary fallback `DVMServer` applies for direct JavaScript
+     * callers that force an incomplete value past the descriptor contract.
      */
-    receiptIssuer?: ReceiptIssuer;
+    private readonly pricingCurrency;
+    constructor(descriptor: DVMDescriptor<State, InputSchema>, opts: JobManagerOpts);
+    /** Active in-memory jobs. */
+    get activeJobs(): Map<string, ServerJob>;
+    /** The backing job store. */
+    get store(): JobStore;
     /**
-     * Credit ledger for the terminal funnel (internal-review): a job carrying a
-     * `creditId`/`drawId` settles its draw on success and releases it on
-     * failure/cancel — this is how "no debit on job failure" is mechanically
-     * real. The resolution runs before receipt issuance so the receipt's
-     * `credit` block countersigns the post-resolution balance.
+     * True when this DVM will actually issue receipts (internal-review) — a key *and*
+     * a store that can allocate sequence numbers and persist bytes write-once.
+     * `/v1/info#receipts` reads this rather than the key alone, so the flag can
+     * never promise something `issueReceipt` silently declines to do.
      */
-    creditLedger?: CreditLedgerLike;
+    get receiptsEnabled(): boolean;
+    /** True when the named capability exists on this descriptor. */
+    hasCapability(name: string): boolean;
+    /** Names of every capability this descriptor exposes — used for error envelopes. */
+    capabilityNames(): string[];
     /**
-     * Durable processed-payment markers (internal-review), threaded through to the
-     * mid-job top-up path (internal-review) so an x402/mpp payment's marker, `fund`, and
-     * `growDraw` commit together.
+     * Resolve a capability's static `price` to msats (internal-review).
+     *
+     * `"$X.XX"` is parsed as USD and converted via the SDK's shared fx fetcher.
+     * Returns `undefined` for dynamic-priced capabilities (those that declare
+     * `onQuote`) — the caller falls back to `computeDynamicPrice` in that path.
      */
-    processedPayments?: ProcessedPaymentStore;
+    currentPriceMsats(capability: string): Promise<number | undefined>;
+    /**
+     * Translate a capability's static `price` into the fiat envelope used by
+     * the per-capability `pricing.max` advertised on `/v1/info` (internal-review).
+     * Returns `undefined` for dynamic-priced capabilities and for unknown
+     * names (the route handler validates the name before invoking this).
+     */
+    currentPricingMax(capability: string): {
+        amount: number;
+        currency: string;
+    } | undefined;
+    /**
+     * Parse a request body through a capability's input schema (internal-review).
+     *
+     * Resolution order when a capability declares an `input` schema:
+     * 1. `body.data` is preferred — agents pass structured fields directly
+     *    (CLI builds this from `--param k=v`).
+     * 2. Fallback: `JSON.parse(body.input)` for clients still on the legacy
+     *    JSON-string contract.
+     * 3. Neither usable → throw `MissingStructuredInputError` so the route can
+     *    return `invalid_input` with a hint pointing at `/v1/info`.
+     *
+     * When the capability has no `input` schema, returns `body.input` raw
+     * (primitive path).
+     *
+     * The internal-review credit envelope is removed before the schema runs, on both
+     * branches (internal-review) — it rides the signed body but is protocol-level, so a
+     * top-level `.strict()` capability schema would otherwise reject every
+     * explicit draw as an unknown key, before the envelope was even extracted.
+     * The persisted `record.input` the internal-review reactivation path re-reads is the
+     * pre-Zod wire form, so it comes through the second branch carrying them too.
+     */
+    parseInput(body: {
+        input?: string;
+        data?: unknown;
+    }, capability: string): unknown;
     /**
-     * Reporter-owned transactional deposit enqueue threaded into mid-job rail
-     * commits (internal-review).
+     * Look up the per-capability descriptor by name (internal-review). Throws when the
+     * name doesn't exist — the route layer validates body.capability first, so
+     * reaching this with an unknown name is a programmer error.
      */
-    enqueueCreditDeposit?: CreditDepositEnqueue;
-    /** Reporter outbox inserted atomically with a terminal draw release (internal-review). */
-    enqueueCreditDrawRelease?: CreditDrawReleaseEnqueue;
-    /** Credit lifetime a top-up mints with, from the DVM's advertised `credit.ttl`. */
-    creditTtlMs?: number;
+    private requireCapability;
     /**
-     * The DVM's declared pricing currency (internal-review), which is the currency of
-     * every credit it opens. Threaded into the job context so a mid-job ask on a
-     * job that holds no credit yet is still pinned in the denomination its first
-     * payment will open the credit in (internal-review). `DVMServer` passes its resolved
-     * `pricingCurrency`; a host building a `JobManager` directly falls back to the
-     * descriptor, and then to `"usd"`.
+     * Soft capability lookup — `undefined` when the name isn't defined. The
+     * single place the `descriptor.capabilities` index cast lives; callers that
+     * tolerate a missing capability (the route layer pre-validates, or the cap
+     * was deleted from the descriptor after a job was persisted) route through
+     * here instead of re-casting inline.
      */
-    pricingCurrency?: string;
+    private getCapability;
     /**
-     * Callback fired when a mid-job top-up moves money onto a credit (internal-review).
-     * The platform books it as a **deposit** — a liability until drawn, never
-     * summed into revenue — so a top-up that skipped this would leave the
-     * outstanding-liability view short. Mirrors `DVMServer.reportCreditDeposit`,
-     * which handles the upfront and `/v1/credit` legs.
+     * Allocate the id the next job will be created under (internal-review). The
+     * submit path calls this BEFORE payment verification so the ledger draw
+     * commits with its job linkage, then passes the id back through
+     * `createJob`'s provenance. Ids allocated for requests whose payment is
+     * refused are simply never used — the sequence has gaps, which nothing
+     * reads meaning into.
      */
-    onCreditFunded?: (info: CreditDepositPayload) => void | Promise<void>;
+    allocateJobId(): string;
     /**
-     * Callback fired when a paid job completes (internal-review). Container-runtime DVMs
-     * use this to report revenue to the platform via `RevenueReporter`. Mirrors
-     * the isolate path's `IsolateJobManager.opts.onJobCompleted`.
+     * Create a new job from a request body. `provenance` (internal-review) is what the
+     * idempotent-replay path on `POST /v1/job` reads back: the raw `job_token`
+     * to re-issue, and the fingerprint + caller pubkey a retry must reproduce
+     * to be given it.
      */
-    onJobCompleted?: (info: {
-        dvmId: string;
-        jobId: string;
-        paidMsats: number;
-        paymentMint?: string;
-        rail: string;
-        paymentTxHash?: string;
-        nativeAmount?: number;
-        nativeAsset?: string;
-        cashuFlow?: string;
-        creditId?: string;
-        drawId?: string;
-        drawAmountMicro?: number;
-        creditCurrency?: string;
-        settledAt?: number;
-        fundingRef?: string;
-        kind?: string;
-    }) => void | Promise<void>;
+    createJob(body: {
+        input: string;
+        params?: Record<string, string>;
+    }, requesterId: string, payment: PaymentInfo, requiredMsats: number | undefined, capability: string, requesterTokenHash?: string, provenance?: {
+        requesterToken?: string;
+        requestFingerprint?: string;
+        requesterPubkey?: string;
+        requestId?: string;
+        authRequestPath?: string;
+        /**
+         * Pre-allocated id from {@link allocateJobId} (internal-review) — the submit
+         * path allocates before payment verification so the ledger draw can
+         * record the job it pays for.
+         */
+        jobId?: string;
+    }): ServerJob;
+    /** Build an SDKJobContext and attach it to the job. */
+    buildAndAttachContext(job: ServerJob, parsedInput: unknown): SDKJobContext<State, ResolvedInput<InputSchema>>;
+    /** Start the handler for a job. */
+    runHandler(job: ServerJob, sdkCtx: SDKJobContext<unknown, unknown>): void;
+    /** Dispatch a validated incoming message to the appropriate handler or pending resolver. */
+    dispatchMessage(job: ServerJob, type: MessageType, content: unknown): Promise<void>;
     /**
-     * Callback fired when the stale-job reaper force-fails a *paid* job — its
-     * pending credit draw is released rather than settled, because only a
-     * completed job settles a draw (internal-review). Container-runtime DVMs wire this
-     * to a paid-job-death report → operator `notice` (internal-review). Never fires for
-     * free jobs (`paidMsats === 0`). Fired fire-and-forget so a throw or a slow
-     * report can't wedge the sweep.
+     * Persist a job to the backing store.
+     *
+     * Awaits the per-job appender tail (internal-review) so that:
+     *   1. The snapshot's `messages` is consistent with the `job_messages` table
+     *      — no row is still in flight at snapshot time.
+     *   2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
+     *      can't race a still-pending `appendOutgoing` for the final yield
+     *      message (which would otherwise wipe the row before an in-flight SSE
+     *      subscriber's NOTIFY-driven fetch can see it).
      */
-    onPaidJobDeath?: (info: {
-        dvmId: string;
-        jobId: string;
-        capability: string;
-        paidMsats: number;
-        rail: string;
-        reason: "worker_died_mid_job" | "stale_no_terminal_status";
-        nativeAmount?: number;
-        nativeAsset?: string;
-        paymentMint?: string;
-    }) => void | Promise<void>;
+    persistJob(job: ServerJob): Promise<void>;
     /**
-     * Callback fired when a settled credit draw cannot book a revenue event
-     * because no usable payment rail is available (internal-review). Container-runtime
-     * DVMs auto-wire this to the platform's deduped operator notice. Fired
-     * fire-and-forget so alert delivery cannot block terminal handling or draw
-     * reconciliation.
+     * Cross-machine terminal guard (internal-review). `buildContext`'s guard reads the
+     * in-memory `job.status`, so on its own it only protects the machine running
+     * the handler. On a multi-machine DVM a `DELETE /v1/job/:id` routinely lands
+     * on a machine that isn't running the job — `app.ts` cancels it in the store
+     * and this process learns of it only through the durable row.
+     *
+     * Adopting the durable status blocks the rest of the handler's writes via the
+     * local guard, makes `handleJobTerminal` see a non-completed job so it skips
+     * the revenue report, rejects a suspended handler's prompt/payment yields, and
+     * fires `job.abort` so in-flight `ctx.fetch` calls tear down. Returns true when
+     * the durable state won and the caller must skip its save.
+     *
+     * Two triggers: `watchDurableStatus`'s NOTIFY subscription (internal-review) fires
+     * this within a round-trip of the remote cancel committing, which is what
+     * actually stops the provider spend; `persistJob` calls it again on every save
+     * as the backstop for the window where a cancel commits between a handler's
+     * read and its write (the check-then-write it can still lose is covered by the
+     * stores' terminal-sticky `save`, which keeps the row itself correct).
      */
-    onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
+    private adoptDurableTerminal;
     /**
-     * Stale-job sweep threshold in ms (internal-review). Jobs in a non-terminal status
-     * (`processing` / `working` / `awaiting-input`) whose `lastActivityAt` is
-     * older than this are force-cancelled with reason `stale_no_terminal_status`,
-     * so callers always reach a terminal status instead of polling forever after
-     * a worker crash, OOM, or silent `messageAppender` failure. Default:
-     * `2 × descriptor.idleTimeout + STALE_JOB_WATCHDOG_HEADROOM_MS`, matching
-     * the internal-review acceptance criterion against scrape's `JOB_TIMEOUT_MS`.
-     * Builders whose per-handler wall-clock bound exceeds 90s must override
-     * this — otherwise the watchdog fires on a legitimate in-flight handler.
-     * Set to `0` to disable (test seam).
+     * Watch the durable status of a locally-active job (internal-review).
+     *
+     * `ctx.signal` is raised by `dispatchMessage`, which only runs on the machine
+     * holding the job in `activeJobs`. On a multi-machine DVM the `DELETE` usually
+     * lands somewhere else, and that machine's store-only cancel (`cancelJob`)
+     * commits the terminal status, appends the `cancel` message, and `pg_notify`s
+     * in one transaction. This subscription is how the handler's machine hears it:
+     * on each notify, re-read the durable status and adopt it if it went terminal.
+     * Without it, the handler only notices at its next store write, and the
+     * in-flight provider call — the spend the cancel was meant to stop — runs to
+     * completion.
+     *
+     * Every locally-emitted message notifies this machine too, so the re-read is
+     * coalesced: at most one `getCounters` in flight per job, and none once the
+     * job is locally terminal.
      */
-    staleJobTimeoutMs?: number;
+    private watchDurableStatus;
     /**
-     * Sweep interval for the stale-job watchdog. Default: `min(60s, max(15s,
-     * tightestActiveTimeout / 4))`. Tests override to fire deterministically.
+     * Tear down a job's durable-status subscription (internal-review). Must be called
+     * wherever a job leaves `activeJobs` — a leaked subscriber outlives the job on
+     * the store's shared LISTEN connection. Idempotent.
      */
-    staleJobSweepIntervalMs?: number;
+    unwatchDurableStatus(jobId: string): void;
     /**
-     * Worker-liveness watchdog in ms (internal-review). Jobs in `processing`/`working`
-     * whose `lastActivityAt` is older than this are marked `failed` (dead
-     * worker), separately from the longer `awaiting-input` idle timeout above.
-     * Default: `descriptor.processingWatchdog * 1000` or
-     * `DEFAULT_PROCESSING_WATCHDOG_MS`. Set to `0` to disable (test seam).
+     * NOTIFY-driven durable-status re-read, coalesced per job (internal-review).
+     *
+     * A notify that arrives while a re-read is in flight is queued rather than
+     * dropped: the in-flight read may have observed the row a moment *before* the
+     * cancel committed, and dropping its notify would put the abort back where
+     * this issue found it — waiting for the handler's next store write.
      */
-    processingWatchdogMs?: number;
+    private checkDurableTerminal;
     /**
-     * Interval at which locally-active `processing`/`working` jobs have their
-     * `lastActivityAt` bumped so the processing watchdog only fires on a truly
-     * dead worker (internal-review). Default: `DEFAULT_HEARTBEAT_INTERVAL_MS`. Set to
-     * `0` to disable (test seam). Also floors how far the internal-review clock guard
-     * may compensate a backwards step on the processing arm — a cadence close to
-     * `processingWatchdogMs` leaves it no room and it compensates nothing.
+     * Wire the Tx A appender when the store supports streaming.
+     *
+     * Tx A (internal-review): outgoing message + `pending_payment_msats` bump land in
+     * the same transaction. The DB allocates the row's seq via
+     * `UPDATE jobs SET next_seq = next_seq + 1 RETURNING` so concurrent inbound
+     * traffic on different machines can never collide on the `(job_id, seq)` PK.
+     * In-memory `job.seq` keeps its own counter for same-machine SSE listeners.
+     *
+     * Per-job serialisation (internal-review): chained through `job.messageAppenderTail`
+     * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
+     * `complete`) commit their `appendOutgoing` transactions in call order.
+     * Without this, the two transactions race for the `jobs` row lock and the
+     * DB-side seq can be allocated in the opposite order — which both renumbers
+     * the persisted messages and reorders the NOTIFY events feeding the
+     * cross-machine SSE subscriber. The subscriber closes the stream on the
+     * first yield message it sees, so a NOTIFY for `complete` arriving before
+     * `artifact`'s NOTIFY silently drops the artifact.
      */
-    heartbeatIntervalMs?: number;
+    private wireMessageAppender;
+    /** Start (or restart) the idle timer for a job. */
+    startIdleTimer(job: ServerJob): void;
+    /** Clear the idle timer for a job. */
+    clearIdleTimer(id: string): void;
+    /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard (internal-review). */
+    cancelJobIdle(job: ServerJob): Promise<void>;
     /**
-     * Age in ms at which a `pending` credit draw whose `job_id` matches no row in
-     * the job store is released as orphaned (internal-review). The draw commits before
-     * the job row is persisted, so a crash or a fail-closed refusal in that
-     * window strands a hold no terminal path can ever reach. Must stay
-     * comfortably above the submit path's draw→persist latency. Set to `0` to
-     * disable the watchdog entirely — stranded holds then stay stranded, so
-     * treat it as a money knob, not a tuning one. Default:
-     * {@link DEFAULT_ORPHAN_DRAW_AGE_MS}.
+     * Force-terminate stale non-terminal jobs. Two status-aware arms:
+     *   • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
+     *     (`stale_no_terminal_status`) — the caller never paid / responded.
+     *   • `processing`/`working` past `processingWatchdogMs` → `failed`
+     *     (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
+     *     live workers fresh, so a stale row here means a dead process.
+     *
+     * Fires on a timer (wired in the constructor) and also callable on demand
+     * (tests, ops). The CAS in `cancelStaleJob` makes this safe to run
+     * concurrently from multiple DVM machines. Scoped to capabilities this
+     * JobManager owns so multi-mount hosts don't steal stuck rows from sibling
+     * descriptors — the local activeJobs teardown only makes sense on the
+     * JobManager that actually hosted the zombie handler.
+     *
+     * **Both cutoffs float off the wall clock (internal-review).** Each is one
+     * `Date.now()` sample compared against `last_activity_at`, stamped from a
+     * different sample at a different moment, so a backwards step between the
+     * two makes every row look more recently active than it is: the query
+     * matches nothing and both arms go silent for the length of the skew. The
+     * dead worker's job keeps its `processing` status, its credit hold stays
+     * `pending`, and the internal-review paid-job-death alert — wired to this reaper —
+     * never fires. Same defect, same host class, as internal-review's orphan sweep.
+     *
+     * **The compensation is capped** — see {@link staleSweepCompensationCapMs}
+     * for where each arm's cap comes from — which internal-review did not need to do. Its eagerness costs at worst an early release
+     * of an unclaimed hold, refused outright for any live job row; ours
+     * force-*fails* a running job. `cancelStaleJob`'s CAS does not cover that:
+     * `expectedActivityBefore` is the same compensated threshold the query used,
+     * and a live worker's post-step heartbeat writes the low, post-step
+     * `Date.now()`, so `last_activity_at <= expectedActivityBefore` still holds.
+     * The CAS guards a job checking in *between* the find and the claim with a
+     * stamp above the cutoff — a race, not a clock.
+     *
+     * **Some blindness is inherent, and no cap choice removes it.** A backwards
+     * step of `S` inverts the stamp ordering: everything stamped after it reads
+     * `S` older than everything stamped before. A live worker heartbeating right
+     * now stamps `wall - S`; a job genuinely idle for `age` stamps `wall - age`.
+     * The stale row is the lower of the two — the one a cutoff reaches first —
+     * only once `age` exceeds `S`. Below that the reaper cannot tell them apart,
+     * so any cutoff that claimed the stale job would force-fail every live
+     * worker on the host with it. The cap picks where on that curve to sit: on
+     * the defaults a row must have been silent for `S + window / 2`, and a live
+     * worker keeps five missed heartbeats of margin. The
+     * alternative to a missed reap is mild and self-healing — the orphan sweep
+     * backstops the hold, and the arm recovers when the wall catches up. The
+     * alternative to a false reap is an irreversible force-fail of paid work.
+     *
+     * The stamps themselves stay wall-clock epoch-ms on purpose — they are
+     * written by whichever machine touched the job and read by every other one,
+     * so only the reading side can float.
      */
-    orphanDrawAgeMs?: number;
+    sweepStaleJobs(): Promise<{
+        swept: number;
+    }>;
     /**
-     * Age in ms at which a `pending` credit draw whose job row **is** terminal is
-     * reconciled against that row's outcome (internal-review) — settled for a
-     * `completed` job, released for a `failed`/`cancelled` one. Covers the hole
-     * `orphanDrawAgeMs` cannot: `resolveCreditDraw` throwing on a ledger error
-     * leaves a terminal job whose hold no later path retries.
+     * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
+     * clock to cover a backwards step (internal-review). The compensation is capped,
+     * not free: a claimed row must still have been silent for
+     * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
+     * force-fails a job that may well be alive.
      *
-     * Rides the same scan as the orphan arm, which has two consequences for the
-     * value you set here. Setting `orphanDrawAgeMs` to `0` disables this arm too.
-     * And the effective gate is `max(orphanDrawAgeMs, terminalDrawReconcileAgeMs)`
-     * — the scan never returns a row younger than its own cutoff, so anything
-     * below `orphanDrawAgeMs` is silently clamped up to it. That floor is
-     * deliberate rather than a wart: honouring a narrower value would mean
-     * widening the scan, which hands the orphan arm rows younger than
-     * `orphanDrawAgeMs` that it must not release. It can only ever delay a
-     * settle, never advance one, which is the safe direction for a debit.
+     * **Half the window** is the floor that governs a wide window — five missed
+     * heartbeats on the processing defaults. On the `awaiting-input` arm it also
+     * preserves a real invariant: with the derived
+     * `2 x idleTimeout + headroom`, half is `idleTimeout + 45s`, so the sweeper
+     * still cannot fire before the in-process idle timer would have. (A builder
+     * who overrides `staleJobTimeoutMs` below `2 x idleTimeout` has already
+     * opted out of that, guard or no guard.)
      *
-     * Set to `0` to disable this arm alone — a money knob, not a tuning one.
-     * Default: {@link DEFAULT_TERMINAL_DRAW_RECONCILE_AGE_MS}.
+     * **Two heartbeat intervals** is the floor that governs a window configured
+     * close to the beat cadence — `processingWatchdog: 40` against the 30s
+     * default beat, where half the window is less than one beat and a worker
+     * heartbeating exactly on schedule would be reaped the moment the host's
+     * clock stepped. That pair is marginal already; the guard must not make it
+     * deterministic. The cap collapses to zero there, which is today's
+     * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
+     * — nothing heartbeats it by design, and its refresh is an inbound caller
+     * message on no cadence at all.
+     *
+     * **Why a magnitude and not a predicate.** The tempting sharper rule is to
+     * compensate per row, fully, for any stamp that reads ahead of our wall —
+     * one our own post-step heartbeat could not have written. It is unsafe: a
+     * future-stamped row is equally what a live job heartbeated by a peer whose
+     * clock runs fast looks like, and from the stamp alone the two are
+     * indistinguishable. The same reasoning bounds the cap from the other side —
+     * while our clock is stepped, the guard force-fails the live jobs of any
+     * peer slower than `windowMs - cap`, which is 2.5 minutes of tolerated
+     * disagreement on the defaults, far outside anything NTP-managed hosts show.
      */
-    terminalDrawReconcileAgeMs?: number;
+    private staleSweepCompensationCapMs;
     /**
-     * Sweep interval for the orphan-draw watchdog. Default:
-     * {@link DEFAULT_ORPHAN_DRAW_SWEEP_INTERVAL_MS}. Set to `0` to disable — the
-     * test seam, since suites drive `sweepOrphanDraws()` directly.
-     */
-    orphanDrawSweepIntervalMs?: number;
+     * Redact terminal job content beyond this DVM's configured window.
+     *
+     * The scan advances over every candidate, including rows that fail draw
+     * resolution, so one money-path fault cannot starve everything behind it.
+     * Any failed row remains unredacted and the next tick restarts from the head;
+     * a page-capped clean pass instead retains its cursor and resumes at the
+     * tail. Failure and recovery callbacks are awaited but never allowed to
+     * change the sweep result.
+     */
+    sweepJobRetention(): Promise<{
+        examined: number;
+        redacted: number;
+        complete: boolean;
+    }>;
+    /** Resolve every hold and persist any configured receipt before content disappears. */
+    private prepareJobForRedaction;
+    private notifyJobRetentionFailed;
+    private notifyJobRetentionRecovered;
     /**
-     * Grace window in ms a reactivating machine waits for a live original handler
-     * to win the single-execution claim before replaying an `awaiting-input` job
-     * itself (internal-review). Default: `DEFAULT_REACTIVATION_CLAIM_GRACE_MS`. Widen if
-     * cross-machine NOTIFY latency causes spurious double executions; lower in
-     * tests for speed.
+     * Resolve `pending` credit draws the terminal funnel can no longer reach.
+     * Two arms over one scan, distinguished by whether the draw's job row exists.
+     *
+     * **No job row (internal-review) — release.** internal-review allocates the job id and
+     * commits the ledger draw, with its `job_id` linkage, before `recordReplay`
+     * and `persistJob` write the job row. A crash, a `draw_conflict` 409, or a
+     * fail-closed `replay_detected` 401 in that window leaves a committed hold
+     * that **no** terminal path can ever reach: `issueReceipt` →
+     * `resolveCreditDraw` keys off the `creditId`/`drawId` persisted on the job
+     * row, so with no row there is no release path at all and the caller's
+     * available balance stays reduced forever. Cosmetic for an implicit N=1
+     * credit, a silent balance shrink for an explicit N>1 one.
+     *
+     * **Terminal job row (internal-review) — reconcile to its outcome.** The funnel
+     * demonstrably fails: `resolveCreditDraw` throws on a ledger/DB error,
+     * `issueReceipt` catches it, logs `credit_resolve_failed` and returns
+     * nothing, and until now nothing retried. Same stranded hold, reached through
+     * a different door — and for a `completed` job it strands the platform's
+     * books too, since draws *are* the revenue events (internal-review): the caller is
+     * charged nothing, the balance never moves, and outstanding liability
+     * (`deposits − draw revenue`) overstates forever. So a late settle books, off
+     * the committed draw row, through the ordinary reporter path.
+     *
+     * **A non-terminal job row is still never touched** — the stale-job sweep
+     * above drives those to terminal first, and its `issueReceiptForStoredJob`
+     * resolves the draw on the way. Those skipped holds are why the scan
+     * keyset-paginates rather than re-reading one batch: they stay `pending`
+     * indefinitely (an `awaiting-input` job on a 30-minute idle timeout sits well
+     * past the orphan cutoff), so a fixed first page of them would starve every
+     * real orphan behind it, on every tick, forever. The cursor advances over
+     * every row examined; a tick that hits {@link ORPHAN_DRAW_SWEEP_MAX_PAGES}
+     * logs `orphan_draw_sweep_truncated` and the next one resumes where it
+     * stopped, so progress is bounded per tick but never blocked.
+     *
+     * Fires on a timer (wired in the constructor) and also callable on demand
+     * (tests, ops). Both `settle` and `release` are idempotent under the credit
+     * row's `FOR UPDATE`, so concurrent sweepers on several machines — and a
+     * sweeper racing the in-line funnel — resolve the hold exactly once; the
+     * losers see `replayed: true` and book nothing.
      */
-    reactivationClaimGraceMs?: number;
-}
-type ResolvedInput<I extends ZodLike | undefined> = I extends ZodLike<infer O> ? O : string;
-/**
- * A deposit this payment funded that the job row did **not** take (internal-review).
- *
- * Reached when two mid-job top-ups race on a free-then-paid job: each opens its
- * own implicit credit, and `verifyAndCredit`'s set-if-null bind keeps one. The
- * loser's money is real, owned by the caller, and reclaimable — but nothing
- * named it, so the caller would have to derive `imp:<rail>:<payment_id>` to
- * reach their own balance. This rides the 201 so they don't have to.
- *
- * The response is the fast surface, not the only one: the credit is opened
- * under the caller's verified pubkey, so `POST /v1/credit` op `balance` lists
- * it and op `drain` reclaims it once the hold resolves.
- */
-interface UnappliedCredit {
-    credit_id: string;
-    credited_micro: number;
-    credit_currency: string;
-    display: string;
-    hint: string;
-}
-/**
- * What {@link JobManager.processPayment} tells the route. `error` is a refusal
- * to serialise verbatim; otherwise the payment was accepted, optionally
- * carrying an {@link UnappliedCredit} to fold into the 201.
- */
-type ProcessPaymentOutcome = {
-    error: {
-        body: Record<string, unknown>;
-        status: number;
-    };
-    unappliedCredit?: undefined;
-} | {
-    error?: undefined;
-    unappliedCredit?: UnappliedCredit;
-};
-/**
- * Transport-agnostic job lifecycle manager.
- *
- * Handles job creation, handler invocation, message dispatch, persistence,
- * idle timeout, and durable replay. Shared by both the HTTP server and
- * relay provider.
- */
-declare class JobManager<State, InputSchema extends ZodLike | undefined> {
-    private readonly descriptor;
-    private readonly opts;
-    private readonly _activeJobs;
-    private readonly jobStore;
-    private readonly idleTimers;
-    private readonly cleanupTimers;
-    /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
-    private readonly statusWatchers;
-    /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
-    private readonly statusChecksInFlight;
-    /** Job ids that were notified mid-re-read and must be re-checked (internal-review). */
-    private readonly statusChecksQueued;
-    private readonly sessionId;
-    private nextJobId;
-    private accumulatorMonitor?;
-    private readonly staleJobTimeoutMs;
-    private readonly processingWatchdogMs;
-    private readonly reactivationClaimGraceMs;
+    sweepOrphanDraws(): Promise<{
+        released: number;
+        reconciled: number;
+    }>;
     /**
-     * Worker-heartbeat cadence (internal-review). Also floors the internal-review clock
-     * guard's compensation on the processing arm — see
-     * {@link staleSweepCompensationCapMs}.
+     * The end-of-scan line for a tick that resolved nothing (internal-review, extended
+     * by internal-review). Two shapes are worth a warning, and neither is the ordinary
+     * one — the timer runs every 5 minutes per ledger in production.
+     *
+     * `examined > 0`: aged candidates were looked at and none moved. Usually
+     * legitimate (their jobs are still running, or terminal inside the reconcile
+     * grace period), but it is also what a silently skipped hold looks like.
+     *
+     * `examined === 0`: the query returned nothing. Ordinarily that means there
+     * is nothing to do — but it is equally what a blinded scan looks like, which
+     * is the case the internal-review gate could not reach. Probe for the oldest
+     * `pending` hold at any age and speak up when one exists the scan should
+     * have seen and didn't: already past the age gate outright, stamped ahead of
+     * our clock (some other process's clock is fast), or hidden while our own
+     * clock is held forward over a backwards step. A ledger holding nothing but
+     * young draws stays quiet.
+     *
+     * The probe is diagnostics, so it is wrapped: a tick that swept cleanly must
+     * never report failure because the extra read fell over. A probe that throws
+     * says so on the same line rather than replacing the tick's outcome.
      */
-    private readonly heartbeatIntervalMs;
-    private readonly orphanDrawAgeMs;
-    private readonly terminalDrawReconcileAgeMs;
-    private staleSweepTimer?;
-    private heartbeatTimer?;
-    private orphanDrawSweepTimer?;
-    /** This manager holds {@link ORPHAN_SWEEP_CLAIMS} for its ledger. */
-    private orphanSweepClaimed;
-    /** Where a page-capped tick left off; cleared once a tick reaches the end. */
-    private orphanSweepResumeFrom?;
+    private reportSweepOutcome;
     /**
-     * A `Date.now()` reading that cannot regress within this manager's lifetime
-     * (internal-review). Anchored at construction, so a manager already running when
-     * the clock stepped is covered. The stale-job sweep's two cutoffs, the
-     * orphan-draw age gate and the reactivation claim grace all read it; see
-     * {@link createMonotonicClock} for what it costs and where it is clamped.
+     * Resolve one aged `pending` draw whose job row reached terminal (internal-review),
+     * mirroring what `resolveCreditDraw` would have done in line. Returns true
+     * when this call is the one that moved the draw — the caller counts it, and
+     * only it books.
+     *
+     * **The settle is gated on the job row naming _this_ draw.** The scan finds
+     * the draw by `credit_draws.job_id`, but the job's own `credit_id`/`draw_id`
+     * are written by a *later* transaction than the one that committed the draw
+     * (`verifyIncomingPayment` commits fund+draw; `verifyAndCredit` binds the
+     * row), and a free-then-paid job binds set-if-null. A store failure or a
+     * second concurrent top-up therefore leaves a hold tagged with the job whose
+     * row points somewhere else, or nowhere. Settling that would debit the caller
+     * a second time for one job — and invisibly, since `revenue_events`'
+     * `UNIQUE (dvm_id, job_id, rail)` would drop the booking. So an unbound hold
+     * is **released**, never settled: the job's payment was the draw it is bound
+     * to, and this one bought nothing.
+     *
+     * Concurrency needs no guard of its own. `settle`/`release` run under the
+     * credit row's `FOR UPDATE`, so exactly one caller — a sibling reconciler,
+     * or the in-line funnel arriving late — sees `replayed: false`, which makes
+     * the booking gate a true mutex rather than a hopeful one. The one race left
+     * open is another machine's `handleJobTerminal` stalled between resolving the
+     * draw and booking it, which would double-report; the platform's
+     * `(dvm_id, credit_id, draw_id)` and `(dvm_id, job_id, rail)` unique indexes
+     * absorb that.
+     *
+     * `invalid_draw_state` — the funnel having already resolved the draw to the
+     * other state — is the expected loss, logged and swallowed like the orphan
+     * arm's, so one contended hold can't strand the rest of the batch.
      */
-    private readonly monotonicNowMs;
-    private sweepInFlight;
-    private orphanSweepInFlight;
-    private heartbeatInFlight;
+    private reconcileTerminalDraw;
     /**
-     * The denomination of every credit this DVM opens (internal-review). Resolved once,
-     * with the same boundary fallback `DVMServer` applies for direct JavaScript
-     * callers that force an incomplete value past the descriptor contract.
+     * Refresh `lastActivityAt` for jobs this process is actively running
+     * (`processing`/`working`) so the processing watchdog only fires once the
+     * worker is genuinely dead (internal-review). `awaiting-input` jobs are
+     * deliberately excluded — their idle timeout must still elapse. Fires on the
+     * heartbeat timer; also callable on demand for tests.
      */
-    private readonly pricingCurrency;
-    constructor(descriptor: DVMDescriptor<State, InputSchema>, opts: JobManagerOpts);
-    /** Active in-memory jobs. */
-    get activeJobs(): Map<string, ServerJob>;
-    /** The backing job store. */
-    get store(): JobStore;
+    heartbeatActiveJobs(): Promise<{
+        beat: number;
+    }>;
     /**
-     * True when this DVM will actually issue receipts (internal-review) — a key *and*
-     * a store that can allocate sequence numbers and persist bytes write-once.
-     * `/v1/info#receipts` reads this rather than the key alone, so the flag can
-     * never promise something `issueReceipt` silently declines to do.
+     * Single-execution claim for a reactivating machine (internal-review). Before
+     * replaying an `awaiting-input` job, wait a bounded grace window for a live
+     * original handler to win the `awaiting-input → processing` CAS via its
+     * NOTIFY wake. Resolves:
+     *   • `false` — the row left `awaiting-input` during the window (the original
+     *     handler claimed it / drove it terminal). Stand down; do not replay.
+     *   • `true`  — the window elapsed still `awaiting-input` (the original worker
+     *     is gone or has no live resolver) AND this machine won the claim CAS.
+     *     Replay for dead-worker recovery.
+     *
+     * Biasing the original handler to win kills the double execution (double
+     * substrate spend, clobbered artifact) without heartbeating `awaiting-input`
+     * (which would break the caller-input idle timeout). Non-streamable stores
+     * have no cross-machine race, so the claim is a no-op `true`.
      */
-    get receiptsEnabled(): boolean;
-    /** True when the named capability exists on this descriptor. */
-    hasCapability(name: string): boolean;
-    /** Names of every capability this descriptor exposes — used for error envelopes. */
-    capabilityNames(): string[];
+    claimAwaitingInputForReactivation(jobId: string): Promise<boolean>;
     /**
-     * Resolve a capability's static `price` to msats (internal-review).
+     * Record an inbound client message durably via Tx B (internal-review) and append
+     * it to the in-memory `job.messages` array. Returns the DB-allocated seq
+     * (`null` when the store isn't streamable — non-Postgres test fallback).
      *
-     * `"$X.XX"` is parsed as USD and converted via the SDK's shared fx fetcher.
-     * Returns `undefined` for dynamic-priced capabilities (those that declare
-     * `onQuote`) — the caller falls back to `computeDynamicPrice` in that path.
+     * Status starts as `pending-verification`; a follow-up Tx C call
+     * (`processPayment` for payments, `markInboundVerified` for everything
+     * else) transitions it to `verified` once the inbound is accepted.
      */
-    currentPriceMsats(capability: string): Promise<number | undefined>;
+    recordInboundPending(job: ServerJob, msgType: MessageType, msgContent: Record<string, unknown>): Promise<number | null>;
     /**
-     * Translate a capability's static `price` into the fiat envelope used by
-     * the per-capability `pricing.max` advertised on `/v1/info` (internal-review).
-     * Returns `undefined` for dynamic-priced capabilities and for unknown
-     * names (the route handler validates the name before invoking this).
+     * Tx C complement for non-payment inbound messages — flip the row to
+     * `verified` so cross-machine readers see it via `subscribeMessages`.
      */
-    currentPricingMax(capability: string): {
-        amount: number;
-        currency: string;
-    } | undefined;
+    markInboundVerified(jobId: string, inboundSeq: number | null): Promise<void>;
     /**
-     * Parse a request body through a capability's input schema (internal-review).
-     *
-     * Resolution order when a capability declares an `input` schema:
-     * 1. `body.data` is preferred — agents pass structured fields directly
-     *    (CLI builds this from `--param k=v`).
-     * 2. Fallback: `JSON.parse(body.input)` for clients still on the legacy
-     *    JSON-string contract.
-     * 3. Neither usable → throw `MissingStructuredInputError` so the route can
-     *    return `invalid_input` with a hint pointing at `/v1/info`.
+     * Reactivate a suspended/event-driven job from the store. Builds the
+     * in-memory `ServerJob`, wires the appender, builds the context, starts
+     * the idle timer. The caller has already recorded the inbound via Tx B
+     * and run Tx C (verify + credit); reactivation is now decoupled from
+     * credit (internal-review, internal-review). The caller decides whether to run the
+     * handler (Pattern A: status was `awaiting-input`) or to dispatch the
+     * message to a custom handler (Pattern B).
      *
-     * When the capability has no `input` schema, returns `body.input` raw
-     * (primitive path).
+     * For DVMs that declare descriptor-level auth, the persisted
+     * `record.input` carries the original signed envelope. We re-verify the
+     * signature here (internal-review) so a DB-layer tamper — compromised admin, SQL
+     * injection, malicious operator with DB access — can't silently feed an
+     * attacker-supplied pubkey/envelope into the handler. The drift window
+     * and replay store are deliberately skipped: the persisted timestamp is
+     * from the original signing instant (long past the 5-min drift bound for
+     * any long-running job), and the nonce was already committed at submission.
+     * On failure: throws `SignedRequestError` ({@link AuthSchemaError} when
+     * the capability has no input schema to verify against); the caller is
+     * expected to mark the row failed and surface a 401 / 500 to the inbound
+     * caller.
      *
-     * The internal-review credit envelope is removed before the schema runs, on both
-     * branches (internal-review) — it rides the signed body but is protocol-level, so a
-     * top-level `.strict()` capability schema would otherwise reject every
-     * explicit draw as an unknown key, before the envelope was even extracted.
-     * The persisted `record.input` the internal-review reactivation path re-reads is the
-     * pre-Zod wire form, so it comes through the second branch carrying them too.
-     */
-    parseInput(body: {
-        input?: string;
-        data?: unknown;
-    }, capability: string): unknown;
-    /**
-     * Look up the per-capability descriptor by name (internal-review). Throws when the
-     * name doesn't exist — the route layer validates body.capability first, so
-     * reaching this with an unknown name is a programmer error.
+     * What gets re-verified is the persisted row read back through
+     * {@link signedRequestInput} — `app.ts` stores the pre-Zod wire form, so
+     * those are the caller's own signed bytes, the same ones `/v1/quote` and the
+     * submit checked (internal-review). That makes the tamper check strictly stronger
+     * than the parsed form it replaced: an injected key the capability schema
+     * doesn't declare used to be stripped before the signature was checked, so
+     * it re-verified clean.
      */
-    private requireCapability;
+    reactivateJob(record: JobRecord): {
+        job: ServerJob;
+        sdkCtx: SDKJobContext<unknown, unknown>;
+    };
     /**
-     * Soft capability lookup — `undefined` when the name isn't defined. The
-     * single place the `descriptor.capabilities` index cast lives; callers that
-     * tolerate a missing capability (the route layer pre-validates, or the cap
-     * was deleted from the descriptor after a job was persisted) route through
-     * here instead of re-casting inline.
+     * Verify an inbound payment and apply the credit via Tx C (internal-review).
+     * The inbound message must have been recorded via Tx B already
+     * (`recordInboundPending` returned `inboundSeq`). For non-streamable
+     * stores (`inboundSeq === null`), falls back to in-memory mutation via
+     * `applyPaymentInfoToJob`.
+     *
+     * Dev-mode short-circuit: auto-credits the outstanding
+     * `pendingPaymentMsats` without external verification. Gated on
+     * `devModeSkipsPaymentVerification` — the same predicate the upfront path
+     * reads, so a dev server wired to a mint verifies mid-job payments for real
+     * (internal-review) — plus the explicit `dev_auto` opt-out the dev console uses,
+     * which is the one caller that has no wallet to pay from. `dev_auto` loses to
+     * any proof riding the same message: money on the wire always takes the rail,
+     * so the flag can never leave a real token unspent against a credited job.
+     *
+     * Tx C is not atomic with the rail commit (internal-review). `verifyIncomingPayment`
+     * commits the proofs *and* the ledger leg in one transaction and returns;
+     * only then does `verifyAndCredit` write the job row, on its own connection.
+     * Everything after that call therefore runs with the caller's money already
+     * moved, which is why the write is retried rather than left to throw, and why
+     * an exhausted retry answers with the credit it landed on instead of a bare
+     * 500. See `creditInbound`.
      */
-    private getCapability;
+    processPayment(job: ServerJob, body: {
+        type: MessageType;
+        content: Record<string, unknown>;
+    }, inboundSeq: number | null, extra?: {
+        lockPubkeys?: LockPubkey[];
+        mintHealthTracker?: MintHealthTracker;
+    }): Promise<ProcessPaymentOutcome>;
     /**
-     * Allocate the id the next job will be created under (internal-review). The
-     * submit path calls this BEFORE payment verification so the ledger draw
-     * commits with its job linkage, then passes the id back through
-     * `createJob`'s provenance. Ids allocated for requests whose payment is
-     * refused are simply never used — the sequence has gaps, which nothing
-     * reads meaning into.
+     * Tx C with a bounded retry (internal-review).
+     *
+     * By the time this runs on the verified path, the rail commit and the ledger
+     * leg have already committed in a transaction this call is not part of — so a
+     * throw here is money moved against a job row that records none of it, and
+     * letting it propagate was the bug. A transient store error is the ordinary
+     * cause and a second attempt clears it.
+     *
+     * The retry is safe by construction, not by convention: `verifyAndCredit`
+     * CASes on `job_messages.status = 'pending-verification'` inside its own
+     * transaction, so a call whose COMMIT actually landed before the ack was lost
+     * finds the row already `verified` and returns `alreadyVerified: true`
+     * carrying the counters and binding that first attempt committed. Re-applying
+     * the delta is impossible either way.
+     *
+     * That argument covers every attempt but the last, whose error nothing
+     * re-checks — and a connection-level fault is exactly the shape that loses
+     * the ack on *all* of them, idempotent replays included (the no-op path
+     * COMMITs too). So the exhausted path asks the row before reporting a
+     * failure: `getVerifiedInbound` reads, transaction-free, whether a Tx C for
+     * this seq committed. Without it a fully credited, fully bound job answers
+     * `payment_unapplied` and invites a retry, and a caller who takes it pays
+     * twice for one ask — the second payment growing the now-bound draw and
+     * settling as revenue.
+     *
+     * The read runs on the pool that just failed those COMMITs, so it is retried
+     * too, and a read that fails all the way through is reported as *unknown*
+     * rather than as nothing: `CreditInboundExhaustedError.readError` is what
+     * separates "checked the row, nothing landed" from "couldn't check", both on
+     * the operator's log line and in the copy the caller acts on.
      */
-    allocateJobId(): string;
+    private creditInbound;
     /**
-     * Create a new job from a request body. `provenance` (internal-review) is what the
-     * idempotent-replay path on `POST /v1/job` reads back: the raw `job_token`
-     * to re-issue, and the fingerprint + caller pubkey a retry must reproduce
-     * to be given it.
-     */
-    createJob(body: {
-        input: string;
-        params?: Record<string, string>;
-    }, requesterId: string, payment: PaymentInfo, requiredMsats: number | undefined, capability: string, requesterTokenHash?: string, provenance?: {
-        requesterToken?: string;
-        requestFingerprint?: string;
-        requesterPubkey?: string;
-        requestId?: string;
-        authRequestPath?: string;
-        /**
-         * Pre-allocated id from {@link allocateJobId} (internal-review) — the submit
-         * path allocates before payment verification so the ledger draw can
-         * record the job it pays for.
-         */
-        jobId?: string;
-    }): ServerJob;
-    /** Build an SDKJobContext and attach it to the job. */
-    buildAndAttachContext(job: ServerJob, parsedInput: unknown): SDKJobContext<State, ResolvedInput<InputSchema>>;
-    /** Start the handler for a job. */
-    runHandler(job: ServerJob, sdkCtx: SDKJobContext<unknown, unknown>): void;
-    /** Dispatch a validated incoming message to the appropriate handler or pending resolver. */
-    dispatchMessage(job: ServerJob, type: MessageType, content: unknown): Promise<void>;
+     * Answer a payment whose rail and ledger legs committed but whose job row
+     * could not be written (internal-review) — every retry spent, the money real.
+     *
+     * The refusal names the credit the money landed on so the caller can act on
+     * it directly, mirroring the short mid-job pay's 402 (`payment.ts`). It is a
+     * 500 rather than a 402 on purpose: the payment was valid and was accepted,
+     * so telling the caller it was insufficient would be a lie, and this is a
+     * fault an operator should see in their 5xx rate. `retryable` is true because
+     * the ask is genuinely still outstanding.
+     *
+     * Nothing is released here. The hold is left to the internal-review reconciler,
+     * which makes the same decision — unbound draw ⇒ release, never settle — but
+     * under the credit row's `FOR UPDATE`, after the job is terminal, where it
+     * cannot race an in-flight COMMIT. Releasing from here would also be
+     * irreversible: a released draw can be neither re-grown nor re-opened, so one
+     * bad call would silently de-ledger every later top-up on the job.
+     *
+     * Whether the row was *read* is load-bearing on both surfaces. When the
+     * post-exhaustion read-back failed as well, `credit_job_row_unwritten` says so
+     * (`row_checked: false` plus the read's own error) instead of implying an
+     * operator can trust the row is clean, and the caller gets the `"unconfirmed"`
+     * copy rather than a flat "pay it again" it could be charged twice for.
+     *
+     * That copy overrides `display` as well as `hint`, on every branch including
+     * the ledger-less one. `display` is the sentence an agent relays to its human
+     * (repo convention: JSON carries the words, not just the facts), so a body
+     * whose `hint` says the outcome is unknown while its `display` still asserts
+     * the ask is outstanding is read as "pay again" by the audience that acts on
+     * it — and a payment that did land is charged on top.
+     */
+    private reportUnappliedPayment;
     /**
-     * Persist a job to the backing store.
-     *
-     * Awaits the per-job appender tail (internal-review) so that:
-     *   1. The snapshot's `messages` is consistent with the `job_messages` table
-     *      — no row is still in flight at snapshot time.
-     *   2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
-     *      can't race a still-pending `appendOutgoing` for the final yield
-     *      message (which would otherwise wipe the row before an in-flight SSE
-     *      subscriber's NOTIFY-driven fetch can see it).
+     * Describe a deposit the job row never took, in the shape both the 201 and
+     * the `payment_unapplied` 500 carry (internal-review). `undefined` when the payment
+     * ran ledger-less (no credit ledger wired, or the top-up preflight skipped) —
+     * there is no credit to name, so the 201 carries no `credit` block and the
+     * 500 takes its words from `unappliedCopy` directly.
      */
-    persistJob(job: ServerJob): Promise<void>;
+    private unappliedCredit;
+    /** Book a mid-job top-up's funding as a deposit (internal-review, spec §10). */
+    private reportCreditDeposit;
     /**
-     * Cross-machine terminal guard (internal-review). `buildContext`'s guard reads the
-     * in-memory `job.status`, so on its own it only protects the machine running
-     * the handler. On a multi-machine DVM a `DELETE /v1/job/:id` routinely lands
-     * on a machine that isn't running the job — `app.ts` cancels it in the store
-     * and this process learns of it only through the durable row.
+     * Internal: build the BuildContextOpts shared between `createJob` and
+     * `reactivateJob`. Centralised so persistence/terminal callbacks and the
+     * internal-review NOTIFY-driven cross-machine wake stay in one place.
+     */
+    private buildContextOpts;
+    /**
+     * Internal: what unit `ctx.requestPayment`'s auto-credit gate may measure this
+     * job's remaining pool in (internal-review).
      *
-     * Adopting the durable status blocks the rest of the handler's writes via the
-     * local guard, makes `handleJobTerminal` see a non-completed job so it skips
-     * the revenue report, rejects a suspended handler's prompt/payment yields, and
-     * fires `job.abort` so in-flight `ctx.fetch` calls tear down. Returns true when
-     * the durable state won and the caller must skip its save.
+     * The regime is read off the DRAW, never off the job. Implicit N=1 is exactly
+     * `credit_id === imp:<rail>:<draw_id>`, because `fundAndDraw` derives both
+     * from the same rail payment id — a fact about a row that was written once
+     * and never moves. The tempting alternative, comparing `job.payment_tx_hash`
+     * against `drawSettlementRef` (what the mid-job preflight does to inherit
+     * `drawBasis`), silently rots: Tx C overwrites that column on every mid-job
+     * credit, and a payment whose ledger leg was skipped — a cross-rail top-up,
+     * an fx outage, a draw already resolved — leaves the rail's own reference
+     * there, so an explicit-draw job would read as implicit from then on.
      *
-     * Two triggers: `watchDurableStatus`'s NOTIFY subscription (internal-review) fires
-     * this within a round-trip of the remote cancel committing, which is what
-     * actually stops the provider spend; `persistJob` calls it again on every save
-     * as the backstop for the window where a cancel commits between a handler's
-     * read and its write (the check-then-write it can still lose is covered by the
-     * stores' terminal-sticky `save`, which keeps the row itself correct).
+     * Never throws, and never answers `rail` on a guess. `rail` is claimed only
+     * where `withDrawBasis` demonstrably left `PaymentInfo.paidMsats` alone — no
+     * draw at all, or a draw carrying no rail value to overlay it with. A job that
+     * drew and whose pool this can't read or denominate answers `unpriced`, which
+     * the gate declines to auto-credit from: the msat figure it would otherwise
+     * fall back on is a slice of the credit's rail value at a ratio pinned
+     * whenever that credit was funded, which is the exact figure this issue exists
+     * to stop spending against.
      */
-    private adoptDurableTerminal;
+    private resolveDrawPool;
+    /** Internal: structured warn for the one path that can't price a drawn job's pool. */
+    private warnDrawPool;
     /**
-     * Watch the durable status of a locally-active job (internal-review).
-     *
-     * `ctx.signal` is raised by `dispatchMessage`, which only runs on the machine
-     * holding the job in `activeJobs`. On a multi-machine DVM the `DELETE` usually
-     * lands somewhere else, and that machine's store-only cancel (`cancelJob`)
-     * commits the terminal status, appends the `cancel` message, and `pg_notify`s
-     * in one transaction. This subscription is how the handler's machine hears it:
-     * on each notify, re-read the durable status and adopt it if it went terminal.
-     * Without it, the handler only notices at its next store write, and the
-     * in-flight provider call — the spend the cancel was meant to stop — runs to
-     * completion.
+     * Issue the signed receipt for a job that has reached a terminal status
+     * (internal-review). Idempotent and safe to call from every terminal path — the
+     * store owns both the sequence allocation and the write-once persist, so
+     * two machines racing on the same job converge on identical bytes and burn
+     * exactly one sequence number.
      *
-     * Every locally-emitted message notifies this machine too, so the re-read is
-     * coalesced: at most one `getCounters` in flight per job, and none once the
-     * job is locally terminal.
+     * Never throws. A receipt is evidence about a job, not part of delivering
+     * it: if signing or persistence fails we log structured and serve the
+     * response without one (same posture as the `cashu_refund_failed` branch in
+     * `context.ts`). The gap is visible to callers — the `seq` series skips a
+     * number — which is precisely the completeness signal receipts exist for.
      */
-    private watchDurableStatus;
+    issueReceipt(record: JobRecord): Promise<JobReceipt | undefined>;
+    /** Build the common settle/release args, adding the hosted release outbox when wired. */
+    private drawResolutionArgs;
     /**
-     * Tear down a job's durable-status subscription (internal-review). Must be called
-     * wherever a job leaves `activeJobs` — a leaked subscriber outlives the job on
-     * the store's shared LISTEN connection. Idempotent.
+     * Settle or release a terminal job's credit draw (internal-review): `completed`
+     * settles (the hold becomes a real debit); `failed`/`cancelled` releases
+     * (the hold evaporates — "no debit on job failure", mechanically
+     * superseding the internal-review/974 no-op refund for credit-paid jobs, including
+     * the `ctx.fail` path and the stale-sweeper reap). Idempotent — a replayed
+     * resolution returns the recorded state. Returns the `ReceiptCredit` block
+     * for the receipt: `balance_after` is the recorded draw trajectory for a
+     * settled draw, and the restored available balance for a released one.
      */
-    unwatchDurableStatus(jobId: string): void;
+    private resolveCreditDraw;
     /**
-     * NOTIFY-driven durable-status re-read, coalesced per job (internal-review).
-     *
-     * A notify that arrives while a re-read is in flight is queued rather than
-     * dropped: the in-flight read may have observed the row a moment *before* the
-     * cancel committed, and dropping its notify would put the abort back where
-     * this issue found it — waiting for the handler's next store write.
+     * The one place a terminal job's status becomes a ledger verb (internal-review):
+     * `completed` settles the hold into a real debit, `failed`/`cancelled`
+     * release it. Read by the in-line funnel (`resolveCreditDraw`) and by the
+     * late reconciler (`reconcileTerminalDraw`) — two paths that must never
+     * disagree about what an outcome means for the caller's money.
      */
-    private checkDurableTerminal;
+    private settlesDraw;
     /**
-     * Wire the Tx A appender when the store supports streaming.
-     *
-     * Tx A (internal-review): outgoing message + `pending_payment_msats` bump land in
-     * the same transaction. The DB allocates the row's seq via
-     * `UPDATE jobs SET next_seq = next_seq + 1 RETURNING` so concurrent inbound
-     * traffic on different machines can never collide on the `(job_id, seq)` PK.
-     * In-memory `job.seq` keeps its own counter for same-machine SSE listeners.
-     *
-     * Per-job serialisation (internal-review): chained through `job.messageAppenderTail`
-     * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
-     * `complete`) commit their `appendOutgoing` transactions in call order.
-     * Without this, the two transactions race for the `jobs` row lock and the
-     * DB-side seq can be allocated in the opposite order — which both renumbers
-     * the persisted messages and reorders the NOTIFY events feeding the
-     * cross-machine SSE subscriber. The subscriber closes the stream on the
-     * first yield message it sees, so a NOTIFY for `complete` arriving before
-     * `artifact`'s NOTIFY silently drops the artifact.
+     * Sign a locally-held terminal job's receipt and mirror it onto the
+     * in-memory job, so the read paths served out of `activeJobs` during the
+     * cleanup window hand back the same bytes as a cross-machine re-read.
      */
-    private wireMessageAppender;
-    /** Start (or restart) the idle timer for a job. */
-    startIdleTimer(job: ServerJob): void;
-    /** Clear the idle timer for a job. */
-    clearIdleTimer(id: string): void;
-    /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard (internal-review). */
-    cancelJobIdle(job: ServerJob): Promise<void>;
+    private attachReceipt;
     /**
-     * Force-terminate stale non-terminal jobs. Two status-aware arms:
-     *   • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
-     *     (`stale_no_terminal_status`) — the caller never paid / responded.
-     *   • `processing`/`working` past `processingWatchdogMs` → `failed`
-     *     (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
-     *     live workers fresh, so a stale row here means a dead process.
-     *
-     * Fires on a timer (wired in the constructor) and also callable on demand
-     * (tests, ops). The CAS in `cancelStaleJob` makes this safe to run
-     * concurrently from multiple DVM machines. Scoped to capabilities this
-     * JobManager owns so multi-mount hosts don't steal stuck rows from sibling
-     * descriptors — the local activeJobs teardown only makes sense on the
-     * JobManager that actually hosted the zombie handler.
-     *
-     * **Both cutoffs float off the wall clock (internal-review).** Each is one
-     * `Date.now()` sample compared against `last_activity_at`, stamped from a
-     * different sample at a different moment, so a backwards step between the
-     * two makes every row look more recently active than it is: the query
-     * matches nothing and both arms go silent for the length of the skew. The
-     * dead worker's job keeps its `processing` status, its credit hold stays
-     * `pending`, and the internal-review paid-job-death alert — wired to this reaper —
-     * never fires. Same defect, same host class, as internal-review's orphan sweep.
-     *
-     * **The compensation is capped** — see {@link staleSweepCompensationCapMs}
-     * for where each arm's cap comes from — which internal-review did not need to do. Its eagerness costs at worst an early release
-     * of an unclaimed hold, refused outright for any live job row; ours
-     * force-*fails* a running job. `cancelStaleJob`'s CAS does not cover that:
-     * `expectedActivityBefore` is the same compensated threshold the query used,
-     * and a live worker's post-step heartbeat writes the low, post-step
-     * `Date.now()`, so `last_activity_at <= expectedActivityBefore` still holds.
-     * The CAS guards a job checking in *between* the find and the claim with a
-     * stamp above the cutoff — a race, not a clock.
-     *
-     * **Some blindness is inherent, and no cap choice removes it.** A backwards
-     * step of `S` inverts the stamp ordering: everything stamped after it reads
-     * `S` older than everything stamped before. A live worker heartbeating right
-     * now stamps `wall - S`; a job genuinely idle for `age` stamps `wall - age`.
-     * The stale row is the lower of the two — the one a cutoff reaches first —
-     * only once `age` exceeds `S`. Below that the reaper cannot tell them apart,
-     * so any cutoff that claimed the stale job would force-fail every live
-     * worker on the host with it. The cap picks where on that curve to sit: on
-     * the defaults a row must have been silent for `S + window / 2`, and a live
-     * worker keeps five missed heartbeats of margin. The
-     * alternative to a missed reap is mild and self-healing — the orphan sweep
-     * backstops the hold, and the arm recovers when the wall catches up. The
-     * alternative to a false reap is an irreversible force-fail of paid work.
+     * Read-path repair for a terminal job carrying no receipt (internal-review), for
+     * either an in-memory job or a store record. Free in the steady state — it
+     * returns on the `receipt` check without touching the store — so it costs
+     * only on the cases it exists for:
      *
-     * The stamps themselves stay wall-clock epoch-ms on purpose — they are
-     * written by whichever machine touched the job and read by every other one,
-     * so only the reading side can float.
+     * - **A crash between the two store calls.** `claimReceiptSeq` commits the
+     *   sequence number to the job row before `saveReceipt` writes the bytes; a
+     *   process death in that window would otherwise strand that number
+     *   forever, and a permanent gap is indistinguishable from the deliberate
+     *   suppression `seq` exists to expose. Re-issuing here reuses the already
+     *   committed number (the claim is idempotent per job) rather than
+     *   allocating a second one.
+     * - **A transient store failure** at the terminal: `issueReceipt` logs
+     *   `receipt_issue_failed` and returns nothing rather than failing the job,
+     *   so the next read retries.
+     * - **Jobs that terminated before the DVM had a receipt key.** They pick one
+     *   up on first read, with `issued_at` reflecting when it was signed.
      */
-    sweepStaleJobs(): Promise<{
-        swept: number;
-    }>;
+    ensureReceipt(target: ServerJob | JobRecord): Promise<void>;
     /**
-     * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
-     * clock to cover a backwards step (internal-review). The compensation is capped,
-     * not free: a claimed row must still have been silent for
-     * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
-     * force-fails a job that may well be alive.
-     *
-     * **Half the window** is the floor that governs a wide window — five missed
-     * heartbeats on the processing defaults. On the `awaiting-input` arm it also
-     * preserves a real invariant: with the derived
-     * `2 x idleTimeout + headroom`, half is `idleTimeout + 45s`, so the sweeper
-     * still cannot fire before the in-process idle timer would have. (A builder
-     * who overrides `staleJobTimeoutMs` below `2 x idleTimeout` has already
-     * opted out of that, guard or no guard.)
-     *
-     * **Two heartbeat intervals** is the floor that governs a window configured
-     * close to the beat cadence — `processingWatchdog: 40` against the 30s
-     * default beat, where half the window is less than one beat and a worker
-     * heartbeating exactly on schedule would be reaped the moment the host's
-     * clock stepped. That pair is marginal already; the guard must not make it
-     * deterministic. The cap collapses to zero there, which is today's
-     * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
-     * — nothing heartbeats it by design, and its refresh is an inbound caller
-     * message on no cadence at all.
-     *
-     * **Why a magnitude and not a predicate.** The tempting sharper rule is to
-     * compensate per row, fully, for any stamp that reads ahead of our wall —
-     * one our own post-step heartbeat could not have written. It is unsafe: a
-     * future-stamped row is equally what a live job heartbeated by a peer whose
-     * clock runs fast looks like, and from the stamp alone the two are
-     * indistinguishable. The same reasoning bounds the cap from the other side —
-     * while our clock is stepped, the guard force-fails the live jobs of any
-     * peer slower than `windowMs - cap`, which is 2.5 minutes of tolerated
-     * disagreement on the defaults, far outside anything NTP-managed hosts show.
+     * Close out a terminal job whose caller hasn't already persisted it: sign
+     * the receipt, then save the snapshot. The snapshot save never writes the
+     * receipt column, so ordering only affects how soon a reader sees the
+     * receipt — this way a caller polling immediately after the terminal
+     * already finds it.
+     */
+    private finalizeTerminal;
+    /**
+     * Issue a receipt for a job this process doesn't hold in `activeJobs` — a
+     * cross-machine cancel, or a row the stale sweeper just reaped. Re-reads the
+     * record so the receipt is built from the committed terminal row rather than
+     * from whatever the caller happened to have in hand.
      */
-    private staleSweepCompensationCapMs;
+    issueReceiptForStoredJob(jobId: string): Promise<JobReceipt | undefined>;
+    /** Handle job reaching terminal state (completed, failed, cancelled). */
+    private handleJobTerminal;
     /**
-     * Resolve `pending` credit draws the terminal funnel can no longer reach.
-     * Two arms over one scan, distinguished by whether the draw's job row exists.
-     *
-     * **No job row (internal-review) — release.** internal-review allocates the job id and
-     * commits the ledger draw, with its `job_id` linkage, before `recordReplay`
-     * and `persistJob` write the job row. A crash, a `draw_conflict` 409, or a
-     * fail-closed `replay_detected` 401 in that window leaves a committed hold
-     * that **no** terminal path can ever reach: `issueReceipt` →
-     * `resolveCreditDraw` keys off the `creditId`/`drawId` persisted on the job
-     * row, so with no row there is no release path at all and the caller's
-     * available balance stays reduced forever. Cosmetic for an implicit N=1
-     * credit, a silent balance shrink for an explicit N>1 one.
-     *
-     * **Terminal job row (internal-review) — reconcile to its outcome.** The funnel
-     * demonstrably fails: `resolveCreditDraw` throws on a ledger/DB error,
-     * `issueReceipt` catches it, logs `credit_resolve_failed` and returns
-     * nothing, and until now nothing retried. Same stranded hold, reached through
-     * a different door — and for a `completed` job it strands the platform's
-     * books too, since draws *are* the revenue events (internal-review): the caller is
-     * charged nothing, the balance never moves, and outstanding liability
-     * (`deposits − draw revenue`) overstates forever. So a late settle books, off
-     * the committed draw row, through the ordinary reporter path.
+     * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
+     * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
      *
-     * **A non-terminal job row is still never touched** — the stale-job sweep
-     * above drives those to terminal first, and its `issueReceiptForStoredJob`
-     * resolves the draw on the way. Those skipped holds are why the scan
-     * keyset-paginates rather than re-reading one batch: they stay `pending`
-     * indefinitely (an `awaiting-input` job on a 30-minute idle timeout sits well
-     * past the orphan cutoff), so a fixed first page of them would starve every
-     * real orphan behind it, on every tick, forever. The cursor advances over
-     * every row examined; a tick that hits {@link ORPHAN_DRAW_SWEEP_MAX_PAGES}
-     * logs `orphan_draw_sweep_truncated` and the next one resumes where it
-     * stopped, so progress is bounded per tick but never blocked.
+     * For a **credit-backed** job the revenue event is the *settled draw* (spec
+     * §10), and since internal-review the sats figure corrects the job's mirror of that
+     * draw against the draw itself: `withDrawBasis` stamps the job when the
+     * payment lands, but a Bitcoin credit's settle re-prices the draw against
+     * the funding lots it consumed. The correction is a delta, because a job's
+     * counter can carry legs no draw ever absorbed — except where the draw's
+     * forecast was zero and the counter therefore never held a component to
+     * correct. The event is dated at settlement rather than at report time. A
+     * released draw — the failed/cancelled path — is deliberately unreachable
+     * here, which is what makes "no debit on job failure" true in the books as
+     * well as the ledger.
      *
-     * Fires on a timer (wired in the constructor) and also callable on demand
-     * (tests, ops). Both `settle` and `release` are idempotent under the credit
-     * row's `FOR UPDATE`, so concurrent sweepers on several machines — and a
-     * sweeper racing the in-line funnel — resolve the hold exactly once; the
-     * losers see `replayed: true` and book nothing.
-     */
-    sweepOrphanDraws(): Promise<{
-        released: number;
-        reconciled: number;
-    }>;
-    /**
-     * The end-of-scan line for a tick that resolved nothing (internal-review, extended
-     * by internal-review). Two shapes are worth a warning, and neither is the ordinary
-     * one — the timer runs every 5 minutes per ledger in production.
+     * For everything else (free-then-paid jobs, isolate-shaped flows, a DVM
+     * whose price couldn't be fiat-denominated) nothing changes: the pre-credits
+     * payload is reported verbatim.
      *
-     * `examined > 0`: aged candidates were looked at and none moved. Usually
-     * legitimate (their jobs are still running, or terminal inside the reconcile
-     * grace period), but it is also what a silently skipped hold looks like.
+     * Takes the fields rather than a `ServerJob` so the internal-review reconciler — a
+     * background sweep that holds no in-process job — books through this exact
+     * path off the row it read. `paymentTxHash` is passed **verbatim**, never
+     * recomputed as a `drawSettlementRef`: it is the same column the in-line
+     * funnel reads, so the two bookings are byte-identical by construction and
+     * the platform's `UNIQUE (rail, tx_hash)` dedupes them. Deriving it instead
+     * would diverge on an implicit N=1 job (whose row carries the rail's own
+     * reference) and on any job whose column a mid-job top-up overwrote — the
+     * same rot `resolveDrawPool` documents as the reason not to read regime off
+     * this column.
      *
-     * `examined === 0`: the query returned nothing. Ordinarily that means there
-     * is nothing to do — but it is equally what a blinded scan looks like, which
-     * is the case the internal-review gate could not reach. Probe for the oldest
-     * `pending` hold at any age and speak up when one exists the scan should
-     * have seen and didn't: already past the age gate outright, stamped ahead of
-     * our clock (some other process's clock is fast), or hidden while our own
-     * clock is held forward over a backwards step. A ledger holding nothing but
-     * young draws stays quiet.
+     * Returns whether the report was handed to `onJobCompleted`, so a caller
+     * that logs the booking says what actually happened rather than what it
+     * assumed — the guards below still drop legitimate shapes (a free job, a
+     * DVM with no reporter). Every drop that costs a booking logs first.
      *
-     * The probe is diagnostics, so it is wrapped: a tick that swept cleanly must
-     * never report failure because the extra read fell over. A probe that throws
-     * says so on the same line rather than replacing the tick's outcome.
+     * The rail check sits **below** the draw re-read, not in the entry guard
+     * (internal-review): a settled draw the terminal can't report under is a real debit
+     * with no revenue event, permanently overstating outstanding liability
+     * (`deposits − draw revenue`), and it used to return here in silence. Placed
+     * after the re-read, `revenue_skipped_no_rail` can name the draw and its
+     * amount, and can distinguish the four causes — see its `reason` below.
      */
-    private reportSweepOutcome;
+    private bookRevenue;
+    /** Schedule job removal from activeJobs after a delay so clients can still poll final status. */
+    scheduleCleanup(job: ServerJob): void;
+    /** Clear all timers. Called on server shutdown to allow clean exit. */
+    shutdown(): void;
+}
+
+/** Cached liveness signal for a platform-hosted DVM's Lightning receive rail. */
+interface LightningRailHealth {
+    /** Whether the receive rail may be advertised at this instant. */
+    available(): boolean;
+    /** Prime the cached signal at boot when the source supports it. */
+    refresh?(): Promise<void>;
+}
+
+/** Builder-facing wiring for the Lightning receive leg (internal-review). */
+interface LightningReceiveConfig {
     /**
-     * Resolve one aged `pending` draw whose job row reached terminal (internal-review),
-     * mirroring what `resolveCreditDraw` would have done in line. Returns true
-     * when this call is the one that moved the draw — the caller counts it, and
-     * only it books.
-     *
-     * **The settle is gated on the job row naming _this_ draw.** The scan finds
-     * the draw by `credit_draws.job_id`, but the job's own `credit_id`/`draw_id`
-     * are written by a *later* transaction than the one that committed the draw
-     * (`verifyIncomingPayment` commits fund+draw; `verifyAndCredit` binds the
-     * row), and a free-then-paid job binds set-if-null. A store failure or a
-     * second concurrent top-up therefore leaves a hold tagged with the job whose
-     * row points somewhere else, or nowhere. Settling that would debit the caller
-     * a second time for one job — and invisibly, since `revenue_events`'
-     * `UNIQUE (dvm_id, job_id, rail)` would drop the booking. So an unbound hold
-     * is **released**, never settled: the job's payment was the draw it is bound
-     * to, and this one bought nothing.
-     *
-     * Concurrency needs no guard of its own. `settle`/`release` run under the
-     * credit row's `FOR UPDATE`, so exactly one caller — a sibling reconciler,
-     * or the in-line funnel arriving late — sees `replayed: false`, which makes
-     * the booking gate a true mutex rather than a hopeful one. The one race left
-     * open is another machine's `handleJobTerminal` stalled between resolving the
-     * draw and booking it, which would double-report; the platform's
-     * `(dvm_id, credit_id, draw_id)` and `(dvm_id, job_id, rail)` unique indexes
-     * absorb that.
-     *
-     * `invalid_draw_state` — the funnel having already resolved the draw to the
-     * other state — is the expected loss, logged and swallowed like the orphan
-     * arm's, so one contended hold can't strand the rest of the batch.
+     * Receive-only NWC connection URI (`DVMKIT_NWC_RECEIVE_URI`). Validated at
+     * boot: a connection that can *spend* is refused outright.
      */
-    private reconcileTerminalDraw;
+    uri?: string;
     /**
-     * Refresh `lastActivityAt` for jobs this process is actively running
-     * (`processing`/`working`) so the processing watchdog only fires once the
-     * worker is genuinely dead (internal-review). `awaiting-input` jobs are
-     * deliberately excluded — their idle timeout must still elapse. Fires on the
-     * heartbeat timer; also callable on demand for tests.
+     * Pre-built backend, bypassing URI parsing and the connect-time probe. Test
+     * seam only — production always goes through `uri` so the receive-only
+     * property is actually checked.
      */
-    heartbeatActiveJobs(): Promise<{
-        beat: number;
-    }>;
+    backend?: LightningBackend;
+    /** Invoice lifetime in seconds. Defaults to {@link DEFAULT_INVOICE_TTL_SECONDS}. */
+    invoiceTtlSeconds?: number;
     /**
-     * Single-execution claim for a reactivating machine (internal-review). Before
-     * replaying an `awaiting-input` job, wait a bounded grace window for a live
-     * original handler to win the `awaiting-input → processing` CAS via its
-     * NOTIFY wake. Resolves:
-     *   • `false` — the row left `awaiting-input` during the window (the original
-     *     handler claimed it / drove it terminal). Stand down; do not replay.
-     *   • `true`  — the window elapsed still `awaiting-input` (the original worker
-     *     is gone or has no live resolver) AND this machine won the claim CAS.
-     *     Replay for dead-worker recovery.
-     *
-     * Biasing the original handler to win kills the double execution (double
-     * substrate spend, clobbered artifact) without heartbeating `awaiting-input`
-     * (which would break the caller-input idle timeout). Non-streamable stores
-     * have no cross-machine race, so the claim is a no-op `true`.
+     * Smallest funding this deployment can receive over Lightning, in sats
+     * (`DVMKIT_LIGHTNING_FUNDING_MIN_SATS`). The floor is a property of the
+     * receive wallet's channel policy (`htlc_minimum_msat` upstream), so it is
+     * per-deployment and sats-physical — the menu renders it into fiat with a
+     * margin, but everything that *enforces* it compares raw sats. Defaults to
+     * {@link DEFAULT_LIGHTNING_FUNDING_MIN_SATS}.
      */
-    claimAwaitingInputForReactivation(jobId: string): Promise<boolean>;
+    fundingMinSats?: number;
     /**
-     * Record an inbound client message durably via Tx B (internal-review) and append
-     * it to the in-memory `job.messages` array. Returns the DB-allocated seq
-     * (`null` when the store isn't streamable — non-Postgres test fallback).
-     *
-     * Status starts as `pending-verification`; a follow-up Tx C call
-     * (`processPayment` for payments, `markInboundVerified` for everything
-     * else) transitions it to `verified` once the inbound is accepted.
+     * Optional platform-derived channel-liveness gate. Platform-hosted DVMs use
+     * it alongside their NWC reachability probe; self-hosted DVMs omit it.
      */
-    recordInboundPending(job: ServerJob, msgType: MessageType, msgContent: Record<string, unknown>): Promise<number | null>;
+    railHealth?: LightningRailHealth;
+}
+/** Default bolt11 lifetime — long enough to pay by hand, short enough to retire. */
+declare const DEFAULT_INVOICE_TTL_SECONDS = 900;
+/**
+ * Floor on the invoice lifetime: twice the signed-request drift window, so the
+ * bolt11 always outlives the funding negotiation that produced it (the issue's
+ * "invoice expiry ≥ the funding-negotiation window"). A shorter one would
+ * expire inside the caller's own retry budget and strand them mid-top-up.
+ */
+declare const MIN_INVOICE_TTL_SECONDS = 600;
+/**
+ * The builder-side Lightning receive leg (internal-review, credits spec §4).
+ *
+ * Issues a bolt11 over a **receive-only** NWC connection while the DVM is
+ * awake serving the 402, and credits the ledger when a later request observes
+ * settlement. Two properties are load-bearing:
+ *
+ * - **It never holds a send credential.** `pay_invoice` on this connection is
+ *   refused at construction, so a compromised DVM can mint invoices and
+ *   nothing else. The drain/refund sender (internal-review) is a separate, budgeted
+ *   connection by rule.
+ * - **Crediting is pull-based — there is no settlement watcher.** The caller's
+ *   next request drives `lookup_invoice`, which is what makes this work on a
+ *   suspend-to-zero fleet: a machine that is asleep has nothing to miss.
+ *   Wallet downtime at that moment delays crediting; it never loses money,
+ *   because the invoice→credit binding is a durable row.
+ *
+ * Reachability is **cached**, never probed per request: the funding menu is
+ * assembled on every quote and every 402, so a live NIP-47 round trip there
+ * would put a nostr relay in the latency path of every priced call.
+ */
+declare class LightningReceive {
+    private readonly source;
+    readonly invoiceTtlSeconds: number;
+    readonly fundingMinSats: number;
+    private health;
+    private checkedAtMs;
+    private refreshing;
+    private permissionRefusal;
+    private constructor();
+    private readonly railHealth;
     /**
-     * Tx C complement for non-payment inbound messages — flip the row to
-     * `verified` so cross-machine readers see it via `subscribeMessages`.
+     * Validate the configured connection and build the receive leg, or return
+     * `undefined` when this DVM didn't configure one.
+     *
+     * **Throws on a credential that is wrong, degrades on one that is merely
+     * unreachable.** A wallet outage at boot must not stop a DVM whose other
+     * rails are fine — the menu simply omits `lightning` until a later probe
+     * succeeds. A connection that can spend, or one that can't state what it can
+     * do, is a different thing entirely: it is a standing money risk that no
+     * amount of retrying fixes, so it fails the boot loudly with the fix in the
+     * message.
      */
-    markInboundVerified(jobId: string, inboundSeq: number | null): Promise<void>;
+    static create(config: LightningReceiveConfig): Promise<LightningReceive | undefined>;
     /**
-     * Reactivate a suspended/event-driven job from the store. Builds the
-     * in-memory `ServerJob`, wires the appender, builds the context, starts
-     * the idle timer. The caller has already recorded the inbound via Tx B
-     * and run Tx C (verify + credit); reactivation is now decoupled from
-     * credit (internal-review, internal-review). The caller decides whether to run the
-     * handler (Pattern A: status was `awaiting-input`) or to dispatch the
-     * message to a custom handler (Pattern B).
-     *
-     * For DVMs that declare descriptor-level auth, the persisted
-     * `record.input` carries the original signed envelope. We re-verify the
-     * signature here (internal-review) so a DB-layer tamper — compromised admin, SQL
-     * injection, malicious operator with DB access — can't silently feed an
-     * attacker-supplied pubkey/envelope into the handler. The drift window
-     * and replay store are deliberately skipped: the persisted timestamp is
-     * from the original signing instant (long past the 5-min drift bound for
-     * any long-running job), and the nonce was already committed at submission.
-     * On failure: throws `SignedRequestError` ({@link AuthSchemaError} when
-     * the capability has no input schema to verify against); the caller is
-     * expected to mark the row failed and surface a 401 / 500 to the inbound
-     * caller.
+     * Whether `lightning` belongs on the funding menu right now.
      *
-     * What gets re-verified is the persisted row read back through
-     * {@link signedRequestInput} — `app.ts` stores the pre-Zod wire form, so
-     * those are the caller's own signed bytes, the same ones `/v1/quote` and the
-     * submit checked (internal-review). That makes the tamper check strictly stronger
-     * than the parsed form it replaced: an injected key the capability schema
-     * doesn't declare used to be stripped before the signature was checked, so
-     * it re-verified clean.
+     * Reads the cached observation and never blocks; a stale one kicks off a
+     * background refresh and answers with what we last knew. Advertising a rail
+     * whose wallet is down would hand the caller an option that 402s on use —
+     * the §4 posture is to drop it and let the sale survive on the others.
      */
-    reactivateJob(record: JobRecord): {
-        job: ServerJob;
-        sdkCtx: SDKJobContext<unknown, unknown>;
-    };
+    available(): boolean;
     /**
-     * Verify an inbound payment and apply the credit via Tx C (internal-review).
-     * The inbound message must have been recorded via Tx B already
-     * (`recordInboundPending` returned `inboundSeq`). For non-streamable
-     * stores (`inboundSeq === null`), falls back to in-memory mutation via
-     * `applyPaymentInfoToJob`.
-     *
-     * Dev-mode short-circuit: auto-credits the outstanding
-     * `pendingPaymentMsats` without external verification. Gated on
-     * `devModeSkipsPaymentVerification` — the same predicate the upfront path
-     * reads, so a dev server wired to a mint verifies mid-job payments for real
-     * (internal-review) — plus the explicit `dev_auto` opt-out the dev console uses,
-     * which is the one caller that has no wallet to pay from. `dev_auto` loses to
-     * any proof riding the same message: money on the wire always takes the rail,
-     * so the flag can never leave a real token unspent against a credited job.
+     * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
      *
-     * Tx C is not atomic with the rail commit (internal-review). `verifyIncomingPayment`
-     * commits the proofs *and* the ledger leg in one transaction and returns;
-     * only then does `verifyAndCredit` write the job row, on its own connection.
-     * Everything after that call therefore runs with the caller's money already
-     * moved, which is why the write is retried rather than left to throw, and why
-     * an exhausted retry answers with the credit it landed on instead of a bare
-     * 500. See `creditInbound`.
+     * The invoice is minted **for** the credit and amount named in the caller's
+     * signed body — that binding is the internal-review condition-3 commitment on this
+     * rail, and it is why no artifact hash rides the request: there is no
+     * caller-supplied artifact to hash. A re-poll returns the stored row rather
+     * than minting again; a second bolt11 for one `fund_id` would leave two
+     * payable invoices against a funding that can only be credited once.
      */
-    processPayment(job: ServerJob, body: {
-        type: MessageType;
-        content: Record<string, unknown>;
-    }, inboundSeq: number | null, extra?: {
-        lockPubkeys?: LockPubkey[];
-        mintHealthTracker?: MintHealthTracker;
-    }): Promise<ProcessPaymentOutcome>;
+    issue(ledger: CreditLedgerLike, args: {
+        creditId: string;
+        fundId: string;
+        callerPubkey: string;
+        currency: string;
+        amountMicro: number;
+        amountMsats: number;
+        description?: string;
+    }): Promise<CreditInvoiceRecord>;
     /**
-     * Tx C with a bounded retry (internal-review).
+     * Ask the wallet whether one payment hash is paid, and when (internal-review).
      *
-     * By the time this runs on the verified path, the rail commit and the ledger
-     * leg have already committed in a transaction this call is not part of — so a
-     * throw here is money moved against a job row that records none of it, and
-     * letting it propagate was the bug. A transient store error is the ordinary
-     * cause and a second attempt clears it.
+     * The operator's reconcile verb runs this before it credits anything. A
+     * `blocked` row implies payment — {@link applyOne} returns above the block
+     * classification when the lookup says unpaid — but that is *this fleet's
+     * belief, recorded possibly weeks ago*, and the verb it gates mints balance
+     * against it. One round trip turns the belief into a fact and recovers the
+     * true settlement instant for `settled_at`, which a blocked row never got to
+     * write.
      *
-     * The retry is safe by construction, not by convention: `verifyAndCredit`
-     * CASes on `job_messages.status = 'pending-verification'` inside its own
-     * transaction, so a call whose COMMIT actually landed before the ack was lost
-     * finds the row already `verified` and returns `alreadyVerified: true`
-     * carrying the counters and binding that first attempt committed. Re-applying
-     * the delta is impossible either way.
+     * Unlike {@link settlePending} this **throws**: there is no request whose
+     * latency it protects, and crediting on an unverifiable wallet is exactly
+     * what it exists to prevent. `NOT_FOUND` is the one exception, and it is not
+     * an outage — it is the wallet saying it has never seen this hash, the same
+     * reading {@link applyOne} and the caller-side reconcile in `src/lib/nwc.ts`
+     * take. It comes back as `known: false` because the operator's repair for it
+     * ("you are pointed at a different wallet than the one that minted this")
+     * is not the repair for an unpaid invoice, and certainly not for a retry.
+     */
+    lookupSettlement(paymentHash: string): Promise<{
+        settled: boolean;
+        settledAt?: number;
+        known: boolean;
+    }>;
+    /**
+     * Consult the wallet about this caller's outstanding invoices and credit the
+     * ones that settled — the pull half of pull-based crediting.
      *
-     * That argument covers every attempt but the last, whose error nothing
-     * re-checks — and a connection-level fault is exactly the shape that loses
-     * the ack on *all* of them, idempotent replays included (the no-op path
-     * COMMITs too). So the exhausted path asks the row before reporting a
-     * failure: `getVerifiedInbound` reads, transaction-free, whether a Tx C for
-     * this seq committed. Without it a fully credited, fully bound job answers
-     * `payment_unapplied` and invites a retry, and a caller who takes it pays
-     * twice for one ask — the second payment growing the now-bound draw and
-     * settling as revenue.
+     * The pending rows are read locally first, so the common case (nothing
+     * outstanding) costs one indexed SELECT and no network at all. Bounded to
+     * {@link MAX_SETTLE_CHECKS} invoices on a short deadline, and **never throws
+     * into the request**: a wallet failure here means the caller's balance is
+     * merely not updated yet, which the ordinary `insufficient_credit` path
+     * already states honestly.
      *
-     * The read runs on the pool that just failed those COMMITs, so it is retried
-     * too, and a read that fails all the way through is reported as *unknown*
-     * rather than as nothing: `CreditInboundExhaustedError.readError` is what
-     * separates "checked the row, nothing landed" from "couldn't check", both on
-     * the operator's log line and in the copy the caller acts on.
+     * **Each invoice gets its own failure boundary.** The sweep window is a few
+     * rows wide, so a row that fails on its own terms — a `fund_id` the caller
+     * reused on another rail, a credit someone else opened first — must not take
+     * the rest of the pass down with it: the next invoice in the window may be
+     * the paid one, and it would never be looked up. Only a transport failure
+     * ends the pass early, because there the wallet itself is gone and the
+     * remaining lookups would just spend the caller's latency confirming it.
      */
-    private creditInbound;
+    settlePending(ledger: CreditLedgerLike, args: {
+        callerPubkey: string;
+        creditId?: string;
+        creditTtlMs: number;
+        dvmId?: string;
+        enqueueCreditDeposit?: CreditDepositEnqueue;
+        nowMs?: number;
+    }): Promise<InvoiceSettlement[]>;
     /**
-     * Answer a payment whose rail and ledger legs committed but whose job row
-     * could not be written (internal-review) — every retry spent, the money real.
+     * One invoice's settlement check. Returns the applied settlement, or
+     * `undefined` when nothing changed (still unpaid, or retired unpaid).
      *
-     * The refusal names the credit the money landed on so the caller can act on
-     * it directly, mirroring the short mid-job pay's 402 (`payment.ts`). It is a
-     * 500 rather than a 402 on purpose: the payment was valid and was accepted,
-     * so telling the caller it was insufficient would be a lie, and this is a
-     * fault an operator should see in their 5xx rate. `retryable` is true because
-     * the ask is genuinely still outstanding.
+     * Throws whatever the wallet or the ledger threw — classifying that is
+     * {@link retireOrLog}'s job, so this stays one invoice's happy path.
+     */
+    private applyOne;
+    /**
+     * Decide what one invoice's failure means, and retire the invoice when the
+     * answer is "this can never succeed".
      *
-     * Nothing is released here. The hold is left to the internal-review reconciler,
-     * which makes the same decision — unbound draw ⇒ release, never settle — but
-     * under the credit row's `FOR UPDATE`, after the job is terminal, where it
-     * cannot race an in-flight COMMIT. Releasing from here would also be
-     * irreversible: a released draw can be neither re-grown nor re-opened, so one
-     * bad call would silently de-ledger every later top-up on the job.
+     * The split that matters is permanent-versus-transient, because it decides
+     * whether the row keeps a slot in the sweep window. A transient failure — the
+     * database blinked, the wallet answered oddly — leaves it `pending` and the
+     * caller's next request retries it. A **permanent** one means the ledger will
+     * refuse this invoice identically forever, so leaving it pending costs a
+     * `lookup_invoice` on every subsequent request and, at
+     * {@link MAX_SETTLE_CHECKS} of them, fills the window so a genuinely payable
+     * invoice behind them is never even looked up. Those get `blocked`, which
+     * drops them out of the sweep and hands the operator the payment hash.
+     */
+    private retireOrLog;
+    /**
+     * The reason this invoice can never be credited, or `undefined` if the
+     * failure was transient.
      *
-     * Whether the row was *read* is load-bearing on both surfaces. When the
-     * post-exhaustion read-back failed as well, `credit_job_row_unwritten` says so
-     * (`row_checked: false` plus the read's own error) instead of implying an
-     * operator can trust the row is clean, and the caller gets the `"unconfirmed"`
-     * copy rather than a flat "pay it again" it could be charged twice for.
+     * Every code here is decided by state a retry cannot move — a row the ledger
+     * has already committed (a `credit_fundings` entry at this
+     * `(credit_id, fund_id)`, or a `credits` row whose owner, denomination or
+     * rail disagrees with the invoice), or the basis this module rebuilds
+     * identically from the invoice row on every pass. None of them is a race.
      *
-     * That copy overrides `display` as well as `hint`, on every branch including
-     * the ledger-less one. `display` is the sentence an agent relays to its human
-     * (repo convention: JSON carries the words, not just the facts), so a body
-     * whose `hint` says the outcome is unknown while its `display` still asserts
-     * the ask is outstanding is read as "pay again" by the audience that acts on
-     * it — and a payment that did land is charged on top.
+     * `funding_replayed` is the one that needs a second read to classify.
+     * Usually it *is* benign — a concurrent check won the race and the money is
+     * credited either way — but the key is `(credit_id, fund_id)` and `fund_id`
+     * is **caller-chosen**: reuse it on cashu or x402 after this bolt11 was
+     * minted and the row that collided is a different payment entirely, so the
+     * sats this invoice received have nowhere to land.
      */
-    private reportUnappliedPayment;
+    private blockingReason;
+    private withBackend;
+    /** Record activity without letting it promote an unvalidated connection. */
+    private noteOperationOk;
+    private notePermissionsOk;
+    private notePermissionRefused;
     /**
-     * Describe a deposit the job row never took, in the shape both the 201 and
-     * the `payment_unapplied` 500 carry (internal-review). `undefined` when the payment
-     * ran ledger-less (no credit ledger wired, or the top-up preflight skipped) —
-     * there is no credit to name, so the 201 carries no `credit` block and the
-     * 500 takes its words from `unappliedCopy` directly.
+     * Only a *transport* failure from an ordinary invoice operation is a health
+     * signal. Permission-probe refusals are classified by {@link refresh}.
      */
-    private unappliedCredit;
-    /** Book a mid-job top-up's funding as a deposit (internal-review, spec §10). */
-    private reportCreditDeposit;
-    /**
-     * Internal: build the BuildContextOpts shared between `createJob` and
-     * `reactivateJob`. Centralised so persistence/terminal callbacks and the
-     * internal-review NOTIFY-driven cross-machine wake stay in one place.
+    private noteFailure;
+    private refresh;
+}
+
+/**
+ * Owner display identity surfaced on `/v1/info#owner` (internal-review). Personal orgs
+ * resolve to the owner builder's profile; shared orgs resolve to the org's own
+ * profile. Container DVMs read from env vars; isolate DVMs resolve from Postgres.
+ */
+interface OwnerDisplay {
+    handle: string;
+    displayName?: string | null;
+    avatarUrl?: string | null;
+    type: "builder" | "org";
+}
+/** Optional builder identity surfaced on `/v1/info` (forward-compatible stub). */
+interface BuilderIdentity {
+    id?: string;
+    name?: string;
+    url?: string;
+    /**
+     * Builder identity x-only secp256k1 pubkey (internal-review). When populated, the
+     * `/v1/info#builder` block also carries `attestation` + `signature` so
+     * consumers can verify the deploy was signed by the holder of this key.
+     * Populated at deploy time from `DVMKIT_BUILDER_PUBKEY` (Fly secret); the
+     * SDK never re-signs at runtime.
      */
-    private buildContextOpts;
+    pubkey?: string;
+    /** Canonical deploy-time attestation payload (internal-review). Served verbatim. */
+    attestation?: AttestationPayload;
+    /** Schnorr signature over `canonicaliseForSigning(attestation)` (internal-review). */
+    signature?: string;
+}
+/** Platform reporter overrides — the host falls back to env when omitted. */
+interface PlatformReporterOpts {
+    /** Bearer token. Defaults to `DVMKIT_PLATFORM_TOKEN` env. */
+    token?: string;
+    /** Platform internal URL. Defaults to `DVMKIT_PLATFORM_URL` env. */
+    url?: string;
+}
+/** Options for {@link createDVMHost}. */
+interface DVMHostOpts {
     /**
-     * Internal: what unit `ctx.requestPayment`'s auto-credit gate may measure this
-     * job's remaining pool in (internal-review).
-     *
-     * The regime is read off the DRAW, never off the job. Implicit N=1 is exactly
-     * `credit_id === imp:<rail>:<draw_id>`, because `fundAndDraw` derives both
-     * from the same rail payment id — a fact about a row that was written once
-     * and never moves. The tempting alternative, comparing `job.payment_tx_hash`
-     * against `drawSettlementRef` (what the mid-job preflight does to inherit
-     * `drawBasis`), silently rots: Tx C overwrites that column on every mid-job
-     * credit, and a payment whose ledger leg was skipped — a cross-rail top-up,
-     * an fx outage, a draw already resolved — leaves the rail's own reference
-     * there, so an explicit-draw job would read as implicit from then on.
-     *
-     * Never throws, and never answers `rail` on a guess. `rail` is claimed only
-     * where `withDrawBasis` demonstrably left `PaymentInfo.paidMsats` alone — no
-     * draw at all, or a draw carrying no rail value to overlay it with. A job that
-     * drew and whose pool this can't read or denominate answers `unpriced`, which
-     * the gate declines to auto-credit from: the msat figure it would otherwise
-     * fall back on is a slice of the credit's rail value at a ratio pinned
-     * whenever that credit was funded, which is the exact figure this issue exists
-     * to stop spending against.
+     * Postgres connection string. Defaults to `DATABASE_URL` env.
+     * Required at runtime (internal-review). Boot fails when missing unless `jobStore`
+     * is explicitly supplied or `devMode` is true (test/dev escape hatches).
      */
-    private resolveDrawPool;
-    /** Internal: structured warn for the one path that can't price a drawn job's pool. */
-    private warnDrawPool;
+    database?: string;
+    /** Listen port. Defaults to `PORT` env or 8080. */
+    port?: number;
+    /** Environment variables. Defaults to `process.env`. */
+    env?: Record<string, string>;
+    /** Builder identity for `/v1/info` (forward-compatible). */
+    builder?: BuilderIdentity;
+    /** Owner display identity for `/v1/info#owner` (internal-review). Falls back to env vars. */
+    owner?: OwnerDisplay;
+    /** Platform reporter overrides. Defaults to env-derived values. */
+    platformReporter?: PlatformReporterOpts;
+    /** Override the SDK's fx fetcher. Defaults to env-configured CoinGecko. */
+    fx?: FxFetcher;
     /**
-     * Issue the signed receipt for a job that has reached a terminal status
-     * (internal-review). Idempotent and safe to call from every terminal path — the
-     * store owns both the sequence allocation and the write-once persist, so
-     * two machines racing on the same job converge on identical bytes and burn
-     * exactly one sequence number.
-     *
-     * Never throws. A receipt is evidence about a job, not part of delivering
-     * it: if signing or persistence fails we log structured and serve the
-     * response without one (same posture as the `cashu_refund_failed` branch in
-     * `context.ts`). The gap is visible to callers — the `seq` series skips a
-     * number — which is precisely the completeness signal receipts exist for.
+     * Custom `/health` handler. When set, the SDK installs this instead of the
+     * default `{ status: "ok" }` responder — useful for runtime-specific health
+     * (pool depth, draining state, 503 while draining).
      */
-    issueReceipt(record: JobRecord): Promise<JobReceipt | undefined>;
-    /** Build the common settle/release args, adding the hosted release outbox when wired. */
-    private drawResolutionArgs;
+    healthHandler?: (c: Context) => Response | Promise<Response>;
+    /** KV store override. Defaults to PostgresKVStore (or MemoryKVStore in dev). */
+    store?: KVStore;
+    /** JobStore override. Takes precedence over `database`. */
+    jobStore?: JobStore;
     /**
-     * Settle or release a terminal job's credit draw (internal-review): `completed`
-     * settles (the hold becomes a real debit); `failed`/`cancelled` releases
-     * (the hold evaporates — "no debit on job failure", mechanically
-     * superseding the internal-review/974 no-op refund for credit-paid jobs, including
-     * the `ctx.fail` path and the stale-sweeper reap). Idempotent — a replayed
-     * resolution returns the recorded state. Returns the `ReceiptCredit` block
-     * for the receipt: `balance_after` is the recorded draw trajectory for a
-     * settled draw, and the restored available balance for a released one.
+     * Existing Postgres pool to reuse instead of opening one from `database`
+     * (internal-review test seam). When set, the host builds its JobStore / KVStore /
+     * cashu accumulator on this pool and leaves it open at shutdown — the caller
+     * owns it. Lets the e2e harness run DVMs in `p2pk-accumulator` mode against
+     * its single shared pool rather than spawning a pool per DVM.
      */
-    private resolveCreditDraw;
+    pool?: Pool;
+    /** Cashu mints accepted. Defaults to env `DVMKIT_CASHU_MINTS`. */
+    mints?: string[];
+    /** Cashu receive mode override. */
+    cashuMode?: CashuMode;
+    /** MPP handle override. Defaults to env-resolved via `createMppFromOpts`. */
+    mpp?: MppxServer;
+    /** x402 stablecoin payment configuration. Defaults to env-resolved. */
+    x402?: X402Config;
+    /** Payment methods override. Defaults to derived from configured rails. */
+    paymentMethods?: PaymentMethod[];
     /**
-     * The one place a terminal job's status becomes a ledger verb (internal-review):
-     * `completed` settles the hold into a real debit, `failed`/`cancelled`
-     * release it. Read by the in-line funnel (`resolveCreditDraw`) and by the
-     * late reconciler (`reconcileTerminalDraw`) — two paths that must never
-     * disagree about what an outcome means for the caller's money.
+     * Lightning receive leg for credit funding (internal-review). Defaults to the
+     * env-resolved `DVMKIT_NWC_RECEIVE_URI` /
+     * `DVMKIT_NWC_RECEIVE_INVOICE_TTL_SECONDS`. Pass `backend` to inject a
+     * wallet directly — a test seam that skips the connect-time probe, so
+     * production must always come through the URI.
      */
-    private settlesDraw;
+    lightningReceive?: LightningReceiveConfig;
+    /** When true, payment is skipped if no mints are configured (dev/test). */
+    devMode?: boolean;
+    /** Consumed-credential store override (test seam). */
+    consumedCredentialStore?: ConsumedCredentialStore;
+    /** Mint-health tracker override (test seam). */
+    mintHealthTracker?: MintHealthTracker;
+    /** Operator-alert boundary for failed terminal-job retention passes. */
+    onJobRetentionSweepFailed?: JobManagerOpts["onJobRetentionSweepFailed"];
+    /** Clear-on-recovery boundary invoked after a complete clean retention pass. */
+    onJobRetentionSweepRecovered?: JobManagerOpts["onJobRetentionSweepRecovered"];
     /**
-     * Sign a locally-held terminal job's receipt and mirror it onto the
-     * in-memory job, so the read paths served out of `activeJobs` during the
-     * cleanup window hand back the same bytes as a cross-machine re-read.
+     * Wrap the SDK compatibility gate before it is exposed to descriptor custom
+     * routes. Platform hosts use this to enforce their independently released
+     * caller rollout policy; self-hosted SDK consumers receive the default gate.
      */
-    private attachReceipt;
+    wrapRouteClientCompatibility?: (sdkGate: ClientCompatibilityGate) => ClientCompatibilityGate;
+}
+/** Per-mount options. Currently only `prefix` is supported. */
+interface MountOpts {
+    /** Path prefix for this DVM's protocol routes (e.g. `/delete-feed`). */
+    prefix?: string;
+}
+/** Live DVM host. Single wiring locus for the SDK (internal-review). */
+interface DVMHost {
     /**
-     * Read-path repair for a terminal job carrying no receipt (internal-review), for
-     * either an in-memory job or a store record. Free in the steady state — it
-     * returns on the `receipt` check without touching the store — so it costs
-     * only on the cases it exists for:
-     *
-     * - **A crash between the two store calls.** `claimReceiptSeq` commits the
-     *   sequence number to the job row before `saveReceipt` writes the bytes; a
-     *   process death in that window would otherwise strand that number
-     *   forever, and a permanent gap is indistinguishable from the deliberate
-     *   suppression `seq` exists to expose. Re-issuing here reuses the already
-     *   committed number (the claim is idempotent per job) rather than
-     *   allocating a second one.
-     * - **A transient store failure** at the terminal: `issueReceipt` logs
-     *   `receipt_issue_failed` and returns nothing rather than failing the job,
-     *   so the next read retries.
-     * - **Jobs that terminated before the DVM had a receipt key.** They pick one
-     *   up on first read, with `issued_at` reflecting when it was signed.
+     * Underlying Hono app for custom non-protocol routes that belong to the
+     * host (cross-DVM `/admin`, cron callbacks, etc.). For DVM-scoped routes,
+     * declare `routes(app)` on the descriptor.
      */
-    ensureReceipt(target: ServerJob | JobRecord): Promise<void>;
+    readonly app: Hono;
     /**
-     * Close out a terminal job whose caller hasn't already persisted it: sign
-     * the receipt, then save the snapshot. The snapshot save never writes the
-     * receipt column, so ordering only affects how soon a reader sees the
-     * receipt — this way a caller polling immediately after the terminal
-     * already finds it.
+     * Resolved Postgres pool — undefined before `host.serve()` completes
+     * database resolution, set thereafter. Exposed so DVM-local Postgres
+     * consumers (e.g. scrape's `ScrapeDb` per-fetch event store, internal-review)
+     * can reuse the host's pool rather than constructing their own. Wire
+     * inside descriptor `onBoot` (fires after pool init, before listener opens).
      */
-    private finalizeTerminal;
+    readonly pool: Pool | undefined;
     /**
-     * Issue a receipt for a job this process doesn't hold in `activeJobs` — a
-     * cross-machine cancel, or a row the stale sweeper just reaped. Re-reads the
-     * record so the receipt is built from the committed terminal row rather than
-     * from whatever the caller happened to have in hand.
+     * Money-safe credit ledger (internal-review) — undefined before `host.serve()`
+     * resolves stores, set thereafter. Postgres-backed when a pool exists;
+     * pool-less hosts get a shared in-memory ledger so the internal-review fund+draw
+     * semantics hold everywhere. Same wiring window as `pool` (descriptor
+     * `onBoot` fires after init, before the listener opens).
      */
-    issueReceiptForStoredJob(jobId: string): Promise<JobReceipt | undefined>;
-    /** Handle job reaching terminal state (completed, failed, cancelled). */
-    private handleJobTerminal;
+    readonly creditLedger: CreditLedgerLike | undefined;
     /**
-     * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
-     * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
-     *
-     * For a **credit-backed** job the revenue event is the *settled draw* (spec
-     * §10), and since internal-review the sats figure corrects the job's mirror of that
-     * draw against the draw itself: `withDrawBasis` stamps the job when the
-     * payment lands, but a Bitcoin credit's settle re-prices the draw against
-     * the funding lots it consumed. The correction is a delta, because a job's
-     * counter can carry legs no draw ever absorbed — except where the draw's
-     * forecast was zero and the counter therefore never held a component to
-     * correct. The event is dated at settlement rather than at report time. A
-     * released draw — the failed/cancelled path — is deliberately unreachable
-     * here, which is what makes "no debit on job failure" true in the books as
-     * well as the ledger.
-     *
-     * For everything else (free-then-paid jobs, isolate-shaped flows, a DVM
-     * whose price couldn't be fiat-denominated) nothing changes: the pre-credits
-     * payload is reported verbatim.
-     *
-     * Takes the fields rather than a `ServerJob` so the internal-review reconciler — a
-     * background sweep that holds no in-process job — books through this exact
-     * path off the row it read. `paymentTxHash` is passed **verbatim**, never
-     * recomputed as a `drawSettlementRef`: it is the same column the in-line
-     * funnel reads, so the two bookings are byte-identical by construction and
-     * the platform's `UNIQUE (rail, tx_hash)` dedupes them. Deriving it instead
-     * would diverge on an implicit N=1 job (whose row carries the rail's own
-     * reference) and on any job whose column a mid-job top-up overwrote — the
-     * same rot `resolveDrawPool` documents as the reason not to read regime off
-     * this column.
-     *
-     * Returns whether the report was handed to `onJobCompleted`, so a caller
-     * that logs the booking says what actually happened rather than what it
-     * assumed — the guards below still drop legitimate shapes (a free job, a
-     * DVM with no reporter). Every drop that costs a booking logs first.
-     *
-     * The rail check sits **below** the draw re-read, not in the entry guard
-     * (internal-review): a settled draw the terminal can't report under is a real debit
-     * with no revenue event, permanently overstating outstanding liability
-     * (`deposits − draw revenue`), and it used to return here in silence. Placed
-     * after the re-read, `revenue_skipped_no_rail` can name the draw and its
-     * amount, and can distinguish the four causes — see its `reason` below.
+     * Add a DVM to this host. Multiple mounts compose at distinct prefixes;
+     * a single mount with no prefix attaches at root.
      */
-    private bookRevenue;
-    /** Schedule job removal from activeJobs after a delay so clients can still poll final status. */
-    scheduleCleanup(job: ServerJob): void;
-    /** Clear all timers. Called on server shutdown to allow clean exit. */
-    shutdown(): void;
+    mount<S, I extends ZodLike | undefined>(descriptor: DVMDescriptor<S, I>, opts?: MountOpts): void;
+    /** Start listening. Returns the live server handle. */
+    serve(opts?: {
+        port?: number;
+    }): Promise<{
+        url: string;
+        close: () => Promise<void>;
+    }>;
+    /** Graceful shutdown. Runs descriptor `onShutdown` hooks in reverse mount order. */
+    shutdown(): Promise<void>;
 }
+/**
+ * Single wiring locus for SDK-side construction (internal-review). Replaces both the
+ * `serve()` wrapper and the `createDVMServer` direct path. Reads env once,
+ * resolves payment rails, owns the Postgres pool, and mounts each DVM
+ * descriptor as a Hono sub-app on `host.app`.
+ */
+declare function createDVMHost(opts?: DVMHostOpts): DVMHost;
 
 /**
  * Cached liveness signal for the platform's central Tempo close observer
@@ -4685,12 +4367,12 @@ interface SDKServerOpts {
     /** Cashu receive mode (internal-review). */
     cashuMode?: CashuMode;
     /**
-     * Builder's NUT-11 P2PK lock pubkey (internal-review). Required to enable accumulator
-     * mode — used as the seed pubkey for `seedLockPubkeyState` on first boot, and
-     * as the gate for whether `/v1/info` advertises `cashu` and the admin routes
-     * mount. After first boot, the authoritative `[current, ...retired]` state
-     * lives in the DVM's Postgres via `dvm_lock_pubkeys`; rotations (internal-review)
-     * mutate that store directly.
+     * Builder's NUT-11 P2PK lock pubkey (internal-review). Used as the seed pubkey for
+     * `seedLockPubkeyState` on first boot, as the admin-auth identity, and as
+     * part of the gate for whether `/v1/info` advertises `cashu`. After first
+     * boot, the authoritative `[current, ...retired]` state lives in the DVM's
+     * Postgres via `dvm_lock_pubkeys`; rotations (internal-review) mutate that store
+     * directly.
      */
     lockPubkey?: string;
     /**
@@ -4708,7 +4390,7 @@ interface SDKServerOpts {
      * without a separate env var.
      */
     canonicalDvmId?: string;
-    /** Postgres pool for wallet accumulator persistence. */
+    /** Postgres pool for builder admin state and wallet accumulator persistence. */
     db?: Pool;
     /**
      * General SDK strict-mode flag (internal-review), sourced from `DVMKIT_FAIL_FAST` at
@@ -4766,6 +4448,10 @@ interface SDKServerOpts {
      * the platform reporter alongside the completion and paid-job-death paths.
      */
     onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
+    /** Advanced operator-alert callback for failed job-retention passes. */
+    onJobRetentionSweepFailed?: JobManagerOpts["onJobRetentionSweepFailed"];
+    /** Advanced clear-on-recovery callback for clean job-retention passes. */
+    onJobRetentionSweepRecovered?: JobManagerOpts["onJobRetentionSweepRecovered"];
     /**
      * Advanced override: callback fired when a payment funds a credit (internal-review).
      * Auto-wired to the `RevenueReporter`'s deposit report alongside
@@ -5122,4 +4808,4 @@ declare function attachCreditMenu(body: Record<string, unknown>, menu: CreditMen
  */
 declare function toCreditTerms(menu: CreditMenu): CreditTerms;
 
-export { assertRevenueReporterReady as $, type AccumulatorPool as A, type BuilderIdentityKeypair as B, type CreatedInvoice as C, X402FacilitatorHealth as D, type X402SettlementEvidenceOutcome as E, type FiatDenomination as F, type X402SettlementRepair as G, type X402SettlementRepairRefusal as H, type InvoiceStatus as I, JobCancelledError as J, type X402SettlementRepaired as K, type LightningTransactionListOptions as L, type MintAmountBounds as M, type X402WedgedSettlement as N, type X402WedgedSettlementPage as O, PAYMENT_PROOF_KEYS as P, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, abortJob as W, type X402BatchChannelObservation as X, amountBoundsVerdict as Y, applyPaymentInfoToJob as Z, assertNutSupport as _, type LightningTransactionSnapshot as a, MIN_INVOICE_TTL_SECONDS as a$, buildAttestation as a0, buildPaymentErrorResponse as a1, canSwap as a2, checkMintHealth as a3, clearAccumulatorForDvm as a4, createDVMServer as a5, creditDepositPayload as a6, derivedFundCreditId as a7, devModeSkipsPaymentVerification as a8, fromJobRecord as a9, toJobRecord as aA, unknownRouteNotFound as aB, verifyAttestation as aC, verifyIncomingPayment as aD, verifyTempoSessionManagementCredential as aE, verifyUpfrontPayment as aF, writeIdentity as aG, x402RequiredUsdcMicro as aH, x402SettledShare as aI, type CreditMenu as aJ, ReceiptIssuer as aK, LightningReceive as aL, TempoSettlementReadiness as aM, type DVMHostOpts as aN, type BuildCreditMenuArgs as aO, type BuilderIdentity as aP, CREDIT_ENVELOPE_KEYS as aQ, type CreateX402BatchSettlementServerOpts as aR, type CreditEnvelope as aS, CreditEnvelopeError as aT, type CreditFundCommitment as aU, type CreditTerms as aV, DEFAULT_INVOICE_TTL_SECONDS as aW, type DVMHost as aX, JobManager as aY, type JobManagerOpts as aZ, type LightningReceiveConfig as a_, fundedMicroFor as aa, generateIdentity as ab, hasPaymentProof as ac, hashCapabilities as ad, hashLockKey as ae, implicitCreditId as af, initWalletAccumulatorTable as ag, insertAccumulatorRows as ah, isDerivedCreditId as ai, isTerminal as aj, isYieldMessage as ak, issueUpfrontChallenges as al, loadIdentitySecret as am, toLockPubkey as an, msatsToFiatMicro as ao, paymentErrorBody as ap, pinAskFiat as aq, priceFiatMicro as ar, processIncomingPayment as as, providerMessage as at, repairX402ExactSettlementEffect as au, resolveFxSnapshot as av, resolvePriceFiat as aw, revenueReporterBannerState as ax, signAttestation as ay, toCreditTerms as az, type LightningBackend as b, MemoryConsumedCredentialStore as b0, type MemoryConsumedCredentialStoreOpts as b1, MemoryProcessedPaymentStore as b2, MemoryX402ExactSettlementStore as b3, type MountOpts as b4, type OwnerDisplay as b5, type PlatformReporterOpts as b6, PostgresProcessedPaymentStore as b7, PostgresX402ExactSettlementStore as b8, type PriceFiat as b9, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as bA, X402_BATCH_SETTLEMENT_NETWORK as bB, attachCreditMenu as bC, buildCreditMenu as bD, createDVMHost as bE, createX402BatchSettlementServer as bF, creditEnvelopeIgnoreFields as bG, drawSettlementRef as bH, extractCreditEnvelope as bI, fundingCommitment as bJ, selectPrimaryCredit as bK, stripCreditEnvelope as bL, toCreditView as bM, type ProcessedPaymentQuerier as ba, type ProcessedPaymentRail as bb, type ProcessedPaymentRecord as bc, ProcessedPaymentReplayError as bd, type ProcessedPaymentStore as be, type X402BatchAcceptance as bf, type X402BatchFunding as bg, type X402BatchRefusal as bh, type X402BatchSettlementServer as bi, type X402ExactAcceptance as bj, X402ExactIntentConflictError as bk, type X402ExactSettlementAttempt as bl, type X402ExactSettlementChainEvidence as bm, type X402ExactSettlementEffect as bn, X402ExactSettlementEvidenceMissingError as bo, type X402ExactSettlementEvidenceReader as bp, type X402ExactSettlementIntent as bq, X402ExactSettlementNotReadyError as br, X402ExactSettlementServer as bs, type X402ExactSettlementServerOpts as bt, type X402ExactSettlementStatus as bu, type X402ExactSettlementStore as bv, type X402SettlementChainEvidence as bw, type X402SettlementEvidenceReader as bx, X402SettlementSubmissionError as by, X402_BATCH_AUTO_SETTLEMENT as bz, type LightningPayment as c, type LightningWalletInfo as d, type LockPubkey as e, type AccumulatorQuerier as f, type ConsumedCredentialStore as g, type MintHealthCheckResult as h, type AppEnv as i, type AttestationPayload as j, type CheckMintHealthOptions as k, type CreditFundingReport as l, type FiatDenominationFailure as m, type FundOnlyRequest as n, type IncomingPaymentOpts as o, MintHealthTracker as p, type PaymentErrorCode as q, type PaymentErrorDetail as r, type PaymentInfo as s, type ResolvedFx as t, type RevenueBootCheckOpts as u, type ServerJob as v, type ShortPayForfeit as w, type TempoObserverHealth as x, TempoSessionChannelMismatchError as y, type VerifyIncomingSnapshot as z };
+export { isTerminal as $, type AccumulatorPool as A, buildPaymentErrorResponse as B, type ConsumedCredentialStore as C, clearAccumulatorForDvm as D, createDVMServer as E, type FiatDenomination as F, creditDepositPayload as G, derivedFundCreditId as H, type IncomingPaymentOpts as I, JobCancelledError as J, devModeSkipsPaymentVerification as K, fromJobRecord as L, MintHealthTracker as M, fundedMicroFor as N, hasPaymentProof as O, PAYMENT_PROOF_KEYS as P, hashLockKey as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, implicitCreditId as W, type X402BatchChannelObservation as X, initWalletAccumulatorTable as Y, insertAccumulatorRows as Z, isDerivedCreditId as _, type AccumulatorQuerier as a, X402ExactSettlementEvidenceMissingError as a$, isYieldMessage as a0, issueUpfrontChallenges as a1, msatsToFiatMicro as a2, paymentErrorBody as a3, pinAskFiat as a4, priceFiatMicro as a5, processIncomingPayment as a6, providerMessage as a7, repairX402ExactSettlementEffect as a8, resolveFxSnapshot as a9, type JobManagerOpts as aA, type LightningReceiveConfig as aB, MIN_INVOICE_TTL_SECONDS as aC, MemoryConsumedCredentialStore as aD, type MemoryConsumedCredentialStoreOpts as aE, MemoryProcessedPaymentStore as aF, MemoryX402ExactSettlementStore as aG, type MountOpts as aH, type OwnerDisplay as aI, type PlatformReporterOpts as aJ, PostgresProcessedPaymentStore as aK, PostgresX402ExactSettlementStore as aL, type PriceFiat as aM, type ProcessedPaymentQuerier as aN, type ProcessedPaymentRail as aO, type ProcessedPaymentRecord as aP, ProcessedPaymentReplayError as aQ, type ProcessedPaymentStore as aR, type X402BatchAcceptance as aS, type X402BatchFunding as aT, type X402BatchRefusal as aU, type X402BatchSettlementServer as aV, type X402ExactAcceptance as aW, X402ExactIntentConflictError as aX, type X402ExactSettlementAttempt as aY, type X402ExactSettlementChainEvidence as aZ, type X402ExactSettlementEffect as a_, resolvePriceFiat as aa, revenueReporterBannerState as ab, toCreditTerms as ac, toJobRecord as ad, unknownRouteNotFound as ae, verifyIncomingPayment as af, verifyTempoSessionManagementCredential as ag, verifyUpfrontPayment as ah, x402RequiredUsdcMicro as ai, x402SettledShare as aj, type CreditMenu as ak, ReceiptIssuer as al, LightningReceive as am, TempoSettlementReadiness as an, type DVMHostOpts as ao, type BuildCreditMenuArgs as ap, type BuilderIdentity as aq, CREDIT_ENVELOPE_KEYS as ar, type CreateX402BatchSettlementServerOpts as as, type CreditEnvelope as at, CreditEnvelopeError as au, type CreditFundCommitment as av, type CreditTerms as aw, DEFAULT_INVOICE_TTL_SECONDS as ax, type DVMHost as ay, JobManager as az, type AppEnv as b, type X402ExactSettlementEvidenceReader as b0, type X402ExactSettlementIntent as b1, X402ExactSettlementNotReadyError as b2, X402ExactSettlementServer as b3, type X402ExactSettlementServerOpts as b4, type X402ExactSettlementStatus as b5, type X402ExactSettlementStore as b6, type X402SettlementChainEvidence as b7, type X402SettlementEvidenceReader as b8, X402SettlementSubmissionError as b9, X402_BATCH_AUTO_SETTLEMENT as ba, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as bb, X402_BATCH_SETTLEMENT_NETWORK as bc, attachCreditMenu as bd, buildCreditMenu as be, createDVMHost as bf, createX402BatchSettlementServer as bg, creditEnvelopeIgnoreFields as bh, drawSettlementRef as bi, extractCreditEnvelope as bj, fundingCommitment as bk, selectPrimaryCredit as bl, stripCreditEnvelope as bm, toCreditView as bn, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, type ResolvedFx as i, type RevenueBootCheckOpts as j, type ServerJob as k, type ShortPayForfeit as l, type TempoObserverHealth as m, TempoSessionChannelMismatchError as n, type VerifyIncomingSnapshot as o, X402FacilitatorHealth as p, type X402SettlementEvidenceOutcome as q, type X402SettlementRepair as r, type X402SettlementRepairRefusal as s, type X402SettlementRepaired as t, type X402WedgedSettlement as u, type X402WedgedSettlementPage as v, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as w, abortJob as x, applyPaymentInfoToJob as y, assertRevenueReporterReady as z };