@mcsherrylabs/pi-meerkat 0.6.0 → 0.8.0

package/dist/installer-runtime/dist/src/registry/dependencies.js

@@ -0,0 +1,28 @@
+// Registry-specific bounded network collaborators, independent of processor lifecycle and env.
+// The production shared worker uses this one composition; there is no transitional collector.
+import { channelTerms, groupMembers } from "../announcements.js";
+import { fetchDetail } from "./detail.js";
+import { decideControl } from "./ownership.js";
+export function registryDependencies(options, say) {
+    return {
+        channel: options.channel, operator: options.operator, maxLeaseRounds: options.maxLeaseRounds,
+        deny: new Set(options.deny), say,
+        decideControl: (sender, ledgerId) => decideControl({
+            sender, ledgerId,
+            readTerms: (id) => channelTerms(options.chainUrl, id),
+            readGroupMembers: async (group) => {
+                const read = await groupMembers(options.chainUrl, group);
+                if (!read.known)
+                    return { known: false, why: "group membership unreadable" };
+                return "absent" in read ? { known: true, members: [] } : { known: true, members: read.members };
+            },
+        }),
+        fetchDetail: async (detail) => {
+            if (options.contentUrl === null)
+                return { ok: false, reason: "this registry has no content endpoint configured (REGISTRY_CONTENT_URL), so the " +
+                        "document was not fetched — the description is indexed, the document is not" };
+            const read = await fetchDetail({ contentUrl: options.contentUrl, detail });
+            return read.ok ? { ok: true, bytes: read.bytes } : { ok: false, reason: read.reason };
+        },
+    };
+}

package/dist/installer-runtime/dist/src/registry/detail.js

@@ -0,0 +1,87 @@
+// The detail document: fetched by the registry, read by an agent.
+//
+// Two bounds, for two different reasons. The DIGEST, because the announcement supplies it and
+// without checking it the registry would trust the announcer twice — once for the description,
+// once for whatever the content store happens to return under that key. The SIZE, because an
+// agent reads this document, and because it is the guard on the registry's own fetcher.
+//
+// ⚠️ Two hashes exist deliberately (144): above the node's chunk threshold the content key is a
+// MANIFEST hash, so a single `sha256(bytes)` could not address a chunked object at all. The
+// announcement carries both; this verifies the ASSEMBLED bytes against `sha256`.
+import { createHash } from "node:crypto";
+import { CHAIN_TIMEOUT_MS } from "../chainfetch.js";
+/** 64 KiB. An agent reads this document, so the bound protects a context as much as a disk. */
+export const MAX_DETAIL_BYTES = 64 * 1024;
+export async function fetchDetail(args) {
+    const { detail } = args;
+    // The ANNOUNCED size is checked first, so an over-size document costs nothing to refuse. It
+    // is only a claim, which is why the real bytes are checked as well below.
+    if (detail.bytes > MAX_DETAIL_BYTES)
+        return { ok: false, reason: `announced ${detail.bytes} bytes, the limit is ${MAX_DETAIL_BYTES}` };
+    const f = args.fetchImpl ?? fetch;
+    let res;
+    try {
+        res = await f(`${args.contentUrl}/content/${encodeURIComponent(detail.key)}`, { signal: AbortSignal.timeout(args.timeoutMs ?? CHAIN_TIMEOUT_MS) });
+    }
+    catch (e) {
+        // A reason, never a throw: the drainer must be able to mark the entry and carry on, and an
+        // exception here would take the whole walk down over one broken document.
+        return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+    }
+    // A 403 is the read-ACL case (142): the document exists and is not readable, which makes it
+    // undiscoverable rather than fatal — the entry stands, marked.
+    if (!res.ok)
+        return { ok: false, reason: `HTTP ${res.status}`.trim() };
+    let bytes;
+    try {
+        bytes = new Uint8Array(await res.arrayBuffer());
+    }
+    catch (e) {
+        return { ok: false, reason: `unreadable body: ${e instanceof Error ? e.message : String(e)}` };
+    }
+    if (bytes.byteLength > MAX_DETAIL_BYTES)
+        return { ok: false, reason: `body is ${bytes.byteLength} bytes, the limit is ${MAX_DETAIL_BYTES} (announced ${detail.bytes})` };
+    const got = createHash("sha256").update(bytes).digest("hex");
+    if (got !== detail.sha256)
+        return { ok: false, reason: `digest mismatch: announced ${detail.sha256.slice(0, 12)}…, got ${got.slice(0, 12)}…` };
+    return { ok: true, bytes };
+}
+/**
+ * Resolve the `detail` reference an announcement will carry, uploading the document unless the
+ * caller named a key for one already published elsewhere.
+ *
+ * ⚠️ THE KEY COMES FROM THE NODE, NOT FROM US. Above the node's chunk threshold it is a MANIFEST
+ * hash, so `sha256(bytes)` could not address the object at all — which is why an announcement
+ * carries both, and why the old guess was only ever right for small documents.
+ *
+ * `sha256` stays OUR computation over the bytes we read. It is the announcer's commitment, and a
+ * registry verifies the assembled bytes against it before indexing; deriving it from anything the
+ * node said would turn that check into a conversation with itself.
+ */
+export async function publishDetail(args) {
+    const { bytes, contentUrl, explicitKey, publisher, say } = args;
+    if (bytes.byteLength > MAX_DETAIL_BYTES)
+        throw new Error(`the document is ${bytes.byteLength} bytes; the registry refuses a detail ` +
+            `document over ${MAX_DETAIL_BYTES}. Shorten it, or link to it from the summary.`);
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    // An explicit key means "already published, elsewhere". Honoured WITHOUT uploading — uploading
+    // as well would leave two objects and announce the wrong one.
+    if (explicitKey && explicitKey.length > 0) {
+        say(`   --detail-key given: NOT uploading. The announcement points at '${explicitKey}', ` +
+            `which must already be fetchable from the registry's content endpoint.`);
+        return { key: explicitKey, sha256, bytes: bytes.byteLength };
+    }
+    if (contentUrl === null)
+        throw new Error(`a detail document needs REGISTRY_CONTENT_URL: it is the node content endpoint this ` +
+            `command uploads the document to, and the same one the registry later reads it back ` +
+            `from. Without it the announcement would commit to a document that exists nowhere — ` +
+            `which is what this command used to do. Point it at a content-enabled node you can ` +
+            `reach (e.g. http://127.0.0.1:8450), or announce without a detail document.`);
+    const published = await publisher().postContent(bytes);
+    if (published.size !== bytes.byteLength)
+        throw new Error(`the content endpoint stored ${published.size} bytes of a ` +
+            `${bytes.byteLength}-byte document — refusing to announce a key over bytes ` +
+            `that are not the ones read`);
+    say(`   uploaded ${bytes.byteLength} bytes to ${contentUrl} → key ${published.key.slice(0, 12)}…`);
+    return { key: published.key, sha256, bytes: bytes.byteLength };
+}

package/dist/installer-runtime/dist/src/registry/drainer.js

@@ -0,0 +1,131 @@
+// Registry indexing policy, invoked by the processor's ONE ordered walk (FR-029).
+// This code never polls the cursor; the supplied store stays on that processor's database owner.
+//
+// ⚠️ Two platform facts shape every decision here, and both were verified in the node source:
+//
+//   The cursor is SINGLE-CONSUMER and FORWARD-ONLY, and no route fetches a body by txId
+//   (evolver#87). So a position walked past is unrecoverable — which makes a REJECTION
+//   terminal in the strongest sense, and makes "reject on a failed read" a way of losing
+//   announcements permanently for a transient 503.
+//
+//   One cursor serves EVERY channel the node declares, and consumers filter by ledger id
+//   afterwards. So this drainer sees other channels' traffic and must ignore it, and no other
+//   component in this process may poll (app.ts chooses between the registry and the demo).
+import { parseAnnouncement } from "./announcement.js";
+import { grantLease } from "./lease.js";
+import { entryFrom } from "./store.js";
+/**
+ * Process one delivery. Pure of transport: the caller owns the cursor and hands deliveries in,
+ * which is what lets `test/drainer-checks.ts` arrange a missing body or an unreadable ownership
+ * check without a chain.
+ */
+export async function processDelivery(store, d, deps) {
+    if (d.ledgerId !== deps.channel)
+        return { outcome: "ignored" };
+    const reject = (reason, detail) => {
+        store.reject({ txId: d.txId, round: d.round, sender: d.sender, ledgerId: d.ledgerId, reason, detail });
+        deps.say(`   refused ${d.txId.slice(0, 12)}… from ${d.sender}: ${reason} — ${detail}`);
+        return { outcome: "rejected", reason };
+    };
+    // Cheapest and most terminal first, so nothing expensive runs for an announcement that
+    // cannot be accepted (data-model.md's validation order).
+    const parsed = parseAnnouncement(d.body);
+    if (!parsed.ok)
+        return reject(parsed.reason, parsed.detail);
+    const a = parsed.value;
+    if (deps.deny.has(d.sender))
+        return reject("deny-listed", `announcer '${d.sender}' is suppressed by the operator`);
+    // THE CHECK THE REGISTRY EXISTS FOR. Three answers, and the third is neither of the others.
+    const control = await deps.decideControl(d.sender, a.ledgerId);
+    if (control.kind === "undetermined") {
+        // Not recorded, because it is not a decision. Recording it as a rejection would make a
+        // transient failure look like a verdict, and the announcer would be told something untrue.
+        deps.say(`   ${d.txId.slice(0, 12)}… from ${d.sender}: control undetermined (${control.why}) — will retry`);
+        return { outcome: "retry", why: control.why };
+    }
+    if (control.kind === "does-not-control")
+        return reject("not-owner", `'${d.sender}' does not control '${a.ledgerId}'` +
+            (control.owners.length ? ` (owners: ${control.owners.join(", ")})` : " (nobody does)"));
+    const lease = grantLease({
+        requestedExpiryRound: a.requestedExpiryRound,
+        // From the round the announcement was ORDERED, not the round it was read: a slow reader
+        // must not shorten somebody's lease.
+        receivedRound: d.round,
+        maxLeaseRounds: deps.maxLeaseRounds,
+    });
+    // The document is fetched AFTER control is settled — it is the expensive step, and there is
+    // no point paying for it on behalf of somebody who cannot announce this channel.
+    let detailState = "ok";
+    let detailReason;
+    if (a.detail) {
+        const got = await deps.fetchDetail(a.detail);
+        if (got.ok) {
+            // KEPT HERE, because this is the only endpoint an agent can reach. The node's content
+            // cache is off by default and its listener is loopback-INSIDE-the-node's-container when
+            // it is on, so "fetch the document yourself" was advice no reader could follow.
+            store.putDetailDoc(a.detail.key, a.detail.sha256, got.bytes);
+        }
+        else {
+            detailState = "unfetchable";
+            detailReason = got.reason;
+            // The entry STILL STANDS. "This service exists and its documentation is broken" is more
+            // useful to a reader than silence, and the reason travels with it (FR-016).
+            deps.say(`   ${a.ledgerId}: detail document unusable (${got.reason}) — indexing without it`);
+        }
+    }
+    const provenance = d.sender === deps.operator ? "operator" : "third-party";
+    store.put(entryFrom({
+        a, announcer: d.sender, provenance, lease,
+        announcedAtRound: d.round, verifiedAtRound: d.round, txId: d.txId,
+        detailState, ...(detailReason ? { detailReason } : {}),
+    }));
+    deps.say(`   indexed '${a.ledgerId}' from ${d.sender} (${provenance}, lease to round ${lease.grantedExpiryRound}` +
+        `${lease.clamped ? `, clamped from ${lease.requestedExpiryRound}` : ""})`);
+    return { outcome: "accepted", ledgerId: a.ledgerId };
+}
+// ── registry-specific walk constants ───────────────────────────────────────
+/** How long an undetermined control check is retried INLINE before the delivery is written to
+ *  the deferred table and the walk moves on. */
+export const CONTROL_RETRY_MS = 60_000;
+/** Registry-specific retry/defer policy, shared by the current composition and the shared SDK
+ * worker adapter. This is NOT a collector: it never polls or paces the node and never owns a
+ * database. Its store and every callback are run by the calling owner. */
+export function createRegistryHandler(store, deps, clock = {}) {
+    const now = clock.now ?? (() => Date.now());
+    const sleep = clock.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let accepted = 0;
+    return {
+        async handle(d) {
+            for (const held of store.deferredAll()) {
+                // Only a typed undetermined control outcome is retryable. Unexpected collaborator or
+                // SQLite errors must reject THIS handler too: the held body remains durable and the
+                // shared owner retains the current original without advancing to the next position.
+                const out = await processDelivery(store, held, deps);
+                if (out.outcome === "retry") {
+                    store.defer({ ...held, why: out.why });
+                    continue;
+                }
+                store.undefer(held.txId);
+                if (out.outcome === "accepted")
+                    accepted += 1;
+                deps.say(`   held ${held.txId.slice(0, 12)}… settled after ${held.attempts} attempt(s): ${out.outcome}`);
+            }
+            const until = now() + CONTROL_RETRY_MS;
+            let out = await processDelivery(store, d, deps);
+            while (out.outcome === "retry" && now() < until) {
+                await sleep(1_000);
+                out = await processDelivery(store, d, deps);
+            }
+            if (out.outcome === "retry") {
+                store.defer({
+                    txId: d.txId || `${d.round}:${d.index}`, round: d.round, index: d.index,
+                    sender: d.sender, ledgerId: d.ledgerId, body: d.body, why: out.why,
+                });
+                deps.say(`   … control of '${d.txId.slice(0, 12)}…' still undetermined after ${CONTROL_RETRY_MS}ms (${out.why}) — HELD with its body, retried on the next walk`);
+            }
+            if (out.outcome === "accepted")
+                accepted += 1;
+        },
+        takeAccepted() { const n = accepted; accepted = 0; return n; },
+    };
+}

package/dist/installer-runtime/dist/src/registry/http.js

@@ -0,0 +1,194 @@
+/** Truncated deliberately — the histogram is the one part of the summary that would otherwise
+ *  grow with the registry, and SC-001's budget is what it must not exceed. */
+export const SUMMARY_KEYWORDS = 40;
+/**
+ * TEN, and DERIVED from SC-001's budget rather than chosen.
+ *
+ * A worst-case list row — a 60-character title, a 200-character summary, eight keywords and a
+ * detail key with its 64-hex digest — measures about 750 bytes. Twenty of those came to
+ * ~15 KB against an 8 KB budget, so the DEFAULT moved rather than the budget: the budget IS
+ * the requirement (do not flood an agent's context) and the limit is only a knob. `total`
+ * tells a reader what it did not see, and a caller who wants more asks for it.
+ */
+export const DEFAULT_LIMIT = 10;
+export const MAX_LIMIT = 100;
+const DISCLAIMER = "inclusion is not endorsement";
+/** The full record — what `/services/<ledgerId>` returns. */
+const wireFull = (e) => ({
+    ledgerId: e.ledgerId,
+    kind: e.kind,
+    title: e.title,
+    summary: e.summary,
+    keywords: e.keywords,
+    announcer: e.announcer,
+    provenance: e.provenance,
+    state: e.state,
+    ...(e.detail ? { detail: {
+            key: e.detail.key, sha256: e.detail.sha256, bytes: String(e.detail.bytes),
+            state: e.detail.state, ...(e.detail.reason ? { reason: e.detail.reason } : {}),
+        } } : {}),
+    announcedAtRound: String(e.announcedAtRound),
+    verifiedAtRound: String(e.verifiedAtRound),
+    grantedExpiryRound: String(e.grantedExpiryRound),
+    requestedExpiryRound: String(e.requestedExpiryRound),
+    txId: e.txId,
+});
+/**
+ * The LIST projection — leaner, because a list is for CHOOSING.
+ *
+ * `txId`, `requestedExpiryRound` and `verifiedAtRound` are provenance a reader wants about a
+ * service it has already picked, and paying for them 20 times to answer "which of these?" is
+ * exactly the context flooding this feature exists to prevent. The detail key AND its digest
+ * stay: an agent must be able to fetch and verify the document without a fourth request
+ * (SC-002).
+ */
+const wireList = (e) => ({
+    ledgerId: e.ledgerId,
+    kind: e.kind,
+    title: e.title,
+    summary: e.summary,
+    keywords: e.keywords,
+    announcer: e.announcer,
+    provenance: e.provenance,
+    state: e.state,
+    ...(e.detail ? { detail: {
+            key: e.detail.key, sha256: e.detail.sha256, bytes: String(e.detail.bytes), state: e.detail.state,
+        } } : {}),
+    announcedAtRound: String(e.announcedAtRound),
+    grantedExpiryRound: String(e.grantedExpiryRound),
+});
+export function registryRoutes(args) {
+    const { store, chain, channel, tipRound, walkedRound, deny } = args;
+    const json = (status, body) => ({ status, json: body });
+    // ⚠️ `/summary`, NOT `/services/summary`, and the move is the fix for a real ambiguity: a
+    // ledger id may legitimately be the single word `summary` (the node's id grammar allows
+    // it), and a route matched before `/services/<id>` made that channel's entry unreachable
+    // while quietly answering a different question. A sibling of `/rejections` has no such
+    // overlap. The old path is GONE rather than aliased — an alias would shadow the same name.
+    const summary = {
+        path: "/summary",
+        handle: () => {
+            const s = store.summary(deny());
+            return json(200, {
+                entries: { live: String(s.entries.live), expired: String(s.entries.expired) },
+                kinds: Object.fromEntries(Object.entries(s.kinds).map(([k, v]) => [k, String(v)])),
+                keywords: s.keywords.slice(0, SUMMARY_KEYWORDS).map((k) => ({ keyword: k.keyword, live: String(k.live) })),
+                keywordsTruncated: s.keywords.length > SUMMARY_KEYWORDS,
+                // Under research D1 this is always zero. A non-zero value means an announcement was
+                // ordered and its body never reached this registry — the readability guarantee
+                // violated — so it is published here rather than left in a log (SC-004).
+                misses: { total: String(s.misses.total), lastRound: s.misses.lastRound === null ? null : String(s.misses.lastRound) },
+                // Not a loss — a delivery whose body this registry still holds while it retries an
+                // ownership check it could not complete. Zero in steady state; a number that persists
+                // means the chain reads behind `decideControl` are failing.
+                deferred: String(s.deferred),
+                chain,
+                channel,
+                // ⚠️ AS OF THE WALK, not the tip. An index answers only for what has been walked past:
+                // stalled below an announcement, it holds zero entries and zero misses, and stamping that
+                // with the node's tip made "not walked yet" read exactly like "walked, and empty".
+                // `tipRound` beside it makes the gap a number a reader can see.
+                asOfRound: String(walkedRound()),
+                tipRound: String(tipRound()),
+                disclaimer: DISCLAIMER,
+            });
+        },
+    };
+    const services = {
+        path: "/services",
+        handle: (url) => {
+            const rawLimit = url.searchParams.get("limit");
+            // REFUSED, not coerced. A caller that asked for something impossible has a bug, and
+            // silently answering a different question hides it.
+            // CLAMPED ABOVE, REFUSED BELOW — and the asymmetry is deliberate, matching the lease
+            // decision (research D4): asking for more than the operator allows is a reasonable
+            // request answered with what is allowed, whereas `limit=0` or `limit=abc` cannot be
+            // answered at all and silently substituting 20 would hide the caller's bug.
+            let limit = DEFAULT_LIMIT;
+            if (rawLimit !== null) {
+                const n = Number(rawLimit);
+                if (!Number.isInteger(n) || n < 1)
+                    return json(400, { error: "bad_request", message: `limit must be a positive integer (it is clamped to ${MAX_LIMIT})` });
+                limit = Math.min(n, MAX_LIMIT);
+            }
+            const rawOffset = url.searchParams.get("offset");
+            let offset = 0;
+            if (rawOffset !== null) {
+                const n = Number(rawOffset);
+                if (!Number.isInteger(n) || n < 0)
+                    return json(400, { error: "bad_request", message: "offset must be a non-negative integer" });
+                offset = n;
+            }
+            const q = url.searchParams.get("q");
+            const kind = url.searchParams.get("kind") ?? undefined;
+            const r = store.search({
+                terms: q ? q.split(/[\s,]+/) : [], ...(kind ? { kind: kind.trim().toLowerCase() } : {}),
+                limit, offset,
+            }, deny());
+            return json(200, {
+                total: String(r.total), limit: String(limit), offset: String(offset),
+                services: r.entries.map(wireList), disclaimer: DISCLAIMER,
+            });
+        },
+    };
+    const service = {
+        path: "/services/",
+        prefix: true,
+        handle: (url) => {
+            // THE DETAIL DOCUMENT, served by the registry itself.
+            //
+            // Because there is nowhere else to get it. `detail.key` is a content-cache key and the
+            // node's content cache is off by default; when it is on, its route is bound to 127.0.0.1
+            // INSIDE the node's container. So "fetch it and verify it yourself" was advice no agent
+            // could act on. The registry has already fetched the bytes and checked the announced
+            // digest over them, so what it serves is what the announcer committed to — and the digest
+            // travels in a header so a reader can check the same thing without trusting this hop.
+            const detailMatch = /^\/services\/(.+)\/detail$/.exec(url.pathname);
+            if (detailMatch) {
+                const id = decodeURIComponent(detailMatch[1]);
+                const e = store.get(id, deny());
+                if (!e || !e.detail)
+                    return json(404, { error: "not_found", message: "no detail document is indexed for that channel" });
+                if (e.detail.state !== "ok")
+                    return json(409, { error: "unfetchable", message: e.detail.reason ?? "the document could not be fetched",
+                        key: e.detail.key, sha256: e.detail.sha256 });
+                const doc = store.detailDoc(e.detail.key);
+                if (!doc)
+                    return json(404, { error: "not_found", message: "the document was verified but is no longer held" });
+                // Served as bytes, with the digest stated. NOT as JSON: an agent asked to verify a
+                // sha256 must receive exactly the bytes that were hashed.
+                return {
+                    status: 200,
+                    bytes: doc.bytes,
+                    headers: {
+                        "content-type": "text/plain; charset=utf-8",
+                        "content-length": doc.bytes.byteLength,
+                        "x-evolver-sha256": doc.sha256,
+                        "x-evolver-announcer": e.announcer,
+                        "x-evolver-provenance": e.provenance,
+                    },
+                };
+            }
+            const id = decodeURIComponent(url.pathname.slice("/services/".length));
+            const e = store.get(id, deny());
+            // 404 means "nobody has announced it", NOT "the channel does not exist" — the registry
+            // knows nothing about channels nobody described, and must not imply otherwise.
+            if (!e)
+                return json(404, { error: "not_found", message: "no entry is indexed for that channel" });
+            return json(200, { ...wireFull(e), disclaimer: DISCLAIMER });
+        },
+    };
+    const rejections = {
+        path: "/rejections",
+        // Deliberately NOT on the agent's search path: a different reader (the announcer, the
+        // operator) with a different need (FR-005).
+        handle: () => json(200, {
+            rejections: store.rejections().map((r) => ({
+                txId: r.txId, round: String(r.round), sender: r.sender,
+                ledgerId: r.ledgerId, reason: r.reason, detail: r.detail,
+            })),
+            disclaimer: DISCLAIMER,
+        }),
+    };
+    return [summary, services, service, rejections];
+}

package/dist/installer-runtime/dist/src/registry/index.js

@@ -0,0 +1,52 @@
+// Application composition only. All generic cursor/storage/config/control ownership is in
+// the SDK. Signing keys and chain provisioning remain in this parent, never worker options.
+import { isValidNodeId } from "@mcsherrylabs/evolver-client";
+import { registryChannel, registryChannelOperator, registryContentUrl, registryDenyList, registryMaxLeaseRounds, } from "../env.js";
+import { provisionRegistryChannel } from "./provision.js";
+import { REGISTRY_MODULE_NAME } from "./worker-module.js";
+export function registryModule(args) {
+    if (!isValidNodeId(args.operator))
+        throw new Error("invalid fixed registry operator identity");
+    const channel = registryChannel();
+    const options = {
+        chain: args.chain, channel, operator: args.operator,
+        maxLeaseRounds: registryMaxLeaseRounds(), deny: [...registryDenyList()],
+        chainUrl: args.chainUrl, contentUrl: registryContentUrl(),
+    };
+    return {
+        // Production starts emitted JS. No tsx worker remapping, test factory or remote discovery.
+        worker: { url: new URL("./worker-module.js", import.meta.url).href, options },
+        lifecycle: {
+            name: REGISTRY_MODULE_NAME, channels: [channel],
+            async setup(context) {
+                await args.beforeProvision?.();
+                const { sender, signer } = await args.identity();
+                if (sender.nodeId !== args.operator)
+                    throw new Error("registry signing identity differs from fixed worker operator");
+                const provisioned = await provisionRegistryChannel({
+                    node: args.node, chainUrl: args.chainUrl, chainAgreedUrl: args.chainAgreedUrl,
+                    channel, owner: sender, signer, nodeIdentity: args.nodeIdentity,
+                    say: args.say, operator: registryChannelOperator(),
+                    pace: async () => { await context.pace(); },
+                });
+                args.say(`   registry ${provisioned.role}: ${channel}`);
+            },
+        },
+    };
+}
+/** HTTP is a parent-side bridge; the actual routes/SQLite reads run serialized in the worker.
+ * A failed tip/cursor/module read propagates to HTTP 500, never a fabricated empty index. */
+export function registryReadRoutes(runtime, tip) {
+    const handle = async (url) => {
+        const currentTip = await tip();
+        const cursor = await runtime.store.cursor();
+        const walked = BigInt(cursor.round) > 0n ? String(BigInt(cursor.round) - 1n) : "0";
+        return await runtime.store.readModule(REGISTRY_MODULE_NAME, {
+            path: `${url.pathname}${url.search}`, tip: currentTip, walked, deny: [...registryDenyList()],
+        });
+    };
+    return [
+        { path: "/summary", handle }, { path: "/services", handle },
+        { path: "/services/", prefix: true, handle }, { path: "/rejections", handle },
+    ];
+}

package/dist/installer-runtime/dist/src/registry/lease.js

@@ -0,0 +1,35 @@
+// Leases, in ROUNDS.
+//
+// ⚠️ Never wall-clock. Devnet commits on a ~600 ms floor when busy and a 300-second idle
+// heartbeat when quiescent, so "an hour" is somewhere between 6,000 and 12 rounds on the SAME
+// chain. A lease that means one thing under load and another at rest is not a lease.
+//
+// Pure: the ceiling arrives as an argument, so the rules are driveable without the environment.
+/**
+ * Grant a lease: DHCP semantics.
+ *
+ * Clamped rather than refused, deliberately (research D4). Refusing punishes a caller for
+ * asking for more than the operator allows, and it makes the operation non-idempotent — an
+ * announcer would have to discover the ceiling by trial. Clamping answers the question.
+ */
+export function grantLease(req) {
+    const ceiling = req.receivedRound + BigInt(req.maxLeaseRounds);
+    // A request in the PAST is floored at the round of receipt rather than granted as asked: an
+    // entry that is expired before it is written is not something an announcer can have meant,
+    // and it would make `state` flip on the very first sweep.
+    const floor = req.receivedRound;
+    const granted = req.requestedExpiryRound > ceiling ? ceiling
+        : req.requestedExpiryRound < floor ? floor
+            : req.requestedExpiryRound;
+    return {
+        requestedExpiryRound: req.requestedExpiryRound,
+        grantedExpiryRound: granted,
+        clamped: req.requestedExpiryRound > ceiling,
+    };
+}
+/** A lease INCLUDES its granted round; it is expired only once the tip has passed it. The
+ *  boundary is stated here rather than at each call site because an off-by-one would silently
+ *  retire entries a round early, which reads as a chain problem rather than an arithmetic one. */
+export function isExpired(grantedExpiryRound, tipRound) {
+    return tipRound > grantedExpiryRound;
+}

package/dist/installer-runtime/dist/src/registry/ownership.js

@@ -0,0 +1,31 @@
+/**
+ * Resolve control, asking for as little as possible: the group read happens only when an
+ * owner is actually a group, so the ordinary individually-owned case costs one request.
+ */
+export async function decideControl(q) {
+    const read = await q.readTerms(q.ledgerId);
+    if (!read.ok)
+        return { kind: "undetermined", why: `terms unreadable: ${read.why}` };
+    const owners = read.terms.owners ?? [];
+    // An identity owner is decided without a second read.
+    for (const o of owners) {
+        if (o.kind === "I" && o.name === q.sender)
+            return { kind: "controls", via: "identity", owner: o.name };
+    }
+    // A group owner needs membership. ⚠️ An unreadable membership read is undetermined for the
+    // same reason an unreadable terms read is: rejecting is TERMINAL, and the cursor has already
+    // moved, so a blip would discard an announcement permanently (research A9).
+    for (const o of owners) {
+        if (o.kind !== "G")
+            continue;
+        const m = await q.readGroupMembers(o.name);
+        if (!m.known)
+            return { kind: "undetermined", why: `members of group '${o.name}' unreadable: ${m.why}` };
+        if (m.members.includes(q.sender))
+            return { kind: "controls", via: "group", owner: o.name };
+    }
+    // Nobody owns it, or somebody else does. Both are the same terminal answer — and note an
+    // UNCLAIMED channel lands here, because the route answers 200 with `owners: []` for a
+    // channel that has never existed (research A2), so "unclaimed" is not a special case.
+    return { kind: "does-not-control", owners: owners.map((o) => o.name) };
+}