@le-space/ui 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/ui",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Floating Aleph sponsor relay UI components for Svelte and React.",
   "license": "MIT",
   "type": "module",
@@ -36,8 +36,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@le-space/browser": "0.4.1",
-    "@le-space/core": "0.4.1",
+    "@le-space/browser": "0.4.2",
+    "@le-space/core": "0.4.2",
     "viem": "^2.38.5"
   },
   "peerDependencies": {

package/react/index.js

@@ -28,7 +28,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.4.1";
+var UI_PACKAGE_VERSION = "0.4.2";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1237,16 +1237,6 @@ function normalizeBroadcastStatus(httpStatus, responseStatus) {
   if (httpStatus === 202) return "pending";
   return normalizeMessageStatus2(responseStatus);
 }
-function isInvalidMessageFormatResponse2(response, payload) {
-  if (response.status !== 422) return false;
-  const details = payload?.details;
-  if (typeof details === "string" && details.includes("InvalidMessageFormat")) return true;
-  if (details && typeof details === "object") {
-    const detailMessage = details.message;
-    if (typeof detailMessage === "string" && detailMessage.includes("InvalidMessageFormat")) return true;
-  }
-  return false;
-}
 function isRetryableBroadcastFailure(response, payload) {
   if (response.status >= 500) return true;
   const publicationStatus = payload?.publication_status?.status;
@@ -1268,25 +1258,22 @@ async function postBroadcastPayload2(body, options) {
   };
 }
 async function broadcastAlephMessage2(message, options) {
-  const attempts = [
-    { sync: options.sync ?? false, message },
-    { ...message, sync: options.sync ?? false },
-    { ...message }
-  ];
-  for (let index = 0; index < attempts.length; index += 1) {
-    const result = await postBroadcastPayload2(attempts[index], {
+  const requestBody = { sync: options.sync ?? false, message };
+  const maxAttempts = 3;
+  for (let index = 0; index < maxAttempts; index += 1) {
+    const result = await postBroadcastPayload2(requestBody, {
       apiHost: options.apiHost,
       fetch: options.fetch
     });
     if (result.httpStatus === 202 || normalizeBroadcastStatus(result.httpStatus, result.response?.message_status) !== "unknown" || result.httpStatus >= 200 && result.httpStatus < 300) {
       return result;
     }
-    const canRetry = index < attempts.length - 1 && (isInvalidMessageFormatResponse2({ status: result.httpStatus }, result.response) || isRetryableBroadcastFailure({ status: result.httpStatus }, result.response));
+    const canRetry = index < maxAttempts - 1 && isRetryableBroadcastFailure({ status: result.httpStatus }, result.response);
     if (!canRetry) {
       throw new Error(`Broadcast failed: ${result.httpStatus} ${JSON.stringify(result.response ?? {})}`);
     }
   }
-  throw new Error("Broadcast failed: no compatible request format was accepted");
+  throw new Error("Broadcast failed: retry budget exhausted");
 }
 
 // ../core/src/forget.ts
@@ -1653,6 +1640,26 @@ function asString3(value) {
 function asNumber3(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
+function normalizeIpv6(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  if (!normalized) return null;
+  const zoneIndex = normalized.indexOf("%");
+  return zoneIndex >= 0 ? normalized.slice(0, zoneIndex) : normalized;
+}
+function isLikelyGlobalIpv6(value) {
+  const normalized = normalizeIpv6(value);
+  if (!normalized || normalized === "::" || normalized === "::1") return false;
+  const firstHextetText = normalized.split(":", 1)[0];
+  if (!firstHextetText) return false;
+  const firstHextet = Number.parseInt(firstHextetText, 16);
+  if (!Number.isFinite(firstHextet)) return false;
+  if ((firstHextet & 65024) === 64512) return false;
+  if ((firstHextet & 65472) === 65152) return false;
+  if ((firstHextet & 65280) === 65280) return false;
+  if ((firstHextet & 65472) === 65216) return false;
+  return true;
+}
 function findCrnByHash(crns, crnHash) {
   return crns.find((crn) => crn.hash === crnHash) ?? null;
 }
@@ -1733,10 +1740,22 @@ function describeRuntimeAvailability(runtime) {
   const execution = runtime.execution ?? null;
   const mappedPorts2 = runtime.mappedPorts ?? {};
   const hostIpv4 = runtime.hostIpv4 ?? null;
+  const ipv6 = runtime.ipv6 ?? null;
   const proxyUrl = runtime.proxyUrl ?? null;
   const schedulerSource = runtime.allocation?.source ?? null;
   const webAccessActive = runtime.webAccess?.active ?? null;
   const mappedPortCount = Object.keys(mappedPorts2).length;
+  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && !isLikelyGlobalIpv6(ipv6)) {
+    return {
+      state: "execution-invalid-public-ipv6",
+      reason: `The CRN exposed runtime networking, but the guest IPv6${ipv6 ? ` (${ipv6})` : ""} is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
+      schedulerSource,
+      executionSeen: Boolean(execution),
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
   if (hostIpv4 && mappedPortCount > 0) {
     return {
       state: "ready",
@@ -1853,7 +1872,8 @@ async function fetchVmRuntime(args) {
     hostIpv4,
     ipv6,
     proxyUrl,
-    mappedPorts: mappedPorts2
+    mappedPorts: mappedPorts2,
+    requirePublicGuestIpv6ForProxy: args.requirePublicGuestIpv6ForProxy
   });
   return {
     allocation,
@@ -1877,7 +1897,7 @@ async function waitForVmRuntime(args) {
   let lastRuntime = await fetchVmRuntime(args);
   args.onAttempt?.(lastRuntime, 1, attempts);
   for (let attempt = 0; attempt < attempts - 1; attempt += 1) {
-    if (lastRuntime.hostIpv4 && Object.keys(lastRuntime.mappedPorts ?? {}).length > 0) {
+    if (lastRuntime.diagnostics?.state === "ready" || lastRuntime.diagnostics?.state === "execution-invalid-public-ipv6") {
       return lastRuntime;
     }
     await sleep2(delayMs);
@@ -2676,6 +2696,16 @@ async function publishRelayBootstrapRegistration(args) {
 
 // ../core/src/bootstrap-config.ts
 var VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY = "vm-bootstrap-config";
+var VM_BOOTSTRAP_CONFIG_SIGNAL_REF = "vm-bootstrap-config";
+var VM_BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE = "vm-bootstrap-config-status";
+function parseJsonObject(value) {
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
 async function fetchVmBootstrapConfigAggregate(address, options) {
   const requestUrl = new URL(`/api/v0/aggregates/${address}.json`, options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
   requestUrl.searchParams.set("keys", VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY);
@@ -2795,6 +2825,89 @@ async function deleteVmBootstrapConfig(args) {
     aggregate: content
   };
 }
+function normalizeVmBootstrapConfigSignalRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const deploymentToken = typeof candidate.deploymentToken === "string" ? candidate.deploymentToken.trim() : "";
+  const status = typeof candidate.status === "string" ? candidate.status.trim() : "";
+  const profile = typeof candidate.profile === "string" ? candidate.profile.trim() : "";
+  const ownerAddress = typeof candidate.ownerAddress === "string" ? candidate.ownerAddress.trim() : "";
+  const instanceItemHash = typeof candidate.instanceItemHash === "string" ? candidate.instanceItemHash.trim() : "";
+  const updatedAt = typeof candidate.updatedAt === "string" ? candidate.updatedAt.trim() : "";
+  if (!deploymentToken || !status || !profile || !ownerAddress || !instanceItemHash || !updatedAt) {
+    return null;
+  }
+  return {
+    deploymentToken,
+    status,
+    profile,
+    ownerAddress,
+    instanceItemHash,
+    updatedAt,
+    publisherAddress: typeof candidate.publisherAddress === "string" && candidate.publisherAddress.trim() ? candidate.publisherAddress.trim() : null,
+    authorization: candidate.authorization,
+    peerId: typeof candidate.peerId === "string" && candidate.peerId.trim() ? candidate.peerId.trim() : null,
+    probeMultiaddrs: Array.isArray(candidate.probeMultiaddrs) ? candidate.probeMultiaddrs.filter(
+      (entry) => typeof entry === "string" && entry.trim().length > 0
+    ) : [],
+    browserBootstrapMultiaddrs: Array.isArray(candidate.browserBootstrapMultiaddrs) ? candidate.browserBootstrapMultiaddrs.filter(
+      (entry) => typeof entry === "string" && entry.trim().length > 0
+    ) : []
+  };
+}
+async function fetchVmBootstrapConfigSignals(args) {
+  const requestUrl = new URL("/api/v0/posts.json", args.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+  requestUrl.searchParams.set("refs", args.ref ?? VM_BOOTSTRAP_CONFIG_SIGNAL_REF);
+  requestUrl.searchParams.set("types", args.postType ?? VM_BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE);
+  requestUrl.searchParams.set("pagination", String(Math.max(1, Number(args.pagination ?? 100))));
+  requestUrl.searchParams.set("page", String(Math.max(1, Number(args.page ?? 1))));
+  requestUrl.searchParams.set("sortOrder", "-1");
+  const response = await args.fetch(requestUrl.toString(), { cache: "no-cache" });
+  if (!response.ok) {
+    throw new Error(`VM bootstrap config signal request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const expectedDeploymentToken = args.deploymentToken?.trim() ?? "";
+  const expectedOwnerAddress = args.ownerAddress?.trim().toLowerCase() ?? "";
+  const expectedInstanceItemHash = args.instanceItemHash?.trim() ?? "";
+  return (payload.posts ?? []).map((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const parsed = "content" in entry && entry.content && typeof entry.content === "object" && !Array.isArray(entry.content) ? entry.content : "item_content" in entry && typeof entry.item_content === "string" ? parseJsonObject(entry.item_content) : null;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const content = "deploymentToken" in parsed ? parsed : "content" in parsed && parsed.content && typeof parsed.content === "object" && !Array.isArray(parsed.content) ? parsed.content : null;
+    if (!content || typeof content !== "object" || Array.isArray(content)) return null;
+    return normalizeVmBootstrapConfigSignalRecord(content);
+  }).filter((entry) => {
+    if (!entry) return false;
+    if (expectedDeploymentToken && entry.deploymentToken !== expectedDeploymentToken) return false;
+    if (expectedOwnerAddress && entry.ownerAddress.toLowerCase() !== expectedOwnerAddress) return false;
+    if (expectedInstanceItemHash && entry.instanceItemHash !== expectedInstanceItemHash) return false;
+    return true;
+  });
+}
+async function waitForVmBootstrapConfigSignal(args) {
+  const attempts = Math.max(1, Number(args.attempts ?? 24));
+  const delayMs = Math.max(0, Number(args.delayMs ?? 2500));
+  const sleep2 = args.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const expectedStatus = args.expectedStatus ?? "applied";
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    const signals = await fetchVmBootstrapConfigSignals({
+      deploymentToken: args.deploymentToken,
+      ownerAddress: args.ownerAddress,
+      instanceItemHash: args.instanceItemHash,
+      fetch: args.fetch,
+      apiHost: args.apiHost,
+      ref: args.ref,
+      postType: args.postType
+    }).catch(() => []);
+    const match = signals.find((entry) => entry.status === expectedStatus) ?? null;
+    if (match) return match;
+    if (attempt < attempts - 1) {
+      await sleep2(delayMs);
+    }
+  }
+  return null;
+}
 
 // ../core/src/bootstrap-reconcile.ts
 function createRelayBootstrapRegistrationId(profile, instanceName, itemHash) {
@@ -3280,11 +3393,13 @@ var SponsorRelayController = class {
     if (!args.runtime.hostIpv4) {
       throw new Error("Relay runtime did not expose a host IPv4 address.");
     }
-    const mappedPorts2 = args.runtime.mappedPorts ?? {};
+    let runtime = args.runtime;
+    let mappedPorts2 = runtime.mappedPorts ?? {};
     const setupPort = mappedPorts2["80"]?.host ?? null;
     if (!setupPort) {
       throw new Error("Relay runtime did not expose the temporary setup endpoint.");
     }
+    let bootstrapSignalRelayMetadata = null;
     if (profile === "orbitdb-relay-pinner") {
       this.emitProgress({
         stage: "deployment-confirmed",
@@ -3353,6 +3468,57 @@ var SponsorRelayController = class {
       if (!args.deploymentToken) {
         throw new Error("Missing deployment token for Aleph bootstrap config handoff.");
       }
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.emitProgress({
+          stage: "deployment-confirmed",
+          label: "Waiting for HTTPS route",
+          progress: 93,
+          status: "warning",
+          itemHash: args.itemHash,
+          detail: "The relay received a 2n6 hostname, but it is not active yet. Waiting before handing HTTPS config to the guest."
+        });
+        let latestRuntime = runtime;
+        for (let attempt = 0; attempt < UI_RUNTIME_WAIT_ATTEMPTS; attempt += 1) {
+          if (latestRuntime.webAccess?.active === true) {
+            break;
+          }
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_RUNTIME_WAIT_DELAY_MS)
+          );
+          latestRuntime = await fetchVmRuntime({
+            itemHash: args.itemHash,
+            fetch: (url, init) => fetch(url, init),
+            crnHash: runtime.selectedCrn?.hash ?? runtime.allocation?.crnHash ?? void 0,
+            crns: this.state.crns,
+            crnListUrl: this.props.crnListUrl,
+            requirePublicGuestIpv6ForProxy: true
+          }).catch(() => latestRuntime);
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: "Waiting for HTTPS route",
+            progress: 93,
+            status: latestRuntime.webAccess?.active === true ? "info" : "warning",
+            itemHash: args.itemHash,
+            detail: `2n6 activation ${attempt + 1}/${UI_RUNTIME_WAIT_ATTEMPTS}: ${latestRuntime.webAccess?.active === true ? "active" : "still pending"} for ${latestRuntime.proxyUrl ?? runtime.proxyUrl ?? "reserved proxy URL"}.`
+          });
+          this.trace("deploy:bootstrap-proxy-activation", {
+            itemHash: args.itemHash,
+            attempt: attempt + 1,
+            attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+            active: latestRuntime.webAccess?.active === true,
+            proxyUrl: latestRuntime.proxyUrl ?? null
+          });
+        }
+        runtime = latestRuntime;
+        mappedPorts2 = runtime.mappedPorts ?? mappedPorts2;
+      }
+      if (!runtime.hostIpv4) {
+        throw new Error(
+          "Relay runtime lost its host IPv4 address while waiting for HTTPS activation."
+        );
+      }
+      const runtimeHostIpv4 = runtime.hostIpv4;
+      const activeProxyUrl = runtime.webAccess?.active === true ? runtime.proxyUrl ?? null : null;
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Publishing relay config",
@@ -3370,9 +3536,9 @@ var SponsorRelayController = class {
         expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
         status: "pending",
         runtime: {
-          publicIpv4: args.runtime.hostIpv4,
-          publicIpv6: args.runtime.ipv6 ?? null,
-          proxyUrl: args.runtime.proxyUrl ?? null,
+          publicIpv4: runtimeHostIpv4,
+          publicIpv6: runtime.ipv6 ?? null,
+          proxyUrl: activeProxyUrl,
           mappedPorts: mappedPorts2
         },
         bootstrap: {
@@ -3401,54 +3567,120 @@ var SponsorRelayController = class {
         aggregateItemHash: bootstrapConfigPublication.aggregateItemHash,
         aggregateStatus: bootstrapConfigPublication.aggregateStatus
       });
-    }
-    this.emitProgress({
-      stage: "publishing-bootstrap",
-      label: "Reading relay multiaddrs",
-      progress: 95,
-      status: "info",
-      itemHash: args.itemHash,
-      detail: "Waiting for the relay to report its final public multiaddrs."
-    });
-    const relayMetadata = await fetchRelayMetadataForRuntime({
-      runtime: args.runtime,
-      fetch: (url, init) => fetch(url, init),
-      preferSecureMetadata: profile === "uc-go-peer",
-      attempts: 80,
-      delayMs: 3e3,
-      timeoutMs: 24e4,
-      onAttempt: (result) => {
-        const payload = result.payload && typeof result.payload === "object" ? result.payload : null;
-        const metadata = payload?.metadata && typeof payload.metadata === "object" ? payload.metadata : null;
-        this.trace("deploy:relay-metadata-attempt", {
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Waiting for guest config",
+        progress: 94,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Waiting for the relay VM to acknowledge that it consumed the Aleph bootstrap config."
+      });
+      const bootstrapConfigSignal = await waitForVmBootstrapConfigSignal({
+        deploymentToken: args.deploymentToken,
+        ownerAddress: this.state.wallet.address,
+        instanceItemHash: args.itemHash,
+        fetch: asJsonFetch,
+        apiHost: this.client.apiHost,
+        attempts: 40,
+        delayMs: 3e3
+      });
+      this.trace("deploy:bootstrap-config-signal-visible", {
+        itemHash: args.itemHash,
+        deploymentToken: args.deploymentToken,
+        bootstrapConfigSignal
+      });
+      if (!bootstrapConfigSignal) {
+        throw new Error(
+          "The relay VM did not confirm that it applied the Aleph bootstrap config in time."
+        );
+      }
+      bootstrapSignalRelayMetadata = typeof bootstrapConfigSignal.peerId === "string" && bootstrapConfigSignal.peerId.length > 0 && Array.isArray(bootstrapConfigSignal.probeMultiaddrs) && bootstrapConfigSignal.probeMultiaddrs.length > 0 ? {
+        peerId: bootstrapConfigSignal.peerId,
+        probeMultiaddrs: bootstrapConfigSignal.probeMultiaddrs,
+        browserBootstrapMultiaddrs: bootstrapConfigSignal.browserBootstrapMultiaddrs ?? []
+      } : null;
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.trace("deploy:bootstrap-proxy-fallback", {
           itemHash: args.itemHash,
-          attempt: result.attempt,
-          attempts: result.attempts,
-          requestUrl: result.requestUrl,
-          metadataUrl: result.metadataUrl,
-          hostIpv4: result.hostIpv4,
-          setupPort: result.setupPort,
-          ok: result.ok,
-          status: result.status,
-          ready: result.ready,
-          error: result.error ?? null,
-          payloadStatus: payload && typeof payload.status === "string" ? payload.status : null,
-          peerId: metadata && typeof metadata.peer_id === "string" ? metadata.peer_id : null,
-          probeMultiaddrCount: Array.isArray(metadata?.probe_multiaddrs) ? metadata.probe_multiaddrs.length : 0,
-          browserBootstrapMultiaddrCount: Array.isArray(
-            metadata?.browser_bootstrap_multiaddrs
-          ) ? metadata.browser_bootstrap_multiaddrs.length : 0
+          deploymentToken: args.deploymentToken,
+          proxyUrl: runtime.proxyUrl,
+          bootstrapSignalRelayMetadata
         });
         this.emitProgress({
-          stage: "publishing-bootstrap",
-          label: "Reading relay multiaddrs",
-          progress: 95,
-          status: result.ready ? "success" : "info",
+          stage: "deployment-confirmed",
+          label: "Continuing without HTTPS route",
+          progress: 94,
+          status: "warning",
           itemHash: args.itemHash,
-          detail: result.ready ? `Relay metadata ${result.attempt}/${result.attempts}: public multiaddrs available.` : `Relay metadata ${result.attempt}/${result.attempts}: waiting for the relay to report public multiaddrs.`
+          detail: "The 2n6 HTTPS route stayed inactive, so guest setup continued without Caddy. Secure browser routing can be enabled later when the proxy becomes available."
         });
+        runtime = {
+          ...runtime,
+          proxyUrl: null,
+          webAccess: runtime.webAccess ? {
+            ...runtime.webAccess,
+            active: false
+          } : runtime.webAccess
+        };
       }
-    });
+    }
+    let relayMetadata = bootstrapSignalRelayMetadata;
+    if (relayMetadata) {
+      this.trace("deploy:relay-metadata-from-bootstrap-signal", {
+        itemHash: args.itemHash,
+        peerId: relayMetadata.peerId,
+        probeMultiaddrCount: relayMetadata.probeMultiaddrs.length,
+        browserBootstrapMultiaddrCount: relayMetadata.browserBootstrapMultiaddrs.length
+      });
+    } else {
+      this.emitProgress({
+        stage: "publishing-bootstrap",
+        label: "Waiting for secure relay metadata",
+        progress: 95,
+        status: "warning",
+        itemHash: args.itemHash,
+        detail: "Runtime networking is available. Waiting for the secure relay metadata endpoint to report final public multiaddrs."
+      });
+      relayMetadata = await fetchRelayMetadataForRuntime({
+        runtime,
+        fetch: (url, init) => fetch(url, init),
+        preferSecureMetadata: profile === "uc-go-peer" && Boolean(runtime.proxyUrl),
+        attempts: 80,
+        delayMs: 3e3,
+        timeoutMs: 24e4,
+        onAttempt: (result) => {
+          const payload = result.payload && typeof result.payload === "object" ? result.payload : null;
+          const metadata = payload?.metadata && typeof payload.metadata === "object" ? payload.metadata : null;
+          this.trace("deploy:relay-metadata-attempt", {
+            itemHash: args.itemHash,
+            attempt: result.attempt,
+            attempts: result.attempts,
+            requestUrl: result.requestUrl,
+            metadataUrl: result.metadataUrl,
+            hostIpv4: result.hostIpv4,
+            setupPort: result.setupPort,
+            ok: result.ok,
+            status: result.status,
+            ready: result.ready,
+            error: result.error ?? null,
+            payloadStatus: payload && typeof payload.status === "string" ? payload.status : null,
+            peerId: metadata && typeof metadata.peer_id === "string" ? metadata.peer_id : null,
+            probeMultiaddrCount: Array.isArray(metadata?.probe_multiaddrs) ? metadata.probe_multiaddrs.length : 0,
+            browserBootstrapMultiaddrCount: Array.isArray(
+              metadata?.browser_bootstrap_multiaddrs
+            ) ? metadata.browser_bootstrap_multiaddrs.length : 0
+          });
+          this.emitProgress({
+            stage: "publishing-bootstrap",
+            label: result.ready ? "Secure relay metadata ready" : "Waiting for secure relay metadata",
+            progress: 95,
+            status: result.ready ? "success" : "warning",
+            itemHash: args.itemHash,
+            detail: result.ready ? `Relay metadata ${result.attempt}/${result.attempts}: secure endpoint responded and public multiaddrs are available.` : `Relay metadata ${result.attempt}/${result.attempts}: waiting for ${result.metadataUrl}.`
+          });
+        }
+      });
+    }
     if (!relayMetadata) {
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
@@ -3589,6 +3821,15 @@ var SponsorRelayController = class {
     const currentProgress = this.state.deploymentProgress;
     const currentProgressIsForLatestHash = currentProgress.itemHash === itemHash || currentProgress.itemHash == null && currentProgress.stage !== "idle" && currentProgress.stage !== "error";
     const keepTerminalSuccess = this.lastCompletedDeploymentHash === itemHash || currentProgressIsForLatestHash && currentProgress.stage === "completed" && currentProgress.status === "success";
+    if (currentProgressIsForLatestHash && currentProgress.stage === "publishing-bootstrap") {
+      this.trace("progress:retain-active-phase", {
+        reason: "latest refresh would overwrite active relay metadata/bootstrap progress",
+        itemHash,
+        label: currentProgress.label,
+        progress: currentProgress.progress
+      });
+      return;
+    }
     const status = latest.details.messageStatus;
     if (status === "rejected") {
       this.emitProgress({
@@ -4228,10 +4469,11 @@ var SponsorRelayController = class {
             crnHash: candidateCrn.hash,
             crns: this.state.crns,
             crnListUrl: this.props.crnListUrl,
+            requirePublicGuestIpv6ForProxy: true,
             attempts: UI_RUNTIME_WAIT_ATTEMPTS,
             delayMs: UI_RUNTIME_WAIT_DELAY_MS,
             onAttempt: (runtime2, attempt, attempts) => {
-              if (runtime2.hostIpv4 && Object.keys(runtime2.mappedPorts ?? {}).length > 0) {
+              if (runtime2.diagnostics?.state === "ready") {
                 this.emitProgress({
                   stage: "deployment-confirmed",
                   label: "Runtime ready",
@@ -4242,6 +4484,17 @@ var SponsorRelayController = class {
                 });
                 return;
               }
+              if (runtime2.diagnostics?.state === "execution-invalid-public-ipv6") {
+                this.emitProgress({
+                  stage: "deployment-confirmed",
+                  label: "Rejecting unusable runtime",
+                  progress: 91,
+                  status: "warning",
+                  itemHash: result.itemHash,
+                  detail: runtime2.diagnostics?.reason ? `Runtime ${attempt}/${attempts}: ${runtime2.diagnostics.reason} Cleaning up this CRN attempt before retrying another relay host.` : `Runtime ${attempt}/${attempts}: the CRN exposed unusable guest networking. Cleaning up this CRN attempt before retrying another relay host.`
+                });
+                return;
+              }
               this.emitProgress({
                 stage: "deployment-confirmed",
                 label: "Waiting for runtime",
@@ -4252,7 +4505,7 @@ var SponsorRelayController = class {
               });
             }
           });
-          if (!runtime.hostIpv4 || Object.keys(runtime.mappedPorts ?? {}).length === 0) {
+          if (runtime.diagnostics?.state !== "ready") {
             throw new Error(
               runtime.diagnostics?.reason ?? "Deployment was processed, but runtime networking never exposed mapped ports."
             );
@@ -4301,6 +4554,7 @@ var SponsorRelayController = class {
         } catch (error) {
           lastError = error instanceof Error ? error : new Error(String(error));
           const attemptLabel = crnDisplayName;
+          const failedDueToInvalidIpv6 = /not globally routable|public guest IPv6/i.test(lastError.message);
           attemptErrors.push(`${attemptLabel}: ${lastError.message}`);
           this.trace("deploy:crn-attempt-error", {
             crnHash: candidateCrn.hash,
@@ -4309,7 +4563,23 @@ var SponsorRelayController = class {
             error: lastError.message
           });
           if (attemptItemHash) {
+            this.emitProgress({
+              stage: "deployment-confirmed",
+              label: failedDueToInvalidIpv6 ? "Rejecting unusable runtime" : "Cleaning up failed attempt",
+              progress: failedDueToInvalidIpv6 ? 91 : 16,
+              status: "warning",
+              itemHash: attemptItemHash,
+              detail: failedDueToInvalidIpv6 ? `${attemptLabel} exposed runtime networking that cannot support proxy-backed HTTPS. Cleaning up this attempt before retrying another CRN.` : `${attemptLabel} failed: ${lastError.message} Cleaning up this attempt before retrying another CRN.`
+            });
             if (attemptDeploymentToken) {
+              this.emitProgress({
+                stage: "deployment-confirmed",
+                label: "Cleaning up failed attempt",
+                progress: 17,
+                status: "warning",
+                itemHash: attemptItemHash,
+                detail: "Removing bootstrap configuration for the failed attempt. MetaMask may request a cleanup signature."
+              });
               this.trace("deploy:bootstrap-config-cleanup-start", {
                 itemHash: attemptItemHash,
                 deploymentToken: attemptDeploymentToken
@@ -4337,6 +4607,14 @@ var SponsorRelayController = class {
                 });
               });
             }
+            this.emitProgress({
+              stage: "deployment-confirmed",
+              label: "Cleaning up failed attempt",
+              progress: 18,
+              status: "warning",
+              itemHash: attemptItemHash,
+              detail: "Forgetting the failed deployment attempt on Aleph. MetaMask may request another cleanup signature."
+            });
             this.trace("deploy:forget-failed-attempt-start", {
               itemHash: attemptItemHash,
               crnHash: candidateCrn.hash,
@@ -4369,11 +4647,11 @@ var SponsorRelayController = class {
           if (candidateIndex < orderedCrns.length - 1) {
             this.emitProgress({
               stage: "selecting-crn",
-              label: `Retrying after ${crnAttemptLabel}`,
+              label: "Retrying on next CRN",
               progress: 20,
               status: "warning",
               itemHash: attemptItemHash,
-              detail: `${attemptLabel} failed: ${lastError.message}`,
+              detail: `${attemptLabel} was discarded: ${lastError.message}`,
               error: lastError.message
             });
             continue;
@@ -4405,6 +4683,17 @@ var SponsorRelayController = class {
       this.patch({ errorText: "Connect MetaMask before deleting instances." });
       return;
     }
+    const linkedRegistrationHashes = Array.from(
+      new Set(
+        this.state.bootstrapRegistrations.filter((entry) => entry.instanceItemHash === instanceHash).map(
+          (entry) => entry.messageHash?.trim() ?? entry.itemHash?.trim() ?? entry.hash?.trim() ?? null
+        ).filter((value) => Boolean(value))
+      )
+    );
+    const hashesToForget = Array.from(
+      /* @__PURE__ */ new Set([instanceHash, ...linkedRegistrationHashes])
+    );
+    const linkedRegistrationCount = linkedRegistrationHashes.length;
     this.patch({
       busy: { deletingInstanceHash: instanceHash },
       errorText: null,
@@ -4417,12 +4706,12 @@ var SponsorRelayController = class {
         progress: 6,
         status: "warning",
         itemHash: instanceHash,
-        detail: "Preparing Aleph FORGET message."
+        detail: linkedRegistrationCount > 0 ? `Preparing Aleph FORGET message for the instance and ${linkedRegistrationCount} linked bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"}.` : "Preparing Aleph FORGET message."
       });
       await forgetAlephMessages({
         sender: this.state.wallet.address,
-        hashes: [instanceHash],
-        reason: "Deleted from Sponsor Relay panel",
+        hashes: hashesToForget,
+        reason: linkedRegistrationCount > 0 ? `Deleted instance and ${linkedRegistrationCount} linked relay bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"} from Sponsor Relay panel` : "Deleted from Sponsor Relay panel",
         signer: personalSign,
         hasher: sha256Hex,
         fetch: asJsonFetch,
@@ -4441,17 +4730,20 @@ var SponsorRelayController = class {
         progress: 92,
         status: "info",
         itemHash: instanceHash,
-        detail: "Reloading current deployments."
+        detail: linkedRegistrationCount > 0 ? "Reloading current deployments and relay bootstrap registrations." : "Reloading current deployments."
       });
       await this.refresh();
-      this.trace("delete:submitted", { instanceHash });
+      this.trace("delete:submitted", {
+        instanceHash,
+        linkedRegistrationHashes
+      });
       this.emitProgress({
         stage: "completed",
         label: "Delete completed",
         progress: 100,
         status: "success",
         itemHash: instanceHash,
-        detail: "Delete request submitted and deployments refreshed.",
+        detail: linkedRegistrationCount > 0 ? `Delete request submitted, including ${linkedRegistrationCount} linked bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"}, and state refreshed.` : "Delete request submitted and deployments refreshed.",
         error: null
       });
     } catch (error) {

package/shared/index.d.ts

@@ -309,7 +309,7 @@ declare const STALE_INSTANCE_ALLOCATION_COOLDOWN_MS: number;
 declare const RECENT_INSTANCE_RUNTIME_GRACE_MS: number;
 declare const DEPLOYMENT_PENDING_WARNING_MS: number;
 
-declare const UI_PACKAGE_VERSION = "0.4.1";
+declare const UI_PACKAGE_VERSION = "0.4.2";
 
 interface RootfsRequiredPortForward {
     port: number;

package/shared/index.js

@@ -27,7 +27,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.4.1";
+var UI_PACKAGE_VERSION = "0.4.2";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1236,16 +1236,6 @@ function normalizeBroadcastStatus(httpStatus, responseStatus) {
   if (httpStatus === 202) return "pending";
   return normalizeMessageStatus2(responseStatus);
 }
-function isInvalidMessageFormatResponse2(response, payload) {
-  if (response.status !== 422) return false;
-  const details = payload?.details;
-  if (typeof details === "string" && details.includes("InvalidMessageFormat")) return true;
-  if (details && typeof details === "object") {
-    const detailMessage = details.message;
-    if (typeof detailMessage === "string" && detailMessage.includes("InvalidMessageFormat")) return true;
-  }
-  return false;
-}
 function isRetryableBroadcastFailure(response, payload) {
   if (response.status >= 500) return true;
   const publicationStatus = payload?.publication_status?.status;
@@ -1267,25 +1257,22 @@ async function postBroadcastPayload2(body, options) {
   };
 }
 async function broadcastAlephMessage2(message, options) {
-  const attempts = [
-    { sync: options.sync ?? false, message },
-    { ...message, sync: options.sync ?? false },
-    { ...message }
-  ];
-  for (let index = 0; index < attempts.length; index += 1) {
-    const result = await postBroadcastPayload2(attempts[index], {
+  const requestBody = { sync: options.sync ?? false, message };
+  const maxAttempts = 3;
+  for (let index = 0; index < maxAttempts; index += 1) {
+    const result = await postBroadcastPayload2(requestBody, {
       apiHost: options.apiHost,
       fetch: options.fetch
     });
     if (result.httpStatus === 202 || normalizeBroadcastStatus(result.httpStatus, result.response?.message_status) !== "unknown" || result.httpStatus >= 200 && result.httpStatus < 300) {
       return result;
     }
-    const canRetry = index < attempts.length - 1 && (isInvalidMessageFormatResponse2({ status: result.httpStatus }, result.response) || isRetryableBroadcastFailure({ status: result.httpStatus }, result.response));
+    const canRetry = index < maxAttempts - 1 && isRetryableBroadcastFailure({ status: result.httpStatus }, result.response);
     if (!canRetry) {
       throw new Error(`Broadcast failed: ${result.httpStatus} ${JSON.stringify(result.response ?? {})}`);
     }
   }
-  throw new Error("Broadcast failed: no compatible request format was accepted");
+  throw new Error("Broadcast failed: retry budget exhausted");
 }
 
 // ../core/src/forget.ts
@@ -1652,6 +1639,26 @@ function asString3(value) {
 function asNumber3(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
+function normalizeIpv6(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  if (!normalized) return null;
+  const zoneIndex = normalized.indexOf("%");
+  return zoneIndex >= 0 ? normalized.slice(0, zoneIndex) : normalized;
+}
+function isLikelyGlobalIpv6(value) {
+  const normalized = normalizeIpv6(value);
+  if (!normalized || normalized === "::" || normalized === "::1") return false;
+  const firstHextetText = normalized.split(":", 1)[0];
+  if (!firstHextetText) return false;
+  const firstHextet = Number.parseInt(firstHextetText, 16);
+  if (!Number.isFinite(firstHextet)) return false;
+  if ((firstHextet & 65024) === 64512) return false;
+  if ((firstHextet & 65472) === 65152) return false;
+  if ((firstHextet & 65280) === 65280) return false;
+  if ((firstHextet & 65472) === 65216) return false;
+  return true;
+}
 function findCrnByHash(crns, crnHash) {
   return crns.find((crn) => crn.hash === crnHash) ?? null;
 }
@@ -1732,10 +1739,22 @@ function describeRuntimeAvailability(runtime) {
   const execution = runtime.execution ?? null;
   const mappedPorts2 = runtime.mappedPorts ?? {};
   const hostIpv4 = runtime.hostIpv4 ?? null;
+  const ipv6 = runtime.ipv6 ?? null;
   const proxyUrl = runtime.proxyUrl ?? null;
   const schedulerSource = runtime.allocation?.source ?? null;
   const webAccessActive = runtime.webAccess?.active ?? null;
   const mappedPortCount = Object.keys(mappedPorts2).length;
+  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && !isLikelyGlobalIpv6(ipv6)) {
+    return {
+      state: "execution-invalid-public-ipv6",
+      reason: `The CRN exposed runtime networking, but the guest IPv6${ipv6 ? ` (${ipv6})` : ""} is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
+      schedulerSource,
+      executionSeen: Boolean(execution),
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
   if (hostIpv4 && mappedPortCount > 0) {
     return {
       state: "ready",
@@ -1852,7 +1871,8 @@ async function fetchVmRuntime(args) {
     hostIpv4,
     ipv6,
     proxyUrl,
-    mappedPorts: mappedPorts2
+    mappedPorts: mappedPorts2,
+    requirePublicGuestIpv6ForProxy: args.requirePublicGuestIpv6ForProxy
   });
   return {
     allocation,
@@ -1876,7 +1896,7 @@ async function waitForVmRuntime(args) {
   let lastRuntime = await fetchVmRuntime(args);
   args.onAttempt?.(lastRuntime, 1, attempts);
   for (let attempt = 0; attempt < attempts - 1; attempt += 1) {
-    if (lastRuntime.hostIpv4 && Object.keys(lastRuntime.mappedPorts ?? {}).length > 0) {
+    if (lastRuntime.diagnostics?.state === "ready" || lastRuntime.diagnostics?.state === "execution-invalid-public-ipv6") {
       return lastRuntime;
     }
     await sleep2(delayMs);
@@ -2675,6 +2695,16 @@ async function publishRelayBootstrapRegistration(args) {
 
 // ../core/src/bootstrap-config.ts
 var VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY = "vm-bootstrap-config";
+var VM_BOOTSTRAP_CONFIG_SIGNAL_REF = "vm-bootstrap-config";
+var VM_BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE = "vm-bootstrap-config-status";
+function parseJsonObject(value) {
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
 async function fetchVmBootstrapConfigAggregate(address, options) {
   const requestUrl = new URL(`/api/v0/aggregates/${address}.json`, options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
   requestUrl.searchParams.set("keys", VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY);
@@ -2794,6 +2824,89 @@ async function deleteVmBootstrapConfig(args) {
     aggregate: content
   };
 }
+function normalizeVmBootstrapConfigSignalRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const deploymentToken = typeof candidate.deploymentToken === "string" ? candidate.deploymentToken.trim() : "";
+  const status = typeof candidate.status === "string" ? candidate.status.trim() : "";
+  const profile = typeof candidate.profile === "string" ? candidate.profile.trim() : "";
+  const ownerAddress = typeof candidate.ownerAddress === "string" ? candidate.ownerAddress.trim() : "";
+  const instanceItemHash = typeof candidate.instanceItemHash === "string" ? candidate.instanceItemHash.trim() : "";
+  const updatedAt = typeof candidate.updatedAt === "string" ? candidate.updatedAt.trim() : "";
+  if (!deploymentToken || !status || !profile || !ownerAddress || !instanceItemHash || !updatedAt) {
+    return null;
+  }
+  return {
+    deploymentToken,
+    status,
+    profile,
+    ownerAddress,
+    instanceItemHash,
+    updatedAt,
+    publisherAddress: typeof candidate.publisherAddress === "string" && candidate.publisherAddress.trim() ? candidate.publisherAddress.trim() : null,
+    authorization: candidate.authorization,
+    peerId: typeof candidate.peerId === "string" && candidate.peerId.trim() ? candidate.peerId.trim() : null,
+    probeMultiaddrs: Array.isArray(candidate.probeMultiaddrs) ? candidate.probeMultiaddrs.filter(
+      (entry) => typeof entry === "string" && entry.trim().length > 0
+    ) : [],
+    browserBootstrapMultiaddrs: Array.isArray(candidate.browserBootstrapMultiaddrs) ? candidate.browserBootstrapMultiaddrs.filter(
+      (entry) => typeof entry === "string" && entry.trim().length > 0
+    ) : []
+  };
+}
+async function fetchVmBootstrapConfigSignals(args) {
+  const requestUrl = new URL("/api/v0/posts.json", args.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+  requestUrl.searchParams.set("refs", args.ref ?? VM_BOOTSTRAP_CONFIG_SIGNAL_REF);
+  requestUrl.searchParams.set("types", args.postType ?? VM_BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE);
+  requestUrl.searchParams.set("pagination", String(Math.max(1, Number(args.pagination ?? 100))));
+  requestUrl.searchParams.set("page", String(Math.max(1, Number(args.page ?? 1))));
+  requestUrl.searchParams.set("sortOrder", "-1");
+  const response = await args.fetch(requestUrl.toString(), { cache: "no-cache" });
+  if (!response.ok) {
+    throw new Error(`VM bootstrap config signal request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const expectedDeploymentToken = args.deploymentToken?.trim() ?? "";
+  const expectedOwnerAddress = args.ownerAddress?.trim().toLowerCase() ?? "";
+  const expectedInstanceItemHash = args.instanceItemHash?.trim() ?? "";
+  return (payload.posts ?? []).map((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const parsed = "content" in entry && entry.content && typeof entry.content === "object" && !Array.isArray(entry.content) ? entry.content : "item_content" in entry && typeof entry.item_content === "string" ? parseJsonObject(entry.item_content) : null;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const content = "deploymentToken" in parsed ? parsed : "content" in parsed && parsed.content && typeof parsed.content === "object" && !Array.isArray(parsed.content) ? parsed.content : null;
+    if (!content || typeof content !== "object" || Array.isArray(content)) return null;
+    return normalizeVmBootstrapConfigSignalRecord(content);
+  }).filter((entry) => {
+    if (!entry) return false;
+    if (expectedDeploymentToken && entry.deploymentToken !== expectedDeploymentToken) return false;
+    if (expectedOwnerAddress && entry.ownerAddress.toLowerCase() !== expectedOwnerAddress) return false;
+    if (expectedInstanceItemHash && entry.instanceItemHash !== expectedInstanceItemHash) return false;
+    return true;
+  });
+}
+async function waitForVmBootstrapConfigSignal(args) {
+  const attempts = Math.max(1, Number(args.attempts ?? 24));
+  const delayMs = Math.max(0, Number(args.delayMs ?? 2500));
+  const sleep2 = args.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const expectedStatus = args.expectedStatus ?? "applied";
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    const signals = await fetchVmBootstrapConfigSignals({
+      deploymentToken: args.deploymentToken,
+      ownerAddress: args.ownerAddress,
+      instanceItemHash: args.instanceItemHash,
+      fetch: args.fetch,
+      apiHost: args.apiHost,
+      ref: args.ref,
+      postType: args.postType
+    }).catch(() => []);
+    const match = signals.find((entry) => entry.status === expectedStatus) ?? null;
+    if (match) return match;
+    if (attempt < attempts - 1) {
+      await sleep2(delayMs);
+    }
+  }
+  return null;
+}
 
 // ../core/src/bootstrap-reconcile.ts
 function createRelayBootstrapRegistrationId(profile, instanceName, itemHash) {
@@ -3279,11 +3392,13 @@ var SponsorRelayController = class {
     if (!args.runtime.hostIpv4) {
       throw new Error("Relay runtime did not expose a host IPv4 address.");
     }
-    const mappedPorts2 = args.runtime.mappedPorts ?? {};
+    let runtime = args.runtime;
+    let mappedPorts2 = runtime.mappedPorts ?? {};
     const setupPort = mappedPorts2["80"]?.host ?? null;
     if (!setupPort) {
       throw new Error("Relay runtime did not expose the temporary setup endpoint.");
     }
+    let bootstrapSignalRelayMetadata = null;
     if (profile === "orbitdb-relay-pinner") {
       this.emitProgress({
         stage: "deployment-confirmed",
@@ -3352,6 +3467,57 @@ var SponsorRelayController = class {
       if (!args.deploymentToken) {
         throw new Error("Missing deployment token for Aleph bootstrap config handoff.");
       }
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.emitProgress({
+          stage: "deployment-confirmed",
+          label: "Waiting for HTTPS route",
+          progress: 93,
+          status: "warning",
+          itemHash: args.itemHash,
+          detail: "The relay received a 2n6 hostname, but it is not active yet. Waiting before handing HTTPS config to the guest."
+        });
+        let latestRuntime = runtime;
+        for (let attempt = 0; attempt < UI_RUNTIME_WAIT_ATTEMPTS; attempt += 1) {
+          if (latestRuntime.webAccess?.active === true) {
+            break;
+          }
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_RUNTIME_WAIT_DELAY_MS)
+          );
+          latestRuntime = await fetchVmRuntime({
+            itemHash: args.itemHash,
+            fetch: (url, init) => fetch(url, init),
+            crnHash: runtime.selectedCrn?.hash ?? runtime.allocation?.crnHash ?? void 0,
+            crns: this.state.crns,
+            crnListUrl: this.props.crnListUrl,
+            requirePublicGuestIpv6ForProxy: true
+          }).catch(() => latestRuntime);
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: "Waiting for HTTPS route",
+            progress: 93,
+            status: latestRuntime.webAccess?.active === true ? "info" : "warning",
+            itemHash: args.itemHash,
+            detail: `2n6 activation ${attempt + 1}/${UI_RUNTIME_WAIT_ATTEMPTS}: ${latestRuntime.webAccess?.active === true ? "active" : "still pending"} for ${latestRuntime.proxyUrl ?? runtime.proxyUrl ?? "reserved proxy URL"}.`
+          });
+          this.trace("deploy:bootstrap-proxy-activation", {
+            itemHash: args.itemHash,
+            attempt: attempt + 1,
+            attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+            active: latestRuntime.webAccess?.active === true,
+            proxyUrl: latestRuntime.proxyUrl ?? null
+          });
+        }
+        runtime = latestRuntime;
+        mappedPorts2 = runtime.mappedPorts ?? mappedPorts2;
+      }
+      if (!runtime.hostIpv4) {
+        throw new Error(
+          "Relay runtime lost its host IPv4 address while waiting for HTTPS activation."
+        );
+      }
+      const runtimeHostIpv4 = runtime.hostIpv4;
+      const activeProxyUrl = runtime.webAccess?.active === true ? runtime.proxyUrl ?? null : null;
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Publishing relay config",
@@ -3369,9 +3535,9 @@ var SponsorRelayController = class {
         expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
         status: "pending",
         runtime: {
-          publicIpv4: args.runtime.hostIpv4,
-          publicIpv6: args.runtime.ipv6 ?? null,
-          proxyUrl: args.runtime.proxyUrl ?? null,
+          publicIpv4: runtimeHostIpv4,
+          publicIpv6: runtime.ipv6 ?? null,
+          proxyUrl: activeProxyUrl,
           mappedPorts: mappedPorts2
         },
         bootstrap: {
@@ -3400,54 +3566,120 @@ var SponsorRelayController = class {
         aggregateItemHash: bootstrapConfigPublication.aggregateItemHash,
         aggregateStatus: bootstrapConfigPublication.aggregateStatus
       });
-    }
-    this.emitProgress({
-      stage: "publishing-bootstrap",
-      label: "Reading relay multiaddrs",
-      progress: 95,
-      status: "info",
-      itemHash: args.itemHash,
-      detail: "Waiting for the relay to report its final public multiaddrs."
-    });
-    const relayMetadata = await fetchRelayMetadataForRuntime({
-      runtime: args.runtime,
-      fetch: (url, init) => fetch(url, init),
-      preferSecureMetadata: profile === "uc-go-peer",
-      attempts: 80,
-      delayMs: 3e3,
-      timeoutMs: 24e4,
-      onAttempt: (result) => {
-        const payload = result.payload && typeof result.payload === "object" ? result.payload : null;
-        const metadata = payload?.metadata && typeof payload.metadata === "object" ? payload.metadata : null;
-        this.trace("deploy:relay-metadata-attempt", {
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Waiting for guest config",
+        progress: 94,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Waiting for the relay VM to acknowledge that it consumed the Aleph bootstrap config."
+      });
+      const bootstrapConfigSignal = await waitForVmBootstrapConfigSignal({
+        deploymentToken: args.deploymentToken,
+        ownerAddress: this.state.wallet.address,
+        instanceItemHash: args.itemHash,
+        fetch: asJsonFetch,
+        apiHost: this.client.apiHost,
+        attempts: 40,
+        delayMs: 3e3
+      });
+      this.trace("deploy:bootstrap-config-signal-visible", {
+        itemHash: args.itemHash,
+        deploymentToken: args.deploymentToken,
+        bootstrapConfigSignal
+      });
+      if (!bootstrapConfigSignal) {
+        throw new Error(
+          "The relay VM did not confirm that it applied the Aleph bootstrap config in time."
+        );
+      }
+      bootstrapSignalRelayMetadata = typeof bootstrapConfigSignal.peerId === "string" && bootstrapConfigSignal.peerId.length > 0 && Array.isArray(bootstrapConfigSignal.probeMultiaddrs) && bootstrapConfigSignal.probeMultiaddrs.length > 0 ? {
+        peerId: bootstrapConfigSignal.peerId,
+        probeMultiaddrs: bootstrapConfigSignal.probeMultiaddrs,
+        browserBootstrapMultiaddrs: bootstrapConfigSignal.browserBootstrapMultiaddrs ?? []
+      } : null;
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.trace("deploy:bootstrap-proxy-fallback", {
           itemHash: args.itemHash,
-          attempt: result.attempt,
-          attempts: result.attempts,
-          requestUrl: result.requestUrl,
-          metadataUrl: result.metadataUrl,
-          hostIpv4: result.hostIpv4,
-          setupPort: result.setupPort,
-          ok: result.ok,
-          status: result.status,
-          ready: result.ready,
-          error: result.error ?? null,
-          payloadStatus: payload && typeof payload.status === "string" ? payload.status : null,
-          peerId: metadata && typeof metadata.peer_id === "string" ? metadata.peer_id : null,
-          probeMultiaddrCount: Array.isArray(metadata?.probe_multiaddrs) ? metadata.probe_multiaddrs.length : 0,
-          browserBootstrapMultiaddrCount: Array.isArray(
-            metadata?.browser_bootstrap_multiaddrs
-          ) ? metadata.browser_bootstrap_multiaddrs.length : 0
+          deploymentToken: args.deploymentToken,
+          proxyUrl: runtime.proxyUrl,
+          bootstrapSignalRelayMetadata
         });
         this.emitProgress({
-          stage: "publishing-bootstrap",
-          label: "Reading relay multiaddrs",
-          progress: 95,
-          status: result.ready ? "success" : "info",
+          stage: "deployment-confirmed",
+          label: "Continuing without HTTPS route",
+          progress: 94,
+          status: "warning",
           itemHash: args.itemHash,
-          detail: result.ready ? `Relay metadata ${result.attempt}/${result.attempts}: public multiaddrs available.` : `Relay metadata ${result.attempt}/${result.attempts}: waiting for the relay to report public multiaddrs.`
+          detail: "The 2n6 HTTPS route stayed inactive, so guest setup continued without Caddy. Secure browser routing can be enabled later when the proxy becomes available."
         });
+        runtime = {
+          ...runtime,
+          proxyUrl: null,
+          webAccess: runtime.webAccess ? {
+            ...runtime.webAccess,
+            active: false
+          } : runtime.webAccess
+        };
       }
-    });
+    }
+    let relayMetadata = bootstrapSignalRelayMetadata;
+    if (relayMetadata) {
+      this.trace("deploy:relay-metadata-from-bootstrap-signal", {
+        itemHash: args.itemHash,
+        peerId: relayMetadata.peerId,
+        probeMultiaddrCount: relayMetadata.probeMultiaddrs.length,
+        browserBootstrapMultiaddrCount: relayMetadata.browserBootstrapMultiaddrs.length
+      });
+    } else {
+      this.emitProgress({
+        stage: "publishing-bootstrap",
+        label: "Waiting for secure relay metadata",
+        progress: 95,
+        status: "warning",
+        itemHash: args.itemHash,
+        detail: "Runtime networking is available. Waiting for the secure relay metadata endpoint to report final public multiaddrs."
+      });
+      relayMetadata = await fetchRelayMetadataForRuntime({
+        runtime,
+        fetch: (url, init) => fetch(url, init),
+        preferSecureMetadata: profile === "uc-go-peer" && Boolean(runtime.proxyUrl),
+        attempts: 80,
+        delayMs: 3e3,
+        timeoutMs: 24e4,
+        onAttempt: (result) => {
+          const payload = result.payload && typeof result.payload === "object" ? result.payload : null;
+          const metadata = payload?.metadata && typeof payload.metadata === "object" ? payload.metadata : null;
+          this.trace("deploy:relay-metadata-attempt", {
+            itemHash: args.itemHash,
+            attempt: result.attempt,
+            attempts: result.attempts,
+            requestUrl: result.requestUrl,
+            metadataUrl: result.metadataUrl,
+            hostIpv4: result.hostIpv4,
+            setupPort: result.setupPort,
+            ok: result.ok,
+            status: result.status,
+            ready: result.ready,
+            error: result.error ?? null,
+            payloadStatus: payload && typeof payload.status === "string" ? payload.status : null,
+            peerId: metadata && typeof metadata.peer_id === "string" ? metadata.peer_id : null,
+            probeMultiaddrCount: Array.isArray(metadata?.probe_multiaddrs) ? metadata.probe_multiaddrs.length : 0,
+            browserBootstrapMultiaddrCount: Array.isArray(
+              metadata?.browser_bootstrap_multiaddrs
+            ) ? metadata.browser_bootstrap_multiaddrs.length : 0
+          });
+          this.emitProgress({
+            stage: "publishing-bootstrap",
+            label: result.ready ? "Secure relay metadata ready" : "Waiting for secure relay metadata",
+            progress: 95,
+            status: result.ready ? "success" : "warning",
+            itemHash: args.itemHash,
+            detail: result.ready ? `Relay metadata ${result.attempt}/${result.attempts}: secure endpoint responded and public multiaddrs are available.` : `Relay metadata ${result.attempt}/${result.attempts}: waiting for ${result.metadataUrl}.`
+          });
+        }
+      });
+    }
     if (!relayMetadata) {
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
@@ -3588,6 +3820,15 @@ var SponsorRelayController = class {
     const currentProgress = this.state.deploymentProgress;
     const currentProgressIsForLatestHash = currentProgress.itemHash === itemHash || currentProgress.itemHash == null && currentProgress.stage !== "idle" && currentProgress.stage !== "error";
     const keepTerminalSuccess = this.lastCompletedDeploymentHash === itemHash || currentProgressIsForLatestHash && currentProgress.stage === "completed" && currentProgress.status === "success";
+    if (currentProgressIsForLatestHash && currentProgress.stage === "publishing-bootstrap") {
+      this.trace("progress:retain-active-phase", {
+        reason: "latest refresh would overwrite active relay metadata/bootstrap progress",
+        itemHash,
+        label: currentProgress.label,
+        progress: currentProgress.progress
+      });
+      return;
+    }
     const status = latest.details.messageStatus;
     if (status === "rejected") {
       this.emitProgress({
@@ -4227,10 +4468,11 @@ var SponsorRelayController = class {
             crnHash: candidateCrn.hash,
             crns: this.state.crns,
             crnListUrl: this.props.crnListUrl,
+            requirePublicGuestIpv6ForProxy: true,
             attempts: UI_RUNTIME_WAIT_ATTEMPTS,
             delayMs: UI_RUNTIME_WAIT_DELAY_MS,
             onAttempt: (runtime2, attempt, attempts) => {
-              if (runtime2.hostIpv4 && Object.keys(runtime2.mappedPorts ?? {}).length > 0) {
+              if (runtime2.diagnostics?.state === "ready") {
                 this.emitProgress({
                   stage: "deployment-confirmed",
                   label: "Runtime ready",
@@ -4241,6 +4483,17 @@ var SponsorRelayController = class {
                 });
                 return;
               }
+              if (runtime2.diagnostics?.state === "execution-invalid-public-ipv6") {
+                this.emitProgress({
+                  stage: "deployment-confirmed",
+                  label: "Rejecting unusable runtime",
+                  progress: 91,
+                  status: "warning",
+                  itemHash: result.itemHash,
+                  detail: runtime2.diagnostics?.reason ? `Runtime ${attempt}/${attempts}: ${runtime2.diagnostics.reason} Cleaning up this CRN attempt before retrying another relay host.` : `Runtime ${attempt}/${attempts}: the CRN exposed unusable guest networking. Cleaning up this CRN attempt before retrying another relay host.`
+                });
+                return;
+              }
               this.emitProgress({
                 stage: "deployment-confirmed",
                 label: "Waiting for runtime",
@@ -4251,7 +4504,7 @@ var SponsorRelayController = class {
               });
             }
           });
-          if (!runtime.hostIpv4 || Object.keys(runtime.mappedPorts ?? {}).length === 0) {
+          if (runtime.diagnostics?.state !== "ready") {
             throw new Error(
               runtime.diagnostics?.reason ?? "Deployment was processed, but runtime networking never exposed mapped ports."
             );
@@ -4300,6 +4553,7 @@ var SponsorRelayController = class {
         } catch (error) {
           lastError = error instanceof Error ? error : new Error(String(error));
           const attemptLabel = crnDisplayName;
+          const failedDueToInvalidIpv6 = /not globally routable|public guest IPv6/i.test(lastError.message);
           attemptErrors.push(`${attemptLabel}: ${lastError.message}`);
           this.trace("deploy:crn-attempt-error", {
             crnHash: candidateCrn.hash,
@@ -4308,7 +4562,23 @@ var SponsorRelayController = class {
             error: lastError.message
           });
           if (attemptItemHash) {
+            this.emitProgress({
+              stage: "deployment-confirmed",
+              label: failedDueToInvalidIpv6 ? "Rejecting unusable runtime" : "Cleaning up failed attempt",
+              progress: failedDueToInvalidIpv6 ? 91 : 16,
+              status: "warning",
+              itemHash: attemptItemHash,
+              detail: failedDueToInvalidIpv6 ? `${attemptLabel} exposed runtime networking that cannot support proxy-backed HTTPS. Cleaning up this attempt before retrying another CRN.` : `${attemptLabel} failed: ${lastError.message} Cleaning up this attempt before retrying another CRN.`
+            });
             if (attemptDeploymentToken) {
+              this.emitProgress({
+                stage: "deployment-confirmed",
+                label: "Cleaning up failed attempt",
+                progress: 17,
+                status: "warning",
+                itemHash: attemptItemHash,
+                detail: "Removing bootstrap configuration for the failed attempt. MetaMask may request a cleanup signature."
+              });
               this.trace("deploy:bootstrap-config-cleanup-start", {
                 itemHash: attemptItemHash,
                 deploymentToken: attemptDeploymentToken
@@ -4336,6 +4606,14 @@ var SponsorRelayController = class {
                 });
               });
             }
+            this.emitProgress({
+              stage: "deployment-confirmed",
+              label: "Cleaning up failed attempt",
+              progress: 18,
+              status: "warning",
+              itemHash: attemptItemHash,
+              detail: "Forgetting the failed deployment attempt on Aleph. MetaMask may request another cleanup signature."
+            });
             this.trace("deploy:forget-failed-attempt-start", {
               itemHash: attemptItemHash,
               crnHash: candidateCrn.hash,
@@ -4368,11 +4646,11 @@ var SponsorRelayController = class {
           if (candidateIndex < orderedCrns.length - 1) {
             this.emitProgress({
               stage: "selecting-crn",
-              label: `Retrying after ${crnAttemptLabel}`,
+              label: "Retrying on next CRN",
               progress: 20,
               status: "warning",
               itemHash: attemptItemHash,
-              detail: `${attemptLabel} failed: ${lastError.message}`,
+              detail: `${attemptLabel} was discarded: ${lastError.message}`,
               error: lastError.message
             });
             continue;
@@ -4404,6 +4682,17 @@ var SponsorRelayController = class {
       this.patch({ errorText: "Connect MetaMask before deleting instances." });
       return;
     }
+    const linkedRegistrationHashes = Array.from(
+      new Set(
+        this.state.bootstrapRegistrations.filter((entry) => entry.instanceItemHash === instanceHash).map(
+          (entry) => entry.messageHash?.trim() ?? entry.itemHash?.trim() ?? entry.hash?.trim() ?? null
+        ).filter((value) => Boolean(value))
+      )
+    );
+    const hashesToForget = Array.from(
+      /* @__PURE__ */ new Set([instanceHash, ...linkedRegistrationHashes])
+    );
+    const linkedRegistrationCount = linkedRegistrationHashes.length;
     this.patch({
       busy: { deletingInstanceHash: instanceHash },
       errorText: null,
@@ -4416,12 +4705,12 @@ var SponsorRelayController = class {
         progress: 6,
         status: "warning",
         itemHash: instanceHash,
-        detail: "Preparing Aleph FORGET message."
+        detail: linkedRegistrationCount > 0 ? `Preparing Aleph FORGET message for the instance and ${linkedRegistrationCount} linked bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"}.` : "Preparing Aleph FORGET message."
       });
       await forgetAlephMessages({
         sender: this.state.wallet.address,
-        hashes: [instanceHash],
-        reason: "Deleted from Sponsor Relay panel",
+        hashes: hashesToForget,
+        reason: linkedRegistrationCount > 0 ? `Deleted instance and ${linkedRegistrationCount} linked relay bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"} from Sponsor Relay panel` : "Deleted from Sponsor Relay panel",
         signer: personalSign,
         hasher: sha256Hex,
         fetch: asJsonFetch,
@@ -4440,17 +4729,20 @@ var SponsorRelayController = class {
         progress: 92,
         status: "info",
         itemHash: instanceHash,
-        detail: "Reloading current deployments."
+        detail: linkedRegistrationCount > 0 ? "Reloading current deployments and relay bootstrap registrations." : "Reloading current deployments."
       });
       await this.refresh();
-      this.trace("delete:submitted", { instanceHash });
+      this.trace("delete:submitted", {
+        instanceHash,
+        linkedRegistrationHashes
+      });
       this.emitProgress({
         stage: "completed",
         label: "Delete completed",
         progress: 100,
         status: "success",
         itemHash: instanceHash,
-        detail: "Delete request submitted and deployments refreshed.",
+        detail: linkedRegistrationCount > 0 ? `Delete request submitted, including ${linkedRegistrationCount} linked bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"}, and state refreshed.` : "Delete request submitted and deployments refreshed.",
         error: null
       });
     } catch (error) {