@dvmkit/sdk 0.1.5-rc.9 → 0.2.1-rc.9

package/dist/{chunk-U6M3ATSG.js → chunk-MD3H3BF7.js}

@@ -1,7 +1,7 @@
 import {
   StepCache,
   loggers
-} from "./chunk-E4EVGPDX.js";
+} from "./chunk-YO56VCTQ.js";
 import {
   redactUrl
 } from "./chunk-FUJ36YDV.js";
@@ -23,6 +23,11 @@ function toJobRecord(job) {
     authRequestPath: job.authRequestPath,
     status: job.status,
     summary: job.summary,
+    timingKnown: job.timingKnown,
+    endedBy: job.endedBy,
+    terminalAtMs: job.terminalAtMs,
+    callerWaitMs: job.callerWaitMs,
+    awaitingInputAtMs: job.awaitingInputAtMs,
     messages: job.messages,
     seq: job.seq,
     paidMsats: job.paidMsats,
@@ -69,6 +74,11 @@ function fromJobRecord(record) {
     requesterTokenHash: record.requesterTokenHash,
     status: record.status,
     summary: record.summary,
+    timingKnown: record.timingKnown,
+    endedBy: record.endedBy,
+    terminalAtMs: record.terminalAtMs,
+    callerWaitMs: record.callerWaitMs,
+    awaitingInputAtMs: record.awaitingInputAtMs,
     messages: [...record.messages],
     seq: record.seq,
     paidMsats: record.paidMsats,
@@ -138,11 +148,12 @@ function providerMessage(job, type, content) {
     const pendingPaymentDelta = typeof paymentRequest.amount_msats === "number" ? paymentRequest.amount_msats : void 0;
     const pendingMppChallengeIds = paymentRequest.tempo?.challenges?.map((challenge) => challenge.id).filter((id) => typeof id === "string");
     job.messageAppender?.(msg, {
+      awaitingInput: job.status === "awaiting-input",
       pendingPaymentDelta,
       pendingMppChallengeIds,
       pendingX402Nonce: typeof paymentRequest.x402?.nonce === "string" ? paymentRequest.x402.nonce : void 0,
       pendingX402AmountUsdcMicro: typeof paymentRequest.x402?.required_usdc_micro === "string" ? paymentRequest.x402.required_usdc_micro : void 0,
-      // internal-review: read off the job rather than the content — the fiat envelope
+      // read off the job rather than the content — the fiat envelope
       // is ledger state, not part of the wire shape, and `requestPayment` has
       // already pinned it on the job by the time this fires (same ordering the
       // `pendingPaymentMsats` comment above describes).
@@ -151,7 +162,7 @@ function providerMessage(job, type, content) {
     });
     return;
   }
-  job.messageAppender?.(msg);
+  job.messageAppender?.(msg, type === "prompt" ? { awaitingInput: job.status === "awaiting-input" } : void 0);
 }
 function localMessage(job, from, type, content) {
   job.seq++;
@@ -215,9 +226,7 @@ var MemoryJobStore = class {
   notifySubscribers = /* @__PURE__ */ new Map();
   reactivationLocks = /* @__PURE__ */ new Set();
   requestIdClaims = /* @__PURE__ */ new Map();
-  /** Per-DVM monotonic receipt counter (internal-review) — the `receipt_counter` row. */
   receiptCounter = 0;
-  /** Receipt sequence already allocated to a job, keyed by job id. */
   receiptSeqs = /* @__PURE__ */ new Map();
   get(id) {
     const record = this.data.get(id);
@@ -280,7 +289,10 @@ var MemoryJobStore = class {
       return Promise.resolve();
     }
     const snapshot = structuredClone(record);
+    if (existing) snapshot.createdAt = existing.createdAt;
     if (existing?.receipt) snapshot.receipt = existing.receipt;
+    snapshot.timingKnown = existing ? existing.timingKnown ?? false : record.timingKnown ?? true;
+    applyTiming(snapshot, existing, Date.now());
     this.data.set(record.id, snapshot);
     const cur = this.nextSeq.get(record.id) ?? 1;
     this.nextSeq.set(record.id, Math.max(cur, record.seq + 1));
@@ -351,6 +363,10 @@ var MemoryJobStore = class {
     }
     const seq = this.allocateSeq(jobId);
     const fullMessage = { ...message, seq };
+    if (opts?.awaitingInput && !isTerminal(record.status)) {
+      applyTiming(record, structuredClone(record), Date.now(), "awaiting-input");
+      record.status = "awaiting-input";
+    }
     this.messagesFor(jobId).push({ message: fullMessage, status: "verified" });
     if (opts?.pendingPaymentDelta !== void 0) {
       if (opts.pendingPaymentDelta !== 0) {
@@ -503,6 +519,7 @@ var MemoryJobStore = class {
   claimForProcessing(jobId) {
     const record = this.data.get(jobId);
     if (record?.status !== "awaiting-input") return Promise.resolve(false);
+    applyTiming(record, structuredClone(record), Date.now(), "processing");
     record.status = "processing";
     record.lastActivityAt = Date.now();
     return Promise.resolve(true);
@@ -565,7 +582,6 @@ var MemoryJobStore = class {
     this.notifySubscribers.clear();
     return Promise.resolve();
   }
-  // ── Internal helpers ──────────────────────────────────────────────────
   /**
    * Shared body of `cancelStaleJob` (activity cutoff supplied) and `cancelJob`
    * (`null` cutoff — unconditional). Mirrors `PostgresJobStore.terminateJob`:
@@ -586,6 +602,8 @@ var MemoryJobStore = class {
       content: { reason }
     };
     this.messagesFor(jobId).push({ message: cancelMsg, status: "verified" });
+    record.endedBy = expectedActivityBefore === null || record.status === "awaiting-input" ? "caller" : "provider";
+    applyTiming(record, structuredClone(record), Date.now(), terminalStatus);
     record.status = terminalStatus;
     record.summary = record.summary ?? reason;
     record.messages = [...record.messages, cancelMsg];
@@ -645,6 +663,22 @@ function snapshotCounters(record) {
     summary: record.summary
   };
 }
+function applyTiming(next, prior, now, status = next.status) {
+  if (prior && isTerminal(prior.status)) {
+    next.endedBy = prior.endedBy;
+    next.terminalAtMs = prior.terminalAtMs;
+    next.callerWaitMs = prior.callerWaitMs;
+    next.awaitingInputAtMs = void 0;
+    return;
+  }
+  const start = prior?.awaitingInputAtMs ?? (prior?.status === "awaiting-input" ? prior.lastActivityAt : void 0);
+  next.callerWaitMs = (prior?.callerWaitMs ?? next.callerWaitMs ?? 0) + (start !== void 0 && status !== "awaiting-input" ? Math.max(0, now - start) : 0);
+  next.awaitingInputAtMs = status === "awaiting-input" ? start ?? now : void 0;
+  if (isTerminal(status)) {
+    next.terminalAtMs = now;
+    next.endedBy = status === "completed" ? void 0 : next.endedBy ?? "provider";
+  }
+}
 
 // src/sdk/server/instrumented-fetch.ts
 function createInstrumentedFetch(signal) {

package/dist/{chunk-CGKZDODG.js → chunk-MG67KXU7.js}

@@ -30,7 +30,6 @@ var PROTECTED_CONFIG_FIELDS = ["nwcUri", "defaultIdentity", "tempo", "x402"];
 var ProtectedFieldAuthorization = class {
   /** Targets this authorization covers. A field also covers its own leaves. */
   targets;
-  /** Prefer {@link authorizeProtectedRemoval}; this exists for it to call. */
   constructor(targets) {
     this.targets = [...targets];
   }
@@ -304,11 +303,7 @@ function protectedRemovalError(targets, reason) {
 }
 var PROTECTED_FIELDS = {
   nwcUri: { aliases: [], credentialLeaves: [], secret: true, hexCredential: false },
-  // A pointer at a key, not a key: worth protecting from removal, and never
-  // worth stripping out of a stored copy — that is recovery lost for nothing.
   defaultIdentity: { aliases: [], credentialLeaves: [], secret: false, hexCredential: false },
-  // `mpp` is the pre-internal-review name; a caller who has not run a mutating command
-  // since the rename still has their private key under it.
   tempo: { aliases: ["mpp"], credentialLeaves: ["apiKey"], secret: true, hexCredential: true },
   x402: { aliases: [], credentialLeaves: ["privateKey"], secret: true, hexCredential: true }
 };

package/dist/{chunk-KSQEFVFJ.js → chunk-MMCE7XSR.js}

@@ -1,6 +1,6 @@
 import {
   IMPLICIT_CREDIT_TTL_MS
-} from "./chunk-5URG56JJ.js";
+} from "./chunk-A4CM2BD3.js";
 import {
   CREDITS_FILE,
   DvmError,

package/dist/{chunk-JZWELPFH.js → chunk-N5B66UOS.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-YG7G4DPZ.js";
 import {
   withSdkInitLock
-} from "./chunk-S3XAHZQY.js";
+} from "./chunk-COYKJRMM.js";
 
 // src/sdk/server/tempo-charge-store.ts
 var DEFAULT_TABLE_NAME = "mpp_tempo_charge_replays";
@@ -46,7 +46,6 @@ var PostgresTempoChargeStore = class {
     );
     return rows[0] ? parseStoreValue(rows[0].value_json) : null;
   }
-  /** Replace one stored value. */
   async put(key, value) {
     await this.update(key, () => ({ op: "set", value, result: void 0 }));
   }
@@ -55,19 +54,9 @@ var PostgresTempoChargeStore = class {
     await this.update(key, () => ({ op: "delete", result: void 0 }));
   }
   /**
-   * Atomic read-modify-write, linearized across every machine sharing the pool.
-   *
-   * The advisory lock is taken before the row lock because a key's *first*
-   * write is the one that matters here: `FOR UPDATE` locks nothing when no row
-   * exists, so two machines marking one hash for the first time would both read
-   * `null` and both believe they won.
-   *
-   * Replay keys are unique per credential, so they never contend. The contended
-   * key is the fee-sponsor budget — one per `(chain, sponsor)`, read-modified
-   * several times per sponsored charge — and serializing it across machines is
-   * the point of sharing the store at all. The critical section is a SELECT and
-   * an upsert, so a queue of waiters clears in tens of milliseconds; a pooled
-   * connection is held for exactly that long and never across a chain call.
+   * Advisory locking covers the absent-row first write before the row lock.
+   * Both competing presentations of one credential and the shared sponsor
+   * budget need this serialization. The transaction contains no chain call.
    */
   async update(key, fn) {
     const client = await this.pool.connect();
@@ -106,7 +95,6 @@ var PostgresTempoChargeStore = class {
       client.release();
     }
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
   async createTables() {
     await this.pool.query(`
       CREATE TABLE IF NOT EXISTS ${this.tableName} (

package/dist/{chunk-BIP6G74V.js → chunk-O6D72KYA.js}

@@ -4,13 +4,13 @@ import {
   listCredits,
   maxAdvertisedMicro,
   withinAdvertisedTolerance
-} from "./chunk-KSQEFVFJ.js";
+} from "./chunk-MMCE7XSR.js";
 import {
   authorizeProtectedRemoval,
   isValidEvmPrivateKey,
   loadConfig,
   updateConfig
-} from "./chunk-CGKZDODG.js";
+} from "./chunk-MG67KXU7.js";
 import {
   X402_DEFAULT_NETWORK,
   X402_V1_VERSION,
@@ -34,7 +34,7 @@ import {
   getLastKnownBtcRate,
   msatsToUsdc,
   usdcToMsats
-} from "./chunk-5URG56JJ.js";
+} from "./chunk-A4CM2BD3.js";
 import {
   DvmError,
   X402_CHANNELS_FILE,
@@ -190,7 +190,7 @@ function x402PendingFundingJson(entry) {
     amount_micro: entry.amountMicro,
     // What the ERC-3009 authorization can still pull, which is the figure a
     // `--force` retirement is really deciding about: a deposit's authorized
-    // value can exceed the amount funded (internal-review), so `amount_micro` alone
+    // value can exceed the amount funded, so `amount_micro` alone
     // understates it. Null on a voucher-only payload, which authorizes no
     // deposit at all.
     deposit_micro: entry.depositMicro ?? null,
@@ -243,7 +243,7 @@ var DvmX402ChannelStorage = class {
   /**
    * Upstream's ordinary write. Its chain-recovery paths are authoritative and
    * clear the unreconciled stamp. DVM-response paths scope this same write to
-   * persist their weaker provenance atomically with the balance (internal-review).
+   * persist their weaker provenance atomically with the balance.
    */
   set(key, context) {
     return fromSynchronousStore(() => {
@@ -266,7 +266,7 @@ var DvmX402ChannelStorage = class {
   }
   /**
    * Write a context whose `balance` carries a deposit this machine added on its
-   * own authority, and stamp the record as unreconciled (internal-review).
+   * own authority, and stamp the record as unreconciled.
    *
    * Separate from {@link set} because the two differ in exactly one thing that
    * matters later: where the figure came from. Nothing else about the write
@@ -279,7 +279,7 @@ var DvmX402ChannelStorage = class {
   }
   /**
    * Write a context whose `balance` is byte-for-byte the one already stored,
-   * leaving the unreconciled stamp exactly as it found it (internal-review).
+   * leaving the unreconciled stamp exactly as it found it.
    *
    * The replay acknowledgement's idempotent second pass is what needs this: it
    * restates a cumulative base without adding to the balance, so it observes
@@ -294,7 +294,7 @@ var DvmX402ChannelStorage = class {
   }
   /**
    * Seed upstream's cooperative-refund probe without changing the acknowledged
-   * base. Records written before internal-review have only the upstream context, so
+   * base. Records written before have only the upstream context, so
    * `hold` adopts its acknowledged value rather than losing that base to the
    * chain floor this seeds. The seed itself is a `channels()` read, so it is
    * `observed` and settles the unreconciled question like any other.
@@ -605,7 +605,7 @@ function loadFile() {
       channels: raw.channels,
       pending: raw.pending,
       // Tolerated rather than required, unlike its two siblings: every file
-      // written before internal-review lacks the key, and failing closed on it would
+      // written before lacks the key, and failing closed on it would
       // read as a corrupt journal on a store that is perfectly intact.
       exact: Array.isArray(raw.exact) ? raw.exact : []
     };
@@ -753,7 +753,7 @@ async function getX402Balance(wallet) {
       usdc: Number(balance) / 1e6,
       network: w.network,
       tokenAddress: spec.usdc,
-      // internal-review: redacted here rather than at a display surface, so the clear
+      // redacted here rather than at a display surface, so the clear
       // endpoint never leaves this function on the success path either.
       rpcUrlRedacted: rpcUrl ? redactUrl(rpcUrl) : void 0,
       rpcSource

package/dist/{chunk-KXCKFIJI.js → chunk-QX52F6IB.js}

@@ -2,7 +2,7 @@ import {
   costAnchor,
   formatUsd,
   msatsToUsd
-} from "./chunk-5URG56JJ.js";
+} from "./chunk-A4CM2BD3.js";
 import {
   AGENT_MNEMONIC_FILE,
   BUILDER_CONFIG_DIR,

package/dist/{chunk-RW5LP57K.js → chunk-SDK6KDJN.js}

@@ -17,7 +17,6 @@ var MemoryKVStore = class {
     this.data.set(key, { value, expiry });
     return Promise.resolve();
   }
-  /** Delete a key. */
   delete(key) {
     this.data.delete(key);
     return Promise.resolve();

package/dist/{chunk-KVEHHC7W.js → chunk-U5VNEALI.js}

@@ -15,14 +15,14 @@ import {
   lotOwedSats,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-MLRCSJYX.js";
+} from "./chunk-2D75MNNG.js";
 
 // src/sdk/server/memory-credit-ledger.ts
 import { randomUUID } from "crypto";
 var MemoryCreditLedger = class _MemoryCreditLedger {
   /**
    * Per-process and lost on restart, so a DVM backed by this ledger never
-   * advertises the funding menu outside devMode (internal-review) — funding on one
+   * advertises the funding menu outside devMode — funding on one
    * machine and drawing on another would `credit_not_found`.
    */
   durable = false;
@@ -42,7 +42,6 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     fork.x402Settlements = this.x402Settlements;
     return fork;
   }
-  /** See {@link CreditLedger.useX402SettlementGate} — same contract (internal-review). */
   useX402SettlementGate(gate) {
     this.x402Settlements = gate;
   }
@@ -62,12 +61,10 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     );
     return run(() => this.drawSync(args, blocking));
   }
-  /** See {@link CreditLedger.blockingX402Refund} — same contract (internal-review). */
   async blockingX402Refund(channelId, statuses) {
     if (!channelId || !this.x402Settlements) return void 0;
     return this.x402Settlements.pendingRefundSettlement(channelId, statuses);
   }
-  /** The unresolved x402 refund that must stop an effect on `creditId` (internal-review). */
   blockingRefundForCredit(creditId, statuses) {
     return this.blockingX402Refund(this.credits.get(creditId)?.x402ChannelId, statuses);
   }
@@ -540,7 +537,6 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     credit.draws.set(args.drawId, draw);
     return { ...drawResult(draw, credit), replayed: false };
   }
-  /** Mid-job top-up growth (internal-review) — see `CreditLedger.growDraw` for the semantics. */
   growDrawSync(args) {
     assertAmount(args.addAmountMicro, { min: 1 });
     const credit = this.requireCredit(args.creditId);
@@ -667,7 +663,6 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     const page = after ? out.filter((d) => compareStaleDrawKey(d, after) > 0) : out;
     return Promise.resolve(page.slice(0, args.limit));
   }
-  /** Settled draws' native value for the credit an x402 channel funded (internal-review). */
   earnedNativeForX402Channel(channelId) {
     for (const credit of this.credits.values()) {
       if (credit.x402ChannelId !== channelId) continue;
@@ -757,7 +752,6 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
       [...this.x402Losses.values()].sort((a, b) => b.observedAt - a.observedAt || a.creditId.localeCompare(b.creditId)).slice(0, args?.limit ?? 50)
     );
   }
-  // ── Drains (internal-review) — semantics mirror the Postgres ledger ─────────
   async requestDrain(args) {
     const wedged = await this.blockingRefundForCredit(
       args.creditId,
@@ -861,15 +855,17 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
   bitcoinDepositLiability() {
     const byRail = /* @__PURE__ */ new Map();
     const byCurrency = /* @__PURE__ */ new Map();
+    const uncoveredByCurrency = /* @__PURE__ */ new Map();
+    const unbackedByCurrency = /* @__PURE__ */ new Map();
     const liability = {
       depositSats: 0,
       credits: 0,
       byRail: [],
       byCurrency: [],
       uncoveredCredits: 0,
-      uncoveredMicro: 0,
+      uncoveredByCurrency: [],
       unbackedCredits: 0,
-      unbackedMicro: 0
+      unbackedByCurrency: []
     };
     for (const credit of this.credits.values()) {
       if (!isNonChannelBitcoinRail(credit.rail)) continue;
@@ -887,10 +883,24 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
       liability.credits++;
       if (covered < credit.balanceMicro) {
         liability.uncoveredCredits++;
-        liability.uncoveredMicro += credit.balanceMicro;
+        const currency2 = uncoveredByCurrency.get(credit.currency) ?? {
+          currency: credit.currency,
+          micro: 0,
+          credits: 0
+        };
+        currency2.micro += credit.balanceMicro;
+        currency2.credits++;
+        uncoveredByCurrency.set(credit.currency, currency2);
       } else if (basisless > 0) {
         liability.unbackedCredits++;
-        liability.unbackedMicro += credit.balanceMicro;
+        const currency2 = unbackedByCurrency.get(credit.currency) ?? {
+          currency: credit.currency,
+          micro: 0,
+          credits: 0
+        };
+        currency2.micro += credit.balanceMicro;
+        currency2.credits++;
+        unbackedByCurrency.set(credit.currency, currency2);
       }
       const rail = byRail.get(credit.rail) ?? { rail: credit.rail, sats: 0, credits: 0 };
       rail.sats += owed;
@@ -907,6 +917,8 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     }
     liability.byRail = [...byRail.values()];
     liability.byCurrency = [...byCurrency.values()];
+    liability.uncoveredByCurrency = [...uncoveredByCurrency.values()];
+    liability.unbackedByCurrency = [...unbackedByCurrency.values()];
     return Promise.resolve(liability);
   }
   listFundingLots(creditId) {
@@ -1046,7 +1058,6 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
       if (drain) drain.receipts.push(args.receipt);
     });
   }
-  // ── Internals ─────────────────────────────────────────────────────────
   requireDrain(creditId, drainId) {
     const credit = this.credits.get(creditId);
     const drain = credit?.drains.get(drainId);

package/dist/{chunk-FROTD5XQ.js → chunk-V5ZRATJH.js}

@@ -1,6 +1,6 @@
 import {
   withSdkInitLock
-} from "./chunk-S3XAHZQY.js";
+} from "./chunk-COYKJRMM.js";
 
 // src/sdk/server/postgres-kv-store.ts
 var PostgresKVStore = class {
@@ -12,12 +12,11 @@ var PostgresKVStore = class {
   async init() {
     await withSdkInitLock(this.pool, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
   async createTables() {
     await this.pool.query(`
       -- Single-tenant KV table aligned with the platform's isolate storage schema.
       -- The only structural difference is the absence of dvm_id (SDK is single-DVM-per-DB).
-      -- Any column addition should land on both schemas; see M06 / internal-review for the convergence precedent.
+      -- Keep column additions aligned with the platform isolate schema.
       CREATE TABLE IF NOT EXISTS kv_store (
         key        TEXT PRIMARY KEY,
         value      JSONB NOT NULL,

package/dist/{chunk-EVBK675R.js → chunk-VA7GT6C6.js}

@@ -1,10 +1,11 @@
 import {
   withSdkInitLock
-} from "./chunk-S3XAHZQY.js";
+} from "./chunk-COYKJRMM.js";
 
 // src/sdk/server/revenue-reporter.ts
 import { randomUUID } from "crypto";
 var ENDPOINTS = {
+  job_terminal: "/_internal/job-terminal",
   revenue: "/_internal/job-revenue",
   cost: "/_internal/job-cost",
   deposit: "/_internal/credit-deposit",
@@ -51,7 +52,6 @@ var RevenueReporter = class _RevenueReporter {
   async init() {
     await withSdkInitLock(this.db, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
   async createTables() {
     await this.db.query(`
       CREATE TABLE IF NOT EXISTS ${PENDING_DVM_REPORTS_TABLE} (
@@ -65,6 +65,10 @@ var RevenueReporter = class _RevenueReporter {
         kind          TEXT NOT NULL DEFAULT 'revenue'
       )
     `);
+    await this.db.query(`CREATE TABLE IF NOT EXISTS reported_job_terminals (
+      dvm_id TEXT NOT NULL, job_id TEXT NOT NULL, created_at BIGINT NOT NULL,
+      PRIMARY KEY (dvm_id, job_id)
+    )`);
     await this.assertSdkTableShape(PENDING_DVM_REPORTS_TABLE);
     await this.db.query(
       `ALTER TABLE ${PENDING_DVM_REPORTS_TABLE} ADD COLUMN IF NOT EXISTS stale_reason TEXT`
@@ -74,7 +78,6 @@ var RevenueReporter = class _RevenueReporter {
     );
     await this.migrateLegacySdkOutbox();
   }
-  /** Copy rows from the old SDK-owned table without touching the platform's table of that name. */
   async migrateLegacySdkOutbox() {
     const columns = await this.tableColumns(LEGACY_PENDING_REPORTS_TABLE);
     if (columns.size === 0) return;
@@ -106,7 +109,6 @@ var RevenueReporter = class _RevenueReporter {
          )
     `);
   }
-  /** Refuse a pre-existing relation whose columns cannot safely serve as the SDK outbox. */
   async assertSdkTableShape(tableName) {
     this.assertSdkColumns(tableName, await this.tableColumns(tableName));
   }
@@ -130,6 +132,21 @@ var RevenueReporter = class _RevenueReporter {
   async report(payload) {
     return this.enqueue("revenue", payload, payload.jobId);
   }
+  /** The permanent deduplication claim and outbox insert commit together.
+   * The claim survives successful delivery, including for custom job stores.
+   */
+  async reportTerminal(payload) {
+    const id = randomUUID();
+    const { rowCount } = await this.db.query(
+      `WITH claimed AS (
+         INSERT INTO reported_job_terminals (dvm_id, job_id, created_at)
+         VALUES ($5, $1, $4) ON CONFLICT DO NOTHING RETURNING job_id
+       ) INSERT INTO ${PENDING_DVM_REPORTS_TABLE} (id, payload, created_at, kind)
+         SELECT $2, $3::jsonb, $4, 'job_terminal' FROM claimed`,
+      [payload.jobId, id, JSON.stringify(payload), Date.now(), payload.dvmId]
+    );
+    if (rowCount) void this.attemptDelivery(id, payload, "job_terminal", payload.jobId).catch(() => void 0);
+  }
   /** Persist a zero-revenue job cost and attempt immediate delivery. */
   async reportCost(payload) {
     return this.enqueue("cost", payload, payload.jobId);
@@ -149,23 +166,15 @@ var RevenueReporter = class _RevenueReporter {
     await this.insertPending(tx, "release", payload);
   }
   /**
-   * Join a credit drain to the transaction that made it terminal (internal-review).
-   *
-   * Same discipline as {@link enqueueDeposit} and the same reason: no network
-   * I/O here, only the durable queue row, written through `tx` so the report
-   * and the status CAS commit or roll back together. A drain whose row was
-   * lost between the two would overstate outstanding liability forever —
-   * the mirror image of a lost deposit.
-   *
-   * Named for the payload rather than the verb because `drain` already means
-   * "flush the queue" in this class (see {@link drainPending}).
+   * Await durable queue insertion through tx so the terminal drain and its
+   * report commit or roll back together; no network I/O here.
    */
   async enqueueCreditDrain(tx, payload) {
     await this.insertPending(tx, "drain", payload);
   }
   /**
    * Join a payout to the transaction that commits the movement it reports
-   * (internal-review) — the batch close, the accumulator mark, the drain booking.
+   * the batch close, the accumulator mark, the drain booking.
    * No network I/O, only the durable queue row through `tx`, the discipline
    * {@link enqueueCreditDrain} set and for the same reason: the money has
    * already moved on a rail this ledger does not own, so the platform row is
@@ -187,7 +196,7 @@ var RevenueReporter = class _RevenueReporter {
     return this.enqueue("payout", payload, payload.payoutId);
   }
   /**
-   * Report one rail's pending-pool snapshot (internal-review). Best-effort and
+   * Report one rail's pending-pool snapshot. Best-effort and
    * fire-and-forget, deliberately unlike {@link reportPayout}: a snapshot is
    * replaced by the next tick, so queueing a stale one behind an outage would
    * only deliver figures the platform already has newer ones for.
@@ -224,20 +233,14 @@ var RevenueReporter = class _RevenueReporter {
     }
   }
   /**
-   * Join a credit-expiry release — or the revival that reverses one — to the
-   * transaction that made it true (internal-review).
-   *
-   * Same discipline as {@link enqueueCreditDrain}: no network I/O, only the
-   * durable queue row written through `tx`. A release whose row was lost after
-   * the sweep committed would understate committed value forever; a lost
-   * reversal would overstate it, which is the worse direction — the builder
-   * would see money as theirs that a revived credit can still buy work with.
+   * Await durable queue insertion through tx so expiry release or reversal and
+   * its report commit together. A missing reversal would overstate builder value.
    */
   async enqueueCreditExpiryRelease(tx, payload) {
     await this.insertPending(tx, "expiry_release", payload);
   }
   /**
-   * Report a reaper-force-failed paid job to the platform (internal-review) so the
+   * Report a reaper-force-failed paid job to the platform so the
    * operator receives an ambient notice that a DVM died or wedged mid-job.
    * Best-effort and fire-and-forget: unlike {@link report} there is no local
    * durable queue — a non-2xx or transport failure is structured-logged
@@ -277,7 +280,7 @@ var RevenueReporter = class _RevenueReporter {
     }
   }
   /**
-   * Report a settled draw whose revenue event was skipped (internal-review).
+   * Report a settled draw whose revenue event was skipped.
    * Best-effort and fire-and-forget: the SDK's structured
    * `revenue_skipped_no_rail` log is the durable backstop, so a failed notice
    * must never wedge terminal handling or the orphan-draw reconciler.
@@ -317,7 +320,6 @@ var RevenueReporter = class _RevenueReporter {
       );
     }
   }
-  /** Report the self-relay's Base gas gauge for platform-side paging and recovery. */
   async reportX402SelfRelayGasBalance(payload) {
     const url = `${this.platformUrl}/_internal/x402-self-relay-gas-balance`;
     try {
@@ -349,7 +351,6 @@ var RevenueReporter = class _RevenueReporter {
       );
     }
   }
-  /** Report redacted self-relay RPC health for platform-side paging and recovery. */
   async reportX402SelfRelayRpcHealth(payload) {
     const url = `${this.platformUrl}/_internal/x402-self-relay-rpc-health`;
     try {
@@ -381,11 +382,9 @@ var RevenueReporter = class _RevenueReporter {
       );
     }
   }
-  /** Report the Tempo operator's fee-token gauge for paging and recovery. */
   async reportTempoSettlementBalance(payload) {
     await this.postTempoSettlementReadiness("balance", payload);
   }
-  /** Report a redacted operator fee rejection immediately. */
   async reportTempoSettlementFailure(payload) {
     await this.postTempoSettlementReadiness("failure", payload);
   }
@@ -422,14 +421,12 @@ var RevenueReporter = class _RevenueReporter {
       );
     }
   }
-  /** Start the background retry loop. */
   startRetryLoop() {
     if (this.retryTimer) return;
     this.retryTimer = setInterval(() => {
       void this.drainPending();
     }, _RevenueReporter.RETRY_INTERVAL_MS);
   }
-  /** Stop the background retry loop. */
   stop() {
     if (this.retryTimer) {
       clearInterval(this.retryTimer);
@@ -466,8 +463,8 @@ var RevenueReporter = class _RevenueReporter {
   /**
    * Deliver one bounded batch from the durable queue.
    *
-   * Public so startup/recovery tests and operator tooling can drive the same
-   * drain the background timer uses without reaching into private state.
+   * Processes due, non-stale rows; failures back off up to five minutes and
+   * become terminal after 24 hours. Successful deliveries remove their rows.
    */
   async drainPending() {
     try {
@@ -517,13 +514,11 @@ var RevenueReporter = class _RevenueReporter {
       console.error("[revenue-reporter] Retry loop error:", err);
     }
   }
-  /** Durably queue one report of either kind, then try it once immediately. */
   async enqueue(kind, payload, label) {
     const id = await this.insertPending(this.db, kind, payload);
     void this.attemptDelivery(id, payload, kind, label).catch(() => {
     });
   }
-  /** Insert one pending report through either the pool or an open transaction. */
   async insertPending(q, kind, payload) {
     const id = randomUUID();
     await q.query(
@@ -575,7 +570,6 @@ var RevenueReporter = class _RevenueReporter {
     console.warn(`[revenue-reporter] delivery failed for ${id}: HTTP ${res.status} \u2014 will retry`);
     throw new Error(`Platform returned ${res.status}`);
   }
-  /** Mark a pending row terminal (stale) with a classification reason. */
   async markStale(id, reason) {
     await this.db.query(
       `UPDATE ${PENDING_DVM_REPORTS_TABLE} SET stale = true, stale_reason = $1 WHERE id = $2`,