@real-life/trust-protocol 0.3.2 → 0.5.0

package/dist/adapters/vti-mediator.js

@@ -0,0 +1,659 @@
+// RLTP transport adapter: VTI mediator — published as
+// @real-life/trust-protocol/adapters/vti-mediator (lib Stage 2, note §4.6).
+//
+// Its reports reach the holder as the ports' DeliveryReport: submitOutbound
+// files an Outbound under its document digest and returns the
+// SubmissionRef (submission id ↔ digest); report(id) maps the adapter's
+// SubmissionState onto DeliveryReport (deliveryReportOf), which the app
+// hands to holder.report(). An adapter's `delivered` is its claim about
+// transport; the holder's receive core verifies the delivery-ack itself.
+//
+// Profile: spec/adapter-vti-mediator.md v0.23 (twenty-third casting;
+// round journals under design/adapter-review*). A
+// transport adapter contract — NOT a carrier at the port.
+//
+// Beyond the profile (lib 0.5.0): conclude(collection, now, {keep}) leaves
+// the items whose disposition is transient unconcluded and offers them
+// again (Delivery 0.82 RLTP-DEL-5810, 5820: failed(rate-limited) is never
+// concluded); `concludable(result)` says which receive outcomes are
+// terminal. The profile's §4 concludes a collection whole; its next
+// casting is to take this up.
+//
+// Structural rules (reviews 3+4):
+//   · No port operation ever awaits the mediator — including
+//     register: keylist synchronization is a recorded intent with a
+//     tracked background task, retried by advance.
+//   · No report is invented, and absence is ABSENT: before the first
+//     honest report exists, status() returns null (§6.1 grants the
+//     window; representing it as a queryable fourth value was
+//     review-4 B2). has() distinguishes an unknown id.
+//   · A retired instance mutates nothing and refuses everything
+//     except reading its ack state.
+import { jcs } from '../core.js';
+import { sha } from '../crypto.js';
+import { carrierPrincipal, carrierScopedIdentity } from '../carrier-identity.js';
+// ── Declared constants (profile §2) — promises of THIS casting ──────
+// frozen: the declared promises cannot be changed at run time either
+export const DECLARED = Object.freeze({
+    giveUpHorizonMs: 72 * 3_600_000,
+    statusHorizonMs: 60_000,
+    queueFloorCount: 64,
+    queueFloorBytes: 1_048_576,
+    maxQueueBytes: 16_777_216,
+    duplicateWindowMs: 30 * 86_400_000,
+});
+export class WireError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message ?? kind);
+        this.kind = kind;
+    }
+}
+// ── Sender states (§6.1 — the closed sets, nothing else) ────────────
+// ReceiverRefusalCode is the ports' (one closed set, one place)
+const RECEIVER_REFUSAL_CODES = new Set([
+    'malformedRequest', 'unsupportedType', 'proofRequired',
+    'proofInvalid', 'wrongRecipient', 'identityMismatch',
+]);
+/** The ports' DeliveryReport for a document `digest` in adapter state `st`
+ *  (Delivery §6.1): one-to-one, `late` and the refusal code carried over. */
+export function deliveryReportOf(digest, st) {
+    switch (st.state) {
+        case 'awaiting-transport': return { digest, status: 'awaiting-transport', reason: st.reason };
+        case 'accepted': return { digest, status: 'accepted' };
+        case 'delivered': return { digest, status: 'delivered', late: st.late };
+        case 'failed': return st.reason === 'rejected-by-receiver'
+            ? { digest, status: 'failed', reason: 'rejected-by-receiver', code: st.code }
+            : { digest, status: 'failed', reason: st.reason };
+    }
+}
+/** Whether a receive outcome is terminal and its item may be concluded
+ *  (Delivery 5a.8): every disposition but `failed(rate-limited)`, the one
+ *  failure that is transient (RLTP-DEL-5820). An InfraError of the
+ *  holder's store is transient as well (RLTP-DEL-5810): an item whose
+ *  receive threw is kept, too. */
+export function concludable(r) {
+    return !(r.disposition === 'failed' && r.reason === 'rate-limited');
+}
+/** The adapter's own copy of a wire's token set: the wire keeps no handle on it. */
+const tokenCopy = (t) => ({ accessToken: t.accessToken, accessExpiresAt: t.accessExpiresAt, refreshToken: t.refreshToken, refreshExpiresAt: t.refreshExpiresAt });
+const hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+// construction capability: only create() holds it
+const KEY = Symbol('MediatorCarrierAdapter.create');
+// ── The adapter ──────────────────────────────────────────────────────
+export class MediatorCarrierAdapter {
+    // JS-hard identity fields: TS `readonly` is a compile-time promise
+    // only, and §8 claims runtime unforgeability — so the values live
+    // in true privates behind getters (R8-B1)
+    #principal;
+    #connectionDid;
+    #egressDid;
+    get principal() { return this.#principal; }
+    get connectionDid() { return this.#connectionDid; }
+    get egressDid() { return this.#egressDid; }
+    #wire;
+    #tokens = null;
+    #clock = Number.NEGATIVE_INFINITY;
+    #closed = false;
+    #subs = new Map();
+    #inflight = new Set();
+    #nextId = 1;
+    #desiredRkids = null;
+    #keylistSynced = false;
+    #keylistSyncing = false;
+    #inbox = [];
+    #inboxBytes = 0;
+    #inboxDigests = new Set();
+    #outstanding = new Map();
+    #outstandingBytes = 0;
+    #concluded = new Map();
+    #pendingAcks = new Set();
+    #flightAcks = new Set(); // ids inside the in-flight flush snapshot
+    #flushing = false;
+    #nextColId = 1;
+    #transitions = [];
+    /** The only way to build an adapter: the trio is DERIVED here from
+     *  one root, one carrier, one nonce — so principal, connection DID
+     *  and egress identity cannot come from different relationships
+     *  (R7-B2: the coupling is enforced by construction, not by
+     *  inspecting caller-supplied identities). */
+    static async create(rootIkm, carrier, nonce, wire, restored, restoredAt) {
+        // ONE tuple, snapshotted at entry: a caller mutating its buffers
+        // between the three awaited derivations must not be able to mix
+        // identities from two tuples (R8-B2)
+        const ikm = new Uint8Array(rootIkm);
+        const n = new Uint8Array(nonce);
+        const principal = await carrierPrincipal(ikm, carrier, n);
+        const connection = await carrierScopedIdentity(ikm, carrier, n, 'connection');
+        const egress = await carrierScopedIdentity(ikm, carrier, n, 'egress');
+        return new MediatorCarrierAdapter(KEY, principal, connection, egress, wire, restored, restoredAt);
+    }
+    constructor(key, principal, connection, egress, wire, restored, restoredAt) {
+        if (key !== KEY) {
+            throw new Error('use MediatorCarrierAdapter.create — the identity trio must be derived, not supplied (5a.10)');
+        }
+        if (connection.scope !== 'connection' || egress.scope !== 'egress') {
+            throw new Error('scoped identities passed in the wrong roles');
+        }
+        const three = new Set([principal.principal, connection.did, egress.did]);
+        if (three.size !== 3) {
+            throw new Error('principal, connection DID and egress identity must be pairwise distinct (5a.10)');
+        }
+        this.#principal = principal.principal;
+        this.#connectionDid = connection.did;
+        this.#egressDid = egress.did;
+        this.#wire = wire;
+        if (restored) {
+            // The restore instant anchors the duplicate-window: an expired,
+            // debt-free entry is dropped HERE, not at the first advance —
+            // otherwise a redelivery arriving before any port call would be
+            // absorbed beyond the declared window (review-4 B4).
+            if (typeof restoredAt !== 'number' || !Number.isFinite(restoredAt)) {
+                throw new Error('restoring ack state requires a finite restoredAt instant');
+            }
+            this.#now(restoredAt);
+            const pending = new Set(restored.pending);
+            const known = new Set(restored.concluded.map((c) => c.queueId));
+            for (const id of pending) {
+                if (!known.has(id)) {
+                    throw new Error('ack snapshot violates its invariant: pending intent without a concluded entry');
+                }
+            }
+            for (const { queueId, concludedAt } of restored.concluded) {
+                if (!Number.isFinite(concludedAt) || concludedAt > restoredAt) {
+                    // a conclusion "from the future" would stretch the window
+                    // past its declared span (R5-B4) — fail closed
+                    throw new Error('ack snapshot: conclusion instant is non-finite or after restoredAt');
+                }
+                // the window beats everything (round-14 B): an expired entry
+                // falls at the restore instant, owed or not — a phantom debt
+                // from an ack that landed just before a close can never
+                // outlive the window and delete a fresh copy (R14-B2)
+                if (restoredAt - concludedAt >= DECLARED.duplicateWindowMs)
+                    continue;
+                this.#concluded.set(queueId, concludedAt);
+                if (pending.has(queueId))
+                    this.#pendingAcks.add(queueId);
+            }
+        }
+        this.#wire.onDeliver(async (raw) => {
+            if (this.#closed)
+                return;
+            // a plain copy of its own: a Node Buffer's slice() would share memory
+            const bytes = new Uint8Array(raw);
+            const queueId = hex(await sha(bytes));
+            if (this.#closed)
+                return;
+            // Absorption is WINDOW-checked at the moment it happens
+            // (R11-B1), and the window beats everything (round-14 B):
+            // beyond it, entry AND any leftover intent fall, and the frame
+            // is a new item — so no acknowledgement, owed or phantom, can
+            // ever delete the only fresh copy.
+            const concludedAt = this.#concluded.get(queueId);
+            if (concludedAt !== undefined) {
+                if (this.#flightAcks.has(queueId) ||
+                    this.#clock - concludedAt < DECLARED.duplicateWindowMs) {
+                    // inside the window — or deferred: an id inside an
+                    // in-flight flush keeps absorbing until that flush ends,
+                    // because its irrecallable ack may still land (R15-B1)
+                    this.#pendingAcks.add(queueId);
+                    return;
+                }
+                this.#concluded.delete(queueId);
+                this.#pendingAcks.delete(queueId);
+            }
+            if (this.#inboxDigests.has(queueId))
+                return;
+            for (const col of this.#outstanding.values())
+                if (col.has(queueId))
+                    return;
+            const held = this.#inboxBytes + this.#outstandingBytes;
+            const underFloor = this.#inbox.length < DECLARED.queueFloorCount &&
+                held + bytes.length <= DECLARED.queueFloorBytes;
+            const underCap = held + bytes.length <= DECLARED.maxQueueBytes;
+            if (!underFloor && !underCap)
+                return;
+            this.#inbox.push({ bytes, queueId });
+            this.#inboxBytes += bytes.length;
+            this.#inboxDigests.add(queueId);
+        });
+    }
+    #now(raw) {
+        if (!Number.isFinite(raw))
+            throw new Error('non-finite time');
+        if (raw > this.#clock)
+            this.#clock = raw;
+        return this.#clock;
+    }
+    #open() { if (this.#closed)
+        throw new Error('retired (5a.10 lifecycle)'); }
+    #track(p) {
+        const t = p.catch(() => { });
+        this.#inflight.add(t);
+        void t.finally(() => this.#inflight.delete(t));
+    }
+    // ── auth: silent carrier policy ─────────────────────────────────
+    // Single-flight: concurrent callers share one handshake — the ATM
+    // challenge/response is a session, and two interleaved sessions
+    // under one connection DID would answer each other's challenges.
+    #authing = null;
+    #ensureAuth(now) {
+        if (this.#tokens && now < this.#tokens.accessExpiresAt)
+            return Promise.resolve(this.#tokens.accessToken);
+        if (this.#authing)
+            return this.#authing;
+        const run = (async () => {
+            if (this.#tokens && now < this.#tokens.refreshExpiresAt) {
+                try {
+                    const refreshed = await this.#wire.refresh(this.#tokens.refreshToken);
+                    if (this.#closed)
+                        throw new Error('retired'); // as on the handshake path (R6-B1)
+                    this.#tokens = tokenCopy(refreshed);
+                    return this.#tokens.accessToken;
+                }
+                catch (e) {
+                    if (this.#closed)
+                        throw e;
+                    // a transient failure (mediator unreachable, retriable refusal)
+                    // says nothing about the token: keep it for the next attempt (#9)
+                    if (e instanceof WireError && (e.kind === 'unreachable' || e.kind === 'refused-retriable'))
+                        throw e;
+                    // a refused refresh (revoked before its expiry) is never replayed:
+                    // drop the tokens and take the challenge handshake below
+                    this.#tokens = null;
+                }
+            }
+            const { challenge, sessionId } = await this.#wire.authChallenge(this.#connectionDid);
+            if (this.#closed)
+                throw new Error('retired'); // nothing new starts, not even the answer (R6-B1)
+            this.#tokens = tokenCopy(await this.#wire.authenticate({ did: this.#connectionDid, challenge, sessionId }));
+            return this.#tokens.accessToken;
+        })();
+        this.#authing = run.finally(() => { this.#authing = null; });
+        return this.#authing;
+    }
+    // ── transport registration (profile §3 — NOT §5a.3) ─────────────
+    /** Records the desired keylist and returns; synchronization runs
+     *  as a tracked background task and advance retries it until it
+     *  lands (review-4 B1). */
+    register(rkids, rawNow) {
+        this.#open();
+        const now = this.#now(rawNow);
+        this.#desiredRkids = [...rkids];
+        this.#keylistSynced = false;
+        this.#startKeylistSync(now);
+    }
+    get keylistSynced() {
+        this.#open();
+        return this.#keylistSynced;
+    }
+    #startKeylistSync(now) {
+        if (this.#keylistSyncing || this.#keylistSynced || this.#desiredRkids === null)
+            return;
+        this.#keylistSyncing = true;
+        const wanted = [...this.#desiredRkids];
+        this.#track((async () => {
+            try {
+                const token = await this.#ensureAuth(now);
+                if (this.#closed)
+                    return;
+                await this.#wire.keylistUpdate(token, [...wanted]); // the wire's own list: `wanted` is compared below
+                // land only if the desire has not moved meanwhile
+                if (!this.#closed && this.#desiredRkids !== null &&
+                    wanted.join(' ') === this.#desiredRkids.join(' ')) {
+                    this.#keylistSynced = true;
+                }
+            }
+            catch {
+                // intent survives; advance retries
+            }
+            finally {
+                this.#keylistSyncing = false;
+            }
+        })());
+    }
+    // ── sender side ─────────────────────────────────────────────────
+    /** Returns the submission id synchronously. Before the first
+     *  honest report exists, status() returns null — §6.1's own
+     *  pre-report window, represented as absence, not as a value. */
+    submit(envelopeBytes, rawNow) {
+        this.#open();
+        const now = this.#now(rawNow);
+        const id = 's' + this.#nextId++;
+        const knownOffline = this.#wire.offline?.() === true;
+        const sub = {
+            // a plain copy of its own (a Node Buffer's slice() shares memory)
+            bytes: new Uint8Array(envelopeBytes),
+            submittedAt: now,
+            attemptStartedAt: null,
+            lastKind: null,
+            st: null,
+        };
+        this.#subs.set(id, sub);
+        if (!knownOffline)
+            this.#startAttempt(sub, now);
+        return id;
+    }
+    /** Files an Outbound (its envelope as JCS bytes) and returns the
+     *  SubmissionRef the holder's reports are keyed by: submission id ↔
+     *  document digest (note §4.3). */
+    submitOutbound(outbound, rawNow) {
+        this.#open();
+        if (typeof outbound?.digest !== 'string' || outbound.digest === '')
+            throw new Error('an outbound needs its document digest');
+        const submissionId = this.submit(new TextEncoder().encode(jcs(outbound.envelope)), rawNow);
+        this.#subs.get(submissionId).digest = outbound.digest;
+        return { submissionId, digest: outbound.digest };
+    }
+    /** The current state as the ports' DeliveryReport for holder.report(),
+     *  or null while no honest report exists (and for an unknown id). A
+     *  submission filed without a digest (submit) has no report form. */
+    report(id) {
+        const st = this.status(id);
+        if (st === null)
+            return null;
+        const digest = this.#subs.get(id).digest;
+        if (digest === undefined)
+            throw new Error('submitted without a document digest: use submitOutbound');
+        return deliveryReportOf(digest, st);
+    }
+    has(id) {
+        this.#open();
+        return this.#subs.has(id);
+    }
+    #startAttempt(sub, now) {
+        if (sub.attemptStartedAt !== null)
+            return;
+        sub.attemptStartedAt = now;
+        this.#track(this.#trySend(sub, now).finally(() => { sub.attemptStartedAt = null; }));
+    }
+    async #trySend(sub, now) {
+        if (sub.st !== null && sub.st.state !== 'awaiting-transport')
+            return;
+        let next;
+        try {
+            const token = await this.#ensureAuth(now);
+            if (this.#closed)
+                return; // retirement between auth and deposit: nothing new starts (R5-B2)
+            // each attempt hands the wire a copy: what it does with it never reaches the next
+            await this.#wire.deposit(token, new Uint8Array(sub.bytes), this.#egressDid);
+            sub.lastKind = null;
+            next = { state: 'accepted' };
+        }
+        catch (e) {
+            const kind = e instanceof WireError ? e.kind : 'unreachable';
+            sub.lastKind = kind;
+            next = kind === 'oversize'
+                ? { state: 'failed', reason: 'oversize' }
+                : {
+                    state: 'awaiting-transport',
+                    reason: kind === 'unreachable' ? 'transport-unreachable' : 'carrier-refused-retriable',
+                };
+        }
+        if (this.#closed)
+            return;
+        // An interim report (including a horizon-corrected one) never
+        // outranks the attempt's real outcome; only a TERMINAL state —
+        // a give-up, a refusal, a delivery — stands (R5-B1). Without
+        // this, an accepted deposit would stay reported unreachable and
+        // be sent a second time.
+        if (sub.st === null || sub.st.state === 'awaiting-transport')
+            sub.st = next;
+    }
+    /** Host teardown aid, NOT a port operation (profile §6): awaits
+     *  the in-flight background tasks so a host can drain before
+     *  persisting ackState. On a hanging wire it waits as long as the
+     *  wire does — a host bounds it externally (Promise.race) exactly
+     *  because this library holds no clock of its own. */
+    async settle() {
+        while (this.#inflight.size > 0)
+            await Promise.all([...this.#inflight]);
+    }
+    /** The §6.1 report, or null while none exists yet (has()
+     *  distinguishes an unknown id). status is a PORT: after close it
+     *  refuses like every other port operation (R5-B3).
+     *
+     *  The pre-transport report is an HONEST SNAPSHOT, derived at the
+     *  moment of observation by one precedence order (Option B of the
+     *  round-14 halt) — never a stored patchwork:
+     *    (a) the wire knows itself offline      → offline
+     *    (b) an attempt is overdue              → transport-unreachable
+     *    (c) the last completed attempt's kind  → its report
+     *    (d) otherwise                          → no report yet (null)
+     *  Terminal states and `accepted` are stored and stand. */
+    status(id) {
+        this.#open();
+        const sub = this.#subs.get(id);
+        if (!sub)
+            return null;
+        if (sub.st !== null && sub.st.state !== 'awaiting-transport')
+            return { ...sub.st };
+        if (this.#wire.offline?.() === true) {
+            return { state: 'awaiting-transport', reason: 'offline' };
+        }
+        if (sub.attemptStartedAt !== null &&
+            this.#clock - sub.attemptStartedAt >= DECLARED.statusHorizonMs) {
+            return { state: 'awaiting-transport', reason: 'transport-unreachable' };
+        }
+        return sub.st === null ? null : { ...sub.st };
+    }
+    acknowledged(id) {
+        if (this.#closed)
+            return;
+        const sub = this.#subs.get(id);
+        if (!sub)
+            return;
+        if (sub.st?.state === 'delivered')
+            return; // idempotent: a duplicate ack never rewrites `late` (R9-M4)
+        const late = sub.st?.state === 'failed';
+        sub.st = { state: 'delivered', late };
+        if (late)
+            this.#transitions.push({ id, to: 'delivered' });
+    }
+    /** Refusals act on live submissions only (§6.1 knows exactly one
+     *  late correction — the valid ack). The code set is closed and
+     *  TERMINAL: retryable counterpart conditions (unavailable,
+     *  internalError) are transport outcomes, never receiver verdicts
+     *  — they have no entry here, and an unknown code is refused
+     *  fail-closed rather than minted into a verdict (R6-B2). */
+    receiverRefused(id, code) {
+        if (this.#closed)
+            return;
+        if (!RECEIVER_REFUSAL_CODES.has(code)) {
+            throw new Error('not a terminal receiver refusal code — retryable conditions are transport outcomes');
+        }
+        const sub = this.#subs.get(id);
+        if (!sub)
+            return;
+        // A VALIDATED refusal is itself the proof of receipt — the
+        // mediator can have accepted and forwarded while our deposit
+        // promise is still unresolved, so the report-less phase is a
+        // legitimate moment for it (R9-B2, reversing the R8-B3
+        // overcorrection). Only terminal states stand against it.
+        if (sub.st !== null && sub.st.state !== 'awaiting-transport' && sub.st.state !== 'accepted')
+            return;
+        sub.st = { state: 'failed', reason: 'rejected-by-receiver', code };
+    }
+    drainTransitions() {
+        this.#open();
+        return this.#transitions.splice(0);
+    }
+    // ── receiver side ───────────────────────────────────────────────
+    collect(rawNow) {
+        this.#open();
+        this.#now(rawNow);
+        if (this.#inbox.length === 0)
+            return { id: 'c-empty', items: [] };
+        const items = this.#inbox.splice(0);
+        this.#outstandingBytes += this.#inboxBytes;
+        this.#inboxBytes = 0;
+        this.#inboxDigests.clear();
+        const id = 'c' + this.#nextColId++;
+        this.#outstanding.set(id, new Map(items.map((i) => [i.queueId, i])));
+        // the caller gets its own copies: the outstanding entries stay intact,
+        // whatever it does with the bytes, for a conclusion that keeps them
+        return { id, items: items.map((i) => ({ ...i, bytes: new Uint8Array(i.bytes) })) };
+    }
+    /** Concludes a collection (profile §4, Delivery 5a.8): its items'
+     *  digests become ack intent. `keep` names the items whose disposition
+     *  is transient (Delivery RLTP-DEL-5810, 5820: `failed(rate-limited)`,
+     *  or a transaction that could not commit, see `concludable`): they are
+     *  not concluded and not acknowledged, they go back to the buffer and the
+     *  next collect offers them again, and the mediator keeps its copy. */
+    conclude(collection, rawNow, opts = {}) {
+        this.#open();
+        const now = this.#now(rawNow);
+        const col = this.#outstanding.get(collection.id);
+        if (!col)
+            return;
+        this.#outstanding.delete(collection.id);
+        const keep = new Set(opts.keep ?? []);
+        for (const item of col.values()) {
+            this.#outstandingBytes -= item.bytes.length;
+            if (keep.has(item.queueId)) {
+                // transient: back to the buffer, offered again, never acknowledged
+                this.#inbox.push(item);
+                this.#inboxBytes += item.bytes.length;
+                this.#inboxDigests.add(item.queueId);
+                continue;
+            }
+            this.#concluded.set(item.queueId, now);
+            this.#pendingAcks.add(item.queueId);
+        }
+        this.#startFlush(now);
+    }
+    ackState() {
+        return {
+            concluded: [...this.#concluded].map(([queueId, concludedAt]) => ({ queueId, concludedAt })),
+            pending: [...this.#pendingAcks],
+        };
+    }
+    #startFlush(now) {
+        if (this.#flushing || this.#pendingAcks.size === 0)
+            return;
+        this.#flushing = true;
+        const snapshot = new Set(this.#pendingAcks);
+        this.#track(this.#flushAcks(now, [...snapshot]).finally(() => {
+            this.#flushing = false;
+            // lost-wake-up guard (review-4 M6): intents that arrived while
+            // this flush ran get their own flush now — but only newcomers,
+            // so a failing wire waits for the next advance instead of
+            // spinning
+            if (!this.#closed) {
+                for (const id of this.#pendingAcks) {
+                    if (!snapshot.has(id)) {
+                        this.#startFlush(this.#clock);
+                        break;
+                    }
+                }
+            }
+        }));
+    }
+    async #flushAcks(now, ids) {
+        try {
+            const token = await this.#ensureAuth(now);
+            if (this.#closed)
+                return;
+            // Only NOW does anything become irrecallable (R16-B1): the
+            // stay of expiry begins at the wire call itself, never at the
+            // snapshot — a hanging auth extends no window. And "live" is
+            // WINDOW-live (R17-B1): an entry whose window already closed —
+            // even if no prune has swept it yet — is never sent.
+            const live = ids.filter((id) => {
+                const at = this.#concluded.get(id);
+                return at !== undefined && this.#clock - at < DECLARED.duplicateWindowMs;
+            });
+            if (live.length === 0)
+                return;
+            for (const id of live)
+                this.#flightAcks.add(id);
+            try {
+                // the wire gets its own list: what it does with it never reaches the bookkeeping below
+                await this.#wire.ackReceived(token, [...live]);
+                if (!this.#closed)
+                    for (const id of live)
+                        this.#pendingAcks.delete(id);
+            }
+            finally {
+                for (const id of live)
+                    this.#flightAcks.delete(id);
+                // deferred window sweep: entries whose window closed while
+                // the ack flew fall now — intent, entry and absorption
+                // together (R15-B1). Never on a retired instance: after
+                // close, ackState() is the host's final-persist surface and
+                // a late-returning wire mutates nothing (R17-B2).
+                if (!this.#closed) {
+                    for (const id of live) {
+                        const at = this.#concluded.get(id);
+                        if (at !== undefined && this.#clock - at >= DECLARED.duplicateWindowMs) {
+                            this.#concluded.delete(id);
+                            this.#pendingAcks.delete(id);
+                        }
+                    }
+                }
+            }
+        }
+        catch {
+            // intent survives; the next advance starts a fresh flush
+        }
+    }
+    // ── the adapter clock — never awaits the mediator ───────────────
+    advance(rawNow) {
+        this.#open();
+        const now = this.#now(rawNow);
+        for (const sub of this.#subs.values()) {
+            const live = sub.st === null || sub.st.state === 'awaiting-transport' || sub.st.state === 'accepted';
+            if (!live)
+                continue;
+            if (now - sub.submittedAt >= DECLARED.giveUpHorizonMs) {
+                // unroutable only when the LAST COMPLETED attempt was an
+                // admission refusal and no attempt is in flight whose outcome
+                // is unknown (review-4 B3)
+                // the give-up verdict applies the SAME precedence as every
+                // observation (R17-B3): a wire that knows itself offline at
+                // the horizon outranks any stored refusal class — unroutable
+                // needs a completed admission refusal, no unknown outcome in
+                // flight, AND no offline signal standing over it
+                sub.st = {
+                    state: 'failed',
+                    reason: sub.lastKind === 'refused-admission' && sub.attemptStartedAt === null &&
+                        this.#wire.offline?.() !== true
+                        ? 'unroutable'
+                        : 'expired-by-adapter-policy',
+                };
+                continue;
+            }
+            if (sub.st !== null && sub.st.state === 'accepted')
+                continue;
+            // reports are DERIVED at observation (see status()); the clock
+            // only decides here whether to start an attempt — and never
+            // against a wire that knows itself offline
+            if (this.#wire.offline?.() === true)
+                continue;
+            if (sub.attemptStartedAt === null)
+                this.#startAttempt(sub, now);
+        }
+        // THE WINDOW BEATS EVERYTHING (Option B of the round-14 halt):
+        // an ack intent is retried until the window closes; then intent
+        // and absorption fall together. There is no ageless debt whose
+        // truth the adapter would have to know — the receiver's §6.2
+        // absorption owns everything beyond the window.
+        for (const [digest, at] of this.#concluded) {
+            if (now - at >= DECLARED.duplicateWindowMs && !this.#flightAcks.has(digest)) {
+                this.#concluded.delete(digest);
+                this.#pendingAcks.delete(digest);
+            }
+        }
+        this.#startKeylistSync(now);
+        this.#startFlush(now);
+    }
+    /** §5a.10 lifecycle boundary: after close, every state port is
+     *  inert — port operations refuse, inbound reports (acknowledged,
+     *  receiverRefused) are no-ops, late wire resolutions mutate
+     *  nothing. Only ackState() stays readable for the host's final
+     *  persist. */
+    close() { this.#closed = true; }
+    get closed() { return this.#closed; }
+}
+export const queueIdOf = async (bytes) => hex(await sha(bytes));
+//# sourceMappingURL=vti-mediator.js.map