@origintrail-official/dkg-agent 10.0.19 → 10.0.21

package/dist/dkg-agent.js

@@ -1,21 +1,22 @@
+import { createACKSendP2P } from './internal/storage-ack-owned-request.js';
 import { resolvePrivateSwmRecoveryBudgetMs } from './sync/requester/private-swm-recovery-budget.js';
 import { createAuthorityIndexBootstrap } from './authority-index-bootstrap.js';
 import { planAuthorityIndexBootstrap } from './authority-index-config.js';
 import { createAuthorityIndexSnapshotTransport } from './authority-index-snapshot-transport.js';
 import { createAuthorityIndexSnapshotClient, } from './authority-index-snapshot-service.js';
-import { DKGNode, TypedEventBus, PROTOCOL_STORAGE_ACK, isStorageACKProtocol, PROTOCOL_STORAGE_UPDATE_ACK, PROTOCOL_STORAGE_UPDATE_ACK_V2, contextGraphPublishTopic, contextGraphDataGraphUri, contextGraphMetaUri, assertionLifecycleUri, contextGraphAssertionUri, contextGraphOnChainIdBindingQuery, CONTEXT_GRAPH_ON_CHAIN_ID_PREDICATE, contextGraphMetadataHomeGraph, MemoryLayer, GRAPH_KA_CONTENT_SCOPE_VERSION, createGraphKnowledgeAssetScope, knowledgeAssetLayerGraphUri, computeContextGraphPolicyObjectDigestV1, encodePublishRequest, DEFAULT_GENESIS_ID, getGenesisQuads, computeNetworkId, SYSTEM_CONTEXT_GRAPHS, DKG_ONTOLOGY, Logger, createOperationContext, pickNetworkTunables, ENTITY_PRED_ALT, LegacyKnowledgeAssetReadOnlyError, isAllocatableKaAuthorV1, applyMixins, } from '@origintrail-official/dkg-core';
+import { DKGNode, TypedEventBus, PROTOCOL_STORAGE_ACK, isStorageACKProtocol, PROTOCOL_STORAGE_UPDATE_ACK, PROTOCOL_STORAGE_UPDATE_ACK_V2, contextGraphPublishTopic, contextGraphDataGraphUri, contextGraphMetaUri, assertionLifecycleUri, contextGraphAssertionUri, contextGraphOnChainIdBindingQuery, CONTEXT_GRAPH_ON_CHAIN_ID_PREDICATE, contextGraphMetadataHomeGraph, MemoryLayer, GRAPH_KA_CONTENT_SCOPE_VERSION, createGraphKnowledgeAssetScope, knowledgeAssetLayerGraphUri, computeContextGraphPolicyObjectDigestV1, computeSwmAuthorInventoryScopeDigestV1, encodePublishRequest, DEFAULT_GENESIS_ID, getGenesisQuads, computeNetworkId, SYSTEM_CONTEXT_GRAPHS, DKG_ONTOLOGY, Logger, createOperationContext, pickNetworkTunables, ENTITY_PRED_ALT, LegacyKnowledgeAssetReadOnlyError, isAllocatableKaAuthorV1, applyMixins, } from '@origintrail-official/dkg-core';
 import { GraphManager, createTripleStore } from '@origintrail-official/dkg-storage';
 import { canonicalRootlessLifecycleGraph } from './rootless-lifecycle-graph.js';
 import { normalizeContextGraphDiscoveryScan, legacyChainListScanOptions, } from './context-graph-discovery-options.js';
 import { prepareRfc64LateLegacySwmBoundaryV1 } from './rfc64/legacy-swm-boundary-v1.js';
 import { EVMChainAdapter, NoChainAdapter, isContextGraphChainScanPartialError, withRpcRequestContext } from '@origintrail-official/dkg-chain';
-import { DKGPublisher, ACKCollector, TripleStoreAsyncPromoteQueue, wrapAsRpcPreconditionIfApplicable, resolveStorageAckTiming, createPromotePostCommitFailure, 
+import { DKGPublisher, ACKCollector, TripleStoreAsyncPromoteQueue, wrapAsRpcPreconditionIfApplicable, resolveStorageAckTiming, 
 // OT-RFC-43 A2/B3 — per-layer pointers + derived status helper.
 deriveStatus, WM_CURRENT_ASSERTION_PRED, SWM_CURRENT_ASSERTION_PRED, VM_CURRENT_ASSERTION_PRED, KA_ID_PRED, RESERVED_UAL_PRED, DEFAULT_REQUIRED_ACKS, } from '@origintrail-official/dkg-publisher';
 import { ethers } from 'ethers';
 import { DKGQueryEngine, } from '@origintrail-official/dkg-query';
 import { DKGAgentWallet } from './agent-wallet.js';
-import { prepareAssertionPromote } from './internal/promote/assertion-promote-precommit.js';
+import { prepareAssertionPromote, translateLegacySwmRetirementFence, } from './internal/promote/assertion-promote-precommit.js';
 import { isCanonicalAuthoritativeContextGraphId } from './context-graph-binding-state.js';
 import { connectedPeerIds as liveConnectedPeerIds } from './p2p/connected-peer-ids.js';
 import { deleteSyncPageCheckpoint, } from './sync/requester/page-fetch.js';
@@ -34,9 +35,13 @@ import { DKGAgentBase, createListContextGraphsCacheInvalidatingStore } from './d
 import { mapWithConcurrency } from './map-with-concurrency.js';
 import { VmReconcileShutdownTimeoutError } from './vm-reconcile-service.js';
 import { ContextGraphMembershipPersistShutdownTimeoutError } from './context-graph-membership-persist-scheduler.js';
+import { ContextGraphSubscriptionPersistShutdownTimeoutError } from './context-graph-subscription-persist-scheduler.js';
+import { drainsWithin } from './keyed-persist-scheduler.js';
 import { reconcileAndAllocateKaNumber } from './allocator.js';
+import { resolveReservedKaIdAllocationV1 } from './reserved-ka-id-allocation.js';
 import { chainAuthorityReadBudgetsOf, resolveChainAuthorityReadBudgets } from './chain-authority-read-budgets.js';
 import { OntologyBindingSlotClassifier } from './ontology-binding-slot-classifier.js';
+import { peekOnDemandAgentsPhonebook } from './sync/on-demand-agents-phonebook.js';
 import { peekFinalizedAuthorityColdResolution } from './finalized-authority-cold-resolution.js';
 import { OwnershipMethods } from './dkg-agent-ownership.js';
 import { ContextGraphResolveMethods } from './dkg-agent-cg-resolve.js';
@@ -52,6 +57,7 @@ import { bindRfc64SwmCatalogProjectionOwnerV1, Rfc64SwmCatalogProjectionOwnerV1,
 import { bindRfc64CatalogBootstrapOwnerV1, partitionRfc64CatalogBootstrapV1, Rfc64CatalogBootstrapMethods, Rfc64CatalogBootstrapOwnerV1, } from './dkg-agent-rfc64-catalog-bootstrap.js';
 import { createRfc64SwmRecoveryRuntimeV1, Rfc64SwmRecoveryRuntimeMethods, } from './dkg-agent-rfc64-swm-recovery-runtime.js';
 import { Rfc64CatalogUpsertMethods } from './dkg-agent-rfc64-catalog-upsert.js';
+import { RegisteredPrivateEmptyVmMethods } from './dkg-agent-registered-private-empty-vm.js';
 import { Rfc64SeedStoreMethods } from './dkg-agent-rfc64-seed-store.js';
 import { Rfc64CatalogRuntimeV1 } from './rfc64/catalog-runtime-v1.js';
 import { createRfc64CatalogAuthorityRefreshOwnerV1 } from './rfc64/catalog-authority-refresh-binding-v1.js';
@@ -72,6 +78,7 @@ import { PublishMethods, SEAL_CAPABILITY_GAP_CODE, } from './dkg-agent-publish.j
 import { SwmHostModeMethods } from './dkg-agent-swm-host.js';
 import { VmReconcileSchedulingMethods } from './dkg-agent-vm-reconcile-scheduling.js';
 import { VmPromotionMethods } from './dkg-agent-vm-promotion.js';
+import { AgentsPhonebookMethods } from './dkg-agent-agents-phonebook.js';
 import { ContextGraphMethods } from './dkg-agent-context-graph.js';
 import { ContextGraphNameResolutionMethods } from './dkg-agent-cg-name-resolution.js';
 import { ContextGraphOnChainIdMethods } from './dkg-agent-cg-on-chain-id.js';
@@ -148,6 +155,7 @@ function constructConfiguredChainAdapter(config, contextGraphAuthorityIndexBoots
             receiptTimeoutMs: config.chainConfig.receiptTimeoutMs,
             finalityConfirmations: config.chainConfig.finalityConfirmations,
             indexTickMs: config.chainConfig.indexTickMs,
+            boundedAuthorityReads: config.chainConfig.boundedAuthorityReads,
             maxFeePerGasWei: config.chainConfig.maxFeePerGasWei,
             approvalPolicy: config.chainConfig.approvalPolicy,
             cgRegistryScanPageSize: config.chainConfig.cgRegistryScanPageSize,
@@ -169,20 +177,6 @@ function constructConfiguredChainAdapter(config, contextGraphAuthorityIndexBoots
     }
     return { chain: new NoChainAdapter(), operationalKeys };
 }
-function createACKSendP2P(input) {
-    return async (peerId, protocol, data) => {
-        const sendResult = await input.messenger.sendRequestOwned(peerId, protocol, data, {
-            timeoutMs: input.timeoutMs,
-        });
-        if (!sendResult.delivered) {
-            throw new Error(`substrate send already in flight (transport): ${sendResult.error}`);
-        }
-        if (!sendResult.response) {
-            throw new Error('substrate delivered (transport) without response');
-        }
-        return sendResult.response;
-    };
-}
 /**
  * High-level facade that ties together all DKG agent capabilities:
  * identity, networking, publishing, querying, discovery, and messaging.
@@ -228,6 +222,12 @@ export function mergeRfc64CatalogBootstrapsV1(catalog, legacyPublic) {
 export class DKGAgent extends DKGAgentBase {
     /** One store discovery pass is shared by concurrent peer-connect sessions. */
     contextGraphStoreDiscoveryInFlight;
+    /**
+     * Progress of the ontology metadata relocation (see
+     * {@link contextGraphServingWithheld}): no pass has ended yet, a pass ended
+     * without reaching every candidate, or one did.
+     */
+    ontologyRelocation = 'pending';
     /**
      * Slots named by ontology bindings. It never writes `onChainAccessPolicyCache`,
      * which StorageACK curation checks trust, since its unproven reads can be 0.
@@ -250,6 +250,7 @@ export class DKGAgent extends DKGAgentBase {
     });
     constructor(config, wallet, node, store, publisher, queryEngine, eventBus, chain, workspaceOwnedEntities, writeLocks, publicSnapshotStore) {
         super(config, wallet, node, store, publisher, queryEngine, eventBus, chain, workspaceOwnedEntities, writeLocks, publicSnapshotStore);
+        this.initializeVmReconcilePublicCoreTransportPreferencePolicy();
         this.configureSwmTargetExecutorSessionsV1({
             privateRecoveryBudgetMs: resolvePrivateSwmRecoveryBudgetMs(),
             store: this.store,
@@ -288,6 +289,7 @@ export class DKGAgent extends DKGAgentBase {
                 return owned;
             },
             retireFinalizedSwmTwin: (candidate, ctx) => (this.retireFinalizedSwmTwinCandidate(candidate, ctx)),
+            retireLegacySwmAfterVerifiedVmTwin: (input) => (this.retireLegacySwmAfterVerifiedVmTwin(input)),
             logInfo: (ctx, message) => this.log.info(ctx, message),
             logWarn: (ctx, message) => this.log.warn(ctx, message),
             logDebug: (ctx, message) => this.log.debug(ctx, message),
@@ -379,6 +381,17 @@ export class DKGAgent extends DKGAgentBase {
             },
             acceptsFinalizedPrivateLane: (contextGraphId) => (this.resolveRfc64CatalogAuthoringLaneV1(contextGraphId, null)
                 ?.acceptsFinalizedVmRepair === true),
+            readRepairRevision: (contextGraphId, authorAddress) => {
+                const lane = this.resolveRfc64CatalogAuthoringLaneV1(contextGraphId, null);
+                if (lane === null)
+                    return null;
+                const scopeDigest = computeSwmAuthorInventoryScopeDigestV1({
+                    ...lane.scopeBase, authorAddress,
+                });
+                const headDigest = this.rfc64PersistenceV1?.swmAuthorInventory
+                    .readSwmAuthorInventoryHeadDigestV1(scopeDigest, authorAddress) ?? null;
+                return JSON.stringify([lane.kind, lane.projectionTargetPolicy, scopeDigest, headDigest]);
+            },
             listFinalizedPrivateRepairs: () => (this.rfc64PersistenceV1?.finalizedPrivatePlacementRepairs.list() ?? []),
             repairFinalizedPrivatePlacement: async (repair) => {
                 await this.repairRfc64FinalizedPrivateCatalogPlacementV1(repair);
@@ -735,8 +748,6 @@ export class DKGAgent extends DKGAgentBase {
         const node = new DKGNode(nodeConfig);
         const workspaceOwnedEntities = new Map();
         const writeLocks = new Map();
-        const publicSnapshotStore = config.publicSnapshotStore
-            ?? createPublicSnapshotStore(config.dataDir, config.sharedMemoryPublicSnapshotStorage);
         const legacyAdapterOperationalKey = opKeys?.[0];
         const legacyAdapterOperationalAddress = privateKeyAddress(legacyAdapterOperationalKey);
         const configuredPublisherAddress = normalizeAdapterPublisherAddress(config.publisherAddress);
@@ -754,10 +765,12 @@ export class DKGAgent extends DKGAgentBase {
             if (!agentRef)
                 return;
             // #1863 — a single-graph destructive mutation (replaceSubject) passes its
-            // TARGET GRAPH so the projection is dirtied by graph (covers deleted meta
-            // rows the inserted quads wouldn't reveal); no-op for non-CG graphs.
+            // TARGET GRAPH so deleted facts are fenced, while replacement quads
+            // cover inserted authority facts.
             if (targetGraph !== undefined) {
                 agentRef.contextGraphMetaProjection.markDirtyForGraph(targetGraph);
+                if (quads)
+                    agentRef.contextGraphMetaProjection.markDirtyFromQuads(quads);
                 return;
             }
             if (quads)
@@ -765,6 +778,9 @@ export class DKGAgent extends DKGAgentBase {
             else
                 agentRef.contextGraphMetaProjection.markAllDirty();
         });
+        const publicSnapshotStore = config.publicSnapshotStore ?? (config.publicSnapshotStoreFactory
+            ? config.publicSnapshotStoreFactory(agentStore)
+            : createPublicSnapshotStore(config.dataDir, config.sharedMemoryPublicSnapshotStorage, agentStore));
         const publisher = new DKGPublisher({
             store: agentStore,
             chain,
@@ -789,10 +805,13 @@ export class DKGAgent extends DKGAgentBase {
                 // retires it later.
                 if (resolvedConfig.dataDir === undefined)
                     return;
-                if (agentRef === undefined) {
+                const owner = agentRef;
+                if (owner === undefined) {
                     throw new Error('RFC-64 legacy SWM write-ahead owner is unavailable');
                 }
-                return prepareRfc64LateLegacySwmBoundaryV1(agentRef, input.contextGraphId, input.kaUal, input.shareOperationId, input.assertionVersion);
+                // A promote that meets a retirement's fence (its asset's, or the graph's) is
+                // retried by the queue; every other refusal here stays a hard failure.
+                return translateLegacySwmRetirementFence(() => prepareRfc64LateLegacySwmBoundaryV1(owner, input.contextGraphId, input.kaUal, input.shareOperationId, input.assertionVersion));
             },
             resolveDurableRootMaterializationAtomicCompanion: (input) => {
                 if (resolvedConfig.dataDir === undefined)
@@ -1101,23 +1120,36 @@ export class DKGAgent extends DKGAgentBase {
      * `context-graph-metadata-relocation.ts`). Every store discovery pass runs
      * this first, so discovery only acts on ontology rows that belong there.
      * Without `classifyOnChain`, bare bindings of graphs this node doesn't hold
-     * are left for a later pass (no chain reads).
+     * are left for a later pass (no chain reads). Once `budgetMs` is spent or
+     * `signal` aborts, the remaining candidates are also left for a later pass,
+     * and {@link contextGraphServingWithheld} holds `ontology` back until a pass
+     * reaches them.
      */
     async relocatePrivateContextGraphMetadata(options = {}) {
-        const result = await relocatePrivateContextGraphMetadata({
-            store: this.store,
-            localAccessPolicy: async (contextGraphId) => {
-                if (await this.isPrivateContextGraph(contextGraphId))
-                    return 'private';
-                return (await this.getExplicitAccessPolicy(contextGraphId)) === 'public' ? 'public' : null;
-            },
-            ...(options.classifyOnChain === false
-                ? {}
-                : {
-                    classifyOnChainSlot: (onChainId) => this.classifyOntologyBindingSlot(onChainId),
-                    knownSlotClass: (onChainId) => this.knownOntologyBindingSlotClass(onChainId),
-                }),
-        });
+        let result;
+        try {
+            result = await relocatePrivateContextGraphMetadata({
+                store: this.store,
+                localAccessPolicy: async (contextGraphId) => {
+                    if (await this.isPrivateContextGraph(contextGraphId))
+                        return 'private';
+                    return (await this.getExplicitAccessPolicy(contextGraphId)) === 'public' ? 'public' : null;
+                },
+                ...(options.classifyOnChain === false
+                    ? {}
+                    : {
+                        classifyOnChainSlot: (onChainId) => this.classifyOntologyBindingSlot(onChainId),
+                        knownSlotClass: (onChainId) => this.knownOntologyBindingSlotClass(onChainId),
+                    }),
+                ...(options.budgetMs !== undefined ? { budgetMs: options.budgetMs } : {}),
+                ...(options.signal ? { signal: options.signal } : {}),
+            });
+        }
+        catch (err) {
+            if (this.ontologyRelocation === 'pending')
+                this.ontologyRelocation = 'withheld';
+            throw err;
+        }
         if (result.movedToMeta.length > 0 || result.deletedForeign > 0) {
             this.invalidateListContextGraphsCache();
             for (const contextGraphId of result.movedToMeta) {
@@ -1126,8 +1158,31 @@ export class DKGAgent extends DKGAgentBase {
             this.log.info(createOperationContext('system'), `Relocated private context graph metadata out of the ontology graph: ` +
                 `${result.movedToMeta.length} moved to their own _meta, ${result.deletedForeign} removed`);
         }
+        if (result.deferred > 0) {
+            this.log.info(createOperationContext('system'), `Context graph metadata relocation stopped early: ${result.deferred} candidate(s) left for a later pass`);
+            if (this.ontologyRelocation === 'pending')
+                this.ontologyRelocation = 'withheld';
+        }
+        else if (this.ontologyRelocation !== 'relocated') {
+            if (this.ontologyRelocation === 'withheld') {
+                this.log.info(createOperationContext('system'), 'Context graph metadata relocation reached every candidate; serving the ontology graph to peers again');
+            }
+            this.ontologyRelocation = 'relocated';
+        }
         return result;
     }
+    /**
+     * Whether peers asking for `contextGraphId` are to be told to retry later
+     * rather than be served it: `ontology`, until a metadata relocation pass
+     * has reached every candidate. Until then it may still hold private
+     * metadata that earlier builds wrote there, and it is a public graph, so
+     * sync, changelog sync and remote queries would hand those rows to anyone.
+     * Nothing in this build writes private metadata to ontology, so once a pass
+     * finishes, the graph stays servable for the life of the agent.
+     */
+    contextGraphServingWithheld(contextGraphId) {
+        return contextGraphId === SYSTEM_CONTEXT_GRAPHS.ONTOLOGY && this.ontologyRelocation !== 'relocated';
+    }
     /** The class of an ontology binding's slot this node knows without a chain read. */
     knownOntologyBindingSlotClass(onChainId) {
         return this.ontologyBindingSlots.known(onChainId);
@@ -1190,6 +1245,7 @@ export class DKGAgent extends DKGAgentBase {
         const prefix = 'did:dkg:context-graph:';
         let discovered = 0;
         const discoveredEntries = new Map();
+        let unprovenClaims = 0;
         const collectEntries = (rows, source, definition) => {
             for (const row of rows) {
                 const uri = row['ctxGraph'] ?? '';
@@ -1200,18 +1256,25 @@ export class DKGAgent extends DKGAgentBase {
                     continue;
                 const existing = discoveredEntries.get(id);
                 const rowName = row['name'] ? stripLiteral(row['name']) : undefined;
-                const candidateOnChainId = row['onChainId']
+                // An `OnChainId` row is a claim, not a binding: the ontology graph is
+                // shared by every network and deployment, and one Base edge held three
+                // definitions claiming #33. Keep only a claim this chain proves, with
+                // the name hash it proves, so the row is bound exactly as a chain lane
+                // would bind it.
+                const claimedOnChainId = row['onChainId']
                     ? stripLiteral(row['onChainId'])
                     : undefined;
-                const rowOnChainId = isCanonicalAuthoritativeContextGraphId(candidateOnChainId)
-                    ? candidateOnChainId
-                    : undefined;
+                const proven = claimedOnChainId === undefined
+                    ? null
+                    : this.provenOnChainContextGraphClaim(id, claimedOnChainId);
+                if (claimedOnChainId !== undefined && proven === null)
+                    unprovenClaims++;
                 const ontologyWins = existing?.source === 'meta' && source === 'ontology';
                 discoveredEntries.set(id, {
                     id,
                     name: rowName ?? existing?.name ?? id,
                     source: !existing || ontologyWins ? source : existing.source,
-                    onChainId: rowOnChainId ?? existing?.onChainId,
+                    binding: proven ?? existing?.binding,
                     hasDefinition: definition || existing?.hasDefinition === true,
                 });
             }
@@ -1266,7 +1329,8 @@ export class DKGAgent extends DKGAgentBase {
         if (metaResult.type === 'bindings') {
             collectEntries(metaResult.bindings, 'meta', true);
         }
-        this.log.debug(ctx, `Discovery scan found ${discoveredEntries.size} CG(s) in store`);
+        this.log.debug(ctx, `Discovery scan found ${discoveredEntries.size} CG(s) in store`
+            + `${unprovenClaims > 0 ? `; ignored ${unprovenClaims} on-chain id claim(s) this chain does not prove` : ''}`);
         // Private classification is needed only to restore the SWM scope of an
         // already-active member. Newly catalogued rows do not need a per-row store
         // read: activation performs its own authority/policy checks, while dormant
@@ -1277,18 +1341,27 @@ export class DKGAgent extends DKGAgentBase {
         });
         const curatedResults = await mapWithConcurrency(curatedCandidates, DKGAgentBase.LIST_CONTEXT_GRAPHS_ROW_CONCURRENCY, async ({ id }) => [id, await this.isPrivateContextGraph(id)]);
         const curatedById = new Map(curatedResults);
+        // A definition for a graph this node wants but holds only by its name hash
+        // (`dkg subscribe <hash>`, or a Core's hosted row) is that graph's verified
+        // cleartext id. Adopt it as the name-hash resolver would, so the
+        // subscription moves to the cleartext id. Recording it below first would
+        // let the canonical setter retire the hash-keyed row and drop the
+        // subscription with it.
+        // Adoptions are independent: each targets its own name hash, is
+        // serialized per hash, and never throws.
+        await mapWithConcurrency([...discoveredEntries.values()], DKGAgentBase.LIST_CONTEXT_GRAPHS_ROW_CONCURRENCY, ({ id }) => this.adoptWantedContextGraphNamePlaceholder(id));
         // Recording and the temporary Core auto-subscribe bridge are synchronous.
         // Defer only this narrow producer burst so every discovered row enters one
         // immutable finalized responsibility batch regardless of scan duration.
         const releaseResponsibilityBatch = this.beginRfc64ScheduledCatalogResponsibilityBatchV1();
         try {
-            for (const { id, name, source, onChainId, hasDefinition } of discoveredEntries.values()) {
+            for (const { id, name, source, binding, hasDefinition } of discoveredEntries.values()) {
                 const existing = this.subscribedContextGraphs.get(id);
                 if (existing) {
                     // Enrich an existing active/hosted record and persist the binding. The
                     // central recorder deliberately does not reactivate an existing
                     // unsubscribed row, preserving explicit unsubscribe semantics.
-                    this.recordDiscoveredContextGraph(id, { name, onChainId });
+                    this.recordDiscoveredContextGraph(id, { name, ...binding });
                     const current = this.subscribedContextGraphs.get(id) ?? existing;
                     // A restart re-seeds `subscribedContextGraphs` from persisted state but
                     // does NOT re-add the CG to the SWM-sync scope (`config.syncContextGraphs`,
@@ -1314,8 +1387,13 @@ export class DKGAgent extends DKGAgentBase {
                 if (!hasDefinition
                     && (this.config.nodeRole ?? 'edge') === 'core'
                     // Only verdicts the relocation above already reached count, so
-                    // this pass stays within its chain read budget.
-                    && await this.contextGraphAccessPolicyState(id, { declared: false, onChainId, readChain: false }) !== 'public') {
+                    // this pass stays within its chain read budget. An unproven claim
+                    // names no slot, so it proves nothing public either.
+                    && await this.contextGraphAccessPolicyState(id, {
+                        declared: false,
+                        ...(binding === undefined ? {} : { onChainId: binding.onChainId }),
+                        readChain: false,
+                    }) !== 'public') {
                     // A bare binding carries no access policy of its own. Activating
                     // it before the chain proves its slot public would host and
                     // advertise a graph whose policy is unknown, and recording it
@@ -1342,7 +1420,7 @@ export class DKGAgent extends DKGAgentBase {
                 //   collision resolver above lets an ontology row shadow a
                 //   meta row when both exist for the same id.
                 const isCurated = curatedById.get(id) === true;
-                const recorded = this.recordDiscoveredContextGraph(id, { name, onChainId }, {
+                const recorded = this.recordDiscoveredContextGraph(id, { name, ...binding }, {
                     // A persisted row left dormant during restart must not be
                     // reactivated when the same definition is found in Oxigraph
                     // moments later. Genuinely new discoveries and explicit live
@@ -1669,6 +1747,11 @@ export class DKGAgent extends DKGAgentBase {
         // Detached cold authority flights are aborted here too: after stop() no
         // request can consume their result, and the chain reader closes below.
         peekFinalizedAuthorityColdResolution(this)?.close();
+        // Abort an on-demand phonebook fetch and its re-check timer. The aborted
+        // `agents` durable sync unwinds at its next page or commit boundary, and
+        // its drain joins the shutdown fence below, so store and network teardown
+        // (and a same-process restart's first fetch) never overlap it.
+        const onDemandPhonebookDrain = peekOnDemandAgentsPhonebook(this)?.close() ?? null;
         const authorityIndexSnapshotDrain = Promise.all([
             this.authorityIndexSnapshotRuntime?.close(),
             this.chain.contextGraphAuthorityIndexSnapshots?.close(),
@@ -1769,6 +1852,8 @@ export class DKGAgent extends DKGAgentBase {
         };
         const drains = [drainPhysicalRuns(), rfc64BackgroundDrain];
         drains.push(authorityIndexSnapshotDrain);
+        if (onDemandPhonebookDrain)
+            drains.push(onDemandPhonebookDrain);
         if (authorityRetryDrain)
             drains.push(authorityRetryDrain);
         if (rehydrationPromotionDrain)
@@ -1780,7 +1865,12 @@ export class DKGAgent extends DKGAgentBase {
         if (dispatcherDrain)
             drains.push(dispatcherDrain);
         let retirement;
-        retirement = Promise.allSettled(drains).then(() => {
+        retirement = Promise.allSettled(drains).then(async () => {
+            // All agent-owned producers are fenced and physically drained before
+            // sampling the reader's GLOBAL activity. Its idle boundary also owns
+            // detached adapter work, including readers without snapshots.close().
+            // Never attach this unrelated global drain to individual read results.
+            await this.chain.contextGraphAuthorityIndexRevisionReader?.whenIdle();
             if (this.vmReconcileScheduling === vmReconcileScheduling) {
                 this.vmReconcileScheduling = undefined;
             }
@@ -1830,6 +1920,13 @@ export class DKGAgent extends DKGAgentBase {
             throw new ContextGraphMembershipPersistShutdownTimeoutError(DKGAgentBase.CONTEXT_GRAPH_MEMBERSHIP_PERSIST_SHUTDOWN_TIMEOUT_MS);
         }
         this.contextGraphMembershipPersistenceShutdownBlocked = false;
+        // A core-host recording persists its host row through the strict
+        // subscription queue, so it has to retire while that queue still admits
+        // writes. Fence new recordings first, then drain the tracked ones: a
+        // StorageACK gate or promotion-audit recording paused before its persist
+        // finishes here instead of being refused by a closed queue. The audit and
+        // promotion flights, which reach subscription state only through
+        // recordings, drain right behind them.
         this.coreHostRecordingsClosed = true;
         await this.drainCoreHostRecordings();
         // An in-flight ACK promotion audit stops at its next checkpoint once the
@@ -1850,6 +1947,21 @@ export class DKGAgent extends DKGAgentBase {
             ]).finally(() => { if (auditDrainTimer)
                 clearTimeout(auditDrainTimer); });
         }
+        // Subscription writes come from graph-scoped sync and reconciliation (cursor
+        // and binding snapshots), from inside a join approval's membership write,
+        // and from core-host recordings. All three have finished by here, so
+        // admission closes now: a run that stop() just waited for still had its
+        // write admitted, and only a late network callback finds the queue closed.
+        // The drain has the same bounded budget as membership's, and a timeout
+        // blocks store teardown until stop() is retried.
+        if (!await drainsWithin(this.contextGraphSubscriptionPersistence.closeAndDrain(), DKGAgentBase.CONTEXT_GRAPH_SUBSCRIPTION_PERSIST_SHUTDOWN_TIMEOUT_MS)) {
+            this.contextGraphSubscriptionPersistenceShutdownBlocked = true;
+            this.log.warn(createOperationContext('system'), `DKGAgent.stop: context-graph subscription persistence did not drain within `
+                + `${DKGAgentBase.CONTEXT_GRAPH_SUBSCRIPTION_PERSIST_SHUTDOWN_TIMEOUT_MS}ms; `
+                + `store teardown is blocked until stop() is retried`);
+            throw new ContextGraphSubscriptionPersistShutdownTimeoutError(DKGAgentBase.CONTEXT_GRAPH_SUBSCRIPTION_PERSIST_SHUTDOWN_TIMEOUT_MS);
+        }
+        this.contextGraphSubscriptionPersistenceShutdownBlocked = false;
         if (this.messengerOutboxTimer) {
             clearInterval(this.messengerOutboxTimer);
             this.messengerOutboxTimer = null;
@@ -1939,6 +2051,10 @@ export class DKGAgent extends DKGAgentBase {
             await this.node.stop();
         }
         finally {
+            // The libp2p node, and every pubsub subscription with it, is gone; what
+            // the agent recorded about the session's gossip wiring is now stale
+            // (restart contract on DKGAgentBase). Subscription intent is untouched.
+            this.retireGossipSession();
             this.finalizationRuntime.markStopped();
             // Node stop aborts active transport first; now drain the peer-serial
             // owners and release every retained selected-SWM prefix/checkpoint before
@@ -2602,9 +2718,12 @@ export class DKGAgent extends DKGAgentBase {
         // lands in that agent's per-KA …/_working_memory/{addr}/{number} graph
         // (not the default agent's, and not the legacy name-keyed fallback used
         // when no number is minted).
-        const resolveAuthorAndAllocator = (explicitAuthor) => {
+        const resolveAuthorAndAllocator = (explicitAuthor, reservedKaId) => {
             const author = explicitAuthor ?? agentAddress;
             const isEvmAuthor = isAllocatableKaAuthorV1(author);
+            if (reservedKaId !== undefined) {
+                return resolveReservedKaIdAllocationV1(author, reservedKaId, agent.chain.chainId, agent.kaNumberAllocator);
+            }
             // The allocator MUST consume `author`'s lane, never the outer default:
             // the number is minted into the reserved UAL the lifecycle is stamped
             // with, so allocating from a different address strands the draft under
@@ -2617,13 +2736,11 @@ export class DKGAgent extends DKGAgentBase {
         };
         return {
             async create(contextGraphId, name, opts) {
-                // D1 (identity-at-create): mint the KA number/UAL at create so the UAL is the
-                // KA's identity from the first write. assertionCreate only allocates when the
-                // draft has no preserved kaId (the re-open guard lives there), so passing the
-                // callback is safe — re-opens reuse the preserved identity.
-                const { author, allocateKaNumber } = resolveAuthorAndAllocator(opts?.agentAddress);
+                // Existing identities are retained; explicit reservations must match
+                // under the publisher's lifecycle lock before any draft is reopened.
+                const { author, allocateKaNumber, expectedKaNumber } = resolveAuthorAndAllocator(opts?.agentAddress, opts?.reservedKaId);
                 return agent.publisher.assertionCreate(contextGraphId, name, author, opts?.subGraphName, {
-                    allocateKaNumber,
+                    allocateKaNumber, expectedKaNumber,
                     onDisposition: opts?.onDisposition,
                 });
             },
@@ -2758,20 +2875,18 @@ export class DKGAgent extends DKGAgentBase {
                 // OT-RFC-43 A2 (decision 2) — stamp dkg:swmCurrentAssertion on the
                 // lifecycle URN so the SWM pointer is observable (and can diverge from
                 // WM/VM). A VM no-op must not restamp a pointer or notify SWM observers.
+                // The hook classifies its own pointer stamp (canonical durable-finalization
+                // boundary): a failure never reports success, and a replay of this same
+                // committed operation repairs it.
                 if (promotedAllRoots) {
-                    try {
-                        await agent.afterDurableSwmPromotionV1({
-                            contextGraphId,
-                            subGraphName: opts?.subGraphName,
-                            assertionCoordinate: name,
-                            lifecycleAgentAddress: promoteAgentAddress,
-                            shareOperationId: shareOperationId ?? null,
-                            ctx: createOperationContext('share'),
-                        });
-                    }
-                    catch (error) {
-                        throw createPromotePostCommitFailure(error);
-                    }
+                    await agent.afterDurableSwmPromotionV1({
+                        contextGraphId,
+                        subGraphName: opts?.subGraphName,
+                        assertionCoordinate: name,
+                        lifecycleAgentAddress: promoteAgentAddress,
+                        shareOperationId: shareOperationId ?? null,
+                        ctx: createOperationContext('share'),
+                    });
                 }
                 // #1116 (round 9) — the swmShareComplete marker mark/clear now lives INSIDE
                 // assertionPromote (co-located with the member-row REPLACE, gated on the
@@ -2830,7 +2945,7 @@ export class DKGAgent extends DKGAgentBase {
                 });
             },
             async history(contextGraphId, name, opts) {
-                const addr = opts?.agentAddress ?? agentAddress;
+                let addr = opts?.agentAddress ?? agentAddress;
                 const metaGraph = contextGraphMetaUri(contextGraphId);
                 const DKG_NS = 'http://dkg.io/ontology/';
                 const PROV_NS = 'http://www.w3.org/ns/prov#';
@@ -2872,6 +2987,7 @@ export class DKGAgent extends DKGAgentBase {
               }
             } LIMIT 1`, { source: 'agent.history.lifecycleState' });
                     if (entityResult.type === 'bindings' && entityResult.bindings.length > 0) {
+                        addr = lifecycleAddress;
                         lifecycleUri = candidateLifecycleUri;
                         row = entityResult.bindings[0];
                         break;
@@ -3169,5 +3285,5 @@ export class DKGAgent extends DKGAgentBase {
         return this.rfc64CatalogRuntimeV1.whenIdle();
     }
 }
-applyMixins(DKGAgent, [ImportedArtifactMethods, ContextGraphMethods, ContextGraphNameResolutionMethods, ContextGraphOnChainIdMethods, ContextGraphChainObservationMethods, SwmHostModeMethods, VmReconcileSchedulingMethods, VmPromotionMethods, PublishMethods, LifecycleSyncMethods, WorkspaceCryptoMethods, AgentRegistryMethods, QueryMethods, SwmSubstrateMethods, JoinRequestMethods, ContextGraphRegistryMethods, EndorseVerifyMethods, CclPolicyMethods, ContextGraphResolveMethods, OwnershipMethods, Rfc64CatalogMethods, Rfc64CatalogSyncMethods, Rfc64CatalogUpsertMethods, Rfc64SwmCatalogProjectionMethods, Rfc64SwmCatalogProjectionSupervisorMethods, Rfc64CatalogAutoPublishMethods, Rfc64SwmRecoveryRuntimeMethods, Rfc64CatalogBootstrapMethods, Rfc64SeedStoreMethods, Rfc64SeedFetchMethods, Rfc64MetaBootstrapMethods]);
+applyMixins(DKGAgent, [ImportedArtifactMethods, ContextGraphMethods, ContextGraphNameResolutionMethods, ContextGraphOnChainIdMethods, ContextGraphChainObservationMethods, SwmHostModeMethods, VmReconcileSchedulingMethods, VmPromotionMethods, PublishMethods, LifecycleSyncMethods, WorkspaceCryptoMethods, AgentRegistryMethods, QueryMethods, SwmSubstrateMethods, JoinRequestMethods, ContextGraphRegistryMethods, EndorseVerifyMethods, CclPolicyMethods, ContextGraphResolveMethods, OwnershipMethods, Rfc64CatalogMethods, Rfc64CatalogSyncMethods, Rfc64CatalogUpsertMethods, RegisteredPrivateEmptyVmMethods, Rfc64SwmCatalogProjectionMethods, Rfc64SwmCatalogProjectionSupervisorMethods, Rfc64CatalogAutoPublishMethods, Rfc64SwmRecoveryRuntimeMethods, Rfc64CatalogBootstrapMethods, Rfc64SeedStoreMethods, Rfc64SeedFetchMethods, Rfc64MetaBootstrapMethods, AgentsPhonebookMethods]);
 //# sourceMappingURL=dkg-agent.js.map