@peerbit/trusted-network 6.0.128 → 6.0.129

package/src/v2-policy-anchor.ts

@@ -16,11 +16,14 @@ import type {
 	PolicyHeadProjectionV2,
 	PolicyReducerDurableStateV2,
 	PolicySnapshotResolverV2,
+	PreparedExactPolicyCandidateV2,
 } from "./v2-policy-engine.js";
 import {
 	TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES,
 	TrustedNetworkV2PolicyReducer,
 	authenticatePolicySnapshotEntryV2,
+	captureCanonicalPolicyEntryCidV2,
+	observeAbortSignalV2,
 } from "./v2-policy-engine.js";
 import {
 	NetworkDescriptorV2,
@@ -59,6 +62,9 @@ export const TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES =
 const MAX_QUEUED_POLICY_INPUT_BYTES_V2 =
 	TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 2;
 const MAX_TIMER_DELAY_MS_V2 = 0x7fffffff;
+const DEFAULT_EXACT_POLICY_HEAD_TIMEOUT_MS_V2 = 10 * 1000;
+const DEFAULT_EXACT_POLICY_HEAD_MAX_ANCESTRY_STEPS_V2 =
+	TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES;
 const ZERO_DIGEST = new Uint8Array(32);
 const textEncoder = new TextEncoder();
 const CHECKPOINT_SCOPE_DOMAIN = textEncoder.encode(
@@ -84,11 +90,18 @@ const isAbortSignalV2 = (value: unknown): value is AbortSignal => {
 	}
 };
 
+const boundedDependencyReasonV2 = (error: unknown): string =>
+	(error instanceof Error ? error.message : String(error)).slice(
+		0,
+		MAX_UNAVAILABLE_REASON_LENGTH,
+	);
+
 export type CrashSafePolicyAnchorStoreV2 = CrashSafeAtomicReplaceStore;
 
 type DurableReducerOptionsV2 = {
 	descriptor: NetworkDescriptorV2;
 	resolvePolicyEntry: PolicySnapshotResolverV2;
+	resolvePolicyEntryByCid?: PolicyEntryCidResolverV2;
 	resolveTimeoutMs?: number;
 	signal?: AbortSignal;
 	maxPending?: number;
@@ -100,6 +113,25 @@ export type TrustedNetworkV2DurablePolicyReducerOptions =
 		store: CrashSafePolicyAnchorStoreV2;
 	};
 
+export type PolicyEntryCidResolverV2 = (
+	policyEntryCid: string,
+	options: { signal: AbortSignal },
+) => Uint8Array | undefined | Promise<Uint8Array | undefined>;
+
+export type ExactPolicyHeadRequirementV2 = {
+	policyEntryCid: string;
+	maxAncestrySteps?: number;
+	/** Queue-inclusive relative deadline; callers may only shorten the 10s cap. */
+	timeoutMs?: number;
+	deadline?: number;
+	signal?: AbortSignal;
+};
+
+export type ExactPolicyHeadLeaseV2 = {
+	policyEntryCid: string;
+	policy: PolicyHeadProjectionV2;
+};
+
 export type PolicyLeaseReferenceV2 = {
 	sequence: bigint;
 	digest: Uint8Array;
@@ -127,6 +159,15 @@ export type PolicyLeaseResultV2<T> =
 			reason: string;
 	  };
 
+type PolicyLeaseFailureV2 = Exclude<
+	PolicyLeaseResultV2<never>,
+	{ status: "completed" }
+>;
+
+type PolicyLeaseAcquisitionV2<T> =
+	| { status: "resolved"; lease: T }
+	| PolicyLeaseFailureV2;
+
 /**
  * One self-contained application snapshot. The enclosing generic checkpoint
  * supplies generation, scope, predecessor, and checksum authentication.
@@ -740,6 +781,11 @@ export class TrustedNetworkV2DurablePolicyReducer {
 	private checkpoint?: CrashSafeTwoSlotCheckpoint;
 	private core: TrustedNetworkV2PolicyReducer;
 	private published: PublishedProjectionV2;
+	private readonly descriptor: NetworkDescriptorV2;
+	private readonly resolvePolicyEntryByCid?: PolicyEntryCidResolverV2;
+	private readonly leaseLifecycleController: AbortController;
+	private readonly disposeLifecycleObservation: () => void;
+	private exactAuthenticationInFlight?: Promise<PreparedExactPolicyCandidateV2>;
 	private durableCoreIdentityBytes?: Uint8Array;
 	private operationTail: Promise<void> = Promise.resolve();
 	private authorizationFences = 0;
@@ -750,11 +796,18 @@ export class TrustedNetworkV2DurablePolicyReducer {
 	private constructor(properties: {
 		checkpoint?: CrashSafeTwoSlotCheckpoint;
 		core: TrustedNetworkV2PolicyReducer;
+		descriptor: NetworkDescriptorV2;
+		resolvePolicyEntryByCid?: PolicyEntryCidResolverV2;
+		lifecycle: ReturnType<typeof observeAbortSignalV2>;
 		durableCoreIdentityBytes?: Uint8Array;
 	}) {
 		this.checkpoint = properties.checkpoint;
 		this.core = properties.core;
 		this.published = publishedFromReducer(this.core);
+		this.descriptor = properties.descriptor;
+		this.resolvePolicyEntryByCid = properties.resolvePolicyEntryByCid;
+		this.leaseLifecycleController = properties.lifecycle[0];
+		this.disposeLifecycleObservation = properties.lifecycle[1];
 		this.durableCoreIdentityBytes =
 			properties.durableCoreIdentityBytes === undefined
 				? undefined
@@ -765,11 +818,18 @@ export class TrustedNetworkV2DurablePolicyReducer {
 		options: TrustedNetworkV2DurablePolicyReducerOptions,
 	): Promise<TrustedNetworkV2DurablePolicyReducer> {
 		assertNetworkDescriptorV2(options.descriptor);
+		if (
+			options.resolvePolicyEntryByCid !== undefined &&
+			typeof options.resolvePolicyEntryByCid !== "function"
+		) {
+			throw new TypeError("Policy CID resolver must be a function");
+		}
 		const descriptor = deserialize(
 			serialize(options.descriptor),
 			NetworkDescriptorV2,
 		);
-		const signal = options.signal;
+		const lifecycle = observeAbortSignalV2(options.signal);
+		const signal = lifecycle[0].signal;
 		const store = options.store;
 		const coreProperties: DurableReducerOptionsV2 = {
 			descriptor,
@@ -779,39 +839,41 @@ export class TrustedNetworkV2DurablePolicyReducer {
 			maxPending: options.maxPending,
 			maxPendingPolicyBytes: options.maxPendingPolicyBytes,
 		};
-		assertOpenNotAborted(signal);
-		const checkpoint = await CrashSafeTwoSlotCheckpoint.open({
-			store,
-			scope: checkpointScope(descriptor),
-			maxPayloadBytes:
-				TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES,
-		});
-		assertOpenNotAborted(signal);
-
-		// Never let the old append-only format look like an empty or newer
-		// checkpoint. It was internal and never activated, so migration or fallback
-		// would add rollback surface without preserving a public compatibility need.
-		for await (const [key] of store.iterator()) {
-			assertOpenNotAborted(signal);
-			if (
-				key === TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER ||
-				key.startsWith(`${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/`)
-			) {
-				throw new Error(
-					"Legacy append-only policy-anchor records are not supported; reset the dedicated store",
-				);
-			}
-		}
-		assertOpenNotAborted(signal);
-
-		const current = checkpoint.current;
 		let core: TrustedNetworkV2PolicyReducer | undefined;
 		try {
+			assertOpenNotAborted(signal);
+			const checkpoint = await CrashSafeTwoSlotCheckpoint.open({
+				store,
+				scope: checkpointScope(descriptor),
+				maxPayloadBytes:
+					TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES,
+			});
+			assertOpenNotAborted(signal);
+
+			// Never let the old append-only format look like an empty or newer
+			// checkpoint. It was internal and never activated, so migration or fallback
+			// would add rollback surface without preserving a public compatibility need.
+			for await (const [key] of store.iterator()) {
+				assertOpenNotAborted(signal);
+				if (
+					key === TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER ||
+					key.startsWith(`${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/`)
+				) {
+					throw new Error(
+						"Legacy append-only policy-anchor records are not supported; reset the dedicated store",
+					);
+				}
+			}
+			assertOpenNotAborted(signal);
+			const current = checkpoint.current;
 			if (current === undefined) {
 				core = new TrustedNetworkV2PolicyReducer(coreProperties);
 				return new TrustedNetworkV2DurablePolicyReducer({
 					checkpoint,
 					core,
+					descriptor,
+					resolvePolicyEntryByCid: options.resolvePolicyEntryByCid,
+					lifecycle,
 				});
 			}
 
@@ -834,10 +896,14 @@ export class TrustedNetworkV2DurablePolicyReducer {
 				// storage, so release that potentially 8.78 MiB snapshot immediately.
 				checkpoint: forked ? undefined : checkpoint,
 				core,
+				descriptor,
+				resolvePolicyEntryByCid: options.resolvePolicyEntryByCid,
+				lifecycle,
 				durableCoreIdentityBytes: decoded.coreIdentityBytes,
 			});
 		} catch (error) {
 			core?.abort();
+			lifecycle[1]();
 			throw error;
 		}
 	}
@@ -916,6 +982,7 @@ export class TrustedNetworkV2DurablePolicyReducer {
 
 	abort(): void {
 		this.core.abort();
+		this.disposeLifecycleObservation();
 	}
 
 	ingest(entryBytes: Uint8Array): Promise<PolicyAdmissionResultV2> {
@@ -1110,38 +1177,242 @@ export class TrustedNetworkV2DurablePolicyReducer {
 			});
 		}
 
-		const retainedReferenceBytes = 32;
-		if (!this.reserveOperation(retainedReferenceBytes)) {
+		let digest: Uint8Array;
+		try {
+			digest = copyBytes(suppliedDigest);
+		} catch {
+			return Promise.resolve({
+				status: "rejected",
+				reason: "Policy reference digest must contain exactly 32 bytes",
+			});
+		}
+
+		return this.withSerializedPolicyLease(
+			32,
+			deadline,
+			signal,
+			async (leaseSignal) => {
+				const resolution = await this.core.resolveAcceptedPolicyPrefix(
+					{ sequence, digest },
+					{ maxSteps, deadline, signal: leaseSignal },
+				);
+				return resolution.status === "resolved"
+					? {
+							status: "resolved",
+							lease: {
+								policy: resolution.policy,
+								acceptedHead: resolution.acceptedHead,
+							},
+						}
+					: resolution;
+			},
+			use,
+		);
+	}
+
+	/**
+	 * Run one callback while a CID-addressed policy wrapper is authenticated and
+	 * its policy-body identity is the stable durable current head.
+	 *
+	 * Exact fetch, prepared admission, crash-safe publication, and callback share
+	 * one bounded budget and serialized queue slot. No digest-resolver fallback is
+	 * allowed when the CID resolver is absent or unavailable.
+	 */
+	withExactPolicyHead<T>(
+		requirement: ExactPolicyHeadRequirementV2,
+		use: (lease: ExactPolicyHeadLeaseV2) => T | Promise<T>,
+	): Promise<PolicyLeaseResultV2<T>> {
+		const halted = this.immediateLeaseHaltedResult();
+		if (halted !== undefined) return Promise.resolve(halted);
+
+		let policyEntryCid: string;
+		let maxAncestrySteps: number;
+		let deadline: number;
+		let signal: AbortSignal | undefined;
+		try {
+			policyEntryCid = captureCanonicalPolicyEntryCidV2(
+				requirement.policyEntryCid,
+			);
+			maxAncestrySteps =
+				requirement.maxAncestrySteps ??
+				DEFAULT_EXACT_POLICY_HEAD_MAX_ANCESTRY_STEPS_V2;
+			if (
+				!Number.isSafeInteger(maxAncestrySteps) ||
+				maxAncestrySteps < 0 ||
+				maxAncestrySteps > TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES
+			) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: `Exact policy maxAncestrySteps must be between 0 and ${TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES}`,
+				});
+			}
+			const suppliedDeadline = requirement.deadline;
+			if (
+				suppliedDeadline !== undefined &&
+				(!Number.isSafeInteger(suppliedDeadline) || suppliedDeadline < 0)
+			) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Exact policy deadline must be a non-negative safe integer",
+				});
+			}
+			const timeoutMs =
+				requirement.timeoutMs ?? DEFAULT_EXACT_POLICY_HEAD_TIMEOUT_MS_V2;
+			if (
+				!Number.isSafeInteger(timeoutMs) ||
+				timeoutMs < 0 ||
+				timeoutMs > DEFAULT_EXACT_POLICY_HEAD_TIMEOUT_MS_V2
+			) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: `Exact policy timeoutMs must be between 0 and ${DEFAULT_EXACT_POLICY_HEAD_TIMEOUT_MS_V2}`,
+				});
+			}
+			const relativeDeadline = Math.min(
+				Number.MAX_SAFE_INTEGER,
+				Date.now() + timeoutMs,
+			);
+			deadline =
+				suppliedDeadline === undefined
+					? relativeDeadline
+					: Math.min(suppliedDeadline, relativeDeadline);
+			signal = requirement.signal;
+			if (signal !== undefined && !isAbortSignalV2(signal)) {
+				return Promise.resolve({
+					status: "rejected",
+					reason: "Exact policy signal must be an AbortSignal",
+				});
+			}
+		} catch {
+			return Promise.resolve({
+				status: "rejected",
+				reason: "Exact policy-head requirement is invalid",
+			});
+		}
+		if (typeof use !== "function") {
+			return Promise.resolve({
+				status: "rejected",
+				reason: "Exact policy-head callback must be a function",
+			});
+		}
+
+		return this.withSerializedPolicyLease(
+			textEncoder.encode(policyEntryCid).byteLength,
+			deadline,
+			signal,
+			async (leaseSignal, mutationCompleted) => {
+				const exact = await this.resolveExactPolicyEntry(
+					policyEntryCid,
+					deadline,
+					leaseSignal,
+				);
+				if (exact.status !== "resolved") return exact;
+				this.authorizationFences += 1;
+				try {
+					const admission = await this.core.ingestPreparedExactPolicy(
+						exact.lease,
+						{
+							maxParentEdges: maxAncestrySteps,
+							deadline,
+							signal: leaseSignal,
+						},
+					);
+					// Core admission may now be mutated. From here through checkpoint
+					// settlement, cancellation may settle outward but cannot release the slot.
+					mutationCompleted();
+					await this.persistCorePublication(admission);
+					const halted = this.immediateLeaseHaltedResult();
+					if (halted !== undefined) return halted;
+					if (
+						admission.status !== "accepted" &&
+						admission.status !== "duplicate"
+					) {
+						return {
+							status:
+								admission.status === "rejected" ||
+								admission.status === "capacity"
+									? admission.status
+									: "unavailable",
+							reason:
+								admission.reason ?? "Exact policy admission is unavailable",
+						};
+					}
+					const head = this.published.head;
+					if (
+						this.published.state !== "ACTIVE" ||
+						head === undefined ||
+						head.sequence !== exact.lease.policy.sequence ||
+						!equals(head.digest, exact.lease.policy.digest)
+					) {
+						return {
+							status: "unavailable",
+							reason:
+								"Exact policy entry is not the durable current policy head",
+						};
+					}
+					return {
+						status: "resolved",
+						lease: { policyEntryCid, policy: copyHead(head)! },
+					};
+				} catch (error) {
+					throw this.halt(error);
+				} finally {
+					this.authorizationFences -= 1;
+				}
+			},
+			use,
+		);
+	}
+
+	private withSerializedPolicyLease<T, Lease>(
+		retainedInputBytes: number,
+		deadline: number | undefined,
+		signal: AbortSignal | undefined,
+		acquire: (
+			signal: AbortSignal,
+			mutationCompleted: () => void,
+		) => Promise<PolicyLeaseAcquisitionV2<Lease>>,
+		use: (lease: Lease) => T | Promise<T>,
+	): Promise<PolicyLeaseResultV2<T>> {
+		if (!this.reserveOperation(retainedInputBytes)) {
 			return Promise.resolve({
 				status: "capacity",
 				reason: "Durable policy operation queue is at its fixed capacity",
 			});
 		}
-		let digest: Uint8Array;
+		let observedSignal: ReturnType<typeof observeAbortSignalV2>;
 		try {
-			digest = copyBytes(suppliedDigest);
+			observedSignal = observeAbortSignalV2(signal);
 		} catch {
-			this.releaseOperation(retainedReferenceBytes);
+			this.releaseOperation(retainedInputBytes);
 			return Promise.resolve({
 				status: "rejected",
-				reason: "Policy reference digest must contain exactly 32 bytes",
+				reason: "Policy lease signal could not be observed",
 			});
 		}
 
 		let queueAcquired = false;
 		let callbackAcquired = false;
+		let mutationCompleted = false;
+		const acquisitionController = observedSignal[0];
+		const interruptionSignal = AbortSignal.any([
+			acquisitionController.signal,
+			this.leaseLifecycleController.signal,
+		]);
 		let preAcquisitionResult: PolicyLeaseResultV2<T> | undefined;
 		let resolveEarly!: (result: PolicyLeaseResultV2<T>) => void;
 		const earlyResult = new Promise<PolicyLeaseResultV2<T>>((resolve) => {
 			resolveEarly = resolve;
 		});
 		let deadlineTimer: ReturnType<typeof setTimeout> | undefined;
-		let signalListenerInstalled = false;
 
-		const abortBeforeAcquisition = (): void => {
+		const interruptBeforeAcquisition = (): void => {
+			const halted = this.leaseLifecycleController.signal.aborted;
 			settleBeforeAcquisition({
-				status: "unavailable",
-				reason: "Policy lease acquisition was aborted by the caller",
+				status: halted ? "halted" : "unavailable",
+				reason: halted
+					? "Policy reducer lifecycle is aborted"
+					: "Policy lease acquisition was aborted by the caller",
 			});
 		};
 		const cleanupWakeups = (): void => {
@@ -1149,31 +1420,29 @@ export class TrustedNetworkV2DurablePolicyReducer {
 				clearTimeout(deadlineTimer);
 				deadlineTimer = undefined;
 			}
-			if (signalListenerInstalled) {
-				signalListenerInstalled = false;
-				try {
-					signal?.removeEventListener("abort", abortBeforeAcquisition);
-				} catch {
-					// A structurally valid hostile signal must not break queue cleanup.
-				}
-			}
+			interruptionSignal.removeEventListener(
+				"abort",
+				interruptBeforeAcquisition,
+			);
+			observedSignal[1]();
 		};
 		function settleBeforeAcquisition(result: PolicyLeaseResultV2<T>): void {
-			if (
-				queueAcquired ||
-				callbackAcquired ||
-				preAcquisitionResult !== undefined
-			) {
+			if (callbackAcquired || preAcquisitionResult !== undefined) {
 				return;
 			}
 			preAcquisitionResult = result;
+			acquisitionController.abort();
 			cleanupWakeups();
-			resolveEarly(result);
+			if (!queueAcquired || mutationCompleted) resolveEarly(result);
 		}
+		const completeMutation = (): void => {
+			mutationCompleted = true;
+			if (preAcquisitionResult !== undefined)
+				resolveEarly(preAcquisitionResult);
+		};
 		const armDeadlineWakeup = (): void => {
 			if (
 				deadline === undefined ||
-				queueAcquired ||
 				callbackAcquired ||
 				preAcquisitionResult !== undefined
 			) {
@@ -1209,26 +1478,22 @@ export class TrustedNetworkV2DurablePolicyReducer {
 					return preAcquisitionResult;
 				}
 				queueAcquired = true;
-				cleanupWakeups();
 				const queuedHalt = this.immediateLeaseHaltedResult();
 				if (queuedHalt !== undefined) return queuedHalt;
-				const resolution = await this.core.resolveAcceptedPolicyPrefix(
-					{
-						sequence,
-						digest,
-					},
-					{ maxSteps, deadline, signal },
+				const acquisition = await acquire(
+					acquisitionController.signal,
+					completeMutation,
 				);
 				if (preAcquisitionResult !== undefined) {
 					return preAcquisitionResult;
 				}
-				if (resolution.status !== "resolved") return resolution;
+				if (acquisition.status !== "resolved") return acquisition;
 				// Lifecycle abort before callback invocation loses acquisition. There is
 				// no await between this check and invoking user code, which is the lease's
 				// linearization point.
 				const resolvedHalt = this.immediateLeaseHaltedResult();
 				if (resolvedHalt !== undefined) return resolvedHalt;
-				if (signal?.aborted) {
+				if (acquisitionController.signal.aborted) {
 					return {
 						status: "unavailable",
 						reason: "Policy lease acquisition was aborted by the caller",
@@ -1242,39 +1507,161 @@ export class TrustedNetworkV2DurablePolicyReducer {
 				}
 				callbackAcquired = true;
 				cleanupWakeups();
-				const value = await use({
-					// The core created these two projections independently and retains
-					// neither, including when the requested policy is the current head.
-					policy: resolution.policy,
-					acceptedHead: resolution.acceptedHead,
-				});
+				const value = await use(acquisition.lease);
 				return { status: "completed", value };
 			});
 		const retainedResult = queuedResult.finally(() => {
 			cleanupWakeups();
-			this.releaseOperation(retainedReferenceBytes);
+			this.releaseOperation(retainedInputBytes);
 		});
 		this.operationTail = retainedResult.then(
 			(): void => {},
 			(): void => {},
 		);
 
-		if (signal !== undefined) {
-			signalListenerInstalled = true;
+		interruptionSignal.addEventListener("abort", interruptBeforeAcquisition, {
+			once: true,
+		});
+		if (interruptionSignal.aborted) interruptBeforeAcquisition();
+		armDeadlineWakeup();
+		return Promise.race([retainedResult, earlyResult]);
+	}
+
+	private async resolveExactPolicyEntry(
+		policyEntryCid: string,
+		deadline: number,
+		callerSignal: AbortSignal,
+	): Promise<PolicyLeaseAcquisitionV2<PreparedExactPolicyCandidateV2>> {
+		const resolver = this.resolvePolicyEntryByCid;
+		if (resolver === undefined) {
+			return {
+				status: "unavailable",
+				reason: "Exact policy-head readiness has no policy CID resolver",
+			};
+		}
+		if (this.core.state === "HALTED") {
+			return {
+				status: "halted",
+				reason: "Policy reducer lifecycle is aborted",
+			};
+		}
+		if (callerSignal.aborted) {
+			return {
+				status: "unavailable",
+				reason: "Exact policy-head acquisition was aborted by the caller",
+			};
+		}
+		if (Date.now() >= deadline) {
+			return {
+				status: "unavailable",
+				reason: "Exact policy-head acquisition deadline elapsed",
+			};
+		}
+
+		const interrupted = new Promise<never>((_resolve, reject) => {
+			callerSignal.addEventListener(
+				"abort",
+				() => reject(new Error("Exact policy-head resolution interrupted")),
+				{ once: true },
+			);
+		});
+		const interruptionFailure = (): PolicyLeaseFailureV2 | undefined => {
+			const halted = this.immediateLeaseHaltedResult();
+			if (halted !== undefined) return halted;
+			if (callerSignal.aborted) {
+				return {
+					status: "unavailable",
+					reason: "Exact policy-head acquisition was aborted by the caller",
+				};
+			}
+			if (Date.now() >= deadline) {
+				return {
+					status: "unavailable",
+					reason: "Exact policy-head acquisition deadline elapsed",
+				};
+			}
+			return undefined;
+		};
+
+		const priorAuthentication = this.exactAuthenticationInFlight;
+		if (priorAuthentication !== undefined) {
 			try {
-				signal.addEventListener("abort", abortBeforeAcquisition, {
-					once: true,
-				});
+				await Promise.race([
+					priorAuthentication.catch((): void => {}),
+					interrupted,
+				]);
 			} catch {
-				settleBeforeAcquisition({
-					status: "rejected",
-					reason: "Policy lease signal could not be observed",
-				});
+				return (
+					interruptionFailure() ?? {
+						status: "unavailable",
+						reason: "Exact policy authentication slot is unavailable",
+					}
+				);
 			}
-			if (signal.aborted) abortBeforeAcquisition();
+			const interruptedResult = interruptionFailure();
+			if (interruptedResult !== undefined) return interruptedResult;
 		}
-		armDeadlineWakeup();
-		return Promise.race([retainedResult, earlyResult]);
+		let entryBytes: Uint8Array | undefined;
+		try {
+			entryBytes = await Promise.race([
+				Promise.resolve().then(() =>
+					resolver(policyEntryCid, { signal: callerSignal }),
+				),
+				interrupted,
+			]);
+		} catch (error) {
+			const interruptedResult = interruptionFailure();
+			if (interruptedResult !== undefined) return interruptedResult;
+			return {
+				status: "unavailable",
+				reason: `Policy CID resolver dependency is unavailable: ${boundedDependencyReasonV2(error)}`,
+			};
+		}
+		if (entryBytes === undefined) {
+			return {
+				status: "unavailable",
+				reason: "Exact policy entry is unavailable from its CID resolver",
+			};
+		}
+		const authentication = Promise.resolve().then(() =>
+			this.authenticateExactPolicyEntry({
+				policyEntryCid,
+				entryBytes,
+				descriptor: this.descriptor,
+			}),
+		);
+		this.exactAuthenticationInFlight = authentication;
+		const clearAuthentication = (): void => {
+			if (this.exactAuthenticationInFlight === authentication) {
+				this.exactAuthenticationInFlight = undefined;
+			}
+		};
+		void authentication.then(clearAuthentication, clearAuthentication);
+		try {
+			const authenticated = await Promise.race([authentication, interrupted]);
+			const completedInterruption = interruptionFailure();
+			return (
+				completedInterruption ?? { status: "resolved", lease: authenticated }
+			);
+		} catch (error) {
+			const interruptedResult = interruptionFailure();
+			if (interruptedResult !== undefined) return interruptedResult;
+			return {
+				status: "rejected",
+				reason: `Exact policy entry is invalid: ${boundedDependencyReasonV2(error)}`,
+			};
+		}
+	}
+
+	private authenticateExactPolicyEntry(properties: {
+		policyEntryCid: string;
+		entryBytes: Uint8Array;
+		descriptor: NetworkDescriptorV2;
+	}): Promise<PreparedExactPolicyCandidateV2> {
+		return this.core.prepareExactPolicyEntry(
+			properties.policyEntryCid,
+			properties.entryBytes,
+		);
 	}
 
 	private forkFailStopResult(): PolicyAdmissionResultV2 {
@@ -1297,7 +1684,7 @@ export class TrustedNetworkV2DurablePolicyReducer {
 		};
 	}
 
-	private immediateLeaseHaltedResult(): PolicyLeaseResultV2<never> | undefined {
+	private immediateLeaseHaltedResult(): PolicyLeaseFailureV2 | undefined {
 		if (this.terminalError !== undefined) {
 			return {
 				status: "halted",
@@ -1440,6 +1827,10 @@ export class TrustedNetworkV2DurablePolicyReducer {
 			throw new Error("Policy-anchor checkpoint is unavailable");
 		}
 		await checkpoint.commit(payloadBytes);
+		// Atomic replacement is not cancellable. A lifecycle that ended while it
+		// was in flight may leave durable recovery state, but cannot publish it into
+		// the stale in-memory instance.
+		if (this.core.state === "HALTED") return;
 
 		this.durableCoreIdentityBytes = nextDurableCoreIdentityBytes;
 		this.published = nextPublished;