@dvmkit/sdk 0.1.5-rc.9 → 0.2.1-rc.9

package/dist/{credit-menu-enwMbn55.d.ts → credit-menu-kDA9RVzD.d.ts}

@@ -1,16 +1,15 @@
-import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cS as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cT as X402SettlementCursor, bQ as X402SettlementStatus, cU as X402SettlementWriteOff, bN as X402RefundSettlementGate, cV as X402FacilitatorAuth, cW as X402BatchSettlementConfig, cy as PostgresX402ChannelStorage, cX as X402PayoutObserver, br as MppxServer, ab as CashuMode, cY as CreditDepositEnqueue, cZ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c_ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cA as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-5dljDqrQ.js';
+import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cT as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cU as X402SettlementCursor, bQ as X402SettlementStatus, cV as X402SettlementWriteOff, bN as X402RefundSettlementGate, cW as X402FacilitatorAuth, cX as X402BatchSettlementConfig, cz as PostgresX402ChannelStorage, cY as X402PayoutObserver, br as MppxServer, ab as CashuMode, cZ as CreditDepositEnqueue, c_ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c$ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cy as JobTerminalReportPayload, cB as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-v2yhyhSZ.js';
 import { ProofLike, SerializedDLEQ, Proof } from '@cashu/cashu-ts';
 import { Hono, Context } from 'hono';
 import { Pool } from 'pg';
-import { b as FxRateSnapshot, F as FxFetcher } from './fx-D860pZvP.js';
-import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-BozcevPZ.js';
-import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-BUGqvCfL.js';
+import { b as FxRateSnapshot, F as FxFetcher } from './fx-DhyT1Cjh.js';
+import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-BhsyrBLa.js';
+import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-D3CcZp_g.js';
 import { Challenge } from 'mppx';
 import { SettleResponse, SupportedResponse } from '@x402/core/types';
 import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server';
 import { FacilitatorClient } from '@x402/core/server';
 
-/** A row in the per-DVM `wallet_accumulator` table (internal-review). */
 interface WalletAccumulatorRow {
     id: string;
     dvmId: string;
@@ -36,11 +35,8 @@ interface WalletAccumulatorRow {
      * rows created before the column existed.
      */
     meltQuoteId: string | null;
-    /**
-     * NUT-11 locktime captured at accept time (ms since epoch). Null when the
-     * accepted proof has no `locktime` tag (internal-review). Drives oldest-first
-     * ordering and the future `wallet_accumulator_batch_expiring_soon` monitor.
-     */
+    /** NUT-11 locktime at acceptance, in epoch ms; null without a tag.
+     * Drives oldest-first ordering and expiring-soon monitoring. */
     tExpire: number | null;
 }
 /**
@@ -71,7 +67,7 @@ declare function initWalletAccumulatorTable(db: AccumulatorPool): Promise<void>;
  *
  * With `tx` (a client inside a caller-owned `BEGIN`), issues **no**
  * transaction control: the inserts join the caller's transaction so the rail
- * commit and the `CreditLedger.fund` + `draw` land atomically (internal-review, spec
+ * commit and the `CreditLedger.fund` + `draw` land atomically (spec
  * §2 condition 3). A `unique_violation` still surfaces as
  * `AccumulatorReplayError`, but the caller owns the ROLLBACK — note the
  * transaction is poisoned after the violation (Postgres aborts it), so the
@@ -82,7 +78,7 @@ declare function insertAccumulatorRows(db: AccumulatorPool, args: {
     /**
      * Per-proof matched lock pubkey, parallel to `proofs`. Recording the
      * matched value per row lets the monitor surface retired-batch alerts
-     * (internal-review) and lets `dvmctl melt-pending`'s rotation walker pick the
+     * and lets `dvmctl melt-pending`'s rotation walker pick the
      * right privkey per batch. Branded `LockPubkey` so the lowercase invariant
      * is enforced at the type boundary, not by every call site.
      */
@@ -97,7 +93,7 @@ declare function insertAccumulatorRows(db: AccumulatorPool, args: {
      */
     tExpireMsByIndex?: (number | null)[];
     receivedAt?: number;
-    /** External transaction handle — caller owns BEGIN/COMMIT/ROLLBACK (internal-review). */
+    /** External transaction handle — caller owns BEGIN/COMMIT/ROLLBACK. */
     tx?: AccumulatorQuerier;
 }): Promise<WalletAccumulatorRow[]>;
 /** Delete every accumulator row for a DVM. Used by `dvmadmin wallet-accumulator clear`. */
@@ -117,8 +113,8 @@ declare function hashLockKey(input: string): bigint;
  *
  * Used by `verifyUpfrontPayment` to reject replay of an MPP credential whose
  * `(realm, challenge.id)` was already accepted within the current TTL window
- * (internal-review). Mid-job replay is handled separately via per-job
- * `pendingMppChallengeIds` (internal-review).
+ * Mid-job replay is handled separately via per-job
+ * `pendingMppChallengeIds`.
  */
 interface ConsumedCredentialStore {
     /** True iff `(realm, challengeId)` was marked and the entry has not expired. */
@@ -126,7 +122,6 @@ interface ConsumedCredentialStore {
     /** Mark `(realm, challengeId)` as consumed for `ttlSeconds`. */
     mark(realm: string, challengeId: string, ttlSeconds: number): Promise<void>;
 }
-/** Options for `MemoryConsumedCredentialStore`. */
 interface MemoryConsumedCredentialStoreOpts {
     /** FIFO eviction kicks in when entry count would exceed this. Default: 10_000. */
     maxEntries?: number;
@@ -138,8 +133,8 @@ interface MemoryConsumedCredentialStoreOpts {
  *
  * Per-process and not multi-instance-safe — each replica tracks its own
  * consumed set, so a credential redirected to a different replica still works
- * once. Acceptable for first-party single-instance Fly DVMs (internal-review open
- * question); swap to a shared backend before deploying multiple replicas.
+ * once. Use only for a single-instance DVM; swap to a shared backend before
+ * deploying multiple replicas.
  */
 declare class MemoryConsumedCredentialStore implements ConsumedCredentialStore {
     private readonly maxEntries;
@@ -175,7 +170,6 @@ interface DisposableCashuCommit {
     commit(requestId: string, proofs: Proof[], account: (ledger: CreditLedgerLike) => Promise<void>): Promise<void>;
 }
 
-/** How often the sweep runs, and how long after boot its first pass fires. */
 interface CreditExpirySweepOpts {
     /** Sweep period. Defaults to {@link DEFAULT_SWEEP_INTERVAL_MS}; `0` disables the timer. */
     intervalMs?: number;
@@ -184,26 +178,22 @@ interface CreditExpirySweepOpts {
      * disables the boot pass, leaving only the interval.
      */
     bootDelayMs?: number;
-    /** Credits released per pass. Passed straight to the ledger. */
     limit?: number;
 }
 
-/** Promise resolver for a pending client prompt response. */
 interface PromptResolver {
     resolve: (value: ResponseContent) => void;
     reject: (reason: Error) => void;
 }
-/** Promise resolver for a pending client payment. */
 interface PaymentResolver {
     resolve: (value: PaymentContent) => void;
     reject: (reason: Error) => void;
 }
-/** In-memory representation of a running job. */
 interface ServerJob {
     id: string;
     tags: string[];
     /**
-     * Capability name this job belongs to (internal-review). Set at submission from
+     * Capability name this job belongs to. Set at submission from
      * `POST /v1/job` body's `capability` field; routes the SDK runtime to the
      * right `onJob` / `onResponse` / `onPayment` handler and the right input
      * schema. Required — the wire layer rejects requests that omit it.
@@ -214,12 +204,12 @@ interface ServerJob {
     requesterId: string;
     /**
      * SHA-256 hex of the per-job opaque `job_token` minted at creation for
-     * anonymous callers (internal-review). Mirror of `JobRecord.requesterTokenHash`;
+     * anonymous callers. Mirror of `JobRecord.requesterTokenHash`;
      * see that field for the wire-level gating semantics.
      */
     requesterTokenHash?: string;
     /**
-     * Submission provenance (internal-review) — mirrors `JobRecord.requesterToken` /
+     * Submission provenance — mirrors `JobRecord.requesterToken` /
      * `requestFingerprint` / `requesterPubkey`. Carried on the job purely so
      * `toJobRecord` persists it; nothing in the runtime reads it. It's the
      * replay gate: a retried paid submit that reproduces the fingerprint (and,
@@ -232,6 +222,16 @@ interface ServerJob {
     /** HTTP path independently recorded when the caller proof was accepted. */
     authRequestPath?: string;
     status: "processing" | "completed" | "failed" | "awaiting-input" | "cancelled" | "working";
+    /** Mirrors the durable completeness marker; false for legacy accepted jobs. */
+    timingKnown?: boolean;
+    /** SDK terminal attribution; never accepted from a handler. */
+    endedBy?: "caller" | "provider";
+    /** Unix ms when the terminal status committed; immutable afterwards. */
+    terminalAtMs?: number;
+    /** Accumulated awaiting-input time, excluding the currently open stretch. */
+    callerWaitMs?: number;
+    /** Unix ms at which the current awaiting-input stretch began. */
+    awaitingInputAtMs?: number;
     summary?: string;
     messages: Message[];
     seq: number;
@@ -243,9 +243,9 @@ interface ServerJob {
      * Settlement reference for the most-recent successful credit. Threaded
      * into `onJobCompleted` so the platform revenue ledger can populate
      * `revenue_events.tx_hash`. mpp/x402 carry the credential's `challenge.id`
-     * / EVM tx hash from the facilitator (internal-review); cashu accumulator carries
-     * the `X-Cashu-Request-Id` UUID (internal-review). Updated on every credit
-     * (upfront or mid-job via `processIncomingPayment`) — internal-review.
+     * / EVM tx hash from the facilitator; cashu accumulator carries
+     * the `X-Cashu-Request-Id` UUID. Updated on every credit
+     * (upfront or mid-job via `processIncomingPayment`).
      * Single-row-per-job accounting keeps the most recent credit's hash,
      * mirroring `paymentRail`.
      */
@@ -253,22 +253,18 @@ interface ServerJob {
     /** Chain transaction returned to callers recovering x402 or Tempo acceptance. */
     paymentTransactionHash?: string;
     /**
-     * Rail-native amount accumulated across all successful credits on this
-     * job (sats for mpp, USDC microunits for x402). The single
-     * `revenue_events` row written at completion uses this as `gross_native`,
-     * so multi-credit jobs sum the per-credit native amounts (internal-review).
-     * internal-review wired the upfront credit; mid-job credits accumulate same-rail
-     * and reset on a cross-rail switch (see `processIncomingPayment`).
+     * Rail-native atomic units accumulated across same-rail credits: Tempo and
+     * x402 use stablecoin micro-units. A rail switch resets this amount; Cashu
+     * revenue is derived from paidMsats instead.
      */
     nativeAmount?: number;
-    /** Native asset tag — paired with `nativeAmount`. internal-review. */
+    /** Native asset tag paired with `nativeAmount`. */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
-    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow` (internal-review). */
     cashuFlow?: "p2pk_accumulator";
     /**
      * What this job cost the **builder** to serve, in 1e-6 of
      * {@link ServerJob.costCurrency} — the running total the handler declared
-     * through `ctx.cost()` (internal-review). Absent until a handler declares
+     * through `ctx.cost()`. Absent until a handler declares
      * something; absent is "unreported", which is not the same fact as a
      * declared zero and is reported differently.
      *
@@ -284,9 +280,9 @@ interface ServerJob {
     costCurrency?: string;
     /** Number of `ctx.cost()` declarations incorporated into the current cost state. */
     costRevision?: number;
-    /** Credit the upfront payment funded/drew (internal-review). See `JobRecord.creditId`. */
+    /** Credit the upfront payment funded/drew. See `JobRecord.creditId`. */
     creditId?: string;
-    /** The draw placed for this job on `creditId` (internal-review). */
+    /** The draw placed for this job on `creditId`. */
     drawId?: string;
     /** Original funding artifact returned by an explicit fund-and-draw. */
     fundingReceipt?: FundingReceipt;
@@ -299,16 +295,16 @@ interface ServerJob {
      * binds challenges to realm/method/amount/expiry, not to the dvmkit job-id;
      * verifying the incoming credential's `challenge.id` is in this set blocks
      * a credential lifted from a sibling job that requested the same fields.
-     * Cleared on successful credit (internal-review).
+     * Cleared on successful credit.
      */
     pendingMppChallengeIds?: string[];
     /**
-     * Per-job binding for x402 mid-job credentials (internal-review). 32-byte 0x-hex
+     * Per-job binding for x402 mid-job credentials. 32-byte 0x-hex
      * nonce issued by `requestPayment` and stamped onto the outbound x402
      * envelope; the caller signs `TransferWithAuthorization` against this exact
      * `bytes32`. Verification rejects an incoming `x402_payment` whose decoded
-     * authorization nonce differs, blocking a cross-job replay before the
-     * facilitator settles. Cleared on successful credit.
+     * authorization nonce differs before crediting the job. Cleared on
+     * successful credit.
      */
     pendingX402Nonce?: string;
     /**
@@ -318,30 +314,30 @@ interface ServerJob {
     pendingX402AmountUsdcMicro?: string;
     /**
      * Fiat micro-units the outstanding `requestPayment` ask is worth, pinned when
-     * the payment-request was emitted (internal-review). See `JobRecord`.
+     * the payment-request was emitted. See `JobRecord`.
      */
     pendingPaymentFiatMicro?: number;
     /** Currency of {@link pendingPaymentFiatMicro} (lowercase ISO-4217). */
     pendingPaymentFiatCurrency?: string;
     /**
      * Cumulative fiat micro this job has asked for mid-job, the ceiling on its
-     * draw growth (internal-review). See `JobRecord.askedTopUpMicro` for the sentinel.
+     * draw growth. See `JobRecord.askedTopUpMicro` for the sentinel.
      */
     askedTopUpMicro?: number;
     /**
      * Currency of {@link askedTopUpMicro} — and this job's sticky ask
-     * denomination (internal-review). See `JobRecord.askedTopUpCurrency`.
+     * denomination. See `JobRecord.askedTopUpCurrency`.
      */
     askedTopUpCurrency?: string;
     /**
-     * Why this job's draw growth is not capped, when it isn't (internal-review). Mirror
+     * Why this job's draw growth is not capped, when it isn't. Mirror
      * of `JobRecord.topUpCapUnenforcedReason`.
      */
     topUpCapUnenforcedReason?: TopUpCapUnenforcedReason;
     /** Price the job was charged at (msats). Used to detect overpayment for change/melt gating. */
     requiredMsats?: number;
     /**
-     * The signed receipt for this job's terminal outcome (internal-review). Mirror of
+     * The signed receipt for this job's terminal outcome. Mirror of
      * `JobRecord.receipt`, set once the terminal funnel has signed and persisted
      * it so the local read paths (which serve from `activeJobs` during the
      * cleanup window) hand back the same bytes as a cross-machine re-read.
@@ -349,7 +345,7 @@ interface ServerJob {
     receipt?: JobReceipt;
     /**
      * The in-flight terminal chain — persist, then sign + store the receipt
-     * (internal-review). Assigned synchronously by `ctx.complete()` / `ctx.fail()` at
+     * Assigned synchronously by `ctx.complete()` / `ctx.fail()` at
      * the instant the job goes terminal, so the `POST /v1/job` fast path can
      * await it (bounded) and put the receipt on the synchronous 200 rather than
      * making the caller poll for it. Never rejects — the chain swallows its own
@@ -358,7 +354,7 @@ interface ServerJob {
     terminalWork?: Promise<void>;
     listeners: Set<(msg: Message) => void>;
     /**
-     * Cancellation signal for the running handler (internal-review). Aborted whenever
+     * Cancellation signal for the running handler. Aborted whenever
      * the job is cancelled on this process — caller cancel, idle timeout,
      * stale-sweep teardown, supersession. Surfaced to builders as `ctx.signal`
      * and auto-threaded into `ctx.fetch`, so an in-flight provider call
@@ -368,18 +364,18 @@ interface ServerJob {
      */
     abort: AbortController;
     /**
-     * Hook for cross-machine message persistence (Tx A, internal-review). Set by
+     * Hook for cross-machine message persistence (Tx A). Set by
      * `JobManager` when the store is streamable. The appender runs the
      * outgoing-message tx atomically with any payment-request counter bump so
      * `(message, pending_payment_msats)` land together — never separately.
      *
-     * Per-job serialised (internal-review): each call chains onto `messageAppenderTail`
+     * Per-job serialised: each call chains onto `messageAppenderTail`
      * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
      * `complete`) can't race for the DB-side seq allocation.
      */
     messageAppender?: (msg: Message, opts?: AppendOutgoingOptions) => void;
     /**
-     * Tail of the per-job appender chain (internal-review). `wireMessageAppender` updates
+     * Tail of the per-job appender chain. `wireMessageAppender` updates
      * this on every call so `persistJob` can await it before the terminal snapshot
      * save runs `DELETE FROM job_messages`.
      */
@@ -406,12 +402,11 @@ interface ServerJob {
     /** Unix ms timestamp of last activity (message, yield, terminal). */
     lastActivityAt: number;
 }
-/** Extract the persistent fields from a ServerJob into a JobRecord. */
 declare function toJobRecord(job: ServerJob): JobRecord;
-/** Reconstitute a ServerJob from a persisted JobRecord with fresh runtime fields. */
+/** Restored snapshots receive fresh process-local listeners, cancellation and prompt state. */
 declare function fromJobRecord(record: JobRecord): ServerJob;
 /**
- * Signal cancellation to a running handler (internal-review). Idempotent — aborting an
+ * Signal cancellation to a running handler. Idempotent — aborting an
  * already-aborted controller is a no-op, so the overlapping teardown paths
  * (caller cancel then stale sweep, say) can each call it unconditionally.
  */
@@ -424,41 +419,14 @@ declare function abortJob(job: ServerJob, reason: string): void;
 declare class JobCancelledError extends Error {
     constructor(message?: string);
 }
-/** Append a provider-sent message to the job and notify SSE listeners. */
 declare function providerMessage(job: ServerJob, type: MessageType, content: Record<string, unknown> | object): void;
-/** Check if a job status is terminal (completed, failed, cancelled). */
 declare function isTerminal(status: ServerJob["status"]): boolean;
-/** Check if a message is a yield point (ends the provider's turn). */
 declare function isYieldMessage(msg: Message): boolean;
 
-/**
- * Per-DVM runtime mint-health tracker (internal-review). Alongside the platform's
- * durable mint-health cron, probes every configured
- * mint on a timer, tracks consecutive failures, and flips a mint to `sick`
- * once the threshold is crossed. The SDK uses the resulting view to:
- *
- *   1. Filter `/v1/info`'s advertised `mints` to currently-healthy ones.
- *   2. Reject new accumulator receives at sick mints before they touch the
- *      DB (`cashu_mint_sick` 503 from `verifyAccumulatorReceipt`).
- *
- * Since internal-review this tracker is the sole owner of mint health: boot no longer
- * runs a fail-fast check before binding the port. To preserve what boot used
- * to guarantee it (a) treats a mint as healthy only when it's reachable AND
- * NUT-compliant (reproducing `assertNutSupport` via `nutCompliant`), and (b)
- * exposes `initialProbeComplete()` so the paid path holds calls at
- * `mint_health_pending` until the first probe validates ≥1 mint.
- *
- * Existing accumulator entries are not touched — they're P2PK-locked to the
- * original mint and stay put until `dvmctl melt-pending` drains them. The
- * accumulator monitor's `wallet_accumulator_batch_expiring_soon` already
- * pages the builder when a stuck batch nears `t_expire`.
- *
- * In-memory only — no DB persistence. The platform cron keeps the durable
- * record + email path (internal-review); the SDK only needs fresh in-process state
- * to make routing decisions.
- */
+/** In-process mint health gates advertising and new receives. Paid calls wait for
+ * the first probe; NUT incompatibility fails immediately, transient failures
+ * use a consecutive threshold. Existing accumulator proofs remain at their mint. */
 
-/** Per-mint runtime view exposed by `snapshot()`. */
 interface MintHealthSnapshot {
     /** Last-observed wall-clock latency of the probe in ms. */
     latencyMs?: number;
@@ -467,8 +435,8 @@ interface MintHealthSnapshot {
     /**
      * True once the mint is considered unhealthy for routing: either
      * `consecutiveFailures` crossed the threshold, or the last probe reached the
-     * mint but it fails the NUT gate (a deterministic, permanent config error
-     * that flips `sick` immediately — internal-review).
+     * mint but it fails the NUT gate, a deterministic, permanent config error
+     * that flips `sick` immediately.
      */
     sick: boolean;
     /**
@@ -478,15 +446,14 @@ interface MintHealthSnapshot {
      * never resolves without a config/mint change.
      */
     nutIncompatible?: boolean;
-    /** Mint version reported by the last successful probe. */
     version?: string;
-    /** Error category from the most recent failed probe. */
     errorCode?: string;
 }
-/** Tunables for {@link MintHealthTracker}. */
 interface MintHealthTrackerOptions {
     /** Cashu mint URLs the DVM accepts. The tracker probes every entry. */
     mints: string[];
+    /** Host environment used for default timing and failure settings. */
+    env?: Record<string, string | undefined>;
     /**
      * Tick cadence in ms. Defaults to {@link DEFAULT_TICK_INTERVAL_MS} or the
      * `DVMKIT_MINT_HEALTH_TICK_MS` env var when set.
@@ -497,26 +464,11 @@ interface MintHealthTrackerOptions {
      * {@link DEFAULT_FAILURES_TO_SICK} or `DVMKIT_MINT_FAILURES_TO_SICK` env.
      */
     consecutiveFailuresToSick?: number;
-    /** Injected `fetch` for tests. */
     fetchImpl?: typeof fetch;
-    /** Injected `Date.now` for tests. */
     now?: () => number;
-    /**
-     * Per-probe timeout / retry / backoff, forwarded to {@link checkMintHealth}.
-     * Defaults to that function's own defaults — 3 attempts with `[200, 500]`
-     * backoff, which is what a real tick should do.
-     *
-     * Tests that drive several failing ticks set `backoffMs: [0]`: a failing
-     * probe otherwise costs 700ms of real `setTimeout`, and four of them put a
-     * unit test within a loaded CI runner's reach of the 5s default timeout.
-     * `fetchImpl` is set on the tracker, not here.
-     */
+    /** Forwarded to checkMintHealth; fetchImpl is supplied on the tracker. */
     probe?: Omit<CheckMintHealthOptions, "fetchImpl">;
 }
-/**
- * Runtime mint-health tracker. Owns its own timer; `start()` runs an initial
- * probe immediately so the first received call doesn't see a stale snapshot.
- */
 declare class MintHealthTracker {
     private readonly mints;
     private readonly tickIntervalMs;
@@ -542,7 +494,7 @@ declare class MintHealthTracker {
     /**
      * True once the first full probe tick has landed. Before this, paid calls
      * are held at `503 mint_health_pending` rather than accepted against
-     * unvalidated mints (internal-review).
+     * unvalidated mints.
      */
     initialProbeComplete(): boolean;
     /**
@@ -559,63 +511,34 @@ declare class MintHealthTracker {
      * gate — a deterministic, permanent config error, unlike a transient outage.
      * Unknown mints return false. `advertisedMints()` uses this to keep a
      * permanently-unsettleable mint off `/v1/info` even in the all-sick fallback,
-     * where a merely-flapping mint is still published (internal-review).
+     * where a merely-flapping mint is still published.
      */
     isNutIncompatible(mintUrl: string): boolean;
-    /** Plain-object snapshot keyed by mint URL — for tests + observability. */
     snapshot(): Record<string, MintHealthSnapshot>;
     private applyResult;
-    /**
-     * One-shot structured summary emitted after the first probe tick. Replaces
-     * the boot check's per-mint `cashu_mint_startup_health` lines and surfaces an
-     * all-mints-unhealthy warning — the operator alert that the Fly restart-loop
-     * used to be before boot stopped refusing to start (internal-review).
-     */
+    /** One boot summary, including an all-unhealthy warning. */
     private logBootHealth;
 }
 
 /**
- * Credit fields riding the signed request body (internal-review, spec §2).
- *
- * An explicit draw references the credit INSIDE the secp256k1/Schnorr-signed
- * `body.data` — no new caller crypto. Wire field names (snake_case, matching
- * the rest of the wire surface):
- *
- * - `credit_id` — the credit to draw against.
- * - `draw_id`   — client-generated draw id; the ledger's idempotency key.
- * - `fund`      — optional `{ amount_micro, commitment }` funding commitment:
- *   present iff a funding artifact (X-Cashu / X-PAYMENT / mpp credential)
- *   rides the same request. `commitment` is the SHA-256 hex over the raw
- *   artifact bytes, binding the header-borne proof — which sits OUTSIDE the
- *   signed body — to the credit its sender intended (spec §2 condition 3).
+ * Credit fields belong to the raw signed body. The funding commitment hashes the header
+ * artifact, binding money outside that body to its intended credit.
  *
- * These are envelope-level fields, not capability input: **the SDK** removes
- * them before any builder-owned schema parses ({@link stripCreditEnvelope} in
- * `JobManager.parseInput` and on the quote path; {@link
- * creditEnvelopeIgnoreFields} feeding the auth verifier's own schema check), so
- * handlers never see them and a top-level `.strict()` capability schema is
- * fine (internal-review). Relying on Zod's default strip mode instead was the trap:
- * `.strict()` rejects unknown keys, so an explicit draw 400'd at parse before
- * the envelope was ever extracted.
- *
- * The strip never touches the canonical signing bytes. Every auth call site
- * verifies the raw wire body (`signedRequestInput`, internal-review), so the credit
- * fields are in the verified bytes because they were never taken out of them —
- * the strip is only ever applied to what a schema is about to parse.
+ * Schema projection strips undeclared protocol keys before builder input parsing, without
+ * changing canonical signing bytes. Signature verification must use the original wire body; a
+ * parsed projection may omit credit fields.
  */
 interface CreditEnvelope {
     creditId: string;
     drawId: string;
     fund?: CreditFundCommitment;
 }
-/** The signed funding commitment for a fund-and-draw request. */
 interface CreditFundCommitment {
     /** Funding amount in 1e-6 units of the credit's currency. */
     amountMicro: number;
     /** SHA-256 hex over the raw funding artifact bytes. */
     commitment: string;
 }
-/** Wire keys reserved for the credit envelope inside `body.data`. */
 declare const CREDIT_ENVELOPE_KEYS: readonly ["credit_id", "draw_id", "fund"];
 /**
  * Thrown by {@link extractCreditEnvelope} on a structurally invalid credit
@@ -633,36 +556,24 @@ declare class CreditEnvelopeError extends Error {
  */
 declare function extractCreditEnvelope(data: unknown): CreditEnvelope | undefined;
 /**
- * The reserved keys `schema` does not itself declare — the ones the SDK is
- * free to remove before handing it an input (internal-review).
- *
- * A capability schema declares none of them, so all three are removable. The
- * one exception this exists for is `/v1/credit`'s own `CREDIT_REQUEST_SCHEMA`,
- * where `credit_id` and `fund` are real fields on a different wire shape and
- * removing them would empty the request. It is not an escape hatch for a
- * capability: the three names stay reserved on `body.data`, and declaring one
- * doesn't win a builder their own value — `app.ts` runs
- * {@link extractCreditEnvelope} over the raw body on every submit, so a
- * capability that declares `fund` answers `invalid_credit_fields` instead.
+ * Return protocol keys not declared by the schema. Schema-declared keys remain available,
+ * including /v1/credit’s differently shaped credit_id and fund fields. Submit separately
+ * extracts and validates the credit envelope from raw body.data; declaring a key does not
+ * bypass that validation.
  */
 declare function creditEnvelopeIgnoreFields(schema: unknown): readonly string[];
 /**
- * Remove the reserved credit keys from `data` before `schema` parses it, so a
- * strict schema doesn't reject the protocol's own envelope (internal-review). Keys
- * `schema` declares are left alone — see {@link creditEnvelopeIgnoreFields}.
- *
- * Returns `data` unchanged when it isn't a plain object or carries none of the
- * removable keys, so the ordinary no-credit request allocates nothing. Never
- * use the result to derive canonical signing bytes: those cover the wire form,
- * credit fields included (`signedRequestInput`).
+ * Remove undeclared credit keys before schema parsing. Preserve nonobject/array inputs and
+ * objects with no removable keys. Never derive signing bytes from this projection; signatures
+ * cover the raw wire body.
  */
 declare function stripCreditEnvelope(schema: unknown, data: unknown): unknown;
 
 /**
- * Fiat denomination of the job price, pinned per request (internal-review).
+ * Fiat denomination of the job price, pinned per request.
  *
- * The credit ledger is fiat-micro denominated (internal-review baked decision:
- * 1e-6 of the DVM's pricing currency, never msats). The conversion pins at
+ * The credit ledger is fiat-micro denominated: 1e-6 of the DVM's pricing
+ * currency, never msats. The conversion pins at
  * quote time: the verify path already fixes both the fiat price and its msat
  * equivalent, so the implicit N=1 fund credits the QUOTED fiat amount when
  * the attached token satisfies the quoted msats — no fresh BTC/USD lookup in
@@ -677,36 +588,13 @@ interface PriceFiat {
 }
 
 /**
- * Resolve the fiat denomination for a request's price (internal-review).
- *
- * Both sources are already fiat-exact, so this never consults an fx rate —
- * which is the point: since internal-review removed numeric-msats prices there is no
- * price form that needs one, and the ledger can be denominated for every paid
- * request rather than only the ones a rate provider happened to be up for.
- *
- * - `dynamicUpfront` — the validated `QuoteResult.upfront` fiat envelope a
- *   dynamic-priced capability returned for THIS request.
- * - a static `"$X.XX"` price — parsed directly.
- *
- * Returns `undefined` for free jobs (`priceMsats` unset or 0). For a paid job
- * it always returns a denomination: `validateQuoteResult` rejects a dynamic
- * amount too small or too large to express in micro-units, and `configureDVM`
- * rejects a static price with the same defect at boot.
- *
- * internal-review: whichever branch answers, the currency is the DVM's declared
- * pricing currency, so a job draws in the denomination `/v1/credit` funded in.
- * Held there by two guards outside this function, which is why neither branch
- * needs to know the DVM's currency to return it — `validateQuoteResult`
- * refuses a quote that disagrees with the declaration, and `configureDVM`
- * refuses a static (USD-literal) price on a DVM that declares anything but
- * `"usd"`. Both refuse rather than convert, deliberately: an fx lookup on this
- * path is the internal-review shape, where a cold-start rate outage took money and
- * recorded no draw.
+ * Paid requests pin the validated fiat price without an FX lookup. Free jobs
+ * return undefined. configureDVM and validateQuoteResult enforce micro-unit
+ * range and the DVM's declared currency before this helper is called; neither
+ * guard converts a mismatched currency.
  */
 declare function resolvePriceFiat(args: {
-    /** The capability's static `price` value, if any. */
     price: string | undefined;
-    /** The resolved required price in msats (static or dynamic). */
     priceMsats: number | undefined;
     /** Fiat envelope from a dynamic quote, when the price came from `onQuote`. */
     dynamicUpfront?: {
@@ -715,28 +603,11 @@ declare function resolvePriceFiat(args: {
     };
 }): PriceFiat | undefined;
 /**
- * The micro-unit half of {@link resolvePriceFiat}, without its "is this job
- * paid at all" gate — the one derivation every surface that states an exact
- * fiat price reads (internal-review).
- *
- * A caller doing an explicit fund-and-draw has to sign the provider's own
- * valuation of the artifact it attaches (`price_micro × paid_msats /
- * required_msats`), and `price_micro` is `PriceFiat.amountMicro`. Reconstructing
- * that integer from a rendered decimal is lossy the moment any surface between
- * the two rounds — the isolate tier advertises at four decimals, and the CLI's
- * synthetic quote used to re-round a 402 the same way — so `/v1/quote`'s
- * `upfront.amount_micro` and the upfront 402's `price_micro` state the integer
- * itself. Both **must** derive through here rather than recomputing: two
- * independent derivations of one figure is the shape that produced the mismatch
- * these fields exist to remove.
- *
- * The `priceMsats` gate stays on `resolvePriceFiat` alone. An advertisement
- * surface has no msat figure in hand — the quote route states a price before
- * anything has converted it — and a free capability is already excluded there
- * by having no price to pass.
+ * Shared exact integer for quote, 402 and ledger valuation. Callers must sign
+ * this micro-unit figure rather than reconstruct it from a rounded display.
+ * Unlike resolvePriceFiat, advertisement callers need no msat price in hand.
  */
 declare function priceFiatMicro(args: {
-    /** The capability's static `price` value, if any. */
     price?: string | undefined;
     /** Fiat envelope from a dynamic quote, when the price came from `onQuote`. */
     dynamicUpfront?: {
@@ -744,17 +615,7 @@ declare function priceFiatMicro(args: {
         currency: string;
     };
 }): PriceFiat | undefined;
-/**
- * Why a denomination could not be produced (internal-review). Carried out of
- * {@link msatsToFiatMicro} and {@link resolveFxSnapshot} so the skip that
- * follows can name its cause.
- *
- * Every one of these used to collapse into a bare `undefined`, which is how a
- * `credit_topup_skipped` / `denomination_unavailable` line came to be
- * undiagnosable: a rate outage, a currency the snapshot never carried, and an
- * ask too small to express in micro-units all read identically in the log, and
- * the only way to tell them apart was to re-derive the whole path by hand.
- */
+/** Reasons are kept distinct so a skipped ledger leg identifies its cause. */
 type FiatDenominationFailure = 
 /** Nothing to convert — a zero-msat ask. */
 "no_msats"
@@ -771,7 +632,7 @@ type FiatDenominationFailure =
  | "rate_stale_refused";
 /**
  * An fx snapshot plus how fresh it is, or why there is none. `stale` means the
- * live fetch failed and this is the last snapshot the fetcher saw (internal-review);
+ * live fetch failed and this is the last snapshot the fetcher saw;
  * `cachedAt` is the Unix ms it landed.
  */
 type ResolvedFx = {
@@ -790,7 +651,7 @@ type ResolvedFx = {
  * `stale` covers both degradation rungs and `carriedForward` distinguishes
  * them: either the whole snapshot came from `lastKnown()` because the live
  * fetch failed, or the fetch succeeded and only *this* currency was carried
- * over from an earlier one because the body omitted it (internal-review). They read
+ * over from an earlier one because the body omitted it. They read
  * differently to an operator — the rate source down, versus the rate source
  * having quietly narrowed — so the log says which.
  */
@@ -806,80 +667,51 @@ type FiatDenomination = {
     detail?: string;
 };
 /**
- * Resolve an fx snapshot for a denomination hop, degrading to the fetcher's
- * last-known one when the live fetch fails (internal-review).
- *
- * The same ladder `resolveServerBtcUsdRate` walks for the x402/Tempo rails
- * (`btc-rate.ts`), and it exists here because the mid-job top-up's two fx legs
- * — the ask-time pin in `context.ts` and the verify-time hop in
- * {@link msatsToFiatMicro} — were the only ones in the payment layer that
- * called `fetch()` raw and swallowed the throw. `FxFetcher.lastKnown` is
- * documented as "the offline degradation source for the payment rail", so a
- * process holding a perfectly good snapshot was nonetheless dropping the
- * receipt's whole `credit` block over one blip at the rate provider.
- *
- * **A known-stale refusal fails closed and never degrades** (internal-review): the
- * platform decided the snapshot is too old to price against, so serving the
- * last-known one prices off exactly what it refused. Every other failure
- * degrades, which is the internal-review posture.
- *
- * No cool-down latch, unlike `resolveServerBtcUsdRate`. That one guards a
- * per-request hot path; this runs at most twice per mid-job ask, and a latch
- * shared across every DVM in the process would suppress the recovery probe a
- * long-lived host needs.
+ * A live fetch failure may use lastKnown(), but a known-stale refusal never
+ * does: that would use the very snapshot the platform refused. No shared
+ * cooldown suppresses the recovery probe on a later mid-job ask.
  */
 declare function resolveFxSnapshot(fetcher: FxFetcher): Promise<ResolvedFx>;
 /**
- * Convert an msat amount into a target currency's micro-units through the
- * shared fx snapshot (internal-review) — the denomination for a mid-job
- * `requestPayment` ask that carries no fiat envelope of its own.
- *
- * internal-review removed the numeric-msats *price*, so {@link resolvePriceFiat} needs
- * no rate; the mid-job ask is the one surface where a bare msat amount survives
- * (`ctx.requestPayment(50_000, …)`), and the credit it tops up may be
- * denominated in a currency the ask never named. An fx hop is the only way to
- * put either on the ledger.
- *
- * Answers a *reason* rather than `undefined` when it can't denominate — the
- * caller still accepts the money and skips the ledger leg rather than refusing
- * over a rate outage (internal-review), but it can now say which failure it degraded
- * on (internal-review). That fail-soft is why this stays separate from
- * `resolvePriceFiat`, which is now total for every paid request.
+ * Bare-msat mid-job asks need an FX conversion into the credit's currency.
+ * Failure carries a reason: callers accept the payment and skip its ledger
+ * leg rather than refusing over an outage. Upfront prices use resolvePriceFiat
+ * and require no rate, so they do not share this fail-soft behavior.
  */
 declare function msatsToFiatMicro(args: {
     msats: number;
     currency: string;
     fxFetcher: FxFetcher;
     /**
-     * A snapshot already in hand (internal-review). The mid-job ask path fetches one to
+     * A snapshot already in hand. The mid-job ask path fetches one to
      * size a fiat-form ask's msats; converting on that same snapshot costs no
      * second fetch and keeps the two figures arithmetically consistent.
      */
     snapshot?: FxRateSnapshot;
 }): Promise<FiatDenomination>;
 /**
- * The mid-job ask's fiat pin, in the target currency (internal-review) — what the cap
+ * The mid-job ask's fiat pin, in the target currency — what the cap
  * on this job's cumulative draw growth is summed from, and what the top-up
  * funds against.
  *
  * Two differences from {@link msatsToFiatMicro}, both scoped to the ask:
  *
  * - **A fiat-form ask already in the target currency is taken verbatim**, so a
- *   `ctx.requestPayment({ amount, currency })` keeps the exactness it has and
- *   never round-trips through a rate. Any other form converts `msats` on the
- *   caller's snapshot — including a fiat-form ask in some *other* currency,
- *   which converts on the very snapshot that sized its msats, so the pin and
- *   the wire ask can't disagree about the rate.
+ * `ctx.requestPayment({ amount, currency })` keeps the exactness it has and
+ * never round-trips through a rate. Any other form converts `msats` on the
+ * caller's snapshot — including a fiat-form ask in some *other* currency,
+ * which converts on the very snapshot that sized its msats, so the pin and
+ * the wire ask can't disagree about the rate.
  * - **Floors at one micro-unit rather than returning `undefined`.**
- *   `ctx.requestPayment(500)` is half a micro at $100k/BTC — a legitimate, if
- *   tiny, ask, and refusing to denominate it poisons the job's whole ask total
- *   and with it the ceiling. One micro is provably conservative for a ceiling:
- *   the ask is worth less than that. `resolvePriceFiat` and `msatsToFiatMicro`
- *   keep their sub-micro refusals, which are load-bearing on the upfront path.
+ * `ctx.requestPayment(500)` is half a micro at $100k/BTC — a legitimate, if
+ * tiny, ask, and refusing to denominate it poisons the job's whole ask total
+ * and with it the ceiling. One micro is provably conservative for a ceiling:
+ * the ask is worth less than that. `resolvePriceFiat` and `msatsToFiatMicro`
+ * keep their sub-micro refusals, which are load-bearing on the upfront path.
  *
  * Throws only what `fxRateFor` throws — an unsupported target currency, or an
  * `fx_rate_unavailable` for one the snapshot never carried. The ask path catches
- * both and degrades to an unpinnable ask (internal-review), naming which it was.
+ * both and degrades to an unpinnable ask, naming which it was.
  */
 declare function pinAskFiat(args: {
     msats: number;
@@ -892,65 +724,29 @@ declare function pinAskFiat(args: {
 }): PriceFiat | undefined;
 /**
  * Fiat micro-units actually funded for a rail payment of `paidMsats` against
- * a job quoted at `requiredMsats` ↔ `priceFiat` (operator ruling: overpay
- * funds and draws the FULL paid amount — ledger truth equals money truth).
+ * a job quoted at `requiredMsats` ↔ `priceFiat`. An overpayment funds and draws
+ * the full paid amount so ledger value matches money received.
  * Pro-rata at the quote-pinned ratio, so the exact-payment case — what every
  * conformant client sends — is `priceFiat.amountMicro` with zero drift.
  */
 declare function fundedMicroFor(priceFiat: PriceFiat, paidMsats: number, requiredMsats: number): number;
 /**
- * The µUSDC figure an x402 402 advertises as `maxAmountRequired`, and the same
- * figure the settled authorization is valued against at submit (internal-review).
- *
- * **A USD-priced job states its price verbatim.** USDC is a six-decimal USD
- * stablecoin, and `priceFiat.amountMicro` is already an exact USD micro figure,
- * so the advertisement is the price — no rate in the derivation, and therefore
- * no way for the 402 and the submit to disagree about it.
- *
- * The BTC hop this replaces was not merely lossy, it was *unpinned*. The 402 is
- * stateless, so the figure was recomputed at submit from whatever the fx cache
- * held by then, through two rate-dependent roundings: `resolveStaticPriceMsats`
- * ceils the price to a whole **satoshi**, and `msatsToUsdc` ceils that back to
- * µUSDC. A rate refresh between the 402 and the payment therefore moved the
- * reconstruction by up to a satoshi's worth (~$0.0013 at $100k/BTC) — and when
- * it moved down, the caller's exact payment read as an overpayment, pro-rated
- * above `price_micro`, and was refused `funding_commitment_mismatch` *after*
- * the facilitator had settled. Money moved, no job, no credit. The sat-ceil
- * also overcharged every x402 caller outright: at $0.01 and $97,432/BTC the
- * quote is 11 sats and the old advertisement demanded 10,718 µUSDC — 7% above
- * the price the caller was quoted and the ledger recorded.
- *
- * Every caller gates x402 on a USD-priced DVM before reaching this helper.
- * Keeping the helper USD-only makes a future advertisement call site fail
- * closed instead of quietly restoring the rate-derived non-USD path.
+ * USD micro-units are already USDC's six-decimal units. Advertise them verbatim
+ * and value settlement against the same figure; a BTC conversion would add
+ * rounding and an unpinned rate between challenge and settlement.
+ * Non-USD callers fail closed rather than implicitly introducing that FX hop.
  */
 declare function x402RequiredUsdcMicro(priceFiat: PriceFiat): number;
 /**
- * A settled x402 authorization's share of a quoted figure, taken against the
- * `maxAmountRequired` the 402 advertised (internal-review) — `quoted` unmodified when
- * the authorization paid exactly that, pro-rata otherwise. Unit-agnostic like
- * {@link fundedMicroFor}: the same ratio restates the job's fiat price and its
- * msat quote, so the two frames can never disagree about what landed.
- *
- * x402 must NOT reach {@link fundedMicroFor} through `usdcToMsats`. The
- * advertised figure is stated in µUSDC by {@link x402RequiredUsdcMicro} — the
- * price verbatim for a USD job — and the
- * receipt converts back with `usdcToMsats`, a `Math.round`, which is the
- * inverse of neither. The round trip lands at or above `requiredMsats`, which
- * took the pro-rata branch and valued a payment of exactly the advertised
- * amount above `price_micro`. That mismatch used to be refused only after the
- * facilitator had broadcast the transfer, so a conformant caller signing the
- * quoted price lost the payment outright (the gate now also runs pre-settle —
- * internal-review).
- *
- * Valuing in the rail's own units removes the manufactured disagreement and
- * nothing else: a genuine overpayment still pro-rates, and both inputs are on
- * the 402, so the caller can derive the figure it must sign from that alone.
+ * Value a settled authorization against the advertised USDC amount, preserving
+ * the quote at exact payment and prorating genuine over/underpayment. Use this
+ * ratio for both fiat and msat frames: a USDC-to-msat round trip can round an
+ * exact payment into a false overpayment and invalidate its signed commitment.
  */
 declare function x402SettledShare(quoted: number, requiredUsdcMicro: number, settledUsdcMicro: number): number;
 /**
  * SHA-256 hex over the raw funding artifact — the value an explicit
- * fund-and-draw request must sign as `fund.commitment` (spec §2 condition 3).
+ * fund-and-draw request must sign as `fund.commitment` (the funding-commitment rule).
  * The artifact is the exact header-borne string: the `X-Cashu` header value,
  * the `X-PAYMENT` header value, or the extracted `Payment <…>` mpp scheme
  * string. Hashing the verbatim wire string keeps the commitment computable by
@@ -964,14 +760,14 @@ declare function fundingCommitment(artifact: string): string;
 declare function implicitCreditId(rail: "cashu" | "x402" | "tempo", paymentId: string): string;
 /**
  * Whether a credit id sits in a namespace the server derives — which a caller
- * may **reference** but must never **create** (internal-review).
+ * may **reference** but must never **create**.
  *
  * Both namespaces are computable by a third party: `imp:` from the rail's
  * payment id, `fnd:` from `(pubkey, fund_id)`. `CreditLedger.fund` INSERTs at
  * whatever id it is handed, so without this rule anyone could pre-open a
  * credit at an id the server would later derive for someone else. The victim's
  * top-up then settles on the rail before `fund` refuses with `caller_mismatch`
- * — they pay and hold nothing. Keeping creation server-side means a derived id
+ * they pay and hold nothing. Keeping creation server-side means a derived id
  * is only ever owned by the caller it was derived for.
  *
  * Referencing stays open, and has to: the id of a credit opened this way is
@@ -981,7 +777,7 @@ declare function implicitCreditId(rail: "cashu" | "x402" | "tempo", paymentId: s
 declare function isDerivedCreditId(creditId: string): boolean;
 /**
  * Deterministic credit id for a `/v1/credit` top-up that names no credit —
- * the documented "omit `credit_id` to open a new one" flow (internal-review).
+ * the documented "omit `credit_id` to open a new one" flow.
  *
  * Minting a fresh random id per attempt would make that flow the one top-up
  * shape that is *not* retry-safe: the second attempt looks up
@@ -998,8 +794,8 @@ declare function isDerivedCreditId(creditId: string): boolean;
  */
 declare function derivedFundCreditId(callerPubkey: string, fundId: string): string;
 /**
- * Settlement reference stamped on the revenue event of an **explicit** draw
- * (internal-review). One funding backs N draws, so the funding's own rail reference
+ * Settlement reference stamped on the revenue event of an **explicit** draw;
+ * one funding backs N draws, so the funding's own rail reference
  * cannot key them: `revenue_events` carries a global `UNIQUE (rail, tx_hash)`
  * that deliberately drops cross-job reuse of a settlement reference, and
  * reusing it would silently discard every draw but the first.
@@ -1012,18 +808,8 @@ declare function derivedFundCreditId(callerPubkey: string, fundId: string): stri
 declare function drawSettlementRef(dvmId: string, creditId: string, drawId: string): string;
 
 /**
- * Durable marker for a rail payment that already funded the credit ledger
- * (internal-review, spec §2 condition 3). The x402 and mpp rails have no dvmkit-side
- * commit point of their own — the money moves at the facilitator / the payer's
- * mpp server — so the marker row, inserted in the SAME transaction as
- * `CreditLedger.fund` + `draw`, is what makes a crash-replayed credential
- * unable to fund twice: the second attempt collides on the primary key and
- * surfaces as {@link ProcessedPaymentReplayError}, which the verifier routes
- * into the internal-review recovery gates instead of a second fund.
- *
- * The Cashu rail does not use this store — its accumulator insert is already
- * the durable commit point, and its replay key (the `X-Cashu-Request-Id`
- * regime) must stay exactly as-is (dual-idempotency rule, spec §2).
+ * x402/Tempo marker, funding and draw commit in one transaction so a retry
+ * cannot fund twice. Cashu retains its separate accumulator replay regime.
  */
 interface ProcessedPaymentStore {
     /**
@@ -1049,11 +835,8 @@ interface ProcessedPaymentStore {
         paymentId: string;
     }): Promise<ProcessedPaymentRecord | undefined>;
     /**
-     * Run `fn` inside one transaction (Postgres: BEGIN → fn → COMMIT, rollback
-     * on throw). The verifier funds and draws the ledger inside `fn`, passing
-     * the handle through to `record` / `CreditLedger.fund` / `draw` so all
-     * three commit atomically. The memory implementation invokes `fn` with no
-     * handle — its operations are synchronous-atomic in-process.
+     * Postgres supplies a transaction for marker, fund and draw; failure rolls it
+     * back. Memory invokes fn without a transactional handle or rollback.
      */
     withTx<T>(fn: (tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<T>;
 }
@@ -1086,7 +869,7 @@ declare class PostgresProcessedPaymentStore implements ProcessedPaymentStore {
     withTx<T>(fn: (tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<T>;
     /** Create the `processed_payments` table if absent. Call once at SDK boot. */
     init(): Promise<void>;
-    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
     private createTables;
     record(args: {
         dvmId: string;
@@ -1128,11 +911,10 @@ declare class MemoryProcessedPaymentStore implements ProcessedPaymentStore {
 /**
  * Machine codes an accumulator-path receive can reject with. Named and exported
  * so the payment-error builder in `payment.ts` folds them into `PaymentErrorCode`
- * and keeps display/hint/retryable copy in lockstep with this union (internal-review).
+ * and keeps display/hint/retryable copy in lockstep with this union.
  */
 type AccumulatorRejectionCode = "missing_request_id" | "missing_lock_pubkey" | "not_p2pk_locked" | "wrong_lock_pubkey" | "proof_not_unspent" | "proof_pending" | "replay_rejected" | "mint_unreachable" | "invalid_token";
 
-/** Durable state of one exact x402 authorization. */
 type X402ExactSettlementStatus = "prepared" | "submitting" | "settled" | "local_committed" | "ambiguous" | "rejected" | "complete";
 /** Serializable local economic effect that follows an exact settlement. */
 interface X402ExactSettlementEffect {
@@ -1181,7 +963,6 @@ interface X402ExactAuthorizationFacts {
     nonce: string;
     fingerprint: string;
 }
-/** One durable exact-x402 settlement intent. */
 interface X402ExactSettlementIntent extends X402ExactAuthorizationFacts {
     id: string;
     dvmId: string;
@@ -1236,11 +1017,9 @@ interface X402ExactSettlementStore {
     }): Promise<X402ExactSettlementIntent[]>;
     attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
 }
-/** Postgres-backed exact settlement intent store. */
 declare class PostgresX402ExactSettlementStore implements X402ExactSettlementStore {
     private readonly pool;
     constructor(pool: Pick<Pool, "query" | "connect">);
-    /** Create the exact settlement tables. */
     init(): Promise<void>;
     prepare(intent: Omit<X402ExactSettlementIntent, "status" | "createdAt" | "updatedAt" | "resolvedAt">): Promise<X402ExactSettlementIntent>;
     get(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent | undefined>;
@@ -1349,7 +1128,6 @@ type X402ExactAcceptance<T> = {
     intentId: string;
     reason: string;
 };
-/** Dependencies for the durable exact x402 settlement coordinator. */
 interface X402ExactSettlementServerOpts {
     store: X402ExactSettlementStore;
     evidence?: X402ExactSettlementEvidenceReader;
@@ -1372,13 +1150,11 @@ declare class X402ExactSettlementServer {
         effect?: X402ExactSettlementEffect;
         commit: (receipt: X402Receipt, tx?: ProcessedPaymentQuerier, effect?: X402ExactSettlementEffect) => Promise<T>;
     }): Promise<X402ExactAcceptance<T>>;
-    /** Read the operator queue. */
     list(args: {
         dvmId: string;
         limit: number;
         includeResolved?: boolean;
     }): Promise<X402ExactSettlementIntent[]>;
-    /** Read durable attempt evidence for one intent. */
     attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
     /** Reconcile and finish one intent from chain evidence. */
     reconcile(dvmId: string, intentId: string): Promise<{
@@ -1437,7 +1213,7 @@ interface X402BatchChannelObservation {
     refundNonce: number;
 }
 /**
- * The chain submission behind an accepted voucher did not return success (internal-review).
+ * The chain submission behind an accepted voucher did not return success.
  *
  * Typed and `retryable` because it is a service-availability fault, not a fault
  * in the credential: the voucher verified, the ledger leg rolled back, and the
@@ -1479,16 +1255,16 @@ interface X402BatchRefusal {
      * `false` when re-signing cannot fix this: the caller must be answered with a
      * terminal error rather than a 402 carrying fresh requirements, because an
      * agent reads a corrective 402 as "sign this and resubmit" and lands straight
-     * back on the same refusal (internal-review). Omitted means corrective.
+     * back on the same refusal. Omitted means corrective.
      */
     corrective?: boolean;
 }
 /**
- * What the chain says about one wedged settlement (internal-review).
+ * What the chain says about one wedged settlement.
  *
  * The four answers are kept apart because their repairs differ and because an
  * operator re-pointing an RPC needs a definitive answer to read as definitive
- * — the same split `LightningReceive.lookupSettlement` draws between
+ * the same split `LightningReceive.lookupSettlement` draws between
  * `invoice_unknown_to_wallet` and `wallet_unreachable`. `findAppliedSettlement`
  * collapses all of them (`undefined` for absent *and* unbookmarked, a throw for
  * transport), so this is where they are separated.
@@ -1563,7 +1339,7 @@ interface X402SettlementRepaired<T> {
 }
 /**
  * The operator's exit from a settlement stuck between "chain paid" and "ledger
- * booked" (internal-review).
+ * booked".
  *
  * `reconcile` is the ordinary recovery path with the chain's figure substituted
  * for the facilitator's: the amount is re-derived from
@@ -1617,7 +1393,7 @@ interface X402BatchSettlementServer {
          * Required on `refund`: the credit's unspent balance in the channel token's
          * own units. It is the ceiling the on-chain payout is sized to, so that a
          * drain returns what the caller is owed and nothing the DVM has earned
-         * (internal-review). `commit` must re-assert it against the authoritative ledger
+         * `commit` must re-assert it against the authoritative ledger
          * figure, since this one is read before the channel lock is taken.
          */
         refundBoundNative?: number;
@@ -1633,7 +1409,7 @@ interface X402BatchSettlementServer {
          * required in the *type*, because the payload the payer presents is
          * what revokes, settles and pays: a refund voucher naming another
          * channel would extinguish this credit's balance out of that channel's
-         * escrow (internal-review). The fund path binds in the ledger
+         * escrow. The fund path binds in the ledger
          * (`credit-ledger.ts`'s `rail_mismatch`) and the Tempo close binds in
          * its credential verifier; this is x402's.
          */
@@ -1648,20 +1424,19 @@ interface X402BatchSettlementServer {
     claimAndSettle(): Promise<void>;
     /**
      * Operator repair for a settlement wedged between chain and ledger
-     * (internal-review). Absent without durable storage: with no settlement rows there
+     * Absent without durable storage: with no settlement rows there
      * is no queue and nothing a repair could act on.
      */
     repair?: X402SettlementRepair;
     /**
      * The durable settlement read the credit ledger gates spending on
-     * (internal-review). Absent without durable storage, on the same reasoning as
+     * Absent without durable storage, on the same reasoning as
      * {@link repair}: with no settlement rows nothing can be wedged, so there is
      * nothing to gate.
      */
     settlementGate?: X402RefundSettlementGate;
     stop(): Promise<void>;
 }
-/** Options for constructing one DVM's batch-settlement server. */
 interface CreateX402BatchSettlementServerOpts {
     network: string;
     payTo: string;
@@ -1677,12 +1452,12 @@ interface CreateX402BatchSettlementServerOpts {
     rpcUrl?: string;
     db?: Pool;
     /**
-     * Durable store to adopt instead of building one from {@link db} (internal-review).
+     * Durable store to adopt instead of building one from {@link db}.
      *
      * `createDVMServer` builds it at ledger construction, because the credit
      * ledger's spend gate has to exist whether or not this server is ever
      * constructed. Adopting it here keeps one `PostgresX402ChannelStorage` — and
-     * so one settlement pool — per mount, which is what the internal-review reasoning on
+     * so one settlement pool — per mount, which is what the reasoning on
      * {@link PostgresX402ChannelStorage} rests on. Ignored when the config
      * supplies its own {@link X402BatchSettlementConfig.storage}.
      */
@@ -1694,7 +1469,7 @@ interface CreateX402BatchSettlementServerOpts {
      * `undefined` means the channel's credit could not be resolved.
      *
      * Required, not optional: it is the ceiling every claim is capped at
-     * (internal-review), and a server that cannot derive one must claim nothing rather
+     * and a server that cannot derive one must claim nothing rather
      * than fall back to the deposit.
      */
     earnedNative: (channelId: string) => Promise<number | undefined>;
@@ -1705,13 +1480,13 @@ interface CreateX402BatchSettlementServerOpts {
     /** Authoritative channel-view override for deterministic tests. */
     channelStateReader?: (channelId: string) => Promise<X402BatchChannelObservation>;
     /**
-     * The payout tracker (internal-review). Attached with this server's settle scope
+     * The payout tracker. Attached with this server's settle scope
      * and routed every claim and settle, so the batch that lands at `pay_to` is
      * reported with the value claimed into it, and the pending snapshot can say
      * what is still on the channels and whether the settle is wedged.
      *
      * @internal Wired by `createDVMServer` from the platform reporter; not a
-     * builder surface, and not part of the extractable SDK contract (internal-review).
+     * builder surface, and not part of the extractable SDK contract.
      */
     payout?: X402PayoutObserver;
 }
@@ -1723,12 +1498,11 @@ interface CreateX402BatchSettlementServerOpts {
  */
 declare function createX402BatchSettlementServer(opts: CreateX402BatchSettlementServerOpts): Promise<X402BatchSettlementServer>;
 
-/** Payment state from upfront token verification. */
 interface PaymentInfo {
     /**
      * Rail value this payment contributes to the job, in millisatoshis.
      *
-     * For a credit-drawn job (internal-review) this is the **draw's** allocated share of
+     * For a credit-drawn job this is the **draw's** allocated share of
      * the credit's rail value, not the amount the caller handed over on this
      * request — under an explicit fund-and-draw the caller may have funded twenty
      * jobs' worth. That makes it the revenue basis for this job: mid-job top-ups
@@ -1739,38 +1513,36 @@ interface PaymentInfo {
     /**
      * Rail that satisfied the upfront payment, if any. A {@link FundingMethod}
      * rather than a `PaymentMethod`: a draw against a Lightning-funded credit
-     * reports `"lightning"` here (internal-review), which is what lets the revenue
+     * reports `"lightning"` here, which is what lets the revenue
      * ledger book it instead of silently dropping the row.
      */
     paymentRail?: FundingMethod;
     receivedProofs: ProofLike[];
     /**
      * Settlement reference for the credit. x402 carries the EVM tx hash from
-     * the facilitator (internal-review); mpp carries the credential's `challenge.id`,
-     * HMAC-bound to the realm so cross-DVM collisions are impossible (internal-review);
-     * cashu accumulator (internal-review) sets it to the `X-Cashu-Request-Id` UUID
-     * (internal-review). Required by the platform revenue ledger for `tempo`/`x402`
+     * the facilitator; mpp carries the credential's `challenge.id`,
+     * HMAC-bound to the realm so cross-DVM collisions are impossible;
+     * cashu accumulator sets it to the `X-Cashu-Request-Id` UUID
+     * Required by the platform revenue ledger for `tempo`/`x402`
      * rails; nullable for cashu's `tx_hash` column.
      */
     paymentTxHash?: string;
     /** Chain transaction returned to a caller recovering this accepted request. */
     paymentTransactionHash?: string;
     /**
-     * Rail-native payment amount in atomic units (internal-review). Sats for mpp,
-     * USDC microunits for x402. Cashu leaves it unset — the existing
-     * `paidMsats / 1000` derivation in the platform callback covers it.
+     * Stablecoin micro-units for Tempo and x402. Cashu leaves this unset; its revenue is derived
+     * from paidMsats.
      */
     nativeAmount?: number;
-    /** Native asset tag matching `revenue_events.native_asset` (internal-review). */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
     /**
      * Discriminator written into `revenue_events.metadata.cashu_flow` so ops
-     * queries can split per-call cashu rows by source path (internal-review).
+     * queries can split per-call cashu rows by source path.
      */
     cashuFlow?: "p2pk_accumulator";
     /**
      * Base64-encoded x402 `SettleResponse` for the `X-PAYMENT-RESPONSE`
-     * response header (internal-review). Set on the upfront-flow x402 success path;
+     * response header. Set on the upfront-flow x402 success path;
      * `app.ts` attaches it to the 2xx response per x402 spec.
      */
     x402SettleResponseHeader?: string;
@@ -1781,21 +1553,21 @@ interface PaymentInfo {
         replayed: boolean;
     };
     /**
-     * Credit-ledger linkage (internal-review). Set whenever the payment funded and/or
+     * Credit-ledger linkage. Set whenever the payment funded and/or
      * drew the ledger — every paid job with a ledger wired. Persisted on the
      * job so the terminal funnel can settle/release the draw and the receipt
      * can countersign the `ReceiptCredit` block.
      */
     creditId?: string;
-    /** The draw placed for this job on `creditId` (internal-review). */
+    /** The draw placed for this job on `creditId`. */
     drawId?: string;
-    /** The draw's fiat amount, 1e-6 of {@link creditCurrency} (internal-review). */
+    /** The draw's fiat amount, 1e-6 of {@link creditCurrency}. */
     drawAmountMicro?: number;
-    /** Currency the credit — and therefore the draw — is denominated in (internal-review). */
+    /** Currency the credit — and therefore the draw — is denominated in. */
     creditCurrency?: string;
     /**
      * The funding leg, when this request actually moved money onto a credit
-     * (internal-review). Reported to the platform as a **deposit**: a liability until
+     * Reported to the platform as a **deposit**: a liability until
      * drawn, never summed into revenue. Absent on a pure draw against an
      * existing balance.
      */
@@ -1805,7 +1577,7 @@ interface PaymentInfo {
     fundingCredit?: CreditSnapshot;
     /**
      * Fiat micro of {@link creditCurrency} this payment funded that bought the
-     * job **nothing** (internal-review) — a second payment for an ask the job's draw
+     * job **nothing** — a second payment for an ask the job's draw
      * already covers, or the overpaid tail of an oversized one. It is available
      * balance on {@link creditId}, drainable at once, and the caller has to be
      * told or they will re-send. Absent on every ordinary payment.
@@ -1813,7 +1585,7 @@ interface PaymentInfo {
     unappliedMicro?: number;
 }
 /**
- * A funding event as the platform books it — one deposit row (internal-review, spec
+ * A funding event as the platform books it — one deposit row (spec
  * §10). Keyed on `(dvmId, creditId, fundingId)`, so a retried report is a
  * no-op rather than a double-count.
  */
@@ -1845,12 +1617,12 @@ interface CreditFundingReport {
         channelId: string;
         cumulativeAmount: string;
     };
-    /** TIP-1034 chain binding, reported so the platform can route a close (internal-review). */
+    /** TIP-1034 chain binding, reported so the platform can route a close. */
     tempoChannel?: TempoChannelReport;
 }
 /**
  * The chain identity of a TIP-1034 channel, as reported to the platform
- * alongside its deposit (internal-review). Read from the DVM's own durable channel
+ * alongside its deposit. Read from the DVM's own durable channel
  * store, never from the caller's credential.
  */
 interface TempoChannelReport {
@@ -1858,7 +1630,6 @@ interface TempoChannelReport {
     escrow: string;
     payee?: string;
 }
-/** Options for verifying an upfront payment on job submission. */
 interface UpfrontPaymentOpts {
     cashuToken?: string;
     requiredMsats?: number;
@@ -1875,7 +1646,7 @@ interface UpfrontPaymentOpts {
     /**
      * Resource URL the client retried against. Bound into the rebuilt
      * `PaymentRequirements` when verifying x402, and surfaced on the 402 body
-     * `accepts` array for x402 dual-serve (internal-review).
+     * `accepts` array for x402 dual-serve.
      */
     x402Resource?: string;
     /** Either the structured credential object or its serialized `Authorization: Payment <…>` value. */
@@ -1884,17 +1655,17 @@ interface UpfrontPaymentOpts {
     /**
      * Request path of the resource being paid for (e.g. `/v1/job`). Bound into
      * each issued mppx challenge's `meta.path` so a credential can't be replayed
-     * against a different paid endpoint of the same DVM (internal-review).
+     * against a different paid endpoint of the same DVM.
      */
     resourcePath?: string;
     /**
      * Whether `tempo/session` may be issued and newly accepted right now — the
-     * platform close-observer and hosted settlement-readiness gates (internal-review,
-     * internal-review), resolved per request by `DVMServer`. Absent means offered: a
+     * platform close-observer and hosted settlement-readiness gates, resolved per
+     * request by `DVMServer`. Absent means offered: a
      * self-hosted DVM operates these responsibilities itself.
      *
      * `false` refuses a session credential that would open a channel the platform
-     * cannot safely protect or settle (internal-review, internal-review), and withholds session
+     * cannot safely protect or settle, and withholds session
      * challenges from every 402 this call emits, *except* on a credit already
      * bound to a TIP-1034 channel. That deposit is already exposed, so refusing
      * its vouchers only strands it; and since a channel-bound credit can be funded
@@ -1907,11 +1678,10 @@ interface UpfrontPaymentOpts {
     /**
      * Tracks consumed `(realm, challenge.id)` pairs so a credential that was
      * already accepted on the upfront path can't be replayed within its
-     * `expires` window (internal-review). Optional: when absent, the upfront flow has
+     * `expires` window. Optional: when absent, the upfront flow has
      * no per-process replay protection beyond mppx's own expiry check.
      */
     consumedCredentialStore?: ConsumedCredentialStore;
-    /** Cashu receive mode (internal-review / internal-review). Routes the receive path. */
     cashuMode?: CashuMode;
     /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
     accumulatorDb?: AccumulatorPool;
@@ -1921,7 +1691,7 @@ interface UpfrontPaymentOpts {
     /**
      * Active NUT-11 P2PK lock pubkeys — required for the `p2pk-accumulator`
      * path. Includes the current pubkey followed by retired pubkeys still
-     * within the rotation grace window (internal-review). Caller resolves via
+     * within the rotation grace window. Caller resolves via
      * `loadLockPubkeyState` per-request so rotations propagate without a
      * server restart.
      */
@@ -1929,7 +1699,7 @@ interface UpfrontPaymentOpts {
     /** UUIDv4 from `X-Cashu-Request-Id` header. */
     requestId?: string;
     /**
-     * Runtime mint-health tracker (internal-review). Receive path short-circuits with
+     * Runtime mint-health tracker. Receive path short-circuits with
      * `cashu_mint_sick` when the token's mint is currently flagged sick, so
      * agents retry against a healthy alternative without waiting for the
      * per-call mint timeout to fire inside `acceptAccumulatorPayment`.
@@ -1937,37 +1707,34 @@ interface UpfrontPaymentOpts {
     mintHealthTracker?: MintHealthTracker;
     /**
      * Host fx fetcher used to price the non-sat rails (x402 USDC, mppx fiat)
-     * through the same BTC/USD source the quote path uses (internal-review). On a hosted
+     * through the same BTC/USD source the quote path uses. On a hosted
      * DVM this is the platform-served snapshot; self-hosted defaults to
      * CoinGecko-direct. Optional: a lazy default fetcher stands in when unset, so
      * the payment path never reaches `fetchBtcUsdRate`.
      */
     fxFetcher?: FxFetcher;
     /**
-     * Credit ledger every payment funds and draws through (internal-review, spec §1):
-     * an attached rail payment is an implicit N=1 funding — `fund` the paid
-     * amount + `draw` it, atomically with the rail commit. When absent (or
-     * when the price can't be fiat-denominated), the payment is accepted with
-     * legacy semantics and a structured warning — money is never refused
-     * because the ledger is unavailable.
+     * Attached payments fund and draw an implicit per-job credit atomically with
+     * rail accounting. Omitting the ledger uses the legacy ledgerless path;
+     * a configured ledger requires a fiat-denominated price before acceptance.
      */
     creditLedger?: CreditLedgerLike;
     /**
-     * Durable processed-payment markers for the x402/mpp rails (internal-review).
+     * Durable processed-payment markers for the x402/mpp rails.
      * Those rails commit money outside dvmkit, so the marker row — written in
      * the same transaction as the ledger fund — is what makes a crash-replayed
      * credential unable to fund twice.
      */
     processedPayments?: ProcessedPaymentStore;
     /**
-     * Reporter-owned transactional outbox enqueue (internal-review). When present,
+     * Reporter-owned transactional outbox enqueue. When present,
      * every funding awaits this inside the rail's commit transaction, so money
      * and its durable deposit report land together.
      */
     enqueueCreditDeposit?: CreditDepositEnqueue;
     /**
      * The job price's fiat denomination, pinned by the caller from the same
-     * quote surface that produced `requiredMsats` (internal-review). The ledger is
+     * quote surface that produced `requiredMsats`. The ledger is
      * fiat-micro denominated; fund = draw = this amount in the exact-payment
      * case, so no fresh fx conversion happens on the verify hot path.
      */
@@ -1983,14 +1750,14 @@ interface UpfrontPaymentOpts {
     /** Requester id — funder identity fallback for DVMs without descriptor auth. */
     requesterId?: string;
     /**
-     * Explicit credit fields extracted from the signed body (spec §2). Their
+     * Explicit credit fields extracted from the signed body (the signed credit contract). Their
      * signature coverage and structural validation happen in `app.ts` before
      * payment verification; this layer enforces ownership, the funding
      * commitment, and the draw itself.
      */
     creditEnvelope?: CreditEnvelope;
     /**
-     * Turn this verification into a **fund-only top-up** (internal-review): the rails
+     * Turn this verification into a **fund-only top-up**: the rails
      * verify and commit exactly as they do for a job, but the ledger leg funds
      * without drawing — there is no job to pay for. Set by `POST /v1/credit`;
      * `requiredMsats` / `priceFiat` carry the requested top-up amount rather
@@ -2021,26 +1788,25 @@ interface FundOnlyRequest {
     /** Client-generated idempotency key for this deposit (`credit_fundings` PK). */
     fundId: string;
     /**
-     * SHA-256 hex over the raw funding artifact, signed by the caller (spec §2
+     * SHA-256 hex over the raw funding artifact, signed by the caller (the signed credit contract
      * condition 3). Checked before any rail work: it is what binds the artifact
      * presented on the header to the deposit named in the signed body.
      */
     commitment: string;
 }
-/** Structured payment validation error detail carried through `PaymentValidationError`. */
 interface PaymentErrorDetail {
     body: Record<string, unknown>;
     status: number;
     /**
      * mppx challenges to advertise via `WWW-Authenticate` headers on the 402
-     * response (internal-review). Populated whenever the DVM has an mppx handle and
+     * response. Populated whenever the DVM has an mppx handle and
      * the request is short on payment — including on payment_invalid, since
      * draft-ryan-httpauth-payment-01 requires a fresh challenge on rejection.
      */
     mppChallenges?: Challenge.Challenge[];
     /**
      * x402 `PaymentRequirements` to merge into the 402 body's `accepts`
-     * array under the `x402Version` envelope (internal-review). Populated when the
+     * array under the `x402Version` envelope. Populated when the
      * DVM has x402 wired and dual-serve is on.
      */
     x402Requirements?: PaymentRequirements[];
@@ -2049,30 +1815,30 @@ interface PaymentErrorDetail {
     /**
      * Scheme-level error code for the x402 v2 envelope, kept apart from the
      * body's human `message` because a scheme client matches on it verbatim to
-     * decide whether a 402 is correctable (internal-review).
+     * decide whether a 402 is correctable.
      */
     x402ErrorCode?: string;
     /**
      * On a `replay_rejected` from the x402/mpp processed-payment marker
-     * (internal-review): the payment id the original funding committed under. The
-     * route feeds it to the internal-review recovery gates (jobs persist it as
+     * the payment id the original funding committed under. The
+     * route feeds it to the recovery gates (jobs persist it as
      * `payment_tx_hash`) so a crash-replayed credential can recover its
      * original job instead of a bare 409.
      */
     replayPaymentId?: string;
     /**
      * A short payment that was kept under the fail-closed posture and settled
-     * on the spot (internal-review). The route books it as revenue under a synthetic
+     * on the spot. The route books it as revenue under a synthetic
      * job id — no job exists to carry it — tagged so it stays separable from
      * per-job service revenue.
      */
     forfeit?: ShortPayForfeit;
     /**
-     * Money that landed on a credit even though this request failed (internal-review,
-     * internal-review). Set when a short mid-job pay funds without completing its ask,
+     * Money that landed on a credit even though this request failed. Set when a
+     * short mid-job pay funds without completing its ask,
      * or an explicit upfront fund-and-draw commits the deposit but the combined
      * balance cannot cover the draw. In both cases the caller keeps an available
-     * balance they can reclaim under the internal-review drain. That is a liability, so
+     * balance they can reclaim under the drain. That is a liability, so
      * the deposit has to reach the platform on the 402 path exactly as it does on
      * the success path, or the outstanding-liability view is short by precisely
      * the money we still owe.
@@ -2085,7 +1851,7 @@ interface PaymentErrorDetail {
      */
     funding?: CreditFundingReport;
 }
-/** A kept-but-undelivered short payment, ready to be booked as tagged revenue (internal-review). */
+/** A kept-but-undelivered short payment, ready to be booked as tagged revenue. */
 interface ShortPayForfeit {
     /** Cashu request id — the rail settlement reference. */
     paymentId: string;
@@ -2101,9 +1867,9 @@ type PaymentResult = PaymentInfo & {
     error?: PaymentErrorDetail;
     /**
      * The signed body's `(credit_id, draw_id)` matches an already-recorded
-     * draw (internal-review, spec §2 condition 1 — the explicit idempotency regime).
+     * draw (the draw-idempotency rule — the explicit idempotency regime).
      * No rail work ran and no second hold was placed; the route applies the
-     * internal-review proof-of-origin gates and re-issues the original job's response.
+     * proof-of-origin gates and re-issues the original job's response.
      */
     replayedDraw?: {
         creditId: string;
@@ -2112,7 +1878,7 @@ type PaymentResult = PaymentInfo & {
     };
 };
 /**
- * Whether a dev-mode server skips payment verification outright (internal-review).
+ * Whether a dev-mode server skips payment verification outright.
  *
  * Both upfront and mid-job acceptance require verification whenever any Cashu,
  * x402, or Tempo rail is configured. An unusable configured rail fails closed;
@@ -2134,7 +1900,7 @@ declare function devModeSkipsPaymentVerification(opts: {
  */
 declare const PAYMENT_PROOF_KEYS: readonly ["cashu_token", "x402_payment", "tempo_credential"];
 /**
- * Whether a `payment` message carries a proof on any mid-job rail (internal-review).
+ * Whether a `payment` message carries a proof on any mid-job rail.
  *
  * Deliberately colocated with the rail dispatch it mirrors, because two call
  * sites decide on it: `validateMessageContent` (`server/app.ts`) admits a
@@ -2146,26 +1912,26 @@ declare const PAYMENT_PROOF_KEYS: readonly ["cashu_token", "x402_payment", "temp
 declare function hasPaymentProof(content: Record<string, unknown>): boolean;
 /**
  * Issue one mppx Challenge per registered method for the upfront HTTP-transport
- * 402 path (internal-review). Mirrors the message-based issuance loop in
+ * 402 path. Mirrors the message-based issuance loop in
  * `context.ts` but binds challenges via `meta` (resource path + per-request
- * nonce) instead of the per-job `pendingMppChallengeIds` binding (internal-review) —
+ * nonce) instead of the per-job `pendingMppChallengeIds` binding —
  * there's no job at upfront challenge-issue time, so the binding has to live
  * inside the challenge itself.
  *
  * `meta.nonce` is unique-per-issue and HMAC-bound; consumed-id tracking on
- * the verification side is wired via `ConsumedCredentialStore` (internal-review), so
+ * the verification side is wired via `ConsumedCredentialStore`, so
  * a successfully-accepted credential can't be replayed within its `expires`
  * window even if it lands on the same paid endpoint.
  *
- * `btcUsdRate` is resolved once per request by the caller (internal-review) rather
+ * `btcUsdRate` is resolved once per request by the caller rather
  * than fetched here, so every rail this request advertises or verifies prices
  * off the same number and a rate-provider outage is handled in one place.
  *
- * `sessionIssuable` is the platform close-observer gate (internal-review), threaded in
+ * `sessionIssuable` is the platform close-observer gate, threaded in
  * by `DVMServer` and defaulting to issuable for a self-hosted DVM that watches
  * its own closes. It used to gate advertisement only, so a `/v1/credit` 402
  * kept issuing `tempo/session` challenges the DVM had just stopped advertising
- * — and its own interface doc said "advertised **and** issued" (internal-review). The
+ * and its own interface doc said "advertised **and** issued". The
  * caller resolves it as "the gate is open, **or** this credit is already bound
  * to a channel", so a top-up on an existing channel keeps its challenge while
  * the gate is closed; `verifyUpfrontPayment` still refuses any *other* channel
@@ -2175,11 +1941,9 @@ declare function hasPaymentProof(content: Record<string, unknown>): boolean;
  * surfaces always keep charge.
  */
 declare function issueUpfrontChallenges(mpp: MppxServer, requiredMsats: number, resourcePath: string, btcUsdRate: number, sessionIssuable?: boolean, allowOneShotStablecoin?: unknown, priceFiat?: PriceFiat): Promise<Challenge.Challenge[]>;
-/** Verify an upfront payment on job submission (Cashu, x402, or MPP). */
 declare function verifyUpfrontPayment(opts: UpfrontPaymentOpts): Promise<PaymentResult>;
 /**
  * A management credential signed for a channel other than the one required
- * (internal-review).
  *
  * Typed rather than a bare `Error` because the drain route has to tell it apart
  * from the transport and chain failures its catch ladder reconciles: this one is
@@ -2206,7 +1970,7 @@ declare function verifyTempoSessionManagementCredential(args: {
      *
      * The drain route re-asserts its close intent here rather than a line above
      * the call so that a credential signed for another channel is refused before
-     * the reservation is touched (internal-review). Only this function knows where that
+     * the reservation is touched. Only this function knows where that
      * seam is, so putting the hook here makes the ordering structural instead of a
      * comment the next edit can reorder past. A throw propagates to the caller
      * with nothing broadcast.
@@ -2218,7 +1982,7 @@ declare function verifyTempoSessionManagementCredential(args: {
     cumulativeAmount?: string;
 }>;
 /**
- * Every machine code a flat payment-error body can carry (internal-review) — the six
+ * Every machine code a flat payment-error body can carry — the six
  * codes constructed directly in this file plus the agent-wallet cashu rejection
  * codes ({@link AccumulatorRejectionCode}), which surface verbatim through the
  * accumulator branch of {@link verifyAccumulatorReceipt}. `fx_rate_unavailable`
@@ -2228,25 +1992,9 @@ declare function verifyTempoSessionManagementCredential(args: {
  */
 type PaymentErrorCode = "payment_invalid" | "x402_not_offered" | "x402_settlement_ambiguous" | "cashu_unavailable" | "cashu_not_p2pk_locked" | "mint_health_pending" | "cashu_mint_sick" | "payment_insufficient" | "payment_unapplied" | "insufficient_credit" | "credit_expired" | "credit_unbacked" | "credit_not_found" | "tempo_channel_closing" | "settlement_pending" | "draw_conflict" | "funding_commitment_mismatch" | "credit_not_supported" | "one_shot_credit_not_supported" | "credit_below_min" | "below_rail_minimum" | "credit_over_max" | "credit_id_unavailable" | "nothing_to_drain" | "drain_below_dust" | "drain_not_found" | "drain_conflict" | "drain_method_unsupported" | "tempo_channel_exit_required" | "x402_settlement_submission_failed" | X402SettlementReconciliationReason | "lightning_settlement_pending" | "lightning_invoice_expired" | "lightning_unavailable" | AccumulatorRejectionCode;
 /**
- * Build a flat payment-error body carrying the four agent-facing fields every
- * payment error must have (internal-review): the machine `code`, the operator-facing
- * `message`, and the `display`/`hint`/`retryable` copy an agent relays to a
- * human and branches retries on. `display`, `hint`, and `retryable` default from
- * {@link PAYMENT_ERROR_COPY} keyed on `code`; `message` is the per-site operator
- * log line. The prose fields can be overridden for dynamic cases (e.g.
- * `cashu_mint_sick` naming the currently-healthy mints, or a retained deposit
- * distinguishing "not spent" from "not paid"). `extra` carries a code's ad-hoc
- * fields (`mints`, `required_msats`, `received_msats`) and is merged last so
- * those are preserved.
- *
- * `retryable` overrides on the same terms, and for the same reason: a code that
- * covers more than one refusal can be terminal for one of them and clear on its
- * own for another — `drain_conflict` is both (internal-review). Override it only
- * alongside the `hint`, since the two are one answer: a hint that says retry
- * under `retryable: false` is the disagreement this exists to prevent.
- *
- * Upstream of {@link buildPaymentErrorResponse}, which serializes the body onto
- * a `Response` — this shapes it.
+ * Per-code display, hint and retryability may be overridden for a particular
+ * refusal. Keep the hint and retry decision consistent. Extra fields merge
+ * last, so callers can supply code-specific amounts and alternatives.
  */
 declare function paymentErrorBody(code: PaymentErrorCode, opts: {
     message: string;
@@ -2258,14 +2006,14 @@ declare function paymentErrorBody(code: PaymentErrorCode, opts: {
 /**
  * Build a payment-error response carrying a JSON error body plus one
  * `WWW-Authenticate: Payment <serialized challenge>` header per mppx challenge
- * (internal-review, per draft-ryan-httpauth-payment-01). When `challenges` is empty,
+ * (per draft-ryan-httpauth-payment-01). When `challenges` is empty,
  * returns a plain JSON response (Cashu/x402-only DVMs).
  *
  * Status defaults to 402 (Payment Required) but callers can override — e.g.
- * the internal-review sick-mint short-circuit returns 503 because the issue is a
+ * the sick-mint short-circuit returns 503 because the failure is a
  * mint-side outage, not a payment problem.
  *
- * When `x402Requirements` is present (internal-review, x402 dual-serve), merge the
+ * When `x402Requirements` is present (x402 dual-serve), merge the
  * x402-spec envelope `{ x402Version, accepts: [...] }` into the body next to
  * the existing dvmkit error fields so x402 clients can find their retry
  * shape on the same response. The MPP `WWW-Authenticate` header and the
@@ -2275,7 +2023,6 @@ declare function paymentErrorBody(code: PaymentErrorCode, opts: {
  * are single-use and shared caches must not return them to other clients.
  */
 declare function buildPaymentErrorResponse(body: Record<string, unknown>, challenges?: Challenge.Challenge[], x402Requirements?: PaymentRequirements[], status?: number, x402V2Requirements?: PaymentRequirementsV2[], x402V2Resource?: string, x402ExactVersions?: X402ExactVersionSupport, x402ErrorCode?: string): Response;
-/** Options for processing an incoming mid-job payment message. */
 interface IncomingPaymentOpts {
     mints?: string[];
     x402Config?: X402Config;
@@ -2288,7 +2035,7 @@ interface IncomingPaymentOpts {
     mpp?: MppxServer;
     /** Resource URL bound into the rebuilt x402 `PaymentRequirements`. */
     resourcePath?: string;
-    /** Cashu receive mode (internal-review). Mirrors {@link UpfrontPaymentOpts.cashuMode}. */
+    /** Cashu receive mode. Mirrors {@link UpfrontPaymentOpts.cashuMode}. */
     cashuMode?: CashuMode;
     /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
     accumulatorDb?: AccumulatorPool;
@@ -2297,28 +2044,28 @@ interface IncomingPaymentOpts {
     dvmId?: string;
     /** Active NUT-11 P2PK lock pubkeys (current + retired-in-grace). */
     lockPubkeys?: LockPubkey[];
-    /** Runtime mint-health tracker (internal-review). */
+    /** Runtime mint-health tracker. */
     mintHealthTracker?: MintHealthTracker;
     /**
-     * Host fx fetcher for the non-sat rails (internal-review). See
+     * Host fx fetcher for the non-sat rails. See
      * {@link UpfrontPaymentOpts.fxFetcher}.
      */
     fxFetcher?: FxFetcher;
     /**
-     * Credit ledger the mid-job top-up funds and grows (internal-review, spec §1:
+     * Credit ledger the mid-job top-up funds and grows (the credit lifecycle contract:
      * "mid-job `requestPayment` becomes a top-up"). Absent ⇒ the payment is
      * accepted with pre-credits semantics, exactly as before.
      */
     creditLedger?: CreditLedgerLike;
     /**
-     * Durable processed-payment markers (internal-review). x402/mpp money moves outside
+     * Durable processed-payment markers. x402/mpp money moves outside
      * dvmkit, so the marker + `fund` + `growDraw` in one transaction is what
      * makes the mid-job ledger leg atomic and crash-replay safe — the cashu path
      * gets the same property from the accumulator's own commit transaction.
      */
     processedPayments?: ProcessedPaymentStore;
     /**
-     * Reporter-owned transactional outbox enqueue (internal-review). Runs inside the
+     * Reporter-owned transactional outbox enqueue. Runs inside the
      * mid-job rail transaction after the ledger top-up/growth and before commit.
      */
     enqueueCreditDeposit?: CreditDepositEnqueue;
@@ -2328,20 +2075,15 @@ interface IncomingPaymentOpts {
     creditTtlMs?: number;
 }
 /**
- * Pure verification of an incoming mid-job payment (internal-review). Runs the
- * rail-specific verify path and returns the credit shape; does not mutate
- * the job. The caller (`JobManager.processPayment`) applies the result
- * inside Tx C so verify+credit land atomically.
- *
- * `snapshot` carries the read-only job state the verification path needs
- * (`pendingPaymentMsats` for amount checks, the MPP/x402 per-job bindings,
- * `paymentRail` for the same-rail accumulator check).
+ * Job state read by incoming-payment verification; the job itself is not mutated. Rail
+ * acceptance and ledger funding can still occur before the caller applies the returned credit in
+ * Tx C.
  */
 interface VerifyIncomingSnapshot {
     pendingPaymentMsats?: number;
     pendingMppChallengeIds?: string[];
     /**
-     * Per-job x402 binding (internal-review). When set, the incoming `x402_payment`'s
+     * Per-job x402 binding. When set, the incoming `x402_payment`'s
      * decoded `authorization.nonce` must match this value or the credential is
      * rejected — closes the pre-settlement cross-job replay window. Pre-fix
      * DVMs leave this `undefined`; the verify-side check no-ops for them.
@@ -2350,9 +2092,9 @@ interface VerifyIncomingSnapshot {
     /** Exact advertised USDC microunits paired with `pendingX402Nonce`. */
     pendingX402AmountUsdcMicro?: string;
     paymentRail?: FundingMethod;
-    /** The credit the upfront leg funded and drew, when it had one (internal-review). */
+    /** The credit the upfront leg funded and drew, when it had one. */
     creditId?: string;
-    /** The draw this job holds on {@link creditId}; the top-up grows it (internal-review). */
+    /** The draw this job holds on {@link creditId}; the top-up grows it. */
     drawId?: string;
     /**
      * The job's current settlement reference. Used to tell an explicit
@@ -2361,17 +2103,17 @@ interface VerifyIncomingSnapshot {
      * upfront leg established.
      */
     paymentTxHash?: string;
-    /** Fiat envelope pinned when the ask was emitted (internal-review). See `JobRecord`. */
+    /** Fiat envelope pinned when the ask was emitted. See `JobRecord`. */
     pendingPaymentFiatMicro?: number;
     pendingPaymentFiatCurrency?: string;
     /**
      * Everything this job has asked for mid-job, summed and never decremented
-     * (internal-review) — the ceiling on its draw growth. See `JobRecord`, including
+     * the ceiling on its draw growth. See `JobRecord`, including
      * why it can't be derived from the outstanding figure above.
      */
     askedTopUpMicro?: number;
     askedTopUpCurrency?: string;
-    /** Why the total above can't express a ceiling, when it can't (internal-review). */
+    /** Why the total above can't express a ceiling, when it can't. */
     topUpCapUnenforcedReason?: TopUpCapUnenforcedReason;
     /**
      * Caller identity for a top-up that has to mint a *fresh* implicit credit
@@ -2382,7 +2124,6 @@ interface VerifyIncomingSnapshot {
     requesterPubkey?: string;
     requesterId?: string;
 }
-/** Result of `verifyIncomingPayment`. */
 interface VerifiedIncomingPayment {
     paidMsats: number;
     paymentMint?: string;
@@ -2391,21 +2132,21 @@ interface VerifiedIncomingPayment {
     nativeAmount?: number;
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
     cashuFlow?: "p2pk_accumulator";
-    /** True when this credit should accumulate onto an existing same-rail native amount (internal-review). */
+    /** True when this credit should accumulate onto an existing same-rail native amount. */
     sameRail: boolean;
     /**
-     * Credit this top-up opened (internal-review). Only set when the job had none — a
+     * Credit this top-up opened. Only set when the job had none — a
      * free-then-paid job — so Tx C can bind it; a job that already holds a credit
      * keeps its binding, because the top-up grew that draw.
      */
     creditId?: string;
     /** The draw opened alongside {@link creditId}. */
     drawId?: string;
-    /** The funding leg, reported to the platform as a deposit (internal-review). */
+    /** The funding leg, reported to the platform as a deposit. */
     funding?: CreditFundingReport;
     /**
      * Fiat micro this payment funded that the job's draw did not take
-     * (internal-review). See `PaymentInfo.unappliedMicro`. When it equals the whole
+     * See `PaymentInfo.unappliedMicro`. When it equals the whole
      * funding, the payment moved no job counters at all and Tx C is handed a
      * `null` delta.
      */
@@ -2413,7 +2154,7 @@ interface VerifiedIncomingPayment {
 }
 /**
  * Verify an incoming payment without mutating the job. Returns the credit
- * shape on success or an error envelope on failure. internal-review.
+ * shape on success or an error envelope on failure.
  *
  * The rails dispatched on below are the list {@link PAYMENT_PROOF_KEYS}
  * carries — add one here and it must be added there in the same commit.
@@ -2428,27 +2169,19 @@ declare function verifyIncomingPayment(body: {
         status: number;
         /**
          * A short mid-job pay that funded a credit before this request failed
-         * (internal-review) — still a deposit, still reported. See `PaymentErrorDetail`.
+         * still a deposit, still reported. See `PaymentErrorDetail`.
          */
         funding?: CreditFundingReport;
     };
 }>;
 /**
  * Apply a verified payment result to the in-memory job. Used by callers that
- * don't run Tx C (e.g., the legacy isolate-job-manager path). internal-review.
+ * don't run Tx C (e.g., the legacy isolate-job-manager path).
  */
 declare function applyPaymentInfoToJob(job: ServerJob, info: VerifiedIncomingPayment): void;
 /**
- * Process an incoming payment message. Returns an error body on failure.
- *
- * **The isolate-runtime path, and deliberately ledger-less** (spec §3). Its
- * only caller is `platform/isolate-job-manager.ts`; isolate DVMs have no
- * Postgres of their own, so they run implicit N=1 with today's semantics
- * preserved and never advertise credit. The credits-carrying mid-job path is
- * {@link verifyIncomingPayment} + `JobManager.processPayment` (Tx C), where
- * internal-review wired `fund` + `growDraw`. Wiring a ledger here would need a
- * platform-side ledger leg with its own funding-atomicity and receipt-key
- * story — the trust-surface expansion internal-review exists to decide.
+ * Legacy ledgerless payment path. Mutates the job on acceptance; durable credit hosts use
+ * verifyIncomingPayment and apply its result in Tx C.
  */
 declare function processIncomingPayment(job: ServerJob, body: {
     type: MessageType;
@@ -2463,22 +2196,22 @@ interface CommittedFunding {
     /** Snapshot fixed immediately after this request's funding leg, before any draw. */
     fundingCredit?: CreditSnapshot;
     /**
-     * Absent for a `/v1/credit` fund-only top-up (internal-review) — money landed on the
+     * Absent for a `/v1/credit` fund-only top-up — money landed on the
      * credit with no job to pay for — for a short mid-job pay, which funds
-     * without drawing or growing (internal-review), and for an explicit short deposit
-     * whose combined balance cannot cover the draw (internal-review). On a mid-job
+     * without drawing or growing, and for an explicit short deposit
+     * whose combined balance cannot cover the draw. On a mid-job
      * top-up this is the **grown** draw, so `amountMicro` is the job's running
      * total, not this leg's contribution.
      */
     draw?: DrawResult;
     /**
      * An explicit short deposit committed, but the combined available balance
-     * could not cover the full-price draw (internal-review). Preserved instead of
+     * could not cover the full-price draw. Preserved instead of
      * thrown so the rail receive and deposit commit atomically with no draw.
      */
     drawRefusal?: CreditLedgerError;
     /**
-     * What this leg added to an already-placed draw (internal-review). Set only on a
+     * What this leg added to an already-placed draw. Set only on a
      * mid-job top-up; the upfront legs contribute the whole draw, so they leave
      * it unset and `draw.railValue` is the same thing.
      */
@@ -2488,7 +2221,7 @@ interface CommittedFunding {
         drawNative: number | null;
     };
     /**
-     * Fiat micro that landed on the credit but grew no draw (internal-review) — a
+     * Fiat micro that landed on the credit but grew no draw — a
      * duplicate payment for an ask already satisfied, the clipped tail of an
      * oversized one, or a payment that arrived after the ask was met. It stays
      * the caller's available balance; `UnappliedCredit` on the 201 is how they
@@ -2503,9 +2236,9 @@ interface CommittedFunding {
  *
  * Exported because the builder-supplied `onCreditFunded` override is a second
  * door onto the same report, and both must say the same thing: hand-rolling the
- * mapping there once dropped the internal-review `tempoChannel` block, so a DVM
+ * mapping there once dropped the `tempoChannel` block, so a DVM
  * reporting through the override registered no channel with the close observer
- * (internal-review). One builder, no drift.
+ * One builder, no drift.
  */
 declare function creditDepositPayload(dvmId: string, funding: CreditFundingReport): CreditDepositPayload;
 /** Finish the local ledger effect retained by a durable exact-settlement intent. */
@@ -2518,7 +2251,6 @@ declare function repairX402ExactSettlementEffect(args: {
     tx?: CreditLedgerQuerier;
 }): Promise<CommittedFunding | undefined>;
 
-/** Everything the issuer needs to sign for one DVM. */
 interface ReceiptIssuerOpts {
     /** 32-byte hex receipt secret — `DVMKIT_RECEIPT_KEY`, or an ephemeral dev key. */
     secret: string;
@@ -2528,14 +2260,8 @@ interface ReceiptIssuerOpts {
     dvmId: string;
 }
 /**
- * Signs job receipts for one DVM (internal-review).
- *
- * Constructed only when a receipt key is wired, so the presence of an issuer
- * *is* the "this DVM emits receipts" signal that `/v1/info` advertises. Pure:
- * it holds the key and the slug and turns a terminal `JobRecord` plus an
- * allocated sequence number into signed bytes — sequence allocation and
- * persistence belong to the store, which is what makes issuance idempotent
- * across machines.
+ * An issuer indicates receipt support. Sequence allocation and write-once
+ * persistence belong to the store; signing alone does not provide idempotency.
  */
 declare class ReceiptIssuer {
     /** x-only pubkey this issuer signs under; the attested `receipt_pubkey`. */
@@ -2545,20 +2271,14 @@ declare class ReceiptIssuer {
     private readonly dvmId;
     constructor(opts: ReceiptIssuerOpts);
     /**
-     * Build and sign the receipt for a terminal job. `seq` comes from
-     * `JobStore.claimReceiptSeq`, `issuedAt` defaults to now (tests pin it).
-     *
-     * Free jobs get receipts too, with `paid.msats: 0` — they still consume a
-     * sequence number and still attest an outcome. Whether feedback is
-     * paid-only is the feedback layer's call, not this one's.
-     *
-     * `credit` is the resolved draw block (internal-review) — present on every job
-     * whose payment funded/drew the ledger, absent otherwise. Signature-
-     * compatible either way: `canonicalize` omits absent keys.
+     * seq is store-allocated; issuedAt is epoch seconds. Free jobs also consume a
+     * sequence and attest their outcome. Timing/attribution comes from the committed
+     * terminal row; legacy rows omit unknown historical fields. credit is present
+     * only for a resolved ledger draw.
      */
     issue(record: JobRecord, seq: number, issuedAt?: number, credit?: ReceiptCredit): JobReceipt;
     /**
-     * Countersign one reclaim event (internal-review). Unlike job receipts there is
+     * Countersign one reclaim event. Unlike job receipts there is
      * no store-allocated sequence — the drain's own `ledger_seq` (taken under
      * the credit row lock, shared with draws) already orders it in the
      * per-credit evidence chain.
@@ -2650,38 +2370,31 @@ declare class X402FacilitatorHealth implements X402FacilitatorHealthLike {
     private refreshOnce;
 }
 
-/** Options for creating a JobManager. */
 interface JobManagerOpts {
-    /** Environment variables for ctx.env. */
     env: Record<string, string>;
-    /** KV store for ctx.store. */
     store: KVStore;
-    /** Cashu mints accepted for payment. */
     mints?: string[];
-    /** Persistent backing store for job records. Default: in-memory. */
+    /** Durable in production; defaults to memory only in development/test mode. */
     jobStore?: JobStore;
-    /** When true, payment messages auto-credit without verification. */
+    /** Skips payment only when no payment rail is configured. Wired rails still verify. */
     devMode?: boolean;
     /** Payment methods this DVM accepts. Default: derived by the server from configured rails. */
     paymentMethods?: PaymentMethod[];
-    /** x402 stablecoin payment configuration. */
     x402?: X402Config;
     /** Durable exact-settlement coordinator shared with upfront verification. */
     x402ExactSettlement?: X402ExactSettlementServer;
     /** Live facilitator capabilities for version-specific mid-job payment handling. */
     x402FacilitatorHealth?: X402FacilitatorHealthLike;
-    /** MPP multi-rail payment handle (built via `createMppFromOpts`). */
     mpp?: MppxServer;
-    /** Cashu receive mode (internal-review). */
     cashuMode?: CashuMode;
-    /** Builder's NUT-11 P2PK lock pubkey (internal-review). Required for accumulator mode. */
+    /** Builder's NUT-11 P2PK lock pubkey. Required for accumulator mode. */
     lockPubkey?: string;
     /** Test-only atomic Cashu backend, supplied by the development host. */
     disposableCashu?: DisposableCashuCommit;
     /** Postgres pool for wallet accumulator persistence. */
     db?: Pool;
     /**
-     * Agent-wallet (internal-review): per-DVM identifier used for the scheduler advisory
+     * Agent-wallet: per-DVM identifier used for the scheduler advisory
      * lock and the `(dvm_id, request_id)` replay key. Defaults to `DVMKIT_DVM_ID`
      * env at boot in `createDVMHost()`.
      */
@@ -2690,18 +2403,18 @@ interface JobManagerOpts {
     authAudience?: SignedRequestAudience;
     /**
      * Shared fx fetcher used to convert USD-string descriptor prices and
-     * fiat-form `requestPayment` calls into sats (internal-review). The SDK server owns
+     * fiat-form `requestPayment` calls into sats. The SDK server owns
      * one per process so concurrent quotes share the 60s cache window.
      */
     fxFetcher: FxFetcher;
     /**
-     * Signs a receipt at every terminal transition (internal-review). Absent when the
+     * Signs a receipt at every terminal transition. Absent when the
      * DVM has no receipt key wired — jobs then terminate exactly as before and
      * `/v1/info` doesn't advertise `receipts`.
      */
     receiptIssuer?: ReceiptIssuer;
     /**
-     * Credit ledger for the terminal funnel (internal-review): a job carrying a
+     * Credit ledger for the terminal funnel: a job carrying a
      * `creditId`/`drawId` settles its draw on success and releases it on
      * failure/cancel — this is how "no debit on job failure" is mechanically
      * real. The resolution runs before receipt issuance so the receipt's
@@ -2709,31 +2422,31 @@ interface JobManagerOpts {
      */
     creditLedger?: CreditLedgerLike;
     /**
-     * Durable processed-payment markers (internal-review), threaded through to the
-     * mid-job top-up path (internal-review) so an x402/mpp payment's marker, `fund`, and
+     * Durable processed-payment markers, threaded through to the
+     * mid-job top-up path so an x402/mpp payment's marker, `fund`, and
      * `growDraw` commit together.
      */
     processedPayments?: ProcessedPaymentStore;
     /**
      * Reporter-owned transactional deposit enqueue threaded into mid-job rail
-     * commits (internal-review).
+     * commits.
      */
     enqueueCreditDeposit?: CreditDepositEnqueue;
-    /** Reporter outbox inserted atomically with a terminal draw release (internal-review). */
+    /** Reporter outbox inserted atomically with a terminal draw release. */
     enqueueCreditDrawRelease?: CreditDrawReleaseEnqueue;
     /** Credit lifetime a top-up mints with, from the DVM's advertised `credit.ttl`. */
     creditTtlMs?: number;
     /**
-     * The DVM's declared pricing currency (internal-review), which is the currency of
+     * The DVM's declared pricing currency, which is the currency of
      * every credit it opens. Threaded into the job context so a mid-job ask on a
      * job that holds no credit yet is still pinned in the denomination its first
-     * payment will open the credit in (internal-review). `DVMServer` passes its resolved
+     * payment will open the credit in. `DVMServer` passes its resolved
      * `pricingCurrency`; a host building a `JobManager` directly falls back to the
      * descriptor, and then to `"usd"`.
      */
     pricingCurrency?: string;
     /**
-     * Callback fired when a mid-job top-up moves money onto a credit (internal-review).
+     * Callback fired when a mid-job top-up moves money onto a credit.
      * The platform books it as a **deposit** — a liability until drawn, never
      * summed into revenue — so a top-up that skipped this would leave the
      * outstanding-liability view short. Mirrors `DVMServer.reportCreditDeposit`,
@@ -2741,7 +2454,7 @@ interface JobManagerOpts {
      */
     onCreditFunded?: (info: CreditDepositPayload) => void | Promise<void>;
     /**
-     * Callback fired when a paid job completes (internal-review). Container-runtime DVMs
+     * Callback fired when a paid job completes. Container-runtime DVMs
      * use this to report revenue to the platform via `RevenueReporter`. Mirrors
      * the isolate path's `IsolateJobManager.opts.onJobCompleted`.
      */
@@ -2773,16 +2486,18 @@ interface JobManagerOpts {
     }) => void | Promise<void>;
     /**
      * Callback fired when a terminal job declared a builder cost but emitted no
-     * revenue report (internal-review). Container-runtime DVMs use the reporter's
+     * revenue report. Container-runtime DVMs use the reporter's
      * durable `job-cost` outbox path. The receiver de-duplicates by DVM + job,
      * independently of the rail-keyed revenue ledger.
      */
     onJobCost?: (info: JobCostReportPayload) => void | Promise<void>;
+    /** SDK-owned hosted terminal outbox callback. */
+    onJobTerminal?: (info: JobTerminalReportPayload) => Promise<void>;
     /**
      * Callback fired when the stale-job reaper force-fails a *paid* job — its
      * pending credit draw is released rather than settled, because only a
-     * completed job settles a draw (internal-review). Container-runtime DVMs wire this
-     * to a paid-job-death report → operator `notice` (internal-review). Never fires for
+     * completed job settles a draw. Container-runtime DVMs wire this
+     * to a paid-job-death report → operator `notice`. Never fires for
      * free jobs (`paidMsats === 0`). Fired fire-and-forget so a throw or a slow
      * report can't wedge the sweep.
      */
@@ -2799,23 +2514,17 @@ interface JobManagerOpts {
     }) => void | Promise<void>;
     /**
      * Callback fired when a settled credit draw cannot book a revenue event
-     * because no usable payment rail is available (internal-review). Container-runtime
+     * because no usable payment rail is available. Container-runtime
      * DVMs auto-wire this to the platform's deduped operator notice. Fired
      * fire-and-forget so alert delivery cannot block terminal handling or draw
      * reconciliation.
      */
     onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
     /**
-     * Stale-job sweep threshold in ms (internal-review). Jobs in a non-terminal status
-     * (`processing` / `working` / `awaiting-input`) whose `lastActivityAt` is
-     * older than this are force-cancelled with reason `stale_no_terminal_status`,
-     * so callers always reach a terminal status instead of polling forever after
-     * a worker crash, OOM, or silent `messageAppender` failure. Default:
-     * `2 × descriptor.idleTimeout + STALE_JOB_WATCHDOG_HEADROOM_MS`, matching
-     * the internal-review acceptance criterion against scrape's `JOB_TIMEOUT_MS`.
-     * Builders whose per-handler wall-clock bound exceeds 90s must override
-     * this — otherwise the watchdog fires on a legitimate in-flight handler.
-     * Set to `0` to disable (test seam).
+     * Awaiting-input age in milliseconds before cancellation. Defaults to
+     * twice descriptor.idleTimeout (seconds), converted to milliseconds, plus
+     * STALE_JOB_WATCHDOG_HEADROOM_MS. Set to 0 to disable this arm; processing
+     * jobs use processingWatchdogMs.
      */
     staleJobTimeoutMs?: number;
     /**
@@ -2824,7 +2533,7 @@ interface JobManagerOpts {
      */
     staleJobSweepIntervalMs?: number;
     /**
-     * Worker-liveness watchdog in ms (internal-review). Jobs in `processing`/`working`
+     * Worker-liveness watchdog in ms. Jobs in `processing`/`working`
      * whose `lastActivityAt` is older than this are marked `failed` (dead
      * worker), separately from the longer `awaiting-input` idle timeout above.
      * Default: `descriptor.processingWatchdog * 1000` or
@@ -2834,15 +2543,15 @@ interface JobManagerOpts {
     /**
      * Interval at which locally-active `processing`/`working` jobs have their
      * `lastActivityAt` bumped so the processing watchdog only fires on a truly
-     * dead worker (internal-review). Default: `DEFAULT_HEARTBEAT_INTERVAL_MS`. Set to
-     * `0` to disable (test seam). Also floors how far the internal-review clock guard
+     * dead worker. Default: `DEFAULT_HEARTBEAT_INTERVAL_MS`. Set to
+     * `0` to disable (test seam). Also floors how far the clock guard
      * may compensate a backwards step on the processing arm — a cadence close to
      * `processingWatchdogMs` leaves it no room and it compensates nothing.
      */
     heartbeatIntervalMs?: number;
     /**
      * Age in ms at which a `pending` credit draw whose `job_id` matches no row in
-     * the job store is released as orphaned (internal-review). The draw commits before
+     * the job store is released as orphaned. The draw commits before
      * the job row is persisted, so a crash or a fail-closed refusal in that
      * window strands a hold no terminal path can ever reach. Must stay
      * comfortably above the submit path's draw→persist latency. Set to `0` to
@@ -2853,7 +2562,7 @@ interface JobManagerOpts {
     orphanDrawAgeMs?: number;
     /**
      * Age in ms at which a `pending` credit draw whose job row **is** terminal is
-     * reconciled against that row's outcome (internal-review) — settled for a
+     * reconciled against that row's outcome — settled for a
      * `completed` job, released for a `failed`/`cancelled` one. Covers the hole
      * `orphanDrawAgeMs` cannot: `resolveCreditDraw` throwing on a ledger error
      * leaves a terminal job whose hold no later path retries.
@@ -2861,7 +2570,7 @@ interface JobManagerOpts {
      * Rides the same scan as the orphan arm, which has two consequences for the
      * value you set here. Setting `orphanDrawAgeMs` to `0` disables this arm too.
      * And the effective gate is `max(orphanDrawAgeMs, terminalDrawReconcileAgeMs)`
-     * — the scan never returns a row younger than its own cutoff, so anything
+     * the scan never returns a row younger than its own cutoff, so anything
      * below `orphanDrawAgeMs` is silently clamped up to it. That floor is
      * deliberate rather than a wart: honouring a narrower value would mean
      * widening the scan, which hands the orphan arm rows younger than
@@ -2900,7 +2609,7 @@ interface JobManagerOpts {
     /**
      * Grace window in ms a reactivating machine waits for a live original handler
      * to win the single-execution claim before replaying an `awaiting-input` job
-     * itself (internal-review). Default: `DEFAULT_REACTIVATION_CLAIM_GRACE_MS`. Widen if
+     * itself. Default: `DEFAULT_REACTIVATION_CLAIM_GRACE_MS`. Widen if
      * cross-machine NOTIFY latency causes spurious double executions; lower in
      * tests for speed.
      */
@@ -2908,7 +2617,7 @@ interface JobManagerOpts {
 }
 type ResolvedInput<I extends ZodLike | undefined> = I extends ZodLike<infer O> ? O : string;
 /**
- * A deposit this payment funded that the job row did **not** take (internal-review).
+ * A deposit this payment funded that the job row did **not** take.
  *
  * Reached when two mid-job top-ups race on a free-then-paid job: each opens its
  * own implicit credit, and `verifyAndCredit`'s set-if-null bind keeps one. The
@@ -2958,12 +2667,13 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private readonly cleanupTimers;
     /** Cost revisions held only by a terminal handler owner until its durable merge succeeds. */
     private readonly terminalCostHandoffRetryTimers;
-    /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
+    /** Per-job NOTIFY unsubscribe handles for the durable-status watch. */
     private readonly statusWatchers;
-    /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
+    /** Job ids whose durable-status re-read is in flight — coalesces notify storms. */
     private readonly statusChecksInFlight;
-    /** Job ids that were notified mid-re-read and must be re-checked (internal-review). */
+    /** Job ids that were notified mid-re-read and must be re-checked. */
     private readonly statusChecksQueued;
+    private readonly inputResumeTails;
     private readonly sessionId;
     private nextJobId;
     private accumulatorMonitor?;
@@ -2971,7 +2681,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private readonly processingWatchdogMs;
     private readonly reactivationClaimGraceMs;
     /**
-     * Worker-heartbeat cadence (internal-review). Also floors the internal-review clock
+     * Worker-heartbeat cadence. Also floors the clock
      * guard's compensation on the processing arm — see
      * {@link staleSweepCompensationCapMs}.
      */
@@ -2991,7 +2701,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private jobRetentionResumeFrom?;
     /**
      * A `Date.now()` reading that cannot regress within this manager's lifetime
-     * (internal-review). Anchored at construction, so a manager already running when
+     * Anchored at construction, so a manager already running when
      * the clock stepped is covered. The stale-job sweep's two cutoffs, the
      * orphan-draw age gate and the reactivation claim grace all read it; see
      * {@link createMonotonicClock} for what it costs and where it is clamped.
@@ -3004,29 +2714,25 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private jobRetentionSweepInFlight;
     private heartbeatInFlight;
     /**
-     * The denomination of every credit this DVM opens (internal-review). Resolved once,
+     * The denomination of every credit this DVM opens. Resolved once,
      * with the same boundary fallback `DVMServer` applies for direct JavaScript
      * callers that force an incomplete value past the descriptor contract.
      */
     private readonly pricingCurrency;
     constructor(descriptor: DVMDescriptor<State, InputSchema>, opts: JobManagerOpts);
-    /** Active in-memory jobs. */
     get activeJobs(): Map<string, ServerJob>;
-    /** The backing job store. */
     get store(): JobStore;
     /**
-     * True when this DVM will actually issue receipts (internal-review) — a key *and*
+     * True when this DVM will actually issue receipts — a key *and*
      * a store that can allocate sequence numbers and persist bytes write-once.
      * `/v1/info#receipts` reads this rather than the key alone, so the flag can
      * never promise something `issueReceipt` silently declines to do.
      */
     get receiptsEnabled(): boolean;
-    /** True when the named capability exists on this descriptor. */
     hasCapability(name: string): boolean;
-    /** Names of every capability this descriptor exposes — used for error envelopes. */
     capabilityNames(): string[];
     /**
-     * Resolve a capability's static `price` to msats (internal-review).
+     * Resolve a capability's static `price` to msats.
      *
      * `"$X.XX"` is parsed as USD and converted via the SDK's shared fx fetcher.
      * Returns `undefined` for dynamic-priced capabilities (those that declare
@@ -3035,7 +2741,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     currentPriceMsats(capability: string): Promise<number | undefined>;
     /**
      * Translate a capability's static `price` into the fiat envelope used by
-     * the per-capability `pricing.max` advertised on `/v1/info` (internal-review).
+     * the per-capability `pricing.max` advertised on `/v1/info`.
      * Returns `undefined` for dynamic-priced capabilities and for unknown
      * names (the route handler validates the name before invoking this).
      */
@@ -3044,24 +2750,24 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         currency: string;
     } | undefined;
     /**
-     * Parse a request body through a capability's input schema (internal-review).
+     * Parse a request body through a capability's input schema.
      *
      * Resolution order when a capability declares an `input` schema:
      * 1. `body.data` is preferred — agents pass structured fields directly
-     *    (CLI builds this from `--param k=v`).
+     * (CLI builds this from `--param k=v`).
      * 2. Fallback: `JSON.parse(body.input)` for clients still on the legacy
-     *    JSON-string contract.
+     * JSON-string contract.
      * 3. Neither usable → throw `MissingStructuredInputError` so the route can
-     *    return `invalid_input` with a hint pointing at `/v1/info`.
+     * return `invalid_input` with a hint pointing at `/v1/info`.
      *
      * When the capability has no `input` schema, returns `body.input` raw
      * (primitive path).
      *
-     * The internal-review credit envelope is removed before the schema runs, on both
-     * branches (internal-review) — it rides the signed body but is protocol-level, so a
+     * The credit envelope is removed before the schema runs, on both
+     * branches — it rides the signed body but is protocol-level, so a
      * top-level `.strict()` capability schema would otherwise reject every
      * explicit draw as an unknown key, before the envelope was even extracted.
-     * The persisted `record.input` the internal-review reactivation path re-reads is the
+     * The persisted `record.input` the reactivation path re-reads is the
      * pre-Zod wire form, so it comes through the second branch carrying them too.
      */
     parseInput(body: {
@@ -3069,7 +2775,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         data?: unknown;
     }, capability: string): unknown;
     /**
-     * Look up the per-capability descriptor by name (internal-review). Throws when the
+     * Look up the per-capability descriptor by name. Throws when the
      * name doesn't exist — the route layer validates body.capability first, so
      * reaching this with an unknown name is a programmer error.
      */
@@ -3083,7 +2789,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private getCapability;
     /**
-     * Allocate the id the next job will be created under (internal-review). The
+     * Allocate the id the next job will be created under. The
      * submit path calls this BEFORE payment verification so the ledger draw
      * commits with its job linkage, then passes the id back through
      * `createJob`'s provenance. Ids allocated for requests whose payment is
@@ -3092,7 +2798,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     allocateJobId(): string;
     /**
-     * Create a new job from a request body. `provenance` (internal-review) is what the
+     * Create a new job from a request body. `provenance` is what the
      * idempotent-replay path on `POST /v1/job` reads back: the raw `job_token`
      * to re-issue, and the fingerprint + caller pubkey a retry must reproduce
      * to be given it.
@@ -3107,32 +2813,32 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         requestId?: string;
         authRequestPath?: string;
         /**
-         * Pre-allocated id from {@link allocateJobId} (internal-review) — the submit
+         * Pre-allocated id from {@link allocateJobId} — the submit
          * path allocates before payment verification so the ledger draw can
          * record the job it pays for.
          */
         jobId?: string;
     }): ServerJob;
-    /** Build an SDKJobContext and attach it to the job. */
     buildAndAttachContext(job: ServerJob, parsedInput: unknown): SDKJobContext<State, ResolvedInput<InputSchema>>;
-    /** Start the handler for a job. */
     runHandler(job: ServerJob, sdkCtx: SDKJobContext<unknown, unknown>): void;
-    /** Dispatch a validated incoming message to the appropriate handler or pending resolver. */
     dispatchMessage(job: ServerJob, type: MessageType, content: unknown): Promise<void>;
+    private queueInputResume;
+    private claimLocalInput;
+    private dispatchMessageNow;
     /**
      * Persist a job to the backing store.
      *
-     * Awaits the per-job appender tail (internal-review) so that:
-     *   1. The snapshot's `messages` is consistent with the `job_messages` table
-     *      — no row is still in flight at snapshot time.
-     *   2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
-     *      can't race a still-pending `appendOutgoing` for the final yield
-     *      message (which would otherwise wipe the row before an in-flight SSE
-     *      subscriber's NOTIFY-driven fetch can see it).
+     * Awaits the per-job appender tail so that:
+     * 1. The snapshot's `messages` is consistent with the `job_messages` table
+     * no row is still in flight at snapshot time.
+     * 2. For terminal saves, the `DELETE FROM job_messages` inside `save()`
+     * can't race a still-pending `appendOutgoing` for the final yield
+     * message (which would otherwise wipe the row before an in-flight SSE
+     * subscriber's NOTIFY-driven fetch can see it).
      */
     persistJob(job: ServerJob): Promise<void>;
     /**
-     * Cross-machine terminal guard (internal-review). `buildContext`'s guard reads the
+     * Cross-machine terminal guard. `buildContext`'s guard reads the
      * in-memory `job.status`, so on its own it only protects the machine running
      * the handler. On a multi-machine DVM a `DELETE /v1/job/:id` routinely lands
      * on a machine that isn't running the job — `app.ts` cancels it in the store
@@ -3144,7 +2850,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * fires `job.abort` so in-flight `ctx.fetch` calls tear down. Returns true when
      * the durable state won and the caller must skip its save.
      *
-     * Two triggers: `watchDurableStatus`'s NOTIFY subscription (internal-review) fires
+     * Two triggers: `watchDurableStatus`'s NOTIFY subscription fires
      * this within a round-trip of the remote cancel committing, which is what
      * actually stops the provider spend; `persistJob` calls it again on every save
      * as the backstop for the window where a cancel commits between a handler's
@@ -3163,7 +2869,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /** Durably merge a terminal handler owner's latest cost before reporting it. */
     private persistAdoptedTerminalCost;
     /**
-     * Watch the durable status of a locally-active job (internal-review).
+     * Watch the durable status of a locally-active job.
      *
      * `ctx.signal` is raised by `dispatchMessage`, which only runs on the machine
      * holding the job in `activeJobs`. On a multi-machine DVM the `DELETE` usually
@@ -3181,30 +2887,30 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private watchDurableStatus;
     /**
-     * Tear down a job's durable-status subscription (internal-review). Must be called
+     * Tear down a job's durable-status subscription. Must be called
      * wherever a job leaves `activeJobs` — a leaked subscriber outlives the job on
      * the store's shared LISTEN connection. Idempotent.
      */
     unwatchDurableStatus(jobId: string): void;
     /**
-     * NOTIFY-driven durable-status re-read, coalesced per job (internal-review).
+     * NOTIFY-driven durable-status re-read, coalesced per job.
      *
      * A notify that arrives while a re-read is in flight is queued rather than
      * dropped: the in-flight read may have observed the row a moment *before* the
-     * cancel committed, and dropping its notify would put the abort back where
-     * this issue found it — waiting for the handler's next store write.
+     * cancel committed, and dropping its notify would leave the local handler
+     * running until its next store write instead of aborting promptly.
      */
     private checkDurableTerminal;
     /**
      * Wire the Tx A appender when the store supports streaming.
      *
-     * Tx A (internal-review): outgoing message + `pending_payment_msats` bump land in
+     * Tx A: outgoing message + `pending_payment_msats` bump land in
      * the same transaction. The DB allocates the row's seq via
      * `UPDATE jobs SET next_seq = next_seq + 1 RETURNING` so concurrent inbound
      * traffic on different machines can never collide on the `(job_id, seq)` PK.
      * In-memory `job.seq` keeps its own counter for same-machine SSE listeners.
      *
-     * Per-job serialisation (internal-review): chained through `job.messageAppenderTail`
+     * Per-job serialisation: chained through `job.messageAppenderTail`
      * so two synchronous `providerMessage` calls (e.g. `artifact` followed by
      * `complete`) commit their `appendOutgoing` transactions in call order.
      * Without this, the two transactions race for the `jobs` row lock and the
@@ -3215,19 +2921,17 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * `artifact`'s NOTIFY silently drops the artifact.
      */
     private wireMessageAppender;
-    /** Start (or restart) the idle timer for a job. */
     startIdleTimer(job: ServerJob): void;
-    /** Clear the idle timer for a job. */
     clearIdleTimer(id: string): void;
-    /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard (internal-review). */
+    /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard. */
     cancelJobIdle(job: ServerJob): Promise<void>;
     /**
      * Force-terminate stale non-terminal jobs. Two status-aware arms:
-     *   • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
-     *     (`stale_no_terminal_status`) — the caller never paid / responded.
-     *   • `processing`/`working` past `processingWatchdogMs` → `failed`
-     *     (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
-     *     live workers fresh, so a stale row here means a dead process.
+     * • `awaiting-input` past `staleJobTimeoutMs` → `cancelled`
+     * (`stale_no_terminal_status`) — the caller never paid / responded.
+     * • `processing`/`working` past `processingWatchdogMs` → `failed`
+     * (`worker_died_mid_job`) — the worker died mid-job. The heartbeat keeps
+     * live workers fresh, so a stale row here means a dead process.
      *
      * Fires on a timer (wired in the constructor) and also callable on demand
      * (tests, ops). The CAS in `cancelStaleJob` makes this safe to run
@@ -3236,17 +2940,17 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * descriptors — the local activeJobs teardown only makes sense on the
      * JobManager that actually hosted the zombie handler.
      *
-     * **Both cutoffs float off the wall clock (internal-review).** Each is one
+     * **Both cutoffs float off the wall clock.** Each is one
      * `Date.now()` sample compared against `last_activity_at`, stamped from a
      * different sample at a different moment, so a backwards step between the
      * two makes every row look more recently active than it is: the query
      * matches nothing and both arms go silent for the length of the skew. The
      * dead worker's job keeps its `processing` status, its credit hold stays
-     * `pending`, and the internal-review paid-job-death alert — wired to this reaper —
-     * never fires. Same defect, same host class, as internal-review's orphan sweep.
+     * `pending`, and the paid-job-death alert — wired to this reaper —
+     * never fires. Same defect, same host class, as orphan sweep.
      *
      * **The compensation is capped** — see {@link staleSweepCompensationCapMs}
-     * for where each arm's cap comes from — which internal-review did not need to do. Its eagerness costs at worst an early release
+     * for where each arm's cap comes from — which did not need to do. Its eagerness costs at worst an early release
      * of an unclaimed hold, refused outright for any live job row; ours
      * force-*fails* a running job. `cancelStaleJob`'s CAS does not cover that:
      * `expectedActivityBefore` is the same compensated threshold the query used,
@@ -3278,7 +2982,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     }>;
     /**
      * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
-     * clock to cover a backwards step (internal-review). The compensation is capped,
+     * clock to cover a backwards step. The compensation is capped,
      * not free: a claimed row must still have been silent for
      * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
      * force-fails a job that may well be alive.
@@ -3298,7 +3002,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * clock stepped. That pair is marginal already; the guard must not make it
      * deterministic. The cap collapses to zero there, which is today's
      * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
-     * — nothing heartbeats it by design, and its refresh is an inbound caller
+     * nothing heartbeats it by design, and its refresh is an inbound caller
      * message on no cadence at all.
      *
      * **Why a magnitude and not a predicate.** The tempting sharper rule is to
@@ -3335,7 +3039,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * Resolve `pending` credit draws the terminal funnel can no longer reach.
      * Two arms over one scan, distinguished by whether the draw's job row exists.
      *
-     * **No job row (internal-review) — release.** internal-review allocates the job id and
+     * **No job row — release.** allocates the job id and
      * commits the ledger draw, with its `job_id` linkage, before `recordReplay`
      * and `persistJob` write the job row. A crash, a `draw_conflict` 409, or a
      * fail-closed `replay_detected` 401 in that window leaves a committed hold
@@ -3345,12 +3049,12 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * available balance stays reduced forever. Cosmetic for an implicit N=1
      * credit, a silent balance shrink for an explicit N>1 one.
      *
-     * **Terminal job row (internal-review) — reconcile to its outcome.** The funnel
+     * **Terminal job row — reconcile to its outcome.** The funnel
      * demonstrably fails: `resolveCreditDraw` throws on a ledger/DB error,
      * `issueReceipt` catches it, logs `credit_resolve_failed` and returns
      * nothing, and until now nothing retried. Same stranded hold, reached through
      * a different door — and for a `completed` job it strands the platform's
-     * books too, since draws *are* the revenue events (internal-review): the caller is
+     * books too, since draws *are* the revenue events: the caller is
      * charged nothing, the balance never moves, and outstanding liability
      * (`deposits − draw revenue`) overstates forever. So a late settle books, off
      * the committed draw row, through the ordinary reporter path.
@@ -3377,8 +3081,8 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         reconciled: number;
     }>;
     /**
-     * The end-of-scan line for a tick that resolved nothing (internal-review, extended
-     * by internal-review). Two shapes are worth a warning, and neither is the ordinary
+     * The end-of-scan line for a tick that resolved nothing. Two shapes are
+     * worth a warning, and neither is the ordinary
      * one — the timer runs every 5 minutes per ledger in production.
      *
      * `examined > 0`: aged candidates were looked at and none moved. Usually
@@ -3387,7 +3091,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      *
      * `examined === 0`: the query returned nothing. Ordinarily that means there
      * is nothing to do — but it is equally what a blinded scan looks like, which
-     * is the case the internal-review gate could not reach. Probe for the oldest
+     * is the case the gate could not reach. Probe for the oldest
      * `pending` hold at any age and speak up when one exists the scan should
      * have seen and didn't: already past the age gate outright, stamped ahead of
      * our clock (some other process's clock is fast), or hidden while our own
@@ -3400,7 +3104,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private reportSweepOutcome;
     /**
-     * Resolve one aged `pending` draw whose job row reached terminal (internal-review),
+     * Resolve one aged `pending` draw whose job row reached terminal,
      * mirroring what `resolveCreditDraw` would have done in line. Returns true
      * when this call is the one that moved the draw — the caller counts it, and
      * only it books.
@@ -3434,7 +3138,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /**
      * Refresh `lastActivityAt` for jobs this process is actively running
      * (`processing`/`working`) so the processing watchdog only fires once the
-     * worker is genuinely dead (internal-review). `awaiting-input` jobs are
+     * worker is genuinely dead. `awaiting-input` jobs are
      * deliberately excluded — their idle timeout must still elapse. Fires on the
      * heartbeat timer; also callable on demand for tests.
      */
@@ -3442,15 +3146,15 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         beat: number;
     }>;
     /**
-     * Single-execution claim for a reactivating machine (internal-review). Before
+     * Single-execution claim for a reactivating machine. Before
      * replaying an `awaiting-input` job, wait a bounded grace window for a live
      * original handler to win the `awaiting-input → processing` CAS via its
      * NOTIFY wake. Resolves:
-     *   • `false` — the row left `awaiting-input` during the window (the original
-     *     handler claimed it / drove it terminal). Stand down; do not replay.
-     *   • `true`  — the window elapsed still `awaiting-input` (the original worker
-     *     is gone or has no live resolver) AND this machine won the claim CAS.
-     *     Replay for dead-worker recovery.
+     * • `false` — the row left `awaiting-input` during the window (the original
+     * handler claimed it / drove it terminal). Stand down; do not replay.
+     * • `true` — the window elapsed still `awaiting-input` (the original worker
+     * is gone or has no live resolver) AND this machine won the claim CAS.
+     * Replay for dead-worker recovery.
      *
      * Biasing the original handler to win kills the double execution (double
      * substrate spend, clobbered artifact) without heartbeating `awaiting-input`
@@ -3459,7 +3163,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     claimAwaitingInputForReactivation(jobId: string): Promise<boolean>;
     /**
-     * Record an inbound client message durably via Tx B (internal-review) and append
+     * Record an inbound client message durably via Tx B and append
      * it to the in-memory `job.messages` array. Returns the DB-allocated seq
      * (`null` when the store isn't streamable — non-Postgres test fallback).
      *
@@ -3478,13 +3182,13 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * in-memory `ServerJob`, wires the appender, builds the context, starts
      * the idle timer. The caller has already recorded the inbound via Tx B
      * and run Tx C (verify + credit); reactivation is now decoupled from
-     * credit (internal-review, internal-review). The caller decides whether to run the
+     * credit. The caller decides whether to run the
      * handler (Pattern A: status was `awaiting-input`) or to dispatch the
      * message to a custom handler (Pattern B).
      *
      * For DVMs that declare descriptor-level auth, the persisted
      * `record.input` carries the original signed envelope. We re-verify the
-     * signature here (internal-review) so a DB-layer tamper — compromised admin, SQL
+     * signature here so a DB-layer tamper — compromised admin, SQL
      * injection, malicious operator with DB access — can't silently feed an
      * attacker-supplied pubkey/envelope into the handler. The drift window
      * and replay store are deliberately skipped: the persisted timestamp is
@@ -3498,7 +3202,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * What gets re-verified is the persisted row read back through
      * {@link signedRequestInput} — `app.ts` stores the pre-Zod wire form, so
      * those are the caller's own signed bytes, the same ones `/v1/quote` and the
-     * submit checked (internal-review). That makes the tamper check strictly stronger
+     * submit checked. That makes the tamper check strictly stronger
      * than the parsed form it replaced: an injected key the capability schema
      * doesn't declare used to be stripped before the signature was checked, so
      * it re-verified clean.
@@ -3508,7 +3212,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         sdkCtx: SDKJobContext<unknown, unknown>;
     };
     /**
-     * Verify an inbound payment and apply the credit via Tx C (internal-review).
+     * Verify an inbound payment and apply the credit via Tx C.
      * The inbound message must have been recorded via Tx B already
      * (`recordInboundPending` returned `inboundSeq`). For non-streamable
      * stores (`inboundSeq === null`), falls back to in-memory mutation via
@@ -3518,12 +3222,12 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * `pendingPaymentMsats` without external verification. Gated on
      * `devModeSkipsPaymentVerification` — the same predicate the upfront path
      * reads, so a dev server wired to a mint verifies mid-job payments for real
-     * (internal-review) — plus the explicit `dev_auto` opt-out the dev console uses,
+     * plus the explicit `dev_auto` opt-out the dev console uses,
      * which is the one caller that has no wallet to pay from. `dev_auto` loses to
      * any proof riding the same message: money on the wire always takes the rail,
      * so the flag can never leave a real token unspent against a credited job.
      *
-     * Tx C is not atomic with the rail commit (internal-review). `verifyIncomingPayment`
+     * Tx C is not atomic with the rail commit. `verifyIncomingPayment`
      * commits the proofs *and* the ledger leg in one transaction and returns;
      * only then does `verifyAndCredit` write the job row, on its own connection.
      * Everything after that call therefore runs with the caller's money already
@@ -3539,7 +3243,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
         mintHealthTracker?: MintHealthTracker;
     }): Promise<ProcessPaymentOutcome>;
     /**
-     * Tx C with a bounded retry (internal-review).
+     * Tx C with a bounded retry.
      *
      * By the time this runs on the verified path, the rail commit and the ledger
      * leg have already committed in a transaction this call is not part of — so a
@@ -3573,7 +3277,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private creditInbound;
     /**
      * Answer a payment whose rail and ledger legs committed but whose job row
-     * could not be written (internal-review) — every retry spent, the money real.
+     * could not be written — every retry spent, the money real.
      *
      * The refusal names the credit the money landed on so the caller can act on
      * it directly, mirroring the short mid-job pay's 402 (`payment.ts`). It is a
@@ -3582,7 +3286,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * fault an operator should see in their 5xx rate. `retryable` is true because
      * the ask is genuinely still outstanding.
      *
-     * Nothing is released here. The hold is left to the internal-review reconciler,
+     * Nothing is released here. The hold is left to the reconciler,
      * which makes the same decision — unbound draw ⇒ release, never settle — but
      * under the credit row's `FOR UPDATE`, after the job is terminal, where it
      * cannot race an in-flight COMMIT. Releasing from here would also be
@@ -3605,23 +3309,23 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private reportUnappliedPayment;
     /**
      * Describe a deposit the job row never took, in the shape both the 201 and
-     * the `payment_unapplied` 500 carry (internal-review). `undefined` when the payment
+     * the `payment_unapplied` 500 carry. `undefined` when the payment
      * ran ledger-less (no credit ledger wired, or the top-up preflight skipped) —
      * there is no credit to name, so the 201 carries no `credit` block and the
      * 500 takes its words from `unappliedCopy` directly.
      */
     private unappliedCredit;
-    /** Book a mid-job top-up's funding as a deposit (internal-review, spec §10). */
+    /** Book a mid-job top-up's funding as a deposit (the deposit-accounting rule). */
     private reportCreditDeposit;
     /**
      * Internal: build the BuildContextOpts shared between `createJob` and
      * `reactivateJob`. Centralised so persistence/terminal callbacks and the
-     * internal-review NOTIFY-driven cross-machine wake stay in one place.
+     * NOTIFY-driven cross-machine wake stay in one place.
      */
     private buildContextOpts;
     /**
      * Internal: what unit `ctx.requestPayment`'s auto-credit gate may measure this
-     * job's remaining pool in (internal-review).
+     * job's remaining pool in.
      *
      * The regime is read off the DRAW, never off the job. Implicit N=1 is exactly
      * `credit_id === imp:<rail>:<draw_id>`, because `fundAndDraw` derives both
@@ -3639,15 +3343,14 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * drew and whose pool this can't read or denominate answers `unpriced`, which
      * the gate declines to auto-credit from: the msat figure it would otherwise
      * fall back on is a slice of the credit's rail value at a ratio pinned
-     * whenever that credit was funded, which is the exact figure this issue exists
-     * to stop spending against.
+     * whenever that credit was funded, so it cannot safely fund a new ask.
      */
     private resolveDrawPool;
     /** Internal: structured warn for the one path that can't price a drawn job's pool. */
     private warnDrawPool;
     /**
      * Issue the signed receipt for a job that has reached a terminal status
-     * (internal-review). Idempotent and safe to call from every terminal path — the
+     * Idempotent and safe to call from every terminal path — the
      * store owns both the sequence allocation and the write-once persist, so
      * two machines racing on the same job converge on identical bytes and burn
      * exactly one sequence number.
@@ -3663,10 +3366,10 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /** Build the common settle/release args, adding the hosted release outbox when wired. */
     private drawResolutionArgs;
     /**
-     * Settle or release a terminal job's credit draw (internal-review): `completed`
+     * Settle or release a terminal job's credit draw: `completed`
      * settles (the hold becomes a real debit); `failed`/`cancelled` releases
      * (the hold evaporates — "no debit on job failure", mechanically
-     * superseding the internal-review/974 no-op refund for credit-paid jobs, including
+     * superseding the 974 no-op refund for credit-paid jobs, including
      * the `ctx.fail` path and the stale-sweeper reap). Idempotent — a replayed
      * resolution returns the recorded state. Returns the `ReceiptCredit` block
      * for the receipt: `balance_after` is the recorded draw trajectory for a
@@ -3674,7 +3377,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private resolveCreditDraw;
     /**
-     * The one place a terminal job's status becomes a ledger verb (internal-review):
+     * The one place a terminal job's status becomes a ledger verb:
      * `completed` settles the hold into a real debit, `failed`/`cancelled`
      * release it. Read by the in-line funnel (`resolveCreditDraw`) and by the
      * late reconciler (`reconcileTerminalDraw`) — two paths that must never
@@ -3688,32 +3391,26 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      */
     private attachReceipt;
     /**
-     * Read-path repair for a terminal job carrying no receipt (internal-review), for
+     * Read-path repair for a terminal job carrying no receipt, for
      * either an in-memory job or a store record. Free in the steady state — it
      * returns on the `receipt` check without touching the store — so it costs
      * only on the cases it exists for:
      *
      * - **A crash between the two store calls.** `claimReceiptSeq` commits the
-     *   sequence number to the job row before `saveReceipt` writes the bytes; a
-     *   process death in that window would otherwise strand that number
-     *   forever, and a permanent gap is indistinguishable from the deliberate
-     *   suppression `seq` exists to expose. Re-issuing here reuses the already
-     *   committed number (the claim is idempotent per job) rather than
-     *   allocating a second one.
+     * sequence number to the job row before `saveReceipt` writes the bytes; a
+     * process death in that window would otherwise strand that number
+     * forever, and a permanent gap is indistinguishable from the deliberate
+     * suppression `seq` exists to expose. Re-issuing here reuses the already
+     * committed number (the claim is idempotent per job) rather than
+     * allocating a second one.
      * - **A transient store failure** at the terminal: `issueReceipt` logs
-     *   `receipt_issue_failed` and returns nothing rather than failing the job,
-     *   so the next read retries.
+     * `receipt_issue_failed` and returns nothing rather than failing the job,
+     * so the next read retries.
      * - **Jobs that terminated before the DVM had a receipt key.** They pick one
-     *   up on first read, with `issued_at` reflecting when it was signed.
+     * up on first read, with `issued_at` reflecting when it was signed.
      */
     ensureReceipt(target: ServerJob | JobRecord): Promise<void>;
-    /**
-     * Close out a terminal job whose caller hasn't already persisted it: sign
-     * the receipt, then save the snapshot. The snapshot save never writes the
-     * receipt column, so ordering only affects how soon a reader sees the
-     * receipt — this way a caller polling immediately after the terminal
-     * already finds it.
-     */
+    /** Commit the terminal snapshot before resolving money and signing its durable evidence. */
     private finalizeTerminal;
     /**
      * Issue a receipt for a job this process doesn't hold in `activeJobs` — a
@@ -3724,10 +3421,12 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     issueReceiptForStoredJob(jobId: string): Promise<JobReceipt | undefined>;
     /**
      * Finish accounting for a terminal written directly to the store — the
-     * stale reaper and a cancel handled on a different machine (internal-review).
+     * stale reaper and a cancel handled on a different machine.
      */
     finalizeStoredTerminal(jobId: string): Promise<JobReceipt | undefined>;
-    /** Handle job reaching terminal state (completed, failed, cancelled). */
+    private reportTerminalJob;
+    private terminalReportRecoveryCursor?;
+    private recoverTerminalReports;
     private handleJobTerminal;
     /**
      * Re-enqueue terminal cost-only rows left between the job commit and outbox
@@ -3744,11 +3443,11 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     /** Report the latest declared-cost state only when no revenue event carried it. */
     private reportJobCost;
     /**
-     * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
+     * Report a completed paid job's revenue under its durable job identity.
      * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
      *
      * For a **credit-backed** job the revenue event is the *settled draw* (spec
-     * §10), and since internal-review the sats figure corrects the job's mirror of that
+     * §10), and since the behavior was introduced the sats figure corrects the job's mirror of that
      * draw against the draw itself: `withDrawBasis` stamps the job when the
      * payment lands, but a Bitcoin credit's settle re-prices the draw against
      * the funding lots it consumed. The correction is a delta, because a job's
@@ -3763,7 +3462,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * whose price couldn't be fiat-denominated) nothing changes: the pre-credits
      * payload is reported verbatim.
      *
-     * Takes the fields rather than a `ServerJob` so the internal-review reconciler — a
+     * Takes the fields rather than a `ServerJob` so the reconciler — a
      * background sweep that holds no in-process job — books through this exact
      * path off the row it read. `paymentTxHash` is passed **verbatim**, never
      * recomputed as a `drawSettlementRef`: it is the same column the in-line
@@ -3780,7 +3479,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * DVM with no reporter). Every drop that costs a booking logs first.
      *
      * The rail check sits **below** the draw re-read, not in the entry guard
-     * (internal-review): a settled draw the terminal can't report under is a real debit
+     * a settled draw the terminal can't report under is a real debit
      * with no revenue event, permanently overstating outstanding liability
      * (`deposits − draw revenue`), and it used to return here in silence. Placed
      * after the re-read, `revenue_skipped_no_rail` can name the draw and its
@@ -3789,19 +3488,16 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private bookRevenue;
     /** Schedule job removal from activeJobs after a delay so clients can still poll final status. */
     scheduleCleanup(job: ServerJob): void;
-    /** Clear all timers. Called on server shutdown to allow clean exit. */
     shutdown(): void;
 }
 
 /** Cached liveness signal for a platform-hosted DVM's Lightning receive rail. */
 interface LightningRailHealth {
-    /** Whether the receive rail may be advertised at this instant. */
     available(): boolean;
     /** Prime the cached signal at boot when the source supports it. */
     refresh?(): Promise<void>;
 }
 
-/** Builder-facing wiring for the Lightning receive leg (internal-review). */
 interface LightningReceiveConfig {
     /**
      * Receive-only NWC connection URI (`DVMKIT_NWC_RECEIVE_URI`). Validated at
@@ -3835,31 +3531,19 @@ interface LightningReceiveConfig {
 declare const DEFAULT_INVOICE_TTL_SECONDS = 900;
 /**
  * Floor on the invoice lifetime: twice the signed-request drift window, so the
- * bolt11 always outlives the funding negotiation that produced it (the issue's
- * "invoice expiry ≥ the funding-negotiation window"). A shorter one would
+ * bolt11 always outlives the funding negotiation that produced it. A shorter one would
  * expire inside the caller's own retry budget and strand them mid-top-up.
  */
 declare const MIN_INVOICE_TTL_SECONDS = 600;
 /**
- * The builder-side Lightning receive leg (internal-review, credits spec §4).
- *
- * Issues a bolt11 over a **receive-only** NWC connection while the DVM is
- * awake serving the 402, and credits the ledger when a later request observes
- * settlement. Two properties are load-bearing:
+ * Prepaid Lightning funding over a receive-safe NWC connection. URI construction validates
+ * the advertised method allowlist, refusing spending or unknown authority; the injected
+ * backend seam bypasses that probe. Receive-safe methods include invoice, read and
+ * hold-invoice operations.
  *
- * - **It never holds a send credential.** `pay_invoice` on this connection is
- *   refused at construction, so a compromised DVM can mint invoices and
- *   nothing else. The drain/refund sender (internal-review) is a separate, budgeted
- *   connection by rule.
- * - **Crediting is pull-based — there is no settlement watcher.** The caller's
- *   next request drives `lookup_invoice`, which is what makes this work on a
- *   suspend-to-zero fleet: a machine that is asleep has nothing to miss.
- *   Wallet downtime at that moment delays crediting; it never loses money,
- *   because the invoice→credit binding is a durable row.
- *
- * Reachability is **cached**, never probed per request: the funding menu is
- * assembled on every quote and every 402, so a live NIP-47 round trip there
- * would put a nostr relay in the latency path of every priced call.
+ * Crediting is pull-based: later requests observe settlement against the durable invoice
+ * binding, so sleeping hosts need no watcher. Reachability is cached and refreshed in the
+ * background for funding menus.
  */
 declare class LightningReceive {
     private readonly source;
@@ -3872,36 +3556,21 @@ declare class LightningReceive {
     private constructor();
     private readonly railHealth;
     /**
-     * Validate the configured connection and build the receive leg, or return
-     * `undefined` when this DVM didn't configure one.
-     *
-     * **Throws on a credential that is wrong, degrades on one that is merely
-     * unreachable.** A wallet outage at boot must not stop a DVM whose other
-     * rails are fine — the menu simply omits `lightning` until a later probe
-     * succeeds. A connection that can spend, or one that can't state what it can
-     * do, is a different thing entirely: it is a standing money risk that no
-     * amount of retrying fixes, so it fails the boot loudly with the fix in the
-     * message.
+     * Return undefined when unconfigured. Permission/URI failures refuse construction with a
+     * corrective message; wallet transport failure constructs an unavailable receive leg so
+     * other rails can still boot. Recovery must validate method scope before advertising
+     * Lightning.
      */
     static create(config: LightningReceiveConfig): Promise<LightningReceive | undefined>;
     /**
-     * Whether `lightning` belongs on the funding menu right now.
-     *
-     * Reads the cached observation and never blocks; a stale one kicks off a
-     * background refresh and answers with what we last knew. Advertising a rail
-     * whose wallet is down would hand the caller an option that 402s on use —
-     * the §4 posture is to drop it and let the sale survive on the others.
+     * Answer from cached wallet and optional rail-health observations without blocking. A stale
+     * wallet observation starts a background refresh.
      */
     available(): boolean;
     /**
-     * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
-     *
-     * The invoice is minted **for** the credit and amount named in the caller's
-     * signed body — that binding is the internal-review condition-3 commitment on this
-     * rail, and it is why no artifact hash rides the request: there is no
-     * caller-supplied artifact to hash. A re-poll returns the stored row rather
-     * than minting again; a second bolt11 for one `fund_id` would leave two
-     * payable invoices against a funding that can only be credited once.
+     * Return the stored invoice on retry: two payable bolt11s for one fund ID could charge
+     * twice while only one credits. Caller and amount are bound to the recorded credit/funding
+     * pair, without a caller-supplied artifact hash.
      */
     issue(ledger: CreditLedgerLike, args: {
         creditId: string;
@@ -3913,24 +3582,9 @@ declare class LightningReceive {
         description?: string;
     }): Promise<CreditInvoiceRecord>;
     /**
-     * Ask the wallet whether one payment hash is paid, and when (internal-review).
-     *
-     * The operator's reconcile verb runs this before it credits anything. A
-     * `blocked` row implies payment — {@link applyOne} returns above the block
-     * classification when the lookup says unpaid — but that is *this fleet's
-     * belief, recorded possibly weeks ago*, and the verb it gates mints balance
-     * against it. One round trip turns the belief into a fact and recovers the
-     * true settlement instant for `settled_at`, which a blocked row never got to
-     * write.
-     *
-     * Unlike {@link settlePending} this **throws**: there is no request whose
-     * latency it protects, and crediting on an unverifiable wallet is exactly
-     * what it exists to prevent. `NOT_FOUND` is the one exception, and it is not
-     * an outage — it is the wallet saying it has never seen this hash, the same
-     * reading {@link applyOne} and the caller-side reconcile in `src/lib/nwc.ts`
-     * take. It comes back as `known: false` because the operator's repair for it
-     * ("you are pointed at a different wallet than the one that minted this")
-     * is not the repair for an unpaid invoice, and certainly not for a retry.
+     * Re-observe the wallet payment before an operator credits a blocked invoice and recover
+     * its settlement instant. Unlike settlePending, lookup failures throw. NOT_FOUND returns
+     * known:false, distinguishing the wrong wallet/unknown hash from an unpaid known invoice.
      */
     lookupSettlement(paymentHash: string): Promise<{
         settled: boolean;
@@ -3938,23 +3592,12 @@ declare class LightningReceive {
         known: boolean;
     }>;
     /**
-     * Consult the wallet about this caller's outstanding invoices and credit the
-     * ones that settled — the pull half of pull-based crediting.
-     *
-     * The pending rows are read locally first, so the common case (nothing
-     * outstanding) costs one indexed SELECT and no network at all. Bounded to
-     * {@link MAX_SETTLE_CHECKS} invoices on a short deadline, and **never throws
-     * into the request**: a wallet failure here means the caller's balance is
-     * merely not updated yet, which the ordinary `insufficient_credit` path
-     * already states honestly.
+     * Read pending invoices locally, then check at most MAX_SETTLE_CHECKS on bounded wallet
+     * deadlines. Log failures without throwing into the request.
      *
-     * **Each invoice gets its own failure boundary.** The sweep window is a few
-     * rows wide, so a row that fails on its own terms — a `fund_id` the caller
-     * reused on another rail, a credit someone else opened first — must not take
-     * the rest of the pass down with it: the next invoice in the window may be
-     * the paid one, and it would never be looked up. Only a transport failure
-     * ends the pass early, because there the wallet itself is gone and the
-     * remaining lookups would just spend the caller's latency confirming it.
+     * An invoice-specific failure must not suppress payable siblings; wallet transport failure
+     * ends the pass. Deterministic refusals retire that row as blocked for operator repair,
+     * while transient failures remain pending.
      */
     settlePending(ledger: CreditLedgerLike, args: {
         callerPubkey: string;
@@ -3964,49 +3607,21 @@ declare class LightningReceive {
         enqueueCreditDeposit?: CreditDepositEnqueue;
         nowMs?: number;
     }): Promise<InvoiceSettlement[]>;
-    /**
-     * One invoice's settlement check. Returns the applied settlement, or
-     * `undefined` when nothing changed (still unpaid, or retired unpaid).
-     *
-     * Throws whatever the wallet or the ledger threw — classifying that is
-     * {@link retireOrLog}'s job, so this stays one invoice's happy path.
-     */
     private applyOne;
     /**
-     * Decide what one invoice's failure means, and retire the invoice when the
-     * answer is "this can never succeed".
-     *
-     * The split that matters is permanent-versus-transient, because it decides
-     * whether the row keeps a slot in the sweep window. A transient failure — the
-     * database blinked, the wallet answered oddly — leaves it `pending` and the
-     * caller's next request retries it. A **permanent** one means the ledger will
-     * refuse this invoice identically forever, so leaving it pending costs a
-     * `lookup_invoice` on every subsequent request and, at
-     * {@link MAX_SETTLE_CHECKS} of them, fills the window so a genuinely payable
-     * invoice behind them is never even looked up. Those get `blocked`, which
-     * drops them out of the sweep and hands the operator the payment hash.
+     * Retire a deterministic uncreditable payment as blocked so it no longer occupies the
+     * bounded sweep window. Transient failures stay pending for a later request; report the
+     * payment hash for operator repair.
      */
     private retireOrLog;
     /**
-     * The reason this invoice can never be credited, or `undefined` if the
-     * failure was transient.
-     *
-     * Every code here is decided by state a retry cannot move — a row the ledger
-     * has already committed (a `credit_fundings` entry at this
-     * `(credit_id, fund_id)`, or a `credits` row whose owner, denomination or
-     * rail disagrees with the invoice), or the basis this module rebuilds
-     * identically from the invoice row on every pass. None of them is a race.
-     *
-     * `funding_replayed` is the one that needs a second read to classify.
-     * Usually it *is* benign — a concurrent check won the race and the money is
-     * credited either way — but the key is `(credit_id, fund_id)` and `fund_id`
-     * is **caller-chosen**: reuse it on cashu or x402 after this bolt11 was
-     * minted and the row that collided is a different payment entirely, so the
-     * sats this invoice received have nowhere to land.
+     * Classify funding_replayed by reading the existing funding’s rail. A Lightning row can
+     * represent a concurrent applied check; another rail at this caller-chosen key is a
+     * different payment, leaving the invoice’s sats uncredited. A failed diagnostic read
+     * remains transient, never a guessed permanent refusal.
      */
     private blockingReason;
     private withBackend;
-    /** Record activity without letting it promote an unvalidated connection. */
     private noteOperationOk;
     private notePermissionsOk;
     private notePermissionRefused;
@@ -4019,7 +3634,7 @@ declare class LightningReceive {
 }
 
 /**
- * Owner display identity surfaced on `/v1/info#owner` (internal-review). Personal orgs
+ * Owner display identity surfaced on `/v1/info#owner`. Personal orgs
  * resolve to the owner builder's profile; shared orgs resolve to the org's own
  * profile. Container DVMs read from env vars; isolate DVMs resolve from Postgres.
  */
@@ -4029,22 +3644,22 @@ interface OwnerDisplay {
     avatarUrl?: string | null;
     type: "builder" | "org";
 }
-/** Optional builder identity surfaced on `/v1/info` (forward-compatible stub). */
+/** Builder identity advertised on /v1/info. */
 interface BuilderIdentity {
     id?: string;
     name?: string;
     url?: string;
     /**
-     * Builder identity x-only secp256k1 pubkey (internal-review). When populated, the
+     * Builder identity x-only secp256k1 pubkey. When populated, the
      * `/v1/info#builder` block also carries `attestation` + `signature` so
      * consumers can verify the deploy was signed by the holder of this key.
      * Populated at deploy time from `DVMKIT_BUILDER_PUBKEY` (Fly secret); the
      * SDK never re-signs at runtime.
      */
     pubkey?: string;
-    /** Canonical deploy-time attestation payload (internal-review). Served verbatim. */
+    /** Canonical deploy-time attestation payload. Served verbatim. */
     attestation?: AttestationPayload;
-    /** Schnorr signature over `canonicaliseForSigning(attestation)` (internal-review). */
+    /** Schnorr signature over `canonicaliseForSigning(attestation)`. */
     signature?: string;
 }
 /** Platform reporter overrides — the host falls back to env when omitted. */
@@ -4054,28 +3669,29 @@ interface PlatformReporterOpts {
     /** Platform internal URL. Defaults to `DVMKIT_PLATFORM_URL` env. */
     url?: string;
 }
-/** Running host handle returned by serve(). */
 interface DVMServeResult {
     url: string;
     close: () => Promise<void>;
     /** Boot snapshot for each mount; configured but unusable rails remain payment-required. */
     paymentModes: PaymentMode[];
 }
-/** Options for {@link createDVMHost}. */
 interface DVMHostOpts {
     /**
      * Postgres connection string. Defaults to `DATABASE_URL` env.
-     * Required at runtime (internal-review). Boot fails when missing unless `jobStore`
+     * Required at runtime. Boot fails when missing unless `jobStore`
      * is explicitly supplied or `devMode` is true (test/dev escape hatches).
      */
     database?: string;
     /** Listen port. Defaults to `PORT` env or 8080. */
     port?: number;
-    /** Environment variables. Defaults to `process.env`. */
+    /**
+     * Environment variables. Defaults to `process.env` when omitted. A supplied
+     * object is the complete host configuration: absent fields do not fall back
+     * to ambient process variables.
+     */
     env?: Record<string, string>;
-    /** Builder identity for `/v1/info` (forward-compatible). */
     builder?: BuilderIdentity;
-    /** Owner display identity for `/v1/info#owner` (internal-review). Falls back to env vars. */
+    /** Owner display identity for `/v1/info#owner`. Falls back to env vars. */
     owner?: OwnerDisplay;
     /** Platform reporter overrides. Defaults to env-derived values. */
     platformReporter?: PlatformReporterOpts;
@@ -4093,7 +3709,7 @@ interface DVMHostOpts {
     jobStore?: JobStore;
     /**
      * Existing Postgres pool to reuse instead of opening one from `database`
-     * (internal-review test seam). When set, the host builds its JobStore / KVStore /
+     * (also useful as a test seam). When set, the host builds its JobStore / KVStore /
      * cashu accumulator on this pool and leaves it open at shutdown — the caller
      * owns it. Lets the e2e harness run DVMs in `p2pk-accumulator` mode against
      * its single shared pool rather than spawning a pool per DVM.
@@ -4101,7 +3717,6 @@ interface DVMHostOpts {
     pool?: Pool;
     /** Cashu mints accepted. Defaults to env `DVMKIT_CASHU_MINTS`. */
     mints?: string[];
-    /** Cashu receive mode override. */
     cashuMode?: CashuMode;
     /** MPP handle override. Defaults to env-resolved via `createMppFromOpts`. */
     mpp?: MppxServer;
@@ -4110,7 +3725,7 @@ interface DVMHostOpts {
     /** Payment methods override. Defaults to derived from configured rails. */
     paymentMethods?: PaymentMethod[];
     /**
-     * Lightning receive leg for credit funding (internal-review). Defaults to the
+     * Lightning receive leg for credit funding. Defaults to the
      * env-resolved `DVMKIT_NWC_RECEIVE_URI` /
      * `DVMKIT_NWC_RECEIVE_INVOICE_TTL_SECONDS`. Pass `backend` to inject a
      * wallet directly — a test seam that skips the connect-time probe, so
@@ -4124,9 +3739,7 @@ interface DVMHostOpts {
     onPaidJobCompleted?: (event: PaidJobCompletion) => void | Promise<void>;
     /** When true, payment is skipped only when no payment rail is configured. */
     devMode?: boolean;
-    /** Consumed-credential store override (test seam). */
     consumedCredentialStore?: ConsumedCredentialStore;
-    /** Mint-health tracker override (test seam). */
     mintHealthTracker?: MintHealthTracker;
     /** Operator-alert boundary for failed terminal-job retention passes. */
     onJobRetentionSweepFailed?: JobManagerOpts["onJobRetentionSweepFailed"];
@@ -4139,12 +3752,10 @@ interface DVMHostOpts {
      */
     wrapRouteClientCompatibility?: (sdkGate: ClientCompatibilityGate) => ClientCompatibilityGate;
 }
-/** Per-mount options. Currently only `prefix` is supported. */
 interface MountOpts {
     /** Path prefix for this DVM's protocol routes (e.g. `/delete-feed`). */
     prefix?: string;
 }
-/** Live DVM host. Single wiring locus for the SDK (internal-review). */
 interface DVMHost {
     /**
      * Underlying Hono app for custom non-protocol routes that belong to the
@@ -4155,15 +3766,15 @@ interface DVMHost {
     /**
      * Resolved Postgres pool — undefined before `host.serve()` completes
      * database resolution, set thereafter. Exposed so DVM-local Postgres
-     * consumers (e.g. scrape's `ScrapeDb` per-fetch event store, internal-review)
+     * consumers (e.g. scrape's `ScrapeDb` per-fetch event store)
      * can reuse the host's pool rather than constructing their own. Wire
      * inside descriptor `onBoot` (fires after pool init, before listener opens).
      */
     readonly pool: Pool | undefined;
     /**
-     * Money-safe credit ledger (internal-review) — undefined before `host.serve()`
+     * Money-safe credit ledger — undefined before `host.serve()`
      * resolves stores, set thereafter. Postgres-backed when a pool exists;
-     * pool-less hosts get a shared in-memory ledger so the internal-review fund+draw
+     * pool-less hosts get a shared in-memory ledger so the fund+draw
      * semantics hold everywhere. Same wiring window as `pool` (descriptor
      * `onBoot` fires after init, before the listener opens).
      */
@@ -4173,7 +3784,6 @@ interface DVMHost {
      * a single mount with no prefix attaches at root.
      */
     mount<S, I extends ZodLike | undefined>(descriptor: DVMDescriptor<S, I>, opts?: MountOpts): void;
-    /** Start listening. Returns the live server handle. */
     serve(opts?: {
         port?: number;
     }): Promise<DVMServeResult>;
@@ -4181,7 +3791,7 @@ interface DVMHost {
     shutdown(): Promise<void>;
 }
 /**
- * Single wiring locus for SDK-side construction (internal-review). Replaces both the
+ * Single wiring locus for SDK-side construction. Replaces both the
  * `serve()` wrapper and the `createDVMServer` direct path. Reads env once,
  * resolves payment rails, owns the Postgres pool, and mounts each DVM
  * descriptor as a Hono sub-app on `host.app`.
@@ -4190,13 +3800,12 @@ declare function createDVMHost(opts?: DVMHostOpts): DVMHost;
 
 /**
  * Cached liveness signal for the platform's central Tempo close observer
- * (internal-review).
  *
  * A TIP-1034 session channel is only safe to accept while something is
  * watching the chain for its close: without that, a caller can consume value,
  * request a close, wait out the 900-second grace period and withdraw. So this
  * gate is **fail-closed**, which is the opposite of `lightning-rail-health.ts`
- * — there, withholding a rail over an outage costs a sale; here, advertising
+ * there, withholding a rail over an outage costs a sale; here, advertising
  * one costs the money. `tempo/charge` is untouched either way: a charge is an
  * ordinary payment with no channel and no close to watch.
  */
@@ -4218,22 +3827,10 @@ interface TempoObserverHealth {
     /** Prime the cached signal at boot. */
     refresh?(): Promise<void>;
     /**
-     * Register a mount's `tempo/session` **capability** so the poll can carry it
-     * back to the platform (internal-review).
-     *
-     * The platform's `dvms.tempo_session_advertised_at` — the only filter on the
-     * close observer's payee-fallback rung 2 — was written once per container
-     * deploy and never refreshed, so a builder flipping sessions on with
-     * `dvmctl env --set` stayed invisible to the fallback indefinitely. That is a
-     * `no_route` on the first close of that DVM's first channel, which is exactly
-     * the race the rung exists to cover.
-     *
-     * The reader must answer from **configuration**, never from
-     * {@link TempoObserverHealth.available} — a fail-closed gate blip must not
-     * de-stamp the DVM, which is the internal-review failure through a new door.
-     *
-     * Returns a disposer the mount calls on shutdown, so a torn-down capability
-     * stops voting in the OR below.
+     * Report the OR of mounted session capabilities to keep the platform's
+     * observer watch signal current. Readers must use configuration, not current
+     * availability: an observer outage must not erase the capability it watches.
+     * The returned disposer removes a mount's contribution on shutdown.
      */
     declareSessionCapability?(read: () => boolean): () => void;
 }
@@ -4281,7 +3878,6 @@ interface TempoSettlementReadinessStateStore {
     clearFailureIfRefilled(version: string, balanceMicro: bigint, lowBalanceMicro: bigint): Promise<boolean>;
     clearFailureAfterSuccessfulTransaction(version: string): Promise<boolean>;
 }
-/** Construction inputs for {@link TempoSettlementReadiness}. */
 interface TempoSettlementReadinessOptions {
     address: `0x${string}`;
     network: string;
@@ -4328,7 +3924,6 @@ declare class TempoSettlementReadiness {
     start(): void;
     /** Stop the cadence without affecting any in-flight reading. */
     stop(): void;
-    /** Read and report the configured fee-token balance now. */
     checkBalance(opts?: {
         successfulTransaction?: boolean;
         recoveryVersion?: string;
@@ -4351,24 +3946,11 @@ declare class TempoSettlementReadiness {
     private notify;
 }
 
-/**
- * Options for the revenue reporter readiness assertion (internal-review).
- *
- * The check branches on `platformUrl` presence — that's the unambiguous
- * "platform-hosted" signal. `failFast` stays on the opts as a general SDK
- * strict-mode flag but is not consulted by this assertion.
- */
 interface RevenueBootCheckOpts {
     /**
-     * General SDK strict-mode flag, sourced from `DVMKIT_FAIL_FAST` at the host
-     * boundary (internal-review). Reserved for future warning-vs-fatal SDK checks; the
-     * reporter check itself ignores it (internal-review), hence optional.
+     * Reporter readiness ignores this host strict-mode flag.
      */
     failFast?: boolean;
-    /**
-     * The SDK's canonical "this is a dev/test run" signal. Exempts the boot from
-     * the platform-hosted wiring requirement (internal-review) — see below.
-     */
     devMode?: boolean;
     platformToken: string | undefined;
     platformUrl: string | undefined;
@@ -4376,63 +3958,38 @@ interface RevenueBootCheckOpts {
     hasPgPool: boolean;
 }
 /**
- * Assert that revenue reporting is correctly configured at boot (internal-review).
- *
- * Platform-hosted DVMs (signalled by `DVMKIT_PLATFORM_URL`) unconditionally
- * require `DVMKIT_PLATFORM_TOKEN`, `DVMKIT_DVM_ID`, and a database connection.
- * Partial wiring is always fatal — there's no legitimate "platform set my URL
- * but didn't finish wiring" case, and `DVMKIT_FAIL_FAST` has no effect here.
- *
- * Self-hosted DVMs (no `DVMKIT_PLATFORM_URL`) have no platform reporter
- * contract to enforce — the SDK skips validation entirely.
- *
- * `devMode` boots are exempt (internal-review), mirroring the test-mint guard's
- * exemption in `createDVMHost` (internal-review, `host.ts`). `devMode` is set by
- * `dvmctl dev`, `standalone development tooling`, the money-loop, and the e2e/smoke
- * harnesses — all of which spread `...process.env`, so a builder whose shell
- * exports `DVMKIT_PLATFORM_URL` for their `dvmctl` platform commands would
- * otherwise hit this FATAL on a dev server that reports no revenue anyway (no
- * payment, no auth, no DB). Production boots never set it: first-party
- * container entrypoints and `dvmctl serve` (`buildServeOpts`) both leave it
- * unset — asserted in
- * `__tests__/revenue-reporter-boot.test.ts`, not just claimed here.
+ * Hosted boots (a platform URL is set) require a token, DVM ID and database;
+ * partial wiring is fatal regardless of `failFast`. Self-hosted and `devMode`
+ * boots skip this assertion. The exemption does not disable an already wired
+ * reporter; the banner separately describes whether reporting is active.
  */
 declare function assertRevenueReporterReady(opts: RevenueBootCheckOpts): void;
 /** What the host's boot banner knows about the revenue reporter's wiring. */
 interface ReporterBannerOpts {
     /** `DVMKIT_PLATFORM_URL` — the platform-hosted signal. */
     platformUrl: string | undefined;
-    /** Whether `DVMKIT_PLATFORM_TOKEN` resolved — never the token itself (internal-review). */
+    /** Whether `DVMKIT_PLATFORM_TOKEN` resolved — never the token itself. */
     hasPlatformToken: boolean;
     /** Whether `DVMKIT_DVM_ID` resolved. */
     hasDvmId: boolean;
-    /** Whether a Postgres pool is wired. */
     databaseConnected: boolean;
-    /** Dev/test boot — exempt from the wiring assertion above (internal-review). */
     devMode: boolean;
 }
 /**
- * Render the boot banner's `Platform rep.` line (internal-review).
+ * Render the boot banner's `Platform rep.` line.
  *
  * Lives here, next to the assertion, because `active` has to mirror the
  * reporter's own wiring gate in `createDVMServer` below — token **and** dvmId
  * **and** database. Miss one and the banner claims a reporter that was never
  * constructed.
  *
- * On a production boot the assertion throws before the banner prints, so only
- * `(self-hosted)` and `active` are reachable there. A `devMode` boot skips the
- * assertion (internal-review), making it the one path where partial wiring reaches
- * this line — say so plainly rather than shouting `misconfigured` at a builder
- * whose shell merely exports the platform URL.
+ * Partial dev wiring reaches the banner because the boot assertion is exempt;
+ * it reports a dev status rather than a production configuration failure.
  */
 declare function revenueReporterBannerState(s: ReporterBannerOpts): string;
-/** Options for creating the SDK server app. */
 interface SDKServerOpts {
-    /** Environment variables for ctx.env. */
     env: Record<string, string>;
-    /** KV store for ctx.store. */
     store: KVStore;
-    /** Cashu mints accepted for payment. */
     mints?: string[];
     /** Persistent backing store for job records. Default: in-memory. */
     jobStore?: JobStore;
@@ -4440,7 +3997,6 @@ interface SDKServerOpts {
     devMode?: boolean;
     /** Payment methods this DVM accepts. Default: derived from configured rails — adds "cashu" when `mints` is set, "x402" when `x402` is set, "tempo" when `tempo` is set. */
     paymentMethods?: PaymentMethod[];
-    /** x402 stablecoin payment configuration. */
     x402?: X402Config;
     /** Live facilitator capability gate. Hosts wire this after probing `/supported`. */
     x402FacilitatorHealth?: X402FacilitatorHealthLike;
@@ -4449,13 +4005,13 @@ interface SDKServerOpts {
     /**
      * Tracks already-consumed upfront-flow MPP credentials so the same
      * credential can't satisfy `POST /v1/job` twice within its `expires`
-     * window (internal-review). Default: in-memory, bounded, per-process. Swap for a
+     * window. Default: in-memory, bounded, per-process. Swap for a
      * shared backend before deploying multiple replicas.
      */
     consumedCredentialStore?: ConsumedCredentialStore;
     /**
      * Tracks already-consumed admin-endpoint nonces so a signed P2PK challenge
-     * can't be replayed within the 5-minute sliding window (internal-review). Default:
+     * can't be replayed within the 5-minute sliding window. Default:
      * in-memory, bounded, per-process. Swap for a shared backend before
      * deploying multiple replicas.
      */
@@ -4469,14 +4025,14 @@ interface SDKServerOpts {
      * registration order.
      */
     healthHandler?: (c: Context<AppEnv>) => Response | Promise<Response>;
-    /** Cashu receive mode (internal-review). */
+    /** Cashu receive mode. */
     cashuMode?: CashuMode;
     /**
-     * Builder's NUT-11 P2PK lock pubkey (internal-review). Used as the seed pubkey for
+     * Builder's NUT-11 P2PK lock pubkey. Used as the seed pubkey for
      * `seedLockPubkeyState` on first boot, as the admin-auth identity, and as
      * part of the gate for whether `/v1/info` advertises `cashu`. After first
      * boot, the authoritative `[current, ...retired]` state lives in the DVM's
-     * Postgres via `dvm_lock_pubkeys`; rotations (internal-review) mutate that store
+     * Postgres via `dvm_lock_pubkeys`; rotations mutate that store
      * directly.
      */
     lockPubkey?: string;
@@ -4485,12 +4041,11 @@ interface SDKServerOpts {
     /**
      * Rotation grace window (seconds) — retired pubkeys remain advertised on
      * `cashu.lock_pubkeys` and accepted by the receive path until they age out.
-     * Default 24h (`DEFAULT_LOCK_PUBKEY_GRACE_SECONDS`); operators tune via
-     * `BUILDER_LOCK_PUBKEY_GRACE_SECONDS` env (internal-review).
+     * Defaults to 24h.
      */
     lockPubkeyGraceSeconds?: number;
     /**
-     * Per-DVM canonical identifier (internal-review). Advertised on `/v1/info` as
+     * Per-DVM canonical identifier. Advertised on `/v1/info` as
      * `cashu.canonical_id` so agents can derive the matching per-DVM refund
      * subkey at `m/1789'/2'/hashed(canonical_dvm_id)'`. Defaults to `dvmId`
      * (the platform's DVM UUID) when unset — keeps `/v1/info` self-consistent
@@ -4500,30 +4055,23 @@ interface SDKServerOpts {
     /** Postgres pool for builder admin state and wallet accumulator persistence. */
     db?: Pool;
     /**
-     * General SDK strict-mode flag (internal-review), sourced from `DVMKIT_FAIL_FAST` at
-     * the host boundary. Reserved for future warning-vs-fatal SDK checks; the
-     * revenue-reporter boot check is gated on platform context, not on this
-     * flag (internal-review).
+     * Host strict-mode flag. Reporter readiness follows hosted context regardless
+     * of this value.
      */
     failFast?: boolean;
-    /** Agent-wallet (internal-review): per-DVM identifier — drives the monitor advisory lock + replay key. */
+    /** Agent-wallet: per-DVM identifier — drives the monitor advisory lock + replay key. */
     dvmId?: string;
     /**
-     * Runtime mint-health tracker (internal-review). When omitted, the server builds a
-     * fresh one whenever `mints?.length > 0`. Sick mints are dropped from
-     * `/v1/info`'s advertised list and rejected at receive time. Tests pass an
-     * instance with `runOnce`-driven state instead of relying on the timer.
+     * Runtime mint-health tracker. When omitted, the server builds a
+     * fresh one whenever `mints?.length > 0`. Healthy mints are preferred in
+     * `/v1/info`; when none are healthy, transiently sick mints remain advertised.
+     * NUT-incompatible mints are excluded even from that fallback.
      */
     mintHealthTracker?: MintHealthTracker;
-    /**
-     * Shared fx fetcher used to translate USD descriptor prices and fiat-form
-     * `ctx.requestPayment` calls into sats (internal-review). When omitted, the server
-     * builds one from `env.DVMKIT_FX_SOURCE` (or the bundled CoinGecko default).
-     * Tests pass a deterministic stub.
-     */
+    /** Shared upfront/mid-job fiat conversion fetcher. Defaults to `DVMKIT_FX_SOURCE` or CoinGecko. */
     fxFetcher?: FxFetcher;
     /**
-     * Platform API token for revenue reporting (internal-review). Read from
+     * Platform API token for revenue reporting. Read from
      * `opts.env.DVMKIT_PLATFORM_TOKEN` when not set explicitly. When both
      * `platformToken` and `platformUrl` are present alongside `db` and `dvmId`,
      * the SDK auto-constructs a `RevenueReporter` and wires it into the
@@ -4531,35 +4079,32 @@ interface SDKServerOpts {
      */
     platformToken?: string;
     /**
-     * Platform API URL for revenue reporting (internal-review). Read from
+     * Platform API URL for revenue reporting. Read from
      * `opts.env.DVMKIT_PLATFORM_URL` when not set explicitly.
      */
     platformUrl?: string;
-    /**
-     * Advanced override: callback fired when a paid job completes (internal-review).
-     * When set, bypasses the SDK's automatic `RevenueReporter` wiring — the
-     * caller assumes full responsibility for revenue tracking. Intended for
-     * tests and advanced integrations only.
-     */
+    /** Observes completed jobs with a positive settled draw; failures are logged and swallowed. */
     onPaidJobCompleted?: (event: PaidJobCompletion) => void | Promise<void>;
     paymentMode?: PaymentMode;
+    /** Overrides automatic RevenueReporter wiring; the caller owns revenue delivery. */
     onJobCompleted?: JobManagerOpts["onJobCompleted"];
     /**
      * Advanced override for a declared cost on a terminal job that emitted no
-     * revenue report (internal-review). Auto-wired to the reporter's durable
+     * revenue report. Auto-wired to the reporter's durable
      * job-cost path; intended for tests and advanced integrations only.
      */
     onJobCost?: JobManagerOpts["onJobCost"];
+    onJobTerminal?: JobManagerOpts["onJobTerminal"];
     /**
      * Advanced override: callback fired when the stale-job reaper force-fails a
-     * *paid* job (internal-review). Auto-wired to the `RevenueReporter`'s paid-job-death
+     * *paid* job. Auto-wired to the `RevenueReporter`'s paid-job-death
      * report alongside `onJobCompleted`; set explicitly only for tests / advanced
      * integrations that own their own reporting.
      */
     onPaidJobDeath?: JobManagerOpts["onPaidJobDeath"];
     /**
      * Advanced override: callback fired when a settled credit draw could not
-     * book revenue because its rail was unavailable (internal-review). Auto-wired to
+     * book revenue because its rail was unavailable. Auto-wired to
      * the platform reporter alongside the completion and paid-job-death paths.
      */
     onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
@@ -4568,22 +4113,22 @@ interface SDKServerOpts {
     /** Advanced clear-on-recovery callback for clean job-retention passes. */
     onJobRetentionSweepRecovered?: JobManagerOpts["onJobRetentionSweepRecovered"];
     /**
-     * Advanced override: callback fired when a payment funds a credit (internal-review).
+     * Advanced override: callback fired when a payment funds a credit.
      * Auto-wired to the `RevenueReporter`'s deposit report alongside
      * `onJobCompleted`; set explicitly only for tests / advanced integrations
      * that own their own reporting. Fundings are deposits — a liability until
-     * drawn — reported separately from the draws that become revenue (spec §10).
+     * drawn — reported separately from the draws that become revenue (the deposit-accounting rule).
      */
     onCreditFunded?: (info: CreditDepositPayload) => void | Promise<void>;
     /**
      * Grace window (ms) a reactivating machine waits for a live original handler
      * to win the single-execution claim before replaying an `awaiting-input` job
-     * (internal-review). Defaults to the JobManager's built-in value; exposed as an ops
+     * Defaults to the JobManager's built-in value; exposed as an ops
      * override and a test seam.
      */
     reactivationClaimGraceMs?: JobManagerOpts["reactivationClaimGraceMs"];
     /**
-     * Builder identity for `/v1/info#builder` (internal-review). Inline alternative
+     * Builder identity for `/v1/info#builder`. Inline alternative
      * to the `DVMKIT_BUILDER_PUBKEY` / `_ATTESTATION` / `_SIGNATURE` env vars
      * the platform's deploy pipeline injects as Fly secrets. When set,
      * `builder.{pubkey, attestation, signature}` take per-field precedence
@@ -4591,10 +4136,10 @@ interface SDKServerOpts {
      * `/v1/info#builder` block to be emitted.
      */
     builder?: BuilderIdentity;
-    /** Owner display identity for `/v1/info#owner` (internal-review). Falls back to env vars. */
+    /** Owner display identity for `/v1/info#owner`. Falls back to env vars. */
     owner?: OwnerDisplay;
     /**
-     * Per-DVM receipt-signing secret, 32 bytes hex (internal-review). Resolved at the
+     * Per-DVM receipt-signing secret, 32 bytes hex. Resolved at the
      * host boundary from `DVMKIT_RECEIPT_KEY` — the deploy pipeline provisions
      * it as a Fly secret, derived one-way from the builder identity key and
      * bound into the deploy attestation's `receipt_pubkey`.
@@ -4605,25 +4150,25 @@ interface SDKServerOpts {
      */
     receiptKey?: string;
     /**
-     * Credit ledger every payment funds and draws through (internal-review). The host
+     * Credit ledger every payment funds and draws through. The host
      * passes the Postgres `CreditLedger` when a pool exists; standalone /
      * pool-less setups default to a per-server `MemoryCreditLedger` so the
      * fund+draw semantics (and receipts' credit block) hold everywhere.
      */
     creditLedger?: CreditLedgerLike;
     /**
-     * Durable x402/mpp processed-payment markers (internal-review). Defaults to the
+     * Durable x402/mpp processed-payment markers. Defaults to the
      * in-memory store; the host passes the Postgres one alongside the ledger.
      */
     processedPayments?: ProcessedPaymentStore;
     /**
-     * Lightning credit-funding receive leg (internal-review), when the host resolved a
+     * Lightning credit-funding receive leg, when the host resolved a
      * receive-only NWC connection. Absent ⇒ `lightning` never appears on the
      * funding menu and `POST /v1/credit` refuses the method.
      */
     lightningReceive?: LightningReceive;
     /**
-     * Liveness of the platform's Tempo close observer (internal-review). Absent ⇒ this
+     * Liveness of the platform's Tempo close observer. Absent ⇒ this
      * DVM is self-hosted and answers for its own close watching, so nothing is
      * withheld. Present and unhealthy ⇒ `tempo/session` is withheld while
      * `tempo/charge` stays available.
@@ -4632,35 +4177,25 @@ interface SDKServerOpts {
     /** Platform-hosted operator fee-token readiness; absent outside hosted sessions. */
     tempoSettlementReadiness?: TempoSettlementReadiness;
     /**
-     * Tuning for the credit-expiry sweep (internal-review). Omitted, the sweep runs on
+     * Tuning for the credit-expiry sweep. Omitted, the sweep runs on
      * its own defaults whenever the ledger supports it; tests pass `intervalMs: 0`
      * and `bootDelayMs: 0` to hold the clock still and drive `runOnce` by hand.
      */
     creditExpirySweep?: CreditExpirySweepOpts;
 }
-/**
- * Per-descriptor server construction — internal to the SDK after host
- * consolidation (internal-review). Public callers use `createDVMHost` instead; this
- * function is what the host invokes per `host.mount(dvm)`.
- *
- * Builds a Hono sub-app for one DVM descriptor, wires payment verification,
- * auto-wires `RevenueReporter` when platform env + db + dvmId are present, and
- * runs the platform-hosted partial-wiring assertion (internal-review) — gated on
- * `DVMKIT_PLATFORM_URL` presence, independent of `DVMKIT_FAIL_FAST`.
- */
 declare function createDVMServer<State, InputSchema extends ZodLike | undefined>(descriptor: DVMDescriptor<State, InputSchema>, opts: SDKServerOpts): Promise<{
     app: Hono<AppEnv>;
     authAudience?: SignedRequestAudience;
     shutdown: () => Promise<void>;
     jobManager: JobManager<State, InputSchema>;
     revenueReporterActive: boolean;
-    /** The payout reporter (internal-review), for the host to attach its Tempo readers to. */
+    /** The payout reporter, for the host to attach its Tempo readers to. */
     payoutReporter?: PayoutReporter;
 }>;
 /**
  * Hono env for the SDK's DVM app. `unknownRoute` is set by
  * {@link unknownRouteNotFound} so the `dvm.request` span can classify a 404 as
- * scanner-probe noise vs a registered route's own 404 (internal-review).
+ * scanner-probe noise vs a registered route's own 404.
  *
  * Exported as a type only, for route modules split out of this file
  * (`credit-routes.ts`) — a type-only import erases at compile time, so it
@@ -4676,7 +4211,7 @@ interface AppEnv {
 /**
  * `notFound` handler for paths that match no registered route — scanner probes
  * (`GET /robots.txt`, `/.env`, …). Tags the request context so the `dvm.request`
- * span downgrades the 404 to `warn`-level probe noise (internal-review) instead of
+ * span downgrades the 404 to `warn`-level probe noise instead of
  * crowding out real errors in a `--level error` sweep, and returns a
  * machine-parseable JSON 404 (Hono's default is plain text). Registered on both
  * the DVM app (standalone `createDVMServer`) and the host app (mounted path):
@@ -4689,13 +4224,8 @@ interface AppEnv {
 declare function unknownRouteNotFound(c: Context): Response;
 
 /**
- * The public prepaid-credit terms a DVM advertises before a caller identifies
- * itself. Snake_case: this is the wire shape.
- *
- * This type deliberately excludes the per-caller echo. `/v1/info` is public
- * and cacheable, so its type must make a caller credit ID or balance
- * unrepresentable rather than relying on the current handler not to ask for
- * one.
+ * Public, cacheable prepaid terms exclude caller IDs and balances. toCreditTerms explicitly
+ * whitelists this shape so later caller-specific menu fields cannot leak into /v1/info.
  */
 interface CreditTerms {
     /** Smallest funding accepted, in 1e-6 units of `currency`. */
@@ -4708,7 +4238,10 @@ interface CreditTerms {
     currency: string;
     /** Rails a top-up may be funded over. */
     funding: FundingMethod[];
-    /** MPP instruments offered or temporarily withheld for credit funding. */
+    /**
+     * Tempo methods are actionable. withheld names configured but temporarily unavailable
+     * instruments, preserving capability discovery without advertising them for funding.
+     */
     tempo?: {
         methods: {
             method: string;
@@ -4720,63 +4253,32 @@ interface CreditTerms {
             reason: string;
         }[];
     };
-    /** x402 flavours accepted for credit funding. */
+    /**
+     * Present with offered x402 funding. Reusable batch settlement is enabled by default; exact
+     * requires explicit acceptance of its manual refund obligation.
+     */
     x402?: {
         schemes: {
             scheme: string;
             network: string;
         }[];
     };
-    /** Smallest Lightning funding accepted, in 1e-6 units of `currency`. */
+    /**
+     * Configured Lightning receive floor in micro-units of currency, including the advertised
+     * FX margin. Issuance checks the raw sats floor at current rates; arbitrary drift can still
+     * make the advertised amount insufficient.
+     */
     lightning_min_micro?: number;
 }
 /**
- * The **funding menu** a DVM advertises on `/v1/quote` and in every 402
- * (internal-review, credits spec §4/§6). Snake_case: this is the wire shape.
- *
- * `min_micro` / `max_micro` / `ttl_ms` are the DVM's sizing terms — `max_micro`
- * binds the **residual balance**, not a funding amount, so a job priced above
- * it still clears as fund-and-immediately-draw. `funding` is the rail list a
- * top-up may arrive on — a {@link FundingMethod}, not a `PaymentMethod`, since
- * `lightning` funds a credit without ever being an attached-proof wire method
- * (internal-review). It degrades per spec §4: a rail whose backing wallet is
- * unreachable drops out and the sale survives on the others.
+ * Funding options and sizing in the wire denomination. max_micro limits residual balance,
+ * not a job’s price; fund-and-draw can spend a larger payment immediately. Lightning funds
+ * credit but is not an attached-proof payment method.
  *
- * The `credit_id` / `balance_micro` / `remaining_micro` / `expiry_ms` echo
- * appears only for an authenticated caller who already holds a live credit —
- * so one round trip answers "what does this cost, and what do I have left?"
- * (spec §7).
+ * An authenticated caller’s live credit may add an echo with funded and spendable balance;
+ * pending holds are included only in the funded figure.
  */
 interface CreditMenu extends CreditTerms {
-    /**
-     * MPP instruments accepted for this credit, reusable sessions first when
-     * available.
-     *
-     * `withheld` names an instrument this DVM is configured for and is not
-     * offering at this instant, with the reason (internal-review). Two audiences read
-     * it. An agent gets to relay *why* `tempo/session` vanished instead of
-     * inferring the DVM never had it. And the platform's deploy probe reads
-     * capability from `methods ∪ withheld`, so a deploy landing during an
-     * observer blip no longer stamps `tempo_session_advertised_at` NULL and
-     * drops the DVM out of the close observer's payee fallback permanently.
-     * `methods` stays the list a caller acts on — never widen it to include a
-     * withheld instrument.
-     */
-    /**
-     * Which x402 flavours a top-up may arrive on, and the chain each rides
-     * (internal-review). Present exactly when `funding` lists `x402`. Reusable
-     * `batch-settlement` is admitted by default; one-payment `exact` appears
-     * only when the builder explicitly accepts its manual refund obligation.
-     */
-    /**
-     * Smallest funding the `lightning` rail accepts, in 1e-6 units of
-     * `currency`. Present only when `funding` lists `lightning`. This is the
-     * deployment's sats-physical receive floor (internal-review) rendered into fiat
-     * with a ×{@link LIGHTNING_FLOOR_FX_MARGIN} margin absorbing rate drift
-     * between menu fetch and funding — issuance enforces the *raw* floor at
-     * request-time rates, so funding exactly this figure always clears. Rails
-     * without an entry (cashu) have no floor beyond `min_micro`.
-     */
     /** The caller's credit this echo describes. Present only with the echo. */
     credit_id?: string;
     /** Funded balance, pending holds NOT subtracted. */
@@ -4786,7 +4288,6 @@ interface CreditMenu extends CreditTerms {
     /** Absolute expiry of the echoed credit, ms since epoch. */
     expiry_ms?: number;
 }
-/** Everything {@link buildCreditMenu} needs, assembled per request. */
 interface BuildCreditMenuArgs {
     /**
      * Which runtime is answering. `"isolate"` is refused unconditionally — see
@@ -4796,13 +4297,8 @@ interface BuildCreditMenuArgs {
     /** The DVM's resolved `credit` block; `undefined` means it didn't opt in. */
     config: ResolvedCreditConfig | undefined;
     /**
-     * Currency the menu — and the credit it funds — denominates in: the DVM's
-     * declared `DVMConfig.currency`, which every call site reads off the single
-     * `DVMServer.creditCurrency()` (internal-review). Deliberately *not* the currency of
-     * the response this menu rides on: a quote priced elsewhere is refused before
-     * it reaches here, so the two agree, and sourcing it from the response is
-     * what left `POST /v1/credit` — which has no response to read — funding in
-     * hardwired USD at a DVM whose jobs draw in something else.
+     * Use the DVM’s declared denomination, including /v1/credit where no quote response supplies
+     * it. Quote validation refuses a different denomination before menu construction.
      */
     currency: string;
     /** Rails this DVM settles over — the menu's funding options. */
@@ -4818,31 +4314,19 @@ interface BuildCreditMenuArgs {
         intent: "charge" | "session";
         reason: string;
     }[];
-    /**
-     * x402 flavours this DVM can actually accept a top-up on (internal-review) — one
-     * server read, so what the sub-block advertises is what `/v1/credit` will
-     * answer a 402 with.
-     */
     x402Schemes?: {
         scheme: string;
         network: string;
     }[];
     /**
-     * The deployment's Lightning receive floor in sats, when `lightning` is on
-     * the menu — rendered into `lightning_min_micro`. An fx failure during that
-     * rendering drops `lightning` from `funding` rather than suppressing the
-     * menu: a rail whose minimum we can't state honestly is a rail we must not
-     * advertise, but the other rails' sale survives.
+     * Configured raw receive floor in sats, rendered with an FX margin for the menu. Failure
+     * omits Lightning while allowing the rest of the menu; issuance checks the raw floor at
+     * current request-time rates.
      */
     lightningFundingMinSats?: number;
     /**
-     * Whether this DVM has at least one accepted Cashu mint configured
-     * (internal-review). Without one, no Bitcoin funding rail may be advertised — see
-     * the filter in {@link buildCreditMenu}.
-     *
-     * Read off the **configured** mint list, never the health-filtered
-     * advertised one: a mint blip must not make a funding rail appear and
-     * disappear between quotes.
+     * Read the configured accepted mint list, not its health-filtered advertisement. Non-channel
+     * Bitcoin refunds need a mint, but configuration alone does not establish refund solvency.
      */
     hasAcceptedMint?: boolean;
     fxFetcher: FxFetcher;
@@ -4855,50 +4339,18 @@ interface BuildCreditMenuArgs {
     callerPubkey?: string;
 }
 /**
- * Assemble the funding menu, or return `undefined` when this DVM must not
- * advertise credit. **The refusal ladder is the feature**; each rung exists
- * because advertising anyway would misadvertise:
- *
- * 1. **Isolate runtime** (credits spec §3) — checked first and unconditionally,
- *    before config is even read. Isolate DVMs have no Postgres of their own;
- *    their only DVM-side persistence is the last-write-wins callback KV, which
- *    spec §2 condition 2 prohibits for credit state. Until [internal-review] resolves
- *    the gate they run implicit N=1 only, and their quote simply never offers
- *    credit so nothing is misadvertised.
- * 2. **Not opted in** — no `credit` block on `configureDVM`.
- * 3. **No descriptor auth** — a credit belongs to a verified secp256k1 pubkey.
- *    Without auth the ledger's funder identity degrades to the requester id or
- *    `"anonymous"` (see `resolveLedgerContext`), which would pool every
- *    anonymous caller's money into one balance. Advertising a per-caller
- *    balance on such a DVM would be a lie at best and a disclosure at worst.
- * 4. **Non-durable ledger outside devMode** — a `MemoryCreditLedger` is
- *    per-process, so a caller funding on machine A and drawing on machine B
- *    gets `credit_not_found`. Advertise only what survives the fleet.
- * 5. **Bounds not expressible in `currency`** — an fx outage, or a currency the
- *    snapshot doesn't carry. Omit rather than quote a number we can't state.
+ * Return no menu for static ineligibility or unresolvable denomination bounds. Isolates
+ * currently lack durable credit storage; anonymous balances must not be advertised.
  *
- * The balance echo is added only when a verified `callerPubkey` holds a live,
- * same-currency credit.
- *
- * Rungs 1–4 live in {@link creditMenuConfigured}, which the capability refresh
- * reads too.
+ * Select the caller echo only from live, same-currency credits with spendable value.
  */
 declare function buildCreditMenu(args: BuildCreditMenuArgs): Promise<CreditMenu | undefined>;
 /**
- * The one credit a caller's quote echoes, from the several they may hold —
- * every implicit N=1 payment mints its own `imp:<rail>:<paymentId>` credit, so
- * this list grows with each paid job.
- *
- * Live, same-currency credits with something left in them; largest spendable
- * balance wins, newest breaks a tie. That is the credit a caller would in fact
- * draw against next. A failed job's released hold leaves a positive implicit
- * balance, which is real caller money (spec §1, no debit on failure) and is
- * echoed like any other.
+ * Choose the largest live, active, same-currency spendable balance; newest creation breaks
+ * a tie. Released implicit payments can hold reclaimable value and are eligible too.
  *
- * **Requires a verified pubkey.** Never call this with a requester id or
- * `"anonymous"`: on an auth-less DVM the ledger pools every anonymous caller
- * under one `caller_pubkey`, so echoing it would show one caller another's
- * balance.
+ * The caller supplies a verified pubkey. Anonymous/missing identity returns no credit; the
+ * ledger’s anonymous pool must not be exposed to an individual caller.
  */
 declare function selectPrimaryCredit(args: {
     ledger: CreditLedgerLike;
@@ -4906,20 +4358,15 @@ declare function selectPrimaryCredit(args: {
     currency: string;
     nowMs?: number;
 }): Promise<CreditSnapshot | undefined>;
-/** Narrow a ledger snapshot to the read-only shape a quote handler receives. */
 declare function toCreditView(snapshot: CreditSnapshot): CreditView;
 /**
- * Attach a menu to a response body when there is one. Keeps the "omit the key
- * entirely rather than emit `credit: null`" rule in one place — every consumer
- * checks presence, and the isolate tier depends on the key never appearing.
+ * Omit the credit key entirely when there is no menu; consumers use presence to determine
+ * whether credit is offered.
  */
 declare function attachCreditMenu(body: Record<string, unknown>, menu: CreditMenu | undefined): Record<string, unknown>;
 /**
- * Project a quote/402 menu onto the public, cache-safe `/v1/info` terms.
- *
- * This is an explicit whitelist rather than object rest syntax: a later
- * caller-specific field added to {@link CreditMenu} cannot cross this boundary
- * until someone deliberately adds it to {@link CreditTerms} and this copy.
+ * Explicitly whitelist public /v1/info terms. A future caller-specific menu field cannot
+ * cross this cacheable boundary merely by being added to CreditMenu.
  */
 declare function toCreditTerms(menu: CreditMenu): CreditTerms;