@origintrail-official/dkg-agent 10.0.19 → 10.0.21

package/dist/dkg-agent-lifecycle.js

@@ -1,3 +1,6 @@
+import { syncReconcilerEnabled, syncOnConnectEnabled, durableSyncEnabled } from './internal/lifecycle-sync-policy.js';
+import { emptySwmRecoveryResult } from './sync/shared-memory-completion.js';
+import { DurableSyncAdmissionBoundary } from './sync/requester/admission-boundary.js';
 import { createRandomSamplingEligibilityResolver } from './random-sampling-eligibility.js';
 import { RandomSamplingRuntime } from './random-sampling-runtime.js';
 import { startAuthorityIndexSnapshotRuntime } from './authority-index-snapshot-runtime.js';
@@ -12,10 +15,11 @@ import { startAuthorityIndexSnapshotRuntime } from './authority-index-snapshot-r
 import { traverseBoundedCuratorRoster, curatorRosterResolution, } from './bounded-curator-roster-traversal.js';
 import { setTimeout as waitForPeerEventTurn } from 'node:timers/promises';
 import { PeerSyncSession } from './sync/peer-sync-session.js';
+import { captureExactBatchStreamRefusalScope } from './sync/exact-batch-stream-capability.js';
 import { createStorageACKRegistrationPlan } from './p2p/storage-ack-registrar.js';
 import { syncOpenedPeerConnection } from './sync/peer-connection.js';
 import { isLegacySyncGraphCandidateV1 } from './sync/legacy-sync-graph-candidate.js';
-import { ProtocolRouter, GossipSubManager, DKGEvent, LibP2PNetwork, PeerResolver, StubNetworkStateRegistry, PROTOCOL_ACCESS, PROTOCOL_PUBLISH, PROTOCOL_SYNC, PROTOCOL_SYNC_POOLED, PROTOCOL_SYNC_CHANGELOG, PROTOCOL_QUERY_REMOTE, PROTOCOL_GET_CIPHERTEXT_CHUNK, PROTOCOL_VERIFY_PROPOSAL, PROTOCOL_JOIN_REQUEST, PROTOCOL_NETWORK_IDENTITY, PROTOCOL_SWM_SENDER_KEY, PROTOCOL_SWM_UPDATE, PROTOCOL_SWM_SHARE_ACK, PROTOCOL_SWM_HOST_CATCHUP, PROTOCOL_MESSAGE, contextGraphDataGraphUri, contextGraphMetaGraphUri, contextGraphWorkspaceMetaGraphUri, contextGraphMetaUri, deriveCuratorDidFromCgId, SYSTEM_CONTEXT_GRAPHS, DKG_ONTOLOGY, GRAPH_KA_CONTENT_SCOPE_VERSION, validateSubGraphName, createOperationContext, isSafeIri, InMemoryMessageIdempotencyStore, InMemoryProtocolOutboxStore, assertBoundedProtocolOutboxStore, tripleContentV10, withRetry, } from '@origintrail-official/dkg-core';
+import { ProtocolRouter, GossipSubManager, DKGEvent, registerExperimentalExactBatchResponder, LibP2PNetwork, PeerResolver, StubNetworkStateRegistry, PROTOCOL_ACCESS, PROTOCOL_PUBLISH, PROTOCOL_SYNC, PROTOCOL_SYNC_POOLED, PROTOCOL_SYNC_CHANGELOG, PROTOCOL_QUERY_REMOTE, PROTOCOL_GET_CIPHERTEXT_CHUNK, PROTOCOL_VERIFY_PROPOSAL, PROTOCOL_JOIN_REQUEST, PROTOCOL_NETWORK_IDENTITY, advertisesSyncProtocol, PROTOCOL_SWM_SENDER_KEY, PROTOCOL_SWM_UPDATE, PROTOCOL_SWM_SHARE_ACK, PROTOCOL_SWM_HOST_CATCHUP, PROTOCOL_MESSAGE, contextGraphDataGraphUri, contextGraphMetaGraphUri, contextGraphWorkspaceMetaGraphUri, contextGraphMetaUri, deriveCuratorDidFromCgId, SYSTEM_CONTEXT_GRAPHS, DKG_ONTOLOGY, GRAPH_KA_CONTENT_SCOPE_VERSION, validateSubGraphName, createOperationContext, isSafeIri, QuietRetryableHandlerError, InMemoryMessageIdempotencyStore, InMemoryProtocolOutboxStore, assertBoundedProtocolOutboxStore, tripleContentV10, withRetry, } from '@origintrail-official/dkg-core';
 import { GraphManager, asChangelogReader } from '@origintrail-official/dkg-storage';
 import { readChangelogDeltaPage } from './sync/responder/graph-plan.js';
 import { decodeChangelogRequest, encodeChangelogResponse } from './sync/changelog/wire.js';
@@ -28,9 +32,11 @@ import { PublishHandler, ChainEventPoller, AccessHandler, PublishJournal, Verify
 import { ethers } from 'ethers';
 import { QueryHandler, } from '@origintrail-official/dkg-query';
 import { repairCreatorPublicMetaProjections } from './context-graph-public-meta-repair.js';
+import { METADATA_RELOCATION_STARTUP_BUDGET_MS } from './context-graph-metadata-relocation.js';
 import { startRandomSamplingExactRepair, } from './sync/recovery/random-sampling-exact-repair.js';
 import { reconcileConfiguredContextGraphMetadataV1, } from './configured-context-graph-metadata-reconciliation.js';
-import { confirmContextGraphMetadataV1 } from './context-graph-meta-confirmation.js';
+import { confirmContextGraphMetadataV1, } from './context-graph-meta-confirmation.js';
+import { resolveApprovedMemberAcceptanceDecision, } from './internal/context-graph-authority/approved-member-acceptance.js';
 import { MessageHandler } from './messaging.js';
 import { ed25519ToX25519Private } from './encryption.js';
 import { SyncVerifyWorker, } from './sync-verify-worker.js';
@@ -52,6 +58,7 @@ import { deleteSyncPageCheckpoint, fetchSyncPages, SyncPageSizeProfileCache, } f
 import { composeSyncWorkAdmission, createSyncFetchSharingIdentity, } from './sync/work-admission.js';
 import { createChallengePinnedExactAssetSelection, createUalOnlyExactAssetSelection, exactAssetUalsForSelection, exactAssetFilterKey, exactSyncPhaseAccumulationLimits, requireExactAssetSelection, } from './sync/exact-assets.js';
 import { runOversizeSweep } from './sync/oversize-sweep.js';
+import { EXACT_SYNC_GZIP_ENCODING, resolveExactSyncGzipProfile } from './sync/wire-compression.js';
 import { MemorySyncCheckpointStore, } from './sync/checkpoint/state.js';
 import { DurableRecoveryRunner, } from './sync/durable-recovery-runner.js';
 import { createDurableSyncBudget, createDurableSyncFetchTimeoutMs, DURABLE_SYNC_SETTLEMENT_HEADROOM_MS, EXACT_RECOVERY_DURABLE_TRANSFER_TIMEOUT_MS, normalizeDurableSyncTimeoutMs, } from './sync/requester/durable-sync-budget.js';
@@ -61,25 +68,28 @@ import { mergeExactAssetResponderCapability, mergeExactDurableFetchDisposition,
 import { resolveSyncAgentsMeta, shouldWithholdAgentsDurableMeta } from './sync/agents-meta-policy.js';
 import { createSelectedSwmMetaRetentionBudget, } from './sync/selected-swm-meta-budget.js';
 import { sharedMemoryOwnershipKeyFromGraph, } from './sync/requester/shared-memory-sync.js';
-import { emptySharedMemorySyncResult as createEmptySharedMemorySyncResult, mergeFleetSharedMemoryDiagnostics, mergeSamePeerSharedMemoryDiagnostics, recordSharedMemoryPhaseFailure, } from './sync/shared-memory-diagnostics.js';
+import { emptySharedMemorySyncResult, mergeSamePeerSharedMemoryDiagnostics, mergeFleetSharedMemoryDiagnostics, recordSharedMemoryPhaseFailure, } from './sync/shared-memory-diagnostics.js';
 import { createSelectedSwmMetaFetcher, } from './sync/selected-swm-meta-fetcher.js';
 import { runOrderedContextGraphSyncs, } from './sync/requester/ordered-sync.js';
 import { registerSyncHandler, resolveSyncResponderSnapshotPolicy, } from './sync/responder/sync-handler.js';
+import { createExactBatchResponderBinding } from './sync/responder/exact-batch-stream.js';
+import { exactBatchTransportOptions } from './sync/requester/exact-batch-stream.js';
+import { runExactBatchStreamDriver } from './sync/requester/exact-batch-stream-driver.js';
 import { runSelectedSharedMemoryRetry, runRegistrySyncOnConnect, SyncOnConnectPostSyncError, } from './sync/on-connect/sync-on-connect.js';
 import { captureSyncOnConnectAttempt, } from './sync/on-connect/attempt-accounting.js';
 import { ReconciledSyncOnConnectPeerJobRunner } from './sync/on-connect/peer-job-runner.js';
 import { formatPrivateRecoverySkip, planPrivateRecoverySource, } from './sync/private-recovery-source-planner.js';
 import { mapWithConcurrency } from './map-with-concurrency.js';
 import { CATCHUP_MAX_CONCURRENT_PEER_SYNCS } from './sync/catchup-concurrency.js';
-import { FOREGROUND_CATCHUP_SYNC_PRIORITY, catchupAdmissionSource, runCatchupPlaneWithPolicy, runCatchupPlanesWithPolicy, } from './sync/catchup-policy.js';
+import { FOREGROUND_CATCHUP_SYNC_PRIORITY, VM_RECOVERY_SYNC_PRIORITY, catchupAdmissionSource, runCatchupPlaneWithPolicy, runCatchupPlanesWithPolicy, } from './sync/catchup-policy.js';
 import { SwmCatchupPassTracker, catchupPassNowMs, resolveSwmCatchupPassConfig, runSwmCatchupContinuations, } from './sync/catchup-pass-policy.js';
 import { runSelectedSwmContinuations, } from './sync/selected-swm-continuation.js';
 import { projectRfc64SelectedSwmGraphSyncStatus, } from './sync/selected-swm-graph-sync-status.js';
 import { applySelectedSwmFreshnessResolution, } from './sync/shared-memory-freshness.js';
 import { classifyDurableProgress, createDurableSyncAccumulator, createFailedPeerDurableSyncResult, createIncompleteDurableSyncResult, durableSyncAccumulatorHasPeerTransportFailure, durableSyncAccumulatorHasTerminalBoundary, durableSyncAccumulatorFromResult, finalizeDurableSyncCompletion, markDurableTerminalBoundary, mergeDurableSyncAccumulatorInto, mergeDurableSyncResultIntoAccumulator, recordDurableSyncDiagnostics, } from './sync/durable-progress.js';
-import { getSyncBackpressureSnapshot, getSyncBackpressureBusyError, resolveBooleanSwitch, resolveSyncReconcilerEnabled, resolveSyncGlobalBackpressure, withGlobalSyncBackpressure, } from './sync/backpressure.js';
+import { getSyncBackpressureSnapshot, getSyncBackpressureBusyError, resolveExactBatchStreamEnabled, resolveSyncGlobalBackpressure, syncAdmissionWouldBeRefused, withGlobalSyncBackpressure, } from './sync/backpressure.js';
 import { contextGraphPriority, countSyncPriorityClasses, normalizeSyncAdmissionSource, orderContextGraphIdsByPriority, syncPriorityClass, } from './sync/policy.js';
-import { automaticDurableSyncContextGraphs } from './sync/system-context-graph-policy.js';
+import { automaticDurableSyncContextGraphs, systemContextGraphSyncOptionsOf, } from './sync/system-context-graph-policy.js';
 import { activeSyncAdmissionSource, monotonicNowMs, recordSyncAttempt, recordSyncAttemptRequestBytes, recordSyncAttemptResponseBytes, recordSyncOperationDuration, recordSyncOperationRejected, recordSyncSingleFlightJoin, syncAttemptAttributes, syncOperationRejectionReason, withSyncAdmissionSource, } from './sync/attempt-telemetry.js';
 // rc.9 PR-10: JoinApprovalRetryQueue removed — substrate outbox
 // (durable, SQLite-backed) replaces it. We keep a minimal local
@@ -96,6 +106,66 @@ const DEFAULT_MAX_REHYDRATED_SUBSCRIPTIONS = 64;
 const REHYDRATE_THROTTLE_BATCH = 8;
 /** Retry interval for a persisted-subscription activation that is waiting for a slot. */
 const REHYDRATION_ROLLING_RETRY_MS = 30_000;
+/**
+ * How long startup rehydration waits on persisted rows' read authority before
+ * leaving the rest to background authority recovery (#2815). Override via
+ * `DKGAgentConfig.contextGraphSubscriptionRehydrationAuthorityBudgetMs` (0
+ * removes the budget).
+ */
+const DEFAULT_REHYDRATION_STARTUP_AUTHORITY_BUDGET_MS = 10_000;
+/** Longest delay a Node timer honours; a longer one fires after 1 ms. */
+const MAX_REHYDRATION_AUTHORITY_BUDGET_MS = 2_147_483_647;
+/** Stands in for an authority decision the startup budget stopped waiting for. */
+const REHYDRATION_AUTHORITY_DEFERRED = Symbol('rehydration-authority-deferred');
+/**
+ * Delays between attempts of a restarted join approval's metadata recovery
+ * after a transient failure; the last one repeats while the row stays
+ * restricted. One attempt is a single curator metadata fetch.
+ */
+const JOIN_APPROVAL_METADATA_RECOVERY_RETRY_MS = Object.freeze([15_000, 30_000, 60_000, 120_000, 300_000]);
+/**
+ * Wait `ms` unless the node stops first; resolves whether the wait completed.
+ * The listener is removed either way, so nothing stays attached to the
+ * node-lifetime signal.
+ */
+function waitUnlessStopped(ms, stopSignal) {
+    return new Promise((resolve) => {
+        if (stopSignal?.aborted === true) {
+            resolve(false);
+            return;
+        }
+        const onStop = () => {
+            clearTimeout(timer);
+            resolve(false);
+        };
+        const timer = setTimeout(() => {
+            stopSignal?.removeEventListener('abort', onStop);
+            resolve(true);
+        }, ms);
+        timer.unref?.();
+        stopSignal?.addEventListener('abort', onStop, { once: true });
+    });
+}
+function startRehydrationAuthorityBudget(budgetMs) {
+    if (budgetMs === 0) {
+        return { spent: () => false, race: (decision) => decision, dispose: () => { } };
+    }
+    let spent = false;
+    let expire = () => { };
+    const expired = new Promise((resolve) => {
+        expire = () => resolve(REHYDRATION_AUTHORITY_DEFERRED);
+    });
+    const timer = setTimeout(() => {
+        spent = true;
+        expire();
+    }, budgetMs);
+    timer.unref?.();
+    return {
+        spent: () => spent,
+        race: (decision) => Promise.race([decision, expired]),
+        dispose: () => clearTimeout(timer),
+    };
+}
 function rehydratedSubscriptionReachedSafeState(subscription) {
     return subscription.synced === true
         && subscription.metaSynced !== false
@@ -116,6 +186,7 @@ import { stripLiteral, } from './dkg-agent-utils.js';
 import { SYNC_BYTE_BUDGET_MAX_ROWS, SYNC_PAGE_SIZE, SYNC_REQUEST_PAGE_SIZE, SYNC_PAGE_RETRY_ATTEMPTS, SYNC_TOTAL_TIMEOUT_MS, SYNC_MIN_GRAPH_BUDGET_MS, SYNC_PAGE_TIMEOUT_MS, SYNC_ROUTER_ATTEMPTS, SYNC_PROTOCOL_CHECK_ATTEMPTS, SYNC_PROTOCOL_CHECK_DELAY_MS, SYNC_ACCESS_DENIED_MARKER, DEBUG_SYNC_PROGRESS, DEFAULT_SWM_TTL_MS, SWM_CLEANUP_INTERVAL_MS, SYNC_DENIED_RESPONSE, GOSSIP_DIAL_COOLDOWN_MS, GOSSIP_DIAL_TIMEOUT_MS, CATCHUP_ON_CONNECT_COOLDOWN_MS, SYNC_RECONNECT_FLAP_GRACE_MS, MESSAGE_OUTBOX_TICK_MS, AGENT_PROFILE_HEARTBEAT_MS, AGENT_PROFILE_STALE_THRESHOLD_MS, WARM_CORE_CONNECTIONS_ENABLED, WARM_CORE_RECONCILE_INTERVAL_MS, WARM_CORE_MAX, WARM_CORE_KEEPALIVE_TAG, WARM_CORE_DIAL_TIMEOUT_MS, BOOT_CHAIN_IDENTITY_TIMEOUT_MS, } from './dkg-agent-constants.js';
 import { chainAuthorityReadBudgetsOf } from './chain-authority-read-budgets.js';
 import { peekFinalizedAuthorityColdResolution } from './finalized-authority-cold-resolution.js';
+import { AGENTS_PHONEBOOK_PRIME_MAX_DIALS, peekOnDemandAgentsPhonebook, } from './sync/on-demand-agents-phonebook.js';
 import { raceWithBootTimeout, isTransientBootChainError } from './dkg-agent-boot.js';
 import { normalizeContextGraphSubscriptionTransition, projectContextGraphSubscriptionPersistence, } from './context-graph-subscription-policy.js';
 import { partitionSupersededContextGraphNamePlaceholders } from './dkg-agent-cg-name-resolution.js';
@@ -126,7 +197,9 @@ import { normalizeAgentDid, inferAdapterPublisherAddress, } from './dkg-agent-he
 import { DKGAgentBase } from './dkg-agent-base.js';
 import { VmReconcileShutdownTimeoutError } from './vm-reconcile-service.js';
 import { ContextGraphMembershipPersistShutdownTimeoutError } from './context-graph-membership-persist-scheduler.js';
+import { ContextGraphSubscriptionPersistShutdownTimeoutError } from './context-graph-subscription-persist-scheduler.js';
 import { createLocalContextGraphOriginMembershipRecord, } from './local-context-graph-provenance.js';
+import { contextGraphReadAuthorityDependencyOf, unavailableContextGraphReadAuthorityDecision, } from './context-graph-read-authority.js';
 import { deterministicStartupJitterMs, scheduleAfterStartupJitter } from './startup-jitter.js';
 import { projectContextGraphDormancy, } from './context-graph-subscription-dormancy.js';
 import { activatePersistedContextGraphSubscription as activatePersistedContextGraphSubscriptionTransaction, recoverDeferredContextGraphSubscriptionAuthorities, } from './context-graph-subscription-authority-recovery.js';
@@ -135,34 +208,11 @@ import { isRfc64PrivateRecoveryOwnerV1, resolveRfc64PrivateRecoveryContextGraphI
 import { CONTEXT_GRAPH_AUTHORITY_RPC_SITES as CG_AUTH_RPC_SITES, withRpcUsageSite, } from '@origintrail-official/dkg-chain';
 import { rfc64ExecutionPlanAllowsLegacySyncV1, resolveRfc64RuntimeCatalogBootstrapConfigV1, } from './rfc64/public-catalog-activation-config-v1.js';
 import { reconcileRfc64CatalogAuthorityPlanV1 } from './rfc64/catalog-rollout-authority-reconciliation-v1.js';
-import { initializeRfc64LegacySwmBoundaryV1, prepareRfc64LateLegacySwmBoundaryV1, } from './rfc64/legacy-swm-boundary-v1.js';
+import { initializeRfc64LegacySwmBoundaryV1, prepareRfc64LateLegacySwmBoundaryV1, retireRfc64LegacySwmAfterFinalizedVmV1, } from './rfc64/legacy-swm-boundary-v1.js';
+import { projectPersistedJoinApprovals, } from './join-approval-restart-projection.js';
+import { verifiedCuratorDialAddress } from './curator-dial-address.js';
 const DEFAULT_HOST_MODE_RECONCILE_JITTER_RATIO = 0.15;
 const RFC64_SELECTED_SWM_ADMISSION_PRIORITY = 2_000;
-function projectPersistedJoinApprovals(persistedMembershipRows, persistedContextGraphIds, localAgentAddresses) {
-    const newestApprovalByContextGraph = new Map();
-    for (const membership of persistedMembershipRows) {
-        const principalId = membership.principalId.toLowerCase();
-        if (membership.principalType !== 'agent' ||
-            membership.status !== 'active' ||
-            membership.source !== 'join-approved' ||
-            !persistedContextGraphIds.has(membership.contextGraphId) ||
-            !localAgentAddresses.has(principalId)) {
-            continue;
-        }
-        const existing = newestApprovalByContextGraph.get(membership.contextGraphId);
-        if (!existing || membership.updatedAt > existing.updatedAt) {
-            newestApprovalByContextGraph.set(membership.contextGraphId, {
-                principalId,
-                updatedAt: membership.updatedAt,
-                curatorPeerId: typeof membership.metadata?.['curatorPeerId'] === 'string' &&
-                    membership.metadata['curatorPeerId'].trim()
-                    ? membership.metadata['curatorPeerId'].trim()
-                    : undefined,
-            });
-        }
-    }
-    return newestApprovalByContextGraph;
-}
 function resolveAgentSyncGlobalBackpressure(config) {
     // `trackSyncContextGraph()` mutates this list when an Edge explicitly
     // subscribes or starts a foreground catch-up. Those operator-selected graphs
@@ -363,6 +413,8 @@ function syncPageFetchCoalescingKey(params) {
         params.assetUals === undefined ? null : exactAssetFilterKey(params.assetUals),
         params.returnAcceptedPrefixOnRetryableTransportFailure === true,
         params.requesterScope ?? null,
+        params.responseEncoding ?? null,
+        params.maxAcceptedBytes ?? null,
         params.maxAcceptedQuads ?? null,
         params.maxAcceptedHeapBytesEstimate ?? null,
     ]);
@@ -450,11 +502,14 @@ function contextGraphCatchupSingleFlightKey(params) {
 function durableSyncSingleFlightKey(params) {
     if (params.hasPhaseCallback
         || params.hasAtomicCommitCallback
+        || params.hasWorkStartedCallback
         || params.hasAccessDeniedCallback
         || params.hasSinceBatchIdResolver
         || params.hasSignal
         || params.hasCurrentFence
-        || params.hasChallengePinnedSelection) {
+        || params.hasChallengePinnedSelection
+        || params.hasForcedFreshExactSession
+        || params.hasRegisteredPublicEvidence) {
         return null;
     }
     return syncSingleFlightKey('durable-sync', {
@@ -466,6 +521,7 @@ function durableSyncSingleFlightKey(params) {
         syncAgentsMeta: params.syncAgentsMeta,
         exactAssetUals: params.exactAssetUals ?? null,
         settlementSliceTimeoutMs: params.settlementSliceTimeoutMs ?? null,
+        exactRecoveryTransportMode: params.exactRecoveryTransportMode ?? 'stream-preferred',
         priority: params.priority ?? null,
     });
 }
@@ -766,42 +822,16 @@ async function authenticateDurableGraphScopedAsset(params) {
         signal?.removeEventListener('abort', abortFromOperation);
     }
 }
-function sameStringArray(a, b) {
-    return a.length === b.length && a.every((value, index) => value === b[index]);
-}
-function syncReconcilerEnabled(config) {
-    return resolveSyncReconcilerEnabled(config.syncReconcilerEnabled);
-}
-function syncOnConnectEnabled(config) {
-    return resolveBooleanSwitch(config.syncOnConnectEnabled, 'DKG_SYNC_ON_CONNECT_ENABLED', true);
-}
-function durableSyncEnabled(config) {
-    return resolveBooleanSwitch(config.durableSyncEnabled, 'DKG_DURABLE_SYNC_ENABLED', true);
-}
 /** OT-RFC-59 responder cap on the peer-controlled raw-scan limit (DoS bound). Honest
  *  requesters send SYNC_PAGE_SIZE (500); the headroom tolerates larger legitimate pages. */
 const CHANGELOG_MAX_SCAN_LIMIT = 2000;
-function emptySharedMemorySyncResult() {
-    return createEmptySharedMemorySyncResult();
-}
-function mergeSharedMemorySyncResults(a, b) {
-    return {
-        ...mergeSamePeerSharedMemoryDiagnostics(a, b),
-    };
-}
-function emptySwmRecoveryResult() {
-    return {
-        replacedRoots: 0,
-        replacedGraphs: 0,
-        insertedDataQuads: 0,
-        insertedMetaQuads: 0,
-        droppedDataTriples: 0,
-        readySnapshots: 0,
-        totalSnapshots: 0,
-        completed: true,
-    };
+function sameStringArray(a, b) {
+    return a.length === b.length && a.every((value, index) => value === b[index]);
 }
 export class LifecycleSyncMethods extends DKGAgentBase {
+    async retireLegacySwmAfterVerifiedVmTwin(input) {
+        await retireRfc64LegacySwmAfterFinalizedVmV1(this, input.contextGraphId, input.kaUal, String(input.assertionVersion), input.subGraphName);
+    }
     async retireFinalizedSwmTwinCandidate(candidate, ctx) {
         await this.publisher.clearPublishedKnowledgeAssetSwm(candidate.contextGraphId, {
             kind: 'named-lifecycle',
@@ -884,6 +914,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 // lanes, and the changelog lane's legacy `runResync` fallback) reports
                 // its attempts and bytes under this label without carrying it as a
                 // parameter, so it can never reach a coalescing key.
+                admission.onWorkStarted?.();
                 return await withSyncAdmissionSource(source, work);
             }
             catch (error) {
@@ -952,6 +983,20 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             admissionBoundary.dispose();
         }
     }
+    /**
+     * Whether this node's sync admission would take an exact VM recovery fetch
+     * for the graph right now. A read of the limiter: nothing is claimed or
+     * queued, and the fetch must still handle a refusal.
+     */
+    vmRecoverySyncAdmissionAvailable(contextGraphId) {
+        return !syncAdmissionWouldBeRefused(resolveAgentSyncGlobalBackpressure(this.config), {
+            contextGraphId,
+            lane: 'durable',
+            priority: VM_RECOVERY_SYNC_PRIORITY,
+            priorityClass: syncPriorityClass(VM_RECOVERY_SYNC_PRIORITY),
+            source: 'vm-recovery',
+        });
+    }
     async start() {
         if (this.vmReconcileShutdownBlocked) {
             throw new VmReconcileShutdownTimeoutError(DKGAgentBase.VM_RECONCILE_SHUTDOWN_TIMEOUT_MS);
@@ -959,6 +1004,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         if (this.contextGraphMembershipPersistenceShutdownBlocked) {
             throw new ContextGraphMembershipPersistShutdownTimeoutError(DKGAgentBase.CONTEXT_GRAPH_MEMBERSHIP_PERSIST_SHUTDOWN_TIMEOUT_MS);
         }
+        if (this.contextGraphSubscriptionPersistenceShutdownBlocked) {
+            throw new ContextGraphSubscriptionPersistShutdownTimeoutError(DKGAgentBase.CONTEXT_GRAPH_SUBSCRIPTION_PERSIST_SHUTDOWN_TIMEOUT_MS);
+        }
         if (this.started)
             return;
         this.storageACKRegistrationRuntime.retireCurrentGeneration();
@@ -977,9 +1025,13 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         await this.contextGraphSubscriptionRehydrationPromotionRuntime?.close();
         this.rfc64BackgroundWorkDispatcherV1.reopen();
         this.contextGraphMembershipPersistence.reopen();
+        // stop() drained and closed subscription writes; a restarted agent admits
+        // them again. Writes issued before the first start() left it open.
+        this.contextGraphSubscriptionPersistence.reopenIfClosed();
         // stop() aborts detached cold authority flights; a restarted agent admits
         // new ones (the runtime is created lazily on first use otherwise).
         peekFinalizedAuthorityColdResolution(this)?.reopen();
+        peekOnDemandAgentsPhonebook(this)?.reopen();
         this.vmReconcileRuntimeReady = false;
         this.graphScopedStoreClosed = false;
         this.coreHostRecordingGeneration += 1;
@@ -1090,13 +1142,22 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // Move what earlier builds left in ontology, using local metadata only,
         // before sync serving starts. Bare bindings of graphs this node doesn't
         // hold need a chain read; that pass runs once start completes and before
-        // every store discovery pass.
+        // every store discovery pass. This pass is on the startup path, so it has
+        // a time budget; candidates it doesn't reach are left to those passes.
+        // Until one of them reaches every candidate (this one included), ontology
+        // may still hold private rows, so peers are not served it.
         try {
-            await this.relocatePrivateContextGraphMetadata({ classifyOnChain: false });
+            await this.relocatePrivateContextGraphMetadata({
+                classifyOnChain: false,
+                budgetMs: METADATA_RELOCATION_STARTUP_BUDGET_MS,
+            });
         }
         catch (err) {
             this.log.warn(ctx, `Failed to relocate private context graph metadata out of the ontology graph: ${err instanceof Error ? err.message : String(err)}`);
         }
+        if (this.contextGraphServingWithheld(SYSTEM_CONTEXT_GRAPHS.ONTOLOGY)) {
+            this.log.warn(ctx, 'Not serving the ontology graph to peers until the context graph metadata relocation reaches every candidate');
+        }
         // Load registered agents from triple store; auto-register default if none exist.
         // loadAgentsFromStore restores defaultAgentAddress from the persisted
         // isDefaultAgent marker, avoiding reliance on SPARQL result ordering.
@@ -1273,11 +1334,17 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         this.messenger.setOutboxResponseHandler(PROTOCOL_JOIN_REQUEST, async (result) => {
             await this.handleJoinRequestOutboxResponse(result);
         });
+        // Snapshot live intent before any durable read or detached persistence
+        // completion. Durable rows claim their part of this startup plan below.
+        const liveIntents = [...this.subscribedContextGraphs].filter(([, subscription]) => subscription.subscribed && !subscription.pendingMeta);
         this.gossip = new GossipSubManager(this.node, this.eventBus, {
             networkId: this.config.networkIdentity?.networkId,
             chainId: this.config.networkIdentity?.chainId,
             isPeerAccepted: (peerId) => this.networkAdmissionCoordinator.isAcceptedPeer(peerId),
         });
+        for (const [id, subscription] of liveIntents) {
+            this.gossipSession.startupLiveIntents.set(id, { syncMode: subscription.syncMode });
+        }
         await this.loadSwmSenderKeyState();
         await this.initializeSwmHostModeStore();
         await this.rehydrateContextGraphsFromDurableState();
@@ -1324,6 +1391,11 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // error, so private/curated/unregistered CGs remain denied.
         const queryRemoteHandler = new QueryHandler(this.queryEngine, queryAccessConfig, {
             isContextGraphPublic: (contextGraphId) => withRpcUsageSite(CG_AUTH_RPC_SITES.remoteQuery, () => this.isContextGraphPublicOnChain(contextGraphId, createOperationContext('query'))),
+            // A graph held back from sync is not queried either, for an operator
+            // whose queryAccess opens it (see contextGraphServingWithheld). The
+            // handler applies this to the id its access policy and lookups use,
+            // once it has checked that id is a string.
+            servingWithheld: (contextGraphId) => this.contextGraphServingWithheld(contextGraphId),
         });
         // rc.9 PR-9: PROTOCOL_QUERY_REMOTE migrated onto the Universal
         // Messenger substrate. Wire prefix bumped to /dkg/10.0.1/* (hard
@@ -1681,6 +1753,29 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         await this.handleKARegisteredNudge(onChainId, kaId, ctx, signal);
                     }
                     : undefined,
+                // #2858 — refresh nudge for KA updates. An update keeps the KA id and
+                // moves its root, and the sweep never revisits a settled ordinal, so a
+                // node holding only a confirmed VM copy learns of the new version here.
+                // Decided from local state; a V10 KA is its own batch, so the event's
+                // batch id is the KA id. The event's block keeps a chain read that
+                // has not seen the update from settling the refresh, and its
+                // transaction spares a check of the publisher's own copy. A nudge that
+                // fails holds the lane, and the lane never persists its cursor past
+                // an unsettled refresh, so a restart replays that update.
+                onCollectionUpdated: this.vmReconcileEnabled()
+                    ? async ({ batchId, merkleRoot, blockNumber, txHash, logIndex, blockHash, signal }) => {
+                        await this.handleKAUpdatedNudge(batchId, merkleRoot, ctx, {
+                            blockNumber,
+                            ...(txHash === undefined ? {} : { txHash }),
+                            ...(logIndex === undefined ? {} : { logIndex }),
+                            ...(blockHash === undefined ? {} : { blockHash }),
+                            signal,
+                        });
+                    }
+                    : undefined,
+                collectionUpdatesPersistCeiling: this.vmReconcileEnabled()
+                    ? () => this.vmRefreshPersistCeiling()
+                    : undefined,
             });
             await this.chainPoller.start();
             this.log.info(ctx, `Chain event poller started`);
@@ -1853,13 +1948,37 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             peerId: this.peerId,
             parseSyncRequest: this.parseSyncRequest.bind(this),
             authorizeSyncRequest: this.authorizeSyncRequest.bind(this),
+            onExperimentalExactBatchResources: resolveExactBatchStreamEnabled()
+                && this.config.nodeRole === 'core'
+                ? (resources) => {
+                    const binding = createExactBatchResponderBinding({
+                        localPeerId: this.peerId,
+                        store: this.store,
+                        exportCache: resources.exportCache,
+                        admission: resources,
+                        parseSyncRequest: this.parseSyncRequest.bind(this),
+                        authorizeSyncRequest: this.authorizeSyncRequest.bind(this),
+                        isPublicContextGraph: async (cg, signal) => (await this.resolveRegisteredContextGraphAuthority(cg, {
+                            authorityReadMode: 'finalized-index-or-live', signal,
+                        })).kind === 'public',
+                        servingWithheld: (cg) => this.contextGraphServingWithheld(cg),
+                        onExport: (assetIndex, wholePayloadExports, operationContext) => this.log.info(operationContext, `Exact batch responder export asset=${assetIndex} wholePayloadExports=${wholePayloadExports}`),
+                        onPayload: (assetIndex, plainBytes, encodedBytes, operationContext) => this.log.info(operationContext, `Exact batch responder payload asset=${assetIndex} plainBytes=${plainBytes} encodedBytes=${encodedBytes}`),
+                        onFallback: (reason, assetIndex, operationContext, budgetReason) => this.log.info(operationContext, `Exact batch responder refusal asset=${assetIndex} reason=${reason}${budgetReason ? ` budgetReason=${budgetReason}` : ''}`),
+                        onStage: (stage, assetIndex, durationMs, operationContext) => this.log.info(operationContext, `Exact batch responder stage=${stage} asset=${assetIndex} durationMs=${durationMs.toFixed(3)}`),
+                    });
+                    registerExperimentalExactBatchResponder(this.router, exactBatchTransportOptions(120_000), binding.authorizeRequest, binding.respond);
+                }
+                : undefined,
             // Serve-skip policy (#1233): withhold the no-consumer agents/_meta snapshot
             // unless the operator opts in. This is the env boundary — the pure
             // `shouldWithholdAgentsDurableMeta` resolver is called directly with a FRESH
             // `process.env.DKG_SERVE_AGENTS_META` read per request, so the kill-switch is
             // reversible at runtime (no restart).
             shouldWithholdDurableMeta: (contextGraphId) => shouldWithholdAgentsDurableMeta(contextGraphId, process.env.DKG_SERVE_AGENTS_META),
+            servingWithheld: (contextGraphId) => this.contextGraphServingWithheld(contextGraphId),
             logWarn: (ctx, message) => this.log.warn(ctx, message),
+            logInfo: (ctx, message) => this.log.info(ctx, message),
             logDebug: (ctx, message) => this.log.debug(ctx, message),
             snapshotBudget: snapshotPolicy.budget,
             contextGraphPriorities: this.config.syncContextGraphPriorities,
@@ -1965,7 +2084,16 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                             role: 'participant',
                             status: 'active',
                             source: 'join-approved',
-                            metadata: { curatorPeerId: peerId.toString() },
+                            metadata: {
+                                curatorPeerId: peerId.toString(),
+                                // The approved sender's own listener address is a durable
+                                // transport hint. An inbound remoteAddr can be an ephemeral
+                                // source port, so it is never persisted for restart dialing.
+                                ...(() => {
+                                    const address = verifiedCuratorDialAddress(payload.curatorDialAddress, peerId.toString());
+                                    return address ? { curatorDialAddress: address } : {};
+                                })(),
+                            },
                         };
                         // Commit the restart contract before changing live subscription
                         // state. The two stores do not expose a shared transaction, so the
@@ -2229,6 +2357,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         for (const systemContextGraph of [SYSTEM_CONTEXT_GRAPHS.AGENTS, SYSTEM_CONTEXT_GRAPHS.ONTOLOGY]) {
             this.subscribeToContextGraph(systemContextGraph, { syncMode: 'always-on' });
         }
+        this.applyStartupContextGraphGossipPlan();
         // Connect to bootstrap peers
         if (this.config.bootstrapPeers) {
             for (const addr of this.config.bootstrapPeers) {
@@ -2445,6 +2574,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // this is now the only outbox tick — chat (PR-3) and every
         // future migrated protocol drain on the same cadence so
         // operators see a single "outbox tick" beat.
+        let senderKeyRetryInFlight = false;
         this.messengerOutboxTimer = setInterval(() => {
             const now = Date.now();
             this.messenger.processOutboxTick(now)
@@ -2460,6 +2590,25 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         `msgId=${entry.messageId.slice(0, 8)} lastError="${entry.lastError}"`);
                 }
             });
+            // A retryable ACK is a delivered Messenger response, so it has no
+            // outbox obligation. The sender-key queue owns that retry and must
+            // progress even if both peers stay connected and no further share is
+            // published. Keep one pass in flight and reuse its current-authority
+            // recipient check before every resend.
+            if (!senderKeyRetryInFlight && this.pendingSenderKeyByAgent.size > 0) {
+                senderKeyRetryInFlight = true;
+                void this.drainPendingSenderKeysForConnectedPeers()
+                    .then((drained) => {
+                    if (drained > 0) {
+                        this.log.info(ctx, `Sender-key retry delivered ${drained} pending package(s)`);
+                    }
+                })
+                    .catch((err) => {
+                    const message = err instanceof Error ? err.message : String(err);
+                    this.log.warn(ctx, `Sender-key retry tick failed: ${message}`);
+                })
+                    .finally(() => { senderKeyRetryInFlight = false; });
+            }
         }, MESSAGE_OUTBOX_TICK_MS);
         if (this.messengerOutboxTimer.unref)
             this.messengerOutboxTimer.unref();
@@ -2578,6 +2727,12 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             // Malformed peer bytes → deny (mirrors the legacy lane's parse-fail path).
             return encodeChangelogResponse({ kind: 'denied' });
         }
+        // A graph held back from the legacy lane is held back here too. The
+        // requester falls back to that lane, which refuses it the same way, and
+        // retries on a later round.
+        if (this.contextGraphServingWithheld(request.contextGraphId)) {
+            throw new QuietRetryableHandlerError(`"${request.contextGraphId}" is not served yet`);
+        }
         // Same per-CG gate as PROTOCOL_SYNC: public CGs are open (returns true),
         // private CGs verify the signed digest — a bare (unsigned) changelog request
         // carries no digest, so `authorizePrivateSyncRequest` denies it. Any throw on a
@@ -2707,6 +2862,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         this.warmedCores.delete(remotePeer);
         this.warmCoreFailedUnpins.delete(remotePeer);
         this.vmReconcileExactPeerCapabilities?.delete(remotePeer);
+        this.vmReconcilePublicCoreTransportPreferencePolicy?.forgetPeer(remotePeer);
     }
     queueSelectedSwmFromPeerOnConnect(remotePeer, handleSyncError, delayMs = 3000) {
         const selectedContextGraphIds = this.selectedSwmBootstrapContextGraphIdsForPeer(remotePeer);
@@ -2931,7 +3087,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const sharedMemoryRecoveryContextGraphIds = [...new Set([
                 ...(this.config.syncContextGraphs ?? []),
                 ...namedSubgraphCompatibilityContextGraphIds,
-                ...resolveRfc64PrivateRecoveryContextGraphIdsV1(resolveRfc64RuntimeCatalogBootstrapConfigV1(this.config.rfc64CatalogBootstrap, this.config.rfc64PublicCatalogBootstrap)).filter((contextGraphId) => this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId).legacySyncAllowed),
+                ...resolveRfc64PrivateRecoveryContextGraphIdsV1(resolveRfc64RuntimeCatalogBootstrapConfigV1(this.config.rfc64CatalogBootstrap, this.config.rfc64PublicCatalogBootstrap)).filter((contextGraphId) => this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)),
             ])];
         const remotePeerIsCompleteSwmProvider = acceptedPolicies.some(({ completeSwmProviders = [] }) => completeSwmProviders.includes(remotePeer));
         const selectedPublicContextGraphIds = new Set(this.selectedSwmBootstrapContextGraphIdsForPeer(remotePeer));
@@ -2948,11 +3104,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             getPeerProtocols: (peerId) => this.getPeerProtocols(peerId),
             peerCapabilities: this.peerCapabilityRegistry,
             getSyncContextGraphs: () => this.config.syncContextGraphs ?? [],
-            getDurableSyncContextGraphs: () => automaticDurableSyncContextGraphs(this.config.syncContextGraphs ?? [], {
-                nodeRole: this.config.nodeRole,
-                configValue: this.config.syncSystemContextGraphsOnConnect,
-                envValue: process.env.DKG_SYNC_SYSTEM_CONTEXT_GRAPHS_ON_CONNECT,
-            }).filter((contextGraphId) => {
+            getDurableSyncContextGraphs: () => automaticDurableSyncContextGraphs(this.config.syncContextGraphs ?? [], systemContextGraphSyncOptionsOf(this.config)).filter((contextGraphId) => {
                 const completeSwmProviders = this.resolveRfc64CompleteSwmProviderPeerIdsV1(contextGraphId);
                 // For an RFC-64 selected public CG, VM/durable inventory is chain/core
                 // territory. An Edge that was pinned as the complete SWM source must
@@ -3142,10 +3294,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 this.log.debug(ctx, `Skipping SWM sync for "${contextGraphId}": superseded by cleartext adoption of "${supersedingId}"`);
                 continue;
             }
-            const authority = this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId);
             const completeSwmProviders = this.resolveRfc64CompleteSwmProviderPeerIdsV1(contextGraphId);
             const acceptedRecoveryLane = resolveRfc64SwmRecoveryLaneV1(resolveRfc64RuntimeCatalogBootstrapConfigV1(this.config.rfc64CatalogBootstrap, this.config.rfc64PublicCatalogBootstrap), contextGraphId);
-            const legacyRootSyncAllowed = authority.legacySyncAllowed;
+            const legacyRootSyncAllowed = this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId);
             const namedSubgraphCompatibilityRequired = !legacyRootSyncAllowed
                 && this.subscribedContextGraphs.get(contextGraphId)?.subscribed === true;
             if (!legacyRootSyncAllowed && !namedSubgraphCompatibilityRequired) {
@@ -3253,7 +3404,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
      * leaves a peer permanently in `skippedNoSyncPeers`. libp2p emits
      * `peer:update` whenever a peer record changes — most importantly when
      * identify completes and the protocol list gets populated for the
-     * first time. If the new list now contains `PROTOCOL_SYNC` and we
+     * first time. If the new list now contains either sync id and we
      * previously skipped this peer for that exact reason, fire one
      * `trySyncFromPeer` immediately.
      *
@@ -3283,7 +3434,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             return;
         if (!syncOnConnectEnabled(this.config))
             return;
-        if (!protocols.includes(PROTOCOL_SYNC))
+        if (!advertisesSyncProtocol(protocols))
             return;
         const ctx = createOperationContext('sync');
         void peerEvents.run(() => this.retrySyncAfterPeerUpdate(peerId, ctx, peerEvents), (error) => this.log.warn(ctx, `Sync retry after peer:update failed for ${peerId.slice(-8)}: ${error instanceof Error ? error.message : String(error)}`));
@@ -3305,7 +3456,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
      * Periodic reconciler for sync-on-connect. Walks every currently
      * connected peer and retries `trySyncFromPeer` for any that either:
      *
-     *   - is in {@link skippedNoSyncPeers} and now advertises `PROTOCOL_SYNC`
+     *   - is in {@link skippedNoSyncPeers} and now advertises either sync id
      *     (covers the case where the `peer:update` listener missed the
      *     event for whatever reason), or
      *   - has no recent clean success or useful-progress cooldown marker, or
@@ -3524,13 +3675,14 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const isShardingTableMember = this.chain.isShardingTableMember?.bind(this.chain);
         if (!getIdentityIdForAddress || !isShardingTableMember)
             return true; // gate unavailable
-        // A legacy/mixed-version core profile may not carry an operational wallet.
-        // Discovery elsewhere supports profiles without `agentAddress`, so treat
-        // its absence as "gate unavailable" (fall back to phonebook nodeRole)
-        // rather than a hard denial — otherwise the warm set can collapse to zero
-        // in a network with healthy but pre-agentAddress cores.
+        // Profiles are unsigned: a `nodeRole='core'` profile without an
+        // operational wallet cannot be checked against the ShardingTable, so it is
+        // as unverifiable as a failed read and is not pinned. Every profile this
+        // codebase publishes carries `agentAddress`; on Base mainnet (2026-09-23)
+        // 62 of 63 core-role profiles did, and the one that did not was pinned and
+        // then failed its dial on every tick.
         if (!agentAddress)
-            return true; // gate unavailable for this profile
+            return false;
         try {
             const identityId = await getIdentityIdForAddress(agentAddress);
             if (identityId === 0n)
@@ -3669,6 +3821,27 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const result = await this.syncFromPeerDetailed(remotePeerId, contextGraphIds, onPhase, onAccessDenied, undefined, options);
         return result.insertedTriples;
     }
+    /** One agent-owned admission decision for the legacy shared-memory lane. */
+    async canUseLegacySharedMemorySyncForContextGraphV1(contextGraphId) {
+        // The private predicate verifies local membership and current lane authority.
+        return this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)
+            || await this.rfc64PrivateRootSwmOnLegacyLaneV1(contextGraphId) === true;
+    }
+    /** One agent-owned admission decision for the legacy durable VM lane. */
+    async canUseLegacyDurableSyncForContextGraphV1(contextGraphId) {
+        // The global emergency stop restores the legacy VM lane even for a
+        // selected catalog graph whose persisted receiver policy remains catalog.
+        if (this.config.rfc64CatalogExecutionPlan.killSwitchActive)
+            return true;
+        if (this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId).legacySyncAllowed) {
+            return true;
+        }
+        // An approved private member keeps this compatibility lane while its
+        // RFC-64 private receiver authority is inactive. The predicate performs
+        // the authenticated local member proof; outsiders remain excluded.
+        return typeof this.rfc64PrivateRootSwmOnLegacyLaneV1 === 'function'
+            && await this.rfc64PrivateRootSwmOnLegacyLaneV1(contextGraphId) === true;
+    }
     async syncFromPeerDetailed(remotePeerId, contextGraphIds, onPhase, onAccessDenied, 
     // Phase C — optional gap-safe per-CG delta high-water mark resolver. Backed
     // by a CONTIGUOUS watermark when supplied; omitted ⇒ full scan (default).
@@ -3679,7 +3852,8 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             return createIncompleteDurableSyncResult();
         }
         const requestedContextGraphCount = contextGraphIds.length;
-        contextGraphIds = contextGraphIds.filter((contextGraphId) => (this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId).legacySyncAllowed));
+        const legacyDurableAllowed = await Promise.all(contextGraphIds.map((contextGraphId) => LifecycleSyncMethods.prototype.canUseLegacyDurableSyncForContextGraphV1.call(this, contextGraphId)));
+        contextGraphIds = contextGraphIds.filter((_, index) => legacyDurableAllowed[index]);
         if (contextGraphIds.length !== requestedContextGraphCount) {
             this.log.debug(ctx, `Skipped ${requestedContextGraphCount - contextGraphIds.length} catalog-authoritative CG(s) from legacy durable sync`);
         }
@@ -3735,6 +3909,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         return (await LifecycleSyncMethods.prototype.runLegacyDurableSyncDetailed.call(this, ctx, remotePeerId, contextGraphIds, onPhase, onAccessDenied, sinceBatchIdFor, options)).result;
     }
     async runLegacyDurableSyncDetailed(ctx, remotePeerId, contextGraphIds, onPhase, onAccessDenied, sinceBatchIdFor, options) {
+        const admissionBoundary = new DurableSyncAdmissionBoundary(options?.onWorkStarted);
         const syncAgentsMeta = resolveSyncAgentsMeta(this.config.syncAgentsMeta, process.env.DKG_SYNC_AGENTS_META);
         const stopOnBackoffWorthyFailure = options?.stopOnBackoffWorthyFailure;
         const exactAssetSelection = options?.exactAssetSelection;
@@ -3760,6 +3935,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         let exactFetchDisposition;
         let exactResponderCapability;
         const authenticatedExactAssets = [];
+        const committedExactAssetUals = [];
+        // What the stream established about this peer for one graph. A run over
+        // several graphs has no single answer, so it reports none.
+        let exactStreamOutcome;
         const markExactFetchIncomplete = () => {
             if (exactAssetUals === undefined)
                 return;
@@ -3780,6 +3959,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                             stopOnBackoffWorthyFailure,
                             fetchTimeoutMs,
                             exactAssetSelection,
+                            forceFreshExactSession: options?.forceFreshExactSession,
+                            exactRecoveryTransportMode: options?.exactRecoveryTransportMode,
+                            registeredPublicEvidence: options?.registeredPublicEvidence,
                             authenticationTimeoutMs,
                             operationFetchDeadline: operationBoundary.fetchDeadline,
                             operationDeadline: operationBoundary.deadline,
@@ -3795,6 +3977,11 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         if (detailed.authenticatedExactAssets !== undefined) {
                             authenticatedExactAssets.push(...detailed.authenticatedExactAssets);
                         }
+                        if (detailed.committedExactAssetUals !== undefined) {
+                            committedExactAssetUals.push(...detailed.committedExactAssetUals);
+                        }
+                        if (orderedContextGraphIds.length === 1)
+                            exactStreamOutcome = detailed.exactStreamOutcome;
                         return durableSyncAccumulatorFromResult(detailed.result);
                     },
                 })),
@@ -3806,6 +3993,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                             priorityOverride: options?.priority,
                             operationSignal: operationBoundary.signal,
                             source: options?.source,
+                            onWorkStarted: admissionBoundary.startWork,
                         }), operationBoundary.signal);
                     }
                     catch (error) {
@@ -3817,6 +4005,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 },
                 merge: mergeDurableSyncAccumulatorInto,
                 markDeferred: (summary) => {
+                    admissionBoundary.defer();
                     markExactFetchIncomplete();
                     recordDurableSyncDiagnostics(summary, { deferredBackpressure: 1 });
                     return markDurableTerminalBoundary(summary, false);
@@ -3839,12 +4028,17 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 onDeferred: (item, error) => this.log.info(ctx, `Deferring durable sync at CG ${item.contextGraphId} due to local backpressure: ${error.message}`),
             });
             return {
+                admission: admissionBoundary.snapshot(),
                 result: finalizeDurableSyncCompletion(accumulator),
                 ...(exactFetchDisposition ? { exactFetchDisposition } : {}),
                 ...(exactResponderCapability ? { exactResponderCapability } : {}),
                 ...(authenticatedExactAssets.length === 0
                     ? {}
                     : { authenticatedExactAssets: Object.freeze([...authenticatedExactAssets]) }),
+                ...(committedExactAssetUals.length === 0
+                    ? {}
+                    : { committedExactAssetUals: Object.freeze([...committedExactAssetUals]) }),
+                ...(exactStreamOutcome === undefined ? {} : { exactStreamOutcome }),
             };
         };
         const singleFlightKey = durableSyncSingleFlightKey({
@@ -3856,13 +4050,17 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             syncAgentsMeta,
             hasPhaseCallback: Boolean(onPhase),
             hasAtomicCommitCallback: Boolean(options?.onAtomicCommitStarted),
+            hasWorkStartedCallback: Boolean(options?.onWorkStarted),
             hasAccessDeniedCallback: Boolean(onAccessDenied),
             hasSinceBatchIdResolver: Boolean(sinceBatchIdFor),
             hasSignal: Boolean(operationBoundary.signal),
             hasCurrentFence: Boolean(options?.isCurrent),
             hasChallengePinnedSelection: exactAssetSelection?.kind === 'challenge-pinned',
+            hasForcedFreshExactSession: options?.forceFreshExactSession === true,
+            hasRegisteredPublicEvidence: options?.registeredPublicEvidence !== undefined,
             exactAssetUals,
             settlementSliceTimeoutMs: options?.settlementSliceTimeoutMs,
+            exactRecoveryTransportMode: options?.exactRecoveryTransportMode,
             priority: options?.priority,
         });
         const runWithinBoundary = async () => {
@@ -3893,13 +4091,19 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const ctx = createOperationContext('sync');
         const detailed = await this.runLegacyDurableSyncDetailed(ctx, remotePeerId, [contextGraphId], undefined, undefined, undefined, {
             exactAssetSelection: selection,
+            forceFreshExactSession: options.forceFreshExactSession,
+            exactRecoveryTransportMode: options.exactRecoveryTransportMode,
+            registeredPublicEvidence: options.registeredPublicEvidence,
+            ...(options.totalTimeoutMs === undefined ? {} : { totalTimeoutMs: options.totalTimeoutMs }),
             stopOnBackoffWorthyFailure: true,
-            priority: 1_000,
+            priority: VM_RECOVERY_SYNC_PRIORITY,
             source: 'vm-recovery',
+            onWorkStarted: options.onWorkStarted,
             signal: options.signal,
             isCurrent: options.isCurrent,
         });
         return {
+            admission: detailed.admission,
             result: detailed.result,
             disposition: detailed.exactFetchDisposition ?? 'incomplete',
             ...(detailed.exactResponderCapability === undefined
@@ -3908,14 +4112,30 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             ...(detailed.authenticatedExactAssets === undefined
                 ? {}
                 : { authenticatedAssets: detailed.authenticatedExactAssets }),
+            ...(detailed.committedExactAssetUals === undefined
+                ? {}
+                : { committedExactAssetUals: detailed.committedExactAssetUals }),
+            ...(detailed.exactStreamOutcome === undefined
+                ? {}
+                : { streamOutcome: detailed.exactStreamOutcome }),
         };
     }
     /** Execute one legacy durable Context Graph after its caller owns admission. */
     async runLegacyDurableSyncForContextGraph(ctx, remotePeerId, contextGraphId, remainingContextGraphs, options = {}) {
         return (await LifecycleSyncMethods.prototype.runLegacyDurableSyncForContextGraphDetailed.call(this, ctx, remotePeerId, contextGraphId, remainingContextGraphs, options)).result;
     }
+    /** Capture transport refusal scope without performing authority or store IO. */
+    captureExperimentalExactBatchRefusalScope(contextGraphId) {
+        return captureExactBatchStreamRefusalScope({
+            contextGraphId, deploymentId: this.chain.deploymentId,
+            binding: this.contextGraphBindingState.currentBindingFor(contextGraphId, this.subscribedContextGraphs.get(contextGraphId)),
+            bindingGeneration: this.contextGraphBindingState.capture(contextGraphId),
+            selectedBindingGeneration: this.selectedVmReconcileCursors?.get(contextGraphId)?.bindingGeneration,
+            lifecycleGeneration: this.vmReconcileLifecycleGeneration,
+        });
+    }
     async runLegacyDurableSyncForContextGraphDetailed(ctx, remotePeerId, contextGraphId, remainingContextGraphs, options = {}) {
-        const { onPhase, onAtomicCommitStarted, onAccessDenied, sinceBatchIdFor, stopOnBackoffWorthyFailure, onVerifiedFullSnapshot, fetchTimeoutMs = SYNC_TOTAL_TIMEOUT_MS, exactAssetSelection, authenticationTimeoutMs = fetchTimeoutMs, operationFetchDeadline, operationDeadline, settlementSliceTimeoutMs, signal, isCurrent, durableMetaContinuation, } = options;
+        const { onPhase, onAtomicCommitStarted, onAccessDenied, sinceBatchIdFor, stopOnBackoffWorthyFailure, onVerifiedFullSnapshot, fetchTimeoutMs = SYNC_TOTAL_TIMEOUT_MS, exactAssetSelection, forceFreshExactSession, exactRecoveryTransportMode = 'stream-preferred', registeredPublicEvidence, authenticationTimeoutMs = fetchTimeoutMs, operationFetchDeadline, operationDeadline, settlementSliceTimeoutMs, signal, isCurrent, durableMetaContinuation, } = options;
         const assertLifecycleCurrent = () => {
             if (isCurrent?.() === false) {
                 throw asSyncFetchAbortError(new Error(`Exact VM recovery lifecycle for ${contextGraphId} is no longer current`));
@@ -3995,6 +4215,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     sinceBatchId,
                     signal: fetchContext.signal,
                     forceFreshSession: forceFreshSession
+                        || forceFreshExactSession === true
                         || onVerifiedFullSnapshot !== undefined,
                     manifestDigest,
                     manifestPrefixDigestAtOffset,
@@ -4074,7 +4295,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                             + `${subscription.onChainId}`), { code: 'VM_CHAIN_CONTEXT_GRAPH_MISMATCH' });
                     }
                     if (verifiedOnChainId && subscription && subscription.onChainId === undefined) {
-                        await this.persistContextGraphSubscriptionStrict(asset.contextGraphId, { ...subscription, onChainId: verifiedOnChainId, lastReconciledOrdinal: 0 }, undefined, isBindingCurrent);
+                        // An on-demand subscription binds in memory only; durable rows are
+                        // saved before the binding becomes visible.
+                        await this.persistContextGraphSyncStateStrict(asset.contextGraphId, { ...subscription, onChainId: verifiedOnChainId, lastReconciledOrdinal: 0 }, 'on-chain id binding', isBindingCurrent);
                         assertCurrent();
                         this.bindSubscriptionOnChainId(asset.contextGraphId, subscription, verifiedOnChainId);
                         recaptureBindingGeneration();
@@ -4107,13 +4330,26 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         this.invalidateListContextGraphsCache();
                         this.contextGraphMetaProjection.markDirtyFromQuads(authentication.asset.metadataQuads);
                         try {
+                            let retiredTwin;
                             const retirement = await reconcileFinalizedSwmTwin({
                                 store: this.store,
                                 writeLocks: this.writeLocks,
                                 asset: authentication.asset,
-                                retire: (candidate) => this.retireFinalizedSwmTwinCandidate(candidate, ctx),
+                                retire: async (candidate) => {
+                                    await this.retireFinalizedSwmTwinCandidate(candidate, ctx);
+                                    retiredTwin = candidate;
+                                },
                             });
                             if (retirement === 'retired') {
+                                await this.retireLegacySwmAfterVerifiedVmTwin({
+                                    contextGraphId: asset.contextGraphId,
+                                    kaUal: asset.ual,
+                                    assertionVersion: asset.assertionVersion,
+                                    // The marker of the namespace whose twin was verified and
+                                    // retired. Without it a twin in a named subgraph would
+                                    // retire the root marker of the same asset.
+                                    subGraphName: retiredTwin?.subGraphName,
+                                });
                                 this.invalidateListContextGraphsCache();
                                 this.log.info(ctx, `Retired byte-identical SWM twin after durable VM materialization for ${asset.ual}`);
                             }
@@ -4161,7 +4397,54 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             };
         }
         if (exactAssetSelection !== undefined) {
-            return runDurableSyncDetailed(durableContext);
+            const outcome = await runExactBatchStreamDriver({
+                contextGraphId, remotePeerId,
+                selection: exactAssetSelection, transportMode: exactRecoveryTransportMode,
+                streamEnabled: resolveExactBatchStreamEnabled(),
+                fetchDeadline: contextGraphBudget.fetchDeadline, signal, isCurrent,
+            }, {
+                router: this.router, capabilityOwner: this,
+                captureConnectionKey: () => this.getSyncReconcilerConnectionKey(remotePeerId),
+                captureRefusalScope: () => this.captureExperimentalExactBatchRefusalScope(contextGraphId),
+                isChainEnabled: () => this.chain.chainId !== 'none',
+                getPeerProtocols: () => this.getPeerProtocols(remotePeerId),
+                // The recovery pass that owns this exchange may have handed it its own fresh positive
+                // answer; every other fetch, and any doubt about that answer, reads the authority itself.
+                isRegisteredPublic: async () => registeredPublicEvidence?.usableFor(contextGraphId, signal) === true
+                    || (await this.resolveRegisteredContextGraphAuthority(contextGraphId, {
+                        authorityReadMode: 'finalized-index-or-live', signal,
+                    })).kind === 'public',
+                requestIdentity: () => ({
+                    requesterPeerId: this.peerId,
+                    computeSyncDigest: (...args) => this.computeSyncDigest(...args),
+                    getIdentityId: () => this.chain.getIdentityId(),
+                    signMessage: typeof this.chain.signMessage === 'function' ? this.chain.signMessage.bind(this.chain) : undefined,
+                }),
+                verification: {
+                    ctx,
+                    parseAndFilter: (text, graph, cg) => this.getOrCreateSyncVerifyWorker().parseAndFilter(text, graph, cg),
+                    processDurableBatchInWorker: durableContext.processDurableBatchInWorker,
+                    authenticationDeadline: contextGraphBudget.createGraphScopedAuthenticationDeadline,
+                    storeGraphScopedAsset: durableContext.storeGraphScopedAsset,
+                },
+                reconnect: async (reconnectSignal) => {
+                    try {
+                        await this.ensurePeerConnected(remotePeerId, { signal: reconnectSignal });
+                    }
+                    catch {
+                        // Unreachable for now, or connected but no longer admitted.
+                        return false;
+                    }
+                    return this.node.libp2p.getConnections()
+                        .some((connection) => connection.remotePeer.toString() === remotePeerId);
+                },
+                logInfo: message => this.log.info(ctx, message),
+            });
+            switch (outcome.kind) {
+                case 'settled': return outcome.detailed;
+                case 'not-selected':
+                case 'unsupported-before-start': return runDurableSyncDetailed(durableContext);
+            }
         }
         return { result: await runDurableSync(durableContext) };
     }
@@ -4510,9 +4793,25 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             deadline,
             fetchSharingIdentity: defaultPageFetchSharingIdentity,
         });
+        // Match the additive builder negotiation. Authorization is still evaluated
+        // by buildSyncRequest and by the responder before any export is admitted.
+        const responseEncoding = resolveExactSyncGzipProfile({
+            includeSharedMemory, phase, assetUals, responseEncoding: EXACT_SYNC_GZIP_ENCODING,
+        })?.responseEncoding;
         const exactAccumulationLimits = assetUals === undefined
             ? undefined
-            : exactSyncPhaseAccumulationLimits(assetUals);
+            : exactSyncPhaseAccumulationLimits(assetUals, responseEncoding);
+        const effectiveMaxAcceptedQuads = exactAccumulationLimits?.maxQuads === undefined
+            ? maxAcceptedQuads
+            : maxAcceptedQuads === undefined
+                ? exactAccumulationLimits.maxQuads
+                : Math.min(exactAccumulationLimits.maxQuads, maxAcceptedQuads);
+        const exactHeapLimit = exactAccumulationLimits?.maxHeapBytesEstimate;
+        const effectiveMaxAcceptedHeapBytesEstimate = exactHeapLimit === undefined
+            ? maxAcceptedHeapBytesEstimate
+            : maxAcceptedHeapBytesEstimate === undefined
+                ? exactHeapLimit
+                : Math.min(exactHeapLimit, maxAcceptedHeapBytesEstimate);
         // Coalescing is declared by the capability, never inferred from singleton
         // identity. Exclusive private rounds cannot inherit another job's clock.
         const fetchSharingIdentity = effectiveWorkAdmission.fetchSharingIdentity;
@@ -4532,8 +4831,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 assetUals,
                 returnAcceptedPrefixOnRetryableTransportFailure,
                 requesterScope,
-                maxAcceptedQuads,
-                maxAcceptedHeapBytesEstimate,
+                responseEncoding,
+                maxAcceptedBytes: exactAccumulationLimits?.maxBytes,
+                maxAcceptedQuads: effectiveMaxAcceptedQuads,
+                maxAcceptedHeapBytesEstimate: effectiveMaxAcceptedHeapBytesEstimate,
             });
         const inFlight = inFlightSyncPageFetchesFor(this);
         // Read once, here: this fetch runs inside the admitted operation, so the
@@ -4590,15 +4891,12 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             snapshotRef,
             sinceBatchId,
             assetUals,
+            responseEncoding,
             returnAcceptedPrefixOnRetryableTransportFailure,
             requesterScope,
             maxAcceptedBytes: exactAccumulationLimits?.maxBytes,
-            maxAcceptedQuads: exactAccumulationLimits?.maxQuads === undefined
-                ? maxAcceptedQuads
-                : maxAcceptedQuads === undefined
-                    ? exactAccumulationLimits.maxQuads
-                    : Math.min(exactAccumulationLimits.maxQuads, maxAcceptedQuads),
-            maxAcceptedHeapBytesEstimate,
+            maxAcceptedQuads: effectiveMaxAcceptedQuads,
+            maxAcceptedHeapBytesEstimate: effectiveMaxAcceptedHeapBytesEstimate,
             pageSizeProfileCache: syncPageSizeProfileCacheFor(this),
             deadline,
             recovery,
@@ -4861,11 +5159,12 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             return execution(emptySharedMemorySyncResult());
         }
         const recoveryExecutor = this.createSwmTargetExecutorSessionV1();
-        const recoverPrivateContextGraph = (contextGraphId, recoveryLease, onRetry) => recoveryExecutor.recoverPrivateTarget({
+        const recoverPrivateContextGraph = async (contextGraphId, recoveryLease, onRetry) => recoveryExecutor.recoverPrivateTarget({
             remotePeerId,
             contextGraphId,
             includeRootScope: requestedScope !== null
-                || this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId).legacySyncAllowed,
+                || this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)
+                || await this.rfc64PrivateRootSwmOnLegacyLaneV1(contextGraphId),
             recoveryGuard: recoveryLease,
             onRetry,
         });
@@ -4972,7 +5271,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     contextGraphId,
                     remainingContextGraphs,
                     includeRootScope: requestedScope !== null
-                        || this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId).legacySyncAllowed,
+                        || this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId),
                     stopOnBackoffWorthyFailure,
                     mode,
                 });
@@ -5047,7 +5346,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         selectedSwmPriority: selectedPublicWork,
                     });
                 },
-                merge: mergeSharedMemorySyncResults,
+                merge: mergeSamePeerSharedMemoryDiagnostics,
                 onResult: (item, result) => {
                     if (selectedSwmEnabled
                         && item.lane === 'shared_memory'
@@ -5101,7 +5400,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     source: options?.source,
                     selectedSwmPriority: true,
                 }),
-                merge: mergeSharedMemorySyncResults,
+                merge: mergeSamePeerSharedMemoryDiagnostics,
                 markDeferred: (summary) => ({
                     ...summary,
                     deferredBackpressure: (summary.deferredBackpressure ?? 0) + 1,
@@ -5124,7 +5423,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 },
             });
             const { summary: continuationSummary } = continuationExecution;
-            const finalSummary = mergeSharedMemorySyncResults(initialSummary, continuationSummary);
+            const finalSummary = mergeSamePeerSharedMemoryDiagnostics(initialSummary, continuationSummary);
             const incompleteSelectedContextGraphs = new Set(continuationExecution.incompleteContextGraphIds);
             const continuedSelectedContextGraphs = new Set(selectedContinuationUnits.map(({ work: unitWork }) => unitWork.contextGraphId));
             for (const target of selectedPublicTargets) {
@@ -5164,11 +5463,14 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             this.log.warn(ctx, `Skipping SWM recovery from ${remotePeerId.slice(-8)} (DKG_DURABLE_SYNC_ENABLED=0)`);
             return emptySwmRecoveryResult();
         }
-        return this.runContextGraphSyncWithBackpressure(ctx, contextGraphId, 'swm_recovery', `swm-recovery:${contextGraphId}:${remotePeerId.slice(-8)}`, () => this.createSwmTargetExecutorSessionV1()
+        return this.runContextGraphSyncWithBackpressure(ctx, contextGraphId, 'swm_recovery', `swm-recovery:${contextGraphId}:${remotePeerId.slice(-8)}`, async () => this.createSwmTargetExecutorSessionV1()
             .recoverPrivateTarget({
             remotePeerId,
             contextGraphId,
-            includeRootScope: this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId).legacySyncAllowed,
+            includeRootScope: this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)
+                // A private graph's root scope stays on the legacy member lane
+                // while its RFC-64 authority is not active (#2858).
+                || await this.rfc64PrivateRootSwmOnLegacyLaneV1(contextGraphId),
         }), { source: 'swm-recovery' });
     }
     /**
@@ -5300,16 +5602,6 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         });
     }
     /** Focused VM-recovery operation that returns clean per-peer miss evidence. */
-    async syncVmRecoveryFromConnectedPeers(contextGraphId, options) {
-        const catchup = await this.syncContextGraphFromConnectedPeers(contextGraphId, options);
-        return {
-            catchup,
-            // Embedders may still override the catch-up method with the pre-evidence
-            // result shape. Treat that legacy shape as no proof; production results
-            // always carry the immutable field below.
-            cleanMissPeerIds: [...(catchup.cleanSharedMemoryPeerIds ?? [])],
-        };
-    }
     selectCatchupPeerWindow(peers, options) {
         const maxPeers = options?.maxPeers;
         if (maxPeers === undefined || !Number.isInteger(maxPeers) || maxPeers <= 0) {
@@ -5470,7 +5762,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // into HEAD's `accessDeniedPeers` counter so the existing daemon
         // catchup-status endpoint and UI keep working — see
         // `cli/src/daemon.ts` subscribe job and `catchup-runner.ts`.
-        const emptyShared = () => createEmptySharedMemorySyncResult(1);
+        const emptyShared = () => emptySharedMemorySyncResult(1);
         // Bounded fan-out: at most CATCHUP_MAX_CONCURRENT_PEER_SYNCS peer syncs run
         // at once. The pre-cap unbounded `Promise.all` over every sync-capable peer
         // was the top amplifier of the 2026-07-07 mainnet sync storm — one
@@ -5755,7 +6047,13 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const ctx = createOperationContext('sync');
         await primeCatchupConnectionsAtom(this.node.libp2p, this.discovery, this.peerId, async (peerId) => {
             await this.networkAdmissionCoordinator.ensureAdmitted(peerId, ctx);
-        });
+        }, 
+        // An on-demand phonebook holds every relay-advertising profile; walking
+        // all of them on each catch-up is a dial storm. Nodes that sync the
+        // phonebook on every connect (and the kill switch) keep today's walk.
+        this.onDemandAgentsPhonebookEnabled()
+            ? { maxDials: AGENTS_PHONEBOOK_PRIME_MAX_DIALS }
+            : {});
     }
     /**
      * Pull `_meta` (and SWM) for a CG immediately after receiving a curator
@@ -5786,26 +6084,16 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const ctx = createOperationContext('sync');
         const curatorShort = curatorPeerId.slice(-8);
         let curatorTargetSucceeded = false;
-        const approvedAgentAddress = this.localApprovedAgentByCG.get(contextGraphId);
-        if (!approvedAgentAddress) {
+        // One acceptance (member proof plus authenticated policy) judges both the
+        // snapshot the curator serves and the local proof that completes the join.
+        const acceptance = await this.resolveApprovedMemberAcceptance(contextGraphId);
+        if (!acceptance) {
             throw new Error(`Post-approval sync for "${contextGraphId}" has no approved local agent binding`);
         }
-        let expectedDelegateeOpKey;
-        try {
-            expectedDelegateeOpKey = await inferAdapterPublisherAddress(this.chain);
-        }
-        catch {
-            // The signed join flow always binds the current libp2p peer, so an
-            // adapter that cannot expose its op-key still has a usable proof.
-        }
         const curatorMetaRefreshOptions = {
             trustedCuratorPeerId: curatorPeerId,
             force: true,
-            memberProof: {
-                approvedAgentAddress,
-                expectedDelegateePeerId: this.peerId,
-                expectedDelegateeOpKey,
-            },
+            approvedMember: acceptance,
         };
         // Curator-direct attempt. Any throw here (relay reservation gone,
         // dial timeout, AbortSignal, transient `Remote closed connection
@@ -5849,12 +6137,14 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         // transfer into a false-ready subscription. Retry once after each
                         // catchup round and require a live metadata proof before declaring
                         // the curator-targeted bootstrap complete.
-                        let hasAuthoritativeMeta = await this.hasConfirmedMetaState(contextGraphId)
-                            .catch(() => false);
+                        // The bootstrap completes only once the local metadata proves this
+                        // approved member; a public definition stored before the join
+                        // (RFC-64 bootstrap) must not end it while the curator's snapshot
+                        // is still stale (#2831 review).
+                        let hasAuthoritativeMeta = await this.hasConfirmedApprovedMemberMetaState(contextGraphId, acceptance).catch(() => false);
                         if (!hasAuthoritativeMeta) {
                             await this.refreshMetaFromCurator(contextGraphId, curatorMetaRefreshOptions);
-                            hasAuthoritativeMeta = await this.hasConfirmedMetaState(contextGraphId)
-                                .catch(() => false);
+                            hasAuthoritativeMeta = await this.hasConfirmedApprovedMemberMetaState(contextGraphId, acceptance).catch(() => false);
                         }
                         if (hasAuthoritativeMeta) {
                             await this.refreshMetaSyncedFlags([contextGraphId]);
@@ -5907,53 +6197,94 @@ export class LifecycleSyncMethods extends DKGAgentBase {
      * authorize VM, payload, plaintext-recovery, or SWM activation. Those lanes
      * are installed only after the fetched metadata (or the registered chain
      * roster) makes the ordinary read-authority resolver return `allowed`.
+     *
+     * Reports whether a later attempt can still succeed: a failed fetch, a
+     * snapshot that does not prove this member yet, or unavailable authority is
+     * `retry`; no approval binding or denied authority is `stop`.
      */
-    async resumePendingJoinApprovalMetadata(contextGraphId, curatorPeerId) {
+    async resumePendingJoinApprovalMetadata(contextGraphId, curatorPeerId, curatorDialAddress) {
         const ctx = createOperationContext('sync');
-        const approvedAgentAddress = this.localApprovedAgentByCG.get(contextGraphId);
-        if (!approvedAgentAddress)
-            return;
-        let expectedDelegateeOpKey;
-        try {
-            expectedDelegateeOpKey = await inferAdapterPublisherAddress(this.chain);
-        }
-        catch {
-            // The durable approval always binds the current libp2p peer. An adapter
-            // without an observable operational key still has a usable proof.
-        }
+        const acceptance = await this.resolveApprovedMemberAcceptance(contextGraphId);
+        if (!acceptance)
+            return 'stop';
         const refreshed = await this.refreshMetaFromCurator(contextGraphId, {
             trustedCuratorPeerId: curatorPeerId,
+            curatorDialAddressHint: curatorDialAddress,
             force: true,
-            memberProof: {
-                approvedAgentAddress,
-                expectedDelegateePeerId: this.peerId,
-                expectedDelegateeOpKey,
-            },
+            approvedMember: acceptance,
         }).catch((error) => {
             this.log.warn(ctx, `Pending join-approval metadata recovery for "${contextGraphId}" failed: ${error instanceof Error ? error.message : String(error)}`);
             return false;
         });
-        if (!refreshed || !(await this.hasConfirmedMetaState(contextGraphId).catch(() => false))) {
+        if (!refreshed
+            || !(await this.hasConfirmedApprovedMemberMetaState(contextGraphId, acceptance)
+                .catch(() => false))) {
             this.log.warn(ctx, `Pending join-approval metadata recovery for "${contextGraphId}" did not establish authoritative metadata; keeping data lanes closed`);
-            return;
+            return 'retry';
         }
         const authority = await withRpcUsageSite(CG_AUTH_RPC_SITES.joinResume, () => this.resolveContextGraphReadAuthority(contextGraphId, {
             allowSubscriptionFallback: false,
         })).catch(() => ({ outcome: 'unavailable' }));
         if (authority.outcome !== 'allowed') {
             this.log.warn(ctx, `Pending join-approval metadata recovery for "${contextGraphId}" completed but current read authority is ${authority.outcome}; keeping data lanes closed`);
-            return;
-        }
+            // A stale approval cannot override an explicit current denial.
+            return authority.outcome === 'unavailable' ? 'retry' : 'stop';
+        }
+        // A shutdown that began during the reads above must not clear the row's
+        // pending state or open its data lanes while the node tears down; the
+        // next start recovers the row again.
+        const stopping = () => this.node.stopSignal?.aborted === true;
+        if (stopping())
+            return 'stop';
         await this.refreshMetaSyncedFlags([contextGraphId]);
         const current = this.subscribedContextGraphs.get(contextGraphId);
-        if (!current?.subscribed)
-            return;
+        if (!current?.subscribed || stopping())
+            return 'stop';
         this.subscribeToContextGraph(contextGraphId, {
             persist: false,
             syncMode: current.syncMode,
         });
         this.persistLocalNodeMembership(contextGraphId, 'rehydrated-subscription');
         await this.runImmediatePostApprovalSync(contextGraphId, curatorPeerId);
+        return 'completed';
+    }
+    /**
+     * Run the restricted pending-metadata recovery of a restarted join approval
+     * until it completes or can no longer complete (#2832). Right after a
+     * restart the node's authority reads can still be rebuilding its finalized
+     * index, so a single attempt could fail transiently and leave every data
+     * lane closed until the next restart. A `retry` outcome, or an attempt that
+     * throws, is tried again with backoff while the row is still a subscribed,
+     * join-approved, pending-metadata row; the node stopping ends the loop.
+     */
+    async recoverPendingJoinApprovalMetadata(contextGraphId, curatorPeerId, curatorDialAddress) {
+        const stopSignal = this.node.stopSignal;
+        for (let attempt = 0;; attempt += 1) {
+            let outcome;
+            try {
+                outcome = await this.resumePendingJoinApprovalMetadata(contextGraphId, curatorPeerId, curatorDialAddress);
+            }
+            catch (error) {
+                // A store or network fault that escapes an attempt is as transient as
+                // a `retry`. Ending the loop on it would leave the row closed until
+                // the next restart again.
+                this.log.warn(createOperationContext('sync'), `Pending join-approval recovery attempt for "${contextGraphId}" failed: ${error instanceof Error ? error.message : String(error)}`);
+                outcome = 'retry';
+            }
+            if (outcome !== 'retry')
+                return;
+            const delayMs = JOIN_APPROVAL_METADATA_RECOVERY_RETRY_MS[Math.min(attempt, JOIN_APPROVAL_METADATA_RECOVERY_RETRY_MS.length - 1)];
+            if (!(await waitUnlessStopped(delayMs, stopSignal)))
+                return;
+            const current = this.subscribedContextGraphs.get(contextGraphId);
+            if (!this.localApprovedAgentByCG.has(contextGraphId)
+                || current?.subscribed !== true
+                // A concurrent data catch-up can set `synced` while authoritative
+                // join metadata is still pending or unknown. Only its explicit
+                // confirmation ends this join-specific retry.
+                || (current.synced === true && current.metaSynced === true && current.pendingMeta !== true))
+                return;
+        }
     }
     selectCatchupPeers(peers, preferredPeerId, privateOnly = false) {
         return orderCatchupPeers(peers, preferredPeerId, privateOnly, this.peerCapabilityRegistry.snapshotCorePeerIds());
@@ -6008,7 +6339,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
      * abort contract.
      */
     async waitForSyncProtocol(pid, signal) {
-        return waitForPeerProtocol(this.node.libp2p.peerStore, pid, PROTOCOL_SYNC, SYNC_PROTOCOL_CHECK_ATTEMPTS, SYNC_PROTOCOL_CHECK_DELAY_MS, signal);
+        return waitForPeerProtocol(this.node.libp2p.peerStore, pid, 
+        // Either id proves sync support (#2822; see `advertisesSyncProtocol`).
+        [PROTOCOL_SYNC, PROTOCOL_SYNC_POOLED], SYNC_PROTOCOL_CHECK_ATTEMPTS, SYNC_PROTOCOL_CHECK_DELAY_MS, signal);
     }
     async refreshMetaSyncedFlags(contextGraphIds) {
         for (const contextGraphId of contextGraphIds) {
@@ -6327,14 +6660,16 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         pending.add(revision);
     }
     enqueueContextGraphSubscriptionPersistWrite(contextGraphId, write) {
-        const previous = this.contextGraphSubscriptionPersistChains.get(contextGraphId) ?? Promise.resolve();
-        const run = previous.then(write);
-        const chain = run.catch(() => undefined);
-        this.contextGraphSubscriptionPersistChains.set(contextGraphId, chain);
-        void chain.finally(() => {
-            if (this.contextGraphSubscriptionPersistChains.get(contextGraphId) !== chain)
-                return;
-            this.contextGraphSubscriptionPersistChains.delete(contextGraphId);
+        // The scheduler owns per-context-graph ordering, strict non-coalescing,
+        // write-start timing (a microtask after admission), shutdown drain and
+        // bounds; the revision maps below stay the cancel/supersede layer on top of
+        // it. The returned promise rejects when the write (or admission) fails, so
+        // an awaiting caller sees the failure. The lane keeps draining, so a failed
+        // write does not stall the next one for this context graph.
+        const run = this.contextGraphSubscriptionPersistence.enqueue(contextGraphId, write);
+        // Idle cleanup runs after the caller's own handlers and marks a failure as
+        // handled for a caller that drops the promise, as the chain tail did.
+        void run.catch(() => undefined).finally(() => {
             this.clearContextGraphSubscriptionPersistRevisionStateIfIdle(contextGraphId);
         });
         return run;
@@ -6355,7 +6690,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
     clearContextGraphSubscriptionPersistRevisionStateIfIdle(contextGraphId) {
         if ((this.contextGraphSubscriptionPersistPendingRevisions.get(contextGraphId)?.size ?? 0) > 0)
             return;
-        if (this.contextGraphSubscriptionPersistChains.has(contextGraphId))
+        if (this.contextGraphSubscriptionPersistence.hasLane(contextGraphId))
             return;
         const sub = this.subscribedContextGraphs.get(contextGraphId);
         if (sub?.subscribed === true || sub?.coreHosted === true)
@@ -6506,6 +6841,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const recoverySelectionChanged = effects.recoveryChanged;
         if (!receiverSelectionChanged && !recoverySelectionChanged)
             return;
+        // Record the inactive edge synchronously: a same-tick resubscription can
+        // otherwise look like an unchanged active lane to repair backoff.
+        this.observeRfc64SwmCatalogProjectionLaneAvailabilityV1(contextGraphId);
         if (receiverSelectionChanged && !effects.nextReceiverActive) {
             this.rfc64PublicCatalogServiceV1?.deactivateReceiverContextGraph(contextGraphId);
             this.clearRfc64CatalogOperationalTargetsV1(contextGraphId);
@@ -6539,8 +6877,8 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 void this.replayRfc64CatalogToConnectedPeersV1(contextGraphId)
                     .catch(() => undefined);
             }
-            // Re-entering the idempotent start boundary also dirties an existing
-            // failed repair for this newly active CG, including retryIntervalMs=0.
+            // The observed inactive edge makes this recovery eligible immediately,
+            // including retryIntervalMs=0; duplicate active starts retain cooldown.
             this.startRfc64SwmCatalogProjectionSupervisorV1(createOperationContext('system'));
         }
     }
@@ -6650,6 +6988,12 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             this.finishContextGraphSubscriptionPersistRevision(contextGraphId, options?.revision);
         });
     }
+    /**
+     * Strict write of a row that must be durable. Throws when the projection
+     * would keep member intent process-local, so it suits persisted-row
+     * activation, not the sync path of a live on-demand subscription (see
+     * {@link persistContextGraphSyncStateStrict}).
+     */
     async persistContextGraphSubscriptionStrict(contextGraphId, subscription, syncScoped, isCurrent = () => true) {
         await this.persistContextGraphSubscriptionProjectionStrict({
             contextGraphId,
@@ -6661,10 +7005,11 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         });
     }
     /**
-     * One strict subscription persistence protocol shared by joins and registry
-     * discovery. It owns snapshot capture, generation validation, per-graph
-     * serialization, and the store-first write. Callers select only whether an
-     * intentionally process-local on-demand member projection is acceptable.
+     * One strict subscription persistence protocol shared by joins, registry
+     * discovery, and sync-owned binding and cursor progress. It owns snapshot
+     * capture, generation validation, per-graph serialization, and the
+     * store-first write. Callers select only whether an intentionally
+     * process-local on-demand member projection is acceptable.
      */
     async persistContextGraphSubscriptionProjectionStrict(input) {
         const store = this.config.contextGraphSubscriptionStore;
@@ -6678,7 +7023,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const expectedBindingGeneration = this.contextGraphBindingState.capture(input.contextGraphId);
         const sub = input.subscription ?? expectedLiveSub;
         if (!sub?.subscribed && !sub?.coreHosted) {
-            throw new Error(`Cannot persist context graph "${input.contextGraphId}": active subscription or host state is missing`);
+            throw new Error(`Cannot persist context graph "${input.contextGraphId}" (${input.operation}): active subscription or host state is missing`);
         }
         const persistence = projectContextGraphSubscriptionPersistence({
             contextGraphId: input.contextGraphId,
@@ -6702,7 +7047,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 || current !== expectedLiveSub
                 || (!current?.subscribed && !current?.coreHosted)
                 || !this.contextGraphBindingState.isGenerationCurrent(input.contextGraphId, expectedBindingGeneration)) {
-                throw asSyncFetchAbortError(new Error(`Context graph "${input.contextGraphId}" changed before its strict subscription snapshot was persisted`));
+                throw asSyncFetchAbortError(new Error(`Context graph "${input.contextGraphId}" changed before its strict subscription snapshot (${input.operation}) was persisted`));
             }
             await store.save(record);
         });
@@ -6722,6 +7067,25 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             operation: 'chain discovery',
         });
     }
+    /**
+     * Sync-owned durability boundary for a live subscription's on-chain id
+     * binding and VM reconcile cursor. Like chain discovery, sync keeps the
+     * canonical projection instead of demanding durable member intent: an
+     * on-demand member subscription is process-local, so nothing is written and
+     * the caller advances only its in-memory state; a Core hosting obligation
+     * still saves its host-only row; an always-on subscription is saved before
+     * the caller exposes the new state. Demanding member intent here stalled
+     * every `dkg subscribe` without `--save` at its first cursor advance.
+     */
+    async persistContextGraphSyncStateStrict(contextGraphId, subscription, operation, isCurrent) {
+        await this.persistContextGraphSubscriptionProjectionStrict({
+            contextGraphId,
+            subscription,
+            isCurrent,
+            requireDurableMemberIntent: false,
+            operation,
+        });
+    }
     /**
      * Persist the two durable halves of a requester-side join approval.
      *
@@ -7005,12 +7369,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     onChainId: row.onChainId,
                     onChainHash: row.onChainHash,
                 },
-            }).catch(() => ({
-                outcome: 'unavailable',
-                source: 'legacy-local',
-                reason: 'unexpected-authority-error',
-                metadataBootstrap: 'eligible',
-            }))),
+            }).catch((error) => unavailableContextGraphReadAuthorityDecision('legacy-local', 'unexpected-authority-error', contextGraphReadAuthorityDependencyOf(error)))),
             activate: async (row, onChainId, revision) => {
                 await this.activatePersistedContextGraphSubscriptionRecord(row, {
                     onChainId,
@@ -7048,6 +7407,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 });
                 this.log.info(ctx, `Activated persisted context-graph subscription "${contextGraphId}" after authority recovery`);
             },
+            capped: (contextGraphId) => {
+                this.contextGraphSubscriptionRehydrationPendingIds.add(contextGraphId);
+                this.contextGraphSubscriptionRehydrationPromotionRuntime?.request();
+            },
         });
     }
     /**
@@ -7130,12 +7493,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     onChainId: row.onChainId,
                     onChainHash: row.onChainHash,
                 },
-            }).catch(() => ({
-                outcome: 'unavailable',
-                source: 'legacy-local',
-                reason: 'unexpected-authority-error',
-                metadataBootstrap: 'eligible',
-            }));
+            }).catch((error) => unavailableContextGraphReadAuthorityDecision('legacy-local', 'unexpected-authority-error', contextGraphReadAuthorityDependencyOf(error)));
             signal.throwIfAborted();
             if (!runtime.owns(signal))
                 return 'idle';
@@ -7298,6 +7656,8 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         if (!store)
             return;
         const ctx = createOperationContext('init');
+        let authorityBudget;
+        const startupPlan = this.gossipSession.beginDurableStartupPlan(this.contextGraphSubscriptionRehydrationAccountedIds);
         try {
             // System context graphs (AGENTS/ONTOLOGY) are auto-subscribed separately
             // by start(); their persisted rows must NOT be rehydrated here too. Re-
@@ -7306,6 +7666,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             // dormant. Exclude them from the rehydration set entirely.
             const systemContextGraphs = new Set(Object.values(SYSTEM_CONTEXT_GRAPHS));
             const persistedRows = await store.loadAll();
+            startupPlan.claimDurableRows(persistedRows);
             // A name-hash placeholder whose verified cleartext row is also durable
             // was adopted earlier; the crash window between the two writes can
             // leave both. Never reactivate the placeholder. Record the adoption as
@@ -7381,10 +7742,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             // snapshot already read by the provenance phase. Load every persisted
             // row (not just rows under the activation cap) so a dormant subscription
             // still has the right signer when an operator activates it explicitly.
-            if (persistedMembershipRows !== null) {
-                const persistedContextGraphIds = new Set(rows.map((row) => row.id));
-                const localAgentAddresses = new Set([...this.localAgents.keys()].map((address) => address.toLowerCase()));
-                const newestApprovalByContextGraph = projectPersistedJoinApprovals(persistedMembershipRows, persistedContextGraphIds, localAgentAddresses);
+            const newestApprovalByContextGraph = persistedMembershipRows === null
+                ? null
+                : projectPersistedJoinApprovals(persistedMembershipRows, new Set(rows.map((row) => row.id)), new Set([...this.localAgents.keys()].map((address) => address.toLowerCase())));
+            if (newestApprovalByContextGraph) {
                 for (const [contextGraphId, approval] of newestApprovalByContextGraph) {
                     this.localApprovedAgentByCG.set(contextGraphId, approval.principalId);
                     if (approval.curatorPeerId) {
@@ -7419,6 +7780,43 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             dormancyById.clear();
             const activatedRows = [];
             let activatedUserRows = 0;
+            // #2815: every row's authority may need a chain read, and start() (with
+            // the daemon API behind it) waits for this loop. Past the budget, a row
+            // without a durable join approval is left dormant as
+            // `authorityUnavailable` unread; background authority recovery resolves
+            // it after start and activates it only once it resolves as allowed.
+            const configuredAuthorityBudgetMs = this.config.contextGraphSubscriptionRehydrationAuthorityBudgetMs;
+            let authorityBudgetMs = DEFAULT_REHYDRATION_STARTUP_AUTHORITY_BUDGET_MS;
+            if (configuredAuthorityBudgetMs != null) {
+                if (Number.isSafeInteger(configuredAuthorityBudgetMs)
+                    && configuredAuthorityBudgetMs >= 0
+                    && configuredAuthorityBudgetMs <= MAX_REHYDRATION_AUTHORITY_BUDGET_MS) {
+                    authorityBudgetMs = configuredAuthorityBudgetMs;
+                }
+                else {
+                    this.log.warn(ctx, `Ignoring invalid contextGraphSubscriptionRehydrationAuthorityBudgetMs=${configuredAuthorityBudgetMs} ` +
+                        `(must be a whole number of milliseconds from 0 to ${MAX_REHYDRATION_AUTHORITY_BUDGET_MS}); ` +
+                        `using default ${DEFAULT_REHYDRATION_STARTUP_AUTHORITY_BUDGET_MS}.`);
+                }
+            }
+            const deferredIds = [];
+            let deferredUserRows = 0;
+            // Past the budget, a user row goes to background authority recovery only
+            // while the activation cap still has room for it; beyond that it waits
+            // for rolling activation unread, as a row beyond the cap always has.
+            // Hosted rows are exempt from the cap and always go to recovery.
+            const leaveUnresolved = (row) => {
+                if (!row.coreHosted && cap > 0 && activatedUserRows + deferredUserRows >= cap) {
+                    dormancyById.set(row.id, 'activationCap');
+                    this.contextGraphSubscriptionRehydrationPendingIds.add(row.id);
+                    return;
+                }
+                if (!row.coreHosted)
+                    deferredUserRows += 1;
+                dormancyById.set(row.id, 'authorityUnavailable');
+                deferredIds.push(row.id);
+            };
+            authorityBudget = startRehydrationAuthorityBudget(authorityBudgetMs);
             for (let i = 0; i < toActivate.length; i++) {
                 const row = toActivate[i];
                 // The cap limits successful non-hosted activations, not candidates.
@@ -7434,7 +7832,29 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 const approvedAgentAddress = row.subscribed
                     ? this.localApprovedAgentByCG.get(row.id)
                     : undefined;
-                const hasJoinApproval = approvedAgentAddress !== undefined;
+                let hasJoinApproval = approvedAgentAddress !== undefined;
+                // The membership row is the restart hint, not the current requester
+                // decision. A later explicit pending/rejected decision must retire a
+                // stale join-approved hint instead of resurrecting its subscription in
+                // restricted pending-metadata mode. Missing decision state remains the
+                // compatibility shape for legacy persisted membership rows.
+                if (approvedAgentAddress !== undefined) {
+                    try {
+                        const requesterState = await this.readRequesterJoinRequestState(row.id, approvedAgentAddress);
+                        hasJoinApproval = requesterState === null
+                            || requesterState.status === 'approved';
+                    }
+                    catch {
+                        hasJoinApproval = false;
+                    }
+                }
+                // A join-approved row keeps the synchronous path: only it can restore
+                // the restricted pending-metadata bootstrap, which background
+                // authority recovery does not offer.
+                if (!hasJoinApproval && authorityBudget.spent()) {
+                    leaveUnresolved(row);
+                    continue;
+                }
                 // A crash between a historical false-ready sync and the approval
                 // reset could leave all three persisted bits true. The durable
                 // join-approved marker identifies a private bootstrap, so prove both
@@ -7458,7 +7878,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 // in-memory state needed for one authenticated metadata fetch. That
                 // restricted path cannot activate data lanes until this same authority
                 // resolver subsequently returns `allowed`.
-                const readAuthority = await this.resolveContextGraphSubscriptionBootstrapAuthority(row.id, {
+                const authorityRead = this.resolveContextGraphSubscriptionBootstrapAuthority(row.id, {
                     allowSubscriptionFallback: false,
                     signal: AbortSignal.timeout(chainAuthorityReadBudgetsOf(this).requestTimeoutMs),
                     durableSubscriptionBinding: {
@@ -7466,12 +7886,16 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         onChainId: row.onChainId,
                         onChainHash: row.onChainHash,
                     },
-                }).catch(() => ({
-                    outcome: 'unavailable',
-                    source: 'legacy-local',
-                    reason: 'unexpected-authority-error',
-                    metadataBootstrap: 'eligible',
-                }));
+                }).catch((error) => unavailableContextGraphReadAuthorityDecision('legacy-local', 'unexpected-authority-error', contextGraphReadAuthorityDependencyOf(error)));
+                // A read the budget stops waiting for ends on its own request
+                // timeout; its late answer is ignored and activates nothing.
+                const readAuthority = hasJoinApproval
+                    ? await authorityRead
+                    : await authorityBudget.race(authorityRead);
+                if (readAuthority === REHYDRATION_AUTHORITY_DEFERRED) {
+                    leaveUnresolved(row);
+                    continue;
+                }
                 // A stale approval cannot override an explicit current membership
                 // denial. The authority resolver supplies a typed bootstrap policy so
                 // lifecycle code never infers security semantics from diagnostic text.
@@ -7519,7 +7943,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     const curatorPeerId = this.preferredSyncPeers.get(row.id);
                     this.log.info(ctx, `Restored persisted context-graph subscription "${row.id}" in restricted pending-metadata mode; VM, payload recovery, and SWM remain closed`);
                     if (curatorPeerId) {
-                        void this.resumePendingJoinApprovalMetadata(row.id, curatorPeerId).catch((error) => {
+                        void this.recoverPendingJoinApprovalMetadata(row.id, curatorPeerId, newestApprovalByContextGraph?.get(row.id)?.curatorDialAddress).catch((error) => {
                             this.log.warn(ctx, `Pending join-approval recovery for "${row.id}" stopped safely: ${error instanceof Error ? error.message : String(error)}`);
                         });
                     }
@@ -7579,13 +8003,23 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             if (dormancy.dormantReasons.authorityDenied.length > 0) {
                 this.log.warn(ctx, `${dormancy.dormantReasons.authorityDenied.length} context-graph subscription(s) left dormant because current read authority denied this node.`);
             }
-            if (dormancy.dormantReasons.authorityUnavailable.length > 0) {
-                this.log.warn(ctx, `${dormancy.dormantReasons.authorityUnavailable.length} context-graph subscription(s) left dormant because current read authority was unavailable; retry after restoring the authority source.`);
+            const unavailableAtStartup = dormancy.dormantReasons.authorityUnavailable.length - deferredIds.length;
+            if (unavailableAtStartup > 0) {
+                this.log.warn(ctx, `${unavailableAtStartup} context-graph subscription(s) left dormant because current read authority was unavailable; retry after restoring the authority source.`);
+            }
+            if (deferredIds.length > 0) {
+                this.log.warn(ctx, `Stopped waiting on read authority for ${deferredIds.length} persisted context-graph subscription(s) ` +
+                    `after the ${authorityBudgetMs} ms startup budget. They stay dormant until background authority ` +
+                    `recovery resolves them as allowed.`);
             }
         }
         catch (err) {
             this.log.warn(ctx, `Failed to rehydrate persisted context-graph subscriptions: ${err instanceof Error ? err.message : String(err)}`);
         }
+        finally {
+            authorityBudget?.dispose();
+            startupPlan.finish();
+        }
     }
     /**
      * Operator recovery for #997: tear down every active in-memory subscription
@@ -7642,7 +8076,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             }
         }
         const activeUserIdsWithPendingStoreWrite = store
-            ? activeUserIds.filter((id) => this.contextGraphSubscriptionPersistChains.has(id))
+            ? activeUserIds.filter((id) => this.contextGraphSubscriptionPersistence.hasLane(id))
             : [];
         const storeDeleteIds = [...new Set([...persistedUserIds, ...activeUserIdsWithPendingStoreWrite])];
         const total = storeDeleteIds.length;
@@ -7726,10 +8160,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             }, normalizedContextGraphId, input),
         }, contextGraphId);
     }
-    async hasConfirmedMetaState(contextGraphId, options) {
+    async hasConfirmedMetaState(contextGraphId, options = {}) {
         return confirmContextGraphMetadataV1({
             chain: this.chain,
-            resolveActivePublicChainProof: () => this.resolveActivePublicContextGraphChainProof(contextGraphId, createOperationContext('sync'), options?.signal),
+            resolveActivePublicChainProof: () => this.resolveActivePublicContextGraphChainProof(contextGraphId, createOperationContext('sync'), options.signal),
             isPrivateContextGraph: (id) => this.isPrivateContextGraph(id),
             localApprovedAgentByContextGraph: this.localApprovedAgentByCG,
             peerId: this.peerId,
@@ -7737,6 +8171,46 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             subscriptions: this.subscribedContextGraphs,
         }, contextGraphId, options);
     }
+    /**
+     * Join bootstrap completion: the local metadata proves this node's approved
+     * member, judged with the same acceptance the snapshot refresh used.
+     */
+    hasConfirmedApprovedMemberMetaState(contextGraphId, acceptance) {
+        return this.hasConfirmedMetaState(contextGraphId, { purpose: 'approved-member', acceptance });
+    }
+    /**
+     * The one approved-member acceptance a join attempt is judged with: this
+     * node's approval binding, its libp2p peer and operational key, and the
+     * authenticated access policy (#2831 review). The curator refresh and join
+     * completion both consume this same value. `undefined` without an approval
+     * binding.
+     *
+     * The policy is `public` only when the graph's SWM transport authority is
+     * plaintext: registered public, or unregistered under an active accepted
+     * owner-signed public policy (see classifySwmTransportAuthority). A retained
+     * snapshot therefore never outvotes a registration the index shows. Private,
+     * approved-private-replica, legacy-unregistered or unavailable authority, or
+     * an unreadable chain, is `unproven`, which admits only the complete private
+     * definition.
+     */
+    async resolveApprovedMemberAcceptance(contextGraphId) {
+        const approvedAgentAddress = this.localApprovedAgentByCG.get(contextGraphId);
+        if (!approvedAgentAddress)
+            return undefined;
+        let expectedDelegateeOpKey;
+        try {
+            expectedDelegateeOpKey = await inferAdapterPublisherAddress(this.chain);
+        }
+        catch {
+            // The signed join flow always binds the current libp2p peer, so an
+            // adapter that cannot expose its op-key still has a usable proof.
+        }
+        return resolveApprovedMemberAcceptanceDecision({
+            approvedAgentAddress,
+            expectedDelegateePeerId: this.peerId,
+            expectedDelegateeOpKey,
+        }, () => this.resolveSwmTransportAuthority(contextGraphId, { authorityReadMode: 'finalized-index-or-live' }));
+    }
     async hasConfirmedSharedMemoryMetaState(contextGraphId) {
         return this.hasConfirmedMetaState(contextGraphId);
     }
@@ -7745,8 +8219,13 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // The accepted snapshot is itself finalized, name-bound authority for a
         // catalog-owned graph. It replaces both the legacy registration read and
         // its metadata-bootstrap proof at this internal transport boundary.
-        if (acceptedRfc64Authority !== undefined)
-            return acceptedRfc64Authority;
+        if (acceptedRfc64Authority === true)
+            return true;
+        // A private graph whose RFC-64 authority is not active keeps the legacy
+        // member checks below (#2858); a refusal by an active authority stands.
+        if (acceptedRfc64Authority === false
+            && !(await this.rfc64PrivateRootSwmOnLegacyLaneV1(contextGraphId)))
+            return false;
         if (!(await this.hasConfirmedSharedMemoryMetaState(contextGraphId))) {
             return false;
         }