@dvmkit/sdk 0.8.0 → 0.9.0

package/dist/{chunk-GSPV3UIM.js → chunk-73C4JN2E.js}

@@ -1,16 +1,11 @@
 import {
-  TEMPO_MODERATO_CHAIN_ID,
-  TEMPO_MODERATO_RPC,
-  advertisedMethods,
-  challengeMeta,
-  installHostedTempoChargeGuard,
-  installHostedTempoCloseGuard,
-  isTempoInsufficientFundsError,
-  resolveTempoNetwork
-} from "./chunk-GB5XPAA5.js";
+  MemoryProcessedPaymentStore,
+  PostgresProcessedPaymentStore,
+  ProcessedPaymentReplayError
+} from "./chunk-XRLKGCAW.js";
 import {
   x402EarnedCeiling
-} from "./chunk-X3JEME6P.js";
+} from "./chunk-K2MSIKMM.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -19,13 +14,13 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-ATXDKX6F.js";
+} from "./chunk-GAZBBMAA.js";
 import {
   MemoryCreditLedger
-} from "./chunk-EBCLWOKF.js";
+} from "./chunk-ZBQKXAYK.js";
 import {
   PostgresJobStore
-} from "./chunk-QPXI7YPH.js";
+} from "./chunk-GODOH2AF.js";
 import {
   parseStoreValue
 } from "./chunk-YG7G4DPZ.js";
@@ -36,7 +31,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-5K5E6ME6.js";
+} from "./chunk-4VV7WACY.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -45,7 +40,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-I6PHA54S.js";
+} from "./chunk-TFDR2YP2.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -85,7 +80,7 @@ import {
   signReceipt,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-RTFBVXCN.js";
+} from "./chunk-LW7KZQHG.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -113,13 +108,7 @@ import {
 } from "./chunk-UKD3R2KU.js";
 import {
   createConsoleLogger
-} from "./chunk-IFWUWHTW.js";
-import {
-  loggers,
-  pinDimension,
-  withSpan,
-  withTraceContext
-} from "./chunk-BL6LRWXD.js";
+} from "./chunk-TRY7BJA4.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -136,7 +125,7 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-5CQKSLAU.js";
+} from "./chunk-HC4I7LAV.js";
 import {
   CreditLedger,
   CreditLedgerError,
@@ -152,26 +141,38 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-VYP6ADCS.js";
+} from "./chunk-YYRY32NR.js";
+import {
+  withSdkInitLock
+} from "./chunk-COYKJRMM.js";
 import {
   withPostgresRecoveryContext
-} from "./chunk-6FEHRZO7.js";
+} from "./chunk-IBX2ORBV.js";
 import {
   DvmError,
   x402NetworkByCaip2
 } from "./chunk-BPYMEMQX.js";
 import {
-  createDiagnosticCapabilityAuthority,
-  diagnosticConsole
-} from "./chunk-DZQYQN2X.js";
+  TEMPO_MODERATO_CHAIN_ID,
+  TEMPO_MODERATO_RPC,
+  TempoCloseDescriptorError,
+  advertisedMethods,
+  challengeMeta,
+  installHostedTempoChargeGuard,
+  installHostedTempoCloseGuard,
+  isTempoInsufficientFundsError,
+  resolveTempoNetwork
+} from "./chunk-LFVIZH2G.js";
 import {
-  MemoryProcessedPaymentStore,
-  PostgresProcessedPaymentStore,
-  ProcessedPaymentReplayError
-} from "./chunk-XRLKGCAW.js";
+  loggers,
+  pinDimension,
+  withSpan,
+  withTraceContext
+} from "./chunk-QSZW2I5Y.js";
 import {
-  withSdkInitLock
-} from "./chunk-COYKJRMM.js";
+  createDiagnosticCapabilityAuthority,
+  diagnosticConsole
+} from "./chunk-OIP44KBB.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -3883,7 +3884,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-Q4S36NHQ.js");
+      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4896,7 +4897,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-Q4S36NHQ.js");
+      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5327,7 +5328,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-Q4S36NHQ.js");
+      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -6953,6 +6954,10 @@ async function completeTempoChannelDrain(args) {
           tx_hash: args.reference,
           channel_id: args.channelId,
           ...settlementEvidence,
+          ...args.finalization && {
+            terminal_outcome: args.finalization.outcome,
+            credit_unbacked: args.finalization.creditUnbacked
+          },
           ...args.repaired ? { repaired: true, repair_kind: "tempo_close_reconciled" } : {}
         },
         tx: innerTx
@@ -7231,14 +7236,14 @@ async function handleDrain(c, deps, args) {
       404
     );
   }
-  if (credit.status === "unbacked") {
+  let existing = await deps.ledger.getDrain({ creditId, drainId: drain.drain_id });
+  if (credit.status === "unbacked" && existing?.status !== "sent") {
     const rejected2 = await burnNonce(c, deps, args.envelope);
     if (rejected2) return rejected2;
     return jsonPaymentError("credit_unbacked", 409, {
       message: `Credit ${creditId} is terminal because its Tempo backing finalized before the DVM was protected.`
     });
   }
-  let existing = await deps.ledger.getDrain({ creditId, drainId: drain.drain_id });
   if (existing) {
     const tempoDiscovery = existing.method === "tempo" && existing.status === "pending" && drain.method === "tempo" && !!credit.tempoChannelId && !c.req.header("Authorization");
     if (!tempoDiscovery) {
@@ -7254,6 +7259,17 @@ async function handleDrain(c, deps, args) {
       const released = await releaseTempoDrain(c, deps, existing, credit.tempoChannelId);
       return respondDrain(c, deps, { record: released, credit });
     }
+    if (existing.status === "exit_required") {
+      const mpp = (await deps.railOpts(c)).mpp;
+      if (mpp && credit.tempoChannelId) {
+        const recovered = await recoverTempoDrain(deps, mpp, existing, credit.tempoChannelId);
+        if (recovered) {
+          if (isHttpResponse(recovered)) return recovered;
+          return respondDrain(c, deps, { record: recovered, credit });
+        }
+      }
+      return tempoExitRequiredResponse(existing);
+    }
     if (existing.method === "tempo" && existing.status === "pending" && credit.tempoChannelId) {
       if (credit.balanceMicro !== credit.availableMicro) {
         const released = await releaseTempoDrain(c, deps, existing, credit.tempoChannelId);
@@ -7487,17 +7503,17 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
         await beginClose(expectedChannelId, record.drainId);
         recoveryVersion = await deps.tempoSettlementReadiness?.captureRecoveryVersion();
         if (deps.hostedSettlementReports) {
-          const reserved = await deps.hostedSettlementReports.reserveTempo(
+          hostedObligationId = await reserveHostedTempoClose(
+            deps.hostedSettlementReports,
+            rail.mpp,
+            record,
             expectedChannelId,
-            "close",
-            record.drainId
+            deps.ledger
           );
-          if (reserved.replayed) throw new Error("Hosted Tempo close already has an original effect attempt");
-          hostedObligationId = reserved.id;
           if (!rail.mpp?.permitHostedTempoClose) {
             throw new Error("Hosted Tempo close credential guard is unavailable");
           }
-          rail.mpp.permitHostedTempoClose(rail.mppCredential, reserved.id);
+          rail.mpp.permitHostedTempoClose(rail.mppCredential, hostedObligationId);
         }
       }
     });
@@ -7522,6 +7538,22 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
     }
     const wrongChannel = tempoWrongChannelRefusal(error, record);
     if (wrongChannel) return wrongChannel;
+    if (error instanceof HostedTempoCloseAttemptsExhaustedError || error instanceof TempoCloseDescriptorError) {
+      const result = deps.ledger.requireTempoDrainExit ? await deps.ledger.requireTempoDrainExit({ creditId: record.creditId, drainId: record.drainId }) : { drain: record, replayed: false };
+      if (!result.replayed && error instanceof TempoCloseDescriptorError) {
+        loggers.tempo.warn("tempo_session_close_descriptor_refused", {
+          credit_id: record.creditId,
+          drain_id: record.drainId,
+          channel_id: expectedChannelId,
+          amount_at_stake_native: record.drainedNative?.toString() ?? null,
+          amount_at_stake_micro: record.amountMicro,
+          currency: record.currency,
+          error: error.message
+        });
+      }
+      if (result.drain.status === "sent") return respondDrain(c, deps, { record: result.drain, credit });
+      return tempoExitRequiredResponse(result.drain);
+    }
     const refused = tempoFloorRefusal(error, record);
     if (refused) return refused;
     if (tempoCloseCredentialNeedsRefresh(error)) {
@@ -7568,6 +7600,69 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
     });
   }
 }
+var HOSTED_TEMPO_CLOSE_STALE_MS = 3e5;
+var HOSTED_TEMPO_CLOSE_MAX_RELEASES = 3;
+var HOSTED_TEMPO_CLOSE_IN_FLIGHT = "Hosted Tempo close already has an original effect attempt";
+var HostedTempoCloseAttemptsExhaustedError = class extends Error {
+};
+async function reserveHostedTempoClose(reports, mpp, record, channelId, ledger) {
+  const pending = await reports.pendingTempoClose(channelId, record.drainId);
+  if (!pending) {
+    const reserved = await reports.reserveTempo(channelId, "close", record.drainId);
+    if (reserved.replayed) throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
+    return reserved.id;
+  }
+  if (pending.state === "exhausted") throw new HostedTempoCloseAttemptsExhaustedError();
+  if (pending.state === "unmatched") throw new Error("Hosted Tempo close report requires an operator retry");
+  if (pending.txHash || !mpp.getTempoSessionDrainState) throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
+  const state = await mpp.getTempoSessionDrainState(channelId);
+  if (state.finalized || state.deposit === 0n || state.closeRequestedAt !== 0n) {
+    throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
+  }
+  const result = await reports.releaseStaleTempoClose(pending.id, channelId, record.drainId, {
+    staleAfterMs: HOSTED_TEMPO_CLOSE_STALE_MS,
+    maxReleases: HOSTED_TEMPO_CLOSE_MAX_RELEASES,
+    onExhausted: async (tx) => {
+      await ledger.requireTempoDrainExit?.({ creditId: record.creditId, drainId: record.drainId, tx });
+    }
+  });
+  if (result.outcome === "in_flight") throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
+  if (result.outcome === "exhausted") {
+    loggers.tempo.warn("tempo_session_close_attempts_exhausted", {
+      credit_id: record.creditId,
+      drain_id: record.drainId,
+      channel_id: channelId,
+      obligation_id: pending.id,
+      attempt: result.releases + 1,
+      amount_at_stake_native: await reports.tempoCloseAmountAtStake(pending.id)
+    });
+    throw new HostedTempoCloseAttemptsExhaustedError(
+      `Tempo drain ${record.drainId} exhausted its cooperative close attempts`
+    );
+  }
+  loggers.tempo.warn("tempo_session_close_reservation_released", {
+    credit_id: record.creditId,
+    drain_id: record.drainId,
+    channel_id: channelId,
+    obligation_id: pending.id,
+    attempt: result.releases + 1
+  });
+  return result.id;
+}
+function tempoExitRequiredResponse(record) {
+  const terminal = record.status === "exit_required";
+  return jsonPaymentError("tempo_channel_exit_required", 409, {
+    message: terminal ? `Tempo drain ${record.drainId} cannot cooperatively close this channel.` : `This Tempo close credential cannot complete drain ${record.drainId}.`,
+    display: "Your funds remain in the channel. Use the timed on-chain exit to recover them.",
+    hint: terminal ? "Start the channel's timed on-chain exit. A corrected close credential does not reopen this drain or debit it again." : "This drain remains pending. Use the channel's timed on-chain exit, or retry the same drain with a valid close credential if cooperative attempts remain. Retrying does not debit it again.",
+    extra: {
+      drain_registered: true,
+      drain_id: record.drainId,
+      channel_id: record.channelId,
+      status: record.status
+    }
+  });
+}
 function tempoCloseCredentialNeedsRefresh(error) {
   return error instanceof MppxErrors.InvalidChallengeError || error instanceof MppxErrors.PaymentExpiredError;
 }
@@ -8059,6 +8154,11 @@ function drainCopy(record) {
         display: "The refund was sent to the payout destination you provided.",
         hint: "See `sent` for the settlement reference (e.g. the on-chain transaction hash)."
       };
+    case "exit_required":
+      return {
+        display: "This drain cannot cooperatively close the channel. Your funds remain in the channel.",
+        hint: "Use the channel's timed on-chain exit. A corrected credential does not reopen this drain."
+      };
     case "released":
       return {
         display: "The channel could not complete this refund, so the service restored the amount to your prepaid balance.",
@@ -9536,172 +9636,6 @@ function safeError(err) {
   return "settlement_transport_error";
 }
 
-// src/sdk/server/hosting-control.ts
-import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
-
-// src/sdk/server/hosting-cleanup-fence.ts
-var HostingCleanupFence = class {
-  constructor(pool, dvmId, scope) {
-    this.pool = pool;
-    this.dvmId = dvmId;
-    this.scope = scope;
-  }
-  pool;
-  dvmId;
-  scope;
-  async assertNewIntent(tx, intent) {
-    const continuation = intent?.admissionId || intent?.paymentSeq !== void 0 || intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash || intent?.creditId && intent.fundId && intent.callerPubkey;
-    const { rows: rows2 } = await tx.query(
-      `SELECT state, closed_at_ms, closed_at_us FROM sdk_hosting_control
-       WHERE dvm_id=$1 AND scope=$2 ${continuation ? "" : "FOR UPDATE"}`,
-      [this.dvmId, this.scope]
-    );
-    const control = rows2[0];
-    if (!control) throw new Error("Hosted obligation fence is unavailable");
-    if (control.state === "closed" && (control.closed_at_ms === null || control.closed_at_us === null)) {
-      throw new Error("Hosted closure cutoff is unavailable");
-    }
-    if (control.state !== "closed" && !continuation) return;
-    if (intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash) {
-      const repair = !!intent.invoiceRepairPaymentHash;
-      const invoice = await tx.query(
-        `SELECT i.payment_hash FROM credit_invoices i
-         LEFT JOIN sdk_hosting_admissions a ON a.id=i.hosting_admission_id
-         WHERE i.payment_hash=$1 AND i.caller_pubkey=$4 AND i.amount_micro=$5
-           AND (($10::boolean AND $3=i.payment_hash AND i.status IN ('blocked','written_off'))
-             OR (NOT $10::boolean AND i.credit_id=$2 AND i.fund_id=$3 AND i.status='pending'))
-           AND ((i.hosting_admission_id IS NULL AND
-                 ($9::bigint IS NULL OR i.created_at_db_us <= $9)) OR
-             (a.dvm_id=$6 AND a.scope=$7 AND a.credit_id=i.credit_id
-              AND a.fund_id=i.fund_id AND a.caller_pubkey=i.caller_pubkey
-              AND a.outcome IN ('pending','accepted','unresolved')
-              AND ($8::bigint IS NULL OR a.admitted_at_ms <= $8)))`,
-        [
-          intent.invoicePaymentHash ?? intent.invoiceRepairPaymentHash,
-          intent.creditId,
-          intent.fundId,
-          intent.callerPubkey,
-          intent.amountMicro,
-          this.dvmId,
-          this.scope,
-          control.closed_at_ms,
-          control.closed_at_us,
-          repair
-        ]
-      );
-      if (invoice.rows[0]) return;
-      throw new Error("Hosted invoice has no original payable admission");
-    }
-    if (intent?.paymentSeq !== void 0 && intent.jobId) {
-      const payment = await tx.query(
-        `SELECT m.job_id FROM job_messages m JOIN jobs j ON j.id=m.job_id
-         WHERE m.job_id=$1 AND m.seq=$2 AND m.status='pending-verification'
-           AND m.created_at_ms IS NOT NULL
-           AND ($3::bigint IS NULL OR m.created_at_ms <= $3) AND j.dvm_id=$4
-           AND ($6::text IS NULL OR m.data->'content'->'tempo_credential'->'challenge'->>'id'=$6)
-           AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
-             WHERE a.dvm_id=$4 AND a.scope=$5 AND a.job_id=m.job_id AND a.outcome <> 'failed')`,
-        [
-          intent.jobId,
-          intent.paymentSeq,
-          control.closed_at_ms,
-          this.dvmId,
-          this.scope,
-          intent.challengeId ?? null
-        ]
-      );
-      if (payment.rows[0]) return;
-      throw new Error("Hosted payment has no pre-closure inbound intent");
-    }
-    if (!intent?.admissionId && !intent?.jobId && !(intent?.creditId && intent.fundId && intent.callerPubkey) || !intent?.jobId && !(intent?.creditId && intent.fundId)) {
-      throw new Error("Hosted obligations are closed to new intents");
-    }
-    const accepted = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE ($1::text IS NULL OR id=$1) AND dvm_id=$2 AND scope=$3
-         AND ($4::bigint IS NULL OR admitted_at_ms <= $4)
-         AND (outcome IN ('pending', 'unresolved') OR ($11::boolean AND outcome='accepted'))
-         AND ($5::text IS NULL OR job_id=$5)
-         AND ($6::text IS NULL OR credit_id=$6)
-         AND ($7::text IS NULL OR fund_id=$7)
-         AND ($8::text IS NULL OR caller_pubkey=$8)
-         AND ($9::text IS NULL OR funding_commitment=$9)
-         AND ($10::text IS NULL OR payment_artifact_hash=$10)`,
-      [
-        intent.admissionId ?? null,
-        this.dvmId,
-        this.scope,
-        control.closed_at_ms,
-        intent.jobId ?? null,
-        intent.creditId ?? null,
-        intent.fundId ?? null,
-        intent.callerPubkey ?? null,
-        intent.fundingCommitment ?? null,
-        intent.paymentArtifactHash ?? null,
-        control.state !== "closed"
-      ]
-    );
-    if (!accepted.rows[0]) throw new Error("Hosted obligation has no pre-closure admission");
-  }
-  async withNewIntent(intent, operation) {
-    return this.withNewIntentOn(this.pool, intent, operation);
-  }
-  async assertFundingReservation(tx, reservation) {
-    await this.assertNewIntent(tx, {
-      admissionId: reservation.admissionId,
-      creditId: reservation.creditId,
-      fundId: reservation.fundId,
-      callerPubkey: reservation.callerPubkey,
-      fundingCommitment: reservation.commitment,
-      paymentArtifactHash: reservation.paymentArtifactHash
-    });
-    const verified = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND credit_id=$4 AND fund_id=$5
-         AND caller_pubkey=$6 AND funding_commitment=$7 AND payment_artifact_hash=$8
-         AND outcome IN ('pending','accepted','unresolved')`,
-      [
-        reservation.admissionId,
-        this.dvmId,
-        this.scope,
-        reservation.creditId,
-        reservation.fundId,
-        reservation.callerPubkey,
-        reservation.commitment,
-        reservation.paymentArtifactHash
-      ]
-    );
-    if (!verified.rows[0]) throw new Error("Hosted funding has no authentic admission");
-  }
-  async fundingAdmission(tx, creditId, fundId, callerPubkey) {
-    await this.assertNewIntent(tx, { creditId, fundId, callerPubkey });
-    const { rows: rows2 } = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE dvm_id=$1 AND scope=$2 AND credit_id=$3 AND fund_id=$4
-         AND caller_pubkey=$5 AND outcome IN ('pending','unresolved')
-       ORDER BY admitted_at_ms,id LIMIT 2`,
-      [this.dvmId, this.scope, creditId, fundId, callerPubkey]
-    );
-    if (rows2.length !== 1) throw new Error("Hosted invoice funding admission is missing or ambiguous");
-    return rows2[0].id;
-  }
-  async withNewIntentOn(db, intent, operation) {
-    const tx = await db.connect();
-    try {
-      await tx.query("BEGIN");
-      await this.assertNewIntent(tx, intent);
-      const result = await operation(tx);
-      await tx.query("COMMIT");
-      return result;
-    } catch (error) {
-      await tx.query("ROLLBACK").catch(() => void 0);
-      throw error;
-    } finally {
-      tx.release();
-    }
-  }
-};
-
 // src/sdk/server/hosting-settlement-report-obligations.ts
 import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
@@ -9925,7 +9859,8 @@ var HostedSettlementReportObligations = class {
           operation TEXT NOT NULL CHECK (operation IN ('claim','refund','settle','close')),
           network TEXT NOT NULL, contract TEXT NOT NULL, channel_id TEXT NOT NULL,
           original JSONB NOT NULL,
-          state TEXT NOT NULL CHECK (state IN ('reserved','observed','report_queued','delivered','no_report')),
+          state TEXT NOT NULL CHECK (state IN ('reserved','observed','report_queued','delivered','no_report','exhausted','unmatched')),
+          close_search_before BIGINT, close_write_off_note TEXT,
           tx_hash TEXT, block_number BIGINT, block_hash TEXT, delta_native NUMERIC(78,0),
           payout_id TEXT, report_id TEXT, report_payload JSONB, delivered_at_ms BIGINT,
           created_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
@@ -9938,6 +9873,29 @@ var HostedSettlementReportObligations = class {
           ON sdk_hosted_settlement_report_obligations (report_id)
           WHERE report_id IS NOT NULL;
       `);
+      const columns = await this.pool.query(
+        `SELECT attname FROM pg_attribute
+         WHERE attrelid='sdk_hosted_settlement_report_obligations'::regclass AND NOT attisdropped`
+      );
+      for (const [name, type] of [["close_search_before", "BIGINT"], ["close_write_off_note", "TEXT"]]) {
+        if (!columns.rows.some((column) => column.attname === name)) {
+          await this.pool.query(`ALTER TABLE sdk_hosted_settlement_report_obligations ADD COLUMN ${name} ${type}`);
+        }
+      }
+      const constraint = await this.pool.query(
+        `SELECT pg_get_constraintdef(oid) AS definition FROM pg_constraint
+         WHERE conrelid='sdk_hosted_settlement_report_obligations'::regclass
+           AND conname='sdk_hosted_settlement_report_obligations_state_check'`
+      );
+      const states = ["reserved", "observed", "report_queued", "delivered", "no_report", "exhausted", "unmatched"];
+      const expected = `CHECK ((state = ANY (ARRAY[${states.map((state) => `'${state}'::text`).join(", ")}])))`;
+      if (constraint.rows[0]?.definition !== expected) {
+        await this.pool.query(`ALTER TABLE sdk_hosted_settlement_report_obligations
+          DROP CONSTRAINT IF EXISTS sdk_hosted_settlement_report_obligations_state_check;
+          ALTER TABLE sdk_hosted_settlement_report_obligations
+          ADD CONSTRAINT sdk_hosted_settlement_report_obligations_state_check
+          CHECK (state IN ('reserved','observed','report_queued','delivered','no_report','exhausted','unmatched'))`);
+      }
       await this.pool.query(
         `INSERT INTO sdk_hosted_settlement_report_history (singleton,complete)
          VALUES (TRUE,$1) ON CONFLICT (singleton) DO NOTHING`,
@@ -10037,53 +9995,169 @@ var HostedSettlementReportObligations = class {
     });
   }
   async reserveTempo(channelId, operation, drainId) {
-    const config = this.tempo;
-    if (!config || !hex(channelId, 32)) throw new Error("Hosted Tempo settlement configuration is unavailable");
+    return transaction(this.pool, (tx) => this.reserveTempoIn(tx, channelId, operation, drainId));
+  }
+  /**
+   * Retire a close reservation that never recorded a transaction and reserve
+   * the drain's next attempt in one transaction. At the retry cap the final
+   * row becomes terminal `exhausted` and remains claimable by a late landing.
+   * A close from the retired attempt that lands late is the same channel's close: `recordSubmitted` on the retired row
+   * writes it onto the successor, and recovery attaches it there if that
+   * attempt never got to write, so it is reported once.
+   *
+   * The caller has just read the channel open on chain. The age bound only
+   * spares a reservation young enough to be inside its first receipt wait; an
+   * attempt slowed past it by a degraded RPC can still be running.
+   */
+  async releaseStaleTempoClose(id, channelId, drainId, limits) {
     return transaction(this.pool, async (tx) => {
-      const state = await tx.query(
-        "SELECT state_json FROM mpp_tempo_channels WHERE channel_key=$1",
-        [channelId.toLowerCase()]
+      await this.lockIdentity(tx);
+      const row = await this.lockRow(tx, id);
+      if (row.rail !== "tempo" || row.operation !== "close" || row.channel_id !== channelId.toLowerCase() || row.original.drainId !== drainId || row.state !== "reserved" || row.tx_hash) {
+        return { outcome: "in_flight" };
+      }
+      const age = await tx.query(
+        `SELECT updated_at_ms <= FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint - $2 AS stale
+         FROM sdk_hosted_settlement_report_obligations WHERE id=$1`,
+        [id, limits.staleAfterMs]
       );
-      if (!state.rows[0]) throw new Error("Hosted Tempo channel is not durable");
-      const identity = await this.lockIdentity(tx);
-      const parsed = parseStoreValue(state.rows[0].state_json);
-      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Hosted Tempo state is invalid");
-      const row = parsed;
-      if (row.chainId !== Number(config.network.split(":")[1]) || String(row.escrowContract).toLowerCase() !== config.escrow.toLowerCase() || String(row.payee).toLowerCase() !== config.payee.toLowerCase() || String(row.token).toLowerCase() !== config.token.toLowerCase()) {
-        throw new Error("Hosted Tempo channel has another chain or recipient");
-      }
-      if (operation === "close") {
-        if (!drainId) throw new Error("Hosted Tempo close requires the original drain");
-        const close = await tx.query(
-          "SELECT drain_id FROM mpp_tempo_close_intents WHERE channel_id=$1",
-          [channelId.toLowerCase()]
+      if (!age.rows[0]?.stale) return { outcome: "in_flight" };
+      const released = Number((await tx.query(
+        `SELECT COUNT(*)::text AS n FROM sdk_hosted_settlement_report_obligations
+         WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
+           AND original->>'drainId'=$4 AND state='no_report' AND tx_hash IS NULL`,
+        [this.dvmId, this.scope, channelId.toLowerCase(), drainId]
+      )).rows[0].n);
+      if (released >= limits.maxReleases) {
+        await tx.query(
+          `UPDATE sdk_hosted_settlement_report_obligations SET state='exhausted',
+             updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
+          [id]
         );
-        if (close.rows[0]?.drain_id !== drainId) throw new Error("Hosted Tempo close has no matching drain");
-      }
-      const highestVoucherAmount = nativeAmount(row.highestVoucherAmount);
-      const settledOnChain = nativeAmount(row.settledOnChain);
-      const spent = nativeAmount(row.spent);
-      if (BigInt(settledOnChain) > BigInt(highestVoucherAmount) || BigInt(spent) > BigInt(highestVoucherAmount)) {
-        throw new Error("Hosted Tempo settlement source has inconsistent amounts");
-      }
-      const original = operation === "settle" ? {
-        highestVoucherAmount,
-        settledOnChain,
-        spent
-      } : { drainId, highestVoucherAmount, settledOnChain, spent };
-      return this.insert(
-        tx,
-        identity,
-        "tempo",
-        operation,
-        config.network,
-        config.escrow,
-        channelId.toLowerCase(),
-        original,
-        operation === "close" ? [drainId] : [highestVoucherAmount]
+        await limits.onExhausted?.(tx);
+        return { outcome: "exhausted", releases: released };
+      }
+      await tx.query(
+        `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report',
+           updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
+        [id]
+      );
+      const next = await this.reserveTempoIn(tx, channelId, "close", drainId);
+      return { outcome: "reserved", id: next.id, releases: released + 1 };
+    });
+  }
+  /**
+   * Resolve an unsubmitted close reservation whose channel the payer exited
+   * on its own: no cooperative close of ours can land on a finalized channel.
+   */
+  async resolveTempoCloseExit(id) {
+    const result = await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report',
+         updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+         AND state IN ('reserved','exhausted') AND tx_hash IS NULL`,
+      [id, this.dvmId, this.scope]
+    );
+    return result.rowCount === 1;
+  }
+  async tempoCloseAmountAtStake(id) {
+    const row = await this.lockRow(this.pool, id);
+    if (row.rail !== "tempo" || row.operation !== "close") throw new Error("Not a Tempo close obligation");
+    return (BigInt(String(row.original.highestVoucherAmount)) - BigInt(String(row.original.settledOnChain))).toString();
+  }
+  /** Stop automatic searches without declaring a possibly missing payout discharged. */
+  async markTempoCloseUnmatched(id) {
+    const result = await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations SET state='unmatched',
+         updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+         AND state IN ('reserved','exhausted') AND tx_hash IS NULL`,
+      [id, this.dvmId, this.scope]
+    );
+    return result.rowCount === 1;
+  }
+  async writeOffTempoClose(id, note) {
+    const result = await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report', close_write_off_note=$4,
+         updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+         AND state='unmatched' AND tx_hash IS NULL RETURNING channel_id,original`,
+      [id, this.dvmId, this.scope, note]
+    );
+    const row = result.rows[0];
+    return row && { channelId: row.channel_id, amount: (BigInt(String(row.original.highestVoucherAmount)) - BigInt(String(row.original.settledOnChain))).toString() };
+  }
+  async reopenTempoClose(id) {
+    return transaction(this.pool, async (tx) => {
+      const owned = await tx.query(
+        "SELECT id FROM sdk_hosted_settlement_report_obligations WHERE id=$1 AND dvm_id=$2 AND scope=$3",
+        [id, this.dvmId, this.scope]
       );
+      if (!owned.rowCount) return false;
+      await this.lockIdentity(tx);
+      const result = await tx.query(
+        `UPDATE sdk_hosted_settlement_report_obligations target
+         SET state='reserved', close_search_before=NULL,
+           updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+         WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+           AND state IN ('unmatched','no_report') AND tx_hash IS NULL
+           AND NOT EXISTS (
+             SELECT 1 FROM sdk_hosted_settlement_report_obligations other
+             WHERE other.dvm_id=target.dvm_id AND other.scope=target.scope
+               AND other.rail='tempo' AND other.operation='close' AND other.channel_id=target.channel_id
+               AND other.id<>target.id AND (other.state<>'no_report' OR other.tx_hash IS NOT NULL)
+           )`,
+        [id, this.dvmId, this.scope]
+      );
+      return result.rowCount === 1;
     });
   }
+  async reserveTempoIn(tx, channelId, operation, drainId) {
+    const config = this.tempo;
+    if (!config || !hex(channelId, 32)) throw new Error("Hosted Tempo settlement configuration is unavailable");
+    const state = await tx.query(
+      "SELECT state_json FROM mpp_tempo_channels WHERE channel_key=$1",
+      [channelId.toLowerCase()]
+    );
+    if (!state.rows[0]) throw new Error("Hosted Tempo channel is not durable");
+    const identity = await this.lockIdentity(tx);
+    const parsed = parseStoreValue(state.rows[0].state_json);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Hosted Tempo state is invalid");
+    const row = parsed;
+    if (row.chainId !== Number(config.network.split(":")[1]) || String(row.escrowContract).toLowerCase() !== config.escrow.toLowerCase() || String(row.payee).toLowerCase() !== config.payee.toLowerCase() || String(row.token).toLowerCase() !== config.token.toLowerCase()) {
+      throw new Error("Hosted Tempo channel has another chain or recipient");
+    }
+    if (operation === "close") {
+      if (!drainId) throw new Error("Hosted Tempo close requires the original drain");
+      const close = await tx.query(
+        "SELECT drain_id FROM mpp_tempo_close_intents WHERE channel_id=$1",
+        [channelId.toLowerCase()]
+      );
+      if (close.rows[0]?.drain_id !== drainId) throw new Error("Hosted Tempo close has no matching drain");
+    }
+    const highestVoucherAmount = nativeAmount(row.highestVoucherAmount);
+    const settledOnChain = nativeAmount(row.settledOnChain);
+    const spent = nativeAmount(row.spent);
+    if (BigInt(settledOnChain) > BigInt(highestVoucherAmount) || BigInt(spent) > BigInt(highestVoucherAmount)) {
+      throw new Error("Hosted Tempo settlement source has inconsistent amounts");
+    }
+    const original = operation === "settle" ? {
+      highestVoucherAmount,
+      settledOnChain,
+      spent
+    } : { drainId, highestVoucherAmount, settledOnChain, spent };
+    return this.insert(
+      tx,
+      identity,
+      "tempo",
+      operation,
+      config.network,
+      config.escrow,
+      channelId.toLowerCase(),
+      original,
+      operation === "close" ? [drainId] : [highestVoucherAmount]
+    );
+  }
   async findPendingTempo(channelId, operation) {
     const result = await this.pool.query(
       `SELECT * FROM sdk_hosted_settlement_report_obligations
@@ -10096,14 +10170,33 @@ var HostedSettlementReportObligations = class {
   /** The original close obligation reserved for this drain, while its report is outstanding. */
   async pendingTempoClose(channelId, drainId) {
     const result = await this.pool.query(
-      `SELECT id,tx_hash,created_at_ms FROM sdk_hosted_settlement_report_obligations
+      `SELECT id,state,tx_hash,created_at_ms,close_search_before FROM sdk_hosted_settlement_report_obligations
        WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
          AND original->>'drainId'=$4 AND state NOT IN ('delivered','no_report')
        ORDER BY created_at_ms DESC LIMIT 1`,
       [this.dvmId, this.scope, channelId.toLowerCase(), drainId]
     );
     const row = result.rows[0];
-    return row && { id: row.id, txHash: row.tx_hash, reservedAtMs: Number(row.created_at_ms) };
+    return row && {
+      id: row.id,
+      state: row.state,
+      txHash: row.tx_hash,
+      reservedAtMs: Number(row.created_at_ms),
+      searchBefore: searchCursor(row.close_search_before)
+    };
+  }
+  /**
+   * Where the next search for this close obligation's transaction resumes. It
+   * lives on the obligation, not the drain's close intent, because releasing
+   * the drain deletes the intent while the obligation still needs the search.
+   */
+  async recordTempoCloseSearch(id, resumeAt) {
+    await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations
+          SET close_search_before = LEAST(COALESCE(close_search_before, $4), $4)
+        WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'`,
+      [id, this.dvmId, this.scope, resumeAt.toString()]
+    );
   }
   async submittedIds(rail, operation, txHash, batchId) {
     if (!hex(txHash, 32)) throw new Error("Hosted effect has no exact transaction hash");
@@ -10211,17 +10304,68 @@ var HostedSettlementReportObligations = class {
     if (!hex(txHash, 32)) throw new Error("Hosted settlement has no transaction hash");
     const write = this.x402SettlementStore ? this.x402Transaction.bind(this) : (operation) => transaction(this.pool, operation);
     await write(async (tx) => {
-      const row = await this.lockRow(tx, id);
+      let row = await this.lockRow(tx, id);
+      if (row.state === "no_report" && !row.tx_hash) {
+        row = await this.successorOfRetiredClose(tx, row);
+      }
       if (row.tx_hash && row.tx_hash.toLowerCase() !== txHash.toLowerCase()) {
         throw new Error("Hosted settlement transaction replay conflicts");
       }
       await tx.query(
         `UPDATE sdk_hosted_settlement_report_obligations SET tx_hash=COALESCE(tx_hash,$2),
+           state=CASE WHEN state IN ('exhausted','unmatched') THEN 'reserved' ELSE state END,
            updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
-        [id, txHash.toLowerCase()]
+        [row.id, txHash.toLowerCase()]
       );
     });
   }
+  /**
+   * Close reservations that never recorded a transaction, oldest first. Each
+   * one owes a payout report if its close lands. Exhausted attempts remain
+   * observable for late landings; unmatched searches require an explicit retry.
+   */
+  async unsubmittedTempoCloses(limit = 100) {
+    const result = await this.pool.query(
+      `SELECT id,channel_id,original->>'drainId' AS drain_id,created_at_ms,close_search_before
+         FROM sdk_hosted_settlement_report_obligations
+        WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close'
+          AND state IN ('reserved','exhausted') AND tx_hash IS NULL
+        ORDER BY created_at_ms,id LIMIT $3`,
+      [this.dvmId, this.scope, limit]
+    );
+    return result.rows.flatMap((row) => row.drain_id === null ? [] : [{
+      id: row.id,
+      channelId: row.channel_id,
+      drainId: row.drain_id,
+      reservedAtMs: Number(row.created_at_ms),
+      searchBefore: searchCursor(row.close_search_before)
+    }]);
+  }
+  /**
+   * A retired close reservation's attempt can still be running when its
+   * successor is reserved, and its close can land. The close is the same
+   * channel's, so it belongs to the drain's outstanding obligation; writing it
+   * onto the retired row would leave that obligation without a transaction and
+   * the payout unreported.
+   */
+  async successorOfRetiredClose(tx, retired) {
+    const drainId = retired.original.drainId;
+    if (retired.rail !== "tempo" || retired.operation !== "close" || typeof drainId !== "string") {
+      throw new Error("Hosted settlement obligation was resolved without a transaction");
+    }
+    const successor = await tx.query(
+      `SELECT id FROM sdk_hosted_settlement_report_obligations
+        WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
+          AND original->>'drainId'=$4 AND state NOT IN ('delivered','no_report')
+        ORDER BY created_at_ms DESC LIMIT 1`,
+      [this.dvmId, this.scope, retired.channel_id, drainId]
+    );
+    if (!successor.rows[0]) {
+      throw new Error("Hosted Tempo close was retired and the drain has no outstanding obligation");
+    }
+    const locked = await this.lockRow(tx, successor.rows[0].id);
+    return locked.state === "no_report" && !locked.tx_hash ? this.successorOfRetiredClose(tx, locked) : locked;
+  }
   async recoveryCandidates() {
     const result = await this.pool.query(
       `SELECT * FROM sdk_hosted_settlement_report_obligations
@@ -10683,6 +10827,191 @@ var HostedSettlementReportObligations = class {
     return { id: row.id, replayed: true };
   }
 };
+async function retryHostedTempoCloseReport(args) {
+  const obligations = new HostedSettlementReportObligations(args.db, args.dvmId, args.scope);
+  return obligations.reopenTempoClose(args.obligationId);
+}
+async function writeOffHostedTempoCloseReport(args) {
+  const note = args.note.trim();
+  if (!note || note.length > 2e3) throw new Error("A write-off requires a note of 1 to 2000 characters");
+  const row = await new HostedSettlementReportObligations(args.db, args.dvmId, args.scope).writeOffTempoClose(args.obligationId, note);
+  if (!row) return false;
+  loggers.tempo.warn("tempo_session_close_report_written_off", {
+    channel_id: row.channelId,
+    obligation_id: args.obligationId,
+    amount_forgone_native: row.amount
+  });
+  return true;
+}
+function searchCursor(value) {
+  return value === null ? null : BigInt(value);
+}
+
+// src/sdk/server/hosting-control.ts
+import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
+
+// src/sdk/server/hosting-cleanup-fence.ts
+var HostingCleanupFence = class {
+  constructor(pool, dvmId, scope) {
+    this.pool = pool;
+    this.dvmId = dvmId;
+    this.scope = scope;
+  }
+  pool;
+  dvmId;
+  scope;
+  async assertNewIntent(tx, intent) {
+    const continuation = intent?.admissionId || intent?.paymentSeq !== void 0 || intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash || intent?.creditId && intent.fundId && intent.callerPubkey;
+    const { rows: rows2 } = await tx.query(
+      `SELECT state, closed_at_ms, closed_at_us FROM sdk_hosting_control
+       WHERE dvm_id=$1 AND scope=$2 ${continuation ? "" : "FOR UPDATE"}`,
+      [this.dvmId, this.scope]
+    );
+    const control = rows2[0];
+    if (!control) throw new Error("Hosted obligation fence is unavailable");
+    if (control.state === "closed" && (control.closed_at_ms === null || control.closed_at_us === null)) {
+      throw new Error("Hosted closure cutoff is unavailable");
+    }
+    if (control.state !== "closed" && !continuation) return;
+    if (intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash) {
+      const repair = !!intent.invoiceRepairPaymentHash;
+      const invoice = await tx.query(
+        `SELECT i.payment_hash FROM credit_invoices i
+         LEFT JOIN sdk_hosting_admissions a ON a.id=i.hosting_admission_id
+         WHERE i.payment_hash=$1 AND i.caller_pubkey=$4 AND i.amount_micro=$5
+           AND (($10::boolean AND $3=i.payment_hash AND i.status IN ('blocked','written_off'))
+             OR (NOT $10::boolean AND i.credit_id=$2 AND i.fund_id=$3 AND i.status='pending'))
+           AND ((i.hosting_admission_id IS NULL AND
+                 ($9::bigint IS NULL OR i.created_at_db_us <= $9)) OR
+             (a.dvm_id=$6 AND a.scope=$7 AND a.credit_id=i.credit_id
+              AND a.fund_id=i.fund_id AND a.caller_pubkey=i.caller_pubkey
+              AND a.outcome IN ('pending','accepted','unresolved')
+              AND ($8::bigint IS NULL OR a.admitted_at_ms <= $8)))`,
+        [
+          intent.invoicePaymentHash ?? intent.invoiceRepairPaymentHash,
+          intent.creditId,
+          intent.fundId,
+          intent.callerPubkey,
+          intent.amountMicro,
+          this.dvmId,
+          this.scope,
+          control.closed_at_ms,
+          control.closed_at_us,
+          repair
+        ]
+      );
+      if (invoice.rows[0]) return;
+      throw new Error("Hosted invoice has no original payable admission");
+    }
+    if (intent?.paymentSeq !== void 0 && intent.jobId) {
+      const payment = await tx.query(
+        `SELECT m.job_id FROM job_messages m JOIN jobs j ON j.id=m.job_id
+         WHERE m.job_id=$1 AND m.seq=$2 AND m.status='pending-verification'
+           AND m.created_at_ms IS NOT NULL
+           AND ($3::bigint IS NULL OR m.created_at_ms <= $3) AND j.dvm_id=$4
+           AND ($6::text IS NULL OR m.data->'content'->'tempo_credential'->'challenge'->>'id'=$6)
+           AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
+             WHERE a.dvm_id=$4 AND a.scope=$5 AND a.job_id=m.job_id AND a.outcome <> 'failed')`,
+        [
+          intent.jobId,
+          intent.paymentSeq,
+          control.closed_at_ms,
+          this.dvmId,
+          this.scope,
+          intent.challengeId ?? null
+        ]
+      );
+      if (payment.rows[0]) return;
+      throw new Error("Hosted payment has no pre-closure inbound intent");
+    }
+    if (!intent?.admissionId && !intent?.jobId && !(intent?.creditId && intent.fundId && intent.callerPubkey) || !intent?.jobId && !(intent?.creditId && intent.fundId)) {
+      throw new Error("Hosted obligations are closed to new intents");
+    }
+    const accepted = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE ($1::text IS NULL OR id=$1) AND dvm_id=$2 AND scope=$3
+         AND ($4::bigint IS NULL OR admitted_at_ms <= $4)
+         AND (outcome IN ('pending', 'unresolved') OR ($11::boolean AND outcome='accepted'))
+         AND ($5::text IS NULL OR job_id=$5)
+         AND ($6::text IS NULL OR credit_id=$6)
+         AND ($7::text IS NULL OR fund_id=$7)
+         AND ($8::text IS NULL OR caller_pubkey=$8)
+         AND ($9::text IS NULL OR funding_commitment=$9)
+         AND ($10::text IS NULL OR payment_artifact_hash=$10)`,
+      [
+        intent.admissionId ?? null,
+        this.dvmId,
+        this.scope,
+        control.closed_at_ms,
+        intent.jobId ?? null,
+        intent.creditId ?? null,
+        intent.fundId ?? null,
+        intent.callerPubkey ?? null,
+        intent.fundingCommitment ?? null,
+        intent.paymentArtifactHash ?? null,
+        control.state !== "closed"
+      ]
+    );
+    if (!accepted.rows[0]) throw new Error("Hosted obligation has no pre-closure admission");
+  }
+  async withNewIntent(intent, operation) {
+    return this.withNewIntentOn(this.pool, intent, operation);
+  }
+  async assertFundingReservation(tx, reservation) {
+    await this.assertNewIntent(tx, {
+      admissionId: reservation.admissionId,
+      creditId: reservation.creditId,
+      fundId: reservation.fundId,
+      callerPubkey: reservation.callerPubkey,
+      fundingCommitment: reservation.commitment,
+      paymentArtifactHash: reservation.paymentArtifactHash
+    });
+    const verified = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND credit_id=$4 AND fund_id=$5
+         AND caller_pubkey=$6 AND funding_commitment=$7 AND payment_artifact_hash=$8
+         AND outcome IN ('pending','accepted','unresolved')`,
+      [
+        reservation.admissionId,
+        this.dvmId,
+        this.scope,
+        reservation.creditId,
+        reservation.fundId,
+        reservation.callerPubkey,
+        reservation.commitment,
+        reservation.paymentArtifactHash
+      ]
+    );
+    if (!verified.rows[0]) throw new Error("Hosted funding has no authentic admission");
+  }
+  async fundingAdmission(tx, creditId, fundId, callerPubkey) {
+    await this.assertNewIntent(tx, { creditId, fundId, callerPubkey });
+    const { rows: rows2 } = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND credit_id=$3 AND fund_id=$4
+         AND caller_pubkey=$5 AND outcome IN ('pending','unresolved')
+       ORDER BY admitted_at_ms,id LIMIT 2`,
+      [this.dvmId, this.scope, creditId, fundId, callerPubkey]
+    );
+    if (rows2.length !== 1) throw new Error("Hosted invoice funding admission is missing or ambiguous");
+    return rows2[0].id;
+  }
+  async withNewIntentOn(db, intent, operation) {
+    const tx = await db.connect();
+    try {
+      await tx.query("BEGIN");
+      await this.assertNewIntent(tx, intent);
+      const result = await operation(tx);
+      await tx.query("COMMIT");
+      return result;
+    } catch (error) {
+      await tx.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      tx.release();
+    }
+  }
+};
 
 // src/sdk/server/hosting-channel-evidence.ts
 import { createHash as createHash7 } from "crypto";
@@ -18168,7 +18497,7 @@ async function requireWedgedTempoDrain(c, opts, args, admitBooked) {
       )
     };
   }
-  if (record.status !== "pending" && !(admitBooked && record.status === "sent")) {
+  if (record.status !== "pending" && !(admitBooked && (record.status === "sent" || record.status === "exit_required"))) {
     return { response: tempoNotWedgedRefusal(c, args, record.status) };
   }
   return { record, channelId: record.channelId };
@@ -19584,7 +19913,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-X52GPZ5U.js");
+      const { RevenueReporter } = await import("./revenue-reporter-4EAVPWXS.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -19594,7 +19923,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-HQSIIBFL.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-TZX2S7KG.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -19895,7 +20224,43 @@ var DVMServer = class {
       dvmId: this.receiptDvmId()
     }) : void 0;
     this.creditLedger = opts.creditLedger ?? new MemoryCreditLedger();
-    this.opts.mpp?.useTempoCreditLedger?.(this.creditLedger);
+    this.opts.mpp?.useTempoCreditLedger?.(this.creditLedger, async (drain, evidence) => {
+      const completed = await completeTempoChannelDrain({
+        deps: { ledger: this.creditLedger, drainReport: {
+          db: this.opts.db,
+          dvmId: this.opts.dvmId,
+          enqueueCreditDrain: this.opts.enqueueCreditDrain
+        } },
+        creditId: drain.creditId,
+        drainId: drain.drainId,
+        channelId: drain.channelId,
+        refundedNative: evidence.refundedNative,
+        debitedNative: drain.drainedNative,
+        reference: evidence.reference,
+        finalization: {
+          outcome: evidence.creditUnbacked ? `${evidence.outcome}_unbacked` : evidence.outcome,
+          creditUnbacked: evidence.creditUnbacked
+        }
+      });
+      if (!completed.replayed && this.receiptIssuer) {
+        const receipt = this.receiptIssuer.issueDrain({
+          creditId: drain.creditId,
+          drainId: drain.drainId,
+          event: "sent",
+          method: drain.method,
+          amountMicro: drain.amountMicro,
+          balanceAfterMicro: drain.balanceAfterMicro,
+          ledgerSeq: drain.ledgerSeq,
+          callerPubkey: drain.callerPubkey
+        });
+        await this.creditLedger.appendDrainReceipt({
+          creditId: drain.creditId,
+          drainId: drain.drainId,
+          receipt
+        });
+      }
+      return !completed.replayed;
+    });
     this.processedPayments = opts.processedPayments ?? new MemoryProcessedPaymentStore();
     this.jobManager = new JobManager(descriptor, {
       receiptIssuer: this.receiptIssuer,
@@ -20051,6 +20416,9 @@ var DVMServer = class {
     if (!certificateOnly && await control.close(command, support) === "conflict") {
       return c.json({ error: "hosting_closure_conflict" }, 409);
     }
+    await this.opts.mpp?.reconcileTempoSessionCloses?.().catch(() => {
+      diagnosticConsole.warn({ level: "tempo_routine_sweep_failed", dvm_id: this.opts.dvmId, error: void 0 });
+    });
     const evidence = await control.certificate({ ...command, action: "certificate" }, support);
     if (!evidence) return c.json({ error: "hosting_closure_stale" }, 409);
     return c.json(evidence);
@@ -23095,6 +23463,8 @@ export {
   X402ExactSettlementServer,
   X402ExactSettlementEvidenceMissingError,
   HostedSettlementReportObligations,
+  retryHostedTempoCloseReport,
+  writeOffHostedTempoCloseReport,
   signHostingControl,
   signHostingClosure,
   jobCredentialGate,