@origintrail-official/dkg-agent 10.0.19 → 10.0.21

package/dist/dkg-agent-rfc64-catalog.js

@@ -16,10 +16,15 @@
  * Gate-1 boundary: staging a fetched head is the terminal step. Nothing here
  * admits candidate rows or activates KA / SWM / VM state.
  */
-import { SYSTEM_CONTEXT_GRAPHS, ZERO_DIGEST32_V1, MAX_AUTHOR_CATALOG_BUCKET_ROWS_V1, contextGraphDataGraphUri, contextGraphMetaGraphUri, assertContextGraphIdV1, assertNetworkIdV1, assertSignedAuthorCatalogBucketEnvelopeV1, assertSignedAuthorCatalogDirectoryNodeEnvelopeV1, assertSignedAuthorCatalogHeadEnvelopeV1, assertSignedAuthorCatalogIssuerDelegationEnvelopeV1, computeAuthorCatalogScopeDigestV1, computeControlSignatureVariantDigestHex, createOperationContext, deriveAuthorCatalogScopeFromHeadV1, } from '@origintrail-official/dkg-core';
+import { Rfc64CatalogTargetTrackerV1, rfc64CatalogTargetExactIdentityKeyV1 } from './rfc64/catalog-operational-targets-v1.js';
+import { evaluateRfc64CatalogCompletionV1 } from './rfc64/catalog-completion-evidence-v1.js';
+export { RFC64_CATALOG_TARGET_MAX_ENTRIES_V1, RFC64_CATALOG_TARGET_MAX_CONTEXT_OVERFLOWS_V1, Rfc64CatalogTargetTrackerV1, rfc64CatalogTargetExactIdentityKeyV1, projectRfc64OperationalRowCountsV1 } from './rfc64/catalog-operational-targets-v1.js';
+import { SYSTEM_CONTEXT_GRAPHS, DKGEvent, ZERO_DIGEST32_V1, MAX_AUTHOR_CATALOG_BUCKET_ROWS_V1, contextGraphDataGraphUri, contextGraphMetaGraphUri, assertContextGraphIdV1, assertNetworkIdV1, assertSignedAuthorCatalogBucketEnvelopeV1, assertSignedAuthorCatalogDirectoryNodeEnvelopeV1, assertSignedAuthorCatalogHeadEnvelopeV1, assertSignedAuthorCatalogIssuerDelegationEnvelopeV1, computeAuthorCatalogScopeDigestV1, computeControlSignatureVariantDigestHex, createOperationContext, deriveAuthorCatalogScopeFromHeadV1, } from '@origintrail-official/dkg-core';
 import { assertContextGraphAuthorityIndexId, resolveRpcUrls, verifyControlEnvelopeIssuerSignatureV1, withRpcRequestContext, } from '@origintrail-official/dkg-chain';
 import { ethers } from 'ethers';
 import { DKGAgentBase } from './dkg-agent-base.js';
+import { resolveChainFinalityConfirmationsV1 } from './chain-finality-confirmations-v1.js';
+import { isApprovedPrivateReplicaDelegationActive, resolveApprovedPrivateReplicaAuthority, } from './approved-private-replica.js';
 import { Rfc64CatalogReplayConnectionRuntimeV1, } from './rfc64/catalog-replay-connection-runtime-v1.js';
 import { Rfc64CatalogReplayRecoveryRuntimeV1, } from './rfc64/catalog-replay-recovery-runtime-v1.js';
 export { RFC64_CATALOG_TARGET_MAX_ENTRIES_PER_CONTEXT_GRAPH_V1 } from './rfc64/catalog-limits-v1.js';
@@ -34,12 +39,15 @@ import { createRfc64CatalogAppliedHeadCoordinatorV1, } from './rfc64/catalog-app
 import { reduceRfc64CatalogSynchronizationEvidenceReplayV1, snapshotRfc64CatalogSynchronizationEvidenceV1, } from './rfc64/catalog-synchronization-evidence-v1.js';
 import { createRfc64BoundedPublicRootCatalogNativeReconcilerV1, createRfc64VerifiedStagedCatalogHeadMemoV1, } from './rfc64/public-catalog-native-reconciler-v1.js';
 import { loadRfc64OperationalAppliedHeadsV1, rfc64CatalogTargetScopeKeyV1, } from './rfc64/catalog-operational-applied-heads-v1.js';
+import { groupRfc64OperationalAppliedHeadsV1, loadRfc64OperationalPromisedRowCountsV1 } from './rfc64/catalog-operational-reads-v1.js';
+import { verifyPrivateCatalogSubscriptionReadinessV1 } from './rfc64/private-catalog-subscription-readiness-v1.js';
 import { Rfc64PublicCatalogSuccessorProducerV1, } from './rfc64/public-catalog-successor-producer-v1.js';
-import { RFC64_PUBLIC_CATALOG_HEAD_ANNOUNCEMENT_KIND_V1, Rfc64PublicCatalogTransportErrorV1, } from './rfc64/public-catalog-transport-v1.js';
+import { RFC64_PUBLIC_CATALOG_HEAD_ANNOUNCEMENT_KIND_V1, RFC64_PUBLIC_CATALOG_HEAD_REPLAY_KIND_V1, Rfc64PublicCatalogTransportErrorV1, } from './rfc64/public-catalog-transport-v1.js';
 import { createRfc64CatalogNativeScopedReadProviderV1 } from './rfc64/catalog-native-scoped-read-provider-v1.js';
 import { projectRfc64CatalogReceiverAuthorityV1, resolveRfc64CatalogResponsibilityAuthorityV1, } from './rfc64/public-catalog-activation-config-v1.js';
 import { Rfc64CatalogResponsibilityRegistryV1, resolveRfc64CatalogResponsibilityReasonV1, } from './rfc64/catalog-responsibility-registry-v1.js';
-import { rfc64CatalogResponsibilityOwnsAuthorityWorkloadV1, } from './rfc64/catalog-rollout-authority-v1.js';
+import { projectRfc64CatalogTransportStateV1, rfc64CatalogResponsibilityOwnsAuthorityWorkloadV1, } from './rfc64/catalog-rollout-authority-v1.js';
+import { isRfc64AuthorityRpcCircuitOpenErrorV1, } from './rfc64/authority-rpc-circuit-breaker-v1.js';
 import { composeRfc64FinalizedCatalogAuthorityV1, composeRfc64RegisteredRosterVersionV1, composeRfc64UnregisteredCatalogAuthorityV1, parseRfc64AuthoritySnapshotV1, } from './rfc64/release-native-catalog-authority-v1.js';
 import { acquireRfc64LegacySwmBoundaryReceiverLeaseV1, readRfc64LegacySwmBoundaryCountV1, } from './rfc64/legacy-swm-boundary-v1.js';
 import { Rfc64CatalogReplaySnapshotRuntimeV1, } from './rfc64/catalog-replay-snapshot-runtime-v1.js';
@@ -49,15 +57,6 @@ import { isRfc64SharedStorePressureFailureV1, } from './rfc64/catalog-authority-
 import { loadRfc64UnregisteredReplicaAuthorityV1 } from './rfc64/unregistered-replica-authority-v1.js';
 const RFC64_PRIVATE_ROSTER_VERSION_PREDICATE_V1 = 'https://dkg.network/ontology#rfc64RosterVersion';
 const RFC64_PRIVATE_ROSTER_VERSION_RADIX_V1 = 10000000000000n;
-function groupRfc64OperationalAppliedHeadsV1(heads) {
-    const byContextGraph = new Map();
-    for (const head of heads) {
-        const grouped = byContextGraph.get(head.contextGraphId) ?? [];
-        grouped.push(head);
-        byContextGraph.set(head.contextGraphId, grouped);
-    }
-    return byContextGraph;
-}
 export { RFC64_PUBLIC_CATALOG_RECONCILIATION_FAILURE_MAX_ENTRIES_V1, Rfc64CatalogReconciliationTerminalErrorV1, } from './rfc64/public-catalog-reconciliation-failure-v1.js';
 export { snapshotRfc64CatalogAccessPolicyAuthorityV1, snapshotRfc64CatalogDeploymentProfileV1, snapshotRfc64PublicCatalogAutoPublishConfigV1, snapshotRfc64PublicCatalogBootstrapConfigV1, } from './rfc64/catalog-authority-config-v1.js';
 import { CONTEXT_GRAPH_AUTHORITY_RPC_SITES as CG_AUTH_RPC_SITES, withRpcUsageSite, } from '@origintrail-official/dkg-chain';
@@ -67,6 +66,14 @@ const rfc64CatalogAuthorityProgressV1 = new WeakMap();
 const rfc64CatalogAuthorityRevisionsV1 = new WeakMap();
 const rfc64AuthorityAcceptedCatchupTimersV1 = new WeakMap();
 const rfc64DirectAcceptedCompatibilityV1 = new WeakMap();
+/**
+ * Context graphs whose accepted policy was composed from a private join
+ * approval rather than from owner-signed or finalized evidence. The approval
+ * proof is time-limited and bound to one request generation, so this
+ * authority may run catalog responsibility but never stands in for the live
+ * proof on reads or shared-memory access.
+ */
+const rfc64JoinDerivedAcceptedAuthorityV1 = new WeakMap();
 const rfc64ResponsibilityAuthorityBatchRuntimesV1 = new WeakMap();
 const rfc64ScheduledResponsibilityStatesV1 = new WeakMap();
 const rfc64SystemContextGraphIdsV1 = new Set(Object.values(SYSTEM_CONTEXT_GRAPHS));
@@ -86,15 +93,50 @@ const RFC64_AUTHORITY_CATALOG_RECOVERY_RETRY_DELAYS_MS_V1 = Object.freeze([
     1_000,
     4_000,
 ]);
+/**
+ * A join-approved replica can accept its policy before its providers have the
+ * roster that names it. Only that replica keeps asking for this long.
+ */
+const RFC64_JOIN_DERIVED_CATALOG_RECOVERY_RETRY_DELAYS_MS_V1 = Object.freeze([
+    ...RFC64_AUTHORITY_CATALOG_RECOVERY_RETRY_DELAYS_MS_V1,
+    15_000,
+    30_000,
+    60_000,
+    120_000,
+    240_000,
+]);
+const RFC64_JOIN_APPROVAL_CATALOG_REPLAY_RETRY_DELAYS_MS_V1 = Object.freeze([
+    5_000,
+    15_000,
+    30_000,
+    60_000,
+]);
+/**
+ * Waits before an authority snapshot is composed again after local authority
+ * facts moved under the previous composition. The first retry is immediate;
+ * the later ones outlast the burst of local writes a join or a publish makes.
+ */
+export const RFC64_AUTHORITY_FACTS_MOVED_RETRY_DELAYS_MS_V1 = Object.freeze([
+    0,
+    50,
+    200,
+    500,
+    1_000,
+    2_000,
+]);
 const RFC64_CATALOG_REPLAY_MAX_QUEUED_V1 = 64;
 const RFC64_CATALOG_REPLAY_MAX_QUEUED_PER_PEER_V1 = 4;
-export const RFC64_CATALOG_TARGET_MAX_ENTRIES_V1 = 1_024;
-export const RFC64_CATALOG_TARGET_MAX_CONTEXT_OVERFLOWS_V1 = 64;
 function isRfc64ActiveRegisteredSubscriptionV1(subscription) {
     return subscription?.subscribed === true
         && subscription.onChainId !== undefined
         && subscription.onChainHash !== undefined;
 }
+/** A private join has no numeric binding while its signed _meta catches up. */
+function isRfc64LocalJoinIntentUnregisteredSubscriptionV1(hasLocalJoinIntent, subscription) {
+    return subscription?.subscribed === true
+        && subscription.onChainId === undefined
+        && hasLocalJoinIntent;
+}
 /**
  * Construct the complete retry identity once so dispatcher-key uniqueness,
  * the revision fence, attempt, and delay cannot drift at separate call sites.
@@ -125,294 +167,6 @@ const rfc64CatalogReplayRuntimesV1 = new WeakMap();
 const rfc64CatalogReplaySnapshotRuntimesV1 = new WeakMap();
 const rfc64CatalogReplayConnectionRuntimesV1 = new WeakMap();
 const rfc64CatalogReplayRecoveryRuntimesV1 = new WeakMap();
-/** Process-local, bounded operational targets; semantic truth remains the durable inventory. */
-export class Rfc64CatalogTargetTrackerV1 {
-    #byContextGraph = new Map();
-    #contextGraphOverflows = new Map();
-    #contextEpochs = new Map();
-    #globalOverflow = null;
-    #size = 0;
-    get size() {
-        return this.#size;
-    }
-    targetsForContextGraph(contextGraphId) {
-        return Object.freeze([...this.#byContextGraph.get(contextGraphId)?.values() ?? []]
-            .map(({ announcement }) => announcement));
-    }
-    hasTerminalFailure(announcement) {
-        const entry = this.#byContextGraph
-            .get(announcement.contextGraphId)
-            ?.get(rfc64CatalogTargetScopeKeyV1(announcement));
-        return entry !== undefined
-            && rfc64CatalogTargetExactIdentityV1(entry.announcement, announcement)
-            && entry.terminalFailure;
-    }
-    capacityExceededForContextGraph(contextGraphId) {
-        return this.#globalOverflow !== null
-            || this.#contextGraphOverflows.has(contextGraphId);
-    }
-    /** Invalidate every outstanding lease and release all process-local target evidence. */
-    resetAll() {
-        for (const contextEpoch of this.#contextEpochs.values())
-            contextEpoch.valid = false;
-        this.#contextEpochs.clear();
-        this.#byContextGraph.clear();
-        this.#contextGraphOverflows.clear();
-        this.#globalOverflow = null;
-        this.#size = 0;
-    }
-    clearContextGraph(contextGraphId) {
-        const byScope = this.#byContextGraph.get(contextGraphId);
-        const contextEpoch = this.#contextEpochs.get(contextGraphId);
-        if (contextEpoch !== undefined) {
-            contextEpoch.valid = false;
-            this.#contextEpochs.delete(contextGraphId);
-        }
-        this.#contextGraphOverflows.delete(contextGraphId);
-        if (this.#globalOverflow !== null) {
-            for (const [identity, witness] of this.#globalOverflow.failureWitnesses) {
-                if (witness.contextGraphId === contextGraphId) {
-                    this.#globalOverflow.failureWitnesses.delete(identity);
-                }
-            }
-            this.#globalOverflow.saturatedContextGraphs.delete(contextGraphId);
-            this.#finishOverflowIfResolved(this.#globalOverflow, null);
-        }
-        if (byScope !== undefined) {
-            this.#byContextGraph.delete(contextGraphId);
-            this.#size -= byScope.size;
-        }
-        this.#promoteOverflowWitnesses();
-        return byScope?.size ?? 0;
-    }
-    begin(announcement) {
-        const existingByScope = this.#byContextGraph.get(announcement.contextGraphId);
-        const key = rfc64CatalogTargetScopeKeyV1(announcement);
-        const previous = existingByScope?.get(key);
-        let contextEpoch = this.#contextEpochs.get(announcement.contextGraphId);
-        if (contextEpoch === undefined) {
-            contextEpoch = { valid: true, activeLeases: 0 };
-            this.#contextEpochs.set(announcement.contextGraphId, contextEpoch);
-        }
-        contextEpoch.activeLeases += 1;
-        const lease = (disposition, overflow = null) => Object.freeze({
-            announcement,
-            disposition,
-            state: { active: true, contextEpoch, overflow },
-        });
-        if (previous !== undefined
-            && BigInt(announcement.catalogVersion)
-                < BigInt(previous.announcement.catalogVersion))
-            return lease('covered');
-        if (previous === undefined
-            && (existingByScope?.size ?? 0)
-                >= RFC64_CATALOG_TARGET_MAX_ENTRIES_PER_CONTEXT_GRAPH_V1) {
-            const overflow = this.#beginContextGraphOverflow(announcement.contextGraphId);
-            return lease(overflow.disposition, overflow.overflow);
-        }
-        if (previous === undefined && this.#size >= RFC64_CATALOG_TARGET_MAX_ENTRIES_V1) {
-            this.#globalOverflow ??= this.#createOverflow();
-            this.#globalOverflow.active += 1;
-            return lease('global-capacity', this.#globalOverflow);
-        }
-        let byScope = existingByScope;
-        if (byScope === undefined) {
-            byScope = new Map();
-            this.#byContextGraph.set(announcement.contextGraphId, byScope);
-        }
-        byScope.set(key, { announcement, terminalFailure: false });
-        if (previous === undefined)
-            this.#size += 1;
-        return lease('tracked');
-    }
-    reject(announcement) {
-        const lease = this.begin(announcement);
-        this.settle(lease, 'dropped');
-        return lease;
-    }
-    settle(lease, outcome) {
-        if (!lease.state.active)
-            return;
-        lease.state.active = false;
-        const { contextEpoch } = lease.state;
-        contextEpoch.activeLeases = Math.max(0, contextEpoch.activeLeases - 1);
-        if (contextEpoch.activeLeases === 0
-            && this.#contextEpochs.get(lease.announcement.contextGraphId) === contextEpoch)
-            this.#contextEpochs.delete(lease.announcement.contextGraphId);
-        const overflow = lease.state.overflow;
-        if (!contextEpoch.valid) {
-            if (overflow !== null) {
-                overflow.active = Math.max(0, overflow.active - 1);
-                if (this.#globalOverflow === overflow) {
-                    this.#finishOverflowIfResolved(overflow, null);
-                }
-            }
-            return;
-        }
-        const resolved = outcome === 'already-applied'
-            || outcome === 'applied'
-            || outcome === 'closed'
-            || outcome === 'staged-only';
-        if (lease.disposition === 'tracked') {
-            if (resolved)
-                this.retire(lease.announcement);
-            else
-                this.#markTerminalFailure(lease.announcement);
-            return;
-        }
-        if (lease.disposition === 'covered')
-            return;
-        if (overflow === null
-            || (lease.disposition === 'context-capacity'
-                ? this.#contextGraphOverflows.get(lease.announcement.contextGraphId) !== overflow
-                : this.#globalOverflow !== overflow))
-            return;
-        overflow.active = Math.max(0, overflow.active - 1);
-        const exactIdentity = rfc64CatalogTargetExactIdentityKeyV1(lease.announcement);
-        if (resolved) {
-            overflow.failureWitnesses.delete(exactIdentity);
-        }
-        else if (!overflow.failureWitnesses.has(exactIdentity)) {
-            if (overflow.failureWitnesses.size
-                >= RFC64_CATALOG_TARGET_MAX_ENTRIES_PER_CONTEXT_GRAPH_V1)
-                this.#markOverflowSaturated(overflow, lease.announcement.contextGraphId);
-            else
-                overflow.failureWitnesses.set(exactIdentity, lease.announcement);
-        }
-        this.#finishOverflowIfResolved(overflow, lease.disposition === 'context-capacity'
-            ? lease.announcement.contextGraphId
-            : null);
-    }
-    retire(announcement) {
-        const byScope = this.#byContextGraph.get(announcement.contextGraphId);
-        const key = rfc64CatalogTargetScopeKeyV1(announcement);
-        const current = byScope?.get(key);
-        let retired = false;
-        if (current !== undefined
-            && rfc64CatalogTargetExactIdentityV1(current.announcement, announcement)) {
-            byScope.delete(key);
-            this.#size -= 1;
-            if (byScope.size === 0)
-                this.#byContextGraph.delete(announcement.contextGraphId);
-            retired = true;
-        }
-        const exactIdentity = rfc64CatalogTargetExactIdentityKeyV1(announcement);
-        const contextOverflow = this.#contextGraphOverflows.get(announcement.contextGraphId);
-        if (contextOverflow?.failureWitnesses.delete(exactIdentity) === true) {
-            this.#finishOverflowIfResolved(contextOverflow, announcement.contextGraphId);
-            retired = true;
-        }
-        if (this.#globalOverflow?.failureWitnesses.delete(exactIdentity) === true) {
-            this.#finishOverflowIfResolved(this.#globalOverflow, null);
-            retired = true;
-        }
-        this.#promoteOverflowWitnesses();
-        return retired;
-    }
-    #markTerminalFailure(announcement) {
-        const entry = this.#byContextGraph
-            .get(announcement.contextGraphId)
-            ?.get(rfc64CatalogTargetScopeKeyV1(announcement));
-        if (entry !== undefined
-            && rfc64CatalogTargetExactIdentityV1(entry.announcement, announcement))
-            entry.terminalFailure = true;
-    }
-    #beginContextGraphOverflow(contextGraphId) {
-        let overflow = this.#contextGraphOverflows.get(contextGraphId);
-        if (overflow === undefined) {
-            if (this.#contextGraphOverflows.size
-                >= RFC64_CATALOG_TARGET_MAX_CONTEXT_OVERFLOWS_V1) {
-                this.#globalOverflow ??= this.#createOverflow();
-                this.#globalOverflow.active += 1;
-                return Object.freeze({
-                    disposition: 'global-capacity',
-                    overflow: this.#globalOverflow,
-                });
-            }
-            overflow = this.#createOverflow();
-            this.#contextGraphOverflows.set(contextGraphId, overflow);
-        }
-        overflow.active += 1;
-        return Object.freeze({ disposition: 'context-capacity', overflow });
-    }
-    #createOverflow() {
-        return {
-            active: 0,
-            failureWitnesses: new Map(),
-            saturatedContextGraphs: new Set(),
-            unattributedSaturation: false,
-        };
-    }
-    #markOverflowSaturated(overflow, contextGraphId) {
-        if (overflow.saturatedContextGraphs.has(contextGraphId))
-            return;
-        if (overflow.saturatedContextGraphs.size
-            >= RFC64_CATALOG_TARGET_MAX_CONTEXT_OVERFLOWS_V1) {
-            overflow.unattributedSaturation = true;
-            return;
-        }
-        overflow.saturatedContextGraphs.add(contextGraphId);
-    }
-    #finishOverflowIfResolved(overflow, contextGraphId) {
-        if (overflow.active > 0)
-            return;
-        if (overflow.failureWitnesses.size === 0
-            && overflow.saturatedContextGraphs.size === 0
-            && !overflow.unattributedSaturation) {
-            if (contextGraphId === null)
-                this.#globalOverflow = null;
-            else
-                this.#contextGraphOverflows.delete(contextGraphId);
-            return;
-        }
-        this.#promoteOverflowWitness(contextGraphId, overflow);
-    }
-    #promoteOverflowWitnesses() {
-        for (const [contextGraphId, overflow] of this.#contextGraphOverflows) {
-            this.#promoteOverflowWitness(contextGraphId, overflow);
-        }
-        if (this.#globalOverflow !== null)
-            this.#promoteOverflowWitness(null, this.#globalOverflow);
-    }
-    #promoteOverflowWitness(contextGraphId, overflow) {
-        if (overflow.active > 0)
-            return;
-        for (const [identity, witness] of overflow.failureWitnesses) {
-            const byScope = this.#byContextGraph.get(witness.contextGraphId);
-            const key = rfc64CatalogTargetScopeKeyV1(witness);
-            const current = byScope?.get(key);
-            if (current !== undefined) {
-                if (BigInt(current.announcement.catalogVersion) > BigInt(witness.catalogVersion)) {
-                    overflow.failureWitnesses.delete(identity);
-                    continue;
-                }
-                current.announcement = witness;
-                current.terminalFailure = true;
-                overflow.failureWitnesses.delete(identity);
-                continue;
-            }
-            if ((byScope?.size ?? 0) >= RFC64_CATALOG_TARGET_MAX_ENTRIES_PER_CONTEXT_GRAPH_V1
-                || this.#size >= RFC64_CATALOG_TARGET_MAX_ENTRIES_V1)
-                continue;
-            const targetByScope = byScope ?? new Map();
-            if (byScope === undefined)
-                this.#byContextGraph.set(witness.contextGraphId, targetByScope);
-            targetByScope.set(key, { announcement: witness, terminalFailure: true });
-            this.#size += 1;
-            overflow.failureWitnesses.delete(identity);
-        }
-        if (overflow.failureWitnesses.size === 0
-            && overflow.saturatedContextGraphs.size === 0
-            && !overflow.unattributedSaturation) {
-            if (contextGraphId === null && this.#globalOverflow === overflow) {
-                this.#globalOverflow = null;
-            }
-            else if (contextGraphId !== null
-                && this.#contextGraphOverflows.get(contextGraphId) === overflow)
-                this.#contextGraphOverflows.delete(contextGraphId);
-        }
-    }
-}
 const rfc64CatalogTargetAnnouncementsV1 = new WeakMap();
 function rfc64CatalogReplayRuntimeForV1(agent) {
     let runtime = rfc64CatalogReplayRuntimesV1.get(agent);
@@ -431,8 +185,7 @@ function rfc64CatalogReplaySnapshotRuntimeForV1(agent, persistence, mutationCoor
     if (owned?.persistence === persistence)
         return owned.runtime;
     const runtime = new Rfc64CatalogReplaySnapshotRuntimeV1(Object.freeze({
-        listAppliedCatalogHeadsV1: () => persistence.inventory.listAppliedCatalogHeadsV1(),
-        readAppliedCatalogHeadsRevisionV1: () => persistence.inventory.readAppliedCatalogHeadsRevisionV1(),
+        readAppliedCatalogHeadsSnapshotV1: () => persistence.inventory.readAppliedCatalogHeadsSnapshotV1(),
         readVerifiedCatalogHeadV1: async (objectDigest) => (await persistence.controlObjects.getVerifiedObjectByDigest({
             objectDigest,
             verifyIssuerSignature: verifyControlEnvelopeIssuerSignatureV1,
@@ -441,18 +194,22 @@ function rfc64CatalogReplaySnapshotRuntimeForV1(agent, persistence, mutationCoor
     rfc64CatalogReplaySnapshotRuntimesV1.set(agent, Object.freeze({ persistence, runtime }));
     return runtime;
 }
-function rfc64CatalogTargetExactIdentityV1(left, right) {
-    return rfc64CatalogTargetExactIdentityKeyV1(left)
-        === rfc64CatalogTargetExactIdentityKeyV1(right);
-}
-function rfc64CatalogTargetExactIdentityKeyV1(target) {
-    return [
-        rfc64CatalogTargetScopeKeyV1(target),
-        target.catalogVersion,
-        target.policyDigest,
-        target.catalogHeadObjectDigest,
-        target.signatureVariantDigest,
-    ].join('\0');
+/**
+ * Keep only the newest catalog version promised for each scope. Targets that
+ * share that newest version but disagree on the head digest are all kept: that
+ * fork is evidence the row projection reports as ambiguous, and dropping one
+ * side of it would pick a branch at random.
+ */
+function pruneRfc64SupersededCatalogTargetsV1(targets) {
+    const newestByScope = new Map();
+    for (const target of targets) {
+        const scopeKey = rfc64CatalogTargetScopeKeyV1(target);
+        const version = BigInt(target.catalogVersion);
+        const newest = newestByScope.get(scopeKey);
+        if (newest === undefined || version > newest)
+            newestByScope.set(scopeKey, version);
+    }
+    return targets.filter((target) => (BigInt(target.catalogVersion) === newestByScope.get(rfc64CatalogTargetScopeKeyV1(target))));
 }
 function recordRfc64CatalogTargetAnnouncementV1(agent, announcement) {
     let tracker = rfc64CatalogTargetAnnouncementsV1.get(agent);
@@ -481,6 +238,25 @@ function markRfc64DirectAcceptedCompatibilityV1(agent, contextGraphId) {
     }
     accepted.add(contextGraphId);
 }
+/**
+ * Record whether the private policy just accepted for a graph is join-derived.
+ * Both ways a private policy is accepted call this (authority composition and
+ * the direct snapshot acceptance), so the mark always describes the acceptance
+ * that produced the current snapshot. An open policy cannot replace a
+ * join-derived one: the registry only takes a linked successor.
+ */
+function noteRfc64AcceptedAuthorityOriginV1(agent, contextGraphId, origin) {
+    let joinDerived = rfc64JoinDerivedAcceptedAuthorityV1.get(agent);
+    if (origin === 'authenticated') {
+        joinDerived?.delete(contextGraphId);
+        return;
+    }
+    if (joinDerived === undefined) {
+        joinDerived = new Set();
+        rfc64JoinDerivedAcceptedAuthorityV1.set(agent, joinDerived);
+    }
+    joinDerived.add(contextGraphId);
+}
 function rfc64CatalogAuthorityGenerationChangedV1(previous, accepted) {
     return previous !== null
         && (previous.policyDigest !== accepted.policyDigest
@@ -564,6 +340,22 @@ function nextRfc64CatalogAuthorityRevisionV1(agent, contextGraphId) {
 function isCurrentRfc64CatalogAuthorityRevisionV1(agent, contextGraphId, revision) {
     return rfc64CatalogAuthorityRevisionsV1.get(agent)?.get(contextGraphId) === revision;
 }
+/**
+ * One authority composition that was discarded because a local authority fact
+ * moved while it was being read. Unlike a superseded composition, no newer one
+ * is running for this graph.
+ */
+class Rfc64AuthorityFactsMovedV1 {
+    authorityRevision;
+    constructor(authorityRevision) {
+        this.authorityRevision = authorityRevision;
+    }
+}
+function waitForRfc64AuthorityFactsMovedRetryV1(delayMs, signal) {
+    if (signal !== undefined)
+        return waitForRfc64ScheduledResponsibilityDelayV1(signal, delayMs);
+    return new Promise((resolve) => { setTimeout(resolve, delayMs); });
+}
 /** Intermediate acceleration-pull WARNs are rate-limited per scope to this window. */
 const RFC64_ACCELERATION_WARN_INTERVAL_MS_V1 = 30_000;
 /** Bound on rate-limit bookkeeping so hostile scope churn cannot grow it unboundedly. */
@@ -582,9 +374,39 @@ function requireRfc64ContextGraphAuthorityReaderV1(capability) {
     }
     return capability.reader;
 }
+/**
+ * Refresh failures that are a not-yet, not a denial. Each keeps the graph in
+ * `resolving` and lets the AUTHOR OF RECORD retain its last accepted policy
+ * while the condition clears; a replica never retains, and every other code
+ * still fails closed to `blocked`.
+ *
+ * - `registered-authority-unfinalized`: the finalized chain index lags the
+ *   registration.
+ * - `registered-private-roster-unresolved`: the authenticated lifecycle roster
+ *   for a private graph is not resolvable locally yet. Demoting to `blocked`
+ *   here fenced off the curator's own SWM root-catalog authoring lane, which is
+ *   the only root-scope SWM delivery path on a catalog-selected graph.
+ */
+const RFC64_TRANSIENT_AUTHORITY_REFRESH_FAILURES_V1 = new Set([
+    'registered-authority-unfinalized',
+    'registered-private-roster-unresolved',
+    'unregistered-private-roster-unresolved',
+    'authority-rpc-circuit-open',
+]);
+/**
+ * Is this refresh failure a not-yet rather than a denial? Exported so the
+ * classification itself is pinned: it decides whether the author keeps its
+ * catalog lane or is parked `blocked`, and on a catalog-selected graph that
+ * lane is the only root-scope SWM delivery path.
+ */
+export function isRfc64TransientAuthorityRefreshFailureV1(code) {
+    return RFC64_TRANSIENT_AUTHORITY_REFRESH_FAILURES_V1.has(code);
+}
 function rfc64CatalogAuthorityFailureCodeV1(error) {
     if (error instanceof Rfc64CatalogAuthorityResolutionErrorV1)
         return error.code;
+    if (isRfc64AuthorityRpcCircuitOpenErrorV1(error))
+        return 'authority-rpc-circuit-open';
     return 'authority-resolution-failed';
 }
 /**
@@ -595,35 +417,8 @@ function rfc64CatalogAuthorityFailureCodeV1(error) {
 export function isRfc64UnregisteredOwnerUnresolvedErrorV1(error) {
     return rfc64CatalogAuthorityFailureCodeV1(error) === 'unregistered-owner-unresolved';
 }
-function aggregateRfc64DigestV1(values) {
-    if (values.length === 0)
-        return null;
-    const sorted = [...values].sort();
-    if (sorted.length === 1)
-        return sorted[0];
-    return ethers.keccak256(ethers.toUtf8Bytes(sorted.join('\n')));
-}
-function sumDecimalCountsV1(values) {
-    return values.reduce((sum, value) => sum + BigInt(value), 0n).toString(10);
-}
 export class Rfc64CatalogMethods extends DKGAgentBase {
     /** Stable recovery capabilities are captured once per agent-owned runtime. */
-    /**
-     * The node's SINGLE finality depth, taken from the adapter that actually
-     * resolves the anchors whenever it can report one.
-     *
-     * `dkg-agent-types.ts` documents `chainAdapter` as "If provided, chainConfig
-     * is ignored", so in the SDK-embedding shape `chainConfig.finalityConfirmations`
-     * is absent or stale while the adapter holds the operator's real value. An
-     * adapter that does not implement the accessor (mocks, out-of-tree adapters)
-     * has no opinion, and the configured value stands.
-     */
-    resolveChainFinalityConfirmationsV1() {
-        const fromAdapter = typeof this.chain.getFinalityConfirmations === 'function'
-            ? this.chain.getFinalityConfirmations()
-            : undefined;
-        return fromAdapter ?? this.config.chainConfig?.finalityConfirmations;
-    }
     rfc64CatalogReplayRecoveryRuntimeV1() {
         let runtime = rfc64CatalogReplayRecoveryRuntimesV1.get(this);
         if (runtime !== undefined)
@@ -663,7 +458,9 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                 await this.rfc64PublicCatalogServiceV1
                     ?.whenReceiverIdleForContextGraph(contextGraphId, signal);
             },
+            warn: (message) => this.log.warn(createOperationContext('system'), message),
             targetIdentity: rfc64CatalogTargetExactIdentityKeyV1,
+            pruneSupersededTargets: pruneRfc64SupersededCatalogTargetsV1,
             parityFailed: async (contextGraphId, promised) => {
                 const persistence = this.rfc64PersistenceV1;
                 if (persistence === undefined)
@@ -802,55 +599,79 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             replaySnapshotRevision = replayRecovery.revision;
             appliedByContextGraph = groupRfc64OperationalAppliedHeadsV1(await loadRfc64OperationalAppliedHeadsV1(persistence));
         }
+        const targetTracker = rfc64CatalogTargetAnnouncementsV1.get(this);
+        const targetsByContextGraph = new Map(selections.map((selection) => [
+            selection.contextGraphId,
+            targetTracker?.targetsForContextGraph(selection.contextGraphId) ?? [],
+        ]));
+        // One accepted-policy snapshot per selection, resolved before the durable
+        // reads below and reused for both the promised targets and the replay
+        // status. Reading it twice across an await lets an accepted-policy rotation
+        // pair an old-digest promise set with a null replay status, which publishes
+        // an expected/missing pair built from promises the runtime has already
+        // dropped at that rotation.
+        const acceptedByContextGraph = new Map(selections.map((selection) => [
+            selection.contextGraphId,
+            service !== undefined && networkId !== undefined
+                ? service.acceptedPolicySnapshot(networkId, selection.contextGraphId)
+                : null,
+        ]));
+        const promisedTargetsByContextGraph = new Map(selections.map((selection) => {
+            const accepted = acceptedByContextGraph.get(selection.contextGraphId) ?? null;
+            return [
+                selection.contextGraphId,
+                accepted === null
+                    ? null
+                    : replayRecovery.promisedTargets(selection.contextGraphId, accepted.policyDigest),
+            ];
+        }));
+        const operationalTargets = [...new Map(selections.flatMap((selection) => [
+                ...targetsByContextGraph.get(selection.contextGraphId) ?? [],
+                ...promisedTargetsByContextGraph.get(selection.contextGraphId) ?? [],
+            ]).map((target) => [rfc64CatalogTargetExactIdentityKeyV1(target), target])).values()];
+        const promisedRowCounts = persistence === undefined
+            ? new Map()
+            : await loadRfc64OperationalPromisedRowCountsV1(persistence, operationalTargets);
         const replaySnapshotUnstable = replaySnapshotRevision !== replayRecovery.revision;
         const progressByContextGraph = rfc64CatalogAuthorityProgressV1.get(this);
         const receiverStats = service?.stats().receiver;
         return Object.freeze(selections.map((selection) => {
-            const accepted = service !== undefined && networkId !== undefined
-                ? service.acceptedPolicySnapshot(networkId, selection.contextGraphId)
-                : null;
+            const accepted = acceptedByContextGraph.get(selection.contextGraphId) ?? null;
             const progress = progressByContextGraph?.get(selection.contextGraphId);
             const currentReplayProgress = accepted === null
                 ? null
                 : replayRecovery.status(selection.contextGraphId, accepted.policyDigest);
-            const replayActive = replaySnapshotUnstable || currentReplayProgress?.active === true;
-            // Only parity/overflow evidence fails a Context Graph. Providers that
-            // could not be replayed from surface through providerHealth instead.
-            const replayFailed = currentReplayProgress?.failed === true;
             const heads = appliedByContextGraph.get(selection.contextGraphId) ?? [];
-            // A full pass that reached no provider at all corroborated nothing: with
-            // an empty promised set parity is vacuously satisfied, so applied rows
-            // would otherwise be reported as agreed by every provider. It is not
-            // evidence of missing rows, so it stays distinct from `replayFailed`, and
-            // it can only mislead once something has been applied.
-            const replayUnverified = currentReplayProgress?.unverified === true
-                && heads.length > 0;
-            const replayUnsettled = replayActive || replayFailed || replayUnverified;
-            const targetTracker = rfc64CatalogTargetAnnouncementsV1.get(this);
-            const targets = targetTracker?.targetsForContextGraph(selection.contextGraphId) ?? [];
+            // The owner is the only possible catalog author only in a private graph
+            // whose accepted roster is the owner alone: catalog authorship follows
+            // the access policy (any member, or any author of a public graph, which
+            // has no roster), not the publish policy. When this node is that owner
+            // and its verified applied heads all belong to it, an unanswered
+            // connected peer cannot reveal another author's catalog. Keep the
+            // provider failure visible in providerHealth, but do not turn locally
+            // complete owner inventory into unknown graph parity.
+            const curatedOwnerAddress = accepted?.policy.source.kind === 'owner-signed-unregistered'
+                ? accepted.policy.source.ownerAddress
+                : null;
+            const ownerIsSoleCatalogAuthor = accepted !== null
+                && curatedOwnerAddress !== null
+                && accepted.roster?.members.length === 1
+                && accepted.roster.members[0]?.agentAddress === curatedOwnerAddress;
+            const localCuratedOwnerHeads = accepted !== null
+                && accepted.policy.publishPolicy === 0
+                && curatedOwnerAddress !== null
+                && ownerIsSoleCatalogAuthor
+                && heads.length > 0
+                && this.listLocalAgents().some(({ agentAddress }) => (agentAddress.toLowerCase() === curatedOwnerAddress))
+                && heads.every(({ snapshot }) => (snapshot.authorAddress === curatedOwnerAddress));
+            const targets = targetsByContextGraph.get(selection.contextGraphId) ?? [];
+            const promisedTargets = promisedTargetsByContextGraph.get(selection.contextGraphId) ?? null;
             const targetCapacityExceeded = targetTracker
                 ?.capacityExceededForContextGraph(selection.contextGraphId) ?? false;
-            const appliedByScope = new Map(heads.map((head) => [head.scopeKey, head]));
-            const pendingTargets = targets.filter((target) => {
-                const applied = appliedByScope.get(rfc64CatalogTargetScopeKeyV1(target));
-                return applied === undefined
-                    || BigInt(target.catalogVersion) > BigInt(applied.snapshot.catalogVersion)
-                    || (target.catalogVersion === applied.snapshot.catalogVersion
-                        && target.catalogHeadObjectDigest !== applied.snapshot.currentCatalogHeadDigest);
+            const { replayActive, replayFailed, replayUnverified, replayUnsettled, pendingTargets, catalogHeadDigest, expectedCatalogHeadDigest, inventoryDigest, rowCount, rowProjection, } = evaluateRfc64CatalogCompletionV1({
+                heads, targets, promisedTargets, promisedRowCounts, replay: currentReplayProgress,
+                replaySnapshotUnstable, targetCapacityExceeded, localCuratedOwnerHeads,
             });
-            const catalogHeadDigest = aggregateRfc64DigestV1(heads.map(({ snapshot }) => snapshot.currentCatalogHeadDigest));
-            const expectedCatalogHeadDigests = new Map(heads.map(({ scopeKey, snapshot }) => [
-                scopeKey,
-                snapshot.currentCatalogHeadDigest,
-            ]));
-            for (const target of pendingTargets) {
-                expectedCatalogHeadDigests.set(rfc64CatalogTargetScopeKeyV1(target), target.catalogHeadObjectDigest);
-            }
-            const expectedCatalogHeadDigest = aggregateRfc64DigestV1([...expectedCatalogHeadDigests.values()]);
-            const inventoryDigest = aggregateRfc64DigestV1(heads.map(({ snapshot }) => snapshot.appliedInventoryDigest));
-            const rowCount = heads.length === 0
-                ? null
-                : sumDecimalCountsV1(heads.map(({ snapshot }) => snapshot.inventoryRowCount));
             const appliedCatalogVersion = heads.length === 0
                 ? null
                 : heads.reduce((highest, { snapshot }) => (BigInt(snapshot.catalogVersion) > BigInt(highest)
@@ -927,11 +748,14 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                                         ? 'applying'
                                         : legacyReadOnlyCount > 0
                                             ? 'known-incomplete'
-                                            : heads.length === 0
-                                                ? 'bootstrapping'
-                                                : replayUnverified
-                                                    ? 'unknown-freshness'
-                                                    : 'complete';
+                                            : rowProjection.missingRowCount !== null
+                                                && BigInt(rowProjection.missingRowCount) > 0n
+                                                ? 'known-incomplete'
+                                                : heads.length === 0
+                                                    ? 'bootstrapping'
+                                                    : replayUnverified
+                                                        ? 'unknown-freshness'
+                                                        : 'complete';
             return Object.freeze({
                 contextGraphId: selection.contextGraphId,
                 responsibilityReason: selection.responsibilityReason,
@@ -957,16 +781,9 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     ? null
                     : inventoryDigest,
                 appliedInventoryDigest: inventoryDigest,
-                expectedRowCount: targetCapacityExceeded || replayUnsettled || pendingTargets.length > 0
-                    ? null
-                    : rowCount,
+                expectedRowCount: rowProjection.expectedRowCount,
                 appliedRowCount: rowCount,
-                missingRowCount: targetCapacityExceeded
-                    || replayUnsettled
-                    || pendingTargets.length > 0
-                    || rowCount === null
-                    ? null
-                    : '0',
+                missingRowCount: rowProjection.missingRowCount,
                 legacyReadOnlyCount,
                 catalogVersion,
                 authorHeadCount: heads.length,
@@ -985,18 +802,122 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             });
         }));
     }
+    /** Re-prove catalog completion before the daemon's synchronous readiness commit. */
+    async withVerifiedPrivateCatalogSubscriptionReadinessV1(contextGraphId, commit) {
+        return verifyPrivateCatalogSubscriptionReadinessV1(this, contextGraphId, commit, () => {
+            const progress = rfc64CatalogAuthorityProgressV1.get(this)?.get(contextGraphId);
+            const tracker = rfc64CatalogTargetAnnouncementsV1.get(this);
+            const targets = tracker?.targetsForContextGraph(contextGraphId) ?? [];
+            return {
+                service: this.rfc64PublicCatalogServiceV1,
+                persistence: this.rfc64PersistenceV1,
+                networkId: this.config.rfc64CatalogDeploymentProfile?.networkId ?? this.config.networkIdentity?.chainId,
+                approvedAgent: this.localApprovedAgentByCG.get(contextGraphId),
+                subscription: this.subscribedContextGraphs.get(contextGraphId),
+                plan: this.config.rfc64CatalogExecutionPlan,
+                metadataRevision: this.contextGraphMetaProjection.readContextGraphAuthorityFactsRevision(contextGraphId),
+                replay: this.rfc64CatalogReplayRecoveryRuntimeV1(),
+                authorityRevision: rfc64CatalogAuthorityRevisionsV1.get(this)?.get(contextGraphId),
+                authorityCurrent: progress?.state === 'accepted' && Date.now() - progress.updatedAtMs
+                    <= RFC64_CATALOG_AUTHORITY_REFRESH_POLICY_V1.intervalMs * RFC64_CATALOG_AUTHORITY_REFRESH_POLICY_V1.freshnessIntervalCount,
+                legacyReadOnlyCount: readRfc64LegacySwmBoundaryCountV1(this, contextGraphId),
+                targets,
+                targetCapacityExceeded: tracker?.capacityExceededForContextGraph(contextGraphId) ?? false,
+                targetFailed: targets.some((target) => tracker.hasTerminalFailure(target)),
+                targetFence: JSON.stringify(targets.map((target) => [
+                    rfc64CatalogTargetExactIdentityKeyV1(target), tracker.hasTerminalFailure(target),
+                ])),
+            };
+        });
+    }
     /**
-     * Resolve the private member set from the hardened, store-backed `_meta`
-     * gate after the complete graph definition has been authenticated. This is
-     * deliberately independent of the accepted RFC-64 roster: responsibility
-     * and roster rotation cannot ask the roster they are about to establish for
-     * permission to establish it.
+     * Resolve the private member set from the authoritative roster source after
+     * the complete graph definition has been authenticated. Registered private
+     * graphs retain the finalized chain roster; unregistered graphs use the
+     * effective store-backed metadata projection. This is deliberately
+     * independent of the accepted RFC-64 overlay: responsibility and roster
+     * rotation cannot ask the roster they are about to establish for permission
+     * to establish it.
      */
     async resolveRfc64VerifiedPrivateRosterV1(contextGraphId) {
-        if (!await this.hasConfirmedMetaState(contextGraphId).catch(() => false)) {
+        // The creator's explicit local-first registration marker already proves
+        // this graph has no chain roster. Reading the general member-recovery
+        // authority here would ask the accepted catalog policy we are currently
+        // rotating to authorize its own successor. A concurrent admission can
+        // then make that read return unavailable and strand the new member behind
+        // the old policy. Read the creator's own confirmed _meta instead, while
+        // keeping merged revocations effective and fencing registration changes.
+        const localFirst = await this.isLocalFirstUnregisteredContextGraph(contextGraphId);
+        const accepted = this.readAcceptedRfc64CatalogAccessSnapshotV1(contextGraphId);
+        const approvedAgent = this.localApprovedAgentByCG.get(contextGraphId);
+        let approvedReplicaGate;
+        if (!localFirst
+            && approvedAgent !== undefined
+            && accepted?.policy.accessPolicy === 1
+            && accepted.policy.source.kind === 'owner-signed-unregistered') {
+            const revision = this.contextGraphMetaProjection
+                .readContextGraphAuthorityFactsRevision(contextGraphId);
+            const approved = await resolveApprovedPrivateReplicaAuthority(this, contextGraphId, approvedAgent, () => this.localApprovedAgentByCG.get(contextGraphId)?.toLowerCase()
+                === approvedAgent.toLowerCase(), () => this.contextGraphMetaProjection
+                .readContextGraphAuthorityFactsRevision(contextGraphId) === revision).catch(() => null);
+            if (approved?.kind === 'unregistered-private-replica'
+                && approved.authority.ownerAddress === accepted.policy.source.ownerAddress) {
+                // The approved-member proof authenticates this replica's own private
+                // definition. Check finalized name absence independently, then read
+                // the effective local roster and fence both sources again after the
+                // store awaits. The general recovery helper would ask the accepted
+                // catalog policy to authorize the roster needed to authorize that
+                // same catalog transport, leaving cold approved replicas stuck.
+                const before = await this.readRfc64RegisteredAuthoritySnapshotV1(contextGraphId)
+                    .catch(() => undefined);
+                if (before === undefined)
+                    return null;
+                if (before === null) {
+                    const merged = await this.getLocalMetadataMemberRecoveryGate(contextGraphId)
+                        .catch(() => null);
+                    const own = await this.getOwnCgMetaFacts(contextGraphId)
+                        .catch(() => null);
+                    const after = await this.readRfc64RegisteredAuthoritySnapshotV1(contextGraphId)
+                        .catch(() => undefined);
+                    if (merged === null
+                        || own === null
+                        || after !== null
+                        || this.contextGraphMetaProjection
+                            .readContextGraphAuthorityFactsRevision(contextGraphId) !== revision
+                        || this.localApprovedAgentByCG.get(contextGraphId)?.toLowerCase()
+                            !== approvedAgent.toLowerCase()
+                        || this.readAcceptedRfc64CatalogAccessSnapshotV1(contextGraphId)
+                            ?.policyDigest !== accepted.policyDigest
+                        // The clock is the one thing the fences above cannot see.
+                        || !isApprovedPrivateReplicaDelegationActive(approved.authority))
+                        return null;
+                    const named = new Set([...own.allowedAgents, ...own.participantAgents]
+                        .map((address) => address.toLowerCase()));
+                    approvedReplicaGate = merged.filter((address) => named.has(address.toLowerCase()));
+                }
+            }
+        }
+        if (approvedReplicaGate === undefined
+            && !await this.hasConfirmedMetaState(contextGraphId).catch(() => false)) {
             return null;
         }
-        const gate = await withRpcUsageSite(CG_AUTH_RPC_SITES.rfc64Roster, () => this.getMemberRecoveryGate(contextGraphId)).catch(() => null);
+        const gate = approvedReplicaGate !== undefined
+            ? approvedReplicaGate
+            : localFirst
+                ? await (async () => {
+                    const revision = this.contextGraphMetaProjection
+                        .readContextGraphAuthorityFactsRevision(contextGraphId);
+                    const merged = await this.getLocalMetadataMemberRecoveryGate(contextGraphId);
+                    const own = await this.getOwnCgMetaFacts(contextGraphId);
+                    if (!await this.isLocalFirstUnregisteredContextGraph(contextGraphId)
+                        || this.contextGraphMetaProjection
+                            .readContextGraphAuthorityFactsRevision(contextGraphId) !== revision)
+                        return null;
+                    const named = new Set([...own.allowedAgents, ...own.participantAgents]
+                        .map((address) => address.toLowerCase()));
+                    return merged?.filter((address) => named.has(address.toLowerCase())) ?? null;
+                })().catch(() => null)
+                : await withRpcUsageSite(CG_AUTH_RPC_SITES.rfc64Roster, () => this.getMemberRecoveryRosterSource(contextGraphId)).catch(() => null);
         if (gate === null || gate.length === 0)
             return null;
         const members = new Set();
@@ -1121,50 +1042,47 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
     }
     /**
      * Resolve a catalog peer from authenticated, Context-Graph-scoped state.
-     * Public agent profiles remain the first choice, but private admission must
-     * not depend on best-effort profile gossip. Curators already hold the
-     * member's signed delegatee binding, while approved receivers persist the
-     * authenticated curator peer together with its exact owner generation.
+     * A peer may advertise a generic agent profile after a private transfer has
+     * already begun. That profile need not be the agent approved for this graph.
+     * Prefer the verified delegatee or curator binding, so late profile gossip
+     * cannot change the identity used for catalog authorization mid-transfer.
      */
     async resolveRfc64CatalogRemoteAgentAddressV1(remotePeerId, contextGraphId) {
+        if (await this.hasConfirmedMetaState(contextGraphId).catch(() => false)) {
+            const delegatedAgents = new Set();
+            const delegateePeers = await this.getContextGraphAllowedDelegateePeers(contextGraphId)
+                .catch(() => new Map());
+            for (const [agentAddress, peerIds] of delegateePeers) {
+                const normalized = agentAddress.toLowerCase();
+                if (peerIds.includes(remotePeerId)
+                    && /^0x[0-9a-f]{40}$/u.test(normalized)) {
+                    delegatedAgents.add(normalized);
+                }
+            }
+            if (delegatedAgents.size === 1)
+                return [...delegatedAgents][0];
+            if (delegatedAgents.size > 1)
+                return null;
+            const approvedAgent = this.localApprovedAgentByCG.get(contextGraphId);
+            if (approvedAgent !== undefined) {
+                const requesterState = await this.readRequesterJoinRequestState(contextGraphId, approvedAgent).catch(() => null);
+                if (requesterState?.status === 'approved'
+                    && requesterState.curatorPeerId === remotePeerId
+                    && requesterState.curatorAgentAddress !== undefined
+                    && requesterState.curatorAuthorityEra !== undefined) {
+                    const current = await this.readRfc64CurrentCuratorAuthorityBindingV1(contextGraphId).catch(() => null);
+                    if (current?.agentAddress === requesterState.curatorAgentAddress
+                        && current.authorityEra === requesterState.curatorAuthorityEra)
+                        return current.agentAddress;
+                }
+            }
+        }
         const discovered = (await this.findAgentByPeerId(remotePeerId))
             ?.agentAddress
             ?.toLowerCase();
-        if (discovered !== undefined && /^0x[0-9a-f]{40}$/u.test(discovered)) {
-            return discovered;
-        }
-        if (!await this.hasConfirmedMetaState(contextGraphId).catch(() => false)) {
-            return null;
-        }
-        const delegatedAgents = new Set();
-        const delegateePeers = await this.getContextGraphAllowedDelegateePeers(contextGraphId)
-            .catch(() => new Map());
-        for (const [agentAddress, peerIds] of delegateePeers) {
-            const normalized = agentAddress.toLowerCase();
-            if (peerIds.includes(remotePeerId)
-                && /^0x[0-9a-f]{40}$/u.test(normalized)) {
-                delegatedAgents.add(normalized);
-            }
-        }
-        if (delegatedAgents.size === 1)
-            return [...delegatedAgents][0];
-        if (delegatedAgents.size > 1)
-            return null;
-        const approvedAgent = this.localApprovedAgentByCG.get(contextGraphId);
-        if (approvedAgent === undefined)
-            return null;
-        const requesterState = await this.readRequesterJoinRequestState(contextGraphId, approvedAgent).catch(() => null);
-        if (requesterState?.status !== 'approved'
-            || requesterState.curatorPeerId !== remotePeerId
-            || requesterState.curatorAgentAddress === undefined
-            || requesterState.curatorAuthorityEra === undefined)
-            return null;
-        const current = await this.readRfc64CurrentCuratorAuthorityBindingV1(contextGraphId).catch(() => null);
-        if (current === null
-            || current.agentAddress !== requesterState.curatorAgentAddress
-            || current.authorityEra !== requesterState.curatorAuthorityEra)
-            return null;
-        return current.agentAddress;
+        return discovered !== undefined && /^0x[0-9a-f]{40}$/u.test(discovered)
+            ? discovered
+            : null;
     }
     /** Read the curator-authored local roster generation from authenticated metadata. */
     async readRfc64PrivateRosterVersionV1(contextGraphId) {
@@ -1576,6 +1494,18 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     // silently instead of reporting a false authority failure.
                     if (ownerSignal.aborted)
                         throw ownerSignal.reason;
+                    if (isRfc64AuthorityRpcCircuitOpenErrorV1(error)) {
+                        // Awaited subscribe/bootstrap callers do not belong to the
+                        // scheduled responsibility batch. A circuit-open read must still
+                        // get an owned follow-up after cooldown; otherwise the private
+                        // receiver can remain unselected until an unrelated event.
+                        this.rfc64BackgroundWorkDispatcherV1.scheduleKeyed(`responsibility-circuit-retry\0${contextGraphId}\0${revision}`, async (signal) => {
+                            await waitForRfc64ScheduledResponsibilityDelayV1(signal, RFC64_SCHEDULED_RESPONSIBILITY_RETRY_MS_V1);
+                            signal.throwIfAborted();
+                            if (isCurrentRfc64CatalogResponsibilityRevisionV1(this, contextGraphId, revision))
+                                this.scheduleRfc64CatalogResponsibilityReconciliationV1(contextGraphId);
+                        });
+                    }
                     this.log.warn(createOperationContext('system'), `RFC-64 authority bootstrap incomplete for "${contextGraphId}": ${error instanceof Error ? error.message : String(error)}`);
                     return null;
                 });
@@ -1682,7 +1612,8 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
         const eligible = authorityRequest.kind === 'finalized-absence'
             && !responsibility.active
             && !this.config.rfc64CatalogExecutionPlan.killSwitchActive
-            && isRfc64ActiveRegisteredSubscriptionV1(subscription)
+            && (isRfc64ActiveRegisteredSubscriptionV1(subscription)
+                || isRfc64LocalJoinIntentUnregisteredSubscriptionV1(this.localApprovedAgentByCG.has(contextGraphId), subscription))
             && isCurrentRfc64CatalogResponsibilityRevisionV1(this, contextGraphId, revision);
         if (!eligible) {
             this.clearRfc64ScheduledFinalizedAbsenceRetryV1(contextGraphId, revision);
@@ -1704,7 +1635,8 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                 return;
             }
             const currentSubscription = this.subscribedContextGraphs.get(contextGraphId);
-            if (!isRfc64ActiveRegisteredSubscriptionV1(currentSubscription)) {
+            if (!isRfc64ActiveRegisteredSubscriptionV1(currentSubscription)
+                && !isRfc64LocalJoinIntentUnregisteredSubscriptionV1(this.localApprovedAgentByCG.has(contextGraphId), currentSubscription)) {
                 this.clearRfc64ScheduledFinalizedAbsenceRetryV1(contextGraphId, retry.revision);
                 return;
             }
@@ -1850,13 +1782,13 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     pending.clear();
                     throw ownerSignal.reason ?? error;
                 }
-                if (isRfc64SharedStorePressureFailureV1(error)) {
-                    // One managed-store timeout/admission failure represents shared
-                    // backend pressure. Do not ask every remaining graph to rediscover
-                    // the same unavailable store in this pass. Requeue the untouched
-                    // suffix behind one abortable retry delay; accepted authority stays
-                    // in place until a later complete projection supersedes it.
-                    this.log.warn(createOperationContext('system'), `RFC-64 background responsibility batch paused after shared store pressure; `
+                if (isRfc64SharedStorePressureFailureV1(error)
+                    || isRfc64AuthorityRpcCircuitOpenErrorV1(error)) {
+                    // Shared store pressure and an open authority RPC circuit are
+                    // temporary node-wide conditions. Requeue this graph and the
+                    // untouched suffix after one bounded delay instead of leaving a
+                    // private receiver parked until an unrelated lifecycle nudge.
+                    this.log.warn(createOperationContext('system'), `RFC-64 background responsibility batch paused after shared authority pressure; `
                         + `${authorityTargets.length - targetIndex} target(s) deferred: ${error instanceof Error ? error.message : String(error)}`);
                     try {
                         await waitForRfc64ScheduledResponsibilityDelayV1(ownerSignal, RFC64_SCHEDULED_RESPONSIBILITY_RETRY_MS_V1);
@@ -1889,8 +1821,32 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
      * Rebuild and accept current RFC-64 authority from ordinary DKG state. A
      * supplied compatibility manifest remains an authority seed for its exact
      * graph; every other responsible graph takes this release-native path.
+     *
+     * `null` means a newer composition owns the outcome. A snapshot discarded
+     * because a local authority fact moved while it was being composed has no
+     * such successor, so it is composed again here. Returning `null` for it left
+     * the graph `resolving` until the next periodic refresh pass, and a curator
+     * that lost the refresh after a membership change kept refusing the new
+     * member's catalog replay for that long.
      */
     async reconcileRfc64CatalogAccessAuthorityV1(contextGraphId, signal, authorityRequest = Object.freeze({ kind: 'auto' })) {
+        for (let retry = 0;; retry += 1) {
+            const outcome = await this.composeRfc64CatalogAccessAuthorityV1(contextGraphId, signal, authorityRequest);
+            if (!(outcome instanceof Rfc64AuthorityFactsMovedV1))
+                return outcome;
+            const retryDelayMs = RFC64_AUTHORITY_FACTS_MOVED_RETRY_DELAYS_MS_V1[retry];
+            if (retryDelayMs === undefined) {
+                this.log.warn(createOperationContext('system'), `RFC-64 authority refresh for "${contextGraphId}" was discarded ${retry + 1} times because local authority facts kept changing; the next refresh pass retries it`);
+                return null;
+            }
+            await waitForRfc64AuthorityFactsMovedRetryV1(retryDelayMs, signal);
+            // A composition that started during the wait owns the outcome now.
+            if (!isCurrentRfc64CatalogAuthorityRevisionV1(this, contextGraphId, outcome.authorityRevision))
+                return null;
+        }
+    }
+    /** One composition; see {@link reconcileRfc64CatalogAccessAuthorityV1}. */
+    async composeRfc64CatalogAccessAuthorityV1(contextGraphId, signal, authorityRequest) {
         const service = this.rfc64PublicCatalogServiceV1;
         if (this.config.rfc64CatalogExecutionPlan.selectedAuthority[contextGraphId] !== undefined) {
             return null;
@@ -1948,6 +1904,38 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                 && directAcceptedPrivateSnapshot.policy.accessPolicy === 1
                 && directAcceptedPrivateSnapshot.roster !== null
                 && directAcceptedPrivateSnapshot.policy.source.kind === 'owner-signed-unregistered';
+            // A join-approved private replica has a curator-bound decision and an
+            // exact, source-qualified member/delegation proof in its own _meta. That
+            // is sufficient local authority after finalized name absence; a remote
+            // private definition must not be promoted from RDF alone.
+            const approvedAgent = this.localApprovedAgentByCG.get(contextGraphId);
+            const approvedPrivateMetaRevision = this.contextGraphMetaProjection
+                .readContextGraphAuthorityFactsRevision(contextGraphId);
+            const approvedPrivateReplica = (boundOnChainId === undefined
+                && !localFirstUnregistered
+                && !directAcceptedPrivateAuthority
+                && authorityRequest.kind === 'finalized-absence'
+                && approvedAgent !== undefined) ? await resolveApprovedPrivateReplicaAuthority(this, contextGraphId, approvedAgent, () => this.localApprovedAgentByCG.get(contextGraphId)?.toLowerCase()
+                === approvedAgent.toLowerCase(), () => this.contextGraphMetaProjection
+                .readContextGraphAuthorityFactsRevision(contextGraphId)
+                === approvedPrivateMetaRevision, signal) : null;
+            // A join or catalog write can invalidate this graph's metadata while
+            // the source-qualified proof is reading it. The proof correctly returns
+            // null for that mixed generation, but null alone is not evidence that
+            // the approved owner vanished. Recompose against the new revision before
+            // falling through to owner-unresolved and deactivating a valid receiver.
+            if (approvedPrivateReplica === null
+                && approvedAgent !== undefined
+                && boundOnChainId === undefined
+                && !localFirstUnregistered
+                && !directAcceptedPrivateAuthority
+                && authorityRequest.kind === 'finalized-absence'
+                && this.contextGraphMetaProjection
+                    .readContextGraphAuthorityFactsRevision(contextGraphId)
+                    !== approvedPrivateMetaRevision)
+                return new Rfc64AuthorityFactsMovedV1(authorityRevision);
+            const approvedPrivateReplicaAuthority = approvedPrivateReplica?.kind
+                === 'unregistered-private-replica' ? approvedPrivateReplica.authority : null;
             // Replica authority is admissible only after the shared finalized name
             // index proves that no on-chain graph owns this name. The embedded
             // policy is independently owner-signed and graph/network-bound; plain
@@ -1957,6 +1945,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             const replicaUnregisteredAuthority = (boundOnChainId === undefined
                 && !localFirstUnregistered
                 && !directAcceptedPrivateAuthority
+                && approvedPrivateReplicaAuthority === null
                 && authorityRequest.kind === 'finalized-absence')
                 ? await loadRfc64UnregisteredReplicaAuthorityV1({
                     store: this.store,
@@ -2003,6 +1992,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             }
             const registeredAuthorityRead = (localFirstUnregistered
                 || directAcceptedPrivateAuthority
+                || approvedPrivateReplicaAuthority !== null
                 || replicaUnregisteredAuthority !== null
                 || (boundOnChainId === undefined
                     && authorityRequest.kind === 'finalized-absence'))
@@ -2031,6 +2021,11 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     })()
                     : await this.readRfc64RegisteredAuthoritySnapshotV1(contextGraphId, signal);
             let authority;
+            // Mutable local authority facts must be one projection generation. Keep
+            // the exact revision paired with every later metadata/version await and
+            // refuse to accept a composed snapshot if owner, policy, revocation, or
+            // membership facts changed in the meantime.
+            let metadataAuthorityRevision = null;
             if (registeredAuthorityRead !== null) {
                 const { expectedNameHash, snapshot } = registeredAuthorityRead;
                 if (signal?.aborted)
@@ -2040,9 +2035,21 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                 }
                 let authoritativeSnapshot = snapshot;
                 if (snapshot.accessPolicy === 1) {
+                    metadataAuthorityRevision = this.contextGraphMetaProjection
+                        .readContextGraphAuthorityFactsRevision(contextGraphId);
                     const localRoster = await this.resolveRfc64VerifiedPrivateRosterV1(contextGraphId);
                     if (localRoster === null) {
-                        throw new Error('registered private RFC-64 Context Graph has no authenticated lifecycle roster');
+                        // TRANSIENT, and typed so it is classified as such. `null` here
+                        // means the authenticated roster is not resolvable *yet* — not
+                        // that membership was revoked to empty, which arrives as a
+                        // resolved, smaller roster. A bare Error fell through to the
+                        // `blocked` branch below, which closes the authoring fence and
+                        // takes the SWM root-catalog lane with it: on a catalog-selected
+                        // graph that lane is the ONLY delivery path for root-scope SWM
+                        // (legacy apply is deliberately closed), so the curator authored
+                        // zero catalog rows for a whole matrix cell and SWM converged
+                        // 0/50 rather than slowly.
+                        throw new Rfc64CatalogAuthorityResolutionErrorV1('registered-private-roster-unresolved', 'registered private RFC-64 Context Graph has no authenticated lifecycle roster yet');
                     }
                     // The finalized chain snapshot can lag an authenticated local
                     // removal. Never union a chain participant back into the catalog
@@ -2070,6 +2077,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             else {
                 if (!localFirstUnregistered
                     && !directAcceptedPrivateAuthority
+                    && approvedPrivateReplicaAuthority === null
                     && replicaUnregisteredAuthority === null) {
                     throw new Rfc64CatalogAuthorityResolutionErrorV1('unregistered-owner-unresolved', 'unregistered RFC-64 Context Graph has no authenticated owner authority');
                 }
@@ -2077,6 +2085,19 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     authority = replicaUnregisteredAuthority;
                 }
                 else {
+                    // Capture before the first owner/policy authority-fact read. Taking
+                    // this revision only before the later roster read could combine an
+                    // old owner with a new policy/roster generation and still pass the
+                    // acceptance-time fence.
+                    //
+                    // A join-approved composition keeps the revision its proof was
+                    // taken against. Capturing a fresh one here would make a change
+                    // that landed between the proof's last check and this line the new
+                    // baseline, and the acceptance-time fence could no longer see it.
+                    metadataAuthorityRevision = approvedPrivateReplicaAuthority !== null
+                        ? approvedPrivateMetaRevision
+                        : this.contextGraphMetaProjection
+                            .readContextGraphAuthorityFactsRevision(contextGraphId);
                     const ownerDid = await this.getContextGraphOwner(contextGraphId);
                     if (signal?.aborted)
                         throw signal.reason;
@@ -2109,15 +2130,58 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                         && ownerAddress !== directAcceptedPrivateSnapshot.policy.source.ownerAddress) {
                         throw new Rfc64CatalogAuthorityResolutionErrorV1('unregistered-owner-unresolved', 'authenticated private RFC-64 authority owner does not match lifecycle metadata');
                     }
+                    if (approvedPrivateReplicaAuthority !== null
+                        && (accessPolicy !== 'private'
+                            || ownerAddress !== approvedPrivateReplicaAuthority.ownerAddress)) {
+                        throw new Rfc64CatalogAuthorityResolutionErrorV1('unregistered-owner-unresolved', 'approved private replica authority does not match lifecycle metadata');
+                    }
                     const stored = await this.getStoredContextGraphRegistrationOptions(contextGraphId);
                     const publishPolicy = stored.publishPolicy === 0 || stored.publishPolicy === 1
                         ? stored.publishPolicy
                         : accessPolicy === 'private' ? 0 : 1;
-                    const members = accessPolicy === 'private'
-                        ? await this.resolveRfc64VerifiedPrivateRosterV1(contextGraphId)
-                        : [];
+                    // The approved-replica proof above has already authenticated this
+                    // receiver's private definition and is fenced to its metadata
+                    // revision. Read that definition's effective roster directly here.
+                    // The general recovery helper performs another registration read;
+                    // during a catalog refresh that read can lose the accepted-absence
+                    // allowance while authority is resolving, making the roster depend
+                    // on the very catalog authority this refresh is meant to restore.
+                    let members = [];
+                    if (accessPolicy === 'private') {
+                        if (approvedPrivateReplicaAuthority !== null) {
+                            const confirmed = await this.hasConfirmedMetaState(contextGraphId)
+                                .catch(() => false);
+                            members = confirmed
+                                ? await this.getLocalMetadataMemberRecoveryGate(contextGraphId, { signal })
+                                : null;
+                            if (members !== null) {
+                                // The join proof authenticates one member against the graph's
+                                // own `_meta`. The roster above comes from the merged
+                                // projection, where the shared agents and ontology graphs can
+                                // name allowed agents no curator approved. Keep only addresses
+                                // the graph's own `_meta` names; a revocation from any source
+                                // has already been applied.
+                                const ownMeta = await this.getOwnCgMetaFacts(contextGraphId, { signal });
+                                if (signal?.aborted)
+                                    throw signal.reason;
+                                const namedByOwnMeta = new Set([...ownMeta.allowedAgents, ...ownMeta.participantAgents]
+                                    .map((address) => address.toLowerCase()));
+                                members = members.filter((member) => namedByOwnMeta.has(member.toLowerCase()));
+                            }
+                        }
+                        else {
+                            members = await this.resolveRfc64VerifiedPrivateRosterV1(contextGraphId);
+                        }
+                    }
                     if (accessPolicy === 'private' && members === null) {
-                        throw new Error('unregistered private RFC-64 Context Graph has no authenticated lifecycle roster');
+                        throw new Rfc64CatalogAuthorityResolutionErrorV1(localFirstUnregistered
+                            ? 'unregistered-private-roster-unresolved'
+                            : 'unregistered-owner-unresolved', 'unregistered private RFC-64 Context Graph has no authenticated lifecycle roster');
+                    }
+                    if (approvedPrivateReplicaAuthority !== null
+                        && !members?.some((member) => member.toLowerCase()
+                            === approvedPrivateReplicaAuthority.approvedAgentAddress)) {
+                        throw new Rfc64CatalogAuthorityResolutionErrorV1('unregistered-owner-unresolved', 'approved private replica member is absent from the authenticated roster');
                     }
                     const rosterVersion = await this.readRfc64PrivateRosterVersionV1(contextGraphId);
                     if (signal?.aborted)
@@ -2138,6 +2202,11 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             }
             if (!isCurrentRfc64CatalogAuthorityRevisionV1(this, contextGraphId, authorityRevision))
                 return null;
+            if (metadataAuthorityRevision !== null
+                && this.contextGraphMetaProjection
+                    .readContextGraphAuthorityFactsRevision(contextGraphId)
+                    !== metadataAuthorityRevision)
+                return new Rfc64AuthorityFactsMovedV1(authorityRevision);
             // Finalized absence was exact when the refresh request was created, but
             // RDF evidence loading is asynchronous. Discovery may bind the graph to
             // a chain id during that await without starting a successor reconcile
@@ -2149,12 +2218,20 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                 && this.subscribedContextGraphs.get(contextGraphId)?.onChainId !== undefined) {
                 throw new Rfc64CatalogAuthorityResolutionErrorV1('registered-authority-binding-mismatch', 'registered RFC-64 Context Graph cannot accept unregistered replica authority');
             }
+            // The join proof was taken before the reads above. Its delegation can
+            // pass its deadline in the meantime without any store write, so the
+            // revision fences do not see it: check the deadline in this same pass.
+            if (approvedPrivateReplicaAuthority !== null
+                && !isApprovedPrivateReplicaDelegationActive(approvedPrivateReplicaAuthority)) {
+                throw new Rfc64CatalogAuthorityResolutionErrorV1('unregistered-owner-unresolved', 'approved private replica delegation expired while its authority was composed');
+            }
             const previousAuthority = service.acceptedPolicySnapshot(authority.policy.networkId, authority.policy.contextGraphId);
             const acceptedAuthority = service.acceptAuthoritativePolicySnapshot({
                 policy: authority.policy,
                 policyDigest: authority.policyDigest,
                 roster: authority.roster,
             });
+            noteRfc64AcceptedAuthorityOriginV1(this, contextGraphId, approvedPrivateReplicaAuthority === null ? 'authenticated' : 'join-approval');
             const authorityGenerationChanged = rfc64CatalogAuthorityGenerationChangedV1(previousAuthority, acceptedAuthority);
             if (authorityGenerationChanged) {
                 service.deactivateReceiverContextGraph(contextGraphId);
@@ -2169,6 +2246,11 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                 reason: null,
                 updatedAtMs: Date.now(),
             });
+            // Restart can restore all applied heads without a receiver completion.
+            // Fresh accepted authority must also wake the live readiness verifier.
+            if (approvedPrivateReplicaAuthority !== null) {
+                this.eventBus.emit(DKGEvent.CATALOG_READINESS_CHECK_REQUESTED, { contextGraphId });
+            }
             // A first subscription attempt can race this authority bootstrap and
             // correctly fail closed. Re-enter the idempotent transport reconciler
             // exactly when authority becomes usable (or its generation changes),
@@ -2177,7 +2259,10 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                 this.queueSharedMemoryGossipSubscription(contextGraphId);
                 this.scheduleRfc64AuthorityAcceptedPeerCatchupV1();
             }
-            this.scheduleRfc64AuthorityAcceptedCatalogRecoveryV1(contextGraphId, acceptedAuthority.policyDigest);
+            this.scheduleRfc64AuthorityAcceptedCatalogRecoveryV1(contextGraphId, acceptedAuthority.policyDigest, {
+                awaitsProviderAuthorization: approvedPrivateReplicaAuthority !== null,
+                retryIncompletePrivate: acceptedAuthority.policy.accessPolicy === 1,
+            });
             return authority;
         }
         catch (error) {
@@ -2185,7 +2270,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                 throw signal.reason;
             if (isCurrentRfc64CatalogAuthorityRevisionV1(this, contextGraphId, authorityRevision)) {
                 const failureCode = rfc64CatalogAuthorityFailureCodeV1(error);
-                if (failureCode === 'registered-authority-unfinalized') {
+                if (RFC64_TRANSIENT_AUTHORITY_REFRESH_FAILURES_V1.has(failureCode)) {
                     // Finality lag is transient. Stay in `resolving`, keep whatever
                     // accepted lineage the refresh started with (so an author keeps
                     // serving and announcing under its accepted policy), and leave the
@@ -2231,24 +2316,56 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
      * wait on receiver admission. The keyed dispatcher owns cancellation,
      * coalescing, error reporting, and shutdown drain for the detached work.
      */
-    scheduleRfc64AuthorityAcceptedCatalogRecoveryV1(contextGraphId, policyDigest) {
+    scheduleRfc64AuthorityAcceptedCatalogRecoveryV1(contextGraphId, policyDigest, options = {}) {
+        const awaitsProviderAuthorization = options.awaitsProviderAuthorization === true;
+        const retryDelays = awaitsProviderAuthorization
+            ? RFC64_JOIN_DERIVED_CATALOG_RECOVERY_RETRY_DELAYS_MS_V1
+            : RFC64_AUTHORITY_CATALOG_RECOVERY_RETRY_DELAYS_MS_V1;
         const workKey = `authority-catalog-recovery\0${contextGraphId}\0${policyDigest}`;
         this.rfc64BackgroundWorkDispatcherV1.scheduleKeyed(workKey, async (signal) => {
-            for (let attempt = 0; attempt <= RFC64_AUTHORITY_CATALOG_RECOVERY_RETRY_DELAYS_MS_V1.length; attempt += 1) {
+            for (let attempt = 0; attempt <= retryDelays.length; attempt += 1) {
                 try {
                     await this.promoteRfc64OwnerSignedSwmInventoriesV1(contextGraphId, signal);
                     signal.throwIfAborted();
-                    await this.requestRfc64CatalogHeadReplaysFromConnectedPeersV1(contextGraphId, signal);
-                    return;
+                    const replay = await this.requestRfc64CatalogHeadReplaysFromConnectedPeersV1(contextGraphId, signal);
+                    // A private join may accept its owner-signed policy before both
+                    // peers have the current member roster. A peer may answer replay
+                    // while the subsequent native fetch is still denied. The replay
+                    // runtime's settled parity, not an answered request alone, is the
+                    // evidence that the promised catalog rows were applied, so that
+                    // replica keeps this bounded demand alive until the parity is clean.
+                    if (!awaitsProviderAuthorization && !options.retryIncompletePrivate)
+                        return;
+                    const progress = this.rfc64CatalogReplayRecoveryRuntimeV1().status(contextGraphId, policyDigest);
+                    const incomplete = progress?.failed === true || progress?.unverified === true;
+                    // A private graph can finish receiving every row while its replay
+                    // drain times out or an authorized peer is temporarily unavailable.
+                    // Its first accepted-authority pass must not leave that unverified
+                    // witness standing until another authority revision happens. Retry
+                    // only this observed incomplete state, under the existing short
+                    // budget. Ordinary public and already-clean graphs still do one
+                    // pass; the longer join-derived budget remains join-only.
+                    if (!awaitsProviderAuthorization) {
+                        if (!options.retryIncompletePrivate || !incomplete)
+                            return;
+                    }
+                    else if (replay.requested > 0 && !incomplete) {
+                        return;
+                    }
                 }
                 catch (error) {
                     if (signal.aborted)
                         throw signal.reason ?? error;
-                    const retryDelayMs = RFC64_AUTHORITY_CATALOG_RECOVERY_RETRY_DELAYS_MS_V1[attempt];
+                    const retryDelayMs = retryDelays[attempt];
                     if (retryDelayMs === undefined)
                         throw error;
                     await waitForRfc64ScheduledResponsibilityDelayV1(signal, retryDelayMs);
+                    continue;
                 }
+                const retryDelayMs = retryDelays[attempt];
+                if (retryDelayMs === undefined)
+                    return;
+                await waitForRfc64ScheduledResponsibilityDelayV1(signal, retryDelayMs);
             }
         });
     }
@@ -2287,12 +2404,10 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
      * to legacy authority; `false` is a catalog-owned fail-closed decision.
      */
     resolveAcceptedRfc64SharedMemoryAuthorityV1(contextGraphId, opts = {}) {
-        const receiverAuthority = this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId);
-        if (receiverAuthority.killSwitchActive
-            || receiverAuthority.mode !== 'catalog')
+        const transport = projectRfc64CatalogTransportStateV1(this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId));
+        if (transport === 'legacy')
             return undefined;
-        if (!receiverAuthority.active
-            || receiverAuthority.reconciliationLane !== 'catalog-apply')
+        if (transport === 'catalog-blocked')
             return false;
         const service = this.rfc64PublicCatalogServiceV1;
         const activeNetworkId = this.config.rfc64CatalogDeploymentProfile?.networkId
@@ -2311,6 +2426,10 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             return false;
         if (accepted.policy.accessPolicy === 0)
             return true;
+        // Join-derived authority does not replace the live join proof: leave the
+        // decision to the caller's read-authority check, which runs that proof.
+        if (this.isRfc64JoinDerivedAcceptedAuthorityV1?.(contextGraphId) === true)
+            return undefined;
         if (accepted.roster === null)
             return false;
         const effectiveCaller = opts.callerAgentAddress
@@ -2318,6 +2437,20 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             ?? this.defaultAgentAddress;
         return this.isAgentAddressAllowed(effectiveCaller, accepted.roster.members.map(({ agentAddress }) => agentAddress));
     }
+    /**
+     * Whether this graph's accepted policy was composed from a private join
+     * approval. Such a snapshot is labelled owner-signed-unregistered like an
+     * authenticated owner policy, but it rests on a proof that expires with the
+     * member's delegation and belongs to one request generation. Reads and
+     * shared-memory access therefore ignore it and keep running the proof.
+     */
+    isRfc64JoinDerivedAcceptedAuthorityV1(contextGraphId) {
+        return rfc64JoinDerivedAcceptedAuthorityV1.get(this)?.has(contextGraphId) === true;
+    }
+    /** Whether an accepted compatibility policy, not responsibility, owns this CG's RFC-64 authority. */
+    hasRfc64AcceptedCompatibilityAuthorityV1(contextGraphId) {
+        return this.resolveRfc64AcceptedCompatibilityAuthorityV1(contextGraphId) !== null;
+    }
     /** Whether the exact active network/CG authority is an accepted unregistered owner policy. */
     hasAcceptedRfc64UnregisteredAuthorityV1(contextGraphId) {
         const service = this.rfc64PublicCatalogServiceV1;
@@ -2346,6 +2479,59 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             return false;
         return service.acceptedPolicySnapshot(activeNetworkId, contextGraphId)?.policy.accessPolicy === 0;
     }
+    /**
+     * Whether this node's accepted RFC-64 authority may govern transport for the
+     * graph right now: the receiver-authority fence shared-memory admission uses
+     * (catalog mode, no kill switch, active, catalog-apply lane). An accepted
+     * snapshot is retained after a failed refresh or a kill switch, so a
+     * transport decision must never read the snapshot without this.
+     */
+    isRfc64CatalogTransportAuthorityActiveV1(contextGraphId) {
+        return projectRfc64CatalogTransportStateV1(this.resolveRfc64CatalogReceiverAuthorityV1(contextGraphId)) === 'catalog-active';
+    }
+    /**
+     * {@link hasAcceptedRfc64PublicUnregisteredAuthorityV1}, but only while that
+     * authority governs transport ({@link isRfc64CatalogTransportAuthorityActiveV1}).
+     * SWM consults this one: a retained public snapshot must not keep plaintext
+     * open once catalog authority is killed, inactive, or blocked (#2831 review).
+     */
+    hasActiveAcceptedRfc64PublicUnregisteredAuthorityV1(contextGraphId) {
+        return this.isRfc64CatalogTransportAuthorityActiveV1(contextGraphId)
+            && this.hasAcceptedRfc64PublicUnregisteredAuthorityV1(contextGraphId);
+    }
+    /**
+     * Current private roster of the accepted owner-signed unregistered policy,
+     * but only while RFC-64 catalog authority governs transport for this graph.
+     *
+     * `undefined` means that no active accepted private-unregistered authority
+     * applies. `null` keeps an applicable but incomplete private authority
+     * fail-closed. Callers must not use the retained accepted snapshot directly:
+     * it deliberately survives a kill switch or inactive catalog lane.
+     */
+    resolveActiveAcceptedRfc64PrivateUnregisteredRosterV1(contextGraphId) {
+        if (!this.isRfc64CatalogTransportAuthorityActiveV1(contextGraphId)) {
+            return undefined;
+        }
+        const configuredPrivate = this.config.rfc64CatalogBootstrap?.acceptedPolicies.some(({ policyEnvelope }) => (policyEnvelope.payload.contextGraphId === contextGraphId
+            && policyEnvelope.payload.accessPolicy === 1)) === true;
+        const accepted = this.readAcceptedRfc64CatalogAccessSnapshotV1(contextGraphId);
+        // A selected private graph stays fail-closed while its policy/roster has
+        // not yet been accepted. Once the catalog transport fence is inactive,
+        // the early return above deliberately restores the legacy fallback.
+        if (accepted === null)
+            return configuredPrivate ? null : undefined;
+        if (accepted.policy.source.kind !== 'owner-signed-unregistered'
+            || accepted.policy.accessPolicy !== 1) {
+            return undefined;
+        }
+        // A join-derived roster is not owner-authenticated transport authority;
+        // the approved-replica proof path keeps governing this graph.
+        if (this.isRfc64JoinDerivedAcceptedAuthorityV1?.(contextGraphId) === true)
+            return undefined;
+        if (accepted.roster === null)
+            return null;
+        return Object.freeze(accepted.roster.members.map(({ agentAddress }) => agentAddress));
+    }
     /**
      * Access policy of the authority this catalog owner has already accepted for
      * the exact active network and graph, or `null` while none is accepted. The
@@ -2636,6 +2822,9 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     // through the ambient lane. Exact retirement must not depend on the
                     // optional attempt-observer bookkeeping still being present.
                     retireRfc64CatalogTargetAnnouncementV1(this, announcement);
+                    this.eventBus.emit(DKGEvent.CATALOG_READINESS_CHECK_REQUESTED, {
+                        contextGraphId: announcement.contextGraphId,
+                    });
                     const attempt = reconciliationAttempts.get(token);
                     if (attempt === undefined)
                         return;
@@ -2760,6 +2949,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             this.rfc64PublicCatalogSynchronizationEvidenceV1.clear();
             this.rfc64PublicCatalogReconciliationFailuresV1.clear();
             rfc64DirectAcceptedCompatibilityV1.delete(this);
+            rfc64JoinDerivedAcceptedAuthorityV1.delete(this);
             rfc64CatalogReplayRuntimesV1.delete(this);
             rfc64CatalogReplaySnapshotRuntimesV1.delete(this);
             rfc64CatalogReplayRecoveryRuntimesV1.get(this)?.reset();
@@ -2800,6 +2990,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             this.clearRfc64CatalogOperationalTargetsV1(input.policy.contextGraphId);
         }
         markRfc64DirectAcceptedCompatibilityV1(this, input.policy.contextGraphId);
+        noteRfc64AcceptedAuthorityOriginV1(this, input.policy.contextGraphId, 'authenticated');
         return accepted;
     }
     /** Author path for a previously accepted policy snapshot in any V1 cell. */
@@ -3042,6 +3233,53 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             },
         });
     }
+    /** Replay only this graph's current head to the exact approved peer. */
+    async reannounceRfc64CatalogAfterJoinApprovalV1(contextGraphId, approvedAgentAddress, peerId) {
+        const accepted = this.readAcceptedRfc64CatalogAccessSnapshotV1(contextGraphId);
+        if (accepted === null)
+            return false;
+        if (accepted.policy.accessPolicy === 1
+            && !accepted.roster?.members.some((member) => member.agentAddress.toLowerCase() === approvedAgentAddress.toLowerCase()))
+            return false;
+        const replay = await this.reannounceRfc64CatalogHeadsToPeerV1(peerId, {
+            kind: RFC64_PUBLIC_CATALOG_HEAD_REPLAY_KIND_V1,
+            networkId: accepted.policy.networkId,
+            contextGraphId: accepted.policy.contextGraphId,
+            policyDigest: accepted.policyDigest,
+        });
+        // An approval can precede the first authored head. An empty replay is not
+        // delivery evidence: keep the bounded retry armed so a head published a
+        // moment later is announced under the settled private roster.
+        return replay.failed === 0 && replay.announced > 0;
+    }
+    /**
+     * An approval can arrive while its successor private roster is still being
+     * composed. Keep the exact approved peer's replay demand alive past the
+     * short notification attempt without delaying the join or widening the
+     * accepted policy. The dispatcher cancels and drains this bounded work on
+     * shutdown; each attempt rechecks current authority and membership.
+     */
+    scheduleRfc64CatalogAfterJoinApprovalRetryV1(contextGraphId, approvedAgentAddress, peerId) {
+        const workKey = `join-approved-catalog-replay\0${contextGraphId}\0${approvedAgentAddress.toLowerCase()}\0${peerId}`;
+        return this.rfc64BackgroundWorkDispatcherV1.scheduleKeyed(workKey, async (signal) => {
+            for (const delayMs of RFC64_JOIN_APPROVAL_CATALOG_REPLAY_RETRY_DELAYS_MS_V1) {
+                await waitForRfc64ScheduledResponsibilityDelayV1(signal, delayMs);
+                try {
+                    await this.reconcileRfc64CatalogAccessAuthorityV1(contextGraphId, signal);
+                    signal.throwIfAborted();
+                    if (await this.reannounceRfc64CatalogAfterJoinApprovalV1(contextGraphId, approvedAgentAddress, peerId))
+                        return;
+                }
+                catch (error) {
+                    if (signal.aborted)
+                        throw signal.reason ?? error;
+                    // An overlapping metadata write or transport refusal is retryable;
+                    // the next pass still has to authenticate the current roster.
+                }
+            }
+            this.log.warn(createOperationContext('system'), `RFC-64 catalog replay remained pending after bounded join approval retries for "${contextGraphId}"`);
+        });
+    }
     /** Request scoped head replay from already-connected peers after late activation. */
     async requestRfc64CatalogHeadReplaysFromConnectedPeersV1(contextGraphId, signal) {
         return this.requestRfc64CatalogHeadReplayV1(contextGraphId, {
@@ -3072,27 +3310,34 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
             contextGraphId,
             policyDigest: accepted.policyDigest,
         };
+        const settle = async (task) => {
+            const result = await task;
+            // Receiver completion precedes the replay owner's parity settlement.
+            // Wake readiness again after that owner releases its active fence.
+            this.eventBus.emit(DKGEvent.CATALOG_READINESS_CHECK_REQUESTED, { contextGraphId });
+            return result;
+        };
         switch (request.kind) {
             case 'connected-peers':
-                return this.rfc64CatalogReplayRecoveryRuntimeV1().request({
+                return settle(this.rfc64CatalogReplayRecoveryRuntimeV1().request({
                     ...scope,
                     ...(signal === undefined ? {} : { signal }),
                     kind: 'full-connected-peers',
                     connectedPeerIds: this.node.libp2p.getPeers().map((peer) => peer.toString()),
-                });
+                }));
             case 'pending-recovery':
-                return this.rfc64CatalogReplayRecoveryRuntimeV1().request({
+                return settle(this.rfc64CatalogReplayRecoveryRuntimeV1().request({
                     ...scope,
                     ...(signal === undefined ? {} : { signal }),
                     kind: 'pending-recovery',
-                });
+                }));
             case 'connection-demand':
-                return this.rfc64CatalogReplayRecoveryRuntimeV1().request({
+                return settle(this.rfc64CatalogReplayRecoveryRuntimeV1().request({
                     ...scope,
                     ...(signal === undefined ? {} : { signal }),
                     kind: 'connection-demand',
                     demand: request.replayDemand,
-                });
+                }));
         }
     }
     /**
@@ -3395,7 +3640,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     // `chainConfig` is ignored, so reading it here would pin the
                     // precommits to the default while the adapter's own authority
                     // reads honoured the operator. One anchor, one source.
-                    finalityConfirmations: this.resolveChainFinalityConfirmationsV1(),
+                    finalityConfirmations: resolveChainFinalityConfirmationsV1(this.chain, this.config.chainConfig),
                     getOnChainContextGraphId: (contextGraphId, signal) => this.getContextGraphOnChainId(contextGraphId, { signal }),
                     getEvmChainId: () => this.chain.getEvmChainId(),
                 });
@@ -3409,7 +3654,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     // `chainConfig` is ignored, so reading it here would pin the
                     // precommits to the default while the adapter's own authority
                     // reads honoured the operator. One anchor, one source.
-                    finalityConfirmations: this.resolveChainFinalityConfirmationsV1(),
+                    finalityConfirmations: resolveChainFinalityConfirmationsV1(this.chain, this.config.chainConfig),
                     getOnChainContextGraphId: (contextGraphId, signal) => this.getContextGraphOnChainId(contextGraphId, { signal }),
                     getEvmChainId: () => this.chain.getEvmChainId(),
                     getKnowledgeAssetStorageAddress: async () => {
@@ -3487,6 +3732,12 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     resolveTrustedCatalogScope: clients.resolveTrustedCatalogScope,
                     resolveDeployment,
                     requiresAppliedHeadPrecommit: (announcement) => {
+                        // An exact applied head can precede a late legacy SWM root marker.
+                        // Replaying that authenticated head retires the marker under the
+                        // native receiver lease; treating the head as satisfied would
+                        // leave the graph permanently known-incomplete despite row parity.
+                        if (readRfc64LegacySwmBoundaryCountV1(this, announcement.contextGraphId) > 0)
+                            return true;
                         const accepted = this.requireRfc64PublicCatalogServiceV1()
                             .acceptedPolicySnapshotForCatalogScope(clients.resolveTrustedCatalogScope(announcement));
                         return accepted.policy.accessPolicy === 1
@@ -3502,8 +3753,7 @@ export class Rfc64CatalogMethods extends DKGAgentBase {
                     // removed, and an EIP-191 head verifies from its envelope alone, so
                     // an exact staged head read and verified once is reused by the
                     // applied-head check instead of being re-read on every announcement.
-                    readStagedCatalogHead: stagedCatalogHeads.read,
-                    peekStagedCatalogHead: stagedCatalogHeads.peek,
+                    stagedCatalogHeads,
                 });
                 const deploymentAwareReconciler = {
                     isHeadSatisfied: (announcement) => withRpcRequestContext({ requestClass: 'background' }, () => {