@dvmkit/sdk 0.9.0 → 0.10.1

package/dist/{chunk-73C4JN2E.js → chunk-SYBFMHXQ.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-XRLKGCAW.js";
 import {
   x402EarnedCeiling
-} from "./chunk-K2MSIKMM.js";
+} from "./chunk-FFXXGCVG.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -14,13 +14,13 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-GAZBBMAA.js";
+} from "./chunk-VTHYQCDB.js";
 import {
   MemoryCreditLedger
-} from "./chunk-ZBQKXAYK.js";
+} from "./chunk-YOSZIWC3.js";
 import {
   PostgresJobStore
-} from "./chunk-GODOH2AF.js";
+} from "./chunk-2OGBZPPJ.js";
 import {
   parseStoreValue
 } from "./chunk-YG7G4DPZ.js";
@@ -31,7 +31,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-4VV7WACY.js";
+} from "./chunk-2XQLL6N6.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -40,7 +40,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-TFDR2YP2.js";
+} from "./chunk-KFCEXCZM.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -80,7 +80,7 @@ import {
   signReceipt,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-LW7KZQHG.js";
+} from "./chunk-VUGEEMLT.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -108,7 +108,7 @@ import {
 } from "./chunk-UKD3R2KU.js";
 import {
   createConsoleLogger
-} from "./chunk-TRY7BJA4.js";
+} from "./chunk-3R7NQA3Z.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -125,7 +125,7 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-HC4I7LAV.js";
+} from "./chunk-W3VGCNG6.js";
 import {
   CreditLedger,
   CreditLedgerError,
@@ -141,13 +141,13 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-YYRY32NR.js";
+} from "./chunk-STJBBVNL.js";
 import {
   withSdkInitLock
 } from "./chunk-COYKJRMM.js";
 import {
   withPostgresRecoveryContext
-} from "./chunk-IBX2ORBV.js";
+} from "./chunk-MMGSYMIC.js";
 import {
   DvmError,
   x402NetworkByCaip2
@@ -162,17 +162,17 @@ import {
   installHostedTempoCloseGuard,
   isTempoInsufficientFundsError,
   resolveTempoNetwork
-} from "./chunk-LFVIZH2G.js";
+} from "./chunk-MU3IE434.js";
 import {
   loggers,
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-QSZW2I5Y.js";
+} from "./chunk-M3T5JYDJ.js";
 import {
   createDiagnosticCapabilityAuthority,
   diagnosticConsole
-} from "./chunk-OIP44KBB.js";
+} from "./chunk-QGNXYVBO.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -3884,7 +3884,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
+      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4193,7 +4193,18 @@ async function verifyUpfrontPaymentInScope(opts) {
           replayRealm,
           cred.challenge.id,
           CONSUMED_CREDENTIAL_TTL_MS / 1e3
-        ));
+        )).catch((error) => {
+          const transactionHash = tempoReceiptTransactionHash(tempoReceipt);
+          if (!transactionHash) throw error;
+          diagnosticConsole.error({
+            level: "error",
+            event: "tempo_replay_mark_failed",
+            phase: "upfront",
+            rail: "tempo",
+            transaction_hash: transactionHash,
+            ...paymentFailureFields(error)
+          });
+        });
       }
       if (ledgerCtx) {
         try {
@@ -4897,7 +4908,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
+      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5328,7 +5339,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
+      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -7572,13 +7583,8 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
     try {
       const state = await rail.mpp.getTempoSessionDrainState?.(expectedChannelId);
       if (state?.finalized || state?.deposit === 0n) {
-        const recovered2 = await rail.mpp.recoverTempoSessionClose?.(
-          expectedChannelId,
-          record.drainId
-        );
-        if (recovered2) {
-          return await markTempoDrainSent(deps, rail.mpp, record, expectedChannelId, recovered2);
-        }
+        const recovered2 = await recoverTempoDrain(deps, rail.mpp, record, expectedChannelId);
+        if (recovered2) return recovered2;
       }
       if (state && (state.closeRequestedAt !== 0n || isDefinitiveTempoCloseFailure(error))) {
         return await releaseTempoDrain(c, deps, record, expectedChannelId);
@@ -7666,10 +7672,38 @@ function tempoExitRequiredResponse(record) {
 function tempoCloseCredentialNeedsRefresh(error) {
   return error instanceof MppxErrors.InvalidChallengeError || error instanceof MppxErrors.PaymentExpiredError;
 }
+function tempoRefundUnprovenResponse(record) {
+  return jsonPaymentError("settlement_pending", 409, {
+    message: "The full Tempo refund could not be proven yet.",
+    display: "Your funds remain held and have not been lost. The DVM operator has been alerted.",
+    hint: `Keep drain ${record.drainId}; no replacement drain is needed.`,
+    extra: { drain_registered: true, drain_id: record.drainId }
+  });
+}
 async function recoverTempoDrain(deps, mpp, record, channelId) {
   try {
-    const reference = await mpp.recoverTempoSessionClose?.(channelId, record.drainId);
-    return reference ? await markTempoDrainSent(deps, mpp, record, channelId, reference) : null;
+    const result = await mpp.recoverTempoSessionClose?.(channelId, record.drainId, record.creditId);
+    const durable = await deps.ledger.getDrain({ creditId: record.creditId, drainId: record.drainId });
+    if (durable?.status === "sent") return durable;
+    if (result && typeof result === "object") {
+      return tempoRefundUnprovenResponse(durable ?? record);
+    }
+    if (!result) return null;
+    if (!/^0x[0-9a-fA-F]{64}$/.test(result)) {
+      loggers.tempo.warn("tempo_session_drain_refund_unproven", {
+        channel_id: channelId,
+        credit_id: record.creditId,
+        drain_id: record.drainId,
+        amount_at_stake_native: record.drainedNative?.toString() ?? null,
+        amount_at_stake_micro: record.amountMicro,
+        currency: record.currency,
+        reason: "close_evidence_missing",
+        error: "Recovery returned no proven refund"
+      });
+      return tempoRefundUnprovenResponse(durable ?? record);
+    }
+    if (durable?.status === "exit_required") return null;
+    return await markTempoDrainSent(deps, mpp, durable ?? record, channelId, result);
   } catch (error) {
     const refused = tempoFloorRefusal(error, record);
     if (refused) return refused;
@@ -7679,7 +7713,9 @@ async function recoverTempoDrain(deps, mpp, record, channelId) {
       error: error instanceof Error ? error.message : String(error)
     });
     return jsonPaymentError("payment_invalid", 402, {
-      message: "The Tempo session close is still being reconciled; retry this drain."
+      message: "The Tempo session close is still being reconciled; retry this drain.",
+      hint: `Retry this same drain ${record.drainId} after the service can read and persist the close evidence.`,
+      retryable: true
     });
   }
 }
@@ -9646,6 +9682,16 @@ import { createPublicClient as createPublicClient4, decodeEventLog, decodeFuncti
 var HOSTED_SETTLEMENT_UNRESOLVED_SQL = `state NOT IN ('delivered','no_report')
   OR (rail='x402' AND operation IN ('claim','refund')
       AND COALESCE(original->>'authorizationCallData','') !~* '^0x([0-9a-f]{2})+$')`;
+var TEMPO_CLOSE_RETRYABLE_SQL = `target.rail='tempo' AND target.operation='close'
+  AND target.state IN ('unmatched','no_report') AND target.tx_hash IS NULL
+  AND NOT EXISTS (
+    SELECT 1 FROM sdk_hosted_settlement_report_obligations other
+    WHERE other.dvm_id=target.dvm_id AND other.scope=target.scope
+      AND other.rail='tempo' AND other.operation='close' AND other.channel_id=target.channel_id
+      AND other.id<>target.id AND (other.state<>'no_report' OR other.tx_hash IS NOT NULL)
+  )`;
+var TEMPO_CLOSE_WRITE_OFF_ALLOWED_SQL = `target.rail='tempo' AND target.operation='close'
+  AND target.state='unmatched' AND target.tx_hash IS NULL`;
 var X402_SETTLED_EVENT = parseAbiItem2(
   "event Settled(address indexed receiver,address indexed token,address indexed sender,uint128 amount)"
 );
@@ -9860,7 +9906,7 @@ var HostedSettlementReportObligations = class {
           network TEXT NOT NULL, contract TEXT NOT NULL, channel_id TEXT NOT NULL,
           original JSONB NOT NULL,
           state TEXT NOT NULL CHECK (state IN ('reserved','observed','report_queued','delivered','no_report','exhausted','unmatched')),
-          close_search_before BIGINT, close_write_off_note TEXT,
+          close_search_before BIGINT, close_write_off_note TEXT, close_written_off_at_ms BIGINT,
           tx_hash TEXT, block_number BIGINT, block_hash TEXT, delta_native NUMERIC(78,0),
           payout_id TEXT, report_id TEXT, report_payload JSONB, delivered_at_ms BIGINT,
           created_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
@@ -9877,7 +9923,7 @@ var HostedSettlementReportObligations = class {
         `SELECT attname FROM pg_attribute
          WHERE attrelid='sdk_hosted_settlement_report_obligations'::regclass AND NOT attisdropped`
       );
-      for (const [name, type] of [["close_search_before", "BIGINT"], ["close_write_off_note", "TEXT"]]) {
+      for (const [name, type] of [["close_search_before", "BIGINT"], ["close_write_off_note", "TEXT"], ["close_written_off_at_ms", "BIGINT"]]) {
         if (!columns.rows.some((column) => column.attname === name)) {
           await this.pool.query(`ALTER TABLE sdk_hosted_settlement_report_obligations ADD COLUMN ${name} ${type}`);
         }
@@ -10076,41 +10122,104 @@ var HostedSettlementReportObligations = class {
     );
     return result.rowCount === 1;
   }
+  async listTempoCloseReports(args) {
+    const result = await this.pool.query(
+      `WITH candidates AS (
+         SELECT target.*, (${TEMPO_CLOSE_RETRYABLE_SQL}) AS retryable,
+           (${TEMPO_CLOSE_WRITE_OFF_ALLOWED_SQL}) AS write_off_allowed
+         FROM sdk_hosted_settlement_report_obligations target
+         WHERE target.dvm_id=$1 AND target.scope=$2 AND target.rail='tempo' AND target.operation='close'
+           AND target.state IN ('unmatched','no_report')
+       )
+       SELECT * FROM candidates
+       WHERE ($6::boolean OR (state='unmatched' AND (retryable OR write_off_allowed)))
+         AND ($4::bigint IS NULL OR (created_at_ms,id)>($4,$5))
+       ORDER BY created_at_ms,id LIMIT $3`,
+      [
+        this.dvmId,
+        this.scope,
+        args.limit,
+        args.after?.createdAtMs ?? null,
+        args.after?.obligationId ?? null,
+        args.all ?? false
+      ]
+    );
+    return result.rows.map((row) => ({
+      id: row.id,
+      channelId: row.channel_id,
+      amountNative: tempoCloseAmount(row.original),
+      status: row.state,
+      createdAtMs: Number(row.created_at_ms),
+      updatedAtMs: Number(row.updated_at_ms),
+      deliveredAtMs: row.delivered_at_ms === null ? null : Number(row.delivered_at_ms),
+      retryable: row.retryable,
+      writeOffAllowed: row.write_off_allowed,
+      writtenOff: row.close_write_off_note !== null,
+      writeOffNote: row.close_write_off_note,
+      writtenOffAtMs: row.close_written_off_at_ms === null ? null : Number(row.close_written_off_at_ms)
+    }));
+  }
+  async hasTempoCloseReport(id) {
+    const result = await this.pool.query(
+      `SELECT id FROM sdk_hosted_settlement_report_obligations
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'`,
+      [id, this.dvmId, this.scope]
+    );
+    return result.rowCount === 1;
+  }
   async writeOffTempoClose(id, note) {
     const result = await this.pool.query(
-      `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report', close_write_off_note=$4,
+      `UPDATE sdk_hosted_settlement_report_obligations target
+       SET state='no_report', close_write_off_note=$4,
+         close_written_off_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
          updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
-       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
-         AND state='unmatched' AND tx_hash IS NULL RETURNING channel_id,original`,
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND ${TEMPO_CLOSE_WRITE_OFF_ALLOWED_SQL}
+       RETURNING channel_id,original`,
       [id, this.dvmId, this.scope, note]
     );
     const row = result.rows[0];
-    return row && { channelId: row.channel_id, amount: (BigInt(String(row.original.highestVoucherAmount)) - BigInt(String(row.original.settledOnChain))).toString() };
+    if (!row) return void 0;
+    const written = { channelId: row.channel_id, amount: tempoCloseAmount(row.original) };
+    loggers.tempo.warn("tempo_session_close_report_written_off", {
+      channel_id: written.channelId,
+      obligation_id: id,
+      amount_forgone_native: written.amount
+    });
+    return written;
   }
   async reopenTempoClose(id) {
-    return transaction(this.pool, async (tx) => {
+    const reopened = await transaction(this.pool, async (tx) => {
       const owned = await tx.query(
         "SELECT id FROM sdk_hosted_settlement_report_obligations WHERE id=$1 AND dvm_id=$2 AND scope=$3",
         [id, this.dvmId, this.scope]
       );
-      if (!owned.rowCount) return false;
+      if (!owned.rowCount) return void 0;
       await this.lockIdentity(tx);
+      const prior = await tx.query(
+        `SELECT channel_id,state,close_write_off_note,original FROM sdk_hosted_settlement_report_obligations
+         WHERE id=$1 AND dvm_id=$2 AND scope=$3 FOR UPDATE`,
+        [id, this.dvmId, this.scope]
+      );
+      const row = prior.rows[0];
+      if (!row) return void 0;
       const result = await tx.query(
         `UPDATE sdk_hosted_settlement_report_obligations target
          SET state='reserved', close_search_before=NULL,
            updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
-         WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
-           AND state IN ('unmatched','no_report') AND tx_hash IS NULL
-           AND NOT EXISTS (
-             SELECT 1 FROM sdk_hosted_settlement_report_obligations other
-             WHERE other.dvm_id=target.dvm_id AND other.scope=target.scope
-               AND other.rail='tempo' AND other.operation='close' AND other.channel_id=target.channel_id
-               AND other.id<>target.id AND (other.state<>'no_report' OR other.tx_hash IS NOT NULL)
-           )`,
+         WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND ${TEMPO_CLOSE_RETRYABLE_SQL}`,
         [id, this.dvmId, this.scope]
       );
-      return result.rowCount === 1;
+      return result.rowCount === 1 ? row : void 0;
     });
+    if (!reopened) return false;
+    loggers.tempo.info("tempo_session_close_report_reopened", {
+      obligation_id: id,
+      channel_id: reopened.channel_id,
+      prior_status: reopened.state,
+      written_off: reopened.close_write_off_note !== null,
+      amount_native: tempoCloseAmount(reopened.original)
+    });
+    return true;
   }
   async reserveTempoIn(tx, channelId, operation, drainId) {
     const config = this.tempo;
@@ -10185,6 +10294,17 @@ var HostedSettlementReportObligations = class {
       searchBefore: searchCursor(row.close_search_before)
     };
   }
+  /** A recorded close transaction remains refund evidence after its report is delivered. */
+  async tempoCloseTransaction(channelId, drainId) {
+    const result = await this.pool.query(
+      `SELECT tx_hash FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
+         AND original->>'drainId'=$4 AND tx_hash IS NOT NULL
+       ORDER BY created_at_ms DESC LIMIT 1`,
+      [this.dvmId, this.scope, channelId.toLowerCase(), drainId]
+    );
+    return result.rows[0]?.tx_hash;
+  }
   /**
    * Where the next search for this close obligation's transaction resumes. It
    * lives on the obligation, not the drain's close intent, because releasing
@@ -10836,12 +10956,10 @@ async function writeOffHostedTempoCloseReport(args) {
   if (!note || note.length > 2e3) throw new Error("A write-off requires a note of 1 to 2000 characters");
   const row = await new HostedSettlementReportObligations(args.db, args.dvmId, args.scope).writeOffTempoClose(args.obligationId, note);
   if (!row) return false;
-  loggers.tempo.warn("tempo_session_close_report_written_off", {
-    channel_id: row.channelId,
-    obligation_id: args.obligationId,
-    amount_forgone_native: row.amount
-  });
-  return true;
+  return args.includeDetails ? { channelId: row.channelId, amountForgoneNative: row.amount } : true;
+}
+function tempoCloseAmount(original) {
+  return (BigInt(String(original.highestVoucherAmount)) - BigInt(String(original.settledOnChain))).toString();
 }
 function searchCursor(value) {
   return value === null ? null : BigInt(value);
@@ -12174,7 +12292,7 @@ function jobCredentialGate(opts) {
         // to a human verbatim, so the conditional advice lives in `hint`, which
         // is what the agent acts on.
         display: "Couldn't retrieve your result \u2014 the request was missing its job credential.",
-        hint: `Send the job_token from the POST /v1/job response as the X-Job-Token header${alternative}. The token is minted once, at submit, and the DVM cannot reissue it \u2014 a job submitted from another machine, or by a caller that never stored it, can't be read here. If your caller never sends X-Job-Token at all, upgrade: npm i -g @dvmkit/dvm-cli@0.2.0, then retry the same command with --endpoint <url> --job-token <hex> (or set DVM_JOB_ENDPOINT and DVM_JOB_TOKEN).`
+        hint: `Send the job_token from the POST /v1/job response as the X-Job-Token header${alternative}. The token is minted once, at submit, and the DVM cannot reissue it \u2014 a job submitted from another machine, or by a caller that never stored it, can't be read here. If your caller never sends X-Job-Token at all, upgrade: npm i -g @dvmkit/dvm-cli@latest, then retry the same command with --endpoint <url> --job-token <hex> (or set DVM_JOB_ENDPOINT and DVM_JOB_TOKEN).`
       };
     }
   };
@@ -12607,22 +12725,17 @@ function buildContext(job, opts) {
         };
         const doResolve = async (pc) => {
           if (resolved) return;
+          if (job.pendingPayment?.resolve === doResolve) {
+            job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
+            const persist = opts.onPaymentResume ?? opts.onYield;
+            if (job.status === "awaiting-input" && persist) await persist();
+            if (resolved) return;
+            job.pendingPayment = null;
+          }
           resolved = true;
           cleanup();
           creditedToHandlerMsats += amountMsats;
           creditedToHandlerMicro += pendingFiat?.amountMicro ?? 0;
-          if (job.pendingPayment?.resolve === doResolve) {
-            job.pendingPayment = null;
-            job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
-            if (job.status === "awaiting-input" && opts.onYield) {
-              try {
-                await opts.onYield();
-              } catch (err) {
-                reject(err);
-                return;
-              }
-            }
-          }
           resolve(pc);
         };
         const doReject = (err) => {
@@ -13148,6 +13261,9 @@ var JobManager = class {
   // A prompt response and a payment NOTIFY must not mistake each other for a
   // different machine's successful claim.
   inputResumeTails = /* @__PURE__ */ new WeakMap();
+  // A failed partial-wait snapshot leaves our durable claim in processing.
+  // Retain its continuation so a later input can finish it without a new claim.
+  claimedPaymentResumes = /* @__PURE__ */ new WeakMap();
   sessionId = randomBytes4(3).toString("hex");
   nextJobId = 1;
   accumulatorMonitor;
@@ -13554,7 +13670,10 @@ var JobManager = class {
   }
   async queueInputResume(job, resume) {
     const previous = this.inputResumeTails.get(job) ?? Promise.resolve();
-    const next = previous.catch(() => void 0).then(resume);
+    const next = previous.catch(() => void 0).then(async () => {
+      await this.claimedPaymentResumes.get(job)?.();
+      return resume();
+    });
     this.inputResumeTails.set(job, next);
     try {
       return await next;
@@ -13566,6 +13685,19 @@ var JobManager = class {
     await job.messageAppenderTail;
     return isStreamableJobStore(this.jobStore) ? this.jobStore.claimForProcessing(job.id) : true;
   }
+  async resumeClaimedPayment(job, resume) {
+    const retry = async () => {
+      try {
+        if (!isTerminal(job.status) && !await this.adoptDurableTerminal(job)) await resume();
+        this.claimedPaymentResumes.delete(job);
+      } catch (error) {
+        if (!(error instanceof JobSnapshotPersistenceError)) this.claimedPaymentResumes.delete(job);
+        throw error;
+      }
+    };
+    this.claimedPaymentResumes.set(job, retry);
+    await retry();
+  }
   async dispatchMessageNow(job, type, content) {
     const ctx = job.sdkCtx;
     const cap = this.getCapability(job.capability);
@@ -13594,10 +13726,13 @@ var JobManager = class {
           return;
         }
         if (job.pendingPayment !== pp || isTerminal(job.status)) return;
-        job.pendingPayment = null;
-        job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
-        if (job.status === "awaiting-input") await this.persistJob(job);
-        await pp.resolve(pc);
+        await this.resumeClaimedPayment(job, async () => {
+          job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
+          if (job.status === "awaiting-input") await retryJobSnapshot(() => this.persistJob(job));
+          if (job.pendingPayment !== pp || isTerminal(job.status)) return;
+          job.pendingPayment = null;
+          await pp.resolve(pc);
+        });
       } else if (cap?.onPayment && ctx) {
         await cap.onPayment(ctx, pc);
       }
@@ -13650,10 +13785,14 @@ var JobManager = class {
         record.seq = Math.max(record.seq, highSeq);
       }
     }
-    if (this.opts.dvmId && isTerminalCostRecoveryStore(this.jobStore)) {
-      await this.jobStore.saveForDvm(record, this.opts.dvmId);
-    } else {
-      await this.jobStore.save(record);
+    try {
+      if (this.opts.dvmId && isTerminalCostRecoveryStore(this.jobStore)) {
+        await this.jobStore.saveForDvm(record, this.opts.dvmId);
+      } else {
+        await this.jobStore.save(record);
+      }
+    } catch (error) {
+      throw new JobSnapshotPersistenceError(error);
     }
     const saved = await this.jobStore.get(job.id);
     if (saved) {
@@ -15193,6 +15332,7 @@ var JobManager = class {
       fxFetcher: this.opts.fxFetcher,
       onTerminal: () => this.handleJobTerminal(job),
       onYield: () => this.persistJob(job),
+      onPaymentResume: () => retryJobSnapshot(() => this.persistJob(job)),
       subscribeNotifications: isStreamableJobStore(jobStore) ? (cb) => jobStore.subscribeNotifications(job.id, cb) : void 0,
       getCounters: isStreamableJobStore(jobStore) ? () => jobStore.getCounters(job.id) : void 0,
       drawPool: this.opts.creditLedger ? () => this.resolveDrawPool(job) : void 0,
@@ -15203,7 +15343,9 @@ var JobManager = class {
           if (!pending || job.pendingPayment !== pending || isTerminal(job.status)) return false;
           if (!await this.claimLocalInput(job)) return false;
           if (job.pendingPayment !== pending || isTerminal(job.status)) return false;
-          await resume?.();
+          await this.resumeClaimedPayment(job, async () => {
+            await resume?.();
+          });
           return true;
         });
       } : void 0,
@@ -15964,6 +16106,23 @@ function resolvePricingMax(raw) {
   if (raw === void 0) return void 0;
   return { amount: roundUsd(parseUsdPrice(raw, "price")), currency: "usd" };
 }
+var JobSnapshotPersistenceError = class extends Error {
+  constructor(cause) {
+    super("Job snapshot could not be persisted", { cause });
+    this.name = "JobSnapshotPersistenceError";
+  }
+};
+async function retryJobSnapshot(persist) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await persist();
+      return;
+    } catch (error) {
+      if (!(error instanceof JobSnapshotPersistenceError) || attempt >= 2) throw error;
+      await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+    }
+  }
+}
 
 // src/sdk/server/mint-health-tracker.ts
 var DEFAULT_TICK_INTERVAL_MS2 = 5 * 60 * 1e3;
@@ -17033,6 +17192,9 @@ function installAdminCreditRoutes(app, opts) {
     "/admin/credit/reconcile-x402-exact-settlement",
     (c) => handleReconcileX402Exact(c, opts)
   );
+  app.get("/admin/credit/tempo-close-reports", (c) => handleTempoCloseReports(c, opts));
+  app.post("/admin/credit/retry-tempo-close-report", (c) => handleTempoCloseReportAction(c, opts, "retry"));
+  app.post("/admin/credit/write-off-tempo-close-report", (c) => handleTempoCloseReportAction(c, opts, "write-off"));
   app.get("/admin/credit/tempo-drains", (c) => handleTempoDrains(c, opts));
   app.get("/admin/credit/tempo-losses", (c) => handleTempoLosses(c, opts));
   app.post("/admin/credit/reconcile-tempo-drain", (c) => handleReconcileTempo(c, opts));
@@ -18008,6 +18170,101 @@ async function handleWriteOffX402(c, opts) {
     replayed: !outcome.written
   });
 }
+function tempoCloseReportsUnavailable(c) {
+  return c.json({
+    error: "tempo_close_report_unavailable",
+    message: "Hosted settlement reports are not configured on this DVM."
+  }, 503);
+}
+async function handleTempoCloseReports(c, opts) {
+  const auth = await requireAuth(c, opts);
+  if ("response" in auth) return auth.response;
+  if (!opts.hostedSettlementReports) return tempoCloseReportsUnavailable(c);
+  const limit = parseTempoLimit(c.req.query("limit"));
+  if (limit === void 0) {
+    return c.json({ error: "invalid_query", message: "limit must be an integer in 1..50." }, 400);
+  }
+  let after;
+  const rawAfter = c.req.query("after");
+  if (rawAfter !== void 0) {
+    try {
+      const value = JSON.parse(Buffer.from(rawAfter, "base64url").toString("utf8"));
+      if (!Array.isArray(value) || value.length !== 2 || !Number.isSafeInteger(value[0]) || value[0] < 0 || typeof value[1] !== "string" || !value[1]) throw new Error("invalid cursor");
+      after = { createdAtMs: value[0], obligationId: value[1] };
+    } catch {
+      return c.json({ error: "invalid_query", message: "after must be a next_after value from a previous response." }, 400);
+    }
+  }
+  const all = c.req.query("all");
+  if (all !== void 0 && all !== "0" && all !== "1") {
+    return c.json({ error: "invalid_query", message: "all must be 0 or 1." }, 400);
+  }
+  const rows2 = await opts.hostedSettlementReports.store.listTempoCloseReports({ limit, after, all: all === "1" });
+  const last = rows2.length === limit ? rows2.at(-1) : void 0;
+  const response = {
+    reports: rows2.map((row) => ({
+      obligation_id: row.id,
+      channel_id: row.channelId,
+      amount_native: row.amountNative,
+      status: row.status,
+      created_at_ms: row.createdAtMs,
+      updated_at_ms: row.updatedAtMs,
+      delivered_at_ms: row.deliveredAtMs,
+      retryable: row.retryable,
+      write_off_allowed: row.writeOffAllowed,
+      written_off: row.writtenOff,
+      write_off_note: row.writeOffNote,
+      written_off_at_ms: row.writtenOffAtMs
+    })),
+    ...last ? { next_after: Buffer.from(JSON.stringify([last.createdAtMs, last.id])).toString("base64url") } : {}
+  };
+  return c.json(response);
+}
+async function handleTempoCloseReportAction(c, opts, action) {
+  const auth = await requireAuth(c, opts);
+  if ("response" in auth) return auth.response;
+  const reports = opts.hostedSettlementReports;
+  if (!reports) return tempoCloseReportsUnavailable(c);
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body.obligation_id !== "string" || !body.obligation_id.trim()) {
+    return c.json({ error: "invalid_request", message: "obligation_id must be a non-empty string." }, 400);
+  }
+  const obligationId = body.obligation_id.trim();
+  if (action === "retry") {
+    if (await reports.store.reopenTempoClose(obligationId)) {
+      const response = { status: "reserved", obligation_id: obligationId };
+      return c.json(response);
+    }
+  } else {
+    if (typeof body.note !== "string" || !body.note.trim() || body.note.trim().length > 2e3) {
+      return c.json({ error: "invalid_request", message: "note must contain 1 to 2000 characters after trimming." }, 400);
+    }
+    const note = body.note.trim();
+    const result = await reports.store.writeOffTempoClose(obligationId, note);
+    if (result) {
+      const response = {
+        status: "written_off",
+        obligation_id: obligationId,
+        channel_id: result.channelId,
+        amount_forgone_native: result.amount,
+        note
+      };
+      return c.json(response);
+    }
+  }
+  if (!await reports.store.hasTempoCloseReport(obligationId)) {
+    return c.json({
+      error: "tempo_close_report_not_found",
+      message: "Close-report obligation not found.",
+      obligation_id: obligationId
+    }, 404);
+  }
+  return c.json({
+    error: "tempo_close_report_conflict",
+    message: action === "retry" ? "Retry requires an unsubmitted unmatched or no_report close obligation without a competing report." : "Write-off requires an unsubmitted unmatched close obligation.",
+    obligation_id: obligationId
+  }, 409);
+}
 async function handleTempoDrains(c, opts) {
   const auth = await requireAuth(c, opts);
   if ("response" in auth) return auth.response;
@@ -19913,7 +20170,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-4EAVPWXS.js");
+      const { RevenueReporter } = await import("./revenue-reporter-EV3K5L6B.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -19923,7 +20180,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-TZX2S7KG.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-HVJ6WUF3.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -20590,6 +20847,9 @@ var DVMServer = class {
         // DVM wired with an in-memory session store resolves to a rail with no
         // close-intent read and the verbs answer 503.
         tempoDrainRail: () => Promise.resolve(this.opts.mpp),
+        ...this.opts.hostedSettlementReports ? {
+          hostedSettlementReports: { store: this.opts.hostedSettlementReports }
+        } : {},
         // Health-filtered, and read per request rather than captured: the
         // servicer picking a mint to buy a refund at wants the list that
         // excludes a mint currently failing its probe.
@@ -22708,8 +22968,14 @@ var DVMServer = class {
         await jm.markInboundVerified(activeJob.id, inboundSeq2);
       }
       jm.startIdleTimer(activeJob);
-      await jm.dispatchMessage(activeJob, body2.type, body2.content);
-      await jm.persistJob(activeJob);
+      try {
+        await jm.dispatchMessage(activeJob, body2.type, body2.content);
+        await this.persistMessageSnapshot(jm, activeJob, body2.type);
+      } catch (error) {
+        const response = this.postPaymentSnapshotFailure(c, error, activeJob, body2.type, inboundSeq2, unappliedCredit2);
+        if (response) return response;
+        throw error;
+      }
       const lastMsg2 = activeJob.messages[activeJob.messages.length - 1];
       return c.json({ seq: lastMsg2.seq, ...unappliedCredit2 && { credit: unappliedCredit2 } }, 201);
     }
@@ -22792,20 +23058,48 @@ var DVMServer = class {
       return c.json({ seq: lastMsg2.seq, ...creditBlock }, 201);
     }
     jm.startIdleTimer(job);
-    if (isStreamableJobStore(jm.store)) {
-      const store = jm.store;
-      const lockResult = await store.tryReactivationLock(job.id, async () => {
+    try {
+      if (isStreamableJobStore(jm.store)) {
+        const store = jm.store;
+        const lockResult = await store.tryReactivationLock(job.id, async () => {
+          await this.runReactivation(jm, job, body, record.status);
+        });
+        if (!lockResult.acquired) {
+          this.teardownReactivationScaffold(jm, job);
+        }
+      } else {
         await this.runReactivation(jm, job, body, record.status);
-      });
-      if (!lockResult.acquired) {
-        this.teardownReactivationScaffold(jm, job);
       }
-    } else {
-      await this.runReactivation(jm, job, body, record.status);
+    } catch (error) {
+      const response = this.postPaymentSnapshotFailure(c, error, job, body.type, inboundSeq, unappliedCredit);
+      if (response) return response;
+      throw error;
     }
     const lastMsg = job.messages[job.messages.length - 1];
     return c.json({ seq: lastMsg.seq, ...creditBlock }, 201);
   }
+  async persistMessageSnapshot(jm, job, type) {
+    if (type === "payment") {
+      await retryJobSnapshot(() => jm.persistJob(job));
+    } else {
+      await jm.persistJob(job);
+    }
+  }
+  postPaymentSnapshotFailure(c, error, job, type, inboundSeq, unappliedCredit) {
+    if (!(error instanceof JobSnapshotPersistenceError) || type !== "payment" || inboundSeq === null || !isStreamableJobStore(this.jobManager.store)) return void 0;
+    diagnosticConsole.error({ level: "job_snapshot_unavailable", job_id: job.id, seq: inboundSeq });
+    return c.json({
+      error: "job_snapshot_unavailable",
+      message: "Payment was recorded but the job snapshot could not be persisted.",
+      display: "Your payment was recorded. The service could not save the latest job progress.",
+      hint: "Do not send another payment. Read the job status and messages; if the worker stopped, resume with a non-payment message.",
+      retryable: false,
+      payment_status: "recorded",
+      job_id: job.id,
+      seq: inboundSeq,
+      ...unappliedCredit && { credit: unappliedCredit }
+    }, 503);
+  }
   /**
    * Run the handler or dispatch the inbound after Tx B + Tx C have already
    * committed the credit. Status decides the behaviour: `awaiting-input`
@@ -22831,7 +23125,7 @@ var DVMServer = class {
       });
     } else {
       await jm.dispatchMessage(job, body.type, body.content);
-      await jm.persistJob(job);
+      await this.persistMessageSnapshot(jm, job, body.type);
     }
   }
   /**