@origintrail-official/dkg-agent 10.0.21 → 10.0.23

package/dist/dkg-agent-lifecycle.js

@@ -188,11 +188,12 @@ import { chainAuthorityReadBudgetsOf } from './chain-authority-read-budgets.js';
 import { peekFinalizedAuthorityColdResolution } from './finalized-authority-cold-resolution.js';
 import { AGENTS_PHONEBOOK_PRIME_MAX_DIALS, peekOnDemandAgentsPhonebook, } from './sync/on-demand-agents-phonebook.js';
 import { raceWithBootTimeout, isTransientBootChainError } from './dkg-agent-boot.js';
-import { normalizeContextGraphSubscriptionTransition, projectContextGraphSubscriptionPersistence, } from './context-graph-subscription-policy.js';
+import { mayAdoptContextGraphWireSubscription, normalizeContextGraphSubscriptionTransition, projectContextGraphSubscriptionPersistence, projectContextGraphSubscriptionPersistenceWithSavedHosting, readPreservedContextGraphCoreHosting, isContextGraphSubscriptionPersistenceTargetCurrent, projectContextGraphJoinSubscriptionRecord, contextGraphSubscriptionClearTargets, retainsInactiveContextGraphBinding, } from './context-graph-subscription-policy.js';
 import { partitionSupersededContextGraphNamePlaceholders } from './dkg-agent-cg-name-resolution.js';
 import { authoritativeSyncPeerId, resolveBoundedCuratorSyncPeer, resolveCuratorSyncPeer, } from './dkg-agent-cg-resolve.js';
 import { runCuratorMetaRefreshFromPeer } from './curator-meta-refresh.js';
 import { isCanonicalAuthoritativeContextGraphId } from './context-graph-binding-state.js';
+import { projectDormantContextGraphIdentities } from './context-graph-dormant-identity.js';
 import { normalizeAgentDid, inferAdapterPublisherAddress, } from './dkg-agent-helpers.js';
 import { DKGAgentBase } from './dkg-agent-base.js';
 import { VmReconcileShutdownTimeoutError } from './vm-reconcile-service.js';
@@ -208,7 +209,7 @@ import { isRfc64PrivateRecoveryOwnerV1, resolveRfc64PrivateRecoveryContextGraphI
 import { CONTEXT_GRAPH_AUTHORITY_RPC_SITES as CG_AUTH_RPC_SITES, withRpcUsageSite, } from '@origintrail-official/dkg-chain';
 import { rfc64ExecutionPlanAllowsLegacySyncV1, resolveRfc64RuntimeCatalogBootstrapConfigV1, } from './rfc64/public-catalog-activation-config-v1.js';
 import { reconcileRfc64CatalogAuthorityPlanV1 } from './rfc64/catalog-rollout-authority-reconciliation-v1.js';
-import { initializeRfc64LegacySwmBoundaryV1, prepareRfc64LateLegacySwmBoundaryV1, retireRfc64LegacySwmAfterFinalizedVmV1, } from './rfc64/legacy-swm-boundary-v1.js';
+import { describeRfc64LegacySwmFenceEventV1, initializeRfc64LegacySwmBoundaryV1, rfc64LateLegacySwmCompanionResolverV1, retireRfc64LegacySwmAfterFinalizedVmV1, } from './rfc64/legacy-swm-boundary-v1.js';
 import { projectPersistedJoinApprovals, } from './join-approval-restart-projection.js';
 import { verifiedCuratorDialAddress } from './curator-dial-address.js';
 const DEFAULT_HOST_MODE_RECONCILE_JITTER_RATIO = 0.15;
@@ -1045,7 +1046,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         try {
             if (this.config.dataDir !== undefined
                 && this.rfc64PersistenceV1 !== undefined) {
-                await initializeRfc64LegacySwmBoundaryV1(this, this.rfc64PersistenceV1.rootPath, this.store);
+                await initializeRfc64LegacySwmBoundaryV1(this, this.rfc64PersistenceV1.rootPath, this.store, { onFenceEvent: (event) => this.log.warn(ctx, describeRfc64LegacySwmFenceEventV1(event)) });
                 await reconcileRfc64CatalogAuthorityPlanV1(this.rfc64PersistenceV1, this.store, this.config.rfc64CatalogExecutionPlan);
             }
             await this.prepareFinalizationRecoveryStore();
@@ -1348,6 +1349,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         await this.loadSwmSenderKeyState();
         await this.initializeSwmHostModeStore();
         await this.rehydrateContextGraphsFromDurableState();
+        await this.restoreSwmHostModeSubscriptions();
         this.networkAdmissionCoordinator.registerIdentityProtocol(this.router);
         // Register protocol handlers. PROTOCOL_ACCESS migrated onto the
         // Universal Messenger substrate in rc.9 PR-8 — handler is
@@ -1628,7 +1630,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     recordStorageAckDecline: (code) => this.recordStorageAckDecline(code),
                     gossipWireIdFor: (id) => this.gossipWireIdFor(id),
                     getSwmSubscriptionSource: (...ids) => this.getSwmSubscriptionSource(...ids),
-                    prepareDurableRootAtomicCompanion: (input) => prepareRfc64LateLegacySwmBoundaryV1(this, input.contextGraphId, input.kaUal, input.shareOperationId, input.assertionVersion),
+                    prepareDurableRootAtomicCompanion: rfc64LateLegacySwmCompanionResolverV1(this),
                     chain: this.chain,
                     config: this.config,
                     log: this.log,
@@ -2132,6 +2134,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         // once the allowlist is locally visible — clean self-heal,
                         // no spurious denial. Other gossip topics (publish/app/
                         // update/finalization) wire up immediately as before.
+                        const wirePredecessor = this.resolveWireOnlyContextGraphSubscription(contextGraphId);
                         this.subscribeToContextGraph(contextGraphId, {
                             deferSharedMemoryGossipSubscribe: true,
                             syncMode: 'always-on',
@@ -2158,6 +2161,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         // as a public CG locally, which is the exact corruption these
                         // guards exist to prevent. Lex review on PR #517 round 2 + Codex.
                         this.setContextGraphSubscription(contextGraphId, approvedSubscription, { persist: false });
+                        if (wirePredecessor && !this.subscribedContextGraphs.has(wirePredecessor.localId)) {
+                            void this.persistContextGraphSubscription(contextGraphId, { retiredNamePredecessor: { ...wirePredecessor.subscription, id: wirePredecessor.localId } });
+                        }
                         this.joinRequestAcceptedBy.delete(this.joinRequestTrackingKey(contextGraphId, approvedAddr, requestGeneration));
                         // Sync immediately by targeting the curator peer we just received
                         // this notification from, instead of relying on the periodic
@@ -4328,7 +4334,6 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     });
                     if (outcome === 'applied') {
                         this.invalidateListContextGraphsCache();
-                        this.contextGraphMetaProjection.markDirtyFromQuads(authentication.asset.metadataQuads);
                         try {
                             let retiredTwin;
                             const retirement = await reconcileFinalizedSwmTwin({
@@ -6346,17 +6351,13 @@ export class LifecycleSyncMethods extends DKGAgentBase {
     async refreshMetaSyncedFlags(contextGraphIds) {
         for (const contextGraphId of contextGraphIds) {
             const sub = this.subscribedContextGraphs.get(contextGraphId);
-            if (!sub)
+            if (!sub || (!sub.subscribed && sub.coreHosted !== true))
                 continue;
             if (await this.hasConfirmedMetaState(contextGraphId)) {
-                // A late private-CG member may never have observed the one-shot public
-                // registry announcement that normally supplies the numeric chain id.
-                // The authenticated curator snapshot carries that immutable binding in
-                // the CG's exact top-level `_meta` graph. Once the full private
-                // definition has passed `hasConfirmedMetaState`, bind and persist it as
-                // part of the same readiness transition. This also makes a completed
-                // catch-up restart-safe instead of leaving `on_chain_id = NULL` in the
-                // durable subscription row.
+                if (this.subscribedContextGraphs.get(contextGraphId) !== sub)
+                    continue;
+                // Confirmed private metadata can fill an unbound late member's numeric id.
+                // Persist this readiness binding so completed catch-up survives restart.
                 const contextGraphUri = contextGraphDataGraphUri(contextGraphId);
                 const metaGraph = contextGraphMetaGraphUri(contextGraphId);
                 const onChainIdPredicate = `${DKG_ONTOLOGY.DKG_CONTEXT_GRAPH}OnChainId`;
@@ -6372,6 +6373,8 @@ export class LifecycleSyncMethods extends DKGAgentBase {
               }
             }
           `, { source: 'agent.durableSync.registrationBinding' });
+                if (this.subscribedContextGraphs.get(contextGraphId) !== sub)
+                    continue;
                 let confirmedOnChainId;
                 let confirmedOnChainHash;
                 let invalidOnChainId = false;
@@ -6398,6 +6401,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     confirmedOnChainHash = undefined;
                 }
                 let current = this.subscribedContextGraphs.get(contextGraphId) ?? sub;
+                if (confirmedOnChainId && isCanonicalAuthoritativeContextGraphId(current.onChainId) && current.onChainId !== confirmedOnChainId) {
+                    this.log.warn(createOperationContext('sync'), `Ignored conflicting confirmed-meta binding for ${contextGraphId}: retained ${current.onChainId}, observed ${confirmedOnChainId}`);
+                    continue;
+                }
                 let registrationChanged = false;
                 let nextOnChainHash = current.onChainHash;
                 if (confirmedOnChainId && current.onChainId !== confirmedOnChainId) {
@@ -6416,6 +6423,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     });
                     current = this.subscribedContextGraphs.get(contextGraphId) ?? current;
                 }
+                const metadataWasPending = current.metaSynced !== true || current.pendingMeta === true;
                 if (current.metaSynced !== true) {
                     this.setContextGraphSubscription(contextGraphId, { ...current, metaSynced: true });
                 }
@@ -6425,12 +6433,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     // (set by the join-approved handler) no longer applies — the
                     // CG will now surface via the normal `_meta` branch in
                     // `listContextGraphs`.
-                    this.setContextGraphSubscription(contextGraphId, {
-                        ...current,
-                        metaSynced: true,
-                        pendingMeta: false,
-                    });
+                    this.setContextGraphSubscription(contextGraphId, { ...current, metaSynced: true, pendingMeta: false });
                 }
+                if (metadataWasPending)
+                    this.announceJoinMetadataConfirmedV1(contextGraphId);
                 // Private responsibility depends on the live ACL projection, not only
                 // on subscription fields. A curator refresh can add/remove the local
                 // agent while `metaSynced`, `subscribed`, and the chain binding all stay
@@ -6454,7 +6460,8 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const explicitNextWireId = next.onChainHash === undefined
             ? undefined
             : this.contextGraphWireId(next.onChainHash);
-        const adoptsWireOnlySubscription = wireOnlySubscription !== null
+        const adoptsWireOnlySubscription = options?.deferWireAdoption !== true && wireOnlySubscription !== null
+            && mayAdoptContextGraphWireSubscription(next, wireOnlySubscription.subscription)
             && (explicitNextWireId === undefined || explicitNextWireId === localWireId)
             && (next.onChainId === undefined
                 || wireOnlySubscription.subscription.onChainId === undefined
@@ -6471,28 +6478,16 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             // was first recorded under.
             ...(adoptsWireOnlySubscription
                 && wireOnlySubscription.subscription.coreHosted === true
-                && next.coreHosted === undefined
                 ? { coreHosted: true }
                 : {}),
         });
         if (adoptsWireOnlySubscription) {
-            // A private chain event reaches an Edge before its join approval and can
-            // only identify the graph by the committed name hash. Once a trusted
-            // local path supplies the matching cleartext id, that hash-only row is
-            // an identity placeholder rather than a second graph. Retire it before
-            // publishing the canonical row so its RFC-64 responsibility, binding
-            // fence, and receiver lifecycle cannot remain active under the wire id.
-            // Host-mode bookkeeping is already wire-keyed and therefore survives
-            // this local-identity promotion without rewiring its ciphertext topic.
+            // Retire the authenticated placeholder before publishing its canonical
+            // row so no RFC-64 responsibility, binding or receiver stays wire-keyed.
             this.deleteContextGraphSubscription(wireOnlySubscription.localId);
             if (this.wireIdToLocalCgId.get(localWireId) === wireOnlySubscription.localId) {
                 this.wireIdToLocalCgId.delete(localWireId);
             }
-            // A placeholder can be durable (a `dkg subscribe <hash> --save` row, or
-            // a Core's hosted row). Delete that record too, whatever this caller's
-            // persist flag: otherwise the next rehydration resurrects the hash row
-            // and re-points the reverse index away from the cleartext id.
-            this.retirePersistedContextGraphNamePlaceholder(wireOnlySubscription.localId, wireOnlySubscription.subscription);
             this.log.info(createOperationContext('system'), `Promoted wire-only Context Graph ${localWireId.slice(0, 18)}… to local identity "${contextGraphId}"`);
         }
         const previousWireId = previous?.onChainHash
@@ -6506,13 +6501,21 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             ...normalizedNext,
             ...(normalizedNext.onChainHash === nextOnChainHash ? {} : { onChainHash: nextOnChainHash }),
         };
+        const retainsInactiveBinding = retainsInactiveContextGraphBinding(previous, canonicalNext);
         const bindingFacts = this.contextGraphBindingState.applySubscriptionTransition(contextGraphId, previous, canonicalNext, nextWireId);
         if (previousWireId !== nextWireId
             && this.wireIdToLocalCgId.get(previousWireId) === contextGraphId) {
             this.wireIdToLocalCgId.delete(previousWireId);
         }
         this.subscribedContextGraphs.set(contextGraphId, canonicalNext);
-        this.wireIdToLocalCgId.set(nextWireId, contextGraphId);
+        const wireOwnerId = this.wireIdToLocalCgId.get(nextWireId);
+        const wireOwner = wireOwnerId === undefined ? undefined : this.subscribedContextGraphs.get(wireOwnerId);
+        const preserveWireOwner = options?.deferWireAdoption === true || ((options?.preserveAdmittedWireBinding === true || retainsInactiveBinding)
+            && wireOwnerId !== contextGraphId
+            && (wireOwner?.subscribed === true || wireOwner?.coreHosted === true)
+            && (retainsInactiveBinding || wireOwner.onChainId !== canonicalNext.onChainId));
+        if (!preserveWireOwner)
+            this.wireIdToLocalCgId.set(nextWireId, contextGraphId);
         if ((canonicalNext.subscribed === true || canonicalNext.coreHosted === true)
             && previous?.subscribed !== true
             && previous?.coreHosted !== true) {
@@ -6573,20 +6576,20 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         else if (!bindingFacts.admitted) {
             this.clearVmReconcileStateForContextGraph(contextGraphId);
         }
-        // On-demand member subscriptions deliberately keep their live state and
-        // readiness process-local. A Core's independent hosting obligation is
-        // still durable, though: persistContextGraphSubscription writes a
-        // host-only snapshot without converting the member intent to always-on.
         const persistence = projectContextGraphSubscriptionPersistence({
             contextGraphId,
             subscription: canonicalNext,
             syncScoped: (this.config.syncContextGraphs ?? []).includes(contextGraphId),
+            preserveInactiveIntent: options?.persist !== true && retainsInactiveBinding
+                && previous?.subscribed !== true && previous?.coreHosted !== true,
         });
         if (options?.persist !== false && persistence.action !== 'skip') {
             if (this.config.contextGraphSubscriptionStore) {
                 const revision = this.nextContextGraphSubscriptionPersistRevision(contextGraphId);
                 this.persistContextGraphSubscription(contextGraphId, {
                     revision,
+                    preserveDormantHosting: previous?.coreHosted !== true || canonicalNext.coreHosted === true,
+                    retiredNamePredecessor: adoptsWireOnlySubscription ? { ...wireOnlySubscription.subscription, id: wireOnlySubscription.localId } : undefined,
                     updateRehydrationStatus: options?.updateRehydrationStatus !== false,
                 });
             }
@@ -6713,21 +6716,31 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         const hostedActivatedIds = status.hostedActivatedIds ?? [];
         const wasAccounted = this.contextGraphSubscriptionRehydrationAccountedIds.has(contextGraphId);
         const isPersisted = next?.subscribed === true || next?.coreHosted === true;
+        const live = this.subscribedContextGraphs.get(contextGraphId);
+        const isActive = live?.subscribed === true || live?.coreHosted === true;
         let persistedTotal = status.persistedTotal;
         let activated = status.activated;
         const dormancyById = this.contextGraphSubscriptionDormancyById;
-        dormancyById.delete(contextGraphId);
+        if (!isPersisted || isActive)
+            dormancyById.delete(contextGraphId);
+        else
+            dormancyById.set(contextGraphId, dormancyById.get(contextGraphId)
+                ?? (status.rehydrationEnabled ? 'authorityUnavailable' : 'rehydrationDisabled'));
         let nextHostedActivatedIds = hostedActivatedIds.filter((id) => id !== contextGraphId);
-        if (next?.coreHosted === true) {
+        if (live?.coreHosted === true) {
             nextHostedActivatedIds = sortIds([...nextHostedActivatedIds, contextGraphId]);
         }
         if (isPersisted) {
-            if (wasDormant) {
+            if (wasDormant && isActive) {
                 activated += 1;
             }
             else if (!wasAccounted) {
                 persistedTotal += 1;
-                activated += 1;
+                if (isActive)
+                    activated += 1;
+            }
+            else if (!wasDormant && !isActive) {
+                activated = Math.max(0, activated - 1);
             }
             this.contextGraphSubscriptionRehydrationAccountedIds.add(contextGraphId);
         }
@@ -6933,6 +6946,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         return this.persistContextGraphSubscription(contextGraphId, {
             revision: this.nextContextGraphSubscriptionPersistRevision(contextGraphId),
             updateRehydrationStatus: false,
+            preserveInactiveIntent: true,
         });
     }
     persistContextGraphSubscription(contextGraphId, options) {
@@ -6943,44 +6957,45 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             return Promise.resolve();
         }
         const sub = this.subscribedContextGraphs.get(contextGraphId);
-        const persistence = projectContextGraphSubscriptionPersistence({
-            contextGraphId,
-            subscription: sub,
+        const generation = this.contextGraphBindingState.capture(contextGraphId);
+        const revision = options?.revision ?? this.contextGraphSubscriptionPersistRevisions.get(contextGraphId);
+        const input = {
+            contextGraphId, subscription: sub && { ...sub },
             syncScoped: (this.config.syncContextGraphs ?? []).includes(contextGraphId),
-        });
-        if (persistence.action === 'skip') {
-            // Some lifecycle paths persist reconciliation watermarks directly
-            // instead of going through setContextGraphSubscription. Preserve the
-            // process-local lifetime at this lowest shared write boundary too.
+            preserveInactiveIntent: options?.preserveInactiveIntent,
+        };
+        if (projectContextGraphSubscriptionPersistence(input).action === 'skip') {
             this.clearContextGraphSubscriptionPersistRevisionStateIfIdle(contextGraphId);
             return Promise.resolve();
         }
-        // Persist member subscriptions AND (Phase D) public CGs this Core hosts —
-        // the host-only record MUST survive restart so a Core that was offline
-        // during a publish remembers it hosts the CG and fills its gap. Drop the
-        // row only when the node neither subscribes to nor hosts the CG.
         this.beginContextGraphSubscriptionPersistRevision(contextGraphId, options?.revision);
-        if (persistence.action === 'delete') {
-            return this.enqueueContextGraphSubscriptionPersistWrite(contextGraphId, () => store.delete(contextGraphId))
-                .then(() => {
-                if (options?.updateRehydrationStatus === true &&
-                    this.claimContextGraphSubscriptionPersistRevision(contextGraphId, options.revision)) {
-                    this.updateContextGraphSubscriptionRehydrationStatusAfterPersist(contextGraphId, undefined);
-                }
-            })
-                .catch((err) => {
-                this.log.warn(createOperationContext('system'), `Failed to delete persisted context-graph subscription for "${contextGraphId}": ${err instanceof Error ? err.message : String(err)}`);
-            })
-                .finally(() => {
-                this.finishContextGraphSubscriptionPersistRevision(contextGraphId, options?.revision);
-            });
-        }
-        const record = persistence.record;
-        return this.enqueueContextGraphSubscriptionPersistWrite(contextGraphId, () => store.save(record))
-            .then(() => {
-            if (options?.updateRehydrationStatus === true &&
-                this.claimContextGraphSubscriptionPersistRevision(contextGraphId, options.revision)) {
-                this.updateContextGraphSubscriptionRehydrationStatusAfterPersist(contextGraphId, record);
+        let written = false;
+        let persisted;
+        return this.enqueueContextGraphSubscriptionPersistWrite(contextGraphId, async () => {
+            const persistence = input.subscription?.coreHosted === true
+                ? projectContextGraphSubscriptionPersistence(input)
+                : await projectContextGraphSubscriptionPersistenceWithSavedHosting(input, store, options?.preserveDormantHosting);
+            const current = this.subscribedContextGraphs.get(contextGraphId);
+            const retired = persistence.action === 'delete' && current === undefined;
+            if (persistence.action === 'skip' || (!retired && (!this.contextGraphBindingState.isGenerationCurrent(contextGraphId, generation)
+                || !isContextGraphSubscriptionPersistenceTargetCurrent(sub, input, current, {
+                    revision,
+                    pendingRevisions: this.contextGraphSubscriptionPersistPendingRevisions.get(contextGraphId),
+                    syncScoped: (this.config.syncContextGraphs ?? []).includes(contextGraphId),
+                }))))
+                return;
+            if (persistence.action === 'delete')
+                await store.delete(contextGraphId);
+            else {
+                persisted = persistence.record;
+                await store.save(persisted);
+            }
+            await this.retirePersistedContextGraphNamePredecessors(input, sub, generation, revision, persistence, options?.retiredNamePredecessor);
+            written = true;
+        }).then(() => {
+            if (written && options?.updateRehydrationStatus === true
+                && this.claimContextGraphSubscriptionPersistRevision(contextGraphId, options.revision)) {
+                this.updateContextGraphSubscriptionRehydrationStatusAfterPersist(contextGraphId, persisted);
             }
         }).catch((err) => {
             this.log.warn(createOperationContext('system'), `Failed to persist context-graph subscription for "${contextGraphId}": ${err instanceof Error ? err.message : String(err)}`);
@@ -7042,6 +7057,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // Queue behind any fire-and-forget writes scheduled by subscribe/mark so
         // this final authoritative snapshot is the last write before the ACK.
         await this.enqueueContextGraphSubscriptionPersistWrite(input.contextGraphId, async () => {
+            const hostedRecord = await readPreservedContextGraphCoreHosting(store, record);
             const current = this.subscribedContextGraphs.get(input.contextGraphId);
             if (!(input.isCurrent?.() ?? true)
                 || current !== expectedLiveSub
@@ -7049,7 +7065,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 || !this.contextGraphBindingState.isGenerationCurrent(input.contextGraphId, expectedBindingGeneration)) {
                 throw asSyncFetchAbortError(new Error(`Context graph "${input.contextGraphId}" changed before its strict subscription snapshot (${input.operation}) was persisted`));
             }
-            await store.save(record);
+            await store.save(hostedRecord);
         });
     }
     /**
@@ -7116,22 +7132,19 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     ? await subscriptionStore.load(contextGraphId)
                     : (await subscriptionStore.loadAll()).find((row) => row.id === contextGraphId) ?? null;
             }
-            const subscriptionRecord = {
-                id: contextGraphId,
-                name: subscription.name,
-                subscribed: subscription.subscribed,
-                synced: subscription.synced,
-                sharedMemorySynced: subscription.sharedMemorySynced,
-                metaSynced: subscription.metaSynced,
-                onChainId: subscription.onChainId,
-                onChainHash: subscription.onChainHash,
-                lastReconciledOrdinal: subscription.lastReconciledOrdinal,
-                coreHosted: subscription.coreHosted,
-                syncScoped: true,
-            };
+            const subscriptionRecord = projectContextGraphJoinSubscriptionRecord(contextGraphId, subscription);
             let membershipAttempted = false;
             let subscriptionAttempted = false;
             try {
+                const expectedLiveSub = this.subscribedContextGraphs.get(contextGraphId);
+                const generation = this.contextGraphBindingState.capture(contextGraphId);
+                const hostedRecord = subscriptionStore
+                    ? await readPreservedContextGraphCoreHosting(subscriptionStore, subscriptionRecord, previousSubscription)
+                    : subscriptionRecord;
+                if (subscriptionStore && (this.subscribedContextGraphs.get(contextGraphId) !== expectedLiveSub
+                    || !this.contextGraphBindingState.isGenerationCurrent(contextGraphId, generation))) {
+                    throw asSyncFetchAbortError(new Error(`Context graph "${contextGraphId}" changed before join persistence`));
+                }
                 if (membershipStore) {
                     membershipAttempted = true;
                     await membershipStore.upsert({
@@ -7142,7 +7155,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 }
                 if (subscriptionStore) {
                     subscriptionAttempted = true;
-                    await subscriptionStore.save(subscriptionRecord);
+                    await subscriptionStore.save(hostedRecord);
                 }
             }
             catch (error) {
@@ -7310,20 +7323,27 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 lastReconciledOrdinal: record.lastReconciledOrdinal,
                 coreHosted: record.coreHosted,
             }, {
-                persist: false,
+                persist: false, deferWireAdoption: true,
                 updateRehydrationStatus: input.updateRehydrationStatus,
             }),
             current: (contextGraphId) => this.subscribedContextGraphs.get(contextGraphId),
             remove: (contextGraphId) => this.deleteContextGraphSubscription(contextGraphId),
+            restoreInactive: (id, previous) => void this.setContextGraphSubscription(id, previous, { persist: false, preserveAdmittedWireBinding: true }),
             rollbackNetworkEffects: (contextGraphId) => this.unsubscribeFromContextGraph(contextGraphId, { persist: false, updateRehydrationStatus: false }),
             trackSync: (contextGraphId) => this.trackSyncContextGraph(contextGraphId),
             subscribe: (contextGraphId) => this.subscribeToContextGraph(contextGraphId, {
                 trackSyncScope: false,
-                persist: false,
+                persist: false, deferWireAdoption: true,
                 syncMode: 'always-on',
             }),
-            persistMembership: (contextGraphId) => {
-                this.persistLocalNodeMembership(contextGraphId, 'rehydrated-subscription');
+            persistMembership: (id) => this.persistLocalNodeMembership(id, 'rehydrated-subscription'),
+            commit: (id) => {
+                const wire = this.resolveWireOnlyContextGraphSubscription(id);
+                this.retireLiveContextGraphNamePlaceholderFor(id);
+                const committed = this.setContextGraphSubscription(id, this.subscribedContextGraphs.get(id), { persist: false, preserveAdmittedWireBinding: true });
+                if (wire && !this.subscribedContextGraphs.has(wire.localId))
+                    void this.persistContextGraphSubscription(id, { retiredNamePredecessor: { ...wire.subscription, id: wire.localId } });
+                return committed;
             },
         }, options);
     }
@@ -7473,7 +7493,8 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 this.updateContextGraphSubscriptionRehydrationStatusAfterClear([], [contextGraphId]);
                 continue;
             }
-            if (this.subscribedContextGraphs.has(contextGraphId)) {
+            const currentSubscription = this.subscribedContextGraphs.get(contextGraphId);
+            if (currentSubscription?.subscribed || currentSubscription?.coreHosted) {
                 this.contextGraphSubscriptionRehydrationPendingIds.delete(contextGraphId);
                 this.contextGraphSubscriptionDormancyById.delete(contextGraphId);
                 continue;
@@ -7527,7 +7548,8 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 || this.contextGraphSubscriptionDormancyById.get(contextGraphId) !== 'activationCap') {
                 continue;
             }
-            if (this.subscribedContextGraphs.has(contextGraphId)) {
+            const freshSubscription = this.subscribedContextGraphs.get(contextGraphId);
+            if (freshSubscription?.subscribed || freshSubscription?.coreHosted) {
                 this.contextGraphSubscriptionRehydrationPendingIds.delete(contextGraphId);
                 this.contextGraphSubscriptionDormancyById.delete(contextGraphId);
                 continue;
@@ -7675,9 +7697,10 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             this.recordPersistedContextGraphIdAliases(persistedRows);
             this.rewriteContextGraphSyncScopeAliases();
             let rows = persistedRows.filter((r) => !systemContextGraphs.has(r.id));
+            const namePlaceholders = partitionSupersededContextGraphNamePlaceholders(rows);
+            rows = namePlaceholders.active;
             // The operator kill-switch below promises not to touch durable state.
             if (this.config.contextGraphSubscriptionRehydrationEnabled) {
-                const namePlaceholders = partitionSupersededContextGraphNamePlaceholders(rows);
                 for (const superseded of namePlaceholders.superseded) {
                     try {
                         await store.delete(superseded.id);
@@ -7687,7 +7710,6 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         this.log.warn(ctx, `Failed to drop superseded name-hash subscription row ${superseded.id.slice(0, 18)}…: ${error instanceof Error ? error.message : String(error)}`);
                     }
                 }
-                rows = namePlaceholders.active;
             }
             // Validate the cap before either branch below so diagnostics retain the
             // operator's configured cap even when the independent rehydration gate
@@ -7703,12 +7725,19 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                         `(must be a non-negative integer); using default ${DEFAULT_MAX_REHYDRATED_SUBSCRIPTIONS}.`);
                 }
             }
-            // Operator kill-switch: inventory the durable rows for diagnostics but
-            // deliberately do not copy any of them into runtime subscription state.
-            // In particular, do not install gossip handlers, add automatic sync
-            // scope, persist node-membership side effects, or touch the RDF store.
-            // A later explicit subscribe remains a normal live activation and updates
-            // the status through updateContextGraphSubscriptionRehydrationStatusAfterPersist.
+            // Restore exact saved identity before discovery, independently of every
+            // activation gate (disabled, capped or authority-denied). Inactive rows
+            // cannot admit gossip, sync or RFC-64 authority; installation owns no
+            // subscription, membership or RDF writes. Unbound/invalid rows stay
+            // absent, and the fresh authority gates below still own activation.
+            for (const [id, identity] of projectDormantContextGraphIdentities(rows)) {
+                const current = this.subscribedContextGraphs.get(id);
+                if (current?.subscribed || current?.coreHosted)
+                    continue;
+                this.setContextGraphSubscription(id, identity, {
+                    persist: false, preserveAdmittedWireBinding: true,
+                });
+            }
             if (!this.config.contextGraphSubscriptionRehydrationEnabled) {
                 const dormancyById = this.contextGraphSubscriptionDormancyById;
                 dormancyById.clear();
@@ -7722,7 +7751,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                 this.contextGraphSubscriptionRehydrationStatus = {
                     rehydrationEnabled: false,
                     persistedTotal: rows.length,
-                    systemExcluded: persistedRows.length - rows.length,
+                    systemExcluded: persistedRows.length - rows.length - namePlaceholders.superseded.length,
                     hostedActivated: 0,
                     hostedActivatedIds: [],
                     activated: 0,
@@ -7762,10 +7791,9 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             // the cap stay PERSISTED but dormant and are promoted when an earlier
             // rehydrated subscription reaches a safe synced state. Prioritise
             // core-hosted, then subscribed, so the first set is most relevant.
-            // A dormant (capped-out) row has no in-memory entry, so individual
-            // `POST /api/context-graph/unsubscribe` cannot target it. The row remains
-            // eligible for rolling activation or bulk pruning through the existing
-            // DELETE endpoint.
+            // Canonically bound dormant rows retain inactive identity only; no data
+            // lane is active. Every dormant row remains eligible for rolling
+            // activation or explicit pruning through the existing DELETE endpoint.
             // coreHosted graphs MUST always be restored — their chain-driven
             // reconcile / host-mode path depends on it — so EXEMPT them from the cap.
             // The cap (a #997 anti-wedge measure) applies only to the non-hosted
@@ -7976,7 +8004,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             this.contextGraphSubscriptionRehydrationStatus = {
                 rehydrationEnabled: true,
                 persistedTotal: rows.length,
-                systemExcluded: persistedRows.length - rows.length,
+                systemExcluded: persistedRows.length - rows.length - namePlaceholders.superseded.length,
                 hostedActivated: activatedRows.filter((r) => r.coreHosted).length,
                 hostedActivatedIds: activatedRows.filter((r) => r.coreHosted).map((r) => r.id),
                 activated: activatedRows.length,
@@ -8040,29 +8068,13 @@ export class LifecycleSyncMethods extends DKGAgentBase {
         // USER context-graph subscriptions, live and persisted alike. (The store's
         // system-unaware bulk delete is deliberately NOT used here.)
         const systemContextGraphs = new Set(Object.values(SYSTEM_CONTEXT_GRAPHS));
-        // Clearable = a NON-system, NON-coreHosted user subscription. System CGs are
-        // the control plane (above). coreHosted graphs are legitimate hosted graphs
-        // that `unsubscribeFromContextGraph` deliberately keeps wired for host-mode /
-        // chain reconcile (so a teardown can't fully remove them anyway) and that the
-        // rehydration cap already exempts — clearing/counting them here would report a
-        // removal that didn't happen. The clear targets only the stale non-hosted
-        // backlog, the actual #997 wedge.
-        const isClearable = (id, coreHosted) => !systemContextGraphs.has(id) && coreHosted !== true;
-        const activeUserIds = [...this.subscribedContextGraphs.entries()]
-            .filter(([id, s]) => isClearable(id, s?.coreHosted))
-            .map(([id]) => id);
-        // The full persisted clearable backlog (active + dormant rows left behind by
-        // the rehydration cap). Counted up front: `unsubscribeFromContextGraph`
-        // deletes each active row as a side effect, so a post-teardown count would
-        // miss them. Starts empty so a node with NO store reports 0 persisted rows
-        // removed (the active teardown is logged separately) rather than a phantom
-        // count of the in-memory subs.
-        let persistedUserIds = [];
+        // Snapshot saved hosting before teardown: dormant Core intent is not
+        // reflected by the inactive runtime projection. Pending writes are checked
+        // again inside their serial lane before a selective durable deletion.
+        let persistedRows = [];
         if (store) {
             try {
-                persistedUserIds = (await store.loadAll())
-                    .filter((r) => isClearable(r.id, r.coreHosted))
-                    .map((r) => r.id);
+                persistedRows = await store.loadAll();
             }
             catch (err) {
                 // Can't enumerate the persisted backlog → the dormant (capped-out) rows
@@ -8075,6 +8087,7 @@ export class LifecycleSyncMethods extends DKGAgentBase {
                     `Resolve the store error and retry.`);
             }
         }
+        const { activeUserIds, persistedUserIds } = contextGraphSubscriptionClearTargets(this.subscribedContextGraphs, persistedRows, systemContextGraphs);
         const activeUserIdsWithPendingStoreWrite = store
             ? activeUserIds.filter((id) => this.contextGraphSubscriptionPersistence.hasLane(id))
             : [];
@@ -8116,7 +8129,17 @@ export class LifecycleSyncMethods extends DKGAgentBase {
             cleared = 0;
             for (const id of storeDeleteIds) {
                 try {
-                    await this.enqueueContextGraphSubscriptionPersistWrite(id, () => store.delete(id));
+                    let deleted = false;
+                    await this.enqueueContextGraphSubscriptionPersistWrite(id, async () => {
+                        const hosted = store.load ? (await store.load(id))?.coreHosted === true
+                            : (await store.loadAll()).some(row => row.id === id && row.coreHosted === true);
+                        if (hosted || this.subscribedContextGraphs.get(id)?.coreHosted === true)
+                            return;
+                        await store.delete(id);
+                        deleted = true;
+                    });
+                    if (!deleted)
+                        continue;
                     cleared++;
                     clearedIds.push(id);
                 }