@dvmkit/sdk 0.8.1 → 0.10.0

package/dist/{chunk-JIZ4ZIXX.js → chunk-QNKK7SPY.js}

@@ -1,16 +1,11 @@
 import {
-  TEMPO_MODERATO_CHAIN_ID,
-  TEMPO_MODERATO_RPC,
-  advertisedMethods,
-  challengeMeta,
-  installHostedTempoChargeGuard,
-  installHostedTempoCloseGuard,
-  isTempoInsufficientFundsError,
-  resolveTempoNetwork
-} from "./chunk-QKE5NDPF.js";
+  MemoryProcessedPaymentStore,
+  PostgresProcessedPaymentStore,
+  ProcessedPaymentReplayError
+} from "./chunk-XRLKGCAW.js";
 import {
   x402EarnedCeiling
-} from "./chunk-J5J63WDC.js";
+} from "./chunk-FFXXGCVG.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -19,13 +14,13 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-AVV5SYGO.js";
+} from "./chunk-VTHYQCDB.js";
 import {
   MemoryCreditLedger
-} from "./chunk-AGE5XZKE.js";
+} from "./chunk-YOSZIWC3.js";
 import {
   PostgresJobStore
-} from "./chunk-G3MPHW5I.js";
+} from "./chunk-Y6DO5WSO.js";
 import {
   parseStoreValue
 } from "./chunk-YG7G4DPZ.js";
@@ -36,7 +31,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-ILBSZMJL.js";
+} from "./chunk-2XQLL6N6.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -45,7 +40,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-IHQUBATH.js";
+} from "./chunk-KFCEXCZM.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -85,7 +80,7 @@ import {
   signReceipt,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-ZEPJF4JC.js";
+} from "./chunk-VUGEEMLT.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -113,13 +108,7 @@ import {
 } from "./chunk-UKD3R2KU.js";
 import {
   createConsoleLogger
-} from "./chunk-OP7VCGQR.js";
-import {
-  loggers,
-  pinDimension,
-  withSpan,
-  withTraceContext
-} from "./chunk-IOQIXRGM.js";
+} from "./chunk-3R7NQA3Z.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -136,7 +125,7 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-2U6LAASN.js";
+} from "./chunk-W3VGCNG6.js";
 import {
   CreditLedger,
   CreditLedgerError,
@@ -152,26 +141,38 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-FM6QAGJC.js";
+} from "./chunk-STJBBVNL.js";
+import {
+  withSdkInitLock
+} from "./chunk-COYKJRMM.js";
 import {
   withPostgresRecoveryContext
-} from "./chunk-7PM4R4GD.js";
+} from "./chunk-MMGSYMIC.js";
 import {
   DvmError,
   x402NetworkByCaip2
 } from "./chunk-BPYMEMQX.js";
 import {
-  createDiagnosticCapabilityAuthority,
-  diagnosticConsole
-} from "./chunk-BFGQG4WY.js";
+  TEMPO_MODERATO_CHAIN_ID,
+  TEMPO_MODERATO_RPC,
+  TempoCloseDescriptorError,
+  advertisedMethods,
+  challengeMeta,
+  installHostedTempoChargeGuard,
+  installHostedTempoCloseGuard,
+  isTempoInsufficientFundsError,
+  resolveTempoNetwork
+} from "./chunk-MU3IE434.js";
 import {
-  MemoryProcessedPaymentStore,
-  PostgresProcessedPaymentStore,
-  ProcessedPaymentReplayError
-} from "./chunk-XRLKGCAW.js";
+  loggers,
+  pinDimension,
+  withSpan,
+  withTraceContext
+} from "./chunk-M3T5JYDJ.js";
 import {
-  withSdkInitLock
-} from "./chunk-COYKJRMM.js";
+  createDiagnosticCapabilityAuthority,
+  diagnosticConsole
+} from "./chunk-QGNXYVBO.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -3883,7 +3884,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
+      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4192,7 +4193,18 @@ async function verifyUpfrontPaymentInScope(opts) {
           replayRealm,
           cred.challenge.id,
           CONSUMED_CREDENTIAL_TTL_MS / 1e3
-        ));
+        )).catch((error) => {
+          const transactionHash = tempoReceiptTransactionHash(tempoReceipt);
+          if (!transactionHash) throw error;
+          diagnosticConsole.error({
+            level: "error",
+            event: "tempo_replay_mark_failed",
+            phase: "upfront",
+            rail: "tempo",
+            transaction_hash: transactionHash,
+            ...paymentFailureFields(error)
+          });
+        });
       }
       if (ledgerCtx) {
         try {
@@ -4896,7 +4908,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
+      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5327,7 +5339,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
+      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -6953,6 +6965,10 @@ async function completeTempoChannelDrain(args) {
           tx_hash: args.reference,
           channel_id: args.channelId,
           ...settlementEvidence,
+          ...args.finalization && {
+            terminal_outcome: args.finalization.outcome,
+            credit_unbacked: args.finalization.creditUnbacked
+          },
           ...args.repaired ? { repaired: true, repair_kind: "tempo_close_reconciled" } : {}
         },
         tx: innerTx
@@ -7231,14 +7247,14 @@ async function handleDrain(c, deps, args) {
       404
     );
   }
-  if (credit.status === "unbacked") {
+  let existing = await deps.ledger.getDrain({ creditId, drainId: drain.drain_id });
+  if (credit.status === "unbacked" && existing?.status !== "sent") {
     const rejected2 = await burnNonce(c, deps, args.envelope);
     if (rejected2) return rejected2;
     return jsonPaymentError("credit_unbacked", 409, {
       message: `Credit ${creditId} is terminal because its Tempo backing finalized before the DVM was protected.`
     });
   }
-  let existing = await deps.ledger.getDrain({ creditId, drainId: drain.drain_id });
   if (existing) {
     const tempoDiscovery = existing.method === "tempo" && existing.status === "pending" && drain.method === "tempo" && !!credit.tempoChannelId && !c.req.header("Authorization");
     if (!tempoDiscovery) {
@@ -7254,6 +7270,17 @@ async function handleDrain(c, deps, args) {
       const released = await releaseTempoDrain(c, deps, existing, credit.tempoChannelId);
       return respondDrain(c, deps, { record: released, credit });
     }
+    if (existing.status === "exit_required") {
+      const mpp = (await deps.railOpts(c)).mpp;
+      if (mpp && credit.tempoChannelId) {
+        const recovered = await recoverTempoDrain(deps, mpp, existing, credit.tempoChannelId);
+        if (recovered) {
+          if (isHttpResponse(recovered)) return recovered;
+          return respondDrain(c, deps, { record: recovered, credit });
+        }
+      }
+      return tempoExitRequiredResponse(existing);
+    }
     if (existing.method === "tempo" && existing.status === "pending" && credit.tempoChannelId) {
       if (credit.balanceMicro !== credit.availableMicro) {
         const released = await releaseTempoDrain(c, deps, existing, credit.tempoChannelId);
@@ -7491,7 +7518,8 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
             deps.hostedSettlementReports,
             rail.mpp,
             record,
-            expectedChannelId
+            expectedChannelId,
+            deps.ledger
           );
           if (!rail.mpp?.permitHostedTempoClose) {
             throw new Error("Hosted Tempo close credential guard is unavailable");
@@ -7521,13 +7549,21 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
     }
     const wrongChannel = tempoWrongChannelRefusal(error, record);
     if (wrongChannel) return wrongChannel;
-    if (error instanceof HostedTempoCloseAttemptsExhaustedError) {
-      return jsonPaymentError("tempo_channel_exit_required", 409, {
-        message: `Tempo drain ${record.drainId} reached its limit of cooperative close attempts that never reached the chain.`,
-        display: "The service could not complete a cooperative close of this stablecoin channel after several attempts. Your funds stay in the channel; use the timed on-chain exit to recover them.",
-        hint: "Start the channel's timed on-chain exit. Retrying this drain with another close credential is refused.",
-        extra: { drain_registered: true, drain_id: record.drainId, channel_id: expectedChannelId }
-      });
+    if (error instanceof HostedTempoCloseAttemptsExhaustedError || error instanceof TempoCloseDescriptorError) {
+      const result = deps.ledger.requireTempoDrainExit ? await deps.ledger.requireTempoDrainExit({ creditId: record.creditId, drainId: record.drainId }) : { drain: record, replayed: false };
+      if (!result.replayed && error instanceof TempoCloseDescriptorError) {
+        loggers.tempo.warn("tempo_session_close_descriptor_refused", {
+          credit_id: record.creditId,
+          drain_id: record.drainId,
+          channel_id: expectedChannelId,
+          amount_at_stake_native: record.drainedNative?.toString() ?? null,
+          amount_at_stake_micro: record.amountMicro,
+          currency: record.currency,
+          error: error.message
+        });
+      }
+      if (result.drain.status === "sent") return respondDrain(c, deps, { record: result.drain, credit });
+      return tempoExitRequiredResponse(result.drain);
     }
     const refused = tempoFloorRefusal(error, record);
     if (refused) return refused;
@@ -7547,13 +7583,8 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
     try {
       const state = await rail.mpp.getTempoSessionDrainState?.(expectedChannelId);
       if (state?.finalized || state?.deposit === 0n) {
-        const recovered2 = await rail.mpp.recoverTempoSessionClose?.(
-          expectedChannelId,
-          record.drainId
-        );
-        if (recovered2) {
-          return await markTempoDrainSent(deps, rail.mpp, record, expectedChannelId, recovered2);
-        }
+        const recovered2 = await recoverTempoDrain(deps, rail.mpp, record, expectedChannelId);
+        if (recovered2) return recovered2;
       }
       if (state && (state.closeRequestedAt !== 0n || isDefinitiveTempoCloseFailure(error))) {
         return await releaseTempoDrain(c, deps, record, expectedChannelId);
@@ -7580,13 +7611,15 @@ var HOSTED_TEMPO_CLOSE_MAX_RELEASES = 3;
 var HOSTED_TEMPO_CLOSE_IN_FLIGHT = "Hosted Tempo close already has an original effect attempt";
 var HostedTempoCloseAttemptsExhaustedError = class extends Error {
 };
-async function reserveHostedTempoClose(reports, mpp, record, channelId) {
+async function reserveHostedTempoClose(reports, mpp, record, channelId, ledger) {
   const pending = await reports.pendingTempoClose(channelId, record.drainId);
   if (!pending) {
     const reserved = await reports.reserveTempo(channelId, "close", record.drainId);
     if (reserved.replayed) throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
     return reserved.id;
   }
+  if (pending.state === "exhausted") throw new HostedTempoCloseAttemptsExhaustedError();
+  if (pending.state === "unmatched") throw new Error("Hosted Tempo close report requires an operator retry");
   if (pending.txHash || !mpp.getTempoSessionDrainState) throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
   const state = await mpp.getTempoSessionDrainState(channelId);
   if (state.finalized || state.deposit === 0n || state.closeRequestedAt !== 0n) {
@@ -7594,7 +7627,10 @@ async function reserveHostedTempoClose(reports, mpp, record, channelId) {
   }
   const result = await reports.releaseStaleTempoClose(pending.id, channelId, record.drainId, {
     staleAfterMs: HOSTED_TEMPO_CLOSE_STALE_MS,
-    maxReleases: HOSTED_TEMPO_CLOSE_MAX_RELEASES
+    maxReleases: HOSTED_TEMPO_CLOSE_MAX_RELEASES,
+    onExhausted: async (tx) => {
+      await ledger.requireTempoDrainExit?.({ creditId: record.creditId, drainId: record.drainId, tx });
+    }
   });
   if (result.outcome === "in_flight") throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
   if (result.outcome === "exhausted") {
@@ -7603,7 +7639,8 @@ async function reserveHostedTempoClose(reports, mpp, record, channelId) {
       drain_id: record.drainId,
       channel_id: channelId,
       obligation_id: pending.id,
-      attempt: result.releases + 1
+      attempt: result.releases + 1,
+      amount_at_stake_native: await reports.tempoCloseAmountAtStake(pending.id)
     });
     throw new HostedTempoCloseAttemptsExhaustedError(
       `Tempo drain ${record.drainId} exhausted its cooperative close attempts`
@@ -7618,13 +7655,55 @@ async function reserveHostedTempoClose(reports, mpp, record, channelId) {
   });
   return result.id;
 }
+function tempoExitRequiredResponse(record) {
+  const terminal = record.status === "exit_required";
+  return jsonPaymentError("tempo_channel_exit_required", 409, {
+    message: terminal ? `Tempo drain ${record.drainId} cannot cooperatively close this channel.` : `This Tempo close credential cannot complete drain ${record.drainId}.`,
+    display: "Your funds remain in the channel. Use the timed on-chain exit to recover them.",
+    hint: terminal ? "Start the channel's timed on-chain exit. A corrected close credential does not reopen this drain or debit it again." : "This drain remains pending. Use the channel's timed on-chain exit, or retry the same drain with a valid close credential if cooperative attempts remain. Retrying does not debit it again.",
+    extra: {
+      drain_registered: true,
+      drain_id: record.drainId,
+      channel_id: record.channelId,
+      status: record.status
+    }
+  });
+}
 function tempoCloseCredentialNeedsRefresh(error) {
   return error instanceof MppxErrors.InvalidChallengeError || error instanceof MppxErrors.PaymentExpiredError;
 }
+function tempoRefundUnprovenResponse(record) {
+  return jsonPaymentError("settlement_pending", 409, {
+    message: "The full Tempo refund could not be proven yet.",
+    display: "Your funds remain held and have not been lost. The DVM operator has been alerted.",
+    hint: `Keep drain ${record.drainId}; no replacement drain is needed.`,
+    extra: { drain_registered: true, drain_id: record.drainId }
+  });
+}
 async function recoverTempoDrain(deps, mpp, record, channelId) {
   try {
-    const reference = await mpp.recoverTempoSessionClose?.(channelId, record.drainId);
-    return reference ? await markTempoDrainSent(deps, mpp, record, channelId, reference) : null;
+    const result = await mpp.recoverTempoSessionClose?.(channelId, record.drainId, record.creditId);
+    const durable = await deps.ledger.getDrain({ creditId: record.creditId, drainId: record.drainId });
+    if (durable?.status === "sent") return durable;
+    if (result && typeof result === "object") {
+      return tempoRefundUnprovenResponse(durable ?? record);
+    }
+    if (!result) return null;
+    if (!/^0x[0-9a-fA-F]{64}$/.test(result)) {
+      loggers.tempo.warn("tempo_session_drain_refund_unproven", {
+        channel_id: channelId,
+        credit_id: record.creditId,
+        drain_id: record.drainId,
+        amount_at_stake_native: record.drainedNative?.toString() ?? null,
+        amount_at_stake_micro: record.amountMicro,
+        currency: record.currency,
+        reason: "close_evidence_missing",
+        error: "Recovery returned no proven refund"
+      });
+      return tempoRefundUnprovenResponse(durable ?? record);
+    }
+    if (durable?.status === "exit_required") return null;
+    return await markTempoDrainSent(deps, mpp, durable ?? record, channelId, result);
   } catch (error) {
     const refused = tempoFloorRefusal(error, record);
     if (refused) return refused;
@@ -7634,7 +7713,9 @@ async function recoverTempoDrain(deps, mpp, record, channelId) {
       error: error instanceof Error ? error.message : String(error)
     });
     return jsonPaymentError("payment_invalid", 402, {
-      message: "The Tempo session close is still being reconciled; retry this drain."
+      message: "The Tempo session close is still being reconciled; retry this drain.",
+      hint: `Retry this same drain ${record.drainId} after the service can read and persist the close evidence.`,
+      retryable: true
     });
   }
 }
@@ -8109,6 +8190,11 @@ function drainCopy(record) {
         display: "The refund was sent to the payout destination you provided.",
         hint: "See `sent` for the settlement reference (e.g. the on-chain transaction hash)."
       };
+    case "exit_required":
+      return {
+        display: "This drain cannot cooperatively close the channel. Your funds remain in the channel.",
+        hint: "Use the channel's timed on-chain exit. A corrected credential does not reopen this drain."
+      };
     case "released":
       return {
         display: "The channel could not complete this refund, so the service restored the amount to your prepaid balance.",
@@ -9586,172 +9672,6 @@ function safeError(err) {
   return "settlement_transport_error";
 }
 
-// src/sdk/server/hosting-control.ts
-import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
-
-// src/sdk/server/hosting-cleanup-fence.ts
-var HostingCleanupFence = class {
-  constructor(pool, dvmId, scope) {
-    this.pool = pool;
-    this.dvmId = dvmId;
-    this.scope = scope;
-  }
-  pool;
-  dvmId;
-  scope;
-  async assertNewIntent(tx, intent) {
-    const continuation = intent?.admissionId || intent?.paymentSeq !== void 0 || intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash || intent?.creditId && intent.fundId && intent.callerPubkey;
-    const { rows: rows2 } = await tx.query(
-      `SELECT state, closed_at_ms, closed_at_us FROM sdk_hosting_control
-       WHERE dvm_id=$1 AND scope=$2 ${continuation ? "" : "FOR UPDATE"}`,
-      [this.dvmId, this.scope]
-    );
-    const control = rows2[0];
-    if (!control) throw new Error("Hosted obligation fence is unavailable");
-    if (control.state === "closed" && (control.closed_at_ms === null || control.closed_at_us === null)) {
-      throw new Error("Hosted closure cutoff is unavailable");
-    }
-    if (control.state !== "closed" && !continuation) return;
-    if (intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash) {
-      const repair = !!intent.invoiceRepairPaymentHash;
-      const invoice = await tx.query(
-        `SELECT i.payment_hash FROM credit_invoices i
-         LEFT JOIN sdk_hosting_admissions a ON a.id=i.hosting_admission_id
-         WHERE i.payment_hash=$1 AND i.caller_pubkey=$4 AND i.amount_micro=$5
-           AND (($10::boolean AND $3=i.payment_hash AND i.status IN ('blocked','written_off'))
-             OR (NOT $10::boolean AND i.credit_id=$2 AND i.fund_id=$3 AND i.status='pending'))
-           AND ((i.hosting_admission_id IS NULL AND
-                 ($9::bigint IS NULL OR i.created_at_db_us <= $9)) OR
-             (a.dvm_id=$6 AND a.scope=$7 AND a.credit_id=i.credit_id
-              AND a.fund_id=i.fund_id AND a.caller_pubkey=i.caller_pubkey
-              AND a.outcome IN ('pending','accepted','unresolved')
-              AND ($8::bigint IS NULL OR a.admitted_at_ms <= $8)))`,
-        [
-          intent.invoicePaymentHash ?? intent.invoiceRepairPaymentHash,
-          intent.creditId,
-          intent.fundId,
-          intent.callerPubkey,
-          intent.amountMicro,
-          this.dvmId,
-          this.scope,
-          control.closed_at_ms,
-          control.closed_at_us,
-          repair
-        ]
-      );
-      if (invoice.rows[0]) return;
-      throw new Error("Hosted invoice has no original payable admission");
-    }
-    if (intent?.paymentSeq !== void 0 && intent.jobId) {
-      const payment = await tx.query(
-        `SELECT m.job_id FROM job_messages m JOIN jobs j ON j.id=m.job_id
-         WHERE m.job_id=$1 AND m.seq=$2 AND m.status='pending-verification'
-           AND m.created_at_ms IS NOT NULL
-           AND ($3::bigint IS NULL OR m.created_at_ms <= $3) AND j.dvm_id=$4
-           AND ($6::text IS NULL OR m.data->'content'->'tempo_credential'->'challenge'->>'id'=$6)
-           AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
-             WHERE a.dvm_id=$4 AND a.scope=$5 AND a.job_id=m.job_id AND a.outcome <> 'failed')`,
-        [
-          intent.jobId,
-          intent.paymentSeq,
-          control.closed_at_ms,
-          this.dvmId,
-          this.scope,
-          intent.challengeId ?? null
-        ]
-      );
-      if (payment.rows[0]) return;
-      throw new Error("Hosted payment has no pre-closure inbound intent");
-    }
-    if (!intent?.admissionId && !intent?.jobId && !(intent?.creditId && intent.fundId && intent.callerPubkey) || !intent?.jobId && !(intent?.creditId && intent.fundId)) {
-      throw new Error("Hosted obligations are closed to new intents");
-    }
-    const accepted = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE ($1::text IS NULL OR id=$1) AND dvm_id=$2 AND scope=$3
-         AND ($4::bigint IS NULL OR admitted_at_ms <= $4)
-         AND (outcome IN ('pending', 'unresolved') OR ($11::boolean AND outcome='accepted'))
-         AND ($5::text IS NULL OR job_id=$5)
-         AND ($6::text IS NULL OR credit_id=$6)
-         AND ($7::text IS NULL OR fund_id=$7)
-         AND ($8::text IS NULL OR caller_pubkey=$8)
-         AND ($9::text IS NULL OR funding_commitment=$9)
-         AND ($10::text IS NULL OR payment_artifact_hash=$10)`,
-      [
-        intent.admissionId ?? null,
-        this.dvmId,
-        this.scope,
-        control.closed_at_ms,
-        intent.jobId ?? null,
-        intent.creditId ?? null,
-        intent.fundId ?? null,
-        intent.callerPubkey ?? null,
-        intent.fundingCommitment ?? null,
-        intent.paymentArtifactHash ?? null,
-        control.state !== "closed"
-      ]
-    );
-    if (!accepted.rows[0]) throw new Error("Hosted obligation has no pre-closure admission");
-  }
-  async withNewIntent(intent, operation) {
-    return this.withNewIntentOn(this.pool, intent, operation);
-  }
-  async assertFundingReservation(tx, reservation) {
-    await this.assertNewIntent(tx, {
-      admissionId: reservation.admissionId,
-      creditId: reservation.creditId,
-      fundId: reservation.fundId,
-      callerPubkey: reservation.callerPubkey,
-      fundingCommitment: reservation.commitment,
-      paymentArtifactHash: reservation.paymentArtifactHash
-    });
-    const verified = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND credit_id=$4 AND fund_id=$5
-         AND caller_pubkey=$6 AND funding_commitment=$7 AND payment_artifact_hash=$8
-         AND outcome IN ('pending','accepted','unresolved')`,
-      [
-        reservation.admissionId,
-        this.dvmId,
-        this.scope,
-        reservation.creditId,
-        reservation.fundId,
-        reservation.callerPubkey,
-        reservation.commitment,
-        reservation.paymentArtifactHash
-      ]
-    );
-    if (!verified.rows[0]) throw new Error("Hosted funding has no authentic admission");
-  }
-  async fundingAdmission(tx, creditId, fundId, callerPubkey) {
-    await this.assertNewIntent(tx, { creditId, fundId, callerPubkey });
-    const { rows: rows2 } = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE dvm_id=$1 AND scope=$2 AND credit_id=$3 AND fund_id=$4
-         AND caller_pubkey=$5 AND outcome IN ('pending','unresolved')
-       ORDER BY admitted_at_ms,id LIMIT 2`,
-      [this.dvmId, this.scope, creditId, fundId, callerPubkey]
-    );
-    if (rows2.length !== 1) throw new Error("Hosted invoice funding admission is missing or ambiguous");
-    return rows2[0].id;
-  }
-  async withNewIntentOn(db, intent, operation) {
-    const tx = await db.connect();
-    try {
-      await tx.query("BEGIN");
-      await this.assertNewIntent(tx, intent);
-      const result = await operation(tx);
-      await tx.query("COMMIT");
-      return result;
-    } catch (error) {
-      await tx.query("ROLLBACK").catch(() => void 0);
-      throw error;
-    } finally {
-      tx.release();
-    }
-  }
-};
-
 // src/sdk/server/hosting-settlement-report-obligations.ts
 import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
@@ -9762,6 +9682,16 @@ import { createPublicClient as createPublicClient4, decodeEventLog, decodeFuncti
 var HOSTED_SETTLEMENT_UNRESOLVED_SQL = `state NOT IN ('delivered','no_report')
   OR (rail='x402' AND operation IN ('claim','refund')
       AND COALESCE(original->>'authorizationCallData','') !~* '^0x([0-9a-f]{2})+$')`;
+var TEMPO_CLOSE_RETRYABLE_SQL = `target.rail='tempo' AND target.operation='close'
+  AND target.state IN ('unmatched','no_report') AND target.tx_hash IS NULL
+  AND NOT EXISTS (
+    SELECT 1 FROM sdk_hosted_settlement_report_obligations other
+    WHERE other.dvm_id=target.dvm_id AND other.scope=target.scope
+      AND other.rail='tempo' AND other.operation='close' AND other.channel_id=target.channel_id
+      AND other.id<>target.id AND (other.state<>'no_report' OR other.tx_hash IS NOT NULL)
+  )`;
+var TEMPO_CLOSE_WRITE_OFF_ALLOWED_SQL = `target.rail='tempo' AND target.operation='close'
+  AND target.state='unmatched' AND target.tx_hash IS NULL`;
 var X402_SETTLED_EVENT = parseAbiItem2(
   "event Settled(address indexed receiver,address indexed token,address indexed sender,uint128 amount)"
 );
@@ -9975,14 +9905,13 @@ var HostedSettlementReportObligations = class {
           operation TEXT NOT NULL CHECK (operation IN ('claim','refund','settle','close')),
           network TEXT NOT NULL, contract TEXT NOT NULL, channel_id TEXT NOT NULL,
           original JSONB NOT NULL,
-          state TEXT NOT NULL CHECK (state IN ('reserved','observed','report_queued','delivered','no_report')),
+          state TEXT NOT NULL CHECK (state IN ('reserved','observed','report_queued','delivered','no_report','exhausted','unmatched')),
+          close_search_before BIGINT, close_write_off_note TEXT, close_written_off_at_ms BIGINT,
           tx_hash TEXT, block_number BIGINT, block_hash TEXT, delta_native NUMERIC(78,0),
           payout_id TEXT, report_id TEXT, report_payload JSONB, delivered_at_ms BIGINT,
           created_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
           updated_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
         );
-        ALTER TABLE sdk_hosted_settlement_report_obligations
-          ADD COLUMN IF NOT EXISTS close_search_before BIGINT;
         CREATE INDEX IF NOT EXISTS sdk_hosted_settlement_report_pending
           ON sdk_hosted_settlement_report_obligations (dvm_id,scope,state)
           WHERE state NOT IN ('delivered','no_report');
@@ -9990,6 +9919,29 @@ var HostedSettlementReportObligations = class {
           ON sdk_hosted_settlement_report_obligations (report_id)
           WHERE report_id IS NOT NULL;
       `);
+      const columns = await this.pool.query(
+        `SELECT attname FROM pg_attribute
+         WHERE attrelid='sdk_hosted_settlement_report_obligations'::regclass AND NOT attisdropped`
+      );
+      for (const [name, type] of [["close_search_before", "BIGINT"], ["close_write_off_note", "TEXT"], ["close_written_off_at_ms", "BIGINT"]]) {
+        if (!columns.rows.some((column) => column.attname === name)) {
+          await this.pool.query(`ALTER TABLE sdk_hosted_settlement_report_obligations ADD COLUMN ${name} ${type}`);
+        }
+      }
+      const constraint = await this.pool.query(
+        `SELECT pg_get_constraintdef(oid) AS definition FROM pg_constraint
+         WHERE conrelid='sdk_hosted_settlement_report_obligations'::regclass
+           AND conname='sdk_hosted_settlement_report_obligations_state_check'`
+      );
+      const states = ["reserved", "observed", "report_queued", "delivered", "no_report", "exhausted", "unmatched"];
+      const expected = `CHECK ((state = ANY (ARRAY[${states.map((state) => `'${state}'::text`).join(", ")}])))`;
+      if (constraint.rows[0]?.definition !== expected) {
+        await this.pool.query(`ALTER TABLE sdk_hosted_settlement_report_obligations
+          DROP CONSTRAINT IF EXISTS sdk_hosted_settlement_report_obligations_state_check;
+          ALTER TABLE sdk_hosted_settlement_report_obligations
+          ADD CONSTRAINT sdk_hosted_settlement_report_obligations_state_check
+          CHECK (state IN ('reserved','observed','report_queued','delivered','no_report','exhausted','unmatched'))`);
+      }
       await this.pool.query(
         `INSERT INTO sdk_hosted_settlement_report_history (singleton,complete)
          VALUES (TRUE,$1) ON CONFLICT (singleton) DO NOTHING`,
@@ -10093,9 +10045,9 @@ var HostedSettlementReportObligations = class {
   }
   /**
    * Retire a close reservation that never recorded a transaction and reserve
-   * the drain's next attempt, in one transaction, so the drain always keeps one
-   * outstanding close obligation. A close from the retired attempt that lands
-   * late is a close of the same channel: `recordSubmitted` on the retired row
+   * the drain's next attempt in one transaction. At the retry cap the final
+   * row becomes terminal `exhausted` and remains claimable by a late landing.
+   * A close from the retired attempt that lands late is the same channel's close: `recordSubmitted` on the retired row
    * writes it onto the successor, and recovery attaches it there if that
    * attempt never got to write, so it is reported once.
    *
@@ -10122,7 +10074,15 @@ var HostedSettlementReportObligations = class {
            AND original->>'drainId'=$4 AND state='no_report' AND tx_hash IS NULL`,
         [this.dvmId, this.scope, channelId.toLowerCase(), drainId]
       )).rows[0].n);
-      if (released >= limits.maxReleases) return { outcome: "exhausted", releases: released };
+      if (released >= limits.maxReleases) {
+        await tx.query(
+          `UPDATE sdk_hosted_settlement_report_obligations SET state='exhausted',
+             updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
+          [id]
+        );
+        await limits.onExhausted?.(tx);
+        return { outcome: "exhausted", releases: released };
+      }
       await tx.query(
         `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report',
            updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
@@ -10141,11 +10101,126 @@ var HostedSettlementReportObligations = class {
       `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report',
          updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
        WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
-         AND state='reserved' AND tx_hash IS NULL`,
+         AND state IN ('reserved','exhausted') AND tx_hash IS NULL`,
+      [id, this.dvmId, this.scope]
+    );
+    return result.rowCount === 1;
+  }
+  async tempoCloseAmountAtStake(id) {
+    const row = await this.lockRow(this.pool, id);
+    if (row.rail !== "tempo" || row.operation !== "close") throw new Error("Not a Tempo close obligation");
+    return (BigInt(String(row.original.highestVoucherAmount)) - BigInt(String(row.original.settledOnChain))).toString();
+  }
+  /** Stop automatic searches without declaring a possibly missing payout discharged. */
+  async markTempoCloseUnmatched(id) {
+    const result = await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations SET state='unmatched',
+         updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+         AND state IN ('reserved','exhausted') AND tx_hash IS NULL`,
+      [id, this.dvmId, this.scope]
+    );
+    return result.rowCount === 1;
+  }
+  async listTempoCloseReports(args) {
+    const result = await this.pool.query(
+      `WITH candidates AS (
+         SELECT target.*, (${TEMPO_CLOSE_RETRYABLE_SQL}) AS retryable,
+           (${TEMPO_CLOSE_WRITE_OFF_ALLOWED_SQL}) AS write_off_allowed
+         FROM sdk_hosted_settlement_report_obligations target
+         WHERE target.dvm_id=$1 AND target.scope=$2 AND target.rail='tempo' AND target.operation='close'
+           AND target.state IN ('unmatched','no_report')
+       )
+       SELECT * FROM candidates
+       WHERE ($6::boolean OR (state='unmatched' AND (retryable OR write_off_allowed)))
+         AND ($4::bigint IS NULL OR (created_at_ms,id)>($4,$5))
+       ORDER BY created_at_ms,id LIMIT $3`,
+      [
+        this.dvmId,
+        this.scope,
+        args.limit,
+        args.after?.createdAtMs ?? null,
+        args.after?.obligationId ?? null,
+        args.all ?? false
+      ]
+    );
+    return result.rows.map((row) => ({
+      id: row.id,
+      channelId: row.channel_id,
+      amountNative: tempoCloseAmount(row.original),
+      status: row.state,
+      createdAtMs: Number(row.created_at_ms),
+      updatedAtMs: Number(row.updated_at_ms),
+      deliveredAtMs: row.delivered_at_ms === null ? null : Number(row.delivered_at_ms),
+      retryable: row.retryable,
+      writeOffAllowed: row.write_off_allowed,
+      writtenOff: row.close_write_off_note !== null,
+      writeOffNote: row.close_write_off_note,
+      writtenOffAtMs: row.close_written_off_at_ms === null ? null : Number(row.close_written_off_at_ms)
+    }));
+  }
+  async hasTempoCloseReport(id) {
+    const result = await this.pool.query(
+      `SELECT id FROM sdk_hosted_settlement_report_obligations
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'`,
       [id, this.dvmId, this.scope]
     );
     return result.rowCount === 1;
   }
+  async writeOffTempoClose(id, note) {
+    const result = await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations target
+       SET state='no_report', close_write_off_note=$4,
+         close_written_off_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
+         updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND ${TEMPO_CLOSE_WRITE_OFF_ALLOWED_SQL}
+       RETURNING channel_id,original`,
+      [id, this.dvmId, this.scope, note]
+    );
+    const row = result.rows[0];
+    if (!row) return void 0;
+    const written = { channelId: row.channel_id, amount: tempoCloseAmount(row.original) };
+    loggers.tempo.warn("tempo_session_close_report_written_off", {
+      channel_id: written.channelId,
+      obligation_id: id,
+      amount_forgone_native: written.amount
+    });
+    return written;
+  }
+  async reopenTempoClose(id) {
+    const reopened = await transaction(this.pool, async (tx) => {
+      const owned = await tx.query(
+        "SELECT id FROM sdk_hosted_settlement_report_obligations WHERE id=$1 AND dvm_id=$2 AND scope=$3",
+        [id, this.dvmId, this.scope]
+      );
+      if (!owned.rowCount) return void 0;
+      await this.lockIdentity(tx);
+      const prior = await tx.query(
+        `SELECT channel_id,state,close_write_off_note,original FROM sdk_hosted_settlement_report_obligations
+         WHERE id=$1 AND dvm_id=$2 AND scope=$3 FOR UPDATE`,
+        [id, this.dvmId, this.scope]
+      );
+      const row = prior.rows[0];
+      if (!row) return void 0;
+      const result = await tx.query(
+        `UPDATE sdk_hosted_settlement_report_obligations target
+         SET state='reserved', close_search_before=NULL,
+           updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+         WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND ${TEMPO_CLOSE_RETRYABLE_SQL}`,
+        [id, this.dvmId, this.scope]
+      );
+      return result.rowCount === 1 ? row : void 0;
+    });
+    if (!reopened) return false;
+    loggers.tempo.info("tempo_session_close_report_reopened", {
+      obligation_id: id,
+      channel_id: reopened.channel_id,
+      prior_status: reopened.state,
+      written_off: reopened.close_write_off_note !== null,
+      amount_native: tempoCloseAmount(reopened.original)
+    });
+    return true;
+  }
   async reserveTempoIn(tx, channelId, operation, drainId) {
     const config = this.tempo;
     if (!config || !hex(channelId, 32)) throw new Error("Hosted Tempo settlement configuration is unavailable");
@@ -10204,7 +10279,7 @@ var HostedSettlementReportObligations = class {
   /** The original close obligation reserved for this drain, while its report is outstanding. */
   async pendingTempoClose(channelId, drainId) {
     const result = await this.pool.query(
-      `SELECT id,tx_hash,created_at_ms,close_search_before FROM sdk_hosted_settlement_report_obligations
+      `SELECT id,state,tx_hash,created_at_ms,close_search_before FROM sdk_hosted_settlement_report_obligations
        WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
          AND original->>'drainId'=$4 AND state NOT IN ('delivered','no_report')
        ORDER BY created_at_ms DESC LIMIT 1`,
@@ -10213,11 +10288,23 @@ var HostedSettlementReportObligations = class {
     const row = result.rows[0];
     return row && {
       id: row.id,
+      state: row.state,
       txHash: row.tx_hash,
       reservedAtMs: Number(row.created_at_ms),
       searchBefore: searchCursor(row.close_search_before)
     };
   }
+  /** A recorded close transaction remains refund evidence after its report is delivered. */
+  async tempoCloseTransaction(channelId, drainId) {
+    const result = await this.pool.query(
+      `SELECT tx_hash FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
+         AND original->>'drainId'=$4 AND tx_hash IS NOT NULL
+       ORDER BY created_at_ms DESC LIMIT 1`,
+      [this.dvmId, this.scope, channelId.toLowerCase(), drainId]
+    );
+    return result.rows[0]?.tx_hash;
+  }
   /**
    * Where the next search for this close obligation's transaction resumes. It
    * lives on the obligation, not the drain's close intent, because releasing
@@ -10346,6 +10433,7 @@ var HostedSettlementReportObligations = class {
       }
       await tx.query(
         `UPDATE sdk_hosted_settlement_report_obligations SET tx_hash=COALESCE(tx_hash,$2),
+           state=CASE WHEN state IN ('exhausted','unmatched') THEN 'reserved' ELSE state END,
            updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
         [row.id, txHash.toLowerCase()]
       );
@@ -10353,15 +10441,15 @@ var HostedSettlementReportObligations = class {
   }
   /**
    * Close reservations that never recorded a transaction, oldest first. Each
-   * one owes a payout report only if its close lands, so it stays unresolved
-   * until a reconcile reads how its channel finalized.
+   * one owes a payout report if its close lands. Exhausted attempts remain
+   * observable for late landings; unmatched searches require an explicit retry.
    */
   async unsubmittedTempoCloses(limit = 100) {
     const result = await this.pool.query(
       `SELECT id,channel_id,original->>'drainId' AS drain_id,created_at_ms,close_search_before
          FROM sdk_hosted_settlement_report_obligations
         WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close'
-          AND state='reserved' AND tx_hash IS NULL
+          AND state IN ('reserved','exhausted') AND tx_hash IS NULL
         ORDER BY created_at_ms,id LIMIT $3`,
       [this.dvmId, this.scope, limit]
     );
@@ -10859,10 +10947,190 @@ var HostedSettlementReportObligations = class {
     return { id: row.id, replayed: true };
   }
 };
+async function retryHostedTempoCloseReport(args) {
+  const obligations = new HostedSettlementReportObligations(args.db, args.dvmId, args.scope);
+  return obligations.reopenTempoClose(args.obligationId);
+}
+async function writeOffHostedTempoCloseReport(args) {
+  const note = args.note.trim();
+  if (!note || note.length > 2e3) throw new Error("A write-off requires a note of 1 to 2000 characters");
+  const row = await new HostedSettlementReportObligations(args.db, args.dvmId, args.scope).writeOffTempoClose(args.obligationId, note);
+  if (!row) return false;
+  return args.includeDetails ? { channelId: row.channelId, amountForgoneNative: row.amount } : true;
+}
+function tempoCloseAmount(original) {
+  return (BigInt(String(original.highestVoucherAmount)) - BigInt(String(original.settledOnChain))).toString();
+}
 function searchCursor(value) {
   return value === null ? null : BigInt(value);
 }
 
+// src/sdk/server/hosting-control.ts
+import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
+
+// src/sdk/server/hosting-cleanup-fence.ts
+var HostingCleanupFence = class {
+  constructor(pool, dvmId, scope) {
+    this.pool = pool;
+    this.dvmId = dvmId;
+    this.scope = scope;
+  }
+  pool;
+  dvmId;
+  scope;
+  async assertNewIntent(tx, intent) {
+    const continuation = intent?.admissionId || intent?.paymentSeq !== void 0 || intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash || intent?.creditId && intent.fundId && intent.callerPubkey;
+    const { rows: rows2 } = await tx.query(
+      `SELECT state, closed_at_ms, closed_at_us FROM sdk_hosting_control
+       WHERE dvm_id=$1 AND scope=$2 ${continuation ? "" : "FOR UPDATE"}`,
+      [this.dvmId, this.scope]
+    );
+    const control = rows2[0];
+    if (!control) throw new Error("Hosted obligation fence is unavailable");
+    if (control.state === "closed" && (control.closed_at_ms === null || control.closed_at_us === null)) {
+      throw new Error("Hosted closure cutoff is unavailable");
+    }
+    if (control.state !== "closed" && !continuation) return;
+    if (intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash) {
+      const repair = !!intent.invoiceRepairPaymentHash;
+      const invoice = await tx.query(
+        `SELECT i.payment_hash FROM credit_invoices i
+         LEFT JOIN sdk_hosting_admissions a ON a.id=i.hosting_admission_id
+         WHERE i.payment_hash=$1 AND i.caller_pubkey=$4 AND i.amount_micro=$5
+           AND (($10::boolean AND $3=i.payment_hash AND i.status IN ('blocked','written_off'))
+             OR (NOT $10::boolean AND i.credit_id=$2 AND i.fund_id=$3 AND i.status='pending'))
+           AND ((i.hosting_admission_id IS NULL AND
+                 ($9::bigint IS NULL OR i.created_at_db_us <= $9)) OR
+             (a.dvm_id=$6 AND a.scope=$7 AND a.credit_id=i.credit_id
+              AND a.fund_id=i.fund_id AND a.caller_pubkey=i.caller_pubkey
+              AND a.outcome IN ('pending','accepted','unresolved')
+              AND ($8::bigint IS NULL OR a.admitted_at_ms <= $8)))`,
+        [
+          intent.invoicePaymentHash ?? intent.invoiceRepairPaymentHash,
+          intent.creditId,
+          intent.fundId,
+          intent.callerPubkey,
+          intent.amountMicro,
+          this.dvmId,
+          this.scope,
+          control.closed_at_ms,
+          control.closed_at_us,
+          repair
+        ]
+      );
+      if (invoice.rows[0]) return;
+      throw new Error("Hosted invoice has no original payable admission");
+    }
+    if (intent?.paymentSeq !== void 0 && intent.jobId) {
+      const payment = await tx.query(
+        `SELECT m.job_id FROM job_messages m JOIN jobs j ON j.id=m.job_id
+         WHERE m.job_id=$1 AND m.seq=$2 AND m.status='pending-verification'
+           AND m.created_at_ms IS NOT NULL
+           AND ($3::bigint IS NULL OR m.created_at_ms <= $3) AND j.dvm_id=$4
+           AND ($6::text IS NULL OR m.data->'content'->'tempo_credential'->'challenge'->>'id'=$6)
+           AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
+             WHERE a.dvm_id=$4 AND a.scope=$5 AND a.job_id=m.job_id AND a.outcome <> 'failed')`,
+        [
+          intent.jobId,
+          intent.paymentSeq,
+          control.closed_at_ms,
+          this.dvmId,
+          this.scope,
+          intent.challengeId ?? null
+        ]
+      );
+      if (payment.rows[0]) return;
+      throw new Error("Hosted payment has no pre-closure inbound intent");
+    }
+    if (!intent?.admissionId && !intent?.jobId && !(intent?.creditId && intent.fundId && intent.callerPubkey) || !intent?.jobId && !(intent?.creditId && intent.fundId)) {
+      throw new Error("Hosted obligations are closed to new intents");
+    }
+    const accepted = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE ($1::text IS NULL OR id=$1) AND dvm_id=$2 AND scope=$3
+         AND ($4::bigint IS NULL OR admitted_at_ms <= $4)
+         AND (outcome IN ('pending', 'unresolved') OR ($11::boolean AND outcome='accepted'))
+         AND ($5::text IS NULL OR job_id=$5)
+         AND ($6::text IS NULL OR credit_id=$6)
+         AND ($7::text IS NULL OR fund_id=$7)
+         AND ($8::text IS NULL OR caller_pubkey=$8)
+         AND ($9::text IS NULL OR funding_commitment=$9)
+         AND ($10::text IS NULL OR payment_artifact_hash=$10)`,
+      [
+        intent.admissionId ?? null,
+        this.dvmId,
+        this.scope,
+        control.closed_at_ms,
+        intent.jobId ?? null,
+        intent.creditId ?? null,
+        intent.fundId ?? null,
+        intent.callerPubkey ?? null,
+        intent.fundingCommitment ?? null,
+        intent.paymentArtifactHash ?? null,
+        control.state !== "closed"
+      ]
+    );
+    if (!accepted.rows[0]) throw new Error("Hosted obligation has no pre-closure admission");
+  }
+  async withNewIntent(intent, operation) {
+    return this.withNewIntentOn(this.pool, intent, operation);
+  }
+  async assertFundingReservation(tx, reservation) {
+    await this.assertNewIntent(tx, {
+      admissionId: reservation.admissionId,
+      creditId: reservation.creditId,
+      fundId: reservation.fundId,
+      callerPubkey: reservation.callerPubkey,
+      fundingCommitment: reservation.commitment,
+      paymentArtifactHash: reservation.paymentArtifactHash
+    });
+    const verified = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND credit_id=$4 AND fund_id=$5
+         AND caller_pubkey=$6 AND funding_commitment=$7 AND payment_artifact_hash=$8
+         AND outcome IN ('pending','accepted','unresolved')`,
+      [
+        reservation.admissionId,
+        this.dvmId,
+        this.scope,
+        reservation.creditId,
+        reservation.fundId,
+        reservation.callerPubkey,
+        reservation.commitment,
+        reservation.paymentArtifactHash
+      ]
+    );
+    if (!verified.rows[0]) throw new Error("Hosted funding has no authentic admission");
+  }
+  async fundingAdmission(tx, creditId, fundId, callerPubkey) {
+    await this.assertNewIntent(tx, { creditId, fundId, callerPubkey });
+    const { rows: rows2 } = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND credit_id=$3 AND fund_id=$4
+         AND caller_pubkey=$5 AND outcome IN ('pending','unresolved')
+       ORDER BY admitted_at_ms,id LIMIT 2`,
+      [this.dvmId, this.scope, creditId, fundId, callerPubkey]
+    );
+    if (rows2.length !== 1) throw new Error("Hosted invoice funding admission is missing or ambiguous");
+    return rows2[0].id;
+  }
+  async withNewIntentOn(db, intent, operation) {
+    const tx = await db.connect();
+    try {
+      await tx.query("BEGIN");
+      await this.assertNewIntent(tx, intent);
+      const result = await operation(tx);
+      await tx.query("COMMIT");
+      return result;
+    } catch (error) {
+      await tx.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      tx.release();
+    }
+  }
+};
+
 // src/sdk/server/hosting-channel-evidence.ts
 import { createHash as createHash7 } from "crypto";
 import { Session as TempoSession2 } from "mppx/tempo";
@@ -12024,7 +12292,7 @@ function jobCredentialGate(opts) {
         // to a human verbatim, so the conditional advice lives in `hint`, which
         // is what the agent acts on.
         display: "Couldn't retrieve your result \u2014 the request was missing its job credential.",
-        hint: `Send the job_token from the POST /v1/job response as the X-Job-Token header${alternative}. The token is minted once, at submit, and the DVM cannot reissue it \u2014 a job submitted from another machine, or by a caller that never stored it, can't be read here. If your caller never sends X-Job-Token at all, upgrade: npm i -g @dvmkit/dvm-cli@0.2.0, then retry the same command with --endpoint <url> --job-token <hex> (or set DVM_JOB_ENDPOINT and DVM_JOB_TOKEN).`
+        hint: `Send the job_token from the POST /v1/job response as the X-Job-Token header${alternative}. The token is minted once, at submit, and the DVM cannot reissue it \u2014 a job submitted from another machine, or by a caller that never stored it, can't be read here. If your caller never sends X-Job-Token at all, upgrade: npm i -g @dvmkit/dvm-cli@latest, then retry the same command with --endpoint <url> --job-token <hex> (or set DVM_JOB_ENDPOINT and DVM_JOB_TOKEN).`
       };
     }
   };
@@ -16883,6 +17151,9 @@ function installAdminCreditRoutes(app, opts) {
     "/admin/credit/reconcile-x402-exact-settlement",
     (c) => handleReconcileX402Exact(c, opts)
   );
+  app.get("/admin/credit/tempo-close-reports", (c) => handleTempoCloseReports(c, opts));
+  app.post("/admin/credit/retry-tempo-close-report", (c) => handleTempoCloseReportAction(c, opts, "retry"));
+  app.post("/admin/credit/write-off-tempo-close-report", (c) => handleTempoCloseReportAction(c, opts, "write-off"));
   app.get("/admin/credit/tempo-drains", (c) => handleTempoDrains(c, opts));
   app.get("/admin/credit/tempo-losses", (c) => handleTempoLosses(c, opts));
   app.post("/admin/credit/reconcile-tempo-drain", (c) => handleReconcileTempo(c, opts));
@@ -17858,6 +18129,101 @@ async function handleWriteOffX402(c, opts) {
     replayed: !outcome.written
   });
 }
+function tempoCloseReportsUnavailable(c) {
+  return c.json({
+    error: "tempo_close_report_unavailable",
+    message: "Hosted settlement reports are not configured on this DVM."
+  }, 503);
+}
+async function handleTempoCloseReports(c, opts) {
+  const auth = await requireAuth(c, opts);
+  if ("response" in auth) return auth.response;
+  if (!opts.hostedSettlementReports) return tempoCloseReportsUnavailable(c);
+  const limit = parseTempoLimit(c.req.query("limit"));
+  if (limit === void 0) {
+    return c.json({ error: "invalid_query", message: "limit must be an integer in 1..50." }, 400);
+  }
+  let after;
+  const rawAfter = c.req.query("after");
+  if (rawAfter !== void 0) {
+    try {
+      const value = JSON.parse(Buffer.from(rawAfter, "base64url").toString("utf8"));
+      if (!Array.isArray(value) || value.length !== 2 || !Number.isSafeInteger(value[0]) || value[0] < 0 || typeof value[1] !== "string" || !value[1]) throw new Error("invalid cursor");
+      after = { createdAtMs: value[0], obligationId: value[1] };
+    } catch {
+      return c.json({ error: "invalid_query", message: "after must be a next_after value from a previous response." }, 400);
+    }
+  }
+  const all = c.req.query("all");
+  if (all !== void 0 && all !== "0" && all !== "1") {
+    return c.json({ error: "invalid_query", message: "all must be 0 or 1." }, 400);
+  }
+  const rows2 = await opts.hostedSettlementReports.store.listTempoCloseReports({ limit, after, all: all === "1" });
+  const last = rows2.length === limit ? rows2.at(-1) : void 0;
+  const response = {
+    reports: rows2.map((row) => ({
+      obligation_id: row.id,
+      channel_id: row.channelId,
+      amount_native: row.amountNative,
+      status: row.status,
+      created_at_ms: row.createdAtMs,
+      updated_at_ms: row.updatedAtMs,
+      delivered_at_ms: row.deliveredAtMs,
+      retryable: row.retryable,
+      write_off_allowed: row.writeOffAllowed,
+      written_off: row.writtenOff,
+      write_off_note: row.writeOffNote,
+      written_off_at_ms: row.writtenOffAtMs
+    })),
+    ...last ? { next_after: Buffer.from(JSON.stringify([last.createdAtMs, last.id])).toString("base64url") } : {}
+  };
+  return c.json(response);
+}
+async function handleTempoCloseReportAction(c, opts, action) {
+  const auth = await requireAuth(c, opts);
+  if ("response" in auth) return auth.response;
+  const reports = opts.hostedSettlementReports;
+  if (!reports) return tempoCloseReportsUnavailable(c);
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body.obligation_id !== "string" || !body.obligation_id.trim()) {
+    return c.json({ error: "invalid_request", message: "obligation_id must be a non-empty string." }, 400);
+  }
+  const obligationId = body.obligation_id.trim();
+  if (action === "retry") {
+    if (await reports.store.reopenTempoClose(obligationId)) {
+      const response = { status: "reserved", obligation_id: obligationId };
+      return c.json(response);
+    }
+  } else {
+    if (typeof body.note !== "string" || !body.note.trim() || body.note.trim().length > 2e3) {
+      return c.json({ error: "invalid_request", message: "note must contain 1 to 2000 characters after trimming." }, 400);
+    }
+    const note = body.note.trim();
+    const result = await reports.store.writeOffTempoClose(obligationId, note);
+    if (result) {
+      const response = {
+        status: "written_off",
+        obligation_id: obligationId,
+        channel_id: result.channelId,
+        amount_forgone_native: result.amount,
+        note
+      };
+      return c.json(response);
+    }
+  }
+  if (!await reports.store.hasTempoCloseReport(obligationId)) {
+    return c.json({
+      error: "tempo_close_report_not_found",
+      message: "Close-report obligation not found.",
+      obligation_id: obligationId
+    }, 404);
+  }
+  return c.json({
+    error: "tempo_close_report_conflict",
+    message: action === "retry" ? "Retry requires an unsubmitted unmatched or no_report close obligation without a competing report." : "Write-off requires an unsubmitted unmatched close obligation.",
+    obligation_id: obligationId
+  }, 409);
+}
 async function handleTempoDrains(c, opts) {
   const auth = await requireAuth(c, opts);
   if ("response" in auth) return auth.response;
@@ -18347,7 +18713,7 @@ async function requireWedgedTempoDrain(c, opts, args, admitBooked) {
       )
     };
   }
-  if (record.status !== "pending" && !(admitBooked && record.status === "sent")) {
+  if (record.status !== "pending" && !(admitBooked && (record.status === "sent" || record.status === "exit_required"))) {
     return { response: tempoNotWedgedRefusal(c, args, record.status) };
   }
   return { record, channelId: record.channelId };
@@ -19763,7 +20129,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-KDUZLD5F.js");
+      const { RevenueReporter } = await import("./revenue-reporter-EV3K5L6B.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -19773,7 +20139,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-NN6K2IVQ.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-HVJ6WUF3.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -20074,7 +20440,43 @@ var DVMServer = class {
       dvmId: this.receiptDvmId()
     }) : void 0;
     this.creditLedger = opts.creditLedger ?? new MemoryCreditLedger();
-    this.opts.mpp?.useTempoCreditLedger?.(this.creditLedger);
+    this.opts.mpp?.useTempoCreditLedger?.(this.creditLedger, async (drain, evidence) => {
+      const completed = await completeTempoChannelDrain({
+        deps: { ledger: this.creditLedger, drainReport: {
+          db: this.opts.db,
+          dvmId: this.opts.dvmId,
+          enqueueCreditDrain: this.opts.enqueueCreditDrain
+        } },
+        creditId: drain.creditId,
+        drainId: drain.drainId,
+        channelId: drain.channelId,
+        refundedNative: evidence.refundedNative,
+        debitedNative: drain.drainedNative,
+        reference: evidence.reference,
+        finalization: {
+          outcome: evidence.creditUnbacked ? `${evidence.outcome}_unbacked` : evidence.outcome,
+          creditUnbacked: evidence.creditUnbacked
+        }
+      });
+      if (!completed.replayed && this.receiptIssuer) {
+        const receipt = this.receiptIssuer.issueDrain({
+          creditId: drain.creditId,
+          drainId: drain.drainId,
+          event: "sent",
+          method: drain.method,
+          amountMicro: drain.amountMicro,
+          balanceAfterMicro: drain.balanceAfterMicro,
+          ledgerSeq: drain.ledgerSeq,
+          callerPubkey: drain.callerPubkey
+        });
+        await this.creditLedger.appendDrainReceipt({
+          creditId: drain.creditId,
+          drainId: drain.drainId,
+          receipt
+        });
+      }
+      return !completed.replayed;
+    });
     this.processedPayments = opts.processedPayments ?? new MemoryProcessedPaymentStore();
     this.jobManager = new JobManager(descriptor, {
       receiptIssuer: this.receiptIssuer,
@@ -20404,6 +20806,9 @@ var DVMServer = class {
         // DVM wired with an in-memory session store resolves to a rail with no
         // close-intent read and the verbs answer 503.
         tempoDrainRail: () => Promise.resolve(this.opts.mpp),
+        ...this.opts.hostedSettlementReports ? {
+          hostedSettlementReports: { store: this.opts.hostedSettlementReports }
+        } : {},
         // Health-filtered, and read per request rather than captured: the
         // servicer picking a mint to buy a refund at wants the list that
         // excludes a mint currently failing its probe.
@@ -23277,6 +23682,8 @@ export {
   X402ExactSettlementServer,
   X402ExactSettlementEvidenceMissingError,
   HostedSettlementReportObligations,
+  retryHostedTempoCloseReport,
+  writeOffHostedTempoCloseReport,
   signHostingControl,
   signHostingClosure,
   jobCredentialGate,