@ours.network/cli 2.0.3 → 2.1.0

package/dist/{chunk-ZCCCTR27.js → chunk-YPDZQ4XD.js}

@@ -4,7 +4,7 @@ import {
   explicitApiToken,
   loadConfig,
   resolveApiToken
-} from "./chunk-FXKFSNKS.js";
+} from "./chunk-DTWZF3ZG.js";
 
 // ../../src/boot.ts
 import { adapt_wrapper } from "@adapt-toolkit/sdk/executables";
@@ -89,13 +89,14 @@ function createStartupProgressReporter(stateDir, opts = {}) {
 }
 
 // ../../src/runtime/env.ts
-var VERSION = true ? "3.0.3" : "0.0.0-dev";
+var VERSION = true ? "3.1.0" : "0.0.0-dev";
 var CONFIG = loadConfig();
 var STATE_DIR = CONFIG.stateDir;
 var BROKER_URL = CONFIG.brokerUrl;
 var TRANSPORT = process.env.OURS_TRANSPORT ?? "http";
 var PORT = CONFIG.port;
 var GC_INTERVAL_MS = CONFIG.gcIntervalMs;
+var HISTORY_MAX_BYTES = CONFIG.historyMaxBytes;
 var API_VISIBILITY = CONFIG.apiVisibility;
 var startupHeartbeatMs = Number(process.env.OURS_TEST_STARTUP_HEARTBEAT_MS || "") || void 0;
 var startupProgress = TRANSPORT === "http" ? createStartupProgressReporter(STATE_DIR, { heartbeatMs: startupHeartbeatMs }) : null;
@@ -166,8 +167,8 @@ function locateUnit() {
   const override = process.env.OURS_UNIT_DIR;
   const noCap = process.env.OURS_ADVERTISE_MIGRATE === "0";
   const withNoCap = (dir) => noCap ? [`${dir}-nocap`] : [dir];
-  const candidates = override ? withNoCap(resolve(override)) : [join2(here, "mufl_code"), join2(here, "..", "mufl_code")].flatMap(withNoCap);
-  for (const dir of candidates) {
+  const candidates2 = override ? withNoCap(resolve(override)) : [join2(here, "mufl_code"), join2(here, "..", "mufl_code")].flatMap(withNoCap);
+  for (const dir of candidates2) {
     if (!fs2.existsSync(dir)) continue;
     const muflo = fs2.readdirSync(dir).find((f) => f.endsWith(".muflo"));
     if (muflo) {
@@ -177,7 +178,7 @@ function locateUnit() {
     }
   }
   throw new Error(
-    `no compiled .muflo packet found (looked in: ${candidates.join(", ")})` + (noCap ? ' \u2014 OURS_ADVERTISE_MIGRATE=0 requires a "<dir>-nocap" packet variant (compiled with $advertise = [core.e2e] only); build it or unset the env.' : "")
+    `no compiled .muflo packet found (looked in: ${candidates2.join(", ")})` + (noCap ? ' \u2014 OURS_ADVERTISE_MIGRATE=0 requires a "<dir>-nocap" packet variant (compiled with $advertise = [core.e2e] only); build it or unset the env.' : "")
   );
 }
 var UNIT;
@@ -186,25 +187,702 @@ function setUnit(u) {
 }
 
 // ../../src/identity/model.ts
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
-import * as fs4 from "node:fs";
+import * as fs5 from "node:fs";
 
 // ../../src/history.ts
 import { createHash, randomUUID } from "node:crypto";
+import * as fs4 from "node:fs";
+import { dirname as dirname3, join as join4, resolve as resolve3, sep as sep2 } from "node:path";
+import Database2 from "better-sqlite3";
+
+// ../../src/history-retention.ts
 import * as fs3 from "node:fs";
-import { dirname as dirname2, join as join3, resolve as resolve2, sep } from "node:path";
+import { basename, dirname as dirname2, join as join3, resolve as resolve2, sep } from "node:path";
 import Database from "better-sqlite3";
+var DB_NAME = "history.sqlite3";
+var BLOB_SUBDIR = join3("blobs", "sha256");
+var DELETE_BATCH = 256;
+var VACUUM_PAGES_PER_PASS = 1024;
+var MAX_SYNCHRONOUS_PASSES = 8;
+var LEGACY_VACUUM_LIMIT_BYTES = 128 * 1024 * 1024;
+var SQLITE_MUTATION_UPPER_BOUND = 1024 * 1024;
+var FILE_READ_GRACE_MS = 5 * 60 * 1e3;
+var RETRY_INITIAL_DELAY_MS = 50;
+var RETRY_MAX_DELAY_MS = 5e3;
+var settings = null;
+var approximatePhysicalBytes = 0;
+var running = false;
+var scheduled = null;
+var transientMaintenanceFailure = false;
+var maintenanceRetryDelayMs = RETRY_INITIAL_DELAY_MS;
+var compactionBlocked = /* @__PURE__ */ new Set();
+var inFlightItems = /* @__PURE__ */ new Map();
+var evictedMessages = 0;
+var evictedFiles = 0;
+var orphanedBlobsRemoved = 0;
+var lastRunAtMs = null;
+var cachedStatus = {
+  state: "disabled",
+  enabled: false,
+  max_bytes: 0,
+  physical_bytes: 0,
+  overflow_bytes: 0,
+  protected_logical_bytes: 0,
+  eligible_logical_bytes: 0,
+  protected_items: 0,
+  eligible_items: 0,
+  newest_item_retained: false,
+  maintenance_pending: false,
+  compaction_blocked_identities: [],
+  evicted_messages: 0,
+  evicted_files: 0,
+  orphaned_blobs_removed: 0,
+  last_run_at_ms: null
+};
+function isSafeCap(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function withinStateRoot(path) {
+  if (!settings) return false;
+  const root = settings.stateDir;
+  const candidate = resolve2(path);
+  return candidate === root || candidate.startsWith(`${root}${sep}`);
+}
+function physicalSize(path, seen) {
+  let st;
+  try {
+    st = fs3.lstatSync(path);
+  } catch {
+    return 0;
+  }
+  if (!st.isFile()) return 0;
+  const inode = `${String(st.dev)}:${String(st.ino)}`;
+  if (st.ino && seen.has(inode)) return 0;
+  if (st.ino) seen.add(inode);
+  return typeof st.blocks === "number" ? st.blocks * 512 : st.size;
+}
+function walkRegularFiles(root, visit) {
+  let entries;
+  try {
+    entries = fs3.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const path = join3(root, entry.name);
+    if (entry.isDirectory()) walkRegularFiles(path, visit);
+    else if (entry.isFile()) visit(path);
+  }
+}
+function databasePaths(stateDir) {
+  let entries;
+  try {
+    entries = fs3.readdirSync(stateDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => join3(stateDir, entry.name, DB_NAME)).filter((path) => fs3.existsSync(path)).sort();
+}
+function measureHistoryStorage(stateDir = settings?.stateDir) {
+  if (!stateDir) return 0;
+  const seen = /* @__PURE__ */ new Set();
+  let total = 0;
+  for (const dbPath of databasePaths(stateDir)) {
+    for (const suffix of ["", "-wal", "-shm"]) total += physicalSize(`${dbPath}${suffix}`, seen);
+    walkRegularFiles(join3(dirname2(dbPath), BLOB_SUBDIR), (path) => {
+      total += physicalSize(path, seen);
+    });
+  }
+  return total;
+}
+function openMaintenanceDatabase(path) {
+  const db = new Database(path);
+  db.pragma("busy_timeout = 50");
+  db.pragma("foreign_keys = ON");
+  return db;
+}
+function isRetryableSqliteError(error) {
+  const code = error && typeof error === "object" && "code" in error ? String(error.code ?? "") : "";
+  if (code === "SQLITE_BUSY" || code.startsWith("SQLITE_BUSY_") || code === "SQLITE_LOCKED" || code.startsWith("SQLITE_LOCKED_")) return true;
+  return /(?:database|table) is locked|database is busy/i.test(String(error));
+}
+function recordMaintenanceError(error, identityName) {
+  if (isRetryableSqliteError(error)) transientMaintenanceFailure = true;
+  else compactionBlocked.add(identityName);
+}
+function checkpointDatabase(db) {
+  const rows = db.pragma("wal_checkpoint(TRUNCATE)");
+  if (Number(rows[0]?.busy ?? 0) === 0) return true;
+  transientMaintenanceFailure = true;
+  return false;
+}
+function prepareHistoryDatabase(path) {
+  if (!fs3.existsSync(path)) return;
+  const identityName = basename(dirname2(path));
+  let db = null;
+  try {
+    db = openMaintenanceDatabase(path);
+    const mode = Number(db.pragma("auto_vacuum", { simple: true }));
+    if (mode === 2) {
+      compactionBlocked.delete(identityName);
+      return;
+    }
+    if (mode === 1) {
+      db.pragma("auto_vacuum = INCREMENTAL");
+      compactionBlocked.delete(identityName);
+      return;
+    }
+    const bytes = physicalSize(path, /* @__PURE__ */ new Set());
+    if (bytes > LEGACY_VACUUM_LIMIT_BYTES) {
+      compactionBlocked.add(identityName);
+      return;
+    }
+    if (!checkpointDatabase(db)) return;
+    db.pragma("journal_mode = DELETE");
+    db.pragma("auto_vacuum = INCREMENTAL");
+    db.exec("VACUUM");
+    db.pragma("journal_mode = WAL");
+    compactionBlocked.delete(identityName);
+  } catch (error) {
+    recordMaintenanceError(error, identityName);
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+}
+function newestItem(dbPath) {
+  let db = null;
+  try {
+    db = openMaintenanceDatabase(dbPath);
+    const row = db.prepare(`
+      SELECT kind, seq, occurred_at_ms, inserted_at_ms, logical_bytes, eligible FROM (
+        SELECT 'message' AS kind, seq, occurred_at_ms, inserted_at_ms,
+               length(CAST(body AS BLOB)) + 512 AS logical_bytes,
+               CASE WHEN inbox_state = 'read' AND direction = 'in' THEN 1
+                 WHEN direction = 'out' AND delivery_state IN ('delivered','read') THEN 1 ELSE 0 END AS eligible
+        FROM messages
+        UNION ALL
+        SELECT 'file' AS kind, seq, occurred_at_ms, inserted_at_ms, byte_length + 512 AS logical_bytes,
+               CASE WHEN direction = 'in' AND inbox_state = 'read' AND human_read_at_ms <= ? THEN 1
+                 WHEN direction = 'out' AND delivery_state IN ('delivered','read') THEN 1 ELSE 0 END AS eligible
+        FROM files
+      ) ORDER BY inserted_at_ms DESC, occurred_at_ms DESC, kind DESC, seq DESC LIMIT 1
+    `).get(Date.now() - FILE_READ_GRACE_MS);
+    return row ? {
+      identityDir: dirname2(dbPath),
+      kind: row.kind,
+      seq: row.seq,
+      occurredAtMs: row.occurred_at_ms,
+      insertedAtMs: row.inserted_at_ms,
+      logicalBytes: Number(row.logical_bytes),
+      eligible: row.eligible === 1
+    } : null;
+  } catch (error) {
+    recordMaintenanceError(error, basename(dirname2(dbPath)));
+    return null;
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+}
+function newer(a, b) {
+  if (a.insertedAtMs !== b.insertedAtMs) return a.insertedAtMs > b.insertedAtMs;
+  if (a.occurredAtMs !== b.occurredAtMs) return a.occurredAtMs > b.occurredAtMs;
+  if (a.identityDir !== b.identityDir) return a.identityDir > b.identityDir;
+  if (a.kind !== b.kind) return a.kind > b.kind;
+  return a.seq > b.seq;
+}
+function globalNewest(paths) {
+  let newest = null;
+  for (const path of paths) {
+    const item = newestItem(path);
+    if (item && (!newest || newer(item, newest))) newest = item;
+  }
+  return newest;
+}
+function isSameItem(a, b) {
+  return !!b && a.identityDir === b.identityDir && a.kind === b.kind && a.seq === b.seq;
+}
+function inFlightKey(identityDir2, kind, wireId) {
+  return `${resolve2(identityDir2)}\0${kind}\0${wireId}`;
+}
+function candidates(paths, newest) {
+  const result = [];
+  for (const dbPath of paths) {
+    let db = null;
+    try {
+      db = openMaintenanceDatabase(dbPath);
+      const rows = db.prepare(`
+        SELECT kind, seq, wire_id, occurred_at_ms, inserted_at_ms, logical_bytes, blob_relpath FROM (
+          SELECT 'message' AS kind, seq, wire_id, occurred_at_ms, inserted_at_ms,
+                 length(CAST(body AS BLOB)) + 512 AS logical_bytes, NULL AS blob_relpath
+          FROM messages WHERE (direction = 'in' AND inbox_state = 'read')
+            OR (direction = 'out' AND delivery_state IN ('delivered','read'))
+          UNION ALL
+          SELECT 'file' AS kind, seq, wire_id, occurred_at_ms, inserted_at_ms,
+                 byte_length + 512 AS logical_bytes, blob_relpath
+          FROM files WHERE (direction = 'in' AND inbox_state = 'read' AND human_read_at_ms <= ?)
+            OR (direction = 'out' AND delivery_state IN ('delivered','read'))
+        ) ORDER BY occurred_at_ms ASC, inserted_at_ms ASC, kind ASC, seq ASC LIMIT ?
+      `).all(Date.now() - FILE_READ_GRACE_MS, DELETE_BATCH + 1);
+      for (const row of rows) {
+        const item = {
+          dbPath,
+          identityDir: dirname2(dbPath),
+          kind: row.kind,
+          seq: row.seq,
+          wireId: row.wire_id,
+          occurredAtMs: row.occurred_at_ms,
+          insertedAtMs: row.inserted_at_ms,
+          logicalBytes: Number(row.logical_bytes),
+          eligible: true,
+          blobRelpath: row.blob_relpath
+        };
+        if (!isSameItem(item, newest) && !inFlightItems.has(inFlightKey(item.identityDir, item.kind, item.wireId))) {
+          result.push(item);
+        }
+      }
+    } catch (error) {
+      recordMaintenanceError(error, basename(dirname2(dbPath)));
+    } finally {
+      try {
+        db?.close();
+      } catch {
+      }
+    }
+  }
+  result.sort((a, b) => a.occurredAtMs - b.occurredAtMs || a.insertedAtMs - b.insertedAtMs || a.identityDir.localeCompare(b.identityDir) || a.kind.localeCompare(b.kind) || a.seq - b.seq);
+  return result.slice(0, DELETE_BATCH);
+}
+function safeBlobPath(identityDir2, relpath) {
+  const root = resolve2(join3(identityDir2, BLOB_SUBDIR));
+  const path = resolve2(identityDir2, relpath);
+  return path.startsWith(`${root}${sep}`) ? path : null;
+}
+function pruneEmptyBlobDirs(identityDir2, from) {
+  const stop = resolve2(join3(identityDir2, "blobs"));
+  let current = resolve2(dirname2(from));
+  while (current.startsWith(`${stop}${sep}`)) {
+    try {
+      fs3.rmdirSync(current);
+    } catch {
+      break;
+    }
+    current = dirname2(current);
+  }
+}
+function unlinkBlobIfOrphaned(db, identityDir2, relpath) {
+  if (db.prepare("SELECT 1 FROM files WHERE blob_relpath = ? LIMIT 1").get(relpath)) return false;
+  const path = safeBlobPath(identityDir2, relpath);
+  if (!path) return false;
+  try {
+    const st = fs3.lstatSync(path);
+    if (!st.isFile()) return false;
+    fs3.unlinkSync(path);
+    pruneEmptyBlobDirs(identityDir2, path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function deleteCandidates(items, targetBytes) {
+  const selected = [];
+  let logical = 0;
+  for (const item of items) {
+    selected.push(item);
+    logical += Math.max(1, item.logicalBytes);
+    if (logical >= targetBytes) break;
+  }
+  const byDatabase = /* @__PURE__ */ new Map();
+  for (const item of selected) {
+    const rows = byDatabase.get(item.dbPath) ?? [];
+    rows.push(item);
+    byDatabase.set(item.dbPath, rows);
+  }
+  let deleted = 0;
+  for (const [dbPath, rows] of byDatabase) {
+    let db = null;
+    try {
+      db = openMaintenanceDatabase(dbPath);
+      const removedBlobs = [];
+      db.transaction(() => {
+        const delMessage = db.prepare(`
+          DELETE FROM messages WHERE seq = ? AND inbox_state = 'read'
+            AND (direction = 'in' OR delivery_state IN ('delivered','read'))
+        `);
+        const delFile = db.prepare(`
+          DELETE FROM files WHERE seq = ? AND (
+            (direction = 'in' AND inbox_state = 'read' AND human_read_at_ms <= ?)
+            OR (direction = 'out' AND delivery_state IN ('delivered','read'))
+          )
+        `);
+        for (const row of rows) {
+          const changes = row.kind === "message" ? delMessage.run(row.seq).changes : delFile.run(row.seq, Date.now() - FILE_READ_GRACE_MS).changes;
+          if (changes !== 1) continue;
+          deleted += 1;
+          if (row.kind === "message") evictedMessages += 1;
+          else {
+            evictedFiles += 1;
+            if (row.blobRelpath) removedBlobs.push(row.blobRelpath);
+          }
+        }
+      })();
+      for (const relpath of new Set(removedBlobs)) {
+        if (unlinkBlobIfOrphaned(db, dirname2(dbPath), relpath)) orphanedBlobsRemoved += 1;
+      }
+      checkpointDatabase(db);
+      if (Number(db.pragma("auto_vacuum", { simple: true })) === 2) {
+        db.pragma(`incremental_vacuum(${VACUUM_PAGES_PER_PASS})`);
+        checkpointDatabase(db);
+        compactionBlocked.delete(basename(dirname2(dbPath)));
+      } else {
+        compactionBlocked.add(basename(dirname2(dbPath)));
+      }
+    } catch (error) {
+      recordMaintenanceError(error, basename(dirname2(dbPath)));
+    } finally {
+      try {
+        db?.close();
+      } catch {
+      }
+    }
+  }
+  return deleted;
+}
+function recoverOrphanedBlobs(dbPath) {
+  const identityDir2 = dirname2(dbPath);
+  let db = null;
+  let removed = 0;
+  try {
+    db = openMaintenanceDatabase(dbPath);
+    const referenced = new Set(
+      db.prepare("SELECT DISTINCT blob_relpath FROM files").pluck().all().map((p) => resolve2(identityDir2, p))
+    );
+    const root = join3(identityDir2, BLOB_SUBDIR);
+    const paths = [];
+    walkRegularFiles(root, (path) => paths.push(path));
+    for (const path of paths) {
+      if (referenced.has(resolve2(path))) continue;
+      try {
+        fs3.unlinkSync(path);
+        removed += 1;
+        pruneEmptyBlobDirs(identityDir2, path);
+      } catch {
+      }
+    }
+  } catch (error) {
+    recordMaintenanceError(error, basename(identityDir2));
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+  return removed;
+}
+function logicalStats(paths, newest) {
+  const totals = {
+    protectedBytes: 0,
+    eligibleBytes: 0,
+    protectedItems: 0,
+    eligibleItems: 0,
+    newestRetained: false
+  };
+  for (const dbPath of paths) {
+    let db = null;
+    try {
+      db = openMaintenanceDatabase(dbPath);
+      const row = db.prepare(`
+        SELECT
+          COALESCE(SUM(CASE WHEN eligible = 1 THEN logical_bytes ELSE 0 END), 0) AS eligible_bytes,
+          COALESCE(SUM(CASE WHEN eligible = 0 THEN logical_bytes ELSE 0 END), 0) AS protected_bytes,
+          COALESCE(SUM(eligible), 0) AS eligible_items,
+          COALESCE(SUM(CASE WHEN eligible = 0 THEN 1 ELSE 0 END), 0) AS protected_items
+        FROM (
+          SELECT length(CAST(body AS BLOB)) + 512 AS logical_bytes,
+            CASE WHEN direction = 'in' AND inbox_state = 'read' THEN 1
+              WHEN direction = 'out' AND delivery_state IN ('delivered','read') THEN 1 ELSE 0 END AS eligible
+          FROM messages
+          UNION ALL
+          SELECT byte_length + 512 AS logical_bytes,
+            CASE WHEN direction = 'in' AND inbox_state = 'read' AND human_read_at_ms <= ? THEN 1
+              WHEN direction = 'out' AND delivery_state IN ('delivered','read') THEN 1 ELSE 0 END AS eligible
+          FROM files
+          UNION ALL
+          SELECT length(CAST(body AS BLOB)) + 512, 0 FROM monitoring_items
+          UNION ALL
+          SELECT length(CAST(payload AS BLOB)) + 512, 0 FROM control_requests
+        )
+      `).get(Date.now() - FILE_READ_GRACE_MS);
+      totals.eligibleBytes += Number(row.eligible_bytes);
+      totals.protectedBytes += Number(row.protected_bytes);
+      totals.eligibleItems += Number(row.eligible_items);
+      totals.protectedItems += Number(row.protected_items);
+    } catch (error) {
+      recordMaintenanceError(error, basename(dirname2(dbPath)));
+    } finally {
+      try {
+        db?.close();
+      } catch {
+      }
+    }
+  }
+  if (newest?.eligible) {
+    totals.newestRetained = true;
+    totals.eligibleItems = Math.max(0, totals.eligibleItems - 1);
+    totals.protectedItems += 1;
+    totals.eligibleBytes = Math.max(0, totals.eligibleBytes - newest.logicalBytes);
+    totals.protectedBytes += newest.logicalBytes;
+  }
+  for (const item of inFlightItems.values()) {
+    let db = null;
+    try {
+      db = openMaintenanceDatabase(join3(item.identityDir, DB_NAME));
+      const table = item.kind === "file" ? "files" : "messages";
+      const sizeExpr = item.kind === "file" ? "byte_length + 512" : "length(CAST(body AS BLOB)) + 512";
+      const eligibility = item.kind === "file" ? `((direction = 'in' AND inbox_state = 'read' AND human_read_at_ms <= ?)
+             OR (direction = 'out' AND delivery_state IN ('delivered','read')))` : `((direction = 'in' AND inbox_state = 'read')
+             OR (direction = 'out' AND delivery_state IN ('delivered','read')))`;
+      const row = db.prepare(`
+        SELECT seq, ${sizeExpr} AS logical_bytes FROM ${table}
+        WHERE wire_id = ? AND ${eligibility}
+      `).get(...item.kind === "file" ? [item.wireId, Date.now() - FILE_READ_GRACE_MS] : [item.wireId]);
+      if (!row) continue;
+      if (isSameItem({ identityDir: item.identityDir, kind: item.kind, seq: row.seq }, newest)) continue;
+      const bytes = Number(row.logical_bytes);
+      totals.eligibleItems = Math.max(0, totals.eligibleItems - 1);
+      totals.protectedItems += 1;
+      totals.eligibleBytes = Math.max(0, totals.eligibleBytes - bytes);
+      totals.protectedBytes += bytes;
+    } catch (error) {
+      recordMaintenanceError(error, basename(item.identityDir));
+    } finally {
+      try {
+        db?.close();
+      } catch {
+      }
+    }
+  }
+  return totals;
+}
+function hasReclaimablePages(paths) {
+  let reclaimable = false;
+  for (const dbPath of paths) {
+    const identityName = basename(dirname2(dbPath));
+    let db = null;
+    try {
+      db = openMaintenanceDatabase(dbPath);
+      if (Number(db.pragma("auto_vacuum", { simple: true })) === 2) {
+        if (Number(db.pragma("freelist_count", { simple: true })) > 0) reclaimable = true;
+      } else {
+        compactionBlocked.add(identityName);
+      }
+    } catch (error) {
+      recordMaintenanceError(error, identityName);
+    } finally {
+      try {
+        db?.close();
+      } catch {
+      }
+    }
+  }
+  return reclaimable;
+}
+function compactDatabases(paths) {
+  for (const dbPath of paths) {
+    const identityName = basename(dirname2(dbPath));
+    let db = null;
+    try {
+      db = openMaintenanceDatabase(dbPath);
+      const firstCheckpoint = checkpointDatabase(db);
+      if (Number(db.pragma("auto_vacuum", { simple: true })) === 2) {
+        db.pragma(`incremental_vacuum(${VACUUM_PAGES_PER_PASS})`);
+        const secondCheckpoint = checkpointDatabase(db);
+        if (firstCheckpoint && secondCheckpoint) compactionBlocked.delete(identityName);
+      } else {
+        compactionBlocked.add(identityName);
+      }
+    } catch (error) {
+      recordMaintenanceError(error, identityName);
+    } finally {
+      try {
+        db?.close();
+      } catch {
+      }
+    }
+  }
+}
+function classify(physical, logical, reclaimable) {
+  const maxBytes = settings?.maxBytes ?? 0;
+  const enabled = maxBytes > 0;
+  const overflow = enabled ? Math.max(0, physical - maxBytes) : 0;
+  const blocked = [...compactionBlocked].sort();
+  let state;
+  if (!enabled) state = "disabled";
+  else if (overflow === 0) state = "within_cap";
+  else if (transientMaintenanceFailure || logical.eligibleItems > 0 || reclaimable) state = "maintenance_pending";
+  else if (blocked.length > 0) state = "compaction_blocked";
+  else state = "protected_overflow";
+  return {
+    state,
+    enabled,
+    max_bytes: maxBytes,
+    physical_bytes: physical,
+    overflow_bytes: overflow,
+    protected_logical_bytes: logical.protectedBytes,
+    eligible_logical_bytes: logical.eligibleBytes,
+    protected_items: logical.protectedItems,
+    eligible_items: logical.eligibleItems,
+    newest_item_retained: logical.newestRetained,
+    maintenance_pending: state === "maintenance_pending",
+    compaction_blocked_identities: blocked,
+    evicted_messages: evictedMessages,
+    evicted_files: evictedFiles,
+    orphaned_blobs_removed: orphanedBlobsRemoved,
+    last_run_at_ms: lastRunAtMs
+  };
+}
+function pruneMissingBlockedIdentities(paths) {
+  const present = new Set(paths.map((path) => basename(dirname2(path))));
+  for (const name of compactionBlocked) if (!present.has(name)) compactionBlocked.delete(name);
+}
+function refreshStatus() {
+  const paths = settings ? databasePaths(settings.stateDir) : [];
+  pruneMissingBlockedIdentities(paths);
+  const physical = settings ? measureHistoryStorage(settings.stateDir) : 0;
+  approximatePhysicalBytes = physical;
+  cachedStatus = classify(physical, logicalStats(paths, globalNewest(paths)), hasReclaimablePages(paths));
+  return cachedStatus;
+}
+function scheduleMaintenance() {
+  if (scheduled || !settings || settings.maxBytes === 0) return;
+  const delayMs = transientMaintenanceFailure ? maintenanceRetryDelayMs : 0;
+  maintenanceRetryDelayMs = transientMaintenanceFailure ? Math.min(RETRY_MAX_DELAY_MS, maintenanceRetryDelayMs * 2) : RETRY_INITIAL_DELAY_MS;
+  scheduled = setTimeout(() => {
+    scheduled = null;
+    enforceHistoryStorageLimit(1);
+  }, delayMs);
+  scheduled.unref?.();
+}
+function initializeHistoryRetention(stateDir, maxBytes) {
+  if (!isSafeCap(maxBytes)) throw new Error("historyMaxBytes must be a non-negative safe integer");
+  if (scheduled) {
+    clearTimeout(scheduled);
+    scheduled = null;
+  }
+  settings = { stateDir: resolve2(stateDir), maxBytes };
+  approximatePhysicalBytes = 0;
+  running = false;
+  transientMaintenanceFailure = false;
+  maintenanceRetryDelayMs = RETRY_INITIAL_DELAY_MS;
+  compactionBlocked.clear();
+  inFlightItems.clear();
+  evictedMessages = 0;
+  evictedFiles = 0;
+  orphanedBlobsRemoved = 0;
+  lastRunAtMs = null;
+  for (const path of databasePaths(settings.stateDir)) {
+    prepareHistoryDatabase(path);
+    orphanedBlobsRemoved += recoverOrphanedBlobs(path);
+  }
+  return enforceHistoryStorageLimit(2);
+}
+function noteHistoryStorageMutation(identityDir2, payloadBytes = 0) {
+  if (!settings || settings.maxBytes === 0 || !withinStateRoot(identityDir2)) return;
+  approximatePhysicalBytes += Math.max(0, payloadBytes) + SQLITE_MUTATION_UPPER_BOUND;
+  if (approximatePhysicalBytes >= settings.maxBytes) {
+    const status = enforceHistoryStorageLimit(MAX_SYNCHRONOUS_PASSES);
+    if (status.maintenance_pending) scheduleMaintenance();
+  }
+}
+function enforceHistoryStorageLimit(maxPasses = MAX_SYNCHRONOUS_PASSES) {
+  if (!settings) return cachedStatus;
+  if (running) {
+    scheduleMaintenance();
+    return cachedStatus;
+  }
+  running = true;
+  transientMaintenanceFailure = false;
+  try {
+    for (let pass = 0; pass < Math.max(1, maxPasses); pass += 1) {
+      let physical = measureHistoryStorage(settings.stateDir);
+      if (settings.maxBytes === 0 || physical <= settings.maxBytes) break;
+      const paths = databasePaths(settings.stateDir);
+      compactDatabases(paths);
+      const compactedPhysical = measureHistoryStorage(settings.stateDir);
+      if (compactedPhysical <= settings.maxBytes) break;
+      const compacted = compactedPhysical < physical;
+      physical = compactedPhysical;
+      const newest = globalNewest(paths);
+      const available = candidates(paths, newest);
+      if (available.length === 0) {
+        if (!compacted) break;
+        continue;
+      }
+      const removed = deleteCandidates(available, physical - settings.maxBytes);
+      if (removed === 0) break;
+    }
+    lastRunAtMs = Date.now();
+    const status = refreshStatus();
+    if (status.maintenance_pending) scheduleMaintenance();
+    return status;
+  } finally {
+    running = false;
+  }
+}
+function getHistoryStorageStatus() {
+  if (!settings) return { ...cachedStatus, compaction_blocked_identities: [...cachedStatus.compaction_blocked_identities] };
+  const status = refreshStatus();
+  return { ...status, compaction_blocked_identities: [...status.compaction_blocked_identities] };
+}
+function stopHistoryRetention() {
+  if (scheduled) {
+    clearTimeout(scheduled);
+    scheduled = null;
+  }
+}
+function pinHistoryItems(identityDir2, kind, wireIds) {
+  for (const wireId of wireIds) {
+    inFlightItems.set(inFlightKey(identityDir2, kind, wireId), { identityDir: identityDir2, kind, wireId });
+  }
+}
+function unpinHistoryItems(identityDir2, kind, wireIds) {
+  for (const wireId of wireIds) inFlightItems.delete(inFlightKey(identityDir2, kind, wireId));
+}
+function cleanupHistoryBlob(identityDir2, relpath) {
+  const dbPath = join3(identityDir2, DB_NAME);
+  if (!fs3.existsSync(dbPath)) return false;
+  let db = null;
+  try {
+    db = openMaintenanceDatabase(dbPath);
+    const removed = unlinkBlobIfOrphaned(db, identityDir2, relpath);
+    if (removed) orphanedBlobsRemoved += 1;
+    return removed;
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+}
+
+// ../../src/history.ts
 var MAX_BATCH = 200;
 var DEFAULT_BATCH = 50;
 var MAX_TEXT_BYTES = 2 * 1024 * 1024;
 var MAX_FILE_BYTES = 8 * 1024 * 1024;
-var DB_NAME = "history.sqlite3";
+var DB_NAME2 = "history.sqlite3";
 var SCHEMA_VERSION = 1;
 var stores = /* @__PURE__ */ new Map();
 var health = /* @__PURE__ */ new Map();
 var outboundFailures = /* @__PURE__ */ new Map();
-var historyPath = (id) => join3(id.dir, DB_NAME);
+var historyPath = (id) => join4(id.dir, DB_NAME2);
 function initialHealth() {
   return {
     write_failures: 0,
@@ -328,12 +1006,15 @@ function schema(db) {
 function openHistory(id) {
   const existing = stores.get(id.dir);
   if (existing) return existing;
-  fs3.mkdirSync(id.dir, { recursive: true, mode: 448 });
-  fs3.chmodSync(id.dir, 448);
+  fs4.mkdirSync(id.dir, { recursive: true, mode: 448 });
+  fs4.chmodSync(id.dir, 448);
   const path = historyPath(id);
-  const db = new Database(path);
+  const isNew = !fs4.existsSync(path) || fs4.statSync(path).size === 0;
+  if (!isNew) prepareHistoryDatabase(path);
+  const db = new Database2(path);
   try {
-    fs3.chmodSync(path, 384);
+    fs4.chmodSync(path, 384);
+    if (isNew) db.pragma("auto_vacuum = INCREMENTAL");
     db.pragma("journal_mode = WAL");
     db.pragma("synchronous = NORMAL");
     db.pragma("foreign_keys = ON");
@@ -341,7 +1022,7 @@ function openHistory(id) {
     schema(db);
     for (const suffix of ["", "-wal", "-shm"]) {
       const candidate = `${path}${suffix}`;
-      if (fs3.existsSync(candidate)) fs3.chmodSync(candidate, 384);
+      if (fs4.existsSync(candidate)) fs4.chmodSync(candidate, 384);
     }
   } catch (error) {
     db.close();
@@ -430,36 +1111,36 @@ function fileFromRow(id, row) {
     delivery_state: row.delivery_state,
     human_read_at_ms: row.human_read_at_ms,
     reply_to: reply(row),
-    blob_path: join3(id.dir, row.blob_relpath),
+    blob_path: join4(id.dir, row.blob_relpath),
     kind: mime.startsWith("audio/") ? "voice_message" : "file"
   };
 }
 function writeBlob(id, bytes) {
   const sha256 = createHash("sha256").update(bytes).digest("hex");
-  const relpath = join3("blobs", "sha256", sha256.slice(0, 2), sha256);
-  const final = join3(id.dir, relpath);
-  fs3.mkdirSync(dirname2(final), { recursive: true, mode: 448 });
-  fs3.chmodSync(dirname2(final), 448);
-  if (!fs3.existsSync(final)) {
-    const tmp = join3(dirname2(final), `.${sha256}.${process.pid}.${randomUUID()}.tmp`);
+  const relpath = join4("blobs", "sha256", sha256.slice(0, 2), sha256);
+  const final = join4(id.dir, relpath);
+  fs4.mkdirSync(dirname3(final), { recursive: true, mode: 448 });
+  fs4.chmodSync(dirname3(final), 448);
+  if (!fs4.existsSync(final)) {
+    const tmp = join4(dirname3(final), `.${sha256}.${process.pid}.${randomUUID()}.tmp`);
     try {
-      fs3.writeFileSync(tmp, bytes, { flag: "wx", mode: 384 });
-      fs3.chmodSync(tmp, 384);
+      fs4.writeFileSync(tmp, bytes, { flag: "wx", mode: 384 });
+      fs4.chmodSync(tmp, 384);
       try {
-        fs3.renameSync(tmp, final);
+        fs4.renameSync(tmp, final);
       } catch (error) {
-        if (!fs3.existsSync(final)) throw error;
-        fs3.rmSync(tmp, { force: true });
+        if (!fs4.existsSync(final)) throw error;
+        fs4.rmSync(tmp, { force: true });
       }
     } catch (error) {
       try {
-        fs3.rmSync(tmp, { force: true });
+        fs4.rmSync(tmp, { force: true });
       } catch {
       }
       throw error;
     }
   }
-  fs3.chmodSync(final, 384);
+  fs4.chmodSync(final, 384);
   return { sha256, relpath };
 }
 function ingestApplicationEvent(id, event) {
@@ -469,7 +1150,7 @@ function ingestApplicationEvent(id, event) {
   const inboxState = event.direction === "in" ? event.inboxState ?? "unread" : "read";
   const deliveryState = event.direction === "out" ? "sent" : null;
   if (event.kind === "message") {
-    return db.transaction(() => {
+    const inserted2 = db.transaction(() => {
       const claimed = db.prepare(`
         INSERT INTO wire_items(wire_id, item_kind) VALUES (?, 'message')
         ON CONFLICT(wire_id) DO NOTHING
@@ -498,44 +1179,55 @@ function ingestApplicationEvent(id, event) {
       );
       return true;
     })();
+    if (inserted2) noteHistoryStorageMutation(id.dir, Buffer.byteLength(event.body, "utf8"));
+    return inserted2;
   }
   const duplicate = db.prepare("SELECT 1 FROM wire_items WHERE wire_id = ?").get(event.wireId);
   if (duplicate) return false;
   const blob = writeBlob(id, event.bytes);
-  return db.transaction(() => {
-    const claimed = db.prepare(`
-      INSERT INTO wire_items(wire_id, item_kind) VALUES (?, 'file')
-      ON CONFLICT(wire_id) DO NOTHING
-    `).run(event.wireId);
-    if (claimed.changes !== 1) return false;
-    db.prepare(`
-      INSERT INTO files (
-        wire_id, peer_cid, peer_name_snapshot, direction, filename, mime,
-        byte_length, sha256, blob_relpath, occurred_at_ms, reply_to_wire_id,
-        reply_to_sentence, encryption, inbox_state, delivery_state,
-        human_read_at_ms, inserted_at_ms
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(
-      event.wireId,
-      event.peerCid,
-      event.peerName,
-      event.direction,
-      event.filename,
-      event.mime || "application/octet-stream",
-      event.bytes.byteLength,
-      blob.sha256,
-      blob.relpath,
-      event.occurredAtMs,
-      event.replyToWireId ?? null,
-      event.replyToSentence ?? null,
-      event.encryption,
-      inboxState,
-      deliveryState,
-      event.direction === "out" ? event.occurredAtMs : null,
-      Date.now()
-    );
-    return true;
-  })();
+  let inserted;
+  try {
+    inserted = db.transaction(() => {
+      const claimed = db.prepare(`
+        INSERT INTO wire_items(wire_id, item_kind) VALUES (?, 'file')
+        ON CONFLICT(wire_id) DO NOTHING
+      `).run(event.wireId);
+      if (claimed.changes !== 1) return false;
+      db.prepare(`
+        INSERT INTO files (
+          wire_id, peer_cid, peer_name_snapshot, direction, filename, mime,
+          byte_length, sha256, blob_relpath, occurred_at_ms, reply_to_wire_id,
+          reply_to_sentence, encryption, inbox_state, delivery_state,
+          human_read_at_ms, inserted_at_ms
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        event.wireId,
+        event.peerCid,
+        event.peerName,
+        event.direction,
+        event.filename,
+        event.mime || "application/octet-stream",
+        event.bytes.byteLength,
+        blob.sha256,
+        blob.relpath,
+        event.occurredAtMs,
+        event.replyToWireId ?? null,
+        event.replyToSentence ?? null,
+        event.encryption,
+        inboxState,
+        deliveryState,
+        event.direction === "out" ? event.occurredAtMs : null,
+        Date.now()
+      );
+      return true;
+    })();
+  } catch (error) {
+    cleanupHistoryBlob(id.dir, blob.relpath);
+    throw error;
+  }
+  if (!inserted) cleanupHistoryBlob(id.dir, blob.relpath);
+  else noteHistoryStorageMutation(id.dir, event.bytes.byteLength);
+  return inserted;
 }
 function ingestMonitoringEvent(id, event) {
   if (!event.itemId || !event.sourceCid || !event.sourceName || !event.peerCid || !event.peerName) {
@@ -543,7 +1235,7 @@ function ingestMonitoringEvent(id, event) {
   }
   if (!Number.isSafeInteger(event.occurredAtMs) || event.occurredAtMs < 0) throw new Error("invalid monitoring timestamp");
   if (Buffer.byteLength(event.body, "utf8") > MAX_TEXT_BYTES) throw new Error("monitoring body exceeds host limit");
-  return openHistory(id).prepare(`
+  const inserted = openHistory(id).prepare(`
     INSERT INTO monitoring_items (
       item_id, source_cid, source_name_snapshot, direction, peer_cid,
       peer_name_snapshot, body, occurred_at_ms, queue_state, inserted_at_ms
@@ -560,12 +1252,14 @@ function ingestMonitoringEvent(id, event) {
     event.occurredAtMs,
     Date.now()
   ).changes === 1;
+  if (inserted) noteHistoryStorageMutation(id.dir, Buffer.byteLength(event.body, "utf8"));
+  return inserted;
 }
 function ingestControlEvent(id, event) {
   if (!event.itemId || !event.senderCid || !event.senderName) throw new Error("invalid control event metadata");
   if (!Number.isSafeInteger(event.occurredAtMs) || event.occurredAtMs < 0) throw new Error("invalid control timestamp");
   if (Buffer.byteLength(event.payload, "utf8") > MAX_TEXT_BYTES) throw new Error("control payload exceeds host limit");
-  return openHistory(id).prepare(`
+  const inserted = openHistory(id).prepare(`
     INSERT INTO control_requests (
       item_id, sender_cid, sender_name_snapshot, payload,
       occurred_at_ms, queue_state, inserted_at_ms
@@ -579,10 +1273,12 @@ function ingestControlEvent(id, event) {
     event.occurredAtMs,
     Date.now()
   ).changes === 1;
+  if (inserted) noteHistoryStorageMutation(id.dir, Buffer.byteLength(event.payload, "utf8"));
+  return inserted;
 }
 function promotePendingIntroduction(id, peerCid) {
   const db = openHistory(id);
-  return db.transaction(() => {
+  const changed = db.transaction(() => {
     const messages = db.prepare(`
       UPDATE messages SET inbox_state = 'unread'
       WHERE direction = 'in' AND peer_cid = ? AND inbox_state = 'pending_introduction'
@@ -593,10 +1289,16 @@ function promotePendingIntroduction(id, peerCid) {
     `).run(peerCid).changes;
     return messages + files;
   })();
+  if (changed > 0) noteHistoryStorageMutation(id.dir);
+  return changed;
 }
 function rejectPendingIntroduction(id, peerCid) {
   const db = openHistory(id);
-  return db.transaction(() => {
+  const blobRelpaths = db.prepare(`
+    SELECT DISTINCT blob_relpath FROM files
+    WHERE direction = 'in' AND peer_cid = ? AND inbox_state = 'pending_introduction'
+  `).pluck().all(peerCid);
+  const changed = db.transaction(() => {
     const messages = db.prepare(`
       DELETE FROM messages
       WHERE direction = 'in' AND peer_cid = ? AND inbox_state = 'pending_introduction'
@@ -607,6 +1309,9 @@ function rejectPendingIntroduction(id, peerCid) {
     `).run(peerCid).changes;
     return messages + files;
   })();
+  for (const relpath of blobRelpaths) cleanupHistoryBlob(id.dir, relpath);
+  if (changed > 0) noteHistoryStorageMutation(id.dir);
+  return changed;
 }
 function batchLimit(value) {
   const limit = value ?? DEFAULT_BATCH;
@@ -640,7 +1345,7 @@ function takeUnreadMessages(id, input = {}) {
   const db = openHistory(id);
   const limit = batchLimit(input.limit);
   const requested = input.wire_ids;
-  return db.transaction(() => {
+  const result = db.transaction(() => {
     let rows;
     if (requested !== void 0) {
       if (requested.length < 1 || requested.length > MAX_BATCH) {
@@ -676,6 +1381,8 @@ function takeUnreadMessages(id, input = {}) {
     `).pluck().get());
     return { messages: rows.map(messageFromRow), remaining };
   })();
+  if (result.messages.length > 0) noteHistoryStorageMutation(id.dir);
+  return result;
 }
 function listIncomingFiles(id) {
   const rows = openHistory(id).prepare(`
@@ -687,7 +1394,7 @@ function takeUnreadFiles(id, input = {}) {
   const db = openHistory(id);
   const limit = batchLimit(input.limit);
   const requested = input.wire_ids;
-  return db.transaction(() => {
+  const result = db.transaction(() => {
     let rows;
     if (requested !== void 0) {
       if (requested.length < 1 || requested.length > MAX_BATCH) throw new Error(`wire_ids must contain 1-${MAX_BATCH} items`);
@@ -704,18 +1411,21 @@ function takeUnreadFiles(id, input = {}) {
       `).all(limit);
     }
     const mark = db.prepare(`
-      UPDATE files SET inbox_state = 'read'
+      UPDATE files SET inbox_state = 'read', human_read_at_ms = COALESCE(human_read_at_ms, ?)
       WHERE seq = ? AND direction = 'in' AND inbox_state = 'unread'
     `);
     for (const row of rows) {
-      if (mark.run(row.seq).changes !== 1) throw new Error(`file row ${row.seq} changed during read batch`);
+      const readAt = Date.now();
+      if (mark.run(readAt, row.seq).changes !== 1) throw new Error(`file row ${row.seq} changed during read batch`);
       row.inbox_state = "read";
+      row.human_read_at_ms = readAt;
     }
     const remaining = Number(db.prepare(`
       SELECT COUNT(*) FROM files WHERE direction = 'in' AND inbox_state = 'unread'
     `).pluck().get());
     return { files: rows.map((row) => fileFromRow(id, row)), remaining };
   })();
+  return result;
 }
 function historyWhere(query) {
   const clauses = [];
@@ -770,10 +1480,10 @@ function getFileHistoryItem(id, wireId) {
 }
 function resolveStoredFile(id, wireId) {
   const item = getFileHistoryItem(id, wireId);
-  if (!item || !fs3.existsSync(item.blob_path)) return null;
-  const identityRoot = resolve2(id.dir);
-  const resolvedPath = resolve2(item.blob_path);
-  return resolvedPath.startsWith(`${identityRoot}${sep}`) ? resolvedPath : null;
+  if (!item || !fs4.existsSync(item.blob_path)) return null;
+  const identityRoot = resolve3(id.dir);
+  const resolvedPath = resolve3(item.blob_path);
+  return resolvedPath.startsWith(`${identityRoot}${sep2}`) ? resolvedPath : null;
 }
 function updateDeliveryState(id, peerCid, kind, wireIds) {
   const db = openHistory(id);
@@ -791,6 +1501,7 @@ function updateDeliveryState(id, peerCid, kind, wireIds) {
     }
   });
   tx();
+  if (wireIds.length > 0) noteHistoryStorageMutation(id.dir);
 }
 
 // ../../src/constants.ts
@@ -802,6 +1513,7 @@ function setWrapper(w) {
   wrapper = w;
 }
 var identities = /* @__PURE__ */ new Map();
+var quarantinedIdentities = /* @__PURE__ */ new Map();
 var registrar = null;
 var registrarAdBlob = null;
 function setRegistrar(id) {
@@ -810,15 +1522,15 @@ function setRegistrar(id) {
 function setRegistrarAdBlob(blob) {
   registrarAdBlob = blob;
 }
-var identityDir = (name) => join4(STATE_DIR, name);
-var keyPath = (dir) => join4(dir, "identity.key");
-var dataPath = (dir) => join4(dir, "state_data.bin");
-var notifyLogPath = (dir) => join4(dir, "notifications.log");
-var unreadPath = (dir) => join4(dir, "unread.json");
-var tempMetaPath = (dir) => join4(dir, "temp.json");
+var identityDir = (name) => join5(STATE_DIR, name);
+var keyPath = (dir) => join5(dir, "identity.key");
+var dataPath = (dir) => join5(dir, "state_data.bin");
+var notifyLogPath = (dir) => join5(dir, "notifications.log");
+var unreadPath = (dir) => join5(dir, "unread.json");
+var tempMetaPath = (dir) => join5(dir, "temp.json");
 var hashLeaseToken = (token) => createHash2("sha256").update(token).digest("hex");
 function writeTempMetaFile(dir, meta) {
-  fs4.writeFileSync(
+  fs5.writeFileSync(
     tempMetaPath(dir),
     JSON.stringify({ v: 1, owner: { token_sha256: meta.owner.tokenHash, pid: meta.owner.pid }, created_at: meta.createdAt }),
     { mode: 384 }
@@ -826,7 +1538,7 @@ function writeTempMetaFile(dir, meta) {
 }
 function readTempMetaFile(dir) {
   try {
-    const raw = JSON.parse(fs4.readFileSync(tempMetaPath(dir), "utf8"));
+    const raw = JSON.parse(fs5.readFileSync(tempMetaPath(dir), "utf8"));
     if (raw.v !== 1 || typeof raw.owner?.token_sha256 !== "string" || typeof raw.owner?.pid !== "number") return null;
     return {
       owner: { tokenHash: raw.owner.token_sha256, pid: raw.owner.pid },
@@ -838,33 +1550,33 @@ function readTempMetaFile(dir) {
 }
 function tightenIdentityPerms() {
   for (const name of listPersistedNames()) {
-    const dir = join4(STATE_DIR, name);
+    const dir = join5(STATE_DIR, name);
     try {
-      fs4.chmodSync(dir, 448);
+      fs5.chmodSync(dir, 448);
     } catch (err) {
       log(`[${name}] chmod 0700 failed:`, String(err));
     }
     for (const f of [dataPath(dir), keyPath(dir), historyPath({ dir }), `${historyPath({ dir })}-wal`, `${historyPath({ dir })}-shm`, notifyLogPath(dir), unreadPath(dir)]) {
-      if (!fs4.existsSync(f)) continue;
+      if (!fs5.existsSync(f)) continue;
       try {
-        fs4.chmodSync(f, 384);
+        fs5.chmodSync(f, 384);
       } catch (err) {
         log(`[${name}] chmod 0600 ${f} failed:`, String(err));
       }
     }
-    const blobs = join4(dir, "blobs");
-    if (fs4.existsSync(blobs)) {
+    const blobs = join5(dir, "blobs");
+    if (fs5.existsSync(blobs)) {
       const tightenTree = (path) => {
-        for (const entry of fs4.readdirSync(path, { withFileTypes: true })) {
-          const child = join4(path, entry.name);
+        for (const entry of fs5.readdirSync(path, { withFileTypes: true })) {
+          const child = join5(path, entry.name);
           if (entry.isDirectory()) {
-            fs4.chmodSync(child, 448);
+            fs5.chmodSync(child, 448);
             tightenTree(child);
-          } else if (entry.isFile()) fs4.chmodSync(child, 384);
+          } else if (entry.isFile()) fs5.chmodSync(child, 384);
         }
       };
       try {
-        fs4.chmodSync(blobs, 448);
+        fs5.chmodSync(blobs, 448);
         tightenTree(blobs);
       } catch (err) {
         log(`[${name}] chmod history blobs failed:`, String(err));
@@ -883,41 +1595,41 @@ function findIdentityFile(id, wireId) {
   }
 }
 function listPersistedNames() {
-  if (!fs4.existsSync(STATE_DIR)) return [];
-  return fs4.readdirSync(STATE_DIR, { withFileTypes: true }).filter((d) => d.isDirectory() && fs4.existsSync(keyPath(join4(STATE_DIR, d.name)))).map((d) => d.name);
+  if (!fs5.existsSync(STATE_DIR)) return [];
+  return fs5.readdirSync(STATE_DIR, { withFileTypes: true }).filter((d) => d.isDirectory() && fs5.existsSync(keyPath(join5(STATE_DIR, d.name)))).map((d) => d.name);
 }
 
 // ../../src/identity/lease.ts
-import { join as join5 } from "node:path";
-import * as fs5 from "node:fs";
+import { join as join6 } from "node:path";
+import * as fs6 from "node:fs";
 var leases = /* @__PURE__ */ new Map();
 var tombstones = /* @__PURE__ */ new Set();
 var sessionHeaders = /* @__PURE__ */ new Map();
 var outboundRemovalInFlight = /* @__PURE__ */ new Set();
-function pidAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
+function pidDefinitelyDead(pid) {
+  if (!Number.isInteger(pid) || pid <= 1) return false;
   try {
     process.kill(pid, 0);
-    return true;
+    return false;
   } catch (err) {
-    return err.code === "EPERM";
+    return err.code === "ESRCH";
   }
 }
 function leaseByToken(token) {
   for (const l of leases.values()) if (l.token === token) return l;
   return void 0;
 }
-var bindingsSnapshotPath = () => join5(STATE_DIR, "bindings.json");
+var bindingsSnapshotPath = () => join6(STATE_DIR, "bindings.json");
 function persistBindings() {
   try {
-    fs5.mkdirSync(STATE_DIR, { recursive: true });
+    fs6.mkdirSync(STATE_DIR, { recursive: true });
     const tmp = `${bindingsSnapshotPath()}.tmp`;
-    fs5.writeFileSync(tmp, JSON.stringify({
+    fs6.writeFileSync(tmp, JSON.stringify({
       pid: process.pid,
       bound: [...leases.keys()],
       holders: [...leases.values()].map((l) => ({ identity: l.identity, pid: l.pid }))
     }));
-    fs5.renameSync(tmp, bindingsSnapshotPath());
+    fs6.renameSync(tmp, bindingsSnapshotPath());
   } catch (err) {
     log("failed to persist bindings snapshot:", String(err));
   }
@@ -963,19 +1675,19 @@ function bindSession(sid, name) {
 }
 
 // ../../src/identity/hierarchy.ts
-import { join as join8 } from "node:path";
-import * as fs10 from "node:fs";
+import { join as join9 } from "node:path";
+import * as fs11 from "node:fs";
 
 // ../../src/mufl/tx.ts
 import { AdaptObjectLifetime as AdaptObjectLifetime2 } from "@adapt-toolkit/sdk/common";
 import { object_to_adapt_value } from "@adapt-toolkit/sdk/wrapper";
 
 // ../../src/state.ts
-import * as fs9 from "node:fs";
+import * as fs10 from "node:fs";
 import { randomBytes as randomBytes2 } from "node:crypto";
 
 // ../../src/identity/provision.ts
-import * as fs8 from "node:fs";
+import * as fs9 from "node:fs";
 import { randomBytes } from "node:crypto";
 import { PacketWrapperConfigurator } from "@adapt-toolkit/sdk/wrappers";
 
@@ -983,8 +1695,8 @@ import { PacketWrapperConfigurator } from "@adapt-toolkit/sdk/wrappers";
 import { AdaptObjectLifetime } from "@adapt-toolkit/sdk/common";
 
 // ../../src/notify.ts
-import { join as join6 } from "node:path";
-import * as fs6 from "node:fs";
+import { join as join7 } from "node:path";
+import * as fs7 from "node:fs";
 
 // ../../src/events.ts
 var nonEmptyString = (value) => typeof value === "string" && value.length > 0;
@@ -1108,7 +1820,7 @@ function fireNotifyWaiters(name) {
   }
 }
 function waitForNotify(name, ms) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let set = notifyWaiters.get(name);
     if (!set) {
       set = /* @__PURE__ */ new Set();
@@ -1121,7 +1833,7 @@ function waitForNotify(name, ms) {
       set.delete(fn);
       if (set.size === 0) notifyWaiters.delete(name);
       clearTimeout(timer);
-      resolve3();
+      resolve4();
     };
     const fn = finish;
     const timer = setTimeout(finish, ms);
@@ -1146,10 +1858,10 @@ function bodyFreeNotifyValue(value) {
 function appendNotifyLog(id, event) {
   const contentFree = bodyFreeNotifyValue(event);
   try {
-    fs6.mkdirSync(id.dir, { recursive: true, mode: 448 });
+    fs7.mkdirSync(id.dir, { recursive: true, mode: 448 });
     const path = notifyLogPath(id.dir);
-    fs6.appendFileSync(path, JSON.stringify(contentFree) + "\n", { mode: 384 });
-    fs6.chmodSync(path, 384);
+    fs7.appendFileSync(path, JSON.stringify(contentFree) + "\n", { mode: 384 });
+    fs7.chmodSync(path, 384);
   } catch (err) {
     log(`[${id.name}] failed to append notifications.log:`, String(err));
   }
@@ -1164,7 +1876,7 @@ var NOTIFY_LONGPOLL_MS = Number(process.env.OURS_NOTIFY_LONGPOLL_MS) > 0 ? Numbe
 var NOTIFY_RECHECK_MS = 250;
 function notifyLogSize(logPath) {
   try {
-    return fs6.statSync(logPath).size;
+    return fs7.statSync(logPath).size;
   } catch {
     return 0;
   }
@@ -1174,11 +1886,11 @@ function readNotifyRange(logPath, from, to) {
   const buf = Buffer.alloc(to - from);
   let read = 0;
   try {
-    const fd = fs6.openSync(logPath, "r");
+    const fd = fs7.openSync(logPath, "r");
     try {
-      read = fs6.readSync(fd, buf, 0, buf.length, from);
+      read = fs7.readSync(fd, buf, 0, buf.length, from);
     } finally {
-      fs6.closeSync(fd);
+      fs7.closeSync(fd);
     }
   } catch {
     return { events: [], cursor: from };
@@ -1197,7 +1909,7 @@ function readNotifyRange(logPath, from, to) {
   return { events, cursor: from + lastNl + 1 };
 }
 async function serveNotifications(req, res, name, sinceParam, kindsParam = null) {
-  const logPath = notifyLogPath(join6(STATE_DIR, name));
+  const logPath = notifyLogPath(join7(STATE_DIR, name));
   const send = (cursor, events) => {
     if (res.writableEnded) return;
     res.writeHead(200, { "Content-Type": "application/json" });
@@ -1268,11 +1980,11 @@ function refreshUnread(id) {
       files: unreadFiles.length,
       unread_files: unreadFiles.slice(-10)
     };
-    fs6.mkdirSync(id.dir, { recursive: true, mode: 448 });
+    fs7.mkdirSync(id.dir, { recursive: true, mode: 448 });
     const tmp = `${unreadPath(id.dir)}.tmp`;
-    fs6.writeFileSync(tmp, JSON.stringify(snapshot), { mode: 384 });
-    fs6.chmodSync(tmp, 384);
-    fs6.renameSync(tmp, unreadPath(id.dir));
+    fs7.writeFileSync(tmp, JSON.stringify(snapshot), { mode: 384 });
+    fs7.chmodSync(tmp, 384);
+    fs7.renameSync(tmp, unreadPath(id.dir));
   } catch (err) {
     log(`[${id.name}] failed to refresh unread snapshot:`, String(err));
   }
@@ -1281,7 +1993,7 @@ function unreadSummary() {
   const out = [];
   let entries = [];
   try {
-    entries = fs6.readdirSync(STATE_DIR, { withFileTypes: true });
+    entries = fs7.readdirSync(STATE_DIR, { withFileTypes: true });
   } catch {
     return { identities: out };
   }
@@ -1289,7 +2001,7 @@ function unreadSummary() {
     if (!entry.isDirectory() || validateName(entry.name) !== null) continue;
     let value;
     try {
-      value = JSON.parse(fs6.readFileSync(unreadPath(join6(STATE_DIR, entry.name)), "utf8"));
+      value = JSON.parse(fs7.readFileSync(unreadPath(join7(STATE_DIR, entry.name)), "utf8"));
     } catch {
       continue;
     }
@@ -1834,24 +2546,24 @@ function wireHandlers(id, hooks) {
 }
 
 // ../../src/book.ts
-import { join as join7 } from "node:path";
-import * as fs7 from "node:fs";
-var bookDir = () => join7(STATE_DIR, BOOK_DIR_NAME);
-var registrarKeyPath = () => join7(bookDir(), "registrar.key");
-var bookPath = () => join7(bookDir(), "book.json");
+import { join as join8 } from "node:path";
+import * as fs8 from "node:fs";
+var bookDir = () => join8(STATE_DIR, BOOK_DIR_NAME);
+var registrarKeyPath = () => join8(bookDir(), "registrar.key");
+var bookPath = () => join8(bookDir(), "book.json");
 function readBook() {
   try {
-    const parsed = JSON.parse(fs7.readFileSync(bookPath(), "utf8"));
+    const parsed = JSON.parse(fs8.readFileSync(bookPath(), "utf8"));
     return parsed && typeof parsed.entries === "object" ? parsed.entries : {};
   } catch {
     return {};
   }
 }
 function writeBook(entries) {
-  fs7.mkdirSync(bookDir(), { recursive: true });
+  fs8.mkdirSync(bookDir(), { recursive: true });
   const tmp = `${bookPath()}.tmp`;
-  fs7.writeFileSync(tmp, JSON.stringify({ v: 1, entries }, null, 2), { mode: 384 });
-  fs7.renameSync(tmp, bookPath());
+  fs8.writeFileSync(tmp, JSON.stringify({ v: 1, entries }, null, 2), { mode: 384 });
+  fs8.renameSync(tmp, bookPath());
 }
 function exportAdBlob(id) {
   return withScope(
@@ -1902,6 +2614,85 @@ async function pinRegistrar(id) {
   });
 }
 
+// ../../src/identity/migration.ts
+function wasPublished(id) {
+  return Object.values(readBook()).some((entry) => entry.container_id === id.cid);
+}
+async function finishRestoredActivation(id) {
+  wrapper.expose_packet(id.cid);
+  identities.set(id.name, id);
+  quarantinedIdentities.delete(id.name);
+  log(`[${id.name}] EXPOSED (routing + broker registration) \u2014 hierarchy reconciled after restore`);
+  try {
+    await contactRestoreSweep(id);
+  } catch (err) {
+    log(`[${id.name}] post-activation contact restore sweep failed:`, String(err));
+  }
+  try {
+    refreshUnread(id);
+  } catch (err) {
+    log(`[${id.name}] post-activation unread refresh failed:`, String(err));
+  }
+  return id;
+}
+function quarantine(id, status) {
+  const exposeLocal = wasPublished(id);
+  if (exposeLocal) unpublishFromBook(id);
+  identities.delete(id.name);
+  quarantinedIdentities.set(id.name, { identity: id, status, exposeLocal });
+  log(`[${id.name}] QUARANTINED (${status}) \u2014 management-only, unexposed and unbindable`);
+  return id;
+}
+async function reconcileRestoredIdentity(id) {
+  if (rootName === id.name) return finishRestoredActivation(id);
+  const hostRoot = rootName ? identities.get(rootName) : void 0;
+  let info;
+  try {
+    info = describeIdentity(id);
+  } catch (err) {
+    log(`[${id.name}] hierarchy classification failed:`, String(err));
+    return quarantine(id, "migration-failed");
+  }
+  if (hostRoot) {
+    if (info.hasCert && info.roleId !== "" && info.rootCid !== hostRoot.cid) {
+      log(`[${id.name}] preserved imported delegation from root ${info.rootCid.slice(0, 12)}\u2026`);
+      return finishRestoredActivation(id);
+    }
+    try {
+      await delegateRole(hostRoot, id);
+      return finishRestoredActivation(id);
+    } catch (err) {
+      log(`[${id.name}] root delegation during restore failed:`, String(err));
+      return quarantine(id, "migration-failed");
+    }
+  }
+  if (info.hasCert && info.roleId !== "") return finishRestoredActivation(id);
+  return quarantine(id, "awaiting-root");
+}
+async function adoptQuarantinedIdentities(root) {
+  const adopted = [];
+  const failed = [];
+  for (const [name, held] of [...quarantinedIdentities]) {
+    try {
+      await delegateRole(root, held.identity);
+      if (held.exposeLocal) await publishToBook(held.identity);
+      await finishRestoredActivation(held.identity);
+      quarantinedIdentities.delete(name);
+      adopted.push(name);
+    } catch (err) {
+      try {
+        unpublishFromBook(held.identity);
+      } catch {
+      }
+      held.status = "migration-failed";
+      quarantinedIdentities.set(name, held);
+      log(`[${name}] quarantine adoption failed under root "${root.name}":`, String(err));
+      failed.push(name);
+    }
+  }
+  return { adopted, failed };
+}
+
 // ../../src/identity/provision.ts
 function createPacket(name, seed, dir, track = true, signingSecret, deferExposure = false) {
   const config = new PacketWrapperConfigurator();
@@ -1958,7 +2749,7 @@ async function provisionIdentity(name, opts = { exposeLocal: true, localAutoAcce
   let provisioned;
   try {
     const dir = identityDir(name);
-    fs8.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs9.mkdirSync(dir, { recursive: true, mode: 448 });
     let tempMeta;
     if (opts.temp) {
       tempMeta = { owner: { tokenHash: opts.temp.tokenHash, pid: opts.temp.pid }, createdAt: Date.now() };
@@ -1969,7 +2760,7 @@ async function provisionIdentity(name, opts = { exposeLocal: true, localAutoAcce
     provisioned = id;
     openHistory(id);
     if (tempMeta) id.temp = tempMeta;
-    fs8.writeFileSync(keyPath(dir), exportSigningSecret(id), { mode: 384 });
+    fs9.writeFileSync(keyPath(dir), exportSigningSecret(id), { mode: 384 });
     await withScopeAsync(async (lt) => {
       await mutatingTx(id, "::a2a_messaging::set_my_name", { name }, lt);
     });
@@ -1992,7 +2783,7 @@ async function provisionIdentity(name, opts = { exposeLocal: true, localAutoAcce
 }
 async function restoreIdentity(name) {
   const dir = identityDir(name);
-  const secret = fs8.readFileSync(keyPath(dir), "utf8").trim();
+  const secret = fs9.readFileSync(keyPath(dir), "utf8").trim();
   const id = await createPacket(name, "", dir, false, secret, true);
   log(`[${name}] created QUARANTINED (no routing/broker registration, not client-bindable) \u2014 importing state before exposure`);
   const holdMs = Number(process.env.OURS_TEST_RESTORE_HOLD_MS || "") || 0;
@@ -2017,7 +2808,7 @@ async function restoreIdentity(name) {
       if (process.env.OURS_TEST_FORCE_IMPORT_TIMEOUT === "1") {
         throw new Error("timed out waiting for the transaction result (forced by OURS_TEST_FORCE_IMPORT_TIMEOUT)");
       }
-      const buf = fs8.readFileSync(dataPath(dir));
+      const buf = fs9.readFileSync(dataPath(dir));
       await withScopeAsync(async (lt) => {
         const adaptData = id.pw.packet.ParseValue(new Uint8Array(buf)).Attach(lt);
         const importTimeoutMs = Number(process.env.OURS_IMPORT_TIMEOUT_MS || "") || void 0;
@@ -2086,33 +2877,30 @@ async function restoreIdentity(name) {
   } catch (err) {
     tearDownUnexposed("history_open", "FAILED (SQLite history unavailable)", err);
   }
-  wrapper.expose_packet(id.cid);
-  identities.set(name, id);
-  log(`[${name}] EXPOSED (routing + broker registration) \u2014 import phase complete`);
-  await contactRestoreSweep(id);
-  refreshUnread(id);
-  return id;
+  const restoredTemp = readTempMetaFile(id.dir);
+  if (restoredTemp) id.temp = restoredTemp;
+  return reconcileRestoredIdentity(id);
 }
 
 // ../../src/state.ts
 async function ensureRegistrar() {
-  fs9.mkdirSync(bookDir(), { recursive: true });
+  fs10.mkdirSync(bookDir(), { recursive: true });
   let secret;
   try {
-    secret = fs9.readFileSync(registrarKeyPath(), "utf8").trim();
+    secret = fs10.readFileSync(registrarKeyPath(), "utf8").trim();
   } catch {
   }
   const seed = randomBytes2(24).toString("hex");
   setRegistrar(await createPacket(BOOK_DIR_NAME, seed, bookDir(), false, secret));
   if (!secret) {
-    fs9.writeFileSync(registrarKeyPath(), exportSigningSecret(registrar), { mode: 384 });
+    fs10.writeFileSync(registrarKeyPath(), exportSigningSecret(registrar), { mode: 384 });
   }
   setRegistrarAdBlob(exportAdBlob(registrar));
   log(`contact-book registrar ready (${registrar.cid})`);
 }
 function hasSavedState(dir) {
   try {
-    return fs9.existsSync(dataPath(dir)) && fs9.statSync(dataPath(dir)).size > 0;
+    return fs10.existsSync(dataPath(dir)) && fs10.statSync(dataPath(dir)).size > 0;
   } catch {
     return false;
   }
@@ -2121,38 +2909,38 @@ function saveState(id) {
   const bytes = withScope(
     (lt) => Buffer.from(readonlyTx(id, "::actor::export_state", lt).Serialize())
   );
-  fs9.mkdirSync(id.dir, { recursive: true, mode: 448 });
+  fs10.mkdirSync(id.dir, { recursive: true, mode: 448 });
   const final = dataPath(id.dir);
   const tmp = `${final}.tmp`;
   let fd;
   try {
-    fd = fs9.openSync(tmp, "w", 384);
-    fs9.fchmodSync(fd, 384);
-    fs9.writeFileSync(fd, bytes);
-    fs9.fsyncSync(fd);
-    fs9.closeSync(fd);
+    fd = fs10.openSync(tmp, "w", 384);
+    fs10.fchmodSync(fd, 384);
+    fs10.writeFileSync(fd, bytes);
+    fs10.fsyncSync(fd);
+    fs10.closeSync(fd);
     fd = void 0;
-    fs9.renameSync(tmp, final);
-    fs9.chmodSync(final, 384);
+    fs10.renameSync(tmp, final);
+    fs10.chmodSync(final, 384);
     try {
-      fs9.chmodSync(keyPath(id.dir), 384);
+      fs10.chmodSync(keyPath(id.dir), 384);
     } catch {
     }
-    const dirFd = fs9.openSync(id.dir, "r");
+    const dirFd = fs10.openSync(id.dir, "r");
     try {
-      fs9.fsyncSync(dirFd);
+      fs10.fsyncSync(dirFd);
     } finally {
-      fs9.closeSync(dirFd);
+      fs10.closeSync(dirFd);
     }
   } catch (err) {
     if (fd !== void 0) {
       try {
-        fs9.closeSync(fd);
+        fs10.closeSync(fd);
       } catch {
       }
     }
     try {
-      fs9.rmSync(tmp, { force: true });
+      fs10.rmSync(tmp, { force: true });
     } catch {
     }
     throw err;
@@ -2264,24 +3052,24 @@ function mutatingTx(id, name, targ, lt, timeoutMs) {
 function setRootName(name) {
   rootName = name;
 }
-var rootMarkerPath = () => join8(STATE_DIR, "root.json");
+var rootMarkerPath = () => join9(STATE_DIR, "root.json");
 var rootName = null;
 function readRootMarker() {
   try {
-    const parsed = JSON.parse(fs10.readFileSync(rootMarkerPath(), "utf8"));
+    const parsed = JSON.parse(fs11.readFileSync(rootMarkerPath(), "utf8"));
     return typeof parsed.name === "string" ? parsed.name : null;
   } catch {
     return null;
   }
 }
 function writeRootMarker(name) {
-  fs10.mkdirSync(STATE_DIR, { recursive: true });
+  fs11.mkdirSync(STATE_DIR, { recursive: true });
   const tmp = `${rootMarkerPath()}.tmp`;
-  fs10.writeFileSync(tmp, JSON.stringify({ v: 1, name }));
-  fs10.renameSync(tmp, rootMarkerPath());
+  fs11.writeFileSync(tmp, JSON.stringify({ v: 1, name }));
+  fs11.renameSync(tmp, rootMarkerPath());
 }
 function clearRootMarker() {
-  fs10.rmSync(rootMarkerPath(), { force: true });
+  fs11.rmSync(rootMarkerPath(), { force: true });
 }
 function describeIdentity(id) {
   return withScope((lt) => {
@@ -2345,9 +3133,12 @@ async function establishRoot(id) {
   return { adopted, failed };
 }
 
+// ../../src/identity/reaper.ts
+import { join as join10 } from "node:path";
+import * as fs13 from "node:fs";
+
 // ../../src/identity/lifecycle.ts
-import { join as join9 } from "node:path";
-import * as fs11 from "node:fs";
+import * as fs12 from "node:fs";
 
 // ../../src/render/adapt-to-json.ts
 import { brotliCompressSync, brotliDecompressSync } from "node:zlib";
@@ -2672,7 +3463,7 @@ function deleteIdentityCompletely(id) {
     clearRootMarker();
   }
   try {
-    fs11.rmSync(id.dir, { recursive: true, force: true });
+    fs12.rmSync(id.dir, { recursive: true, force: true });
     reservedNames.delete(id.name);
   } catch (err) {
     return `deleting ${id.dir} failed: ${String(err)}`;
@@ -2724,31 +3515,46 @@ function closeTemporaryIdentity(id, cause) {
   })();
   return t.closing;
 }
-function sweepStaleTempIdentities() {
-  for (const id of [...identities.values()]) {
+
+// ../../src/identity/reaper.ts
+function sessionReaperIntervalMs(raw = process.env.OURS_SESSION_REAPER_INTERVAL_MS) {
+  if (raw === void 0 || raw.trim() === "") return 5e3;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed)) return 5e3;
+  return Math.max(100, Math.trunc(parsed));
+}
+async function reapStaleTemporaryIdentities() {
+  const all = [
+    ...identities.values(),
+    ...[...quarantinedIdentities.values()].map((held) => held.identity)
+  ];
+  const closes = [];
+  for (const id of all) {
     const t = id.temp;
-    if (!t || t.closing) continue;
-    if (pidAlive(t.owner.pid)) continue;
+    if (!t || t.closing || !pidDefinitelyDead(t.owner.pid)) continue;
     const lease = leases.get(id.name);
-    if (lease && pidAlive(lease.pid)) continue;
-    void closeTemporaryIdentity(id, `stale lease \u2014 owner pid ${t.owner.pid} is dead`).catch(
-      (err) => log(`[${id.name}] stale-temp reclaim failed:`, String(err))
+    if (lease && !pidDefinitelyDead(lease.pid)) continue;
+    closes.push(
+      closeTemporaryIdentity(id, `stale lease \u2014 owner pid ${t.owner.pid} is dead`).then(() => {
+        quarantinedIdentities.delete(id.name);
+      }).catch((err) => log(`[${id.name}] stale-temp reclaim failed:`, String(err)))
     );
   }
+  await Promise.all(closes);
 }
-function sweepOrphanTempDirs() {
-  if (!fs11.existsSync(STATE_DIR)) return;
-  for (const d of fs11.readdirSync(STATE_DIR, { withFileTypes: true })) {
-    if (!d.isDirectory() || identities.has(d.name)) continue;
-    const dir = join9(STATE_DIR, d.name);
+async function reapOrphanTemporaryDirectories() {
+  if (!fs13.existsSync(STATE_DIR)) return;
+  for (const d of fs13.readdirSync(STATE_DIR, { withFileTypes: true })) {
+    if (!d.isDirectory() || identities.has(d.name) || quarantinedIdentities.has(d.name)) continue;
+    const dir = join10(STATE_DIR, d.name);
     const meta = readTempMetaFile(dir);
-    if (!meta || pidAlive(meta.owner.pid)) continue;
+    if (!meta || !pidDefinitelyDead(meta.owner.pid)) continue;
     try {
-      fs11.rmSync(dir, { recursive: true, force: true });
+      fs13.rmSync(dir, { recursive: true, force: true });
       reservedNames.delete(d.name);
-      log(`[${d.name}] removed orphaned temporary-identity dir (owner pid ${meta.owner.pid} dead, no live packet)`);
+      log(`[${d.name}] removed orphaned temporary-identity dir (owner pid ${meta.owner.pid} confirmed dead)`);
     } catch (err) {
-      log(`[${d.name}] failed to remove orphaned temporary-identity dir:`, String(err));
+      throw new Error(`[${d.name}] failed to remove orphaned temporary-identity dir: ${String(err)}`);
     }
   }
 }
@@ -2859,7 +3665,9 @@ async function bootWrapper() {
     log("failed to start the contact-book registrar (local contact book disabled):", String(err));
   }
   tightenIdentityPerms();
-  const names = listPersistedNames();
+  setRootName(readRootMarker());
+  const persistedNames = listPersistedNames();
+  const names = rootName && persistedNames.includes(rootName) ? [rootName, ...persistedNames.filter((name) => name !== rootName)] : persistedNames;
   const fakeRestoreCount = Math.max(0, Number(process.env.OURS_TEST_FAKE_RESTORE_COUNT || "") || 0);
   const fakeRestoreMs = Math.max(0, Number(process.env.OURS_TEST_FAKE_RESTORE_MS || "") || 0);
   const restoreTotal = names.length === 0 && fakeRestoreCount > 0 ? fakeRestoreCount : names.length;
@@ -2945,8 +3753,8 @@ async function bootWrapper() {
     if (refreshedRoles.length > 0) log(`refreshed ${refreshedRoles.length} role delegation cert(s) against the live AD on boot`);
   }
   persistBindings();
-  sweepOrphanTempDirs();
-  sweepStaleTempIdentities();
+  await reapOrphanTemporaryDirectories();
+  await reapStaleTemporaryIdentities();
 }
 
 export {
@@ -2956,12 +3764,21 @@ export {
   BROKER_URL,
   PORT,
   GC_INTERVAL_MS,
+  HISTORY_MAX_BYTES,
   API_VISIBILITY,
   startupProgress,
   log,
   requireAuth,
   validateName,
+  initializeHistoryRetention,
+  noteHistoryStorageMutation,
+  getHistoryStorageStatus,
+  stopHistoryRetention,
+  pinHistoryItems,
+  unpinHistoryItems,
   consumeOutboundHistoryFailure,
+  openHistory,
+  closeHistory,
   listIncomingMessages,
   takeUnreadMessages,
   listIncomingFiles,
@@ -2972,8 +3789,12 @@ export {
   listFileHistory,
   getFileHistoryItem,
   FILE_SELECTION_CAP,
+  wrapper,
   identities,
+  quarantinedIdentities,
   registrar,
+  identityDir,
+  keyPath,
   hashLeaseToken,
   writeTempMetaFile,
   isSelectableWireId,
@@ -2982,7 +3803,7 @@ export {
   tombstones,
   sessionHeaders,
   outboundRemovalInFlight,
-  pidAlive,
+  pidDefinitelyDead,
   leaseByToken,
   persistBindings,
   resolveBound,
@@ -3000,11 +3821,16 @@ export {
   e2eRecoverySweep,
   readBook,
   exportAdBlob,
+  exportSigningSecret,
   publishToBook,
   unpublishFromBook,
+  pinRegistrar,
+  adoptQuarantinedIdentities,
+  createPacket,
   reservedNames,
   provisionIdentity,
   saveState,
+  saveStateFailClosed,
   withScope,
   withScopeAsync,
   readonlyTx,
@@ -3025,7 +3851,8 @@ export {
   decodeWireBin,
   deleteIdentityCompletely,
   closeTemporaryIdentity,
-  sweepStaleTempIdentities,
+  sessionReaperIntervalMs,
+  reapStaleTemporaryIdentities,
   envelopeDispatch,
   PROTOCOL_VERSION,
   clusterSweep,