@origintrail-official/dkg-agent 10.0.19 → 10.0.21

package/dist/curator-peer-connection.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0
+import { verifiedCuratorDialAddress } from './curator-dial-address.js';
+export function ensureCuratorConnected(agent, curatorPeerId, signal, ctx, throwIfAborted, addressHint) {
+    throwIfAborted(signal);
+    if (agent.node.libp2p.getConnections().some((connection) => (connection.remotePeer.toString() === curatorPeerId)))
+        return true;
+    return connectCurator(agent, curatorPeerId, signal, ctx, throwIfAborted, addressHint);
+}
+async function connectCurator(agent, curatorPeerId, signal, ctx, throwIfAborted, addressHint) {
+    const verifiedAddress = verifiedCuratorDialAddress(addressHint, curatorPeerId);
+    try {
+        const outcome = await agent.peerResolver.connect(curatorPeerId, {
+            signal,
+            recovery: {
+                verifiedInitialAddress: verifiedAddress,
+                initialTimeoutMs: 5_000,
+                cachedTimeoutMs: 5_000,
+                resolverTimeoutMs: 15_000,
+            },
+            perStepTimeoutMs: 5_000,
+            candidateTimeoutMs: 5_000,
+        });
+        throwIfAborted(signal);
+        return outcome.status === 'connected';
+    }
+    catch (error) {
+        throwIfAborted(signal);
+        agent.log.warn(ctx, `Failed to dial curator ${curatorPeerId.slice(-8)}: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
+    }
+}
+/** Dial recovery cannot prevent Messenger from durably accepting an offline join. */
+export async function recoverCuratorConnectionBeforeQueueing(agent, curatorPeerId, signal, ctx) {
+    try {
+        await ensureCuratorConnected(agent, curatorPeerId, signal, ctx, (abort) => abort?.throwIfAborted());
+    }
+    catch (error) {
+        agent.log.warn(ctx, `Curator connection recovery deferred: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=curator-peer-connection.js.map

package/dist/curator-peer-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"curator-peer-connection.js","sourceRoot":"","sources":["../src/curator-peer-connection.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAMtC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAQvE,MAAM,UAAU,sBAAsB,CACpC,KAAiC,EACjC,aAAqB,EACrB,MAA+B,EAC/B,GAAqB,EACrB,cAAyD,EACzD,WAAoB;IAEpB,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAC1D,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,aAAa,CACnD,CAAC;QAAE,OAAO,IAAI,CAAC;IAChB,OAAO,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAiC,EACjC,aAAqB,EACrB,MAA+B,EAC/B,GAAqB,EACrB,cAAyD,EACzD,WAAoB;IAEpB,MAAM,eAAe,GAAG,0BAA0B,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE;YAC9D,MAAM;YACN,QAAQ,EAAE;gBACR,sBAAsB,EAAE,eAAe;gBACvC,gBAAgB,EAAE,KAAK;gBACvB,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,MAAM;aAC1B;YACD,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;QACH,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,IAAI,CACZ,GAAG,EACH,0BAA0B,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/G,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAAiC,EACjC,aAAqB,EACrB,MAAmB,EACnB,GAAqB;IAErB,IAAI,CAAC;QACH,MAAM,sBAAsB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACtG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC"}

package/dist/dkg-agent-agents-phonebook.d.ts

@@ -0,0 +1,41 @@
+/**
+ * On-demand `agents` phonebook mixin: the enable gate, the per-agent fetcher,
+ * the subscribe/reconcile trigger, the public-policy read, and the fetcher's
+ * agent-backed dependencies. The fetcher itself lives in
+ * `sync/on-demand-agents-phonebook.ts`; re-scheduling VM recovery for graphs
+ * whose curator now resolves stays with VM-reconcile scheduling.
+ */
+import { DKGAgentBase } from './dkg-agent-base.js';
+import type { DKGAgent } from './dkg-agent.js';
+import { OnDemandAgentsPhonebookFetcher, type AgentsPhonebookAccessPolicy, type AgentsPhonebookFetchTrigger, type OnDemandAgentsPhonebookDeps } from './sync/on-demand-agents-phonebook.js';
+export declare class AgentsPhonebookMethods extends DKGAgentBase {
+    /**
+     * Whether this node may fetch the `agents` phonebook on demand right now:
+     * running, durable sync on, and no automatic on-connect system-graph sync
+     * (which already keeps the phonebook).
+     */
+    onDemandAgentsPhonebookEnabled(this: DKGAgent): boolean;
+    /** The process-local on-demand phonebook fetcher, created on first use. */
+    onDemandAgentsPhonebook(this: DKGAgent): OnDemandAgentsPhonebookFetcher;
+    /**
+     * Ask for one bounded `agents` phonebook fetch on behalf of a graph whose
+     * owner the local phonebook cannot map to a peer. Synchronous and never
+     * throws; `sync/on-demand-agents-phonebook.ts` owns every bound.
+     */
+    requestOnDemandAgentsPhonebook(this: DKGAgent, contextGraphId: string, trigger: AgentsPhonebookFetchTrigger): void;
+    /**
+     * Fetch the `agents` phonebook for recipient agents a private share has no
+     * key for, and wait for it (#2849). Resolves with the lower-cased wallets
+     * whose key the store holds afterwards; never throws.
+     */
+    ensureAgentsInOnDemandPhonebook(this: DKGAgent, wallets: readonly string[], signal?: AbortSignal): Promise<ReadonlySet<string>>;
+    /**
+     * Read-only public-policy check for the phonebook trigger. A wrong answer
+     * costs at most one bounded fetch or one skipped fetch that the next trigger
+     * corrects, so the finalized authority projection may answer, else one
+     * bounded current-state read.
+     */
+    readAgentsPhonebookAccessPolicy(this: DKGAgent, contextGraphId: string, signal: AbortSignal): Promise<AgentsPhonebookAccessPolicy>;
+    createOnDemandAgentsPhonebookDeps(this: DKGAgent): OnDemandAgentsPhonebookDeps;
+}
+//# sourceMappingURL=dkg-agent-agents-phonebook.d.ts.map

package/dist/dkg-agent-agents-phonebook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dkg-agent-agents-phonebook.d.ts","sourceRoot":"","sources":["../src/dkg-agent-agents-phonebook.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAW/C,OAAO,EACL,8BAA8B,EAG9B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EACjC,MAAM,sCAAsC,CAAC;AAE9C,qBAAa,sBAAuB,SAAQ,YAAY;IACtD;;;;OAIG;IACH,8BAA8B,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAUvD,2EAA2E;IAC3E,uBAAuB,CAAC,IAAI,EAAE,QAAQ,GAAG,8BAA8B;IAOvE;;;;OAIG;IACH,8BAA8B,CAC5B,IAAI,EAAE,QAAQ,EACd,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,2BAA2B,GACnC,IAAI;IAQP;;;;OAIG;IACG,+BAA+B,CACnC,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAQ/B;;;;;OAKG;IACG,+BAA+B,CACnC,IAAI,EAAE,QAAQ,EACd,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,2BAA2B,CAAC;IAmBvC,iCAAiC,CAAC,IAAI,EAAE,QAAQ,GAAG,2BAA2B;CA4E/E"}

package/dist/dkg-agent-agents-phonebook.js

@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * On-demand `agents` phonebook mixin: the enable gate, the per-agent fetcher,
+ * the subscribe/reconcile trigger, the public-policy read, and the fetcher's
+ * agent-backed dependencies. The fetcher itself lives in
+ * `sync/on-demand-agents-phonebook.ts`; re-scheduling VM recovery for graphs
+ * whose curator now resolves stays with VM-reconcile scheduling.
+ */
+import { DKGAgentBase } from './dkg-agent-base.js';
+import { AGENT_DID_PREFIX, createOperationContext, deriveCuratorDidFromCgId, SYSTEM_CONTEXT_GRAPHS, } from '@origintrail-official/dkg-core';
+import { resolveWorkspaceAgentRecipientKeys } from '@origintrail-official/dkg-publisher';
+import { chainAuthorityReadBudgetsOf } from './chain-authority-read-budgets.js';
+import { resolveBooleanSwitch } from './sync/backpressure.js';
+import { systemContextGraphSyncOptionsOf } from './sync/system-context-graph-policy.js';
+import { OnDemandAgentsPhonebookFetcher, onDemandAgentsPhonebookFor, resolveOnDemandAgentsPhonebookFetch, } from './sync/on-demand-agents-phonebook.js';
+export class AgentsPhonebookMethods extends DKGAgentBase {
+    /**
+     * Whether this node may fetch the `agents` phonebook on demand right now:
+     * running, durable sync on, and no automatic on-connect system-graph sync
+     * (which already keeps the phonebook).
+     */
+    onDemandAgentsPhonebookEnabled() {
+        return this.started === true
+            && resolveBooleanSwitch(this.config.durableSyncEnabled, 'DKG_DURABLE_SYNC_ENABLED', true)
+            && resolveOnDemandAgentsPhonebookFetch({
+                ...systemContextGraphSyncOptionsOf(this.config),
+                onDemandConfigValue: this.config.onDemandAgentsPhonebook,
+                onDemandEnvValue: process.env.DKG_ON_DEMAND_AGENTS_PHONEBOOK,
+            });
+    }
+    /** The process-local on-demand phonebook fetcher, created on first use. */
+    onDemandAgentsPhonebook() {
+        return onDemandAgentsPhonebookFor(this, () => new OnDemandAgentsPhonebookFetcher(this.createOnDemandAgentsPhonebookDeps()));
+    }
+    /**
+     * Ask for one bounded `agents` phonebook fetch on behalf of a graph whose
+     * owner the local phonebook cannot map to a peer. Synchronous and never
+     * throws; `sync/on-demand-agents-phonebook.ts` owns every bound.
+     */
+    requestOnDemandAgentsPhonebook(contextGraphId, trigger) {
+        try {
+            this.onDemandAgentsPhonebook().request(contextGraphId, trigger);
+        }
+        catch {
+            // Advisory only: a narrow host without the agent runtime skips it.
+        }
+    }
+    /**
+     * Fetch the `agents` phonebook for recipient agents a private share has no
+     * key for, and wait for it (#2849). Resolves with the lower-cased wallets
+     * whose key the store holds afterwards; never throws.
+     */
+    async ensureAgentsInOnDemandPhonebook(wallets, signal) {
+        try {
+            return await this.onDemandAgentsPhonebook().ensureWallets(wallets, signal);
+        }
+        catch {
+            return new Set();
+        }
+    }
+    /**
+     * Read-only public-policy check for the phonebook trigger. A wrong answer
+     * costs at most one bounded fetch or one skipped fetch that the next trigger
+     * corrects, so the finalized authority projection may answer, else one
+     * bounded current-state read.
+     */
+    async readAgentsPhonebookAccessPolicy(contextGraphId, signal) {
+        const { requestTimeoutMs, coldResolutionTimeoutMs } = chainAuthorityReadBudgetsOf(this);
+        try {
+            const authority = await this.resolveRegisteredContextGraphAuthority(contextGraphId, {
+                signal: AbortSignal.any([
+                    signal,
+                    AbortSignal.timeout(coldResolutionTimeoutMs + requestTimeoutMs),
+                ]),
+                registrationTimeoutMs: coldResolutionTimeoutMs,
+                authorityReadMode: 'finalized-index-or-live',
+                freshness: 'bounded',
+            });
+            if (authority.kind === 'public')
+                return 'public';
+            return authority.kind === 'unavailable' ? 'unknown' : 'not-public';
+        }
+        catch {
+            return 'unknown';
+        }
+    }
+    createOnDemandAgentsPhonebookDeps() {
+        const ctx = createOperationContext('sync');
+        return {
+            isEnabled: () => this.onDemandAgentsPhonebookEnabled(),
+            remoteCuratorWallet: (contextGraphId) => {
+                const curatorDid = deriveCuratorDidFromCgId(contextGraphId);
+                if (curatorDid === null)
+                    return null;
+                const wallet = curatorDid.slice(AGENT_DID_PREFIX.length);
+                const walletKey = wallet.toLowerCase();
+                for (const address of this.localAgents.keys()) {
+                    if (address.toLowerCase() === walletKey)
+                        return null;
+                }
+                return wallet;
+            },
+            isActiveSubscription: (contextGraphId) => {
+                const subscription = this.subscribedContextGraphs.get(contextGraphId);
+                return subscription?.subscribed === true || subscription?.coreHosted === true;
+            },
+            phonebookHasWallet: async (wallet, signal) => (await this.discovery.findAgentPeerPageByAddress(wallet, { limit: 1, signal })).peerIds.length > 0,
+            // The same resolution a private share runs: a verified, unrevoked key.
+            recipientKeyKnown: async (wallet) => {
+                try {
+                    return (await resolveWorkspaceAgentRecipientKeys(this.store, wallet)).length > 0;
+                }
+                catch {
+                    return false;
+                }
+            },
+            readAccessPolicy: (contextGraphId, signal) => (this.readAgentsPhonebookAccessPolicy(contextGraphId, signal)),
+            listConnectedPeers: () => {
+                const peers = new Map();
+                for (const connection of this.node.libp2p.getConnections()) {
+                    const peerId = connection.remotePeer.toString();
+                    if (peerId === this.peerId || peers.has(peerId))
+                        continue;
+                    peers.set(peerId, { peerId, core: this.peerCapabilityRegistry?.supportsCore(peerId) === true });
+                }
+                return [...peers.values()];
+            },
+            // Network admission first (#2740): a peer of another DKG network, or
+            // one that failed the identity proof, never feeds the phonebook.
+            preparePeer: async (peerId, signal) => (await this.ensurePeerAdmittedForRecovery(peerId, ctx, 'Agents phonebook peer', signal)
+                && await this.waitForSyncProtocol({ toString: () => peerId }, signal)),
+            // A caller signal and wall-clock budget select the row-paged legacy
+            // durable lane, which is the right lane for the large `agents` graph.
+            syncAgentsFromPeer: async (peerId, { signal, totalTimeoutMs }) => {
+                const result = await this.syncFromPeerDetailed(peerId, [SYSTEM_CONTEXT_GRAPHS.AGENTS], undefined, undefined, undefined, {
+                    signal,
+                    totalTimeoutMs,
+                    stopOnBackoffWorthyFailure: true,
+                    source: 'catchup-background',
+                });
+                return {
+                    fetchedTriples: result.fetchedDataTriples + result.fetchedMetaTriples,
+                    insertedTriples: result.insertedTriples,
+                    complete: result.complete,
+                };
+            },
+            onCuratorsResolved: (contextGraphIds) => {
+                this.scheduleVmRecoveryForResolvedCurators(contextGraphIds);
+            },
+            logInfo: (message) => this.log.info(ctx, message),
+            logDebug: (message) => this.log.debug(ctx, message),
+        };
+    }
+}
+//# sourceMappingURL=dkg-agent-agents-phonebook.js.map

package/dist/dkg-agent-agents-phonebook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dkg-agent-agents-phonebook.js","sourceRoot":"","sources":["../src/dkg-agent-agents-phonebook.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kCAAkC,EAAE,MAAM,qCAAqC,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,mCAAmC,GAIpC,MAAM,sCAAsC,CAAC;AAE9C,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IACtD;;;;OAIG;IACH,8BAA8B;QAC5B,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI;eACvB,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,EAAE,IAAI,CAAC;eACtF,mCAAmC,CAAC;gBACrC,GAAG,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/C,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB;gBACxD,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;aAC7D,CAAC,CAAC;IACP,CAAC;IAED,2EAA2E;IAC3E,uBAAuB;QACrB,OAAO,0BAA0B,CAC/B,IAAI,EACJ,GAAG,EAAE,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,iCAAiC,EAAE,CAAC,CACnF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,8BAA8B,CAE5B,cAAsB,EACtB,OAAoC;QAEpC,IAAI,CAAC;YACH,IAAI,CAAC,uBAAuB,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,+BAA+B,CAEnC,OAA0B,EAC1B,MAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,+BAA+B,CAEnC,cAAsB,EACtB,MAAmB;QAEnB,MAAM,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sCAAsC,CAAC,cAAc,EAAE;gBAClF,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;oBACtB,MAAM;oBACN,WAAW,CAAC,OAAO,CAAC,uBAAuB,GAAG,gBAAgB,CAAC;iBAChE,CAAC;gBACF,qBAAqB,EAAE,uBAAuB;gBAC9C,iBAAiB,EAAE,yBAAyB;gBAC5C,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YACjD,OAAO,SAAS,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,iCAAiC;QAC/B,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE;YACtD,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE;gBACtC,MAAM,UAAU,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;gBAC5D,IAAI,UAAU,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC9C,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,SAAS;wBAAE,OAAO,IAAI,CAAC;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,oBAAoB,EAAE,CAAC,cAAc,EAAE,EAAE;gBACvC,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACtE,OAAO,YAAY,EAAE,UAAU,KAAK,IAAI,IAAI,YAAY,EAAE,UAAU,KAAK,IAAI,CAAC;YAChF,CAAC;YACD,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAC5C,MAAM,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAC9E,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,uEAAuE;YACvE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBAClC,IAAI,CAAC;oBACH,OAAO,CAAC,MAAM,kCAAkC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,gBAAgB,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,CAC5C,IAAI,CAAC,+BAA+B,CAAC,cAAc,EAAE,MAAM,CAAC,CAC7D;YACD,kBAAkB,EAAE,GAAG,EAAE;gBACvB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6C,CAAC;gBACnE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAChD,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;wBAAE,SAAS;oBAC1D,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAClG,CAAC;gBACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7B,CAAC;YACD,qEAAqE;YACrE,iEAAiE;YACjE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CACrC,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,CAAC;mBACnF,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CACtE;YACD,oEAAoE;YACpE,sEAAsE;YACtE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE;gBAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC5C,MAAM,EACN,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAC9B,SAAS,EACT,SAAS,EACT,SAAS,EACT;oBACE,MAAM;oBACN,cAAc;oBACd,0BAA0B,EAAE,IAAI;oBAChC,MAAM,EAAE,oBAAoB;iBAC7B,CACF,CAAC;gBACF,OAAO;oBACL,cAAc,EAAE,MAAM,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB;oBACrE,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC;YACJ,CAAC;YACD,kBAAkB,EAAE,CAAC,eAAe,EAAE,EAAE;gBACtC,IAAI,CAAC,qCAAqC,CAAC,eAAe,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;YACjD,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;SACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/dkg-agent-base.d.ts

@@ -1,3 +1,7 @@
+export { createListContextGraphsCacheInvalidatingStore } from './internal/context-graph-cache-invalidating-store.js';
+import type { VmRecoveryCoreTransportPreferencePolicy } from './vm-recovery-core-transport-preference.js';
+import { VmRecoveryTransportBudgetPolicy } from './vm-recovery-transport-budget-policy.js';
+import { VmRecoveryStreamSetbackPolicy } from './vm-recovery-stream-setback-policy.js';
 import type { RandomSamplingRuntime } from './random-sampling-runtime.js';
 import { PeerSyncSession } from './sync/peer-sync-session.js';
 import { PeerCapabilityRegistry } from './p2p/peer-capability.js';
@@ -16,14 +20,17 @@ import { Rfc64CatalogMutationCoordinatorV1 } from './rfc64/catalog-mutation-runt
 import type { Rfc64CatalogRuntimeV1 } from './rfc64/catalog-runtime-v1.js';
 import type { Rfc64CatalogShadowObservabilityRuntimeV1 } from './rfc64/catalog-shadow-observability-v1.js';
 import { ContextGraphMembershipPersistScheduler } from './context-graph-membership-persist-scheduler.js';
+import { ContextGraphSubscriptionPersistScheduler } from './context-graph-subscription-persist-scheduler.js';
+import { GossipSession } from './gossip-session.js';
 import { ContextGraphBindingState } from './context-graph-binding-state.js';
+import { SlotFactsIndex } from './context-graph-claim-proof.js';
 import type { CoalescingRecurringTask } from './coalescing-recurring-task.js';
 import { SelectedSwmBootstrapAdmission } from './sync/selected-swm-bootstrap-admission.js';
 import { type SwmTargetExecutorPortsV1, type SwmTargetExecutorV1 } from './sync/requester/swm-target-executor.js';
 import type { Rfc64SwmRecoveryCoordinatorV1 } from './rfc64/swm-recovery-coordinator-v1.js';
 import type { Rfc64SwmRecoveryRuntimeV1 } from './dkg-agent-rfc64-swm-recovery-runtime.js';
-import { DKGNode, ProtocolRouter, GossipSubManager, TypedEventBus, PeerResolver, Logger, type SubscriptionSource } from '@origintrail-official/dkg-core';
-import { type TripleStore, type Quad, type QueryOptions, type SortedGraphSetSource } from '@origintrail-official/dkg-storage';
+import { DKGNode, ProtocolRouter, GossipSubManager, TypedEventBus, PeerResolver, Logger } from '@origintrail-official/dkg-core';
+import { type TripleStore, type Quad, type QueryOptions } from '@origintrail-official/dkg-storage';
 import { type ChainAdapter, type ContextGraphAuthorityReaderCapability, type KnowledgeAssetVersionSnapshot, type RpcUsageWindow } from '@origintrail-official/dkg-chain';
 import { DKGPublisher, SharedMemoryHandler, ChainEventPoller, type AsyncPromoteQueue, type AsyncPromoteQueueConfig, type PromoteTerminalJobClearer, type WorkspacePublicSnapshotStore } from '@origintrail-official/dkg-publisher';
 import { DKGQueryEngine } from '@origintrail-official/dkg-query';
@@ -49,7 +56,8 @@ import { FinalizationHandler } from './finalization-handler.js';
 import { RecentReconcileEvidenceMap, RecentUalSet, type VmReconcileSchedulingRuntime } from './chain-reconciler.js';
 import type { ContextGraphReconcileResult } from './vm-reconcile-service.js';
 import { type CursorState } from './reconcile-cursor.js';
-import { type LocalSwmSenderKeySendState, type LocalSwmSenderKeyReceiveState, type PendingSenderKeyEntry, type PeerHealth, type ContextGraphSub, type ContextGraphSubscriptionRehydrationInternalStatus, type VmReconcileNegativeRecord, type VmReconcilePeerTopology, type SelectedVmReconcileCursorRecord, type VmReconcileRotationRecord, type ResolvedDKGAgentConfig } from './dkg-agent-types.js';
+import { VmRefreshQueue } from './vm-refresh.js';
+import { type LocalSwmSenderKeySendState, type LocalSwmSenderKeyReceiveState, type PendingSenderKeyEntry, type PeerHealth, type ContextGraphSub, type ContextGraphSubscriptionRehydrationInternalStatus, type SelectedVmReconcileCursorRecord, type VmReconcileRotationRecord, type ResolvedDKGAgentConfig } from './dkg-agent-types.js';
 import type { SyncCheckpointStore, ChangelogCursorStore } from './sync/checkpoint/state.js';
 import { ContextGraphMetaProjection } from './context-graph-meta-projection.js';
 import { ContextGraphJoinAdmissionLockManager } from './context-graph-join-admission-lock.js';
@@ -58,7 +66,44 @@ import { LocalContextGraphProvenance } from './local-context-graph-provenance.js
 import { type VmPromotionAuditStatus } from './vm-promotion-audit.js';
 import type { ContextGraphStorageDiscovery, OnChainContextGraphFacts } from './context-graph-storage-discovery.js';
 import { type ChainAuthorityReadBudgets } from './chain-authority-read-budgets.js';
-export declare function createListContextGraphsCacheInvalidatingStore(innerStore: TripleStore, invalidate: () => void, markProjectionDirty?: (quads?: readonly Quad[], targetGraph?: string) => void): TripleStore & Partial<SortedGraphSetSource>;
+/**
+ * Same-instance restart contract.
+ *
+ * `stop()` followed by `start()` on the SAME `DKGAgent` instance is a supported
+ * lifecycle: `start()` re-opens the runtimes `stop()` closed, and reuses
+ * `this.node` (whose `DKGNode.start()` creates a brand-new libp2p node every
+ * time). Every instance field is exactly one of three kinds:
+ *
+ * 1. Session-scoped, bound to the libp2p node and its `GossipSubManager`.
+ *    `start()` builds a new manager with zero subscriptions and zero handlers,
+ *    so anything that records "topic X is subscribed and handler Y is
+ *    installed on the manager" describes a dead object once the session ends.
+ *    The subscribe helpers short-circuit on these records, so a stale copy
+ *    makes a restarted node silently deaf: `gossipRegistered`,
+ *    `sharedMemoryGossipRegistered`, `swmHostModeSubscribed`,
+ *    `swmHostModeCurated` and `swmHostModeHandlers`. They live with that
+ *    manager in one {@link GossipSession}, retired as a unit by `stop()`.
+ * 2. Session-scoped, owned by a lifecycle runtime that `stop()` closes and
+ *    `start()` re-opens or rebuilds: the router, messenger, peer resolver and
+ *    network admission, the peer-sync session, the chain and VM-reconcile
+ *    schedulers and their lifecycle generation, the RFC-64 dispatcher and
+ *    catalog runtimes, the membership-persistence scheduler, the StorageACK
+ *    registration runtime, random sampling, the host-mode store, and every
+ *    timer.
+ * 3. Durable across `stop()`/`start()` (everything else): subscription INTENT
+ *    (`subscribedContextGraphs`, `config.syncContextGraphs`), disconnect
+ *    history (`lastSyncDisconnectedAt`), local agents, the beacon registry,
+ *    and the process-lifetime caches and counters. They are keyed by durable
+ *    identifiers (context graph id, peer id, agent address) and are
+ *    reconciled lazily.
+ *
+ * `start()` re-derives kind 1 from kind 3, so that a restart ends in the state
+ * a fresh process would reach from the same durable stores, plus the
+ * process-local (on-demand, or store-less) subscriptions that were live:
+ * `start()` snapshots live intents, then the durable startup read removes its
+ * rows from that plan and replays them behind the authority gate. The same
+ * subscription wiring applies the remaining process-local intents.
+ */
 export declare class DKGAgentBase {
     readonly wallet: AgentWallet;
     readonly node: DKGNode;
@@ -84,7 +129,9 @@ export declare class DKGAgentBase {
      * these overrides folded into the defaults.
      */
     protected _promoteQueueConfig?: Partial<AsyncPromoteQueueConfig>;
-    gossip: GossipSubManager;
+    protected gossipSession: GossipSession;
+    get gossip(): GossipSubManager;
+    set gossip(manager: GossipSubManager);
     router: ProtocolRouter;
     messenger: Messenger;
     networkAdmission: NetworkAdmissionService;
@@ -117,7 +164,7 @@ export declare class DKGAgentBase {
     protected readonly lastHostCatchupSeqno: Map<string, Map<string, number>>;
     /** Shared write locks so gossip writes serialize against local CAS writes. */
     protected readonly writeLocks: Map<string, Promise<void>>;
-    protected readonly publicSnapshotStore?: WorkspacePublicSnapshotStore;
+    readonly publicSnapshotStore?: WorkspacePublicSnapshotStore;
     private swmTargetExecutorSessionFactoryV1?;
     protected sharedMemoryHandler?: InstanceType<typeof SharedMemoryHandler>;
     protected gossipPublishHandler?: GossipPublishHandler;
@@ -161,14 +208,20 @@ export declare class DKGAgentBase {
      * subscribed via beacon" from "restored on restart" should consult
      * the daemon log at subscribe time, not the live `subscriptionSource`
      * field.
+     *
+     * Session-scoped, together with {@link swmHostModeCurated} and
+     * {@link swmHostModeHandlers}: they describe handlers installed on the
+     * current `GossipSubManager` and are owned by its {@link GossipSession}
+     * (restart contract on {@link DKGAgentBase}). The persisted host-mode
+     * markers in `swmHostModeStore` are the durable side.
      */
-    protected readonly swmHostModeSubscribed: Map<string, SubscriptionSource>;
+    protected get swmHostModeSubscribed(): Map<string, import("@origintrail-official/dkg-core").SubscriptionSource>;
     /**
      * Cached curation classification for each host-mode handler. The handler
      * reads this map before dispatch so the strip can cover both legacy and
      * chunked envelopes without a store-backed policy lookup per message.
      */
-    protected readonly swmHostModeCurated: Map<string, boolean>;
+    protected get swmHostModeCurated(): Map<string, boolean>;
     /**
      * Per-CG reference to the host-mode gossip handler closure. Kept
      * so we can call `gossip.offMessage(topic, handler)` to remove
@@ -182,7 +235,7 @@ export declare class DKGAgentBase {
      * Keyed by the canonical wire-form id (same invariant as
      * `swmHostModeSubscribed`); see {@link canonicalSwmHostModeKey}.
      */
-    protected readonly swmHostModeHandlers: Map<string, (topic: string, data: Uint8Array, from: string) => void>;
+    protected get swmHostModeHandlers(): Map<string, (topic: string, data: Uint8Array, from: string) => void>;
     /** Async lock for the host-mode reconciler so simultaneous calls don't double-subscribe. */
     protected hostModeReconcileInflight?: Promise<void>;
     /** Rotating cursor for bounded host-mode reconcile sweeps over known context graphs. */
@@ -385,6 +438,8 @@ export declare class DKGAgentBase {
     static readonly VM_PROMOTION_AUDIT_MAX_CHAIN_CHECKS = 32;
     /** Ledgered copies one audit pass examines (local reads only), keyset paged. */
     static readonly VM_PROMOTION_AUDIT_PAGE_SIZE = 1000;
+    /** Max ledger rows checked for VM promotion in one graph-scoped store query. */
+    static readonly VM_PROMOTION_AUDIT_PROMOTED_BATCH_SIZE = 64;
     /** Ledger namespaces one backfill pass pages through. */
     static readonly VM_PROMOTION_BACKFILL_PAGE_SIZE = 256;
     /** Per-asset VM reconciles one audit pass may run for landed copies. */
@@ -406,12 +461,13 @@ export declare class DKGAgentBase {
     /** Maximum unbound subscription read-authority/binding attempts per periodic sweep. */
     static readonly VM_RECONCILE_UNBOUND_BATCH_SIZE = 8;
     static readonly VM_RECONCILE_CACHE_MAX_ENTRIES: number;
-    static readonly VM_RECONCILE_SWM_GEN_FINGERPRINT_MAX_ROWS: number;
     static readonly VM_RECONCILE_CG_STATE_MAX_ENTRIES: number;
     /** Maximum peers connected/probed/transported by one exact-recovery pass. */
     static readonly VM_RECONCILE_EXACT_PEER_MAX = 3;
     /** How long a clean legacy exact-filter miss suppresses one peer. */
     static readonly VM_RECONCILE_EXACT_CAPABILITY_TTL_MS: number;
+    /** Transport affinity is short-lived and never establishes asset coverage. */
+    static readonly VM_RECONCILE_PUBLIC_CORE_TRANSPORT_TTL_MS: number;
     /** Bounded proof universe retained across passes; transport still uses the cap above. */
     static readonly VM_RECONCILE_EXACT_ROSTER_MAX = 256;
     static readonly VM_RECONCILE_QUEUE_MAX_PENDING: number;
@@ -421,6 +477,8 @@ export declare class DKGAgentBase {
      * latency and the per-request UAL filter.
      */
     static readonly VM_RECONCILE_BATCH_SIZE: number;
+    /** Maximum bound graphs one timer sweep admits before yielding to live work. */
+    static readonly VM_RECONCILE_PERIODIC_BOUND_BATCH_SIZE: number;
     /** Hard ceiling: RS heal is best-effort maintenance and must stay bounded. */
     static readonly RS_HEAL_BATCH_MAX = 64;
     /**
@@ -450,6 +508,59 @@ export declare class DKGAgentBase {
      * registration before trusting the watermark".
      */
     static readonly VM_RECONCILE_CONFIRMATION_DEPTH: number;
+    /**
+     * #2858 — confirmed VM copies waiting for a refresh after a KA update, held
+     * process-wide. Each entry is one (graph, KA) pair, a few hundred bytes. A
+     * full set refuses a new target, which holds the update event lane at that
+     * event until targets settle or are given up.
+     */
+    static readonly VM_REFRESH_MAX_ENTRIES = 4096;
+    /**
+     * #2858 — age, from its first offer, at which a refresh target that never
+     * settled is given up (an unreachable holder, a graph whose pass no longer
+     * runs). It then no longer holds the event lane's persisted cursor or a
+     * slot, and its copy waits for the KA's next update or an asset fetch.
+     */
+    static readonly VM_REFRESH_MAX_AGE_MS: number;
+    /**
+     * Refresh attempts one refresh worker runs for its graph. Each is a few
+     * chain reads plus one exact fetch that asks at most
+     * `VM_RECONCILE_EXACT_PEER_MAX` peers; more due targets continue in the
+     * graph's next pass.
+     */
+    static readonly VM_REFRESH_MAX_PER_PASS = 2;
+    /**
+     * Refresh workers running at once across graphs. A worker runs beside its
+     * graph's reconcile pass, never inside it, so this keeps the lane within the
+     * dispatcher's own concurrency.
+     */
+    static readonly VM_REFRESH_MAX_WORKERS = 2;
+    /**
+     * Wall clock for each network step of a refresh attempt that runs before
+     * any data moves: resolving the graph's curators, and connecting, probing
+     * and admitting one candidate peer. Without it these steps follow only the
+     * VM lifecycle signal, which never fires in normal operation, and a libp2p
+     * dial given a caller signal has no deadline of its own, so one peer that
+     * cannot be reached held the whole attempt. A peer past it is skipped for
+     * the next candidate; curator resolution past it falls back to connected
+     * peers.
+     */
+    static readonly VM_REFRESH_PEER_STEP_TIMEOUT_MS = 20000;
+    /**
+     * Backstop for one whole refresh attempt, above the per-step bounds and the
+     * durable sync's own transfer budget for up to `VM_RECONCILE_EXACT_PEER_MAX`
+     * peers. An attempt past it is retried after backoff.
+     */
+    static readonly VM_REFRESH_ATTEMPT_TIMEOUT_MS: number;
+    /**
+     * Delay before refreshing a copy whose workspace already stages a newer
+     * version. The lane that staged it (the publisher's own update, a core's
+     * StorageACK pending-update lane) promotes it within seconds of the
+     * confirmation. On a member nothing does (a curator's shared memory it
+     * recovered after a restart, for example), so the refresh takes over once
+     * this has passed; the graph's next reconcile pass starts it.
+     */
+    static readonly VM_REFRESH_STAGED_GRACE_MS = 30000;
     static readonly LIST_CONTEXT_GRAPHS_CACHE_TTL_MS: number;
     static readonly LIST_CONTEXT_GRAPHS_CACHE_MAX: number;
     static readonly LIST_CONTEXT_GRAPHS_ROW_BUDGET_MS: number;
@@ -568,16 +679,20 @@ export declare class DKGAgentBase {
     protected get storageAckHandlerRegistered(): boolean;
     /** StorageACK declines per minute bucket and code, for the last hour. */
     protected readonly storageAckDeclineBuckets: Map<number, Map<string, number>>;
-    /** Phase D/A4 — per-UAL retry damping after a chain ordinal has no matching local SWM snapshot. */
-    protected readonly vmReconcileNegativeCache: Map<string, Omit<VmReconcileNegativeRecord, "cleanMissPeerIds" | "peerTopology" | "cacheKey" | "peerTopologyKey"> & {
-        peerTopology: VmReconcilePeerTopology;
-        cleanMissPeerIds: string[];
-    }>;
-    /** Bounded access-ordered keys already consulted in the durable store. */
-    protected readonly vmReconcileNegativeCacheHydrated: Map<string, string>;
-    protected readonly vmReconcileNegativeCacheKeysByCg: Map<string, Set<string>>;
     /** Bounded, process-local clean-absence rotations for production VM recovery. */
     protected readonly vmReconcileRotationState: Map<string, VmReconcileRotationRecord>;
+    protected readonly vmReconcileTransportBudgetPolicy: VmRecoveryTransportBudgetPolicy;
+    /** What a busy or broken exact-batch stream costs its peer in a graph's recovery. */
+    protected readonly vmReconcileStreamSetbackPolicy: VmRecoveryStreamSetbackPolicy;
+    /**
+     * #2858 — confirmed VM copies behind an on-chain update, queued by the
+     * `KnowledgeAssetUpdated` nudge and worked off by a refresh worker each
+     * graph's reconcile pass starts. Retries follow the recovery backoff (sweep
+     * interval, doubling, to the recovery ceiling).
+     */
+    protected readonly vmRefreshQueue: VmRefreshQueue;
+    /** #2858 — the running refresh worker of each graph, at most one per graph. */
+    protected readonly vmRefreshWorkers: Map<string, Promise<void>>;
     /** Next stable batch index to consider when the bounded rotation cache has waiters. */
     protected readonly vmReconcileRotationAdmissionCursorByCg: Map<string, number>;
     /** Last resolved curator peers, used to keep the capped exact-recovery roster authoritative. */
@@ -591,12 +706,23 @@ export declare class DKGAgentBase {
         connectionKey: string;
         expiresAt: number;
     }>;
+    /** Owns process-local Core ordering and reusable-holder transitions. */
+    protected vmReconcilePublicCoreTransportPreferencePolicy: VmRecoveryCoreTransportPreferencePolicy;
     /** Exclusive peer-id cursor used to walk oversized curator registries. */
     protected readonly vmReconcileCuratorPageCursorByCg: Map<string, string>;
     /** Bounded per-principal persistence lanes keep compensation ordered without heap backlog. */
     protected readonly contextGraphMembershipPersistence: ContextGraphMembershipPersistScheduler;
     protected contextGraphMembershipPersistenceShutdownBlocked: boolean;
     static readonly CONTEXT_GRAPH_MEMBERSHIP_PERSIST_SHUTDOWN_TIMEOUT_MS = 5000;
+    /**
+     * Per-context-graph subscription store writes. Membership and subscription
+     * lanes stay separate instances of one scheduler type: a join approval
+     * enqueues a subscription write from inside a membership write, which needs
+     * the two to make progress independently.
+     */
+    protected readonly contextGraphSubscriptionPersistence: ContextGraphSubscriptionPersistScheduler;
+    protected contextGraphSubscriptionPersistenceShutdownBlocked: boolean;
+    static readonly CONTEXT_GRAPH_SUBSCRIPTION_PERSIST_SHUTDOWN_TIMEOUT_MS = 5000;
     /** Late exact responses must not mutate rotation state after shutdown begins. */
     protected vmReconcileRotationClosed: boolean;
     /** Monotonic guard: every VM reconcile continuation from an earlier node run stays stale. */
@@ -669,6 +795,11 @@ export declare class DKGAgentBase {
     protected readonly rfc64PublicCatalogSynchronizationEvidenceV1: Map<string, Rfc64CatalogSynchronizationEvidenceV1>;
     /** Bounded process-local terminal receiver failures, keyed by announced head. */
     protected readonly rfc64PublicCatalogReconciliationFailuresV1: Rfc64PublicCatalogReconciliationFailureRegistryV1;
+    /**
+     * Subscription INTENT per context graph. Durable across `stop()`/`start()`
+     * (restart contract on {@link DKGAgentBase}): only the gossip wiring derived
+     * from it is session-scoped and re-established by `start()`.
+     */
     protected readonly subscribedContextGraphs: Map<string, ContextGraphSub>;
     /**
      * Process-local fence for a registration operation whose durable marker has
@@ -697,7 +828,6 @@ export declare class DKGAgentBase {
     protected readonly contextGraphSubscriptionPersistAppliedRevisions: Map<string, number>;
     protected readonly contextGraphSubscriptionPersistCanceledRevisions: Map<string, number>;
     protected readonly contextGraphSubscriptionPersistPendingRevisions: Map<string, Set<number>>;
-    protected readonly contextGraphSubscriptionPersistChains: Map<string, Promise<void>>;
     protected readonly listContextGraphsCache: Map<string, {
         expiresAt: number;
         rows: Array<Record<string, unknown>>;
@@ -723,15 +853,19 @@ export declare class DKGAgentBase {
      * 2026-07-08 mainnet poison-literal retry storm).
      */
     protected insertSyncedQuadsAndInvalidateListCache(quads: Quad[], options?: QueryOptions): Promise<void>;
-    protected readonly gossipRegistered: Set<string>;
-    protected readonly sharedMemoryGossipRegistered: Set<string>;
+    protected get gossipRegistered(): Set<string>;
+    protected get sharedMemoryGossipRegistered(): Set<string>;
+    /** Retire the owner without touching durable subscription or host-mode intent. */
+    protected retireGossipSession(): void;
     protected readonly seenOnChainIds: Set<string>;
     /**
      * Chain-public facts per on-chain Context Graph id (decimal), merged from the
      * live `ContextGraphCreated` tail and ContextGraphStorage enumeration. Feeds
-     * the `onChain` field of `listContextGraphs` rows; never an authority input.
+     * the `onChain` field of `listContextGraphs` rows and the proof of off-chain
+     * on-chain id claims (indexed by committed name hash for that); never an
+     * authority input on its own.
      */
-    protected readonly onChainContextGraphFacts: Map<string, OnChainContextGraphFacts>;
+    protected readonly onChainContextGraphFacts: SlotFactsIndex<OnChainContextGraphFacts>;
     /** Lazily built ContextGraphStorage id enumeration (historical discovery). */
     protected contextGraphStorageDiscovery?: ContextGraphStorageDiscovery | null;
     /** One-shot guard for the "ContextGraphNameRegistry is not in the Hub" notice. */
@@ -1089,7 +1223,9 @@ export declare class DKGAgentBase {
     /**
      * Per-peer timestamp of the last time all live connections to that peer
      * were gone. Used to avoid suppressing reconnect catch-up with a
-     * `lastSuccessfulSyncAt` value from before an offline gap.
+     * `lastSuccessfulSyncAt` value from before an offline gap. Durable across
+     * `stop()`/`start()` on purpose: `stop()` records every still-connected peer
+     * here, and the restarted session reads it on reconnect.
      */
     protected readonly lastSyncDisconnectedAt: Map<string, number>;
     /** Peer + selected-CG scoped seed/retry/terminal state for RFC-64 SWM. */
@@ -1146,6 +1282,8 @@ export declare class DKGAgentBase {
     */
     protected readonly pendingSenderKeyByAgent: Map<string, PendingSenderKeyEntry[]>;
     protected readonly pendingSenderKeyDrainByAgent: Map<string, Promise<number>>;
+    /** Agent-wide serialization for the single SWM sender-key state file. */
+    protected swmSenderKeyStateSaveQueue: Promise<void>;
     /** Per-CG serialized host-mode persistence queue (moved here from the host-mode cluster during the mixin split). */
     protected readonly hostModePersistenceQueues: Map<string, Promise<void>>;
     /** System graph holding agent-registry triples (moved here so holder classes can reference it). */