@origintrail-official/dkg-agent 10.0.19 → 10.0.21

package/dist/dkg-agent-crypto.js

@@ -7,59 +7,30 @@
  * 1:1 move; methods take `this: DKGAgent` so cross-calls resolve against the
  * composed class.
  */
+import { collectProjectedDelegatees } from './internal/workspace-projected-delegatees.js';
 import { createHash, randomUUID } from 'node:crypto';
-import { PROTOCOL_SWM_SENDER_KEY, encodeGossipEnvelope, computeGossipSigningPayload, GOSSIP_ENVELOPE_VERSION, GOSSIP_TYPE_WORKSPACE_PUBLISH, createOperationContext, logKaLifecycleEvent, WORKSPACE_AGENT_ENCRYPTION_KEY_ALGORITHM_X25519, WORKSPACE_RECIPIENT_ENCRYPTION_KEY_PURPOSE, decodeWorkspaceEncryptionKey, SWM_SENDER_KEY_PACKAGE_ACK_TYPE, SWM_SENDER_KEY_PACKAGE_ACK_RETRYABLE_REASON_CODES, SWM_SENDER_KEY_PACKAGE_VERSION, computeSwmSenderKeyMembershipHash, computeSwmSenderKeyPackageAAD, decodeWorkspacePublishRequest, decodeSwmSenderKeyPackage, decodeSwmSenderKeyPackageAck, decryptSwmSenderKeyMessage, decryptSwmSenderKeyPackage, encodeSwmSenderKeyMessage, encodeSwmSenderKeyPackage, encodeSwmSenderKeyPackageAck, encryptSwmSenderKeyMessage, encryptSwmSenderKeyPackage, generateEd25519Keypair, generateSwmSenderChainKey, generateSwmSenderEpochId, ratchetSwmSenderChainKey, uint64ForProto, SWM_SENDER_KEY_SKIPPED_MESSAGE_CACHE_LIMIT, } from '@origintrail-official/dkg-core';
+import { PROTOCOL_SWM_SENDER_KEY, encodeGossipEnvelope, computeGossipSigningPayload, GOSSIP_ENVELOPE_VERSION, GOSSIP_TYPE_WORKSPACE_PUBLISH, createOperationContext, logKaLifecycleEvent, WORKSPACE_AGENT_ENCRYPTION_KEY_ALGORITHM_X25519, WORKSPACE_RECIPIENT_ENCRYPTION_KEY_PURPOSE, decodeWorkspaceEncryptionKey, SWM_SENDER_KEY_PACKAGE_ACK_TYPE, SWM_SENDER_KEY_PACKAGE_ACK_RETRYABLE_REASON_CODES, SWM_SENDER_KEY_PACKAGE_VERSION, computeSwmSenderKeyMembershipHash, computeSwmSenderKeyPackageAAD, decodeWorkspacePublishRequest, decodeSwmSenderKeyPackage, decodeSwmSenderKeyPackageAck, decryptSwmSenderKeyMessage, decryptSwmSenderKeyPackage, encodeSwmSenderKeyMessage, encodeSwmSenderKeyPackage, encodeSwmSenderKeyPackageAck, encryptSwmSenderKeyMessage, encryptSwmSenderKeyPackage, generateEd25519Keypair, generateSwmSenderChainKey, generateSwmSenderEpochId, ratchetSwmSenderChainKey, uint64ForProto, SWM_SENDER_KEY_SKIPPED_MESSAGE_CACHE_LIMIT, tryCanonicalPeerIdString, } from '@origintrail-official/dkg-core';
 import { createRpcTimeoutError, withRpcRequestContext } from '@origintrail-official/dkg-chain';
-import { resolveWorkspaceAgentRecipients, resolveWorkspaceAgentRecipientKeys, } from '@origintrail-official/dkg-publisher';
+import { resolveWorkspaceAgentRecipients, resolveWorkspaceAgentRecipientKeys, isWorkspaceAgentEncryptionKeyMissingError, WorkspaceAgentEncryptionKeyMissingError, } from '@origintrail-official/dkg-publisher';
 import { ethers } from 'ethers';
 import { resolveActivePublicContextGraphChainProof as resolveStrictActivePublicChainProof, } from './active-public-context-graph-chain-proof.js';
 import { resolveContextGraphAgentGateAuthorityDecision, } from './internal/context-graph-authority/context-graph-agent-gate-authority.js';
 import { resolveLiveOnChainAccessPolicyState as resolveLiveAccessPolicyState, } from './internal/context-graph-authority/context-graph-access-policy.js';
-import { createContextGraphAuthorityError, } from './internal/context-graph-authority/context-graph-authority.js';
+import { createContextGraphAuthorityError, isContextGraphAuthorityUnavailableMarker, isRetryableContextGraphAuthorityUnavailableReason, } from './internal/context-graph-authority/context-graph-authority.js';
+import { resolveSwmMemberRecoveryAuthorityDecision, resolveSwmRegisteredAuthorityDecision, resolveSwmTransportAuthorityDecision, } from './internal/context-graph-authority/swm-transport-authority.js';
 import { FANOUT_RESPONSE_REJECTED, FANOUT_RESPONSE_RETRYABLE, } from './swm/substrate-fanout.js';
 import { SyncTargetSupersededError } from './sync/error-tags.js';
 import { resolveAssetUalFromKaIdentity } from './ka-identity.js';
-import { TIMEOUT_SENTINEL, CHAIN_POLICY_READ_TIMEOUT_MS, SWM_SENDER_KEY_PENDING_DRAIN_LOG_CTX, } from './dkg-agent-constants.js';
+import { SWM_RECIPIENT_KEY_FETCH_WAIT_MS, TIMEOUT_SENTINEL, CHAIN_POLICY_READ_TIMEOUT_MS, SWM_SENDER_KEY_PENDING_DRAIN_LOG_CTX, } from './dkg-agent-constants.js';
 import { chainAuthorityReadBudgetsOf } from './chain-authority-read-budgets.js';
 import { isBoundedOperationTimeoutError, runBoundedOperation, } from './bounded-operation.js';
 import { StaleSenderKeyTargetError, SwmSenderKeySetupRejectionError, } from './dkg-agent-types.js';
-import { swmSenderStateKey, swmReceiverStateKey, serializeSwmSenderSendState, serializeSwmSenderReceiveState, serializePendingSenderKeyEntry, deserializeSwmSenderSendState, deserializeSwmSenderReceiveState, deserializePendingSenderKeyEntry, } from './dkg-agent-swm-state.js';
+import { computeSwmSenderKeyRecipientRouteHash, swmSenderStateKey, swmReceiverStateKey, serializeSwmSenderSendState, serializeSwmSenderReceiveState, serializePendingSenderKeyEntry, deserializeSwmSenderSendState, deserializeSwmSenderReceiveState, deserializePendingSenderKeyEntry, } from './dkg-agent-swm-state.js';
 import { DKGAgentBase } from './dkg-agent-base.js';
-import { localContextGraphIdMatchesCommittedNameHash } from './context-graph-binding-state.js';
+import { isCanonicalPositiveContextGraphId, localContextGraphIdMatchesCommittedNameHash, } from './context-graph-binding-state.js';
 import { CONTEXT_GRAPH_AUTHORITY_RPC_SITES as CG_AUTH_RPC_SITES, withRpcUsageSite, } from '@origintrail-official/dkg-chain';
 const KA_LIFECYCLE_ASSET_UAL_RESOLVE_TIMEOUT_MS = 50;
-function delegationIsCurrentlyActive(expiresAtValues, nowMs) {
-    if (expiresAtValues.length === 0)
-        return true;
-    return expiresAtValues.some((value) => {
-        const expiresAt = Number(value);
-        return !Number.isFinite(expiresAt) || expiresAt <= 0 || expiresAt >= nowMs;
-    });
-}
-function collectProjectedDelegatees(meta, field, normalizeValue) {
-    const members = new Set([...meta.allowedAgents, ...meta.participantAgents].map((agent) => agent.toLowerCase()));
-    const revoked = new Set(meta.revokedAgents.map((agent) => agent.toLowerCase()));
-    const out = new Map();
-    const nowMs = Date.now();
-    for (const delegation of meta.delegations) {
-        if (!delegationIsCurrentlyActive(delegation.expiresAtValues, nowMs))
-            continue;
-        for (const rawAgent of delegation.agents) {
-            const agent = rawAgent.toLowerCase();
-            if (!agent || !members.has(agent) || revoked.has(agent))
-                continue;
-            const values = out.get(agent) ?? [];
-            for (const rawValue of delegation[field]) {
-                const value = normalizeValue(rawValue);
-                if (value && !values.includes(value))
-                    values.push(value);
-            }
-            if (values.length > 0)
-                out.set(agent, values);
-        }
-    }
-    return out;
-}
+const SWM_RECIPIENT_AUTHORITY_STABILITY_ATTEMPTS = 3;
 function mapContextGraphSlotBindingOutcome(outcome, mode) {
     if (outcome.kind === 'match')
         return true;
@@ -172,6 +143,62 @@ function bindLiveAuthorityRead(chain, read, freshness) {
         freshness,
     });
 }
+/**
+ * The recipient-key failure a sender reports once fetching cannot help: why
+ * the keys are unknown and what gets them here (#2849).
+ */
+function withMemberKeyHint(error) {
+    const { agentAddresses } = error;
+    const one = agentAddresses.length === 1;
+    return new WorkspaceAgentEncryptionKeyMissingError(agentAddresses, `${new WorkspaceAgentEncryptionKeyMissingError(agentAddresses).message}: this node has neither `
+        + (one ? 'a join request from the agent nor its profile. Have the member' : 'join requests from these agents nor their profiles. Have each member')
+        + ' join through an invite, or retry once '
+        + (one ? 'its profile has' : 'their profiles have')
+        + ' reached this node (profiles are re-published about every 20 minutes).');
+}
+function hasExactRecipientAgentRoster(resolution, participantAgents) {
+    try {
+        const resolvedAgents = new Set(resolution.recipients.map(({ agentAddress }) => ethers.getAddress(agentAddress).toLowerCase()));
+        const currentAgents = new Set(participantAgents.map((address) => ethers.getAddress(address).toLowerCase()));
+        return currentAgents.size === resolvedAgents.size
+            && [...currentAgents].every((address) => resolvedAgents.has(address));
+    }
+    catch {
+        return false;
+    }
+}
+function hasExactWorkspaceRecipientSet(left, right) {
+    const canonical = (recipient) => [
+        ethers.getAddress(recipient.agentAddress).toLowerCase(),
+        recipient.recipientKeyId,
+        recipient.peerId ?? '',
+    ].join('\u0000');
+    try {
+        const leftRecipients = left.recipients.map(canonical).sort();
+        const rightRecipients = right.recipients.map(canonical).sort();
+        return leftRecipients.length === rightRecipients.length
+            && leftRecipients.every((recipient, index) => recipient === rightRecipients[index]);
+    }
+    catch {
+        return false;
+    }
+}
+function sameStringSet(left, right) {
+    const leftSet = new Set(left);
+    const rightSet = new Set(right);
+    return leftSet.size === rightSet.size && [...leftSet].every((value) => rightSet.has(value));
+}
+function pendingSenderKeyEntryMatchesDrainAuthority(entry, authority) {
+    return entry.contextGraphId === authority.contextGraphId
+        && (authority.allSubgraphs === true
+            || (entry.subGraphName ?? undefined) === (authority.subGraphName ?? undefined))
+        && entry.recipientAgentAddress === authority.recipientAgentAddress
+        && entry.recipientKeyId === authority.recipientKeyId
+        && entry.recipientPeerId === authority.recipientPeerId
+        && (authority.senderAgentAddress === undefined
+            || entry.senderAgentAddress === authority.senderAgentAddress)
+        && (authority.epochId === undefined || entry.epochId === authority.epochId);
+}
 export class WorkspaceCryptoMethods extends DKGAgentBase {
     getWorkspaceGossipSigningAgent() {
         const defaultAddress = this.defaultAgentAddress?.toLowerCase();
@@ -227,8 +254,8 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
     async resolveContextGraphAgentGateAuthority(contextGraphId, options = {}) {
         return withRpcUsageSite(CG_AUTH_RPC_SITES.gate, () => resolveContextGraphAgentGateAuthorityDecision({
             contextGraphId,
-            getRegisteredAuthority: () => this.resolveRegisteredContextGraphAuthority(contextGraphId, { signal: options.signal }),
-            resolveRfc64PrivateRoster: () => this.resolveRfc64PrivateReadRosterV1(contextGraphId),
+            getTransportAuthority: () => this.resolveSwmTransportAuthority(contextGraphId, { signal: options.signal }),
+            readMetadataRevision: () => this.contextGraphMetaProjection.readAuthorityFactsRevision,
             getLegacyMeta: () => this.getCgMeta(contextGraphId, { signal: options.signal }),
             getSubscriptionAgents: () => (this.subscribedContextGraphs.get(contextGraphId)?.participantAgents ?? []),
         }));
@@ -243,32 +270,89 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         return [];
     }
     /**
-     * R9 (SECURITY) — FRESH, `_meta`-only member-recovery gate.
+     * R9 (SECURITY) — authoritative member-recovery gate.
      *
-     * Resolves `allowedAgents ∪ participantAgents` minus `revokedAgents` from the
-     * CG `_meta` projection (store-backed, write-invalidated), with the
-     * network-influenced `subscribedContextGraphs` subscription cache
-     * DELIBERATELY OMITTED — that cache is poisonable, and folding it in is
-     * exactly what `member-recovery-auth.ts` forbids.
+     * Registered and active accepted-private graphs use their exact authority
+     * roster. Only a legacy unregistered graph (including accepted public, whose
+     * local gate controls recovery rather than reads) resolves the effective
+     * store-backed metadata projection of
+     * `allowedAgents ∪ participantAgents` minus `revokedAgents` from the CG
+     * metadata. The network-influenced `subscribedContextGraphs`
+     * subscription cache is DELIBERATELY OMITTED — that cache is poisonable, and
+     * folding it in is exactly what `member-recovery-auth.ts` forbids.
      *
      * Unlike {@link getContextGraphAgentGateAddresses} (which also feeds normal
      * sync admission and may fold in the subscription cache only for graphs that
      * are not registered on-chain), this read is used ONLY for `request.recovery`
      * and is passed straight to
      * `isMemberRecoveryAuthorized`, which hard-denies on null/empty. Returns
-     * `null` when the CG has no `_meta` agent gate at all (⇒ hard-deny).
+     * `null` when the CG has no projected agent gate at all (⇒ hard-deny).
      */
     async getMemberRecoveryGate(contextGraphId, options = {}) {
-        const registeredAuthority = await withRpcUsageSite(CG_AUTH_RPC_SITES.recoveryGate, () => this.resolveRegisteredContextGraphAuthority(contextGraphId, { signal: options.signal }));
-        if (registeredAuthority.kind === 'private')
-            return registeredAuthority.participantAgents;
-        if (registeredAuthority.kind !== 'unregistered')
+        const recoveryAuthority = await withRpcUsageSite(CG_AUTH_RPC_SITES.recoveryGate, () => resolveSwmMemberRecoveryAuthorityDecision(this, contextGraphId, { signal: options.signal }));
+        if (recoveryAuthority.kind === 'private-roster') {
+            return [...recoveryAuthority.participantAgents];
+        }
+        if (recoveryAuthority.kind !== 'legacy-unregistered')
             return null;
+        const metadataRevision = this.contextGraphMetaProjection
+            .readContextGraphAuthorityFactsRevision(contextGraphId);
+        const metadataGate = await this.getLocalMetadataMemberRecoveryGate(contextGraphId, options);
+        // Metadata is another async boundary. Re-resolve the authoritative state
+        // before returning it so a private policy activation/rotation or a chain
+        // registration that commits during the store read takes precedence over
+        // the now-stale local projection.
+        const currentRecoveryAuthority = await withRpcUsageSite(CG_AUTH_RPC_SITES.recoveryGate, () => resolveSwmMemberRecoveryAuthorityDecision(this, contextGraphId, { signal: options.signal }));
+        if (currentRecoveryAuthority.kind === 'private-roster') {
+            return [...currentRecoveryAuthority.participantAgents];
+        }
+        if (currentRecoveryAuthority.kind !== 'legacy-unregistered')
+            return null;
+        // A revocation or other authority-fact mutation during the metadata read
+        // invalidates the captured roster even if registration remained absent.
+        // Recovery is retryable, so fail closed instead of serving that snapshot.
+        return this.contextGraphMetaProjection
+            .readContextGraphAuthorityFactsRevision(contextGraphId) === metadataRevision
+            ? metadataGate
+            : null;
+    }
+    /**
+     * Authority source used while constructing or mutating a private roster.
+     * Registered private graphs retain their finalized chain participant set;
+     * unregistered graphs use the effective store-backed metadata projection.
+     * This deliberately ignores an accepted-private overlay roster so rotation
+     * does not ask the roster it is replacing to define its own successor.
+     */
+    async getMemberRecoveryRosterSource(contextGraphId, options = {}) {
+        const registered = await this.resolveSwmRegisteredAuthority(contextGraphId, { signal: options.signal });
+        if (registered.kind === 'private')
+            return [...registered.participantAgents];
+        if (registered.kind !== 'unregistered')
+            return null;
+        const metadataRevision = this.contextGraphMetaProjection
+            .readContextGraphAuthorityFactsRevision(contextGraphId);
+        const metadataGate = await this.getLocalMetadataMemberRecoveryGate(contextGraphId, options);
+        const currentRegistered = await this.resolveSwmRegisteredAuthority(contextGraphId, { signal: options.signal });
+        if (currentRegistered.kind === 'private') {
+            return [...currentRegistered.participantAgents];
+        }
+        if (currentRegistered.kind !== 'unregistered')
+            return null;
+        return this.contextGraphMetaProjection
+            .readContextGraphAuthorityFactsRevision(contextGraphId) === metadataRevision
+            ? metadataGate
+            : null;
+    }
+    /**
+     * Fresh effective store-backed metadata member set. This deliberately stays
+     * separate from the transport-authoritative recovery decision.
+     */
+    async getLocalMetadataMemberRecoveryGate(contextGraphId, options = {}) {
         const seen = new Set();
         const agents = [];
         const meta = await this.getCgMeta(contextGraphId, { signal: options.signal });
         if (meta.allowedAgents.length === 0 && meta.participantAgents.length === 0) {
-            return null; // no _meta agent gate ⇒ hard-deny at the recovery gate
+            return null; // no projected agent gate ⇒ hard-deny at the recovery gate
         }
         const revoked = new Set(meta.revokedAgents.map((addr) => addr.toLowerCase()));
         const add = (value) => {
@@ -494,7 +578,24 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         const trimmed = contextGraphId.trim();
         let onChainId = null;
         let resolvedFromLocalCg = false;
-        if (typeof this.getContextGraphOnChainId === 'function') {
+        if (this.chain?.contextGraphAuthorityIndexRevisionReader !== undefined
+            && typeof this.resolveContextGraphRegistrationBinding === 'function'
+            && !isCanonicalPositiveContextGraphId(trimmed)) {
+            // An indexed adapter takes the identity from the finalized registration
+            // binding too, never from a live registry range scan (#2827 follow-up).
+            // Finalized absence is `unregistered`, as a scan's miss was; any other
+            // unanswered read is `unknown`.
+            const binding = await this.resolveContextGraphRegistrationBinding(contextGraphId, { signal });
+            if (binding.kind === 'registered') {
+                onChainId = binding.onChainId.toString();
+                resolvedFromLocalCg = true;
+            }
+            else if (binding.kind === 'unavailable'
+                && binding.reason !== 'finalized-name-absence-unaccepted') {
+                return 'unknown';
+            }
+        }
+        else if (typeof this.getContextGraphOnChainId === 'function') {
             onChainId = await this.getContextGraphOnChainId(contextGraphId, { signal });
             if (onChainId)
                 resolvedFromLocalCg = true;
@@ -553,6 +654,96 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         this.onChainAccessPolicyCache.set(onChainId, accessPolicy);
         return accessPolicy;
     }
+    /**
+     * Registered-chain authority for the SWM consumers that need the raw roster,
+     * the agent gate and member recovery (#2827). The policy, and why the
+     * finalized authority index is the only registration evidence, live in
+     * {@link resolveSwmRegisteredAuthorityDecision}.
+     */
+    resolveSwmRegisteredAuthority(contextGraphId, options = {}) {
+        return resolveSwmRegisteredAuthorityDecision(this, contextGraphId, options);
+    }
+    /**
+     * How SWM on this graph may travel, for both ends of the wire
+     * ({@link resolveSwmTransportAuthorityDecision}).
+     */
+    resolveSwmTransportAuthority(contextGraphId, options = {}) {
+        return resolveSwmTransportAuthorityDecision(this, contextGraphId, options);
+    }
+    /**
+     * Resolve the transport peer gate that applies to inbound SWM traffic.
+     *
+     * Ordinary graphs retain the legacy merged metadata projection. A graph
+     * carrying a durable local join approval must instead use the peer roster
+     * from the same source-qualified proof that authorized its private replica;
+     * falling back to the merged projection there would let an unrelated
+     * AGENTS/ONTOLOGY row widen the inbound gate. Registration (or a proven
+     * public policy) supersedes that participant proof and keeps the established
+     * registered/public behaviour.
+     */
+    async resolveApprovedPrivateReplicaSwmAllowedPeersOverride(contextGraphId) {
+        if (!this.localApprovedAgentByCG.has(contextGraphId)) {
+            return undefined;
+        }
+        const transport = await this.resolveSwmTransportAuthority(contextGraphId, {
+            authorityReadMode: 'finalized-index-or-live',
+        });
+        switch (transport.kind) {
+            case 'approved-private-replica':
+                // An empty proved list is an authoritative open peer gate. Keep it
+                // distinct from `undefined` (this override does not apply) so the
+                // SharedMemoryHandler projection wrapper never falls back to a merged
+                // secondary-source row.
+                return [...new Set(transport.allowedPeers)];
+            case 'plaintext':
+            case 'private-roster':
+                return undefined;
+            case 'unavailable':
+                throw createContextGraphAuthorityError(`Context graph "${contextGraphId}" SWM peer gate authority is unavailable (${transport.reason})`, transport);
+            case 'legacy-unregistered':
+                // The approval may have been removed while the authority read was in
+                // flight. Only that transition restores ordinary legacy behaviour.
+                if (!this.localApprovedAgentByCG.has(contextGraphId)) {
+                    return undefined;
+                }
+                throw createContextGraphAuthorityError(`Context graph "${contextGraphId}" still has a local join approval but no approved private replica authority`, {
+                    reason: 'finalized-name-absence-unaccepted',
+                    detail: 'approved private replica authority did not survive current SWM authority resolution',
+                });
+        }
+    }
+    /** List/null adapter for SWM consumers that do not consume meta records. */
+    async resolveSwmAllowedPeersForCurrentAuthority(contextGraphId) {
+        const approvedReplicaOverride = await this.resolveApprovedPrivateReplicaSwmAllowedPeersOverride(contextGraphId);
+        if (approvedReplicaOverride === undefined) {
+            return this.getContextGraphAllowedPeers(contextGraphId);
+        }
+        return approvedReplicaOverride.length > 0 ? approvedReplicaOverride : null;
+    }
+    /**
+     * Whether SWM on this graph is public-readable, so plaintext may be both
+     * sent and accepted. One predicate for both ends of the wire: the sender's
+     * recipient resolver and the receiver's plaintext oracle.
+     *
+     * Without an active accepted owner-signed public policy it is exactly the
+     * live on-chain probe (isContextGraphPublicOnChain). With one, it is the
+     * `plaintext` transport authority of {@link resolveSwmTransportAuthority},
+     * the same answer the sender's recipient selection uses.
+     */
+    async isContextGraphSwmPublic(contextGraphId, opCtx) {
+        if (!this.hasActiveAcceptedRfc64PublicUnregisteredAuthorityV1(contextGraphId)) {
+            return this.isContextGraphPublicOnChain(contextGraphId, opCtx);
+        }
+        try {
+            const transport = await withRpcUsageSite(CG_AUTH_RPC_SITES.publicProbe, () => this.resolveSwmTransportAuthority(contextGraphId, { authorityReadMode: 'finalized-index-or-live' }));
+            return transport.kind === 'plaintext';
+        }
+        catch (err) {
+            this.log.warn(opCtx ?? createOperationContext('share'), `isContextGraphSwmPublic(${contextGraphId}) could not resolve registered authority — `
+                + `treating the graph as NOT public (fail-closed): ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
     /**
      * True iff `contextGraphId` is DEFINITIVELY public per its on-chain
      * access policy (policy enum `0`). Gates SWM encryption: an on-chain
@@ -820,9 +1011,18 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
      * avoids the resolver's "Missing public encryption key" throw for an
      * allowlisted agent whose key isn't locally available — irrelevant for
      * a public CG that never encrypts. Private graphs resolve recipients from
-     * the live roster; unavailable registered authority fails closed.
+     * the live roster; unavailable registered authority fails closed. An
+     * unregistered graph whose accepted owner-signed policy is public is
+     * treated like an on-chain public one. An approved private replica retains
+     * the full effective metadata roster, while any explicit graph peer
+     * allowlist restricts the recipient keys available to every roster member.
      */
     async resolveWorkspaceRecipientsGated(input) {
+        // Hydrate durable sender-key state before resolving recipients. The
+        // publisher invokes the encryptor synchronously after this resolver, so
+        // this keeps state I/O out of the authority-fenced interval between the
+        // final recipient recheck and sender-key epoch selection/creation.
+        await this.loadSwmSenderKeyState();
         return this.resolveWorkspaceAgentRecipientsForCurrentAuthority(input);
     }
     /**
@@ -842,60 +1042,231 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
      * current chain state (`requireLiveRosterForPrivate`), never from the index.
      */
     async resolveWorkspaceAgentRecipientsForCurrentAuthority(input) {
-        const registeredAuthority = await withRpcUsageSite(CG_AUTH_RPC_SITES.recipients, () => this.resolveRegisteredContextGraphAuthority(input.contextGraphId, {
+        // The receiver decides plaintext from this same transport authority
+        // (isContextGraphSwmPublic), so the two ends cannot disagree (#2827).
+        const transport = await withRpcUsageSite(CG_AUTH_RPC_SITES.recipients, () => this.resolveSwmTransportAuthority(input.contextGraphId, {
             authorityReadMode: 'finalized-index-or-live',
             requireLiveRosterForPrivate: true,
         }));
-        if (registeredAuthority.kind === 'unregistered') {
-            return resolveWorkspaceAgentRecipients(this.store, input);
-        }
-        if (registeredAuthority.kind === 'public') {
+        if (transport.kind === 'plaintext') {
             return { requiresEncryption: false, recipients: [] };
         }
-        if (registeredAuthority.kind === 'unavailable') {
-            const message = `Registered context graph "${input.contextGraphId}" authority is unavailable (${registeredAuthority.reason})`;
-            throw createContextGraphAuthorityError(message, registeredAuthority);
-        }
-        if (registeredAuthority.participantAgents.length === 0) {
-            throw new Error(`Registered context graph "${input.contextGraphId}" requires encrypted SWM gossip but its authoritative chain roster is empty or unavailable`);
-        }
-        const allowedPeers = await this.getContextGraphAllowedPeers(input.contextGraphId);
-        const allowedPeerSet = allowedPeers === null ? null : new Set(allowedPeers);
-        // Resolve only the live chain-authorized addresses. Filtering a completed
-        // local resolution afterward is too late: stale removed members can have
-        // malformed/missing key metadata that makes the local resolver throw
-        // before the chain intersection is reached, blocking every post-revoke
-        // write until the local cleanup retry succeeds.
-        const recipients = [];
-        for (const agentAddress of registeredAuthority.participantAgents) {
-            const agentRecipients = await resolveWorkspaceAgentRecipientKeys(this.store, agentAddress);
-            const authorizedRecipients = allowedPeerSet === null
-                ? agentRecipients
-                : agentRecipients.filter((recipient) => (recipient.peerId !== undefined && allowedPeerSet.has(recipient.peerId)));
-            if (authorizedRecipients.length === 0) {
-                throw new Error(`Registered context graph "${input.contextGraphId}" requires encrypted SWM gossip but `
-                    + `chain-authorized DKG agent ${ethers.getAddress(agentAddress)} has no recipient key `
-                    + 'advertised by a peer in the context graph allowlist');
-            }
-            recipients.push(...authorizedRecipients);
-        }
-        const [firstRecipient, ...remainingRecipients] = recipients;
-        if (!firstRecipient) {
-            throw new Error(`Registered context graph "${input.contextGraphId}" requires encrypted SWM gossip but has no chain-authorized DKG agent recipients`);
+        let recipientAuthorityRevision = null;
+        let resolveKeys;
+        if (transport.kind === 'legacy-unregistered') {
+            resolveKeys = async () => {
+                const attemptRevision = this.contextGraphMetaProjection.readAuthorityFactsRevision;
+                const resolution = await resolveWorkspaceAgentRecipients(this.store, input);
+                recipientAuthorityRevision = attemptRevision;
+                return resolution;
+            };
+        }
+        else if (transport.kind === 'approved-private-replica') {
+            // Resolve the complete effective metadata roster first. Participant
+            // approval authorizes this receiver; it is not a replacement roster.
+            // The peer gate comes from the same source-qualified, revision-fenced
+            // proof as the transport classification, never the merged projection.
+            resolveKeys = async () => {
+                const attemptRevision = this.contextGraphMetaProjection.readAuthorityFactsRevision;
+                const resolution = await resolveWorkspaceAgentRecipients(this.store, input);
+                if (!resolution.requiresEncryption) {
+                    throw new Error(`Approved private replica "${input.contextGraphId}" resolved a plaintext SWM roster`);
+                }
+                if (transport.allowedPeers.length === 0) {
+                    recipientAuthorityRevision = attemptRevision;
+                    return resolution;
+                }
+                const allowedPeerSet = new Set(transport.allowedPeers);
+                const effectiveAgentAddresses = new Set(resolution.recipients.map(({ agentAddress }) => agentAddress.toLowerCase()));
+                const authorizedRecipients = resolution.recipients.filter((recipient) => (recipient.peerId !== undefined && allowedPeerSet.has(recipient.peerId)));
+                const authorizedAgentAddresses = new Set(authorizedRecipients.map(({ agentAddress }) => agentAddress.toLowerCase()));
+                for (const agentAddress of effectiveAgentAddresses) {
+                    if (!authorizedAgentAddresses.has(agentAddress)) {
+                        throw new Error(`Approved private replica "${input.contextGraphId}" requires encrypted SWM gossip but `
+                            + `effective DKG agent ${ethers.getAddress(agentAddress)} has no recipient key `
+                            + 'advertised by a peer in the context graph allowlist');
+                    }
+                }
+                const [firstRecipient, ...remainingRecipients] = authorizedRecipients;
+                if (!firstRecipient) {
+                    throw new Error(`Approved private replica "${input.contextGraphId}" requires encrypted SWM gossip but has no allowed DKG agent recipients`);
+                }
+                const authorizedResolution = {
+                    requiresEncryption: true,
+                    recipients: [firstRecipient, ...remainingRecipients],
+                };
+                recipientAuthorityRevision = attemptRevision;
+                return authorizedResolution;
+            };
         }
-        return {
-            requiresEncryption: true,
-            recipients: [firstRecipient, ...remainingRecipients],
+        else {
+            if (transport.kind === 'unavailable') {
+                const message = `Registered context graph "${input.contextGraphId}" authority is unavailable (${transport.reason})`;
+                throw createContextGraphAuthorityError(message, transport);
+            }
+            const participantAgents = transport.participantAgents;
+            if (participantAgents.length === 0) {
+                throw new Error(`Registered context graph "${input.contextGraphId}" requires encrypted SWM gossip but its authoritative chain roster is empty or unavailable`);
+            }
+            // Resolve only the live chain-authorized addresses. Filtering a completed
+            // local resolution afterward is too late: stale removed members can have
+            // malformed/missing key metadata that makes the local resolver throw
+            // before the chain intersection is reached, blocking every post-revoke
+            // write until the local cleanup retry succeeds.
+            resolveKeys = async () => {
+                // The registered/accepted private roster, local peer gate, and verified
+                // recipient-key routes are conjunctive authorities. Capture their shared
+                // revision before every attempt so a phonebook-hydration retry owns a new
+                // snapshot, while the final transport recheck cannot return a route
+                // removed or revoked meanwhile.
+                const attemptRevision = this.contextGraphMetaProjection.readAuthorityFactsRevision;
+                const allowedPeers = await this.getContextGraphAllowedPeers(input.contextGraphId);
+                const allowedPeerSet = allowedPeers === null ? null : new Set(allowedPeers);
+                const recipients = [];
+                // Every member without a key is named at once, so one phonebook fetch
+                // can cover them all (#2849). Any other key failure still stops here.
+                const missingKeys = [];
+                for (const agentAddress of participantAgents) {
+                    let agentRecipients;
+                    try {
+                        agentRecipients = await resolveWorkspaceAgentRecipientKeys(this.store, agentAddress);
+                    }
+                    catch (error) {
+                        if (!isWorkspaceAgentEncryptionKeyMissingError(error))
+                            throw error;
+                        missingKeys.push(...error.agentAddresses);
+                        continue;
+                    }
+                    const authorizedRecipients = allowedPeerSet === null
+                        ? agentRecipients
+                        : agentRecipients.filter((recipient) => (recipient.peerId !== undefined && allowedPeerSet.has(recipient.peerId)));
+                    if (authorizedRecipients.length === 0) {
+                        throw new Error(`Registered context graph "${input.contextGraphId}" requires encrypted SWM gossip but `
+                            + `chain-authorized DKG agent ${ethers.getAddress(agentAddress)} has no recipient key `
+                            + 'advertised by a peer in the context graph allowlist');
+                    }
+                    recipients.push(...authorizedRecipients);
+                }
+                if (missingKeys.length > 0)
+                    throw new WorkspaceAgentEncryptionKeyMissingError(missingKeys);
+                const [firstRecipient, ...remainingRecipients] = recipients;
+                if (!firstRecipient) {
+                    throw new Error(`Registered context graph "${input.contextGraphId}" requires encrypted SWM gossip but has no chain-authorized DKG agent recipients`);
+                }
+                // Publish only the snapshot owned by the attempt that actually
+                // completed. A failed pre-hydration attempt must not pin its revision
+                // across the phonebook write and the successful retry.
+                recipientAuthorityRevision = attemptRevision;
+                return {
+                    requiresEncryption: true,
+                    recipients: [firstRecipient, ...remainingRecipients],
+                };
+            };
+        }
+        // A member added by address before it joined is known here only by its
+        // profile, which an Edge fetches on demand (#2849). One fetch asks for
+        // every member whose key is missing, then the keys are resolved once more.
+        // Every member still needs a key, so a share that cannot get one stays
+        // closed.
+        const resolveWithPhonebookHydration = async () => {
+            try {
+                return await resolveKeys();
+            }
+            catch (error) {
+                if (!isWorkspaceAgentEncryptionKeyMissingError(error))
+                    throw error;
+                if (typeof this.ensureAgentsInOnDemandPhonebook !== 'function') {
+                    throw withMemberKeyHint(error);
+                }
+                await this.ensureAgentsInOnDemandPhonebook(error.agentAddresses.map((address) => address.toLowerCase()), AbortSignal.timeout(SWM_RECIPIENT_KEY_FETCH_WAIT_MS));
+            }
+            try {
+                return await resolveKeys();
+            }
+            catch (error) {
+                throw isWorkspaceAgentEncryptionKeyMissingError(error) ? withMemberKeyHint(error) : error;
+            }
         };
+        let resolution = await resolveWithPhonebookHydration();
+        if (transport.kind === 'private-roster'
+            || transport.kind === 'approved-private-replica'
+            || transport.kind === 'legacy-unregistered') {
+            // Key and phonebook lookup are asynchronous. Re-read the paired
+            // transport decision after them so an accepted-private (or registered)
+            // roster rotation cannot return keys for a member removed meanwhile.
+            // The store revision is deliberately conservative because recipient
+            // facts can live in any named graph. Unrelated graph activity therefore
+            // triggers a bounded optimistic retry, but a retry is accepted only when
+            // both the exact (agent,key,peer) set and transport authority are stable.
+            for (let attempt = 0; attempt < SWM_RECIPIENT_AUTHORITY_STABILITY_ATTEMPTS; attempt += 1) {
+                const currentTransport = await withRpcUsageSite(CG_AUTH_RPC_SITES.recipients, () => this.resolveSwmTransportAuthority(input.contextGraphId, {
+                    authorityReadMode: 'finalized-index-or-live',
+                    requireLiveRosterForPrivate: true,
+                }));
+                if (currentTransport.kind === 'unavailable') {
+                    throw createContextGraphAuthorityError(`Context graph "${input.contextGraphId}" recipient authority is unavailable (${currentTransport.reason})`, currentTransport);
+                }
+                const transportStayedCurrent = transport.kind === 'private-roster'
+                    ? currentTransport.kind === 'private-roster'
+                        && resolution.requiresEncryption
+                        && hasExactRecipientAgentRoster(resolution, currentTransport.participantAgents)
+                    : transport.kind === 'approved-private-replica'
+                        ? currentTransport.kind === 'approved-private-replica'
+                            && sameStringSet(transport.allowedPeers, currentTransport.allowedPeers)
+                        : currentTransport.kind === 'legacy-unregistered';
+                const revisionStayedCurrent = recipientAuthorityRevision
+                    === this.contextGraphMetaProjection.readAuthorityFactsRevision;
+                if (transportStayedCurrent && revisionStayedCurrent)
+                    break;
+                const hasAnotherAttempt = attempt + 1 < SWM_RECIPIENT_AUTHORITY_STABILITY_ATTEMPTS;
+                if (!transportStayedCurrent || !hasAnotherAttempt) {
+                    throw createContextGraphAuthorityError(`Context graph "${input.contextGraphId}" private authority changed while recipient keys were resolving`, {
+                        reason: 'chain-participant-authority-unavailable',
+                        detail: 'retry recipient resolution against the current private authority',
+                    });
+                }
+                const retriedResolution = await resolveWithPhonebookHydration();
+                const recipientSnapshotStayedCurrent = resolution.requiresEncryption
+                    ? retriedResolution.requiresEncryption
+                        && hasExactWorkspaceRecipientSet(resolution, retriedResolution)
+                    : !retriedResolution.requiresEncryption;
+                if (!recipientSnapshotStayedCurrent) {
+                    throw createContextGraphAuthorityError(`Context graph "${input.contextGraphId}" private authority changed while recipient keys were resolving`, {
+                        reason: 'chain-participant-authority-unavailable',
+                        detail: 'recipient routes changed while retrying against current private authority',
+                    });
+                }
+                resolution = retriedResolution;
+            }
+        }
+        return resolution;
     }
     async encryptWorkspacePayloadWithSenderKey(input) {
-        await this.loadSwmSenderKeyState();
+        let resolution = input.resolution;
+        if (!this.swmSenderKeyStateLoaded) {
+            await this.loadSwmSenderKeyState();
+            // Recipient authority may have changed while durable state was loading.
+            // Resolve once against the now-hydrated state and proceed only when the
+            // exact agent/key/peer snapshot is unchanged. The production publisher
+            // avoids this compatibility reread by hydrating in
+            // resolveWorkspaceRecipientsGated above.
+            const currentResolution = await this.resolveWorkspaceAgentRecipientsForCurrentAuthority({
+                contextGraphId: input.contextGraphId,
+            });
+            if (!currentResolution.requiresEncryption
+                || !hasExactWorkspaceRecipientSet(resolution, currentResolution)) {
+                throw createContextGraphAuthorityError(`Context graph "${input.contextGraphId}" authority changed while sender-key state was loading`, {
+                    reason: 'chain-participant-authority-unavailable',
+                    detail: 'retry recipient resolution before creating or reusing a sender-key epoch',
+                });
+            }
+            resolution = currentResolution;
+        }
         const ctx = createOperationContext('share', input.operationId);
         const sender = this.getLocalSigningAgentForAddress(input.senderAgentAddress);
         if (!sender) {
             throw new Error(`Cannot create SWM Sender Key epoch: no local custodial signing key for agent ${input.senderAgentAddress}`);
         }
-        const resolution = input.resolution;
         const senderAddress = ethers.getAddress(sender.agentAddress);
         const recipientSet = new Set(resolution.recipients.map((recipient) => recipient.agentAddress.toLowerCase()));
         if (!recipientSet.has(senderAddress.toLowerCase())) {
@@ -914,9 +1285,16 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
                 recipientKeyId: recipient.recipientKeyId,
             })),
         });
+        const recipientRouteHash = computeSwmSenderKeyRecipientRouteHash({
+            contextGraphId: input.contextGraphId,
+            subGraphName: input.subGraphName,
+            recipients: resolution.recipients,
+        });
         const stateKey = swmSenderStateKey(input.contextGraphId, input.subGraphName, senderAddress);
         let state = this.swmSenderKeySendStates.get(stateKey);
-        if (!state || state.membershipHash !== membershipHash) {
+        if (!state
+            || state.membershipHash !== membershipHash
+            || state.recipientRouteHash !== recipientRouteHash) {
             const pruned = this.prunePendingSenderKeysForEpochRotation({
                 contextGraphId: input.contextGraphId,
                 subGraphName: input.subGraphName,
@@ -939,7 +1317,12 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
             await this.saveSwmSenderKeyState();
         }
         else {
-            await this.drainPendingSenderKeyForRecipients(resolution.recipients, ctx);
+            await this.drainPendingSenderKeyForRecipients(resolution.recipients, ctx, {
+                contextGraphId: input.contextGraphId,
+                subGraphName: input.subGraphName,
+                senderAgentAddress: state.senderAgentAddress,
+                epochId: state.epochId,
+            });
         }
         const encrypted = await encryptSwmSenderKeyMessage({
             chainKey: state.chainKey,
@@ -974,6 +1357,11 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
             senderAgentAddress,
             epochId,
             membershipHash: input.membershipHash,
+            recipientRouteHash: computeSwmSenderKeyRecipientRouteHash({
+                contextGraphId: input.contextGraphId,
+                subGraphName: input.subGraphName,
+                recipients: input.recipients,
+            }),
             chainKey,
             nextMessageIndex: 0,
             senderSigningSecretKey: senderSigningKeypair.secretKey,
@@ -989,7 +1377,18 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
                 senderPrivateKey: input.sender.privateKey,
             });
             const packageBytes = encodeSwmSenderKeyPackage(pkg);
-            if (this.hasLocalAgent(recipientAgentAddress)) {
+            const recipientIsLocal = this.hasLocalAgent(recipientAgentAddress);
+            let targetsLocalPeer = recipient.peerId === undefined;
+            if (recipientIsLocal && recipient.peerId !== undefined) {
+                const localPeerId = this.node.peerId.toString();
+                const canonicalRecipientPeerId = tryCanonicalPeerIdString(recipient.peerId);
+                const canonicalLocalPeerId = tryCanonicalPeerIdString(localPeerId);
+                targetsLocalPeer = recipient.peerId === localPeerId
+                    || (canonicalRecipientPeerId !== null
+                        && canonicalLocalPeerId !== null
+                        && canonicalRecipientPeerId === canonicalLocalPeerId);
+            }
+            if (recipientIsLocal && targetsLocalPeer) {
                 try {
                     await this.acceptSwmSenderKeyPackage(pkg, this.node.peerId.toString(), input.ctx);
                     return { kind: 'success', agentAddress: recipientAgentAddress };
@@ -1026,7 +1425,7 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
                 });
                 pendingSenderKeyQueued = true;
                 this.log.warn(input.ctx, `SWM sender-key setup for ${recipientAgentAddress} keyId=${recipient.recipientKeyId} ` +
-                    `queued (no advertised peerId) — will deliver when recipient connects`);
+                    `queued (no advertised peerId) — will deliver after a verified peer route is learned`);
                 return { kind: 'success', agentAddress: recipientAgentAddress };
             }
             this.log.info(input.ctx, `SWM sender-key setup send: senderAgent=${senderAgentAddress} recipientAgent=${recipientAgentAddress} ` +
@@ -1067,6 +1466,7 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
                         senderAgentAddress: senderAgentAddress.toLowerCase(),
                         recipientAgentAddress: recipientAgentAddress.toLowerCase(),
                         recipientKeyId: recipient.recipientKeyId,
+                        recipientPeerId: recipient.peerId,
                         epochId: state.epochId,
                         contextGraphId: state.contextGraphId,
                         subGraphName: state.subGraphName,
@@ -1088,6 +1488,7 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
                         senderAgentAddress: senderAgentAddress.toLowerCase(),
                         recipientAgentAddress: recipientAgentAddress.toLowerCase(),
                         recipientKeyId: recipient.recipientKeyId,
+                        recipientPeerId: recipient.peerId,
                         epochId: state.epochId,
                         contextGraphId: state.contextGraphId,
                         subGraphName: state.subGraphName,
@@ -1106,6 +1507,7 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
                         senderAgentAddress: senderAgentAddress.toLowerCase(),
                         recipientAgentAddress: recipientAgentAddress.toLowerCase(),
                         recipientKeyId: recipient.recipientKeyId,
+                        recipientPeerId: recipient.peerId,
                         epochId: state.epochId,
                         contextGraphId: state.contextGraphId,
                         subGraphName: state.subGraphName,
@@ -1125,6 +1527,7 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
                             senderAgentAddress: senderAgentAddress.toLowerCase(),
                             recipientAgentAddress: recipientAgentAddress.toLowerCase(),
                             recipientKeyId: recipient.recipientKeyId,
+                            recipientPeerId: recipient.peerId,
                             epochId: state.epochId,
                             contextGraphId: state.contextGraphId,
                             subGraphName: state.subGraphName,
@@ -1233,26 +1636,34 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
     /**
      * PR-2 (SWM-fanout plan): enqueue a sender-key package whose recipient
      * has no advertised `dkg:peerId` (so we can't even ask the messenger
-     * to queue it). Older epochs for the same `(sender, recipient)` pair
-     * are evicted — a newer epoch supersedes them by definition.
+     * to queue it). Older epochs for the same `(sender, recipient, context
+     * graph, subgraph)` scope are evicted — a newer epoch supersedes them by
+     * definition. Other graph/subgraph obligations remain independent.
      *
-     * Per-key dedup: `(senderAgentAddress, recipientKeyId, epochId)`
-     * matches an existing row, we replace it (idempotent re-enqueue).
+     * Per-route dedup: `(senderAgentAddress, recipientKeyId,
+     * recipientPeerId, epochId)` matches an existing row, we replace it
+     * (idempotent re-enqueue). Distinct peers advertising the same key retain
+     * independent delivery obligations.
      */
     enqueuePendingSenderKey(entry) {
         const recipientKey = entry.recipientAgentAddress.toLowerCase();
         const existing = this.pendingSenderKeyByAgent.get(recipientKey) ?? [];
-        // Drop older epochs for the same (sender, recipient) pair; the newer
-        // epoch's membership-hash supersedes them. Keep entries for OTHER
-        // senders / recipients unchanged.
+        // Drop older epochs only within the same sender + graph/subgraph scope;
+        // the newer epoch's membership hash supersedes those rows. The map key
+        // already scopes recipient agent. Keep every other scope unchanged.
         const filtered = existing.filter((e) => {
             if (e.senderAgentAddress !== entry.senderAgentAddress)
                 return true;
+            if (e.contextGraphId !== entry.contextGraphId
+                || (e.subGraphName ?? undefined) !== (entry.subGraphName ?? undefined)) {
+                return true;
+            }
             if (e.epochId === entry.epochId) {
-                // Same epoch: dedupe by recipientKeyId — caller may re-enqueue
-                // on retry. Replace by dropping the old slot; the new one is
-                // appended below.
-                return e.recipientKeyId !== entry.recipientKeyId;
+                // Same epoch: dedupe only the exact key + peer route. A successful
+                // ACK from one peer must never overwrite a retry owed to another peer
+                // that advertises the same agent/key pair.
+                return e.recipientKeyId !== entry.recipientKeyId
+                    || e.recipientPeerId !== entry.recipientPeerId;
             }
             return false;
         });
@@ -1281,17 +1692,21 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         return removed;
     }
     async drainPendingSenderKeyQueueForPeer(input) {
-        const recipientAgentAddress = input.recipientAgentAddress.toLowerCase();
+        const authority = {
+            ...input.authority,
+            recipientAgentAddress: input.authority.recipientAgentAddress.toLowerCase(),
+            senderAgentAddress: input.authority.senderAgentAddress?.toLowerCase(),
+        };
+        const recipientAgentAddress = authority.recipientAgentAddress;
         const existingDrain = this.pendingSenderKeyDrainByAgent.get(recipientAgentAddress);
         if (existingDrain) {
             await existingDrain;
             if (!this.pendingSenderKeyByAgent.has(recipientAgentAddress))
                 return 0;
-            return this.drainPendingSenderKeyQueueForPeer(input);
+            return this.drainPendingSenderKeyQueueForPeer({ authority, ctx: input.ctx });
         }
         const drain = this.drainPendingSenderKeyQueueForPeerLocked({
-            peerId: input.peerId,
-            recipientAgentAddress,
+            authority,
             ctx: input.ctx,
         }).finally(() => {
             if (this.pendingSenderKeyDrainByAgent.get(recipientAgentAddress) === drain) {
@@ -1302,19 +1717,75 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         return drain;
     }
     async drainPendingSenderKeyQueueForPeerLocked(input) {
-        const recipientAgentAddress = input.recipientAgentAddress;
+        const { authority } = input;
+        const recipientAgentAddress = authority.recipientAgentAddress;
         const queue = this.pendingSenderKeyByAgent.get(recipientAgentAddress);
         if (!queue || queue.length === 0)
             return 0;
         let drained = 0;
-        const remaining = [];
+        // `sendReliable` yields. Enqueue/epoch rotation can replace the live array
+        // while this drain is in flight, so record outcomes against the exact
+        // snapshot objects instead of later overwriting the whole map entry. At
+        // commit, only original objects still present in the live queue are
+        // transformed; concurrently inserted replacements/new scopes survive and
+        // originals concurrently superseded by a new epoch are not resurrected.
+        const outcomes = new Map();
+        const commitOutcomes = () => {
+            const live = this.pendingSenderKeyByAgent.get(recipientAgentAddress) ?? [];
+            const reconciled = [];
+            for (const liveEntry of live) {
+                if (!outcomes.has(liveEntry)) {
+                    reconciled.push(liveEntry);
+                    continue;
+                }
+                const replacement = outcomes.get(liveEntry);
+                if (replacement)
+                    reconciled.push(replacement);
+            }
+            if (reconciled.length === 0) {
+                this.pendingSenderKeyByAgent.delete(recipientAgentAddress);
+            }
+            else {
+                this.pendingSenderKeyByAgent.set(recipientAgentAddress, reconciled);
+            }
+        };
         for (let i = 0; i < queue.length; i += 1) {
             const entry = queue[i];
+            // A row may only be consumed by the caller's exact current-authority
+            // route and graph scope. Legacy/no-peer rows are expanded into explicit
+            // peer-bound obligations before reaching this drain. Foreground callers
+            // additionally bind the current sender + epoch; connection-open callers
+            // explicitly authorize every subgraph for one resolved CG.
+            if (!pendingSenderKeyEntryMatchesDrainAuthority(entry, authority)) {
+                outcomes.set(entry, entry);
+                continue;
+            }
+            // Authority can change while this route waits for the per-agent drain
+            // lock, or while a preceding row is in flight. Re-resolve immediately
+            // before every send so a stale caller snapshot can never consume a row.
+            let routeStillCurrent = false;
             try {
-                const sendResult = await this.messenger.sendReliable(input.peerId, PROTOCOL_SWM_SENDER_KEY, entry.packageBytes, { messageId: this.swmSenderKeyPendingMessageId(entry) });
+                const resolution = await this.resolveWorkspaceAgentRecipientsForCurrentAuthority({
+                    contextGraphId: entry.contextGraphId,
+                });
+                routeStillCurrent = resolution.requiresEncryption
+                    && resolution.recipients.some((recipient) => (recipient.agentAddress.toLowerCase() === entry.recipientAgentAddress
+                        && recipient.recipientKeyId === entry.recipientKeyId
+                        && recipient.peerId === entry.recipientPeerId));
+            }
+            catch {
+                // Fail closed. The queued obligation remains available for a later
+                // current-authority retry.
+            }
+            if (!routeStillCurrent) {
+                outcomes.set(entry, entry);
+                continue;
+            }
+            try {
+                const sendResult = await this.messenger.sendReliable(authority.recipientPeerId, PROTOCOL_SWM_SENDER_KEY, entry.packageBytes, { messageId: this.swmSenderKeyPendingMessageId(entry) });
                 if (!sendResult.delivered) {
                     if (sendResult.queued || ('inFlight' in sendResult && sendResult.inFlight)) {
-                        remaining.push(entry);
+                        outcomes.set(entry, entry);
                         continue;
                     }
                     throw new Error(`Unexpected undelivered Sender Key retry result: ${sendResult.error}`);
@@ -1326,65 +1797,134 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
                 catch {
                     // Malformed/legacy ACK: no positive acceptance yet. Keep the
                     // row queued so a mixed-version rollout cannot strand the recipient.
-                    remaining.push(this.rotateSwmSenderKeyPendingMessageId(entry));
+                    outcomes.set(entry, this.rotateSwmSenderKeyPendingMessageId(entry));
                     continue;
                 }
                 if (ack.version !== SWM_SENDER_KEY_PACKAGE_VERSION ||
                     ack.type !== SWM_SENDER_KEY_PACKAGE_ACK_TYPE) {
                     // Malformed/legacy ACK: no positive acceptance yet. Keep the
                     // row queued so a mixed-version rollout cannot strand the recipient.
-                    remaining.push(this.rotateSwmSenderKeyPendingMessageId(entry));
+                    outcomes.set(entry, this.rotateSwmSenderKeyPendingMessageId(entry));
                     continue;
                 }
                 if (ack.accepted) {
                     drained += 1;
+                    outcomes.set(entry, null);
                 }
                 else if (this.isRetryableSwmSenderKeySetupAckReason(ack.reasonCode)) {
-                    remaining.push(this.rotateSwmSenderKeyPendingMessageId(entry));
+                    outcomes.set(entry, this.rotateSwmSenderKeyPendingMessageId(entry));
                 }
                 else {
                     const reason = ack.reason ?? 'unknown reason';
                     const reasonCode = ack.reasonCode ?? 'legacy-unknown';
                     this.log.warn(input.ctx ?? SWM_SENDER_KEY_PENDING_DRAIN_LOG_CTX, `SWM sender-key pending retry for ${entry.recipientAgentAddress} keyId=${entry.recipientKeyId} ` +
-                        `peerId=${input.peerId} contextGraph=${entry.contextGraphId}${entry.subGraphName ? `/${entry.subGraphName}` : ''} ` +
+                        `peerId=${authority.recipientPeerId} contextGraph=${entry.contextGraphId}${entry.subGraphName ? `/${entry.subGraphName}` : ''} ` +
                         `dropped after terminal rejection (${reasonCode}): ${reason}`);
                     // Terminal rejection: keep it out of the queue, but do not
                     // report it as a successful drain.
+                    outcomes.set(entry, null);
                 }
             }
             catch (err) {
-                remaining.push(...queue.slice(i));
-                if (remaining.length === 0) {
-                    this.pendingSenderKeyByAgent.delete(recipientAgentAddress);
-                }
-                else {
-                    this.pendingSenderKeyByAgent.set(recipientAgentAddress, remaining);
+                outcomes.set(entry, entry);
+                for (const unprocessed of queue.slice(i + 1)) {
+                    outcomes.set(unprocessed, unprocessed);
                 }
+                commitOutcomes();
                 await this.saveSwmSenderKeyState();
                 const message = err instanceof Error ? err.message : String(err);
                 this.log.warn(input.ctx ?? SWM_SENDER_KEY_PENDING_DRAIN_LOG_CTX, `SWM sender-key pending retry for ${entry.recipientAgentAddress} keyId=${entry.recipientKeyId} ` +
-                    `peerId=${input.peerId} contextGraph=${entry.contextGraphId}${entry.subGraphName ? `/${entry.subGraphName}` : ''} ` +
+                    `peerId=${authority.recipientPeerId} contextGraph=${entry.contextGraphId}${entry.subGraphName ? `/${entry.subGraphName}` : ''} ` +
                     `failed before the Messenger substrate queued a retry: ${message}`);
                 throw err;
             }
         }
-        if (remaining.length === 0) {
-            this.pendingSenderKeyByAgent.delete(recipientAgentAddress);
-        }
-        else {
-            this.pendingSenderKeyByAgent.set(recipientAgentAddress, remaining);
-        }
+        commitOutcomes();
         await this.saveSwmSenderKeyState();
         return drained;
     }
     /**
-     * Drain queued sender-key packages whose recipient agent is one of
-     * the agent addresses advertised by `peerId`. Returns the number of
-     * rows successfully delivered (acked) and removed.
+     * Upgrade legacy/no-peer pending rows into one durable obligation per exact
+     * `(agent, key, peer)` route in a current authority-fenced recipient
+     * snapshot. The replacement is synchronous so drains can never observe a
+     * partially expanded multi-peer obligation.
+     */
+    expandUnboundPendingSenderKeyRoutes(input) {
+        const peersByAgentAndKey = new Map();
+        for (const recipient of input.recipients) {
+            if (!recipient.peerId)
+                continue;
+            const routeKey = `${recipient.agentAddress.toLowerCase()}\0${recipient.recipientKeyId}`;
+            const peers = peersByAgentAndKey.get(routeKey) ?? new Set();
+            peers.add(recipient.peerId);
+            peersByAgentAndKey.set(routeKey, peers);
+        }
+        if (peersByAgentAndKey.size === 0)
+            return 0;
+        const boundRouteIdentity = (entry, peerId) => JSON.stringify([
+            entry.senderAgentAddress,
+            entry.recipientKeyId,
+            peerId,
+            entry.epochId,
+            entry.contextGraphId,
+            entry.subGraphName ?? null,
+        ]);
+        const senderAgentAddress = input.senderAgentAddress?.toLowerCase();
+        let expanded = 0;
+        for (const [recipientAgentAddress, queue] of this.pendingSenderKeyByAgent.entries()) {
+            const existingBoundRoutes = new Set(queue
+                .flatMap((entry) => entry.recipientPeerId === undefined
+                ? []
+                : [boundRouteIdentity(entry, entry.recipientPeerId)]));
+            let changed = false;
+            const replacement = [];
+            for (const entry of queue) {
+                const matchesScope = entry.contextGraphId === input.contextGraphId
+                    && (input.allSubgraphs
+                        || (entry.subGraphName ?? undefined) === (input.subGraphName ?? undefined))
+                    && (senderAgentAddress === undefined || entry.senderAgentAddress === senderAgentAddress)
+                    && (input.epochId === undefined || entry.epochId === input.epochId);
+                if (entry.recipientPeerId !== undefined || !matchesScope) {
+                    replacement.push(entry);
+                    continue;
+                }
+                const peers = peersByAgentAndKey.get(`${entry.recipientAgentAddress}\0${entry.recipientKeyId}`);
+                if (!peers || peers.size === 0) {
+                    replacement.push(entry);
+                    continue;
+                }
+                changed = true;
+                expanded += 1;
+                for (const peerId of peers) {
+                    const identity = boundRouteIdentity(entry, peerId);
+                    if (existingBoundRoutes.has(identity))
+                        continue;
+                    replacement.push({ ...entry, recipientPeerId: peerId });
+                    existingBoundRoutes.add(identity);
+                }
+            }
+            if (changed) {
+                if (replacement.length === 0) {
+                    this.pendingSenderKeyByAgent.delete(recipientAgentAddress);
+                }
+                else {
+                    this.pendingSenderKeyByAgent.set(recipientAgentAddress, replacement);
+                }
+            }
+        }
+        return expanded;
+    }
+    /**
+     * Drain queued sender-key packages whose exact current recipient route is
+     * the newly connected `peerId`. Returns the number of rows successfully
+     * delivered (acked) and removed.
      *
      * Fired from the `connection:open` listener — see line 2382 — so the
      * cost lives on the cold path of "we just connected to a new peer",
-     * not on every share. Each successful `sendReliable` with
+     * not on every share. Every context graph represented by either a bound or
+     * legacy row is resolved first; bound rows never bypass that authority read.
+     * Legacy/no-peer rows are expanded only from that graph's current,
+     * authority-fenced recipient snapshot. Each successful `sendReliable` with
      * `delivered=true && ack.accepted=true` deletes the row and counts as
      * drained; soft (`delivered=false`) and explicitly retryable delivered
      * rejections leave it queued for the next attempt; terminal delivered
@@ -1395,21 +1935,80 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         if (this.pendingSenderKeyByAgent.size === 0)
             return 0;
         let drained = 0;
-        let agentAddresses = [];
-        try {
-            const profile = await this.discovery.findAgentByPeerId(peerId);
-            if (profile?.agentAddress) {
-                agentAddresses = [profile.agentAddress.toLowerCase()];
+        const pendingContextGraphIds = new Set([...this.pendingSenderKeyByAgent.values()]
+            .flatMap((queue) => queue
+            .filter((entry) => entry.recipientPeerId === undefined || entry.recipientPeerId === peerId)
+            .map((entry) => entry.contextGraphId)));
+        let expandedRows = 0;
+        for (const contextGraphId of pendingContextGraphIds) {
+            let resolution;
+            try {
+                resolution = await this.resolveWorkspaceAgentRecipientsForCurrentAuthority({
+                    contextGraphId,
+                });
+            }
+            catch {
+                // Authority/key resolution failure is benign on connection-open. No
+                // row for this CG — including already bound rows — may bypass it.
+                continue;
+            }
+            if (!resolution.requiresEncryption)
+                continue;
+            expandedRows += this.expandUnboundPendingSenderKeyRoutes({
+                recipients: resolution.recipients,
+                contextGraphId,
+                allSubgraphs: true,
+            });
+            const routes = new Map();
+            for (const recipient of resolution.recipients) {
+                if (recipient.peerId !== peerId)
+                    continue;
+                const recipientAgentAddress = recipient.agentAddress.toLowerCase();
+                const authority = {
+                    contextGraphId,
+                    allSubgraphs: true,
+                    recipientAgentAddress,
+                    recipientKeyId: recipient.recipientKeyId,
+                    recipientPeerId: peerId,
+                };
+                const queue = this.pendingSenderKeyByAgent.get(recipientAgentAddress);
+                if (!queue?.some((entry) => (pendingSenderKeyEntryMatchesDrainAuthority(entry, authority))))
+                    continue;
+                routes.set(`${recipientAgentAddress}\0${recipient.recipientKeyId}\0${peerId}`, authority);
+            }
+            for (const authority of routes.values()) {
+                drained += await this.drainPendingSenderKeyQueueForPeer({ authority, ctx });
             }
         }
-        catch {
-            // Resolution failure is benign — we'll try again on the next
-            // connection:open burst. Don't propagate.
+        if (expandedRows > 0) {
+            // A connection can teach us routes for another peer. Persist that legacy
+            // migration even when this peer had no exact authorized row to drain.
+            await this.saveSwmSenderKeyState();
         }
-        if (agentAddresses.length === 0)
+        return drained;
+    }
+    /**
+     * A delivered Sender Key setup can receive a retryable authority denial.
+     * That leaves a durable pending row but does not create a Messenger outbox
+     * retry, and an already-connected recipient may never produce another
+     * connection:open event. Retry only peer-bound rows on the ordinary outbox
+     * cadence. The drain below re-resolves current graph authority and the exact
+     * recipient key/peer route before sending any package.
+     */
+    async drainPendingSenderKeysForConnectedPeers() {
+        await this.loadSwmSenderKeyState();
+        if (this.pendingSenderKeyByAgent.size === 0 || !this.node.isStarted)
+            return 0;
+        const pendingPeers = new Set([...this.pendingSenderKeyByAgent.values()]
+            .flatMap((queue) => queue.flatMap((entry) => entry.recipientPeerId === undefined ? [] : [entry.recipientPeerId])));
+        if (pendingPeers.size === 0)
             return 0;
-        for (const recipientAgentAddress of agentAddresses) {
-            drained += await this.drainPendingSenderKeyQueueForPeer({ peerId, recipientAgentAddress, ctx });
+        let drained = 0;
+        for (const peer of this.node.libp2p.getPeers()) {
+            const peerId = peer.toString();
+            if (!pendingPeers.has(peerId))
+                continue;
+            drained += await this.drainPendingSenderKeyForPeer(peerId);
         }
         return drained;
     }
@@ -1419,25 +2018,41 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
      * connections where no fresh connection:open event will fire after the
      * remote membership/key view converges.
      */
-    async drainPendingSenderKeyForRecipients(recipients, ctx) {
+    async drainPendingSenderKeyForRecipients(recipients, ctx, scope) {
         if (this.pendingSenderKeyByAgent.size === 0)
             return 0;
-        const peerByAgent = new Map();
+        const senderAgentAddress = scope.senderAgentAddress.toLowerCase();
+        this.expandUnboundPendingSenderKeyRoutes({
+            recipients,
+            contextGraphId: scope.contextGraphId,
+            subGraphName: scope.subGraphName,
+            senderAgentAddress,
+            epochId: scope.epochId,
+        });
+        const routes = new Map();
         for (const recipient of recipients) {
             if (!recipient.peerId)
                 continue;
             const recipientAgentAddress = recipient.agentAddress.toLowerCase();
             if (!this.pendingSenderKeyByAgent.has(recipientAgentAddress))
                 continue;
-            if (!peerByAgent.has(recipientAgentAddress)) {
-                peerByAgent.set(recipientAgentAddress, recipient.peerId);
-            }
+            const authority = {
+                contextGraphId: scope.contextGraphId,
+                subGraphName: scope.subGraphName,
+                senderAgentAddress,
+                epochId: scope.epochId,
+                recipientAgentAddress,
+                recipientKeyId: recipient.recipientKeyId,
+                recipientPeerId: recipient.peerId,
+            };
+            const routeKey = `${recipientAgentAddress}\0${recipient.recipientKeyId}\0${recipient.peerId}`;
+            routes.set(routeKey, authority);
         }
-        if (peerByAgent.size === 0)
+        if (routes.size === 0)
             return 0;
         let drained = 0;
-        for (const [recipientAgentAddress, peerId] of peerByAgent.entries()) {
-            drained += await this.drainPendingSenderKeyQueueForPeer({ peerId, recipientAgentAddress, ctx });
+        for (const authority of routes.values()) {
+            drained += await this.drainPendingSenderKeyQueueForPeer({ authority, ctx });
         }
         if (drained > 0 && ctx) {
             this.log.info(ctx, `SWM sender-key pending retry drained ${drained} queued package(s) during publish`);
@@ -1667,7 +2282,21 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         if (recovered.toLowerCase() !== senderAgentAddress.toLowerCase()) {
             throw new SwmSenderKeySetupRejectionError('bad-signature', `Sender Key setup signature recovered ${recovered}, expected ${senderAgentAddress}`);
         }
-        const agentGateAddresses = await withRpcUsageSite(CG_AUTH_RPC_SITES.senderKeyAccept, () => this.getContextGraphAgentGateAddresses(pkg.contextGraphId));
+        const agentGateAuthority = await withRpcUsageSite(CG_AUTH_RPC_SITES.senderKeyAccept, () => this.resolveContextGraphAgentGateAuthority(pkg.contextGraphId));
+        if (agentGateAuthority.kind === 'unavailable') {
+            // Not knowing the gate is not evidence that either endpoint is outside
+            // it. Answering `sender-not-allowed` here made an authority failure look
+            // like a membership decision (#2827). A transient failure asks the
+            // sender to retain and retry the package; one that needs a software or
+            // configuration change is terminal, classified exactly as the promote
+            // retry is (isRetryableContextGraphAuthorityUnavailableReason).
+            throw new SwmSenderKeySetupRejectionError(isRetryableContextGraphAuthorityUnavailableReason(agentGateAuthority.reason)
+                ? 'agent-gate-pending'
+                : 'agent-gate-unavailable', `Context graph "${pkg.contextGraphId}" agent gate authority is unavailable (${agentGateAuthority.reason})`);
+        }
+        const agentGateAddresses = agentGateAuthority.kind === 'available'
+            ? agentGateAuthority.agentAddresses
+            : null;
         if (!agentGateAddresses) {
             // A cold private member can receive Sender Key setup after the finalized
             // chain binding but before its accepted RFC-64 roster or legacy `_meta`
@@ -1689,7 +2318,17 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         if (!agentGateSet.has(recipientAgentAddress.toLowerCase())) {
             throw new SwmSenderKeySetupRejectionError('recipient-not-allowed', `Recipient agent ${recipientAgentAddress} is not allowed for context graph "${pkg.contextGraphId}"`);
         }
-        const allowedPeers = await this.getContextGraphAllowedPeers(pkg.contextGraphId);
+        let allowedPeers;
+        try {
+            allowedPeers = await this.resolveSwmAllowedPeersForCurrentAuthority(pkg.contextGraphId);
+        }
+        catch (error) {
+            if (!isContextGraphAuthorityUnavailableMarker(error))
+                throw error;
+            throw new SwmSenderKeySetupRejectionError(isRetryableContextGraphAuthorityUnavailableReason(error.reason)
+                ? 'agent-gate-pending'
+                : 'agent-gate-unavailable', `Context graph "${pkg.contextGraphId}" SWM peer gate authority is unavailable (${error.reason})`);
+        }
         if (allowedPeers !== null && !allowedPeers.includes(fromPeerId)) {
             throw new SwmSenderKeySetupRejectionError('sender-not-allowed', `Sender peer ${fromPeerId} is not allowed for context graph "${pkg.contextGraphId}"`);
         }
@@ -2018,23 +2657,32 @@ export class WorkspaceCryptoMethods extends DKGAgentBase {
         const path = this.swmSenderKeyStatePath();
         if (!path)
             return;
-        const { mkdir, writeFile, chmod } = await import('node:fs/promises');
-        const { dirname } = await import('node:path');
-        await mkdir(dirname(path), { recursive: true });
-        const payload = {
-            version: 1,
-            send: [...this.swmSenderKeySendStates.values()].map(serializeSwmSenderSendState),
-            receive: [...this.swmSenderKeyReceiveStates.values()].map(serializeSwmSenderReceiveState),
-            pending: [...this.pendingSenderKeyByAgent.values()]
-                .flatMap((queue) => queue.map(serializePendingSenderKeyEntry)),
-        };
-        await writeFile(path, JSON.stringify(payload, null, 2), { mode: 0o600 });
-        try {
-            await chmod(path, 0o600);
-        }
-        catch {
-            // Best-effort on platforms/filesystems that do not support chmod.
-        }
+        const save = this.swmSenderKeyStateSaveQueue.then(async () => {
+            const { mkdir, writeFile, chmod } = await import('node:fs/promises');
+            const { dirname } = await import('node:path');
+            await mkdir(dirname(path), { recursive: true });
+            // Capture inside the serialized section. A caller queued behind an
+            // in-flight write must persist the state current when its turn begins,
+            // not a stale snapshot captured while the older write was outstanding.
+            const payload = {
+                version: 1,
+                send: [...this.swmSenderKeySendStates.values()].map(serializeSwmSenderSendState),
+                receive: [...this.swmSenderKeyReceiveStates.values()].map(serializeSwmSenderReceiveState),
+                pending: [...this.pendingSenderKeyByAgent.values()]
+                    .flatMap((queue) => queue.map(serializePendingSenderKeyEntry)),
+            };
+            await writeFile(path, JSON.stringify(payload, null, 2), { mode: 0o600 });
+            try {
+                await chmod(path, 0o600);
+            }
+            catch {
+                // Best-effort on platforms/filesystems that do not support chmod.
+            }
+        });
+        // A failed save is still reported to its caller, but must not poison the
+        // queue and suppress every later persistence attempt.
+        this.swmSenderKeyStateSaveQueue = save.catch(() => undefined);
+        await save;
     }
     async resolveWorkspaceGossipSigningAgent(contextGraphId) {
         const authority = await withRpcUsageSite(CG_AUTH_RPC_SITES.signer, () => this.resolveContextGraphAgentGateAuthority(contextGraphId));