@dvmkit/sdk 0.1.5-rc.9 → 0.2.1-rc.9

package/dist/{chunk-5PBOA25N.js → chunk-JNKQZVZX.js}

@@ -1,7 +1,7 @@
 import {
   MemoryProcessedPaymentStore,
   ProcessedPaymentReplayError
-} from "./chunk-DMNLFNTW.js";
+} from "./chunk-XRLKGCAW.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -10,7 +10,7 @@ import {
 } from "./chunk-BQ2NMWKE.js";
 import {
   MemoryCreditLedger
-} from "./chunk-KVEHHC7W.js";
+} from "./chunk-U5VNEALI.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -35,7 +35,7 @@ import {
   localMessage,
   providerMessage,
   toJobRecord
-} from "./chunk-U6M3ATSG.js";
+} from "./chunk-MD3H3BF7.js";
 import {
   ADMIN_AUTH_CLOCK_SKEW_SECONDS,
   ADMIN_AUTH_NONCE_TTL_SECONDS,
@@ -60,7 +60,7 @@ import {
   toLockPubkey,
   verifyCashuToken,
   verifyChallenge
-} from "./chunk-KXCKFIJI.js";
+} from "./chunk-QX52F6IB.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -83,7 +83,7 @@ import {
   msatsToUsd,
   msatsToUsdc,
   usdcToMsats
-} from "./chunk-5URG56JJ.js";
+} from "./chunk-A4CM2BD3.js";
 import {
   resolveRpcOverride
 } from "./chunk-MKI6OVW4.js";
@@ -100,7 +100,7 @@ import {
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-E4EVGPDX.js";
+} from "./chunk-YO56VCTQ.js";
 import {
   FxRateUnavailableError,
   InvalidCurrencyError,
@@ -109,7 +109,7 @@ import {
   fxRateFor,
   resolveFxSourceFromEnv,
   validateCurrency
-} from "./chunk-27V2ILSR.js";
+} from "./chunk-4A2RAKCW.js";
 import {
   fiatToSatsCeil,
   parseUsdPrice,
@@ -130,10 +130,10 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-MLRCSJYX.js";
+} from "./chunk-2D75MNNG.js";
 import {
   withSdkInitLock
-} from "./chunk-S3XAHZQY.js";
+} from "./chunk-COYKJRMM.js";
 import {
   withPostgresRecoveryContext
 } from "./chunk-C3MTFLC6.js";
@@ -141,7 +141,7 @@ import {
   advertisedMethods,
   challengeMeta,
   isTempoInsufficientFundsError
-} from "./chunk-M7LHFJ5K.js";
+} from "./chunk-XZ7LW4S5.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -881,22 +881,19 @@ async function buildCreditMenu(args) {
     ttl_ms: args.config.ttlSeconds * 1e3,
     currency,
     funding,
-    // Rendered when either half has something to say: a DVM configured for
-    // sessions only would otherwise lose the whole block the moment the gate
-    // closed, taking its capability signal with it (internal-review).
+    // Keep withheld Tempo capability discoverable even when no method is currently offered.
     ...(tempoMethods.length > 0 || tempoWithheld.length > 0) && {
       tempo: {
         methods: tempoMethods,
         ...tempoWithheld.length > 0 && { withheld: tempoWithheld }
       }
     },
-    // Tied to the rail's own presence, the way `lightning_min_micro` is below:
     // a builder who overrides `paymentMethods` can drop x402 from `funding`
     // while the rail stays wired, and terms for a rail the menu doesn't offer
     // are the same misadvertisement in the other direction.
     ...funding.includes("x402") && x402Schemes.length > 0 && { x402: { schemes: x402Schemes } }
   };
-  if (args.funding.includes("lightning") && args.lightningFundingMinSats !== void 0) {
+  if (funding.includes("lightning") && args.lightningFundingMinSats !== void 0) {
     try {
       const fx = await args.fxFetcher.fetch();
       menu.lightning_min_micro = lightningFloorMicro(args.lightningFundingMinSats, fx, currency);
@@ -905,7 +902,7 @@ async function buildCreditMenu(args) {
         "credit_menu_lightning_floor_unavailable",
         `credit menu degraded: could not express the Lightning funding floor in ${currency}, so the lightning rail is omitted from the funding menu until a rate is available.`
       );
-      menu.funding = args.funding.filter((rail) => rail !== "lightning");
+      menu.funding = menu.funding.filter((rail) => rail !== "lightning");
     }
   }
   const echo = await selectPrimaryCredit({
@@ -1950,7 +1947,7 @@ async function createX402BatchSettlementServer(opts) {
     ...opts.config.autoSettlement === false ? {} : opts.config.autoSettlement,
     // Every claim this fleet builds is capped at earned draws — the claim
     // timer, `claimAndSettle()`, and the withdraw-race rush claim all route
-    // through this selector (internal-review). A builder-supplied
+    // through this selector. A builder-supplied
     // `autoSettlement.selectClaimChannels` cannot override it: the ceiling is
     // a money invariant, not a policy knob. Upstream's refund job builds its
     // bundled claim from storage instead and never consults a selector, which
@@ -2071,14 +2068,13 @@ async function createX402BatchSettlementServer(opts) {
         // move money. The voucher base does not: a cooperatively drained and
         // reused channel can present the same cumulative maximum again under a
         // fresh authorization, which made the second legitimate deposit
-        // collide with the first row (internal-review). Conversely, keying by the
+        // collide with the first row. Conversely, keying by the
         // credit effect would let one signed authorization open several rows.
         //
         // A cooperative refund belongs to one caller drain: after an operator
         // writes a failed drain off, the unchanged channel can legitimately
         // present the same voucher base under a fresh drain id. Keep that new
         // effect out of the old row's `(operation, payment_id)` replay slot
-        // (internal-review).
         paymentId: isRefund ? `${paymentBase}:${settlementId}` : depositPaymentId ?? paymentBase,
         amount: matched.amount
       };
@@ -3631,7 +3627,7 @@ async function verifyUpfrontPayment(opts) {
               // Nothing settled, so the EIP-3009 nonce is unspent and the same
               // header is still payable — unlike the post-settlement branch
               // below, where saying this would be telling the caller to pay
-              // twice (internal-review).
+              // twice.
               hint: `Nothing was settled \u2014 re-sign this request with fund.amount_micro set to expected_micro (${predicted}), re-attach this same X-PAYMENT header, and resubmit.`
             }
           );
@@ -3652,7 +3648,7 @@ async function verifyUpfrontPayment(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
+      const { verifyX402Payment } = await import("./x402-CI6PSHNO.js");
       const receipt = await verifyX402Payment(
         x402Payment,
         x402Config,
@@ -3689,7 +3685,7 @@ async function verifyUpfrontPayment(opts) {
               `fund.amount_micro (${creditEnv.fund.amountMicro}) does not match the settled payment's value at the quoted price (${fundedMicro}).`,
               // `expected_micro` states the valuation, but carries no corrective
               // hint here: the facilitator already settled, so re-presenting
-              // this credential would be a second payment (internal-review).
+              // this credential would be a second payment.
               { extra: { expected_micro: fundedMicro } }
             );
           }
@@ -4195,16 +4191,16 @@ var PAYMENT_ERROR_COPY = {
   // Only the Cashu accumulator emits this code, and it evaluates each call's
   // own proofs — nothing sums a partial with a later one, on any path. So the
   // retry owes the full amount: implicit upfront the shortfall was forfeited
-  // (internal-review), mid-job it sits on a credit the per-site hint names
-  // (internal-review). Explicit upfront short deposits use `insufficient_credit`
-  // instead (internal-review). Telling a caller to "send the difference" produced a
+  // mid-job it sits on a credit the per-site hint names
+  // Explicit upfront short deposits use `insufficient_credit`
+  // instead. Telling a caller to "send the difference" produced a
   // second short pay either way.
   payment_insufficient: {
     display: "The payment was less than the amount required, so it didn't cover the request. The full amount is still owed.",
     hint: "Retry with a single payment of required_msats \u2014 a partial payment does not reduce what is owed.",
     retryable: true
   },
-  // internal-review: the rail and the ledger leg commit together, but the job row is
+  // the rail and the ledger leg commit together, but the job row is
   // written by a *second* transaction (`verifyAndCredit`). When that one can't
   // be made to land, the money is real and the caller's — it just isn't on the
   // job. Say so rather than answering a bare 500: the per-site body names the
@@ -4251,7 +4247,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "Use a different prepaid balance or pay per call. To reclaim this balance after running jobs finish, inspect it with 'dvm wallet tempo-exit <dvm>'.",
     retryable: false
   },
-  // internal-review: a refund on this credit's payment channel reached the chain and
+  // a refund on this credit's payment channel reached the chain and
   // never finished booking, so the escrow behind the balance may already have
   // been paid back. Spending it would buy work the service can never collect
   // for. The copy must not promise the money is gone *or* that it is safe to
@@ -4283,7 +4279,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "Fund at least min_micro (in the credit block of any quote) and try again.",
     retryable: true
   },
-  // internal-review: a per-rail floor, not the menu-wide minimum — today only the
+  // a per-rail floor, not the menu-wide minimum — today only the
   // lightning rail carries one (the receive channel's routing floor). Refused
   // before any invoice is minted, so nothing is ever paid against this code;
   // `retryable: false` because re-sending the identical request can never
@@ -4313,7 +4309,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "The balance is zero or fully held by in-flight jobs. Wait for running jobs to finish, then request the drain again with a fresh drain_id.",
     retryable: true
   },
-  // internal-review. Distinct from `nothing_to_drain` because the balance is real and
+  // Distinct from `nothing_to_drain` because the balance is real and
   // waiting changes nothing: a reusable Bitcoin balance is a deposit the
   // service owes back in the asset it received, and what is left here converts
   // to less than one satoshi at the rate its own funding landed at. There is
@@ -4345,7 +4341,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "Run 'dvm wallet tempo-exit <dvm>' to inspect the channel, request its on-chain exit if needed, and withdraw after the 15-minute grace period.",
     retryable: false
   },
-  // internal-review. The voucher verified and the ledger leg rolled back with the
+  // The voucher verified and the ledger leg rolled back with the
   // failed submission, so nothing was charged and nothing about the payment is
   // wrong — which is exactly what the `payment_invalid` this replaced got
   // backwards, telling an agent to discard a credential that is still good. The
@@ -4422,7 +4418,7 @@ var PAYMENT_ERROR_COPY = {
     hint: "The token's proofs are pending at the mint; retry in a few seconds.",
     retryable: true
   },
-  // internal-review. Not failures — the two `lightning_*` states below are the normal
+  // Not failures — the two `lightning_*` states below are the normal
   // shape of an interactive funding leg, which is why both are retryable and
   // neither `display` implies anything went wrong.
   lightning_settlement_pending: {
@@ -4442,7 +4438,7 @@ var PAYMENT_ERROR_COPY = {
   },
   replay_rejected: {
     display: "This payment was already submitted, so it wasn't charged again.",
-    // internal-review: this hint reaches a caller whose money already landed — the
+    // this hint reaches a caller whose money already landed — the
     // accumulator holds these proofs under this request id. It used to read
     // "use a fresh token and a new request id for the next payment", which an
     // agent could follow straight into paying twice for the same charge.
@@ -4586,7 +4582,7 @@ async function verifyIncomingPayment(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
+      const { verifyX402Payment } = await import("./x402-CI6PSHNO.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5003,7 +4999,7 @@ async function processIncomingPayment(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
+      const { verifyX402Payment } = await import("./x402-CI6PSHNO.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5307,7 +5303,7 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
       // requestId is non-null here because acceptAccumulatorPayment returns
       // kind:"rejected" with code "missing_request_id" when unset (handled by
       // the rejected branch above). Thread it as the per-call settlement
-      // reference for revenue_events.tx_hash (internal-review). Unique per
+      // reference for revenue_events.tx_hash. Unique per
       // (dvm_id, request_id) by the wallet_accumulator UNIQUE constraint, so
       // it serves as a stable id even though it isn't an on-chain hash.
       paymentTxHash: opts.requestId,
@@ -5456,7 +5452,7 @@ async function resolveTopUpLedgerContext(opts, snapshot, binding) {
       amount_micro: priceFiat.amountMicro,
       // Which rung degraded: the whole snapshot fell back to `lastKnown()`, or
       // the live fetch landed without this currency and it was carried forward
-      // from an earlier one (internal-review). The first is the rate source down, the
+      // from an earlier one. The first is the rate source down, the
       // second is the rate source having quietly stopped carrying a currency
       // this DVM advertises — a config problem, and a different repair.
       ...denomination.carriedForward === true && { rate_carried_forward: true },
@@ -5687,7 +5683,7 @@ async function fundAndDraw(ctx, funding, tx) {
       creditId: creditId2,
       drawId: drawId2,
       addAmountMicro: fundedMicro,
-      // internal-review: never grow the draw past what the job cumulatively asked.
+      // never grow the draw past what the job cumulatively asked.
       // The available-balance guard inside `growDraw` cannot do this — the
       // `fund` above raised the balance by exactly this amount — so a second
       // payment for one ask would otherwise be absorbed and settle as revenue.
@@ -5800,7 +5796,7 @@ function creditDepositPayload(dvmId, funding) {
     creditCurrency: funding.currency,
     fundedAt: funding.fundedAt,
     expiryMs: funding.expiryMs,
-    // internal-review: label a session-funded deposit as one, whether or not the chain
+    // label a session-funded deposit as one, whether or not the chain
     // binding below could be read. `rail: "tempo"` alone does not say — a
     // `tempo/charge` one-shot funds a credit with no channel at all — so this is
     // what lets the platform tell a routine charge from a session whose binding
@@ -5808,7 +5804,7 @@ function creditDepositPayload(dvmId, funding) {
     ...funding.tempoSession && {
       tempoSession: { channelId: funding.tempoSession.channelId.toLowerCase() }
     },
-    // internal-review: the channel registration rides the deposit report, so it
+    // the channel registration rides the deposit report, so it
     // commits with the voucher acceptance that created the channel's liability.
     ...funding.tempoChannel && funding.tempoSession && {
       tempoChannel: {
@@ -6075,7 +6071,7 @@ function mapLedgerCommitError(err, x402Requirements, paymentCommitted = false) {
       receivedProofs: [],
       error: {
         // A fixed message plus the reason enum, never `err.message`: that string
-        // is upstream's, and on this PR's own case it is the relay lock holder's
+        // is upstream's and may include the relay lock holder's
         // backend pid and `client_addr`. The detail is logged where the throw is.
         body: paymentErrorBody("x402_settlement_submission_failed", {
           message: "x402 batch settlement submission failed",
@@ -6674,7 +6670,7 @@ var CREDIT_REQUEST_SCHEMA = z.object({
     /** Client-generated idempotency key — a retry with the same id credits once. */
     fund_id: z.string().min(1),
     /**
-     * SHA-256 hex over the raw funding artifact (spec §2 condition 3).
+     * SHA-256 hex over the raw funding artifact (the funding-commitment rule).
      * Required for every attach rail; absent on `method: "lightning"`, which
      * carries no caller-supplied artifact to hash — see {@link CreditRequest}.
      */
@@ -6692,14 +6688,8 @@ var CREDIT_REQUEST_SCHEMA = z.object({
     /** Client-generated idempotency key — the same id polls/collects one drain. */
     drain_id: z.string().min(1),
     /**
-     * Payout rail. Required on the first request; optional on a poll.
-     *
-     * Deliberately a bare string rather than the `DrainMethod` enum, so a
-     * rail this build does not carry is answered by `validateDrainTarget`
-     * with a typed `drain_method_unsupported` naming the rails that do
-     * work — not by a Zod parse failure that says only "invalid enum". The
-     * caller of a removed rail (`lightning`, internal-review) and the caller of a
-     * typo deserve the same actionable refusal.
+     * Required on a fresh drain, optional on poll. Keep this a string so an unsupported
+     * rail receives its specific typed refusal before payout-shape validation.
      */
     method: z.string().min(1).optional(),
     /**
@@ -6825,17 +6815,12 @@ async function handleBalance(c, deps, args) {
   const primary = pickPrimary(all, args.menu.currency);
   return c.json({
     op: "balance",
-    // Expired credits are included: expiry ends spending, never ownership
-    // (spec §5), so stranded value must stay visible to whoever owns it.
+    // Keep expired credit records visible. Nominal expiry alone does not release ownership;
+    // an expiry sweep can later zero the undrawn balance.
     credits: all.map(
       (credit) => creditBody(credit, pendingChannels.has(credit.tempoChannelId ?? ""))
     ),
     ...primary ? { credit: creditBody(primary, pendingChannels.has(primary.tempoChannelId ?? "")) } : {},
-    // internal-review: the funding menu the quote and 402 surfaces already advertise,
-    // echoed here so one read answers "what do I hold, and what may I add".
-    // Under the key `menu`, not `credit` — that one is the credit projection on
-    // this route. Carried without the caller echo fields: `credits[]` above says
-    // the same thing in more detail, so `deps.menu()` is called without a pubkey.
     menu: args.menu
   });
 }
@@ -7114,11 +7099,8 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
       resourcePath: c.req.path,
       action: "close",
       expectedChannelId,
-      // The close intent is re-asserted from inside the verifier, once the
-      // credential is bound to this credit's own channel and before anything
-      // broadcasts (internal-review). Run above the call instead and a credential
-      // signed for another channel touches the reservation on its way to a
-      // refusal that was never going to close anything.
+      // Reassert the intent only after the verifier binds the credential to this channel, and
+      // before broadcast. A wrong-channel signature cannot create or cancel its close intent.
       onBound: async () => {
         await beginClose(expectedChannelId, record.drainId);
         recoveryVersion = await deps.tempoSettlementReadiness?.captureRecoveryVersion();
@@ -7420,9 +7402,6 @@ async function handleX402ChannelDrain(c, deps, args) {
       amount: "0",
       operation: "refund",
       effectId: `${args.credit.creditId}:${args.drainId}`,
-      // The voucher the caller presents is what actually gets revoked and paid,
-      // so the settlement layer refuses one signed for any other channel before
-      // it touches anything (internal-review).
       expectedChannelId: channelId,
       refundBoundNative,
       commit: async (_funding, tx) => {
@@ -7641,12 +7620,9 @@ function drainBody(record) {
     status: record.status,
     amount_micro: record.amountMicro,
     currency: record.currency,
-    // The in-kind obligation, where there is one (internal-review): a Bitcoin
-    // reclaim returns the deposited sats pro rata, at the rate each funding
-    // landed at, so this figure was fixed when the reclaim was requested and
-    // does not move with the market. Published beside the fiat one rather than
-    // instead of it — the fiat figure is what the caller's balance was
-    // denominated in, and both are things an agent relays.
+    // Fixed in-kind Bitcoin refund obligation after the delivery reserve. It reflects the
+    // funding lots remaining at request time; null means no whole-balance in-kind price was
+    // available.
     ...record.owedSats !== null ? { owed_sats: record.owedSats } : {},
     ledger_seq: record.ledgerSeq,
     created_at: record.createdAt,
@@ -7660,17 +7636,7 @@ function drainCopy(record) {
     case "pending":
       if (record.method === "cashu") {
         return {
-          display: record.owedSats === null ? "The refund is approved and being prepared. The balance is already set aside for you." : (
-            // Named because it is the obligation, and because it is
-            // fixed: a Bitcoin refund returns the share of the Bitcoin you
-            // deposited that you never spent, so it does not move if the
-            // price does before you collect it (internal-review). The mint's own
-            // redemption charge is named rather than glossed — it is a sat
-            // or two at a fee-charging mint and nothing at a free one, and
-            // a figure an agent relays to a human should not be a promise
-            // that lands short.
-            `The refund is approved and being prepared: ${record.owedSats} sats, the share of the Bitcoin you deposited that you haven't spent, less whatever the mint charges to hand it over. That figure won't move while you wait, whatever the price does.`
-          ),
+          display: record.owedSats === null ? "The refund is approved and being prepared. The balance is already set aside for you." : `The refund is approved and being prepared: ${record.owedSats} sats, the share of the Bitcoin you deposited that you haven't spent, less whatever the mint charges to hand it over. That figure won't move while you wait, whatever the price does.`,
           hint: "Poll this op with the same drain_id until a token appears. Preparation can be delayed (e.g. the mint is temporarily down) \u2014 the refund stays owed to you either way."
         };
       }
@@ -7796,11 +7762,6 @@ async function handleFund(c, deps, args) {
     fundId: fund.fund_id,
     amountMicro: fund.amount_micro,
     menu,
-    // Lightning and MPP name their rail in the signed body. Header-attached
-    // Cashu and x402 are discriminated by `verifyUpfrontPayment`, which still
-    // refuses their mismatches before money moves. Lightning must be checked
-    // here because past this point the bolt11 is minted and payable; MPP is
-    // checked here so discovery never advertises the wrong Tempo instrument.
     rail: fund.method,
     tempoIntent: fund.method === "tempo" ? fund.intent : void 0
   });
@@ -8091,9 +8052,8 @@ function lightningInvoiceBlock(invoice) {
       invoice: invoice.bolt11,
       payment_hash: invoice.paymentHash,
       amount_msats: invoice.amountMsats,
-      // Named for its unit, like every other timestamp an agent reads off this
-      // API (`ttl_ms`, `expiry_ms`): bolt11 expiries are conventionally quoted
-      // in seconds, and a bare `expires_at` invites a reader to assume that.
+      // Wire timestamp is milliseconds; bolt11 lifetimes are conventionally expressed in
+      // seconds.
       expires_at_ms: invoice.expiresAt
     }
   };
@@ -8324,26 +8284,13 @@ var DRAIN_CONFLICT_COPY = {
     retryable: true,
     drainRegistered: false
   },
-  // Deliberately rail-neutral: `refundFloorEvidence` is one floor over both
-  // channel rails, and two doors with two answers about one shortfall is the
-  // drift consolidating it was meant to prevent (internal-review). Tempo answers its
-  // own through `tempoFloorRefusal`, which reaches the same conclusion a step
-  // earlier and adds the one rail-specific fact — its channel is already closed.
   refund_floor: {
     display: "The refund reached the chain, but it paid less than the balance this service had recorded, so nothing was booked here. Your on-chain refund arrived; the difference has to be reconciled by the service operator.",
     hint: ({ creditId, drainId }) => `Report drain ${drainId} on credit ${creditId} to the service operator \u2014 only they can reconcile the difference. Retrying this drain, or requesting a new drain_id, lands here again.`,
-    // Terminal for the caller, unlike the two above: no amount of waiting or
-    // re-signing changes what the chain already paid.
     retryable: false,
-    // True even though the ledger transaction that would have written the drain
-    // row rolled back around this refusal. The wedged settlement row is recorded
-    // outside that transaction (internal-review) and holds this drain id as its
-    // `effect_id`, which is the id `X402SettlementRepair.reconcile` books the
-    // drain under — so the caller has to keep it. Dropping it mints a fresh one
-    // that the wedged-channel gate refuses as `settlement_pending` anyway, and
-    // re-presenting *this* id is that gate's own documented exemption. Tempo
-    // reaches the same `true` one artifact earlier, off a `credit_drains` row
-    // its close-intent reservation already committed (internal-review).
+    // The settlement evidence survives outside the rolled-back ledger transaction. Keep
+    // drain_registered:true so the caller retains this effect ID for repair even when no
+    // drain row committed.
     drainRegistered: true
   }
 };
@@ -8389,8 +8336,6 @@ function drainLedgerErrorResponse(error, creditId, drainId) {
       message: error.message,
       display: copy?.display,
       hint: copy?.hint({ creditId, drainId }),
-      // An unclassified conflict keeps the duplicate-payout copy's own
-      // `retryable`, and the id it was never told anything about.
       retryable: copy?.retryable,
       extra: { drain_registered: copy?.drainRegistered ?? false }
     });
@@ -8441,8 +8386,8 @@ function creditBody(credit, reconciliationPending = false) {
     remaining_micro: credit.availableMicro,
     expiry_ms: credit.expiryMs,
     expired: credit.expired,
-    // Reclaimable via op "drain" (internal-review) — true whenever spendable-or-
-    // expired value remains. Expiry ends spending, never ownership.
+    // Nominal expiry does not itself reclaim ownership; a committed sweep can remove undrawn
+    // value.
     drainable: credit.status === "active" && credit.availableMicro > 0,
     ...reconciliationPending && { reconciliation_pending: true },
     ledger_seq: credit.lastLedgerSeq
@@ -8976,11 +8921,9 @@ var X402ExactSettlementServer = class {
     }
     return this.finalize(intent, args.btcUsdRate, args.commit);
   }
-  /** Read the operator queue. */
   list(args) {
     return this.opts.store.list(args);
   }
-  /** Read durable attempt evidence for one intent. */
   attempts(dvmId, intentId) {
     return this.opts.store.attempts(dvmId, intentId);
   }
@@ -9315,13 +9258,13 @@ function buildContext(job, opts) {
       if (terminated("prompt")) {
         return Promise.reject(new JobCancelledError(`Job already ${job.status}`));
       }
+      job.status = "awaiting-input";
       providerMessage(job, "prompt", {
         id,
         text,
         ...promptOpts?.options && { options: promptOpts.options },
         ...promptOpts?.schema && { schema: promptOpts.schema }
       });
-      job.status = "awaiting-input";
       if (job.replayHighSeq !== null) {
         const response = job.messages.find(
           (m) => m.type === "response" && m.from === "requester" && m.content.prompt_id === id
@@ -9435,7 +9378,7 @@ function buildContext(job, opts) {
           poolBasis: pool.basis,
           askCurrency,
           // `draw` here means the pool read fine and either the ASK wouldn't pin
-          // — an fx outage on a bare-msats ask, or a sub-micro amount — or it
+          // an fx outage on a bare-msats ask, or a sub-micro amount — or it
           // pinned in a currency this pool isn't denominated in.
           ...pool.basis === "draw" && { poolCurrency: pool.currency }
         });
@@ -9570,8 +9513,8 @@ function buildContext(job, opts) {
           ask_msats: amountMsats
         });
       }
-      providerMessage(job, "payment-request", paymentRequestContent);
       job.status = "awaiting-input";
+      providerMessage(job, "payment-request", paymentRequestContent);
       const paidMsatsAtYield = job.paidMsats;
       const p = new Promise((resolve, reject) => {
         let resolved = false;
@@ -9580,12 +9523,24 @@ function buildContext(job, opts) {
           unsubscribeNotify?.();
           unsubscribeNotify = void 0;
         };
-        const doResolve = (pc) => {
+        const doResolve = async (pc) => {
           if (resolved) return;
           resolved = true;
           cleanup();
           creditedToHandlerMsats += amountMsats;
           creditedToHandlerMicro += pendingFiat?.amountMicro ?? 0;
+          if (job.pendingPayment?.resolve === doResolve) {
+            job.pendingPayment = null;
+            job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
+            if (job.status === "awaiting-input" && opts.onYield) {
+              try {
+                await opts.onYield();
+              } catch (err) {
+                reject(err);
+                return;
+              }
+            }
+          }
           resolve(pc);
         };
         const doReject = (err) => {
@@ -9602,11 +9557,17 @@ function buildContext(job, opts) {
             if (resolved) return;
             try {
               const counters = await getCounters();
-              if (!counters) return;
+              if (!counters || resolved) return;
               const satisfied = poolBasis ? counters.paidMsats - paidMsatsAtYield >= amountMsats : counters.paidMsats - creditedToHandlerMsats >= amountMsats;
               if (satisfied) {
+                const resume = async () => {
+                  job.paidMsats = counters.paidMsats;
+                  job.pendingPaymentMsats = counters.pendingPaymentMsats;
+                  await doResolve({ amount_msats: amountMsats });
+                };
                 if (opts.claimForProcessing) {
-                  const won = await opts.claimForProcessing();
+                  const won = await opts.claimForProcessing(resume);
+                  if (resolved) return;
                   if (!won) {
                     resolved = true;
                     cleanup();
@@ -9614,10 +9575,7 @@ function buildContext(job, opts) {
                     return;
                   }
                 }
-                job.paidMsats = counters.paidMsats;
-                job.pendingPaymentMsats = counters.pendingPaymentMsats;
-                if (job.status === "awaiting-input") job.status = "processing";
-                doResolve({ amount_msats: amountMsats });
+                await resume();
               }
             } catch (err) {
               log.error("requestPayment NOTIFY check failed", { error: String(err) });
@@ -9668,12 +9626,12 @@ function buildContext(job, opts) {
       runTerminal();
     },
     // `failOpts.refund` is a caller-fault annotation and nothing more
-    // (internal-review). No rail hands value backwards: a failed job's debit is the
+    // No rail hands value backwards: a failed job's debit is the
     // credit draw the terminal funnel releases, and the caller reclaims that
-    // balance through the internal-review `drain` op. The Cashu branch that used to
+    // balance through the `drain` op. The Cashu branch that used to
     // send proofs back here was dead — `job.receivedProofs` has been empty on
     // every path since the accumulator became the commit boundary for inbound
-    // proofs (internal-review) — and internal-review, the accumulator-debit rewrite that would
+    // proofs — and the accumulator-debit rewrite that would
     // have revived it, was cancelled as superseded by the ledger.
     fail: (error) => {
       if (terminated("fail")) return;
@@ -9742,16 +9700,10 @@ var ReceiptIssuer = class {
     this.pubkey = receiptPubkeyFromSecret(opts.secret);
   }
   /**
-   * Build and sign the receipt for a terminal job. `seq` comes from
-   * `JobStore.claimReceiptSeq`, `issuedAt` defaults to now (tests pin it).
-   *
-   * Free jobs get receipts too, with `paid.msats: 0` — they still consume a
-   * sequence number and still attest an outcome. Whether feedback is
-   * paid-only is the feedback layer's call, not this one's.
-   *
-   * `credit` is the resolved draw block (internal-review) — present on every job
-   * whose payment funded/drew the ledger, absent otherwise. Signature-
-   * compatible either way: `canonicalize` omits absent keys.
+   * seq is store-allocated; issuedAt is epoch seconds. Free jobs also consume a
+   * sequence and attest their outcome. Timing/attribution comes from the committed
+   * terminal row; legacy rows omit unknown historical fields. credit is present
+   * only for a resolved ledger draw.
    */
   issue(record, seq, issuedAt, credit) {
     const unsigned = {
@@ -9762,6 +9714,14 @@ var ReceiptIssuer = class {
       capability: record.capability,
       outcome: outcomeFor(record.status),
       reason: terminalReason(record),
+      ...record.timingKnown !== false && record.terminalAtMs !== void 0 && {
+        timing: {
+          accepted_at_ms: record.createdAt,
+          terminal_at_ms: record.terminalAtMs,
+          caller_wait_ms: record.callerWaitMs ?? 0
+        }
+      },
+      ...record.timingKnown !== false && record.status !== "completed" && record.endedBy && { ended_by: record.endedBy },
       seq,
       issued_at: issuedAt ?? Math.floor(Date.now() / 1e3),
       requester_pubkey: record.requesterPubkey ?? null,
@@ -9780,7 +9740,7 @@ var ReceiptIssuer = class {
     return signReceipt(unsigned, this.secret);
   }
   /**
-   * Countersign one reclaim event (internal-review). Unlike job receipts there is
+   * Countersign one reclaim event. Unlike job receipts there is
    * no store-allocated sequence — the drain's own `ledger_seq` (taken under
    * the credit row lock, shared with draws) already orders it in the
    * per-credit evidence chain.
@@ -9854,7 +9814,6 @@ function resultHashFor(record) {
 }
 
 // src/lib/cashu/mint-info.ts
-var MINT_INFO_TTL_MS = 5 * 6e4;
 async function getKeysetFinalExpiry(mintUrl, keysetId) {
   try {
     const wallet = await getWallet(mintUrl);
@@ -10097,12 +10056,16 @@ var JobManager = class {
   cleanupTimers = /* @__PURE__ */ new Map();
   /** Cost revisions held only by a terminal handler owner until its durable merge succeeds. */
   terminalCostHandoffRetryTimers = /* @__PURE__ */ new Map();
-  /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
+  /** Per-job NOTIFY unsubscribe handles for the durable-status watch. */
   statusWatchers = /* @__PURE__ */ new Map();
-  /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
+  /** Job ids whose durable-status re-read is in flight — coalesces notify storms. */
   statusChecksInFlight = /* @__PURE__ */ new Set();
-  /** Job ids that were notified mid-re-read and must be re-checked (internal-review). */
+  /** Job ids that were notified mid-re-read and must be re-checked. */
   statusChecksQueued = /* @__PURE__ */ new Set();
+  // Every local input resume holds this queue through its durable wait update.
+  // A prompt response and a payment NOTIFY must not mistake each other for a
+  // different machine's successful claim.
+  inputResumeTails = /* @__PURE__ */ new WeakMap();
   sessionId = randomBytes4(3).toString("hex");
   nextJobId = 1;
   accumulatorMonitor;
@@ -10110,7 +10073,7 @@ var JobManager = class {
   processingWatchdogMs;
   reactivationClaimGraceMs;
   /**
-   * Worker-heartbeat cadence (internal-review). Also floors the internal-review clock
+   * Worker-heartbeat cadence. Also floors the clock
    * guard's compensation on the processing arm — see
    * {@link staleSweepCompensationCapMs}.
    */
@@ -10130,7 +10093,7 @@ var JobManager = class {
   jobRetentionResumeFrom;
   /**
    * A `Date.now()` reading that cannot regress within this manager's lifetime
-   * (internal-review). Anchored at construction, so a manager already running when
+   * Anchored at construction, so a manager already running when
    * the clock stepped is covered. The stale-job sweep's two cutoffs, the
    * orphan-draw age gate and the reactivation claim grace all read it; see
    * {@link createMonotonicClock} for what it costs and where it is clamped.
@@ -10143,7 +10106,7 @@ var JobManager = class {
   jobRetentionSweepInFlight = false;
   heartbeatInFlight = false;
   /**
-   * The denomination of every credit this DVM opens (internal-review). Resolved once,
+   * The denomination of every credit this DVM opens. Resolved once,
    * with the same boundary fallback `DVMServer` applies for direct JavaScript
    * callers that force an incomplete value past the descriptor contract.
    */
@@ -10158,7 +10121,7 @@ var JobManager = class {
       this.jobStore = new MemoryJobStore();
     } else {
       throw new Error(
-        "JobManager requires a persistent jobStore in production. Pass `jobStore` explicitly, set `devMode: true`, or construct via createDVMHost (which boots a PostgresJobStore from DATABASE_URL). See internal-review / internal-review."
+        "JobManager requires a persistent jobStore in production. Pass `jobStore` explicitly, set `devMode: true`, or construct via createDVMHost (which boots a PostgresJobStore from DATABASE_URL)."
       );
     }
     if (opts.receiptIssuer && !isReceiptIssuingStore(this.jobStore)) {
@@ -10166,7 +10129,7 @@ var JobManager = class {
         JSON.stringify({
           level: "warn",
           event: "receipts_disabled_store_unsupported",
-          message: "DVMKIT_RECEIPT_KEY is set but the configured jobStore does not implement ReceiptIssuingStore (claimReceiptSeq / saveReceipt), so no receipts will be issued and /v1/info will not advertise them. Use PostgresJobStore, MemoryJobStore, or implement both methods. See internal-review."
+          message: "DVMKIT_RECEIPT_KEY is set but the configured jobStore does not implement ReceiptIssuingStore (claimReceiptSeq / saveReceipt), so no receipts will be issued and /v1/info will not advertise them. Use PostgresJobStore, MemoryJobStore, or implement both methods."
         })
       );
     }
@@ -10265,7 +10228,7 @@ var JobManager = class {
         }
       }
     }
-    if (opts.dvmId && opts.onJobCost && isTerminalCostRecoveryStore(this.jobStore)) {
+    if (opts.dvmId && (opts.onJobCost || opts.onJobTerminal) && isTerminalCostRecoveryStore(this.jobStore)) {
       this.terminalCostRecoveryTimer = setInterval(() => {
         void this.recoverTerminalCosts().catch((err) => {
           console.error(
@@ -10279,16 +10242,14 @@ var JobManager = class {
       this.terminalCostRecoveryTimer.unref();
     }
   }
-  /** Active in-memory jobs. */
   get activeJobs() {
     return this._activeJobs;
   }
-  /** The backing job store. */
   get store() {
     return this.jobStore;
   }
   /**
-   * True when this DVM will actually issue receipts (internal-review) — a key *and*
+   * True when this DVM will actually issue receipts — a key *and*
    * a store that can allocate sequence numbers and persist bytes write-once.
    * `/v1/info#receipts` reads this rather than the key alone, so the flag can
    * never promise something `issueReceipt` silently declines to do.
@@ -10296,16 +10257,14 @@ var JobManager = class {
   get receiptsEnabled() {
     return this.opts.receiptIssuer !== void 0 && isReceiptIssuingStore(this.jobStore);
   }
-  /** True when the named capability exists on this descriptor. */
   hasCapability(name) {
     return Object.prototype.hasOwnProperty.call(this.descriptor.capabilities, name);
   }
-  /** Names of every capability this descriptor exposes — used for error envelopes. */
   capabilityNames() {
     return Object.keys(this.descriptor.capabilities);
   }
   /**
-   * Resolve a capability's static `price` to msats (internal-review).
+   * Resolve a capability's static `price` to msats.
    *
    * `"$X.XX"` is parsed as USD and converted via the SDK's shared fx fetcher.
    * Returns `undefined` for dynamic-priced capabilities (those that declare
@@ -10318,7 +10277,7 @@ var JobManager = class {
   }
   /**
    * Translate a capability's static `price` into the fiat envelope used by
-   * the per-capability `pricing.max` advertised on `/v1/info` (internal-review).
+   * the per-capability `pricing.max` advertised on `/v1/info`.
    * Returns `undefined` for dynamic-priced capabilities and for unknown
    * names (the route handler validates the name before invoking this).
    */
@@ -10328,24 +10287,24 @@ var JobManager = class {
     return resolvePricingMax(cap.price);
   }
   /**
-   * Parse a request body through a capability's input schema (internal-review).
+   * Parse a request body through a capability's input schema.
    *
    * Resolution order when a capability declares an `input` schema:
    * 1. `body.data` is preferred — agents pass structured fields directly
-   *    (CLI builds this from `--param k=v`).
+   * (CLI builds this from `--param k=v`).
    * 2. Fallback: `JSON.parse(body.input)` for clients still on the legacy
-   *    JSON-string contract.
+   * JSON-string contract.
    * 3. Neither usable → throw `MissingStructuredInputError` so the route can
-   *    return `invalid_input` with a hint pointing at `/v1/info`.
+   * return `invalid_input` with a hint pointing at `/v1/info`.
    *
    * When the capability has no `input` schema, returns `body.input` raw
    * (primitive path).
    *
-   * The internal-review credit envelope is removed before the schema runs, on both
-   * branches (internal-review) — it rides the signed body but is protocol-level, so a
+   * The credit envelope is removed before the schema runs, on both
+   * branches — it rides the signed body but is protocol-level, so a
    * top-level `.strict()` capability schema would otherwise reject every
    * explicit draw as an unknown key, before the envelope was even extracted.
-   * The persisted `record.input` the internal-review reactivation path re-reads is the
+   * The persisted `record.input` the reactivation path re-reads is the
    * pre-Zod wire form, so it comes through the second branch carrying them too.
    */
   parseInput(body, capability) {
@@ -10363,7 +10322,7 @@ var JobManager = class {
     throw new MissingStructuredInputError();
   }
   /**
-   * Look up the per-capability descriptor by name (internal-review). Throws when the
+   * Look up the per-capability descriptor by name. Throws when the
    * name doesn't exist — the route layer validates body.capability first, so
    * reaching this with an unknown name is a programmer error.
    */
@@ -10389,7 +10348,7 @@ var JobManager = class {
     return this.descriptor.capabilities[name];
   }
   /**
-   * Allocate the id the next job will be created under (internal-review). The
+   * Allocate the id the next job will be created under. The
    * submit path calls this BEFORE payment verification so the ledger draw
    * commits with its job linkage, then passes the id back through
    * `createJob`'s provenance. Ids allocated for requests whose payment is
@@ -10400,7 +10359,7 @@ var JobManager = class {
     return `job-${this.sessionId}-${this.nextJobId++}`;
   }
   /**
-   * Create a new job from a request body. `provenance` (internal-review) is what the
+   * Create a new job from a request body. `provenance` is what the
    * idempotent-replay path on `POST /v1/job` reads back: the raw `job_token`
    * to re-issue, and the fingerprint + caller pubkey a retry must reproduce
    * to be given it.
@@ -10456,27 +10415,23 @@ var JobManager = class {
     this.watchDurableStatus(job);
     return job;
   }
-  /** Build an SDKJobContext and attach it to the job. */
   buildAndAttachContext(job, parsedInput) {
     const auth = deriveAuthFromParsedInput(this.descriptor, parsedInput);
     const sdkCtx = buildContext(job, { ...this.buildContextOpts(job), parsedInput, auth });
     job.sdkCtx = sdkCtx;
     return sdkCtx;
   }
-  /** Start the handler for a job. */
   runHandler(job, sdkCtx) {
     const cap = this.getCapability(job.capability);
     const onError = (err) => {
       if (isTerminal(job.status)) return;
       job.replayProviderSkip = 0;
-      if (!job.pendingPrompts.size && !job.pendingPayment) {
-        job.status = "failed";
-        providerMessage(job, "cancel", {
-          reason: err instanceof Error ? err.message : String(err)
-        });
-        job.terminalWork = this.finalizeTerminal(job);
-        void job.terminalWork;
-      }
+      job.status = "failed";
+      providerMessage(job, "cancel", {
+        reason: err instanceof Error ? err.message : String(err)
+      });
+      job.terminalWork = this.finalizeTerminal(job);
+      void job.terminalWork;
     };
     if (!cap) {
       if (!isTerminal(job.status)) {
@@ -10504,16 +10459,46 @@ var JobManager = class {
       onError(err);
     }
   }
-  /** Dispatch a validated incoming message to the appropriate handler or pending resolver. */
   async dispatchMessage(job, type, content) {
+    if (type !== "response" && type !== "payment") {
+      return this.dispatchMessageNow(job, type, content);
+    }
+    const pending = type === "payment" ? job.pendingPayment : job.pendingPrompts.get(content.prompt_id);
+    await this.queueInputResume(job, async () => {
+      const current = type === "payment" ? job.pendingPayment : job.pendingPrompts.get(content.prompt_id);
+      if (pending && current !== pending) return;
+      return this.dispatchMessageNow(job, type, content);
+    });
+  }
+  async queueInputResume(job, resume) {
+    const previous = this.inputResumeTails.get(job) ?? Promise.resolve();
+    const next = previous.catch(() => void 0).then(resume);
+    this.inputResumeTails.set(job, next);
+    try {
+      return await next;
+    } finally {
+      if (this.inputResumeTails.get(job) === next) this.inputResumeTails.delete(job);
+    }
+  }
+  async claimLocalInput(job) {
+    await job.messageAppenderTail;
+    return isStreamableJobStore(this.jobStore) ? this.jobStore.claimForProcessing(job.id) : true;
+  }
+  async dispatchMessageNow(job, type, content) {
     const ctx = job.sdkCtx;
     const cap = this.getCapability(job.capability);
     if (type === "response") {
       const rc = content;
       const pending = job.pendingPrompts.get(rc.prompt_id);
       if (pending) {
+        if (!await this.claimLocalInput(job)) {
+          await this.adoptDurableTerminal(job);
+          return;
+        }
+        if (job.pendingPrompts.get(rc.prompt_id) !== pending || isTerminal(job.status)) return;
         job.pendingPrompts.delete(rc.prompt_id);
-        job.status = "processing";
+        job.status = job.pendingPrompts.size > 0 || job.pendingPayment ? "awaiting-input" : "processing";
+        if (job.status === "awaiting-input") await this.persistJob(job);
         pending.resolve(rc);
       } else if (cap?.onResponse && ctx) {
         await cap.onResponse(ctx, rc);
@@ -10522,9 +10507,15 @@ var JobManager = class {
       const pc = content;
       if (job.pendingPayment) {
         const pp = job.pendingPayment;
+        if (!await this.claimLocalInput(job)) {
+          await this.adoptDurableTerminal(job);
+          return;
+        }
+        if (job.pendingPayment !== pp || isTerminal(job.status)) return;
         job.pendingPayment = null;
-        job.status = "processing";
-        pp.resolve(pc);
+        job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
+        if (job.status === "awaiting-input") await this.persistJob(job);
+        await pp.resolve(pc);
       } else if (cap?.onPayment && ctx) {
         await cap.onPayment(ctx, pc);
       }
@@ -10533,6 +10524,7 @@ var JobManager = class {
     } else if (type === "cancel") {
       const reason = content?.reason ?? "Job cancelled";
       abortJob(job, reason);
+      job.endedBy = "caller";
       job.status = "cancelled";
       if (cap?.onCancel && ctx) {
         await cap.onCancel(ctx, content);
@@ -10551,17 +10543,16 @@ var JobManager = class {
       });
     }
   }
-  // ── Persistence ──────────────────────────────────────────────────────
   /**
    * Persist a job to the backing store.
    *
-   * Awaits the per-job appender tail (internal-review) so that:
-   *   1. The snapshot's `messages` is consistent with the `job_messages` table
-   *      — no row is still in flight at snapshot time.
-   *   2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
-   *      can't race a still-pending `appendOutgoing` for the final yield
-   *      message (which would otherwise wipe the row before an in-flight SSE
-   *      subscriber's NOTIFY-driven fetch can see it).
+   * Awaits the per-job appender tail so that:
+   * 1. The snapshot's `messages` is consistent with the `job_messages` table
+   * no row is still in flight at snapshot time.
+   * 2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
+   * can't race a still-pending `appendOutgoing` for the final yield
+   * message (which would otherwise wipe the row before an in-flight SSE
+   * subscriber's NOTIFY-driven fetch can see it).
    */
   async persistJob(job) {
     if (job.messageAppenderTail) {
@@ -10582,9 +10573,17 @@ var JobManager = class {
     } else {
       await this.jobStore.save(record);
     }
+    const saved = await this.jobStore.get(job.id);
+    if (saved) {
+      job.timingKnown = saved.timingKnown;
+      job.endedBy = saved.endedBy;
+      job.terminalAtMs = saved.terminalAtMs;
+      job.callerWaitMs = saved.callerWaitMs;
+      job.awaitingInputAtMs = saved.awaitingInputAtMs;
+    }
   }
   /**
-   * Cross-machine terminal guard (internal-review). `buildContext`'s guard reads the
+   * Cross-machine terminal guard. `buildContext`'s guard reads the
    * in-memory `job.status`, so on its own it only protects the machine running
    * the handler. On a multi-machine DVM a `DELETE /v1/job/:id` routinely lands
    * on a machine that isn't running the job — `app.ts` cancels it in the store
@@ -10596,7 +10595,7 @@ var JobManager = class {
    * fires `job.abort` so in-flight `ctx.fetch` calls tear down. Returns true when
    * the durable state won and the caller must skip its save.
    *
-   * Two triggers: `watchDurableStatus`'s NOTIFY subscription (internal-review) fires
+   * Two triggers: `watchDurableStatus`'s NOTIFY subscription fires
    * this within a round-trip of the remote cancel committing, which is what
    * actually stops the provider spend; `persistJob` calls it again on every save
    * as the backstop for the window where a cancel commits between a handler's
@@ -10604,8 +10603,10 @@ var JobManager = class {
    * stores' terminal-sticky `save`, which keeps the row itself correct).
    */
   async adoptDurableTerminal(job) {
-    const durable = isStreamableJobStore(this.jobStore) ? await this.jobStore.getCounters(job.id).catch(() => void 0) : await this.jobStore.get(job.id).catch(() => void 0);
-    if (!durable || !isTerminal(durable.status) || durable.status === job.status) return false;
+    const counters = isStreamableJobStore(this.jobStore) ? await this.jobStore.getCounters(job.id).catch(() => void 0) : await this.jobStore.get(job.id).catch(() => void 0);
+    if (!counters || !isTerminal(counters.status) || counters.status === job.status) return false;
+    const durable = await this.jobStore.get(job.id);
+    if (!durable) return false;
     console.warn(
       JSON.stringify({
         level: "job_terminal_elsewhere",
@@ -10616,6 +10617,11 @@ var JobManager = class {
     );
     job.status = durable.status;
     job.summary = durable.summary;
+    job.timingKnown = durable.timingKnown;
+    job.endedBy = durable.endedBy;
+    job.terminalAtMs = durable.terminalAtMs;
+    job.callerWaitMs = durable.callerWaitMs;
+    job.awaitingInputAtMs = durable.awaitingInputAtMs;
     const reason = durable.status !== "completed" && durable.summary ? durable.summary : `Job ${durable.status}`;
     for (const [, p] of job.pendingPrompts) p.reject(new JobCancelledError(reason));
     job.pendingPayment?.reject(new JobCancelledError(reason));
@@ -10635,7 +10641,7 @@ var JobManager = class {
       });
     }
     this.clearIdleTimer(job.id);
-    void this.issueReceiptForStoredJob(job.id);
+    void this.issueReceiptForStoredJob(job.id).then(() => this.reportTerminalJob(job.id));
     this.scheduleCleanup(job);
     if (durable.status !== "completed" && terminalCostPersisted) {
       await this.reportJobCost(job);
@@ -10681,6 +10687,7 @@ var JobManager = class {
   async retryTerminalCostHandoff(job, attempt) {
     if (!await this.tryPersistAdoptedTerminalCost(job, attempt)) return;
     await this.reportJobCost(job);
+    await this.reportTerminalJob(job.id);
   }
   /** Durably merge a terminal handler owner's latest cost before reporting it. */
   async persistAdoptedTerminalCost(job) {
@@ -10710,7 +10717,7 @@ var JobManager = class {
     );
   }
   /**
-   * Watch the durable status of a locally-active job (internal-review).
+   * Watch the durable status of a locally-active job.
    *
    * `ctx.signal` is raised by `dispatchMessage`, which only runs on the machine
    * holding the job in `activeJobs`. On a multi-machine DVM the `DELETE` usually
@@ -10751,7 +10758,7 @@ var JobManager = class {
     });
   }
   /**
-   * Tear down a job's durable-status subscription (internal-review). Must be called
+   * Tear down a job's durable-status subscription. Must be called
    * wherever a job leaves `activeJobs` — a leaked subscriber outlives the job on
    * the store's shared LISTEN connection. Idempotent.
    */
@@ -10763,12 +10770,12 @@ var JobManager = class {
     unsubscribe();
   }
   /**
-   * NOTIFY-driven durable-status re-read, coalesced per job (internal-review).
+   * NOTIFY-driven durable-status re-read, coalesced per job.
    *
    * A notify that arrives while a re-read is in flight is queued rather than
    * dropped: the in-flight read may have observed the row a moment *before* the
-   * cancel committed, and dropping its notify would put the abort back where
-   * this issue found it — waiting for the handler's next store write.
+   * cancel committed, and dropping its notify would leave the local handler
+   * running until its next store write instead of aborting promptly.
    */
   async checkDurableTerminal(job) {
     if (this.statusChecksInFlight.has(job.id)) {
@@ -10798,13 +10805,13 @@ var JobManager = class {
   /**
    * Wire the Tx A appender when the store supports streaming.
    *
-   * Tx A (internal-review): outgoing message + `pending_payment_msats` bump land in
+   * Tx A: outgoing message + `pending_payment_msats` bump land in
    * the same transaction. The DB allocates the row's seq via
    * `UPDATE jobs SET next_seq = next_seq + 1 RETURNING` so concurrent inbound
    * traffic on different machines can never collide on the `(job_id, seq)` PK.
    * In-memory `job.seq` keeps its own counter for same-machine SSE listeners.
    *
-   * Per-job serialisation (internal-review): chained through `job.messageAppenderTail`
+   * Per-job serialisation: chained through `job.messageAppenderTail`
    * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
    * `complete`) commit their `appendOutgoing` transactions in call order.
    * Without this, the two transactions race for the `jobs` row lock and the
@@ -10838,7 +10845,7 @@ var JobManager = class {
               // In-memory counter, NOT the authoritative DB-allocated seq:
               // `appendOutgoing` allocates the real seq via `UPDATE ...
               // RETURNING` inside the transaction that just failed, so no DB
-              // seq was assigned for this message (internal-review).
+              // seq was assigned for this message.
               localSeq: msg.seq,
               note: "localSeq is the in-process counter; the DB-allocated seq was never assigned (append rolled back)",
               error: err instanceof Error ? err.message : String(err)
@@ -10849,8 +10856,6 @@ var JobManager = class {
       job.messageAppenderTail = next;
     };
   }
-  // ── Idle timeout ─────────────────────────────────────────────────────
-  /** Start (or restart) the idle timer for a job. */
   startIdleTimer(job) {
     this.clearIdleTimer(job.id);
     const timeoutMs = this.descriptor.idleTimeout * 1e3;
@@ -10859,7 +10864,6 @@ var JobManager = class {
     }, timeoutMs);
     this.idleTimers.set(job.id, timer);
   }
-  /** Clear the idle timer for a job. */
   clearIdleTimer(id) {
     const timer = this.idleTimers.get(id);
     if (timer) {
@@ -10867,7 +10871,7 @@ var JobManager = class {
       this.idleTimers.delete(id);
     }
   }
-  /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard (internal-review). */
+  /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard. */
   async cancelJobIdle(job) {
     if (isTerminal(job.status)) return;
     const current = await this.jobStore.get(job.id).catch(() => void 0);
@@ -10886,6 +10890,7 @@ var JobManager = class {
     if (job.pendingPayment) job.pendingPayment.reject(new Error("Job timed out (idle)"));
     job.pendingPrompts.clear();
     job.pendingPayment = null;
+    job.endedBy = (current?.status ?? job.status) === "awaiting-input" ? "caller" : "provider";
     job.status = "cancelled";
     abortJob(job, "Job timed out (idle)");
     providerMessage(job, "cancel", { reason: "Job timed out (idle)" });
@@ -10893,14 +10898,13 @@ var JobManager = class {
     void job.terminalWork;
     this.scheduleCleanup(job);
   }
-  // ── Stale-job sweeper (internal-review / internal-review) ──────────────────────────
   /**
    * Force-terminate stale non-terminal jobs. Two status-aware arms:
-   *   • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
-   *     (`stale_no_terminal_status`) — the caller never paid / responded.
-   *   • `processing`/`working` past `processingWatchdogMs` → `failed`
-   *     (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
-   *     live workers fresh, so a stale row here means a dead process.
+   * • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
+   * (`stale_no_terminal_status`) — the caller never paid / responded.
+   * • `processing`/`working` past `processingWatchdogMs` → `failed`
+   * (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
+   * live workers fresh, so a stale row here means a dead process.
    *
    * Fires on a timer (wired in the constructor) and also callable on demand
    * (tests, ops). The CAS in `cancelStaleJob` makes this safe to run
@@ -10909,17 +10913,17 @@ var JobManager = class {
    * descriptors — the local activeJobs teardown only makes sense on the
    * JobManager that actually hosted the zombie handler.
    *
-   * **Both cutoffs float off the wall clock (internal-review).** Each is one
+   * **Both cutoffs float off the wall clock.** Each is one
    * `Date.now()` sample compared against `last_activity_at`, stamped from a
    * different sample at a different moment, so a backwards step between the
    * two makes every row look more recently active than it is: the query
    * matches nothing and both arms go silent for the length of the skew. The
    * dead worker's job keeps its `processing` status, its credit hold stays
-   * `pending`, and the internal-review paid-job-death alert — wired to this reaper —
-   * never fires. Same defect, same host class, as internal-review's orphan sweep.
+   * `pending`, and the paid-job-death alert — wired to this reaper —
+   * never fires. Same defect, same host class, as orphan sweep.
    *
    * **The compensation is capped** — see {@link staleSweepCompensationCapMs}
-   * for where each arm's cap comes from — which internal-review did not need to do. Its eagerness costs at worst an early release
+   * for where each arm's cap comes from — which did not need to do. Its eagerness costs at worst an early release
    * of an unclaimed hold, refused outright for any live job row; ours
    * force-*fails* a running job. `cancelStaleJob`'s CAS does not cover that:
    * `expectedActivityBefore` is the same compensated threshold the query used,
@@ -11055,7 +11059,7 @@ var JobManager = class {
   }
   /**
    * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
-   * clock to cover a backwards step (internal-review). The compensation is capped,
+   * clock to cover a backwards step. The compensation is capped,
    * not free: a claimed row must still have been silent for
    * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
    * force-fails a job that may well be alive.
@@ -11075,7 +11079,7 @@ var JobManager = class {
    * clock stepped. That pair is marginal already; the guard must not make it
    * deterministic. The cap collapses to zero there, which is today's
    * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
-   * — nothing heartbeats it by design, and its refresh is an inbound caller
+   * nothing heartbeats it by design, and its refresh is an inbound caller
    * message on no cadence at all.
    *
    * **Why a magnitude and not a predicate.** The tempting sharper rule is to
@@ -11094,7 +11098,6 @@ var JobManager = class {
     if (!heartbeated || this.heartbeatIntervalMs <= 0) return halfWindow;
     return Math.max(0, Math.min(halfWindow, windowMs - 2 * this.heartbeatIntervalMs));
   }
-  // ── Terminal job content retention ───────────────────────────────────
   /**
    * Redact terminal job content beyond this DVM's configured window.
    *
@@ -11259,12 +11262,11 @@ var JobManager = class {
       );
     }
   }
-  // ── Orphan-draw sweeper (internal-review) + terminal reconciler (internal-review) ──
   /**
    * Resolve `pending` credit draws the terminal funnel can no longer reach.
    * Two arms over one scan, distinguished by whether the draw's job row exists.
    *
-   * **No job row (internal-review) — release.** internal-review allocates the job id and
+   * **No job row — release.** allocates the job id and
    * commits the ledger draw, with its `job_id` linkage, before `recordReplay`
    * and `persistJob` write the job row. A crash, a `draw_conflict` 409, or a
    * fail-closed `replay_detected` 401 in that window leaves a committed hold
@@ -11274,12 +11276,12 @@ var JobManager = class {
    * available balance stays reduced forever. Cosmetic for an implicit N=1
    * credit, a silent balance shrink for an explicit N>1 one.
    *
-   * **Terminal job row (internal-review) — reconcile to its outcome.** The funnel
+   * **Terminal job row — reconcile to its outcome.** The funnel
    * demonstrably fails: `resolveCreditDraw` throws on a ledger/DB error,
    * `issueReceipt` catches it, logs `credit_resolve_failed` and returns
    * nothing, and until now nothing retried. Same stranded hold, reached through
    * a different door — and for a `completed` job it strands the platform's
-   * books too, since draws *are* the revenue events (internal-review): the caller is
+   * books too, since draws *are* the revenue events: the caller is
    * charged nothing, the balance never moves, and outstanding liability
    * (`deposits − draw revenue`) overstates forever. So a late settle books, off
    * the committed draw row, through the ordinary reporter path.
@@ -11407,8 +11409,8 @@ var JobManager = class {
     }
   }
   /**
-   * The end-of-scan line for a tick that resolved nothing (internal-review, extended
-   * by internal-review). Two shapes are worth a warning, and neither is the ordinary
+   * The end-of-scan line for a tick that resolved nothing. Two shapes are
+   * worth a warning, and neither is the ordinary
    * one — the timer runs every 5 minutes per ledger in production.
    *
    * `examined > 0`: aged candidates were looked at and none moved. Usually
@@ -11417,7 +11419,7 @@ var JobManager = class {
    *
    * `examined === 0`: the query returned nothing. Ordinarily that means there
    * is nothing to do — but it is equally what a blinded scan looks like, which
-   * is the case the internal-review gate could not reach. Probe for the oldest
+   * is the case the gate could not reach. Probe for the oldest
    * `pending` hold at any age and speak up when one exists the scan should
    * have seen and didn't: already past the age gate outright, stamped ahead of
    * our clock (some other process's clock is fast), or hidden while our own
@@ -11469,7 +11471,7 @@ var JobManager = class {
     );
   }
   /**
-   * Resolve one aged `pending` draw whose job row reached terminal (internal-review),
+   * Resolve one aged `pending` draw whose job row reached terminal,
    * mirroring what `resolveCreditDraw` would have done in line. Returns true
    * when this call is the one that moved the draw — the caller counts it, and
    * only it books.
@@ -11542,7 +11544,7 @@ var JobManager = class {
   /**
    * Refresh `lastActivityAt` for jobs this process is actively running
    * (`processing`/`working`) so the processing watchdog only fires once the
-   * worker is genuinely dead (internal-review). `awaiting-input` jobs are
+   * worker is genuinely dead. `awaiting-input` jobs are
    * deliberately excluded — their idle timeout must still elapse. Fires on the
    * heartbeat timer; also callable on demand for tests.
    */
@@ -11562,17 +11564,16 @@ var JobManager = class {
       this.heartbeatInFlight = false;
     }
   }
-  // ── Reactivation (replay) ────────────────────────────────────────────
   /**
-   * Single-execution claim for a reactivating machine (internal-review). Before
+   * Single-execution claim for a reactivating machine. Before
    * replaying an `awaiting-input` job, wait a bounded grace window for a live
    * original handler to win the `awaiting-input → processing` CAS via its
    * NOTIFY wake. Resolves:
-   *   • `false` — the row left `awaiting-input` during the window (the original
-   *     handler claimed it / drove it terminal). Stand down; do not replay.
-   *   • `true`  — the window elapsed still `awaiting-input` (the original worker
-   *     is gone or has no live resolver) AND this machine won the claim CAS.
-   *     Replay for dead-worker recovery.
+   * • `false` — the row left `awaiting-input` during the window (the original
+   * handler claimed it / drove it terminal). Stand down; do not replay.
+   * • `true` — the window elapsed still `awaiting-input` (the original worker
+   * is gone or has no live resolver) AND this machine won the claim CAS.
+   * Replay for dead-worker recovery.
    *
    * Biasing the original handler to win kills the double execution (double
    * substrate spend, clobbered artifact) without heartbeating `awaiting-input`
@@ -11595,7 +11596,7 @@ var JobManager = class {
     }
   }
   /**
-   * Record an inbound client message durably via Tx B (internal-review) and append
+   * Record an inbound client message durably via Tx B and append
    * it to the in-memory `job.messages` array. Returns the DB-allocated seq
    * (`null` when the store isn't streamable — non-Postgres test fallback).
    *
@@ -11639,13 +11640,13 @@ var JobManager = class {
    * in-memory `ServerJob`, wires the appender, builds the context, starts
    * the idle timer. The caller has already recorded the inbound via Tx B
    * and run Tx C (verify + credit); reactivation is now decoupled from
-   * credit (internal-review, internal-review). The caller decides whether to run the
+   * credit. The caller decides whether to run the
    * handler (Pattern A: status was `awaiting-input`) or to dispatch the
    * message to a custom handler (Pattern B).
    *
    * For DVMs that declare descriptor-level auth, the persisted
    * `record.input` carries the original signed envelope. We re-verify the
-   * signature here (internal-review) so a DB-layer tamper — compromised admin, SQL
+   * signature here so a DB-layer tamper — compromised admin, SQL
    * injection, malicious operator with DB access — can't silently feed an
    * attacker-supplied pubkey/envelope into the handler. The drift window
    * and replay store are deliberately skipped: the persisted timestamp is
@@ -11659,7 +11660,7 @@ var JobManager = class {
    * What gets re-verified is the persisted row read back through
    * {@link signedRequestInput} — `app.ts` stores the pre-Zod wire form, so
    * those are the caller's own signed bytes, the same ones `/v1/quote` and the
-   * submit checked (internal-review). That makes the tamper check strictly stronger
+   * submit checked. That makes the tamper check strictly stronger
    * than the parsed form it replaced: an injected key the capability schema
    * doesn't declare used to be stripped before the signature was checked, so
    * it re-verified clean.
@@ -11704,7 +11705,7 @@ var JobManager = class {
     return { job, sdkCtx };
   }
   /**
-   * Verify an inbound payment and apply the credit via Tx C (internal-review).
+   * Verify an inbound payment and apply the credit via Tx C.
    * The inbound message must have been recorded via Tx B already
    * (`recordInboundPending` returned `inboundSeq`). For non-streamable
    * stores (`inboundSeq === null`), falls back to in-memory mutation via
@@ -11714,12 +11715,12 @@ var JobManager = class {
    * `pendingPaymentMsats` without external verification. Gated on
    * `devModeSkipsPaymentVerification` — the same predicate the upfront path
    * reads, so a dev server wired to a mint verifies mid-job payments for real
-   * (internal-review) — plus the explicit `dev_auto` opt-out the dev console uses,
+   * plus the explicit `dev_auto` opt-out the dev console uses,
    * which is the one caller that has no wallet to pay from. `dev_auto` loses to
    * any proof riding the same message: money on the wire always takes the rail,
    * so the flag can never leave a real token unspent against a credited job.
    *
-   * Tx C is not atomic with the rail commit (internal-review). `verifyIncomingPayment`
+   * Tx C is not atomic with the rail commit. `verifyIncomingPayment`
    * commits the proofs *and* the ledger leg in one transaction and returns;
    * only then does `verifyAndCredit` write the job row, on its own connection.
    * Everything after that call therefore runs with the caller's money already
@@ -11769,7 +11770,7 @@ var JobManager = class {
         lockPubkeys: extra?.lockPubkeys,
         mintHealthTracker: extra?.mintHealthTracker,
         fxFetcher: this.opts.fxFetcher,
-        // internal-review: the ledger leg — a mid-job payment is a top-up that funds
+        // the ledger leg — a mid-job payment is a top-up that funds
         // the job's credit and grows its draw, atomically with the rail commit.
         creditLedger: this.opts.creditLedger,
         processedPayments: this.opts.processedPayments,
@@ -11904,7 +11905,7 @@ var JobManager = class {
     return { ...unappliedCredit && { unappliedCredit } };
   }
   /**
-   * Tx C with a bounded retry (internal-review).
+   * Tx C with a bounded retry.
    *
    * By the time this runs on the verified path, the rail commit and the ledger
    * leg have already committed in a transaction this call is not part of — so a
@@ -11991,7 +11992,7 @@ var JobManager = class {
   }
   /**
    * Answer a payment whose rail and ledger legs committed but whose job row
-   * could not be written (internal-review) — every retry spent, the money real.
+   * could not be written — every retry spent, the money real.
    *
    * The refusal names the credit the money landed on so the caller can act on
    * it directly, mirroring the short mid-job pay's 402 (`payment.ts`). It is a
@@ -12000,7 +12001,7 @@ var JobManager = class {
    * fault an operator should see in their 5xx rate. `retryable` is true because
    * the ask is genuinely still outstanding.
    *
-   * Nothing is released here. The hold is left to the internal-review reconciler,
+   * Nothing is released here. The hold is left to the reconciler,
    * which makes the same decision — unbound draw ⇒ release, never settle — but
    * under the credit row's `FOR UPDATE`, after the job is terminal, where it
    * cannot race an in-flight COMMIT. Releasing from here would also be
@@ -12067,7 +12068,7 @@ var JobManager = class {
   }
   /**
    * Describe a deposit the job row never took, in the shape both the 201 and
-   * the `payment_unapplied` 500 carry (internal-review). `undefined` when the payment
+   * the `payment_unapplied` 500 carry. `undefined` when the payment
    * ran ledger-less (no credit ledger wired, or the top-up preflight skipped) —
    * there is no credit to name, so the 201 carries no `credit` block and the
    * 500 takes its words from `unappliedCopy` directly.
@@ -12081,7 +12082,7 @@ var JobManager = class {
       ...unappliedCopy(reason, creditId)
     };
   }
-  /** Book a mid-job top-up's funding as a deposit (internal-review, spec §10). */
+  /** Book a mid-job top-up's funding as a deposit (the deposit-accounting rule). */
   reportCreditDeposit(funding) {
     const onCreditFunded = this.opts.onCreditFunded;
     if (!funding || !onCreditFunded || !this.opts.dvmId) return;
@@ -12094,7 +12095,7 @@ var JobManager = class {
   /**
    * Internal: build the BuildContextOpts shared between `createJob` and
    * `reactivateJob`. Centralised so persistence/terminal callbacks and the
-   * internal-review NOTIFY-driven cross-machine wake stay in one place.
+   * NOTIFY-driven cross-machine wake stay in one place.
    */
   buildContextOpts(job) {
     const jobStore = this.jobStore;
@@ -12113,7 +12114,16 @@ var JobManager = class {
       getCounters: isStreamableJobStore(jobStore) ? () => jobStore.getCounters(job.id) : void 0,
       drawPool: this.opts.creditLedger ? () => this.resolveDrawPool(job) : void 0,
       pricingCurrency: this.pricingCurrency,
-      claimForProcessing: isStreamableJobStore(jobStore) ? () => jobStore.claimForProcessing(job.id) : void 0,
+      claimForProcessing: isStreamableJobStore(jobStore) ? (resume) => {
+        const pending = job.pendingPayment;
+        return this.queueInputResume(job, async () => {
+          if (!pending || job.pendingPayment !== pending || isTerminal(job.status)) return false;
+          if (!await this.claimLocalInput(job)) return false;
+          if (job.pendingPayment !== pending || isTerminal(job.status)) return false;
+          await resume?.();
+          return true;
+        });
+      } : void 0,
       onSuperseded: () => {
         this.clearIdleTimer(job.id);
         this.unwatchDurableStatus(job.id);
@@ -12124,7 +12134,7 @@ var JobManager = class {
   }
   /**
    * Internal: what unit `ctx.requestPayment`'s auto-credit gate may measure this
-   * job's remaining pool in (internal-review).
+   * job's remaining pool in.
    *
    * The regime is read off the DRAW, never off the job. Implicit N=1 is exactly
    * `credit_id === imp:<rail>:<draw_id>`, because `fundAndDraw` derives both
@@ -12142,8 +12152,7 @@ var JobManager = class {
    * drew and whose pool this can't read or denominate answers `unpriced`, which
    * the gate declines to auto-credit from: the msat figure it would otherwise
    * fall back on is a slice of the credit's rail value at a ratio pinned
-   * whenever that credit was funded, which is the exact figure this issue exists
-   * to stop spending against.
+   * whenever that credit was funded, so it cannot safely fund a new ask.
    */
   async resolveDrawPool(job) {
     const ledger = this.opts.creditLedger;
@@ -12192,7 +12201,7 @@ var JobManager = class {
   }
   /**
    * Issue the signed receipt for a job that has reached a terminal status
-   * (internal-review). Idempotent and safe to call from every terminal path — the
+   * Idempotent and safe to call from every terminal path — the
    * store owns both the sequence allocation and the write-once persist, so
    * two machines racing on the same job converge on identical bytes and burn
    * exactly one sequence number.
@@ -12277,10 +12286,10 @@ var JobManager = class {
     };
   }
   /**
-   * Settle or release a terminal job's credit draw (internal-review): `completed`
+   * Settle or release a terminal job's credit draw: `completed`
    * settles (the hold becomes a real debit); `failed`/`cancelled` releases
    * (the hold evaporates — "no debit on job failure", mechanically
-   * superseding the internal-review/974 no-op refund for credit-paid jobs, including
+   * superseding the 974 no-op refund for credit-paid jobs, including
    * the `ctx.fail` path and the stale-sweeper reap). Idempotent — a replayed
    * resolution returns the recorded state. Returns the `ReceiptCredit` block
    * for the receipt: `balance_after` is the recorded draw trajectory for a
@@ -12326,7 +12335,7 @@ var JobManager = class {
     }
   }
   /**
-   * The one place a terminal job's status becomes a ledger verb (internal-review):
+   * The one place a terminal job's status becomes a ledger verb:
    * `completed` settles the hold into a real debit, `failed`/`cancelled`
    * release it. Read by the in-line funnel (`resolveCreditDraw`) and by the
    * late reconciler (`reconcileTerminalDraw`) — two paths that must never
@@ -12341,45 +12350,47 @@ var JobManager = class {
    * cleanup window hand back the same bytes as a cross-machine re-read.
    */
   async attachReceipt(job) {
-    const receipt = await this.issueReceipt(toJobRecord(job));
+    const record = await this.jobStore.get(job.id);
+    if (!record || !isTerminal(record.status)) return;
+    const receipt = await this.issueReceipt(record);
     if (receipt) job.receipt = receipt;
   }
   /**
-   * Read-path repair for a terminal job carrying no receipt (internal-review), for
+   * Read-path repair for a terminal job carrying no receipt, for
    * either an in-memory job or a store record. Free in the steady state — it
    * returns on the `receipt` check without touching the store — so it costs
    * only on the cases it exists for:
    *
    * - **A crash between the two store calls.** `claimReceiptSeq` commits the
-   *   sequence number to the job row before `saveReceipt` writes the bytes; a
-   *   process death in that window would otherwise strand that number
-   *   forever, and a permanent gap is indistinguishable from the deliberate
-   *   suppression `seq` exists to expose. Re-issuing here reuses the already
-   *   committed number (the claim is idempotent per job) rather than
-   *   allocating a second one.
+   * sequence number to the job row before `saveReceipt` writes the bytes; a
+   * process death in that window would otherwise strand that number
+   * forever, and a permanent gap is indistinguishable from the deliberate
+   * suppression `seq` exists to expose. Re-issuing here reuses the already
+   * committed number (the claim is idempotent per job) rather than
+   * allocating a second one.
    * - **A transient store failure** at the terminal: `issueReceipt` logs
-   *   `receipt_issue_failed` and returns nothing rather than failing the job,
-   *   so the next read retries.
+   * `receipt_issue_failed` and returns nothing rather than failing the job,
+   * so the next read retries.
    * - **Jobs that terminated before the DVM had a receipt key.** They pick one
-   *   up on first read, with `issued_at` reflecting when it was signed.
+   * up on first read, with `issued_at` reflecting when it was signed.
    */
   async ensureReceipt(target) {
-    if (target.receipt) return;
-    const record = "listeners" in target ? toJobRecord(target) : target;
+    if (target.receipt) {
+      if (isTerminal(target.status)) await this.reportTerminalJob(target.id);
+      return;
+    }
+    const record = "listeners" in target ? await this.jobStore.get(target.id) : target;
+    if (!record || !isTerminal(record.status)) return;
     const receipt = await this.issueReceipt(record);
     if (receipt) target.receipt = receipt;
+    if (isTerminal(target.status)) await this.reportTerminalJob(target.id);
   }
-  /**
-   * Close out a terminal job whose caller hasn't already persisted it: sign
-   * the receipt, then save the snapshot. The snapshot save never writes the
-   * receipt column, so ordering only affects how soon a reader sees the
-   * receipt — this way a caller polling immediately after the terminal
-   * already finds it.
-   */
+  /** Commit the terminal snapshot before resolving money and signing its durable evidence. */
   async finalizeTerminal(job) {
+    await this.persistJob(job);
     await this.attachReceipt(job);
-    await this.persistJob(job).catch(() => void 0);
     await this.reportJobCost(job);
+    await this.reportTerminalJob(job.id);
   }
   /**
    * Issue a receipt for a job this process doesn't hold in `activeJobs` — a
@@ -12398,20 +12409,68 @@ var JobManager = class {
   }
   /**
    * Finish accounting for a terminal written directly to the store — the
-   * stale reaper and a cancel handled on a different machine (internal-review).
+   * stale reaper and a cancel handled on a different machine.
    */
   async finalizeStoredTerminal(jobId) {
     const receipt = await this.issueReceiptForStoredJob(jobId);
     const record = await this.jobStore.get(jobId).catch(() => void 0);
-    if (record && isTerminal(record.status)) await this.reportJobCost(record);
+    if (record && isTerminal(record.status)) {
+      await this.reportJobCost(record);
+      await this.reportTerminalJob(jobId);
+    }
     return receipt;
   }
-  /** Handle job reaching terminal state (completed, failed, cancelled). */
+  async reportTerminalJob(jobId) {
+    try {
+      const callback = this.opts.onJobTerminal;
+      const dvmId = this.opts.dvmId;
+      if (!callback || !dvmId) return;
+      const record = await this.jobStore.get(jobId);
+      if (!record || !isReceiptableStatus(record.status) || record.timingKnown === false || record.terminalAtMs === void 0 || record.status !== "completed" && !record.endedBy) return;
+      const receipt = await this.issueReceipt(record);
+      if (this.opts.receiptIssuer && !receipt) return;
+      if (record.creditId && record.drawId && this.opts.creditLedger) {
+        const draw = await this.opts.creditLedger.getDraw({ creditId: record.creditId, drawId: record.drawId });
+        if (!draw || draw.status === "pending") return;
+      }
+      await callback({
+        dvmId,
+        jobId: record.id,
+        capability: record.capability,
+        outcome: record.status,
+        endedBy: record.status === "completed" ? null : record.endedBy ?? "provider",
+        paid: record.paidMsats > 0 || (record.nativeAmount ?? 0) > 0 || !!record.drawId,
+        acceptedAtMs: record.createdAt,
+        terminalAtMs: record.terminalAtMs,
+        callerWaitMs: record.callerWaitMs ?? 0,
+        receiptSeq: receipt?.seq ?? null
+      });
+      if ("markTerminalReported" in this.jobStore) {
+        await this.jobStore.markTerminalReported(jobId);
+      }
+    } catch (error) {
+      console.error(`[${jobId}] Terminal reporting failed:`, error);
+    }
+  }
+  terminalReportRecoveryCursor;
+  async recoverTerminalReports() {
+    const store = this.jobStore;
+    const dvmId = this.opts.dvmId;
+    if (!this.opts.onJobTerminal || !dvmId || !("listUnreportedTerminalReports" in store)) return;
+    const recovery = store;
+    const records = await recovery.listUnreportedTerminalReports(dvmId, this.capabilityNames(), this.terminalReportRecoveryCursor);
+    for (const record of records) await this.reportTerminalJob(record.id);
+    this.terminalReportRecoveryCursor = records.length === 100 ? records[records.length - 1].id : void 0;
+  }
   async handleJobTerminal(job) {
     this.clearIdleTimer(job.id);
+    if (await this.adoptDurableTerminal(job)) return;
+    const durable = await this.jobStore.get(job.id);
+    if (!durable || !isTerminal(durable.status)) await this.persistJob(job);
     await this.attachReceipt(job);
     const booked = await this.bookRevenue(job);
     if (!booked) await this.reportJobCost(job);
+    await this.reportTerminalJob(job.id);
     this.scheduleCleanup(job);
   }
   /**
@@ -12424,6 +12483,7 @@ var JobManager = class {
   async recoverTerminalCosts() {
     const store = this.jobStore;
     const dvmId = this.opts.dvmId;
+    await this.recoverTerminalReports();
     if (!dvmId || !this.opts.onJobCost || !isTerminalCostRecoveryStore(store)) {
       return { examined: 0, queued: 0, complete: true };
     }
@@ -12508,11 +12568,11 @@ var JobManager = class {
     return true;
   }
   /**
-   * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
+   * Report a completed paid job's revenue under its durable job identity.
    * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
    *
    * For a **credit-backed** job the revenue event is the *settled draw* (spec
-   * §10), and since internal-review the sats figure corrects the job's mirror of that
+   * §10), and since the behavior was introduced the sats figure corrects the job's mirror of that
    * draw against the draw itself: `withDrawBasis` stamps the job when the
    * payment lands, but a Bitcoin credit's settle re-prices the draw against
    * the funding lots it consumed. The correction is a delta, because a job's
@@ -12527,7 +12587,7 @@ var JobManager = class {
    * whose price couldn't be fiat-denominated) nothing changes: the pre-credits
    * payload is reported verbatim.
    *
-   * Takes the fields rather than a `ServerJob` so the internal-review reconciler — a
+   * Takes the fields rather than a `ServerJob` so the reconciler — a
    * background sweep that holds no in-process job — books through this exact
    * path off the row it read. `paymentTxHash` is passed **verbatim**, never
    * recomputed as a `drawSettlementRef`: it is the same column the in-line
@@ -12544,7 +12604,7 @@ var JobManager = class {
    * DVM with no reporter). Every drop that costs a booking logs first.
    *
    * The rail check sits **below** the draw re-read, not in the entry guard
-   * (internal-review): a settled draw the terminal can't report under is a real debit
+   * a settled draw the terminal can't report under is a real debit
    * with no revenue event, permanently overstating outstanding liability
    * (`deposits − draw revenue`), and it used to return here in silence. Placed
    * after the re-read, `revenue_skipped_no_rail` can name the draw and its
@@ -12607,9 +12667,9 @@ var JobManager = class {
             paidMsats: job.paidMsats,
             creditRail: creditRail ?? null,
             // Four distinct causes needing four distinct fixes, so none of them
-            // is the else-branch: the credit predates internal-review and has no rail
+            // is the else-branch: the credit predates and has no rail
             // (`credit_rail_null`); it carries one this build doesn't list, the
-            // internal-review sibling class (`credit_rail_unrecognized`); the credit's
+            // sibling class (`credit_rail_unrecognized`); the credit's
             // rail is perfectly good and it is the *job row* that lost its own
             // (`job_rail_missing`), which no change to the ledger would fix; or
             // this manager was built with no `creditLedger` to read the draw
@@ -12657,7 +12717,7 @@ var JobManager = class {
         cashuFlow: job.cashuFlow,
         // Absent unless the handler declared one, and absent is a fact: the
         // platform shows "no costs reported" rather than a zero cost and a
-        // 100% margin (internal-review). Both halves or neither — a bare amount
+        // 100% margin. Both halves or neither — a bare amount
         // in an unnamed currency is not a cost.
         ...job.costAmountMicro !== void 0 && job.costCurrency !== void 0 ? { cost: { amountMicro: job.costAmountMicro, currency: job.costCurrency } } : {},
         ...credit
@@ -12677,7 +12737,6 @@ var JobManager = class {
     }, 6e4);
     this.cleanupTimers.set(job.id, timer);
   }
-  /** Clear all timers. Called on server shutdown to allow clean exit. */
   shutdown() {
     for (const [id] of this.idleTimers) {
       this.clearIdleTimer(id);
@@ -12840,8 +12899,8 @@ var MintHealthTracker = class {
   firstProbeComplete = false;
   constructor(opts) {
     this.mints = [...opts.mints];
-    this.tickIntervalMs = opts.tickIntervalMs ?? resolveEnvTickMs();
-    this.failuresToSick = opts.consecutiveFailuresToSick ?? resolveEnvFailuresToSick();
+    this.tickIntervalMs = opts.tickIntervalMs ?? resolveEnvTickMs(opts.env);
+    this.failuresToSick = opts.consecutiveFailuresToSick ?? resolveEnvFailuresToSick(opts.env);
     this.fetchImpl = opts.fetchImpl;
     this.probeOpts = { ...opts.probe, fetchImpl: opts.fetchImpl };
     this.nowFn = opts.now ?? Date.now;
@@ -12892,7 +12951,7 @@ var MintHealthTracker = class {
   /**
    * True once the first full probe tick has landed. Before this, paid calls
    * are held at `503 mint_health_pending` rather than accepted against
-   * unvalidated mints (internal-review).
+   * unvalidated mints.
    */
   initialProbeComplete() {
     return this.firstProbeComplete;
@@ -12917,12 +12976,11 @@ var MintHealthTracker = class {
    * gate — a deterministic, permanent config error, unlike a transient outage.
    * Unknown mints return false. `advertisedMints()` uses this to keep a
    * permanently-unsettleable mint off `/v1/info` even in the all-sick fallback,
-   * where a merely-flapping mint is still published (internal-review).
+   * where a merely-flapping mint is still published.
    */
   isNutIncompatible(mintUrl) {
     return this.state.get(normaliseMintUrl(mintUrl))?.nutIncompatible ?? false;
   }
-  /** Plain-object snapshot keyed by mint URL — for tests + observability. */
   snapshot() {
     return Object.fromEntries(Array.from(this.state.entries()).map(([k, v]) => [k, { ...v }]));
   }
@@ -12980,12 +13038,7 @@ var MintHealthTracker = class {
       );
     }
   }
-  /**
-   * One-shot structured summary emitted after the first probe tick. Replaces
-   * the boot check's per-mint `cashu_mint_startup_health` lines and surfaces an
-   * all-mints-unhealthy warning — the operator alert that the Fly restart-loop
-   * used to be before boot stopped refusing to start (internal-review).
-   */
+  /** One boot summary, including an all-unhealthy warning. */
   logBootHealth() {
     const mints = Object.entries(this.snapshot()).map(([mintUrl, s]) => ({
       mintUrl,
@@ -13009,15 +13062,15 @@ var MintHealthTracker = class {
     );
   }
 };
-function resolveEnvTickMs() {
-  const raw = process.env.DVMKIT_MINT_HEALTH_TICK_MS;
+function resolveEnvTickMs(env = process.env) {
+  const raw = env.DVMKIT_MINT_HEALTH_TICK_MS;
   if (!raw) return DEFAULT_TICK_INTERVAL_MS2;
   const parsed = Number(raw);
   if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_TICK_INTERVAL_MS2;
   return Math.floor(parsed);
 }
-function resolveEnvFailuresToSick() {
-  const raw = process.env.DVMKIT_MINT_FAILURES_TO_SICK;
+function resolveEnvFailuresToSick(env = process.env) {
+  const raw = env.DVMKIT_MINT_FAILURES_TO_SICK;
   if (!raw) return DEFAULT_FAILURES_TO_SICK;
   const parsed = Number(raw);
   if (!Number.isInteger(parsed) || parsed < 1) return DEFAULT_FAILURES_TO_SICK;
@@ -13116,7 +13169,6 @@ var PostgresX402ExactSettlementStore = class {
     this.pool = pool;
   }
   pool;
-  /** Create the exact settlement tables. */
   async init() {
     await withSdkInitLock(this.pool, async () => {
       await this.pool.query(`
@@ -14062,20 +14114,11 @@ async function handlePendingDrains(c, opts) {
       amount_micro: d.amountMicro,
       amount_sats: amountSats,
       amount_msats: amountSats === null ? null : amountSats * 1e3,
-      // Whether this row's sats figure is the in-kind obligation or a live-rate
-      // conversion. An operator settling a refund should be able to see which,
-      // and the servicer's own logs carry it for the same reason.
       sats_basis: amountSats === null ? null : d.owedSats === null ? "rate" : "in_kind",
-      // The figure a `manual` payout is actually sized in: `amount_micro` is
-      // fiat, and the operator sends the rail's own token. It is the same debit
-      // `completeX402ChannelDrain` treats as its settlement floor (internal-review),
-      // so publishing it is what lets an operator settle from the row instead
-      // of assuming their stablecoin happens to be six-decimal (internal-review).
+      // Rail-native debit, distinct from fiat amount_micro. This is the channel refund floor
+      // and the size a manual payout must cover.
       amount_native: d.drainedNative,
       settlement,
-      // Why this row is classified as it is, and the channel an operator would
-      // look up to see the close land. `payout` cannot answer it: a
-      // channel-backed mpp drain carries `{}`.
       channel_id: d.channelId,
       created_at: d.createdAt
     };
@@ -14086,13 +14129,7 @@ async function handlePendingDrains(c, opts) {
       acc[method] = pending.filter((d) => d.method === method).reduce((sum, d) => sum + d.amountMicro, 0);
       return acc;
     }, {}),
-    // What no job will ever pay down: the operator's own worklist, in the one
-    // denomination these rows have.
     manual_micro: drains.filter((d) => d.settlement === "manual").reduce((sum, d) => sum + d.amount_micro, 0),
-    // The rest of the stablecoin liability — owed, but by a channel close in
-    // flight rather than by a person. Published beside `manual_micro` so the
-    // difference between the two is visible rather than inferred from a
-    // `by_method_micro` figure neither of them matches.
     channel_micro: drains.filter((d) => d.settlement === "channel").reduce((sum, d) => sum + d.amount_micro, 0)
   };
   return c.json({ drains, liability, mints: opts.mints?.() ?? [] });
@@ -14121,17 +14158,21 @@ async function handleBitcoinLiability(c, opts) {
     drain_liability_sats: drainSats,
     drain_count: promised.length,
     total_owed_sats: deposit.depositSats + drainSats,
-    // Money this figure does not speak for, published rather than folded in:
-    // `uncovered` is a credit whose lots fall short of its balance, `unbacked`
-    // is one holding any open micro with no sats basis. A reclaim on either
-    // prices the whole balance off a live rate, so both are reported whole and
-    // neither contributes to `deposit_liability_sats` — a sweep computed
-    // against `total_owed_sats` alone is short by whatever they turn out to be
-    // worth.
+    // Uncovered or basisless balances require whole-balance live-rate pricing and do not
+    // contribute to deposit_liability_sats. total_owed_sats alone cannot reserve their
+    // eventual refunds.
     uncovered_credits: deposit.uncoveredCredits,
-    uncovered_micro: deposit.uncoveredMicro,
+    uncovered_by_currency: deposit.uncoveredByCurrency.map((currency) => ({
+      currency: currency.currency,
+      micro: currency.micro,
+      credits: currency.credits
+    })),
     unbacked_credits: deposit.unbackedCredits,
-    unbacked_micro: deposit.unbackedMicro,
+    unbacked_by_currency: deposit.unbackedByCurrency.map((currency) => ({
+      currency: currency.currency,
+      micro: currency.micro,
+      credits: currency.credits
+    })),
     unpriced_drains: drainsUnpriced
   });
 }
@@ -14569,9 +14610,6 @@ async function handleReconcileInvoice(c, opts) {
     const result = await opts.ledger.reconcileBlockedInvoice({
       paymentHash,
       targetCreditId,
-      // `fund`'s upsert OVERWRITES `expiry_ms`, so a bare `now + ttl` would
-      // shorten a target credit with more life left on it — destroying
-      // spendable value while purporting to add some.
       expiryMs,
       basis,
       ...settledAtMs === void 0 ? {} : { settledAtMs },
@@ -14592,9 +14630,6 @@ async function handleReconcileInvoice(c, opts) {
             creditCurrency: invoice.currency,
             fundedAt: settledAtMs ?? invoice.settledAt ?? nowMs,
             expiryMs,
-            // The settlements table types this deposit `repair` off the
-            // flag (internal-review): the sats landed at payment time and the
-            // deposit is the one row they get.
             repaired: true
           }
         }
@@ -14677,8 +14712,6 @@ async function handleWriteOffInvoice(c, opts) {
     amount_micro: written.amountMicro,
     currency: written.currency,
     note: written.writeOffNote,
-    // Mirrors the reconcile's `replayed`: the operator asked for a decision and
-    // finds one already recorded, possibly with someone else's note on it.
     replayed: !outcome.written
   });
 }
@@ -16588,7 +16621,7 @@ function autoApprovePayment(content) {
     headers: jobHeaders(true),
     // amount_msats rides along so an onPayment handler sees the same shape a
     // real rail would hand it. dev_auto is admitted on dev-mode servers only
-    // (internal-review) \u2014 hence the status check below rather than a silent catch.
+    // hence the status check below rather than a silent catch.
     body: JSON.stringify({ type: "payment", content: { dev_auto: true, amount_msats: content.amount_msats || 0 } }),
   }).then(function(r) {
     if (!r.ok) addMsg("Auto-approve rejected (" + r.status + ") \u2014 dev mode only.", "msg-system");
@@ -16735,7 +16768,7 @@ async function createDVMServer(descriptor, opts) {
     }
   })();
   try {
-    if (process.env.DVMKIT_CASHU_MINTS && opts.cashuMode === void 0) {
+    if (opts.env.DVMKIT_CASHU_MINTS && opts.cashuMode === void 0) {
       console.warn(
         JSON.stringify({
           level: "cashu_opts_env_ignored",
@@ -16748,12 +16781,12 @@ async function createDVMServer(descriptor, opts) {
     const platformUrl = opts.platformUrl ?? envMaybe.DVMKIT_PLATFORM_URL;
     const dvmId = opts.dvmId;
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-ASZ7SHHH.js");
+      const { RevenueReporter } = await import("./revenue-reporter-O75BGYFK.js");
       const reporter = new RevenueReporter(opts.db, platformUrl, platformToken);
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-RG6XNGPI.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-KEMUXEUO.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -16896,6 +16929,7 @@ async function createDVMServer(descriptor, opts) {
       processedPayments,
       onJobCompleted: effectiveOnJobCompleted,
       onJobCost: effectiveOnJobCost,
+      onJobTerminal: activeRevenueReporter?.reportTerminal.bind(activeRevenueReporter),
       onPaidJobDeath: effectiveOnPaidJobDeath,
       onRevenueSkippedNoRail: effectiveOnRevenueSkippedNoRail,
       onCreditFunded: opts.onCreditFunded,
@@ -16939,7 +16973,7 @@ var DVMServer = class {
   fxFetcher;
   /**
    * The currency this DVM prices in and denominates its credit ledger in,
-   * resolved once at construction (internal-review).
+   * resolved once at construction.
    *
    * `configureDVM` and the CLI loader both resolve this field. The server is
    * also exported for direct JavaScript callers, so defaulting at the one
@@ -16948,29 +16982,24 @@ var DVMServer = class {
    */
   pricingCurrency;
   /**
-   * Last-good lock-pubkey state observed from Postgres (internal-review). Used as the
+   * Last-good lock-pubkey state observed from Postgres. Used as the
    * fallback when `loadLockPubkeyState` throws — degrades more gracefully than
    * falling back to the env-derived seed, which post-rotation is the *retired*
    * pubkey. Null until the first successful read.
    */
   cachedLockPubkeyState = null;
-  /** Guards the opportunistic Tempo settlement cadence (internal-review). */
   tempoSweepInFlight = false;
   tempoSweepLastAttemptMs = 0;
-  /** Receipt signer for this DVM (internal-review). Undefined when no key is wired. */
   receiptIssuer;
-  /** Credit ledger the payment gate funds/draws through (internal-review). */
   creditLedger;
-  /** Durable x402/mpp funding markers (internal-review). */
   processedPayments;
   authAudience;
   /** Lazily constructed when a refreshed facilitator probe gains batch support. */
   x402BatchSettlement;
   /** Coalesces concurrent requests that first observe batch support. */
   x402BatchSettlementInit;
-  /** Durable exact-settlement coordinator shared by every exact payment surface. */
   x402ExactSettlement;
-  /** Withdraws this mount's Tempo session capability from the poll (internal-review). */
+  /** Withdraws this mount's Tempo session capability from the poll. */
   undeclareSessionCapability;
   constructor(descriptor, opts) {
     this.descriptor = descriptor;
@@ -16994,7 +17023,7 @@ var DVMServer = class {
       this.mintHealthTracker = opts.mintHealthTracker;
       this.ownsMintHealthTracker = false;
     } else if (opts.mints && opts.mints.length > 0) {
-      this.mintHealthTracker = new MintHealthTracker({ mints: opts.mints });
+      this.mintHealthTracker = new MintHealthTracker({ mints: opts.mints, env: opts.env });
       this.ownsMintHealthTracker = true;
     } else {
       this.ownsMintHealthTracker = false;
@@ -17015,17 +17044,9 @@ var DVMServer = class {
       mints: opts.mints,
       jobStore: opts.jobStore,
       devMode: opts.devMode,
-      // Derived, not raw (internal-review). `ctx.requestPayment` gates its x402 and
-      // Tempo challenge issuance on this list, while `/v1/info`, `/v1/quote`
-      // and the upfront 402 all read `resolvePaymentMethods()` — so passing the
-      // raw option meant a DVM that never set `paymentMethods` (no first-party
-      // one does; the descriptor documents it as "derived from configured
-      // rails") advertised both rails, took the upfront payment on either, and
-      // then emitted a mid-job payment-request carrying no rail at all. The
-      // caller's responder had nothing to sign and the job stalled at
-      // needs-approval — reachable only from a rung that raises a real mid-job
-      // ask, which nothing above L1 did. Facilitator availability is still
-      // re-checked per ask in `context.ts`, so a static list is safe here.
+      // Use the same derived rail list as discovery/upfront payment; otherwise
+      // default-configured rails vanish from mid-job asks. Availability is rechecked
+      // per ask.
       paymentMethods: (opts.paymentMethods ?? this.defaultPaymentMethods()).filter(
         (method) => method !== "x402" || this.x402CurrencySupported()
       ),
@@ -17040,21 +17061,20 @@ var DVMServer = class {
       dvmId: opts.dvmId,
       authAudience: this.authAudience,
       fxFetcher: this.fxFetcher,
-      // internal-review: the mid-job top-up leg needs the same rail wiring the upfront
+      // the mid-job top-up leg needs the same rail wiring the upfront
       // path gets — a divergence here would be a DVM whose upfront payment funds
       // a credit and whose mid-job payment silently doesn't.
       processedPayments: this.processedPayments,
       enqueueCreditDeposit: opts.enqueueCreditDeposit,
       enqueueCreditDrawRelease: opts.enqueueCreditDrawRelease,
       creditTtlMs: descriptor.credit ? descriptor.credit.ttlSeconds * 1e3 : void 0,
-      // internal-review: the same read `creditCurrency()` serves everywhere else, so a
-      // mid-job ask pins in the denomination this DVM's credits actually use.
       pricingCurrency: this.pricingCurrency,
       onCreditFunded: opts.onCreditFunded,
       onJobCompleted: opts.onJobCompleted,
       onPaidJobCompleted: opts.onPaidJobCompleted,
       paymentMode: opts.paymentMode,
       onJobCost: opts.onJobCost,
+      onJobTerminal: opts.onJobTerminal,
       onPaidJobDeath: opts.onPaidJobDeath,
       onRevenueSkippedNoRail: opts.onRevenueSkippedNoRail,
       onJobRetentionSweepFailed: opts.onJobRetentionSweepFailed,
@@ -17092,7 +17112,7 @@ var DVMServer = class {
    * Tear down this mount. Every leg is synchronous except the batch-settlement
    * server's own `stop()`; the returned promise settles once that has finished,
    * so a caller holding a resource behind it — the settlement pool the spend
-   * gate's store owns (internal-review) — can sequence its close instead of pulling it
+   * gate's store owns — can sequence its close instead of pulling it
    * out from under an in-flight stop. A rejection remains observable so the app
    * and host teardown layers can finish later cleanup before surfacing it.
    */
@@ -17193,12 +17213,12 @@ var DVMServer = class {
       (c) => c.json({
         ok: true,
         // shortSha, not .slice(0, 7): a dirty-tree deploy bakes a `-dirty`
-        // marker (internal-review) that a raw truncation would cut off the end,
+        // marker that a raw truncation would cut off the end,
         // leaving this endpoint claiming a clean commit while /v1/info's
         // untruncated sdk_sha says otherwise — same image, two answers.
-        gitSha: shortSha(process.env.GIT_SHA ?? "unknown"),
-        deployedAt: process.env.BUILD_TIME ?? "unknown",
-        deployId: process.env.DVMKIT_DEPLOY_ID ?? "unknown"
+        gitSha: shortSha(this.opts.env.GIT_SHA ?? "unknown"),
+        deployedAt: this.opts.env.BUILD_TIME ?? "unknown",
+        deployId: this.opts.env.DVMKIT_DEPLOY_ID ?? "unknown"
       })
     );
     if (this.opts.devMode) {
@@ -17231,8 +17251,6 @@ var DVMServer = class {
           getLockPubkeyState: () => this.loadActiveLockPubkeyState(db, dvmId),
           graceSeconds: this.graceSeconds(),
           nonceStore: this.adminCashuNonceStore,
-          // internal-review: a completed melt is a landed payout, queued in the
-          // transaction that marks it.
           ...payoutReporter ? { onMelted: payoutReporter.meltHook() } : {}
         });
       }
@@ -17250,13 +17268,13 @@ var DVMServer = class {
         enqueueCreditDeposit: this.opts.enqueueCreditDeposit,
         enqueueCreditDrain: this.opts.enqueueCreditDrain,
         lightningReceive: this.opts.lightningReceive,
-        // internal-review's x402 repair queue rides the same surface, and resolves
+        // x402 repair queue rides the same surface, and resolves
         // the rail the same lazy way the verify path does — constructing the
         // settlement server probes the facilitator, which must not happen just
         // because the admin routes were mounted.
         x402BatchSettlement: () => this.resolveX402BatchSettlement(),
         x402ExactSettlement: this.x402ExactSettlement,
-        // internal-review's Tempo repair queue, same surface again. The mppx handle is
+        // Tempo repair queue, same surface again. The mppx handle is
         // already built by the time routes mount, so the thunk is uniformity
         // rather than laziness — and it is the *handle*, not the store, so a
         // DVM wired with an in-memory session store resolves to a rail with no
@@ -17264,10 +17282,8 @@ var DVMServer = class {
         tempoDrainRail: () => Promise.resolve(this.opts.mpp),
         // Health-filtered, and read per request rather than captured: the
         // servicer picking a mint to buy a refund at wants the list that
-        // excludes a mint currently failing its probe (internal-review).
+        // excludes a mint currently failing its probe.
         mints: () => this.advertisedMints(),
-        // internal-review: a repaired Tempo close is a landed payout the agent
-        // finished, queued in the transaction that books the drain.
         ...payoutReporter ? { onTempoDrainReconciled: payoutReporter.tempoRepairHook() } : {}
       });
     }
@@ -17278,7 +17294,7 @@ var DVMServer = class {
   /**
    * Load the live lock-pubkey state for this DVM. Reads from
    * `dvm_lock_pubkeys` on every call so rotations propagate without needing
-   * a process restart (internal-review). On success the result is cached so a later
+   * a process restart. On success the result is cached so a later
    * DB outage can degrade to the last-observed state instead of the
    * env-derived seed (which post-rotation is the *retired* pubkey).
    */
@@ -17288,12 +17304,8 @@ var DVMServer = class {
     return state;
   }
   /**
-   * Resolve the active lock-pubkey set for the mid-job cashu accept path
-   * (internal-review). Returns the same `[current, ...retired_in_grace]` shape the
-   * upfront flow uses at lines 709-718 so accept-time rotation tolerance is
-   * consistent across upfront and mid-job. Falls back to `undefined` when
-   * accumulator mode isn't wired (the receive path then rejects with
-   * `cashu_not_p2pk_locked`).
+   * Mid-job and upfront receive paths use current plus grace-period retired keys.
+   * Without accumulator mode this is undefined and the receive path refuses it.
    */
   async resolveLockPubkeysForReceive() {
     if (this.opts.disposableCashu && this.opts.lockPubkey) return [toLockPubkey(this.opts.lockPubkey)];
@@ -17308,12 +17320,8 @@ var DVMServer = class {
     }
   }
   /**
-   * Best-effort lock-pubkey state for read-only consumers (`/v1/info` and the
-   * accept path). Tries Postgres; on failure falls back to the last-good
-   * cached state, and only as a final resort to the env-derived seed in a
-   * single-entry array. The cache makes the degradation safe across a
-   * rotation — without it the env seed advertises and accepts the retired
-   * pubkey while the DB is unreachable.
+   * Read Postgres first, then fall back to last-observed state, then the env seed.
+   * Caching avoids reverting an observed rotation to the old seed during an outage.
    */
   async lockPubkeyStateForRead(db, dvmId) {
     try {
@@ -17325,22 +17333,9 @@ var DVMServer = class {
     }
   }
   /**
-   * Run the routine Tempo settlement cadence opportunistically, on ordinary
-   * traffic (internal-review).
-   *
-   * Routine settlement used to ride the per-DVM watcher machine's four-minute
-   * poll, which is exactly what kept an idle DVM awake and billing. It cannot
-   * move to a timer for the same reason — a timer on a machine that ought to
-   * be suspended either does not fire or defeats the suspension. So it rides
-   * requests instead, the way Lightning funding is credited (internal-review): a DVM
-   * with no traffic has nothing to settle on a 24-hour cadence anyway, and the
-   * forced-close guarantee does not depend on this path at all — that is the
-   * chain-event wake, which reaches a suspended DVM through Fly Proxy.
-   *
-   * Fire-and-forget and self-throttled: the request never waits on it, only
-   * one runs at a time, and a failure is logged rather than surfaced. The
-   * sweep re-checks each channel's own schedule, so the throttle here only
-   * bounds how often we pay for the store scan.
+   * Opportunistic traffic avoids a timer that keeps an idle machine awake. Forced
+   * close servicing is independent. Fire-and-forget, one sweep at a time; failures
+   * are logged. The throttle bounds scans, not each channel's settlement schedule.
    */
   maybeSweepTempoSessions() {
     const sweep = this.opts.mpp?.sweepTempoSessions;
@@ -17372,7 +17367,7 @@ var DVMServer = class {
     });
   }
   /**
-   * Whether one advertised MPP method may still be offered (internal-review).
+   * Whether one advertised MPP method may still be offered.
    *
    * Only `tempo/session` is gated, and only when this DVM is platform-hosted:
    * a session channel is safe to accept exactly while something is watching
@@ -17388,7 +17383,6 @@ var DVMServer = class {
   tempoSessionOffered(method) {
     return this.tempoSessionWithheldReason(method) === void 0;
   }
-  /** Stable caller-facing reason for withholding one newly opened session. */
   tempoSessionWithheldReason(method) {
     if (method.method !== "tempo" || method.intent !== "session") return void 0;
     if (this.opts.tempoSettlementReadiness && !this.opts.tempoSettlementReadiness.available()) {
@@ -17399,7 +17393,6 @@ var DVMServer = class {
     }
     return void 0;
   }
-  /** Await only the cold-start reads each fail-closed session gate needs. */
   async ensureTempoSessionHealth() {
     await Promise.all([
       this.opts.tempoObserverHealth?.ensureFresh?.(),
@@ -17407,28 +17400,13 @@ var DVMServer = class {
     ]);
   }
   /**
-   * Whether this DVM is **configured** to take TIP-1034 session channels — the
-   * value the observer-health poll carries back to the platform, where it keeps
-   * `dvms.tempo_session_advertised_at` current between container deploys
-   * (internal-review).
-   *
-   * Deliberately the same question the platform's post-deploy `/v1/info` probe
-   * answers (`infoAdvertisesTempoSession`), from the same two facts: the credit
-   * menu exists at all, and the configured MPP methods include `tempo/session`.
-   * Credit-scoped because sessions are confined to `POST /v1/credit` — a
-   * top-level session method with no credit menu is not a channel anyone can
-   * open, so it is not a candidate the payee fallback should reach for.
-   *
-   * It reads `advertisedMethods` rather than {@link creditMppSplit}'s `offered`,
-   * and never {@link tempoSessionOffered}: what the column records is
-   * capability, not availability, so an observer blip must leave it alone. That
-   * distinction is the whole of internal-review, and answering it here from the gate
-   * would reintroduce it on a one-minute cadence.
+   * Report configured session capability independently of current availability.
+   * A temporary observer outage must not remove the platform's watch signal.
+   * Credit menu, auth and session method configuration still gate that capability.
    */
   tempoSessionCapability() {
     if (!this.opts.mpp) return false;
     if (!creditMenuConfigured({
-      // The SDK server only ever runs the container runtime — see `creditMenu`.
       runtime: "container",
       config: this.descriptor.credit,
       hasAuth: !!this.descriptor.auth,
@@ -17442,25 +17420,11 @@ var DVMServer = class {
     );
   }
   /**
-   * `POST /_internal/tempo-close-event` — the forced-close wake path
-   * (internal-review), replacing the per-DVM `tempo-session-watch` Fly Machine.
-   *
-   * Deliberately **unauthenticated**, and that is the design rather than an
-   * omission: the body is an event locator, so the DVM re-reads the event from
-   * its own Tempo RPC and verifies chain, escrow, topic and local channel
-   * ownership before touching money (see `handleTempoCloseEvent`). An
-   * unverifiable locator can therefore do nothing, which is what lets the
-   * platform wake a DVM without holding a signing key or a recoverable copy of
-   * the DVM's bearer token.
-   *
-   * What an unauthenticated caller *can* do is spend the DVM's resources: each
-   * POST is an unthrottled outbound `eth_getTransactionReceipt` against the
-   * builder's own Tempo provider, billed to them, before anything about the
-   * locator has been checked — the verification needs the receipt to happen at
-   * all. So the cost of an open endpoint is metered RPC calls, not money: no
-   * locator can move value except one naming a real close of a channel this
-   * DVM owns, and settling that is what the routine cadence would do anyway.
-   * Watch the provider's quota rather than the ledger.
+   * Unauthenticated wake carrying only an event locator. After parsing, verify
+   * the receipt from the DVM's own RPC, including chain, escrow, topic and local
+   * channel ownership before settlement. The observer needs no spending secret.
+   * Syntactically valid requests can still consume unthrottled provider RPC quota;
+   * malformed locators return 400 before that read.
    */
   registerTempoCloseEventRoute() {
     const mpp = this.opts.mpp;
@@ -17521,22 +17485,14 @@ var DVMServer = class {
     });
   }
   /**
-   * Compose the `/v1/info#builder` block from `opts.builder` (inline SDK
-   * config) with a fallback to deploy-injected env vars (internal-review). Each
-   * field is independently sourced (opts wins per-field, env fills gaps);
-   * all three of pubkey / attestation / signature must resolve to emit the
-   * block — partial state is treated as absent rather than half-emitted.
-   *
-   * Env-var form: `DVMKIT_BUILDER_ATTESTATION` is a JSON string (Fly secrets
-   * can't carry structured data), so it's parsed here. A malformed JSON
-   * string drops the block rather than throwing, so a corrupted env var
-   * can't take the DVM down.
+   * Options override environment per field. Emit only when pubkey, attestation
+   * and signature all exist; malformed attestation JSON omits the block.
    */
   builderAttestationBlock() {
     const builder = this.opts.builder;
     const env = this.opts.env;
-    const pubkey = builder?.pubkey ?? env.DVMKIT_BUILDER_PUBKEY ?? process.env.DVMKIT_BUILDER_PUBKEY;
-    const signature = builder?.signature ?? env.DVMKIT_BUILDER_SIGNATURE ?? process.env.DVMKIT_BUILDER_SIGNATURE;
+    const pubkey = builder?.pubkey ?? env.DVMKIT_BUILDER_PUBKEY;
+    const signature = builder?.signature ?? env.DVMKIT_BUILDER_SIGNATURE;
     const attestation = builder?.attestation ? { ...builder.attestation } : this.parseAttestationFromEnv(env);
     if (!pubkey || !signature || !attestation) return null;
     return { pubkey, attestation, signature };
@@ -17568,7 +17524,7 @@ var DVMServer = class {
     throw new AuthAudienceError();
   }
   /**
-   * The slug every receipt is stamped with (internal-review). Read off the signed
+   * The slug every receipt is stamped with. Read off the signed
    * attestation payload, which is the only place the *attested* slug lives —
    * a receipt claiming a different name than the attestation binds would be
    * unverifiable. Falls back to the descriptor name for dev/self-host boots
@@ -17579,14 +17535,13 @@ var DVMServer = class {
     const slug = attestation?.slug;
     return typeof slug === "string" && slug.length > 0 ? slug : this.descriptor.name;
   }
-  /** Immutable identity written into every signed receipt. */
   receiptDvmId() {
     const attestation = this.builderAttestationBlock()?.attestation;
     const dvmId = attestation?.dvm_id;
     return typeof dvmId === "string" && dvmId.length > 0 ? dvmId : this.opts.dvmId ?? this.descriptor.name;
   }
   parseAttestationFromEnv(env) {
-    const raw = env.DVMKIT_BUILDER_ATTESTATION ?? process.env.DVMKIT_BUILDER_ATTESTATION;
+    const raw = env.DVMKIT_BUILDER_ATTESTATION;
     if (!raw) return null;
     try {
       const parsed = JSON.parse(raw);
@@ -17597,7 +17552,7 @@ var DVMServer = class {
     }
   }
   /**
-   * Owner display block for `/v1/info#owner` (internal-review). Resolved from
+   * Owner display block for `/v1/info#owner`. Resolved from
    * `opts.owner` or env vars injected by the platform deploy pipeline.
    * Returns null when no owner identity is configured — pre-unification
    * DVMs that haven't been redeployed omit the block.
@@ -17605,11 +17560,11 @@ var DVMServer = class {
   ownerDisplayBlock() {
     const owner = this.opts.owner;
     const env = this.opts.env;
-    const handle = owner?.handle ?? env.DVMKIT_OWNER_HANDLE ?? process.env.DVMKIT_OWNER_HANDLE;
+    const handle = owner?.handle ?? env.DVMKIT_OWNER_HANDLE;
     if (!handle) return null;
-    const type = owner?.type ?? env.DVMKIT_OWNER_TYPE ?? process.env.DVMKIT_OWNER_TYPE ?? "builder";
-    const displayName = owner?.displayName ?? env.DVMKIT_OWNER_DISPLAY_NAME ?? process.env.DVMKIT_OWNER_DISPLAY_NAME ?? null;
-    const avatarUrl = owner?.avatarUrl ?? env.DVMKIT_OWNER_AVATAR_URL ?? process.env.DVMKIT_OWNER_AVATAR_URL ?? null;
+    const type = owner?.type ?? env.DVMKIT_OWNER_TYPE ?? "builder";
+    const displayName = owner?.displayName ?? env.DVMKIT_OWNER_DISPLAY_NAME ?? null;
+    const avatarUrl = owner?.avatarUrl ?? env.DVMKIT_OWNER_AVATAR_URL ?? null;
     return { handle, display_name: displayName, avatar_url: avatarUrl, type };
   }
   defaultPaymentMethods() {
@@ -17628,14 +17583,13 @@ var DVMServer = class {
     if (!this.opts.x402.batchSettlement?.selfRelay) return support;
     return { ...support, batchSettlement: true };
   }
-  /** Whether this DVM can state its price exactly in x402's USDC unit. */
   x402CurrencySupported() {
     return this.pricingCurrency === "usd";
   }
   /**
    * Settleable rails for this DVM, honouring an explicit `opts.paymentMethods`
    * override and otherwise deriving from wired rails. Single source of truth so
-   * the `/v1/info` and `/v1/quote` rail enumerations can't drift (internal-review).
+   * the `/v1/info` and `/v1/quote` rail enumerations can't drift.
    */
   resolvePaymentMethods() {
     const configured = this.opts.paymentMethods ?? this.defaultPaymentMethods();
@@ -17648,13 +17602,13 @@ var DVMServer = class {
   }
   /**
    * Rails a **credit top-up** may arrive on — the funding menu's list
-   * (internal-review). A superset of {@link resolvePaymentMethods}, and deliberately
+   * A superset of {@link resolvePaymentMethods}, and deliberately
    * a separate read: `lightning` funds a credit but is not an attached-proof
    * wire method, so it must never reach `/v1/info` or `/v1/quote`'s
-   * `payment.methods` (internal-review stands).
+   * `payment.methods`.
    *
-   * The rail drops out when the receive wallet is unreachable (spec §4 menu
-   * degradation) — advertising it then would hand the caller an option that
+   * The rail drops out of the funding menu when the receive wallet is unreachable;
+   * advertising it then would hand the caller an option that
    * fails on use, while the other rails would have closed the sale.
    */
   resolveFundingMethods() {
@@ -17673,7 +17627,7 @@ var DVMServer = class {
   }
   /**
    * The credit menu's MPP instruments, split into what is on offer right now
-   * and what this DVM is configured for but withholding (internal-review).
+   * and what this DVM is configured for but withholding.
    *
    * The split has to survive into the response rather than being filtered
    * away, because "not offered right now" and "not configured" are different
@@ -17701,7 +17655,7 @@ var DVMServer = class {
   }
   /**
    * Which x402 flavours a credit top-up may arrive on — the funding menu's
-   * `x402` sub-block (internal-review). Hosted health buys `exact`; a genuinely wired
+   * `x402` sub-block. Hosted health buys `exact`; a genuinely wired
    * batch server buys `batch-settlement` independently, including while the
    * hosted facilitator is unavailable or stale.
    *
@@ -17718,13 +17672,12 @@ var DVMServer = class {
       ...this.x402BatchAvailable() ? [{ scheme: X402_BATCH_SETTLEMENT_SCHEME, network: x402.network }] : []
     ];
   }
-  /** Whether a channel server is both supported and constructible for credit funding. */
   x402BatchAvailable() {
     return !!this.x402Support()?.batchSettlement && !!(this.opts.x402BatchSettlement ?? this.opts.x402BatchSettlementFactory);
   }
   /**
    * Apply any Lightning funding invoice this caller has paid since we last
-   * looked — the pull half of pull-based crediting (internal-review, spec §4).
+   * looked — the pull half of pull-based crediting.
    *
    * Called from every authenticated surface where the balance is about to
    * matter: the `/v1/credit` ops and the `/v1/job` submit. Deliberately **not**
@@ -17737,7 +17690,7 @@ var DVMServer = class {
    * outstanding, and never blocks the request when it fails.
    *
    * The SDK-owned reporter queues each Lightning deposit inside
-   * `settleInvoice`'s transaction (internal-review). The loop below only preserves
+   * `settleInvoice`'s transaction. The loop below only preserves
    * the explicit `onCreditFunded` override, whose caller owns its durability.
    */
   async settleLightningFunding(callerPubkey, creditId) {
@@ -17768,7 +17721,6 @@ var DVMServer = class {
       });
     }
   }
-  /** Credit lifetime this DVM mints, in ms — the descriptor's `credit.ttl` or the platform default. */
   creditTtlMs() {
     return this.descriptor.credit ? this.descriptor.credit.ttlSeconds * 1e3 : IMPLICIT_CREDIT_TTL_MS;
   }
@@ -17789,7 +17741,7 @@ var DVMServer = class {
    * The per-DVM + per-request rail wiring every payment verification needs —
    * everything except what the *operation* contributes (its price, its job or
    * fund id, the caller's credit fields). Shared by `/v1/job`'s upfront gate
-   * and `/v1/credit`'s top-up (internal-review) so a rail wired into one is wired
+   * and `/v1/credit`'s top-up so a rail wired into one is wired
    * into both by construction; a divergence here would be a rail that funds
    * jobs but silently can't fund credits.
    */
@@ -17822,7 +17774,7 @@ var DVMServer = class {
       mppCredential,
       mpp: this.opts.mpp,
       resourcePath: c.req.path,
-      // internal-review/internal-review: the gate covers issuance and new-channel acceptance,
+      // the gate covers issuance and new-channel acceptance,
       // not just the two advertisement surfaces. `ensureFresh` above makes this
       // an observation rather than a cold-start default on the one surface that
       // can act on it.
@@ -17840,8 +17792,6 @@ var DVMServer = class {
       requestId: c.req.header("X-Cashu-Request-Id"),
       mintHealthTracker: this.mintHealthTracker,
       fxFetcher: this.fxFetcher,
-      // internal-review: the ledger leg — every rail payment becomes fund_credit +
-      // draw, atomic with the rail commit.
       creditLedger: this.creditLedger,
       processedPayments: this.processedPayments,
       enqueueCreditDeposit: this.opts.enqueueCreditDeposit,
@@ -17851,7 +17801,7 @@ var DVMServer = class {
   }
   /**
    * Assemble this DVM's funding menu for a response denominated in
-   * `currency` (internal-review). All the refusal logic — including the credits-spec
+   * `currency`. All the refusal logic — including the credits-spec
    * §3 isolate gate — lives in {@link buildCreditMenu}; this just supplies the
    * server's state. `callerPubkey` must be a *verified* envelope pubkey: the
    * balance echo is per-caller money and there is no safe fallback identity.
@@ -17860,8 +17810,6 @@ var DVMServer = class {
     await this.ensureTempoSessionHealth();
     const mppSplit = this.creditMppSplit();
     return buildCreditMenu({
-      // The SDK server only ever runs the container runtime; the isolate route
-      // calls the same builder with `"isolate"` and is refused there.
       runtime: "container",
       config: this.descriptor.credit,
       currency,
@@ -17870,7 +17818,7 @@ var DVMServer = class {
       tempoWithheld: mppSplit.withheld,
       x402Schemes: this.creditX402Schemes(),
       lightningFundingMinSats: this.opts.lightningReceive?.fundingMinSats,
-      // Configured, not advertised (internal-review): `advertisedMints()` is health
+      // Configured, not advertised: `advertisedMints()` is health
       // filtered, and a rail that comes and goes with a mint's uptime is worse
       // product than one that is honestly absent.
       hasAcceptedMint: (this.opts.mints?.length ?? 0) > 0,
@@ -17907,7 +17855,7 @@ var DVMServer = class {
   }
   /**
    * Currency this DVM's credit ledger is denominated in — the builder's
-   * declared pricing currency, `"usd"` unless they said otherwise (internal-review).
+   * declared pricing currency, `"usd"` unless they said otherwise.
    *
    * Every denomination surface reads this one answer: the funding menu on
    * `/v1/quote` and the 402, `POST /v1/credit`, and the quote balance echo.
@@ -17916,20 +17864,13 @@ var DVMServer = class {
    * static (USD-literal) price on a non-USD DVM, and a quote denominated
    * elsewhere is refused as `quote_currency_mismatch` — so what a job draws in
    * is what a top-up funded in, on every path.
-   *
-   * It used to return the literal `"usd"`, which is how a EUR-pricing DVM
-   * came to fund `/v1/credit` top-ups in a denomination none of its jobs
-   * would ever draw from.
    */
   creditCurrency() {
     return this.pricingCurrency;
   }
   /**
-   * Quote-response `payment` block (internal-review). Carries the same `methods` array
-   * `/v1/info` advertises plus a per-rail `refundable` map keyed by method, so a
-   * caller can see which rails return funds on failure before committing. The
-   * `methods` shape stays identical to `/v1/info` and the platform isolate route
-   * (post-internal-review nested `payment.methods`); refundability rides alongside.
+   * Advertise the same method list as info. Refundability describes the rail
+   * itself; failed jobs release their pending credit draw separately.
    */
   quotePaymentBlock() {
     const methods = this.resolvePaymentMethods();
@@ -17938,8 +17879,6 @@ var DVMServer = class {
       refundable: Object.fromEntries(methods.map((m) => [m, RAIL_REFUNDABLE[m]]))
     };
   }
-  // ── Route handlers ──────────────────────────────────────────────────
-  /** Dev-mode proxy: forwards requests to a remote DVM specified by cookie. */
   async handleProxy(c) {
     const raw = getCookie(c, "dvmkit_target");
     const target = raw ? decodeURIComponent(raw) : null;
@@ -17975,8 +17914,8 @@ var DVMServer = class {
       auth: this.descriptor.auth ? [this.descriptor.auth.id] : ["none"],
       ...this.authAudience ? { auth_audience: this.authAudience } : {},
       protocol_version: 1,
-      sdk_sha: process.env.GIT_SHA ?? "unknown",
-      deploy_id: process.env.DVMKIT_DEPLOY_ID ?? "unknown"
+      sdk_sha: this.opts.env.GIT_SHA ?? "unknown",
+      deploy_id: this.opts.env.DVMKIT_DEPLOY_ID ?? "unknown"
     };
     const ownerBlock = this.ownerDisplayBlock();
     if (ownerBlock) info.owner = ownerBlock;
@@ -17997,8 +17936,7 @@ var DVMServer = class {
         network: this.opts.x402.network,
         asset: this.opts.x402.asset ?? "USDC",
         ...this.opts.x402.facilitator && { facilitator: this.opts.x402.facilitator },
-        // Surface dual-serve state so x402 clients can confirm the 402 will
-        // carry their PaymentRequirements before submitting (internal-review).
+        // Advertises whether 402 challenges include x402 PaymentRequirements.
         dual_serve: this.opts.x402.dualServe ?? true
       };
     }
@@ -18009,11 +17947,11 @@ var DVMServer = class {
         return reason ? [{ ...method, reason }] : [];
       });
       info.tempo = {
-        // internal-review: withheld sessions are withheld here too. `/v1/info` is
+        // withheld sessions are withheld here too. `/v1/info` is
         // where a caller decides what to attempt, so advertising a session the
         // credit menu will refuse just sends them down a dead end.
         methods: configured.filter((method) => this.tempoSessionOffered(method)),
-        // …but say so rather than letting it vanish (internal-review): an agent that
+        // …but say so rather than letting it vanish: an agent that
         // sees only the shortened list cannot tell a DVM that never did
         // sessions from one whose observer is down for a minute.
         ...withheld.length && { withheld },
@@ -18045,12 +17983,8 @@ var DVMServer = class {
     return c.json(info);
   }
   /**
-   * Render the `/v1/info.capabilities` block (internal-review). Each capability
-   * advertises its `description`, optional `input_schema`, and optional
-   * `pricing` block — `pricing.quote.schema` for dynamic-priced capabilities,
-   * `pricing.max` for static-priced ones. Capabilities without an `input`
-   * schema or any pricing surface omit those fields entirely; free
-   * capabilities (no `price`) omit `pricing` entirely.
+   * Input-mode JSON Schema keeps defaulted fields optional on the advertised
+   * wire contract. Capability names are the descriptor's keys.
    */
   renderCapabilities() {
     const out = {};
@@ -18251,11 +18185,8 @@ var DVMServer = class {
     return c.json(res);
   }
   /**
-   * Build the {@link QuoteContext} a pricing handler receives. Extracted so
-   * the two callers — `/v1/quote` and `computeDynamicPrice` on the submit
-   * path — cannot drift: a field added for one is present in the other by
-   * construction, and both paths price against the same view of the caller's
-   * credit (internal-review, spec §7).
+   * Callers supply quote-schema-parsed data when a quote schema exists, alongside
+   * raw input text and params. Quote and job pricing share these runtime helpers.
    */
   async buildQuoteContext(args) {
     const ctx = {
@@ -18277,16 +18208,8 @@ var DVMServer = class {
     return ctx;
   }
   /**
-   * Validate the `capability` field on a `/v1/job` or `/v1/quote` body
-   * (internal-review). Returns the canonical name when set + known; otherwise a
-   * structured 400 envelope agents can relay verbatim to a human caller.
-   *
-   * - **Missing** — `body.capability` is absent or empty. Surface as
-   *   `capability_required` with a hint pointing at `/v1/info` so the agent
-   *   can re-discover the capability set.
-   * - **Unknown** — `body.capability` is set but doesn't match any
-   *   capability on this descriptor. Surface as `unknown_capability` listing
-   *   the known names so the agent can correct without a round-trip.
+   * Missing or unknown capabilities return structured errors with the current
+   * info-schema URL.
    */
   requireCapabilityFromBody(c, capability) {
     const known = this.jobManager.capabilityNames();
@@ -18345,25 +18268,9 @@ var DVMServer = class {
     }
   }
   /**
-   * The one `invalid_input` body `/v1/quote` and `/v1/job` emit for a
-   * capability-input violation (internal-review).
-   *
-   * The two endpoints used to answer the same caller mistake with two unrelated
-   * shapes — quote gated on auth first, so a wrong field name came back 401
-   * `auth_error` + `sub_reason: "schema_invalid"`, while submit parsed first and
-   * came back 400 `invalid_input`. Both named the offending field (internal-review), so
-   * neither was wrong; an agent just had to recognise two codes and two statuses
-   * for one class of mistake, and the CLI's `parseStructuredError` mapped them to
-   * two different `DvmError`s — which is why its structured-input remediation
-   * (`invalid_input` only) never fired for the live fleet failure internal-review was
-   * written about.
-   *
-   * The 400 wins because it is the only shape both endpoints can produce: a DVM
-   * that declares no `auth` has no 401 to give, and quote didn't validate
-   * `cap.input` at all on that path, so it answered 200 to a body submit would
-   * reject. `display` is carried here as well as `message` because this is now
-   * the shape agents branch on, and it reuses the 401's sentence so the words
-   * relayed to a human don't change with the status.
+   * Shared schema-violation response for quote and submit, including auth-less
+   * DVMs. A 400 classifies caller input without requiring an auth gate; `display`
+   * and `message` carry the same relayable explanation.
    */
   invalidInputResponse(c, err) {
     const schemaUrl = infoSchemaUrl(c.req.url, this.publicOrigin);
@@ -18406,22 +18313,9 @@ var DVMServer = class {
     );
   }
   /**
-   * True when a failed capability-input parse is the auth gate's answer rather
-   * than {@link invalidInputResponse}'s (internal-review).
-   *
-   * A capability schema may declare the signing-envelope fields required
-   * (cast's `addEpisodeSchema`) or optional (scribe's `transcribeSchema`). On
-   * the required shape an *unsigned* request fails the input parse naming
-   * `pubkey` / `signature` — a signing failure, and answering it with "your
-   * input is invalid: pubkey required" is the internal-review mistake in reverse. So a
-   * parse whose issues are **only** envelope-side falls through to the auth
-   * gate, which answers 401 `signature_invalid` with the remedy that works.
-   *
-   * Deferring is safe because the gate below re-parses the same schema over the
-   * same bytes, so a caller that reaches it with an envelope-side failure is
-   * rejected there for certain; both routes still carry a backstop for the
-   * impossible case. It applies only to a DVM that declares `auth` — with no
-   * gate below, the 400 is the only answer available.
+   * On authenticated DVMs, envelope-only parse failures defer to auth
+   * (401 signature_invalid). Builder input issues remain 400 invalid_input.
+   * Auth reparses the same schema/raw input; a backstop refuses disagreement.
    */
   deferToAuthGate(err) {
     if (!this.descriptor.auth) return false;
@@ -18430,13 +18324,13 @@ var DVMServer = class {
   }
   /**
    * Mints to advertise to clients on `/v1/info` and `/v1/quote`. Filters the
-   * configured list through the runtime health tracker (internal-review). When every
+   * configured list through the runtime health tracker. When every
    * mint is currently sick it falls back to the still-configured list rather
    * than publish an empty rail — a *transient* outage shouldn't read as "no
    * Cashu" and push well-behaved agents to bypass the rail. But NUT-incompatible
-   * mints are excluded even from that fallback (internal-review): NUT-incompatibility
+   * mints are excluded even from that fallback: NUT-incompatibility
    * is a permanent, deterministic config error the DVM can never settle
-   * against, so per AC bullet 3 such a mint is never advertised. If *every*
+   * against, so such a mint is never advertised. If *every*
    * configured mint is NUT-incompatible the rail correctly goes empty.
    */
   advertisedMints() {
@@ -18865,10 +18759,6 @@ var DVMServer = class {
         priceMsats,
         capabilityName,
         requesterTokenHash,
-        // internal-review: everything the idempotent-replay path needs to recognise a
-        // retry of THIS call and re-issue the token its lost response carried.
-        // internal-review: `jobId` is the pre-allocated id the payment's ledger draw
-        // already committed under.
         {
           requesterToken: jobToken,
           requestFingerprint: fingerprint,
@@ -18906,7 +18796,7 @@ var DVMServer = class {
     }
   }
   /**
-   * Book a committed funding as a deposit (internal-review, spec §10). Fire-and-forget
+   * Book a committed funding as a deposit (the deposit-accounting rule). Fire-and-forget
    * onto the reporter's durable queue: a funding is a liability the platform
    * must show, but a reporting hiccup must never fail the paid request that
    * just succeeded.
@@ -18921,7 +18811,7 @@ var DVMServer = class {
     );
   }
   /**
-   * Book a kept short payment as tagged revenue (internal-review, operator ruling).
+   * Book a kept short payment as tagged revenue.
    * The proofs are committed and the draw was settled on the spot, so the money
    * is earned — but no job exists to carry it, hence the synthetic job id. It
    * is deliberately **not** a deposit: nothing is owed back, so a liability
@@ -18951,20 +18841,9 @@ var DVMServer = class {
     });
   }
   /**
-   * The idempotent half of `POST /v1/job` (internal-review). A paid submit whose
-   * response the caller lost is safe to retry — the accumulator's
-   * `UNIQUE(dvm_id, request_id, proof_secret)` makes the duplicate a no-op —
-   * but until now it was also useless: the caller got a 409 and the `job_id` /
-   * `job_token` it paid for stayed unreachable forever.
-   *
-   * Returns the original job's submit response iff the retry proves it is the
-   * original caller. Proof is reproducing the request, **not** possessing the
-   * spent Cashu token: the token is a bearer secret, so gating on it alone
-   * would hand the job (and its result) to anyone who lifted it. The legitimate
-   * retry always has the body — the internal-review resume sweep re-POSTs it — while a
-   * token thief does not. On a descriptor-auth DVM the caller pubkey must match
-   * too. Anything short of that falls through to the 409 the caller has always
-   * gotten.
+   * Recover a lost paid response only for matching request fingerprint,
+   * authenticated pubkey and requester identity. A spent bearer token alone
+   * is not proof of request ownership.
    */
   async recoverReplayedJob(c, opts) {
     if (!opts.requestId) return void 0;
@@ -18988,16 +18867,9 @@ var DVMServer = class {
     return buildSubmitResponse(c, prior, prior.requesterToken);
   }
   /**
-   * The draw-keyed half of idempotent recovery (internal-review, spec §2 condition
-   * 1). The signed body's `(credit_id, draw_id)` matched a recorded draw;
-   * resolve the job it paid for (the draw carries its pre-allocated job id)
-   * and re-issue the original response under the SAME proof-of-origin gates
-   * as the header regime: reproduce the fingerprint, sign as the same caller
-   * (explicit draws only exist on descriptor-auth DVMs), match requesterId.
-   *
-   * A recorded draw whose job row never landed (crash between the ledger
-   * commit and the job persist) has nothing to hand back — refuse with the
-   * 409 and log loudly; the pending hold is surfaced by `listPendingDraws`.
+   * Resolve the recorded draw's job under the same fingerprint/pubkey/requester
+   * checks as header recovery. If no job exists, the caller may still recover a
+   * pending durable acceptance under its bound public request-id claim.
    */
   async recoverDrawnJob(c, opts) {
     let jobId = opts.jobId;
@@ -19078,7 +18950,6 @@ var DVMServer = class {
     }
     return void 0;
   }
-  /** Recover one still-pending draw recorded for the stable public job id. */
   async recoverDrawAcceptance(opts) {
     const dvmId = this.opts.dvmId;
     if (!dvmId) return void 0;
@@ -19108,12 +18979,9 @@ var DVMServer = class {
     return payment;
   }
   /**
-   * Recompute the upfront price for a dynamic-priced capability by
-   * re-invoking its `onQuote.handler` with the parsed job input as `data`
-   * (internal-review). Returns a 400-style error envelope when the input doesn't
-   * satisfy `onQuote.schema` or the handler throws — failing closed is the
-   * right default, since the alternative (running the job with
-   * `requiredMsats=undefined`) lets unpaid jobs through.
+   * Recompute dynamic upfront pricing from parsed job input, applying the quote
+   * schema separately. Refuse invalid input/results, currency mismatch or missing
+   * FX rather than running without a price (400/500/503 as classified below).
    */
   async computeDynamicPrice(onQuote, parsedInput, body, callerPubkey) {
     let data = parsedInput;
@@ -19319,13 +19187,6 @@ var DVMServer = class {
     }
     return c.json({ messages: job.messages.filter((m) => m.seq > after) });
   }
-  /**
-   * Structured 409 for a write (message POST / cancel) against a job that has
-   * already reached a terminal status (internal-review). The two-audiences convention
-   * wants a `code` an intermediary agent can branch on plus a `hint` it can
-   * relay verbatim — a bare `{ error }` string gave the openclaw nothing to act
-   * on and it re-paid a completed job into this 409 (internal-review step 7).
-   */
   jobNotActiveResponse(c) {
     return c.json(
       {
@@ -19498,8 +19359,8 @@ var DVMServer = class {
   }
   /**
    * Tear down this machine's in-memory reactivation scaffold when it stands
-   * down (lost the reactivation advisory lock, or deferred to a live original
-   * handler that won the single-execution claim — internal-review / internal-review). Leaving
+   * down after losing the reactivation advisory lock or deferring to a live original
+   * handler that won the single-execution claim. Leaving
    * the job in `activeJobs` with a live idle timer would, one idle window
    * later, fire `cancelJobIdle` → Tx A `cancel` and clobber the winner. We also
    * must not persist our stale snapshot; clearing the appender prevents that.
@@ -19535,6 +19396,7 @@ var DVMServer = class {
         await jm.finalizeStoredTerminal(id);
         return c.json({ status: "cancelled" });
       }
+      record.endedBy = "caller";
       record.status = "cancelled";
       record.lastActivityAt = Date.now();
       await jm.store.save(record);
@@ -19880,7 +19742,7 @@ var PlatformTempoObserverHealth = class {
     }
   }
   /**
-   * Register one mount's session capability (internal-review).
+   * Register one mount's session capability.
    *
    * A host can serve several DVMs behind one `DVMKIT_PLATFORM_TOKEN`, and the
    * platform row that token identifies is the deployment as a whole — so the
@@ -19896,16 +19758,9 @@ var PlatformTempoObserverHealth = class {
     };
   }
   /**
-   * Prime the signal during boot without making a menu request wait.
-   *
-   * De-dupes on the probe in flight, but only while that probe still speaks for
-   * the current set of declarations. `host.ts` primes this client before any
-   * mount exists, so at boot there is routinely an open probe carrying **no**
-   * `tempo_session` at all — handing it back to the mount that just declared
-   * one would leave a scale-to-zero DVM unstamped until traffic arrived, which
-   * is exactly the container-restart case internal-review is about. Same shape with
-   * two mounts: the second would join a probe whose URL already read the first
-   * one's `false`.
+   * De-duplicate probes only while their declaration epoch is current. A mount
+   * declared during boot or another mount's probe must await a fresh probe so
+   * the platform receives the updated capability, even before traffic arrives.
    */
   async refresh() {
     const open = this.inFlight;
@@ -19951,7 +19806,7 @@ var PlatformTempoObserverHealth = class {
   }
   /**
    * The probe URL, carrying this deployment's session capability when a mount
-   * has declared one (internal-review).
+   * has declared one.
    *
    * Absent means "no signal", not "no sessions": a container running an older
    * SDK build sends nothing, and the platform must leave its stamp exactly