@dvmkit/sdk 0.1.5-rc.9 → 0.2.0-rc.9

package/dist/{credit-menu-enwMbn55.d.ts → credit-menu-D4Gcdgc4.d.ts}

@@ -1,16 +1,16 @@
-import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cS as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cT as X402SettlementCursor, bQ as X402SettlementStatus, cU as X402SettlementWriteOff, bN as X402RefundSettlementGate, cV as X402FacilitatorAuth, cW as X402BatchSettlementConfig, cy as PostgresX402ChannelStorage, cX as X402PayoutObserver, br as MppxServer, ab as CashuMode, cY as CreditDepositEnqueue, cZ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c_ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cA as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-5dljDqrQ.js';
+import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cT as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cU as X402SettlementCursor, bQ as X402SettlementStatus, cV as X402SettlementWriteOff, bN as X402RefundSettlementGate, cW as X402FacilitatorAuth, cX as X402BatchSettlementConfig, cz as PostgresX402ChannelStorage, cY as X402PayoutObserver, br as MppxServer, ab as CashuMode, cZ as CreditDepositEnqueue, c_ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c$ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cy as JobTerminalReportPayload, cB as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-CXg7ziML.js';
 import { ProofLike, SerializedDLEQ, Proof } from '@cashu/cashu-ts';
 import { Hono, Context } from 'hono';
 import { Pool } from 'pg';
-import { b as FxRateSnapshot, F as FxFetcher } from './fx-D860pZvP.js';
-import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-BozcevPZ.js';
-import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-BUGqvCfL.js';
+import { b as FxRateSnapshot, F as FxFetcher } from './fx-B0SLBe5x.js';
+import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-CQBnQgsT.js';
+import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-B2uZvga4.js';
 import { Challenge } from 'mppx';
 import { SettleResponse, SupportedResponse } from '@x402/core/types';
 import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server';
 import { FacilitatorClient } from '@x402/core/server';
 
-/** A row in the per-DVM `wallet_accumulator` table (internal-review). */
+/** A row in the per-DVM `wallet_accumulator` table. */
 interface WalletAccumulatorRow {
     id: string;
     dvmId: string;
@@ -38,7 +38,7 @@ interface WalletAccumulatorRow {
     meltQuoteId: string | null;
     /**
      * NUT-11 locktime captured at accept time (ms since epoch). Null when the
-     * accepted proof has no `locktime` tag (internal-review). Drives oldest-first
+     * accepted proof has no `locktime` tag. Drives oldest-first
      * ordering and the future `wallet_accumulator_batch_expiring_soon` monitor.
      */
     tExpire: number | null;
@@ -71,7 +71,7 @@ declare function initWalletAccumulatorTable(db: AccumulatorPool): Promise<void>;
  *
  * With `tx` (a client inside a caller-owned `BEGIN`), issues **no**
  * transaction control: the inserts join the caller's transaction so the rail
- * commit and the `CreditLedger.fund` + `draw` land atomically (internal-review, spec
+ * commit and the `CreditLedger.fund` + `draw` land atomically (spec
  * §2 condition 3). A `unique_violation` still surfaces as
  * `AccumulatorReplayError`, but the caller owns the ROLLBACK — note the
  * transaction is poisoned after the violation (Postgres aborts it), so the
@@ -82,7 +82,7 @@ declare function insertAccumulatorRows(db: AccumulatorPool, args: {
     /**
      * Per-proof matched lock pubkey, parallel to `proofs`. Recording the
      * matched value per row lets the monitor surface retired-batch alerts
-     * (internal-review) and lets `dvmctl melt-pending`'s rotation walker pick the
+     * and lets `dvmctl melt-pending`'s rotation walker pick the
      * right privkey per batch. Branded `LockPubkey` so the lowercase invariant
      * is enforced at the type boundary, not by every call site.
      */
@@ -97,7 +97,7 @@ declare function insertAccumulatorRows(db: AccumulatorPool, args: {
      */
     tExpireMsByIndex?: (number | null)[];
     receivedAt?: number;
-    /** External transaction handle — caller owns BEGIN/COMMIT/ROLLBACK (internal-review). */
+    /** External transaction handle — caller owns BEGIN/COMMIT/ROLLBACK. */
     tx?: AccumulatorQuerier;
 }): Promise<WalletAccumulatorRow[]>;
 /** Delete every accumulator row for a DVM. Used by `dvmadmin wallet-accumulator clear`. */
@@ -117,8 +117,8 @@ declare function hashLockKey(input: string): bigint;
  *
  * Used by `verifyUpfrontPayment` to reject replay of an MPP credential whose
  * `(realm, challenge.id)` was already accepted within the current TTL window
- * (internal-review). Mid-job replay is handled separately via per-job
- * `pendingMppChallengeIds` (internal-review).
+ * Mid-job replay is handled separately via per-job
+ * `pendingMppChallengeIds`.
  */
 interface ConsumedCredentialStore {
     /** True iff `(realm, challengeId)` was marked and the entry has not expired. */
@@ -126,7 +126,6 @@ interface ConsumedCredentialStore {
     /** Mark `(realm, challengeId)` as consumed for `ttlSeconds`. */
     mark(realm: string, challengeId: string, ttlSeconds: number): Promise<void>;
 }
-/** Options for `MemoryConsumedCredentialStore`. */
 interface MemoryConsumedCredentialStoreOpts {
     /** FIFO eviction kicks in when entry count would exceed this. Default: 10_000. */
     maxEntries?: number;
@@ -138,8 +137,8 @@ interface MemoryConsumedCredentialStoreOpts {
  *
  * Per-process and not multi-instance-safe — each replica tracks its own
  * consumed set, so a credential redirected to a different replica still works
- * once. Acceptable for first-party single-instance Fly DVMs (internal-review open
- * question); swap to a shared backend before deploying multiple replicas.
+ * once. Use only for a single-instance DVM; swap to a shared backend before
+ * deploying multiple replicas.
  */
 declare class MemoryConsumedCredentialStore implements ConsumedCredentialStore {
     private readonly maxEntries;
@@ -203,7 +202,7 @@ interface ServerJob {
     id: string;
     tags: string[];
     /**
-     * Capability name this job belongs to (internal-review). Set at submission from
+     * Capability name this job belongs to. Set at submission from
      * `POST /v1/job` body's `capability` field; routes the SDK runtime to the
      * right `onJob` / `onResponse` / `onPayment` handler and the right input
      * schema. Required — the wire layer rejects requests that omit it.
@@ -214,12 +213,12 @@ interface ServerJob {
     requesterId: string;
     /**
      * SHA-256 hex of the per-job opaque `job_token` minted at creation for
-     * anonymous callers (internal-review). Mirror of `JobRecord.requesterTokenHash`;
+     * anonymous callers. Mirror of `JobRecord.requesterTokenHash`;
      * see that field for the wire-level gating semantics.
      */
     requesterTokenHash?: string;
     /**
-     * Submission provenance (internal-review) — mirrors `JobRecord.requesterToken` /
+     * Submission provenance — mirrors `JobRecord.requesterToken` /
      * `requestFingerprint` / `requesterPubkey`. Carried on the job purely so
      * `toJobRecord` persists it; nothing in the runtime reads it. It's the
      * replay gate: a retried paid submit that reproduces the fingerprint (and,
@@ -232,6 +231,16 @@ interface ServerJob {
     /** HTTP path independently recorded when the caller proof was accepted. */
     authRequestPath?: string;
     status: "processing" | "completed" | "failed" | "awaiting-input" | "cancelled" | "working";
+    /** Mirrors the durable completeness marker; false for legacy accepted jobs. */
+    timingKnown?: boolean;
+    /** SDK terminal attribution; never accepted from a handler. */
+    endedBy?: "caller" | "provider";
+    /** Unix ms when the terminal status committed; immutable afterwards. */
+    terminalAtMs?: number;
+    /** Accumulated awaiting-input time, excluding the currently open stretch. */
+    callerWaitMs?: number;
+    /** Unix ms at which the current awaiting-input stretch began. */
+    awaitingInputAtMs?: number;
     summary?: string;
     messages: Message[];
     seq: number;
@@ -243,9 +252,9 @@ interface ServerJob {
      * Settlement reference for the most-recent successful credit. Threaded
      * into `onJobCompleted` so the platform revenue ledger can populate
      * `revenue_events.tx_hash`. mpp/x402 carry the credential's `challenge.id`
-     * / EVM tx hash from the facilitator (internal-review); cashu accumulator carries
-     * the `X-Cashu-Request-Id` UUID (internal-review). Updated on every credit
-     * (upfront or mid-job via `processIncomingPayment`) — internal-review.
+     * / EVM tx hash from the facilitator; cashu accumulator carries
+     * the `X-Cashu-Request-Id` UUID. Updated on every credit
+     * (upfront or mid-job via `processIncomingPayment`).
      * Single-row-per-job accounting keeps the most recent credit's hash,
      * mirroring `paymentRail`.
      */
@@ -256,19 +265,19 @@ interface ServerJob {
      * Rail-native amount accumulated across all successful credits on this
      * job (sats for mpp, USDC microunits for x402). The single
      * `revenue_events` row written at completion uses this as `gross_native`,
-     * so multi-credit jobs sum the per-credit native amounts (internal-review).
-     * internal-review wired the upfront credit; mid-job credits accumulate same-rail
+     * so multi-credit jobs sum the per-credit native amounts.
+     * The upfront credit initializes this value; mid-job credits accumulate same-rail
      * and reset on a cross-rail switch (see `processIncomingPayment`).
      */
     nativeAmount?: number;
-    /** Native asset tag — paired with `nativeAmount`. internal-review. */
+    /** Native asset tag paired with `nativeAmount`. */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
-    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow` (internal-review). */
+    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow`. */
     cashuFlow?: "p2pk_accumulator";
     /**
      * What this job cost the **builder** to serve, in 1e-6 of
      * {@link ServerJob.costCurrency} — the running total the handler declared
-     * through `ctx.cost()` (internal-review). Absent until a handler declares
+     * through `ctx.cost()`. Absent until a handler declares
      * something; absent is "unreported", which is not the same fact as a
      * declared zero and is reported differently.
      *
@@ -284,9 +293,9 @@ interface ServerJob {
     costCurrency?: string;
     /** Number of `ctx.cost()` declarations incorporated into the current cost state. */
     costRevision?: number;
-    /** Credit the upfront payment funded/drew (internal-review). See `JobRecord.creditId`. */
+    /** Credit the upfront payment funded/drew. See `JobRecord.creditId`. */
     creditId?: string;
-    /** The draw placed for this job on `creditId` (internal-review). */
+    /** The draw placed for this job on `creditId`. */
     drawId?: string;
     /** Original funding artifact returned by an explicit fund-and-draw. */
     fundingReceipt?: FundingReceipt;
@@ -299,11 +308,11 @@ interface ServerJob {
      * binds challenges to realm/method/amount/expiry, not to the dvmkit job-id;
      * verifying the incoming credential's `challenge.id` is in this set blocks
      * a credential lifted from a sibling job that requested the same fields.
-     * Cleared on successful credit (internal-review).
+     * Cleared on successful credit.
      */
     pendingMppChallengeIds?: string[];
     /**
-     * Per-job binding for x402 mid-job credentials (internal-review). 32-byte 0x-hex
+     * Per-job binding for x402 mid-job credentials. 32-byte 0x-hex
      * nonce issued by `requestPayment` and stamped onto the outbound x402
      * envelope; the caller signs `TransferWithAuthorization` against this exact
      * `bytes32`. Verification rejects an incoming `x402_payment` whose decoded
@@ -318,30 +327,30 @@ interface ServerJob {
     pendingX402AmountUsdcMicro?: string;
     /**
      * Fiat micro-units the outstanding `requestPayment` ask is worth, pinned when
-     * the payment-request was emitted (internal-review). See `JobRecord`.
+     * the payment-request was emitted. See `JobRecord`.
      */
     pendingPaymentFiatMicro?: number;
     /** Currency of {@link pendingPaymentFiatMicro} (lowercase ISO-4217). */
     pendingPaymentFiatCurrency?: string;
     /**
      * Cumulative fiat micro this job has asked for mid-job, the ceiling on its
-     * draw growth (internal-review). See `JobRecord.askedTopUpMicro` for the sentinel.
+     * draw growth. See `JobRecord.askedTopUpMicro` for the sentinel.
      */
     askedTopUpMicro?: number;
     /**
      * Currency of {@link askedTopUpMicro} — and this job's sticky ask
-     * denomination (internal-review). See `JobRecord.askedTopUpCurrency`.
+     * denomination. See `JobRecord.askedTopUpCurrency`.
      */
     askedTopUpCurrency?: string;
     /**
-     * Why this job's draw growth is not capped, when it isn't (internal-review). Mirror
+     * Why this job's draw growth is not capped, when it isn't. Mirror
      * of `JobRecord.topUpCapUnenforcedReason`.
      */
     topUpCapUnenforcedReason?: TopUpCapUnenforcedReason;
     /** Price the job was charged at (msats). Used to detect overpayment for change/melt gating. */
     requiredMsats?: number;
     /**
-     * The signed receipt for this job's terminal outcome (internal-review). Mirror of
+     * The signed receipt for this job's terminal outcome. Mirror of
      * `JobRecord.receipt`, set once the terminal funnel has signed and persisted
      * it so the local read paths (which serve from `activeJobs` during the
      * cleanup window) hand back the same bytes as a cross-machine re-read.
@@ -349,7 +358,7 @@ interface ServerJob {
     receipt?: JobReceipt;
     /**
      * The in-flight terminal chain — persist, then sign + store the receipt
-     * (internal-review). Assigned synchronously by `ctx.complete()` / `ctx.fail()` at
+     * Assigned synchronously by `ctx.complete()` / `ctx.fail()` at
      * the instant the job goes terminal, so the `POST /v1/job` fast path can
      * await it (bounded) and put the receipt on the synchronous 200 rather than
      * making the caller poll for it. Never rejects — the chain swallows its own
@@ -358,7 +367,7 @@ interface ServerJob {
     terminalWork?: Promise<void>;
     listeners: Set<(msg: Message) => void>;
     /**
-     * Cancellation signal for the running handler (internal-review). Aborted whenever
+     * Cancellation signal for the running handler. Aborted whenever
      * the job is cancelled on this process — caller cancel, idle timeout,
      * stale-sweep teardown, supersession. Surfaced to builders as `ctx.signal`
      * and auto-threaded into `ctx.fetch`, so an in-flight provider call
@@ -368,18 +377,18 @@ interface ServerJob {
      */
     abort: AbortController;
     /**
-     * Hook for cross-machine message persistence (Tx A, internal-review). Set by
+     * Hook for cross-machine message persistence (Tx A). Set by
      * `JobManager` when the store is streamable. The appender runs the
      * outgoing-message tx atomically with any payment-request counter bump so
      * `(message, pending_payment_msats)` land together — never separately.
      *
-     * Per-job serialised (internal-review): each call chains onto `messageAppenderTail`
+     * Per-job serialised: each call chains onto `messageAppenderTail`
      * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
      * `complete`) can't race for the DB-side seq allocation.
      */
     messageAppender?: (msg: Message, opts?: AppendOutgoingOptions) => void;
     /**
-     * Tail of the per-job appender chain (internal-review). `wireMessageAppender` updates
+     * Tail of the per-job appender chain. `wireMessageAppender` updates
      * this on every call so `persistJob` can await it before the terminal snapshot
      * save runs `DELETE FROM job_messages`.
      */
@@ -411,7 +420,7 @@ declare function toJobRecord(job: ServerJob): JobRecord;
 /** Reconstitute a ServerJob from a persisted JobRecord with fresh runtime fields. */
 declare function fromJobRecord(record: JobRecord): ServerJob;
 /**
- * Signal cancellation to a running handler (internal-review). Idempotent — aborting an
+ * Signal cancellation to a running handler. Idempotent — aborting an
  * already-aborted controller is a no-op, so the overlapping teardown paths
  * (caller cancel then stale sweep, say) can each call it unconditionally.
  */
@@ -426,22 +435,21 @@ declare class JobCancelledError extends Error {
 }
 /** Append a provider-sent message to the job and notify SSE listeners. */
 declare function providerMessage(job: ServerJob, type: MessageType, content: Record<string, unknown> | object): void;
-/** Check if a job status is terminal (completed, failed, cancelled). */
 declare function isTerminal(status: ServerJob["status"]): boolean;
 /** Check if a message is a yield point (ends the provider's turn). */
 declare function isYieldMessage(msg: Message): boolean;
 
 /**
- * Per-DVM runtime mint-health tracker (internal-review). Alongside the platform's
+ * Per-DVM runtime mint-health tracker. Alongside the platform's
  * durable mint-health cron, probes every configured
  * mint on a timer, tracks consecutive failures, and flips a mint to `sick`
  * once the threshold is crossed. The SDK uses the resulting view to:
  *
- *   1. Filter `/v1/info`'s advertised `mints` to currently-healthy ones.
- *   2. Reject new accumulator receives at sick mints before they touch the
- *      DB (`cashu_mint_sick` 503 from `verifyAccumulatorReceipt`).
+ * 1. Filter `/v1/info`'s advertised `mints` to currently-healthy ones.
+ * 2. Reject new accumulator receives at sick mints before they touch the
+ * DB (`cashu_mint_sick` 503 from `verifyAccumulatorReceipt`).
  *
- * Since internal-review this tracker is the sole owner of mint health: boot no longer
+ * Since this tracker is the sole owner of mint health: boot no longer
  * runs a fail-fast check before binding the port. To preserve what boot used
  * to guarantee it (a) treats a mint as healthy only when it's reachable AND
  * NUT-compliant (reproducing `assertNutSupport` via `nutCompliant`), and (b)
@@ -454,7 +462,7 @@ declare function isYieldMessage(msg: Message): boolean;
  * pages the builder when a stuck batch nears `t_expire`.
  *
  * In-memory only — no DB persistence. The platform cron keeps the durable
- * record + email path (internal-review); the SDK only needs fresh in-process state
+ * record + email path; the SDK only needs fresh in-process state
  * to make routing decisions.
  */
 
@@ -467,8 +475,8 @@ interface MintHealthSnapshot {
     /**
      * True once the mint is considered unhealthy for routing: either
      * `consecutiveFailures` crossed the threshold, or the last probe reached the
-     * mint but it fails the NUT gate (a deterministic, permanent config error
-     * that flips `sick` immediately — internal-review).
+     * mint but it fails the NUT gate, a deterministic, permanent config error
+     * that flips `sick` immediately.
      */
     sick: boolean;
     /**
@@ -483,10 +491,11 @@ interface MintHealthSnapshot {
     /** Error category from the most recent failed probe. */
     errorCode?: string;
 }
-/** Tunables for {@link MintHealthTracker}. */
 interface MintHealthTrackerOptions {
     /** Cashu mint URLs the DVM accepts. The tracker probes every entry. */
     mints: string[];
+    /** Host environment used for default timing and failure settings. */
+    env?: Record<string, string | undefined>;
     /**
      * Tick cadence in ms. Defaults to {@link DEFAULT_TICK_INTERVAL_MS} or the
      * `DVMKIT_MINT_HEALTH_TICK_MS` env var when set.
@@ -497,9 +506,7 @@ interface MintHealthTrackerOptions {
      * {@link DEFAULT_FAILURES_TO_SICK} or `DVMKIT_MINT_FAILURES_TO_SICK` env.
      */
     consecutiveFailuresToSick?: number;
-    /** Injected `fetch` for tests. */
     fetchImpl?: typeof fetch;
-    /** Injected `Date.now` for tests. */
     now?: () => number;
     /**
      * Per-probe timeout / retry / backoff, forwarded to {@link checkMintHealth}.
@@ -542,7 +549,7 @@ declare class MintHealthTracker {
     /**
      * True once the first full probe tick has landed. Before this, paid calls
      * are held at `503 mint_health_pending` rather than accepted against
-     * unvalidated mints (internal-review).
+     * unvalidated mints.
      */
     initialProbeComplete(): boolean;
     /**
@@ -559,7 +566,7 @@ declare class MintHealthTracker {
      * gate — a deterministic, permanent config error, unlike a transient outage.
      * Unknown mints return false. `advertisedMints()` uses this to keep a
      * permanently-unsettleable mint off `/v1/info` even in the all-sick fallback,
-     * where a merely-flapping mint is still published (internal-review).
+     * where a merely-flapping mint is still published.
      */
     isNutIncompatible(mintUrl: string): boolean;
     /** Plain-object snapshot keyed by mint URL — for tests + observability. */
@@ -569,37 +576,37 @@ declare class MintHealthTracker {
      * One-shot structured summary emitted after the first probe tick. Replaces
      * the boot check's per-mint `cashu_mint_startup_health` lines and surfaces an
      * all-mints-unhealthy warning — the operator alert that the Fly restart-loop
-     * used to be before boot stopped refusing to start (internal-review).
+     * used to be before boot stopped refusing to start.
      */
     private logBootHealth;
 }
 
 /**
- * Credit fields riding the signed request body (internal-review, spec §2).
+ * Credit fields carried inside the signed request body.
  *
  * An explicit draw references the credit INSIDE the secp256k1/Schnorr-signed
  * `body.data` — no new caller crypto. Wire field names (snake_case, matching
  * the rest of the wire surface):
  *
  * - `credit_id` — the credit to draw against.
- * - `draw_id`   — client-generated draw id; the ledger's idempotency key.
- * - `fund`      — optional `{ amount_micro, commitment }` funding commitment:
- *   present iff a funding artifact (X-Cashu / X-PAYMENT / mpp credential)
- *   rides the same request. `commitment` is the SHA-256 hex over the raw
- *   artifact bytes, binding the header-borne proof — which sits OUTSIDE the
- *   signed body — to the credit its sender intended (spec §2 condition 3).
+ * - `draw_id` — client-generated draw id; the ledger's idempotency key.
+ * - `fund` — optional `{ amount_micro, commitment }` funding commitment:
+ * present iff a funding artifact (X-Cashu / X-PAYMENT / mpp credential)
+ * rides the same request. `commitment` is the SHA-256 hex over the raw
+ * artifact bytes, binding the header-borne proof — which sits OUTSIDE the
+ * signed body — to the credit its sender intended (the funding-commitment rule).
  *
  * These are envelope-level fields, not capability input: **the SDK** removes
  * them before any builder-owned schema parses ({@link stripCreditEnvelope} in
  * `JobManager.parseInput` and on the quote path; {@link
  * creditEnvelopeIgnoreFields} feeding the auth verifier's own schema check), so
  * handlers never see them and a top-level `.strict()` capability schema is
- * fine (internal-review). Relying on Zod's default strip mode instead was the trap:
+ * fine. Relying on Zod's default strip mode instead was the trap:
  * `.strict()` rejects unknown keys, so an explicit draw 400'd at parse before
  * the envelope was ever extracted.
  *
  * The strip never touches the canonical signing bytes. Every auth call site
- * verifies the raw wire body (`signedRequestInput`, internal-review), so the credit
+ * verifies the raw wire body (`signedRequestInput`), so the credit
  * fields are in the verified bytes because they were never taken out of them —
  * the strip is only ever applied to what a schema is about to parse.
  */
@@ -634,7 +641,7 @@ declare class CreditEnvelopeError extends Error {
 declare function extractCreditEnvelope(data: unknown): CreditEnvelope | undefined;
 /**
  * The reserved keys `schema` does not itself declare — the ones the SDK is
- * free to remove before handing it an input (internal-review).
+ * free to remove before handing it an input.
  *
  * A capability schema declares none of them, so all three are removable. The
  * one exception this exists for is `/v1/credit`'s own `CREDIT_REQUEST_SCHEMA`,
@@ -648,7 +655,7 @@ declare function extractCreditEnvelope(data: unknown): CreditEnvelope | undefine
 declare function creditEnvelopeIgnoreFields(schema: unknown): readonly string[];
 /**
  * Remove the reserved credit keys from `data` before `schema` parses it, so a
- * strict schema doesn't reject the protocol's own envelope (internal-review). Keys
+ * strict schema doesn't reject the protocol's own envelope. Keys
  * `schema` declares are left alone — see {@link creditEnvelopeIgnoreFields}.
  *
  * Returns `data` unchanged when it isn't a plain object or carries none of the
@@ -659,10 +666,10 @@ declare function creditEnvelopeIgnoreFields(schema: unknown): readonly string[];
 declare function stripCreditEnvelope(schema: unknown, data: unknown): unknown;
 
 /**
- * Fiat denomination of the job price, pinned per request (internal-review).
+ * Fiat denomination of the job price, pinned per request.
  *
- * The credit ledger is fiat-micro denominated (internal-review baked decision:
- * 1e-6 of the DVM's pricing currency, never msats). The conversion pins at
+ * The credit ledger is fiat-micro denominated: 1e-6 of the DVM's pricing
+ * currency, never msats. The conversion pins at
  * quote time: the verify path already fixes both the fiat price and its msat
  * equivalent, so the implicit N=1 fund credits the QUOTED fiat amount when
  * the attached token satisfies the quoted msats — no fresh BTC/USD lookup in
@@ -677,36 +684,13 @@ interface PriceFiat {
 }
 
 /**
- * Resolve the fiat denomination for a request's price (internal-review).
- *
- * Both sources are already fiat-exact, so this never consults an fx rate —
- * which is the point: since internal-review removed numeric-msats prices there is no
- * price form that needs one, and the ledger can be denominated for every paid
- * request rather than only the ones a rate provider happened to be up for.
- *
- * - `dynamicUpfront` — the validated `QuoteResult.upfront` fiat envelope a
- *   dynamic-priced capability returned for THIS request.
- * - a static `"$X.XX"` price — parsed directly.
- *
- * Returns `undefined` for free jobs (`priceMsats` unset or 0). For a paid job
- * it always returns a denomination: `validateQuoteResult` rejects a dynamic
- * amount too small or too large to express in micro-units, and `configureDVM`
- * rejects a static price with the same defect at boot.
- *
- * internal-review: whichever branch answers, the currency is the DVM's declared
- * pricing currency, so a job draws in the denomination `/v1/credit` funded in.
- * Held there by two guards outside this function, which is why neither branch
- * needs to know the DVM's currency to return it — `validateQuoteResult`
- * refuses a quote that disagrees with the declaration, and `configureDVM`
- * refuses a static (USD-literal) price on a DVM that declares anything but
- * `"usd"`. Both refuse rather than convert, deliberately: an fx lookup on this
- * path is the internal-review shape, where a cold-start rate outage took money and
- * recorded no draw.
+ * Paid requests pin the validated fiat price without an FX lookup. Free jobs
+ * return undefined. configureDVM and validateQuoteResult enforce micro-unit
+ * range and the DVM's declared currency before this helper is called; neither
+ * guard converts a mismatched currency.
  */
 declare function resolvePriceFiat(args: {
-    /** The capability's static `price` value, if any. */
     price: string | undefined;
-    /** The resolved required price in msats (static or dynamic). */
     priceMsats: number | undefined;
     /** Fiat envelope from a dynamic quote, when the price came from `onQuote`. */
     dynamicUpfront?: {
@@ -715,28 +699,11 @@ declare function resolvePriceFiat(args: {
     };
 }): PriceFiat | undefined;
 /**
- * The micro-unit half of {@link resolvePriceFiat}, without its "is this job
- * paid at all" gate — the one derivation every surface that states an exact
- * fiat price reads (internal-review).
- *
- * A caller doing an explicit fund-and-draw has to sign the provider's own
- * valuation of the artifact it attaches (`price_micro × paid_msats /
- * required_msats`), and `price_micro` is `PriceFiat.amountMicro`. Reconstructing
- * that integer from a rendered decimal is lossy the moment any surface between
- * the two rounds — the isolate tier advertises at four decimals, and the CLI's
- * synthetic quote used to re-round a 402 the same way — so `/v1/quote`'s
- * `upfront.amount_micro` and the upfront 402's `price_micro` state the integer
- * itself. Both **must** derive through here rather than recomputing: two
- * independent derivations of one figure is the shape that produced the mismatch
- * these fields exist to remove.
- *
- * The `priceMsats` gate stays on `resolvePriceFiat` alone. An advertisement
- * surface has no msat figure in hand — the quote route states a price before
- * anything has converted it — and a free capability is already excluded there
- * by having no price to pass.
+ * Shared exact integer for quote, 402 and ledger valuation. Callers must sign
+ * this micro-unit figure rather than reconstruct it from a rounded display.
+ * Unlike resolvePriceFiat, advertisement callers need no msat price in hand.
  */
 declare function priceFiatMicro(args: {
-    /** The capability's static `price` value, if any. */
     price?: string | undefined;
     /** Fiat envelope from a dynamic quote, when the price came from `onQuote`. */
     dynamicUpfront?: {
@@ -744,17 +711,7 @@ declare function priceFiatMicro(args: {
         currency: string;
     };
 }): PriceFiat | undefined;
-/**
- * Why a denomination could not be produced (internal-review). Carried out of
- * {@link msatsToFiatMicro} and {@link resolveFxSnapshot} so the skip that
- * follows can name its cause.
- *
- * Every one of these used to collapse into a bare `undefined`, which is how a
- * `credit_topup_skipped` / `denomination_unavailable` line came to be
- * undiagnosable: a rate outage, a currency the snapshot never carried, and an
- * ask too small to express in micro-units all read identically in the log, and
- * the only way to tell them apart was to re-derive the whole path by hand.
- */
+/** Reasons are kept distinct so a skipped ledger leg identifies its cause. */
 type FiatDenominationFailure = 
 /** Nothing to convert — a zero-msat ask. */
 "no_msats"
@@ -771,7 +728,7 @@ type FiatDenominationFailure =
  | "rate_stale_refused";
 /**
  * An fx snapshot plus how fresh it is, or why there is none. `stale` means the
- * live fetch failed and this is the last snapshot the fetcher saw (internal-review);
+ * live fetch failed and this is the last snapshot the fetcher saw;
  * `cachedAt` is the Unix ms it landed.
  */
 type ResolvedFx = {
@@ -790,7 +747,7 @@ type ResolvedFx = {
  * `stale` covers both degradation rungs and `carriedForward` distinguishes
  * them: either the whole snapshot came from `lastKnown()` because the live
  * fetch failed, or the fetch succeeded and only *this* currency was carried
- * over from an earlier one because the body omitted it (internal-review). They read
+ * over from an earlier one because the body omitted it. They read
  * differently to an operator — the rate source down, versus the rate source
  * having quietly narrowed — so the log says which.
  */
@@ -806,80 +763,51 @@ type FiatDenomination = {
     detail?: string;
 };
 /**
- * Resolve an fx snapshot for a denomination hop, degrading to the fetcher's
- * last-known one when the live fetch fails (internal-review).
- *
- * The same ladder `resolveServerBtcUsdRate` walks for the x402/Tempo rails
- * (`btc-rate.ts`), and it exists here because the mid-job top-up's two fx legs
- * — the ask-time pin in `context.ts` and the verify-time hop in
- * {@link msatsToFiatMicro} — were the only ones in the payment layer that
- * called `fetch()` raw and swallowed the throw. `FxFetcher.lastKnown` is
- * documented as "the offline degradation source for the payment rail", so a
- * process holding a perfectly good snapshot was nonetheless dropping the
- * receipt's whole `credit` block over one blip at the rate provider.
- *
- * **A known-stale refusal fails closed and never degrades** (internal-review): the
- * platform decided the snapshot is too old to price against, so serving the
- * last-known one prices off exactly what it refused. Every other failure
- * degrades, which is the internal-review posture.
- *
- * No cool-down latch, unlike `resolveServerBtcUsdRate`. That one guards a
- * per-request hot path; this runs at most twice per mid-job ask, and a latch
- * shared across every DVM in the process would suppress the recovery probe a
- * long-lived host needs.
+ * A live fetch failure may use lastKnown(), but a known-stale refusal never
+ * does: that would use the very snapshot the platform refused. No shared
+ * cooldown suppresses the recovery probe on a later mid-job ask.
  */
 declare function resolveFxSnapshot(fetcher: FxFetcher): Promise<ResolvedFx>;
 /**
- * Convert an msat amount into a target currency's micro-units through the
- * shared fx snapshot (internal-review) — the denomination for a mid-job
- * `requestPayment` ask that carries no fiat envelope of its own.
- *
- * internal-review removed the numeric-msats *price*, so {@link resolvePriceFiat} needs
- * no rate; the mid-job ask is the one surface where a bare msat amount survives
- * (`ctx.requestPayment(50_000, …)`), and the credit it tops up may be
- * denominated in a currency the ask never named. An fx hop is the only way to
- * put either on the ledger.
- *
- * Answers a *reason* rather than `undefined` when it can't denominate — the
- * caller still accepts the money and skips the ledger leg rather than refusing
- * over a rate outage (internal-review), but it can now say which failure it degraded
- * on (internal-review). That fail-soft is why this stays separate from
- * `resolvePriceFiat`, which is now total for every paid request.
+ * Bare-msat mid-job asks need an FX conversion into the credit's currency.
+ * Failure carries a reason: callers accept the payment and skip its ledger
+ * leg rather than refusing over an outage. Upfront prices use resolvePriceFiat
+ * and require no rate, so they do not share this fail-soft behavior.
  */
 declare function msatsToFiatMicro(args: {
     msats: number;
     currency: string;
     fxFetcher: FxFetcher;
     /**
-     * A snapshot already in hand (internal-review). The mid-job ask path fetches one to
+     * A snapshot already in hand. The mid-job ask path fetches one to
      * size a fiat-form ask's msats; converting on that same snapshot costs no
      * second fetch and keeps the two figures arithmetically consistent.
      */
     snapshot?: FxRateSnapshot;
 }): Promise<FiatDenomination>;
 /**
- * The mid-job ask's fiat pin, in the target currency (internal-review) — what the cap
+ * The mid-job ask's fiat pin, in the target currency — what the cap
  * on this job's cumulative draw growth is summed from, and what the top-up
  * funds against.
  *
  * Two differences from {@link msatsToFiatMicro}, both scoped to the ask:
  *
  * - **A fiat-form ask already in the target currency is taken verbatim**, so a
- *   `ctx.requestPayment({ amount, currency })` keeps the exactness it has and
- *   never round-trips through a rate. Any other form converts `msats` on the
- *   caller's snapshot — including a fiat-form ask in some *other* currency,
- *   which converts on the very snapshot that sized its msats, so the pin and
- *   the wire ask can't disagree about the rate.
+ * `ctx.requestPayment({ amount, currency })` keeps the exactness it has and
+ * never round-trips through a rate. Any other form converts `msats` on the
+ * caller's snapshot — including a fiat-form ask in some *other* currency,
+ * which converts on the very snapshot that sized its msats, so the pin and
+ * the wire ask can't disagree about the rate.
  * - **Floors at one micro-unit rather than returning `undefined`.**
- *   `ctx.requestPayment(500)` is half a micro at $100k/BTC — a legitimate, if
- *   tiny, ask, and refusing to denominate it poisons the job's whole ask total
- *   and with it the ceiling. One micro is provably conservative for a ceiling:
- *   the ask is worth less than that. `resolvePriceFiat` and `msatsToFiatMicro`
- *   keep their sub-micro refusals, which are load-bearing on the upfront path.
+ * `ctx.requestPayment(500)` is half a micro at $100k/BTC — a legitimate, if
+ * tiny, ask, and refusing to denominate it poisons the job's whole ask total
+ * and with it the ceiling. One micro is provably conservative for a ceiling:
+ * the ask is worth less than that. `resolvePriceFiat` and `msatsToFiatMicro`
+ * keep their sub-micro refusals, which are load-bearing on the upfront path.
  *
  * Throws only what `fxRateFor` throws — an unsupported target currency, or an
  * `fx_rate_unavailable` for one the snapshot never carried. The ask path catches
- * both and degrades to an unpinnable ask (internal-review), naming which it was.
+ * both and degrades to an unpinnable ask, naming which it was.
  */
 declare function pinAskFiat(args: {
     msats: number;
@@ -892,65 +820,29 @@ declare function pinAskFiat(args: {
 }): PriceFiat | undefined;
 /**
  * Fiat micro-units actually funded for a rail payment of `paidMsats` against
- * a job quoted at `requiredMsats` ↔ `priceFiat` (operator ruling: overpay
- * funds and draws the FULL paid amount — ledger truth equals money truth).
+ * a job quoted at `requiredMsats` ↔ `priceFiat`. An overpayment funds and draws
+ * the full paid amount so ledger value matches money received.
  * Pro-rata at the quote-pinned ratio, so the exact-payment case — what every
  * conformant client sends — is `priceFiat.amountMicro` with zero drift.
  */
 declare function fundedMicroFor(priceFiat: PriceFiat, paidMsats: number, requiredMsats: number): number;
 /**
- * The µUSDC figure an x402 402 advertises as `maxAmountRequired`, and the same
- * figure the settled authorization is valued against at submit (internal-review).
- *
- * **A USD-priced job states its price verbatim.** USDC is a six-decimal USD
- * stablecoin, and `priceFiat.amountMicro` is already an exact USD micro figure,
- * so the advertisement is the price — no rate in the derivation, and therefore
- * no way for the 402 and the submit to disagree about it.
- *
- * The BTC hop this replaces was not merely lossy, it was *unpinned*. The 402 is
- * stateless, so the figure was recomputed at submit from whatever the fx cache
- * held by then, through two rate-dependent roundings: `resolveStaticPriceMsats`
- * ceils the price to a whole **satoshi**, and `msatsToUsdc` ceils that back to
- * µUSDC. A rate refresh between the 402 and the payment therefore moved the
- * reconstruction by up to a satoshi's worth (~$0.0013 at $100k/BTC) — and when
- * it moved down, the caller's exact payment read as an overpayment, pro-rated
- * above `price_micro`, and was refused `funding_commitment_mismatch` *after*
- * the facilitator had settled. Money moved, no job, no credit. The sat-ceil
- * also overcharged every x402 caller outright: at $0.01 and $97,432/BTC the
- * quote is 11 sats and the old advertisement demanded 10,718 µUSDC — 7% above
- * the price the caller was quoted and the ledger recorded.
- *
- * Every caller gates x402 on a USD-priced DVM before reaching this helper.
- * Keeping the helper USD-only makes a future advertisement call site fail
- * closed instead of quietly restoring the rate-derived non-USD path.
+ * USD micro-units are already USDC's six-decimal units. Advertise them verbatim
+ * and value settlement against the same figure; a BTC conversion would add
+ * rounding and an unpinned rate between challenge and settlement.
+ * Non-USD callers fail closed rather than implicitly introducing that FX hop.
  */
 declare function x402RequiredUsdcMicro(priceFiat: PriceFiat): number;
 /**
- * A settled x402 authorization's share of a quoted figure, taken against the
- * `maxAmountRequired` the 402 advertised (internal-review) — `quoted` unmodified when
- * the authorization paid exactly that, pro-rata otherwise. Unit-agnostic like
- * {@link fundedMicroFor}: the same ratio restates the job's fiat price and its
- * msat quote, so the two frames can never disagree about what landed.
- *
- * x402 must NOT reach {@link fundedMicroFor} through `usdcToMsats`. The
- * advertised figure is stated in µUSDC by {@link x402RequiredUsdcMicro} — the
- * price verbatim for a USD job — and the
- * receipt converts back with `usdcToMsats`, a `Math.round`, which is the
- * inverse of neither. The round trip lands at or above `requiredMsats`, which
- * took the pro-rata branch and valued a payment of exactly the advertised
- * amount above `price_micro`. That mismatch used to be refused only after the
- * facilitator had broadcast the transfer, so a conformant caller signing the
- * quoted price lost the payment outright (the gate now also runs pre-settle —
- * internal-review).
- *
- * Valuing in the rail's own units removes the manufactured disagreement and
- * nothing else: a genuine overpayment still pro-rates, and both inputs are on
- * the 402, so the caller can derive the figure it must sign from that alone.
+ * Value a settled authorization against the advertised USDC amount, preserving
+ * the quote at exact payment and prorating genuine over/underpayment. Use this
+ * ratio for both fiat and msat frames: a USDC-to-msat round trip can round an
+ * exact payment into a false overpayment and invalidate its signed commitment.
  */
 declare function x402SettledShare(quoted: number, requiredUsdcMicro: number, settledUsdcMicro: number): number;
 /**
  * SHA-256 hex over the raw funding artifact — the value an explicit
- * fund-and-draw request must sign as `fund.commitment` (spec §2 condition 3).
+ * fund-and-draw request must sign as `fund.commitment` (the funding-commitment rule).
  * The artifact is the exact header-borne string: the `X-Cashu` header value,
  * the `X-PAYMENT` header value, or the extracted `Payment <…>` mpp scheme
  * string. Hashing the verbatim wire string keeps the commitment computable by
@@ -964,14 +856,14 @@ declare function fundingCommitment(artifact: string): string;
 declare function implicitCreditId(rail: "cashu" | "x402" | "tempo", paymentId: string): string;
 /**
  * Whether a credit id sits in a namespace the server derives — which a caller
- * may **reference** but must never **create** (internal-review).
+ * may **reference** but must never **create**.
  *
  * Both namespaces are computable by a third party: `imp:` from the rail's
  * payment id, `fnd:` from `(pubkey, fund_id)`. `CreditLedger.fund` INSERTs at
  * whatever id it is handed, so without this rule anyone could pre-open a
  * credit at an id the server would later derive for someone else. The victim's
  * top-up then settles on the rail before `fund` refuses with `caller_mismatch`
- * — they pay and hold nothing. Keeping creation server-side means a derived id
+ * they pay and hold nothing. Keeping creation server-side means a derived id
  * is only ever owned by the caller it was derived for.
  *
  * Referencing stays open, and has to: the id of a credit opened this way is
@@ -981,7 +873,7 @@ declare function implicitCreditId(rail: "cashu" | "x402" | "tempo", paymentId: s
 declare function isDerivedCreditId(creditId: string): boolean;
 /**
  * Deterministic credit id for a `/v1/credit` top-up that names no credit —
- * the documented "omit `credit_id` to open a new one" flow (internal-review).
+ * the documented "omit `credit_id` to open a new one" flow.
  *
  * Minting a fresh random id per attempt would make that flow the one top-up
  * shape that is *not* retry-safe: the second attempt looks up
@@ -998,8 +890,8 @@ declare function isDerivedCreditId(creditId: string): boolean;
  */
 declare function derivedFundCreditId(callerPubkey: string, fundId: string): string;
 /**
- * Settlement reference stamped on the revenue event of an **explicit** draw
- * (internal-review). One funding backs N draws, so the funding's own rail reference
+ * Settlement reference stamped on the revenue event of an **explicit** draw;
+ * one funding backs N draws, so the funding's own rail reference
  * cannot key them: `revenue_events` carries a global `UNIQUE (rail, tx_hash)`
  * that deliberately drops cross-job reuse of a settlement reference, and
  * reusing it would silently discard every draw but the first.
@@ -1013,17 +905,17 @@ declare function drawSettlementRef(dvmId: string, creditId: string, drawId: stri
 
 /**
  * Durable marker for a rail payment that already funded the credit ledger
- * (internal-review, spec §2 condition 3). The x402 and mpp rails have no dvmkit-side
+ * (the funding-commitment rule). The x402 and mpp rails have no dvmkit-side
  * commit point of their own — the money moves at the facilitator / the payer's
  * mpp server — so the marker row, inserted in the SAME transaction as
  * `CreditLedger.fund` + `draw`, is what makes a crash-replayed credential
  * unable to fund twice: the second attempt collides on the primary key and
  * surfaces as {@link ProcessedPaymentReplayError}, which the verifier routes
- * into the internal-review recovery gates instead of a second fund.
+ * into the recovery gates instead of a second fund.
  *
  * The Cashu rail does not use this store — its accumulator insert is already
  * the durable commit point, and its replay key (the `X-Cashu-Request-Id`
- * regime) must stay exactly as-is (dual-idempotency rule, spec §2).
+ * regime) must stay exactly as-is (dual-idempotency rule, the signed credit contract).
  */
 interface ProcessedPaymentStore {
     /**
@@ -1086,7 +978,7 @@ declare class PostgresProcessedPaymentStore implements ProcessedPaymentStore {
     withTx<T>(fn: (tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<T>;
     /** Create the `processed_payments` table if absent. Call once at SDK boot. */
     init(): Promise<void>;
-    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
     private createTables;
     record(args: {
         dvmId: string;
@@ -1128,7 +1020,7 @@ declare class MemoryProcessedPaymentStore implements ProcessedPaymentStore {
 /**
  * Machine codes an accumulator-path receive can reject with. Named and exported
  * so the payment-error builder in `payment.ts` folds them into `PaymentErrorCode`
- * and keeps display/hint/retryable copy in lockstep with this union (internal-review).
+ * and keeps display/hint/retryable copy in lockstep with this union.
  */
 type AccumulatorRejectionCode = "missing_request_id" | "missing_lock_pubkey" | "not_p2pk_locked" | "wrong_lock_pubkey" | "proof_not_unspent" | "proof_pending" | "replay_rejected" | "mint_unreachable" | "invalid_token";
 
@@ -1437,7 +1329,7 @@ interface X402BatchChannelObservation {
     refundNonce: number;
 }
 /**
- * The chain submission behind an accepted voucher did not return success (internal-review).
+ * The chain submission behind an accepted voucher did not return success.
  *
  * Typed and `retryable` because it is a service-availability fault, not a fault
  * in the credential: the voucher verified, the ledger leg rolled back, and the
@@ -1479,16 +1371,16 @@ interface X402BatchRefusal {
      * `false` when re-signing cannot fix this: the caller must be answered with a
      * terminal error rather than a 402 carrying fresh requirements, because an
      * agent reads a corrective 402 as "sign this and resubmit" and lands straight
-     * back on the same refusal (internal-review). Omitted means corrective.
+     * back on the same refusal. Omitted means corrective.
      */
     corrective?: boolean;
 }
 /**
- * What the chain says about one wedged settlement (internal-review).
+ * What the chain says about one wedged settlement.
  *
  * The four answers are kept apart because their repairs differ and because an
  * operator re-pointing an RPC needs a definitive answer to read as definitive
- * — the same split `LightningReceive.lookupSettlement` draws between
+ * the same split `LightningReceive.lookupSettlement` draws between
  * `invoice_unknown_to_wallet` and `wallet_unreachable`. `findAppliedSettlement`
  * collapses all of them (`undefined` for absent *and* unbookmarked, a throw for
  * transport), so this is where they are separated.
@@ -1563,7 +1455,7 @@ interface X402SettlementRepaired<T> {
 }
 /**
  * The operator's exit from a settlement stuck between "chain paid" and "ledger
- * booked" (internal-review).
+ * booked".
  *
  * `reconcile` is the ordinary recovery path with the chain's figure substituted
  * for the facilitator's: the amount is re-derived from
@@ -1617,7 +1509,7 @@ interface X402BatchSettlementServer {
          * Required on `refund`: the credit's unspent balance in the channel token's
          * own units. It is the ceiling the on-chain payout is sized to, so that a
          * drain returns what the caller is owed and nothing the DVM has earned
-         * (internal-review). `commit` must re-assert it against the authoritative ledger
+         * `commit` must re-assert it against the authoritative ledger
          * figure, since this one is read before the channel lock is taken.
          */
         refundBoundNative?: number;
@@ -1633,7 +1525,7 @@ interface X402BatchSettlementServer {
          * required in the *type*, because the payload the payer presents is
          * what revokes, settles and pays: a refund voucher naming another
          * channel would extinguish this credit's balance out of that channel's
-         * escrow (internal-review). The fund path binds in the ledger
+         * escrow. The fund path binds in the ledger
          * (`credit-ledger.ts`'s `rail_mismatch`) and the Tempo close binds in
          * its credential verifier; this is x402's.
          */
@@ -1648,20 +1540,19 @@ interface X402BatchSettlementServer {
     claimAndSettle(): Promise<void>;
     /**
      * Operator repair for a settlement wedged between chain and ledger
-     * (internal-review). Absent without durable storage: with no settlement rows there
+     * Absent without durable storage: with no settlement rows there
      * is no queue and nothing a repair could act on.
      */
     repair?: X402SettlementRepair;
     /**
      * The durable settlement read the credit ledger gates spending on
-     * (internal-review). Absent without durable storage, on the same reasoning as
+     * Absent without durable storage, on the same reasoning as
      * {@link repair}: with no settlement rows nothing can be wedged, so there is
      * nothing to gate.
      */
     settlementGate?: X402RefundSettlementGate;
     stop(): Promise<void>;
 }
-/** Options for constructing one DVM's batch-settlement server. */
 interface CreateX402BatchSettlementServerOpts {
     network: string;
     payTo: string;
@@ -1677,12 +1568,12 @@ interface CreateX402BatchSettlementServerOpts {
     rpcUrl?: string;
     db?: Pool;
     /**
-     * Durable store to adopt instead of building one from {@link db} (internal-review).
+     * Durable store to adopt instead of building one from {@link db}.
      *
      * `createDVMServer` builds it at ledger construction, because the credit
      * ledger's spend gate has to exist whether or not this server is ever
      * constructed. Adopting it here keeps one `PostgresX402ChannelStorage` — and
-     * so one settlement pool — per mount, which is what the internal-review reasoning on
+     * so one settlement pool — per mount, which is what the reasoning on
      * {@link PostgresX402ChannelStorage} rests on. Ignored when the config
      * supplies its own {@link X402BatchSettlementConfig.storage}.
      */
@@ -1694,7 +1585,7 @@ interface CreateX402BatchSettlementServerOpts {
      * `undefined` means the channel's credit could not be resolved.
      *
      * Required, not optional: it is the ceiling every claim is capped at
-     * (internal-review), and a server that cannot derive one must claim nothing rather
+     * and a server that cannot derive one must claim nothing rather
      * than fall back to the deposit.
      */
     earnedNative: (channelId: string) => Promise<number | undefined>;
@@ -1705,13 +1596,13 @@ interface CreateX402BatchSettlementServerOpts {
     /** Authoritative channel-view override for deterministic tests. */
     channelStateReader?: (channelId: string) => Promise<X402BatchChannelObservation>;
     /**
-     * The payout tracker (internal-review). Attached with this server's settle scope
+     * The payout tracker. Attached with this server's settle scope
      * and routed every claim and settle, so the batch that lands at `pay_to` is
      * reported with the value claimed into it, and the pending snapshot can say
      * what is still on the channels and whether the settle is wedged.
      *
      * @internal Wired by `createDVMServer` from the platform reporter; not a
-     * builder surface, and not part of the extractable SDK contract (internal-review).
+     * builder surface, and not part of the extractable SDK contract.
      */
     payout?: X402PayoutObserver;
 }
@@ -1728,7 +1619,7 @@ interface PaymentInfo {
     /**
      * Rail value this payment contributes to the job, in millisatoshis.
      *
-     * For a credit-drawn job (internal-review) this is the **draw's** allocated share of
+     * For a credit-drawn job this is the **draw's** allocated share of
      * the credit's rail value, not the amount the caller handed over on this
      * request — under an explicit fund-and-draw the caller may have funded twenty
      * jobs' worth. That makes it the revenue basis for this job: mid-job top-ups
@@ -1739,38 +1630,38 @@ interface PaymentInfo {
     /**
      * Rail that satisfied the upfront payment, if any. A {@link FundingMethod}
      * rather than a `PaymentMethod`: a draw against a Lightning-funded credit
-     * reports `"lightning"` here (internal-review), which is what lets the revenue
+     * reports `"lightning"` here, which is what lets the revenue
      * ledger book it instead of silently dropping the row.
      */
     paymentRail?: FundingMethod;
     receivedProofs: ProofLike[];
     /**
      * Settlement reference for the credit. x402 carries the EVM tx hash from
-     * the facilitator (internal-review); mpp carries the credential's `challenge.id`,
-     * HMAC-bound to the realm so cross-DVM collisions are impossible (internal-review);
-     * cashu accumulator (internal-review) sets it to the `X-Cashu-Request-Id` UUID
-     * (internal-review). Required by the platform revenue ledger for `tempo`/`x402`
+     * the facilitator; mpp carries the credential's `challenge.id`,
+     * HMAC-bound to the realm so cross-DVM collisions are impossible;
+     * cashu accumulator sets it to the `X-Cashu-Request-Id` UUID
+     * Required by the platform revenue ledger for `tempo`/`x402`
      * rails; nullable for cashu's `tx_hash` column.
      */
     paymentTxHash?: string;
     /** Chain transaction returned to a caller recovering this accepted request. */
     paymentTransactionHash?: string;
     /**
-     * Rail-native payment amount in atomic units (internal-review). Sats for mpp,
+     * Rail-native payment amount in atomic units. Sats for mpp,
      * USDC microunits for x402. Cashu leaves it unset — the existing
      * `paidMsats / 1000` derivation in the platform callback covers it.
      */
     nativeAmount?: number;
-    /** Native asset tag matching `revenue_events.native_asset` (internal-review). */
+    /** Native asset tag matching `revenue_events.native_asset`. */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
     /**
      * Discriminator written into `revenue_events.metadata.cashu_flow` so ops
-     * queries can split per-call cashu rows by source path (internal-review).
+     * queries can split per-call cashu rows by source path.
      */
     cashuFlow?: "p2pk_accumulator";
     /**
      * Base64-encoded x402 `SettleResponse` for the `X-PAYMENT-RESPONSE`
-     * response header (internal-review). Set on the upfront-flow x402 success path;
+     * response header. Set on the upfront-flow x402 success path;
      * `app.ts` attaches it to the 2xx response per x402 spec.
      */
     x402SettleResponseHeader?: string;
@@ -1781,21 +1672,21 @@ interface PaymentInfo {
         replayed: boolean;
     };
     /**
-     * Credit-ledger linkage (internal-review). Set whenever the payment funded and/or
+     * Credit-ledger linkage. Set whenever the payment funded and/or
      * drew the ledger — every paid job with a ledger wired. Persisted on the
      * job so the terminal funnel can settle/release the draw and the receipt
      * can countersign the `ReceiptCredit` block.
      */
     creditId?: string;
-    /** The draw placed for this job on `creditId` (internal-review). */
+    /** The draw placed for this job on `creditId`. */
     drawId?: string;
-    /** The draw's fiat amount, 1e-6 of {@link creditCurrency} (internal-review). */
+    /** The draw's fiat amount, 1e-6 of {@link creditCurrency}. */
     drawAmountMicro?: number;
-    /** Currency the credit — and therefore the draw — is denominated in (internal-review). */
+    /** Currency the credit — and therefore the draw — is denominated in. */
     creditCurrency?: string;
     /**
      * The funding leg, when this request actually moved money onto a credit
-     * (internal-review). Reported to the platform as a **deposit**: a liability until
+     * Reported to the platform as a **deposit**: a liability until
      * drawn, never summed into revenue. Absent on a pure draw against an
      * existing balance.
      */
@@ -1805,7 +1696,7 @@ interface PaymentInfo {
     fundingCredit?: CreditSnapshot;
     /**
      * Fiat micro of {@link creditCurrency} this payment funded that bought the
-     * job **nothing** (internal-review) — a second payment for an ask the job's draw
+     * job **nothing** — a second payment for an ask the job's draw
      * already covers, or the overpaid tail of an oversized one. It is available
      * balance on {@link creditId}, drainable at once, and the caller has to be
      * told or they will re-send. Absent on every ordinary payment.
@@ -1813,7 +1704,7 @@ interface PaymentInfo {
     unappliedMicro?: number;
 }
 /**
- * A funding event as the platform books it — one deposit row (internal-review, spec
+ * A funding event as the platform books it — one deposit row (spec
  * §10). Keyed on `(dvmId, creditId, fundingId)`, so a retried report is a
  * no-op rather than a double-count.
  */
@@ -1845,12 +1736,12 @@ interface CreditFundingReport {
         channelId: string;
         cumulativeAmount: string;
     };
-    /** TIP-1034 chain binding, reported so the platform can route a close (internal-review). */
+    /** TIP-1034 chain binding, reported so the platform can route a close. */
     tempoChannel?: TempoChannelReport;
 }
 /**
  * The chain identity of a TIP-1034 channel, as reported to the platform
- * alongside its deposit (internal-review). Read from the DVM's own durable channel
+ * alongside its deposit. Read from the DVM's own durable channel
  * store, never from the caller's credential.
  */
 interface TempoChannelReport {
@@ -1858,7 +1749,6 @@ interface TempoChannelReport {
     escrow: string;
     payee?: string;
 }
-/** Options for verifying an upfront payment on job submission. */
 interface UpfrontPaymentOpts {
     cashuToken?: string;
     requiredMsats?: number;
@@ -1875,7 +1765,7 @@ interface UpfrontPaymentOpts {
     /**
      * Resource URL the client retried against. Bound into the rebuilt
      * `PaymentRequirements` when verifying x402, and surfaced on the 402 body
-     * `accepts` array for x402 dual-serve (internal-review).
+     * `accepts` array for x402 dual-serve.
      */
     x402Resource?: string;
     /** Either the structured credential object or its serialized `Authorization: Payment <…>` value. */
@@ -1884,17 +1774,17 @@ interface UpfrontPaymentOpts {
     /**
      * Request path of the resource being paid for (e.g. `/v1/job`). Bound into
      * each issued mppx challenge's `meta.path` so a credential can't be replayed
-     * against a different paid endpoint of the same DVM (internal-review).
+     * against a different paid endpoint of the same DVM.
      */
     resourcePath?: string;
     /**
      * Whether `tempo/session` may be issued and newly accepted right now — the
-     * platform close-observer and hosted settlement-readiness gates (internal-review,
-     * internal-review), resolved per request by `DVMServer`. Absent means offered: a
+     * platform close-observer and hosted settlement-readiness gates, resolved per
+     * request by `DVMServer`. Absent means offered: a
      * self-hosted DVM operates these responsibilities itself.
      *
      * `false` refuses a session credential that would open a channel the platform
-     * cannot safely protect or settle (internal-review, internal-review), and withholds session
+     * cannot safely protect or settle, and withholds session
      * challenges from every 402 this call emits, *except* on a credit already
      * bound to a TIP-1034 channel. That deposit is already exposed, so refusing
      * its vouchers only strands it; and since a channel-bound credit can be funded
@@ -1907,11 +1797,11 @@ interface UpfrontPaymentOpts {
     /**
      * Tracks consumed `(realm, challenge.id)` pairs so a credential that was
      * already accepted on the upfront path can't be replayed within its
-     * `expires` window (internal-review). Optional: when absent, the upfront flow has
+     * `expires` window. Optional: when absent, the upfront flow has
      * no per-process replay protection beyond mppx's own expiry check.
      */
     consumedCredentialStore?: ConsumedCredentialStore;
-    /** Cashu receive mode (internal-review / internal-review). Routes the receive path. */
+    /** Cashu receive mode. Routes the receive path. */
     cashuMode?: CashuMode;
     /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
     accumulatorDb?: AccumulatorPool;
@@ -1921,7 +1811,7 @@ interface UpfrontPaymentOpts {
     /**
      * Active NUT-11 P2PK lock pubkeys — required for the `p2pk-accumulator`
      * path. Includes the current pubkey followed by retired pubkeys still
-     * within the rotation grace window (internal-review). Caller resolves via
+     * within the rotation grace window. Caller resolves via
      * `loadLockPubkeyState` per-request so rotations propagate without a
      * server restart.
      */
@@ -1929,7 +1819,7 @@ interface UpfrontPaymentOpts {
     /** UUIDv4 from `X-Cashu-Request-Id` header. */
     requestId?: string;
     /**
-     * Runtime mint-health tracker (internal-review). Receive path short-circuits with
+     * Runtime mint-health tracker. Receive path short-circuits with
      * `cashu_mint_sick` when the token's mint is currently flagged sick, so
      * agents retry against a healthy alternative without waiting for the
      * per-call mint timeout to fire inside `acceptAccumulatorPayment`.
@@ -1937,14 +1827,14 @@ interface UpfrontPaymentOpts {
     mintHealthTracker?: MintHealthTracker;
     /**
      * Host fx fetcher used to price the non-sat rails (x402 USDC, mppx fiat)
-     * through the same BTC/USD source the quote path uses (internal-review). On a hosted
+     * through the same BTC/USD source the quote path uses. On a hosted
      * DVM this is the platform-served snapshot; self-hosted defaults to
      * CoinGecko-direct. Optional: a lazy default fetcher stands in when unset, so
      * the payment path never reaches `fetchBtcUsdRate`.
      */
     fxFetcher?: FxFetcher;
     /**
-     * Credit ledger every payment funds and draws through (internal-review, spec §1):
+     * Credit ledger every payment funds and draws through (the credit lifecycle contract):
      * an attached rail payment is an implicit N=1 funding — `fund` the paid
      * amount + `draw` it, atomically with the rail commit. When absent (or
      * when the price can't be fiat-denominated), the payment is accepted with
@@ -1953,21 +1843,21 @@ interface UpfrontPaymentOpts {
      */
     creditLedger?: CreditLedgerLike;
     /**
-     * Durable processed-payment markers for the x402/mpp rails (internal-review).
+     * Durable processed-payment markers for the x402/mpp rails.
      * Those rails commit money outside dvmkit, so the marker row — written in
      * the same transaction as the ledger fund — is what makes a crash-replayed
      * credential unable to fund twice.
      */
     processedPayments?: ProcessedPaymentStore;
     /**
-     * Reporter-owned transactional outbox enqueue (internal-review). When present,
+     * Reporter-owned transactional outbox enqueue. When present,
      * every funding awaits this inside the rail's commit transaction, so money
      * and its durable deposit report land together.
      */
     enqueueCreditDeposit?: CreditDepositEnqueue;
     /**
      * The job price's fiat denomination, pinned by the caller from the same
-     * quote surface that produced `requiredMsats` (internal-review). The ledger is
+     * quote surface that produced `requiredMsats`. The ledger is
      * fiat-micro denominated; fund = draw = this amount in the exact-payment
      * case, so no fresh fx conversion happens on the verify hot path.
      */
@@ -1983,14 +1873,14 @@ interface UpfrontPaymentOpts {
     /** Requester id — funder identity fallback for DVMs without descriptor auth. */
     requesterId?: string;
     /**
-     * Explicit credit fields extracted from the signed body (spec §2). Their
+     * Explicit credit fields extracted from the signed body (the signed credit contract). Their
      * signature coverage and structural validation happen in `app.ts` before
      * payment verification; this layer enforces ownership, the funding
      * commitment, and the draw itself.
      */
     creditEnvelope?: CreditEnvelope;
     /**
-     * Turn this verification into a **fund-only top-up** (internal-review): the rails
+     * Turn this verification into a **fund-only top-up**: the rails
      * verify and commit exactly as they do for a job, but the ledger leg funds
      * without drawing — there is no job to pay for. Set by `POST /v1/credit`;
      * `requiredMsats` / `priceFiat` carry the requested top-up amount rather
@@ -2021,7 +1911,7 @@ interface FundOnlyRequest {
     /** Client-generated idempotency key for this deposit (`credit_fundings` PK). */
     fundId: string;
     /**
-     * SHA-256 hex over the raw funding artifact, signed by the caller (spec §2
+     * SHA-256 hex over the raw funding artifact, signed by the caller (the signed credit contract
      * condition 3). Checked before any rail work: it is what binds the artifact
      * presented on the header to the deposit named in the signed body.
      */
@@ -2033,14 +1923,14 @@ interface PaymentErrorDetail {
     status: number;
     /**
      * mppx challenges to advertise via `WWW-Authenticate` headers on the 402
-     * response (internal-review). Populated whenever the DVM has an mppx handle and
+     * response. Populated whenever the DVM has an mppx handle and
      * the request is short on payment — including on payment_invalid, since
      * draft-ryan-httpauth-payment-01 requires a fresh challenge on rejection.
      */
     mppChallenges?: Challenge.Challenge[];
     /**
      * x402 `PaymentRequirements` to merge into the 402 body's `accepts`
-     * array under the `x402Version` envelope (internal-review). Populated when the
+     * array under the `x402Version` envelope. Populated when the
      * DVM has x402 wired and dual-serve is on.
      */
     x402Requirements?: PaymentRequirements[];
@@ -2049,30 +1939,30 @@ interface PaymentErrorDetail {
     /**
      * Scheme-level error code for the x402 v2 envelope, kept apart from the
      * body's human `message` because a scheme client matches on it verbatim to
-     * decide whether a 402 is correctable (internal-review).
+     * decide whether a 402 is correctable.
      */
     x402ErrorCode?: string;
     /**
      * On a `replay_rejected` from the x402/mpp processed-payment marker
-     * (internal-review): the payment id the original funding committed under. The
-     * route feeds it to the internal-review recovery gates (jobs persist it as
+     * the payment id the original funding committed under. The
+     * route feeds it to the recovery gates (jobs persist it as
      * `payment_tx_hash`) so a crash-replayed credential can recover its
      * original job instead of a bare 409.
      */
     replayPaymentId?: string;
     /**
      * A short payment that was kept under the fail-closed posture and settled
-     * on the spot (internal-review). The route books it as revenue under a synthetic
+     * on the spot. The route books it as revenue under a synthetic
      * job id — no job exists to carry it — tagged so it stays separable from
      * per-job service revenue.
      */
     forfeit?: ShortPayForfeit;
     /**
-     * Money that landed on a credit even though this request failed (internal-review,
-     * internal-review). Set when a short mid-job pay funds without completing its ask,
+     * Money that landed on a credit even though this request failed. Set when a
+     * short mid-job pay funds without completing its ask,
      * or an explicit upfront fund-and-draw commits the deposit but the combined
      * balance cannot cover the draw. In both cases the caller keeps an available
-     * balance they can reclaim under the internal-review drain. That is a liability, so
+     * balance they can reclaim under the drain. That is a liability, so
      * the deposit has to reach the platform on the 402 path exactly as it does on
      * the success path, or the outstanding-liability view is short by precisely
      * the money we still owe.
@@ -2085,7 +1975,7 @@ interface PaymentErrorDetail {
      */
     funding?: CreditFundingReport;
 }
-/** A kept-but-undelivered short payment, ready to be booked as tagged revenue (internal-review). */
+/** A kept-but-undelivered short payment, ready to be booked as tagged revenue. */
 interface ShortPayForfeit {
     /** Cashu request id — the rail settlement reference. */
     paymentId: string;
@@ -2101,9 +1991,9 @@ type PaymentResult = PaymentInfo & {
     error?: PaymentErrorDetail;
     /**
      * The signed body's `(credit_id, draw_id)` matches an already-recorded
-     * draw (internal-review, spec §2 condition 1 — the explicit idempotency regime).
+     * draw (the draw-idempotency rule — the explicit idempotency regime).
      * No rail work ran and no second hold was placed; the route applies the
-     * internal-review proof-of-origin gates and re-issues the original job's response.
+     * proof-of-origin gates and re-issues the original job's response.
      */
     replayedDraw?: {
         creditId: string;
@@ -2112,7 +2002,7 @@ type PaymentResult = PaymentInfo & {
     };
 };
 /**
- * Whether a dev-mode server skips payment verification outright (internal-review).
+ * Whether a dev-mode server skips payment verification outright.
  *
  * Both upfront and mid-job acceptance require verification whenever any Cashu,
  * x402, or Tempo rail is configured. An unusable configured rail fails closed;
@@ -2134,7 +2024,7 @@ declare function devModeSkipsPaymentVerification(opts: {
  */
 declare const PAYMENT_PROOF_KEYS: readonly ["cashu_token", "x402_payment", "tempo_credential"];
 /**
- * Whether a `payment` message carries a proof on any mid-job rail (internal-review).
+ * Whether a `payment` message carries a proof on any mid-job rail.
  *
  * Deliberately colocated with the rail dispatch it mirrors, because two call
  * sites decide on it: `validateMessageContent` (`server/app.ts`) admits a
@@ -2146,26 +2036,26 @@ declare const PAYMENT_PROOF_KEYS: readonly ["cashu_token", "x402_payment", "temp
 declare function hasPaymentProof(content: Record<string, unknown>): boolean;
 /**
  * Issue one mppx Challenge per registered method for the upfront HTTP-transport
- * 402 path (internal-review). Mirrors the message-based issuance loop in
+ * 402 path. Mirrors the message-based issuance loop in
  * `context.ts` but binds challenges via `meta` (resource path + per-request
- * nonce) instead of the per-job `pendingMppChallengeIds` binding (internal-review) —
+ * nonce) instead of the per-job `pendingMppChallengeIds` binding —
  * there's no job at upfront challenge-issue time, so the binding has to live
  * inside the challenge itself.
  *
  * `meta.nonce` is unique-per-issue and HMAC-bound; consumed-id tracking on
- * the verification side is wired via `ConsumedCredentialStore` (internal-review), so
+ * the verification side is wired via `ConsumedCredentialStore`, so
  * a successfully-accepted credential can't be replayed within its `expires`
  * window even if it lands on the same paid endpoint.
  *
- * `btcUsdRate` is resolved once per request by the caller (internal-review) rather
+ * `btcUsdRate` is resolved once per request by the caller rather
  * than fetched here, so every rail this request advertises or verifies prices
  * off the same number and a rate-provider outage is handled in one place.
  *
- * `sessionIssuable` is the platform close-observer gate (internal-review), threaded in
+ * `sessionIssuable` is the platform close-observer gate, threaded in
  * by `DVMServer` and defaulting to issuable for a self-hosted DVM that watches
  * its own closes. It used to gate advertisement only, so a `/v1/credit` 402
  * kept issuing `tempo/session` challenges the DVM had just stopped advertising
- * — and its own interface doc said "advertised **and** issued" (internal-review). The
+ * and its own interface doc said "advertised **and** issued". The
  * caller resolves it as "the gate is open, **or** this credit is already bound
  * to a channel", so a top-up on an existing channel keeps its challenge while
  * the gate is closed; `verifyUpfrontPayment` still refuses any *other* channel
@@ -2179,7 +2069,6 @@ declare function issueUpfrontChallenges(mpp: MppxServer, requiredMsats: number,
 declare function verifyUpfrontPayment(opts: UpfrontPaymentOpts): Promise<PaymentResult>;
 /**
  * A management credential signed for a channel other than the one required
- * (internal-review).
  *
  * Typed rather than a bare `Error` because the drain route has to tell it apart
  * from the transport and chain failures its catch ladder reconciles: this one is
@@ -2206,7 +2095,7 @@ declare function verifyTempoSessionManagementCredential(args: {
      *
      * The drain route re-asserts its close intent here rather than a line above
      * the call so that a credential signed for another channel is refused before
-     * the reservation is touched (internal-review). Only this function knows where that
+     * the reservation is touched. Only this function knows where that
      * seam is, so putting the hook here makes the ordering structural instead of a
      * comment the next edit can reorder past. A throw propagates to the caller
      * with nothing broadcast.
@@ -2218,7 +2107,7 @@ declare function verifyTempoSessionManagementCredential(args: {
     cumulativeAmount?: string;
 }>;
 /**
- * Every machine code a flat payment-error body can carry (internal-review) — the six
+ * Every machine code a flat payment-error body can carry — the six
  * codes constructed directly in this file plus the agent-wallet cashu rejection
  * codes ({@link AccumulatorRejectionCode}), which surface verbatim through the
  * accumulator branch of {@link verifyAccumulatorReceipt}. `fx_rate_unavailable`
@@ -2229,7 +2118,7 @@ declare function verifyTempoSessionManagementCredential(args: {
 type PaymentErrorCode = "payment_invalid" | "x402_not_offered" | "x402_settlement_ambiguous" | "cashu_unavailable" | "cashu_not_p2pk_locked" | "mint_health_pending" | "cashu_mint_sick" | "payment_insufficient" | "payment_unapplied" | "insufficient_credit" | "credit_expired" | "credit_unbacked" | "credit_not_found" | "tempo_channel_closing" | "settlement_pending" | "draw_conflict" | "funding_commitment_mismatch" | "credit_not_supported" | "one_shot_credit_not_supported" | "credit_below_min" | "below_rail_minimum" | "credit_over_max" | "credit_id_unavailable" | "nothing_to_drain" | "drain_below_dust" | "drain_not_found" | "drain_conflict" | "drain_method_unsupported" | "tempo_channel_exit_required" | "x402_settlement_submission_failed" | X402SettlementReconciliationReason | "lightning_settlement_pending" | "lightning_invoice_expired" | "lightning_unavailable" | AccumulatorRejectionCode;
 /**
  * Build a flat payment-error body carrying the four agent-facing fields every
- * payment error must have (internal-review): the machine `code`, the operator-facing
+ * payment error must have: the machine `code`, the operator-facing
  * `message`, and the `display`/`hint`/`retryable` copy an agent relays to a
  * human and branches retries on. `display`, `hint`, and `retryable` default from
  * {@link PAYMENT_ERROR_COPY} keyed on `code`; `message` is the per-site operator
@@ -2241,7 +2130,7 @@ type PaymentErrorCode = "payment_invalid" | "x402_not_offered" | "x402_settlemen
  *
  * `retryable` overrides on the same terms, and for the same reason: a code that
  * covers more than one refusal can be terminal for one of them and clear on its
- * own for another — `drain_conflict` is both (internal-review). Override it only
+ * own for another — `drain_conflict` is both. Override it only
  * alongside the `hint`, since the two are one answer: a hint that says retry
  * under `retryable: false` is the disagreement this exists to prevent.
  *
@@ -2258,14 +2147,14 @@ declare function paymentErrorBody(code: PaymentErrorCode, opts: {
 /**
  * Build a payment-error response carrying a JSON error body plus one
  * `WWW-Authenticate: Payment <serialized challenge>` header per mppx challenge
- * (internal-review, per draft-ryan-httpauth-payment-01). When `challenges` is empty,
+ * (per draft-ryan-httpauth-payment-01). When `challenges` is empty,
  * returns a plain JSON response (Cashu/x402-only DVMs).
  *
  * Status defaults to 402 (Payment Required) but callers can override — e.g.
- * the internal-review sick-mint short-circuit returns 503 because the issue is a
+ * the sick-mint short-circuit returns 503 because the failure is a
  * mint-side outage, not a payment problem.
  *
- * When `x402Requirements` is present (internal-review, x402 dual-serve), merge the
+ * When `x402Requirements` is present (x402 dual-serve), merge the
  * x402-spec envelope `{ x402Version, accepts: [...] }` into the body next to
  * the existing dvmkit error fields so x402 clients can find their retry
  * shape on the same response. The MPP `WWW-Authenticate` header and the
@@ -2275,7 +2164,6 @@ declare function paymentErrorBody(code: PaymentErrorCode, opts: {
  * are single-use and shared caches must not return them to other clients.
  */
 declare function buildPaymentErrorResponse(body: Record<string, unknown>, challenges?: Challenge.Challenge[], x402Requirements?: PaymentRequirements[], status?: number, x402V2Requirements?: PaymentRequirementsV2[], x402V2Resource?: string, x402ExactVersions?: X402ExactVersionSupport, x402ErrorCode?: string): Response;
-/** Options for processing an incoming mid-job payment message. */
 interface IncomingPaymentOpts {
     mints?: string[];
     x402Config?: X402Config;
@@ -2288,7 +2176,7 @@ interface IncomingPaymentOpts {
     mpp?: MppxServer;
     /** Resource URL bound into the rebuilt x402 `PaymentRequirements`. */
     resourcePath?: string;
-    /** Cashu receive mode (internal-review). Mirrors {@link UpfrontPaymentOpts.cashuMode}. */
+    /** Cashu receive mode. Mirrors {@link UpfrontPaymentOpts.cashuMode}. */
     cashuMode?: CashuMode;
     /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
     accumulatorDb?: AccumulatorPool;
@@ -2297,28 +2185,28 @@ interface IncomingPaymentOpts {
     dvmId?: string;
     /** Active NUT-11 P2PK lock pubkeys (current + retired-in-grace). */
     lockPubkeys?: LockPubkey[];
-    /** Runtime mint-health tracker (internal-review). */
+    /** Runtime mint-health tracker. */
     mintHealthTracker?: MintHealthTracker;
     /**
-     * Host fx fetcher for the non-sat rails (internal-review). See
+     * Host fx fetcher for the non-sat rails. See
      * {@link UpfrontPaymentOpts.fxFetcher}.
      */
     fxFetcher?: FxFetcher;
     /**
-     * Credit ledger the mid-job top-up funds and grows (internal-review, spec §1:
+     * Credit ledger the mid-job top-up funds and grows (the credit lifecycle contract:
      * "mid-job `requestPayment` becomes a top-up"). Absent ⇒ the payment is
      * accepted with pre-credits semantics, exactly as before.
      */
     creditLedger?: CreditLedgerLike;
     /**
-     * Durable processed-payment markers (internal-review). x402/mpp money moves outside
+     * Durable processed-payment markers. x402/mpp money moves outside
      * dvmkit, so the marker + `fund` + `growDraw` in one transaction is what
      * makes the mid-job ledger leg atomic and crash-replay safe — the cashu path
      * gets the same property from the accumulator's own commit transaction.
      */
     processedPayments?: ProcessedPaymentStore;
     /**
-     * Reporter-owned transactional outbox enqueue (internal-review). Runs inside the
+     * Reporter-owned transactional outbox enqueue. Runs inside the
      * mid-job rail transaction after the ledger top-up/growth and before commit.
      */
     enqueueCreditDeposit?: CreditDepositEnqueue;
@@ -2328,7 +2216,7 @@ interface IncomingPaymentOpts {
     creditTtlMs?: number;
 }
 /**
- * Pure verification of an incoming mid-job payment (internal-review). Runs the
+ * Pure verification of an incoming mid-job payment. Runs the
  * rail-specific verify path and returns the credit shape; does not mutate
  * the job. The caller (`JobManager.processPayment`) applies the result
  * inside Tx C so verify+credit land atomically.
@@ -2341,7 +2229,7 @@ interface VerifyIncomingSnapshot {
     pendingPaymentMsats?: number;
     pendingMppChallengeIds?: string[];
     /**
-     * Per-job x402 binding (internal-review). When set, the incoming `x402_payment`'s
+     * Per-job x402 binding. When set, the incoming `x402_payment`'s
      * decoded `authorization.nonce` must match this value or the credential is
      * rejected — closes the pre-settlement cross-job replay window. Pre-fix
      * DVMs leave this `undefined`; the verify-side check no-ops for them.
@@ -2350,9 +2238,9 @@ interface VerifyIncomingSnapshot {
     /** Exact advertised USDC microunits paired with `pendingX402Nonce`. */
     pendingX402AmountUsdcMicro?: string;
     paymentRail?: FundingMethod;
-    /** The credit the upfront leg funded and drew, when it had one (internal-review). */
+    /** The credit the upfront leg funded and drew, when it had one. */
     creditId?: string;
-    /** The draw this job holds on {@link creditId}; the top-up grows it (internal-review). */
+    /** The draw this job holds on {@link creditId}; the top-up grows it. */
     drawId?: string;
     /**
      * The job's current settlement reference. Used to tell an explicit
@@ -2361,17 +2249,17 @@ interface VerifyIncomingSnapshot {
      * upfront leg established.
      */
     paymentTxHash?: string;
-    /** Fiat envelope pinned when the ask was emitted (internal-review). See `JobRecord`. */
+    /** Fiat envelope pinned when the ask was emitted. See `JobRecord`. */
     pendingPaymentFiatMicro?: number;
     pendingPaymentFiatCurrency?: string;
     /**
      * Everything this job has asked for mid-job, summed and never decremented
-     * (internal-review) — the ceiling on its draw growth. See `JobRecord`, including
+     * the ceiling on its draw growth. See `JobRecord`, including
      * why it can't be derived from the outstanding figure above.
      */
     askedTopUpMicro?: number;
     askedTopUpCurrency?: string;
-    /** Why the total above can't express a ceiling, when it can't (internal-review). */
+    /** Why the total above can't express a ceiling, when it can't. */
     topUpCapUnenforcedReason?: TopUpCapUnenforcedReason;
     /**
      * Caller identity for a top-up that has to mint a *fresh* implicit credit
@@ -2382,7 +2270,6 @@ interface VerifyIncomingSnapshot {
     requesterPubkey?: string;
     requesterId?: string;
 }
-/** Result of `verifyIncomingPayment`. */
 interface VerifiedIncomingPayment {
     paidMsats: number;
     paymentMint?: string;
@@ -2391,21 +2278,21 @@ interface VerifiedIncomingPayment {
     nativeAmount?: number;
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
     cashuFlow?: "p2pk_accumulator";
-    /** True when this credit should accumulate onto an existing same-rail native amount (internal-review). */
+    /** True when this credit should accumulate onto an existing same-rail native amount. */
     sameRail: boolean;
     /**
-     * Credit this top-up opened (internal-review). Only set when the job had none — a
+     * Credit this top-up opened. Only set when the job had none — a
      * free-then-paid job — so Tx C can bind it; a job that already holds a credit
      * keeps its binding, because the top-up grew that draw.
      */
     creditId?: string;
     /** The draw opened alongside {@link creditId}. */
     drawId?: string;
-    /** The funding leg, reported to the platform as a deposit (internal-review). */
+    /** The funding leg, reported to the platform as a deposit. */
     funding?: CreditFundingReport;
     /**
      * Fiat micro this payment funded that the job's draw did not take
-     * (internal-review). See `PaymentInfo.unappliedMicro`. When it equals the whole
+     * See `PaymentInfo.unappliedMicro`. When it equals the whole
      * funding, the payment moved no job counters at all and Tx C is handed a
      * `null` delta.
      */
@@ -2413,7 +2300,7 @@ interface VerifiedIncomingPayment {
 }
 /**
  * Verify an incoming payment without mutating the job. Returns the credit
- * shape on success or an error envelope on failure. internal-review.
+ * shape on success or an error envelope on failure.
  *
  * The rails dispatched on below are the list {@link PAYMENT_PROOF_KEYS}
  * carries — add one here and it must be added there in the same commit.
@@ -2428,27 +2315,27 @@ declare function verifyIncomingPayment(body: {
         status: number;
         /**
          * A short mid-job pay that funded a credit before this request failed
-         * (internal-review) — still a deposit, still reported. See `PaymentErrorDetail`.
+         * still a deposit, still reported. See `PaymentErrorDetail`.
          */
         funding?: CreditFundingReport;
     };
 }>;
 /**
  * Apply a verified payment result to the in-memory job. Used by callers that
- * don't run Tx C (e.g., the legacy isolate-job-manager path). internal-review.
+ * don't run Tx C (e.g., the legacy isolate-job-manager path).
  */
 declare function applyPaymentInfoToJob(job: ServerJob, info: VerifiedIncomingPayment): void;
 /**
  * Process an incoming payment message. Returns an error body on failure.
  *
- * **The isolate-runtime path, and deliberately ledger-less** (spec §3). Its
+ * **The isolate-runtime path, and deliberately ledger-less** (the isolate-runtime rule). Its
  * only caller is `platform/isolate-job-manager.ts`; isolate DVMs have no
  * Postgres of their own, so they run implicit N=1 with today's semantics
  * preserved and never advertise credit. The credits-carrying mid-job path is
  * {@link verifyIncomingPayment} + `JobManager.processPayment` (Tx C), where
- * internal-review wired `fund` + `growDraw`. Wiring a ledger here would need a
+ * wired `fund` + `growDraw`. Wiring a ledger here would need a
  * platform-side ledger leg with its own funding-atomicity and receipt-key
- * story — the trust-surface expansion internal-review exists to decide.
+ * story — the trust-surface expansion exists to decide.
  */
 declare function processIncomingPayment(job: ServerJob, body: {
     type: MessageType;
@@ -2463,22 +2350,22 @@ interface CommittedFunding {
     /** Snapshot fixed immediately after this request's funding leg, before any draw. */
     fundingCredit?: CreditSnapshot;
     /**
-     * Absent for a `/v1/credit` fund-only top-up (internal-review) — money landed on the
+     * Absent for a `/v1/credit` fund-only top-up — money landed on the
      * credit with no job to pay for — for a short mid-job pay, which funds
-     * without drawing or growing (internal-review), and for an explicit short deposit
-     * whose combined balance cannot cover the draw (internal-review). On a mid-job
+     * without drawing or growing, and for an explicit short deposit
+     * whose combined balance cannot cover the draw. On a mid-job
      * top-up this is the **grown** draw, so `amountMicro` is the job's running
      * total, not this leg's contribution.
      */
     draw?: DrawResult;
     /**
      * An explicit short deposit committed, but the combined available balance
-     * could not cover the full-price draw (internal-review). Preserved instead of
+     * could not cover the full-price draw. Preserved instead of
      * thrown so the rail receive and deposit commit atomically with no draw.
      */
     drawRefusal?: CreditLedgerError;
     /**
-     * What this leg added to an already-placed draw (internal-review). Set only on a
+     * What this leg added to an already-placed draw. Set only on a
      * mid-job top-up; the upfront legs contribute the whole draw, so they leave
      * it unset and `draw.railValue` is the same thing.
      */
@@ -2488,7 +2375,7 @@ interface CommittedFunding {
         drawNative: number | null;
     };
     /**
-     * Fiat micro that landed on the credit but grew no draw (internal-review) — a
+     * Fiat micro that landed on the credit but grew no draw — a
      * duplicate payment for an ask already satisfied, the clipped tail of an
      * oversized one, or a payment that arrived after the ask was met. It stays
      * the caller's available balance; `UnappliedCredit` on the 201 is how they
@@ -2503,9 +2390,9 @@ interface CommittedFunding {
  *
  * Exported because the builder-supplied `onCreditFunded` override is a second
  * door onto the same report, and both must say the same thing: hand-rolling the
- * mapping there once dropped the internal-review `tempoChannel` block, so a DVM
+ * mapping there once dropped the `tempoChannel` block, so a DVM
  * reporting through the override registered no channel with the close observer
- * (internal-review). One builder, no drift.
+ * One builder, no drift.
  */
 declare function creditDepositPayload(dvmId: string, funding: CreditFundingReport): CreditDepositPayload;
 /** Finish the local ledger effect retained by a durable exact-settlement intent. */
@@ -2518,7 +2405,6 @@ declare function repairX402ExactSettlementEffect(args: {
     tx?: CreditLedgerQuerier;
 }): Promise<CommittedFunding | undefined>;
 
-/** Everything the issuer needs to sign for one DVM. */
 interface ReceiptIssuerOpts {
     /** 32-byte hex receipt secret — `DVMKIT_RECEIPT_KEY`, or an ephemeral dev key. */
     secret: string;
@@ -2528,7 +2414,7 @@ interface ReceiptIssuerOpts {
     dvmId: string;
 }
 /**
- * Signs job receipts for one DVM (internal-review).
+ * Signs job receipts for one DVM.
  *
  * Constructed only when a receipt key is wired, so the presence of an issuer
  * *is* the "this DVM emits receipts" signal that `/v1/info` advertises. Pure:
@@ -2546,19 +2432,23 @@ declare class ReceiptIssuer {
     constructor(opts: ReceiptIssuerOpts);
     /**
      * Build and sign the receipt for a terminal job. `seq` comes from
-     * `JobStore.claimReceiptSeq`, `issuedAt` defaults to now (tests pin it).
+     * `JobStore.claimReceiptSeq`; `issuedAt` is epoch seconds and defaults to now.
      *
      * Free jobs get receipts too, with `paid.msats: 0` — they still consume a
      * sequence number and still attest an outcome. Whether feedback is
      * paid-only is the feedback layer's call, not this one's.
      *
-     * `credit` is the resolved draw block (internal-review) — present on every job
+     * Timing and attribution come from the committed terminal row, not signing
+     * time or handler input. Legacy rows without those durable inputs omit the
+     * optional blocks rather than inventing historical evidence.
+     *
+     * `credit` is the resolved draw block — present on every job
      * whose payment funded/drew the ledger, absent otherwise. Signature-
      * compatible either way: `canonicalize` omits absent keys.
      */
     issue(record: JobRecord, seq: number, issuedAt?: number, credit?: ReceiptCredit): JobReceipt;
     /**
-     * Countersign one reclaim event (internal-review). Unlike job receipts there is
+     * Countersign one reclaim event. Unlike job receipts there is
      * no store-allocated sequence — the drain's own `ledger_seq` (taken under
      * the credit row lock, shared with draws) already orders it in the
      * per-credit evidence chain.
@@ -2650,13 +2540,9 @@ declare class X402FacilitatorHealth implements X402FacilitatorHealthLike {
     private refreshOnce;
 }
 
-/** Options for creating a JobManager. */
 interface JobManagerOpts {
-    /** Environment variables for ctx.env. */
     env: Record<string, string>;
-    /** KV store for ctx.store. */
     store: KVStore;
-    /** Cashu mints accepted for payment. */
     mints?: string[];
     /** Persistent backing store for job records. Default: in-memory. */
     jobStore?: JobStore;
@@ -2664,7 +2550,6 @@ interface JobManagerOpts {
     devMode?: boolean;
     /** Payment methods this DVM accepts. Default: derived by the server from configured rails. */
     paymentMethods?: PaymentMethod[];
-    /** x402 stablecoin payment configuration. */
     x402?: X402Config;
     /** Durable exact-settlement coordinator shared with upfront verification. */
     x402ExactSettlement?: X402ExactSettlementServer;
@@ -2672,16 +2557,16 @@ interface JobManagerOpts {
     x402FacilitatorHealth?: X402FacilitatorHealthLike;
     /** MPP multi-rail payment handle (built via `createMppFromOpts`). */
     mpp?: MppxServer;
-    /** Cashu receive mode (internal-review). */
+    /** Cashu receive mode. */
     cashuMode?: CashuMode;
-    /** Builder's NUT-11 P2PK lock pubkey (internal-review). Required for accumulator mode. */
+    /** Builder's NUT-11 P2PK lock pubkey. Required for accumulator mode. */
     lockPubkey?: string;
     /** Test-only atomic Cashu backend, supplied by the development host. */
     disposableCashu?: DisposableCashuCommit;
     /** Postgres pool for wallet accumulator persistence. */
     db?: Pool;
     /**
-     * Agent-wallet (internal-review): per-DVM identifier used for the scheduler advisory
+     * Agent-wallet: per-DVM identifier used for the scheduler advisory
      * lock and the `(dvm_id, request_id)` replay key. Defaults to `DVMKIT_DVM_ID`
      * env at boot in `createDVMHost()`.
      */
@@ -2690,18 +2575,18 @@ interface JobManagerOpts {
     authAudience?: SignedRequestAudience;
     /**
      * Shared fx fetcher used to convert USD-string descriptor prices and
-     * fiat-form `requestPayment` calls into sats (internal-review). The SDK server owns
+     * fiat-form `requestPayment` calls into sats. The SDK server owns
      * one per process so concurrent quotes share the 60s cache window.
      */
     fxFetcher: FxFetcher;
     /**
-     * Signs a receipt at every terminal transition (internal-review). Absent when the
+     * Signs a receipt at every terminal transition. Absent when the
      * DVM has no receipt key wired — jobs then terminate exactly as before and
      * `/v1/info` doesn't advertise `receipts`.
      */
     receiptIssuer?: ReceiptIssuer;
     /**
-     * Credit ledger for the terminal funnel (internal-review): a job carrying a
+     * Credit ledger for the terminal funnel: a job carrying a
      * `creditId`/`drawId` settles its draw on success and releases it on
      * failure/cancel — this is how "no debit on job failure" is mechanically
      * real. The resolution runs before receipt issuance so the receipt's
@@ -2709,31 +2594,31 @@ interface JobManagerOpts {
      */
     creditLedger?: CreditLedgerLike;
     /**
-     * Durable processed-payment markers (internal-review), threaded through to the
-     * mid-job top-up path (internal-review) so an x402/mpp payment's marker, `fund`, and
+     * Durable processed-payment markers, threaded through to the
+     * mid-job top-up path so an x402/mpp payment's marker, `fund`, and
      * `growDraw` commit together.
      */
     processedPayments?: ProcessedPaymentStore;
     /**
      * Reporter-owned transactional deposit enqueue threaded into mid-job rail
-     * commits (internal-review).
+     * commits.
      */
     enqueueCreditDeposit?: CreditDepositEnqueue;
-    /** Reporter outbox inserted atomically with a terminal draw release (internal-review). */
+    /** Reporter outbox inserted atomically with a terminal draw release. */
     enqueueCreditDrawRelease?: CreditDrawReleaseEnqueue;
     /** Credit lifetime a top-up mints with, from the DVM's advertised `credit.ttl`. */
     creditTtlMs?: number;
     /**
-     * The DVM's declared pricing currency (internal-review), which is the currency of
+     * The DVM's declared pricing currency, which is the currency of
      * every credit it opens. Threaded into the job context so a mid-job ask on a
      * job that holds no credit yet is still pinned in the denomination its first
-     * payment will open the credit in (internal-review). `DVMServer` passes its resolved
+     * payment will open the credit in. `DVMServer` passes its resolved
      * `pricingCurrency`; a host building a `JobManager` directly falls back to the
      * descriptor, and then to `"usd"`.
      */
     pricingCurrency?: string;
     /**
-     * Callback fired when a mid-job top-up moves money onto a credit (internal-review).
+     * Callback fired when a mid-job top-up moves money onto a credit.
      * The platform books it as a **deposit** — a liability until drawn, never
      * summed into revenue — so a top-up that skipped this would leave the
      * outstanding-liability view short. Mirrors `DVMServer.reportCreditDeposit`,
@@ -2741,7 +2626,7 @@ interface JobManagerOpts {
      */
     onCreditFunded?: (info: CreditDepositPayload) => void | Promise<void>;
     /**
-     * Callback fired when a paid job completes (internal-review). Container-runtime DVMs
+     * Callback fired when a paid job completes. Container-runtime DVMs
      * use this to report revenue to the platform via `RevenueReporter`. Mirrors
      * the isolate path's `IsolateJobManager.opts.onJobCompleted`.
      */
@@ -2773,16 +2658,18 @@ interface JobManagerOpts {
     }) => void | Promise<void>;
     /**
      * Callback fired when a terminal job declared a builder cost but emitted no
-     * revenue report (internal-review). Container-runtime DVMs use the reporter's
+     * revenue report. Container-runtime DVMs use the reporter's
      * durable `job-cost` outbox path. The receiver de-duplicates by DVM + job,
      * independently of the rail-keyed revenue ledger.
      */
     onJobCost?: (info: JobCostReportPayload) => void | Promise<void>;
+    /** SDK-owned hosted terminal outbox callback. */
+    onJobTerminal?: (info: JobTerminalReportPayload) => Promise<void>;
     /**
      * Callback fired when the stale-job reaper force-fails a *paid* job — its
      * pending credit draw is released rather than settled, because only a
-     * completed job settles a draw (internal-review). Container-runtime DVMs wire this
-     * to a paid-job-death report → operator `notice` (internal-review). Never fires for
+     * completed job settles a draw. Container-runtime DVMs wire this
+     * to a paid-job-death report → operator `notice`. Never fires for
      * free jobs (`paidMsats === 0`). Fired fire-and-forget so a throw or a slow
      * report can't wedge the sweep.
      */
@@ -2799,20 +2686,20 @@ interface JobManagerOpts {
     }) => void | Promise<void>;
     /**
      * Callback fired when a settled credit draw cannot book a revenue event
-     * because no usable payment rail is available (internal-review). Container-runtime
+     * because no usable payment rail is available. Container-runtime
      * DVMs auto-wire this to the platform's deduped operator notice. Fired
      * fire-and-forget so alert delivery cannot block terminal handling or draw
      * reconciliation.
      */
     onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
     /**
-     * Stale-job sweep threshold in ms (internal-review). Jobs in a non-terminal status
+     * Stale-job sweep threshold in ms. Jobs in a non-terminal status
      * (`processing` / `working` / `awaiting-input`) whose `lastActivityAt` is
      * older than this are force-cancelled with reason `stale_no_terminal_status`,
      * so callers always reach a terminal status instead of polling forever after
      * a worker crash, OOM, or silent `messageAppender` failure. Default:
-     * `2 × descriptor.idleTimeout + STALE_JOB_WATCHDOG_HEADROOM_MS`, matching
-     * the internal-review acceptance criterion against scrape's `JOB_TIMEOUT_MS`.
+     * `2 × descriptor.idleTimeout + STALE_JOB_WATCHDOG_HEADROOM_MS`, which keeps
+     * the default beyond scrape's `JOB_TIMEOUT_MS`.
      * Builders whose per-handler wall-clock bound exceeds 90s must override
      * this — otherwise the watchdog fires on a legitimate in-flight handler.
      * Set to `0` to disable (test seam).
@@ -2824,7 +2711,7 @@ interface JobManagerOpts {
      */
     staleJobSweepIntervalMs?: number;
     /**
-     * Worker-liveness watchdog in ms (internal-review). Jobs in `processing`/`working`
+     * Worker-liveness watchdog in ms. Jobs in `processing`/`working`
      * whose `lastActivityAt` is older than this are marked `failed` (dead
      * worker), separately from the longer `awaiting-input` idle timeout above.
      * Default: `descriptor.processingWatchdog * 1000` or
@@ -2834,15 +2721,15 @@ interface JobManagerOpts {
     /**
      * Interval at which locally-active `processing`/`working` jobs have their
      * `lastActivityAt` bumped so the processing watchdog only fires on a truly
-     * dead worker (internal-review). Default: `DEFAULT_HEARTBEAT_INTERVAL_MS`. Set to
-     * `0` to disable (test seam). Also floors how far the internal-review clock guard
+     * dead worker. Default: `DEFAULT_HEARTBEAT_INTERVAL_MS`. Set to
+     * `0` to disable (test seam). Also floors how far the clock guard
      * may compensate a backwards step on the processing arm — a cadence close to
      * `processingWatchdogMs` leaves it no room and it compensates nothing.
      */
     heartbeatIntervalMs?: number;
     /**
      * Age in ms at which a `pending` credit draw whose `job_id` matches no row in
-     * the job store is released as orphaned (internal-review). The draw commits before
+     * the job store is released as orphaned. The draw commits before
      * the job row is persisted, so a crash or a fail-closed refusal in that
      * window strands a hold no terminal path can ever reach. Must stay
      * comfortably above the submit path's draw→persist latency. Set to `0` to
@@ -2853,7 +2740,7 @@ interface JobManagerOpts {
     orphanDrawAgeMs?: number;
     /**
      * Age in ms at which a `pending` credit draw whose job row **is** terminal is
-     * reconciled against that row's outcome (internal-review) — settled for a
+     * reconciled against that row's outcome — settled for a
      * `completed` job, released for a `failed`/`cancelled` one. Covers the hole
      * `orphanDrawAgeMs` cannot: `resolveCreditDraw` throwing on a ledger error
      * leaves a terminal job whose hold no later path retries.
@@ -2861,7 +2748,7 @@ interface JobManagerOpts {
      * Rides the same scan as the orphan arm, which has two consequences for the
      * value you set here. Setting `orphanDrawAgeMs` to `0` disables this arm too.
      * And the effective gate is `max(orphanDrawAgeMs, terminalDrawReconcileAgeMs)`
-     * — the scan never returns a row younger than its own cutoff, so anything
+     * the scan never returns a row younger than its own cutoff, so anything
      * below `orphanDrawAgeMs` is silently clamped up to it. That floor is
      * deliberate rather than a wart: honouring a narrower value would mean
      * widening the scan, which hands the orphan arm rows younger than
@@ -2900,7 +2787,7 @@ interface JobManagerOpts {
     /**
      * Grace window in ms a reactivating machine waits for a live original handler
      * to win the single-execution claim before replaying an `awaiting-input` job
-     * itself (internal-review). Default: `DEFAULT_REACTIVATION_CLAIM_GRACE_MS`. Widen if
+     * itself. Default: `DEFAULT_REACTIVATION_CLAIM_GRACE_MS`. Widen if
      * cross-machine NOTIFY latency causes spurious double executions; lower in
      * tests for speed.
      */
@@ -2908,7 +2795,7 @@ interface JobManagerOpts {
 }
 type ResolvedInput<I extends ZodLike | undefined> = I extends ZodLike<infer O> ? O : string;
 /**
- * A deposit this payment funded that the job row did **not** take (internal-review).
+ * A deposit this payment funded that the job row did **not** take.
  *
  * Reached when two mid-job top-ups race on a free-then-paid job: each opens its
  * own implicit credit, and `verifyAndCredit`'s set-if-null bind keeps one. The
@@ -2958,12 +2845,13 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private readonly cleanupTimers;
     /** Cost revisions held only by a terminal handler owner until its durable merge succeeds. */
     private readonly terminalCostHandoffRetryTimers;
-    /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
+    /** Per-job NOTIFY unsubscribe handles for the durable-status watch. */
     private readonly statusWatchers;
-    /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
+    /** Job ids whose durable-status re-read is in flight — coalesces notify storms. */
     private readonly statusChecksInFlight;
-    /** Job ids that were notified mid-re-read and must be re-checked (internal-review). */
+    /** Job ids that were notified mid-re-read and must be re-checked. */
     private readonly statusChecksQueued;
+    private readonly inputResumeTails;
     private readonly sessionId;
     private nextJobId;
     private accumulatorMonitor?;
@@ -2971,7 +2859,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private readonly processingWatchdogMs;
     private readonly reactivationClaimGraceMs;
     /**
-     * Worker-heartbeat cadence (internal-review). Also floors the internal-review clock
+     * Worker-heartbeat cadence. Also floors the clock
      * guard's compensation on the processing arm — see
      * {@link staleSweepCompensationCapMs}.
      */
@@ -2991,7 +2879,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private jobRetentionResumeFrom?;
     /**
      * A `Date.now()` reading that cannot regress within this manager's lifetime
-     * (internal-review). Anchored at construction, so a manager already running when
+     * Anchored at construction, so a manager already running when
      * the clock stepped is covered. The stale-job sweep's two cutoffs, the
      * orphan-draw age gate and the reactivation claim grace all read it; see
      * {@link createMonotonicClock} for what it costs and where it is clamped.
@@ -3004,18 +2892,16 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private jobRetentionSweepInFlight;
     private heartbeatInFlight;
     /**
-     * The denomination of every credit this DVM opens (internal-review). Resolved once,
+     * The denomination of every credit this DVM opens. Resolved once,
      * with the same boundary fallback `DVMServer` applies for direct JavaScript
      * callers that force an incomplete value past the descriptor contract.
      */
     private readonly pricingCurrency;
     constructor(descriptor: DVMDescriptor<State, InputSchema>, opts: JobManagerOpts);
-    /** Active in-memory jobs. */
     get activeJobs(): Map<string, ServerJob>;
-    /** The backing job store. */
     get store(): JobStore;
     /**
-     * True when this DVM will actually issue receipts (internal-review) — a key *and*
+     * True when this DVM will actually issue receipts — a key *and*
      * a store that can allocate sequence numbers and persist bytes write-once.
      * `/v1/info#receipts` reads this rather than the key alone, so the flag can
      * never promise something `issueReceipt` silently declines to do.
@@ -3026,7 +2912,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /** Names of every capability this descriptor exposes — used for error envelopes. */
     capabilityNames(): string[];
     /**
-     * Resolve a capability's static `price` to msats (internal-review).
+     * Resolve a capability's static `price` to msats.
      *
      * `"$X.XX"` is parsed as USD and converted via the SDK's shared fx fetcher.
      * Returns `undefined` for dynamic-priced capabilities (those that declare
@@ -3035,7 +2921,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     currentPriceMsats(capability: string): Promise<number | undefined>;
     /**
      * Translate a capability's static `price` into the fiat envelope used by
-     * the per-capability `pricing.max` advertised on `/v1/info` (internal-review).
+     * the per-capability `pricing.max` advertised on `/v1/info`.
      * Returns `undefined` for dynamic-priced capabilities and for unknown
      * names (the route handler validates the name before invoking this).
      */
@@ -3044,24 +2930,24 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         currency: string;
     } | undefined;
     /**
-     * Parse a request body through a capability's input schema (internal-review).
+     * Parse a request body through a capability's input schema.
      *
      * Resolution order when a capability declares an `input` schema:
      * 1. `body.data` is preferred — agents pass structured fields directly
-     *    (CLI builds this from `--param k=v`).
+     * (CLI builds this from `--param k=v`).
      * 2. Fallback: `JSON.parse(body.input)` for clients still on the legacy
-     *    JSON-string contract.
+     * JSON-string contract.
      * 3. Neither usable → throw `MissingStructuredInputError` so the route can
-     *    return `invalid_input` with a hint pointing at `/v1/info`.
+     * return `invalid_input` with a hint pointing at `/v1/info`.
      *
      * When the capability has no `input` schema, returns `body.input` raw
      * (primitive path).
      *
-     * The internal-review credit envelope is removed before the schema runs, on both
-     * branches (internal-review) — it rides the signed body but is protocol-level, so a
+     * The credit envelope is removed before the schema runs, on both
+     * branches — it rides the signed body but is protocol-level, so a
      * top-level `.strict()` capability schema would otherwise reject every
      * explicit draw as an unknown key, before the envelope was even extracted.
-     * The persisted `record.input` the internal-review reactivation path re-reads is the
+     * The persisted `record.input` the reactivation path re-reads is the
      * pre-Zod wire form, so it comes through the second branch carrying them too.
      */
     parseInput(body: {
@@ -3069,7 +2955,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         data?: unknown;
     }, capability: string): unknown;
     /**
-     * Look up the per-capability descriptor by name (internal-review). Throws when the
+     * Look up the per-capability descriptor by name. Throws when the
      * name doesn't exist — the route layer validates body.capability first, so
      * reaching this with an unknown name is a programmer error.
      */
@@ -3083,7 +2969,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private getCapability;
     /**
-     * Allocate the id the next job will be created under (internal-review). The
+     * Allocate the id the next job will be created under. The
      * submit path calls this BEFORE payment verification so the ledger draw
      * commits with its job linkage, then passes the id back through
      * `createJob`'s provenance. Ids allocated for requests whose payment is
@@ -3092,7 +2978,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     allocateJobId(): string;
     /**
-     * Create a new job from a request body. `provenance` (internal-review) is what the
+     * Create a new job from a request body. `provenance` is what the
      * idempotent-replay path on `POST /v1/job` reads back: the raw `job_token`
      * to re-issue, and the fingerprint + caller pubkey a retry must reproduce
      * to be given it.
@@ -3107,32 +2993,32 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         requestId?: string;
         authRequestPath?: string;
         /**
-         * Pre-allocated id from {@link allocateJobId} (internal-review) — the submit
+         * Pre-allocated id from {@link allocateJobId} — the submit
          * path allocates before payment verification so the ledger draw can
          * record the job it pays for.
          */
         jobId?: string;
     }): ServerJob;
-    /** Build an SDKJobContext and attach it to the job. */
     buildAndAttachContext(job: ServerJob, parsedInput: unknown): SDKJobContext<State, ResolvedInput<InputSchema>>;
-    /** Start the handler for a job. */
     runHandler(job: ServerJob, sdkCtx: SDKJobContext<unknown, unknown>): void;
-    /** Dispatch a validated incoming message to the appropriate handler or pending resolver. */
     dispatchMessage(job: ServerJob, type: MessageType, content: unknown): Promise<void>;
+    private queueInputResume;
+    private claimLocalInput;
+    private dispatchMessageNow;
     /**
      * Persist a job to the backing store.
      *
-     * Awaits the per-job appender tail (internal-review) so that:
-     *   1. The snapshot's `messages` is consistent with the `job_messages` table
-     *      — no row is still in flight at snapshot time.
-     *   2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
-     *      can't race a still-pending `appendOutgoing` for the final yield
-     *      message (which would otherwise wipe the row before an in-flight SSE
-     *      subscriber's NOTIFY-driven fetch can see it).
+     * Awaits the per-job appender tail so that:
+     * 1. The snapshot's `messages` is consistent with the `job_messages` table
+     * no row is still in flight at snapshot time.
+     * 2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
+     * can't race a still-pending `appendOutgoing` for the final yield
+     * message (which would otherwise wipe the row before an in-flight SSE
+     * subscriber's NOTIFY-driven fetch can see it).
      */
     persistJob(job: ServerJob): Promise<void>;
     /**
-     * Cross-machine terminal guard (internal-review). `buildContext`'s guard reads the
+     * Cross-machine terminal guard. `buildContext`'s guard reads the
      * in-memory `job.status`, so on its own it only protects the machine running
      * the handler. On a multi-machine DVM a `DELETE /v1/job/:id` routinely lands
      * on a machine that isn't running the job — `app.ts` cancels it in the store
@@ -3144,7 +3030,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * fires `job.abort` so in-flight `ctx.fetch` calls tear down. Returns true when
      * the durable state won and the caller must skip its save.
      *
-     * Two triggers: `watchDurableStatus`'s NOTIFY subscription (internal-review) fires
+     * Two triggers: `watchDurableStatus`'s NOTIFY subscription fires
      * this within a round-trip of the remote cancel committing, which is what
      * actually stops the provider spend; `persistJob` calls it again on every save
      * as the backstop for the window where a cancel commits between a handler's
@@ -3163,7 +3049,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /** Durably merge a terminal handler owner's latest cost before reporting it. */
     private persistAdoptedTerminalCost;
     /**
-     * Watch the durable status of a locally-active job (internal-review).
+     * Watch the durable status of a locally-active job.
      *
      * `ctx.signal` is raised by `dispatchMessage`, which only runs on the machine
      * holding the job in `activeJobs`. On a multi-machine DVM the `DELETE` usually
@@ -3181,30 +3067,30 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private watchDurableStatus;
     /**
-     * Tear down a job's durable-status subscription (internal-review). Must be called
+     * Tear down a job's durable-status subscription. Must be called
      * wherever a job leaves `activeJobs` — a leaked subscriber outlives the job on
      * the store's shared LISTEN connection. Idempotent.
      */
     unwatchDurableStatus(jobId: string): void;
     /**
-     * NOTIFY-driven durable-status re-read, coalesced per job (internal-review).
+     * NOTIFY-driven durable-status re-read, coalesced per job.
      *
      * A notify that arrives while a re-read is in flight is queued rather than
      * dropped: the in-flight read may have observed the row a moment *before* the
-     * cancel committed, and dropping its notify would put the abort back where
-     * this issue found it — waiting for the handler's next store write.
+     * cancel committed, and dropping its notify would leave the local handler
+     * running until its next store write instead of aborting promptly.
      */
     private checkDurableTerminal;
     /**
      * Wire the Tx A appender when the store supports streaming.
      *
-     * Tx A (internal-review): outgoing message + `pending_payment_msats` bump land in
+     * Tx A: outgoing message + `pending_payment_msats` bump land in
      * the same transaction. The DB allocates the row's seq via
      * `UPDATE jobs SET next_seq = next_seq + 1 RETURNING` so concurrent inbound
      * traffic on different machines can never collide on the `(job_id, seq)` PK.
      * In-memory `job.seq` keeps its own counter for same-machine SSE listeners.
      *
-     * Per-job serialisation (internal-review): chained through `job.messageAppenderTail`
+     * Per-job serialisation: chained through `job.messageAppenderTail`
      * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
      * `complete`) commit their `appendOutgoing` transactions in call order.
      * Without this, the two transactions race for the `jobs` row lock and the
@@ -3219,15 +3105,15 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     startIdleTimer(job: ServerJob): void;
     /** Clear the idle timer for a job. */
     clearIdleTimer(id: string): void;
-    /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard (internal-review). */
+    /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard. */
     cancelJobIdle(job: ServerJob): Promise<void>;
     /**
      * Force-terminate stale non-terminal jobs. Two status-aware arms:
-     *   • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
-     *     (`stale_no_terminal_status`) — the caller never paid / responded.
-     *   • `processing`/`working` past `processingWatchdogMs` → `failed`
-     *     (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
-     *     live workers fresh, so a stale row here means a dead process.
+     * • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
+     * (`stale_no_terminal_status`) — the caller never paid / responded.
+     * • `processing`/`working` past `processingWatchdogMs` → `failed`
+     * (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
+     * live workers fresh, so a stale row here means a dead process.
      *
      * Fires on a timer (wired in the constructor) and also callable on demand
      * (tests, ops). The CAS in `cancelStaleJob` makes this safe to run
@@ -3236,17 +3122,17 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * descriptors — the local activeJobs teardown only makes sense on the
      * JobManager that actually hosted the zombie handler.
      *
-     * **Both cutoffs float off the wall clock (internal-review).** Each is one
+     * **Both cutoffs float off the wall clock.** Each is one
      * `Date.now()` sample compared against `last_activity_at`, stamped from a
      * different sample at a different moment, so a backwards step between the
      * two makes every row look more recently active than it is: the query
      * matches nothing and both arms go silent for the length of the skew. The
      * dead worker's job keeps its `processing` status, its credit hold stays
-     * `pending`, and the internal-review paid-job-death alert — wired to this reaper —
-     * never fires. Same defect, same host class, as internal-review's orphan sweep.
+     * `pending`, and the paid-job-death alert — wired to this reaper —
+     * never fires. Same defect, same host class, as orphan sweep.
      *
      * **The compensation is capped** — see {@link staleSweepCompensationCapMs}
-     * for where each arm's cap comes from — which internal-review did not need to do. Its eagerness costs at worst an early release
+     * for where each arm's cap comes from — which did not need to do. Its eagerness costs at worst an early release
      * of an unclaimed hold, refused outright for any live job row; ours
      * force-*fails* a running job. `cancelStaleJob`'s CAS does not cover that:
      * `expectedActivityBefore` is the same compensated threshold the query used,
@@ -3278,7 +3164,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     }>;
     /**
      * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
-     * clock to cover a backwards step (internal-review). The compensation is capped,
+     * clock to cover a backwards step. The compensation is capped,
      * not free: a claimed row must still have been silent for
      * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
      * force-fails a job that may well be alive.
@@ -3298,7 +3184,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * clock stepped. That pair is marginal already; the guard must not make it
      * deterministic. The cap collapses to zero there, which is today's
      * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
-     * — nothing heartbeats it by design, and its refresh is an inbound caller
+     * nothing heartbeats it by design, and its refresh is an inbound caller
      * message on no cadence at all.
      *
      * **Why a magnitude and not a predicate.** The tempting sharper rule is to
@@ -3335,7 +3221,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * Resolve `pending` credit draws the terminal funnel can no longer reach.
      * Two arms over one scan, distinguished by whether the draw's job row exists.
      *
-     * **No job row (internal-review) — release.** internal-review allocates the job id and
+     * **No job row — release.** allocates the job id and
      * commits the ledger draw, with its `job_id` linkage, before `recordReplay`
      * and `persistJob` write the job row. A crash, a `draw_conflict` 409, or a
      * fail-closed `replay_detected` 401 in that window leaves a committed hold
@@ -3345,12 +3231,12 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * available balance stays reduced forever. Cosmetic for an implicit N=1
      * credit, a silent balance shrink for an explicit N>1 one.
      *
-     * **Terminal job row (internal-review) — reconcile to its outcome.** The funnel
+     * **Terminal job row — reconcile to its outcome.** The funnel
      * demonstrably fails: `resolveCreditDraw` throws on a ledger/DB error,
      * `issueReceipt` catches it, logs `credit_resolve_failed` and returns
      * nothing, and until now nothing retried. Same stranded hold, reached through
      * a different door — and for a `completed` job it strands the platform's
-     * books too, since draws *are* the revenue events (internal-review): the caller is
+     * books too, since draws *are* the revenue events: the caller is
      * charged nothing, the balance never moves, and outstanding liability
      * (`deposits − draw revenue`) overstates forever. So a late settle books, off
      * the committed draw row, through the ordinary reporter path.
@@ -3377,8 +3263,8 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         reconciled: number;
     }>;
     /**
-     * The end-of-scan line for a tick that resolved nothing (internal-review, extended
-     * by internal-review). Two shapes are worth a warning, and neither is the ordinary
+     * The end-of-scan line for a tick that resolved nothing. Two shapes are
+     * worth a warning, and neither is the ordinary
      * one — the timer runs every 5 minutes per ledger in production.
      *
      * `examined > 0`: aged candidates were looked at and none moved. Usually
@@ -3387,7 +3273,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      *
      * `examined === 0`: the query returned nothing. Ordinarily that means there
      * is nothing to do — but it is equally what a blinded scan looks like, which
-     * is the case the internal-review gate could not reach. Probe for the oldest
+     * is the case the gate could not reach. Probe for the oldest
      * `pending` hold at any age and speak up when one exists the scan should
      * have seen and didn't: already past the age gate outright, stamped ahead of
      * our clock (some other process's clock is fast), or hidden while our own
@@ -3400,7 +3286,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private reportSweepOutcome;
     /**
-     * Resolve one aged `pending` draw whose job row reached terminal (internal-review),
+     * Resolve one aged `pending` draw whose job row reached terminal,
      * mirroring what `resolveCreditDraw` would have done in line. Returns true
      * when this call is the one that moved the draw — the caller counts it, and
      * only it books.
@@ -3434,7 +3320,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /**
      * Refresh `lastActivityAt` for jobs this process is actively running
      * (`processing`/`working`) so the processing watchdog only fires once the
-     * worker is genuinely dead (internal-review). `awaiting-input` jobs are
+     * worker is genuinely dead. `awaiting-input` jobs are
      * deliberately excluded — their idle timeout must still elapse. Fires on the
      * heartbeat timer; also callable on demand for tests.
      */
@@ -3442,15 +3328,15 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         beat: number;
     }>;
     /**
-     * Single-execution claim for a reactivating machine (internal-review). Before
+     * Single-execution claim for a reactivating machine. Before
      * replaying an `awaiting-input` job, wait a bounded grace window for a live
      * original handler to win the `awaiting-input → processing` CAS via its
      * NOTIFY wake. Resolves:
-     *   • `false` — the row left `awaiting-input` during the window (the original
-     *     handler claimed it / drove it terminal). Stand down; do not replay.
-     *   • `true`  — the window elapsed still `awaiting-input` (the original worker
-     *     is gone or has no live resolver) AND this machine won the claim CAS.
-     *     Replay for dead-worker recovery.
+     * • `false` — the row left `awaiting-input` during the window (the original
+     * handler claimed it / drove it terminal). Stand down; do not replay.
+     * • `true` — the window elapsed still `awaiting-input` (the original worker
+     * is gone or has no live resolver) AND this machine won the claim CAS.
+     * Replay for dead-worker recovery.
      *
      * Biasing the original handler to win kills the double execution (double
      * substrate spend, clobbered artifact) without heartbeating `awaiting-input`
@@ -3459,7 +3345,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     claimAwaitingInputForReactivation(jobId: string): Promise<boolean>;
     /**
-     * Record an inbound client message durably via Tx B (internal-review) and append
+     * Record an inbound client message durably via Tx B and append
      * it to the in-memory `job.messages` array. Returns the DB-allocated seq
      * (`null` when the store isn't streamable — non-Postgres test fallback).
      *
@@ -3478,13 +3364,13 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * in-memory `ServerJob`, wires the appender, builds the context, starts
      * the idle timer. The caller has already recorded the inbound via Tx B
      * and run Tx C (verify + credit); reactivation is now decoupled from
-     * credit (internal-review, internal-review). The caller decides whether to run the
+     * credit. The caller decides whether to run the
      * handler (Pattern A: status was `awaiting-input`) or to dispatch the
      * message to a custom handler (Pattern B).
      *
      * For DVMs that declare descriptor-level auth, the persisted
      * `record.input` carries the original signed envelope. We re-verify the
-     * signature here (internal-review) so a DB-layer tamper — compromised admin, SQL
+     * signature here so a DB-layer tamper — compromised admin, SQL
      * injection, malicious operator with DB access — can't silently feed an
      * attacker-supplied pubkey/envelope into the handler. The drift window
      * and replay store are deliberately skipped: the persisted timestamp is
@@ -3498,7 +3384,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * What gets re-verified is the persisted row read back through
      * {@link signedRequestInput} — `app.ts` stores the pre-Zod wire form, so
      * those are the caller's own signed bytes, the same ones `/v1/quote` and the
-     * submit checked (internal-review). That makes the tamper check strictly stronger
+     * submit checked. That makes the tamper check strictly stronger
      * than the parsed form it replaced: an injected key the capability schema
      * doesn't declare used to be stripped before the signature was checked, so
      * it re-verified clean.
@@ -3508,7 +3394,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         sdkCtx: SDKJobContext<unknown, unknown>;
     };
     /**
-     * Verify an inbound payment and apply the credit via Tx C (internal-review).
+     * Verify an inbound payment and apply the credit via Tx C.
      * The inbound message must have been recorded via Tx B already
      * (`recordInboundPending` returned `inboundSeq`). For non-streamable
      * stores (`inboundSeq === null`), falls back to in-memory mutation via
@@ -3518,12 +3404,12 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * `pendingPaymentMsats` without external verification. Gated on
      * `devModeSkipsPaymentVerification` — the same predicate the upfront path
      * reads, so a dev server wired to a mint verifies mid-job payments for real
-     * (internal-review) — plus the explicit `dev_auto` opt-out the dev console uses,
+     * plus the explicit `dev_auto` opt-out the dev console uses,
      * which is the one caller that has no wallet to pay from. `dev_auto` loses to
      * any proof riding the same message: money on the wire always takes the rail,
      * so the flag can never leave a real token unspent against a credited job.
      *
-     * Tx C is not atomic with the rail commit (internal-review). `verifyIncomingPayment`
+     * Tx C is not atomic with the rail commit. `verifyIncomingPayment`
      * commits the proofs *and* the ledger leg in one transaction and returns;
      * only then does `verifyAndCredit` write the job row, on its own connection.
      * Everything after that call therefore runs with the caller's money already
@@ -3539,7 +3425,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         mintHealthTracker?: MintHealthTracker;
     }): Promise<ProcessPaymentOutcome>;
     /**
-     * Tx C with a bounded retry (internal-review).
+     * Tx C with a bounded retry.
      *
      * By the time this runs on the verified path, the rail commit and the ledger
      * leg have already committed in a transaction this call is not part of — so a
@@ -3573,7 +3459,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private creditInbound;
     /**
      * Answer a payment whose rail and ledger legs committed but whose job row
-     * could not be written (internal-review) — every retry spent, the money real.
+     * could not be written — every retry spent, the money real.
      *
      * The refusal names the credit the money landed on so the caller can act on
      * it directly, mirroring the short mid-job pay's 402 (`payment.ts`). It is a
@@ -3582,7 +3468,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * fault an operator should see in their 5xx rate. `retryable` is true because
      * the ask is genuinely still outstanding.
      *
-     * Nothing is released here. The hold is left to the internal-review reconciler,
+     * Nothing is released here. The hold is left to the reconciler,
      * which makes the same decision — unbound draw ⇒ release, never settle — but
      * under the credit row's `FOR UPDATE`, after the job is terminal, where it
      * cannot race an in-flight COMMIT. Releasing from here would also be
@@ -3605,23 +3491,23 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private reportUnappliedPayment;
     /**
      * Describe a deposit the job row never took, in the shape both the 201 and
-     * the `payment_unapplied` 500 carry (internal-review). `undefined` when the payment
+     * the `payment_unapplied` 500 carry. `undefined` when the payment
      * ran ledger-less (no credit ledger wired, or the top-up preflight skipped) —
      * there is no credit to name, so the 201 carries no `credit` block and the
      * 500 takes its words from `unappliedCopy` directly.
      */
     private unappliedCredit;
-    /** Book a mid-job top-up's funding as a deposit (internal-review, spec §10). */
+    /** Book a mid-job top-up's funding as a deposit (the deposit-accounting rule). */
     private reportCreditDeposit;
     /**
      * Internal: build the BuildContextOpts shared between `createJob` and
      * `reactivateJob`. Centralised so persistence/terminal callbacks and the
-     * internal-review NOTIFY-driven cross-machine wake stay in one place.
+     * NOTIFY-driven cross-machine wake stay in one place.
      */
     private buildContextOpts;
     /**
      * Internal: what unit `ctx.requestPayment`'s auto-credit gate may measure this
-     * job's remaining pool in (internal-review).
+     * job's remaining pool in.
      *
      * The regime is read off the DRAW, never off the job. Implicit N=1 is exactly
      * `credit_id === imp:<rail>:<draw_id>`, because `fundAndDraw` derives both
@@ -3639,15 +3525,14 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * drew and whose pool this can't read or denominate answers `unpriced`, which
      * the gate declines to auto-credit from: the msat figure it would otherwise
      * fall back on is a slice of the credit's rail value at a ratio pinned
-     * whenever that credit was funded, which is the exact figure this issue exists
-     * to stop spending against.
+     * whenever that credit was funded, so it cannot safely fund a new ask.
      */
     private resolveDrawPool;
     /** Internal: structured warn for the one path that can't price a drawn job's pool. */
     private warnDrawPool;
     /**
      * Issue the signed receipt for a job that has reached a terminal status
-     * (internal-review). Idempotent and safe to call from every terminal path — the
+     * Idempotent and safe to call from every terminal path — the
      * store owns both the sequence allocation and the write-once persist, so
      * two machines racing on the same job converge on identical bytes and burn
      * exactly one sequence number.
@@ -3663,10 +3548,10 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /** Build the common settle/release args, adding the hosted release outbox when wired. */
     private drawResolutionArgs;
     /**
-     * Settle or release a terminal job's credit draw (internal-review): `completed`
+     * Settle or release a terminal job's credit draw: `completed`
      * settles (the hold becomes a real debit); `failed`/`cancelled` releases
      * (the hold evaporates — "no debit on job failure", mechanically
-     * superseding the internal-review/974 no-op refund for credit-paid jobs, including
+     * superseding the 974 no-op refund for credit-paid jobs, including
      * the `ctx.fail` path and the stale-sweeper reap). Idempotent — a replayed
      * resolution returns the recorded state. Returns the `ReceiptCredit` block
      * for the receipt: `balance_after` is the recorded draw trajectory for a
@@ -3674,7 +3559,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private resolveCreditDraw;
     /**
-     * The one place a terminal job's status becomes a ledger verb (internal-review):
+     * The one place a terminal job's status becomes a ledger verb:
      * `completed` settles the hold into a real debit, `failed`/`cancelled`
      * release it. Read by the in-line funnel (`resolveCreditDraw`) and by the
      * late reconciler (`reconcileTerminalDraw`) — two paths that must never
@@ -3688,32 +3573,26 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private attachReceipt;
     /**
-     * Read-path repair for a terminal job carrying no receipt (internal-review), for
+     * Read-path repair for a terminal job carrying no receipt, for
      * either an in-memory job or a store record. Free in the steady state — it
      * returns on the `receipt` check without touching the store — so it costs
      * only on the cases it exists for:
      *
      * - **A crash between the two store calls.** `claimReceiptSeq` commits the
-     *   sequence number to the job row before `saveReceipt` writes the bytes; a
-     *   process death in that window would otherwise strand that number
-     *   forever, and a permanent gap is indistinguishable from the deliberate
-     *   suppression `seq` exists to expose. Re-issuing here reuses the already
-     *   committed number (the claim is idempotent per job) rather than
-     *   allocating a second one.
+     * sequence number to the job row before `saveReceipt` writes the bytes; a
+     * process death in that window would otherwise strand that number
+     * forever, and a permanent gap is indistinguishable from the deliberate
+     * suppression `seq` exists to expose. Re-issuing here reuses the already
+     * committed number (the claim is idempotent per job) rather than
+     * allocating a second one.
      * - **A transient store failure** at the terminal: `issueReceipt` logs
-     *   `receipt_issue_failed` and returns nothing rather than failing the job,
-     *   so the next read retries.
+     * `receipt_issue_failed` and returns nothing rather than failing the job,
+     * so the next read retries.
      * - **Jobs that terminated before the DVM had a receipt key.** They pick one
-     *   up on first read, with `issued_at` reflecting when it was signed.
+     * up on first read, with `issued_at` reflecting when it was signed.
      */
     ensureReceipt(target: ServerJob | JobRecord): Promise<void>;
-    /**
-     * Close out a terminal job whose caller hasn't already persisted it: sign
-     * the receipt, then save the snapshot. The snapshot save never writes the
-     * receipt column, so ordering only affects how soon a reader sees the
-     * receipt — this way a caller polling immediately after the terminal
-     * already finds it.
-     */
+    /** Commit the terminal snapshot before resolving money and signing its durable evidence. */
     private finalizeTerminal;
     /**
      * Issue a receipt for a job this process doesn't hold in `activeJobs` — a
@@ -3724,9 +3603,12 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     issueReceiptForStoredJob(jobId: string): Promise<JobReceipt | undefined>;
     /**
      * Finish accounting for a terminal written directly to the store — the
-     * stale reaper and a cancel handled on a different machine (internal-review).
+     * stale reaper and a cancel handled on a different machine.
      */
     finalizeStoredTerminal(jobId: string): Promise<JobReceipt | undefined>;
+    private reportTerminalJob;
+    private terminalReportRecoveryCursor?;
+    private recoverTerminalReports;
     /** Handle job reaching terminal state (completed, failed, cancelled). */
     private handleJobTerminal;
     /**
@@ -3744,11 +3626,11 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /** Report the latest declared-cost state only when no revenue event carried it. */
     private reportJobCost;
     /**
-     * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
+     * Report a completed paid job's revenue under its durable job identity.
      * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
      *
      * For a **credit-backed** job the revenue event is the *settled draw* (spec
-     * §10), and since internal-review the sats figure corrects the job's mirror of that
+     * §10), and since the behavior was introduced the sats figure corrects the job's mirror of that
      * draw against the draw itself: `withDrawBasis` stamps the job when the
      * payment lands, but a Bitcoin credit's settle re-prices the draw against
      * the funding lots it consumed. The correction is a delta, because a job's
@@ -3763,7 +3645,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * whose price couldn't be fiat-denominated) nothing changes: the pre-credits
      * payload is reported verbatim.
      *
-     * Takes the fields rather than a `ServerJob` so the internal-review reconciler — a
+     * Takes the fields rather than a `ServerJob` so the reconciler — a
      * background sweep that holds no in-process job — books through this exact
      * path off the row it read. `paymentTxHash` is passed **verbatim**, never
      * recomputed as a `drawSettlementRef`: it is the same column the in-line
@@ -3780,7 +3662,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * DVM with no reporter). Every drop that costs a booking logs first.
      *
      * The rail check sits **below** the draw re-read, not in the entry guard
-     * (internal-review): a settled draw the terminal can't report under is a real debit
+     * a settled draw the terminal can't report under is a real debit
      * with no revenue event, permanently overstating outstanding liability
      * (`deposits − draw revenue`), and it used to return here in silence. Placed
      * after the re-read, `revenue_skipped_no_rail` can name the draw and its
@@ -3801,7 +3683,7 @@ interface LightningRailHealth {
     refresh?(): Promise<void>;
 }
 
-/** Builder-facing wiring for the Lightning receive leg (internal-review). */
+/** Builder-facing wiring for the Lightning receive leg. */
 interface LightningReceiveConfig {
     /**
      * Receive-only NWC connection URI (`DVMKIT_NWC_RECEIVE_URI`). Validated at
@@ -3835,27 +3717,26 @@ interface LightningReceiveConfig {
 declare const DEFAULT_INVOICE_TTL_SECONDS = 900;
 /**
  * Floor on the invoice lifetime: twice the signed-request drift window, so the
- * bolt11 always outlives the funding negotiation that produced it (the issue's
- * "invoice expiry ≥ the funding-negotiation window"). A shorter one would
+ * bolt11 always outlives the funding negotiation that produced it. A shorter one would
  * expire inside the caller's own retry budget and strand them mid-top-up.
  */
 declare const MIN_INVOICE_TTL_SECONDS = 600;
 /**
- * The builder-side Lightning receive leg (internal-review, credits spec §4).
+ * The builder-side Lightning receive leg for funding prepaid credit.
  *
  * Issues a bolt11 over a **receive-only** NWC connection while the DVM is
  * awake serving the 402, and credits the ledger when a later request observes
  * settlement. Two properties are load-bearing:
  *
  * - **It never holds a send credential.** `pay_invoice` on this connection is
- *   refused at construction, so a compromised DVM can mint invoices and
- *   nothing else. The drain/refund sender (internal-review) is a separate, budgeted
- *   connection by rule.
+ * refused at construction, so a compromised DVM can mint invoices and
+ * nothing else. The drain/refund sender is a separate, budgeted
+ * connection by rule.
  * - **Crediting is pull-based — there is no settlement watcher.** The caller's
- *   next request drives `lookup_invoice`, which is what makes this work on a
- *   suspend-to-zero fleet: a machine that is asleep has nothing to miss.
- *   Wallet downtime at that moment delays crediting; it never loses money,
- *   because the invoice→credit binding is a durable row.
+ * next request drives `lookup_invoice`, which is what makes this work on a
+ * suspend-to-zero fleet: a machine that is asleep has nothing to miss.
+ * Wallet downtime at that moment delays crediting; it never loses money,
+ * because the invoice→credit binding is a durable row.
  *
  * Reachability is **cached**, never probed per request: the funding menu is
  * assembled on every quote and every 402, so a live NIP-47 round trip there
@@ -3897,7 +3778,7 @@ declare class LightningReceive {
      * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
      *
      * The invoice is minted **for** the credit and amount named in the caller's
-     * signed body — that binding is the internal-review condition-3 commitment on this
+     * signed body — that binding is the condition-3 commitment on this
      * rail, and it is why no artifact hash rides the request: there is no
      * caller-supplied artifact to hash. A re-poll returns the stored row rather
      * than minting again; a second bolt11 for one `fund_id` would leave two
@@ -3913,7 +3794,7 @@ declare class LightningReceive {
         description?: string;
     }): Promise<CreditInvoiceRecord>;
     /**
-     * Ask the wallet whether one payment hash is paid, and when (internal-review).
+     * Ask the wallet whether one payment hash is paid, and when.
      *
      * The operator's reconcile verb runs this before it credits anything. A
      * `blocked` row implies payment — {@link applyOne} returns above the block
@@ -4019,7 +3900,7 @@ declare class LightningReceive {
 }
 
 /**
- * Owner display identity surfaced on `/v1/info#owner` (internal-review). Personal orgs
+ * Owner display identity surfaced on `/v1/info#owner`. Personal orgs
  * resolve to the owner builder's profile; shared orgs resolve to the org's own
  * profile. Container DVMs read from env vars; isolate DVMs resolve from Postgres.
  */
@@ -4035,16 +3916,16 @@ interface BuilderIdentity {
     name?: string;
     url?: string;
     /**
-     * Builder identity x-only secp256k1 pubkey (internal-review). When populated, the
+     * Builder identity x-only secp256k1 pubkey. When populated, the
      * `/v1/info#builder` block also carries `attestation` + `signature` so
      * consumers can verify the deploy was signed by the holder of this key.
      * Populated at deploy time from `DVMKIT_BUILDER_PUBKEY` (Fly secret); the
      * SDK never re-signs at runtime.
      */
     pubkey?: string;
-    /** Canonical deploy-time attestation payload (internal-review). Served verbatim. */
+    /** Canonical deploy-time attestation payload. Served verbatim. */
     attestation?: AttestationPayload;
-    /** Schnorr signature over `canonicaliseForSigning(attestation)` (internal-review). */
+    /** Schnorr signature over `canonicaliseForSigning(attestation)`. */
     signature?: string;
 }
 /** Platform reporter overrides — the host falls back to env when omitted. */
@@ -4061,21 +3942,24 @@ interface DVMServeResult {
     /** Boot snapshot for each mount; configured but unusable rails remain payment-required. */
     paymentModes: PaymentMode[];
 }
-/** Options for {@link createDVMHost}. */
 interface DVMHostOpts {
     /**
      * Postgres connection string. Defaults to `DATABASE_URL` env.
-     * Required at runtime (internal-review). Boot fails when missing unless `jobStore`
+     * Required at runtime. Boot fails when missing unless `jobStore`
      * is explicitly supplied or `devMode` is true (test/dev escape hatches).
      */
     database?: string;
     /** Listen port. Defaults to `PORT` env or 8080. */
     port?: number;
-    /** Environment variables. Defaults to `process.env`. */
+    /**
+     * Environment variables. Defaults to `process.env` when omitted. A supplied
+     * object is the complete host configuration: absent fields do not fall back
+     * to ambient process variables.
+     */
     env?: Record<string, string>;
     /** Builder identity for `/v1/info` (forward-compatible). */
     builder?: BuilderIdentity;
-    /** Owner display identity for `/v1/info#owner` (internal-review). Falls back to env vars. */
+    /** Owner display identity for `/v1/info#owner`. Falls back to env vars. */
     owner?: OwnerDisplay;
     /** Platform reporter overrides. Defaults to env-derived values. */
     platformReporter?: PlatformReporterOpts;
@@ -4093,7 +3977,7 @@ interface DVMHostOpts {
     jobStore?: JobStore;
     /**
      * Existing Postgres pool to reuse instead of opening one from `database`
-     * (internal-review test seam). When set, the host builds its JobStore / KVStore /
+     * (also useful as a test seam). When set, the host builds its JobStore / KVStore /
      * cashu accumulator on this pool and leaves it open at shutdown — the caller
      * owns it. Lets the e2e harness run DVMs in `p2pk-accumulator` mode against
      * its single shared pool rather than spawning a pool per DVM.
@@ -4110,7 +3994,7 @@ interface DVMHostOpts {
     /** Payment methods override. Defaults to derived from configured rails. */
     paymentMethods?: PaymentMethod[];
     /**
-     * Lightning receive leg for credit funding (internal-review). Defaults to the
+     * Lightning receive leg for credit funding. Defaults to the
      * env-resolved `DVMKIT_NWC_RECEIVE_URI` /
      * `DVMKIT_NWC_RECEIVE_INVOICE_TTL_SECONDS`. Pass `backend` to inject a
      * wallet directly — a test seam that skips the connect-time probe, so
@@ -4144,7 +4028,7 @@ interface MountOpts {
     /** Path prefix for this DVM's protocol routes (e.g. `/delete-feed`). */
     prefix?: string;
 }
-/** Live DVM host. Single wiring locus for the SDK (internal-review). */
+/** Live DVM host. Single wiring locus for the SDK. */
 interface DVMHost {
     /**
      * Underlying Hono app for custom non-protocol routes that belong to the
@@ -4155,15 +4039,15 @@ interface DVMHost {
     /**
      * Resolved Postgres pool — undefined before `host.serve()` completes
      * database resolution, set thereafter. Exposed so DVM-local Postgres
-     * consumers (e.g. scrape's `ScrapeDb` per-fetch event store, internal-review)
+     * consumers (e.g. scrape's `ScrapeDb` per-fetch event store)
      * can reuse the host's pool rather than constructing their own. Wire
      * inside descriptor `onBoot` (fires after pool init, before listener opens).
      */
     readonly pool: Pool | undefined;
     /**
-     * Money-safe credit ledger (internal-review) — undefined before `host.serve()`
+     * Money-safe credit ledger — undefined before `host.serve()`
      * resolves stores, set thereafter. Postgres-backed when a pool exists;
-     * pool-less hosts get a shared in-memory ledger so the internal-review fund+draw
+     * pool-less hosts get a shared in-memory ledger so the fund+draw
      * semantics hold everywhere. Same wiring window as `pool` (descriptor
      * `onBoot` fires after init, before the listener opens).
      */
@@ -4181,7 +4065,7 @@ interface DVMHost {
     shutdown(): Promise<void>;
 }
 /**
- * Single wiring locus for SDK-side construction (internal-review). Replaces both the
+ * Single wiring locus for SDK-side construction. Replaces both the
  * `serve()` wrapper and the `createDVMServer` direct path. Reads env once,
  * resolves payment rails, owns the Postgres pool, and mounts each DVM
  * descriptor as a Hono sub-app on `host.app`.
@@ -4190,13 +4074,12 @@ declare function createDVMHost(opts?: DVMHostOpts): DVMHost;
 
 /**
  * Cached liveness signal for the platform's central Tempo close observer
- * (internal-review).
  *
  * A TIP-1034 session channel is only safe to accept while something is
  * watching the chain for its close: without that, a caller can consume value,
  * request a close, wait out the 900-second grace period and withdraw. So this
  * gate is **fail-closed**, which is the opposite of `lightning-rail-health.ts`
- * — there, withholding a rail over an outage costs a sale; here, advertising
+ * there, withholding a rail over an outage costs a sale; here, advertising
  * one costs the money. `tempo/charge` is untouched either way: a charge is an
  * ordinary payment with no channel and no close to watch.
  */
@@ -4219,7 +4102,7 @@ interface TempoObserverHealth {
     refresh?(): Promise<void>;
     /**
      * Register a mount's `tempo/session` **capability** so the poll can carry it
-     * back to the platform (internal-review).
+     * back to the platform.
      *
      * The platform's `dvms.tempo_session_advertised_at` — the only filter on the
      * close observer's payee-fallback rung 2 — was written once per container
@@ -4230,7 +4113,7 @@ interface TempoObserverHealth {
      *
      * The reader must answer from **configuration**, never from
      * {@link TempoObserverHealth.available} — a fail-closed gate blip must not
-     * de-stamp the DVM, which is the internal-review failure through a new door.
+     * de-stamp the DVM, which is the failure through a new door.
      *
      * Returns a disposer the mount calls on shutdown, so a torn-down capability
      * stops voting in the OR below.
@@ -4352,7 +4235,7 @@ declare class TempoSettlementReadiness {
 }
 
 /**
- * Options for the revenue reporter readiness assertion (internal-review).
+ * Options for the revenue reporter readiness assertion.
  *
  * The check branches on `platformUrl` presence — that's the unambiguous
  * "platform-hosted" signal. `failFast` stays on the opts as a general SDK
@@ -4361,13 +4244,13 @@ declare class TempoSettlementReadiness {
 interface RevenueBootCheckOpts {
     /**
      * General SDK strict-mode flag, sourced from `DVMKIT_FAIL_FAST` at the host
-     * boundary (internal-review). Reserved for future warning-vs-fatal SDK checks; the
-     * reporter check itself ignores it (internal-review), hence optional.
+     * boundary. Reserved for future warning-vs-fatal SDK checks; the
+     * reporter check itself ignores it, hence optional.
      */
     failFast?: boolean;
     /**
      * The SDK's canonical "this is a dev/test run" signal. Exempts the boot from
-     * the platform-hosted wiring requirement (internal-review) — see below.
+     * the platform-hosted wiring requirement — see below.
      */
     devMode?: boolean;
     platformToken: string | undefined;
@@ -4376,63 +4259,38 @@ interface RevenueBootCheckOpts {
     hasPgPool: boolean;
 }
 /**
- * Assert that revenue reporting is correctly configured at boot (internal-review).
- *
- * Platform-hosted DVMs (signalled by `DVMKIT_PLATFORM_URL`) unconditionally
- * require `DVMKIT_PLATFORM_TOKEN`, `DVMKIT_DVM_ID`, and a database connection.
- * Partial wiring is always fatal — there's no legitimate "platform set my URL
- * but didn't finish wiring" case, and `DVMKIT_FAIL_FAST` has no effect here.
- *
- * Self-hosted DVMs (no `DVMKIT_PLATFORM_URL`) have no platform reporter
- * contract to enforce — the SDK skips validation entirely.
- *
- * `devMode` boots are exempt (internal-review), mirroring the test-mint guard's
- * exemption in `createDVMHost` (internal-review, `host.ts`). `devMode` is set by
- * `dvmctl dev`, `standalone development tooling`, the money-loop, and the e2e/smoke
- * harnesses — all of which spread `...process.env`, so a builder whose shell
- * exports `DVMKIT_PLATFORM_URL` for their `dvmctl` platform commands would
- * otherwise hit this FATAL on a dev server that reports no revenue anyway (no
- * payment, no auth, no DB). Production boots never set it: first-party
- * container entrypoints and `dvmctl serve` (`buildServeOpts`) both leave it
- * unset — asserted in
- * `__tests__/revenue-reporter-boot.test.ts`, not just claimed here.
+ * Hosted boots (a platform URL is set) require a token, DVM ID and database;
+ * partial wiring is fatal regardless of `failFast`. Self-hosted and `devMode`
+ * boots skip this assertion. The exemption does not disable an already wired
+ * reporter; the banner separately describes whether reporting is active.
  */
 declare function assertRevenueReporterReady(opts: RevenueBootCheckOpts): void;
 /** What the host's boot banner knows about the revenue reporter's wiring. */
 interface ReporterBannerOpts {
     /** `DVMKIT_PLATFORM_URL` — the platform-hosted signal. */
     platformUrl: string | undefined;
-    /** Whether `DVMKIT_PLATFORM_TOKEN` resolved — never the token itself (internal-review). */
+    /** Whether `DVMKIT_PLATFORM_TOKEN` resolved — never the token itself. */
     hasPlatformToken: boolean;
     /** Whether `DVMKIT_DVM_ID` resolved. */
     hasDvmId: boolean;
-    /** Whether a Postgres pool is wired. */
     databaseConnected: boolean;
-    /** Dev/test boot — exempt from the wiring assertion above (internal-review). */
     devMode: boolean;
 }
 /**
- * Render the boot banner's `Platform rep.` line (internal-review).
+ * Render the boot banner's `Platform rep.` line.
  *
  * Lives here, next to the assertion, because `active` has to mirror the
  * reporter's own wiring gate in `createDVMServer` below — token **and** dvmId
  * **and** database. Miss one and the banner claims a reporter that was never
  * constructed.
  *
- * On a production boot the assertion throws before the banner prints, so only
- * `(self-hosted)` and `active` are reachable there. A `devMode` boot skips the
- * assertion (internal-review), making it the one path where partial wiring reaches
- * this line — say so plainly rather than shouting `misconfigured` at a builder
- * whose shell merely exports the platform URL.
+ * Partial dev wiring reaches the banner because the boot assertion is exempt;
+ * it reports a dev status rather than a production configuration failure.
  */
 declare function revenueReporterBannerState(s: ReporterBannerOpts): string;
-/** Options for creating the SDK server app. */
 interface SDKServerOpts {
-    /** Environment variables for ctx.env. */
     env: Record<string, string>;
-    /** KV store for ctx.store. */
     store: KVStore;
-    /** Cashu mints accepted for payment. */
     mints?: string[];
     /** Persistent backing store for job records. Default: in-memory. */
     jobStore?: JobStore;
@@ -4440,7 +4298,6 @@ interface SDKServerOpts {
     devMode?: boolean;
     /** Payment methods this DVM accepts. Default: derived from configured rails — adds "cashu" when `mints` is set, "x402" when `x402` is set, "tempo" when `tempo` is set. */
     paymentMethods?: PaymentMethod[];
-    /** x402 stablecoin payment configuration. */
     x402?: X402Config;
     /** Live facilitator capability gate. Hosts wire this after probing `/supported`. */
     x402FacilitatorHealth?: X402FacilitatorHealthLike;
@@ -4449,13 +4306,13 @@ interface SDKServerOpts {
     /**
      * Tracks already-consumed upfront-flow MPP credentials so the same
      * credential can't satisfy `POST /v1/job` twice within its `expires`
-     * window (internal-review). Default: in-memory, bounded, per-process. Swap for a
+     * window. Default: in-memory, bounded, per-process. Swap for a
      * shared backend before deploying multiple replicas.
      */
     consumedCredentialStore?: ConsumedCredentialStore;
     /**
      * Tracks already-consumed admin-endpoint nonces so a signed P2PK challenge
-     * can't be replayed within the 5-minute sliding window (internal-review). Default:
+     * can't be replayed within the 5-minute sliding window. Default:
      * in-memory, bounded, per-process. Swap for a shared backend before
      * deploying multiple replicas.
      */
@@ -4469,14 +4326,14 @@ interface SDKServerOpts {
      * registration order.
      */
     healthHandler?: (c: Context<AppEnv>) => Response | Promise<Response>;
-    /** Cashu receive mode (internal-review). */
+    /** Cashu receive mode. */
     cashuMode?: CashuMode;
     /**
-     * Builder's NUT-11 P2PK lock pubkey (internal-review). Used as the seed pubkey for
+     * Builder's NUT-11 P2PK lock pubkey. Used as the seed pubkey for
      * `seedLockPubkeyState` on first boot, as the admin-auth identity, and as
      * part of the gate for whether `/v1/info` advertises `cashu`. After first
      * boot, the authoritative `[current, ...retired]` state lives in the DVM's
-     * Postgres via `dvm_lock_pubkeys`; rotations (internal-review) mutate that store
+     * Postgres via `dvm_lock_pubkeys`; rotations mutate that store
      * directly.
      */
     lockPubkey?: string;
@@ -4485,12 +4342,11 @@ interface SDKServerOpts {
     /**
      * Rotation grace window (seconds) — retired pubkeys remain advertised on
      * `cashu.lock_pubkeys` and accepted by the receive path until they age out.
-     * Default 24h (`DEFAULT_LOCK_PUBKEY_GRACE_SECONDS`); operators tune via
-     * `BUILDER_LOCK_PUBKEY_GRACE_SECONDS` env (internal-review).
+     * Defaults to 24h.
      */
     lockPubkeyGraceSeconds?: number;
     /**
-     * Per-DVM canonical identifier (internal-review). Advertised on `/v1/info` as
+     * Per-DVM canonical identifier. Advertised on `/v1/info` as
      * `cashu.canonical_id` so agents can derive the matching per-DVM refund
      * subkey at `m/1789'/2'/hashed(canonical_dvm_id)'`. Defaults to `dvmId`
      * (the platform's DVM UUID) when unset — keeps `/v1/info` self-consistent
@@ -4500,30 +4356,25 @@ interface SDKServerOpts {
     /** Postgres pool for builder admin state and wallet accumulator persistence. */
     db?: Pool;
     /**
-     * General SDK strict-mode flag (internal-review), sourced from `DVMKIT_FAIL_FAST` at
+     * General SDK strict-mode flag, sourced from `DVMKIT_FAIL_FAST` at
      * the host boundary. Reserved for future warning-vs-fatal SDK checks; the
      * revenue-reporter boot check is gated on platform context, not on this
-     * flag (internal-review).
+     * flag.
      */
     failFast?: boolean;
-    /** Agent-wallet (internal-review): per-DVM identifier — drives the monitor advisory lock + replay key. */
+    /** Agent-wallet: per-DVM identifier — drives the monitor advisory lock + replay key. */
     dvmId?: string;
     /**
-     * Runtime mint-health tracker (internal-review). When omitted, the server builds a
-     * fresh one whenever `mints?.length > 0`. Sick mints are dropped from
-     * `/v1/info`'s advertised list and rejected at receive time. Tests pass an
-     * instance with `runOnce`-driven state instead of relying on the timer.
+     * Runtime mint-health tracker. When omitted, the server builds a
+     * fresh one whenever `mints?.length > 0`. Healthy mints are preferred in
+     * `/v1/info`; when none are healthy, transiently sick mints remain advertised.
+     * NUT-incompatible mints are excluded even from that fallback.
      */
     mintHealthTracker?: MintHealthTracker;
-    /**
-     * Shared fx fetcher used to translate USD descriptor prices and fiat-form
-     * `ctx.requestPayment` calls into sats (internal-review). When omitted, the server
-     * builds one from `env.DVMKIT_FX_SOURCE` (or the bundled CoinGecko default).
-     * Tests pass a deterministic stub.
-     */
+    /** Shared upfront/mid-job fiat conversion fetcher. Defaults to `DVMKIT_FX_SOURCE` or CoinGecko. */
     fxFetcher?: FxFetcher;
     /**
-     * Platform API token for revenue reporting (internal-review). Read from
+     * Platform API token for revenue reporting. Read from
      * `opts.env.DVMKIT_PLATFORM_TOKEN` when not set explicitly. When both
      * `platformToken` and `platformUrl` are present alongside `db` and `dvmId`,
      * the SDK auto-constructs a `RevenueReporter` and wires it into the
@@ -4531,35 +4382,32 @@ interface SDKServerOpts {
      */
     platformToken?: string;
     /**
-     * Platform API URL for revenue reporting (internal-review). Read from
+     * Platform API URL for revenue reporting. Read from
      * `opts.env.DVMKIT_PLATFORM_URL` when not set explicitly.
      */
     platformUrl?: string;
-    /**
-     * Advanced override: callback fired when a paid job completes (internal-review).
-     * When set, bypasses the SDK's automatic `RevenueReporter` wiring — the
-     * caller assumes full responsibility for revenue tracking. Intended for
-     * tests and advanced integrations only.
-     */
+    /** Observes completed jobs with a positive settled draw; failures are logged and swallowed. */
     onPaidJobCompleted?: (event: PaidJobCompletion) => void | Promise<void>;
     paymentMode?: PaymentMode;
+    /** Overrides automatic RevenueReporter wiring; the caller owns revenue delivery. */
     onJobCompleted?: JobManagerOpts["onJobCompleted"];
     /**
      * Advanced override for a declared cost on a terminal job that emitted no
-     * revenue report (internal-review). Auto-wired to the reporter's durable
+     * revenue report. Auto-wired to the reporter's durable
      * job-cost path; intended for tests and advanced integrations only.
      */
     onJobCost?: JobManagerOpts["onJobCost"];
+    onJobTerminal?: JobManagerOpts["onJobTerminal"];
     /**
      * Advanced override: callback fired when the stale-job reaper force-fails a
-     * *paid* job (internal-review). Auto-wired to the `RevenueReporter`'s paid-job-death
+     * *paid* job. Auto-wired to the `RevenueReporter`'s paid-job-death
      * report alongside `onJobCompleted`; set explicitly only for tests / advanced
      * integrations that own their own reporting.
      */
     onPaidJobDeath?: JobManagerOpts["onPaidJobDeath"];
     /**
      * Advanced override: callback fired when a settled credit draw could not
-     * book revenue because its rail was unavailable (internal-review). Auto-wired to
+     * book revenue because its rail was unavailable. Auto-wired to
      * the platform reporter alongside the completion and paid-job-death paths.
      */
     onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
@@ -4568,22 +4416,22 @@ interface SDKServerOpts {
     /** Advanced clear-on-recovery callback for clean job-retention passes. */
     onJobRetentionSweepRecovered?: JobManagerOpts["onJobRetentionSweepRecovered"];
     /**
-     * Advanced override: callback fired when a payment funds a credit (internal-review).
+     * Advanced override: callback fired when a payment funds a credit.
      * Auto-wired to the `RevenueReporter`'s deposit report alongside
      * `onJobCompleted`; set explicitly only for tests / advanced integrations
      * that own their own reporting. Fundings are deposits — a liability until
-     * drawn — reported separately from the draws that become revenue (spec §10).
+     * drawn — reported separately from the draws that become revenue (the deposit-accounting rule).
      */
     onCreditFunded?: (info: CreditDepositPayload) => void | Promise<void>;
     /**
      * Grace window (ms) a reactivating machine waits for a live original handler
      * to win the single-execution claim before replaying an `awaiting-input` job
-     * (internal-review). Defaults to the JobManager's built-in value; exposed as an ops
+     * Defaults to the JobManager's built-in value; exposed as an ops
      * override and a test seam.
      */
     reactivationClaimGraceMs?: JobManagerOpts["reactivationClaimGraceMs"];
     /**
-     * Builder identity for `/v1/info#builder` (internal-review). Inline alternative
+     * Builder identity for `/v1/info#builder`. Inline alternative
      * to the `DVMKIT_BUILDER_PUBKEY` / `_ATTESTATION` / `_SIGNATURE` env vars
      * the platform's deploy pipeline injects as Fly secrets. When set,
      * `builder.{pubkey, attestation, signature}` take per-field precedence
@@ -4591,10 +4439,10 @@ interface SDKServerOpts {
      * `/v1/info#builder` block to be emitted.
      */
     builder?: BuilderIdentity;
-    /** Owner display identity for `/v1/info#owner` (internal-review). Falls back to env vars. */
+    /** Owner display identity for `/v1/info#owner`. Falls back to env vars. */
     owner?: OwnerDisplay;
     /**
-     * Per-DVM receipt-signing secret, 32 bytes hex (internal-review). Resolved at the
+     * Per-DVM receipt-signing secret, 32 bytes hex. Resolved at the
      * host boundary from `DVMKIT_RECEIPT_KEY` — the deploy pipeline provisions
      * it as a Fly secret, derived one-way from the builder identity key and
      * bound into the deploy attestation's `receipt_pubkey`.
@@ -4605,25 +4453,25 @@ interface SDKServerOpts {
      */
     receiptKey?: string;
     /**
-     * Credit ledger every payment funds and draws through (internal-review). The host
+     * Credit ledger every payment funds and draws through. The host
      * passes the Postgres `CreditLedger` when a pool exists; standalone /
      * pool-less setups default to a per-server `MemoryCreditLedger` so the
      * fund+draw semantics (and receipts' credit block) hold everywhere.
      */
     creditLedger?: CreditLedgerLike;
     /**
-     * Durable x402/mpp processed-payment markers (internal-review). Defaults to the
+     * Durable x402/mpp processed-payment markers. Defaults to the
      * in-memory store; the host passes the Postgres one alongside the ledger.
      */
     processedPayments?: ProcessedPaymentStore;
     /**
-     * Lightning credit-funding receive leg (internal-review), when the host resolved a
+     * Lightning credit-funding receive leg, when the host resolved a
      * receive-only NWC connection. Absent ⇒ `lightning` never appears on the
      * funding menu and `POST /v1/credit` refuses the method.
      */
     lightningReceive?: LightningReceive;
     /**
-     * Liveness of the platform's Tempo close observer (internal-review). Absent ⇒ this
+     * Liveness of the platform's Tempo close observer. Absent ⇒ this
      * DVM is self-hosted and answers for its own close watching, so nothing is
      * withheld. Present and unhealthy ⇒ `tempo/session` is withheld while
      * `tempo/charge` stays available.
@@ -4632,20 +4480,16 @@ interface SDKServerOpts {
     /** Platform-hosted operator fee-token readiness; absent outside hosted sessions. */
     tempoSettlementReadiness?: TempoSettlementReadiness;
     /**
-     * Tuning for the credit-expiry sweep (internal-review). Omitted, the sweep runs on
+     * Tuning for the credit-expiry sweep. Omitted, the sweep runs on
      * its own defaults whenever the ledger supports it; tests pass `intervalMs: 0`
      * and `bootDelayMs: 0` to hold the clock still and drive `runOnce` by hand.
      */
     creditExpirySweep?: CreditExpirySweepOpts;
 }
 /**
- * Per-descriptor server construction — internal to the SDK after host
- * consolidation (internal-review). Public callers use `createDVMHost` instead; this
- * function is what the host invokes per `host.mount(dvm)`.
- *
  * Builds a Hono sub-app for one DVM descriptor, wires payment verification,
  * auto-wires `RevenueReporter` when platform env + db + dvmId are present, and
- * runs the platform-hosted partial-wiring assertion (internal-review) — gated on
+ * runs the platform-hosted partial-wiring assertion — gated on
  * `DVMKIT_PLATFORM_URL` presence, independent of `DVMKIT_FAIL_FAST`.
  */
 declare function createDVMServer<State, InputSchema extends ZodLike | undefined>(descriptor: DVMDescriptor<State, InputSchema>, opts: SDKServerOpts): Promise<{
@@ -4654,13 +4498,13 @@ declare function createDVMServer<State, InputSchema extends ZodLike | undefined>
     shutdown: () => Promise<void>;
     jobManager: JobManager<State, InputSchema>;
     revenueReporterActive: boolean;
-    /** The payout reporter (internal-review), for the host to attach its Tempo readers to. */
+    /** The payout reporter, for the host to attach its Tempo readers to. */
     payoutReporter?: PayoutReporter;
 }>;
 /**
  * Hono env for the SDK's DVM app. `unknownRoute` is set by
  * {@link unknownRouteNotFound} so the `dvm.request` span can classify a 404 as
- * scanner-probe noise vs a registered route's own 404 (internal-review).
+ * scanner-probe noise vs a registered route's own 404.
  *
  * Exported as a type only, for route modules split out of this file
  * (`credit-routes.ts`) — a type-only import erases at compile time, so it
@@ -4676,7 +4520,7 @@ interface AppEnv {
 /**
  * `notFound` handler for paths that match no registered route — scanner probes
  * (`GET /robots.txt`, `/.env`, …). Tags the request context so the `dvm.request`
- * span downgrades the 404 to `warn`-level probe noise (internal-review) instead of
+ * span downgrades the 404 to `warn`-level probe noise instead of
  * crowding out real errors in a `--level error` sweep, and returns a
  * machine-parseable JSON 404 (Hono's default is plain text). Registered on both
  * the DVM app (standalone `createDVMServer`) and the host app (mounted path):
@@ -4731,21 +4575,21 @@ interface CreditTerms {
     lightning_min_micro?: number;
 }
 /**
- * The **funding menu** a DVM advertises on `/v1/quote` and in every 402
- * (internal-review, credits spec §4/§6). Snake_case: this is the wire shape.
+ * The **funding menu** a DVM advertises on `/v1/quote` and in every 402;
+ * this is the snake_case wire shape.
  *
  * `min_micro` / `max_micro` / `ttl_ms` are the DVM's sizing terms — `max_micro`
  * binds the **residual balance**, not a funding amount, so a job priced above
  * it still clears as fund-and-immediately-draw. `funding` is the rail list a
  * top-up may arrive on — a {@link FundingMethod}, not a `PaymentMethod`, since
- * `lightning` funds a credit without ever being an attached-proof wire method
- * (internal-review). It degrades per spec §4: a rail whose backing wallet is
- * unreachable drops out and the sale survives on the others.
+ * `lightning` funds a credit without ever being an attached-proof wire method.
+ * A rail whose backing wallet is unreachable drops out and the sale survives
+ * on the others.
  *
  * The `credit_id` / `balance_micro` / `remaining_micro` / `expiry_ms` echo
  * appears only for an authenticated caller who already holds a live credit —
  * so one round trip answers "what does this cost, and what do I have left?"
- * (spec §7).
+ * through the signed credit endpoint.
  */
 interface CreditMenu extends CreditTerms {
     /**
@@ -4753,7 +4597,7 @@ interface CreditMenu extends CreditTerms {
      * available.
      *
      * `withheld` names an instrument this DVM is configured for and is not
-     * offering at this instant, with the reason (internal-review). Two audiences read
+     * offering at this instant, with the reason. Two audiences read
      * it. An agent gets to relay *why* `tempo/session` vanished instead of
      * inferring the DVM never had it. And the platform's deploy probe reads
      * capability from `methods ∪ withheld`, so a deploy landing during an
@@ -4764,14 +4608,14 @@ interface CreditMenu extends CreditTerms {
      */
     /**
      * Which x402 flavours a top-up may arrive on, and the chain each rides
-     * (internal-review). Present exactly when `funding` lists `x402`. Reusable
+     * Present exactly when `funding` lists `x402`. Reusable
      * `batch-settlement` is admitted by default; one-payment `exact` appears
      * only when the builder explicitly accepts its manual refund obligation.
      */
     /**
      * Smallest funding the `lightning` rail accepts, in 1e-6 units of
      * `currency`. Present only when `funding` lists `lightning`. This is the
-     * deployment's sats-physical receive floor (internal-review) rendered into fiat
+     * deployment's sats-physical receive floor rendered into fiat
      * with a ×{@link LIGHTNING_FLOOR_FX_MARGIN} margin absorbing rate drift
      * between menu fetch and funding — issuance enforces the *raw* floor at
      * request-time rates, so funding exactly this figure always clears. Rails
@@ -4798,7 +4642,7 @@ interface BuildCreditMenuArgs {
     /**
      * Currency the menu — and the credit it funds — denominates in: the DVM's
      * declared `DVMConfig.currency`, which every call site reads off the single
-     * `DVMServer.creditCurrency()` (internal-review). Deliberately *not* the currency of
+     * `DVMServer.creditCurrency()`. Deliberately *not* the currency of
      * the response this menu rides on: a quote priced elsewhere is refused before
      * it reaches here, so the two agree, and sourcing it from the response is
      * what left `POST /v1/credit` — which has no response to read — funding in
@@ -4819,7 +4663,7 @@ interface BuildCreditMenuArgs {
         reason: string;
     }[];
     /**
-     * x402 flavours this DVM can actually accept a top-up on (internal-review) — one
+     * x402 flavours this DVM can actually accept a top-up on — one
      * server read, so what the sub-block advertises is what `/v1/credit` will
      * answer a 402 with.
      */
@@ -4837,7 +4681,7 @@ interface BuildCreditMenuArgs {
     lightningFundingMinSats?: number;
     /**
      * Whether this DVM has at least one accepted Cashu mint configured
-     * (internal-review). Without one, no Bitcoin funding rail may be advertised — see
+     * Without one, no Bitcoin funding rail may be advertised — see
      * the filter in {@link buildCreditMenu}.
      *
      * Read off the **configured** mint list, never the health-filtered
@@ -4859,23 +4703,23 @@ interface BuildCreditMenuArgs {
  * advertise credit. **The refusal ladder is the feature**; each rung exists
  * because advertising anyway would misadvertise:
  *
- * 1. **Isolate runtime** (credits spec §3) — checked first and unconditionally,
- *    before config is even read. Isolate DVMs have no Postgres of their own;
- *    their only DVM-side persistence is the last-write-wins callback KV, which
- *    spec §2 condition 2 prohibits for credit state. Until [internal-review] resolves
- *    the gate they run implicit N=1 only, and their quote simply never offers
- *    credit so nothing is misadvertised.
+ * 1. **Isolate runtime** (the isolate-runtime rule) — checked first and unconditionally,
+ * before config is even read. Isolate DVMs have no Postgres of their own;
+ * their only DVM-side persistence is the last-write-wins callback KV, which
+ * the durable-ledger requirement prohibits for credit state. Until isolate
+ * runtimes have durable credit storage, they run implicit N=1 only and their quote never offers
+ * credit so nothing is misadvertised.
  * 2. **Not opted in** — no `credit` block on `configureDVM`.
  * 3. **No descriptor auth** — a credit belongs to a verified secp256k1 pubkey.
- *    Without auth the ledger's funder identity degrades to the requester id or
- *    `"anonymous"` (see `resolveLedgerContext`), which would pool every
- *    anonymous caller's money into one balance. Advertising a per-caller
- *    balance on such a DVM would be a lie at best and a disclosure at worst.
+ * Without auth the ledger's funder identity degrades to the requester id or
+ * `"anonymous"` (see `resolveLedgerContext`), which would pool every
+ * anonymous caller's money into one balance. Advertising a per-caller
+ * balance on such a DVM would be a lie at best and a disclosure at worst.
  * 4. **Non-durable ledger outside devMode** — a `MemoryCreditLedger` is
- *    per-process, so a caller funding on machine A and drawing on machine B
- *    gets `credit_not_found`. Advertise only what survives the fleet.
+ * per-process, so a caller funding on machine A and drawing on machine B
+ * gets `credit_not_found`. Advertise only what survives the fleet.
  * 5. **Bounds not expressible in `currency`** — an fx outage, or a currency the
- *    snapshot doesn't carry. Omit rather than quote a number we can't state.
+ * snapshot doesn't carry. Omit rather than quote a number we can't state.
  *
  * The balance echo is added only when a verified `callerPubkey` holds a live,
  * same-currency credit.
@@ -4892,7 +4736,7 @@ declare function buildCreditMenu(args: BuildCreditMenuArgs): Promise<CreditMenu
  * Live, same-currency credits with something left in them; largest spendable
  * balance wins, newest breaks a tie. That is the credit a caller would in fact
  * draw against next. A failed job's released hold leaves a positive implicit
- * balance, which is real caller money (spec §1, no debit on failure) and is
+ * balance, which is real caller money (the credit lifecycle contract, no debit on failure) and is
  * echoed like any other.
  *
  * **Requires a verified pubkey.** Never call this with a requester id or