@peerbit/trusted-network 6.0.107 → 6.0.109

package/dist/src/v2-policy-anchor.js

@@ -35,7 +35,7 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
 import { deserialize, field, fixedArray, serialize, variant, } from "@dao-xyz/borsh";
 import { PublicSignKey, sha256Sync } from "@peerbit/crypto";
 import { compare, concat, equals } from "uint8arrays";
-import { TrustedNetworkV2PolicyReducer, authenticatePolicySnapshotEntryV2, } from "./v2-policy-engine.js";
+import { TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES, TrustedNetworkV2PolicyReducer, authenticatePolicySnapshotEntryV2, } from "./v2-policy-engine.js";
 import { NetworkDescriptorV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS, TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES, assertNetworkDescriptorV2, } from "./v2.js";
 /**
  * Internal crash-safe policy-anchor storage format.
@@ -48,13 +48,20 @@ import { NetworkDescriptorV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_R
 export const TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER = "peerbit/trusted-network/v2/policy-anchor/v1";
 export const TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 4;
 const GENERATION_KEY_PREFIX = `${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/generation/`;
-const FORMAT_VERSION = 1;
+const ANCHOR_FORMAT_VERSION = 2;
+const REDUCER_DURABLE_FORMAT_VERSION = 1;
 const MAX_U64 = 0xffffffffffffffffn;
 const MAX_UNAVAILABLE_REASON_LENGTH = 512;
+// The core admits at most 64 pending policies. A fork transition can surface
+// that complete set plus its accepted and triggering children. Once the
+// transition is durable the wrapper stops policy admission entirely.
+const MAX_FORK_OBSERVATIONS_V2 = TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES + 2;
+const MAX_QUEUED_POLICY_ENTRY_BYTES_V2 = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 2;
 const ZERO_DIGEST = new Uint8Array(32);
 const textEncoder = new TextEncoder();
 const DESCRIPTOR_DIGEST_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/descriptor/v1");
 const GENERATION_CHECKSUM_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/generation/v1");
+const FORK_OBSERVATION_COMMITMENT_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/fork-observations/v1");
 const ANCHOR_STATE = Object.freeze({
     ACTIVE: 1,
     UNAVAILABLE: 2,
@@ -138,20 +145,32 @@ let PolicyAnchorStateGenerationPayloadV2 = (() => {
     let _coreState_decorators;
     let _coreState_initializers = [];
     let _coreState_extraInitializers = [];
+    let _forkObservationCount_decorators;
+    let _forkObservationCount_initializers = [];
+    let _forkObservationCount_extraInitializers = [];
+    let _forkObservationCommitment_decorators;
+    let _forkObservationCommitment_initializers = [];
+    let _forkObservationCommitment_extraInitializers = [];
     var PolicyAnchorStateGenerationPayloadV2 = class {
         static { _classThis = this; }
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
             _coreState_decorators = [field({ type: PolicyAnchorCoreStateRecordV2 })];
+            _forkObservationCount_decorators = [field({ type: "u8" })];
+            _forkObservationCommitment_decorators = [field({ type: fixedArray("u8", 32) })];
             __esDecorate(null, null, _coreState_decorators, { kind: "field", name: "coreState", static: false, private: false, access: { has: obj => "coreState" in obj, get: obj => obj.coreState, set: (obj, value) => { obj.coreState = value; } }, metadata: _metadata }, _coreState_initializers, _coreState_extraInitializers);
+            __esDecorate(null, null, _forkObservationCount_decorators, { kind: "field", name: "forkObservationCount", static: false, private: false, access: { has: obj => "forkObservationCount" in obj, get: obj => obj.forkObservationCount, set: (obj, value) => { obj.forkObservationCount = value; } }, metadata: _metadata }, _forkObservationCount_initializers, _forkObservationCount_extraInitializers);
+            __esDecorate(null, null, _forkObservationCommitment_decorators, { kind: "field", name: "forkObservationCommitment", static: false, private: false, access: { has: obj => "forkObservationCommitment" in obj, get: obj => obj.forkObservationCommitment, set: (obj, value) => { obj.forkObservationCommitment = value; } }, metadata: _metadata }, _forkObservationCommitment_initializers, _forkObservationCommitment_extraInitializers);
             __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
             PolicyAnchorStateGenerationPayloadV2 = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
             __runInitializers(_classThis, _classExtraInitializers);
         }
         coreState = __runInitializers(this, _coreState_initializers, void 0);
+        forkObservationCount = (__runInitializers(this, _coreState_extraInitializers), __runInitializers(this, _forkObservationCount_initializers, void 0));
+        forkObservationCommitment = (__runInitializers(this, _forkObservationCount_extraInitializers), __runInitializers(this, _forkObservationCommitment_initializers, void 0));
         constructor(properties) {
-            __runInitializers(this, _coreState_extraInitializers);
+            __runInitializers(this, _forkObservationCommitment_extraInitializers);
             if (properties)
                 Object.assign(this, properties);
         }
@@ -278,7 +297,39 @@ let PolicyAnchorGenerationRecordV2 = (() => {
     };
     return PolicyAnchorGenerationRecordV2 = _classThis;
 })();
-const copyBytes = (bytes) => Uint8Array.from(bytes);
+const TYPED_ARRAY_PROTOTYPE = Object.getPrototypeOf(Uint8Array.prototype);
+const TYPED_ARRAY_BYTE_LENGTH = Object.getOwnPropertyDescriptor(TYPED_ARRAY_PROTOTYPE, "byteLength").get;
+const TYPED_ARRAY_TAG = Object.getOwnPropertyDescriptor(TYPED_ARRAY_PROTOTYPE, Symbol.toStringTag).get;
+const ARRAY_BUFFER_IS_VIEW = ArrayBuffer.isView;
+const UINT8_ARRAY_SET = Uint8Array.prototype.set;
+const exactUint8ArrayByteLength = (input) => {
+    if (!ARRAY_BUFFER_IS_VIEW(input) ||
+        TYPED_ARRAY_TAG.call(input) !== "Uint8Array") {
+        throw new TypeError("Expected a genuine Uint8Array");
+    }
+    const byteLength = TYPED_ARRAY_BYTE_LENGTH.call(input);
+    if (byteLength === 0) {
+        UINT8_ARRAY_SET.call(new Uint8Array(0), input);
+    }
+    return byteLength;
+};
+const copyBytesWithLength = (bytes, byteLength) => {
+    const copy = new Uint8Array(byteLength);
+    UINT8_ARRAY_SET.call(copy, bytes);
+    return copy;
+};
+const copyBytes = (bytes) => {
+    const byteLength = exactUint8ArrayByteLength(bytes);
+    return copyBytesWithLength(bytes, byteLength);
+};
+const hasExactUint8ArrayByteLength = (input, expected) => {
+    try {
+        return exactUint8ArrayByteLength(input) === expected;
+    }
+    catch {
+        return false;
+    }
+};
 const bytesKey = (bytes) => {
     let key = "";
     for (const byte of bytes)
@@ -314,6 +365,32 @@ const keyId = (key) => bytesKey(serialize(key));
 const descriptorDigest = (descriptor) => sha256Sync(concat([DESCRIPTOR_DIGEST_DOMAIN, serialize(descriptor)]));
 const generationChecksum = (body) => sha256Sync(concat([GENERATION_CHECKSUM_DOMAIN, serialize(body)]));
 const observationContentHash = (entryBytes) => sha256Sync(entryBytes);
+const u32Bytes = (value) => {
+    const bytes = new Uint8Array(4);
+    new DataView(bytes.buffer).setUint32(0, value, false);
+    return bytes;
+};
+const canonicalForkObservationEntries = (entries) => [...entries]
+    .map((entryBytes) => ({
+    entryBytes: copyBytes(entryBytes),
+    hash: observationContentHash(entryBytes),
+}))
+    .sort((left, right) => {
+    const hashOrder = compare(left.hash, right.hash);
+    return hashOrder === 0
+        ? compare(left.entryBytes, right.entryBytes)
+        : hashOrder;
+})
+    .map(({ entryBytes }) => entryBytes);
+const forkObservationCommitment = (descriptorHash, canonicalEntries) => sha256Sync(concat([
+    FORK_OBSERVATION_COMMITMENT_DOMAIN,
+    descriptorHash,
+    Uint8Array.of(canonicalEntries.length),
+    ...canonicalEntries.flatMap((entryBytes) => [
+        u32Bytes(entryBytes.byteLength),
+        entryBytes,
+    ]),
+]));
 const generationKey = (generation) => `${GENERATION_KEY_PREFIX}${generation.toString().padStart(20, "0")}`;
 const assertOpenNotAborted = (signal) => {
     if (signal?.aborted) {
@@ -321,9 +398,15 @@ const assertOpenNotAborted = (signal) => {
     }
 };
 const assertEntryBytes = (bytes, label) => {
-    if (!(bytes instanceof Uint8Array) ||
-        bytes.byteLength === 0 ||
-        bytes.byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES) {
+    let byteLength;
+    try {
+        byteLength = exactUint8ArrayByteLength(bytes);
+    }
+    catch {
+        byteLength = -1;
+    }
+    if (byteLength < 1 ||
+        byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES) {
         throw new Error(`${label} must contain 1-${TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES} bytes`);
     }
 };
@@ -349,7 +432,7 @@ const retainCanonicalForkChild = (children, candidate) => {
         children.length = 2;
 };
 const assertEmptyBytes = (bytes, label) => {
-    if (!(bytes instanceof Uint8Array) || bytes.byteLength !== 0) {
+    if (!hasExactUint8ArrayByteLength(bytes, 0)) {
         throw new Error(`${label} must be empty`);
     }
 };
@@ -399,14 +482,14 @@ const durableStateFromCoreRecord = (record) => {
         assertEmptyBytes(record.forkChildEntryBytes0, "active fork child 0");
         assertEmptyBytes(record.forkChildEntryBytes1, "active fork child 1");
         return {
-            formatVersion: FORMAT_VERSION,
+            formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
             state: "ACTIVE",
             acceptedHeadEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
         };
     }
     if (record.state === ANCHOR_STATE.UNAVAILABLE) {
         assertEntryBytes(record.comparisonCandidateEntryBytes, "unavailable comparison candidate");
-        if (record.acceptedAncestorDigest.byteLength !== 32) {
+        if (!hasExactUint8ArrayByteLength(record.acceptedAncestorDigest, 32)) {
             throw new Error("Unavailable accepted-ancestor digest must be 32 bytes");
         }
         if (record.unavailableReason.length === 0 ||
@@ -416,7 +499,7 @@ const durableStateFromCoreRecord = (record) => {
         assertEmptyBytes(record.forkChildEntryBytes0, "unavailable fork child 0");
         assertEmptyBytes(record.forkChildEntryBytes1, "unavailable fork child 1");
         return {
-            formatVersion: FORMAT_VERSION,
+            formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
             state: "UNAVAILABLE",
             acceptedHeadEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
             comparisonCandidateEntryBytes: copyBytes(record.comparisonCandidateEntryBytes),
@@ -435,7 +518,7 @@ const durableStateFromCoreRecord = (record) => {
         assertEntryBytes(record.forkChildEntryBytes0, "fork child 0");
         assertEntryBytes(record.forkChildEntryBytes1, "fork child 1");
         return {
-            formatVersion: FORMAT_VERSION,
+            formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
             state: "FORKED",
             commonParentEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
             childEntryBytes: [
@@ -447,12 +530,17 @@ const durableStateFromCoreRecord = (record) => {
     throw new Error("Unknown durable policy-anchor state");
 };
 const decodeCanonicalPayload = (input, type, maxBytes, label) => {
-    if (!(input instanceof Uint8Array) ||
-        input.byteLength === 0 ||
-        input.byteLength > maxBytes) {
+    let byteLength;
+    try {
+        byteLength = exactUint8ArrayByteLength(input);
+    }
+    catch {
+        byteLength = -1;
+    }
+    if (byteLength < 1 || byteLength > maxBytes) {
         throw new Error(`${label} exceeds its byte ceiling`);
     }
-    const bytes = copyBytes(input);
+    const bytes = copyBytesWithLength(input, byteLength);
     const payload = deserialize(bytes, type);
     if (!equals(bytes, serialize(payload))) {
         throw new Error(`${label} is not canonical`);
@@ -462,10 +550,21 @@ const decodeCanonicalPayload = (input, type, maxBytes, label) => {
 const decodeGenerationPayload = (body) => {
     if (body.kind === GENERATION_KIND.STATE) {
         const payload = decodeCanonicalPayload(body.payloadBytes, PolicyAnchorStateGenerationPayloadV2, MAX_STATE_GENERATION_PAYLOAD_BYTES, "Policy-anchor state payload");
+        const durableState = durableStateFromCoreRecord(payload.coreState);
+        if (durableState.state === "FORKED") {
+            if (payload.forkObservationCount < 2 ||
+                payload.forkObservationCount > MAX_FORK_OBSERVATIONS_V2) {
+                throw new Error(`Forked policy-anchor state must commit to 2-${MAX_FORK_OBSERVATIONS_V2} observations`);
+            }
+        }
+        else if (payload.forkObservationCount !== 0 ||
+            !equals(payload.forkObservationCommitment, ZERO_DIGEST)) {
+            throw new Error("Non-forked policy-anchor state must not contain a fork commitment");
+        }
         return {
             kind: "state",
             payload,
-            durableState: durableStateFromCoreRecord(payload.coreState),
+            durableState,
         };
     }
     if (body.kind === GENERATION_KIND.FORK_OBSERVATION) {
@@ -476,17 +575,23 @@ const decodeGenerationPayload = (body) => {
     throw new Error("Unknown policy-anchor generation kind");
 };
 const decodeGenerationRecord = (input) => {
-    if (!(input instanceof Uint8Array) ||
-        input.byteLength === 0 ||
-        input.byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
+    let byteLength;
+    try {
+        byteLength = exactUint8ArrayByteLength(input);
+    }
+    catch {
+        byteLength = -1;
+    }
+    if (byteLength < 1 ||
+        byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
         throw new Error("Policy-anchor generation record exceeds its byte ceiling");
     }
-    const bytes = copyBytes(input);
+    const bytes = copyBytesWithLength(input, byteLength);
     const record = deserialize(bytes, PolicyAnchorGenerationRecordV2);
     if (!equals(bytes, serialize(record))) {
         throw new Error("Policy-anchor generation record is not canonical");
     }
-    if (record.body.formatVersion !== FORMAT_VERSION) {
+    if (record.body.formatVersion !== ANCHOR_FORMAT_VERSION) {
         throw new Error("Unsupported policy-anchor generation format");
     }
     if (!equals(record.checksum, generationChecksum(record.body))) {
@@ -537,9 +642,10 @@ export class TrustedNetworkV2DurablePolicyReducer {
     generation = 0n;
     previousGenerationChecksum = copyBytes(ZERO_DIGEST);
     durableCoreBytes;
-    observedHashes = new Set();
     operationTail = Promise.resolve();
     authorizationFences = 0;
+    bufferedAdmissions = 0;
+    bufferedAdmissionEntryBytes = 0;
     terminalError;
     constructor(properties) {
         this.store = properties.store;
@@ -554,7 +660,6 @@ export class TrustedNetworkV2DurablePolicyReducer {
             properties.durableCoreBytes === undefined
                 ? undefined
                 : copyBytes(properties.durableCoreBytes);
-        this.observedHashes = new Set(properties.observedHashes);
     }
     static async open(options) {
         assertNetworkDescriptorV2(options.descriptor);
@@ -591,10 +696,15 @@ export class TrustedNetworkV2DurablePolicyReducer {
                 if (!/^\d{20}$/.test(suffix)) {
                     throw new Error("Malformed policy-anchor generation key");
                 }
-                if (!(input instanceof Uint8Array) ||
-                    input.byteLength === 0 ||
-                    input.byteLength >
-                        TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
+                let byteLength;
+                try {
+                    byteLength = exactUint8ArrayByteLength(input);
+                }
+                catch {
+                    byteLength = -1;
+                }
+                if (byteLength < 1 ||
+                    byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
                     throw new Error("Policy-anchor generation record exceeds its byte ceiling");
                 }
                 const generation = BigInt(suffix);
@@ -617,8 +727,9 @@ export class TrustedNetworkV2DurablePolicyReducer {
         let core;
         let durableCoreBytes;
         let forkEvidence;
-        const observedHashes = new Set();
-        const authenticatedEvidenceEntryByHash = new Map();
+        let expectedForkObservationCount;
+        let expectedForkObservationCommitment;
+        const observedEntries = new Map();
         const canonicalChildren = [];
         try {
             for (let index = 0; index < generationKeys.length; index++) {
@@ -652,6 +763,8 @@ export class TrustedNetworkV2DurablePolicyReducer {
                     latestCoreBytes = serialize(payload.payload.coreState);
                     latestDurableState = payload.durableState;
                     if (latestDurableState.state === "FORKED") {
+                        expectedForkObservationCount = payload.payload.forkObservationCount;
+                        expectedForkObservationCommitment = copyBytes(payload.payload.forkObservationCommitment);
                         core = await TrustedNetworkV2PolicyReducer.restore({
                             ...coreProperties,
                             durableState: latestDurableState,
@@ -665,13 +778,10 @@ export class TrustedNetworkV2DurablePolicyReducer {
                         }
                         for (const child of forkEvidence.children) {
                             const hashKey = bytesKey(observationContentHash(child.entryBytes));
-                            const retained = authenticatedEvidenceEntryByHash.get(hashKey);
-                            if (retained !== undefined &&
-                                !equals(retained, child.entryBytes)) {
-                                throw new Error("Policy fork-observation content hash collision");
+                            if (observedEntries.has(hashKey)) {
+                                throw new Error("Duplicate policy fork observation in durable state");
                             }
-                            authenticatedEvidenceEntryByHash.set(hashKey, child.entryBytes);
-                            observedHashes.add(hashKey);
+                            observedEntries.set(hashKey, copyBytes(child.entryBytes));
                             retainCanonicalForkChild(canonicalChildren, child);
                         }
                     }
@@ -684,27 +794,24 @@ export class TrustedNetworkV2DurablePolicyReducer {
                     }
                     const entryBytes = payload.payload.entryBytes;
                     const hashKey = bytesKey(observationContentHash(entryBytes));
-                    if (observedHashes.has(hashKey)) {
-                        const evidenceEntry = authenticatedEvidenceEntryByHash.get(hashKey);
-                        if (evidenceEntry !== undefined &&
-                            !equals(evidenceEntry, entryBytes)) {
-                            throw new Error("Policy fork-observation content hash collision");
-                        }
+                    if (observedEntries.has(hashKey)) {
+                        throw new Error("Duplicate policy fork-observation generation");
                     }
-                    else {
-                        const authenticated = await authenticatePolicySnapshotEntryV2(entryBytes, descriptor);
-                        assertOpenNotAborted(signal);
-                        if (authenticated.body.sequence !==
-                            forkEvidence.commonParent.sequence + 1n ||
-                            !equals(authenticated.body.previousPolicyDigest, forkEvidence.commonParent.digest)) {
-                            throw new Error("Stored policy fork observation is not a direct child of the common parent");
-                        }
-                        observedHashes.add(hashKey);
-                        retainCanonicalForkChild(canonicalChildren, {
-                            digest: authenticated.digest,
-                            entryBytes,
-                        });
+                    if (observedEntries.size >= MAX_FORK_OBSERVATIONS_V2) {
+                        throw new Error(`Policy fork evidence exceeds ${MAX_FORK_OBSERVATIONS_V2} children`);
                     }
+                    const authenticated = await authenticatePolicySnapshotEntryV2(entryBytes, descriptor);
+                    assertOpenNotAborted(signal);
+                    if (authenticated.body.sequence !==
+                        forkEvidence.commonParent.sequence + 1n ||
+                        !equals(authenticated.body.previousPolicyDigest, forkEvidence.commonParent.digest)) {
+                        throw new Error("Stored policy fork observation is not a direct child of the common parent");
+                    }
+                    observedEntries.set(hashKey, copyBytes(entryBytes));
+                    retainCanonicalForkChild(canonicalChildren, {
+                        digest: authenticated.digest,
+                        entryBytes,
+                    });
                 }
                 previousChecksum = copyBytes(record.checksum);
             }
@@ -727,14 +834,23 @@ export class TrustedNetworkV2DurablePolicyReducer {
                 }
             }
             if (latestDurableState?.state === "FORKED") {
-                if (forkEvidence === undefined) {
+                if (forkEvidence === undefined ||
+                    expectedForkObservationCount === undefined ||
+                    expectedForkObservationCommitment === undefined) {
                     throw new Error("Restored forked policy anchor has no fork evidence");
                 }
+                if (observedEntries.size !== expectedForkObservationCount) {
+                    throw new Error(`Policy fork evidence is incomplete: expected ${expectedForkObservationCount}, restored ${observedEntries.size}`);
+                }
+                const restoredCommitment = forkObservationCommitment(expectedDescriptorHash, canonicalForkObservationEntries(observedEntries.values()));
+                if (!equals(restoredCommitment, expectedForkObservationCommitment)) {
+                    throw new Error("Policy fork evidence commitment mismatch");
+                }
                 if (canonicalChildren.length !== 2) {
                     throw new Error("Stored policy fork evidence has fewer than two distinct children");
                 }
                 const normalizedForkState = {
-                    formatVersion: FORMAT_VERSION,
+                    formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
                     state: "FORKED",
                     commonParentEntryBytes: copyBytes(latestDurableState.commonParentEntryBytes),
                     childEntryBytes: [
@@ -756,7 +872,7 @@ export class TrustedNetworkV2DurablePolicyReducer {
                 latestDurableState = normalizedForkState;
                 durableCoreBytes = serialize(coreRecordFromState(normalizedForkState));
             }
-            else if (observedHashes.size !== 0) {
+            else if (observedEntries.size !== 0) {
                 throw new Error("Non-forked policy anchor has fork observations");
             }
             return new TrustedNetworkV2DurablePolicyReducer({
@@ -767,7 +883,6 @@ export class TrustedNetworkV2DurablePolicyReducer {
                 generation: highestGeneration,
                 previousGenerationChecksum: previousChecksum,
                 durableCoreBytes,
-                observedHashes,
             });
         }
         catch (error) {
@@ -776,9 +891,13 @@ export class TrustedNetworkV2DurablePolicyReducer {
         }
     }
     get state() {
-        if (this.terminalError !== undefined || this.core.state === "HALTED") {
+        if (this.terminalError !== undefined) {
             return "HALTED";
         }
+        if (this.published.state === "FORKED")
+            return "FORKED";
+        if (this.core.state === "HALTED")
+            return "HALTED";
         return this.published.state;
     }
     get head() {
@@ -796,6 +915,14 @@ export class TrustedNetworkV2DurablePolicyReducer {
     get pendingDigests() {
         return this.core.pendingDigests.map(copyBytes);
     }
+    /** Internal diagnostics for the fixed pre-publication admission bound. */
+    get bufferedAdmissionCount() {
+        return this.bufferedAdmissions;
+    }
+    /** Internal diagnostics for copied entry bytes awaiting settlement. */
+    get bufferedAdmissionBytes() {
+        return this.bufferedAdmissionEntryBytes;
+    }
     /** Projection query only; use isAuthorized() for the fail-closed gate. */
     rolesFor(subject) {
         return this.published.roles.get(keyId(subject)) ?? 0;
@@ -814,24 +941,109 @@ export class TrustedNetworkV2DurablePolicyReducer {
         this.core.abort();
     }
     ingest(entryBytes) {
-        const captured = entryBytes instanceof Uint8Array &&
-            entryBytes.byteLength <= TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES
-            ? copyBytes(entryBytes)
-            : entryBytes;
+        if (this.terminalError !== undefined) {
+            return Promise.reject(this.terminalError);
+        }
+        if (this.published.state === "FORKED") {
+            return Promise.resolve(this.forkFailStopResult());
+        }
+        if (this.core.state === "HALTED") {
+            return Promise.resolve(this.lifecycleHaltedResult());
+        }
+        let reservedEntryBytes;
+        try {
+            reservedEntryBytes = exactUint8ArrayByteLength(entryBytes);
+        }
+        catch {
+            return Promise.resolve(this.immediateAdmissionResult("rejected", "Policy snapshot entry must be a Uint8Array"));
+        }
+        if (reservedEntryBytes > TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES) {
+            return Promise.resolve(this.immediateAdmissionResult("rejected", `Policy snapshot entry exceeds ${TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES} bytes`));
+        }
+        if (!this.reserveAdmission(reservedEntryBytes)) {
+            return Promise.resolve(this.immediateAdmissionResult("capacity", "Durable policy admission queue is at its fixed capacity", this.core.pendingCount, this.core.pendingBytes));
+        }
+        let captured;
+        try {
+            captured = copyBytesWithLength(entryBytes, reservedEntryBytes);
+        }
+        catch (error) {
+            this.releaseAdmission(reservedEntryBytes);
+            return Promise.reject(error);
+        }
         return this.enqueue(async () => {
+            if (this.published.state === "FORKED") {
+                return this.forkFailStopResult();
+            }
+            if (this.core.state === "HALTED") {
+                return this.lifecycleHaltedResult();
+            }
             const result = await this.core.ingest(captured);
             await this.persistCorePublication(result);
             return result;
-        });
+        }, reservedEntryBytes);
     }
     retryUnavailable() {
+        if (this.terminalError !== undefined) {
+            return Promise.reject(this.terminalError);
+        }
+        if (this.published.state === "FORKED") {
+            return Promise.resolve(this.forkFailStopResult());
+        }
+        if (this.core.state === "HALTED") {
+            return Promise.resolve(this.lifecycleHaltedResult());
+        }
+        if (!this.reserveAdmission(0)) {
+            return Promise.resolve(this.immediateAdmissionResult("capacity", "Durable policy admission queue is at its fixed capacity", this.core.pendingCount, this.core.pendingBytes));
+        }
         return this.enqueue(async () => {
+            if (this.published.state === "FORKED") {
+                return this.forkFailStopResult();
+            }
+            if (this.core.state === "HALTED") {
+                return this.lifecycleHaltedResult();
+            }
             const result = await this.core.retryUnavailable();
             await this.persistCorePublication(result);
             return result;
-        });
+        }, 0);
+    }
+    forkFailStopResult() {
+        return {
+            status: "halted",
+            reason: "Policy reducer is halted by authority equivocation",
+            fetchHints: [],
+            pendingCount: 0,
+            pendingBytes: 0,
+        };
+    }
+    lifecycleHaltedResult() {
+        return {
+            status: "halted",
+            reason: "Policy reducer lifecycle is aborted",
+            fetchHints: [],
+            pendingCount: this.core.pendingCount,
+            pendingBytes: this.core.pendingBytes,
+        };
+    }
+    immediateAdmissionResult(status, reason, pendingCount = 0, pendingBytes = 0) {
+        return { status, reason, fetchHints: [], pendingCount, pendingBytes };
+    }
+    reserveAdmission(entryBytes) {
+        if (this.bufferedAdmissions >= TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES ||
+            entryBytes >
+                MAX_QUEUED_POLICY_ENTRY_BYTES_V2 - this.bufferedAdmissionEntryBytes) {
+            return false;
+        }
+        this.bufferedAdmissions += 1;
+        this.bufferedAdmissionEntryBytes += entryBytes;
+        return true;
     }
-    enqueue(operation) {
+    releaseAdmission(entryBytes) {
+        this.bufferedAdmissions -= 1;
+        this.bufferedAdmissionEntryBytes -= entryBytes;
+    }
+    enqueue(operation, bufferedEntryBytes) {
         this.authorizationFences++;
         const result = this.operationTail.then(async () => {
             if (this.terminalError !== undefined)
@@ -846,6 +1058,7 @@ export class TrustedNetworkV2DurablePolicyReducer {
         this.operationTail = result.then(() => { }, () => { });
         return result.finally(() => {
             this.authorizationFences--;
+            this.releaseAdmission(bufferedEntryBytes);
         });
     }
     halt(error) {
@@ -868,12 +1081,8 @@ export class TrustedNetworkV2DurablePolicyReducer {
         }
         const coreRecord = coreRecordFromState(durableState);
         const coreBytes = serialize(coreRecord);
-        // FORKED is terminal. Once its common-parent anchor exists, later child
-        // proofs are observation deltas even when they change the live canonical
-        // pair; reopen derives that pair from the complete delta history.
-        const stateChanged = !(this.published.state === "FORKED" && durableState.state === "FORKED") &&
-            (this.durableCoreBytes === undefined ||
-                !equals(this.durableCoreBytes, coreBytes));
+        const stateChanged = this.durableCoreBytes === undefined ||
+            !equals(this.durableCoreBytes, coreBytes);
         const suppliedObservations = new Map();
         for (const proof of result.forkObservations ?? []) {
             const contentHash = observationContentHash(proof.entryBytes);
@@ -884,28 +1093,32 @@ export class TrustedNetworkV2DurablePolicyReducer {
             }
             suppliedObservations.set(hashKey, copyBytes(proof.entryBytes));
         }
+        let committedForkObservationCount = 0;
+        let committedForkObservationDigest = copyBytes(ZERO_DIGEST);
         if (durableState.state !== "FORKED") {
-            if (suppliedObservations.size !== 0 || this.observedHashes.size !== 0) {
+            if (suppliedObservations.size !== 0) {
                 throw this.halt("Only a forked policy anchor may contain observations");
             }
         }
         else {
+            if (this.published.state === "FORKED" || !stateChanged) {
+                throw this.halt("A durable fork transition may be published only once");
+            }
+            if (suppliedObservations.size < 2 ||
+                suppliedObservations.size > MAX_FORK_OBSERVATIONS_V2) {
+                throw this.halt(`A durable fork transition must contain 2-${MAX_FORK_OBSERVATIONS_V2} distinct observations`);
+            }
+            const completeObservationEntries = canonicalForkObservationEntries(suppliedObservations.values());
+            committedForkObservationCount = completeObservationEntries.length;
+            committedForkObservationDigest = forkObservationCommitment(this.descriptorHash, completeObservationEntries);
             for (const entryBytes of durableState.childEntryBytes) {
                 const hashKey = bytesKey(observationContentHash(entryBytes));
-                if (stateChanged)
-                    suppliedObservations.delete(hashKey);
-                else if (!this.observedHashes.has(hashKey) &&
-                    !suppliedObservations.has(hashKey)) {
+                if (!suppliedObservations.delete(hashKey)) {
                     throw this.halt("Published fork state is missing a canonical observation");
                 }
             }
         }
-        for (const hashKey of this.observedHashes) {
-            suppliedObservations.delete(hashKey);
-        }
-        const observationEntries = [...suppliedObservations.entries()]
-            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
-            .map(([hashKey, entryBytes]) => ({ hashKey, entryBytes }));
+        const observationEntries = canonicalForkObservationEntries(suppliedObservations.values());
         const recordCount = (stateChanged ? 1 : 0) + observationEntries.length;
         if (recordCount === 0)
             return;
@@ -914,16 +1127,19 @@ export class TrustedNetworkV2DurablePolicyReducer {
         }
         let nextGeneration = this.generation;
         let previousChecksum = copyBytes(this.previousGenerationChecksum);
-        const stagedObservedHashes = new Set(this.observedHashes);
         const drafts = [];
         if (stateChanged) {
-            const payloadBytes = serialize(new PolicyAnchorStateGenerationPayloadV2({ coreState: coreRecord }));
+            const payloadBytes = serialize(new PolicyAnchorStateGenerationPayloadV2({
+                coreState: coreRecord,
+                forkObservationCount: committedForkObservationCount,
+                forkObservationCommitment: committedForkObservationDigest,
+            }));
             if (payloadBytes.byteLength > MAX_STATE_GENERATION_PAYLOAD_BYTES) {
                 throw this.halt("Policy-anchor state payload exceeds its byte ceiling");
             }
             drafts.push({ kind: GENERATION_KIND.STATE, payloadBytes });
         }
-        for (const { hashKey, entryBytes } of observationEntries) {
+        for (const entryBytes of observationEntries) {
             const payloadBytes = serialize(new PolicyAnchorObservationGenerationPayloadV2({
                 entryBytes: copyBytes(entryBytes),
             }));
@@ -933,23 +1149,12 @@ export class TrustedNetworkV2DurablePolicyReducer {
             drafts.push({
                 kind: GENERATION_KIND.FORK_OBSERVATION,
                 payloadBytes,
-                applyObservationHash: hashKey,
             });
         }
         for (const draft of drafts) {
             nextGeneration += 1n;
-            if (draft.kind === GENERATION_KIND.STATE) {
-                if (durableState.state === "FORKED") {
-                    for (const entryBytes of durableState.childEntryBytes) {
-                        stagedObservedHashes.add(bytesKey(observationContentHash(entryBytes)));
-                    }
-                }
-            }
-            else {
-                stagedObservedHashes.add(draft.applyObservationHash);
-            }
             const body = new PolicyAnchorGenerationBodyV2({
-                formatVersion: FORMAT_VERSION,
+                formatVersion: ANCHOR_FORMAT_VERSION,
                 generation: nextGeneration,
                 descriptorDigest: copyBytes(this.descriptorHash),
                 previousGenerationChecksum: copyBytes(previousChecksum),
@@ -978,7 +1183,6 @@ export class TrustedNetworkV2DurablePolicyReducer {
         this.generation = nextGeneration;
         this.previousGenerationChecksum = previousChecksum;
         this.durableCoreBytes = copyBytes(coreBytes);
-        this.observedHashes = stagedObservedHashes;
         try {
             this.published = publishedFromReducer(this.core);
         }