@origintrail-official/dkg-agent 10.0.20 → 10.0.21

package/dist/dkg-agent-lifecycle.js

@@ -1,3 +1,6 @@
+import { syncReconcilerEnabled, syncOnConnectEnabled, durableSyncEnabled } from './internal/lifecycle-sync-policy.js';
+import { emptySwmRecoveryResult } from './sync/shared-memory-completion.js';
+import { DurableSyncAdmissionBoundary } from './sync/requester/admission-boundary.js';
 import { createRandomSamplingEligibilityResolver } from './random-sampling-eligibility.js';
 import { RandomSamplingRuntime } from './random-sampling-runtime.js';
 import { startAuthorityIndexSnapshotRuntime } from './authority-index-snapshot-runtime.js';
@@ -12,10 +15,11 @@ import { startAuthorityIndexSnapshotRuntime } from './authority-index-snapshot-r
 import { traverseBoundedCuratorRoster, curatorRosterResolution, } from './bounded-curator-roster-traversal.js';
 import { setTimeout as waitForPeerEventTurn } from 'node:timers/promises';
 import { PeerSyncSession } from './sync/peer-sync-session.js';
+import { captureExactBatchStreamRefusalScope } from './sync/exact-batch-stream-capability.js';
 import { createStorageACKRegistrationPlan } from './p2p/storage-ack-registrar.js';
 import { syncOpenedPeerConnection } from './sync/peer-connection.js';
 import { isLegacySyncGraphCandidateV1 } from './sync/legacy-sync-graph-candidate.js';
-import { ProtocolRouter, GossipSubManager, DKGEvent, LibP2PNetwork, PeerResolver, StubNetworkStateRegistry, PROTOCOL_ACCESS, PROTOCOL_PUBLISH, PROTOCOL_SYNC, PROTOCOL_SYNC_POOLED, PROTOCOL_SYNC_CHANGELOG, PROTOCOL_QUERY_REMOTE, PROTOCOL_GET_CIPHERTEXT_CHUNK, PROTOCOL_VERIFY_PROPOSAL, PROTOCOL_JOIN_REQUEST, PROTOCOL_NETWORK_IDENTITY, advertisesSyncProtocol, PROTOCOL_SWM_SENDER_KEY, PROTOCOL_SWM_UPDATE, PROTOCOL_SWM_SHARE_ACK, PROTOCOL_SWM_HOST_CATCHUP, PROTOCOL_MESSAGE, contextGraphDataGraphUri, contextGraphMetaGraphUri, contextGraphWorkspaceMetaGraphUri, contextGraphMetaUri, deriveCuratorDidFromCgId, SYSTEM_CONTEXT_GRAPHS, DKG_ONTOLOGY, GRAPH_KA_CONTENT_SCOPE_VERSION, validateSubGraphName, createOperationContext, isSafeIri, QuietRetryableHandlerError, InMemoryMessageIdempotencyStore, InMemoryProtocolOutboxStore, assertBoundedProtocolOutboxStore, tripleContentV10, withRetry, } from '@origintrail-official/dkg-core';
+import { ProtocolRouter, GossipSubManager, DKGEvent, registerExperimentalExactBatchResponder, LibP2PNetwork, PeerResolver, StubNetworkStateRegistry, PROTOCOL_ACCESS, PROTOCOL_PUBLISH, PROTOCOL_SYNC, PROTOCOL_SYNC_POOLED, PROTOCOL_SYNC_CHANGELOG, PROTOCOL_QUERY_REMOTE, PROTOCOL_GET_CIPHERTEXT_CHUNK, PROTOCOL_VERIFY_PROPOSAL, PROTOCOL_JOIN_REQUEST, PROTOCOL_NETWORK_IDENTITY, advertisesSyncProtocol, PROTOCOL_SWM_SENDER_KEY, PROTOCOL_SWM_UPDATE, PROTOCOL_SWM_SHARE_ACK, PROTOCOL_SWM_HOST_CATCHUP, PROTOCOL_MESSAGE, contextGraphDataGraphUri, contextGraphMetaGraphUri, contextGraphWorkspaceMetaGraphUri, contextGraphMetaUri, deriveCuratorDidFromCgId, SYSTEM_CONTEXT_GRAPHS, DKG_ONTOLOGY, GRAPH_KA_CONTENT_SCOPE_VERSION, validateSubGraphName, createOperationContext, isSafeIri, QuietRetryableHandlerError, InMemoryMessageIdempotencyStore, InMemoryProtocolOutboxStore, assertBoundedProtocolOutboxStore, tripleContentV10, withRetry, } from '@origintrail-official/dkg-core';
 import { GraphManager, asChangelogReader } from '@origintrail-official/dkg-storage';
 import { readChangelogDeltaPage } from './sync/responder/graph-plan.js';
 import { decodeChangelogRequest, encodeChangelogResponse } from './sync/changelog/wire.js';
@@ -54,6 +58,7 @@ import { deleteSyncPageCheckpoint, fetchSyncPages, SyncPageSizeProfileCache, } f
 import { composeSyncWorkAdmission, createSyncFetchSharingIdentity, } from './sync/work-admission.js';
 import { createChallengePinnedExactAssetSelection, createUalOnlyExactAssetSelection, exactAssetUalsForSelection, exactAssetFilterKey, exactSyncPhaseAccumulationLimits, requireExactAssetSelection, } from './sync/exact-assets.js';
 import { runOversizeSweep } from './sync/oversize-sweep.js';
+import { EXACT_SYNC_GZIP_ENCODING, resolveExactSyncGzipProfile } from './sync/wire-compression.js';
 import { MemorySyncCheckpointStore, } from './sync/checkpoint/state.js';
 import { DurableRecoveryRunner, } from './sync/durable-recovery-runner.js';
 import { createDurableSyncBudget, createDurableSyncFetchTimeoutMs, DURABLE_SYNC_SETTLEMENT_HEADROOM_MS, EXACT_RECOVERY_DURABLE_TRANSFER_TIMEOUT_MS, normalizeDurableSyncTimeoutMs, } from './sync/requester/durable-sync-budget.js';
@@ -63,23 +68,26 @@ import { mergeExactAssetResponderCapability, mergeExactDurableFetchDisposition,
 import { resolveSyncAgentsMeta, shouldWithholdAgentsDurableMeta } from './sync/agents-meta-policy.js';
 import { createSelectedSwmMetaRetentionBudget, } from './sync/selected-swm-meta-budget.js';
 import { sharedMemoryOwnershipKeyFromGraph, } from './sync/requester/shared-memory-sync.js';
-import { emptySharedMemorySyncResult as createEmptySharedMemorySyncResult, mergeFleetSharedMemoryDiagnostics, mergeSamePeerSharedMemoryDiagnostics, recordSharedMemoryPhaseFailure, } from './sync/shared-memory-diagnostics.js';
+import { emptySharedMemorySyncResult, mergeSamePeerSharedMemoryDiagnostics, mergeFleetSharedMemoryDiagnostics, recordSharedMemoryPhaseFailure, } from './sync/shared-memory-diagnostics.js';
 import { createSelectedSwmMetaFetcher, } from './sync/selected-swm-meta-fetcher.js';
 import { runOrderedContextGraphSyncs, } from './sync/requester/ordered-sync.js';
 import { registerSyncHandler, resolveSyncResponderSnapshotPolicy, } from './sync/responder/sync-handler.js';
+import { createExactBatchResponderBinding } from './sync/responder/exact-batch-stream.js';
+import { exactBatchTransportOptions } from './sync/requester/exact-batch-stream.js';
+import { runExactBatchStreamDriver } from './sync/requester/exact-batch-stream-driver.js';
 import { runSelectedSharedMemoryRetry, runRegistrySyncOnConnect, SyncOnConnectPostSyncError, } from './sync/on-connect/sync-on-connect.js';
 import { captureSyncOnConnectAttempt, } from './sync/on-connect/attempt-accounting.js';
 import { ReconciledSyncOnConnectPeerJobRunner } from './sync/on-connect/peer-job-runner.js';
 import { formatPrivateRecoverySkip, planPrivateRecoverySource, } from './sync/private-recovery-source-planner.js';
 import { mapWithConcurrency } from './map-with-concurrency.js';
 import { CATCHUP_MAX_CONCURRENT_PEER_SYNCS } from './sync/catchup-concurrency.js';
-import { FOREGROUND_CATCHUP_SYNC_PRIORITY, catchupAdmissionSource, runCatchupPlaneWithPolicy, runCatchupPlanesWithPolicy, } from './sync/catchup-policy.js';
+import { FOREGROUND_CATCHUP_SYNC_PRIORITY, VM_RECOVERY_SYNC_PRIORITY, catchupAdmissionSource, runCatchupPlaneWithPolicy, runCatchupPlanesWithPolicy, } from './sync/catchup-policy.js';
 import { SwmCatchupPassTracker, catchupPassNowMs, resolveSwmCatchupPassConfig, runSwmCatchupContinuations, } from './sync/catchup-pass-policy.js';
 import { runSelectedSwmContinuations, } from './sync/selected-swm-continuation.js';
 import { projectRfc64SelectedSwmGraphSyncStatus, } from './sync/selected-swm-graph-sync-status.js';
 import { applySelectedSwmFreshnessResolution, } from './sync/shared-memory-freshness.js';
 import { classifyDurableProgress, createDurableSyncAccumulator, createFailedPeerDurableSyncResult, createIncompleteDurableSyncResult, durableSyncAccumulatorHasPeerTransportFailure, durableSyncAccumulatorHasTerminalBoundary, durableSyncAccumulatorFromResult, finalizeDurableSyncCompletion, markDurableTerminalBoundary, mergeDurableSyncAccumulatorInto, mergeDurableSyncResultIntoAccumulator, recordDurableSyncDiagnostics, } from './sync/durable-progress.js';
-import { getSyncBackpressureSnapshot, getSyncBackpressureBusyError, resolveBooleanSwitch, resolveSyncReconcilerEnabled, resolveSyncGlobalBackpressure, withGlobalSyncBackpressure, } from './sync/backpressure.js';
+import { getSyncBackpressureSnapshot, getSyncBackpressureBusyError, resolveExactBatchStreamEnabled, resolveSyncGlobalBackpressure, syncAdmissionWouldBeRefused, withGlobalSyncBackpressure, } from './sync/backpressure.js';
 import { contextGraphPriority, countSyncPriorityClasses, normalizeSyncAdmissionSource, orderContextGraphIdsByPriority, syncPriorityClass, } from './sync/policy.js';
 import { automaticDurableSyncContextGraphs, systemContextGraphSyncOptionsOf, } from './sync/system-context-graph-policy.js';
 import { activeSyncAdmissionSource, monotonicNowMs, recordSyncAttempt, recordSyncAttemptRequestBytes, recordSyncAttemptResponseBytes, recordSyncOperationDuration, recordSyncOperationRejected, recordSyncSingleFlightJoin, syncAttemptAttributes, syncOperationRejectionReason, withSyncAdmissionSource, } from './sync/attempt-telemetry.js';
@@ -189,6 +197,7 @@ import { normalizeAgentDid, inferAdapterPublisherAddress, } from './dkg-agent-he
 import { DKGAgentBase } from './dkg-agent-base.js';
 import { VmReconcileShutdownTimeoutError } from './vm-reconcile-service.js';
 import { ContextGraphMembershipPersistShutdownTimeoutError } from './context-graph-membership-persist-scheduler.js';
+import { ContextGraphSubscriptionPersistShutdownTimeoutError } from './context-graph-subscription-persist-scheduler.js';
 import { createLocalContextGraphOriginMembershipRecord, } from './local-context-graph-provenance.js';
 import { contextGraphReadAuthorityDependencyOf, unavailableContextGraphReadAuthorityDecision, } from './context-graph-read-authority.js';
 import { deterministicStartupJitterMs, scheduleAfterStartupJitter } from './startup-jitter.js';
@@ -199,34 +208,11 @@ import { isRfc64PrivateRecoveryOwnerV1, resolveRfc64PrivateRecoveryContextGraphI
 import { CONTEXT_GRAPH_AUTHORITY_RPC_SITES as CG_AUTH_RPC_SITES, withRpcUsageSite, } from '@origintrail-official/dkg-chain';
 import { rfc64ExecutionPlanAllowsLegacySyncV1, resolveRfc64RuntimeCatalogBootstrapConfigV1, } from './rfc64/public-catalog-activation-config-v1.js';
 import { reconcileRfc64CatalogAuthorityPlanV1 } from './rfc64/catalog-rollout-authority-reconciliation-v1.js';
-import { initializeRfc64LegacySwmBoundaryV1, prepareRfc64LateLegacySwmBoundaryV1, } from './rfc64/legacy-swm-boundary-v1.js';
+import { initializeRfc64LegacySwmBoundaryV1, prepareRfc64LateLegacySwmBoundaryV1, retireRfc64LegacySwmAfterFinalizedVmV1, } from './rfc64/legacy-swm-boundary-v1.js';
+import { projectPersistedJoinApprovals, } from './join-approval-restart-projection.js';
+import { verifiedCuratorDialAddress } from './curator-dial-address.js';
 const DEFAULT_HOST_MODE_RECONCILE_JITTER_RATIO = 0.15;
 const RFC64_SELECTED_SWM_ADMISSION_PRIORITY = 2_000;
-function projectPersistedJoinApprovals(persistedMembershipRows, persistedContextGraphIds, localAgentAddresses) {
-    const newestApprovalByContextGraph = new Map();
-    for (const membership of persistedMembershipRows) {
-        const principalId = membership.principalId.toLowerCase();
-        if (membership.principalType !== 'agent' ||
-            membership.status !== 'active' ||
-            membership.source !== 'join-approved' ||
-            !persistedContextGraphIds.has(membership.contextGraphId) ||
-            !localAgentAddresses.has(principalId)) {
-            continue;
-        }
-        const existing = newestApprovalByContextGraph.get(membership.contextGraphId);
-        if (!existing || membership.updatedAt > existing.updatedAt) {
-            newestApprovalByContextGraph.set(membership.contextGraphId, {
-                principalId,
-                updatedAt: membership.updatedAt,
-                curatorPeerId: typeof membership.metadata?.['curatorPeerId'] === 'string' &&
-                    membership.metadata['curatorPeerId'].trim()
-                    ? membership.metadata['curatorPeerId'].trim()
-                    : undefined,
-            });
-        }
-    }
-    return newestApprovalByContextGraph;
-}
 function resolveAgentSyncGlobalBackpressure(config) {
     // `trackSyncContextGraph()` mutates this list when an Edge explicitly
     // subscribes or starts a foreground catch-up. Those operator-selected graphs
@@ -427,6 +413,8 @@ function syncPageFetchCoalescingKey(params) {
         params.assetUals === undefined ? null : exactAssetFilterKey(params.assetUals),
         params.returnAcceptedPrefixOnRetryableTransportFailure === true,
         params.requesterScope ?? null,
+        params.responseEncoding ?? null,
+        params.maxAcceptedBytes ?? null,
         params.maxAcceptedQuads ?? null,
         params.maxAcceptedHeapBytesEstimate ?? null,
     ]);
@@ -514,12 +502,14 @@ function contextGraphCatchupSingleFlightKey(params) {
 function durableSyncSingleFlightKey(params) {
     if (params.hasPhaseCallback
         || params.hasAtomicCommitCallback
+        || params.hasWorkStartedCallback
         || params.hasAccessDeniedCallback
         || params.hasSinceBatchIdResolver
         || params.hasSignal
         || params.hasCurrentFence
         || params.hasChallengePinnedSelection
-        || params.hasForcedFreshExactSession) {
+        || params.hasForcedFreshExactSession
+        || params.hasRegisteredPublicEvidence) {
         return null;
     }
     return syncSingleFlightKey('durable-sync', {
@@ -531,6 +521,7 @@ function durableSyncSingleFlightKey(params) {
         syncAgentsMeta: params.syncAgentsMeta,
         exactAssetUals: params.exactAssetUals ?? null,
         settlementSliceTimeoutMs: params.settlementSliceTimeoutMs ?? null,
+        exactRecoveryTransportMode: params.exactRecoveryTransportMode ?? 'stream-preferred',
         priority: params.priority ?? null,
     });
 }
@@ -831,42 +822,16 @@ async function authenticateDurableGraphScopedAsset(params) {
         signal?.removeEventListener('abort', abortFromOperation);
     }
 }
-function sameStringArray(a, b) {
-    return a.length === b.length && a.every((value, index) => value === b[index]);
-}
-function syncReconcilerEnabled(config) {
-    return resolveSyncReconcilerEnabled(config.syncReconcilerEnabled);
-}
-function syncOnConnectEnabled(config) {
-    return resolveBooleanSwitch(config.syncOnConnectEnabled, 'DKG_SYNC_ON_CONNECT_ENABLED', true);
-}
-function durableSyncEnabled(config) {
-    return resolveBooleanSwitch(config.durableSyncEnabled, 'DKG_DURABLE_SYNC_ENABLED', true);
-}
 /** OT-RFC-59 responder cap on the peer-controlled raw-scan limit (DoS bound). Honest
  *  requesters send SYNC_PAGE_SIZE (500); the headroom tolerates larger legitimate pages. */
 const CHANGELOG_MAX_SCAN_LIMIT = 2000;
-function emptySharedMemorySyncResult() {
-    return createEmptySharedMemorySyncResult();
-}
-function mergeSharedMemorySyncResults(a, b) {
-    return {
-        ...mergeSamePeerSharedMemoryDiagnostics(a, b),
-    };
-}
-function emptySwmRecoveryResult() {
-    return {
-        replacedRoots: 0,
-        replacedGraphs: 0,
-        insertedDataQuads: 0,
-        insertedMetaQuads: 0,
-        droppedDataTriples: 0,
-        readySnapshots: 0,
-        totalSnapshots: 0,
-        completed: true,
-    };
+function sameStringArray(a, b) {
+    return a.length === b.length && a.every((value, index) => value === b[index]);
 }
 export class LifecycleSyncMethods extends DKGAgentBase {
+    async retireLegacySwmAfterVerifiedVmTwin(input) {
+        await retireRfc64LegacySwmAfterFinalizedVmV1(this, input.contextGraphId, input.kaUal, String(input.assertionVersion), input.subGraphName);
+    }
     async retireFinalizedSwmTwinCandidate(candidate, ctx) {
         await this.publisher.clearPublishedKnowledgeAssetSwm(candidate.contextGraphId, {
             kind: 'named-lifecycle',
@@ -949,6 +914,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 // lanes, and the changelog lane's legacy `runResync` fallback) reports
                 // its attempts and bytes under this label without carrying it as a
                 // parameter, so it can never reach a coalescing key.
+                admission.onWorkStarted?.();
                 return await withSyncAdmissionSource(source, work);
             }
             catch (error) {
@@ -1017,6 +983,20 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             admissionBoundary.dispose();
         }
     }
+    /**
+     * Whether this node's sync admission would take an exact VM recovery fetch
+     * for the graph right now. A read of the limiter: nothing is claimed or
+     * queued, and the fetch must still handle a refusal.
+     */
+    vmRecoverySyncAdmissionAvailable(contextGraphId) {
+        return !syncAdmissionWouldBeRefused(resolveAgentSyncGlobalBackpressure(this.config), {
+            contextGraphId,
+            lane: 'durable',
+            priority: VM_RECOVERY_SYNC_PRIORITY,
+            priorityClass: syncPriorityClass(VM_RECOVERY_SYNC_PRIORITY),
+            source: 'vm-recovery',
+        });
+    }
     async start() {
         if (this.vmReconcileShutdownBlocked) {
             throw new VmReconcileShutdownTimeoutError(DKGAgentBase.VM_RECONCILE_SHUTDOWN_TIMEOUT_MS);
@@ -1024,6 +1004,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         if (this.contextGraphMembershipPersistenceShutdownBlocked) {
             throw new ContextGraphMembershipPersistShutdownTimeoutError(DKGAgentBase.CONTEXT_GRAPH_MEMBERSHIP_PERSIST_SHUTDOWN_TIMEOUT_MS);
         }
+        if (this.contextGraphSubscriptionPersistenceShutdownBlocked) {
+            throw new ContextGraphSubscriptionPersistShutdownTimeoutError(DKGAgentBase.CONTEXT_GRAPH_SUBSCRIPTION_PERSIST_SHUTDOWN_TIMEOUT_MS);
+        }
         if (this.started)
             return;
         this.storageACKRegistrationRuntime.retireCurrentGeneration();
@@ -1042,6 +1025,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         await this.contextGraphSubscriptionRehydrationPromotionRuntime?.close();
         this.rfc64BackgroundWorkDispatcherV1.reopen();
         this.contextGraphMembershipPersistence.reopen();
+        // stop() drained and closed subscription writes; a restarted agent admits
+        // them again. Writes issued before the first start() left it open.
+        this.contextGraphSubscriptionPersistence.reopenIfClosed();
         // stop() aborts detached cold authority flights; a restarted agent admits
         // new ones (the runtime is created lazily on first use otherwise).
         peekFinalizedAuthorityColdResolution(this)?.reopen();
@@ -1348,11 +1334,17 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         this.messenger.setOutboxResponseHandler(PROTOCOL_JOIN_REQUEST, async (result) => {
             await this.handleJoinRequestOutboxResponse(result);
         });
+        // Snapshot live intent before any durable read or detached persistence
+        // completion. Durable rows claim their part of this startup plan below.
+        const liveIntents = [...this.subscribedContextGraphs].filter(([, subscription]) => subscription.subscribed && !subscription.pendingMeta);
         this.gossip = new GossipSubManager(this.node, this.eventBus, {
             networkId: this.config.networkIdentity?.networkId,
             chainId: this.config.networkIdentity?.chainId,
             isPeerAccepted: (peerId) => this.networkAdmissionCoordinator.isAcceptedPeer(peerId),
         });
+        for (const [id, subscription] of liveIntents) {
+            this.gossipSession.startupLiveIntents.set(id, { syncMode: subscription.syncMode });
+        }
         await this.loadSwmSenderKeyState();
         await this.initializeSwmHostModeStore();
         await this.rehydrateContextGraphsFromDurableState();
@@ -1956,6 +1948,28 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             peerId: this.peerId,
             parseSyncRequest: this.parseSyncRequest.bind(this),
             authorizeSyncRequest: this.authorizeSyncRequest.bind(this),
+            onExperimentalExactBatchResources: resolveExactBatchStreamEnabled()
+                && this.config.nodeRole === 'core'
+                ? (resources) => {
+                    const binding = createExactBatchResponderBinding({
+                        localPeerId: this.peerId,
+                        store: this.store,
+                        exportCache: resources.exportCache,
+                        admission: resources,
+                        parseSyncRequest: this.parseSyncRequest.bind(this),
+                        authorizeSyncRequest: this.authorizeSyncRequest.bind(this),
+                        isPublicContextGraph: async (cg, signal) => (await this.resolveRegisteredContextGraphAuthority(cg, {
+                            authorityReadMode: 'finalized-index-or-live', signal,
+                        })).kind === 'public',
+                        servingWithheld: (cg) => this.contextGraphServingWithheld(cg),
+                        onExport: (assetIndex, wholePayloadExports, operationContext) => this.log.info(operationContext, `Exact batch responder export asset=${assetIndex} wholePayloadExports=${wholePayloadExports}`),
+                        onPayload: (assetIndex, plainBytes, encodedBytes, operationContext) => this.log.info(operationContext, `Exact batch responder payload asset=${assetIndex} plainBytes=${plainBytes} encodedBytes=${encodedBytes}`),
+                        onFallback: (reason, assetIndex, operationContext, budgetReason) => this.log.info(operationContext, `Exact batch responder refusal asset=${assetIndex} reason=${reason}${budgetReason ? ` budgetReason=${budgetReason}` : ''}`),
+                        onStage: (stage, assetIndex, durationMs, operationContext) => this.log.info(operationContext, `Exact batch responder stage=${stage} asset=${assetIndex} durationMs=${durationMs.toFixed(3)}`),
+                    });
+                    registerExperimentalExactBatchResponder(this.router, exactBatchTransportOptions(120_000), binding.authorizeRequest, binding.respond);
+                }
+                : undefined,
             // Serve-skip policy (#1233): withhold the no-consumer agents/_meta snapshot
             // unless the operator opts in. This is the env boundary — the pure
             // `shouldWithholdAgentsDurableMeta` resolver is called directly with a FRESH
@@ -1964,6 +1978,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             shouldWithholdDurableMeta: (contextGraphId) => shouldWithholdAgentsDurableMeta(contextGraphId, process.env.DKG_SERVE_AGENTS_META),
             servingWithheld: (contextGraphId) => this.contextGraphServingWithheld(contextGraphId),
             logWarn: (ctx, message) => this.log.warn(ctx, message),
+            logInfo: (ctx, message) => this.log.info(ctx, message),
             logDebug: (ctx, message) => this.log.debug(ctx, message),
             snapshotBudget: snapshotPolicy.budget,
             contextGraphPriorities: this.config.syncContextGraphPriorities,
@@ -2069,7 +2084,16 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                             role: 'participant',
                             status: 'active',
                             source: 'join-approved',
-                            metadata: { curatorPeerId: peerId.toString() },
+                            metadata: {
+                                curatorPeerId: peerId.toString(),
+                                // The approved sender's own listener address is a durable
+                                // transport hint. An inbound remoteAddr can be an ephemeral
+                                // source port, so it is never persisted for restart dialing.
+                                ...(() => {
+                                    const address = verifiedCuratorDialAddress(payload.curatorDialAddress, peerId.toString());
+                                    return address ? { curatorDialAddress: address } : {};
+                                })(),
+                            },
                         };
                         // Commit the restart contract before changing live subscription
                         // state. The two stores do not expose a shared transaction, so the
@@ -2333,6 +2357,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         for (const systemContextGraph of [SYSTEM_CONTEXT_GRAPHS.AGENTS, SYSTEM_CONTEXT_GRAPHS.ONTOLOGY]) {
             this.subscribeToContextGraph(systemContextGraph, { syncMode: 'always-on' });
         }
+        this.applyStartupContextGraphGossipPlan();
         // Connect to bootstrap peers
         if (this.config.bootstrapPeers) {
             for (const addr of this.config.bootstrapPeers) {
@@ -2549,6 +2574,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // this is now the only outbox tick — chat (PR-3) and every
         // future migrated protocol drain on the same cadence so
         // operators see a single "outbox tick" beat.
+        let senderKeyRetryInFlight = false;
         this.messengerOutboxTimer = setInterval(() => {
             const now = Date.now();
             this.messenger.processOutboxTick(now)
@@ -2564,6 +2590,25 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         `msgId=${entry.messageId.slice(0, 8)} lastError="${entry.lastError}"`);
                 }
             });
+            // A retryable ACK is a delivered Messenger response, so it has no
+            // outbox obligation. The sender-key queue owns that retry and must
+            // progress even if both peers stay connected and no further share is
+            // published. Keep one pass in flight and reuse its current-authority
+            // recipient check before every resend.
+            if (!senderKeyRetryInFlight && this.pendingSenderKeyByAgent.size > 0) {
+                senderKeyRetryInFlight = true;
+                void this.drainPendingSenderKeysForConnectedPeers()
+                    .then((drained) => {
+                    if (drained > 0) {
+                        this.log.info(ctx, `Sender-key retry delivered ${drained} pending package(s)`);
+                    }
+                })
+                    .catch((err) => {
+                    const message = err instanceof Error ? err.message : String(err);
+                    this.log.warn(ctx, `Sender-key retry tick failed: ${message}`);
+                })
+                    .finally(() => { senderKeyRetryInFlight = false; });
+            }
         }, MESSAGE_OUTBOX_TICK_MS);
         if (this.messengerOutboxTimer.unref)
             this.messengerOutboxTimer.unref();
@@ -2817,6 +2862,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         this.warmedCores.delete(remotePeer);
         this.warmCoreFailedUnpins.delete(remotePeer);
         this.vmReconcileExactPeerCapabilities?.delete(remotePeer);
+        this.vmReconcilePublicCoreTransportPreferencePolicy?.forgetPeer(remotePeer);
     }
     queueSelectedSwmFromPeerOnConnect(remotePeer, handleSyncError, delayMs = 3000) {
         const selectedContextGraphIds = this.selectedSwmBootstrapContextGraphIdsForPeer(remotePeer);
@@ -3776,8 +3822,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         return result.insertedTriples;
     }
     /** One agent-owned admission decision for the legacy shared-memory lane. */
-    canUseLegacySharedMemorySyncForContextGraphV1(contextGraphId) {
-        return this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId);
+    async canUseLegacySharedMemorySyncForContextGraphV1(contextGraphId) {
+        // The private predicate verifies local membership and current lane authority.
+        return this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)
+            || await this.rfc64PrivateRootSwmOnLegacyLaneV1(contextGraphId) === true;
     }
     /** One agent-owned admission decision for the legacy durable VM lane. */
     async canUseLegacyDurableSyncForContextGraphV1(contextGraphId) {
@@ -3861,6 +3909,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         return (await LifecycleSyncMethods.prototype.runLegacyDurableSyncDetailed.call(this, ctx, remotePeerId, contextGraphIds, onPhase, onAccessDenied, sinceBatchIdFor, options)).result;
     }
     async runLegacyDurableSyncDetailed(ctx, remotePeerId, contextGraphIds, onPhase, onAccessDenied, sinceBatchIdFor, options) {
+        const admissionBoundary = new DurableSyncAdmissionBoundary(options?.onWorkStarted);
         const syncAgentsMeta = resolveSyncAgentsMeta(this.config.syncAgentsMeta, process.env.DKG_SYNC_AGENTS_META);
         const stopOnBackoffWorthyFailure = options?.stopOnBackoffWorthyFailure;
         const exactAssetSelection = options?.exactAssetSelection;
@@ -3886,6 +3935,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         let exactFetchDisposition;
         let exactResponderCapability;
         const authenticatedExactAssets = [];
+        const committedExactAssetUals = [];
+        // What the stream established about this peer for one graph. A run over
+        // several graphs has no single answer, so it reports none.
+        let exactStreamOutcome;
         const markExactFetchIncomplete = () => {
             if (exactAssetUals === undefined)
                 return;
@@ -3907,6 +3960,8 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                             fetchTimeoutMs,
                             exactAssetSelection,
                             forceFreshExactSession: options?.forceFreshExactSession,
+                            exactRecoveryTransportMode: options?.exactRecoveryTransportMode,
+                            registeredPublicEvidence: options?.registeredPublicEvidence,
                             authenticationTimeoutMs,
                             operationFetchDeadline: operationBoundary.fetchDeadline,
                             operationDeadline: operationBoundary.deadline,
@@ -3922,6 +3977,11 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         if (detailed.authenticatedExactAssets !== undefined) {
                             authenticatedExactAssets.push(...detailed.authenticatedExactAssets);
                         }
+                        if (detailed.committedExactAssetUals !== undefined) {
+                            committedExactAssetUals.push(...detailed.committedExactAssetUals);
+                        }
+                        if (orderedContextGraphIds.length === 1)
+                            exactStreamOutcome = detailed.exactStreamOutcome;
                         return durableSyncAccumulatorFromResult(detailed.result);
                     },
                 })),
@@ -3933,6 +3993,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                             priorityOverride: options?.priority,
                             operationSignal: operationBoundary.signal,
                             source: options?.source,
+                            onWorkStarted: admissionBoundary.startWork,
                         }), operationBoundary.signal);
                     }
                     catch (error) {
@@ -3944,6 +4005,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 },
                 merge: mergeDurableSyncAccumulatorInto,
                 markDeferred: (summary) => {
+                    admissionBoundary.defer();
                     markExactFetchIncomplete();
                     recordDurableSyncDiagnostics(summary, { deferredBackpressure: 1 });
                     return markDurableTerminalBoundary(summary, false);
@@ -3966,12 +4028,17 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 onDeferred: (item, error) => this.log.info(ctx, `Deferring durable sync at CG ${item.contextGraphId} due to local backpressure: ${error.message}`),
             });
             return {
+                admission: admissionBoundary.snapshot(),
                 result: finalizeDurableSyncCompletion(accumulator),
                 ...(exactFetchDisposition ? { exactFetchDisposition } : {}),
                 ...(exactResponderCapability ? { exactResponderCapability } : {}),
                 ...(authenticatedExactAssets.length === 0
                     ? {}
                     : { authenticatedExactAssets: Object.freeze([...authenticatedExactAssets]) }),
+                ...(committedExactAssetUals.length === 0
+                    ? {}
+                    : { committedExactAssetUals: Object.freeze([...committedExactAssetUals]) }),
+                ...(exactStreamOutcome === undefined ? {} : { exactStreamOutcome }),
             };
         };
         const singleFlightKey = durableSyncSingleFlightKey({
@@ -3983,14 +4050,17 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             syncAgentsMeta,
             hasPhaseCallback: Boolean(onPhase),
             hasAtomicCommitCallback: Boolean(options?.onAtomicCommitStarted),
+            hasWorkStartedCallback: Boolean(options?.onWorkStarted),
             hasAccessDeniedCallback: Boolean(onAccessDenied),
             hasSinceBatchIdResolver: Boolean(sinceBatchIdFor),
             hasSignal: Boolean(operationBoundary.signal),
             hasCurrentFence: Boolean(options?.isCurrent),
             hasChallengePinnedSelection: exactAssetSelection?.kind === 'challenge-pinned',
             hasForcedFreshExactSession: options?.forceFreshExactSession === true,
+            hasRegisteredPublicEvidence: options?.registeredPublicEvidence !== undefined,
             exactAssetUals,
             settlementSliceTimeoutMs: options?.settlementSliceTimeoutMs,
+            exactRecoveryTransportMode: options?.exactRecoveryTransportMode,
             priority: options?.priority,
         });
         const runWithinBoundary = async () => {
@@ -4022,13 +4092,18 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const detailed = await this.runLegacyDurableSyncDetailed(ctx, remotePeerId, [contextGraphId], undefined, undefined, undefined, {
             exactAssetSelection: selection,
             forceFreshExactSession: options.forceFreshExactSession,
+            exactRecoveryTransportMode: options.exactRecoveryTransportMode,
+            registeredPublicEvidence: options.registeredPublicEvidence,
+            ...(options.totalTimeoutMs === undefined ? {} : { totalTimeoutMs: options.totalTimeoutMs }),
             stopOnBackoffWorthyFailure: true,
-            priority: 1_000,
+            priority: VM_RECOVERY_SYNC_PRIORITY,
             source: 'vm-recovery',
+            onWorkStarted: options.onWorkStarted,
             signal: options.signal,
             isCurrent: options.isCurrent,
         });
         return {
+            admission: detailed.admission,
             result: detailed.result,
             disposition: detailed.exactFetchDisposition ?? 'incomplete',
             ...(detailed.exactResponderCapability === undefined
@@ -4037,14 +4112,30 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             ...(detailed.authenticatedExactAssets === undefined
                 ? {}
                 : { authenticatedAssets: detailed.authenticatedExactAssets }),
+            ...(detailed.committedExactAssetUals === undefined
+                ? {}
+                : { committedExactAssetUals: detailed.committedExactAssetUals }),
+            ...(detailed.exactStreamOutcome === undefined
+                ? {}
+                : { streamOutcome: detailed.exactStreamOutcome }),
         };
     }
     /** Execute one legacy durable Context Graph after its caller owns admission. */
     async runLegacyDurableSyncForContextGraph(ctx, remotePeerId, contextGraphId, remainingContextGraphs, options = {}) {
         return (await LifecycleSyncMethods.prototype.runLegacyDurableSyncForContextGraphDetailed.call(this, ctx, remotePeerId, contextGraphId, remainingContextGraphs, options)).result;
     }
+    /** Capture transport refusal scope without performing authority or store IO. */
+    captureExperimentalExactBatchRefusalScope(contextGraphId) {
+        return captureExactBatchStreamRefusalScope({
+            contextGraphId, deploymentId: this.chain.deploymentId,
+            binding: this.contextGraphBindingState.currentBindingFor(contextGraphId, this.subscribedContextGraphs.get(contextGraphId)),
+            bindingGeneration: this.contextGraphBindingState.capture(contextGraphId),
+            selectedBindingGeneration: this.selectedVmReconcileCursors?.get(contextGraphId)?.bindingGeneration,
+            lifecycleGeneration: this.vmReconcileLifecycleGeneration,
+        });
+    }
     async runLegacyDurableSyncForContextGraphDetailed(ctx, remotePeerId, contextGraphId, remainingContextGraphs, options = {}) {
-        const { onPhase, onAtomicCommitStarted, onAccessDenied, sinceBatchIdFor, stopOnBackoffWorthyFailure, onVerifiedFullSnapshot, fetchTimeoutMs = SYNC_TOTAL_TIMEOUT_MS, exactAssetSelection, forceFreshExactSession, authenticationTimeoutMs = fetchTimeoutMs, operationFetchDeadline, operationDeadline, settlementSliceTimeoutMs, signal, isCurrent, durableMetaContinuation, } = options;
+        const { onPhase, onAtomicCommitStarted, onAccessDenied, sinceBatchIdFor, stopOnBackoffWorthyFailure, onVerifiedFullSnapshot, fetchTimeoutMs = SYNC_TOTAL_TIMEOUT_MS, exactAssetSelection, forceFreshExactSession, exactRecoveryTransportMode = 'stream-preferred', registeredPublicEvidence, authenticationTimeoutMs = fetchTimeoutMs, operationFetchDeadline, operationDeadline, settlementSliceTimeoutMs, signal, isCurrent, durableMetaContinuation, } = options;
         const assertLifecycleCurrent = () => {
             if (isCurrent?.() === false) {
                 throw asSyncFetchAbortError(new Error(`Exact VM recovery lifecycle for ${contextGraphId} is no longer current`));
@@ -4239,13 +4330,26 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         this.invalidateListContextGraphsCache();
                         this.contextGraphMetaProjection.markDirtyFromQuads(authentication.asset.metadataQuads);
                         try {
+                            let retiredTwin;
                             const retirement = await reconcileFinalizedSwmTwin({
                                 store: this.store,
                                 writeLocks: this.writeLocks,
                                 asset: authentication.asset,
-                                retire: (candidate) => this.retireFinalizedSwmTwinCandidate(candidate, ctx),
+                                retire: async (candidate) => {
+                                    await this.retireFinalizedSwmTwinCandidate(candidate, ctx);
+                                    retiredTwin = candidate;
+                                },
                             });
                             if (retirement === 'retired') {
+                                await this.retireLegacySwmAfterVerifiedVmTwin({
+                                    contextGraphId: asset.contextGraphId,
+                                    kaUal: asset.ual,
+                                    assertionVersion: asset.assertionVersion,
+                                    // The marker of the namespace whose twin was verified and
+                                    // retired. Without it a twin in a named subgraph would
+                                    // retire the root marker of the same asset.
+                                    subGraphName: retiredTwin?.subGraphName,
+                                });
                                 this.invalidateListContextGraphsCache();
                                 this.log.info(ctx, `Retired byte-identical SWM twin after durable VM materialization for ${asset.ual}`);
                             }
@@ -4293,7 +4397,54 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             };
         }
         if (exactAssetSelection !== undefined) {
-            return runDurableSyncDetailed(durableContext);
+            const outcome = await runExactBatchStreamDriver({
+                contextGraphId, remotePeerId,
+                selection: exactAssetSelection, transportMode: exactRecoveryTransportMode,
+                streamEnabled: resolveExactBatchStreamEnabled(),
+                fetchDeadline: contextGraphBudget.fetchDeadline, signal, isCurrent,
+            }, {
+                router: this.router, capabilityOwner: this,
+                captureConnectionKey: () => this.getSyncReconcilerConnectionKey(remotePeerId),
+                captureRefusalScope: () => this.captureExperimentalExactBatchRefusalScope(contextGraphId),
+                isChainEnabled: () => this.chain.chainId !== 'none',
+                getPeerProtocols: () => this.getPeerProtocols(remotePeerId),
+                // The recovery pass that owns this exchange may have handed it its own fresh positive
+                // answer; every other fetch, and any doubt about that answer, reads the authority itself.
+                isRegisteredPublic: async () => registeredPublicEvidence?.usableFor(contextGraphId, signal) === true
+                    || (await this.resolveRegisteredContextGraphAuthority(contextGraphId, {
+                        authorityReadMode: 'finalized-index-or-live', signal,
+                    })).kind === 'public',
+                requestIdentity: () => ({
+                    requesterPeerId: this.peerId,
+                    computeSyncDigest: (...args) => this.computeSyncDigest(...args),
+                    getIdentityId: () => this.chain.getIdentityId(),
+                    signMessage: typeof this.chain.signMessage === 'function' ? this.chain.signMessage.bind(this.chain) : undefined,
+                }),
+                verification: {
+                    ctx,
+                    parseAndFilter: (text, graph, cg) => this.getOrCreateSyncVerifyWorker().parseAndFilter(text, graph, cg),
+                    processDurableBatchInWorker: durableContext.processDurableBatchInWorker,
+                    authenticationDeadline: contextGraphBudget.createGraphScopedAuthenticationDeadline,
+                    storeGraphScopedAsset: durableContext.storeGraphScopedAsset,
+                },
+                reconnect: async (reconnectSignal) => {
+                    try {
+                        await this.ensurePeerConnected(remotePeerId, { signal: reconnectSignal });
+                    }
+                    catch {
+                        // Unreachable for now, or connected but no longer admitted.
+                        return false;
+                    }
+                    return this.node.libp2p.getConnections()
+                        .some((connection) => connection.remotePeer.toString() === remotePeerId);
+                },
+                logInfo: message => this.log.info(ctx, message),
+            });
+            switch (outcome.kind) {
+                case 'settled': return outcome.detailed;
+                case 'not-selected':
+                case 'unsupported-before-start': return runDurableSyncDetailed(durableContext);
+            }
         }
         return { result: await runDurableSync(durableContext) };
     }
@@ -4642,9 +4793,25 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             deadline,
             fetchSharingIdentity: defaultPageFetchSharingIdentity,
         });
+        // Match the additive builder negotiation. Authorization is still evaluated
+        // by buildSyncRequest and by the responder before any export is admitted.
+        const responseEncoding = resolveExactSyncGzipProfile({
+            includeSharedMemory, phase, assetUals, responseEncoding: EXACT_SYNC_GZIP_ENCODING,
+        })?.responseEncoding;
         const exactAccumulationLimits = assetUals === undefined
             ? undefined
-            : exactSyncPhaseAccumulationLimits(assetUals);
+            : exactSyncPhaseAccumulationLimits(assetUals, responseEncoding);
+        const effectiveMaxAcceptedQuads = exactAccumulationLimits?.maxQuads === undefined
+            ? maxAcceptedQuads
+            : maxAcceptedQuads === undefined
+                ? exactAccumulationLimits.maxQuads
+                : Math.min(exactAccumulationLimits.maxQuads, maxAcceptedQuads);
+        const exactHeapLimit = exactAccumulationLimits?.maxHeapBytesEstimate;
+        const effectiveMaxAcceptedHeapBytesEstimate = exactHeapLimit === undefined
+            ? maxAcceptedHeapBytesEstimate
+            : maxAcceptedHeapBytesEstimate === undefined
+                ? exactHeapLimit
+                : Math.min(exactHeapLimit, maxAcceptedHeapBytesEstimate);
         // Coalescing is declared by the capability, never inferred from singleton
         // identity. Exclusive private rounds cannot inherit another job's clock.
         const fetchSharingIdentity = effectiveWorkAdmission.fetchSharingIdentity;
@@ -4664,8 +4831,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 assetUals,
                 returnAcceptedPrefixOnRetryableTransportFailure,
                 requesterScope,
-                maxAcceptedQuads,
-                maxAcceptedHeapBytesEstimate,
+                responseEncoding,
+                maxAcceptedBytes: exactAccumulationLimits?.maxBytes,
+                maxAcceptedQuads: effectiveMaxAcceptedQuads,
+                maxAcceptedHeapBytesEstimate: effectiveMaxAcceptedHeapBytesEstimate,
             });
         const inFlight = inFlightSyncPageFetchesFor(this);
         // Read once, here: this fetch runs inside the admitted operation, so the
@@ -4722,15 +4891,12 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             snapshotRef,
             sinceBatchId,
             assetUals,
+            responseEncoding,
             returnAcceptedPrefixOnRetryableTransportFailure,
             requesterScope,
             maxAcceptedBytes: exactAccumulationLimits?.maxBytes,
-            maxAcceptedQuads: exactAccumulationLimits?.maxQuads === undefined
-                ? maxAcceptedQuads
-                : maxAcceptedQuads === undefined
-                    ? exactAccumulationLimits.maxQuads
-                    : Math.min(exactAccumulationLimits.maxQuads, maxAcceptedQuads),
-            maxAcceptedHeapBytesEstimate,
+            maxAcceptedQuads: effectiveMaxAcceptedQuads,
+            maxAcceptedHeapBytesEstimate: effectiveMaxAcceptedHeapBytesEstimate,
             pageSizeProfileCache: syncPageSizeProfileCacheFor(this),
             deadline,
             recovery,
@@ -5180,7 +5346,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         selectedSwmPriority: selectedPublicWork,
                     });
                 },
-                merge: mergeSharedMemorySyncResults,
+                merge: mergeSamePeerSharedMemoryDiagnostics,
                 onResult: (item, result) => {
                     if (selectedSwmEnabled
                         && item.lane === 'shared_memory'
@@ -5234,7 +5400,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     source: options?.source,
                     selectedSwmPriority: true,
                 }),
-                merge: mergeSharedMemorySyncResults,
+                merge: mergeSamePeerSharedMemoryDiagnostics,
                 markDeferred: (summary) => ({
                     ...summary,
                     deferredBackpressure: (summary.deferredBackpressure ?? 0) + 1,
@@ -5257,7 +5423,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 },
             });
             const { summary: continuationSummary } = continuationExecution;
-            const finalSummary = mergeSharedMemorySyncResults(initialSummary, continuationSummary);
+            const finalSummary = mergeSamePeerSharedMemoryDiagnostics(initialSummary, continuationSummary);
             const incompleteSelectedContextGraphs = new Set(continuationExecution.incompleteContextGraphIds);
             const continuedSelectedContextGraphs = new Set(selectedContinuationUnits.map(({ work: unitWork }) => unitWork.contextGraphId));
             for (const target of selectedPublicTargets) {
@@ -5436,16 +5602,6 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         });
     }
     /** Focused VM-recovery operation that returns clean per-peer miss evidence. */
-    async syncVmRecoveryFromConnectedPeers(contextGraphId, options) {
-        const catchup = await this.syncContextGraphFromConnectedPeers(contextGraphId, options);
-        return {
-            catchup,
-            // Embedders may still override the catch-up method with the pre-evidence
-            // result shape. Treat that legacy shape as no proof; production results
-            // always carry the immutable field below.
-            cleanMissPeerIds: [...(catchup.cleanSharedMemoryPeerIds ?? [])],
-        };
-    }
     selectCatchupPeerWindow(peers, options) {
         const maxPeers = options?.maxPeers;
         if (maxPeers === undefined || !Number.isInteger(maxPeers) || maxPeers <= 0) {
@@ -5606,7 +5762,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // into HEAD's `accessDeniedPeers` counter so the existing daemon
         // catchup-status endpoint and UI keep working — see
         // `cli/src/daemon.ts` subscribe job and `catchup-runner.ts`.
-        const emptyShared = () => createEmptySharedMemorySyncResult(1);
+        const emptyShared = () => emptySharedMemorySyncResult(1);
         // Bounded fan-out: at most CATCHUP_MAX_CONCURRENT_PEER_SYNCS peer syncs run
         // at once. The pre-cap unbounded `Promise.all` over every sync-capable peer
         // was the top amplifier of the 2026-07-07 mainnet sync storm — one
@@ -6046,13 +6202,14 @@ export class LifecycleSyncMethods extends DKGAgentBase {
      * snapshot that does not prove this member yet, or unavailable authority is
      * `retry`; no approval binding or denied authority is `stop`.
      */
-    async resumePendingJoinApprovalMetadata(contextGraphId, curatorPeerId) {
+    async resumePendingJoinApprovalMetadata(contextGraphId, curatorPeerId, curatorDialAddress) {
         const ctx = createOperationContext('sync');
         const acceptance = await this.resolveApprovedMemberAcceptance(contextGraphId);
         if (!acceptance)
             return 'stop';
         const refreshed = await this.refreshMetaFromCurator(contextGraphId, {
             trustedCuratorPeerId: curatorPeerId,
+            curatorDialAddressHint: curatorDialAddress,
             force: true,
             approvedMember: acceptance,
         }).catch((error) => {
@@ -6100,12 +6257,12 @@ export class LifecycleSyncMethods extends DKGAgentBase {
      * throws, is tried again with backoff while the row is still a subscribed,
      * join-approved, pending-metadata row; the node stopping ends the loop.
      */
-    async recoverPendingJoinApprovalMetadata(contextGraphId, curatorPeerId) {
+    async recoverPendingJoinApprovalMetadata(contextGraphId, curatorPeerId, curatorDialAddress) {
         const stopSignal = this.node.stopSignal;
         for (let attempt = 0;; attempt += 1) {
             let outcome;
             try {
-                outcome = await this.resumePendingJoinApprovalMetadata(contextGraphId, curatorPeerId);
+                outcome = await this.resumePendingJoinApprovalMetadata(contextGraphId, curatorPeerId, curatorDialAddress);
             }
             catch (error) {
                 // A store or network fault that escapes an attempt is as transient as
@@ -6122,7 +6279,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             const current = this.subscribedContextGraphs.get(contextGraphId);
             if (!this.localApprovedAgentByCG.has(contextGraphId)
                 || current?.subscribed !== true
-                || current.pendingMeta !== true)
+                // A concurrent data catch-up can set `synced` while authoritative
+                // join metadata is still pending or unknown. Only its explicit
+                // confirmation ends this join-specific retry.
+                || (current.synced === true && current.metaSynced === true && current.pendingMeta !== true))
                 return;
         }
     }
@@ -6500,14 +6660,16 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         pending.add(revision);
     }
     enqueueContextGraphSubscriptionPersistWrite(contextGraphId, write) {
-        const previous = this.contextGraphSubscriptionPersistChains.get(contextGraphId) ?? Promise.resolve();
-        const run = previous.then(write);
-        const chain = run.catch(() => undefined);
-        this.contextGraphSubscriptionPersistChains.set(contextGraphId, chain);
-        void chain.finally(() => {
-            if (this.contextGraphSubscriptionPersistChains.get(contextGraphId) !== chain)
-                return;
-            this.contextGraphSubscriptionPersistChains.delete(contextGraphId);
+        // The scheduler owns per-context-graph ordering, strict non-coalescing,
+        // write-start timing (a microtask after admission), shutdown drain and
+        // bounds; the revision maps below stay the cancel/supersede layer on top of
+        // it. The returned promise rejects when the write (or admission) fails, so
+        // an awaiting caller sees the failure. The lane keeps draining, so a failed
+        // write does not stall the next one for this context graph.
+        const run = this.contextGraphSubscriptionPersistence.enqueue(contextGraphId, write);
+        // Idle cleanup runs after the caller's own handlers and marks a failure as
+        // handled for a caller that drops the promise, as the chain tail did.
+        void run.catch(() => undefined).finally(() => {
             this.clearContextGraphSubscriptionPersistRevisionStateIfIdle(contextGraphId);
         });
         return run;
@@ -6528,7 +6690,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
     clearContextGraphSubscriptionPersistRevisionStateIfIdle(contextGraphId) {
         if ((this.contextGraphSubscriptionPersistPendingRevisions.get(contextGraphId)?.size ?? 0) > 0)
             return;
-        if (this.contextGraphSubscriptionPersistChains.has(contextGraphId))
+        if (this.contextGraphSubscriptionPersistence.hasLane(contextGraphId))
             return;
         const sub = this.subscribedContextGraphs.get(contextGraphId);
         if (sub?.subscribed === true || sub?.coreHosted === true)
@@ -7495,6 +7657,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             return;
         const ctx = createOperationContext('init');
         let authorityBudget;
+        const startupPlan = this.gossipSession.beginDurableStartupPlan(this.contextGraphSubscriptionRehydrationAccountedIds);
         try {
             // System context graphs (AGENTS/ONTOLOGY) are auto-subscribed separately
             // by start(); their persisted rows must NOT be rehydrated here too. Re-
@@ -7503,6 +7666,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             // dormant. Exclude them from the rehydration set entirely.
             const systemContextGraphs = new Set(Object.values(SYSTEM_CONTEXT_GRAPHS));
             const persistedRows = await store.loadAll();
+            startupPlan.claimDurableRows(persistedRows);
             // A name-hash placeholder whose verified cleartext row is also durable
             // was adopted earlier; the crash window between the two writes can
             // leave both. Never reactivate the placeholder. Record the adoption as
@@ -7578,10 +7742,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             // snapshot already read by the provenance phase. Load every persisted
             // row (not just rows under the activation cap) so a dormant subscription
             // still has the right signer when an operator activates it explicitly.
-            if (persistedMembershipRows !== null) {
-                const persistedContextGraphIds = new Set(rows.map((row) => row.id));
-                const localAgentAddresses = new Set([...this.localAgents.keys()].map((address) => address.toLowerCase()));
-                const newestApprovalByContextGraph = projectPersistedJoinApprovals(persistedMembershipRows, persistedContextGraphIds, localAgentAddresses);
+            const newestApprovalByContextGraph = persistedMembershipRows === null
+                ? null
+                : projectPersistedJoinApprovals(persistedMembershipRows, new Set(rows.map((row) => row.id)), new Set([...this.localAgents.keys()].map((address) => address.toLowerCase())));
+            if (newestApprovalByContextGraph) {
                 for (const [contextGraphId, approval] of newestApprovalByContextGraph) {
                     this.localApprovedAgentByCG.set(contextGraphId, approval.principalId);
                     if (approval.curatorPeerId) {
@@ -7668,7 +7832,22 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 const approvedAgentAddress = row.subscribed
                     ? this.localApprovedAgentByCG.get(row.id)
                     : undefined;
-                const hasJoinApproval = approvedAgentAddress !== undefined;
+                let hasJoinApproval = approvedAgentAddress !== undefined;
+                // The membership row is the restart hint, not the current requester
+                // decision. A later explicit pending/rejected decision must retire a
+                // stale join-approved hint instead of resurrecting its subscription in
+                // restricted pending-metadata mode. Missing decision state remains the
+                // compatibility shape for legacy persisted membership rows.
+                if (approvedAgentAddress !== undefined) {
+                    try {
+                        const requesterState = await this.readRequesterJoinRequestState(row.id, approvedAgentAddress);
+                        hasJoinApproval = requesterState === null
+                            || requesterState.status === 'approved';
+                    }
+                    catch {
+                        hasJoinApproval = false;
+                    }
+                }
                 // A join-approved row keeps the synchronous path: only it can restore
                 // the restricted pending-metadata bootstrap, which background
                 // authority recovery does not offer.
@@ -7764,7 +7943,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     const curatorPeerId = this.preferredSyncPeers.get(row.id);
                     this.log.info(ctx, `Restored persisted context-graph subscription "${row.id}" in restricted pending-metadata mode; VM, payload recovery, and SWM remain closed`);
                     if (curatorPeerId) {
-                        void this.recoverPendingJoinApprovalMetadata(row.id, curatorPeerId).catch((error) => {
+                        void this.recoverPendingJoinApprovalMetadata(row.id, curatorPeerId, newestApprovalByContextGraph?.get(row.id)?.curatorDialAddress).catch((error) => {
                             this.log.warn(ctx, `Pending join-approval recovery for "${row.id}" stopped safely: ${error instanceof Error ? error.message : String(error)}`);
                         });
                     }
@@ -7839,6 +8018,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         }
         finally {
             authorityBudget?.dispose();
+            startupPlan.finish();
         }
     }
     /**
@@ -7896,7 +8076,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             }
         }
         const activeUserIdsWithPendingStoreWrite = store
-            ? activeUserIds.filter((id) => this.contextGraphSubscriptionPersistChains.has(id))
+            ? activeUserIds.filter((id) => this.contextGraphSubscriptionPersistence.hasLane(id))
             : [];
         const storeDeleteIds = [...new Set([...persistedUserIds, ...activeUserIdsWithPendingStoreWrite])];
         const total = storeDeleteIds.length;
@@ -8009,8 +8189,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
      * plaintext: registered public, or unregistered under an active accepted
      * owner-signed public policy (see classifySwmTransportAuthority). A retained
      * snapshot therefore never outvotes a registration the index shows. Private,
-     * legacy-unregistered or unavailable authority, or an unreadable chain, is
-     * `unproven`, which admits only the complete private definition.
+     * approved-private-replica, legacy-unregistered or unavailable authority, or
+     * an unreadable chain, is `unproven`, which admits only the complete private
+     * definition.
      */
     async resolveApprovedMemberAcceptance(contextGraphId) {
         const approvedAgentAddress = this.localApprovedAgentByCG.get(contextGraphId);