@peerbit/trusted-network 6.0.104 → 6.0.106

package/dist/src/v2-policy-engine.js

@@ -2,7 +2,7 @@ import { deserialize, serialize } from "@dao-xyz/borsh";
 import { DecryptedThing, PublicSignKey, verify } from "@peerbit/crypto";
 import { Entry, EntryV0, NO_ENCODING } from "@peerbit/log";
 import { compare, equals } from "uint8arrays";
-import { NetworkDescriptorV2, PolicySnapshotBodyV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS, assertNetworkDescriptorV2, decodePolicySnapshotBodyV2, digestPolicySnapshotBodyV2, } from "./v2.js";
+import { NetworkDescriptorV2, PolicySnapshotBodyV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS, TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES, assertNetworkDescriptorV2, decodePolicySnapshotBodyV2, digestPolicySnapshotBodyV2, } from "./v2.js";
 /**
  * Internal policy reducer for the non-activatable TrustedNetwork v2 scaffold.
  *
@@ -12,8 +12,12 @@ import { NetworkDescriptorV2, PolicySnapshotBodyV2, PolicySubjectBindingV2, TRUS
  * resolver instead of being accumulated in memory.
  */
 const DEFAULT_MAX_PENDING_POLICIES_V2 = 64;
-const DEFAULT_MAX_PENDING_POLICY_BYTES_V2 = 256 * 1024;
 const PENDING_POLICY_ACCOUNTING_OVERHEAD_V2 = 64;
+const MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2 = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 2 +
+    PENDING_POLICY_ACCOUNTING_OVERHEAD_V2;
+const DEFAULT_MAX_PENDING_POLICY_BYTES_V2 = MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2;
+const DEFAULT_POLICY_RESOLUTION_TIMEOUT_MS_V2 = 10 * 1000;
+const MAX_TIMER_DELAY_MS_V2 = 0x7fffffff;
 const MAX_UNAVAILABLE_REASON_LENGTH_V2 = 512;
 const copyBytes = (bytes) => Uint8Array.from(bytes);
 const bytesKey = (bytes) => {
@@ -44,29 +48,47 @@ const copySnapshot = (snapshot) => ({
 });
 const validationMessage = (error) => error instanceof Error ? error.message : String(error);
 const boundedUnavailableReason = (reason) => reason.slice(0, MAX_UNAVAILABLE_REASON_LENGTH_V2);
-export const authenticatePolicySnapshotEntryV2 = async (entry, descriptor) => {
-    assertNetworkDescriptorV2(descriptor);
-    if (!(entry instanceof EntryV0)) {
+class PolicyDependencyUnavailableErrorV2 extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PolicyDependencyUnavailableErrorV2";
+    }
+}
+const capturePolicySnapshotEntryBytesV2 = (entryBytes) => {
+    if (!(entryBytes instanceof Uint8Array)) {
+        throw new Error("Policy snapshot must use canonical EntryV0 bytes");
+    }
+    if (entryBytes.byteLength === 0) {
+        throw new Error("Policy snapshot must use EntryV0");
+    }
+    if (entryBytes.byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES) {
+        throw new Error(`Policy snapshot entry must contain 1-${TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES} bytes`);
+    }
+    // Apply the protocol byte ceiling before this first copy, decode, or crypto
+    // operation. The retained copy also prevents caller mutation during awaits.
+    return copyBytes(entryBytes);
+};
+const authenticateCapturedPolicySnapshotEntryV2 = async (canonicalEntryBytes, descriptor) => {
+    const authenticatedEntry = deserialize(canonicalEntryBytes, Entry);
+    if (!(authenticatedEntry instanceof EntryV0)) {
         throw new Error("Policy snapshot must use EntryV0");
     }
-    if (!(entry._meta instanceof DecryptedThing)) {
+    if (!equals(canonicalEntryBytes, serialize(authenticatedEntry))) {
+        throw new Error("Policy snapshot entry encoding is not canonical");
+    }
+    if (!(authenticatedEntry._meta instanceof DecryptedThing)) {
         throw new Error("Policy snapshot metadata must be public");
     }
-    if (!(entry._payload instanceof DecryptedThing)) {
+    if (!(authenticatedEntry._payload instanceof DecryptedThing)) {
         throw new Error("Policy snapshot payload must be public");
     }
-    if (entry._signatures === undefined ||
-        entry._signatures.signatures.length !== 1) {
+    if (authenticatedEntry._signatures === undefined ||
+        authenticatedEntry._signatures.signatures.length !== 1) {
         throw new Error("Policy snapshot must contain exactly one signature");
     }
-    if (!(entry._signatures.signatures[0] instanceof DecryptedThing)) {
+    if (!(authenticatedEntry._signatures.signatures[0] instanceof DecryptedThing)) {
         throw new Error("Policy snapshot signature must be public");
     }
-    const entryBytes = serialize(entry);
-    const authenticatedEntry = deserialize(entryBytes, Entry);
-    if (!(authenticatedEntry instanceof EntryV0)) {
-        throw new Error("Policy snapshot must decode as EntryV0");
-    }
     authenticatedEntry.init({ encoding: NO_ENCODING });
     const signatures = await authenticatedEntry.getSignatures();
     if (signatures.length !== 1) {
@@ -89,12 +111,16 @@ export const authenticatePolicySnapshotEntryV2 = async (entry, descriptor) => {
         body: copyBody(body),
         digest: copyBytes(digest),
         digestKey: bytesKey(digest),
-        entryBytes,
-        accountedBytes: entryBytes.byteLength +
+        entryBytes: canonicalEntryBytes,
+        accountedBytes: canonicalEntryBytes.byteLength +
             serialize(body).byteLength +
             PENDING_POLICY_ACCOUNTING_OVERHEAD_V2,
     };
 };
+export const authenticatePolicySnapshotEntryV2 = async (entryBytes, descriptor) => {
+    assertNetworkDescriptorV2(descriptor);
+    return authenticateCapturedPolicySnapshotEntryV2(capturePolicySnapshotEntryBytesV2(entryBytes), descriptor);
+};
 const projectionFromSnapshot = (snapshot) => ({
     sequence: snapshot.body.sequence,
     digest: copyBytes(snapshot.digest),
@@ -128,11 +154,67 @@ const copyForkEvidence = (evidence) => ({
         copyForkChildProof(evidence.children[1]),
     ],
 });
+const captureDurableStateV2 = (durableState) => {
+    if (durableState === null ||
+        typeof durableState !== "object" ||
+        durableState.formatVersion !== 1) {
+        throw new Error("Unsupported TrustedNetwork v2 reducer state format");
+    }
+    switch (durableState.state) {
+        case "EMPTY":
+            return { formatVersion: 1, state: "EMPTY" };
+        case "ACTIVE":
+            return {
+                formatVersion: 1,
+                state: "ACTIVE",
+                acceptedHeadEntryBytes: capturePolicySnapshotEntryBytesV2(durableState.acceptedHeadEntryBytes),
+            };
+        case "UNAVAILABLE": {
+            if (!(durableState.acceptedAncestorDigest instanceof Uint8Array) ||
+                durableState.acceptedAncestorDigest.byteLength !== 32) {
+                throw new Error("Unavailable accepted ancestor digest must contain exactly 32 bytes");
+            }
+            if (typeof durableState.reason !== "string" ||
+                durableState.reason.length === 0 ||
+                durableState.reason.length > MAX_UNAVAILABLE_REASON_LENGTH_V2) {
+                throw new Error(`Unavailable reason must contain 1-${MAX_UNAVAILABLE_REASON_LENGTH_V2} characters`);
+            }
+            return {
+                formatVersion: 1,
+                state: "UNAVAILABLE",
+                acceptedHeadEntryBytes: capturePolicySnapshotEntryBytesV2(durableState.acceptedHeadEntryBytes),
+                comparisonCandidateEntryBytes: capturePolicySnapshotEntryBytesV2(durableState.comparisonCandidateEntryBytes),
+                acceptedAncestorDigest: copyBytes(durableState.acceptedAncestorDigest),
+                reason: durableState.reason,
+            };
+        }
+        case "FORKED":
+            if (!Array.isArray(durableState.childEntryBytes) ||
+                durableState.childEntryBytes.length !== 2) {
+                throw new Error("Forked reducer state must contain exactly two children");
+            }
+            return {
+                formatVersion: 1,
+                state: "FORKED",
+                commonParentEntryBytes: capturePolicySnapshotEntryBytesV2(durableState.commonParentEntryBytes),
+                childEntryBytes: [
+                    capturePolicySnapshotEntryBytesV2(durableState.childEntryBytes[0]),
+                    capturePolicySnapshotEntryBytesV2(durableState.childEntryBytes[1]),
+                ],
+            };
+        default:
+            throw new Error("Unsupported TrustedNetwork v2 reducer state");
+    }
+};
 export class TrustedNetworkV2PolicyReducer {
     descriptor;
     resolvePolicyEntry;
+    resolveTimeoutMs;
     maxPending;
     maxPendingPolicyBytes;
+    lifecycleController = new AbortController();
+    externalSignal;
+    externalAbortListener;
     acceptedHead;
     projectedRoles = new Map();
     pending = new Map();
@@ -149,15 +231,107 @@ export class TrustedNetworkV2PolicyReducer {
         }
         const maxPendingPolicyBytes = properties.maxPendingPolicyBytes ?? DEFAULT_MAX_PENDING_POLICY_BYTES_V2;
         if (!Number.isSafeInteger(maxPendingPolicyBytes) ||
-            maxPendingPolicyBytes < 1) {
-            throw new Error("maxPendingPolicyBytes must be a positive safe integer");
+            maxPendingPolicyBytes < 1 ||
+            maxPendingPolicyBytes > MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2) {
+            throw new Error(`maxPendingPolicyBytes must be a positive safe integer no greater than ${MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2}`);
+        }
+        const resolveTimeoutMs = properties.resolveTimeoutMs ?? DEFAULT_POLICY_RESOLUTION_TIMEOUT_MS_V2;
+        if (!Number.isSafeInteger(resolveTimeoutMs) ||
+            resolveTimeoutMs < 1 ||
+            resolveTimeoutMs > MAX_TIMER_DELAY_MS_V2) {
+            throw new Error(`resolveTimeoutMs must be a positive safe integer no greater than ${MAX_TIMER_DELAY_MS_V2}`);
         }
         this.descriptor = deserialize(serialize(properties.descriptor), NetworkDescriptorV2);
         this.resolvePolicyEntry = properties.resolvePolicyEntry;
+        this.resolveTimeoutMs = resolveTimeoutMs;
         this.maxPending = maxPending;
         this.maxPendingPolicyBytes = maxPendingPolicyBytes;
+        if (properties.signal?.aborted) {
+            this.lifecycleController.abort();
+        }
+        else if (properties.signal !== undefined) {
+            this.externalSignal = properties.signal;
+            this.externalAbortListener = () => {
+                this.externalSignal = undefined;
+                this.externalAbortListener = undefined;
+                this.lifecycleController.abort();
+            };
+            this.externalSignal.addEventListener("abort", this.externalAbortListener, { once: true });
+        }
+    }
+    static async restore(properties) {
+        // Capture the complete checkpoint before the first await. Persistence
+        // adapters commonly reuse read buffers, and mutation during authentication
+        // must not change what is restored.
+        const durableState = captureDurableStateV2(properties.durableState);
+        const reducer = new TrustedNetworkV2PolicyReducer(properties);
+        const authenticate = (entryBytes) => authenticateCapturedPolicySnapshotEntryV2(entryBytes, reducer.descriptor);
+        try {
+            switch (durableState.state) {
+                case "EMPTY":
+                    return reducer;
+                case "ACTIVE": {
+                    const acceptedHead = await authenticate(durableState.acceptedHeadEntryBytes);
+                    // A durable ACTIVE head is a trusted prior-validation checkpoint. Its
+                    // authority signature and network binding are re-authenticated above,
+                    // but restore deliberately does not require historical resolver data.
+                    reducer.project(acceptedHead);
+                    return reducer;
+                }
+                case "UNAVAILABLE": {
+                    const [acceptedHead, comparisonCandidate] = await Promise.all([
+                        authenticate(durableState.acceptedHeadEntryBytes),
+                        authenticate(durableState.comparisonCandidateEntryBytes),
+                    ]);
+                    if (equals(acceptedHead.digest, comparisonCandidate.digest)) {
+                        throw new Error("Unavailable comparison candidate must differ from the accepted head");
+                    }
+                    reducer.project(acceptedHead);
+                    reducer.addPending(comparisonCandidate, durableState.acceptedAncestorDigest);
+                    reducer.unavailable = {
+                        acceptedAncestorDigest: copyBytes(durableState.acceptedAncestorDigest),
+                        comparisonCandidate: copySnapshot(comparisonCandidate),
+                        reason: durableState.reason,
+                    };
+                    return reducer;
+                }
+                case "FORKED": {
+                    const [commonParent, firstChild, secondChild] = await Promise.all([
+                        authenticate(durableState.commonParentEntryBytes),
+                        authenticate(durableState.childEntryBytes[0]),
+                        authenticate(durableState.childEntryBytes[1]),
+                    ]);
+                    for (const child of [firstChild, secondChild]) {
+                        if (child.body.sequence !== commonParent.body.sequence + 1n ||
+                            !equals(child.body.previousPolicyDigest, commonParent.digest)) {
+                            throw new Error("Fork child must be a direct successor of the common parent");
+                        }
+                    }
+                    if (equals(firstChild.digest, secondChild.digest)) {
+                        throw new Error("Fork children must have distinct policy digests");
+                    }
+                    const children = [
+                        forkProofFromSnapshot(firstChild),
+                        forkProofFromSnapshot(secondChild),
+                    ].sort(compareForkChildProofs);
+                    reducer.project(commonParent);
+                    reducer.fork = {
+                        commonParent: projectionFromSnapshot(commonParent),
+                        children,
+                    };
+                    return reducer;
+                }
+            }
+        }
+        catch (error) {
+            // Do not retain a caller-owned AbortSignal listener when restore rejects.
+            reducer.abort();
+            throw error;
+        }
     }
     get state() {
+        if (this.lifecycleController.signal.aborted)
+            return "HALTED";
         if (this.fork !== undefined)
             return "FORKED";
         if (this.unavailable !== undefined)
@@ -187,6 +361,45 @@ export class TrustedNetworkV2PolicyReducer {
             .sort((a, b) => compareKeys(a.snapshot.digestKey, b.snapshot.digestKey))
             .map(({ snapshot }) => copyBytes(snapshot.digest));
     }
+    exportDurableState() {
+        // Lifecycle cancellation is process-local. Export the underlying protocol
+        // safety state so a replacement process cannot erase UNAVAILABLE/FORKED.
+        if (this.fork !== undefined) {
+            if (this.acceptedHead === undefined) {
+                throw new Error("Forked reducer is missing its common-parent entry");
+            }
+            return {
+                formatVersion: 1,
+                state: "FORKED",
+                commonParentEntryBytes: copyBytes(this.acceptedHead.entryBytes),
+                childEntryBytes: [
+                    copyBytes(this.fork.children[0].entryBytes),
+                    copyBytes(this.fork.children[1].entryBytes),
+                ],
+            };
+        }
+        if (this.unavailable !== undefined) {
+            if (this.acceptedHead === undefined) {
+                throw new Error("Unavailable reducer is missing its accepted head");
+            }
+            return {
+                formatVersion: 1,
+                state: "UNAVAILABLE",
+                acceptedHeadEntryBytes: copyBytes(this.acceptedHead.entryBytes),
+                comparisonCandidateEntryBytes: copyBytes(this.unavailable.comparisonCandidate.entryBytes),
+                acceptedAncestorDigest: copyBytes(this.unavailable.acceptedAncestorDigest),
+                reason: this.unavailable.reason,
+            };
+        }
+        if (this.acceptedHead !== undefined) {
+            return {
+                formatVersion: 1,
+                state: "ACTIVE",
+                acceptedHeadEntryBytes: copyBytes(this.acceptedHead.entryBytes),
+            };
+        }
+        return { formatVersion: 1, state: "EMPTY" };
+    }
     rolesFor(subject) {
         return this.projectedRoles.get(publicKeyId(subject)) ?? 0;
     }
@@ -199,6 +412,15 @@ export class TrustedNetworkV2PolicyReducer {
         }
         return (this.rolesFor(subject) & roles) === roles;
     }
+    abort() {
+        if (this.externalSignal !== undefined &&
+            this.externalAbortListener !== undefined) {
+            this.externalSignal.removeEventListener("abort", this.externalAbortListener);
+        }
+        this.externalSignal = undefined;
+        this.externalAbortListener = undefined;
+        this.lifecycleController.abort();
+    }
     fetchHints() {
         const unique = new Map();
         for (const { missingParentDigest } of this.pending.values()) {
@@ -214,11 +436,14 @@ export class TrustedNetworkV2PolicyReducer {
             digest: copyBytes(digest),
         }));
     }
-    result(status, reason, evictedPolicyDigests) {
+    result(status, reason, evictedPolicyDigests, forkObservations) {
         return {
             status,
             reason,
             head: this.head,
+            forkObservations: forkObservations === undefined
+                ? undefined
+                : forkObservations.map(copyForkChildProof),
             fetchHints: this.fetchHints(),
             pendingCount: this.pending.size,
             pendingBytes: this.pendingBytes,
@@ -227,12 +452,15 @@ export class TrustedNetworkV2PolicyReducer {
                 : evictedPolicyDigests.map(copyBytes),
         };
     }
-    forkedResult() {
-        return this.result("forked", "Policy authority signed competing children");
+    forkedResult(forkObservations) {
+        return this.result("forked", "Policy authority signed competing children", undefined, forkObservations);
+    }
+    haltedResult() {
+        return this.result("halted", "Policy reducer lifecycle is aborted");
     }
     unavailableResult(retention) {
         const blockedCandidateRetained = this.unavailable !== undefined &&
-            this.pending.has(this.unavailable.candidateDigestKey);
+            this.pending.has(this.unavailable.comparisonCandidate.digestKey);
         const recoverable = (retention?.retained ?? true) && blockedCandidateRetained;
         const reason = recoverable
             ? this.unavailable.reason
@@ -242,8 +470,11 @@ export class TrustedNetworkV2PolicyReducer {
         return this.result(recoverable ? "unavailable" : "capacity", reason, retention?.evictedPolicyDigests);
     }
     completedDrainResult(outcome) {
-        if (outcome?.status === "forked")
-            return this.forkedResult();
+        if (outcome?.status === "forked") {
+            return this.forkedResult(outcome.forkObservations);
+        }
+        if (outcome?.status === "halted")
+            return this.haltedResult();
         return outcome?.status === "unavailable"
             ? this.unavailableResult(outcome)
             : undefined;
@@ -261,6 +492,67 @@ export class TrustedNetworkV2PolicyReducer {
             this.acceptedHead = copySnapshot(snapshot);
         }
     }
+    async resolveExternalSnapshot(digest) {
+        if (this.lifecycleController.signal.aborted) {
+            throw new PolicyDependencyUnavailableErrorV2("Policy resolver lifecycle is aborted");
+        }
+        const attemptController = new AbortController();
+        let timedOut = false;
+        const abortFromLifecycle = () => attemptController.abort();
+        this.lifecycleController.signal.addEventListener("abort", abortFromLifecycle, { once: true });
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            attemptController.abort();
+        }, this.resolveTimeoutMs);
+        const abortError = () => new PolicyDependencyUnavailableErrorV2(timedOut
+            ? `Policy resolver timed out after ${this.resolveTimeoutMs} ms`
+            : "Policy resolver attempt was aborted");
+        let rejectOnAbort;
+        const abortPromise = new Promise((_resolve, reject) => {
+            rejectOnAbort = () => {
+                reject(abortError());
+            };
+            attemptController.signal.addEventListener("abort", rejectOnAbort, {
+                once: true,
+            });
+        });
+        const resolution = Promise.resolve().then(async () => {
+            if (attemptController.signal.aborted)
+                throw abortError();
+            const entryBytes = await this.resolvePolicyEntry(copyBytes(digest), {
+                signal: attemptController.signal,
+            });
+            // A resolver may ignore cancellation. Do not spend decode or signature
+            // verification work on bytes that arrive after this attempt expired.
+            if (attemptController.signal.aborted)
+                throw abortError();
+            if (entryBytes === undefined)
+                return undefined;
+            const snapshot = await authenticatePolicySnapshotEntryV2(entryBytes, this.descriptor);
+            if (!equals(snapshot.digest, digest)) {
+                throw new Error("Policy resolver returned the wrong body digest");
+            }
+            return snapshot;
+        });
+        // Promise.race installs handlers, but this explicit observer documents and
+        // preserves consumption if the resolver settles after its deadline.
+        void resolution.then(() => undefined, () => undefined);
+        try {
+            return await Promise.race([resolution, abortPromise]);
+        }
+        catch (error) {
+            if (error instanceof PolicyDependencyUnavailableErrorV2)
+                throw error;
+            throw new PolicyDependencyUnavailableErrorV2(`Policy resolver dependency is unavailable: ${validationMessage(error)}`);
+        }
+        finally {
+            clearTimeout(timeout);
+            this.lifecycleController.signal.removeEventListener("abort", abortFromLifecycle);
+            if (rejectOnAbort !== undefined) {
+                attemptController.signal.removeEventListener("abort", rejectOnAbort);
+            }
+        }
+    }
     async resolveSnapshot(digest, cache) {
         const digestKey = bytesKey(digest);
         if (this.acceptedHead?.digestKey === digestKey) {
@@ -271,16 +563,7 @@ export class TrustedNetworkV2PolicyReducer {
             return copySnapshot(pending.snapshot);
         let resolution = cache?.get(digestKey);
         if (resolution === undefined) {
-            resolution = (async () => {
-                const entry = await this.resolvePolicyEntry(copyBytes(digest));
-                if (entry === undefined)
-                    return undefined;
-                const snapshot = await authenticatePolicySnapshotEntryV2(entry, this.descriptor);
-                if (!equals(snapshot.digest, digest)) {
-                    throw new Error("Policy resolver returned the wrong body digest");
-                }
-                return snapshot;
-            })();
+            resolution = this.resolveExternalSnapshot(digest);
             cache?.set(digestKey, resolution);
         }
         const snapshot = await resolution;
@@ -300,9 +583,9 @@ export class TrustedNetworkV2PolicyReducer {
         }
         catch (error) {
             return {
-                status: "reject",
+                status: "unavailable",
                 digest: copyBytes(child.body.previousPolicyDigest),
-                reason: `Policy parent validation failed: ${validationMessage(error)}`,
+                reason: `Policy parent dependency is unavailable: ${validationMessage(error)}`,
             };
         }
         if (parent === undefined) {
@@ -320,13 +603,24 @@ export class TrustedNetworkV2PolicyReducer {
         }
         return { status: "found", parent };
     }
+    candidateAncestryResult(resolution) {
+        return resolution.status === "unavailable"
+            ? {
+                status: "missing",
+                digest: copyBytes(resolution.digest),
+                reason: resolution.reason,
+            }
+            : resolution;
+    }
     acceptedAncestryUnavailable(resolution) {
         return {
             status: "unavailable",
             digest: copyBytes(resolution.digest),
             reason: resolution.status === "missing"
                 ? "Accepted policy ancestry is unavailable from the resolver"
-                : `Accepted policy ancestry validation failed: ${resolution.reason}`,
+                : resolution.status === "unavailable"
+                    ? `Accepted policy ancestry is unavailable: ${resolution.reason}`
+                    : `Accepted policy ancestry validation failed: ${resolution.reason}`,
         };
     }
     async evaluate(candidate) {
@@ -335,8 +629,9 @@ export class TrustedNetworkV2PolicyReducer {
             let cursor = candidate;
             while (cursor.body.sequence !== 0n) {
                 const parent = await this.parentOf(cursor, resolutionCache);
-                if (parent.status !== "found")
-                    return parent;
+                if (parent.status !== "found") {
+                    return this.candidateAncestryResult(parent);
+                }
                 cursor = parent.parent;
             }
             return { status: "accept" };
@@ -348,8 +643,9 @@ export class TrustedNetworkV2PolicyReducer {
         while (candidateCursor.body.sequence > acceptedCursor.body.sequence) {
             candidateChild = candidateCursor;
             const parent = await this.parentOf(candidateCursor, resolutionCache);
-            if (parent.status !== "found")
-                return parent;
+            if (parent.status !== "found") {
+                return this.candidateAncestryResult(parent);
+            }
             candidateCursor = parent.parent;
         }
         while (acceptedCursor.body.sequence > candidateCursor.body.sequence) {
@@ -377,8 +673,9 @@ export class TrustedNetworkV2PolicyReducer {
             if (acceptedParent.status !== "found") {
                 return this.acceptedAncestryUnavailable(acceptedParent);
             }
-            if (candidateParent.status !== "found")
-                return candidateParent;
+            if (candidateParent.status !== "found") {
+                return this.candidateAncestryResult(candidateParent);
+            }
             candidateCursor = candidateParent.parent;
             acceptedCursor = acceptedParent.parent;
         }
@@ -399,6 +696,26 @@ export class TrustedNetworkV2PolicyReducer {
         };
     }
     setFork(evaluation) {
+        // Pending snapshots were authenticated when admitted. Combine every one
+        // that is already provably a direct child with the pair that first exposed
+        // the fork. Canonical selection below may displace either initial child, so
+        // the durable layer needs the complete bounded observation set and removes
+        // whichever final pair is carried by exportDurableState().
+        const pendingForkObservationSnapshots = [...this.pending.values()]
+            .map(({ snapshot }) => snapshot)
+            .filter((snapshot) => snapshot.body.sequence ===
+            evaluation.commonParent.body.sequence + 1n &&
+            equals(snapshot.body.previousPolicyDigest, evaluation.commonParent.digest));
+        const forkObservationSnapshots = [
+            evaluation.candidateChild,
+            evaluation.acceptedChild,
+            ...pendingForkObservationSnapshots,
+        ];
+        const forkObservations = forkObservationSnapshots
+            .map(forkProofFromSnapshot)
+            .sort(compareForkChildProofs)
+            .filter((proof, index, observations) => index === 0 ||
+            !equals(proof.entryBytes, observations[index - 1].entryBytes));
         this.project(evaluation.commonParent);
         const children = [
             forkProofFromSnapshot(evaluation.candidateChild),
@@ -408,8 +725,12 @@ export class TrustedNetworkV2PolicyReducer {
             commonParent: projectionFromSnapshot(evaluation.commonParent),
             children,
         };
+        for (const snapshot of forkObservationSnapshots) {
+            this.retainCanonicalForkChild(snapshot);
+        }
         this.unavailable = undefined;
         this.pending.clear();
+        return forkObservations;
     }
     retainCanonicalForkChild(snapshot) {
         if (this.fork === undefined)
@@ -434,17 +755,20 @@ export class TrustedNetworkV2PolicyReducer {
         this.fork.children = [canonical[0], canonical[1]];
     }
     observeAfterFork(snapshot) {
-        if (this.fork === undefined || this.acceptedHead === undefined)
-            return;
+        if (this.fork === undefined || this.acceptedHead === undefined) {
+            return undefined;
+        }
         const commonParent = this.acceptedHead;
         if (snapshot.body.sequence !== commonParent.body.sequence + 1n ||
             !equals(snapshot.body.previousPolicyDigest, commonParent.digest)) {
-            return;
+            return undefined;
         }
-        // This bounded kernel deliberately retains only the canonical two direct
-        // child proofs. Durable storage of every authenticated fork observation is
-        // an outer-layer responsibility for a later integration slice.
+        // This bounded kernel retains only the canonical two direct child proofs.
+        // Return this already-authenticated observation so the durable outer layer
+        // can retain every proof without verifying it twice.
+        const observation = forkProofFromSnapshot(snapshot);
         this.retainCanonicalForkChild(snapshot);
+        return observation;
     }
     addPending(snapshot, missingParentDigest) {
         const existing = this.pending.get(snapshot.digestKey);
@@ -484,12 +808,15 @@ export class TrustedNetworkV2PolicyReducer {
         const retention = this.addPending(snapshot, evaluation.digest);
         this.unavailable = {
             acceptedAncestorDigest: copyBytes(evaluation.digest),
-            candidateDigestKey: snapshot.digestKey,
+            comparisonCandidate: copySnapshot(snapshot),
             reason: boundedUnavailableReason(evaluation.reason),
         };
         return retention;
     }
     async drainPending() {
+        if (this.lifecycleController.signal.aborted) {
+            return { status: "halted" };
+        }
         let accepted = false;
         let progress = true;
         while (progress &&
@@ -502,6 +829,9 @@ export class TrustedNetworkV2PolicyReducer {
                 if (!this.pending.has(pending.snapshot.digestKey))
                     continue;
                 const evaluation = await this.evaluate(pending.snapshot);
+                if (this.lifecycleController.signal.aborted) {
+                    return { status: "halted" };
+                }
                 if (evaluation.status === "missing") {
                     pending.missingParentDigest = copyBytes(evaluation.digest);
                     continue;
@@ -517,41 +847,70 @@ export class TrustedNetworkV2PolicyReducer {
                     accepted = true;
                 }
                 else if (evaluation.status === "fork") {
-                    this.setFork(evaluation);
-                    return { status: "forked" };
+                    return {
+                        status: "forked",
+                        forkObservations: this.setFork(evaluation),
+                    };
                 }
             }
         }
         return accepted ? { status: "accepted" } : undefined;
     }
     enqueueAdmission(operation) {
-        const result = this.admissionTail.then(operation);
+        const result = this.admissionTail.then(async () => {
+            if (this.lifecycleController.signal.aborted) {
+                return this.haltedResult();
+            }
+            const admission = await operation();
+            return this.lifecycleController.signal.aborted
+                ? this.haltedResult()
+                : admission;
+        });
         this.admissionTail = result.then(() => { }, (_reason) => { });
         return result;
     }
-    ingest(entry) {
-        return this.enqueueAdmission(() => this.ingestOne(entry));
+    ingest(entryBytes) {
+        if (this.lifecycleController.signal.aborted) {
+            return Promise.resolve(this.haltedResult());
+        }
+        let capturedEntryBytes;
+        try {
+            // Capture at the API boundary, before this admission waits behind earlier
+            // work. Otherwise a caller could mutate a queued entry before validation.
+            capturedEntryBytes = capturePolicySnapshotEntryBytesV2(entryBytes);
+        }
+        catch (error) {
+            const reason = validationMessage(error);
+            return this.enqueueAdmission(async () => this.result("rejected", reason));
+        }
+        return this.enqueueAdmission(() => this.ingestOne(capturedEntryBytes));
     }
     retryUnavailable() {
         return this.enqueueAdmission(() => this.retryUnavailableOne());
     }
-    async ingestOne(entry) {
+    async ingestOne(entryBytes) {
         let snapshot;
         try {
-            snapshot = await authenticatePolicySnapshotEntryV2(entry, this.descriptor);
+            snapshot = await authenticateCapturedPolicySnapshotEntryV2(entryBytes, this.descriptor);
         }
         catch (error) {
             return this.result("rejected", validationMessage(error));
         }
+        if (this.lifecycleController.signal.aborted)
+            return this.haltedResult();
         if (this.fork !== undefined) {
-            this.observeAfterFork(snapshot);
-            return this.result("halted", "Policy reducer is halted by authority equivocation");
+            const forkObservation = this.observeAfterFork(snapshot);
+            return this.result("halted", "Policy reducer is halted by authority equivocation", undefined, forkObservation === undefined ? undefined : [forkObservation]);
         }
         this.retainCanonicalHeadEntry(snapshot);
         if (this.unavailable !== undefined) {
             if (this.acceptedHead?.digestKey === snapshot.digestKey) {
                 return this.result("unavailable", this.unavailable.reason);
             }
+            if (this.unavailable.comparisonCandidate.digestKey === snapshot.digestKey &&
+                compare(snapshot.entryBytes, this.unavailable.comparisonCandidate.entryBytes) < 0) {
+                this.unavailable.comparisonCandidate = copySnapshot(snapshot);
+            }
             const existingPending = this.pending.get(snapshot.digestKey);
             if (existingPending !== undefined) {
                 this.addPending(snapshot, existingPending.missingParentDigest);
@@ -566,6 +925,8 @@ export class TrustedNetworkV2PolicyReducer {
             return this.result("pending", "Policy snapshot is already pending");
         }
         const evaluation = await this.evaluate(snapshot);
+        if (this.lifecycleController.signal.aborted)
+            return this.haltedResult();
         if (evaluation.status === "reject") {
             return this.result("rejected", evaluation.reason);
         }
@@ -573,8 +934,7 @@ export class TrustedNetworkV2PolicyReducer {
             return this.result("duplicate");
         }
         if (evaluation.status === "fork") {
-            this.setFork(evaluation);
-            return this.forkedResult();
+            return this.forkedResult(this.setFork(evaluation));
         }
         if (evaluation.status === "unavailable") {
             const retention = this.enterUnavailable(snapshot, evaluation);
@@ -583,7 +943,7 @@ export class TrustedNetworkV2PolicyReducer {
         if (evaluation.status === "missing") {
             const pending = this.addPending(snapshot, evaluation.digest);
             return this.result(pending.retained ? "pending" : "capacity", pending.retained
-                ? "Policy parent is missing"
+                ? (evaluation.reason ?? "Policy parent is missing")
                 : "Policy pending capacity did not retain this candidate", pending.evictedPolicyDigests);
         }
         this.project(snapshot);
@@ -591,6 +951,8 @@ export class TrustedNetworkV2PolicyReducer {
             this.result("accepted"));
     }
     async retryUnavailableOne() {
+        if (this.lifecycleController.signal.aborted)
+            return this.haltedResult();
         if (this.fork !== undefined) {
             return this.result("halted", "Policy reducer is halted by authority equivocation");
         }
@@ -598,16 +960,18 @@ export class TrustedNetworkV2PolicyReducer {
         if (unavailable === undefined) {
             return this.result("duplicate", "Policy reducer is not unavailable");
         }
-        const pending = this.pending.get(unavailable.candidateDigestKey);
+        const pending = this.pending.get(unavailable.comparisonCandidate.digestKey);
         if (pending === undefined) {
             return this.result("capacity", "Unavailable comparison candidate is not retained; re-ingest it before retrying");
         }
         const evaluation = await this.evaluate(pending.snapshot);
+        if (this.lifecycleController.signal.aborted)
+            return this.haltedResult();
         if (evaluation.status === "unavailable") {
             pending.missingParentDigest = copyBytes(evaluation.digest);
             this.unavailable = {
                 acceptedAncestorDigest: copyBytes(evaluation.digest),
-                candidateDigestKey: pending.snapshot.digestKey,
+                comparisonCandidate: copySnapshot(pending.snapshot),
                 reason: boundedUnavailableReason(evaluation.reason),
             };
             return this.result("unavailable", this.unavailable.reason);
@@ -618,13 +982,12 @@ export class TrustedNetworkV2PolicyReducer {
         if (evaluation.status === "missing") {
             pending.missingParentDigest = copyBytes(evaluation.digest);
             status = "pending";
-            reason = "Policy parent is missing";
+            reason = evaluation.reason ?? "Policy parent is missing";
         }
         else {
             this.pending.delete(pending.snapshot.digestKey);
             if (evaluation.status === "fork") {
-                this.setFork(evaluation);
-                return this.forkedResult();
+                return this.forkedResult(this.setFork(evaluation));
             }
             if (evaluation.status === "accept") {
                 this.project(pending.snapshot);