@dvmkit/sdk 0.3.4-rc.10 → 0.5.0-rc.1

package/dist/{chunk-UZC4A4DM.js → chunk-EYTHFFFU.js}

@@ -1,5 +1,6 @@
 import {
   MemoryProcessedPaymentStore,
+  PostgresProcessedPaymentStore,
   ProcessedPaymentReplayError
 } from "./chunk-XRLKGCAW.js";
 import {
@@ -7,13 +8,16 @@ import {
   createX402FacilitatorClient,
   settleWithFacilitator,
   verifyWithFacilitator
-} from "./chunk-BQ2NMWKE.js";
+} from "./chunk-PLG4XER6.js";
 import {
   MemoryCreditLedger
-} from "./chunk-M4QDXD2A.js";
+} from "./chunk-FYRR2UEZ.js";
 import {
   PostgresJobStore
-} from "./chunk-JDFLRNAZ.js";
+} from "./chunk-PB4FYZET.js";
+import {
+  parseStoreValue
+} from "./chunk-YG7G4DPZ.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -21,7 +25,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-CE7XEHYC.js";
+} from "./chunk-Z4KLECAC.js";
 import {
   JobCancelledError,
   MemoryJobStore,
@@ -48,7 +52,6 @@ import {
   attestedDvmIdentity,
   buildAdminChallenge,
   checkMintHealth,
-  computeResultHash,
   createMonotonicClock,
   getWallet,
   isPublicRequestId,
@@ -57,13 +60,10 @@ import {
   normaliseMintUrl,
   parseTraceparent,
   receiptPubkeyFromSecret,
-  signDrainReceipt,
-  signFundingReceipt,
-  signReceipt,
   toLockPubkey,
   verifyCashuToken,
   verifyChallenge
-} from "./chunk-VAMSJRJT.js";
+} from "./chunk-TUA7PYH7.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -77,25 +77,30 @@ import {
   encodeSettleResponseHeader,
   exactEvmAuthorization,
   paymentRequiredV2FromV1,
-  x402NetworkByCaip2,
   x402NetworkToCaip2
-} from "./chunk-Z4BNLUZF.js";
+} from "./chunk-IWQHUSMO.js";
 import {
   IMPLICIT_CREDIT_TTL_MS,
+  computeResultHash,
   formatStaleness,
   msatsToUsd,
   msatsToUsdc,
+  signDrainReceipt,
+  signFundingReceipt,
+  signReceipt,
   usdcToMsats
-} from "./chunk-A4CM2BD3.js";
+} from "./chunk-PAIM66YA.js";
 import {
   resolveRpcOverride
-} from "./chunk-MKI6OVW4.js";
+} from "./chunk-CZULM42S.js";
 import {
   RAIL_REFUNDABLE,
   canonicalRequestPath,
-  canonicalize,
   isZodSchema
-} from "./chunk-KXZUCCEY.js";
+} from "./chunk-A4YFWZ7R.js";
+import {
+  canonicalize
+} from "./chunk-OFVV37XC.js";
 import {
   StepCache,
   createConsoleLogger,
@@ -120,6 +125,7 @@ import {
   satsToFiat
 } from "./chunk-AT6V3SY7.js";
 import {
+  CreditLedger,
   CreditLedgerError,
   DRAIN_METHODS,
   PostgresX402ChannelStorage,
@@ -133,7 +139,7 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-2SD2W2BG.js";
+} from "./chunk-JH3SX3LY.js";
 import {
   withSdkInitLock
 } from "./chunk-COYKJRMM.js";
@@ -141,10 +147,18 @@ import {
   withPostgresRecoveryContext
 } from "./chunk-P6QON7ER.js";
 import {
+  x402NetworkByCaip2
+} from "./chunk-RLTSCKRI.js";
+import {
+  TEMPO_MODERATO_CHAIN_ID,
+  TEMPO_MODERATO_RPC,
   advertisedMethods,
   challengeMeta,
-  isTempoInsufficientFundsError
-} from "./chunk-4J32DTLT.js";
+  installHostedTempoChargeGuard,
+  installHostedTempoCloseGuard,
+  isTempoInsufficientFundsError,
+  resolveTempoNetwork
+} from "./chunk-IXR5RFK7.js";
 import {
   createDiagnosticCapabilityAuthority,
   diagnosticConsole
@@ -205,7 +219,7 @@ async function seedLockPubkeyRows(db, dvmId, pubkey, now) {
   }
 }
 async function loadLockPubkeyState(db, dvmId, graceMs, now = Date.now()) {
-  const { rows } = await db.query(
+  const { rows: rows2 } = await db.query(
     `SELECT pubkey, retired_at_ms
        FROM dvm_lock_pubkeys
        WHERE dvm_id = $1
@@ -215,7 +229,7 @@ async function loadLockPubkeyState(db, dvmId, graceMs, now = Date.now()) {
   );
   let current = null;
   const retired = [];
-  for (const r of rows) {
+  for (const r of rows2) {
     if (r.retired_at_ms == null) {
       current = toLockPubkey(r.pubkey);
     } else {
@@ -234,19 +248,19 @@ async function rotateLockPubkey(db, dvmId, newPubkey, graceMs, now = Date.now())
   const client = await db.connect();
   try {
     await client.query("BEGIN");
-    const { rows } = await client.query(
+    const { rows: rows2 } = await client.query(
       `SELECT pubkey FROM dvm_lock_pubkeys
          WHERE dvm_id = $1 AND retired_at_ms IS NULL
          FOR UPDATE`,
       [dvmId]
     );
-    if (rows.length === 0) {
+    if (rows2.length === 0) {
       await client.query("ROLLBACK");
       throw new Error(
         `dvm_lock_pubkeys: cannot rotate dvm_id=${dvmId} \u2014 no current pubkey exists.`
       );
     }
-    if (rows[0].pubkey === normalised) {
+    if (rows2[0].pubkey === normalised) {
       await client.query("ROLLBACK");
       return await loadLockPubkeyState(db, dvmId, graceMs, now);
     }
@@ -356,10 +370,10 @@ async function createWalletAccumulatorTable(db) {
   await db.query(`ALTER TABLE wallet_accumulator DROP COLUMN IF EXISTS spend_authorization;`);
 }
 async function backfillProofSecretHash(db) {
-  const { rows } = await db.query(
+  const { rows: rows2 } = await db.query(
     `SELECT id, proof_secret FROM wallet_accumulator WHERE proof_secret_hash IS NULL`
   );
-  for (const r of rows) {
+  for (const r of rows2) {
     await db.query(`UPDATE wallet_accumulator SET proof_secret_hash = $2 WHERE id = $1`, [
       r.id,
       hashProofSecret(r.proof_secret)
@@ -393,24 +407,24 @@ async function insertAccumulatorRows(db, args) {
   }
 }
 async function listPendingBatches(db, dvmId) {
-  const { rows } = await db.query(
+  const { rows: rows2 } = await db.query(
     `SELECT id, lock_pubkey, mint_url, proof_keyset_id, proof_secret, proof_c, proof_amount, proof_dleq, received_at, melt_quote_id, t_expire
        FROM wallet_accumulator
        WHERE dvm_id = $1 AND melted_at IS NULL AND melt_status IS NULL
        ORDER BY t_expire ASC NULLS LAST, lock_pubkey, mint_url, received_at ASC`,
     [dvmId]
   );
-  return groupRowsIntoBatches(rows);
+  return groupRowsIntoBatches(rows2);
 }
 async function fetchRowsForMelt(db, dvmId, rowIds) {
   if (rowIds.length === 0) return [];
-  const { rows } = await db.query(
+  const { rows: rows2 } = await db.query(
     `SELECT id, mint_url, proof_keyset_id, proof_secret, proof_c, proof_amount, melt_status
        FROM wallet_accumulator
        WHERE dvm_id = $1 AND id = ANY($2::text[])`,
     [dvmId, rowIds]
   );
-  return rows.map((r) => ({
+  return rows2.map((r) => ({
     id: r.id,
     mintUrl: r.mint_url,
     proofKeysetId: r.proof_keyset_id,
@@ -541,9 +555,9 @@ async function insertRows(q, args) {
   }
   return inserted;
 }
-function groupRowsIntoBatches(rows) {
+function groupRowsIntoBatches(rows2) {
   const groups = /* @__PURE__ */ new Map();
-  for (const r of rows) {
+  for (const r of rows2) {
     const key = JSON.stringify([r.lock_pubkey, r.mint_url, r.melt_quote_id ?? null]);
     const rowTExpire = r.t_expire == null ? null : Number(r.t_expire);
     let batch = groups.get(key);
@@ -1258,6 +1272,7 @@ import {
   BatchSettlementEvmScheme as BatchSettlementEvmScheme2,
   InMemoryChannelStorage
 } from "@x402/evm/batch-settlement/server";
+import { computeChannelId } from "@x402/evm/batch-settlement/client";
 import { createPublicClient as createPublicClient3, http as http3 } from "viem";
 import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
 
@@ -1590,12 +1605,12 @@ async function findExactPayment(client, intent) {
   );
   for (const log of logs) {
     if (!log.transactionHash) continue;
-    const transaction = await client.getTransaction({ hash: log.transactionHash });
-    if (!transaction.to || !isAddressEqual(transaction.to, getAddress(intent.asset))) continue;
+    const transaction2 = await client.getTransaction({ hash: log.transactionHash });
+    if (!transaction2.to || !isAddressEqual(transaction2.to, getAddress(intent.asset))) continue;
     try {
       const decoded = decodeFunctionData({
         abi: EXACT_SETTLEMENT_CALL_ABI,
-        data: transaction.input
+        data: transaction2.input
       });
       const [from, to, value, validAfter, validBefore, nonce] = decoded.args;
       if (isAddressEqual(from, getAddress(intent.from)) && isAddressEqual(to, getAddress(intent.to)) && value === BigInt(intent.value) && validAfter === BigInt(intent.validAfter) && validBefore === BigInt(intent.validBefore) && nonce.toLowerCase() === intent.nonce.toLowerCase()) {
@@ -1650,12 +1665,12 @@ async function findAppliedSettlement(client, intent) {
       authorizationLogs.flatMap((log) => log.transactionHash ? [log.transactionHash] : [])
     );
     for (const log of depositLogs) {
-      const transaction = log.transactionHash;
-      if (!transaction || !authorizationTransactions.has(transaction)) continue;
+      const transaction2 = log.transactionHash;
+      if (!transaction2 || !authorizationTransactions.has(transaction2)) continue;
       const amount = logAmount(log);
       if (amount !== BigInt(raw.deposit.amount)) continue;
-      if (await transactionMatchesDeposit(client, transaction, intent)) {
-        return { transaction, amount: amount.toString() };
+      if (await transactionMatchesDeposit(client, transaction2, intent)) {
+        return { transaction: transaction2, amount: amount.toString() };
       }
     }
     return void 0;
@@ -1672,11 +1687,11 @@ async function findAppliedSettlement(client, intent) {
       toBlock
     );
     for (const log of refundLogs) {
-      const transaction = log.transactionHash;
+      const transaction2 = log.transactionHash;
       const amount = logAmount(log);
-      if (!transaction || amount === void 0) continue;
-      if (await transactionMatchesRefund(client, transaction, intent)) {
-        return { transaction, amount: amount.toString() };
+      if (!transaction2 || amount === void 0) continue;
+      if (await transactionMatchesRefund(client, transaction2, intent)) {
+        return { transaction: transaction2, amount: amount.toString() };
       }
     }
   }
@@ -1691,10 +1706,10 @@ async function getLogsInChunks(client, query, fromBlock, toBlock) {
   return logs;
 }
 async function transactionMatchesDeposit(client, transactionHash, intent) {
-  const transaction = await client.getTransaction({ hash: transactionHash });
-  if (!transaction.to || !isAddressEqual(transaction.to, BATCH_SETTLEMENT_ADDRESS)) return false;
+  const transaction2 = await client.getTransaction({ hash: transactionHash });
+  if (!transaction2.to || !isAddressEqual(transaction2.to, BATCH_SETTLEMENT_ADDRESS)) return false;
   try {
-    const decoded = decodeFunctionData({ abi: BATCH_SETTLEMENT_CALL_ABI, data: transaction.input });
+    const decoded = decodeFunctionData({ abi: BATCH_SETTLEMENT_CALL_ABI, data: transaction2.input });
     if (decoded.functionName !== "deposit") return false;
     const [config, amount, collector] = decoded.args;
     const raw = intent.payload.payload;
@@ -1704,9 +1719,9 @@ async function transactionMatchesDeposit(client, transactionHash, intent) {
   }
 }
 async function transactionMatchesRefund(client, transactionHash, intent) {
-  const transaction = await client.getTransaction({ hash: transactionHash });
-  if (!transaction.to || !isAddressEqual(transaction.to, BATCH_SETTLEMENT_ADDRESS)) return false;
-  return calldataMatchesRefund(transaction.input, intent);
+  const transaction2 = await client.getTransaction({ hash: transactionHash });
+  if (!transaction2.to || !isAddressEqual(transaction2.to, BATCH_SETTLEMENT_ADDRESS)) return false;
+  return calldataMatchesRefund(transaction2.input, intent);
 }
 function calldataMatchesRefund(data, intent) {
   try {
@@ -1850,6 +1865,77 @@ var X402SettlementSubmissionError = class extends Error {
   code = "x402_settlement_submission_failed";
   retryable = true;
 };
+function hostedSettlementFacilitator(facilitator, obligations, network) {
+  return new Proxy(facilitator, {
+    get(target, property, receiver) {
+      if (property !== "settle") {
+        const value = Reflect.get(target, property, receiver);
+        return typeof value === "function" ? value.bind(target) : value;
+      }
+      return async (payment, requirements) => {
+        const payload = payment.payload;
+        const reservations = [];
+        if (payload.type === "claim") {
+          if (!Array.isArray(payload.claims) || !payload.claims.length) {
+            throw new Error("Hosted x402 claim has no selected vouchers");
+          }
+          for (const raw of payload.claims) {
+            const claim = raw;
+            if (!claim.voucher?.channel || !claim.signature || !claim.totalClaimed) {
+              throw new Error("Hosted x402 claim lacks original voucher identity");
+            }
+            const channelId = computeChannelId(claim.voucher.channel, network);
+            const reservation = await obligations.reserveX402(channelId, "claim", {
+              charged: claim.totalClaimed,
+              signature: claim.signature,
+              signedMax: String(claim.voucher.maxClaimableAmount),
+              authorizationPayload: payload,
+              authorizationRequirements: requirements
+            });
+            if (!reservation) throw new Error("Hosted x402 selected voucher is not claimable");
+            if (reservation.replayed) throw new Error("Hosted x402 claim already has an original effect attempt");
+            reservations.push(reservation);
+          }
+        } else if (payload.type === "refund") {
+          const config = payload.channelConfig;
+          if (!config || typeof payload.refundNonce !== "string" || typeof payload.amount !== "string") {
+            throw new Error("Hosted x402 refund lacks original channel identity");
+          }
+          const channelId = computeChannelId(config, network);
+          const claims = payload.claims;
+          if (!Array.isArray(claims) || claims.length > 1 || claims.some((raw) => {
+            const claim = raw;
+            return !claim.voucher?.channel || computeChannelId(claim.voucher.channel, network).toLowerCase() !== channelId.toLowerCase();
+          })) {
+            throw new Error("Hosted x402 refund contains an unbound claim");
+          }
+          const reservation = await obligations.reserveX402(channelId, "refund", {
+            refundNonce: payload.refundNonce,
+            refundAmount: payload.amount,
+            voucherSignature: String(payload.voucher?.signature),
+            signedMax: String(payload.voucher?.maxClaimableAmount),
+            authorizationPayload: payload,
+            authorizationRequirements: requirements
+          });
+          if (!reservation) throw new Error("Hosted x402 selected channel is not refundable");
+          if (reservation.replayed) throw new Error("Hosted x402 refund already has an original effect attempt");
+          reservations.push(reservation);
+        } else if (payload.type === "settle") {
+          const reservation = await obligations.reserveOpenX402Settlement();
+          if (reservation.replayed) throw new Error("Hosted x402 settle already has an original effect attempt");
+          reservations.push(reservation);
+        }
+        const response = await target.settle(payment, requirements);
+        if (response.success && reservations.length) {
+          for (const reservation of reservations) {
+            await obligations.recordSubmitted(reservation.id, response.transaction);
+          }
+        }
+        return response;
+      };
+    }
+  });
+}
 async function createX402BatchSettlementServer(opts) {
   const selfRelayEnabled = !!opts.config.selfRelay;
   if (selfRelayEnabled && opts.network !== X402_BATCH_SETTLEMENT_MAINNET_NETWORK) {
@@ -1897,6 +1983,9 @@ async function createX402BatchSettlementServer(opts) {
     }
     storage = new InMemoryChannelStorage();
   }
+  if (postgres && opts.hostedObligations) {
+    opts.hostedObligations.attachX402SettlementStore(postgres);
+  }
   const selfRelayActive = selfRelayEnabled && !opts.config.facilitatorClient;
   const relayLockOwner = selfRelayActive ? postgres ?? (opts.db ? new PostgresX402ChannelStorage(opts.db) : void 0) : void 0;
   if (selfRelayActive && !relayLockOwner && !opts.allowInMemory) {
@@ -1919,6 +2008,7 @@ async function createX402BatchSettlementServer(opts) {
     ...opts.facilitatorAuth ? { facilitatorAuth: opts.facilitatorAuth } : {}
   });
   const facilitator = opts.supportedResponse && !selfRelayEnabled ? withCachedSupportedResponse(rawFacilitator, opts.supportedResponse) : rawFacilitator;
+  const settlementFacilitator = opts.hostedObligations ? hostedSettlementFacilitator(facilitator, opts.hostedObligations, opts.network) : facilitator;
   const rpcUrl = opts.rpcUrl ?? opts.config.rpcUrl;
   const settlementEvidence = opts.settlementEvidenceReader ?? await createX402SettlementEvidenceReader({
     network: opts.network,
@@ -1934,7 +2024,7 @@ async function createX402BatchSettlementServer(opts) {
     withdrawDelay,
     ...opts.config.onchainStateTtlMs !== void 0 ? { onchainStateTtlMs: opts.config.onchainStateTtlMs } : {}
   });
-  const resource = new x402ResourceServer(facilitator).register(
+  const resource = new x402ResourceServer(settlementFacilitator).register(
     opts.network,
     scheme
   );
@@ -1943,7 +2033,7 @@ async function createX402BatchSettlementServer(opts) {
   if (!network) throw new Error(`No USDC contract configured for ${opts.network}`);
   const token = network.usdc;
   const manager = scheme.createChannelManager(
-    facilitator,
+    settlementFacilitator,
     opts.network,
     token
   );
@@ -2044,6 +2134,15 @@ async function createX402BatchSettlementServer(opts) {
           requirements
         };
       }
+      if (args.operation === "fund" && postgres) {
+        if (args.hostingFunding && args.effectId !== `${args.hostingFunding.creditId}:${args.hostingFunding.fundId}`) {
+          throw new Error("x402 funding effect conflicts with its hosted admission");
+        }
+        if (args.hostingFunding && createHash3("sha256").update(args.paymentHeader).digest("hex") !== args.hostingFunding.paymentArtifactHash) {
+          throw new Error("x402 payment differs from its hosted admission artifact");
+        }
+        await postgres.assertHostingFundingReservation(args.hostingFunding);
+      }
       if (isRefund && raw.amount !== void 0) {
         return {
           ok: false,
@@ -2258,7 +2357,7 @@ async function createX402BatchSettlementServer(opts) {
             requirements: matched,
             channelBefore: channelBeforeVerify ?? reserved,
             ...pendingId ? { pendingId } : {}
-          });
+          }, args.hostingFunding);
           if (intent.status === "settled" && intent.response) {
             const value = await recoverSettledPayment({
               postgres,
@@ -2315,7 +2414,7 @@ async function createX402BatchSettlementServer(opts) {
           throw error;
         }
       };
-      const result = postgres ? await postgres.withChannelTransaction(funding.channelId, (tx) => guarded(tx)) : await withLocalChannelLock(inMemoryChannelTails, funding.channelId, () => guarded());
+      const result = postgres ? await postgres.withChannelTransaction(funding.channelId, (tx) => guarded(tx), args.hostingFunding) : await withLocalChannelLock(inMemoryChannelTails, funding.channelId, () => guarded());
       if ("withdrawalPending" in result) {
         try {
           const claim = async () => {
@@ -2339,6 +2438,18 @@ async function createX402BatchSettlementServer(opts) {
         }
         return correctiveRefusal(resource, requirements, payload, "withdrawal_pending");
       }
+      if (isRefund && opts.hostedObligations && result.ok) {
+        const delta = await opts.hostedObligations.refundClaimDelta(
+          result.value.settlement.transaction,
+          funding.channelId
+        );
+        if (delta > 0n) {
+          if (!opts.payout?.recordRefundClaim) {
+            throw new Error("Hosted x402 refund claim has no durable payout tracker");
+          }
+          await opts.payout.recordRefundClaim(result.value.settlement.transaction, delta);
+        }
+      }
       return result;
     },
     getChannel: (channelId) => storage.get(channelId),
@@ -2514,11 +2625,11 @@ function createSettlementRepair(postgres, storage, facilitator, evidenceReader)
       if (args.evidence === false) {
         return { settlements: page.settlements.map((intent) => ({ intent })), ...nextAfter };
       }
-      const rows = [];
+      const rows2 = [];
       for (const intent of page.settlements) {
-        rows.push({ intent, evidence: await classifySettlementEvidence(evidenceReader, intent) });
+        rows2.push({ intent, evidence: await classifySettlementEvidence(evidenceReader, intent) });
       }
-      return { settlements: rows, ...nextAfter };
+      return { settlements: rows2, ...nextAfter };
     },
     async reconcile(args) {
       const nowMs = args.nowMs ?? Date.now();
@@ -3084,13 +3195,13 @@ function methodNativeAmountFromDecimal(amountStr, methodName) {
   return Math.round(parseFloat(amountStr) * 10 ** decimalsFor(methodName));
 }
 function methodNativeAmountToDecimal(amount, methodName) {
-  const nativeAmount = BigInt(amount);
-  if (nativeAmount < 0n) {
+  const nativeAmount2 = BigInt(amount);
+  if (nativeAmount2 < 0n) {
     throw new Error("mpp-units: amount must be non-negative");
   }
   const decimals = decimalsFor(methodName);
   const scale = 10n ** BigInt(decimals);
-  return `${nativeAmount / scale}.${(nativeAmount % scale).toString().padStart(decimals, "0")}`;
+  return `${nativeAmount2 / scale}.${(nativeAmount2 % scale).toString().padStart(decimals, "0")}`;
 }
 
 // src/sdk/server/wallet-accumulator-receive.ts
@@ -3535,6 +3646,9 @@ async function verifyUpfrontPayment(opts) {
     if (!ledgerCtx?.fundOnly?.creditId) {
       throw new Error("x402 batch settlement requires a named credit funding effect");
     }
+    if (ledgerCtx.hostingAdmissionId && !ledgerCtx.hostingPaymentArtifactHash) {
+      throw new Error("Hosted x402 funding lacks its original payment artifact");
+    }
     const requiredUsdcMicro = x402RequiredUsdcMicro(x402PriceFiat);
     try {
       const accepted = await opts.x402BatchSettlement.accept({
@@ -3542,6 +3656,16 @@ async function verifyUpfrontPayment(opts) {
         amount: String(requiredUsdcMicro),
         operation: "fund",
         effectId: `${ledgerCtx.fundOnly.creditId}:${ledgerCtx.fundOnly.fundId}`,
+        ...ledgerCtx.hostingAdmissionId && {
+          hostingFunding: {
+            admissionId: ledgerCtx.hostingAdmissionId,
+            creditId: ledgerCtx.fundOnly.creditId,
+            fundId: ledgerCtx.fundOnly.fundId,
+            callerPubkey: ledgerCtx.callerId,
+            commitment: ledgerCtx.fundOnly.commitment,
+            paymentArtifactHash: ledgerCtx.hostingPaymentArtifactHash ?? ""
+          }
+        },
         commit: async (funding, tx) => {
           return commitMarkedFunding(
             ledgerCtx,
@@ -3655,7 +3779,7 @@ async function verifyUpfrontPayment(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-S47Q77UE.js");
+      const { verifyX402Payment } = await import("./x402-R6HPBY5D.js");
       const receipt = await verifyX402Payment(
         x402Payment,
         x402Config,
@@ -3824,8 +3948,21 @@ async function verifyUpfrontPayment(opts) {
             challenge_id: cred.challenge.id,
             amount: expectedAmount
           },
-          () => mpp.broadcastCredential(cred, {
+          () => mpp.broadcastCredential(mppCredential, {
             request: { amount: expectedAmount },
+            ...opts.hostingAdmissionId && {
+              hostedPaymentIntent: {
+                admissionId: opts.hostingAdmissionId,
+                jobId: opts.jobId,
+                paymentArtifactHash: opts.hostingPaymentArtifactHash,
+                ...ledgerCtx?.fundOnly && {
+                  creditId: ledgerCtx.fundOnly.creditId,
+                  fundId: ledgerCtx.fundOnly.fundId,
+                  callerPubkey: ledgerCtx.callerId,
+                  fundingCommitment: ledgerCtx.fundOnly.commitment
+                }
+              }
+            },
             meta: {
               path: resourcePath ?? "/v1/job",
               nonce: challengeMeta(cred.challenge)?.nonce ?? ""
@@ -3846,11 +3983,25 @@ async function verifyUpfrontPayment(opts) {
           nativeAsset: methodNativeAsset(cred.challenge.method)
         };
         try {
+          if (ledgerCtx.hostingAdmissionId && ledgerCtx.fundOnly && !ledgerCtx.hostingPaymentArtifactHash) {
+            throw new Error("Hosted Tempo funding lacks its original payment artifact");
+          }
+          const voucherAcceptance = {
+            channelId: sessionBasis.channelId,
+            cumulativeAmount: BigInt(sessionBasis.cumulativeAmount),
+            ...ledgerCtx.hostingAdmissionId && ledgerCtx.fundOnly && {
+              hostingFunding: {
+                admissionId: ledgerCtx.hostingAdmissionId,
+                creditId: ledgerCtx.fundOnly.creditId,
+                fundId: ledgerCtx.fundOnly.fundId,
+                callerPubkey: ledgerCtx.callerId,
+                commitment: ledgerCtx.fundOnly.commitment,
+                paymentArtifactHash: ledgerCtx.hostingPaymentArtifactHash ?? ""
+              }
+            }
+          };
           const accepted = await mpp.withTempoSessionAcceptance(
-            {
-              channelId: sessionBasis.channelId,
-              cumulativeAmount: BigInt(sessionBasis.cumulativeAmount)
-            },
+            voucherAcceptance,
             async (tx, voucher) => {
               const binding = await mpp.getTempoSessionBinding?.(sessionBasis.channelId);
               if (binding) {
@@ -3954,6 +4105,11 @@ async function verifyUpfrontPayment(opts) {
           CONSUMED_CREDENTIAL_TTL_MS / 1e3
         );
       }
+      if (credited) {
+        await mpp.completeHostedTempoCharge?.(cred.challenge.id).catch((error) => {
+          console.warn("Hosted Tempo charge completion remains unresolved", error);
+        });
+      }
       if (credited?.drawRefusal) {
         return creditLedgerErrorResult(credited.drawRefusal, x402Requirements, credited.deposit);
       }
@@ -4001,7 +4157,9 @@ async function verifyUpfrontPayment(opts) {
         creditId: creditEnv.creditId,
         drawId: creditEnv.drawId,
         amountMicro: ledgerCtx.priceFiat.amountMicro,
-        jobId: ledgerCtx.jobId
+        jobId: ledgerCtx.jobId,
+        hostingAdmissionId: ledgerCtx.hostingAdmissionId,
+        hostingPaymentSeq: ledgerCtx.hostingPaymentSeq
       });
       if (draw.replayed) {
         const rec = await ledgerCtx.ledger.getDraw({
@@ -4140,8 +4298,7 @@ async function verifyTempoSessionManagementCredential(args) {
   if (typeof challengeAmount !== "string" && typeof challengeAmount !== "bigint") {
     throw new Error("Tempo session challenge has an invalid amount");
   }
-  await args.onBound?.();
-  const receipt = await args.mpp.broadcastCredential(credential, {
+  const verifyOptions = {
     request: {
       amount: methodNativeAmountToDecimal(challengeAmount, credential.challenge.method)
     },
@@ -4149,7 +4306,15 @@ async function verifyTempoSessionManagementCredential(args) {
       path: args.resourcePath,
       nonce: challengeMeta(credential.challenge)?.nonce ?? ""
     }
-  });
+  };
+  if (args.preflightBeforeBound) {
+    if (!args.mpp.validateCredential) {
+      throw new Error("Hosted Tempo close requires non-mutating credential validation");
+    }
+    await args.mpp.validateCredential(credential, verifyOptions);
+  }
+  await args.onBound?.();
+  const receipt = await args.mpp.broadcastCredential(credential, verifyOptions);
   const sessionReceipt = receipt;
   return {
     reference: typeof sessionReceipt.txHash === "string" ? sessionReceipt.txHash : receipt.reference,
@@ -4589,7 +4754,7 @@ async function verifyIncomingPayment(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-S47Q77UE.js");
+      const { verifyX402Payment } = await import("./x402-R6HPBY5D.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -4755,6 +4920,9 @@ async function verifyIncomingPayment(body, opts, snapshot) {
         },
         () => mppServer.broadcastCredential(credential, {
           request: { amount: expectedAmount },
+          ...opts.hostingPaymentSeq !== void 0 && {
+            hostedPaymentIntent: { jobId: opts.jobId, paymentSeq: opts.hostingPaymentSeq }
+          },
           ...expectedMeta && { meta: expectedMeta }
         })
       );
@@ -4770,6 +4938,11 @@ async function verifyIncomingPayment(body, opts, snapshot) {
           throw err;
         }
       }
+      if (credited) {
+        await mppServer.completeHostedTempoCharge?.(credential.challenge.id).catch((error) => {
+          console.warn("Hosted Tempo charge completion remains unresolved", error);
+        });
+      }
       const info = withDrawBasis(
         {
           paidMsats: expectedMsats,
@@ -5006,7 +5179,7 @@ async function processIncomingPayment(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-S47Q77UE.js");
+      const { verifyX402Payment } = await import("./x402-R6HPBY5D.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5083,6 +5256,9 @@ async function processIncomingPayment(job, body, opts) {
         },
         () => mppHandle.broadcastCredential(credential, {
           request: { amount: expectedAmount },
+          ...opts.hostingPaymentSeq !== void 0 && {
+            hostedPaymentIntent: { jobId: opts.jobId, paymentSeq: opts.hostingPaymentSeq }
+          },
           ...expectedMeta && { meta: expectedMeta }
         })
       );
@@ -5106,6 +5282,9 @@ async function processIncomingPayment(job, body, opts) {
       job.paymentRail = "tempo";
       job.pendingMppChallengeIds = void 0;
       creditPendingPayment(job);
+      await mppHandle.completeHostedTempoCharge?.(credential.challenge.id).catch((error) => {
+        console.warn("Hosted Tempo charge completion remains unresolved", error);
+      });
     } catch (err) {
       logCredentialRejected("tempo", "mid-job", err);
       return {
@@ -5357,6 +5536,8 @@ function resolveLedgerContext(opts) {
     requiredMsats: opts.requiredMsats,
     callerId: opts.callerPubkey ?? opts.requesterId ?? "anonymous",
     jobId: opts.jobId,
+    hostingAdmissionId: opts.hostingAdmissionId,
+    hostingPaymentArtifactHash: opts.hostingPaymentArtifactHash,
     jobAdmission: opts.jobId && opts.requestFingerprint ? {
       requestFingerprint: opts.requestFingerprint,
       authFingerprint: opts.requestAuthFingerprint
@@ -5477,6 +5658,7 @@ async function resolveTopUpLedgerContext(opts, snapshot, binding) {
     requiredMsats: priceBasisMsats,
     callerId,
     jobId: opts.jobId,
+    hostingPaymentSeq: opts.hostingPaymentSeq,
     dvmId,
     topUp,
     topUpCapMicro,
@@ -5650,11 +5832,15 @@ async function fundAndDraw(ctx, funding, tx) {
       fundId: ctx.fundOnly.fundId,
       amountMicro: fundedMicro,
       rail: funding.rail,
+      hostingAdmissionId: ctx.hostingAdmissionId,
+      hostingCallerPubkey: ctx.callerId,
       tx
     });
     const credit = await ctx.ledger.fund({
       creditId: creditId2,
       callerPubkey: ctx.callerId,
+      hostingAdmissionId: ctx.hostingAdmissionId,
+      hostingFundId: ctx.fundOnly.fundId,
       currency: ctx.priceFiat.currency,
       amountMicro: fundedMicro,
       expiryMs,
@@ -5676,6 +5862,9 @@ async function fundAndDraw(ctx, funding, tx) {
     const credit = await ctx.ledger.fund({
       creditId: creditId2,
       callerPubkey: ctx.callerId,
+      hostingJobId: ctx.jobId,
+      hostingAdmissionId: ctx.hostingAdmissionId,
+      hostingPaymentSeq: ctx.hostingPaymentSeq,
       currency: ctx.priceFiat.currency,
       amountMicro: fundedMicro,
       expiryMs,
@@ -5727,12 +5916,18 @@ async function fundAndDraw(ctx, funding, tx) {
       fundId: funding.paymentId,
       amountMicro: fundedMicro,
       rail: funding.rail,
+      hostingAdmissionId: ctx.hostingAdmissionId,
+      hostingJobId: ctx.jobId,
+      hostingPaymentSeq: ctx.hostingPaymentSeq,
       tx
     });
   }
   const fundedCredit = await ctx.ledger.fund({
     creditId,
     callerPubkey: ctx.callerId,
+    hostingJobId: ctx.jobId,
+    hostingAdmissionId: ctx.hostingAdmissionId,
+    hostingPaymentSeq: ctx.hostingPaymentSeq,
     currency: ctx.priceFiat.currency,
     amountMicro: fundedMicro,
     expiryMs,
@@ -5747,6 +5942,8 @@ async function fundAndDraw(ctx, funding, tx) {
       drawId,
       amountMicro: drawMicro,
       jobId: ctx.jobId,
+      hostingAdmissionId: ctx.hostingAdmissionId,
+      hostingPaymentSeq: ctx.hostingPaymentSeq,
       tx
     });
   } catch (err) {
@@ -5837,6 +6034,8 @@ async function repairX402ExactSettlementEffect(args) {
     callerId: effect.callerId,
     dvmId: effect.dvmId,
     jobId: effect.jobId,
+    hostingAdmissionId: effect.hostingAdmissionId,
+    hostingPaymentSeq: effect.hostingPaymentSeq,
     jobAdmission: effect.jobAdmission,
     creditEnvelope: effect.creditEnvelope,
     fundOnly: effect.fundOnly,
@@ -5984,6 +6183,8 @@ function exactSettlementEffect(ctx, funding) {
     callerId: ctx.callerId,
     dvmId: ctx.dvmId,
     jobId: ctx.jobId,
+    hostingAdmissionId: ctx.hostingAdmissionId,
+    hostingPaymentSeq: ctx.hostingPaymentSeq,
     jobAdmission: ctx.jobAdmission,
     creditEnvelope: ctx.creditEnvelope,
     fundOnly: ctx.fundOnly,
@@ -7111,6 +7312,7 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
   }
   const beginClose = rail.mpp.beginTempoSessionClose.bind(rail.mpp);
   let recoveryVersion;
+  let hostedObligationId;
   try {
     const closed = await verifyTempoSessionManagementCredential({
       credential: rail.mppCredential,
@@ -7118,13 +7320,30 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
       resourcePath: c.req.path,
       action: "close",
       expectedChannelId,
+      preflightBeforeBound: !!deps.hostedSettlementReports,
       // Reassert the intent only after the verifier binds the credential to this channel, and
       // before broadcast. A wrong-channel signature cannot create or cancel its close intent.
       onBound: async () => {
         await beginClose(expectedChannelId, record.drainId);
         recoveryVersion = await deps.tempoSettlementReadiness?.captureRecoveryVersion();
+        if (deps.hostedSettlementReports) {
+          const reserved = await deps.hostedSettlementReports.reserveTempo(
+            expectedChannelId,
+            "close",
+            record.drainId
+          );
+          if (reserved.replayed) throw new Error("Hosted Tempo close already has an original effect attempt");
+          hostedObligationId = reserved.id;
+          if (!rail.mpp?.permitHostedTempoClose) {
+            throw new Error("Hosted Tempo close credential guard is unavailable");
+          }
+          rail.mpp.permitHostedTempoClose(rail.mppCredential, reserved.id);
+        }
       }
     });
+    if (hostedObligationId) {
+      await deps.hostedSettlementReports?.recordSubmitted(hostedObligationId, closed.reference);
+    }
     const reference = await rail.mpp.confirmTempoSessionClose(
       expectedChannelId,
       record.drainId,
@@ -8572,9 +8791,9 @@ async function handleMarkMelted(c, opts) {
       400
     );
   }
-  const rows = await fetchRowsForMelt(opts.db, opts.dvmId, rowIds);
-  if (rows.length !== rowIds.length) {
-    const found = new Set(rows.map((r) => r.id));
+  const rows2 = await fetchRowsForMelt(opts.db, opts.dvmId, rowIds);
+  if (rows2.length !== rowIds.length) {
+    const found = new Set(rows2.map((r) => r.id));
     return c.json(
       {
         error: "rows_not_found",
@@ -8584,7 +8803,7 @@ async function handleMarkMelted(c, opts) {
       404
     );
   }
-  const alreadyMelted = rows.filter((r) => r.meltStatus === "melted").map((r) => r.id);
+  const alreadyMelted = rows2.filter((r) => r.meltStatus === "melted").map((r) => r.id);
   if (alreadyMelted.length > 0) {
     return c.json(
       {
@@ -8596,7 +8815,7 @@ async function handleMarkMelted(c, opts) {
     );
   }
   const byMint = /* @__PURE__ */ new Map();
-  for (const row of rows) {
+  for (const row of rows2) {
     const list = byMint.get(row.mintUrl);
     if (list) list.push(row);
     else byMint.set(row.mintUrl, [row]);
@@ -8660,7 +8879,7 @@ async function handleMarkMelted(c, opts) {
     if (opts.onMelted) {
       await opts.onMelted.enqueue(
         {
-          rows: rows.map((r) => ({ id: r.id, mintUrl: r.mintUrl, proofAmount: r.proofAmount })),
+          rows: rows2.map((r) => ({ id: r.id, mintUrl: r.mintUrl, proofAmount: r.proofAmount })),
           meltQuoteId,
           paymentPreimage
         },
@@ -9064,34 +9283,1552 @@ function decodeAndDescribe(args) {
     intentId: hash([facts.network, facts.asset, facts.from, facts.nonce])
   };
 }
-function receiptFromIntent(intent, btcUsdRate) {
-  const amountUsdcMicro = Number.parseInt(intent.value, 10);
-  const response = intent.settleResponse ?? {
-    success: true,
-    transaction: intent.transaction
+function receiptFromIntent(intent, btcUsdRate) {
+  const amountUsdcMicro = Number.parseInt(intent.value, 10);
+  const response = intent.settleResponse ?? {
+    success: true,
+    transaction: intent.transaction
+  };
+  return {
+    verified: true,
+    amountMsats: btcUsdRate > 0 ? usdcToMsats(amountUsdcMicro / 1e6, btcUsdRate) : 0,
+    amountUsdcMicro,
+    txHash: intent.transaction,
+    settleResponseHeader: encodeSettleResponseHeader(response)
+  };
+}
+function settlementMayHaveMoved(response) {
+  const reason = response.errorReason?.toLowerCase() ?? "";
+  return reason.includes("authorization_already_used") || reason.includes("authorization already used") || /facilitator_status_5\d\d/.test(reason);
+}
+function hash(parts) {
+  return createHash4("sha256").update(JSON.stringify(parts)).digest("hex");
+}
+function safeError(err) {
+  if (err instanceof Error) return err.name;
+  return "settlement_transport_error";
+}
+
+// src/sdk/server/hosting-control.ts
+import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
+
+// src/sdk/server/hosting-cleanup-fence.ts
+var HostingCleanupFence = class {
+  constructor(pool, dvmId, scope) {
+    this.pool = pool;
+    this.dvmId = dvmId;
+    this.scope = scope;
+  }
+  pool;
+  dvmId;
+  scope;
+  async assertNewIntent(tx, intent) {
+    const continuation = intent?.admissionId || intent?.paymentSeq !== void 0 || intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash || intent?.creditId && intent.fundId && intent.callerPubkey;
+    const { rows: rows2 } = await tx.query(
+      `SELECT state, closed_at_ms, closed_at_us FROM sdk_hosting_control
+       WHERE dvm_id=$1 AND scope=$2 ${continuation ? "" : "FOR UPDATE"}`,
+      [this.dvmId, this.scope]
+    );
+    const control = rows2[0];
+    if (!control) throw new Error("Hosted obligation fence is unavailable");
+    if (control.state === "closed" && (control.closed_at_ms === null || control.closed_at_us === null)) {
+      throw new Error("Hosted closure cutoff is unavailable");
+    }
+    if (control.state !== "closed" && !continuation) return;
+    if (intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash) {
+      const repair = !!intent.invoiceRepairPaymentHash;
+      const invoice = await tx.query(
+        `SELECT i.payment_hash FROM credit_invoices i
+         LEFT JOIN sdk_hosting_admissions a ON a.id=i.hosting_admission_id
+         WHERE i.payment_hash=$1 AND i.caller_pubkey=$4 AND i.amount_micro=$5
+           AND (($10::boolean AND $3=i.payment_hash AND i.status IN ('blocked','written_off'))
+             OR (NOT $10::boolean AND i.credit_id=$2 AND i.fund_id=$3 AND i.status='pending'))
+           AND ((i.hosting_admission_id IS NULL AND
+                 ($9::bigint IS NULL OR i.created_at_db_us <= $9)) OR
+             (a.dvm_id=$6 AND a.scope=$7 AND a.credit_id=i.credit_id
+              AND a.fund_id=i.fund_id AND a.caller_pubkey=i.caller_pubkey
+              AND a.outcome IN ('pending','accepted','unresolved')
+              AND ($8::bigint IS NULL OR a.admitted_at_ms <= $8)))`,
+        [
+          intent.invoicePaymentHash ?? intent.invoiceRepairPaymentHash,
+          intent.creditId,
+          intent.fundId,
+          intent.callerPubkey,
+          intent.amountMicro,
+          this.dvmId,
+          this.scope,
+          control.closed_at_ms,
+          control.closed_at_us,
+          repair
+        ]
+      );
+      if (invoice.rows[0]) return;
+      throw new Error("Hosted invoice has no original payable admission");
+    }
+    if (intent?.paymentSeq !== void 0 && intent.jobId) {
+      const payment = await tx.query(
+        `SELECT m.job_id FROM job_messages m JOIN jobs j ON j.id=m.job_id
+         WHERE m.job_id=$1 AND m.seq=$2 AND m.status='pending-verification'
+           AND m.created_at_ms IS NOT NULL
+           AND ($3::bigint IS NULL OR m.created_at_ms <= $3) AND j.dvm_id=$4
+           AND ($6::text IS NULL OR m.data->'content'->'tempo_credential'->'challenge'->>'id'=$6)
+           AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
+             WHERE a.dvm_id=$4 AND a.scope=$5 AND a.job_id=m.job_id AND a.outcome <> 'failed')`,
+        [
+          intent.jobId,
+          intent.paymentSeq,
+          control.closed_at_ms,
+          this.dvmId,
+          this.scope,
+          intent.challengeId ?? null
+        ]
+      );
+      if (payment.rows[0]) return;
+      throw new Error("Hosted payment has no pre-closure inbound intent");
+    }
+    if (!intent?.admissionId && !intent?.jobId && !(intent?.creditId && intent.fundId && intent.callerPubkey) || !intent?.jobId && !(intent?.creditId && intent.fundId)) {
+      throw new Error("Hosted obligations are closed to new intents");
+    }
+    const accepted = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE ($1::text IS NULL OR id=$1) AND dvm_id=$2 AND scope=$3
+         AND ($4::bigint IS NULL OR admitted_at_ms <= $4)
+         AND (outcome IN ('pending', 'unresolved') OR ($11::boolean AND outcome='accepted'))
+         AND ($5::text IS NULL OR job_id=$5)
+         AND ($6::text IS NULL OR credit_id=$6)
+         AND ($7::text IS NULL OR fund_id=$7)
+         AND ($8::text IS NULL OR caller_pubkey=$8)
+         AND ($9::text IS NULL OR funding_commitment=$9)
+         AND ($10::text IS NULL OR payment_artifact_hash=$10)`,
+      [
+        intent.admissionId ?? null,
+        this.dvmId,
+        this.scope,
+        control.closed_at_ms,
+        intent.jobId ?? null,
+        intent.creditId ?? null,
+        intent.fundId ?? null,
+        intent.callerPubkey ?? null,
+        intent.fundingCommitment ?? null,
+        intent.paymentArtifactHash ?? null,
+        control.state !== "closed"
+      ]
+    );
+    if (!accepted.rows[0]) throw new Error("Hosted obligation has no pre-closure admission");
+  }
+  async withNewIntent(intent, operation) {
+    return this.withNewIntentOn(this.pool, intent, operation);
+  }
+  async assertFundingReservation(tx, reservation) {
+    await this.assertNewIntent(tx, {
+      admissionId: reservation.admissionId,
+      creditId: reservation.creditId,
+      fundId: reservation.fundId,
+      callerPubkey: reservation.callerPubkey,
+      fundingCommitment: reservation.commitment,
+      paymentArtifactHash: reservation.paymentArtifactHash
+    });
+    const verified = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND credit_id=$4 AND fund_id=$5
+         AND caller_pubkey=$6 AND funding_commitment=$7 AND payment_artifact_hash=$8
+         AND outcome IN ('pending','accepted','unresolved')`,
+      [
+        reservation.admissionId,
+        this.dvmId,
+        this.scope,
+        reservation.creditId,
+        reservation.fundId,
+        reservation.callerPubkey,
+        reservation.commitment,
+        reservation.paymentArtifactHash
+      ]
+    );
+    if (!verified.rows[0]) throw new Error("Hosted funding has no authentic admission");
+  }
+  async fundingAdmission(tx, creditId, fundId, callerPubkey) {
+    await this.assertNewIntent(tx, { creditId, fundId, callerPubkey });
+    const { rows: rows2 } = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND credit_id=$3 AND fund_id=$4
+         AND caller_pubkey=$5 AND outcome IN ('pending','unresolved')
+       ORDER BY admitted_at_ms,id LIMIT 2`,
+      [this.dvmId, this.scope, creditId, fundId, callerPubkey]
+    );
+    if (rows2.length !== 1) throw new Error("Hosted invoice funding admission is missing or ambiguous");
+    return rows2[0].id;
+  }
+  async withNewIntentOn(db, intent, operation) {
+    const tx = await db.connect();
+    try {
+      await tx.query("BEGIN");
+      await this.assertNewIntent(tx, intent);
+      const result = await operation(tx);
+      await tx.query("COMMIT");
+      return result;
+    } catch (error) {
+      await tx.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      tx.release();
+    }
+  }
+};
+
+// src/sdk/server/hosting-settlement-report-obligations.ts
+import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { BATCH_SETTLEMENT_ADDRESS as BATCH_SETTLEMENT_ADDRESS3 } from "@x402/evm";
+import { computeChannelId as computeChannelId2 } from "@x402/evm/batch-settlement/client";
+import { Session as TempoSession } from "mppx/tempo";
+import { createPublicClient as createPublicClient4, decodeEventLog, decodeFunctionData as decodeFunctionData2, encodeFunctionData, http as http4, parseAbiItem as parseAbiItem2, toFunctionSelector } from "viem";
+var HOSTED_SETTLEMENT_UNRESOLVED_SQL = `state NOT IN ('delivered','no_report')
+  OR (rail='x402' AND operation IN ('claim','refund')
+      AND COALESCE(original->>'authorizationCallData','') !~* '^0x([0-9a-f]{2})+$')`;
+var X402_SETTLED_EVENT = parseAbiItem2(
+  "event Settled(address indexed receiver,address indexed token,address indexed sender,uint128 amount)"
+);
+var X402_REFUNDED_EVENT = parseAbiItem2(
+  "event Refunded(bytes32 indexed channelId,address indexed sender,uint128 amount)"
+);
+var X402_CLAIM_ABI = [{
+  type: "function",
+  name: "claimWithSignature",
+  stateMutability: "nonpayable",
+  inputs: [{ name: "voucherClaims", type: "tuple[]", components: [
+    { name: "voucher", type: "tuple", components: [
+      { name: "channel", type: "tuple", components: [
+        { name: "payer", type: "address" },
+        { name: "payerAuthorizer", type: "address" },
+        { name: "receiver", type: "address" },
+        { name: "receiverAuthorizer", type: "address" },
+        { name: "token", type: "address" },
+        { name: "withdrawDelay", type: "uint40" },
+        { name: "salt", type: "bytes32" }
+      ] },
+      { name: "maxClaimableAmount", type: "uint128" }
+    ] },
+    { name: "signature", type: "bytes" },
+    { name: "totalClaimed", type: "uint128" }
+  ] }, { name: "authorizerSignature", type: "bytes" }],
+  outputs: []
+}];
+var X402_REFUND_ABI = [{
+  type: "function",
+  name: "refundWithSignature",
+  stateMutability: "nonpayable",
+  inputs: [
+    { name: "config", type: "tuple", components: X402_CLAIM_ABI[0].inputs[0].components[0].components[0].components },
+    { name: "amount", type: "uint128" },
+    { name: "nonce", type: "uint256" },
+    { name: "receiverAuthorizerSignature", type: "bytes" }
+  ],
+  outputs: []
+}];
+var X402_MULTICALL_ABI = [{
+  type: "function",
+  name: "multicall",
+  stateMutability: "nonpayable",
+  inputs: [{ name: "data", type: "bytes[]" }],
+  outputs: [{ name: "results", type: "bytes[]" }]
+}];
+var TEMPO_SETTLED_EVENT = TempoSession.Precompile.escrowAbi.find(
+  (item) => item.type === "event" && item.name === "Settled"
+);
+var TEMPO_CLOSED_EVENT = TempoSession.Precompile.escrowAbi.find(
+  (item) => item.type === "event" && item.name === "ChannelClosed"
+);
+function hash2(value) {
+  return createHash5("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function hex(value, bytes) {
+  return typeof value === "string" && new RegExp(`^0x[0-9a-fA-F]{${bytes * 2}}$`).test(value);
+}
+function signedBytes(value) {
+  if (typeof value !== "string" || !/^0x(?:[0-9a-fA-F]{2})+$/.test(value)) {
+    throw new Error("Hosted x402 authorization signature is unavailable before settlement");
+  }
+  return value;
+}
+function uint(value) {
+  if ((typeof value !== "string" || !/^\d+$/.test(value)) && (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) && (typeof value !== "bigint" || value < 0n)) {
+    throw new Error("Hosted x402 authorization has an invalid unsigned amount");
+  }
+  return BigInt(value);
+}
+function contractChannel(value) {
+  const channel = value;
+  if (!channel || !hex(channel.payer, 20) || !hex(channel.payerAuthorizer, 20) || !hex(channel.receiver, 20) || !hex(channel.receiverAuthorizer, 20) || !hex(channel.token, 20) || !hex(channel.salt, 32)) {
+    throw new Error("Hosted x402 authorization has no original channel config");
+  }
+  const withdrawDelay = uint(channel.withdrawDelay);
+  if (withdrawDelay > (1n << 40n) - 1n) {
+    throw new Error("Hosted x402 authorization has an invalid withdrawal delay");
+  }
+  return {
+    payer: channel.payer,
+    payerAuthorizer: channel.payerAuthorizer,
+    receiver: channel.receiver,
+    receiverAuthorizer: channel.receiverAuthorizer,
+    token: channel.token,
+    withdrawDelay: Number(withdrawDelay),
+    salt: channel.salt
+  };
+}
+function authorizationCallData(operation, payload) {
+  if (payload.type !== operation) throw new Error("Hosted x402 authorization operation changed");
+  const rawClaims = payload.claims;
+  if (!Array.isArray(rawClaims) || operation === "claim" && !rawClaims.length || operation === "refund" && rawClaims.length > 1) {
+    throw new Error("Hosted x402 authorization has no exact original claim set");
+  }
+  const claims = rawClaims.map((raw) => {
+    const claim = raw;
+    const voucher = claim?.voucher;
+    if (!voucher) throw new Error("Hosted x402 authorization has no original voucher");
+    return {
+      voucher: {
+        channel: contractChannel(voucher.channel),
+        maxClaimableAmount: uint(voucher.maxClaimableAmount)
+      },
+      signature: signedBytes(claim.signature),
+      totalClaimed: uint(claim.totalClaimed)
+    };
+  });
+  const claimData = claims.length ? encodeFunctionData({
+    abi: X402_CLAIM_ABI,
+    functionName: "claimWithSignature",
+    args: [
+      claims,
+      signedBytes(payload.claimAuthorizerSignature)
+    ]
+  }) : void 0;
+  if (operation === "claim") return claimData;
+  const refundData = encodeFunctionData({
+    abi: X402_REFUND_ABI,
+    functionName: "refundWithSignature",
+    args: [
+      contractChannel(payload.channelConfig),
+      uint(payload.amount),
+      uint(payload.refundNonce),
+      signedBytes(payload.refundAuthorizerSignature)
+    ]
+  });
+  return claimData ? encodeFunctionData({
+    abi: X402_MULTICALL_ABI,
+    functionName: "multicall",
+    args: [[claimData, refundData]]
+  }) : refundData;
+}
+function nativeAmount(value) {
+  if (typeof value !== "bigint" || value < 0n) {
+    throw new Error("Hosted settlement source has no exact nonnegative amount");
+  }
+  return value.toString();
+}
+async function transaction(pool, operation) {
+  const tx = await pool.connect();
+  try {
+    await tx.query("BEGIN");
+    const result = await operation(tx);
+    await tx.query("COMMIT");
+    return result;
+  } catch (error) {
+    await tx.query("ROLLBACK").catch(() => void 0);
+    throw error;
+  } finally {
+    tx.release();
+  }
+}
+var HostedSettlementReportObligations = class {
+  constructor(pool, dvmId, scope) {
+    this.pool = pool;
+    this.dvmId = dvmId;
+    this.scope = scope;
+  }
+  pool;
+  dvmId;
+  scope;
+  x402;
+  tempo;
+  x402SettlementStore;
+  configureX402(config) {
+    if (!x402NetworkByCaip2(config.network) || !hex(config.receiver, 20) || !hex(config.token, 20)) {
+      throw new Error("Hosted x402 settlement identity is unsupported");
+    }
+    if (this.x402 && hash2(this.x402) !== hash2(config)) throw new Error("Hosted x402 settlement identity changed");
+    this.x402 = config;
+  }
+  attachX402SettlementStore(store) {
+    if (this.x402SettlementStore && this.x402SettlementStore !== store) {
+      throw new Error("Hosted x402 settlement writer changed");
+    }
+    this.x402SettlementStore = store;
+  }
+  x402Transaction(operation) {
+    const store = this.x402SettlementStore;
+    if (!store) throw new Error("Hosted x402 durable settlement writer is unavailable");
+    return store.withSettlementTransaction(operation);
+  }
+  configureTempo(config) {
+    if (!/^eip155:[0-9]+$/.test(config.network) || !hex(config.escrow, 20) || !hex(config.payee, 20) || !hex(config.token, 20)) {
+      throw new Error("Hosted Tempo settlement identity is unsupported");
+    }
+    if (this.tempo && hash2(this.tempo) !== hash2(config)) throw new Error("Hosted Tempo settlement identity changed");
+    this.tempo = config;
+  }
+  async init() {
+    await withSdkInitLock(this.pool, async () => {
+      const earlier = await this.pool.query(
+        `SELECT to_regclass('x402_batch_channels') IS NOT NULL AS x402,
+                to_regclass('x402_batch_settlements') IS NOT NULL AS "x402Settlement",
+                to_regclass('payout_x402_batches') IS NOT NULL AS "x402Batch",
+                to_regclass('mpp_tempo_channels') IS NOT NULL AS tempo,
+                to_regclass('mpp_tempo_close_intents') IS NOT NULL AS "tempoClose",
+                to_regclass('pending_dvm_reports') IS NOT NULL AS reports,
+                to_regclass('sdk_hosted_settlement_report_obligations') IS NOT NULL AS obligations`
+      );
+      await this.pool.query(`
+        CREATE TABLE IF NOT EXISTS sdk_hosted_settlement_report_history (
+          singleton BOOLEAN PRIMARY KEY CHECK (singleton), complete BOOLEAN NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS sdk_hosted_settlement_report_obligations (
+          id TEXT PRIMARY KEY, source_key TEXT NOT NULL UNIQUE,
+          dvm_id TEXT NOT NULL, scope TEXT NOT NULL, instance_id TEXT NOT NULL,
+          boot_epoch BIGINT NOT NULL, rail TEXT NOT NULL CHECK (rail IN ('x402','tempo')),
+          operation TEXT NOT NULL CHECK (operation IN ('claim','refund','settle','close')),
+          network TEXT NOT NULL, contract TEXT NOT NULL, channel_id TEXT NOT NULL,
+          original JSONB NOT NULL,
+          state TEXT NOT NULL CHECK (state IN ('reserved','observed','report_queued','delivered','no_report')),
+          tx_hash TEXT, block_number BIGINT, block_hash TEXT, delta_native NUMERIC(78,0),
+          payout_id TEXT, report_id TEXT, report_payload JSONB, delivered_at_ms BIGINT,
+          created_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
+          updated_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+        );
+        CREATE INDEX IF NOT EXISTS sdk_hosted_settlement_report_pending
+          ON sdk_hosted_settlement_report_obligations (dvm_id,scope,state)
+          WHERE state NOT IN ('delivered','no_report');
+        CREATE INDEX IF NOT EXISTS sdk_hosted_settlement_report_delivery
+          ON sdk_hosted_settlement_report_obligations (report_id)
+          WHERE report_id IS NOT NULL;
+      `);
+      await this.pool.query(
+        `INSERT INTO sdk_hosted_settlement_report_history (singleton,complete)
+         VALUES (TRUE,$1) ON CONFLICT (singleton) DO NOTHING`,
+        [Object.values(earlier.rows[0]).every((exists) => !exists)]
+      );
+    });
+  }
+  async reserveX402(channelId, operation, expected) {
+    const config = this.x402;
+    if (!config || !hex(channelId, 32)) throw new Error("Hosted x402 settlement configuration is unavailable");
+    const requirements = expected.authorizationRequirements;
+    if (requirements.scheme !== "batch-settlement" || requirements.network !== config.network || requirements.asset.toLowerCase() !== config.token.toLowerCase() || requirements.payTo.toLowerCase() !== config.receiver.toLowerCase() || requirements.amount !== "0") {
+      throw new Error("Hosted x402 authorization has another selected rail or recipient");
+    }
+    const originalCallData = authorizationCallData(operation, expected.authorizationPayload);
+    return this.x402Transaction(async (tx) => {
+      let row;
+      let refundSettlementId;
+      if (operation === "refund") {
+        const result = await tx.query(`SELECT settlement_id,channel_at_submission,payment_payload,payment_requirements
+             FROM x402_batch_settlements
+             WHERE channel_id=$1 AND operation='refund' AND status='submitting'
+             ORDER BY created_at DESC LIMIT 2`, [channelId.toLowerCase()]);
+        if (result.rows.length !== 1 || !result.rows[0].channel_at_submission) {
+          throw new Error("Hosted x402 refund has no unique durable pre-submission source");
+        }
+        const original2 = result.rows[0];
+        const snapshot = original2.channel_at_submission;
+        const payment = original2.payment_payload.payload;
+        const voucher = payment?.voucher;
+        const requirements2 = original2.payment_requirements;
+        if (payment?.type !== "refund" || !payment.channelConfig || computeChannelId2(payment.channelConfig, config.network).toLowerCase() !== channelId.toLowerCase() || String(voucher?.signature).toLowerCase() !== expected.voucherSignature?.toLowerCase() || String(voucher?.channelId).toLowerCase() !== channelId.toLowerCase() || String(voucher?.maxClaimableAmount) !== expected.signedMax || String(snapshot.signature).toLowerCase() !== expected.voucherSignature?.toLowerCase() || String(snapshot.signedMaxClaimable) !== expected.signedMax || requirements2.scheme !== "batch-settlement" || requirements2.network !== config.network || String(requirements2.payTo).toLowerCase() !== config.receiver.toLowerCase() || String(requirements2.asset).toLowerCase() !== config.token.toLowerCase()) {
+          throw new Error("Hosted x402 refund differs from its original signed credit effect");
+        }
+        row = {
+          channel_config: snapshot.channelConfig,
+          charged_cumulative_amount: String(snapshot.chargedCumulativeAmount),
+          signed_max_claimable: String(snapshot.signedMaxClaimable),
+          signature: String(snapshot.signature),
+          total_claimed: String(snapshot.totalClaimed),
+          balance: String(snapshot.balance),
+          refund_nonce: String(snapshot.refundNonce)
+        };
+        refundSettlementId = original2.settlement_id;
+      } else {
+        const result = await tx.query(`SELECT channel_config,charged_cumulative_amount,signed_max_claimable,
+              signature,total_claimed,balance,refund_nonce
+             FROM x402_batch_channels WHERE channel_id=$1`, [channelId.toLowerCase()]);
+        row = result.rows[0];
+      }
+      if (!row) return null;
+      const identity = await this.lockIdentity(tx);
+      if (operation === "claim" && BigInt(row.charged_cumulative_amount) <= BigInt(row.total_claimed)) return null;
+      if (operation === "refund" && BigInt(row.balance) <= BigInt(row.total_claimed)) return null;
+      if (String(row.channel_config.receiver).toLowerCase() !== config.receiver.toLowerCase() || String(row.channel_config.token).toLowerCase() !== config.token.toLowerCase() || computeChannelId2(row.channel_config, config.network).toLowerCase() !== channelId.toLowerCase()) {
+        throw new Error("Hosted x402 channel has another recipient or token");
+      }
+      if (operation === "claim" && (expected.charged !== row.charged_cumulative_amount || expected.signature?.toLowerCase() !== row.signature.toLowerCase() || expected.signedMax !== row.signed_max_claimable)) {
+        throw new Error("Hosted x402 claim changed after selection");
+      }
+      if (operation === "refund" && (expected.refundNonce !== row.refund_nonce || expected.refundAmount !== (BigInt(row.balance) - BigInt(row.charged_cumulative_amount)).toString())) {
+        throw new Error("Hosted x402 refund changed after selection");
+      }
+      const batchId = operation === "claim" || BigInt(row.charged_cumulative_amount) > BigInt(row.total_claimed) ? await this.ensureOpenX402Batch(tx, config) : void 0;
+      const original = operation === "claim" ? {
+        charged: row.charged_cumulative_amount,
+        claimedBefore: row.total_claimed,
+        signed: row.signed_max_claimable,
+        signature: row.signature,
+        batchId,
+        authorizationRequirements: requirements,
+        authorizationCallData: originalCallData
+      } : {
+        charged: row.charged_cumulative_amount,
+        claimedBefore: row.total_claimed,
+        balance: row.balance,
+        refundNonce: row.refund_nonce,
+        refundAmount: (BigInt(row.balance) - BigInt(row.charged_cumulative_amount)).toString(),
+        signed: row.signed_max_claimable,
+        signature: row.signature,
+        settlementId: refundSettlementId,
+        authorizationRequirements: requirements,
+        authorizationCallData: originalCallData,
+        ...batchId ? { batchId } : {}
+      };
+      return this.insert(
+        tx,
+        identity,
+        "x402",
+        operation,
+        config.network,
+        BATCH_SETTLEMENT_ADDRESS3,
+        channelId.toLowerCase(),
+        original,
+        operation === "claim" ? [row.charged_cumulative_amount, row.signature.toLowerCase()] : [refundSettlementId, row.refund_nonce]
+      );
+    });
+  }
+  async reserveTempo(channelId, operation, drainId) {
+    const config = this.tempo;
+    if (!config || !hex(channelId, 32)) throw new Error("Hosted Tempo settlement configuration is unavailable");
+    return transaction(this.pool, async (tx) => {
+      const state = await tx.query(
+        "SELECT state_json FROM mpp_tempo_channels WHERE channel_key=$1",
+        [channelId.toLowerCase()]
+      );
+      if (!state.rows[0]) throw new Error("Hosted Tempo channel is not durable");
+      const identity = await this.lockIdentity(tx);
+      const parsed = parseStoreValue(state.rows[0].state_json);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Hosted Tempo state is invalid");
+      const row = parsed;
+      if (row.chainId !== Number(config.network.split(":")[1]) || String(row.escrowContract).toLowerCase() !== config.escrow.toLowerCase() || String(row.payee).toLowerCase() !== config.payee.toLowerCase() || String(row.token).toLowerCase() !== config.token.toLowerCase()) {
+        throw new Error("Hosted Tempo channel has another chain or recipient");
+      }
+      if (operation === "close") {
+        if (!drainId) throw new Error("Hosted Tempo close requires the original drain");
+        const close = await tx.query(
+          "SELECT drain_id FROM mpp_tempo_close_intents WHERE channel_id=$1",
+          [channelId.toLowerCase()]
+        );
+        if (close.rows[0]?.drain_id !== drainId) throw new Error("Hosted Tempo close has no matching drain");
+      }
+      const highestVoucherAmount = nativeAmount(row.highestVoucherAmount);
+      const settledOnChain = nativeAmount(row.settledOnChain);
+      const spent = nativeAmount(row.spent);
+      if (BigInt(settledOnChain) > BigInt(highestVoucherAmount) || BigInt(spent) > BigInt(highestVoucherAmount)) {
+        throw new Error("Hosted Tempo settlement source has inconsistent amounts");
+      }
+      const original = operation === "settle" ? {
+        highestVoucherAmount,
+        settledOnChain,
+        spent
+      } : { drainId, highestVoucherAmount, settledOnChain, spent };
+      return this.insert(
+        tx,
+        identity,
+        "tempo",
+        operation,
+        config.network,
+        config.escrow,
+        channelId.toLowerCase(),
+        original,
+        operation === "close" ? [drainId] : [highestVoucherAmount]
+      );
+    });
+  }
+  async findPendingTempo(channelId, operation) {
+    const result = await this.pool.query(
+      `SELECT * FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation=$3 AND channel_id=$4
+         AND state NOT IN ('delivered','no_report') ORDER BY created_at_ms DESC LIMIT 1`,
+      [this.dvmId, this.scope, operation, channelId.toLowerCase()]
+    );
+    return result.rows[0];
+  }
+  async submittedIds(rail, operation, txHash, batchId) {
+    if (!hex(txHash, 32)) throw new Error("Hosted effect has no exact transaction hash");
+    const result = await this.pool.query(
+      `SELECT id,original FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail=$3 AND operation=$4 AND tx_hash=$5
+       ORDER BY source_key`,
+      [this.dvmId, this.scope, rail, operation, txHash.toLowerCase()]
+    );
+    if (batchId && result.rows.some((row) => row.original.batchId !== batchId)) {
+      throw new Error("Hosted x402 submitted claim belongs to another payout batch");
+    }
+    return result.rows.map((row) => row.id);
+  }
+  async refundClaimDelta(txHash, channelId) {
+    const rows2 = await this.pool.query(
+      `SELECT original FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail='x402' AND operation='refund'
+         AND channel_id=$3 AND tx_hash=$4`,
+      [this.dvmId, this.scope, channelId.toLowerCase(), txHash.toLowerCase()]
+    );
+    if (rows2.rows.length !== 1) throw new Error("Hosted refund has no exact submitted source");
+    const original = rows2.rows[0].original;
+    const delta = BigInt(String(original.charged)) - BigInt(String(original.claimedBefore));
+    if (delta < 0n) throw new Error("Hosted refund original claim amount is invalid");
+    return delta;
+  }
+  async assertReservedTempoClose(id, channelId) {
+    const result = await this.pool.query(
+      "SELECT * FROM sdk_hosted_settlement_report_obligations WHERE id=$1",
+      [id]
+    );
+    const row = result.rows[0];
+    if (!row || row.dvm_id !== this.dvmId || row.scope !== this.scope || row.rail !== "tempo" || row.operation !== "close" || row.channel_id !== channelId.toLowerCase() || row.state !== "reserved" || row.tx_hash) {
+      throw new Error("Hosted Tempo close permit has no original reserved drain");
+    }
+  }
+  async originalTempoCloseSettled(id, channelId, txHash) {
+    const result = await this.pool.query(
+      "SELECT * FROM sdk_hosted_settlement_report_obligations WHERE id=$1",
+      [id]
+    );
+    const row = result.rows[0];
+    if (!row || row.dvm_id !== this.dvmId || row.scope !== this.scope || row.rail !== "tempo" || row.operation !== "close" || row.channel_id !== channelId.toLowerCase() || row.tx_hash?.toLowerCase() !== txHash.toLowerCase()) {
+      throw new Error("Hosted Tempo repair has no matching original close");
+    }
+    const amount = row.original.settledOnChain;
+    if (typeof amount !== "string" || !/^\d+$/.test(amount)) {
+      throw new Error("Hosted Tempo repair has no original settled amount");
+    }
+    return BigInt(amount);
+  }
+  async settlementId(batchId, txHash) {
+    const result = await this.pool.query(
+      `SELECT id,original FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail='x402' AND operation='settle' AND tx_hash=$3`,
+      [this.dvmId, this.scope, txHash.toLowerCase()]
+    );
+    const matching = result.rows.filter((row) => row.original.batchId === batchId);
+    if (matching.length !== 1) throw new Error("Hosted x402 settlement is not bound to the original batch");
+    return matching[0].id;
+  }
+  async reserveOpenX402Settlement() {
+    const config = this.x402;
+    if (!config) throw new Error("Hosted x402 payout batch is unavailable");
+    return this.x402Transaction(async (tx) => {
+      const expectedScope = `${config.network}|${config.receiver.toLowerCase()}|${config.token.toLowerCase()}`;
+      const batch = await tx.query(
+        "SELECT batch_id,claimed_native FROM payout_x402_batches WHERE scope=$1",
+        [expectedScope]
+      );
+      const row = batch.rows[0];
+      if (!row || BigInt(row.claimed_native) <= 0n) {
+        throw new Error("Hosted x402 settlement has no original claimed batch");
+      }
+      const identity = await this.lockIdentity(tx);
+      return this.insert(
+        tx,
+        identity,
+        "x402",
+        "settle",
+        config.network,
+        BATCH_SETTLEMENT_ADDRESS3,
+        expectedScope,
+        { batchId: row.batch_id, claimedNative: row.claimed_native },
+        [row.batch_id]
+      );
+    });
+  }
+  async ensureOpenX402Batch(tx, config) {
+    const scope = `${config.network}|${config.receiver.toLowerCase()}|${config.token.toLowerCase()}`;
+    const result = await tx.query(
+      `INSERT INTO payout_x402_batches
+         (scope,batch_id,claimed_native,voucher_count,claims,opened_at,updated_at)
+       VALUES ($1,$2,0,0,0,
+         FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
+         FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint)
+       ON CONFLICT (scope) DO UPDATE SET scope=EXCLUDED.scope
+       RETURNING batch_id`,
+      [scope, randomUUID3()]
+    );
+    return result.rows[0].batch_id;
+  }
+  async recordSubmitted(id, txHash) {
+    if (!hex(txHash, 32)) throw new Error("Hosted settlement has no transaction hash");
+    const write = this.x402SettlementStore ? this.x402Transaction.bind(this) : (operation) => transaction(this.pool, operation);
+    await write(async (tx) => {
+      const row = await this.lockRow(tx, id);
+      if (row.tx_hash && row.tx_hash.toLowerCase() !== txHash.toLowerCase()) {
+        throw new Error("Hosted settlement transaction replay conflicts");
+      }
+      await tx.query(
+        `UPDATE sdk_hosted_settlement_report_obligations SET tx_hash=COALESCE(tx_hash,$2),
+           updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
+        [id, txHash.toLowerCase()]
+      );
+    });
+  }
+  async recoveryCandidates() {
+    const result = await this.pool.query(
+      `SELECT * FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND tx_hash IS NOT NULL
+         AND state NOT IN ('delivered','no_report')
+         AND (block_hash IS NULL OR report_id IS NULL)
+       ORDER BY created_at_ms,id`,
+      [this.dvmId, this.scope]
+    );
+    return result.rows.map((row) => ({
+      id: row.id,
+      rail: row.rail,
+      operation: row.operation,
+      channelId: row.channel_id,
+      txHash: row.tx_hash,
+      ...typeof row.original.batchId === "string" ? { batchId: row.original.batchId } : {},
+      reportId: row.report_id,
+      blockHash: row.block_hash,
+      deltaNative: row.delta_native
+    }));
+  }
+  async recoverOriginalX402Refunds() {
+    const rows2 = await this.pool.query(
+      `SELECT obligation.id,settlement.settle_response AS response
+       FROM sdk_hosted_settlement_report_obligations obligation
+       JOIN x402_batch_settlements settlement
+         ON settlement.settlement_id=obligation.original->>'settlementId'
+       WHERE obligation.dvm_id=$1 AND obligation.scope=$2 AND obligation.rail='x402'
+         AND obligation.operation='refund' AND obligation.tx_hash IS NULL
+         AND settlement.operation='refund' AND settlement.channel_id=obligation.channel_id
+         AND settlement.status IN ('settled','complete')
+         AND settlement.settle_response->>'success'='true'`,
+      [this.dvmId, this.scope]
+    );
+    const failures = [];
+    for (const row of rows2.rows) {
+      if (!hex(row.response?.transaction, 32)) continue;
+      try {
+        await this.recordSubmitted(row.id, row.response.transaction);
+      } catch (error) {
+        failures.push({ id: row.id, error });
+      }
+    }
+    return failures;
+  }
+  async reconcileX402Batches() {
+    const batches = await this.pool.query(
+      `SELECT DISTINCT obligation.original->>'batchId' AS batch_id
+       FROM sdk_hosted_settlement_report_obligations obligation
+       JOIN payout_x402_batches batch ON batch.batch_id=obligation.original->>'batchId'
+       WHERE obligation.dvm_id=$1 AND obligation.scope=$2 AND obligation.rail='x402'
+         AND obligation.operation IN ('claim','refund') AND obligation.original ? 'batchId'
+       ORDER BY batch_id`,
+      [this.dvmId, this.scope]
+    );
+    const failures = [];
+    for (const batch of batches.rows) {
+      try {
+        await transaction(this.pool, async (tx) => {
+          const open = await tx.query(
+            "SELECT scope FROM payout_x402_batches WHERE batch_id=$1 FOR UPDATE",
+            [batch.batch_id]
+          );
+          if (!open.rows[0]) return;
+          const sources = await tx.query(
+            `SELECT * FROM sdk_hosted_settlement_report_obligations
+           WHERE dvm_id=$1 AND scope=$2 AND rail='x402'
+             AND operation IN ('claim','refund') AND original->>'batchId'=$3
+           ORDER BY source_key FOR UPDATE`,
+            [this.dvmId, this.scope, batch.batch_id]
+          );
+          if (!sources.rows.length || sources.rows.some((row) => !row.tx_hash || !row.block_hash || row.delta_native === null)) return;
+          const claimed = sources.rows.reduce((sum, row) => sum + BigInt(row.delta_native), 0n);
+          const hashes = new Set(sources.rows.map((row) => row.tx_hash));
+          await tx.query(
+            `UPDATE payout_x402_batches
+             SET claimed_native=$2,voucher_count=$3,claims=$4,obligation_ids=$5,
+                 updated_at=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+           WHERE batch_id=$1`,
+            [
+              batch.batch_id,
+              claimed.toString(),
+              sources.rows.length,
+              hashes.size,
+              JSON.stringify(sources.rows.map((row) => row.id))
+            ]
+          );
+        });
+      } catch (error) {
+        failures.push({ id: batch.batch_id, error });
+      }
+    }
+    return failures;
+  }
+  async queueReport(ids, payoutId, reportId, payload, tx) {
+    if (!ids.length || !payoutId || !reportId || new Set(ids).size !== ids.length) {
+      throw new Error("Hosted payout report has no exact obligation set");
+    }
+    if (payoutId.startsWith("x402:batch:")) {
+      const batchId = payoutId.slice("x402:batch:".length);
+      const sources = await tx.query(
+        `SELECT id,tx_hash,operation FROM sdk_hosted_settlement_report_obligations
+         WHERE dvm_id=$1 AND scope=$2 AND rail='x402'
+           AND operation IN ('claim','refund','settle')
+           AND original->>'batchId'=$3 FOR UPDATE`,
+        [this.dvmId, this.scope, batchId]
+      );
+      if (sources.rows.filter((row) => row.operation === "settle").length !== 1 || !sources.rows.some((row) => row.operation === "claim" || row.operation === "refund") || sources.rows.some((row) => !row.tx_hash || !ids.includes(row.id)) || sources.rows.length !== ids.length) {
+        throw new Error("Hosted x402 payout excludes an original effect or its submission is unknown");
+      }
+    } else if (payoutId.startsWith("tempo:")) {
+      if (ids.length !== 1) throw new Error("Hosted Tempo payout requires one original effect");
+      const row = await this.lockRow(tx, ids[0]);
+      if (row.rail !== "tempo" || !row.tx_hash || payoutId !== `tempo:${row.tx_hash}` || row.operation !== "settle" && row.operation !== "close") {
+        throw new Error("Hosted Tempo payout differs from its original effect");
+      }
+    } else {
+      throw new Error("Hosted payout has an unsupported original rail identity");
+    }
+    for (const id of [...ids].sort()) {
+      const row = await this.lockRow(tx, id);
+      if (!row.tx_hash || row.payout_id && row.payout_id !== payoutId || row.report_id && row.report_id !== reportId || row.report_payload && !isDeepStrictEqual2(row.report_payload, payload)) {
+        throw new Error("Hosted payout report has no original transaction or conflicts");
+      }
+      await tx.query(
+        `UPDATE sdk_hosted_settlement_report_obligations
+           SET payout_id=$2, report_id=$3, report_payload=$4,
+             state=CASE WHEN state='delivered' THEN 'delivered'
+                        WHEN block_hash IS NULL THEN 'report_queued' ELSE 'observed' END,
+             updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+         WHERE id=$1`,
+        [id, payoutId, reportId, JSON.stringify(payload)]
+      );
+    }
+  }
+  async hasOriginalReport(ids, payoutId, payload, tx) {
+    if (!ids.length || new Set(ids).size !== ids.length) {
+      throw new Error("Hosted payout replay has no exact original set");
+    }
+    const rows2 = [];
+    for (const id of [...ids].sort()) rows2.push(await this.lockRow(tx, id));
+    const recorded = rows2.filter((row) => row.report_id !== null);
+    if (!recorded.length) return false;
+    const first = recorded[0];
+    if (recorded.length !== ids.length || rows2.some((row) => row.payout_id !== payoutId || row.report_id !== first.report_id || row.report_payload?.dvmId !== payload.dvmId || row.report_payload?.rail !== payload.rail || row.report_payload?.kind !== payload.kind || row.report_payload?.nativeAmount !== payload.nativeAmount || row.report_payload?.nativeAsset !== payload.nativeAsset || row.report_payload?.recipient !== payload.recipient || !isDeepStrictEqual2(row.report_payload?.refs, payload.refs))) {
+      throw new Error("Hosted payout replay conflicts with its original report");
+    }
+    return true;
+  }
+  async assertReportReady(reportId, payload, query = this.pool) {
+    const rows2 = await query.query(
+      `SELECT * FROM sdk_hosted_settlement_report_obligations
+       WHERE report_id=$1 ORDER BY source_key`,
+      [reportId]
+    );
+    if (!rows2.rows.length) {
+      if (await this.hasCompleteHistory(query)) {
+        throw new Error("Hosted payout has no original effect report");
+      }
+      return;
+    }
+    const amount = payload.nativeAmount;
+    if (typeof amount !== "number" || !Number.isSafeInteger(amount) || amount < 0 || rows2.rows.some((row) => row.dvm_id !== this.dvmId || row.scope !== this.scope || row.report_id !== reportId || row.payout_id !== payload.payoutId || !isDeepStrictEqual2(row.report_payload, payload) || row.rail === "x402" && (row.operation === "claim" || row.operation === "refund") && (typeof row.original.authorizationCallData !== "string" || !/^0x(?:[0-9a-f]{2})+$/i.test(row.original.authorizationCallData)) || !row.block_hash || row.delta_native === null || row.state === "no_report")) {
+      throw new Error("Hosted payout has no finalized exact original effect set");
+    }
+    if (payload.rail === "tempo") {
+      if (rows2.rows.length !== 1 || rows2.rows[0].rail !== "tempo" || BigInt(rows2.rows[0].delta_native) !== BigInt(amount)) {
+        throw new Error("Hosted Tempo payout amount differs from its original finalized effect");
+      }
+    } else if (payload.rail === "x402" && typeof payload.payoutId === "string" && payload.payoutId.startsWith("x402:batch:")) {
+      const batchId = payload.payoutId.slice("x402:batch:".length);
+      const settle = rows2.rows.filter((row) => row.operation === "settle" && row.rail === "x402");
+      const claims = rows2.rows.filter((row) => row.operation === "claim" || row.operation === "refund");
+      if (settle.length !== 1 || !claims.length || claims.length + 1 !== rows2.rows.length || rows2.rows.some((row) => row.original.batchId !== batchId) || BigInt(settle[0].delta_native) !== BigInt(amount) || claims.reduce((sum, row) => sum + BigInt(row.delta_native), 0n) !== BigInt(amount)) {
+        throw new Error("Hosted x402 payout differs from its original finalized batch");
+      }
+    } else {
+      throw new Error("Hosted payout has no supported original rail report");
+    }
+  }
+  async acknowledgeDelivered(reportId, tx, requireLinked = true) {
+    const pending = await tx.query(
+      "SELECT payload FROM pending_dvm_reports WHERE id=$1 AND kind='payout' FOR UPDATE",
+      [reportId]
+    );
+    if (!pending.rows[0]) throw new Error("Hosted payout acknowledgement has no durable outbox row");
+    if (pending.rows[0].payload.rail === "x402" || pending.rows[0].payload.rail === "tempo") {
+      await this.assertReportReady(reportId, pending.rows[0].payload, tx);
+    }
+    const rows2 = await tx.query(
+      `UPDATE sdk_hosted_settlement_report_obligations
+         SET delivered_at_ms=COALESCE(delivered_at_ms,
+               FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint),
+             state=CASE WHEN block_hash IS NULL THEN 'report_queued' ELSE 'delivered' END,
+             updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE report_id=$1 AND state <> 'no_report' RETURNING id`,
+      [reportId]
+    );
+    if (!rows2.rows.length && requireLinked) throw new Error("Hosted payout report lacks its original obligation");
+  }
+  async observeCanonical(id) {
+    const result = await this.pool.query(
+      "SELECT * FROM sdk_hosted_settlement_report_obligations WHERE id=$1",
+      [id]
+    );
+    const row = result.rows[0];
+    if (!row || !row.tx_hash || !hex(row.tx_hash, 32)) throw new Error("Hosted effect has no durable transaction");
+    if (row.rail === "x402" && (row.operation === "claim" || row.operation === "refund") && (typeof row.original.authorizationCallData !== "string" || !/^0x(?:[0-9a-f]{2})+$/i.test(row.original.authorizationCallData))) {
+      throw new Error("Hosted x402 original signed authorization is unknown");
+    }
+    if (row.block_hash && row.block_number !== null && row.delta_native !== null) {
+      return {
+        id,
+        txHash: row.tx_hash,
+        blockNumber: row.block_number,
+        blockHash: row.block_hash,
+        deltaNative: row.delta_native
+      };
+    }
+    const config = row.rail === "x402" ? this.x402 : this.tempo;
+    const expectedContract = row.rail === "x402" ? BATCH_SETTLEMENT_ADDRESS3 : this.tempo?.escrow;
+    if (!config || !expectedContract || row.network !== config.network || row.contract !== expectedContract.toLowerCase()) {
+      throw new Error("Hosted effect chain configuration changed");
+    }
+    const { tempo, tempoModerato } = await import("viem/chains");
+    const spec = row.rail === "x402" ? x402NetworkByCaip2(config.network) : void 0;
+    const chains = await import("viem/chains");
+    const chain = row.rail === "x402" ? spec && chains[spec.viemChain] : Number(config.network.split(":")[1]) === tempoModerato.id ? tempoModerato : tempo;
+    if (!chain) throw new Error("Hosted effect chain is unsupported");
+    const rpcUrl = resolveRpcOverride(config.rpcUrl, chain.rpcUrls.default.http[0]).url;
+    const client = createPublicClient4({ chain, transport: http4(rpcUrl) });
+    const [chainId, finalBlock, receipt, transactionRecord] = await Promise.all([
+      client.getChainId(),
+      client.getBlock({ blockTag: "finalized" }),
+      client.getTransactionReceipt({ hash: row.tx_hash }),
+      client.getTransaction({ hash: row.tx_hash })
+    ]);
+    if (chainId !== chain.id || finalBlock.number === null || receipt.status !== "success" || receipt.blockNumber > finalBlock.number || receipt.transactionHash.toLowerCase() !== row.tx_hash.toLowerCase() || transactionRecord.to?.toLowerCase() !== row.contract || !hex(receipt.blockHash, 32)) {
+      throw new Error("Hosted effect is not finalized on its original contract");
+    }
+    const receiptBlock = await client.getBlock({ blockNumber: receipt.blockNumber });
+    if (receiptBlock.hash.toLowerCase() !== receipt.blockHash.toLowerCase()) {
+      throw new Error("Hosted effect receipt is not canonical");
+    }
+    if (row.rail === "x402" && (row.operation === "claim" || row.operation === "refund")) {
+      const committed = row.original.authorizationCallData;
+      if (typeof committed !== "string" || !/^0x[0-9a-f]+$/i.test(committed) || transactionRecord.input?.toLowerCase() !== committed.toLowerCase()) {
+        throw new Error("Hosted x402 transaction differs from its pre-effect signed authorization");
+      }
+    }
+    let delta;
+    if (row.rail === "x402" && row.operation === "claim") {
+      if (!transactionRecord.input) throw new Error("Hosted claim has no transaction input");
+      const decoded = decodeFunctionData2({ abi: X402_CLAIM_ABI, data: transactionRecord.input });
+      if (decoded.functionName !== "claimWithSignature") throw new Error("Hosted claim transaction has another method");
+      const claims = decoded.args[0];
+      const submitted = await this.pool.query(
+        `SELECT * FROM sdk_hosted_settlement_report_obligations
+         WHERE tx_hash=$1 AND rail='x402' AND operation='claim'`,
+        [row.tx_hash]
+      );
+      if (submitted.rows.length !== claims.length || submitted.rows.some((original) => original.dvm_id !== this.dvmId || original.scope !== this.scope || claims.filter(
+        (claim) => computeChannelId2(claim.voucher.channel, config.network).toLowerCase() === original.channel_id && claim.voucher.maxClaimableAmount === BigInt(String(original.original.signed)) && claim.signature.toLowerCase() === String(original.original.signature).toLowerCase() && claim.totalClaimed === BigInt(String(original.original.charged))
+      ).length !== 1)) {
+        throw new Error("Hosted claim transaction contains an unbound voucher");
+      }
+      const source = claims.find(
+        (claim) => computeChannelId2(claim.voucher.channel, config.network).toLowerCase() === row.channel_id && claim.voucher.maxClaimableAmount === BigInt(String(row.original.signed)) && claim.signature.toLowerCase() === String(row.original.signature).toLowerCase() && claim.totalClaimed === BigInt(String(row.original.charged))
+      );
+      if (!source) throw new Error("Hosted claim transaction did not consume the original voucher");
+      const [balance, claimed] = await client.readContract({
+        address: BATCH_SETTLEMENT_ADDRESS3,
+        abi: X402_BATCH_CHANNEL_ABI,
+        functionName: "channels",
+        args: [row.channel_id],
+        blockNumber: receipt.blockNumber
+      });
+      if (claimed < source.totalClaimed || balance < claimed) throw new Error("Hosted claim was not applied");
+      delta = source.totalClaimed - BigInt(String(row.original.claimedBefore));
+    } else {
+      if (row.rail === "x402" && row.operation === "refund") {
+        if (!transactionRecord.input) throw new Error("Hosted refund has no transaction input");
+        let refundData = transactionRecord.input;
+        let claimData;
+        if (refundData.slice(0, 10).toLowerCase() === toFunctionSelector(X402_MULTICALL_ABI[0]).toLowerCase()) {
+          const multicall = decodeFunctionData2({ abi: X402_MULTICALL_ABI, data: refundData });
+          if (multicall.functionName !== "multicall" || multicall.args[0].length !== 2) {
+            throw new Error("Hosted refund has unexpected bundled calls");
+          }
+          [claimData, refundData] = multicall.args[0];
+        }
+        const refund = decodeFunctionData2({ abi: X402_REFUND_ABI, data: refundData });
+        if (refund.functionName !== "refundWithSignature" || computeChannelId2(refund.args[0], config.network).toLowerCase() !== row.channel_id || refund.args[1] !== BigInt(String(row.original.refundAmount)) || refund.args[2] !== BigInt(String(row.original.refundNonce))) {
+          throw new Error("Hosted refund transaction differs from its original request");
+        }
+        if (claimData) {
+          const claim = decodeFunctionData2({ abi: X402_CLAIM_ABI, data: claimData });
+          if (claim.functionName !== "claimWithSignature" || claim.args[0].length !== 1 || !claim.args[0].some((source) => computeChannelId2(source.voucher.channel, config.network).toLowerCase() === row.channel_id && source.voucher.maxClaimableAmount === BigInt(String(row.original.signed)) && source.signature.toLowerCase() === String(row.original.signature).toLowerCase() && source.totalClaimed === BigInt(String(row.original.charged)))) {
+            throw new Error("Hosted refund did not consume its original claim voucher");
+          }
+        } else if (BigInt(String(row.original.charged)) > BigInt(String(row.original.claimedBefore))) {
+          throw new Error("Hosted refund did not include its original claim");
+        }
+      }
+      const event = row.rail === "x402" ? row.operation === "refund" ? X402_REFUNDED_EVENT : X402_SETTLED_EVENT : row.operation === "close" ? TEMPO_CLOSED_EVENT : TEMPO_SETTLED_EVENT;
+      if (!event) throw new Error("Hosted effect event is unsupported");
+      for (const log of receipt.logs) {
+        if (log.address.toLowerCase() !== row.contract) continue;
+        try {
+          const decoded = decodeEventLog({ abi: [event], data: log.data, topics: log.topics });
+          const args = decoded.args;
+          if (row.rail === "x402" && row.operation === "settle" && String(args.receiver).toLowerCase() === this.x402?.receiver.toLowerCase() && String(args.token).toLowerCase() === this.x402?.token.toLowerCase()) {
+            delta = BigInt(String(args.amount));
+          } else if (row.rail === "x402" && row.operation === "refund" && String(args.channelId).toLowerCase() === row.channel_id && BigInt(String(args.amount)) === BigInt(String(row.original.refundAmount))) {
+            delta = BigInt(String(row.original.charged)) - BigInt(String(row.original.claimedBefore));
+          } else if (row.rail === "tempo" && String(args.channelId).toLowerCase() === row.channel_id && String(args.payee).toLowerCase() === this.tempo?.payee.toLowerCase()) {
+            delta = row.operation === "close" ? BigInt(String(args.settledToPayee)) - BigInt(String(row.original.settledOnChain)) : BigInt(String(args.deltaPaid));
+          }
+        } catch {
+        }
+      }
+    }
+    if (delta === void 0 || delta < 0n) throw new Error("Hosted effect has no matching positive or zero result");
+    if (row.report_payload && (row.rail === "tempo" || row.operation === "settle")) {
+      const reported = row.report_payload.nativeAmount;
+      if (typeof reported !== "number" || !Number.isSafeInteger(reported) || reported < 0 || BigInt(reported) !== delta) {
+        throw new Error("Hosted payout amount differs from finalized original effect");
+      }
+    }
+    const canonical = await client.getBlock({ blockNumber: receipt.blockNumber });
+    const currentFinal = await client.getBlock({ blockTag: "finalized" });
+    if (canonical.hash.toLowerCase() !== receipt.blockHash.toLowerCase() || currentFinal.number === null || currentFinal.number < receipt.blockNumber) {
+      throw new Error("Hosted effect finality changed");
+    }
+    await transaction(this.pool, async (tx) => {
+      const current = await this.lockRow(tx, id);
+      if (current.tx_hash?.toLowerCase() !== row.tx_hash.toLowerCase() || current.block_hash && current.block_hash.toLowerCase() !== receipt.blockHash.toLowerCase() || current.delta_native && BigInt(current.delta_native) !== delta) {
+        throw new Error("Hosted effect observation conflicts with durable original");
+      }
+      const noReport = delta === 0n && (row.operation === "refund" || row.operation === "close");
+      await tx.query(
+        `UPDATE sdk_hosted_settlement_report_obligations
+            SET block_number=$2,block_hash=$3,delta_native=$4,
+                state=CASE WHEN $5 THEN 'no_report'
+                           WHEN delivered_at_ms IS NOT NULL THEN 'delivered' ELSE 'observed' END,
+                updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+          WHERE id=$1`,
+        [
+          id,
+          receipt.blockNumber.toString(),
+          receipt.blockHash.toLowerCase(),
+          delta.toString(),
+          noReport
+        ]
+      );
+    });
+    return {
+      id,
+      txHash: row.tx_hash,
+      blockNumber: receipt.blockNumber.toString(),
+      blockHash: receipt.blockHash,
+      deltaNative: delta.toString()
+    };
+  }
+  async lockRow(tx, id) {
+    const result = await tx.query(
+      "SELECT * FROM sdk_hosted_settlement_report_obligations WHERE id=$1 FOR UPDATE",
+      [id]
+    );
+    const row = result.rows[0];
+    if (!row || row.dvm_id !== this.dvmId || row.scope !== this.scope) {
+      throw new Error("Hosted settlement obligation is not owned by this mount");
+    }
+    return row;
+  }
+  async unresolvedCount(query = this.pool) {
+    const result = await query.query(
+      `SELECT COUNT(*)::text AS n FROM sdk_hosted_settlement_report_obligations
+       WHERE ${HOSTED_SETTLEMENT_UNRESOLVED_SQL}`
+    );
+    return Number(result.rows[0].n);
+  }
+  async hasCompleteHistory(query = this.pool) {
+    const result = await query.query(
+      "SELECT complete FROM sdk_hosted_settlement_report_history WHERE singleton=TRUE"
+    );
+    return result.rows[0]?.complete === true;
+  }
+  async lockIdentity(tx) {
+    const result = await tx.query(
+      "SELECT instance_id,boot_epoch FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2 FOR UPDATE",
+      [this.dvmId, this.scope]
+    );
+    if (!result.rows[0]?.instance_id || !BigInt(result.rows[0].boot_epoch)) {
+      throw new Error("Hosted settlement identity is unavailable");
+    }
+    return { instanceId: result.rows[0].instance_id, bootEpoch: result.rows[0].boot_epoch };
+  }
+  async insert(tx, identity, rail, operation, network, contract, channelId, original, operationIdentity) {
+    const priorNoEffect = await tx.query(
+      `SELECT COUNT(*)::text AS n FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail=$3 AND operation=$4 AND channel_id=$5
+         AND state='no_report'`,
+      [this.dvmId, this.scope, rail, operation, channelId]
+    );
+    const sourceKey = hash2([
+      this.dvmId,
+      this.scope,
+      rail,
+      operation,
+      network,
+      contract.toLowerCase(),
+      channelId,
+      operationIdentity,
+      priorNoEffect.rows[0].n
+    ]);
+    const competing = await tx.query(
+      `SELECT source_key FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail=$3 AND operation=$4 AND channel_id=$5
+         AND state NOT IN ('delivered','no_report') FOR UPDATE`,
+      [this.dvmId, this.scope, rail, operation, channelId]
+    );
+    if (competing.rows.some((row2) => row2.source_key !== sourceKey)) {
+      throw new Error("Hosted settlement has another unresolved original effect");
+    }
+    const id = randomUUID3();
+    const result = await tx.query(
+      `INSERT INTO sdk_hosted_settlement_report_obligations
+        (id,source_key,dvm_id,scope,instance_id,boot_epoch,rail,operation,network,
+         contract,channel_id,original,state)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,'reserved')
+       ON CONFLICT (source_key) DO NOTHING RETURNING id`,
+      [
+        id,
+        sourceKey,
+        this.dvmId,
+        this.scope,
+        identity.instanceId,
+        identity.bootEpoch,
+        rail,
+        operation,
+        network,
+        contract.toLowerCase(),
+        channelId,
+        JSON.stringify(original)
+      ]
+    );
+    if (result.rows[0]) return { id, replayed: false };
+    const prior = await tx.query(
+      "SELECT * FROM sdk_hosted_settlement_report_obligations WHERE source_key=$1",
+      [sourceKey]
+    );
+    const row = prior.rows[0];
+    if (!row || row.dvm_id !== this.dvmId || row.scope !== this.scope || row.instance_id !== identity.instanceId || !isDeepStrictEqual2(row.original, original)) throw new Error("Hosted settlement source replay conflicts");
+    return { id: row.id, replayed: true };
+  }
+};
+
+// src/sdk/server/hosting-channel-evidence.ts
+import { createHash as createHash6 } from "crypto";
+import { Session as TempoSession2 } from "mppx/tempo";
+import { createPublicClient as createPublicClient5, http as http5 } from "viem";
+import { BATCH_SETTLEMENT_ADDRESS as BATCH_SETTLEMENT_ADDRESS4 } from "@x402/evm";
+function unsigned(value) {
+  if (typeof value !== "string" && typeof value !== "bigint") return void 0;
+  try {
+    const number = BigInt(value);
+    return number >= 0n ? number : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function hex2(value, bytes) {
+  return typeof value === "string" && new RegExp(`^0x[0-9a-fA-F]{${bytes * 2}}$`).test(value);
+}
+async function rows(query, table, order) {
+  const result = await query.query(`SELECT * FROM ${table} ORDER BY ${order}`);
+  return result.rows;
+}
+async function readHostedChannelSnapshot(query) {
+  const names = [
+    "x402_batch_channels",
+    "x402_batch_settlements",
+    "mpp_tempo_channels",
+    "mpp_tempo_close_intents",
+    "x402_batch_channel_tombstones",
+    "mpp_tempo_channel_tombstones",
+    "x402_batch_channel_history",
+    "mpp_tempo_channel_history",
+    "sdk_hosted_settlement_report_obligations"
+  ];
+  const present = await query.query(
+    "SELECT name, to_regclass(name) IS NOT NULL AS exists FROM unnest($1::text[]) AS name",
+    [names]
+  );
+  const exists = new Set(present.rows.filter((row) => row.exists).map((row) => row.name));
+  const x402 = exists.has(names[0]) ? await rows(query, names[0], "channel_id") : [];
+  const x402Settlements = exists.has(names[1]) ? await rows(query, names[1], "settlement_id") : [];
+  const tempo = exists.has(names[2]) ? await rows(query, names[2], "channel_key") : [];
+  const tempoCloses = exists.has(names[3]) ? await rows(query, names[3], "channel_id") : [];
+  const x402Tombstones = exists.has(names[4]) ? await rows(query, names[4], "channel_id") : [];
+  const tempoTombstones = exists.has(names[5]) ? await rows(query, names[5], "channel_key") : [];
+  const effects = exists.has(names[8]) ? await rows(query, names[8], "source_key") : [];
+  const history = async (table) => {
+    if (!exists.has(table)) return null;
+    const result = await query.query(`SELECT complete FROM ${table} WHERE singleton=TRUE`);
+    return result.rows.length === 1 ? result.rows[0].complete === true : false;
   };
+  const x402HistoryComplete = await history(names[6]);
+  const tempoHistoryComplete = await history(names[7]);
+  const digest = createHash6("sha256").update(JSON.stringify({
+    present: [...exists].sort(),
+    x402,
+    x402Tombstones,
+    x402Settlements,
+    tempo,
+    tempoTombstones,
+    tempoCloses,
+    effects,
+    x402HistoryComplete,
+    tempoHistoryComplete
+  })).digest("hex");
   return {
-    verified: true,
-    amountMsats: btcUsdRate > 0 ? usdcToMsats(amountUsdcMicro / 1e6, btcUsdRate) : 0,
-    amountUsdcMicro,
-    txHash: intent.transaction,
-    settleResponseHeader: encodeSettleResponseHeader(response)
+    digest,
+    present: [...exists],
+    x402,
+    x402Tombstones,
+    x402Settlements,
+    tempo,
+    tempoTombstones,
+    tempoCloses,
+    effects,
+    x402HistoryComplete,
+    tempoHistoryComplete
   };
 }
-function settlementMayHaveMoved(response) {
-  const reason = response.errorReason?.toLowerCase() ?? "";
-  return reason.includes("authorization_already_used") || reason.includes("authorization already used") || /facilitator_status_5\d\d/.test(reason);
-}
-function hash(parts) {
-  return createHash4("sha256").update(JSON.stringify(parts)).digest("hex");
+async function finalized(client, expectedChainId) {
+  const chainId = await client.getChainId();
+  if (chainId !== expectedChainId) throw new Error("configured RPC chain mismatch");
+  const block = await client.getBlock({ blockTag: "finalized" });
+  if (block.number === null || !hex2(block.hash, 32)) throw new Error("finalized block unavailable");
+  return { chainId, number: block.number, hash: block.hash };
+}
+async function stillFinalized(client, selected) {
+  const [canonical, current] = await Promise.all([
+    client.getBlock({ blockNumber: selected.number }),
+    client.getBlock({ blockTag: "finalized" })
+  ]);
+  if (canonical.hash.toLowerCase() !== selected.hash.toLowerCase() || current.number === null || current.number < selected.number) {
+    throw new Error("finalized block changed");
+  }
 }
-function safeError(err) {
-  if (err instanceof Error) return err.name;
-  return "settlement_transport_error";
+async function verifyOriginalEffect(client, effect, selected, contract, requireSignedCall) {
+  const number = unsigned(effect.block_number);
+  const delta = unsigned(effect.delta_native);
+  if (!hex2(effect.tx_hash, 32) || !hex2(effect.block_hash, 32) || number === void 0 || number > selected || delta === void 0 || effect.contract !== contract || effect.state !== "delivered" && effect.state !== "no_report" || effect.state === "no_report" && (delta !== 0n || effect.operation !== "refund" && effect.operation !== "close")) {
+    throw new Error("original settlement or report remains unresolved");
+  }
+  const [receipt, canonical] = await Promise.all([
+    client.getTransactionReceipt({ hash: effect.tx_hash }),
+    client.getBlock({ blockNumber: number })
+  ]);
+  if (receipt.status !== "success" || receipt.blockNumber !== number || receipt.transactionHash.toLowerCase() !== effect.tx_hash.toLowerCase() || receipt.blockHash.toLowerCase() !== effect.block_hash.toLowerCase() || canonical.hash.toLowerCase() !== effect.block_hash.toLowerCase()) {
+    throw new Error("original effect receipt is not canonical at the selected block");
+  }
+  if (requireSignedCall) {
+    const original = effect.original;
+    const call = original?.authorizationCallData;
+    if (typeof call !== "string" || !/^0x(?:[0-9a-f]{2})+$/i.test(call)) {
+      throw new Error("original signed call is unknown");
+    }
+    const transaction2 = await client.getTransaction({ hash: effect.tx_hash });
+    if (transaction2.to?.toLowerCase() !== contract || transaction2.input.toLowerCase() !== call.toLowerCase()) {
+      throw new Error("original signed call differs from the finalized transaction");
+    }
+  }
+  return delta;
 }
+var HostedChannelEvidenceReader = class _HostedChannelEvidenceReader {
+  constructor(pool, x402, tempo) {
+    this.pool = pool;
+    this.x402 = x402;
+    this.tempo = tempo;
+  }
+  pool;
+  x402;
+  tempo;
+  static async fromServerConfig(pool, config) {
+    let x402;
+    if (config.x402) {
+      const spec = x402NetworkByCaip2(config.x402.network);
+      if (spec) {
+        const chains = await import("viem/chains");
+        const chain = chains[spec.viemChain];
+        if (chain) {
+          const rpcUrl = resolveRpcOverride(config.x402.rpcUrl, chain.rpcUrls.default.http[0]).url;
+          x402 = {
+            client: createPublicClient5({ chain, transport: http5(rpcUrl) }),
+            chainId: chain.id
+          };
+        }
+      }
+    }
+    let tempo;
+    if (config.tempoEnv) {
+      const network = resolveTempoNetwork(config.tempoEnv);
+      const { tempo: mainnet, tempoModerato: moderato } = await import("viem/chains");
+      const chain = network.chainId === TEMPO_MODERATO_CHAIN_ID ? moderato : mainnet;
+      const rpcUrl = resolveRpcOverride(
+        config.tempoEnv.DVMKIT_TEMPO_RPC_URL,
+        network.chainId === TEMPO_MODERATO_CHAIN_ID ? TEMPO_MODERATO_RPC : chain.rpcUrls.default.http[0]
+      ).url;
+      tempo = {
+        client: createPublicClient5({ chain, transport: http5(rpcUrl) }),
+        chainId: network.chainId,
+        currency: network.currency.toLowerCase()
+      };
+    }
+    return new _HostedChannelEvidenceReader(pool, x402, tempo);
+  }
+  async observe(identity) {
+    const snapshot = await readHostedChannelSnapshot(this.pool);
+    const observation = { digest: snapshot.digest, x402: null, tempo: null, reasons: [] };
+    if ((snapshot.present.includes("x402_batch_channels") || snapshot.present.includes("x402_batch_channel_tombstones")) && snapshot.x402HistoryComplete !== true) {
+      observation.reasons.push("x402_channel_history_incomplete");
+    }
+    if ((snapshot.present.includes("mpp_tempo_channels") || snapshot.present.includes("mpp_tempo_channel_tombstones")) && snapshot.tempoHistoryComplete !== true) {
+      observation.reasons.push("tempo_channel_history_incomplete");
+    }
+    if (this.x402 && !snapshot.present.includes("x402_batch_channel_tombstones")) {
+      observation.reasons.push("x402_channel_history_missing");
+    }
+    if (this.tempo && (!snapshot.present.includes("mpp_tempo_channels") || !snapshot.present.includes("mpp_tempo_close_intents") || !snapshot.present.includes("mpp_tempo_channel_tombstones"))) {
+      observation.reasons.push("tempo_channel_history_missing");
+    }
+    if (snapshot.x402.length || snapshot.x402Tombstones.length || snapshot.effects.some((effect) => effect.rail === "x402")) {
+      try {
+        observation.x402 = await this.observeX402(snapshot, identity);
+      } catch {
+        observation.reasons.push("x402_channel_evidence_unresolved");
+      }
+    }
+    if (snapshot.tempo.length || snapshot.tempoTombstones.length || snapshot.tempoCloses.length || snapshot.effects.some((effect) => effect.rail === "tempo")) {
+      try {
+        observation.tempo = await this.observeTempo(snapshot, identity);
+      } catch {
+        observation.reasons.push("tempo_channel_evidence_unresolved");
+      }
+    }
+    return observation;
+  }
+  async observeX402(snapshot, identity) {
+    if (!this.x402 || !identity || snapshot.x402Settlements.some((row) => row.status !== "complete")) {
+      throw new Error("x402 settlement unresolved");
+    }
+    const { client, chainId } = this.x402;
+    const block = await finalized(client, chainId);
+    const channels = [];
+    const channelIds = new Set([...snapshot.x402, ...snapshot.x402Tombstones].map((row) => row.channel_id));
+    if (snapshot.effects.some((effect) => effect.rail === "x402" && (effect.operation === "claim" || effect.operation === "refund") && !channelIds.has(effect.channel_id))) throw new Error("original x402 channel disappeared");
+    for (const row of [...snapshot.x402, ...snapshot.x402Tombstones]) {
+      if (!hex2(row.channel_id, 32)) throw new Error("invalid channel");
+      if (row.pending_request !== null) {
+        const pending2 = row.pending_request;
+        const pendingId = pending2 && typeof pending2 === "object" && !Array.isArray(pending2) ? pending2.pendingId : void 0;
+        if (!snapshot.x402Tombstones.includes(row) || typeof pendingId !== "string" || !snapshot.x402Settlements.some((settlement) => settlement.channel_id === row.channel_id && settlement.pending_id === pendingId && settlement.status === "complete")) throw new Error("x402 request remains pending");
+      }
+      const binding = row.hosting_binding;
+      if (!binding || typeof binding !== "object" || Array.isArray(binding)) {
+        throw new Error("historical x402 channel has no original network");
+      }
+      const original = binding;
+      if (original.network !== `eip155:${chainId}` || original.chainId !== chainId || original.contract !== BATCH_SETTLEMENT_ADDRESS4.toLowerCase() || original.version !== "x402-batch-settlement-v1" || original.channelId !== row.channel_id) {
+        throw new Error("x402 channel original contract differs from configured chain");
+      }
+      const charged = unsigned(row.charged_cumulative_amount);
+      const signed = unsigned(row.signed_max_claimable);
+      const localNonce = unsigned(row.refund_nonce);
+      if (charged === void 0 || signed === void 0 || localNonce === void 0) throw new Error("unpriced channel");
+      const originalEffects = snapshot.effects.filter((effect) => effect.rail === "x402" && (effect.operation === "claim" || effect.operation === "refund") && effect.channel_id === row.channel_id);
+      const intervals = [];
+      const refundNonces = [];
+      for (const effect of originalEffects) {
+        if (effect.dvm_id !== identity.dvmId || effect.scope !== identity.scope || effect.instance_id !== identity.instanceId || effect.network !== original.network) {
+          throw new Error("original x402 effect has another owner or chain");
+        }
+        const delta = await verifyOriginalEffect(
+          client,
+          effect,
+          block.number,
+          BATCH_SETTLEMENT_ADDRESS4.toLowerCase(),
+          true
+        );
+        const source = effect.original;
+        const start = unsigned(source?.claimedBefore);
+        const end = unsigned(source?.charged);
+        if (start === void 0 || end === void 0 || end < start || end - start !== delta) {
+          throw new Error("original x402 claim interval is incomplete");
+        }
+        if (end > start) intervals.push({ start, end });
+        if (effect.operation === "refund") {
+          const preRefundNonce = unsigned(source?.refundNonce);
+          if (preRefundNonce === void 0) throw new Error("original x402 refund nonce is unknown");
+          refundNonces.push(preRefundNonce);
+        }
+      }
+      intervals.sort((a, b) => a.start < b.start ? -1 : a.start > b.start ? 1 : 0);
+      let covered = 0n;
+      for (const interval of intervals) {
+        if (interval.start !== covered) throw new Error("original x402 claims have a gap or duplicate");
+        covered = interval.end;
+      }
+      if (covered < charged || covered < signed) {
+        throw new Error("original x402 effects do not cover accepted voucher authority");
+      }
+      refundNonces.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+      for (let index = 0; index < refundNonces.length; index++) {
+        if (refundNonces[index] !== BigInt(index)) {
+          throw new Error("original x402 refunds have a gap or duplicate nonce");
+        }
+      }
+      const [state, withdrawal, nonce] = await Promise.all([
+        client.readContract({
+          address: BATCH_SETTLEMENT_ADDRESS4,
+          abi: X402_BATCH_CHANNEL_ABI,
+          functionName: "channels",
+          args: [row.channel_id],
+          blockNumber: block.number
+        }),
+        client.readContract({
+          address: BATCH_SETTLEMENT_ADDRESS4,
+          abi: X402_BATCH_CHANNEL_ABI,
+          functionName: "pendingWithdrawals",
+          args: [row.channel_id],
+          blockNumber: block.number
+        }),
+        client.readContract({
+          address: BATCH_SETTLEMENT_ADDRESS4,
+          abi: X402_BATCH_CHANNEL_ABI,
+          functionName: "refundNonce",
+          args: [row.channel_id],
+          blockNumber: block.number
+        })
+      ]);
+      const [balance, claimed] = state;
+      const [pending, initiatedAt] = withdrawal;
+      if (balance !== claimed || BigInt(pending) !== 0n || initiatedAt !== 0 || claimed !== covered || localNonce > BigInt(refundNonces.length) || nonce !== BigInt(refundNonces.length)) {
+        throw new Error("x402 balance, original claims, or refunds remain unresolved");
+      }
+      channels.push(row.channel_id);
+    }
+    for (const effect of snapshot.effects.filter((row) => row.rail === "x402" && row.operation === "settle")) {
+      if (effect.dvm_id !== identity.dvmId || effect.scope !== identity.scope || effect.instance_id !== identity.instanceId || effect.network !== `eip155:${chainId}`) {
+        throw new Error("original x402 payout has another owner or chain");
+      }
+      await verifyOriginalEffect(
+        client,
+        effect,
+        block.number,
+        BATCH_SETTLEMENT_ADDRESS4.toLowerCase(),
+        false
+      );
+    }
+    await stillFinalized(client, block);
+    return { chainId, blockNumber: block.number.toString(), blockHash: block.hash, channels };
+  }
+  async observeTempo(snapshot, identity) {
+    const tempoRows = [...snapshot.tempo, ...snapshot.tempoTombstones.filter((row) => !snapshot.tempo.some((live) => live.channel_key === row.channel_key))];
+    if (!this.tempo || !identity || snapshot.tempoCloses.length !== tempoRows.length || snapshot.tempoCloses.some((close) => !tempoRows.some((row) => row.channel_key === close.channel_id))) {
+      throw new Error("Tempo close facts incomplete");
+    }
+    const { client, chainId, currency } = this.tempo;
+    const block = await finalized(client, chainId);
+    const channels = [];
+    if (snapshot.effects.some((effect) => effect.rail === "tempo" && !tempoRows.some((row) => row.channel_key === effect.channel_id))) {
+      throw new Error("original Tempo channel disappeared");
+    }
+    for (const row of tempoRows) {
+      const state = typeof row.state_json === "string" ? parseStoreValue(row.state_json) : void 0;
+      if (!state || typeof state !== "object" || Array.isArray(state)) throw new Error("Tempo state invalid");
+      const local = state;
+      const channelId = local.channelId;
+      const escrow = local.escrowContract;
+      const payer = local.payer;
+      const payee = local.payee;
+      const close = snapshot.tempoCloses.find((item) => item.channel_id === channelId);
+      const spent = unsigned(local.spent);
+      const highest = unsigned(local.highestVoucherAmount);
+      const settled = unsigned(local.settledOnChain);
+      const deposit = unsigned(local.deposit);
+      const requested = unsigned(local.closeRequestedAt);
+      if (!hex2(channelId, 32) || row.channel_key !== channelId.toLowerCase() || !hex2(escrow, 20) || escrow.toLowerCase() !== TempoSession2.Precompile.Constants.tip20ChannelEscrow.toLowerCase() || !hex2(payer, 20) || !hex2(payee, 20) || local.chainId !== chainId || String(local.token).toLowerCase() !== currency || local.finalized !== true || spent === void 0 || highest === void 0 || settled === void 0 || deposit === void 0 || requested === void 0 || !close || close.forecast_pending !== false || !hex2(close.reference, 32)) {
+        throw new Error("Tempo local close evidence incomplete");
+      }
+      const [chain, receipt] = await Promise.all([
+        TempoSession2.Precompile.Chain.getChannelState(client, channelId, escrow, block.number),
+        client.getTransactionReceipt({ hash: close.reference })
+      ]);
+      if (chain.deposit !== 0n || chain.settled < spent || chain.settled < settled || receipt.status !== "success" || receipt.blockNumber > block.number || receipt.transactionHash.toLowerCase() !== close.reference.toLowerCase() || !hex2(receipt.blockHash, 32)) throw new Error("Tempo chain close not complete");
+      const receiptBlock = await client.getBlock({ blockNumber: receipt.blockNumber });
+      if (receiptBlock.hash.toLowerCase() !== receipt.blockHash.toLowerCase()) {
+        throw new Error("Tempo close receipt is not canonical");
+      }
+      const event = TempoSession2.Precompile.Chain.getChannelEvent(
+        {
+          ...receipt,
+          logs: receipt.logs.filter((log) => log.address.toLowerCase() === escrow.toLowerCase())
+        },
+        "ChannelClosed",
+        channelId
+      );
+      const amounts = TempoSession2.Precompile.Chain.readChannelClosedReceiptFields(event);
+      if (chain.settled + amounts.refundedToPayer < highest) {
+        throw new Error("Tempo close did not cover the accepted voucher");
+      }
+      const effects = snapshot.effects.filter((effect) => effect.rail === "tempo" && effect.channel_id === channelId);
+      const closes = effects.filter((effect) => effect.operation === "close" && effect.tx_hash === close.reference);
+      if (closes.length !== 1) throw new Error("Tempo close has no original effect");
+      for (const effect of effects) {
+        if (effect.dvm_id !== identity.dvmId || effect.scope !== identity.scope || effect.instance_id !== identity.instanceId || effect.network !== `eip155:${chainId}`) {
+          throw new Error("original Tempo effect has another owner or chain");
+        }
+        const delta = await verifyOriginalEffect(
+          client,
+          effect,
+          block.number,
+          escrow.toLowerCase(),
+          false
+        );
+        if (effect.operation === "close") {
+          const original = effect.original;
+          const before = unsigned(original?.settledOnChain);
+          const accepted = unsigned(original?.highestVoucherAmount);
+          if (before === void 0 || accepted === void 0 || before + delta !== chain.settled || accepted < highest || effect.block_hash !== receipt.blockHash.toLowerCase()) {
+            throw new Error("Tempo original close does not discharge the accepted spend");
+          }
+        }
+      }
+      channels.push(channelId);
+    }
+    await stillFinalized(client, block);
+    return { chainId, blockNumber: block.number.toString(), blockHash: block.hash, channels };
+  }
+};
 
 // src/sdk/server/hosting-control.ts
-import { createHmac, timingSafeEqual } from "crypto";
 function signHostingControl(secret, command) {
   const signed = command.version === 2 ? [
     "dvmkit-hosting-v2",
@@ -9115,18 +10852,35 @@ function signHostingControl(secret, command) {
   ];
   return createHmac("sha256", secret).update(JSON.stringify(signed)).digest("hex");
 }
+function signHostingClosure(secret, command) {
+  return createHmac("sha256", secret).update(JSON.stringify([
+    "dvmkit-hosting-closure-v3",
+    command.action,
+    command.scope,
+    command.dvmId,
+    command.generation,
+    command.operationId,
+    command.timestampMs,
+    command.nonce
+  ])).digest("hex");
+}
 var HostingControl = class {
-  constructor(pool, dvmId, config) {
+  constructor(pool, dvmId, config, channelReader) {
     this.pool = pool;
     this.dvmId = dvmId;
     this.config = config;
+    this.channelReader = channelReader;
     if (Buffer.byteLength(config.secret) < 32 || !config.scope) {
       throw new Error("Hosting control requires a 32-byte secret and a non-empty scope");
     }
+    this.cleanupFence = new HostingCleanupFence(pool, dvmId, config.scope);
   }
   pool;
   dvmId;
   config;
+  channelReader;
+  cleanupFence;
+  bootEpoch;
   async init() {
     await withSdkInitLock(this.pool, async () => {
       await this.pool.query(`
@@ -9140,17 +10894,27 @@ var HostingControl = class {
         created_at_ms BIGINT NOT NULL,
         PRIMARY KEY (dvm_id, scope, nonce)
       );
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS lease_expires_at_ms BIGINT;
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS instance_id TEXT;
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS boot_epoch BIGINT NOT NULL DEFAULT 0;
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS closed_operation_id TEXT;
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS closed_at_ms BIGINT;
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS closed_at_us BIGINT;
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS cutoff_txid BIGINT;
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS channel_evidence JSONB;
       CREATE TABLE IF NOT EXISTS sdk_hosting_admissions (
         id TEXT PRIMARY KEY, dvm_id TEXT NOT NULL, scope TEXT NOT NULL,
         job_id TEXT NOT NULL, admitted_at_ms BIGINT NOT NULL,
         outcome TEXT NOT NULL DEFAULT 'pending', drain_deadline_ms BIGINT,
-        credit_id TEXT, fund_id TEXT, payment_artifact_hash TEXT
+        credit_id TEXT, fund_id TEXT, caller_pubkey TEXT, funding_commitment TEXT,
+        payment_artifact_hash TEXT
       );
       ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS drain_deadline_ms BIGINT;
       ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS credit_id TEXT;
       ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS fund_id TEXT;
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS caller_pubkey TEXT;
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS funding_commitment TEXT;
       ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS payment_artifact_hash TEXT;
-      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS lease_expires_at_ms BIGINT;
       CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_pending
         ON sdk_hosting_admissions (dvm_id, scope) WHERE outcome = 'pending';
       CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_unresolved
@@ -9170,6 +10934,14 @@ var HostingControl = class {
       const client = await this.pool.connect();
       try {
         await client.query("BEGIN");
+        const boot = await client.query(
+          `UPDATE sdk_hosting_control
+           SET instance_id=COALESCE(instance_id,$3), boot_epoch=boot_epoch+1
+           WHERE dvm_id=$1 AND scope=$2 RETURNING boot_epoch`,
+          [this.dvmId, this.config.scope, randomUUID4()]
+        );
+        if (!boot.rows[0]) throw new Error("Hosting control identity was not initialized");
+        this.bootEpoch = Number(boot.rows[0].boot_epoch);
         const migrated = await client.query(
           `UPDATE sdk_hosting_control SET state='draining',
              deadline_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint + 3600000
@@ -9200,16 +10972,342 @@ var HostingControl = class {
     await this.pool.query("DELETE FROM sdk_hosting_nonces WHERE created_at_ms < $1", [Date.now() - 6e5]);
     return result.rowCount === 1;
   }
+  async authorizeClosure(command, signature) {
+    if (command?.version !== 3 || command.action !== "close" && command.action !== "certificate" || command.scope !== this.config.scope || command.dvmId !== this.dvmId || !Number.isSafeInteger(command.generation) || command.generation < 1 || typeof command.operationId !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(command.operationId) || !Number.isSafeInteger(command.timestampMs) || Math.abs(Date.now() - command.timestampMs) > 3e5 || typeof command.nonce !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(command.nonce) || !signature || !/^[0-9a-f]{64}$/i.test(signature)) return false;
+    if (!timingSafeEqual(
+      Buffer.from(signature, "hex"),
+      Buffer.from(signHostingClosure(this.config.secret, command), "hex")
+    )) return false;
+    const inserted = await this.pool.query(
+      `INSERT INTO sdk_hosting_nonces (dvm_id, scope, nonce, created_at_ms)
+       VALUES ($1,$2,$3,$4) ON CONFLICT DO NOTHING`,
+      [this.dvmId, this.config.scope, command.nonce, Date.now()]
+    );
+    return inserted.rowCount === 1;
+  }
+  async close(command, support) {
+    if (command.action !== "close") return "conflict";
+    if (!Object.values(support).every(Boolean)) return "conflict";
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const locked = await client.query(
+        `SELECT state, generation, deadline_ms, closed_operation_id FROM sdk_hosting_control
+         WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
+        [this.dvmId, this.config.scope]
+      );
+      const prior = locked.rows[0];
+      if (!prior) throw new Error("Hosting control identity is unavailable");
+      if (prior.state === "closed") {
+        await client.query("COMMIT");
+        return Number(prior.generation) === command.generation && prior.closed_operation_id === command.operationId ? "ok" : "conflict";
+      }
+      if (command.generation <= Number(prior.generation)) {
+        await client.query("ROLLBACK");
+        return "conflict";
+      }
+      const now = await this.databaseNow(client);
+      const deadline = prior.deadline_ms === null ? now + 36e5 : Math.min(Number(prior.deadline_ms), now + 36e5);
+      await client.query(
+        `UPDATE sdk_hosting_control
+         SET state='closed', generation=$3, closed_operation_id=$4,
+             closed_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
+             closed_at_us=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000000)::bigint,
+             cutoff_txid=txid_current(), channel_evidence=NULL,
+             lease_expires_at_ms=NULL, deadline_ms=$5
+         WHERE dvm_id=$1 AND scope=$2`,
+        [this.dvmId, this.config.scope, command.generation, command.operationId, deadline]
+      );
+      await this.pinAdmissionDeadlines(client, deadline);
+      await client.query("COMMIT");
+      return "ok";
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async certificate(command, support) {
+    if (command.action !== "certificate" || this.bootEpoch === void 0) return void 0;
+    const observedClosure = await this.pool.query(`SELECT state,generation,closed_operation_id,boot_epoch,cutoff_txid,instance_id
+        FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2`, [this.dvmId, this.config.scope]);
+    const observed = observedClosure.rows[0];
+    if (observed?.state !== "closed" || observed.closed_operation_id !== command.operationId || Number(observed.generation) !== command.generation || Number(observed.boot_epoch) !== this.bootEpoch || observed.cutoff_txid === null || observed.instance_id === null) return void 0;
+    const channelObservation = this.channelReader ? await this.channelReader.observe({
+      dvmId: this.dvmId,
+      scope: this.config.scope,
+      instanceId: observed.instance_id
+    }).catch(() => void 0) : void 0;
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const locked = await client.query(
+        `SELECT state,generation,instance_id,boot_epoch,closed_operation_id,closed_at_ms,
+                closed_at_us,cutoff_txid
+         FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
+        [this.dvmId, this.config.scope]
+      );
+      const row = locked.rows[0];
+      if (!row || row.state !== "closed" || row.closed_operation_id !== command.operationId || Number(row.generation) !== command.generation || Number(row.boot_epoch) !== this.bootEpoch || row.instance_id === null || row.instance_id !== observed.instance_id || row.closed_at_ms === null || row.closed_at_us === null || row.cutoff_txid === null || row.cutoff_txid !== observed.cutoff_txid) {
+        await client.query("ROLLBACK");
+        return void 0;
+      }
+      const reasons = [];
+      if (!support.singleMount) reasons.push("multi_mount_ledger_unowned");
+      if (!support.durableLedger) reasons.push("credit_ledger_unavailable");
+      if (!support.durableJobStore) reasons.push("job_store_unavailable");
+      if (!support.durableReporter) reasons.push("reporter_unavailable");
+      if (!support.durablePaymentReplay) reasons.push("payment_replay_unavailable");
+      if (!support.knownRailStores) reasons.push("rail_store_unsupported");
+      const tables = [
+        "jobs",
+        "job_messages",
+        "request_id_claims",
+        "sdk_hosting_admissions",
+        "credits",
+        "credit_draws",
+        "credit_drains",
+        "credit_invoices",
+        "credit_fundings",
+        "pending_dvm_reports",
+        "payout_x402_batches",
+        "x402_exact_settlement_intents",
+        "x402_batch_settlements",
+        "x402_batch_settlement_state",
+        "x402_batch_channels",
+        "mpp_tempo_channels",
+        "mpp_tempo_close_intents",
+        "tempo_settlement_readiness",
+        "mpp_tempo_charge_replays",
+        "sdk_hosted_tempo_charge_intents",
+        "sdk_hosted_settlement_report_history",
+        "sdk_hosted_settlement_report_obligations"
+      ];
+      const present = await client.query(
+        `SELECT name, to_regclass(name) IS NOT NULL AS exists FROM unnest($1::text[]) AS name`,
+        [tables]
+      );
+      const exists = new Set(present.rows.filter((table) => table.exists).map((table) => table.name));
+      for (const required of [
+        "jobs",
+        "job_messages",
+        "request_id_claims",
+        "sdk_hosting_admissions",
+        "credits",
+        "credit_draws",
+        "credit_drains",
+        "credit_invoices",
+        "credit_fundings",
+        "pending_dvm_reports",
+        "payout_x402_batches",
+        "sdk_hosted_settlement_report_history",
+        "sdk_hosted_settlement_report_obligations"
+      ]) {
+        if (!exists.has(required)) reasons.push(`missing_${required}`);
+      }
+      const count = async (table, predicate, params = []) => {
+        if (!exists.has(table)) return 0;
+        const result = await client.query(
+          `SELECT COUNT(*)::text AS n FROM ${table} WHERE ${predicate}`,
+          params
+        );
+        return Number(result.rows[0].n);
+      };
+      if (await count(
+        "sdk_hosting_admissions",
+        "dvm_id=$1 AND scope=$2 AND outcome IN ('pending','unresolved')",
+        [this.dvmId, this.config.scope]
+      )) reasons.push("admissions_unresolved");
+      if (await count(
+        "sdk_hosting_admissions",
+        "dvm_id<>$1 OR scope<>$2",
+        [this.dvmId, this.config.scope]
+      )) reasons.push("historical_admission_owner_unknown");
+      if (exists.has("sdk_hosting_admissions") && exists.has("credit_fundings")) {
+        const unbooked = await client.query(
+          `SELECT COUNT(*)::text AS n FROM sdk_hosting_admissions a
+           WHERE a.dvm_id=$1 AND a.scope=$2 AND a.outcome='accepted'
+             AND a.credit_id IS NOT NULL AND a.fund_id IS NOT NULL
+             AND NOT EXISTS (SELECT 1 FROM credit_fundings f
+               WHERE f.credit_id=a.credit_id AND f.fund_id=a.fund_id)`,
+          [this.dvmId, this.config.scope]
+        );
+        if (Number(unbooked.rows[0].n)) reasons.push("funding_intents_unbooked");
+      }
+      if (await count(
+        "jobs",
+        "(dvm_id=$1 OR dvm_id IS NULL) AND status NOT IN ('completed','failed','cancelled')",
+        [this.dvmId]
+      )) reasons.push("jobs_in_flight_or_unowned");
+      if (await count("jobs", "dvm_id IS DISTINCT FROM $1", [this.dvmId])) {
+        reasons.push("historical_job_owner_unknown");
+      }
+      if (await count(
+        "jobs",
+        "dvm_id=$1 AND status IN ('completed','failed','cancelled') AND terminal_report_enqueued IS DISTINCT FROM TRUE",
+        [this.dvmId]
+      )) reasons.push("terminal_reports_unenqueued");
+      if (await count("job_messages", "status IN ('pending-verification','failed-verify') AND data->>'type'='payment'")) {
+        reasons.push("inbound_payments_unresolved");
+      }
+      if (exists.has("request_id_claims") && exists.has("jobs")) {
+        const claims = await client.query(
+          `SELECT COUNT(*)::text AS n FROM request_id_claims c
+           LEFT JOIN jobs j ON j.id=c.job_id WHERE j.id IS NULL`
+        );
+        if (Number(claims.rows[0].n)) reasons.push("request_claims_unowned");
+      }
+      if (await count("credit_draws", "status='pending'")) reasons.push("draws_pending");
+      if (await count("credit_invoices", "status NOT IN ('settled','reconciled')")) {
+        reasons.push("invoices_unresolved");
+      }
+      if (await count("credit_invoices", "hosting_admission_id IS NULL")) {
+        reasons.push("historical_invoice_owner_unknown");
+      }
+      if (await count(
+        "credit_fundings",
+        "caller_pubkey IS NULL OR balance_after_micro IS NULL OR rail IS NULL"
+      )) {
+        reasons.push("funding_facts_incomplete");
+      }
+      if (await count("pending_dvm_reports", "TRUE")) reasons.push("reports_pending_or_unowned");
+      if (exists.has("sdk_hosted_settlement_report_history")) {
+        const history = await client.query(
+          "SELECT complete FROM sdk_hosted_settlement_report_history WHERE singleton=TRUE"
+        );
+        if (history.rows[0]?.complete !== true) reasons.push("historical_settlement_report_provenance_unknown");
+      }
+      if (await count(
+        "sdk_hosted_settlement_report_obligations",
+        HOSTED_SETTLEMENT_UNRESOLVED_SQL
+      )) {
+        reasons.push("settlement_reports_unresolved");
+      }
+      if (await count(
+        "sdk_hosted_settlement_report_obligations",
+        "dvm_id<>$1 OR scope<>$2 OR instance_id<>$3",
+        [this.dvmId, this.config.scope, row.instance_id]
+      )) {
+        reasons.push("historical_settlement_owner_unknown");
+      }
+      if (await count("payout_x402_batches", "TRUE")) reasons.push("x402_payout_batches_pending");
+      if (await count("x402_exact_settlement_intents", "status NOT IN ('complete','rejected')")) {
+        reasons.push("x402_exact_unresolved");
+      }
+      if (await count("x402_batch_settlements", "status <> 'complete'")) {
+        reasons.push("x402_batch_unresolved");
+      }
+      if (exists.has("x402_batch_channels") && !exists.has("x402_batch_settlement_state")) {
+        reasons.push("x402_payout_transfer_state_missing");
+      }
+      if (await count("x402_batch_settlement_state", "pending_settle=TRUE")) {
+        reasons.push("x402_payout_transfer_pending");
+      }
+      const channelSnapshot = await readHostedChannelSnapshot(client);
+      if (this.channelReader && !channelObservation) reasons.push("channel_evidence_unavailable");
+      if (channelSnapshot.present.includes("x402_batch_channels") && channelSnapshot.x402HistoryComplete !== true) reasons.push("x402_channel_history_incomplete");
+      if (channelSnapshot.present.includes("mpp_tempo_channels") && channelSnapshot.tempoHistoryComplete !== true) reasons.push("tempo_channel_history_incomplete");
+      const observationCurrent = channelObservation?.digest === channelSnapshot.digest;
+      const x402FactCount = channelSnapshot.x402.length + channelSnapshot.x402Tombstones.length;
+      if (x402FactCount && (!observationCurrent || !channelObservation?.x402 || channelObservation.x402.channels.length !== x402FactCount)) {
+        reasons.push("x402_channel_evidence_unresolved");
+      }
+      const tempoFactCount = new Set([...channelSnapshot.tempo, ...channelSnapshot.tempoTombstones].map((channel) => channel.channel_key)).size;
+      if ((tempoFactCount || channelSnapshot.tempoCloses.length) && (!observationCurrent || !channelObservation?.tempo || channelObservation.tempo.channels.length !== tempoFactCount)) {
+        reasons.push("tempo_channel_evidence_unresolved");
+      }
+      if (channelObservation && !observationCurrent) reasons.push("channel_evidence_stale");
+      if (channelObservation?.reasons.length) reasons.push(...channelObservation.reasons);
+      if (await count("tempo_settlement_readiness", "failure_latched=TRUE")) {
+        reasons.push("tempo_settlement_unresolved");
+      }
+      if (support.knownRailStores && !exists.has("sdk_hosted_tempo_charge_intents") && exists.has("mpp_tempo_charge_replays")) reasons.push("tempo_charge_intents_missing");
+      if (await count("sdk_hosted_tempo_charge_intents", "status <> 'complete'")) {
+        reasons.push("tempo_charge_unresolved");
+      }
+      if (await count("mpp_tempo_charge_replays", "TRUE")) {
+        reasons.push("tempo_charge_store_not_quiescent");
+      }
+      const liabilities = [];
+      if (exists.has("credits") && exists.has("credit_drains")) {
+        const balances = await client.query(
+          `SELECT currency, SUM(amount_micro)::text AS amount_micro FROM (
+             SELECT currency, balance_micro AS amount_micro FROM credits WHERE balance_micro > 0
+             UNION ALL
+             SELECT c.currency, d.amount_micro FROM credit_drains d
+             JOIN credits c ON c.credit_id=d.credit_id WHERE d.status <> 'sent' AND d.status <> 'released'
+           ) owed GROUP BY currency ORDER BY currency`
+        );
+        liabilities.push(...balances.rows.map((balance) => ({
+          currency: balance.currency,
+          amountMicro: balance.amount_micro
+        })));
+        if (await count("credit_drains", "status <> 'sent' AND status <> 'released' AND owed_sats IS NULL")) {
+          reasons.push("drain_value_unpriced");
+        }
+        const orphan = await client.query(
+          `SELECT COUNT(*)::text AS n FROM credit_drains d
+           LEFT JOIN credits c ON c.credit_id=d.credit_id WHERE c.credit_id IS NULL`
+        );
+        if (Number(orphan.rows[0].n)) reasons.push("drain_owner_unknown");
+      }
+      if (liabilities.length) reasons.push("caller_liability_positive");
+      if (reasons.length === 0 && observationCurrent && channelObservation) {
+        const persisted = {
+          dvmId: this.dvmId,
+          scope: this.config.scope,
+          instanceId: row.instance_id,
+          bootEpoch: this.bootEpoch,
+          generation: command.generation,
+          operationId: command.operationId,
+          cutoffTxid: row.cutoff_txid,
+          digest: channelSnapshot.digest,
+          x402: channelObservation.x402,
+          tempo: channelObservation.tempo
+        };
+        const saved = await client.query(
+          `UPDATE sdk_hosting_control SET channel_evidence=$3::jsonb
+           WHERE dvm_id=$1 AND scope=$2 RETURNING channel_evidence`,
+          [this.dvmId, this.config.scope, JSON.stringify(persisted)]
+        );
+        if (saved.rows[0]?.channel_evidence?.digest !== channelSnapshot.digest || saved.rows[0]?.channel_evidence?.operationId !== command.operationId || saved.rows[0]?.channel_evidence?.bootEpoch !== this.bootEpoch) {
+          throw new Error("Hosting channel evidence could not be persisted for this closure");
+        }
+      }
+      await client.query("COMMIT");
+      const complete = reasons.length === 0;
+      return {
+        dvmId: this.dvmId,
+        scope: this.config.scope,
+        instanceId: row.instance_id,
+        bootEpoch: this.bootEpoch,
+        generation: command.generation,
+        operationId: command.operationId,
+        cutoffTxid: row.cutoff_txid,
+        closedAtMs: Number(row.closed_at_ms),
+        complete,
+        eligible: complete,
+        reasons,
+        liabilities
+      };
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
   async admit(id, jobId, details) {
     const client = await this.pool.connect();
     try {
       await client.query("BEGIN");
-      const { rows } = await client.query(
+      const { rows: rows2 } = await client.query(
         `SELECT state, lease_expires_at_ms, deadline_ms FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
         [this.dvmId, this.config.scope]
       );
       const now = await this.databaseNow(client);
-      const current = rows[0];
+      const current = rows2[0];
       if (current) await this.expireIfNeeded(client, current, now);
       if (current?.state !== "accepting" || current.lease_expires_at_ms === null || Number(current.lease_expires_at_ms) <= now) {
         await client.query("COMMIT");
@@ -9217,8 +11315,9 @@ var HostingControl = class {
       }
       await client.query(
         `INSERT INTO sdk_hosting_admissions
-         (id, dvm_id, scope, job_id, admitted_at_ms, credit_id, fund_id, payment_artifact_hash)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+         (id, dvm_id, scope, job_id, admitted_at_ms, credit_id, fund_id,
+          caller_pubkey, funding_commitment, payment_artifact_hash)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
         [
           id,
           this.dvmId,
@@ -9227,6 +11326,8 @@ var HostingControl = class {
           now,
           details?.creditId ?? null,
           details?.fundId ?? null,
+          details?.callerPubkey ?? null,
+          details?.fundingCommitment ?? null,
           details?.paymentArtifactHash ?? null
         ]
       );
@@ -9239,16 +11340,36 @@ var HostingControl = class {
       client.release();
     }
   }
-  async acceptedJobByPaymentArtifactHash(hash2) {
-    const { rows } = await this.pool.query(
+  async acceptedJobByPaymentArtifactHash(hash3) {
+    const { rows: rows2 } = await this.pool.query(
       `SELECT a.job_id FROM sdk_hosting_admissions a
        JOIN jobs j ON j.id=a.job_id
        WHERE a.dvm_id=$1 AND a.scope=$2 AND a.payment_artifact_hash=$3
          AND a.outcome IN ('accepted', 'unresolved', 'pending')
        ORDER BY a.admitted_at_ms DESC LIMIT 1`,
-      [this.dvmId, this.config.scope, hash2]
+      [this.dvmId, this.config.scope, hash3]
+    );
+    return rows2[0]?.job_id;
+  }
+  async acceptedFundingAdmission(creditId, fundId, callerPubkey, commitment, paymentArtifactHash) {
+    const { rows: rows2 } = await this.pool.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND credit_id=$3 AND fund_id=$4
+         AND caller_pubkey=$5 AND funding_commitment=$6
+         AND payment_artifact_hash IS NOT DISTINCT FROM $7
+         AND outcome IN ('pending','accepted','unresolved')
+       ORDER BY admitted_at_ms, id LIMIT 1`,
+      [
+        this.dvmId,
+        this.config.scope,
+        creditId,
+        fundId,
+        callerPubkey,
+        commitment,
+        paymentArtifactHash ?? null
+      ]
     );
-    return rows[0]?.job_id;
+    return rows2[0]?.id;
   }
   async rebindAdmissionJob(id, jobId) {
     await this.pool.query(
@@ -9264,33 +11385,33 @@ var HostingControl = class {
     );
   }
   async jobDeadline(jobId) {
-    const { rows } = await this.pool.query(
+    const { rows: rows2 } = await this.pool.query(
       `SELECT MIN(drain_deadline_ms)::text AS drain_deadline_ms
        FROM sdk_hosting_admissions WHERE dvm_id=$1 AND scope=$2 AND job_id=$3`,
       [this.dvmId, this.config.scope, jobId]
     );
-    return rows[0]?.drain_deadline_ms === null || !rows[0] ? null : Number(rows[0].drain_deadline_ms);
+    return rows2[0]?.drain_deadline_ms === null || !rows2[0] ? null : Number(rows2[0].drain_deadline_ms);
   }
   async dispatchDeadlineReached(jobId) {
-    const { rows } = await this.pool.query(
+    const { rows: rows2 } = await this.pool.query(
       `SELECT EXISTS (
          SELECT 1 FROM sdk_hosting_admissions
          WHERE dvm_id=$1 AND scope=$2 AND job_id=$3
            AND drain_deadline_ms <= FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
        ) OR EXISTS (
          SELECT 1 FROM sdk_hosting_control
-         WHERE dvm_id=$1 AND scope=$2 AND state='draining'
+         WHERE dvm_id=$1 AND scope=$2 AND state IN ('draining','closed')
            AND deadline_ms <= FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
        ) AS reached`,
       [this.dvmId, this.config.scope, jobId]
     );
-    return rows[0]?.reached ?? false;
+    return rows2[0]?.reached ?? false;
   }
   async databaseNow(client) {
-    const { rows } = await client.query(
+    const { rows: rows2 } = await client.query(
       `SELECT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint AS now_ms`
     );
-    return Number(rows[0].now_ms);
+    return Number(rows2[0].now_ms);
   }
   async pinAdmissionDeadlines(client, deadlineMs) {
     await client.query(
@@ -9317,13 +11438,17 @@ var HostingControl = class {
     const client = await this.pool.connect();
     try {
       await client.query("BEGIN");
-      const { rows } = await client.query(
+      const { rows: rows2 } = await client.query(
         `SELECT state, generation, deadline_ms, lease_expires_at_ms FROM sdk_hosting_control
          WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
         [this.dvmId, this.config.scope]
       );
-      const prior = rows[0];
+      const prior = rows2[0];
       if (!prior) throw new Error("Hosting control was not initialized");
+      if (prior.state === "closed") {
+        await client.query("ROLLBACK");
+        return "conflict";
+      }
       const now = await this.databaseNow(client);
       await this.expireIfNeeded(client, prior, now);
       const generation = Number(prior.generation);
@@ -9404,7 +11529,7 @@ var HostingControl = class {
            ))` : ""})`,
       [this.dvmId, this.config.scope]
     );
-    const { rows } = await this.pool.query(
+    const { rows: rows2 } = await this.pool.query(
       `SELECT state, generation, deadline_ms, lease_expires_at_ms FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2`,
       [this.dvmId, this.config.scope]
     );
@@ -9441,10 +11566,10 @@ var HostingControl = class {
       [this.dvmId, this.config.scope]
     );
     return {
-      state: rows[0].state,
-      generation: Number(rows[0].generation),
-      deadlineMs: rows[0].deadline_ms === null ? null : Number(rows[0].deadline_ms),
-      leaseExpiresAtMs: rows[0].lease_expires_at_ms === null ? null : Number(rows[0].lease_expires_at_ms),
+      state: rows2[0].state,
+      generation: Number(rows2[0].generation),
+      deadlineMs: rows2[0].deadline_ms === null ? null : Number(rows2[0].deadline_ms),
+      leaseExpiresAtMs: rows2[0].lease_expires_at_ms === null ? null : Number(rows2[0].lease_expires_at_ms),
       activeJobIds: active.rows.map((row) => row.id),
       unownedActiveJobIds: unowned.rows.map((row) => row.id),
       pendingAdmissionCount: Number(pending.rows[0].pending),
@@ -9517,9 +11642,9 @@ import { AsyncLocalStorage } from "async_hooks";
 import { randomBytes as randomBytes3 } from "crypto";
 
 // src/sdk/server/instrumented-kv.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function hashKey(key) {
-  return createHash5("sha256").update(key).digest("hex").slice(0, 16);
+  return createHash7("sha256").update(key).digest("hex").slice(0, 16);
 }
 function instrumentKVStore(inner) {
   return {
@@ -10090,7 +12215,7 @@ var ReceiptIssuer = class {
    * only for a resolved ledger draw.
    */
   issue(record, seq, issuedAt, credit) {
-    const unsigned = {
+    const unsigned2 = {
       v: 1,
       job_id: record.id,
       dvm_id: this.dvmId,
@@ -10121,7 +12246,7 @@ var ReceiptIssuer = class {
       receipt_pubkey: this.pubkey,
       ...credit && { credit }
     };
-    return signReceipt(unsigned, this.secret);
+    return signReceipt(unsigned2, this.secret);
   }
   /**
    * Countersign one reclaim event. Unlike job receipts there is
@@ -10256,11 +12381,11 @@ function startAccumulatorMonitor(opts) {
 async function runTick(opts) {
   const client = await opts.pool.connect();
   try {
-    const { rows } = await client.query(
+    const { rows: rows2 } = await client.query(
       `SELECT pg_try_advisory_lock($1) AS acquired`,
       [opts.lockKey.toString()]
     );
-    if (!rows[0]?.acquired) {
+    if (!rows2[0]?.acquired) {
       return;
     }
     try {
@@ -10370,15 +12495,15 @@ function emitExpiringSoon(dvmId, batch, timeToExpireMs) {
   );
 }
 async function reapExpiredKeysetRows(opts, db) {
-  const { rows } = await db.query(
+  const { rows: rows2 } = await db.query(
     `SELECT DISTINCT mint_url, proof_keyset_id
        FROM wallet_accumulator
        WHERE dvm_id = $1`,
     [opts.dvmId]
   );
-  if (rows.length === 0) return;
+  if (rows2.length === 0) return;
   const nowSec = Math.floor(opts.now() / 1e3);
-  for (const { mint_url, proof_keyset_id } of rows) {
+  for (const { mint_url, proof_keyset_id } of rows2) {
     const finalExpiry = await getKeysetFinalExpiry(mint_url, proof_keyset_id);
     if (finalExpiry === void 0 || finalExpiry > nowSec) continue;
     const { rowCount } = await db.query(
@@ -12160,6 +14285,7 @@ var JobManager = class {
         processedPayments: this.opts.processedPayments,
         enqueueCreditDeposit: this.opts.enqueueCreditDeposit,
         jobId: job.id,
+        hostingPaymentSeq: inboundSeq ?? void 0,
         creditTtlMs: this.opts.creditTtlMs
       },
       {
@@ -13545,12 +15671,16 @@ function tempoCloseEventStatus(result) {
 }
 
 // src/sdk/server/x402-exact-settlement-store.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var PostgresX402ExactSettlementStore = class {
   constructor(pool) {
     this.pool = pool;
   }
   pool;
+  hostingCleanupFence;
+  useHostingCleanupFence(fence) {
+    this.hostingCleanupFence = fence;
+  }
   async init() {
     await withSdkInitLock(this.pool, async () => {
       await this.pool.query(`
@@ -13610,49 +15740,65 @@ var PostgresX402ExactSettlementStore = class {
     if (existing && !sameIntentBinding(existing, intent)) {
       throw new X402ExactIntentConflictError(intent.id);
     }
-    const authFingerprint = intent.effect?.jobAdmission?.authFingerprint;
-    if (authFingerprint) {
-      await this.pool.query(
-        `INSERT INTO x402_exact_job_auth_bindings (dvm_id, auth_fingerprint, intent_id)
+    const write = async (q) => {
+      const authFingerprint = intent.effect?.jobAdmission?.authFingerprint;
+      if (authFingerprint) {
+        await q.query(
+          `INSERT INTO x402_exact_job_auth_bindings (dvm_id, auth_fingerprint, intent_id)
          VALUES ($1,$2,$3) ON CONFLICT DO NOTHING`,
-        [intent.dvmId, authFingerprint, intent.id]
-      );
-      const { rows } = await this.pool.query(
-        `SELECT intent_id FROM x402_exact_job_auth_bindings
+          [intent.dvmId, authFingerprint, intent.id]
+        );
+        const { rows: rows2 } = await q.query(
+          `SELECT intent_id FROM x402_exact_job_auth_bindings
           WHERE dvm_id = $1 AND auth_fingerprint = $2`,
-        [intent.dvmId, authFingerprint]
-      );
-      if (rows[0]?.intent_id !== intent.id) throw new X402ExactIntentConflictError(intent.id);
-    }
-    if (existing) return existing;
-    await this.pool.query(
-      `INSERT INTO x402_exact_settlement_intents
+          [intent.dvmId, authFingerprint]
+        );
+        if (rows2[0]?.intent_id !== intent.id) throw new X402ExactIntentConflictError(intent.id);
+      }
+      if (existing) return;
+      await q.query(
+        `INSERT INTO x402_exact_settlement_intents
          (dvm_id, intent_id, resource, network, asset, authorizer, recipient, value,
           valid_after, valid_before, nonce, fingerprint, status, effect, submission_block,
           transaction, settle_response, last_outcome, created_at, updated_at)
        VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,'prepared',$13,$14,$15,$16,$17,$18,$18)
        ON CONFLICT (dvm_id, intent_id) DO NOTHING`,
-      [
-        intent.dvmId,
-        intent.id,
-        intent.resource,
-        intent.network,
-        intent.asset,
-        intent.from,
-        intent.to,
-        intent.value,
-        intent.validAfter,
-        intent.validBefore,
-        intent.nonce,
-        intent.fingerprint,
-        intent.effect ? JSON.stringify(intent.effect) : null,
-        intent.submissionBlock ?? null,
-        intent.transaction ?? null,
-        intent.settleResponse ? JSON.stringify(intent.settleResponse) : null,
-        intent.lastOutcome ?? null,
-        now
-      ]
-    );
+        [
+          intent.dvmId,
+          intent.id,
+          intent.resource,
+          intent.network,
+          intent.asset,
+          intent.from,
+          intent.to,
+          intent.value,
+          intent.validAfter,
+          intent.validBefore,
+          intent.nonce,
+          intent.fingerprint,
+          intent.effect ? JSON.stringify(intent.effect) : null,
+          intent.submissionBlock ?? null,
+          intent.transaction ?? null,
+          intent.settleResponse ? JSON.stringify(intent.settleResponse) : null,
+          intent.lastOutcome ?? null,
+          now
+        ]
+      );
+    };
+    if (this.hostingCleanupFence && !existing) {
+      const effect = intent.effect;
+      await this.hostingCleanupFence.withNewIntent({
+        admissionId: effect?.hostingAdmissionId,
+        jobId: effect?.jobId,
+        paymentSeq: effect?.hostingPaymentSeq,
+        creditId: effect?.jobId ? void 0 : effect?.fundOnly?.creditId,
+        fundId: effect?.fundOnly?.fundId,
+        callerPubkey: effect?.jobId ? void 0 : effect?.callerId
+      }, write);
+    } else {
+      await write(this.pool);
+    }
+    if (existing) return existing;
     const stored = await this.get(intent.dvmId, intent.id);
     if (!stored) throw new Error(`x402 exact intent ${intent.id} was not persisted`);
     if (!sameIntentBinding(stored, intent)) {
@@ -13661,11 +15807,11 @@ var PostgresX402ExactSettlementStore = class {
     return stored;
   }
   async get(dvmId, intentId) {
-    const { rows } = await this.pool.query(
+    const { rows: rows2 } = await this.pool.query(
       `SELECT * FROM x402_exact_settlement_intents WHERE dvm_id = $1 AND intent_id = $2`,
       [dvmId, intentId]
     );
-    return rows[0] ? rowToIntent(rows[0]) : void 0;
+    return rows2[0] ? rowToIntent(rows2[0]) : void 0;
   }
   async markSubmitting(args) {
     const now = Date.now();
@@ -13705,7 +15851,7 @@ var PostgresX402ExactSettlementStore = class {
     const client = await this.pool.connect();
     try {
       await client.query("BEGIN");
-      const { rows } = await client.query(
+      const { rows: rows2 } = await client.query(
         `UPDATE x402_exact_settlement_intents
             SET status = $3, last_outcome = $4,
                 transaction = COALESCE($5, transaction),
@@ -13724,7 +15870,7 @@ var PostgresX402ExactSettlementStore = class {
           now
         ]
       );
-      const current = rows.at(0) ?? (await client.query(
+      const current = rows2.at(0) ?? (await client.query(
         `SELECT * FROM x402_exact_settlement_intents
               WHERE dvm_id = $1 AND intent_id = $2 FOR UPDATE`,
         [args.dvmId, args.intentId]
@@ -13752,13 +15898,13 @@ var PostgresX402ExactSettlementStore = class {
     const client = await this.pool.connect();
     try {
       await client.query("BEGIN");
-      const { rows } = await client.query(
+      const { rows: rows2 } = await client.query(
         `SELECT * FROM x402_exact_settlement_intents
           WHERE dvm_id = $1 AND intent_id = $2 FOR UPDATE`,
         [dvmId, intentId]
       );
-      if (!rows[0]) throw new Error(`x402 exact intent ${intentId} was not found`);
-      const intent = rowToIntent(rows[0]);
+      if (!rows2[0]) throw new Error(`x402 exact intent ${intentId} was not found`);
+      const intent = rowToIntent(rows2[0]);
       if (intent.status === "complete" || intent.status === "local_committed") {
         await client.query("COMMIT");
         return { intent, replayed: true };
@@ -13797,14 +15943,14 @@ var PostgresX402ExactSettlementStore = class {
   }
   async markAdmissionComplete(dvmId, intentId) {
     const now = Date.now();
-    const { rows } = await this.pool.query(
+    const { rows: rows2 } = await this.pool.query(
       `UPDATE x402_exact_settlement_intents
           SET status = 'complete', resolved_at = $3, updated_at = $3
         WHERE dvm_id = $1 AND intent_id = $2 AND status = 'local_committed'
       RETURNING *`,
       [dvmId, intentId, now]
     );
-    const intent = rows[0] ? rowToIntent(rows[0]) : await this.get(dvmId, intentId);
+    const intent = rows2[0] ? rowToIntent(rows2[0]) : await this.get(dvmId, intentId);
     if (!intent) throw new Error(`x402 exact intent ${intentId} was not found`);
     if (intent.status !== "complete") {
       throw new X402ExactSettlementNotReadyError(intentId, intent.status);
@@ -13812,28 +15958,28 @@ var PostgresX402ExactSettlementStore = class {
     return intent;
   }
   async list(args) {
-    const { rows } = await this.pool.query(
+    const { rows: rows2 } = await this.pool.query(
       `SELECT * FROM x402_exact_settlement_intents
         WHERE dvm_id = $1 ${args.includeResolved ? "" : "AND status <> 'complete' AND status <> 'rejected'"}
         ORDER BY updated_at ASC LIMIT $2`,
       [args.dvmId, args.limit]
     );
-    return rows.map(rowToIntent);
+    return rows2.map(rowToIntent);
   }
   async attempts(dvmId, intentId) {
-    const { rows } = await this.pool.query(
+    const { rows: rows2 } = await this.pool.query(
       `SELECT * FROM x402_exact_settlement_attempts
         WHERE dvm_id = $1 AND intent_id = $2 ORDER BY created_at, id`,
       [dvmId, intentId]
     );
-    return rows.map(rowToAttempt);
+    return rows2.map(rowToAttempt);
   }
-  async insertAttempt(q, dvmId, intentId, outcome, detail, transaction, createdAt) {
+  async insertAttempt(q, dvmId, intentId, outcome, detail, transaction2, createdAt) {
     await q.query(
       `INSERT INTO x402_exact_settlement_attempts
          (id, dvm_id, intent_id, outcome, detail, transaction, created_at)
        VALUES ($1,$2,$3,$4,$5,$6,$7)`,
-      [randomUUID3(), dvmId, intentId, outcome, detail ?? null, transaction ?? null, createdAt]
+      [randomUUID5(), dvmId, intentId, outcome, detail ?? null, transaction2 ?? null, createdAt]
     );
   }
 };
@@ -13957,15 +16103,15 @@ var MemoryX402ExactSettlementStore = class {
   attempts(dvmId, intentId) {
     return Promise.resolve(this.evidence.get(intentKey(dvmId, intentId)) ?? []);
   }
-  addAttempt(dvmId, intentId, outcome, detail, transaction) {
+  addAttempt(dvmId, intentId, outcome, detail, transaction2) {
     const key = intentKey(dvmId, intentId);
     const attempts = this.evidence.get(key) ?? [];
     attempts.push({
-      id: randomUUID3(),
+      id: randomUUID5(),
       intentId,
       outcome,
       detail,
-      transaction,
+      transaction: transaction2,
       createdAt: Date.now()
     });
     this.evidence.set(key, attempts);
@@ -14274,7 +16420,7 @@ function withWallClockDeadline(promise, timeoutMs) {
 }
 
 // src/sdk/server/app.ts
-import { createHash as createHash7, randomBytes as randomBytes5, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash9, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "crypto";
 import { Hono } from "hono";
 import { getCookie } from "hono/cookie";
 import { cors } from "hono/cors";
@@ -15138,13 +17284,13 @@ async function handleX402Settlements(c, opts) {
     includeResolved: c.req.query("include_resolved") === "true",
     evidence: c.req.query("evidence") !== "false"
   });
-  const rows = await Promise.all(
+  const rows2 = await Promise.all(
     page.settlements.map(
       (row) => settlementBody(row, opts.ledger.getCreditByX402Channel.bind(opts.ledger))
     )
   );
   return c.json({
-    settlements: rows,
+    settlements: rows2,
     ...page.nextAfter ? { next_after: encodeX402Cursor(page.nextAfter) } : {}
   });
 }
@@ -15331,14 +17477,14 @@ async function handleTempoDrains(c, opts) {
     includeResolved: c.req.query("include_resolved") === "true"
   });
   const wantsEvidence = c.req.query("evidence") !== "false";
-  const rows = [];
+  const rows2 = [];
   for (const drain of drains) {
     const evidence = wantsEvidence && drain.channelId ? await classifyTempoCloseEvidence(rail.rail, drain.channelId) : void 0;
-    rows.push(tempoDrainBody(drain, evidence));
+    rows2.push(tempoDrainBody(drain, evidence));
   }
   const last = drains.length === limit ? drains[drains.length - 1] : void 0;
   return c.json({
-    drains: rows,
+    drains: rows2,
     ...last ? {
       next_after: encodeTempoCursor({
         createdAt: last.createdAt,
@@ -17063,7 +19209,7 @@ initSchemaForm();
 }
 
 // src/sdk/server/request-fingerprint.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function requestFingerprint(req, opts) {
   const canonical = canonicalize({
     capability: req.capability,
@@ -17071,7 +19217,7 @@ function requestFingerprint(req, opts) {
     params: req.params ?? {},
     data: opts.stripAuthEnvelope ? stripEnvelope(req.data) : req.data
   });
-  return createHash6("sha256").update(canonical).digest("hex");
+  return createHash8("sha256").update(canonical).digest("hex");
 }
 var ENVELOPE_KEYS = /* @__PURE__ */ new Set(["pubkey", "signature", "timestamp", "nonce", "auth_statement"]);
 function stripEnvelope(data) {
@@ -17113,6 +19259,7 @@ async function createDVMServer(descriptor, opts) {
   let x402BatchSettlement;
   let server;
   let hostingControl;
+  let hostedSettlementReports;
   let shutdownPromise;
   const shutdown = () => shutdownPromise ??= (async () => {
     const errors = [];
@@ -17163,17 +19310,52 @@ async function createDVMServer(descriptor, opts) {
     const platformToken = opts.platformToken ?? envMaybe.DVMKIT_PLATFORM_TOKEN;
     const platformUrl = opts.platformUrl ?? envMaybe.DVMKIT_PLATFORM_URL;
     const dvmId = opts.dvmId;
+    if (opts.hostingControl && opts.db && dvmId && typeof opts.db.connect === "function") {
+      hostedSettlementReports = new HostedSettlementReportObligations(
+        opts.db,
+        dvmId,
+        opts.hostingControl.scope
+      );
+      await hostedSettlementReports.init();
+      if (opts.x402?.batchSettlement) {
+        const network = x402NetworkByCaip2(opts.x402.network);
+        if (!network) throw new Error("Hosted x402 batch network is unsupported");
+        hostedSettlementReports.configureX402({
+          network: opts.x402.network,
+          receiver: opts.x402.payTo,
+          token: network.usdc,
+          ...opts.x402.batchSettlement.rpcUrl ? { rpcUrl: opts.x402.batchSettlement.rpcUrl } : {}
+        });
+      }
+      if (opts.hostingTempoSessionStore && opts.mpp?.tempoConfiguration) {
+        const { Session: TempoSession3 } = await import("mppx/tempo");
+        const tempo = opts.mpp.tempoConfiguration;
+        hostedSettlementReports.configureTempo({
+          network: `eip155:${tempo.chainId}`,
+          escrow: TempoSession3.Precompile.Constants.tip20ChannelEscrow,
+          payee: tempo.recipient,
+          token: tempo.paymentToken,
+          ...envMaybe.DVMKIT_TEMPO_RPC_URL ? { rpcUrl: envMaybe.DVMKIT_TEMPO_RPC_URL } : {}
+        });
+      }
+    }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-EKJOGQYR.js");
-      const reporter = new RevenueReporter(opts.db, platformUrl, platformToken);
+      const { RevenueReporter } = await import("./revenue-reporter-MAERPYGK.js");
+      const reporter = new RevenueReporter(
+        opts.db,
+        platformUrl,
+        platformToken,
+        hostedSettlementReports
+      );
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-ZMOA37GN.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-3Y2U55ZX.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
         transport: reporter,
+        ...hostedSettlementReports ? { hostedObligations: hostedSettlementReports } : {},
         // The same condition the admin routes and the accumulator monitor mount on.
         cashu: opts.cashuMode === "p2pk-accumulator" && !!opts.lockPubkey,
         ...typeof opts.db.connect === "function" ? {} : { batchStore: new MemoryX402BatchStore() }
@@ -17265,6 +19447,7 @@ async function createDVMServer(descriptor, opts) {
       }
     } : x402BatchConfig;
     x402ChannelStorage = opts.db && x402Config && effectiveX402BatchConfig && !effectiveX402BatchConfig.storage ? new PostgresX402ChannelStorage(opts.db, {
+      ...opts.hostingControl ? { hostedNetwork: x402Config.network } : {},
       terminalizeUnbackedCredit: (evidence, tx) => creditLedger.terminalizeX402Credit(evidence, tx)
     }) : void 0;
     if (x402ChannelStorage) {
@@ -17282,7 +19465,8 @@ async function createDVMServer(descriptor, opts) {
       allowInMemory: opts.devMode,
       earnedNative: (channelId) => creditLedger.earnedNativeForX402Channel(channelId),
       supportedResponse: selfRelayEnabled ? void 0 : opts.x402FacilitatorHealth?.supportedResponse?.(),
-      payout: payoutReporter?.x402Observer()
+      payout: payoutReporter?.x402Observer(),
+      hostedObligations: hostedSettlementReports
     }) : void 0;
     x402BatchSettlement = x402BatchSettlementFactory && (bootX402Support?.batchSettlement || selfRelayEnabled) ? await x402BatchSettlementFactory() : void 0;
     const x402ExactStore = x402Config && opts.db && typeof opts.db.connect === "function" ? new PostgresX402ExactSettlementStore(opts.db) : void 0;
@@ -17313,12 +19497,45 @@ async function createDVMServer(descriptor, opts) {
       if (descriptor.credit && !opts.creditLedger?.durable) {
         throw new Error("Hosting control with credit requires a durable credit ledger");
       }
-      hostingControl = new HostingControl(opts.db, opts.dvmId, opts.hostingControl);
+      const channelReader = await HostedChannelEvidenceReader.fromServerConfig(opts.db, {
+        ...x402BatchConfig && x402ChannelStorage && x402Config ? { x402: {
+          network: x402Config.network,
+          ...x402BatchConfig.rpcUrl ? { rpcUrl: x402BatchConfig.rpcUrl } : {}
+        } } : {},
+        ...opts.hostingTempoSessionStore && opts.mpp ? { tempoEnv: opts.env } : {}
+      });
+      hostingControl = new HostingControl(opts.db, opts.dvmId, opts.hostingControl, channelReader);
       await hostingControl.init();
+      if (opts.hostingCleanupSingleMount ?? true) {
+        if (opts.creditLedger instanceof CreditLedger) {
+          opts.creditLedger.useHostingCleanupFence(hostingControl.cleanupFence);
+        }
+        opts.jobStore.useHostingCleanupFence(hostingControl.cleanupFence);
+        x402ExactStore?.useHostingCleanupFence(hostingControl.cleanupFence);
+        x402ChannelStorage?.useHostingCleanupFence(hostingControl.cleanupFence);
+        opts.hostingTempoSessionStore?.useHostingCleanupFence(hostingControl.cleanupFence);
+        opts.hostingTempoChargeStore?.useHostingCleanupFence(hostingControl.cleanupFence);
+        if (opts.mpp && opts.hostingTempoChargeStore) {
+          installHostedTempoChargeGuard(opts.mpp, opts.hostingTempoChargeStore);
+        }
+        if (opts.mpp && opts.hostingTempoSessionStore && hostedSettlementReports) {
+          installHostedTempoCloseGuard(opts.mpp, hostedSettlementReports);
+        }
+      }
     }
+    const hostingClosureSupport = hostingControl ? {
+      singleMount: opts.hostingCleanupSingleMount ?? true,
+      durableLedger: opts.creditLedger instanceof CreditLedger,
+      durableJobStore: opts.jobStore instanceof PostgresJobStore,
+      durableReporter: !!activeRevenueReporter,
+      durablePaymentReplay: processedPayments instanceof PostgresProcessedPaymentStore,
+      knownRailStores: (opts.hostingCleanupKnownRailStores ?? !opts.mpp) && (!x402Config || !!x402ExactStore && (!x402BatchConfig || !!x402ChannelStorage))
+    } : void 0;
     server = new DVMServer(descriptor, {
       ...opts,
       hostingControlInstance: hostingControl,
+      hostedSettlementReports,
+      hostingClosureSupport,
       creditLedger,
       processedPayments,
       onJobCompleted: effectiveOnJobCompleted,
@@ -17570,13 +19787,36 @@ var DVMServer = class {
     if (!statusOnly) await this.sweepHostingDeadline();
     return c.json(await control.status());
   }
+  async handleHostingClosure(c, certificateOnly) {
+    const control = this.opts.hostingControlInstance;
+    const support = this.opts.hostingClosureSupport;
+    if (!control || !support) return c.json({ error: "not_found" }, 404);
+    let command;
+    try {
+      command = await c.req.json();
+    } catch {
+      return c.json({ error: "invalid_hosting_closure" }, 400);
+    }
+    if (!command || command.action !== (certificateOnly ? "certificate" : "close")) {
+      return c.json({ error: "invalid_hosting_closure" }, 400);
+    }
+    if (!await control.authorizeClosure(command, c.req.header("X-DVM-Hosting-Signature"))) {
+      return c.json({ error: "hosting_closure_unauthorized" }, 401);
+    }
+    if (!certificateOnly && await control.close(command, support) === "conflict") {
+      return c.json({ error: "hosting_closure_conflict" }, 409);
+    }
+    const evidence = await control.certificate({ ...command, action: "certificate" }, support);
+    if (!evidence) return c.json({ error: "hosting_closure_stale" }, 409);
+    return c.json(evidence);
+  }
   registerRoutes() {
     const dvmSlug = this.descriptor.name;
     this.app.use("*", async (c, next) => {
       const raw = c.req.header("traceparent");
       const parsed = raw ? parseTraceparent(raw) : null;
       const traceCtx = {
-        traceId: parsed ? parsed.traceId : randomUUID4().replace(/-/g, ""),
+        traceId: parsed ? parsed.traceId : randomUUID6().replace(/-/g, ""),
         spanId: parsed ? parsed.parentSpanId : null,
         dimensions: {},
         service: `isolate-${dvmSlug}`,
@@ -17679,6 +19919,8 @@ var DVMServer = class {
     if (this.opts.hostingControlInstance) {
       this.app.post("/_hosting/control", (c) => this.handleHostingCommand(c, false));
       this.app.post("/_hosting/status", (c) => this.handleHostingCommand(c, true));
+      this.app.post("/_hosting/closure", (c) => this.handleHostingClosure(c, false));
+      this.app.post("/_hosting/closure-certificate", (c) => this.handleHostingClosure(c, true));
     }
     this.app.post("/v1/request-resume/:requestId", (c) => this.handleCreateJob(c, true));
     this.app.post("/v1/request-result/:requestId", (c) => this.handleRequestResult(c));
@@ -17966,7 +20208,7 @@ var DVMServer = class {
       const dvmId = this.opts.dvmId ?? `dev:${this.descriptor.name}`;
       return {
         dvm_id: dvmId,
-        builder_pubkey: createHash7("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
+        builder_pubkey: createHash9("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
       };
     }
     throw new AuthAudienceError();
@@ -18278,15 +20520,22 @@ var DVMServer = class {
     });
   }
   async handleCredit(c) {
+    let hostingFundingAdmissionId;
+    let hostingFundingArtifactHash;
     this.maybeSweepTempoSessions();
     return handleCreditRequest(c, {
+      hostedSettlementReports: this.opts.hostedSettlementReports,
       menu: () => this.creditMenu(this.creditCurrency()),
       creditConfig: this.descriptor.credit,
       auth: this.descriptor.auth,
       authDomain: this.authAudience ? this.signedRequestDomain(c, null) : void 0,
       ledger: this.creditLedger,
       fxFetcher: this.fxFetcher,
-      railOpts: (ctx) => this.railVerifyOpts(ctx),
+      railOpts: async (ctx) => ({
+        ...await this.railVerifyOpts(ctx),
+        hostingAdmissionId: hostingFundingAdmissionId,
+        hostingPaymentArtifactHash: hostingFundingArtifactHash
+      }),
       onDeposit: (funding) => {
         this.reportCreditDeposit(funding);
       },
@@ -18300,17 +20549,39 @@ var DVMServer = class {
       settleLightning: (callerPubkey, creditId) => this.settleLightningFunding(callerPubkey, creditId),
       withFundingAdmission: this.opts.hostingControlInstance ? async (ctx, body, run) => {
         const control = this.opts.hostingControlInstance;
-        const admissionId = randomUUID4();
+        let admissionId = randomUUID6();
         const fundId = body.fund?.fund_id ?? admissionId;
         const creditId = body.credit_id ?? derivedFundCreditId(body.pubkey, fundId);
         const workId = `credit-fund:${creditId}:${fundId}`;
-        if (!await control.admit(admissionId, workId, { creditId, fundId })) {
-          return ctx.json({
-            error: "hosting_draining",
-            message: "This service is draining and is not accepting new credit funding.",
-            hint: "Balance, reclaim, and already-issued funding recovery remain available."
-          }, 503);
+        const paymentAuthorization = ctx.req.header("Authorization");
+        const mppArtifact = paymentAuthorization ? (await import("mppx")).Credential.extractPaymentScheme(paymentAuthorization) : void 0;
+        const attachedPayment = ctx.req.header("X-Cashu") ?? ctx.req.header("PAYMENT-SIGNATURE") ?? ctx.req.header("X-PAYMENT") ?? mppArtifact;
+        const paymentArtifactHash = attachedPayment ? createHash9("sha256").update(attachedPayment).digest("hex") : void 0;
+        hostingFundingArtifactHash = paymentArtifactHash;
+        if (!await control.admit(admissionId, workId, {
+          creditId,
+          fundId,
+          callerPubkey: body.pubkey,
+          fundingCommitment: body.fund?.commitment,
+          paymentArtifactHash
+        })) {
+          const prior = body.fund?.commitment ? await control.acceptedFundingAdmission(
+            creditId,
+            fundId,
+            body.pubkey,
+            body.fund.commitment,
+            paymentArtifactHash
+          ) : void 0;
+          if (!prior) {
+            return ctx.json({
+              error: "hosting_draining",
+              message: "This service is draining and is not accepting new credit funding.",
+              hint: "Balance, reclaim, and already-issued funding recovery remain available."
+            }, 503);
+          }
+          admissionId = prior;
         }
+        hostingFundingAdmissionId = admissionId;
         const authorization = ctx.req.header("Authorization");
         const paymentArtifact = Boolean(
           ctx.req.header("X-Cashu") || ctx.req.header("PAYMENT-SIGNATURE") || ctx.req.header("X-PAYMENT") || authorization && /^Payment\s/i.test(authorization)
@@ -18989,8 +21260,9 @@ var DVMServer = class {
       { stripAuthEnvelope: false }
     ) : void 0;
     const authorization = c.req.header("Authorization");
-    const attachedPayment = c.req.header("X-Cashu") ?? c.req.header("PAYMENT-SIGNATURE") ?? c.req.header("X-PAYMENT") ?? (authorization && /^Payment\s/i.test(authorization) ? authorization : void 0);
-    const hostingPaymentArtifactHash = attachedPayment ? createHash7("sha256").update(attachedPayment).digest("hex") : void 0;
+    const mppArtifact = authorization ? (await import("mppx")).Credential.extractPaymentScheme(authorization) : void 0;
+    const attachedPayment = c.req.header("X-Cashu") ?? c.req.header("PAYMENT-SIGNATURE") ?? c.req.header("X-PAYMENT") ?? mppArtifact;
+    const hostingPaymentArtifactHash = attachedPayment ? createHash9("sha256").update(attachedPayment).digest("hex") : void 0;
     if (!resumeOnly && this.opts.hostingControlInstance && hostingPaymentArtifactHash) {
       const priorId = await this.opts.hostingControlInstance.acceptedJobByPaymentArtifactHash(
         hostingPaymentArtifactHash
@@ -19045,7 +21317,7 @@ var DVMServer = class {
       }
       let jobId = publicRequestClaimResult?.jobId ?? this.jobManager.allocateJobId();
       if (!resumeOnly && this.opts.hostingControlInstance) {
-        hostingAdmissionId = randomUUID4();
+        hostingAdmissionId = randomUUID6();
         if (!await this.opts.hostingControlInstance.admit(hostingAdmissionId, jobId, {
           paymentArtifactHash: hostingPaymentArtifactHash
         })) {
@@ -19132,6 +21404,8 @@ var DVMServer = class {
             async () => {
               const result = await verifyUpfrontPayment({
                 ...railOpts,
+                hostingAdmissionId,
+                hostingPaymentArtifactHash,
                 requiredMsats: priceMsats,
                 priceFiat,
                 jobId,
@@ -19286,7 +21560,7 @@ var DVMServer = class {
       }
       const isAnonymous = requesterId === "anonymous" || requesterId === "dev-anonymous";
       const jobToken = isAnonymous ? randomBytes5(32).toString("hex") : void 0;
-      const requesterTokenHash = jobToken ? createHash7("sha256").update(jobToken).digest("hex") : void 0;
+      const requesterTokenHash = jobToken ? createHash9("sha256").update(jobToken).digest("hex") : void 0;
       const job = jm.createJob(
         normalisedBody,
         requesterId,
@@ -19975,7 +22249,7 @@ function isJobOwner(c, job) {
   if (job.requesterTokenHash) {
     const token = c.req.header("X-Job-Token");
     if (!token) return false;
-    const provided = createHash7("sha256").update(token).digest("hex");
+    const provided = createHash9("sha256").update(token).digest("hex");
     return timingSafeEqualHex(provided, job.requesterTokenHash);
   }
   return c.get("requesterId") === job.requesterId;
@@ -20478,7 +22752,9 @@ export {
   createAdminCashuNonceStore,
   X402ExactSettlementServer,
   X402ExactSettlementEvidenceMissingError,
+  HostedSettlementReportObligations,
   signHostingControl,
+  signHostingClosure,
   jobCredentialGate,
   REQUEST_ID_FIELD,
   protocolEnvelopeIgnoreFields,