@dvmkit/sdk 0.1.5-rc.8 → 0.2.0-rc.9

package/dist/{chunk-UB5FZ43T.js → chunk-PCUQZDZA.js}

@@ -1,7 +1,7 @@
 import {
   MemoryProcessedPaymentStore,
   ProcessedPaymentReplayError
-} from "./chunk-DMNLFNTW.js";
+} from "./chunk-QT4ONTST.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -10,7 +10,7 @@ import {
 } from "./chunk-BQ2NMWKE.js";
 import {
   MemoryCreditLedger
-} from "./chunk-KVEHHC7W.js";
+} from "./chunk-PHHAYRQV.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -35,7 +35,7 @@ import {
   localMessage,
   providerMessage,
   toJobRecord
-} from "./chunk-U6M3ATSG.js";
+} from "./chunk-JDT5LCJC.js";
 import {
   ADMIN_AUTH_CLOCK_SKEW_SECONDS,
   ADMIN_AUTH_NONCE_TTL_SECONDS,
@@ -100,7 +100,7 @@ import {
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-E4EVGPDX.js";
+} from "./chunk-XQXJKJ3P.js";
 import {
   FxRateUnavailableError,
   InvalidCurrencyError,
@@ -109,7 +109,7 @@ import {
   fxRateFor,
   resolveFxSourceFromEnv,
   validateCurrency
-} from "./chunk-27V2ILSR.js";
+} from "./chunk-4A2RAKCW.js";
 import {
   fiatToSatsCeil,
   parseUsdPrice,
@@ -130,7 +130,7 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-MLRCSJYX.js";
+} from "./chunk-V7EVFLAK.js";
 import {
   withSdkInitLock
 } from "./chunk-S3XAHZQY.js";
@@ -141,7 +141,7 @@ import {
   advertisedMethods,
   challengeMeta,
   isTempoInsufficientFundsError
-} from "./chunk-M7LHFJ5K.js";
+} from "./chunk-KMZXTBLA.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -883,7 +883,7 @@ async function buildCreditMenu(args) {
     funding,
     // Rendered when either half has something to say: a DVM configured for
     // sessions only would otherwise lose the whole block the moment the gate
-    // closed, taking its capability signal with it (internal-review).
+    // closed, taking its capability signal with it.
     ...(tempoMethods.length > 0 || tempoWithheld.length > 0) && {
       tempo: {
         methods: tempoMethods,
@@ -896,7 +896,7 @@ async function buildCreditMenu(args) {
     // are the same misadvertisement in the other direction.
     ...funding.includes("x402") && x402Schemes.length > 0 && { x402: { schemes: x402Schemes } }
   };
-  if (args.funding.includes("lightning") && args.lightningFundingMinSats !== void 0) {
+  if (funding.includes("lightning") && args.lightningFundingMinSats !== void 0) {
     try {
       const fx = await args.fxFetcher.fetch();
       menu.lightning_min_micro = lightningFloorMicro(args.lightningFundingMinSats, fx, currency);
@@ -905,7 +905,7 @@ async function buildCreditMenu(args) {
         "credit_menu_lightning_floor_unavailable",
         `credit menu degraded: could not express the Lightning funding floor in ${currency}, so the lightning rail is omitted from the funding menu until a rate is available.`
       );
-      menu.funding = args.funding.filter((rail) => rail !== "lightning");
+      menu.funding = menu.funding.filter((rail) => rail !== "lightning");
     }
   }
   const echo = await selectPrimaryCredit({
@@ -1950,7 +1950,7 @@ async function createX402BatchSettlementServer(opts) {
     ...opts.config.autoSettlement === false ? {} : opts.config.autoSettlement,
     // Every claim this fleet builds is capped at earned draws — the claim
     // timer, `claimAndSettle()`, and the withdraw-race rush claim all route
-    // through this selector (internal-review). A builder-supplied
+    // through this selector. A builder-supplied
     // `autoSettlement.selectClaimChannels` cannot override it: the ceiling is
     // a money invariant, not a policy knob. Upstream's refund job builds its
     // bundled claim from storage instead and never consults a selector, which
@@ -2071,14 +2071,13 @@ async function createX402BatchSettlementServer(opts) {
         // move money. The voucher base does not: a cooperatively drained and
         // reused channel can present the same cumulative maximum again under a
         // fresh authorization, which made the second legitimate deposit
-        // collide with the first row (internal-review). Conversely, keying by the
+        // collide with the first row. Conversely, keying by the
         // credit effect would let one signed authorization open several rows.
         //
         // A cooperative refund belongs to one caller drain: after an operator
         // writes a failed drain off, the unchanged channel can legitimately
         // present the same voucher base under a fresh drain id. Keep that new
         // effect out of the old row's `(operation, payment_id)` replay slot
-        // (internal-review).
         paymentId: isRefund ? `${paymentBase}:${settlementId}` : depositPaymentId ?? paymentBase,
         amount: matched.amount
       };
@@ -3049,6 +3048,26 @@ function msatsToMethodAmount(msats, methodName, btcUsd) {
   const usd = msatsToUsd(msats, btcUsd);
   return usd.toFixed(decimalsFor(methodName));
 }
+function fiatMicroToMethodAmount(amountMicro, methodName) {
+  if (!Number.isSafeInteger(amountMicro) || amountMicro < 0) {
+    throw new Error("mpp-units: fiat amount must be a non-negative safe integer");
+  }
+  const decimals = decimalsFor(methodName);
+  const microDecimals = 6;
+  let atomic = BigInt(amountMicro);
+  if (decimals < microDecimals) {
+    const divisor = 10n ** BigInt(microDecimals - decimals);
+    if (atomic % divisor !== 0n) {
+      throw new Error(
+        `mpp-units: fiat microunits cannot be represented exactly with ${decimals} decimals`
+      );
+    }
+    atomic /= divisor;
+  } else if (decimals > microDecimals) {
+    atomic *= 10n ** BigInt(decimals - microDecimals);
+  }
+  return methodNativeAmountToDecimal(atomic, methodName);
+}
 function methodNativeAsset(methodName) {
   switch (methodName) {
     case "tempo":
@@ -3287,7 +3306,7 @@ var PAYMENT_PROOF_KEYS = ["cashu_token", "x402_payment", "tempo_credential"];
 function hasPaymentProof(content) {
   return PAYMENT_PROOF_KEYS.some((key) => Boolean(content[key]));
 }
-async function issueUpfrontChallenges(mpp, requiredMsats, resourcePath, btcUsdRate, sessionIssuable = true, allowOneShotStablecoin = false) {
+async function issueUpfrontChallenges(mpp, requiredMsats, resourcePath, btcUsdRate, sessionIssuable = true, allowOneShotStablecoin = false, priceFiat) {
   return loggers.tempo.span(
     "tempo.issue_challenges",
     {
@@ -3305,7 +3324,7 @@ async function issueUpfrontChallenges(mpp, requiredMsats, resourcePath, btcUsdRa
         if (creditSurface && meta.intent === "charge" && !stablecoinCreditInstrumentAllowed(allowOneShotStablecoin, "tempo_charge")) {
           continue;
         }
-        const amount = msatsToMethodAmount(requiredMsats, meta.name, btcUsdRate);
+        const amount = priceFiat?.currency === "usd" ? fiatMicroToMethodAmount(priceFiat.amountMicro, meta.name) : msatsToMethodAmount(requiredMsats, meta.name, btcUsdRate);
         const ch = await mpp.issueChallenge(meta.name, meta.intent, {
           amount,
           ...meta.intent === "session" && { suggestedDeposit: amount, unitType: "request" },
@@ -3611,7 +3630,7 @@ async function verifyUpfrontPayment(opts) {
               // Nothing settled, so the EIP-3009 nonce is unspent and the same
               // header is still payable — unlike the post-settlement branch
               // below, where saying this would be telling the caller to pay
-              // twice (internal-review).
+              // twice.
               hint: `Nothing was settled \u2014 re-sign this request with fund.amount_micro set to expected_micro (${predicted}), re-attach this same X-PAYMENT header, and resubmit.`
             }
           );
@@ -3632,7 +3651,7 @@ async function verifyUpfrontPayment(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
+      const { verifyX402Payment } = await import("./x402-7S2EFINY.js");
       const receipt = await verifyX402Payment(
         x402Payment,
         x402Config,
@@ -3669,7 +3688,7 @@ async function verifyUpfrontPayment(opts) {
               `fund.amount_micro (${creditEnv.fund.amountMicro}) does not match the settled payment's value at the quoted price (${fundedMicro}).`,
               // `expected_micro` states the valuation, but carries no corrective
               // hint here: the facilitator already settled, so re-presenting
-              // this credential would be a second payment (internal-review).
+              // this credential would be a second payment.
               { extra: { expected_micro: fundedMicro } }
             );
           }
@@ -3783,13 +3802,14 @@ async function verifyUpfrontPayment(opts) {
                 resourcePath ?? "/v1/job",
                 rate,
                 sessionIssuable,
-                opts.fundOnly?.allowOneShotStablecoin
+                opts.fundOnly?.allowOneShotStablecoin,
+                opts.priceFiat
               )
             }
           };
         }
       }
-      const expectedAmount = msatsToMethodAmount(requiredMsats, cred.challenge.method, rate);
+      const expectedAmount = opts.priceFiat?.currency === "usd" ? fiatMicroToMethodAmount(opts.priceFiat.amountMicro, cred.challenge.method) : msatsToMethodAmount(requiredMsats, cred.challenge.method, rate);
       const sessionBasis = mppSessionBasis(cred);
       let tempoReceipt;
       const broadcast = async () => {
@@ -3862,7 +3882,8 @@ async function verifyUpfrontPayment(opts) {
           resourcePath ?? "/v1/job",
           rate,
           sessionIssuable,
-          opts.fundOnly?.allowOneShotStablecoin
+          opts.fundOnly?.allowOneShotStablecoin,
+          opts.priceFiat
         );
         return {
           paidMsats: 0,
@@ -3886,7 +3907,8 @@ async function verifyUpfrontPayment(opts) {
             resourcePath ?? "/v1/job",
             rate,
             sessionIssuable,
-            opts.fundOnly?.allowOneShotStablecoin
+            opts.fundOnly?.allowOneShotStablecoin,
+            opts.priceFiat
           );
           return {
             paidMsats: 0,
@@ -3952,7 +3974,8 @@ async function verifyUpfrontPayment(opts) {
         resourcePath ?? "/v1/job",
         rate,
         sessionIssuable,
-        opts.fundOnly?.allowOneShotStablecoin
+        opts.fundOnly?.allowOneShotStablecoin,
+        opts.priceFiat
       );
       return {
         paidMsats: 0,
@@ -4015,7 +4038,8 @@ async function verifyUpfrontPayment(opts) {
       resourcePath ?? "/v1/job",
       rate,
       sessionIssuable,
-      opts.fundOnly?.allowOneShotStablecoin
+      opts.fundOnly?.allowOneShotStablecoin,
+      opts.priceFiat
     ) : void 0;
     return {
       paidMsats: 0,
@@ -4170,16 +4194,16 @@ var PAYMENT_ERROR_COPY = {
   // Only the Cashu accumulator emits this code, and it evaluates each call's
   // own proofs — nothing sums a partial with a later one, on any path. So the
   // retry owes the full amount: implicit upfront the shortfall was forfeited
-  // (internal-review), mid-job it sits on a credit the per-site hint names
-  // (internal-review). Explicit upfront short deposits use `insufficient_credit`
-  // instead (internal-review). Telling a caller to "send the difference" produced a
+  // mid-job it sits on a credit the per-site hint names
+  // Explicit upfront short deposits use `insufficient_credit`
+  // instead. Telling a caller to "send the difference" produced a
   // second short pay either way.
   payment_insufficient: {
     display: "The payment was less than the amount required, so it didn't cover the request. The full amount is still owed.",
     hint: "Retry with a single payment of required_msats \u2014 a partial payment does not reduce what is owed.",
     retryable: true
   },
-  // internal-review: the rail and the ledger leg commit together, but the job row is
+  // the rail and the ledger leg commit together, but the job row is
   // written by a *second* transaction (`verifyAndCredit`). When that one can't
   // be made to land, the money is real and the caller's — it just isn't on the
   // job. Say so rather than answering a bare 500: the per-site body names the
@@ -4226,7 +4250,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "Use a different prepaid balance or pay per call. To reclaim this balance after running jobs finish, inspect it with 'dvm wallet tempo-exit <dvm>'.",
     retryable: false
   },
-  // internal-review: a refund on this credit's payment channel reached the chain and
+  // a refund on this credit's payment channel reached the chain and
   // never finished booking, so the escrow behind the balance may already have
   // been paid back. Spending it would buy work the service can never collect
   // for. The copy must not promise the money is gone *or* that it is safe to
@@ -4258,7 +4282,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "Fund at least min_micro (in the credit block of any quote) and try again.",
     retryable: true
   },
-  // internal-review: a per-rail floor, not the menu-wide minimum — today only the
+  // a per-rail floor, not the menu-wide minimum — today only the
   // lightning rail carries one (the receive channel's routing floor). Refused
   // before any invoice is minted, so nothing is ever paid against this code;
   // `retryable: false` because re-sending the identical request can never
@@ -4288,7 +4312,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "The balance is zero or fully held by in-flight jobs. Wait for running jobs to finish, then request the drain again with a fresh drain_id.",
     retryable: true
   },
-  // internal-review. Distinct from `nothing_to_drain` because the balance is real and
+  // Distinct from `nothing_to_drain` because the balance is real and
   // waiting changes nothing: a reusable Bitcoin balance is a deposit the
   // service owes back in the asset it received, and what is left here converts
   // to less than one satoshi at the rate its own funding landed at. There is
@@ -4320,7 +4344,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "Run 'dvm wallet tempo-exit <dvm>' to inspect the channel, request its on-chain exit if needed, and withdraw after the 15-minute grace period.",
     retryable: false
   },
-  // internal-review. The voucher verified and the ledger leg rolled back with the
+  // The voucher verified and the ledger leg rolled back with the
   // failed submission, so nothing was charged and nothing about the payment is
   // wrong — which is exactly what the `payment_invalid` this replaced got
   // backwards, telling an agent to discard a credential that is still good. The
@@ -4397,7 +4421,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "The token's proofs are pending at the mint; retry in a few seconds.",
     retryable: true
   },
-  // internal-review. Not failures — the two `lightning_*` states below are the normal
+  // Not failures — the two `lightning_*` states below are the normal
   // shape of an interactive funding leg, which is why both are retryable and
   // neither `display` implies anything went wrong.
   lightning_settlement_pending: {
@@ -4417,7 +4441,7 @@ var PAYMENT_ERROR_COPY = {
   },
   replay_rejected: {
     display: "This payment was already submitted, so it wasn't charged again.",
-    // internal-review: this hint reaches a caller whose money already landed — the
+    // this hint reaches a caller whose money already landed — the
     // accumulator holds these proofs under this request id. It used to read
     // "use a fresh token and a new request id for the next payment", which an
     // agent could follow straight into paying twice for the same charge.
@@ -4561,7 +4585,7 @@ async function verifyIncomingPayment(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
+      const { verifyX402Payment } = await import("./x402-7S2EFINY.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -4696,7 +4720,10 @@ async function verifyIncomingPayment(body, opts, snapshot) {
           }
         };
       }
-      const expectedAmount = msatsToMethodAmount(expectedMsats, credential.challenge.method, rate);
+      const expectedAmount = snapshot.pendingPaymentFiatCurrency === "usd" && snapshot.pendingPaymentFiatMicro !== void 0 ? fiatMicroToMethodAmount(
+        snapshot.pendingPaymentFiatMicro,
+        credential.challenge.method
+      ) : msatsToMethodAmount(expectedMsats, credential.challenge.method, rate);
       const expectedMeta = challengeMeta(credential.challenge);
       const creditNative = methodNativeAmountFromDecimal(
         expectedAmount,
@@ -4975,7 +5002,7 @@ async function processIncomingPayment(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
+      const { verifyX402Payment } = await import("./x402-7S2EFINY.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5041,7 +5068,7 @@ async function processIncomingPayment(job, body, opts) {
           status: 402
         };
       }
-      const expectedAmount = msatsToMethodAmount(expectedMsats, credential.challenge.method, rate);
+      const expectedAmount = job.pendingPaymentFiatCurrency === "usd" && job.pendingPaymentFiatMicro !== void 0 ? fiatMicroToMethodAmount(job.pendingPaymentFiatMicro, credential.challenge.method) : msatsToMethodAmount(expectedMsats, credential.challenge.method, rate);
       const expectedMeta = challengeMeta(credential.challenge);
       await loggers.tempo.span(
         "tempo.verify_credential",
@@ -5279,7 +5306,7 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
       // requestId is non-null here because acceptAccumulatorPayment returns
       // kind:"rejected" with code "missing_request_id" when unset (handled by
       // the rejected branch above). Thread it as the per-call settlement
-      // reference for revenue_events.tx_hash (internal-review). Unique per
+      // reference for revenue_events.tx_hash. Unique per
       // (dvm_id, request_id) by the wallet_accumulator UNIQUE constraint, so
       // it serves as a stable id even though it isn't an on-chain hash.
       paymentTxHash: opts.requestId,
@@ -5428,7 +5455,7 @@ async function resolveTopUpLedgerContext(opts, snapshot, binding) {
       amount_micro: priceFiat.amountMicro,
       // Which rung degraded: the whole snapshot fell back to `lastKnown()`, or
       // the live fetch landed without this currency and it was carried forward
-      // from an earlier one (internal-review). The first is the rate source down, the
+      // from an earlier one. The first is the rate source down, the
       // second is the rate source having quietly stopped carrying a currency
       // this DVM advertises — a config problem, and a different repair.
       ...denomination.carriedForward === true && { rate_carried_forward: true },
@@ -5659,7 +5686,7 @@ async function fundAndDraw(ctx, funding, tx) {
       creditId: creditId2,
       drawId: drawId2,
       addAmountMicro: fundedMicro,
-      // internal-review: never grow the draw past what the job cumulatively asked.
+      // never grow the draw past what the job cumulatively asked.
       // The available-balance guard inside `growDraw` cannot do this — the
       // `fund` above raised the balance by exactly this amount — so a second
       // payment for one ask would otherwise be absorbed and settle as revenue.
@@ -5772,7 +5799,7 @@ function creditDepositPayload(dvmId, funding) {
     creditCurrency: funding.currency,
     fundedAt: funding.fundedAt,
     expiryMs: funding.expiryMs,
-    // internal-review: label a session-funded deposit as one, whether or not the chain
+    // label a session-funded deposit as one, whether or not the chain
     // binding below could be read. `rail: "tempo"` alone does not say — a
     // `tempo/charge` one-shot funds a credit with no channel at all — so this is
     // what lets the platform tell a routine charge from a session whose binding
@@ -5780,7 +5807,7 @@ function creditDepositPayload(dvmId, funding) {
     ...funding.tempoSession && {
       tempoSession: { channelId: funding.tempoSession.channelId.toLowerCase() }
     },
-    // internal-review: the channel registration rides the deposit report, so it
+    // the channel registration rides the deposit report, so it
     // commits with the voucher acceptance that created the channel's liability.
     ...funding.tempoChannel && funding.tempoSession && {
       tempoChannel: {
@@ -6047,7 +6074,7 @@ function mapLedgerCommitError(err, x402Requirements, paymentCommitted = false) {
       receivedProofs: [],
       error: {
         // A fixed message plus the reason enum, never `err.message`: that string
-        // is upstream's, and on this PR's own case it is the relay lock holder's
+        // is upstream's and may include the relay lock holder's
         // backend pid and `client_addr`. The detail is logged where the throw is.
         body: paymentErrorBody("x402_settlement_submission_failed", {
           message: "x402 batch settlement submission failed",
@@ -6646,7 +6673,7 @@ var CREDIT_REQUEST_SCHEMA = z.object({
     /** Client-generated idempotency key — a retry with the same id credits once. */
     fund_id: z.string().min(1),
     /**
-     * SHA-256 hex over the raw funding artifact (spec §2 condition 3).
+     * SHA-256 hex over the raw funding artifact (the funding-commitment rule).
      * Required for every attach rail; absent on `method: "lightning"`, which
      * carries no caller-supplied artifact to hash — see {@link CreditRequest}.
      */
@@ -6670,7 +6697,7 @@ var CREDIT_REQUEST_SCHEMA = z.object({
      * rail this build does not carry is answered by `validateDrainTarget`
      * with a typed `drain_method_unsupported` naming the rails that do
      * work — not by a Zod parse failure that says only "invalid enum". The
-     * caller of a removed rail (`lightning`, internal-review) and the caller of a
+     * caller of a removed rail (`lightning`) and the caller of a
      * typo deserve the same actionable refusal.
      */
     method: z.string().min(1).optional(),
@@ -6798,12 +6825,12 @@ async function handleBalance(c, deps, args) {
   return c.json({
     op: "balance",
     // Expired credits are included: expiry ends spending, never ownership
-    // (spec §5), so stranded value must stay visible to whoever owns it.
+    // (the caller-ownership contract), so stranded value must stay visible to whoever owns it.
     credits: all.map(
       (credit) => creditBody(credit, pendingChannels.has(credit.tempoChannelId ?? ""))
     ),
     ...primary ? { credit: creditBody(primary, pendingChannels.has(primary.tempoChannelId ?? "")) } : {},
-    // internal-review: the funding menu the quote and 402 surfaces already advertise,
+    // the funding menu the quote and 402 surfaces already advertise,
     // echoed here so one read answers "what do I hold, and what may I add".
     // Under the key `menu`, not `credit` — that one is the credit projection on
     // this route. Carried without the caller echo fields: `credits[]` above says
@@ -7088,7 +7115,7 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
       expectedChannelId,
       // The close intent is re-asserted from inside the verifier, once the
       // credential is bound to this credit's own channel and before anything
-      // broadcasts (internal-review). Run above the call instead and a credential
+      // broadcasts. Run above the call instead and a credential
       // signed for another channel touches the reservation on its way to a
       // refusal that was never going to close anything.
       onBound: async () => {
@@ -7394,7 +7421,7 @@ async function handleX402ChannelDrain(c, deps, args) {
       effectId: `${args.credit.creditId}:${args.drainId}`,
       // The voucher the caller presents is what actually gets revoked and paid,
       // so the settlement layer refuses one signed for any other channel before
-      // it touches anything (internal-review).
+      // it touches anything.
       expectedChannelId: channelId,
       refundBoundNative,
       commit: async (_funding, tx) => {
@@ -7613,7 +7640,7 @@ function drainBody(record) {
     status: record.status,
     amount_micro: record.amountMicro,
     currency: record.currency,
-    // The in-kind obligation, where there is one (internal-review): a Bitcoin
+    // The in-kind obligation, where there is one: a Bitcoin
     // reclaim returns the deposited sats pro rata, at the rate each funding
     // landed at, so this figure was fixed when the reclaim was requested and
     // does not move with the market. Published beside the fiat one rather than
@@ -7636,7 +7663,7 @@ function drainCopy(record) {
             // Named because it is the obligation, and because it is
             // fixed: a Bitcoin refund returns the share of the Bitcoin you
             // deposited that you never spent, so it does not move if the
-            // price does before you collect it (internal-review). The mint's own
+            // price does before you collect it. The mint's own
             // redemption charge is named rather than glossed — it is a sat
             // or two at a fee-charging mint and nothing at a free one, and
             // a figure an agent relays to a human should not be a promise
@@ -8298,7 +8325,7 @@ var DRAIN_CONFLICT_COPY = {
   },
   // Deliberately rail-neutral: `refundFloorEvidence` is one floor over both
   // channel rails, and two doors with two answers about one shortfall is the
-  // drift consolidating it was meant to prevent (internal-review). Tempo answers its
+  // drift consolidating it was meant to prevent. Tempo answers its
   // own through `tempoFloorRefusal`, which reaches the same conclusion a step
   // earlier and adds the one rail-specific fact — its channel is already closed.
   refund_floor: {
@@ -8309,13 +8336,13 @@ var DRAIN_CONFLICT_COPY = {
     retryable: false,
     // True even though the ledger transaction that would have written the drain
     // row rolled back around this refusal. The wedged settlement row is recorded
-    // outside that transaction (internal-review) and holds this drain id as its
+    // outside that transaction and holds this drain id as its
     // `effect_id`, which is the id `X402SettlementRepair.reconcile` books the
     // drain under — so the caller has to keep it. Dropping it mints a fresh one
     // that the wedged-channel gate refuses as `settlement_pending` anyway, and
     // re-presenting *this* id is that gate's own documented exemption. Tempo
     // reaches the same `true` one artifact earlier, off a `credit_drains` row
-    // its close-intent reservation already committed (internal-review).
+    // its close-intent reservation already committed.
     drainRegistered: true
   }
 };
@@ -8413,7 +8440,7 @@ function creditBody(credit, reconciliationPending = false) {
     remaining_micro: credit.availableMicro,
     expiry_ms: credit.expiryMs,
     expired: credit.expired,
-    // Reclaimable via op "drain" (internal-review) — true whenever spendable-or-
+    // Reclaimable via op "drain" — true whenever spendable-or-
     // expired value remains. Expiry ends spending, never ownership.
     drainable: credit.status === "active" && credit.availableMicro > 0,
     ...reconciliationPending && { reconciliation_pending: true },
@@ -9287,13 +9314,13 @@ function buildContext(job, opts) {
       if (terminated("prompt")) {
         return Promise.reject(new JobCancelledError(`Job already ${job.status}`));
       }
+      job.status = "awaiting-input";
       providerMessage(job, "prompt", {
         id,
         text,
         ...promptOpts?.options && { options: promptOpts.options },
         ...promptOpts?.schema && { schema: promptOpts.schema }
       });
-      job.status = "awaiting-input";
       if (job.replayHighSeq !== null) {
         const response = job.messages.find(
           (m) => m.type === "response" && m.from === "requester" && m.content.prompt_id === id
@@ -9407,7 +9434,7 @@ function buildContext(job, opts) {
           poolBasis: pool.basis,
           askCurrency,
           // `draw` here means the pool read fine and either the ASK wouldn't pin
-          // — an fx outage on a bare-msats ask, or a sub-micro amount — or it
+          // an fx outage on a bare-msats ask, or a sub-micro amount — or it
           // pinned in a currency this pool isn't denominated in.
           ...pool.basis === "draw" && { poolCurrency: pool.currency }
         });
@@ -9494,7 +9521,7 @@ function buildContext(job, opts) {
         for (const m of opts.mpp.methods) {
           const meta = m;
           if (meta.intent === "session") continue;
-          const amount2 = msatsToMethodAmount(amountMsats, meta.name, rate);
+          const amount2 = pendingFiat?.currency === "usd" ? fiatMicroToMethodAmount(pendingFiat.amountMicro, meta.name) : msatsToMethodAmount(amountMsats, meta.name, rate);
           const ch = await opts.mpp.issueChallenge(meta.name, meta.intent, {
             amount: amount2,
             description: reason
@@ -9542,8 +9569,8 @@ function buildContext(job, opts) {
           ask_msats: amountMsats
         });
       }
-      providerMessage(job, "payment-request", paymentRequestContent);
       job.status = "awaiting-input";
+      providerMessage(job, "payment-request", paymentRequestContent);
       const paidMsatsAtYield = job.paidMsats;
       const p = new Promise((resolve, reject) => {
         let resolved = false;
@@ -9552,12 +9579,24 @@ function buildContext(job, opts) {
           unsubscribeNotify?.();
           unsubscribeNotify = void 0;
         };
-        const doResolve = (pc) => {
+        const doResolve = async (pc) => {
           if (resolved) return;
           resolved = true;
           cleanup();
           creditedToHandlerMsats += amountMsats;
           creditedToHandlerMicro += pendingFiat?.amountMicro ?? 0;
+          if (job.pendingPayment?.resolve === doResolve) {
+            job.pendingPayment = null;
+            job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
+            if (job.status === "awaiting-input" && opts.onYield) {
+              try {
+                await opts.onYield();
+              } catch (err) {
+                reject(err);
+                return;
+              }
+            }
+          }
           resolve(pc);
         };
         const doReject = (err) => {
@@ -9574,11 +9613,17 @@ function buildContext(job, opts) {
             if (resolved) return;
             try {
               const counters = await getCounters();
-              if (!counters) return;
+              if (!counters || resolved) return;
               const satisfied = poolBasis ? counters.paidMsats - paidMsatsAtYield >= amountMsats : counters.paidMsats - creditedToHandlerMsats >= amountMsats;
               if (satisfied) {
+                const resume = async () => {
+                  job.paidMsats = counters.paidMsats;
+                  job.pendingPaymentMsats = counters.pendingPaymentMsats;
+                  await doResolve({ amount_msats: amountMsats });
+                };
                 if (opts.claimForProcessing) {
-                  const won = await opts.claimForProcessing();
+                  const won = await opts.claimForProcessing(resume);
+                  if (resolved) return;
                   if (!won) {
                     resolved = true;
                     cleanup();
@@ -9586,10 +9631,7 @@ function buildContext(job, opts) {
                     return;
                   }
                 }
-                job.paidMsats = counters.paidMsats;
-                job.pendingPaymentMsats = counters.pendingPaymentMsats;
-                if (job.status === "awaiting-input") job.status = "processing";
-                doResolve({ amount_msats: amountMsats });
+                await resume();
               }
             } catch (err) {
               log.error("requestPayment NOTIFY check failed", { error: String(err) });
@@ -9640,12 +9682,12 @@ function buildContext(job, opts) {
       runTerminal();
     },
     // `failOpts.refund` is a caller-fault annotation and nothing more
-    // (internal-review). No rail hands value backwards: a failed job's debit is the
+    // No rail hands value backwards: a failed job's debit is the
     // credit draw the terminal funnel releases, and the caller reclaims that
-    // balance through the internal-review `drain` op. The Cashu branch that used to
+    // balance through the `drain` op. The Cashu branch that used to
     // send proofs back here was dead — `job.receivedProofs` has been empty on
     // every path since the accumulator became the commit boundary for inbound
-    // proofs (internal-review) — and internal-review, the accumulator-debit rewrite that would
+    // proofs — and the accumulator-debit rewrite that would
     // have revived it, was cancelled as superseded by the ledger.
     fail: (error) => {
       if (terminated("fail")) return;
@@ -9715,13 +9757,17 @@ var ReceiptIssuer = class {
   }
   /**
    * Build and sign the receipt for a terminal job. `seq` comes from
-   * `JobStore.claimReceiptSeq`, `issuedAt` defaults to now (tests pin it).
+   * `JobStore.claimReceiptSeq`; `issuedAt` is epoch seconds and defaults to now.
    *
    * Free jobs get receipts too, with `paid.msats: 0` — they still consume a
    * sequence number and still attest an outcome. Whether feedback is
    * paid-only is the feedback layer's call, not this one's.
    *
-   * `credit` is the resolved draw block (internal-review) — present on every job
+   * Timing and attribution come from the committed terminal row, not signing
+   * time or handler input. Legacy rows without those durable inputs omit the
+   * optional blocks rather than inventing historical evidence.
+   *
+   * `credit` is the resolved draw block — present on every job
    * whose payment funded/drew the ledger, absent otherwise. Signature-
    * compatible either way: `canonicalize` omits absent keys.
    */
@@ -9734,6 +9780,14 @@ var ReceiptIssuer = class {
       capability: record.capability,
       outcome: outcomeFor(record.status),
       reason: terminalReason(record),
+      ...record.timingKnown !== false && record.terminalAtMs !== void 0 && {
+        timing: {
+          accepted_at_ms: record.createdAt,
+          terminal_at_ms: record.terminalAtMs,
+          caller_wait_ms: record.callerWaitMs ?? 0
+        }
+      },
+      ...record.timingKnown !== false && record.status !== "completed" && record.endedBy && { ended_by: record.endedBy },
       seq,
       issued_at: issuedAt ?? Math.floor(Date.now() / 1e3),
       requester_pubkey: record.requesterPubkey ?? null,
@@ -9752,7 +9806,7 @@ var ReceiptIssuer = class {
     return signReceipt(unsigned, this.secret);
   }
   /**
-   * Countersign one reclaim event (internal-review). Unlike job receipts there is
+   * Countersign one reclaim event. Unlike job receipts there is
    * no store-allocated sequence — the drain's own `ledger_seq` (taken under
    * the credit row lock, shared with draws) already orders it in the
    * per-credit evidence chain.
@@ -10069,12 +10123,16 @@ var JobManager = class {
   cleanupTimers = /* @__PURE__ */ new Map();
   /** Cost revisions held only by a terminal handler owner until its durable merge succeeds. */
   terminalCostHandoffRetryTimers = /* @__PURE__ */ new Map();
-  /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
+  /** Per-job NOTIFY unsubscribe handles for the durable-status watch. */
   statusWatchers = /* @__PURE__ */ new Map();
-  /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
+  /** Job ids whose durable-status re-read is in flight — coalesces notify storms. */
   statusChecksInFlight = /* @__PURE__ */ new Set();
-  /** Job ids that were notified mid-re-read and must be re-checked (internal-review). */
+  /** Job ids that were notified mid-re-read and must be re-checked. */
   statusChecksQueued = /* @__PURE__ */ new Set();
+  // Every local input resume holds this queue through its durable wait update.
+  // A prompt response and a payment NOTIFY must not mistake each other for a
+  // different machine's successful claim.
+  inputResumeTails = /* @__PURE__ */ new WeakMap();
   sessionId = randomBytes4(3).toString("hex");
   nextJobId = 1;
   accumulatorMonitor;
@@ -10082,7 +10140,7 @@ var JobManager = class {
   processingWatchdogMs;
   reactivationClaimGraceMs;
   /**
-   * Worker-heartbeat cadence (internal-review). Also floors the internal-review clock
+   * Worker-heartbeat cadence. Also floors the clock
    * guard's compensation on the processing arm — see
    * {@link staleSweepCompensationCapMs}.
    */
@@ -10102,7 +10160,7 @@ var JobManager = class {
   jobRetentionResumeFrom;
   /**
    * A `Date.now()` reading that cannot regress within this manager's lifetime
-   * (internal-review). Anchored at construction, so a manager already running when
+   * Anchored at construction, so a manager already running when
    * the clock stepped is covered. The stale-job sweep's two cutoffs, the
    * orphan-draw age gate and the reactivation claim grace all read it; see
    * {@link createMonotonicClock} for what it costs and where it is clamped.
@@ -10115,7 +10173,7 @@ var JobManager = class {
   jobRetentionSweepInFlight = false;
   heartbeatInFlight = false;
   /**
-   * The denomination of every credit this DVM opens (internal-review). Resolved once,
+   * The denomination of every credit this DVM opens. Resolved once,
    * with the same boundary fallback `DVMServer` applies for direct JavaScript
    * callers that force an incomplete value past the descriptor contract.
    */
@@ -10130,7 +10188,7 @@ var JobManager = class {
       this.jobStore = new MemoryJobStore();
     } else {
       throw new Error(
-        "JobManager requires a persistent jobStore in production. Pass `jobStore` explicitly, set `devMode: true`, or construct via createDVMHost (which boots a PostgresJobStore from DATABASE_URL). See internal-review / internal-review."
+        "JobManager requires a persistent jobStore in production. Pass `jobStore` explicitly, set `devMode: true`, or construct via createDVMHost (which boots a PostgresJobStore from DATABASE_URL)."
       );
     }
     if (opts.receiptIssuer && !isReceiptIssuingStore(this.jobStore)) {
@@ -10138,7 +10196,7 @@ var JobManager = class {
         JSON.stringify({
           level: "warn",
           event: "receipts_disabled_store_unsupported",
-          message: "DVMKIT_RECEIPT_KEY is set but the configured jobStore does not implement ReceiptIssuingStore (claimReceiptSeq / saveReceipt), so no receipts will be issued and /v1/info will not advertise them. Use PostgresJobStore, MemoryJobStore, or implement both methods. See internal-review."
+          message: "DVMKIT_RECEIPT_KEY is set but the configured jobStore does not implement ReceiptIssuingStore (claimReceiptSeq / saveReceipt), so no receipts will be issued and /v1/info will not advertise them. Use PostgresJobStore, MemoryJobStore, or implement both methods."
         })
       );
     }
@@ -10237,7 +10295,7 @@ var JobManager = class {
         }
       }
     }
-    if (opts.dvmId && opts.onJobCost && isTerminalCostRecoveryStore(this.jobStore)) {
+    if (opts.dvmId && (opts.onJobCost || opts.onJobTerminal) && isTerminalCostRecoveryStore(this.jobStore)) {
       this.terminalCostRecoveryTimer = setInterval(() => {
         void this.recoverTerminalCosts().catch((err) => {
           console.error(
@@ -10251,16 +10309,14 @@ var JobManager = class {
       this.terminalCostRecoveryTimer.unref();
     }
   }
-  /** Active in-memory jobs. */
   get activeJobs() {
     return this._activeJobs;
   }
-  /** The backing job store. */
   get store() {
     return this.jobStore;
   }
   /**
-   * True when this DVM will actually issue receipts (internal-review) — a key *and*
+   * True when this DVM will actually issue receipts — a key *and*
    * a store that can allocate sequence numbers and persist bytes write-once.
    * `/v1/info#receipts` reads this rather than the key alone, so the flag can
    * never promise something `issueReceipt` silently declines to do.
@@ -10277,7 +10333,7 @@ var JobManager = class {
     return Object.keys(this.descriptor.capabilities);
   }
   /**
-   * Resolve a capability's static `price` to msats (internal-review).
+   * Resolve a capability's static `price` to msats.
    *
    * `"$X.XX"` is parsed as USD and converted via the SDK's shared fx fetcher.
    * Returns `undefined` for dynamic-priced capabilities (those that declare
@@ -10290,7 +10346,7 @@ var JobManager = class {
   }
   /**
    * Translate a capability's static `price` into the fiat envelope used by
-   * the per-capability `pricing.max` advertised on `/v1/info` (internal-review).
+   * the per-capability `pricing.max` advertised on `/v1/info`.
    * Returns `undefined` for dynamic-priced capabilities and for unknown
    * names (the route handler validates the name before invoking this).
    */
@@ -10300,24 +10356,24 @@ var JobManager = class {
     return resolvePricingMax(cap.price);
   }
   /**
-   * Parse a request body through a capability's input schema (internal-review).
+   * Parse a request body through a capability's input schema.
    *
    * Resolution order when a capability declares an `input` schema:
    * 1. `body.data` is preferred — agents pass structured fields directly
-   *    (CLI builds this from `--param k=v`).
+   * (CLI builds this from `--param k=v`).
    * 2. Fallback: `JSON.parse(body.input)` for clients still on the legacy
-   *    JSON-string contract.
+   * JSON-string contract.
    * 3. Neither usable → throw `MissingStructuredInputError` so the route can
-   *    return `invalid_input` with a hint pointing at `/v1/info`.
+   * return `invalid_input` with a hint pointing at `/v1/info`.
    *
    * When the capability has no `input` schema, returns `body.input` raw
    * (primitive path).
    *
-   * The internal-review credit envelope is removed before the schema runs, on both
-   * branches (internal-review) — it rides the signed body but is protocol-level, so a
+   * The credit envelope is removed before the schema runs, on both
+   * branches — it rides the signed body but is protocol-level, so a
    * top-level `.strict()` capability schema would otherwise reject every
    * explicit draw as an unknown key, before the envelope was even extracted.
-   * The persisted `record.input` the internal-review reactivation path re-reads is the
+   * The persisted `record.input` the reactivation path re-reads is the
    * pre-Zod wire form, so it comes through the second branch carrying them too.
    */
   parseInput(body, capability) {
@@ -10335,7 +10391,7 @@ var JobManager = class {
     throw new MissingStructuredInputError();
   }
   /**
-   * Look up the per-capability descriptor by name (internal-review). Throws when the
+   * Look up the per-capability descriptor by name. Throws when the
    * name doesn't exist — the route layer validates body.capability first, so
    * reaching this with an unknown name is a programmer error.
    */
@@ -10361,7 +10417,7 @@ var JobManager = class {
     return this.descriptor.capabilities[name];
   }
   /**
-   * Allocate the id the next job will be created under (internal-review). The
+   * Allocate the id the next job will be created under. The
    * submit path calls this BEFORE payment verification so the ledger draw
    * commits with its job linkage, then passes the id back through
    * `createJob`'s provenance. Ids allocated for requests whose payment is
@@ -10372,7 +10428,7 @@ var JobManager = class {
     return `job-${this.sessionId}-${this.nextJobId++}`;
   }
   /**
-   * Create a new job from a request body. `provenance` (internal-review) is what the
+   * Create a new job from a request body. `provenance` is what the
    * idempotent-replay path on `POST /v1/job` reads back: the raw `job_token`
    * to re-issue, and the fingerprint + caller pubkey a retry must reproduce
    * to be given it.
@@ -10428,27 +10484,23 @@ var JobManager = class {
     this.watchDurableStatus(job);
     return job;
   }
-  /** Build an SDKJobContext and attach it to the job. */
   buildAndAttachContext(job, parsedInput) {
     const auth = deriveAuthFromParsedInput(this.descriptor, parsedInput);
     const sdkCtx = buildContext(job, { ...this.buildContextOpts(job), parsedInput, auth });
     job.sdkCtx = sdkCtx;
     return sdkCtx;
   }
-  /** Start the handler for a job. */
   runHandler(job, sdkCtx) {
     const cap = this.getCapability(job.capability);
     const onError = (err) => {
       if (isTerminal(job.status)) return;
       job.replayProviderSkip = 0;
-      if (!job.pendingPrompts.size && !job.pendingPayment) {
-        job.status = "failed";
-        providerMessage(job, "cancel", {
-          reason: err instanceof Error ? err.message : String(err)
-        });
-        job.terminalWork = this.finalizeTerminal(job);
-        void job.terminalWork;
-      }
+      job.status = "failed";
+      providerMessage(job, "cancel", {
+        reason: err instanceof Error ? err.message : String(err)
+      });
+      job.terminalWork = this.finalizeTerminal(job);
+      void job.terminalWork;
     };
     if (!cap) {
       if (!isTerminal(job.status)) {
@@ -10476,16 +10528,46 @@ var JobManager = class {
       onError(err);
     }
   }
-  /** Dispatch a validated incoming message to the appropriate handler or pending resolver. */
   async dispatchMessage(job, type, content) {
+    if (type !== "response" && type !== "payment") {
+      return this.dispatchMessageNow(job, type, content);
+    }
+    const pending = type === "payment" ? job.pendingPayment : job.pendingPrompts.get(content.prompt_id);
+    await this.queueInputResume(job, async () => {
+      const current = type === "payment" ? job.pendingPayment : job.pendingPrompts.get(content.prompt_id);
+      if (pending && current !== pending) return;
+      return this.dispatchMessageNow(job, type, content);
+    });
+  }
+  async queueInputResume(job, resume) {
+    const previous = this.inputResumeTails.get(job) ?? Promise.resolve();
+    const next = previous.catch(() => void 0).then(resume);
+    this.inputResumeTails.set(job, next);
+    try {
+      return await next;
+    } finally {
+      if (this.inputResumeTails.get(job) === next) this.inputResumeTails.delete(job);
+    }
+  }
+  async claimLocalInput(job) {
+    await job.messageAppenderTail;
+    return isStreamableJobStore(this.jobStore) ? this.jobStore.claimForProcessing(job.id) : true;
+  }
+  async dispatchMessageNow(job, type, content) {
     const ctx = job.sdkCtx;
     const cap = this.getCapability(job.capability);
     if (type === "response") {
       const rc = content;
       const pending = job.pendingPrompts.get(rc.prompt_id);
       if (pending) {
+        if (!await this.claimLocalInput(job)) {
+          await this.adoptDurableTerminal(job);
+          return;
+        }
+        if (job.pendingPrompts.get(rc.prompt_id) !== pending || isTerminal(job.status)) return;
         job.pendingPrompts.delete(rc.prompt_id);
-        job.status = "processing";
+        job.status = job.pendingPrompts.size > 0 || job.pendingPayment ? "awaiting-input" : "processing";
+        if (job.status === "awaiting-input") await this.persistJob(job);
         pending.resolve(rc);
       } else if (cap?.onResponse && ctx) {
         await cap.onResponse(ctx, rc);
@@ -10494,9 +10576,15 @@ var JobManager = class {
       const pc = content;
       if (job.pendingPayment) {
         const pp = job.pendingPayment;
+        if (!await this.claimLocalInput(job)) {
+          await this.adoptDurableTerminal(job);
+          return;
+        }
+        if (job.pendingPayment !== pp || isTerminal(job.status)) return;
         job.pendingPayment = null;
-        job.status = "processing";
-        pp.resolve(pc);
+        job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
+        if (job.status === "awaiting-input") await this.persistJob(job);
+        await pp.resolve(pc);
       } else if (cap?.onPayment && ctx) {
         await cap.onPayment(ctx, pc);
       }
@@ -10505,6 +10593,7 @@ var JobManager = class {
     } else if (type === "cancel") {
       const reason = content?.reason ?? "Job cancelled";
       abortJob(job, reason);
+      job.endedBy = "caller";
       job.status = "cancelled";
       if (cap?.onCancel && ctx) {
         await cap.onCancel(ctx, content);
@@ -10523,17 +10612,16 @@ var JobManager = class {
       });
     }
   }
-  // ── Persistence ──────────────────────────────────────────────────────
   /**
    * Persist a job to the backing store.
    *
-   * Awaits the per-job appender tail (internal-review) so that:
-   *   1. The snapshot's `messages` is consistent with the `job_messages` table
-   *      — no row is still in flight at snapshot time.
-   *   2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
-   *      can't race a still-pending `appendOutgoing` for the final yield
-   *      message (which would otherwise wipe the row before an in-flight SSE
-   *      subscriber's NOTIFY-driven fetch can see it).
+   * Awaits the per-job appender tail so that:
+   * 1. The snapshot's `messages` is consistent with the `job_messages` table
+   * no row is still in flight at snapshot time.
+   * 2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
+   * can't race a still-pending `appendOutgoing` for the final yield
+   * message (which would otherwise wipe the row before an in-flight SSE
+   * subscriber's NOTIFY-driven fetch can see it).
    */
   async persistJob(job) {
     if (job.messageAppenderTail) {
@@ -10554,9 +10642,17 @@ var JobManager = class {
     } else {
       await this.jobStore.save(record);
     }
+    const saved = await this.jobStore.get(job.id);
+    if (saved) {
+      job.timingKnown = saved.timingKnown;
+      job.endedBy = saved.endedBy;
+      job.terminalAtMs = saved.terminalAtMs;
+      job.callerWaitMs = saved.callerWaitMs;
+      job.awaitingInputAtMs = saved.awaitingInputAtMs;
+    }
   }
   /**
-   * Cross-machine terminal guard (internal-review). `buildContext`'s guard reads the
+   * Cross-machine terminal guard. `buildContext`'s guard reads the
    * in-memory `job.status`, so on its own it only protects the machine running
    * the handler. On a multi-machine DVM a `DELETE /v1/job/:id` routinely lands
    * on a machine that isn't running the job — `app.ts` cancels it in the store
@@ -10568,7 +10664,7 @@ var JobManager = class {
    * fires `job.abort` so in-flight `ctx.fetch` calls tear down. Returns true when
    * the durable state won and the caller must skip its save.
    *
-   * Two triggers: `watchDurableStatus`'s NOTIFY subscription (internal-review) fires
+   * Two triggers: `watchDurableStatus`'s NOTIFY subscription fires
    * this within a round-trip of the remote cancel committing, which is what
    * actually stops the provider spend; `persistJob` calls it again on every save
    * as the backstop for the window where a cancel commits between a handler's
@@ -10576,8 +10672,10 @@ var JobManager = class {
    * stores' terminal-sticky `save`, which keeps the row itself correct).
    */
   async adoptDurableTerminal(job) {
-    const durable = isStreamableJobStore(this.jobStore) ? await this.jobStore.getCounters(job.id).catch(() => void 0) : await this.jobStore.get(job.id).catch(() => void 0);
-    if (!durable || !isTerminal(durable.status) || durable.status === job.status) return false;
+    const counters = isStreamableJobStore(this.jobStore) ? await this.jobStore.getCounters(job.id).catch(() => void 0) : await this.jobStore.get(job.id).catch(() => void 0);
+    if (!counters || !isTerminal(counters.status) || counters.status === job.status) return false;
+    const durable = await this.jobStore.get(job.id);
+    if (!durable) return false;
     console.warn(
       JSON.stringify({
         level: "job_terminal_elsewhere",
@@ -10588,6 +10686,11 @@ var JobManager = class {
     );
     job.status = durable.status;
     job.summary = durable.summary;
+    job.timingKnown = durable.timingKnown;
+    job.endedBy = durable.endedBy;
+    job.terminalAtMs = durable.terminalAtMs;
+    job.callerWaitMs = durable.callerWaitMs;
+    job.awaitingInputAtMs = durable.awaitingInputAtMs;
     const reason = durable.status !== "completed" && durable.summary ? durable.summary : `Job ${durable.status}`;
     for (const [, p] of job.pendingPrompts) p.reject(new JobCancelledError(reason));
     job.pendingPayment?.reject(new JobCancelledError(reason));
@@ -10607,7 +10710,7 @@ var JobManager = class {
       });
     }
     this.clearIdleTimer(job.id);
-    void this.issueReceiptForStoredJob(job.id);
+    void this.issueReceiptForStoredJob(job.id).then(() => this.reportTerminalJob(job.id));
     this.scheduleCleanup(job);
     if (durable.status !== "completed" && terminalCostPersisted) {
       await this.reportJobCost(job);
@@ -10653,6 +10756,7 @@ var JobManager = class {
   async retryTerminalCostHandoff(job, attempt) {
     if (!await this.tryPersistAdoptedTerminalCost(job, attempt)) return;
     await this.reportJobCost(job);
+    await this.reportTerminalJob(job.id);
   }
   /** Durably merge a terminal handler owner's latest cost before reporting it. */
   async persistAdoptedTerminalCost(job) {
@@ -10682,7 +10786,7 @@ var JobManager = class {
     );
   }
   /**
-   * Watch the durable status of a locally-active job (internal-review).
+   * Watch the durable status of a locally-active job.
    *
    * `ctx.signal` is raised by `dispatchMessage`, which only runs on the machine
    * holding the job in `activeJobs`. On a multi-machine DVM the `DELETE` usually
@@ -10723,7 +10827,7 @@ var JobManager = class {
     });
   }
   /**
-   * Tear down a job's durable-status subscription (internal-review). Must be called
+   * Tear down a job's durable-status subscription. Must be called
    * wherever a job leaves `activeJobs` — a leaked subscriber outlives the job on
    * the store's shared LISTEN connection. Idempotent.
    */
@@ -10735,12 +10839,12 @@ var JobManager = class {
     unsubscribe();
   }
   /**
-   * NOTIFY-driven durable-status re-read, coalesced per job (internal-review).
+   * NOTIFY-driven durable-status re-read, coalesced per job.
    *
    * A notify that arrives while a re-read is in flight is queued rather than
    * dropped: the in-flight read may have observed the row a moment *before* the
-   * cancel committed, and dropping its notify would put the abort back where
-   * this issue found it — waiting for the handler's next store write.
+   * cancel committed, and dropping its notify would leave the local handler
+   * running until its next store write instead of aborting promptly.
    */
   async checkDurableTerminal(job) {
     if (this.statusChecksInFlight.has(job.id)) {
@@ -10770,13 +10874,13 @@ var JobManager = class {
   /**
    * Wire the Tx A appender when the store supports streaming.
    *
-   * Tx A (internal-review): outgoing message + `pending_payment_msats` bump land in
+   * Tx A: outgoing message + `pending_payment_msats` bump land in
    * the same transaction. The DB allocates the row's seq via
    * `UPDATE jobs SET next_seq = next_seq + 1 RETURNING` so concurrent inbound
    * traffic on different machines can never collide on the `(job_id, seq)` PK.
    * In-memory `job.seq` keeps its own counter for same-machine SSE listeners.
    *
-   * Per-job serialisation (internal-review): chained through `job.messageAppenderTail`
+   * Per-job serialisation: chained through `job.messageAppenderTail`
    * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
    * `complete`) commit their `appendOutgoing` transactions in call order.
    * Without this, the two transactions race for the `jobs` row lock and the
@@ -10810,7 +10914,7 @@ var JobManager = class {
               // In-memory counter, NOT the authoritative DB-allocated seq:
               // `appendOutgoing` allocates the real seq via `UPDATE ...
               // RETURNING` inside the transaction that just failed, so no DB
-              // seq was assigned for this message (internal-review).
+              // seq was assigned for this message.
               localSeq: msg.seq,
               note: "localSeq is the in-process counter; the DB-allocated seq was never assigned (append rolled back)",
               error: err instanceof Error ? err.message : String(err)
@@ -10821,7 +10925,6 @@ var JobManager = class {
       job.messageAppenderTail = next;
     };
   }
-  // ── Idle timeout ─────────────────────────────────────────────────────
   /** Start (or restart) the idle timer for a job. */
   startIdleTimer(job) {
     this.clearIdleTimer(job.id);
@@ -10839,7 +10942,7 @@ var JobManager = class {
       this.idleTimers.delete(id);
     }
   }
-  /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard (internal-review). */
+  /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard. */
   async cancelJobIdle(job) {
     if (isTerminal(job.status)) return;
     const current = await this.jobStore.get(job.id).catch(() => void 0);
@@ -10858,6 +10961,7 @@ var JobManager = class {
     if (job.pendingPayment) job.pendingPayment.reject(new Error("Job timed out (idle)"));
     job.pendingPrompts.clear();
     job.pendingPayment = null;
+    job.endedBy = (current?.status ?? job.status) === "awaiting-input" ? "caller" : "provider";
     job.status = "cancelled";
     abortJob(job, "Job timed out (idle)");
     providerMessage(job, "cancel", { reason: "Job timed out (idle)" });
@@ -10865,14 +10969,13 @@ var JobManager = class {
     void job.terminalWork;
     this.scheduleCleanup(job);
   }
-  // ── Stale-job sweeper (internal-review / internal-review) ──────────────────────────
   /**
    * Force-terminate stale non-terminal jobs. Two status-aware arms:
-   *   • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
-   *     (`stale_no_terminal_status`) — the caller never paid / responded.
-   *   • `processing`/`working` past `processingWatchdogMs` → `failed`
-   *     (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
-   *     live workers fresh, so a stale row here means a dead process.
+   * • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
+   * (`stale_no_terminal_status`) — the caller never paid / responded.
+   * • `processing`/`working` past `processingWatchdogMs` → `failed`
+   * (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
+   * live workers fresh, so a stale row here means a dead process.
    *
    * Fires on a timer (wired in the constructor) and also callable on demand
    * (tests, ops). The CAS in `cancelStaleJob` makes this safe to run
@@ -10881,17 +10984,17 @@ var JobManager = class {
    * descriptors — the local activeJobs teardown only makes sense on the
    * JobManager that actually hosted the zombie handler.
    *
-   * **Both cutoffs float off the wall clock (internal-review).** Each is one
+   * **Both cutoffs float off the wall clock.** Each is one
    * `Date.now()` sample compared against `last_activity_at`, stamped from a
    * different sample at a different moment, so a backwards step between the
    * two makes every row look more recently active than it is: the query
    * matches nothing and both arms go silent for the length of the skew. The
    * dead worker's job keeps its `processing` status, its credit hold stays
-   * `pending`, and the internal-review paid-job-death alert — wired to this reaper —
-   * never fires. Same defect, same host class, as internal-review's orphan sweep.
+   * `pending`, and the paid-job-death alert — wired to this reaper —
+   * never fires. Same defect, same host class, as orphan sweep.
    *
    * **The compensation is capped** — see {@link staleSweepCompensationCapMs}
-   * for where each arm's cap comes from — which internal-review did not need to do. Its eagerness costs at worst an early release
+   * for where each arm's cap comes from — which did not need to do. Its eagerness costs at worst an early release
    * of an unclaimed hold, refused outright for any live job row; ours
    * force-*fails* a running job. `cancelStaleJob`'s CAS does not cover that:
    * `expectedActivityBefore` is the same compensated threshold the query used,
@@ -11027,7 +11130,7 @@ var JobManager = class {
   }
   /**
    * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
-   * clock to cover a backwards step (internal-review). The compensation is capped,
+   * clock to cover a backwards step. The compensation is capped,
    * not free: a claimed row must still have been silent for
    * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
    * force-fails a job that may well be alive.
@@ -11047,7 +11150,7 @@ var JobManager = class {
    * clock stepped. That pair is marginal already; the guard must not make it
    * deterministic. The cap collapses to zero there, which is today's
    * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
-   * — nothing heartbeats it by design, and its refresh is an inbound caller
+   * nothing heartbeats it by design, and its refresh is an inbound caller
    * message on no cadence at all.
    *
    * **Why a magnitude and not a predicate.** The tempting sharper rule is to
@@ -11066,7 +11169,6 @@ var JobManager = class {
     if (!heartbeated || this.heartbeatIntervalMs <= 0) return halfWindow;
     return Math.max(0, Math.min(halfWindow, windowMs - 2 * this.heartbeatIntervalMs));
   }
-  // ── Terminal job content retention ───────────────────────────────────
   /**
    * Redact terminal job content beyond this DVM's configured window.
    *
@@ -11231,12 +11333,11 @@ var JobManager = class {
       );
     }
   }
-  // ── Orphan-draw sweeper (internal-review) + terminal reconciler (internal-review) ──
   /**
    * Resolve `pending` credit draws the terminal funnel can no longer reach.
    * Two arms over one scan, distinguished by whether the draw's job row exists.
    *
-   * **No job row (internal-review) — release.** internal-review allocates the job id and
+   * **No job row — release.** allocates the job id and
    * commits the ledger draw, with its `job_id` linkage, before `recordReplay`
    * and `persistJob` write the job row. A crash, a `draw_conflict` 409, or a
    * fail-closed `replay_detected` 401 in that window leaves a committed hold
@@ -11246,12 +11347,12 @@ var JobManager = class {
    * available balance stays reduced forever. Cosmetic for an implicit N=1
    * credit, a silent balance shrink for an explicit N>1 one.
    *
-   * **Terminal job row (internal-review) — reconcile to its outcome.** The funnel
+   * **Terminal job row — reconcile to its outcome.** The funnel
    * demonstrably fails: `resolveCreditDraw` throws on a ledger/DB error,
    * `issueReceipt` catches it, logs `credit_resolve_failed` and returns
    * nothing, and until now nothing retried. Same stranded hold, reached through
    * a different door — and for a `completed` job it strands the platform's
-   * books too, since draws *are* the revenue events (internal-review): the caller is
+   * books too, since draws *are* the revenue events: the caller is
    * charged nothing, the balance never moves, and outstanding liability
    * (`deposits − draw revenue`) overstates forever. So a late settle books, off
    * the committed draw row, through the ordinary reporter path.
@@ -11379,8 +11480,8 @@ var JobManager = class {
     }
   }
   /**
-   * The end-of-scan line for a tick that resolved nothing (internal-review, extended
-   * by internal-review). Two shapes are worth a warning, and neither is the ordinary
+   * The end-of-scan line for a tick that resolved nothing. Two shapes are
+   * worth a warning, and neither is the ordinary
    * one — the timer runs every 5 minutes per ledger in production.
    *
    * `examined > 0`: aged candidates were looked at and none moved. Usually
@@ -11389,7 +11490,7 @@ var JobManager = class {
    *
    * `examined === 0`: the query returned nothing. Ordinarily that means there
    * is nothing to do — but it is equally what a blinded scan looks like, which
-   * is the case the internal-review gate could not reach. Probe for the oldest
+   * is the case the gate could not reach. Probe for the oldest
    * `pending` hold at any age and speak up when one exists the scan should
    * have seen and didn't: already past the age gate outright, stamped ahead of
    * our clock (some other process's clock is fast), or hidden while our own
@@ -11441,7 +11542,7 @@ var JobManager = class {
     );
   }
   /**
-   * Resolve one aged `pending` draw whose job row reached terminal (internal-review),
+   * Resolve one aged `pending` draw whose job row reached terminal,
    * mirroring what `resolveCreditDraw` would have done in line. Returns true
    * when this call is the one that moved the draw — the caller counts it, and
    * only it books.
@@ -11514,7 +11615,7 @@ var JobManager = class {
   /**
    * Refresh `lastActivityAt` for jobs this process is actively running
    * (`processing`/`working`) so the processing watchdog only fires once the
-   * worker is genuinely dead (internal-review). `awaiting-input` jobs are
+   * worker is genuinely dead. `awaiting-input` jobs are
    * deliberately excluded — their idle timeout must still elapse. Fires on the
    * heartbeat timer; also callable on demand for tests.
    */
@@ -11534,17 +11635,16 @@ var JobManager = class {
       this.heartbeatInFlight = false;
     }
   }
-  // ── Reactivation (replay) ────────────────────────────────────────────
   /**
-   * Single-execution claim for a reactivating machine (internal-review). Before
+   * Single-execution claim for a reactivating machine. Before
    * replaying an `awaiting-input` job, wait a bounded grace window for a live
    * original handler to win the `awaiting-input → processing` CAS via its
    * NOTIFY wake. Resolves:
-   *   • `false` — the row left `awaiting-input` during the window (the original
-   *     handler claimed it / drove it terminal). Stand down; do not replay.
-   *   • `true`  — the window elapsed still `awaiting-input` (the original worker
-   *     is gone or has no live resolver) AND this machine won the claim CAS.
-   *     Replay for dead-worker recovery.
+   * • `false` — the row left `awaiting-input` during the window (the original
+   * handler claimed it / drove it terminal). Stand down; do not replay.
+   * • `true` — the window elapsed still `awaiting-input` (the original worker
+   * is gone or has no live resolver) AND this machine won the claim CAS.
+   * Replay for dead-worker recovery.
    *
    * Biasing the original handler to win kills the double execution (double
    * substrate spend, clobbered artifact) without heartbeating `awaiting-input`
@@ -11567,7 +11667,7 @@ var JobManager = class {
     }
   }
   /**
-   * Record an inbound client message durably via Tx B (internal-review) and append
+   * Record an inbound client message durably via Tx B and append
    * it to the in-memory `job.messages` array. Returns the DB-allocated seq
    * (`null` when the store isn't streamable — non-Postgres test fallback).
    *
@@ -11611,13 +11711,13 @@ var JobManager = class {
    * in-memory `ServerJob`, wires the appender, builds the context, starts
    * the idle timer. The caller has already recorded the inbound via Tx B
    * and run Tx C (verify + credit); reactivation is now decoupled from
-   * credit (internal-review, internal-review). The caller decides whether to run the
+   * credit. The caller decides whether to run the
    * handler (Pattern A: status was `awaiting-input`) or to dispatch the
    * message to a custom handler (Pattern B).
    *
    * For DVMs that declare descriptor-level auth, the persisted
    * `record.input` carries the original signed envelope. We re-verify the
-   * signature here (internal-review) so a DB-layer tamper — compromised admin, SQL
+   * signature here so a DB-layer tamper — compromised admin, SQL
    * injection, malicious operator with DB access — can't silently feed an
    * attacker-supplied pubkey/envelope into the handler. The drift window
    * and replay store are deliberately skipped: the persisted timestamp is
@@ -11631,7 +11731,7 @@ var JobManager = class {
    * What gets re-verified is the persisted row read back through
    * {@link signedRequestInput} — `app.ts` stores the pre-Zod wire form, so
    * those are the caller's own signed bytes, the same ones `/v1/quote` and the
-   * submit checked (internal-review). That makes the tamper check strictly stronger
+   * submit checked. That makes the tamper check strictly stronger
    * than the parsed form it replaced: an injected key the capability schema
    * doesn't declare used to be stripped before the signature was checked, so
    * it re-verified clean.
@@ -11676,7 +11776,7 @@ var JobManager = class {
     return { job, sdkCtx };
   }
   /**
-   * Verify an inbound payment and apply the credit via Tx C (internal-review).
+   * Verify an inbound payment and apply the credit via Tx C.
    * The inbound message must have been recorded via Tx B already
    * (`recordInboundPending` returned `inboundSeq`). For non-streamable
    * stores (`inboundSeq === null`), falls back to in-memory mutation via
@@ -11686,12 +11786,12 @@ var JobManager = class {
    * `pendingPaymentMsats` without external verification. Gated on
    * `devModeSkipsPaymentVerification` — the same predicate the upfront path
    * reads, so a dev server wired to a mint verifies mid-job payments for real
-   * (internal-review) — plus the explicit `dev_auto` opt-out the dev console uses,
+   * plus the explicit `dev_auto` opt-out the dev console uses,
    * which is the one caller that has no wallet to pay from. `dev_auto` loses to
    * any proof riding the same message: money on the wire always takes the rail,
    * so the flag can never leave a real token unspent against a credited job.
    *
-   * Tx C is not atomic with the rail commit (internal-review). `verifyIncomingPayment`
+   * Tx C is not atomic with the rail commit. `verifyIncomingPayment`
    * commits the proofs *and* the ledger leg in one transaction and returns;
    * only then does `verifyAndCredit` write the job row, on its own connection.
    * Everything after that call therefore runs with the caller's money already
@@ -11741,7 +11841,7 @@ var JobManager = class {
         lockPubkeys: extra?.lockPubkeys,
         mintHealthTracker: extra?.mintHealthTracker,
         fxFetcher: this.opts.fxFetcher,
-        // internal-review: the ledger leg — a mid-job payment is a top-up that funds
+        // the ledger leg — a mid-job payment is a top-up that funds
         // the job's credit and grows its draw, atomically with the rail commit.
         creditLedger: this.opts.creditLedger,
         processedPayments: this.opts.processedPayments,
@@ -11876,7 +11976,7 @@ var JobManager = class {
     return { ...unappliedCredit && { unappliedCredit } };
   }
   /**
-   * Tx C with a bounded retry (internal-review).
+   * Tx C with a bounded retry.
    *
    * By the time this runs on the verified path, the rail commit and the ledger
    * leg have already committed in a transaction this call is not part of — so a
@@ -11963,7 +12063,7 @@ var JobManager = class {
   }
   /**
    * Answer a payment whose rail and ledger legs committed but whose job row
-   * could not be written (internal-review) — every retry spent, the money real.
+   * could not be written — every retry spent, the money real.
    *
    * The refusal names the credit the money landed on so the caller can act on
    * it directly, mirroring the short mid-job pay's 402 (`payment.ts`). It is a
@@ -11972,7 +12072,7 @@ var JobManager = class {
    * fault an operator should see in their 5xx rate. `retryable` is true because
    * the ask is genuinely still outstanding.
    *
-   * Nothing is released here. The hold is left to the internal-review reconciler,
+   * Nothing is released here. The hold is left to the reconciler,
    * which makes the same decision — unbound draw ⇒ release, never settle — but
    * under the credit row's `FOR UPDATE`, after the job is terminal, where it
    * cannot race an in-flight COMMIT. Releasing from here would also be
@@ -12039,7 +12139,7 @@ var JobManager = class {
   }
   /**
    * Describe a deposit the job row never took, in the shape both the 201 and
-   * the `payment_unapplied` 500 carry (internal-review). `undefined` when the payment
+   * the `payment_unapplied` 500 carry. `undefined` when the payment
    * ran ledger-less (no credit ledger wired, or the top-up preflight skipped) —
    * there is no credit to name, so the 201 carries no `credit` block and the
    * 500 takes its words from `unappliedCopy` directly.
@@ -12053,7 +12153,7 @@ var JobManager = class {
       ...unappliedCopy(reason, creditId)
     };
   }
-  /** Book a mid-job top-up's funding as a deposit (internal-review, spec §10). */
+  /** Book a mid-job top-up's funding as a deposit (the deposit-accounting rule). */
   reportCreditDeposit(funding) {
     const onCreditFunded = this.opts.onCreditFunded;
     if (!funding || !onCreditFunded || !this.opts.dvmId) return;
@@ -12066,7 +12166,7 @@ var JobManager = class {
   /**
    * Internal: build the BuildContextOpts shared between `createJob` and
    * `reactivateJob`. Centralised so persistence/terminal callbacks and the
-   * internal-review NOTIFY-driven cross-machine wake stay in one place.
+   * NOTIFY-driven cross-machine wake stay in one place.
    */
   buildContextOpts(job) {
     const jobStore = this.jobStore;
@@ -12085,7 +12185,16 @@ var JobManager = class {
       getCounters: isStreamableJobStore(jobStore) ? () => jobStore.getCounters(job.id) : void 0,
       drawPool: this.opts.creditLedger ? () => this.resolveDrawPool(job) : void 0,
       pricingCurrency: this.pricingCurrency,
-      claimForProcessing: isStreamableJobStore(jobStore) ? () => jobStore.claimForProcessing(job.id) : void 0,
+      claimForProcessing: isStreamableJobStore(jobStore) ? (resume) => {
+        const pending = job.pendingPayment;
+        return this.queueInputResume(job, async () => {
+          if (!pending || job.pendingPayment !== pending || isTerminal(job.status)) return false;
+          if (!await this.claimLocalInput(job)) return false;
+          if (job.pendingPayment !== pending || isTerminal(job.status)) return false;
+          await resume?.();
+          return true;
+        });
+      } : void 0,
       onSuperseded: () => {
         this.clearIdleTimer(job.id);
         this.unwatchDurableStatus(job.id);
@@ -12096,7 +12205,7 @@ var JobManager = class {
   }
   /**
    * Internal: what unit `ctx.requestPayment`'s auto-credit gate may measure this
-   * job's remaining pool in (internal-review).
+   * job's remaining pool in.
    *
    * The regime is read off the DRAW, never off the job. Implicit N=1 is exactly
    * `credit_id === imp:<rail>:<draw_id>`, because `fundAndDraw` derives both
@@ -12114,8 +12223,7 @@ var JobManager = class {
    * drew and whose pool this can't read or denominate answers `unpriced`, which
    * the gate declines to auto-credit from: the msat figure it would otherwise
    * fall back on is a slice of the credit's rail value at a ratio pinned
-   * whenever that credit was funded, which is the exact figure this issue exists
-   * to stop spending against.
+   * whenever that credit was funded, so it cannot safely fund a new ask.
    */
   async resolveDrawPool(job) {
     const ledger = this.opts.creditLedger;
@@ -12164,7 +12272,7 @@ var JobManager = class {
   }
   /**
    * Issue the signed receipt for a job that has reached a terminal status
-   * (internal-review). Idempotent and safe to call from every terminal path — the
+   * Idempotent and safe to call from every terminal path — the
    * store owns both the sequence allocation and the write-once persist, so
    * two machines racing on the same job converge on identical bytes and burn
    * exactly one sequence number.
@@ -12249,10 +12357,10 @@ var JobManager = class {
     };
   }
   /**
-   * Settle or release a terminal job's credit draw (internal-review): `completed`
+   * Settle or release a terminal job's credit draw: `completed`
    * settles (the hold becomes a real debit); `failed`/`cancelled` releases
    * (the hold evaporates — "no debit on job failure", mechanically
-   * superseding the internal-review/974 no-op refund for credit-paid jobs, including
+   * superseding the 974 no-op refund for credit-paid jobs, including
    * the `ctx.fail` path and the stale-sweeper reap). Idempotent — a replayed
    * resolution returns the recorded state. Returns the `ReceiptCredit` block
    * for the receipt: `balance_after` is the recorded draw trajectory for a
@@ -12298,7 +12406,7 @@ var JobManager = class {
     }
   }
   /**
-   * The one place a terminal job's status becomes a ledger verb (internal-review):
+   * The one place a terminal job's status becomes a ledger verb:
    * `completed` settles the hold into a real debit, `failed`/`cancelled`
    * release it. Read by the in-line funnel (`resolveCreditDraw`) and by the
    * late reconciler (`reconcileTerminalDraw`) — two paths that must never
@@ -12313,45 +12421,47 @@ var JobManager = class {
    * cleanup window hand back the same bytes as a cross-machine re-read.
    */
   async attachReceipt(job) {
-    const receipt = await this.issueReceipt(toJobRecord(job));
+    const record = await this.jobStore.get(job.id);
+    if (!record || !isTerminal(record.status)) return;
+    const receipt = await this.issueReceipt(record);
     if (receipt) job.receipt = receipt;
   }
   /**
-   * Read-path repair for a terminal job carrying no receipt (internal-review), for
+   * Read-path repair for a terminal job carrying no receipt, for
    * either an in-memory job or a store record. Free in the steady state — it
    * returns on the `receipt` check without touching the store — so it costs
    * only on the cases it exists for:
    *
    * - **A crash between the two store calls.** `claimReceiptSeq` commits the
-   *   sequence number to the job row before `saveReceipt` writes the bytes; a
-   *   process death in that window would otherwise strand that number
-   *   forever, and a permanent gap is indistinguishable from the deliberate
-   *   suppression `seq` exists to expose. Re-issuing here reuses the already
-   *   committed number (the claim is idempotent per job) rather than
-   *   allocating a second one.
+   * sequence number to the job row before `saveReceipt` writes the bytes; a
+   * process death in that window would otherwise strand that number
+   * forever, and a permanent gap is indistinguishable from the deliberate
+   * suppression `seq` exists to expose. Re-issuing here reuses the already
+   * committed number (the claim is idempotent per job) rather than
+   * allocating a second one.
    * - **A transient store failure** at the terminal: `issueReceipt` logs
-   *   `receipt_issue_failed` and returns nothing rather than failing the job,
-   *   so the next read retries.
+   * `receipt_issue_failed` and returns nothing rather than failing the job,
+   * so the next read retries.
    * - **Jobs that terminated before the DVM had a receipt key.** They pick one
-   *   up on first read, with `issued_at` reflecting when it was signed.
+   * up on first read, with `issued_at` reflecting when it was signed.
    */
   async ensureReceipt(target) {
-    if (target.receipt) return;
-    const record = "listeners" in target ? toJobRecord(target) : target;
+    if (target.receipt) {
+      if (isTerminal(target.status)) await this.reportTerminalJob(target.id);
+      return;
+    }
+    const record = "listeners" in target ? await this.jobStore.get(target.id) : target;
+    if (!record || !isTerminal(record.status)) return;
     const receipt = await this.issueReceipt(record);
     if (receipt) target.receipt = receipt;
+    if (isTerminal(target.status)) await this.reportTerminalJob(target.id);
   }
-  /**
-   * Close out a terminal job whose caller hasn't already persisted it: sign
-   * the receipt, then save the snapshot. The snapshot save never writes the
-   * receipt column, so ordering only affects how soon a reader sees the
-   * receipt — this way a caller polling immediately after the terminal
-   * already finds it.
-   */
+  /** Commit the terminal snapshot before resolving money and signing its durable evidence. */
   async finalizeTerminal(job) {
+    await this.persistJob(job);
     await this.attachReceipt(job);
-    await this.persistJob(job).catch(() => void 0);
     await this.reportJobCost(job);
+    await this.reportTerminalJob(job.id);
   }
   /**
    * Issue a receipt for a job this process doesn't hold in `activeJobs` — a
@@ -12370,20 +12480,69 @@ var JobManager = class {
   }
   /**
    * Finish accounting for a terminal written directly to the store — the
-   * stale reaper and a cancel handled on a different machine (internal-review).
+   * stale reaper and a cancel handled on a different machine.
    */
   async finalizeStoredTerminal(jobId) {
     const receipt = await this.issueReceiptForStoredJob(jobId);
     const record = await this.jobStore.get(jobId).catch(() => void 0);
-    if (record && isTerminal(record.status)) await this.reportJobCost(record);
+    if (record && isTerminal(record.status)) {
+      await this.reportJobCost(record);
+      await this.reportTerminalJob(jobId);
+    }
     return receipt;
   }
+  async reportTerminalJob(jobId) {
+    try {
+      const callback = this.opts.onJobTerminal;
+      const dvmId = this.opts.dvmId;
+      if (!callback || !dvmId) return;
+      const record = await this.jobStore.get(jobId);
+      if (!record || !isReceiptableStatus(record.status) || record.timingKnown === false || record.terminalAtMs === void 0 || record.status !== "completed" && !record.endedBy) return;
+      const receipt = await this.issueReceipt(record);
+      if (this.opts.receiptIssuer && !receipt) return;
+      if (record.creditId && record.drawId && this.opts.creditLedger) {
+        const draw = await this.opts.creditLedger.getDraw({ creditId: record.creditId, drawId: record.drawId });
+        if (!draw || draw.status === "pending") return;
+      }
+      await callback({
+        dvmId,
+        jobId: record.id,
+        capability: record.capability,
+        outcome: record.status,
+        endedBy: record.status === "completed" ? null : record.endedBy ?? "provider",
+        paid: record.paidMsats > 0 || (record.nativeAmount ?? 0) > 0 || !!record.drawId,
+        acceptedAtMs: record.createdAt,
+        terminalAtMs: record.terminalAtMs,
+        callerWaitMs: record.callerWaitMs ?? 0,
+        receiptSeq: receipt?.seq ?? null
+      });
+      if ("markTerminalReported" in this.jobStore) {
+        await this.jobStore.markTerminalReported(jobId);
+      }
+    } catch (error) {
+      console.error(`[${jobId}] Terminal reporting failed:`, error);
+    }
+  }
+  terminalReportRecoveryCursor;
+  async recoverTerminalReports() {
+    const store = this.jobStore;
+    const dvmId = this.opts.dvmId;
+    if (!this.opts.onJobTerminal || !dvmId || !("listUnreportedTerminalReports" in store)) return;
+    const recovery = store;
+    const records = await recovery.listUnreportedTerminalReports(dvmId, this.capabilityNames(), this.terminalReportRecoveryCursor);
+    for (const record of records) await this.reportTerminalJob(record.id);
+    this.terminalReportRecoveryCursor = records.length === 100 ? records[records.length - 1].id : void 0;
+  }
   /** Handle job reaching terminal state (completed, failed, cancelled). */
   async handleJobTerminal(job) {
     this.clearIdleTimer(job.id);
+    if (await this.adoptDurableTerminal(job)) return;
+    const durable = await this.jobStore.get(job.id);
+    if (!durable || !isTerminal(durable.status)) await this.persistJob(job);
     await this.attachReceipt(job);
     const booked = await this.bookRevenue(job);
     if (!booked) await this.reportJobCost(job);
+    await this.reportTerminalJob(job.id);
     this.scheduleCleanup(job);
   }
   /**
@@ -12396,6 +12555,7 @@ var JobManager = class {
   async recoverTerminalCosts() {
     const store = this.jobStore;
     const dvmId = this.opts.dvmId;
+    await this.recoverTerminalReports();
     if (!dvmId || !this.opts.onJobCost || !isTerminalCostRecoveryStore(store)) {
       return { examined: 0, queued: 0, complete: true };
     }
@@ -12480,11 +12640,11 @@ var JobManager = class {
     return true;
   }
   /**
-   * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
+   * Report a completed paid job's revenue under its durable job identity.
    * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
    *
    * For a **credit-backed** job the revenue event is the *settled draw* (spec
-   * §10), and since internal-review the sats figure corrects the job's mirror of that
+   * §10), and since the behavior was introduced the sats figure corrects the job's mirror of that
    * draw against the draw itself: `withDrawBasis` stamps the job when the
    * payment lands, but a Bitcoin credit's settle re-prices the draw against
    * the funding lots it consumed. The correction is a delta, because a job's
@@ -12499,7 +12659,7 @@ var JobManager = class {
    * whose price couldn't be fiat-denominated) nothing changes: the pre-credits
    * payload is reported verbatim.
    *
-   * Takes the fields rather than a `ServerJob` so the internal-review reconciler — a
+   * Takes the fields rather than a `ServerJob` so the reconciler — a
    * background sweep that holds no in-process job — books through this exact
    * path off the row it read. `paymentTxHash` is passed **verbatim**, never
    * recomputed as a `drawSettlementRef`: it is the same column the in-line
@@ -12516,7 +12676,7 @@ var JobManager = class {
    * DVM with no reporter). Every drop that costs a booking logs first.
    *
    * The rail check sits **below** the draw re-read, not in the entry guard
-   * (internal-review): a settled draw the terminal can't report under is a real debit
+   * a settled draw the terminal can't report under is a real debit
    * with no revenue event, permanently overstating outstanding liability
    * (`deposits − draw revenue`), and it used to return here in silence. Placed
    * after the re-read, `revenue_skipped_no_rail` can name the draw and its
@@ -12579,9 +12739,9 @@ var JobManager = class {
             paidMsats: job.paidMsats,
             creditRail: creditRail ?? null,
             // Four distinct causes needing four distinct fixes, so none of them
-            // is the else-branch: the credit predates internal-review and has no rail
+            // is the else-branch: the credit predates and has no rail
             // (`credit_rail_null`); it carries one this build doesn't list, the
-            // internal-review sibling class (`credit_rail_unrecognized`); the credit's
+            // sibling class (`credit_rail_unrecognized`); the credit's
             // rail is perfectly good and it is the *job row* that lost its own
             // (`job_rail_missing`), which no change to the ledger would fix; or
             // this manager was built with no `creditLedger` to read the draw
@@ -12629,7 +12789,7 @@ var JobManager = class {
         cashuFlow: job.cashuFlow,
         // Absent unless the handler declared one, and absent is a fact: the
         // platform shows "no costs reported" rather than a zero cost and a
-        // 100% margin (internal-review). Both halves or neither — a bare amount
+        // 100% margin. Both halves or neither — a bare amount
         // in an unnamed currency is not a cost.
         ...job.costAmountMicro !== void 0 && job.costCurrency !== void 0 ? { cost: { amountMicro: job.costAmountMicro, currency: job.costCurrency } } : {},
         ...credit
@@ -12812,8 +12972,8 @@ var MintHealthTracker = class {
   firstProbeComplete = false;
   constructor(opts) {
     this.mints = [...opts.mints];
-    this.tickIntervalMs = opts.tickIntervalMs ?? resolveEnvTickMs();
-    this.failuresToSick = opts.consecutiveFailuresToSick ?? resolveEnvFailuresToSick();
+    this.tickIntervalMs = opts.tickIntervalMs ?? resolveEnvTickMs(opts.env);
+    this.failuresToSick = opts.consecutiveFailuresToSick ?? resolveEnvFailuresToSick(opts.env);
     this.fetchImpl = opts.fetchImpl;
     this.probeOpts = { ...opts.probe, fetchImpl: opts.fetchImpl };
     this.nowFn = opts.now ?? Date.now;
@@ -12864,7 +13024,7 @@ var MintHealthTracker = class {
   /**
    * True once the first full probe tick has landed. Before this, paid calls
    * are held at `503 mint_health_pending` rather than accepted against
-   * unvalidated mints (internal-review).
+   * unvalidated mints.
    */
   initialProbeComplete() {
     return this.firstProbeComplete;
@@ -12889,7 +13049,7 @@ var MintHealthTracker = class {
    * gate — a deterministic, permanent config error, unlike a transient outage.
    * Unknown mints return false. `advertisedMints()` uses this to keep a
    * permanently-unsettleable mint off `/v1/info` even in the all-sick fallback,
-   * where a merely-flapping mint is still published (internal-review).
+   * where a merely-flapping mint is still published.
    */
   isNutIncompatible(mintUrl) {
     return this.state.get(normaliseMintUrl(mintUrl))?.nutIncompatible ?? false;
@@ -12956,7 +13116,7 @@ var MintHealthTracker = class {
    * One-shot structured summary emitted after the first probe tick. Replaces
    * the boot check's per-mint `cashu_mint_startup_health` lines and surfaces an
    * all-mints-unhealthy warning — the operator alert that the Fly restart-loop
-   * used to be before boot stopped refusing to start (internal-review).
+   * used to be before boot stopped refusing to start.
    */
   logBootHealth() {
     const mints = Object.entries(this.snapshot()).map(([mintUrl, s]) => ({
@@ -12981,15 +13141,15 @@ var MintHealthTracker = class {
     );
   }
 };
-function resolveEnvTickMs() {
-  const raw = process.env.DVMKIT_MINT_HEALTH_TICK_MS;
+function resolveEnvTickMs(env = process.env) {
+  const raw = env.DVMKIT_MINT_HEALTH_TICK_MS;
   if (!raw) return DEFAULT_TICK_INTERVAL_MS2;
   const parsed = Number(raw);
   if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_TICK_INTERVAL_MS2;
   return Math.floor(parsed);
 }
-function resolveEnvFailuresToSick() {
-  const raw = process.env.DVMKIT_MINT_FAILURES_TO_SICK;
+function resolveEnvFailuresToSick(env = process.env) {
+  const raw = env.DVMKIT_MINT_FAILURES_TO_SICK;
   if (!raw) return DEFAULT_FAILURES_TO_SICK;
   const parsed = Number(raw);
   if (!Number.isInteger(parsed) || parsed < 1) return DEFAULT_FAILURES_TO_SICK;
@@ -14040,9 +14200,9 @@ async function handlePendingDrains(c, opts) {
       sats_basis: amountSats === null ? null : d.owedSats === null ? "rate" : "in_kind",
       // The figure a `manual` payout is actually sized in: `amount_micro` is
       // fiat, and the operator sends the rail's own token. It is the same debit
-      // `completeX402ChannelDrain` treats as its settlement floor (internal-review),
+      // `completeX402ChannelDrain` treats as its settlement floor,
       // so publishing it is what lets an operator settle from the row instead
-      // of assuming their stablecoin happens to be six-decimal (internal-review).
+      // of assuming their stablecoin happens to be six-decimal.
       amount_native: d.drainedNative,
       settlement,
       // Why this row is classified as it is, and the channel an operator would
@@ -14565,7 +14725,7 @@ async function handleReconcileInvoice(c, opts) {
             fundedAt: settledAtMs ?? invoice.settledAt ?? nowMs,
             expiryMs,
             // The settlements table types this deposit `repair` off the
-            // flag (internal-review): the sats landed at payment time and the
+            // flag: the sats landed at payment time and the
             // deposit is the one row they get.
             repaired: true
           }
@@ -16560,7 +16720,7 @@ function autoApprovePayment(content) {
     headers: jobHeaders(true),
     // amount_msats rides along so an onPayment handler sees the same shape a
     // real rail would hand it. dev_auto is admitted on dev-mode servers only
-    // (internal-review) \u2014 hence the status check below rather than a silent catch.
+    // hence the status check below rather than a silent catch.
     body: JSON.stringify({ type: "payment", content: { dev_auto: true, amount_msats: content.amount_msats || 0 } }),
   }).then(function(r) {
     if (!r.ok) addMsg("Auto-approve rejected (" + r.status + ") \u2014 dev mode only.", "msg-system");
@@ -16707,7 +16867,7 @@ async function createDVMServer(descriptor, opts) {
     }
   })();
   try {
-    if (process.env.DVMKIT_CASHU_MINTS && opts.cashuMode === void 0) {
+    if (opts.env.DVMKIT_CASHU_MINTS && opts.cashuMode === void 0) {
       console.warn(
         JSON.stringify({
           level: "cashu_opts_env_ignored",
@@ -16720,12 +16880,12 @@ async function createDVMServer(descriptor, opts) {
     const platformUrl = opts.platformUrl ?? envMaybe.DVMKIT_PLATFORM_URL;
     const dvmId = opts.dvmId;
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-ASZ7SHHH.js");
+      const { RevenueReporter } = await import("./revenue-reporter-NNCNRY4C.js");
       const reporter = new RevenueReporter(opts.db, platformUrl, platformToken);
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-RG6XNGPI.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-5PIRYFVQ.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -16868,6 +17028,7 @@ async function createDVMServer(descriptor, opts) {
       processedPayments,
       onJobCompleted: effectiveOnJobCompleted,
       onJobCost: effectiveOnJobCost,
+      onJobTerminal: activeRevenueReporter?.reportTerminal.bind(activeRevenueReporter),
       onPaidJobDeath: effectiveOnPaidJobDeath,
       onRevenueSkippedNoRail: effectiveOnRevenueSkippedNoRail,
       onCreditFunded: opts.onCreditFunded,
@@ -16911,7 +17072,7 @@ var DVMServer = class {
   fxFetcher;
   /**
    * The currency this DVM prices in and denominates its credit ledger in,
-   * resolved once at construction (internal-review).
+   * resolved once at construction.
    *
    * `configureDVM` and the CLI loader both resolve this field. The server is
    * also exported for direct JavaScript callers, so defaulting at the one
@@ -16920,29 +17081,24 @@ var DVMServer = class {
    */
   pricingCurrency;
   /**
-   * Last-good lock-pubkey state observed from Postgres (internal-review). Used as the
+   * Last-good lock-pubkey state observed from Postgres. Used as the
    * fallback when `loadLockPubkeyState` throws — degrades more gracefully than
    * falling back to the env-derived seed, which post-rotation is the *retired*
    * pubkey. Null until the first successful read.
    */
   cachedLockPubkeyState = null;
-  /** Guards the opportunistic Tempo settlement cadence (internal-review). */
   tempoSweepInFlight = false;
   tempoSweepLastAttemptMs = 0;
-  /** Receipt signer for this DVM (internal-review). Undefined when no key is wired. */
   receiptIssuer;
-  /** Credit ledger the payment gate funds/draws through (internal-review). */
   creditLedger;
-  /** Durable x402/mpp funding markers (internal-review). */
   processedPayments;
   authAudience;
   /** Lazily constructed when a refreshed facilitator probe gains batch support. */
   x402BatchSettlement;
   /** Coalesces concurrent requests that first observe batch support. */
   x402BatchSettlementInit;
-  /** Durable exact-settlement coordinator shared by every exact payment surface. */
   x402ExactSettlement;
-  /** Withdraws this mount's Tempo session capability from the poll (internal-review). */
+  /** Withdraws this mount's Tempo session capability from the poll. */
   undeclareSessionCapability;
   constructor(descriptor, opts) {
     this.descriptor = descriptor;
@@ -16966,7 +17122,7 @@ var DVMServer = class {
       this.mintHealthTracker = opts.mintHealthTracker;
       this.ownsMintHealthTracker = false;
     } else if (opts.mints && opts.mints.length > 0) {
-      this.mintHealthTracker = new MintHealthTracker({ mints: opts.mints });
+      this.mintHealthTracker = new MintHealthTracker({ mints: opts.mints, env: opts.env });
       this.ownsMintHealthTracker = true;
     } else {
       this.ownsMintHealthTracker = false;
@@ -16987,7 +17143,7 @@ var DVMServer = class {
       mints: opts.mints,
       jobStore: opts.jobStore,
       devMode: opts.devMode,
-      // Derived, not raw (internal-review). `ctx.requestPayment` gates its x402 and
+      // Derived, not raw. `ctx.requestPayment` gates its x402 and
       // Tempo challenge issuance on this list, while `/v1/info`, `/v1/quote`
       // and the upfront 402 all read `resolvePaymentMethods()` — so passing the
       // raw option meant a DVM that never set `paymentMethods` (no first-party
@@ -17012,21 +17168,20 @@ var DVMServer = class {
       dvmId: opts.dvmId,
       authAudience: this.authAudience,
       fxFetcher: this.fxFetcher,
-      // internal-review: the mid-job top-up leg needs the same rail wiring the upfront
+      // the mid-job top-up leg needs the same rail wiring the upfront
       // path gets — a divergence here would be a DVM whose upfront payment funds
       // a credit and whose mid-job payment silently doesn't.
       processedPayments: this.processedPayments,
       enqueueCreditDeposit: opts.enqueueCreditDeposit,
       enqueueCreditDrawRelease: opts.enqueueCreditDrawRelease,
       creditTtlMs: descriptor.credit ? descriptor.credit.ttlSeconds * 1e3 : void 0,
-      // internal-review: the same read `creditCurrency()` serves everywhere else, so a
-      // mid-job ask pins in the denomination this DVM's credits actually use.
       pricingCurrency: this.pricingCurrency,
       onCreditFunded: opts.onCreditFunded,
       onJobCompleted: opts.onJobCompleted,
       onPaidJobCompleted: opts.onPaidJobCompleted,
       paymentMode: opts.paymentMode,
       onJobCost: opts.onJobCost,
+      onJobTerminal: opts.onJobTerminal,
       onPaidJobDeath: opts.onPaidJobDeath,
       onRevenueSkippedNoRail: opts.onRevenueSkippedNoRail,
       onJobRetentionSweepFailed: opts.onJobRetentionSweepFailed,
@@ -17064,7 +17219,7 @@ var DVMServer = class {
    * Tear down this mount. Every leg is synchronous except the batch-settlement
    * server's own `stop()`; the returned promise settles once that has finished,
    * so a caller holding a resource behind it — the settlement pool the spend
-   * gate's store owns (internal-review) — can sequence its close instead of pulling it
+   * gate's store owns — can sequence its close instead of pulling it
    * out from under an in-flight stop. A rejection remains observable so the app
    * and host teardown layers can finish later cleanup before surfacing it.
    */
@@ -17165,12 +17320,12 @@ var DVMServer = class {
       (c) => c.json({
         ok: true,
         // shortSha, not .slice(0, 7): a dirty-tree deploy bakes a `-dirty`
-        // marker (internal-review) that a raw truncation would cut off the end,
+        // marker that a raw truncation would cut off the end,
         // leaving this endpoint claiming a clean commit while /v1/info's
         // untruncated sdk_sha says otherwise — same image, two answers.
-        gitSha: shortSha(process.env.GIT_SHA ?? "unknown"),
-        deployedAt: process.env.BUILD_TIME ?? "unknown",
-        deployId: process.env.DVMKIT_DEPLOY_ID ?? "unknown"
+        gitSha: shortSha(this.opts.env.GIT_SHA ?? "unknown"),
+        deployedAt: this.opts.env.BUILD_TIME ?? "unknown",
+        deployId: this.opts.env.DVMKIT_DEPLOY_ID ?? "unknown"
       })
     );
     if (this.opts.devMode) {
@@ -17203,8 +17358,6 @@ var DVMServer = class {
           getLockPubkeyState: () => this.loadActiveLockPubkeyState(db, dvmId),
           graceSeconds: this.graceSeconds(),
           nonceStore: this.adminCashuNonceStore,
-          // internal-review: a completed melt is a landed payout, queued in the
-          // transaction that marks it.
           ...payoutReporter ? { onMelted: payoutReporter.meltHook() } : {}
         });
       }
@@ -17222,13 +17375,13 @@ var DVMServer = class {
         enqueueCreditDeposit: this.opts.enqueueCreditDeposit,
         enqueueCreditDrain: this.opts.enqueueCreditDrain,
         lightningReceive: this.opts.lightningReceive,
-        // internal-review's x402 repair queue rides the same surface, and resolves
+        // x402 repair queue rides the same surface, and resolves
         // the rail the same lazy way the verify path does — constructing the
         // settlement server probes the facilitator, which must not happen just
         // because the admin routes were mounted.
         x402BatchSettlement: () => this.resolveX402BatchSettlement(),
         x402ExactSettlement: this.x402ExactSettlement,
-        // internal-review's Tempo repair queue, same surface again. The mppx handle is
+        // Tempo repair queue, same surface again. The mppx handle is
         // already built by the time routes mount, so the thunk is uniformity
         // rather than laziness — and it is the *handle*, not the store, so a
         // DVM wired with an in-memory session store resolves to a rail with no
@@ -17236,10 +17389,8 @@ var DVMServer = class {
         tempoDrainRail: () => Promise.resolve(this.opts.mpp),
         // Health-filtered, and read per request rather than captured: the
         // servicer picking a mint to buy a refund at wants the list that
-        // excludes a mint currently failing its probe (internal-review).
+        // excludes a mint currently failing its probe.
         mints: () => this.advertisedMints(),
-        // internal-review: a repaired Tempo close is a landed payout the agent
-        // finished, queued in the transaction that books the drain.
         ...payoutReporter ? { onTempoDrainReconciled: payoutReporter.tempoRepairHook() } : {}
       });
     }
@@ -17250,7 +17401,7 @@ var DVMServer = class {
   /**
    * Load the live lock-pubkey state for this DVM. Reads from
    * `dvm_lock_pubkeys` on every call so rotations propagate without needing
-   * a process restart (internal-review). On success the result is cached so a later
+   * a process restart. On success the result is cached so a later
    * DB outage can degrade to the last-observed state instead of the
    * env-derived seed (which post-rotation is the *retired* pubkey).
    */
@@ -17261,7 +17412,7 @@ var DVMServer = class {
   }
   /**
    * Resolve the active lock-pubkey set for the mid-job cashu accept path
-   * (internal-review). Returns the same `[current, ...retired_in_grace]` shape the
+   * Returns the same `[current, ...retired_in_grace]` shape the
    * upfront flow uses at lines 709-718 so accept-time rotation tolerance is
    * consistent across upfront and mid-job. Falls back to `undefined` when
    * accumulator mode isn't wired (the receive path then rejects with
@@ -17298,13 +17449,13 @@ var DVMServer = class {
   }
   /**
    * Run the routine Tempo settlement cadence opportunistically, on ordinary
-   * traffic (internal-review).
+   * traffic.
    *
    * Routine settlement used to ride the per-DVM watcher machine's four-minute
    * poll, which is exactly what kept an idle DVM awake and billing. It cannot
    * move to a timer for the same reason — a timer on a machine that ought to
    * be suspended either does not fire or defeats the suspension. So it rides
-   * requests instead, the way Lightning funding is credited (internal-review): a DVM
+   * requests instead, the way Lightning funding is credited: a DVM
    * with no traffic has nothing to settle on a 24-hour cadence anyway, and the
    * forced-close guarantee does not depend on this path at all — that is the
    * chain-event wake, which reaches a suspended DVM through Fly Proxy.
@@ -17344,7 +17495,7 @@ var DVMServer = class {
     });
   }
   /**
-   * Whether one advertised MPP method may still be offered (internal-review).
+   * Whether one advertised MPP method may still be offered.
    *
    * Only `tempo/session` is gated, and only when this DVM is platform-hosted:
    * a session channel is safe to accept exactly while something is watching
@@ -17360,7 +17511,6 @@ var DVMServer = class {
   tempoSessionOffered(method) {
     return this.tempoSessionWithheldReason(method) === void 0;
   }
-  /** Stable caller-facing reason for withholding one newly opened session. */
   tempoSessionWithheldReason(method) {
     if (method.method !== "tempo" || method.intent !== "session") return void 0;
     if (this.opts.tempoSettlementReadiness && !this.opts.tempoSettlementReadiness.available()) {
@@ -17371,7 +17521,6 @@ var DVMServer = class {
     }
     return void 0;
   }
-  /** Await only the cold-start reads each fail-closed session gate needs. */
   async ensureTempoSessionHealth() {
     await Promise.all([
       this.opts.tempoObserverHealth?.ensureFresh?.(),
@@ -17382,7 +17531,6 @@ var DVMServer = class {
    * Whether this DVM is **configured** to take TIP-1034 session channels — the
    * value the observer-health poll carries back to the platform, where it keeps
    * `dvms.tempo_session_advertised_at` current between container deploys
-   * (internal-review).
    *
    * Deliberately the same question the platform's post-deploy `/v1/info` probe
    * answers (`infoAdvertisesTempoSession`), from the same two facts: the credit
@@ -17394,13 +17542,12 @@ var DVMServer = class {
    * It reads `advertisedMethods` rather than {@link creditMppSplit}'s `offered`,
    * and never {@link tempoSessionOffered}: what the column records is
    * capability, not availability, so an observer blip must leave it alone. That
-   * distinction is the whole of internal-review, and answering it here from the gate
+   * distinction is the whole of and answering it here from the gate
    * would reintroduce it on a one-minute cadence.
    */
   tempoSessionCapability() {
     if (!this.opts.mpp) return false;
     if (!creditMenuConfigured({
-      // The SDK server only ever runs the container runtime — see `creditMenu`.
       runtime: "container",
       config: this.descriptor.credit,
       hasAuth: !!this.descriptor.auth,
@@ -17415,7 +17562,7 @@ var DVMServer = class {
   }
   /**
    * `POST /_internal/tempo-close-event` — the forced-close wake path
-   * (internal-review), replacing the per-DVM `tempo-session-watch` Fly Machine.
+   * replacing the per-DVM `tempo-session-watch` Fly Machine.
    *
    * Deliberately **unauthenticated**, and that is the design rather than an
    * omission: the body is an event locator, so the DVM re-reads the event from
@@ -17494,7 +17641,7 @@ var DVMServer = class {
   }
   /**
    * Compose the `/v1/info#builder` block from `opts.builder` (inline SDK
-   * config) with a fallback to deploy-injected env vars (internal-review). Each
+   * config) with a fallback to deploy-injected env vars. Each
    * field is independently sourced (opts wins per-field, env fills gaps);
    * all three of pubkey / attestation / signature must resolve to emit the
    * block — partial state is treated as absent rather than half-emitted.
@@ -17507,8 +17654,8 @@ var DVMServer = class {
   builderAttestationBlock() {
     const builder = this.opts.builder;
     const env = this.opts.env;
-    const pubkey = builder?.pubkey ?? env.DVMKIT_BUILDER_PUBKEY ?? process.env.DVMKIT_BUILDER_PUBKEY;
-    const signature = builder?.signature ?? env.DVMKIT_BUILDER_SIGNATURE ?? process.env.DVMKIT_BUILDER_SIGNATURE;
+    const pubkey = builder?.pubkey ?? env.DVMKIT_BUILDER_PUBKEY;
+    const signature = builder?.signature ?? env.DVMKIT_BUILDER_SIGNATURE;
     const attestation = builder?.attestation ? { ...builder.attestation } : this.parseAttestationFromEnv(env);
     if (!pubkey || !signature || !attestation) return null;
     return { pubkey, attestation, signature };
@@ -17540,7 +17687,7 @@ var DVMServer = class {
     throw new AuthAudienceError();
   }
   /**
-   * The slug every receipt is stamped with (internal-review). Read off the signed
+   * The slug every receipt is stamped with. Read off the signed
    * attestation payload, which is the only place the *attested* slug lives —
    * a receipt claiming a different name than the attestation binds would be
    * unverifiable. Falls back to the descriptor name for dev/self-host boots
@@ -17551,14 +17698,13 @@ var DVMServer = class {
     const slug = attestation?.slug;
     return typeof slug === "string" && slug.length > 0 ? slug : this.descriptor.name;
   }
-  /** Immutable identity written into every signed receipt. */
   receiptDvmId() {
     const attestation = this.builderAttestationBlock()?.attestation;
     const dvmId = attestation?.dvm_id;
     return typeof dvmId === "string" && dvmId.length > 0 ? dvmId : this.opts.dvmId ?? this.descriptor.name;
   }
   parseAttestationFromEnv(env) {
-    const raw = env.DVMKIT_BUILDER_ATTESTATION ?? process.env.DVMKIT_BUILDER_ATTESTATION;
+    const raw = env.DVMKIT_BUILDER_ATTESTATION;
     if (!raw) return null;
     try {
       const parsed = JSON.parse(raw);
@@ -17569,7 +17715,7 @@ var DVMServer = class {
     }
   }
   /**
-   * Owner display block for `/v1/info#owner` (internal-review). Resolved from
+   * Owner display block for `/v1/info#owner`. Resolved from
    * `opts.owner` or env vars injected by the platform deploy pipeline.
    * Returns null when no owner identity is configured — pre-unification
    * DVMs that haven't been redeployed omit the block.
@@ -17577,11 +17723,11 @@ var DVMServer = class {
   ownerDisplayBlock() {
     const owner = this.opts.owner;
     const env = this.opts.env;
-    const handle = owner?.handle ?? env.DVMKIT_OWNER_HANDLE ?? process.env.DVMKIT_OWNER_HANDLE;
+    const handle = owner?.handle ?? env.DVMKIT_OWNER_HANDLE;
     if (!handle) return null;
-    const type = owner?.type ?? env.DVMKIT_OWNER_TYPE ?? process.env.DVMKIT_OWNER_TYPE ?? "builder";
-    const displayName = owner?.displayName ?? env.DVMKIT_OWNER_DISPLAY_NAME ?? process.env.DVMKIT_OWNER_DISPLAY_NAME ?? null;
-    const avatarUrl = owner?.avatarUrl ?? env.DVMKIT_OWNER_AVATAR_URL ?? process.env.DVMKIT_OWNER_AVATAR_URL ?? null;
+    const type = owner?.type ?? env.DVMKIT_OWNER_TYPE ?? "builder";
+    const displayName = owner?.displayName ?? env.DVMKIT_OWNER_DISPLAY_NAME ?? null;
+    const avatarUrl = owner?.avatarUrl ?? env.DVMKIT_OWNER_AVATAR_URL ?? null;
     return { handle, display_name: displayName, avatar_url: avatarUrl, type };
   }
   defaultPaymentMethods() {
@@ -17600,14 +17746,13 @@ var DVMServer = class {
     if (!this.opts.x402.batchSettlement?.selfRelay) return support;
     return { ...support, batchSettlement: true };
   }
-  /** Whether this DVM can state its price exactly in x402's USDC unit. */
   x402CurrencySupported() {
     return this.pricingCurrency === "usd";
   }
   /**
    * Settleable rails for this DVM, honouring an explicit `opts.paymentMethods`
    * override and otherwise deriving from wired rails. Single source of truth so
-   * the `/v1/info` and `/v1/quote` rail enumerations can't drift (internal-review).
+   * the `/v1/info` and `/v1/quote` rail enumerations can't drift.
    */
   resolvePaymentMethods() {
     const configured = this.opts.paymentMethods ?? this.defaultPaymentMethods();
@@ -17620,13 +17765,13 @@ var DVMServer = class {
   }
   /**
    * Rails a **credit top-up** may arrive on — the funding menu's list
-   * (internal-review). A superset of {@link resolvePaymentMethods}, and deliberately
+   * A superset of {@link resolvePaymentMethods}, and deliberately
    * a separate read: `lightning` funds a credit but is not an attached-proof
    * wire method, so it must never reach `/v1/info` or `/v1/quote`'s
-   * `payment.methods` (internal-review stands).
+   * `payment.methods`.
    *
-   * The rail drops out when the receive wallet is unreachable (spec §4 menu
-   * degradation) — advertising it then would hand the caller an option that
+   * The rail drops out of the funding menu when the receive wallet is unreachable;
+   * advertising it then would hand the caller an option that
    * fails on use, while the other rails would have closed the sale.
    */
   resolveFundingMethods() {
@@ -17645,7 +17790,7 @@ var DVMServer = class {
   }
   /**
    * The credit menu's MPP instruments, split into what is on offer right now
-   * and what this DVM is configured for but withholding (internal-review).
+   * and what this DVM is configured for but withholding.
    *
    * The split has to survive into the response rather than being filtered
    * away, because "not offered right now" and "not configured" are different
@@ -17673,7 +17818,7 @@ var DVMServer = class {
   }
   /**
    * Which x402 flavours a credit top-up may arrive on — the funding menu's
-   * `x402` sub-block (internal-review). Hosted health buys `exact`; a genuinely wired
+   * `x402` sub-block. Hosted health buys `exact`; a genuinely wired
    * batch server buys `batch-settlement` independently, including while the
    * hosted facilitator is unavailable or stale.
    *
@@ -17690,13 +17835,12 @@ var DVMServer = class {
       ...this.x402BatchAvailable() ? [{ scheme: X402_BATCH_SETTLEMENT_SCHEME, network: x402.network }] : []
     ];
   }
-  /** Whether a channel server is both supported and constructible for credit funding. */
   x402BatchAvailable() {
     return !!this.x402Support()?.batchSettlement && !!(this.opts.x402BatchSettlement ?? this.opts.x402BatchSettlementFactory);
   }
   /**
    * Apply any Lightning funding invoice this caller has paid since we last
-   * looked — the pull half of pull-based crediting (internal-review, spec §4).
+   * looked — the pull half of pull-based crediting.
    *
    * Called from every authenticated surface where the balance is about to
    * matter: the `/v1/credit` ops and the `/v1/job` submit. Deliberately **not**
@@ -17709,7 +17853,7 @@ var DVMServer = class {
    * outstanding, and never blocks the request when it fails.
    *
    * The SDK-owned reporter queues each Lightning deposit inside
-   * `settleInvoice`'s transaction (internal-review). The loop below only preserves
+   * `settleInvoice`'s transaction. The loop below only preserves
    * the explicit `onCreditFunded` override, whose caller owns its durability.
    */
   async settleLightningFunding(callerPubkey, creditId) {
@@ -17740,7 +17884,6 @@ var DVMServer = class {
       });
     }
   }
-  /** Credit lifetime this DVM mints, in ms — the descriptor's `credit.ttl` or the platform default. */
   creditTtlMs() {
     return this.descriptor.credit ? this.descriptor.credit.ttlSeconds * 1e3 : IMPLICIT_CREDIT_TTL_MS;
   }
@@ -17761,7 +17904,7 @@ var DVMServer = class {
    * The per-DVM + per-request rail wiring every payment verification needs —
    * everything except what the *operation* contributes (its price, its job or
    * fund id, the caller's credit fields). Shared by `/v1/job`'s upfront gate
-   * and `/v1/credit`'s top-up (internal-review) so a rail wired into one is wired
+   * and `/v1/credit`'s top-up so a rail wired into one is wired
    * into both by construction; a divergence here would be a rail that funds
    * jobs but silently can't fund credits.
    */
@@ -17794,7 +17937,7 @@ var DVMServer = class {
       mppCredential,
       mpp: this.opts.mpp,
       resourcePath: c.req.path,
-      // internal-review/internal-review: the gate covers issuance and new-channel acceptance,
+      // the gate covers issuance and new-channel acceptance,
       // not just the two advertisement surfaces. `ensureFresh` above makes this
       // an observation rather than a cold-start default on the one surface that
       // can act on it.
@@ -17812,8 +17955,6 @@ var DVMServer = class {
       requestId: c.req.header("X-Cashu-Request-Id"),
       mintHealthTracker: this.mintHealthTracker,
       fxFetcher: this.fxFetcher,
-      // internal-review: the ledger leg — every rail payment becomes fund_credit +
-      // draw, atomic with the rail commit.
       creditLedger: this.creditLedger,
       processedPayments: this.processedPayments,
       enqueueCreditDeposit: this.opts.enqueueCreditDeposit,
@@ -17823,7 +17964,7 @@ var DVMServer = class {
   }
   /**
    * Assemble this DVM's funding menu for a response denominated in
-   * `currency` (internal-review). All the refusal logic — including the credits-spec
+   * `currency`. All the refusal logic — including the credits-spec
    * §3 isolate gate — lives in {@link buildCreditMenu}; this just supplies the
    * server's state. `callerPubkey` must be a *verified* envelope pubkey: the
    * balance echo is per-caller money and there is no safe fallback identity.
@@ -17832,8 +17973,6 @@ var DVMServer = class {
     await this.ensureTempoSessionHealth();
     const mppSplit = this.creditMppSplit();
     return buildCreditMenu({
-      // The SDK server only ever runs the container runtime; the isolate route
-      // calls the same builder with `"isolate"` and is refused there.
       runtime: "container",
       config: this.descriptor.credit,
       currency,
@@ -17842,7 +17981,7 @@ var DVMServer = class {
       tempoWithheld: mppSplit.withheld,
       x402Schemes: this.creditX402Schemes(),
       lightningFundingMinSats: this.opts.lightningReceive?.fundingMinSats,
-      // Configured, not advertised (internal-review): `advertisedMints()` is health
+      // Configured, not advertised: `advertisedMints()` is health
       // filtered, and a rail that comes and goes with a mint's uptime is worse
       // product than one that is honestly absent.
       hasAcceptedMint: (this.opts.mints?.length ?? 0) > 0,
@@ -17879,7 +18018,7 @@ var DVMServer = class {
   }
   /**
    * Currency this DVM's credit ledger is denominated in — the builder's
-   * declared pricing currency, `"usd"` unless they said otherwise (internal-review).
+   * declared pricing currency, `"usd"` unless they said otherwise.
    *
    * Every denomination surface reads this one answer: the funding menu on
    * `/v1/quote` and the 402, `POST /v1/credit`, and the quote balance echo.
@@ -17888,20 +18027,16 @@ var DVMServer = class {
    * static (USD-literal) price on a non-USD DVM, and a quote denominated
    * elsewhere is refused as `quote_currency_mismatch` — so what a job draws in
    * is what a top-up funded in, on every path.
-   *
-   * It used to return the literal `"usd"`, which is how a EUR-pricing DVM
-   * came to fund `/v1/credit` top-ups in a denomination none of its jobs
-   * would ever draw from.
    */
   creditCurrency() {
     return this.pricingCurrency;
   }
   /**
-   * Quote-response `payment` block (internal-review). Carries the same `methods` array
+   * Quote-response `payment` block. Carries the same `methods` array
    * `/v1/info` advertises plus a per-rail `refundable` map keyed by method, so a
    * caller can see which rails return funds on failure before committing. The
    * `methods` shape stays identical to `/v1/info` and the platform isolate route
-   * (post-internal-review nested `payment.methods`); refundability rides alongside.
+   * (current nested `payment.methods`); refundability rides alongside.
    */
   quotePaymentBlock() {
     const methods = this.resolvePaymentMethods();
@@ -17910,8 +18045,6 @@ var DVMServer = class {
       refundable: Object.fromEntries(methods.map((m) => [m, RAIL_REFUNDABLE[m]]))
     };
   }
-  // ── Route handlers ──────────────────────────────────────────────────
-  /** Dev-mode proxy: forwards requests to a remote DVM specified by cookie. */
   async handleProxy(c) {
     const raw = getCookie(c, "dvmkit_target");
     const target = raw ? decodeURIComponent(raw) : null;
@@ -17947,8 +18080,8 @@ var DVMServer = class {
       auth: this.descriptor.auth ? [this.descriptor.auth.id] : ["none"],
       ...this.authAudience ? { auth_audience: this.authAudience } : {},
       protocol_version: 1,
-      sdk_sha: process.env.GIT_SHA ?? "unknown",
-      deploy_id: process.env.DVMKIT_DEPLOY_ID ?? "unknown"
+      sdk_sha: this.opts.env.GIT_SHA ?? "unknown",
+      deploy_id: this.opts.env.DVMKIT_DEPLOY_ID ?? "unknown"
     };
     const ownerBlock = this.ownerDisplayBlock();
     if (ownerBlock) info.owner = ownerBlock;
@@ -17969,8 +18102,7 @@ var DVMServer = class {
         network: this.opts.x402.network,
         asset: this.opts.x402.asset ?? "USDC",
         ...this.opts.x402.facilitator && { facilitator: this.opts.x402.facilitator },
-        // Surface dual-serve state so x402 clients can confirm the 402 will
-        // carry their PaymentRequirements before submitting (internal-review).
+        // Advertises whether 402 challenges include x402 PaymentRequirements.
         dual_serve: this.opts.x402.dualServe ?? true
       };
     }
@@ -17981,11 +18113,11 @@ var DVMServer = class {
         return reason ? [{ ...method, reason }] : [];
       });
       info.tempo = {
-        // internal-review: withheld sessions are withheld here too. `/v1/info` is
+        // withheld sessions are withheld here too. `/v1/info` is
         // where a caller decides what to attempt, so advertising a session the
         // credit menu will refuse just sends them down a dead end.
         methods: configured.filter((method) => this.tempoSessionOffered(method)),
-        // …but say so rather than letting it vanish (internal-review): an agent that
+        // …but say so rather than letting it vanish: an agent that
         // sees only the shortened list cannot tell a DVM that never did
         // sessions from one whose observer is down for a minute.
         ...withheld.length && { withheld },
@@ -18017,7 +18149,7 @@ var DVMServer = class {
     return c.json(info);
   }
   /**
-   * Render the `/v1/info.capabilities` block (internal-review). Each capability
+   * Render the `/v1/info.capabilities` block. Each capability
    * advertises its `description`, optional `input_schema`, and optional
    * `pricing` block — `pricing.quote.schema` for dynamic-priced capabilities,
    * `pricing.max` for static-priced ones. Capabilities without an `input`
@@ -18227,7 +18359,7 @@ var DVMServer = class {
    * the two callers — `/v1/quote` and `computeDynamicPrice` on the submit
    * path — cannot drift: a field added for one is present in the other by
    * construction, and both paths price against the same view of the caller's
-   * credit (internal-review, spec §7).
+   * credit.
    */
   async buildQuoteContext(args) {
     const ctx = {
@@ -18250,15 +18382,15 @@ var DVMServer = class {
   }
   /**
    * Validate the `capability` field on a `/v1/job` or `/v1/quote` body
-   * (internal-review). Returns the canonical name when set + known; otherwise a
+   * Returns the canonical name when set + known; otherwise a
    * structured 400 envelope agents can relay verbatim to a human caller.
    *
    * - **Missing** — `body.capability` is absent or empty. Surface as
-   *   `capability_required` with a hint pointing at `/v1/info` so the agent
-   *   can re-discover the capability set.
+   * `capability_required` with a hint pointing at `/v1/info` so the agent
+   * can re-discover the capability set.
    * - **Unknown** — `body.capability` is set but doesn't match any
-   *   capability on this descriptor. Surface as `unknown_capability` listing
-   *   the known names so the agent can correct without a round-trip.
+   * capability on this descriptor. Surface as `unknown_capability` listing
+   * the known names so the agent can correct without a round-trip.
    */
   requireCapabilityFromBody(c, capability) {
     const known = this.jobManager.capabilityNames();
@@ -18317,25 +18449,9 @@ var DVMServer = class {
     }
   }
   /**
-   * The one `invalid_input` body `/v1/quote` and `/v1/job` emit for a
-   * capability-input violation (internal-review).
-   *
-   * The two endpoints used to answer the same caller mistake with two unrelated
-   * shapes — quote gated on auth first, so a wrong field name came back 401
-   * `auth_error` + `sub_reason: "schema_invalid"`, while submit parsed first and
-   * came back 400 `invalid_input`. Both named the offending field (internal-review), so
-   * neither was wrong; an agent just had to recognise two codes and two statuses
-   * for one class of mistake, and the CLI's `parseStructuredError` mapped them to
-   * two different `DvmError`s — which is why its structured-input remediation
-   * (`invalid_input` only) never fired for the live fleet failure internal-review was
-   * written about.
-   *
-   * The 400 wins because it is the only shape both endpoints can produce: a DVM
-   * that declares no `auth` has no 401 to give, and quote didn't validate
-   * `cap.input` at all on that path, so it answered 200 to a body submit would
-   * reject. `display` is carried here as well as `message` because this is now
-   * the shape agents branch on, and it reuses the 401's sentence so the words
-   * relayed to a human don't change with the status.
+   * Shared schema-violation response for quote and submit, including auth-less
+   * DVMs. A 400 classifies caller input without requiring an auth gate; `display`
+   * and `message` carry the same relayable explanation.
    */
   invalidInputResponse(c, err) {
     const schemaUrl = infoSchemaUrl(c.req.url, this.publicOrigin);
@@ -18379,13 +18495,13 @@ var DVMServer = class {
   }
   /**
    * True when a failed capability-input parse is the auth gate's answer rather
-   * than {@link invalidInputResponse}'s (internal-review).
+   * than {@link invalidInputResponse}'s.
    *
    * A capability schema may declare the signing-envelope fields required
    * (cast's `addEpisodeSchema`) or optional (scribe's `transcribeSchema`). On
    * the required shape an *unsigned* request fails the input parse naming
    * `pubkey` / `signature` — a signing failure, and answering it with "your
-   * input is invalid: pubkey required" is the internal-review mistake in reverse. So a
+   * input is invalid: pubkey required" is the mistake in reverse. So a
    * parse whose issues are **only** envelope-side falls through to the auth
    * gate, which answers 401 `signature_invalid` with the remedy that works.
    *
@@ -18402,13 +18518,13 @@ var DVMServer = class {
   }
   /**
    * Mints to advertise to clients on `/v1/info` and `/v1/quote`. Filters the
-   * configured list through the runtime health tracker (internal-review). When every
+   * configured list through the runtime health tracker. When every
    * mint is currently sick it falls back to the still-configured list rather
    * than publish an empty rail — a *transient* outage shouldn't read as "no
    * Cashu" and push well-behaved agents to bypass the rail. But NUT-incompatible
-   * mints are excluded even from that fallback (internal-review): NUT-incompatibility
+   * mints are excluded even from that fallback: NUT-incompatibility
    * is a permanent, deterministic config error the DVM can never settle
-   * against, so per AC bullet 3 such a mint is never advertised. If *every*
+   * against, so such a mint is never advertised. If *every*
    * configured mint is NUT-incompatible the rail correctly goes empty.
    */
   advertisedMints() {
@@ -18837,9 +18953,9 @@ var DVMServer = class {
         priceMsats,
         capabilityName,
         requesterTokenHash,
-        // internal-review: everything the idempotent-replay path needs to recognise a
+        // everything the idempotent-replay path needs to recognise a
         // retry of THIS call and re-issue the token its lost response carried.
-        // internal-review: `jobId` is the pre-allocated id the payment's ledger draw
+        // `jobId` is the pre-allocated id the payment's ledger draw
         // already committed under.
         {
           requesterToken: jobToken,
@@ -18878,7 +18994,7 @@ var DVMServer = class {
     }
   }
   /**
-   * Book a committed funding as a deposit (internal-review, spec §10). Fire-and-forget
+   * Book a committed funding as a deposit (the deposit-accounting rule). Fire-and-forget
    * onto the reporter's durable queue: a funding is a liability the platform
    * must show, but a reporting hiccup must never fail the paid request that
    * just succeeded.
@@ -18893,7 +19009,7 @@ var DVMServer = class {
     );
   }
   /**
-   * Book a kept short payment as tagged revenue (internal-review, operator ruling).
+   * Book a kept short payment as tagged revenue.
    * The proofs are committed and the draw was settled on the spot, so the money
    * is earned — but no job exists to carry it, hence the synthetic job id. It
    * is deliberately **not** a deposit: nothing is owed back, so a liability
@@ -18923,7 +19039,7 @@ var DVMServer = class {
     });
   }
   /**
-   * The idempotent half of `POST /v1/job` (internal-review). A paid submit whose
+   * The idempotent half of `POST /v1/job`. A paid submit whose
    * response the caller lost is safe to retry — the accumulator's
    * `UNIQUE(dvm_id, request_id, proof_secret)` makes the duplicate a no-op —
    * but until now it was also useless: the caller got a 409 and the `job_id` /
@@ -18933,7 +19049,7 @@ var DVMServer = class {
    * original caller. Proof is reproducing the request, **not** possessing the
    * spent Cashu token: the token is a bearer secret, so gating on it alone
    * would hand the job (and its result) to anyone who lifted it. The legitimate
-   * retry always has the body — the internal-review resume sweep re-POSTs it — while a
+   * retry always has the body — the resume sweep re-POSTs it — while a
    * token thief does not. On a descriptor-auth DVM the caller pubkey must match
    * too. Anything short of that falls through to the 409 the caller has always
    * gotten.
@@ -18960,8 +19076,8 @@ var DVMServer = class {
     return buildSubmitResponse(c, prior, prior.requesterToken);
   }
   /**
-   * The draw-keyed half of idempotent recovery (internal-review, spec §2 condition
-   * 1). The signed body's `(credit_id, draw_id)` matched a recorded draw;
+   * The draw-keyed half of idempotent recovery. The signed body's
+   * `(credit_id, draw_id)` matched a recorded draw;
    * resolve the job it paid for (the draw carries its pre-allocated job id)
    * and re-issue the original response under the SAME proof-of-origin gates
    * as the header regime: reproduce the fingerprint, sign as the same caller
@@ -19050,7 +19166,6 @@ var DVMServer = class {
     }
     return void 0;
   }
-  /** Recover one still-pending draw recorded for the stable public job id. */
   async recoverDrawAcceptance(opts) {
     const dvmId = this.opts.dvmId;
     if (!dvmId) return void 0;
@@ -19082,7 +19197,7 @@ var DVMServer = class {
   /**
    * Recompute the upfront price for a dynamic-priced capability by
    * re-invoking its `onQuote.handler` with the parsed job input as `data`
-   * (internal-review). Returns a 400-style error envelope when the input doesn't
+   * Returns a 400-style error envelope when the input doesn't
    * satisfy `onQuote.schema` or the handler throws — failing closed is the
    * right default, since the alternative (running the job with
    * `requiredMsats=undefined`) lets unpaid jobs through.
@@ -19291,13 +19406,6 @@ var DVMServer = class {
     }
     return c.json({ messages: job.messages.filter((m) => m.seq > after) });
   }
-  /**
-   * Structured 409 for a write (message POST / cancel) against a job that has
-   * already reached a terminal status (internal-review). The two-audiences convention
-   * wants a `code` an intermediary agent can branch on plus a `hint` it can
-   * relay verbatim — a bare `{ error }` string gave the openclaw nothing to act
-   * on and it re-paid a completed job into this 409 (internal-review step 7).
-   */
   jobNotActiveResponse(c) {
     return c.json(
       {
@@ -19470,8 +19578,8 @@ var DVMServer = class {
   }
   /**
    * Tear down this machine's in-memory reactivation scaffold when it stands
-   * down (lost the reactivation advisory lock, or deferred to a live original
-   * handler that won the single-execution claim — internal-review / internal-review). Leaving
+   * down after losing the reactivation advisory lock or deferring to a live original
+   * handler that won the single-execution claim. Leaving
    * the job in `activeJobs` with a live idle timer would, one idle window
    * later, fire `cancelJobIdle` → Tx A `cancel` and clobber the winner. We also
    * must not persist our stale snapshot; clearing the appender prevents that.
@@ -19507,6 +19615,7 @@ var DVMServer = class {
         await jm.finalizeStoredTerminal(id);
         return c.json({ status: "cancelled" });
       }
+      record.endedBy = "caller";
       record.status = "cancelled";
       record.lastActivityAt = Date.now();
       await jm.store.save(record);
@@ -19852,7 +19961,7 @@ var PlatformTempoObserverHealth = class {
     }
   }
   /**
-   * Register one mount's session capability (internal-review).
+   * Register one mount's session capability.
    *
    * A host can serve several DVMs behind one `DVMKIT_PLATFORM_TOKEN`, and the
    * platform row that token identifies is the deployment as a whole — so the
@@ -19875,7 +19984,7 @@ var PlatformTempoObserverHealth = class {
    * mount exists, so at boot there is routinely an open probe carrying **no**
    * `tempo_session` at all — handing it back to the mount that just declared
    * one would leave a scale-to-zero DVM unstamped until traffic arrived, which
-   * is exactly the container-restart case internal-review is about. Same shape with
+   * is exactly the container-restart case is about. Same shape with
    * two mounts: the second would join a probe whose URL already read the first
    * one's `false`.
    */
@@ -19923,7 +20032,7 @@ var PlatformTempoObserverHealth = class {
   }
   /**
    * The probe URL, carrying this deployment's session capability when a mount
-   * has declared one (internal-review).
+   * has declared one.
    *
    * Absent means "no signal", not "no sessions": a container running an older
    * SDK build sends nothing, and the platform must leave its stamp exactly