@ours.network/cli 2.0.3 → 2.1.0

package/dist/{server-TVV2EZZ6.js → server-3PM3QOPD.js}

@@ -4,19 +4,23 @@ import {
   CONFIG,
   FILE_SELECTION_CAP,
   GC_INTERVAL_MS,
+  HISTORY_MAX_BYTES,
   PORT,
   PROTOCOL_VERSION,
   STATE_DIR,
   VERSION,
+  adoptQuarantinedIdentities,
   appendNotifyLog,
   bindSession,
   bootWrapper,
   capabilityReconcileSweep,
   clearNotifyHook,
+  closeHistory,
   closeTemporaryIdentity,
   clusterSweep,
   consumeOutboundHistoryFailure,
   contactRestoreSweep,
+  createPacket,
   decodeWireBin,
   delegateRole,
   deleteIdentityCompletely,
@@ -26,13 +30,18 @@ import {
   envelopeDispatch,
   establishRoot,
   exportAdBlob,
+  exportSigningSecret,
   findIdentityFile,
   getFileHistoryItem,
+  getHistoryStorageStatus,
   getMessageHistoryItem,
   getMessageHistorySummary,
   hashLeaseToken,
   identities,
+  identityDir,
+  initializeHistoryRetention,
   isSelectableWireId,
+  keyPath,
   leaseByToken,
   leases,
   listFileHistory,
@@ -41,13 +50,19 @@ import {
   listMessageHistory,
   log,
   mutatingTx,
+  noteHistoryStorageMutation,
+  openHistory,
   outboundRemovalInFlight,
   persistBindings,
-  pidAlive,
+  pidDefinitelyDead,
+  pinHistoryItems,
+  pinRegistrar,
   provisionIdentity,
   publishToBook,
+  quarantinedIdentities,
   readBook,
   readonlyTx,
+  reapStaleTemporaryIdentities,
   refreshUnread,
   registrar,
   renderContactRoots,
@@ -60,39 +75,189 @@ import {
   resolveBound,
   rootName,
   saveState,
+  saveStateFailClosed,
   scheduleCapabilityReconcile,
   serveNotifications,
   sessionHeaders,
+  sessionReaperIntervalMs,
   setNotifyHook,
   startupProgress,
+  stopHistoryRetention,
   structuredVoiceOutcome,
   sttStatus,
-  sweepStaleTempIdentities,
   takeUnreadFiles,
   takeUnreadMessages,
   tombstones,
   transcribeVoice,
+  unpinHistoryItems,
   unpublishFromBook,
   unreadSummary,
   validateName,
   voiceDeliveryLine,
   withScope,
   withScopeAsync,
+  wrapper,
   writeTempMetaFile
-} from "./chunk-ZCCCTR27.js";
+} from "./chunk-YPDZQ4XD.js";
 import {
   buildIdentityFile,
   writeIdentityFile
-} from "./chunk-FXKFSNKS.js";
+} from "./chunk-DTWZF3ZG.js";
 
 // ../../src/http/server.ts
 import { createServer as createHttpServer } from "node:http";
 import { randomUUID } from "node:crypto";
-import * as fs2 from "node:fs";
+import * as fs3 from "node:fs";
 
 // ../../src/protocol.ts
 var OURS_COMPAT_VERSION = 1;
 
+// ../../src/errors.ts
+var OursError = class extends Error {
+  // `details` is PURELY ADDITIVE and optional: every existing construction and
+  // every `e.code` check keeps working untouched. It exists because a refusal a
+  // caller is expected to ACT on (trim N bytes, shorten the filename) cannot be
+  // delivered as prose alone — see errFileTooLarge.
+  constructor(code, message, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "OursError";
+  }
+};
+var errNameTaken = (tool, name) => new OursError("NAME_TAKEN", `${tool} failed: an identity named "${name}" already exists.`);
+var errNoLeaseHeaders = () => new OursError(
+  "NO_LEASE_HEADERS",
+  "create_temporary_identity failed: this client is not connected through the ours connector (no lease token / client pid headers), so there is no session lease to own the identity. Launch ours via the connector (`ours-mcp proxy`)."
+);
+var errRandomNameExhausted = () => new OursError(
+  "RANDOM_NAME_EXHAUSTED",
+  "create_temporary_identity failed: could not pick a free random name after 5 attempts \u2014 retry."
+);
+var errRootExists = (rootName2) => new OursError(
+  "ROOT_EXISTS",
+  `create_root_identity failed: a root identity already exists ("${rootName2}") \u2014 one root per host. Nothing to do.`
+);
+var errNotBoundNoName = () => new OursError("NOT_BOUND_NO_NAME", "close_temporary_identity failed: no identity is bound to this session and no name was given.");
+var errNotTemporary = (name) => new OursError(
+  "NOT_TEMPORARY",
+  `close_temporary_identity failed: "${name}" is a permanent identity. Use remove_identity if you really mean to delete it.`
+);
+var errTempOwnedElsewhereClose = (name, pid) => new OursError(
+  "TEMP_OWNED_ELSEWHERE",
+  `close_temporary_identity failed: "${name}" is owned by another LIVE session (owner pid ${pid}) \u2014 one session cannot delete another's temporary identity.`
+);
+var errTempClosedWithError = (name, deleteError, remote) => new OursError("DELETE_PARTIAL", `Temporary identity "${name}" closed with an error: ${deleteError}. ${remote}`);
+var errPathNotAbsolute = (path) => new OursError("PATH_NOT_ABSOLUTE", `define_local_identity_file failed: path must be absolute (got "${path}").`);
+var errNoSuchIdentity = (name) => new OursError("NO_SUCH_IDENTITY", `choose_identity failed: no identity named "${name}". Create it with create_identity.`);
+var errNoLeaseToken = () => new OursError(
+  "NO_LEASE_TOKEN",
+  "choose_identity failed: this client is not connected through the ours connector (no lease token header). Launch ours via the connector (`ours-mcp proxy`)."
+);
+var errTempClosingChoose = (name) => new OursError("TEMP_CLOSING", `choose_identity failed: temporary identity "${name}" is closing \u2014 its state is being deleted.`);
+var errTempOwnedLive = (name, pid) => new OursError(
+  "TEMP_OWNED_ELSEWHERE",
+  `choose_identity failed: "${name}" is a TEMPORARY identity owned by another live session (owner pid ${pid}). Ownership is exclusive and cannot be overridden \u2014 not even with force. Create your own with create_temporary_identity.`
+);
+var errTempStale = (name, pid) => new OursError(
+  "TEMP_STALE",
+  `choose_identity failed: temporary identity "${name}" is STALE \u2014 its owning session (pid ${pid}) is gone and it is pending automatic cleanup. It cannot be adopted by another session; use close_temporary_identity to reclaim (clean it up) now.`
+);
+var errBoundElsewhere = (name) => new OursError(
+  "BOUND_ELSEWHERE",
+  `choose_identity declined: "${name}" is currently bound to another live session. Do not retry with force=true on your own \u2014 tell the user it is in use elsewhere and ask whether to forcibly rebind it here; only retry with force=true after they explicitly confirm.`
+);
+var errTempOwnedElsewhereRemove = (name, pid) => new OursError(
+  "TEMP_OWNED_ELSEWHERE",
+  `remove_identity failed: "${name}" is a TEMPORARY identity owned by another LIVE session (owner pid ${pid}) \u2014 one session cannot delete another's temporary identity.`
+);
+var errIdentityClosedWithError = (name, deleteError, remote) => new OursError("DELETE_PARTIAL", `Temporary identity "${name}" closed with an error: ${deleteError}.${remote}`);
+var errRootHasRoles = (name, roles) => new OursError(
+  "ROOT_HAS_ROLES",
+  `remove_identity failed: "${name}" is the root identity and still has ${roles.length} role(s): ${roles.join(", ")}. Remove the roles first.`
+);
+var errIdentityPartiallyRemoved = (name, fail) => new OursError("DELETE_PARTIAL", `Identity "${name}" removed from memory, but ${fail}`);
+var errPublicInviteNamed = () => new OursError(
+  "PUBLIC_INVITE_NAMED",
+  "generate_invite failed: a public invite cannot pre-assign a contact name \u2014 every redeemer would be registered under it. Omit `name` for a public invite."
+);
+var errNoPolicyArgs = () => new OursError("NO_POLICY_ARGS", "set_local_book_policy: pass expose and/or auto_accept.");
+var errSendFileArgs = () => new OursError("SEND_ARGS", "send_file: provide exactly one of `path` or `data_base64`.");
+var errSendFileFilenameRequired = () => new OursError("SEND_ARGS", "send_file: `filename` is required with `data_base64`.");
+var errFileUnreadable = (detail) => new OursError("FILE_UNREADABLE", `send_file: cannot read file: ${detail}`);
+var errSendFileUploadArgs = () => new OursError("SEND_ARGS", "send_file: provide exactly one of `path`, `data_base64` or `upload_id`.");
+var errUploadNotFound = (uploadId) => new OursError(
+  "FILE_UNREADABLE",
+  `send_file: no staged upload "${uploadId}" for the bound identity. Upload the bytes with POST /files/upload first. A staged upload is consumed by the first send that names it \u2014 including a send that failed \u2014 so a retry needs a fresh upload.`
+);
+var errFileTooLarge = (i) => new OursError(
+  "FILE_TOO_LARGE",
+  `send_file: "${i.filename}" is ${i.bytes} bytes. This send's envelope would serialize to ${i.envelopeBytes} bytes, over the transport's ${i.limit}-byte budget \u2014 the largest payload it can carry with this filename, MIME and reply reference is ${i.maxPayloadBytes} bytes. Nothing was sent.`,
+  i
+);
+var errNoRoot = () => new OursError("NO_ROOT", "No root identity exists on this host \u2014 create one with create_root_identity first.");
+var errInvalidSelection = (cap) => new OursError("INVALID_SELECTION", `get_files failed: wire_ids must contain 1-${cap} items.`);
+var errMalformedId = () => new OursError("MALFORMED_ID", "get_files failed: every selected wire_id must be exactly 64 hexadecimal characters.");
+var errDuplicateId = () => new OursError("DUPLICATE_ID", "get_files failed: wire_ids must not contain duplicates.");
+var errUnknownOrStaleId = () => new OursError(
+  "UNKNOWN_OR_STALE_ID",
+  "get_files failed: one or more selected wire_ids is unknown, stale, or no longer unread; no files were retrieved."
+);
+var errTool = (tool, detail, code = "TX_FAILED") => new OursError(code, `${tool} failed: ${detail}`);
+
+// ../../src/identity/release.ts
+async function releaseLeaseByToken(token) {
+  const tokenHash = hashLeaseToken(token);
+  const released = [];
+  for (const [name, lease] of [...leases]) {
+    if (lease.token !== token) continue;
+    leases.delete(name);
+    released.push(name);
+  }
+  const candidates = [
+    ...identities.values(),
+    ...[...quarantinedIdentities.values()].map((held) => held.identity)
+  ];
+  const owned = candidates.filter(
+    (id) => id.temp?.owner.tokenHash === tokenHash
+  );
+  const settled = await Promise.allSettled(
+    owned.map((id) => closeTemporaryIdentity(id, "owning session released its lease"))
+  );
+  const closed = [];
+  let attempted = 0;
+  let notified = 0;
+  let failed = 0;
+  const localFailures = [];
+  for (let i = 0; i < settled.length; i++) {
+    const item = settled[i];
+    const name = owned[i].name;
+    if (item.status === "rejected") {
+      localFailures.push({ name, error: String(item.reason) });
+      continue;
+    }
+    const result2 = item.value;
+    quarantinedIdentities.delete(name);
+    closed.push(name);
+    attempted += result2.attempted;
+    notified += result2.notified;
+    failed += result2.failed;
+    if (result2.deleteError) localFailures.push({ name, error: result2.deleteError });
+  }
+  tombstones.delete(token);
+  persistBindings();
+  log(`lease released by token \u2026${token.slice(-6)} (${closed.length} temporary identity close(s) awaited)`);
+  const result = { released, closed, attempted, notified, failed };
+  if (localFailures.length > 0) {
+    throw new OursError(
+      "DELETE_PARTIAL",
+      `Lease release completed with ${localFailures.length} local cleanup failure(s).`,
+      { result, localFailures }
+    );
+  }
+  return result;
+}
+
 // ../../src/gc.ts
 var gcTimer = null;
 var gcRunning = false;
@@ -350,101 +515,86 @@ function checkFileEnvelope(i) {
   };
 }
 
-// ../../src/errors.ts
-var OursError = class extends Error {
-  // `details` is PURELY ADDITIVE and optional: every existing construction and
-  // every `e.code` check keeps working untouched. It exists because a refusal a
-  // caller is expected to ACT on (trim N bytes, shorten the filename) cannot be
-  // delivered as prose alone — see errFileTooLarge.
-  constructor(code, message, details) {
-    super(message);
-    this.code = code;
-    this.details = details;
-    this.name = "OursError";
+// ../../src/api/identity.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { isAbsolute } from "node:path";
+
+// ../../src/identity/staged.ts
+import * as fs2 from "node:fs";
+import { randomBytes } from "node:crypto";
+async function provisionIdentityUnexposed(name, opts) {
+  if (reservedNames.has(name) || identities.has(name)) {
+    throw new Error(`identity name "${name}" is reserved or already present`);
   }
-};
-var errNameTaken = (tool, name) => new OursError("NAME_TAKEN", `${tool} failed: an identity named "${name}" already exists.`);
-var errNoLeaseHeaders = () => new OursError(
-  "NO_LEASE_HEADERS",
-  "create_temporary_identity failed: this client is not connected through the ours connector (no lease token / client pid headers), so there is no session lease to own the identity. Launch ours via the connector (`ours-mcp proxy`)."
-);
-var errRandomNameExhausted = () => new OursError(
-  "RANDOM_NAME_EXHAUSTED",
-  "create_temporary_identity failed: could not pick a free random name after 5 attempts \u2014 retry."
-);
-var errRootExists = (rootName2) => new OursError(
-  "ROOT_EXISTS",
-  `create_root_identity failed: a root identity already exists ("${rootName2}") \u2014 one root per host. Nothing to do.`
-);
-var errNotBoundNoName = () => new OursError("NOT_BOUND_NO_NAME", "close_temporary_identity failed: no identity is bound to this session and no name was given.");
-var errNotTemporary = (name) => new OursError(
-  "NOT_TEMPORARY",
-  `close_temporary_identity failed: "${name}" is a permanent identity. Use remove_identity if you really mean to delete it.`
-);
-var errTempOwnedElsewhereClose = (name, pid) => new OursError(
-  "TEMP_OWNED_ELSEWHERE",
-  `close_temporary_identity failed: "${name}" is owned by another LIVE session (owner pid ${pid}) \u2014 one session cannot delete another's temporary identity.`
-);
-var errTempClosedWithError = (name, deleteError, remote) => new OursError("DELETE_PARTIAL", `Temporary identity "${name}" closed with an error: ${deleteError}. ${remote}`);
-var errPathNotAbsolute = (path) => new OursError("PATH_NOT_ABSOLUTE", `define_local_identity_file failed: path must be absolute (got "${path}").`);
-var errNoSuchIdentity = (name) => new OursError("NO_SUCH_IDENTITY", `choose_identity failed: no identity named "${name}". Create it with create_identity.`);
-var errNoLeaseToken = () => new OursError(
-  "NO_LEASE_TOKEN",
-  "choose_identity failed: this client is not connected through the ours connector (no lease token header). Launch ours via the connector (`ours-mcp proxy`)."
-);
-var errTempClosingChoose = (name) => new OursError("TEMP_CLOSING", `choose_identity failed: temporary identity "${name}" is closing \u2014 its state is being deleted.`);
-var errTempOwnedLive = (name, pid) => new OursError(
-  "TEMP_OWNED_ELSEWHERE",
-  `choose_identity failed: "${name}" is a TEMPORARY identity owned by another live session (owner pid ${pid}). Ownership is exclusive and cannot be overridden \u2014 not even with force. Create your own with create_temporary_identity.`
-);
-var errTempStale = (name, pid) => new OursError(
-  "TEMP_STALE",
-  `choose_identity failed: temporary identity "${name}" is STALE \u2014 its owning session (pid ${pid}) is gone and it is pending automatic cleanup. It cannot be adopted by another session; use close_temporary_identity to reclaim (clean it up) now.`
-);
-var errBoundElsewhere = (name) => new OursError(
-  "BOUND_ELSEWHERE",
-  `choose_identity declined: "${name}" is currently bound to another live session. Do not retry with force=true on your own \u2014 tell the user it is in use elsewhere and ask whether to forcibly rebind it here; only retry with force=true after they explicitly confirm.`
-);
-var errTempOwnedElsewhereRemove = (name, pid) => new OursError(
-  "TEMP_OWNED_ELSEWHERE",
-  `remove_identity failed: "${name}" is a TEMPORARY identity owned by another LIVE session (owner pid ${pid}) \u2014 one session cannot delete another's temporary identity.`
-);
-var errIdentityClosedWithError = (name, deleteError, remote) => new OursError("DELETE_PARTIAL", `Temporary identity "${name}" closed with an error: ${deleteError}.${remote}`);
-var errRootHasRoles = (name, roles) => new OursError(
-  "ROOT_HAS_ROLES",
-  `remove_identity failed: "${name}" is the root identity and still has ${roles.length} role(s): ${roles.join(", ")}. Remove the roles first.`
-);
-var errIdentityPartiallyRemoved = (name, fail) => new OursError("DELETE_PARTIAL", `Identity "${name}" removed from memory, but ${fail}`);
-var errPublicInviteNamed = () => new OursError(
-  "PUBLIC_INVITE_NAMED",
-  "generate_invite failed: a public invite cannot pre-assign a contact name \u2014 every redeemer would be registered under it. Omit `name` for a public invite."
-);
-var errNoPolicyArgs = () => new OursError("NO_POLICY_ARGS", "set_local_book_policy: pass expose and/or auto_accept.");
-var errSendFileArgs = () => new OursError("SEND_ARGS", "send_file: provide exactly one of `path` or `data_base64`.");
-var errSendFileFilenameRequired = () => new OursError("SEND_ARGS", "send_file: `filename` is required with `data_base64`.");
-var errFileUnreadable = (detail) => new OursError("FILE_UNREADABLE", `send_file: cannot read file: ${detail}`);
-var errSendFileUploadArgs = () => new OursError("SEND_ARGS", "send_file: provide exactly one of `path`, `data_base64` or `upload_id`.");
-var errUploadNotFound = (uploadId) => new OursError(
-  "FILE_UNREADABLE",
-  `send_file: no staged upload "${uploadId}" for the bound identity. Upload the bytes with POST /files/upload first. A staged upload is consumed by the first send that names it \u2014 including a send that failed \u2014 so a retry needs a fresh upload.`
-);
-var errFileTooLarge = (i) => new OursError(
-  "FILE_TOO_LARGE",
-  `send_file: "${i.filename}" is ${i.bytes} bytes. This send's envelope would serialize to ${i.envelopeBytes} bytes, over the transport's ${i.limit}-byte budget \u2014 the largest payload it can carry with this filename, MIME and reply reference is ${i.maxPayloadBytes} bytes. Nothing was sent.`,
-  i
-);
-var errInvalidSelection = (cap) => new OursError("INVALID_SELECTION", `get_files failed: wire_ids must contain 1-${cap} items.`);
-var errMalformedId = () => new OursError("MALFORMED_ID", "get_files failed: every selected wire_id must be exactly 64 hexadecimal characters.");
-var errDuplicateId = () => new OursError("DUPLICATE_ID", "get_files failed: wire_ids must not contain duplicates.");
-var errUnknownOrStaleId = () => new OursError(
-  "UNKNOWN_OR_STALE_ID",
-  "get_files failed: one or more selected wire_ids is unknown, stale, or no longer unread; no files were retrieved."
-);
-var errTool = (tool, detail, code = "TX_FAILED") => new OursError(code, `${tool} failed: ${detail}`);
+  reservedNames.add(name);
+  const dir = identityDir(name);
+  let id;
+  try {
+    fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+    let tempMeta;
+    if (opts.temp) {
+      tempMeta = {
+        owner: { tokenHash: opts.temp.tokenHash, pid: opts.temp.pid },
+        createdAt: Date.now()
+      };
+      writeTempMetaFile(dir, tempMeta);
+    }
+    id = await createPacket(name, randomBytes(24).toString("hex"), dir, false, void 0, true);
+    openHistory(id);
+    if (tempMeta) id.temp = tempMeta;
+    fs2.writeFileSync(keyPath(dir), exportSigningSecret(id), { mode: 384 });
+    await withScopeAsync(async (lt) => {
+      await mutatingTx(id, "::a2a_messaging::set_my_name", { name }, lt);
+    });
+    await pinRegistrar(id);
+    if (!opts.localAutoAccept) {
+      await withScopeAsync(async (lt) => {
+        await mutatingTx(id, "::actor::set_local_policy", { auto_accept: false }, lt);
+      });
+    }
+    saveStateFailClosed(id);
+    log(`[${name}] provisioned UNEXPOSED pending hierarchy reconciliation`);
+    return id;
+  } catch (err) {
+    rollbackUnexposedIdentity(id, name, dir);
+    throw err;
+  }
+}
+async function activateIdentity(id, exposeLocal) {
+  wrapper.expose_packet(id.cid);
+  identities.set(id.name, id);
+  try {
+    if (exposeLocal) await publishToBook(id);
+    log(`[${id.name}] EXPOSED (routing + broker registration) \u2014 hierarchy reconciled`);
+  } catch (err) {
+    rollbackUnexposedIdentity(id, id.name, id.dir);
+    throw err;
+  }
+}
+function rollbackUnexposedIdentity(id, name, dir) {
+  if (id) {
+    try {
+      closeHistory(id);
+    } catch {
+    }
+    try {
+      unpublishFromBook(id);
+    } catch {
+    }
+    try {
+      wrapper.remove_packet(id.cid);
+    } catch {
+    }
+  }
+  identities.delete(name);
+  try {
+    fs2.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+  reservedNames.delete(name);
+}
 
 // ../../src/api/identity.ts
-import { randomBytes } from "node:crypto";
-import { isAbsolute } from "node:path";
 function describeOrNull(id) {
   try {
     return describeIdentity(id);
@@ -479,7 +629,7 @@ async function createIdentity(ctx, a) {
   const { name, bio, exposeLocal, localAutoAccept } = a;
   const bad = validateName(name);
   if (bad) throw errTool("create_identity", bad, "NAME_INVALID");
-  if (identities.has(name)) throw errNameTaken("create_identity", name);
+  if (identities.has(name) || quarantinedIdentities.has(name)) throw errNameTaken("create_identity", name);
   try {
     const id = await provisionIdentity(name, { exposeLocal, localAutoAccept });
     await setBio(id, bio);
@@ -496,8 +646,9 @@ async function createIdentity(ctx, a) {
     } else {
       hierarchy = "root";
       const res = await establishRoot(id);
-      adopted = res.adopted;
-      failed = res.failed;
+      const held = await adoptQuarantinedIdentities(id);
+      adopted = [...res.adopted, ...held.adopted];
+      failed = [...res.failed, ...held.failed];
     }
     bindSession(ctx.sessionId(), name);
     return { info: identityInfo(id), hierarchy, underRoot, adopted, failed, exposedLocal: exposeLocal, localAutoAccept };
@@ -519,22 +670,34 @@ async function createTemporaryIdentity(ctx, a) {
     }
   } else {
     for (let i = 0; i < 5 && chosen === void 0; i++) {
-      const cand = `tmp-${randomBytes(5).toString("hex")}`;
+      const cand = `tmp-${randomBytes2(5).toString("hex")}`;
       if (!identities.has(cand) && !reservedNames.has(cand)) chosen = cand;
     }
     if (chosen === void 0) throw errRandomNameExhausted();
   }
   const name = chosen;
+  const root = rootName ? identities.get(rootName) : void 0;
+  if (!root) throw errNoRoot();
+  let id;
   try {
-    const id = await provisionIdentity(name, {
-      exposeLocal,
+    id = await provisionIdentityUnexposed(name, {
       localAutoAccept,
       temp: { tokenHash: hashLeaseToken(token), pid }
     });
     await setBio(id, bio);
+    await delegateRole(root, id);
+    await activateIdentity(id, exposeLocal);
     bindSession(ctx.sessionId(), name);
-    return { info: identityInfo(id), ownerPid: pid, exposedLocal: exposeLocal, localAutoAccept };
+    return {
+      info: identityInfo(id),
+      ownerPid: pid,
+      hierarchy: "role",
+      underRoot: root.name,
+      exposedLocal: exposeLocal,
+      localAutoAccept
+    };
   } catch (err) {
+    if (id) rollbackUnexposedIdentity(id, name, id.dir);
     throw errTool("create_temporary_identity", String(err), "PROVISION_FAILED");
   }
 }
@@ -552,7 +715,7 @@ async function closeTemporaryIdentityOp(ctx, a) {
   if (!id.temp) throw errNotTemporary(id.name);
   const owner = id.temp.owner;
   const isOwner = token !== void 0 && owner.tokenHash === hashLeaseToken(token);
-  if (!isOwner && !id.temp.closing && pidAlive(owner.pid)) {
+  if (!isOwner && !id.temp.closing && !pidDefinitelyDead(owner.pid)) {
     throw errTempOwnedElsewhereClose(id.name, owner.pid);
   }
   try {
@@ -578,7 +741,7 @@ async function createRootIdentity(ctx, a) {
   if (skipIfRootExists && existingRootName && identities.has(existingRootName)) {
     throw errRootExists(existingRootName);
   }
-  if (identities.has(name)) throw errNameTaken("create_root_identity", name);
+  if (identities.has(name) || quarantinedIdentities.has(name)) throw errNameTaken("create_root_identity", name);
   try {
     const id = await provisionIdentity(name, { exposeLocal, localAutoAccept });
     await setBio(id, bio);
@@ -598,13 +761,14 @@ async function createRootIdentity(ctx, a) {
       };
     }
     const { adopted, failed } = await establishRoot(id);
+    const held = await adoptQuarantinedIdentities(id);
     bindSession(ctx.sessionId(), name);
     return {
       info: identityInfo(id),
       hierarchy: "root",
       underRoot: null,
-      adopted,
-      failed,
+      adopted: [...adopted, ...held.adopted],
+      failed: [...failed, ...held.failed],
       exposedLocal: exposeLocal,
       localAutoAccept
     };
@@ -633,7 +797,7 @@ async function chooseIdentity(ctx, a) {
     if (target.temp.closing) throw errTempClosingChoose(name);
     const owner = target.temp.owner;
     if (owner.tokenHash !== hashLeaseToken(token)) {
-      if (pidAlive(owner.pid)) throw errTempOwnedLive(name, owner.pid);
+      if (!pidDefinitelyDead(owner.pid)) throw errTempOwnedLive(name, owner.pid);
       throw errTempStale(name, owner.pid);
     }
     const hdrPid = ctx.clientPid();
@@ -648,7 +812,7 @@ async function chooseIdentity(ctx, a) {
   }
   const existing = leases.get(name);
   if (existing && existing.token !== token) {
-    if (!pidAlive(existing.pid)) {
+    if (pidDefinitelyDead(existing.pid)) {
       log(`auto-reclaiming "${name}" from dead client pid ${existing.pid}`);
       leases.delete(name);
     } else if (!force) {
@@ -664,13 +828,13 @@ async function chooseIdentity(ctx, a) {
   return { name, cid: identities.get(name).cid, switchedFrom };
 }
 async function listIdentities(ctx) {
-  if (identities.size === 0) return [];
+  if (identities.size === 0 && quarantinedIdentities.size === 0) return [];
   const myToken = ctx.leaseToken();
   const sessionOf = (name) => {
     const lease = leases.get(name);
     if (!lease) return null;
     if (lease.token === myToken) return "mine";
-    if (!pidAlive(lease.pid)) return null;
+    if (pidDefinitelyDead(lease.pid)) return null;
     return "other-live";
   };
   const tempOf = (id) => {
@@ -680,7 +844,7 @@ async function listIdentities(ctx) {
     if (myToken !== void 0 && id.temp.owner.tokenHash === hashLeaseToken(myToken)) {
       return { state: "mine", ownerPid };
     }
-    return pidAlive(ownerPid) ? { state: "other-live", ownerPid } : { state: "stale", ownerPid };
+    return pidDefinitelyDead(ownerPid) ? { state: "stale", ownerPid } : { state: "other-live", ownerPid };
   };
   const row = (id, kind) => ({
     name: id.name,
@@ -697,13 +861,10 @@ async function listIdentities(ctx) {
       if (id.name === root.name) continue;
       if (describeIdentity(id).roleId !== "") rows.push(row(id, "role"));
     }
-    for (const id of identities.values()) {
-      if (id.name === root.name || describeIdentity(id).roleId !== "") continue;
-      rows.push(row(id, "flat"));
-    }
   } else {
-    for (const id of identities.values()) rows.push(row(id, "flat"));
+    for (const id of identities.values()) rows.push(row(id, "role"));
   }
+  for (const [name, held] of quarantinedIdentities) rows.push({ name, status: held.status });
   return rows;
 }
 async function currentIdentity(ctx) {
@@ -724,16 +885,18 @@ async function currentIdentity(ctx) {
 }
 async function removeIdentity(ctx, a) {
   const { name } = a;
-  const id = identities.get(name);
+  const held = quarantinedIdentities.get(name);
+  const id = identities.get(name) ?? held?.identity;
   if (!id) throw errTool("remove_identity", `no identity named "${name}".`, "NO_SUCH_IDENTITY");
   if (id.temp) {
     const token = ctx.leaseToken();
     const owner = id.temp.owner;
-    if ((token === void 0 || owner.tokenHash !== hashLeaseToken(token)) && !id.temp.closing && pidAlive(owner.pid)) {
+    if ((token === void 0 || owner.tokenHash !== hashLeaseToken(token)) && !id.temp.closing && !pidDefinitelyDead(owner.pid)) {
       throw errTempOwnedElsewhereRemove(name, owner.pid);
     }
     try {
       const res = await closeTemporaryIdentity(id, "remove_identity");
+      quarantinedIdentities.delete(name);
       if (res.deleteError) {
         const remote = res.attempted === 0 ? "" : ` Remove-me notices: ${res.notified}/${res.attempted} queued, ${res.failed} not sent (best effort).`;
         throw errIdentityClosedWithError(name, res.deleteError, remote);
@@ -752,27 +915,13 @@ async function removeIdentity(ctx, a) {
   }
   const fail = deleteIdentityCompletely(id);
   if (fail) throw errIdentityPartiallyRemoved(name, fail);
+  quarantinedIdentities.delete(name);
   return { name, kind: "permanent" };
 }
 async function releaseLease(ctx) {
   const token = ctx.leaseToken();
   if (!token) throw errNoLeaseToken();
-  const released = [];
-  for (const [n, l] of [...leases]) {
-    if (l.token !== token) continue;
-    leases.delete(n);
-    released.push(n);
-    const rid = identities.get(n);
-    if (rid?.temp && rid.temp.owner.tokenHash === hashLeaseToken(token) && !rid.temp.closing) {
-      void closeTemporaryIdentity(rid, "owning session released its lease").catch(
-        (err) => log(`[${n}] close on lease release failed:`, String(err))
-      );
-    }
-  }
-  tombstones.delete(token);
-  persistBindings();
-  log(`lease released by token \u2026${token.slice(-6)}`);
-  return { released };
+  return releaseLeaseByToken(token);
 }
 
 // ../../src/api/contacts.ts
@@ -1325,8 +1474,11 @@ async function getFiles(ctx, a = {}) {
     if (wire_ids.some((wire) => !isSelectableWireId(wire))) throw errMalformedId();
     if (new Set(wire_ids).size !== wire_ids.length) throw errDuplicateId();
   }
+  let pinned = [];
   try {
     const selected = takeUnreadFiles(id, { wire_ids, limit: a.limit });
+    pinned = selected.files.map((file) => file.wire_id);
+    pinHistoryItems(id.dir, "file", pinned);
     const files = [];
     const lines = [];
     for (const file of selected.files) {
@@ -1393,6 +1545,11 @@ ${lines.join("\n")}`,
       throw errUnknownOrStaleId();
     }
     throw errTool("get_files", message);
+  } finally {
+    if (pinned.length > 0) {
+      unpinHistoryItems(id.dir, "file", pinned);
+      noteHistoryStorageMutation(id.dir);
+    }
   }
 }
 function saveFileFallbackNotice(ctx, a) {
@@ -1621,7 +1778,13 @@ async function serveApiOperation(req, res, pathname, readBody2) {
     sendJson(res, 200, await handler(session.ctx, body));
   } catch (err) {
     if (err instanceof OursError) {
-      sendJson(res, 400, { error: { code: err.code, message: err.message } });
+      sendJson(res, 400, {
+        error: {
+          code: err.code,
+          message: err.message,
+          ...err.details ? { details: err.details } : {}
+        }
+      });
       return;
     }
     log("api handler error:", name, String(err));
@@ -1700,7 +1863,14 @@ function looksLikeInitializeRequest(body) {
   const m = body;
   return m.jsonrpc === "2.0" && m.method === "initialize";
 }
-var LOAD_TIME_CONFIG_FIELDS = ["brokerUrl", "port", "stateDir", "gcIntervalMs", "apiVisibility"];
+var LOAD_TIME_CONFIG_FIELDS = [
+  "brokerUrl",
+  "port",
+  "stateDir",
+  "gcIntervalMs",
+  "historyMaxBytes",
+  "apiVisibility"
+];
 function readBody(req) {
   return new Promise((resolve2, reject) => {
     let data = "";
@@ -1750,6 +1920,10 @@ async function startHttpDaemon(opts) {
   log("booting wrapper\u2026");
   try {
     await bootWrapper();
+    const historyStorage = initializeHistoryRetention(STATE_DIR, HISTORY_MAX_BYTES);
+    log(
+      `history storage ${historyStorage.state} (physical=${historyStorage.physical_bytes}, cap=${historyStorage.max_bytes}, overflow=${historyStorage.overflow_bytes})`
+    );
     startGcTimer();
   } catch (err) {
     if (installedHook) clearNotifyHook(installedHook);
@@ -1776,7 +1950,7 @@ async function startHttpDaemon(opts) {
     for (const sid of [...serversBySession.keys()]) {
       if (sid === "stdio") continue;
       const pid = sessionHeaders.get(sid)?.pid;
-      if (pid === void 0 || pid <= 1 || pidAlive(pid)) continue;
+      if (pid === void 0 || !pidDefinitelyDead(pid)) continue;
       const inf = inflight.get(sid);
       if (inf && inf.n > 0 && Date.now() - inf.since < STUCK_MS) continue;
       const srv = serversBySession.get(sid);
@@ -1792,11 +1966,16 @@ async function startHttpDaemon(opts) {
     }
     return reaped;
   };
+  let reaperRunning = false;
   const sessionReaper = setInterval(() => {
+    if (reaperRunning) return;
+    reaperRunning = true;
     reapDeadSessions();
-    sweepStaleTempIdentities();
     sweepStaleUploads();
-  }, 6e4);
+    void reapStaleTemporaryIdentities().finally(() => {
+      reaperRunning = false;
+    });
+  }, sessionReaperIntervalMs());
   sessionReaper.unref?.();
   const REQ_META_MAX = 1e3;
   const REQ_META_TTL_MS = 10 * 6e4;
@@ -1863,8 +2042,8 @@ async function startHttpDaemon(opts) {
       res.end(JSON.stringify({
         identities: [...identities.values()].map((i) => ({
           name: i.name,
-          ...i.temp ? { temporary: true, stale: !pidAlive(i.temp.owner.pid) } : {}
-        }))
+          ...i.temp ? { temporary: true, stale: pidDefinitelyDead(i.temp.owner.pid) } : {}
+        })).concat([...quarantinedIdentities.entries()].map(([name, held]) => ({ name, status: held.status })))
       }));
       return;
     }
@@ -1874,6 +2053,12 @@ async function startHttpDaemon(opts) {
       res.end(JSON.stringify(unreadSummary()));
       return;
     }
+    if (req.method === "GET" && url.pathname === "/history-storage") {
+      if (!requireAuth(req, res)) return;
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(getHistoryStorageStatus()));
+      return;
+    }
     {
       const m = /^\/identities\/([^/]+)\/notifications$/.exec(url.pathname);
       if (req.method === "GET" && m) {
@@ -1884,6 +2069,11 @@ async function startHttpDaemon(opts) {
           res.end(JSON.stringify({ error: "invalid identity name" }));
           return;
         }
+        if (!identities.has(name)) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "no active identity with that name" }));
+          return;
+        }
         await serveNotifications(req, res, name, url.searchParams.get("since"), url.searchParams.get("kinds"));
         return;
       }
@@ -1939,9 +2129,9 @@ async function startHttpDaemon(opts) {
           return;
         }
         try {
-          const stat = fs2.statSync(filePath);
+          const stat = fs3.statSync(filePath);
           res.writeHead(200, { "Content-Type": "application/octet-stream", "Content-Length": String(stat.size) });
-          const stream = fs2.createReadStream(filePath);
+          const stream = fs3.createReadStream(filePath);
           stream.on("error", () => {
             try {
               res.destroy();
@@ -2043,19 +2233,7 @@ async function startHttpDaemon(opts) {
         }
         const token = sessionHeaders.get(sessionId)?.token ?? req.headers["x-ours-lease-token"];
         if (token) {
-          for (const [n, l] of [...leases]) {
-            if (l.token !== token) continue;
-            leases.delete(n);
-            const rid = identities.get(n);
-            if (rid?.temp && rid.temp.owner.tokenHash === hashLeaseToken(token) && !rid.temp.closing) {
-              void closeTemporaryIdentity(rid, "owning session released its lease").catch(
-                (err) => log(`[${n}] close on lease release failed:`, String(err))
-              );
-            }
-          }
-          tombstones.delete(token);
-          persistBindings();
-          log(`lease released by token \u2026${token.slice(-6)}`);
+          await releaseLeaseByToken(token);
         }
         await transports[sessionId].handleRequest(req, res);
       } else {
@@ -2077,6 +2255,7 @@ async function startHttpDaemon(opts) {
     torn = true;
     clearInterval(sessionReaper);
     stopGcTimer();
+    stopHistoryRetention();
     if (installedHook) clearNotifyHook(installedHook);
     for (const sid of Object.keys(transports)) {
       try {