@peerbit/trusted-network 6.0.104 → 6.0.106

package/src/v2-policy-engine.ts

@@ -7,6 +7,7 @@ import {
 	PolicySnapshotBodyV2,
 	PolicySubjectBindingV2,
 	TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS,
+	TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES,
 	assertNetworkDescriptorV2,
 	decodePolicySnapshotBodyV2,
 	digestPolicySnapshotBodyV2,
@@ -22,8 +23,14 @@ import {
  */
 
 const DEFAULT_MAX_PENDING_POLICIES_V2 = 64;
-const DEFAULT_MAX_PENDING_POLICY_BYTES_V2 = 256 * 1024;
 const PENDING_POLICY_ACCOUNTING_OVERHEAD_V2 = 64;
+const MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2 =
+	TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 2 +
+	PENDING_POLICY_ACCOUNTING_OVERHEAD_V2;
+const DEFAULT_MAX_PENDING_POLICY_BYTES_V2 =
+	MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2;
+const DEFAULT_POLICY_RESOLUTION_TIMEOUT_MS_V2 = 10 * 1000;
+const MAX_TIMER_DELAY_MS_V2 = 0x7fffffff;
 const MAX_UNAVAILABLE_REASON_LENGTH_V2 = 512;
 
 const copyBytes = (bytes: Uint8Array): Uint8Array => Uint8Array.from(bytes);
@@ -76,7 +83,8 @@ const copySnapshot = (
 
 export type PolicySnapshotResolverV2 = (
 	digest: Uint8Array,
-) => EntryV0<Uint8Array> | undefined | Promise<EntryV0<Uint8Array> | undefined>;
+	options: { signal: AbortSignal },
+) => Uint8Array | undefined | Promise<Uint8Array | undefined>;
 
 export type PolicyParentFetchHintV2 = {
 	kind: "policy-parent";
@@ -114,12 +122,50 @@ export type PolicyAdmissionResultV2 = {
 	status: PolicyAdmissionStatusV2;
 	reason?: string;
 	head?: PolicyHeadProjectionV2;
+	/**
+	 * Authenticated direct children surfaced while entering or already in
+	 * FORKED. The outer durable layer can persist these proofs without decoding
+	 * or verifying them a second time. They are bounded by one admission plus the
+	 * pending working set and are not accumulated by this reducer.
+	 */
+	forkObservations?: PolicyForkChildProofV2[];
 	fetchHints: PolicyParentFetchHintV2[];
 	pendingCount: number;
 	pendingBytes: number;
 	evictedPolicyDigests?: Uint8Array[];
 };
 
+export type PolicyReducerDurableStateV2 =
+	| { formatVersion: 1; state: "EMPTY" }
+	| {
+			formatVersion: 1;
+			state: "ACTIVE";
+			acceptedHeadEntryBytes: Uint8Array;
+	  }
+	| {
+			formatVersion: 1;
+			state: "UNAVAILABLE";
+			acceptedHeadEntryBytes: Uint8Array;
+			comparisonCandidateEntryBytes: Uint8Array;
+			acceptedAncestorDigest: Uint8Array;
+			reason: string;
+	  }
+	| {
+			formatVersion: 1;
+			state: "FORKED";
+			commonParentEntryBytes: Uint8Array;
+			childEntryBytes: [Uint8Array, Uint8Array];
+	  };
+
+export type TrustedNetworkV2PolicyReducerProperties = {
+	descriptor: NetworkDescriptorV2;
+	resolvePolicyEntry: PolicySnapshotResolverV2;
+	resolveTimeoutMs?: number;
+	signal?: AbortSignal;
+	maxPending?: number;
+	maxPendingPolicyBytes?: number;
+};
+
 type PendingPolicySnapshotV2 = {
 	snapshot: ValidatedPolicySnapshotV2;
 	missingParentDigest: Uint8Array;
@@ -127,13 +173,14 @@ type PendingPolicySnapshotV2 = {
 
 type UnavailablePolicyComparisonV2 = {
 	acceptedAncestorDigest: Uint8Array;
-	candidateDigestKey: string;
+	comparisonCandidate: ValidatedPolicySnapshotV2;
 	reason: string;
 };
 
 type ParentResolutionV2 =
 	| { status: "found"; parent: ValidatedPolicySnapshotV2 }
 	| { status: "missing"; digest: Uint8Array }
+	| { status: "unavailable"; digest: Uint8Array; reason: string }
 	| { status: "reject"; digest: Uint8Array; reason: string };
 
 type SnapshotResolutionCacheV2 = Map<
@@ -144,7 +191,7 @@ type SnapshotResolutionCacheV2 = Map<
 type EvaluationV2 =
 	| { status: "accept" }
 	| { status: "duplicate" }
-	| { status: "missing"; digest: Uint8Array }
+	| { status: "missing"; digest: Uint8Array; reason?: string }
 	| { status: "reject"; reason: string }
 	| { status: "unavailable"; digest: Uint8Array; reason: string }
 	| {
@@ -156,7 +203,8 @@ type EvaluationV2 =
 
 type PendingDrainOutcomeV2 =
 	| { status: "accepted" }
-	| { status: "forked" }
+	| { status: "forked"; forkObservations: PolicyForkChildProofV2[] }
+	| { status: "halted" }
 	| {
 			status: "unavailable";
 			retained: boolean;
@@ -169,34 +217,61 @@ const validationMessage = (error: unknown): string =>
 const boundedUnavailableReason = (reason: string): string =>
 	reason.slice(0, MAX_UNAVAILABLE_REASON_LENGTH_V2);
 
-export const authenticatePolicySnapshotEntryV2 = async (
-	entry: unknown,
+class PolicyDependencyUnavailableErrorV2 extends Error {
+	constructor(message: string) {
+		super(message);
+		this.name = "PolicyDependencyUnavailableErrorV2";
+	}
+}
+
+const capturePolicySnapshotEntryBytesV2 = (
+	entryBytes: Uint8Array,
+): Uint8Array => {
+	if (!(entryBytes instanceof Uint8Array)) {
+		throw new Error("Policy snapshot must use canonical EntryV0 bytes");
+	}
+	if (entryBytes.byteLength === 0) {
+		throw new Error("Policy snapshot must use EntryV0");
+	}
+	if (entryBytes.byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES) {
+		throw new Error(
+			`Policy snapshot entry must contain 1-${TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES} bytes`,
+		);
+	}
+
+	// Apply the protocol byte ceiling before this first copy, decode, or crypto
+	// operation. The retained copy also prevents caller mutation during awaits.
+	return copyBytes(entryBytes);
+};
+
+const authenticateCapturedPolicySnapshotEntryV2 = async (
+	canonicalEntryBytes: Uint8Array,
 	descriptor: NetworkDescriptorV2,
 ): Promise<ValidatedPolicySnapshotV2> => {
-	assertNetworkDescriptorV2(descriptor);
-	if (!(entry instanceof EntryV0)) {
+	const authenticatedEntry = deserialize(canonicalEntryBytes, Entry);
+	if (!(authenticatedEntry instanceof EntryV0)) {
 		throw new Error("Policy snapshot must use EntryV0");
 	}
-	if (!(entry._meta instanceof DecryptedThing)) {
+	if (!equals(canonicalEntryBytes, serialize(authenticatedEntry))) {
+		throw new Error("Policy snapshot entry encoding is not canonical");
+	}
+	if (!(authenticatedEntry._meta instanceof DecryptedThing)) {
 		throw new Error("Policy snapshot metadata must be public");
 	}
-	if (!(entry._payload instanceof DecryptedThing)) {
+	if (!(authenticatedEntry._payload instanceof DecryptedThing)) {
 		throw new Error("Policy snapshot payload must be public");
 	}
 	if (
-		entry._signatures === undefined ||
-		entry._signatures.signatures.length !== 1
+		authenticatedEntry._signatures === undefined ||
+		authenticatedEntry._signatures.signatures.length !== 1
 	) {
 		throw new Error("Policy snapshot must contain exactly one signature");
 	}
-	if (!(entry._signatures.signatures[0] instanceof DecryptedThing)) {
+	if (
+		!(authenticatedEntry._signatures.signatures[0] instanceof DecryptedThing)
+	) {
 		throw new Error("Policy snapshot signature must be public");
 	}
-	const entryBytes = serialize(entry);
-	const authenticatedEntry = deserialize(entryBytes, Entry);
-	if (!(authenticatedEntry instanceof EntryV0)) {
-		throw new Error("Policy snapshot must decode as EntryV0");
-	}
 	authenticatedEntry.init({ encoding: NO_ENCODING });
 
 	const signatures = await authenticatedEntry.getSignatures();
@@ -228,14 +303,25 @@ export const authenticatePolicySnapshotEntryV2 = async (
 		body: copyBody(body),
 		digest: copyBytes(digest),
 		digestKey: bytesKey(digest),
-		entryBytes,
+		entryBytes: canonicalEntryBytes,
 		accountedBytes:
-			entryBytes.byteLength +
+			canonicalEntryBytes.byteLength +
 			serialize(body).byteLength +
 			PENDING_POLICY_ACCOUNTING_OVERHEAD_V2,
 	};
 };
 
+export const authenticatePolicySnapshotEntryV2 = async (
+	entryBytes: Uint8Array,
+	descriptor: NetworkDescriptorV2,
+): Promise<ValidatedPolicySnapshotV2> => {
+	assertNetworkDescriptorV2(descriptor);
+	return authenticateCapturedPolicySnapshotEntryV2(
+		capturePolicySnapshotEntryBytesV2(entryBytes),
+		descriptor,
+	);
+};
+
 const projectionFromSnapshot = (
 	snapshot: ValidatedPolicySnapshotV2,
 ): PolicyHeadProjectionV2 => ({
@@ -288,11 +374,93 @@ const copyForkEvidence = (
 	],
 });
 
+const captureDurableStateV2 = (
+	durableState: PolicyReducerDurableStateV2,
+): PolicyReducerDurableStateV2 => {
+	if (
+		durableState === null ||
+		typeof durableState !== "object" ||
+		durableState.formatVersion !== 1
+	) {
+		throw new Error("Unsupported TrustedNetwork v2 reducer state format");
+	}
+
+	switch (durableState.state) {
+		case "EMPTY":
+			return { formatVersion: 1, state: "EMPTY" };
+		case "ACTIVE":
+			return {
+				formatVersion: 1,
+				state: "ACTIVE",
+				acceptedHeadEntryBytes: capturePolicySnapshotEntryBytesV2(
+					durableState.acceptedHeadEntryBytes,
+				),
+			};
+		case "UNAVAILABLE": {
+			if (
+				!(durableState.acceptedAncestorDigest instanceof Uint8Array) ||
+				durableState.acceptedAncestorDigest.byteLength !== 32
+			) {
+				throw new Error(
+					"Unavailable accepted ancestor digest must contain exactly 32 bytes",
+				);
+			}
+			if (
+				typeof durableState.reason !== "string" ||
+				durableState.reason.length === 0 ||
+				durableState.reason.length > MAX_UNAVAILABLE_REASON_LENGTH_V2
+			) {
+				throw new Error(
+					`Unavailable reason must contain 1-${MAX_UNAVAILABLE_REASON_LENGTH_V2} characters`,
+				);
+			}
+			return {
+				formatVersion: 1,
+				state: "UNAVAILABLE",
+				acceptedHeadEntryBytes: capturePolicySnapshotEntryBytesV2(
+					durableState.acceptedHeadEntryBytes,
+				),
+				comparisonCandidateEntryBytes: capturePolicySnapshotEntryBytesV2(
+					durableState.comparisonCandidateEntryBytes,
+				),
+				acceptedAncestorDigest: copyBytes(durableState.acceptedAncestorDigest),
+				reason: durableState.reason,
+			};
+		}
+		case "FORKED":
+			if (
+				!Array.isArray(durableState.childEntryBytes) ||
+				durableState.childEntryBytes.length !== 2
+			) {
+				throw new Error(
+					"Forked reducer state must contain exactly two children",
+				);
+			}
+			return {
+				formatVersion: 1,
+				state: "FORKED",
+				commonParentEntryBytes: capturePolicySnapshotEntryBytesV2(
+					durableState.commonParentEntryBytes,
+				),
+				childEntryBytes: [
+					capturePolicySnapshotEntryBytesV2(durableState.childEntryBytes[0]),
+					capturePolicySnapshotEntryBytesV2(durableState.childEntryBytes[1]),
+				],
+			};
+		default:
+			throw new Error("Unsupported TrustedNetwork v2 reducer state");
+	}
+};
+
 export class TrustedNetworkV2PolicyReducer {
 	private readonly descriptor: NetworkDescriptorV2;
 	private readonly resolvePolicyEntry: PolicySnapshotResolverV2;
+	private readonly resolveTimeoutMs: number;
 	private readonly maxPending: number;
 	private readonly maxPendingPolicyBytes: number;
+	private readonly lifecycleController = new AbortController();
+	private externalSignal?: AbortSignal;
+	private externalAbortListener?: () => void;
 	private acceptedHead?: ValidatedPolicySnapshotV2;
 	private projectedRoles = new Map<string, number>();
 	private readonly pending = new Map<string, PendingPolicySnapshotV2>();
@@ -302,12 +470,7 @@ export class TrustedNetworkV2PolicyReducer {
 	private fork?: PolicyForkEvidenceV2;
 	private admissionTail: Promise<void> = Promise.resolve();
 
-	constructor(properties: {
-		descriptor: NetworkDescriptorV2;
-		resolvePolicyEntry: PolicySnapshotResolverV2;
-		maxPending?: number;
-		maxPendingPolicyBytes?: number;
-	}) {
+	constructor(properties: TrustedNetworkV2PolicyReducerProperties) {
 		assertNetworkDescriptorV2(properties.descriptor);
 		const maxPending = properties.maxPending ?? DEFAULT_MAX_PENDING_POLICIES_V2;
 		if (!Number.isSafeInteger(maxPending) || maxPending < 1) {
@@ -317,20 +480,147 @@ export class TrustedNetworkV2PolicyReducer {
 			properties.maxPendingPolicyBytes ?? DEFAULT_MAX_PENDING_POLICY_BYTES_V2;
 		if (
 			!Number.isSafeInteger(maxPendingPolicyBytes) ||
-			maxPendingPolicyBytes < 1
+			maxPendingPolicyBytes < 1 ||
+			maxPendingPolicyBytes > MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2
 		) {
-			throw new Error("maxPendingPolicyBytes must be a positive safe integer");
+			throw new Error(
+				`maxPendingPolicyBytes must be a positive safe integer no greater than ${MAX_PENDING_POLICY_ACCOUNTED_BYTES_V2}`,
+			);
+		}
+		const resolveTimeoutMs =
+			properties.resolveTimeoutMs ?? DEFAULT_POLICY_RESOLUTION_TIMEOUT_MS_V2;
+		if (
+			!Number.isSafeInteger(resolveTimeoutMs) ||
+			resolveTimeoutMs < 1 ||
+			resolveTimeoutMs > MAX_TIMER_DELAY_MS_V2
+		) {
+			throw new Error(
+				`resolveTimeoutMs must be a positive safe integer no greater than ${MAX_TIMER_DELAY_MS_V2}`,
+			);
 		}
 		this.descriptor = deserialize(
 			serialize(properties.descriptor),
 			NetworkDescriptorV2,
 		);
 		this.resolvePolicyEntry = properties.resolvePolicyEntry;
+		this.resolveTimeoutMs = resolveTimeoutMs;
 		this.maxPending = maxPending;
 		this.maxPendingPolicyBytes = maxPendingPolicyBytes;
+
+		if (properties.signal?.aborted) {
+			this.lifecycleController.abort();
+		} else if (properties.signal !== undefined) {
+			this.externalSignal = properties.signal;
+			this.externalAbortListener = (): void => {
+				this.externalSignal = undefined;
+				this.externalAbortListener = undefined;
+				this.lifecycleController.abort();
+			};
+			this.externalSignal.addEventListener(
+				"abort",
+				this.externalAbortListener,
+				{ once: true },
+			);
+		}
+	}
+
+	static async restore(
+		properties: TrustedNetworkV2PolicyReducerProperties & {
+			durableState: PolicyReducerDurableStateV2;
+		},
+	): Promise<TrustedNetworkV2PolicyReducer> {
+		// Capture the complete checkpoint before the first await. Persistence
+		// adapters commonly reuse read buffers, and mutation during authentication
+		// must not change what is restored.
+		const durableState = captureDurableStateV2(properties.durableState);
+		const reducer = new TrustedNetworkV2PolicyReducer(properties);
+		const authenticate = (
+			entryBytes: Uint8Array,
+		): Promise<ValidatedPolicySnapshotV2> =>
+			authenticateCapturedPolicySnapshotEntryV2(entryBytes, reducer.descriptor);
+
+		try {
+			switch (durableState.state) {
+				case "EMPTY":
+					return reducer;
+				case "ACTIVE": {
+					const acceptedHead = await authenticate(
+						durableState.acceptedHeadEntryBytes,
+					);
+					// A durable ACTIVE head is a trusted prior-validation checkpoint. Its
+					// authority signature and network binding are re-authenticated above,
+					// but restore deliberately does not require historical resolver data.
+					reducer.project(acceptedHead);
+					return reducer;
+				}
+				case "UNAVAILABLE": {
+					const [acceptedHead, comparisonCandidate] = await Promise.all([
+						authenticate(durableState.acceptedHeadEntryBytes),
+						authenticate(durableState.comparisonCandidateEntryBytes),
+					]);
+					if (equals(acceptedHead.digest, comparisonCandidate.digest)) {
+						throw new Error(
+							"Unavailable comparison candidate must differ from the accepted head",
+						);
+					}
+					reducer.project(acceptedHead);
+					reducer.addPending(
+						comparisonCandidate,
+						durableState.acceptedAncestorDigest,
+					);
+					reducer.unavailable = {
+						acceptedAncestorDigest: copyBytes(
+							durableState.acceptedAncestorDigest,
+						),
+						comparisonCandidate: copySnapshot(comparisonCandidate),
+						reason: durableState.reason,
+					};
+					return reducer;
+				}
+				case "FORKED": {
+					const [commonParent, firstChild, secondChild] = await Promise.all([
+						authenticate(durableState.commonParentEntryBytes),
+						authenticate(durableState.childEntryBytes[0]),
+						authenticate(durableState.childEntryBytes[1]),
+					]);
+					for (const child of [firstChild, secondChild]) {
+						if (
+							child.body.sequence !== commonParent.body.sequence + 1n ||
+							!equals(child.body.previousPolicyDigest, commonParent.digest)
+						) {
+							throw new Error(
+								"Fork child must be a direct successor of the common parent",
+							);
+						}
+					}
+					if (equals(firstChild.digest, secondChild.digest)) {
+						throw new Error("Fork children must have distinct policy digests");
+					}
+
+					const children = [
+						forkProofFromSnapshot(firstChild),
+						forkProofFromSnapshot(secondChild),
+					].sort(compareForkChildProofs) as [
+						PolicyForkChildProofV2,
+						PolicyForkChildProofV2,
+					];
+					reducer.project(commonParent);
+					reducer.fork = {
+						commonParent: projectionFromSnapshot(commonParent),
+						children,
+					};
+					return reducer;
+				}
+			}
+		} catch (error) {
+			// Do not retain a caller-owned AbortSignal listener when restore rejects.
+			reducer.abort();
+			throw error;
+		}
 	}
 
-	get state(): "EMPTY" | "ACTIVE" | "UNAVAILABLE" | "FORKED" {
+	get state(): "EMPTY" | "ACTIVE" | "UNAVAILABLE" | "FORKED" | "HALTED" {
+		if (this.lifecycleController.signal.aborted) return "HALTED";
 		if (this.fork !== undefined) return "FORKED";
 		if (this.unavailable !== undefined) return "UNAVAILABLE";
 		return this.acceptedHead === undefined ? "EMPTY" : "ACTIVE";
@@ -364,6 +654,50 @@ export class TrustedNetworkV2PolicyReducer {
 			.map(({ snapshot }) => copyBytes(snapshot.digest));
 	}
 
+	exportDurableState(): PolicyReducerDurableStateV2 {
+		// Lifecycle cancellation is process-local. Export the underlying protocol
+		// safety state so a replacement process cannot erase UNAVAILABLE/FORKED.
+		if (this.fork !== undefined) {
+			if (this.acceptedHead === undefined) {
+				throw new Error("Forked reducer is missing its common-parent entry");
+			}
+			return {
+				formatVersion: 1,
+				state: "FORKED",
+				commonParentEntryBytes: copyBytes(this.acceptedHead.entryBytes),
+				childEntryBytes: [
+					copyBytes(this.fork.children[0].entryBytes),
+					copyBytes(this.fork.children[1].entryBytes),
+				],
+			};
+		}
+		if (this.unavailable !== undefined) {
+			if (this.acceptedHead === undefined) {
+				throw new Error("Unavailable reducer is missing its accepted head");
+			}
+			return {
+				formatVersion: 1,
+				state: "UNAVAILABLE",
+				acceptedHeadEntryBytes: copyBytes(this.acceptedHead.entryBytes),
+				comparisonCandidateEntryBytes: copyBytes(
+					this.unavailable.comparisonCandidate.entryBytes,
+				),
+				acceptedAncestorDigest: copyBytes(
+					this.unavailable.acceptedAncestorDigest,
+				),
+				reason: this.unavailable.reason,
+			};
+		}
+		if (this.acceptedHead !== undefined) {
+			return {
+				formatVersion: 1,
+				state: "ACTIVE",
+				acceptedHeadEntryBytes: copyBytes(this.acceptedHead.entryBytes),
+			};
+		}
+		return { formatVersion: 1, state: "EMPTY" };
+	}
+
 	rolesFor(subject: PublicSignKey): number {
 		return this.projectedRoles.get(publicKeyId(subject)) ?? 0;
 	}
@@ -380,6 +714,21 @@ export class TrustedNetworkV2PolicyReducer {
 		return (this.rolesFor(subject) & roles) === roles;
 	}
 
+	abort(): void {
+		if (
+			this.externalSignal !== undefined &&
+			this.externalAbortListener !== undefined
+		) {
+			this.externalSignal.removeEventListener(
+				"abort",
+				this.externalAbortListener,
+			);
+		}
+		this.externalSignal = undefined;
+		this.externalAbortListener = undefined;
+		this.lifecycleController.abort();
+	}
+
 	private fetchHints(): PolicyParentFetchHintV2[] {
 		const unique = new Map<string, Uint8Array>();
 		for (const { missingParentDigest } of this.pending.values()) {
@@ -403,11 +752,16 @@ export class TrustedNetworkV2PolicyReducer {
 		status: PolicyAdmissionStatusV2,
 		reason?: string,
 		evictedPolicyDigests?: Uint8Array[],
+		forkObservations?: PolicyForkChildProofV2[],
 	): PolicyAdmissionResultV2 {
 		return {
 			status,
 			reason,
 			head: this.head,
+			forkObservations:
+				forkObservations === undefined
+					? undefined
+					: forkObservations.map(copyForkChildProof),
 			fetchHints: this.fetchHints(),
 			pendingCount: this.pending.size,
 			pendingBytes: this.pendingBytes,
@@ -418,8 +772,19 @@ export class TrustedNetworkV2PolicyReducer {
 		};
 	}
 
-	private forkedResult(): PolicyAdmissionResultV2 {
-		return this.result("forked", "Policy authority signed competing children");
+	private forkedResult(
+		forkObservations?: PolicyForkChildProofV2[],
+	): PolicyAdmissionResultV2 {
+		return this.result(
+			"forked",
+			"Policy authority signed competing children",
+			undefined,
+			forkObservations,
+		);
+	}
+
+	private haltedResult(): PolicyAdmissionResultV2 {
+		return this.result("halted", "Policy reducer lifecycle is aborted");
 	}
 
 	private unavailableResult(retention?: {
@@ -428,7 +793,7 @@ export class TrustedNetworkV2PolicyReducer {
 	}): PolicyAdmissionResultV2 {
 		const blockedCandidateRetained =
 			this.unavailable !== undefined &&
-			this.pending.has(this.unavailable.candidateDigestKey);
+			this.pending.has(this.unavailable.comparisonCandidate.digestKey);
 		const recoverable =
 			(retention?.retained ?? true) && blockedCandidateRetained;
 		const reason = recoverable
@@ -446,7 +811,10 @@ export class TrustedNetworkV2PolicyReducer {
 	private completedDrainResult(
 		outcome: PendingDrainOutcomeV2 | undefined,
 	): PolicyAdmissionResultV2 | undefined {
-		if (outcome?.status === "forked") return this.forkedResult();
+		if (outcome?.status === "forked") {
+			return this.forkedResult(outcome.forkObservations);
+		}
+		if (outcome?.status === "halted") return this.haltedResult();
 		return outcome?.status === "unavailable"
 			? this.unavailableResult(outcome)
 			: undefined;
@@ -471,6 +839,88 @@ export class TrustedNetworkV2PolicyReducer {
 		}
 	}
 
+	private async resolveExternalSnapshot(
+		digest: Uint8Array,
+	): Promise<ValidatedPolicySnapshotV2 | undefined> {
+		if (this.lifecycleController.signal.aborted) {
+			throw new PolicyDependencyUnavailableErrorV2(
+				"Policy resolver lifecycle is aborted",
+			);
+		}
+
+		const attemptController = new AbortController();
+		let timedOut = false;
+		const abortFromLifecycle = (): void => attemptController.abort();
+		this.lifecycleController.signal.addEventListener(
+			"abort",
+			abortFromLifecycle,
+			{ once: true },
+		);
+		const timeout = setTimeout(() => {
+			timedOut = true;
+			attemptController.abort();
+		}, this.resolveTimeoutMs);
+		const abortError = (): PolicyDependencyUnavailableErrorV2 =>
+			new PolicyDependencyUnavailableErrorV2(
+				timedOut
+					? `Policy resolver timed out after ${this.resolveTimeoutMs} ms`
+					: "Policy resolver attempt was aborted",
+			);
+
+		let rejectOnAbort: (() => void) | undefined;
+		const abortPromise = new Promise<never>((_resolve, reject) => {
+			rejectOnAbort = (): void => {
+				reject(abortError());
+			};
+			attemptController.signal.addEventListener("abort", rejectOnAbort, {
+				once: true,
+			});
+		});
+
+		const resolution = Promise.resolve().then(async () => {
+			if (attemptController.signal.aborted) throw abortError();
+			const entryBytes = await this.resolvePolicyEntry(copyBytes(digest), {
+				signal: attemptController.signal,
+			});
+			// A resolver may ignore cancellation. Do not spend decode or signature
+			// verification work on bytes that arrive after this attempt expired.
+			if (attemptController.signal.aborted) throw abortError();
+			if (entryBytes === undefined) return undefined;
+			const snapshot = await authenticatePolicySnapshotEntryV2(
+				entryBytes,
+				this.descriptor,
+			);
+			if (!equals(snapshot.digest, digest)) {
+				throw new Error("Policy resolver returned the wrong body digest");
+			}
+			return snapshot;
+		});
+		// Promise.race installs handlers, but this explicit observer documents and
+		// preserves consumption if the resolver settles after its deadline.
+		void resolution.then(
+			(): void => undefined,
+			(): void => undefined,
+		);
+
+		try {
+			return await Promise.race([resolution, abortPromise]);
+		} catch (error) {
+			if (error instanceof PolicyDependencyUnavailableErrorV2) throw error;
+			throw new PolicyDependencyUnavailableErrorV2(
+				`Policy resolver dependency is unavailable: ${validationMessage(error)}`,
+			);
+		} finally {
+			clearTimeout(timeout);
+			this.lifecycleController.signal.removeEventListener(
+				"abort",
+				abortFromLifecycle,
+			);
+			if (rejectOnAbort !== undefined) {
+				attemptController.signal.removeEventListener("abort", rejectOnAbort);
+			}
+		}
+	}
+
 	private async resolveSnapshot(
 		digest: Uint8Array,
 		cache?: SnapshotResolutionCacheV2,
@@ -483,18 +933,7 @@ export class TrustedNetworkV2PolicyReducer {
 		if (pending !== undefined) return copySnapshot(pending.snapshot);
 		let resolution = cache?.get(digestKey);
 		if (resolution === undefined) {
-			resolution = (async () => {
-				const entry = await this.resolvePolicyEntry(copyBytes(digest));
-				if (entry === undefined) return undefined;
-				const snapshot = await authenticatePolicySnapshotEntryV2(
-					entry,
-					this.descriptor,
-				);
-				if (!equals(snapshot.digest, digest)) {
-					throw new Error("Policy resolver returned the wrong body digest");
-				}
-				return snapshot;
-			})();
+			resolution = this.resolveExternalSnapshot(digest);
 			cache?.set(digestKey, resolution);
 		}
 		const snapshot = await resolution;
@@ -520,9 +959,9 @@ export class TrustedNetworkV2PolicyReducer {
 			);
 		} catch (error) {
 			return {
-				status: "reject",
+				status: "unavailable",
 				digest: copyBytes(child.body.previousPolicyDigest),
-				reason: `Policy parent validation failed: ${validationMessage(error)}`,
+				reason: `Policy parent dependency is unavailable: ${validationMessage(error)}`,
 			};
 		}
 		if (parent === undefined) {
@@ -541,6 +980,18 @@ export class TrustedNetworkV2PolicyReducer {
 		return { status: "found", parent };
 	}
 
+	private candidateAncestryResult(
+		resolution: Exclude<ParentResolutionV2, { status: "found" }>,
+	): EvaluationV2 {
+		return resolution.status === "unavailable"
+			? {
+					status: "missing",
+					digest: copyBytes(resolution.digest),
+					reason: resolution.reason,
+				}
+			: resolution;
+	}
+
 	private acceptedAncestryUnavailable(
 		resolution: Exclude<ParentResolutionV2, { status: "found" }>,
 	): Extract<EvaluationV2, { status: "unavailable" }> {
@@ -550,7 +1001,9 @@ export class TrustedNetworkV2PolicyReducer {
 			reason:
 				resolution.status === "missing"
 					? "Accepted policy ancestry is unavailable from the resolver"
-					: `Accepted policy ancestry validation failed: ${resolution.reason}`,
+					: resolution.status === "unavailable"
+						? `Accepted policy ancestry is unavailable: ${resolution.reason}`
+						: `Accepted policy ancestry validation failed: ${resolution.reason}`,
 		};
 	}
 
@@ -562,7 +1015,9 @@ export class TrustedNetworkV2PolicyReducer {
 			let cursor = candidate;
 			while (cursor.body.sequence !== 0n) {
 				const parent = await this.parentOf(cursor, resolutionCache);
-				if (parent.status !== "found") return parent;
+				if (parent.status !== "found") {
+					return this.candidateAncestryResult(parent);
+				}
 				cursor = parent.parent;
 			}
 			return { status: "accept" };
@@ -576,7 +1031,9 @@ export class TrustedNetworkV2PolicyReducer {
 		while (candidateCursor.body.sequence > acceptedCursor.body.sequence) {
 			candidateChild = candidateCursor;
 			const parent = await this.parentOf(candidateCursor, resolutionCache);
-			if (parent.status !== "found") return parent;
+			if (parent.status !== "found") {
+				return this.candidateAncestryResult(parent);
+			}
 			candidateCursor = parent.parent;
 		}
 		while (acceptedCursor.body.sequence > candidateCursor.body.sequence) {
@@ -607,7 +1064,9 @@ export class TrustedNetworkV2PolicyReducer {
 			if (acceptedParent.status !== "found") {
 				return this.acceptedAncestryUnavailable(acceptedParent);
 			}
-			if (candidateParent.status !== "found") return candidateParent;
+			if (candidateParent.status !== "found") {
+				return this.candidateAncestryResult(candidateParent);
+			}
 			candidateCursor = candidateParent.parent;
 			acceptedCursor = acceptedParent.parent;
 		}
@@ -629,7 +1088,39 @@ export class TrustedNetworkV2PolicyReducer {
 		};
 	}
 
-	private setFork(evaluation: Extract<EvaluationV2, { status: "fork" }>): void {
+	private setFork(
+		evaluation: Extract<EvaluationV2, { status: "fork" }>,
+	): PolicyForkChildProofV2[] {
+		// Pending snapshots were authenticated when admitted. Combine every one
+		// that is already provably a direct child with the pair that first exposed
+		// the fork. Canonical selection below may displace either initial child, so
+		// the durable layer needs the complete bounded observation set and removes
+		// whichever final pair is carried by exportDurableState().
+		const pendingForkObservationSnapshots = [...this.pending.values()]
+			.map(({ snapshot }) => snapshot)
+			.filter(
+				(snapshot) =>
+					snapshot.body.sequence ===
+						evaluation.commonParent.body.sequence + 1n &&
+					equals(
+						snapshot.body.previousPolicyDigest,
+						evaluation.commonParent.digest,
+					),
+			);
+		const forkObservationSnapshots = [
+			evaluation.candidateChild,
+			evaluation.acceptedChild,
+			...pendingForkObservationSnapshots,
+		];
+		const forkObservations = forkObservationSnapshots
+			.map(forkProofFromSnapshot)
+			.sort(compareForkChildProofs)
+			.filter(
+				(proof, index, observations) =>
+					index === 0 ||
+					!equals(proof.entryBytes, observations[index - 1]!.entryBytes),
+			);
+
 		this.project(evaluation.commonParent);
 		const children = [
 			forkProofFromSnapshot(evaluation.candidateChild),
@@ -642,8 +1133,12 @@ export class TrustedNetworkV2PolicyReducer {
 			commonParent: projectionFromSnapshot(evaluation.commonParent),
 			children,
 		};
+		for (const snapshot of forkObservationSnapshots) {
+			this.retainCanonicalForkChild(snapshot);
+		}
 		this.unavailable = undefined;
 		this.pending.clear();
+		return forkObservations;
 	}
 
 	private retainCanonicalForkChild(snapshot: ValidatedPolicySnapshotV2): void {
@@ -669,20 +1164,26 @@ export class TrustedNetworkV2PolicyReducer {
 		this.fork.children = [canonical[0]!, canonical[1]!];
 	}
 
-	private observeAfterFork(snapshot: ValidatedPolicySnapshotV2): void {
-		if (this.fork === undefined || this.acceptedHead === undefined) return;
+	private observeAfterFork(
+		snapshot: ValidatedPolicySnapshotV2,
+	): PolicyForkChildProofV2 | undefined {
+		if (this.fork === undefined || this.acceptedHead === undefined) {
+			return undefined;
+		}
 		const commonParent = this.acceptedHead;
 		if (
 			snapshot.body.sequence !== commonParent.body.sequence + 1n ||
 			!equals(snapshot.body.previousPolicyDigest, commonParent.digest)
 		) {
-			return;
+			return undefined;
 		}
 
-		// This bounded kernel deliberately retains only the canonical two direct
-		// child proofs. Durable storage of every authenticated fork observation is
-		// an outer-layer responsibility for a later integration slice.
+		// This bounded kernel retains only the canonical two direct child proofs.
+		// Return this already-authenticated observation so the durable outer layer
+		// can retain every proof without verifying it twice.
+		const observation = forkProofFromSnapshot(snapshot);
 		this.retainCanonicalForkChild(snapshot);
+		return observation;
 	}
 
 	private addPending(
@@ -735,13 +1236,16 @@ export class TrustedNetworkV2PolicyReducer {
 		const retention = this.addPending(snapshot, evaluation.digest);
 		this.unavailable = {
 			acceptedAncestorDigest: copyBytes(evaluation.digest),
-			candidateDigestKey: snapshot.digestKey,
+			comparisonCandidate: copySnapshot(snapshot),
 			reason: boundedUnavailableReason(evaluation.reason),
 		};
 		return retention;
 	}
 
 	private async drainPending(): Promise<PendingDrainOutcomeV2 | undefined> {
+		if (this.lifecycleController.signal.aborted) {
+			return { status: "halted" };
+		}
 		let accepted = false;
 		let progress = true;
 		while (
@@ -757,6 +1261,9 @@ export class TrustedNetworkV2PolicyReducer {
 			for (const pending of ordered) {
 				if (!this.pending.has(pending.snapshot.digestKey)) continue;
 				const evaluation = await this.evaluate(pending.snapshot);
+				if (this.lifecycleController.signal.aborted) {
+					return { status: "halted" };
+				}
 				if (evaluation.status === "missing") {
 					pending.missingParentDigest = copyBytes(evaluation.digest);
 					continue;
@@ -771,8 +1278,10 @@ export class TrustedNetworkV2PolicyReducer {
 					this.project(pending.snapshot);
 					accepted = true;
 				} else if (evaluation.status === "fork") {
-					this.setFork(evaluation);
-					return { status: "forked" };
+					return {
+						status: "forked",
+						forkObservations: this.setFork(evaluation),
+					};
 				}
 			}
 		}
@@ -782,7 +1291,15 @@ export class TrustedNetworkV2PolicyReducer {
 	private enqueueAdmission(
 		operation: () => Promise<PolicyAdmissionResultV2>,
 	): Promise<PolicyAdmissionResultV2> {
-		const result = this.admissionTail.then(operation);
+		const result = this.admissionTail.then(async () => {
+			if (this.lifecycleController.signal.aborted) {
+				return this.haltedResult();
+			}
+			const admission = await operation();
+			return this.lifecycleController.signal.aborted
+				? this.haltedResult()
+				: admission;
+		});
 		this.admissionTail = result.then(
 			(): void => {},
 			(_reason: unknown): void => {},
@@ -790,30 +1307,47 @@ export class TrustedNetworkV2PolicyReducer {
 		return result;
 	}
 
-	ingest(entry: unknown): Promise<PolicyAdmissionResultV2> {
-		return this.enqueueAdmission(() => this.ingestOne(entry));
+	ingest(entryBytes: Uint8Array): Promise<PolicyAdmissionResultV2> {
+		if (this.lifecycleController.signal.aborted) {
+			return Promise.resolve(this.haltedResult());
+		}
+		let capturedEntryBytes: Uint8Array;
+		try {
+			// Capture at the API boundary, before this admission waits behind earlier
+			// work. Otherwise a caller could mutate a queued entry before validation.
+			capturedEntryBytes = capturePolicySnapshotEntryBytesV2(entryBytes);
+		} catch (error) {
+			const reason = validationMessage(error);
+			return this.enqueueAdmission(async () => this.result("rejected", reason));
+		}
+		return this.enqueueAdmission(() => this.ingestOne(capturedEntryBytes));
 	}
 
 	retryUnavailable(): Promise<PolicyAdmissionResultV2> {
 		return this.enqueueAdmission(() => this.retryUnavailableOne());
 	}
 
-	private async ingestOne(entry: unknown): Promise<PolicyAdmissionResultV2> {
+	private async ingestOne(
+		entryBytes: Uint8Array,
+	): Promise<PolicyAdmissionResultV2> {
 		let snapshot: ValidatedPolicySnapshotV2;
 		try {
-			snapshot = await authenticatePolicySnapshotEntryV2(
-				entry,
+			snapshot = await authenticateCapturedPolicySnapshotEntryV2(
+				entryBytes,
 				this.descriptor,
 			);
 		} catch (error) {
 			return this.result("rejected", validationMessage(error));
 		}
+		if (this.lifecycleController.signal.aborted) return this.haltedResult();
 
 		if (this.fork !== undefined) {
-			this.observeAfterFork(snapshot);
+			const forkObservation = this.observeAfterFork(snapshot);
 			return this.result(
 				"halted",
 				"Policy reducer is halted by authority equivocation",
+				undefined,
+				forkObservation === undefined ? undefined : [forkObservation],
 			);
 		}
 		this.retainCanonicalHeadEntry(snapshot);
@@ -822,6 +1356,15 @@ export class TrustedNetworkV2PolicyReducer {
 			if (this.acceptedHead?.digestKey === snapshot.digestKey) {
 				return this.result("unavailable", this.unavailable.reason);
 			}
+			if (
+				this.unavailable.comparisonCandidate.digestKey === snapshot.digestKey &&
+				compare(
+					snapshot.entryBytes,
+					this.unavailable.comparisonCandidate.entryBytes,
+				) < 0
+			) {
+				this.unavailable.comparisonCandidate = copySnapshot(snapshot);
+			}
 			const existingPending = this.pending.get(snapshot.digestKey);
 			if (existingPending !== undefined) {
 				this.addPending(snapshot, existingPending.missingParentDigest);
@@ -841,6 +1384,7 @@ export class TrustedNetworkV2PolicyReducer {
 		}
 
 		const evaluation = await this.evaluate(snapshot);
+		if (this.lifecycleController.signal.aborted) return this.haltedResult();
 		if (evaluation.status === "reject") {
 			return this.result("rejected", evaluation.reason);
 		}
@@ -848,8 +1392,7 @@ export class TrustedNetworkV2PolicyReducer {
 			return this.result("duplicate");
 		}
 		if (evaluation.status === "fork") {
-			this.setFork(evaluation);
-			return this.forkedResult();
+			return this.forkedResult(this.setFork(evaluation));
 		}
 		if (evaluation.status === "unavailable") {
 			const retention = this.enterUnavailable(snapshot, evaluation);
@@ -860,7 +1403,7 @@ export class TrustedNetworkV2PolicyReducer {
 			return this.result(
 				pending.retained ? "pending" : "capacity",
 				pending.retained
-					? "Policy parent is missing"
+					? (evaluation.reason ?? "Policy parent is missing")
 					: "Policy pending capacity did not retain this candidate",
 				pending.evictedPolicyDigests,
 			);
@@ -874,6 +1417,7 @@ export class TrustedNetworkV2PolicyReducer {
 	}
 
 	private async retryUnavailableOne(): Promise<PolicyAdmissionResultV2> {
+		if (this.lifecycleController.signal.aborted) return this.haltedResult();
 		if (this.fork !== undefined) {
 			return this.result(
 				"halted",
@@ -884,7 +1428,7 @@ export class TrustedNetworkV2PolicyReducer {
 		if (unavailable === undefined) {
 			return this.result("duplicate", "Policy reducer is not unavailable");
 		}
-		const pending = this.pending.get(unavailable.candidateDigestKey);
+		const pending = this.pending.get(unavailable.comparisonCandidate.digestKey);
 		if (pending === undefined) {
 			return this.result(
 				"capacity",
@@ -893,11 +1437,12 @@ export class TrustedNetworkV2PolicyReducer {
 		}
 
 		const evaluation = await this.evaluate(pending.snapshot);
+		if (this.lifecycleController.signal.aborted) return this.haltedResult();
 		if (evaluation.status === "unavailable") {
 			pending.missingParentDigest = copyBytes(evaluation.digest);
 			this.unavailable = {
 				acceptedAncestorDigest: copyBytes(evaluation.digest),
-				candidateDigestKey: pending.snapshot.digestKey,
+				comparisonCandidate: copySnapshot(pending.snapshot),
 				reason: boundedUnavailableReason(evaluation.reason),
 			};
 			return this.result("unavailable", this.unavailable.reason);
@@ -909,12 +1454,11 @@ export class TrustedNetworkV2PolicyReducer {
 		if (evaluation.status === "missing") {
 			pending.missingParentDigest = copyBytes(evaluation.digest);
 			status = "pending";
-			reason = "Policy parent is missing";
+			reason = evaluation.reason ?? "Policy parent is missing";
 		} else {
 			this.pending.delete(pending.snapshot.digestKey);
 			if (evaluation.status === "fork") {
-				this.setFork(evaluation);
-				return this.forkedResult();
+				return this.forkedResult(this.setFork(evaluation));
 			}
 			if (evaluation.status === "accept") {
 				this.project(pending.snapshot);