@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -1,75 +1,70 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, bytesToUnprefixedHex, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import "../../../../shared-ts/src/utils/validation.js";
-import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import "../../../../shared-ts/src/utils/encoders.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { deriveSigningRootId, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
-import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { registrationPreparationIdFromString } from "../../../../core/types.js";
-import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
-import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
+import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
+import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
-import { routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, buildStoredWalletRegistrationPreparedContext, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, inferRuntimePolicyScopeFromSigningRoot, normalizeThresholdEcdsaChainTargets, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
-import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
+import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
-import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
-import { commitRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
-import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
-import { projectWalletRegistrationSessionCommitReceiptV2, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
+import { reserveRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
+import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
+import { walletRegistrationOperationPreparedFromCeremony } from "./d1WalletRegistrationPreparation.js";
+import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
+import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
+import { projectWalletRegistrationSessionCommitReceiptV2, registrationCommitActivation, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
 import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
+import { commitWalletRegistration } from "./d1WalletRegistrationInitialSession.js";
+import { storedRespondEd25519DeferredWork, walletRegistrationRespondResult } from "./d1WalletRegistrationSetup.js";
+import { executeD1WalletRegistrationSetup } from "./d1WalletRegistrationSetupExecution.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationService.ts
-function buildWalletRegistrationActivatePendingPasskeyResponse(input) {
-	return {
-		ok: true,
-		kind: "near_ed25519",
-		walletId: input.walletId,
-		authority: input.authority,
-		authMethod: input.authMethod,
-		rpId: input.rpId,
-		nearProvisioning: { status: "near_pending" }
-	};
-}
-function buildWalletRegistrationActivatePendingEmailOtpResponse(input) {
-	return {
-		ok: true,
-		kind: "near_ed25519",
-		walletId: input.walletId,
-		authority: input.authority,
-		authMethod: input.authMethod,
-		nearProvisioning: { status: "near_pending" }
-	};
+async function buildRespondEd25519AdmissionRequest(input) {
+	return buildRouterAbEd25519YaoProductAdmissionRequestV1({
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		walletId: input.ceremony.intent.walletId,
+		signingRootId: normalizeOptionalTrimmedString(input.ceremony.signingRootId) || "",
+		signingRootVersion: normalizeOptionalTrimmedString(input.ceremony.signingRootVersion) || "",
+		authorityScope: registrationEd25519AuthorityScopeFromAuthority(input.authority),
+		branch: input.branch,
+		signingWorkerId: input.signingWorkerId,
+		materialActivation: createRouterAbEd25519YaoMaterialActivationRefV1({
+			walletId: input.ceremony.intent.walletId,
+			signingWorkerId: input.signingWorkerId
+		})
+	});
 }
 function sameEd25519ParticipantIds(left, right) {
 	return left[0] === right[0] && left[1] === right[1];
@@ -92,7 +87,7 @@ function sameRouterAbEcdsaRegistrationRequest(left, right) {
 	return routerAbEcdsaStrictRegistrationRequestBindingJson(left) === routerAbEcdsaStrictRegistrationRequestBindingJson(right) && left.client_ephemeral_public_key === right.client_ephemeral_public_key && sameRouterAbEcdsaRegistrationEnvelope(left.deriver_a_envelope, right.deriver_a_envelope) && sameRouterAbEcdsaRegistrationEnvelope(left.deriver_b_envelope, right.deriver_b_envelope);
 }
 function sameEcdsaDerivationServerBootstrap(left, right) {
-	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentity(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.publicTranscriptDigest32B64u === right.publicTranscriptDigest32B64u && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && sameEcdsaParticipantIds(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
+	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentity(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && sameEcdsaParticipantIds(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
 }
 function linkedEd25519ProjectionMaterialActivationWire(projection) {
 	return routerAbMpcMaterialActivationRefToWire(projection.materialActivation);
@@ -203,23 +198,6 @@ function requirePreparedRegistrationId(result, label) {
 	if (!result.ok) throw new Error(`${label} is invalid: ${result.error.message}`);
 	return result.value;
 }
-function allocateWalletRegistrationOperationPrepared() {
-	return {
-		kind: "d1_wallet_registration_operation_prepared_v1",
-		walletAuthorityId: requirePreparedRegistrationId(parseWalletAuthorityId(`wallet-authority:${secureRandomBase64Url(32)}`), "walletAuthorityId"),
-		deviceId: requirePreparedRegistrationId(parseDeviceId(`device:${secureRandomBase64Url(32)}`), "deviceId"),
-		walletAuthMethodId: requirePreparedRegistrationId(parseWalletAuthMethodId(`wallet-auth-method:${secureRandomBase64Url(32)}`), "walletAuthMethodId")
-	};
-}
-function walletRegistrationOperationPreparedFromCeremony(ceremony) {
-	if (String(ceremony.foundingWalletAuthMethodId) !== String(ceremony.intent.foundingWalletAuthMethodId)) throw new Error("registration ceremony and intent name different founding auth methods");
-	return {
-		kind: "d1_wallet_registration_operation_prepared_v1",
-		walletAuthorityId: ceremony.foundingWalletAuthorityId,
-		deviceId: ceremony.foundingDeviceId,
-		walletAuthMethodId: ceremony.foundingWalletAuthMethodId
-	};
-}
 function committedInstallationProjectionFromCeremony(ceremony) {
 	const registrationAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
 	if (ceremony.signerState.kind !== "signer_set_registration" || registrationAuthority === null) return null;
@@ -415,6 +393,16 @@ async function buildFoundingAuthorityRecords(input) {
 function assertNeverFoundingSignerFacts(value) {
 	throw new Error(`Unsupported founding signer facts: ${String(value)}`);
 }
+function registrationOwnerProofContextFromCeremony(ceremony) {
+	const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
+	const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
+	if (!expectedOrigin || !runtimePolicyScope) throw new Error("Registration is missing its session origin or runtime policy scope");
+	return {
+		expectedOrigin,
+		runtimePolicyScope,
+		expiresAtMs: ceremony.expiresAtMs
+	};
+}
 function registrationFinalizeCeremonyFromStored(ceremony) {
 	if (ceremony.signerState.kind !== "signer_set_registration") throw new Error("signer-set registration state is required");
 	return {
@@ -528,18 +516,12 @@ function ed25519AlreadyCommittedWalletSessionResponse(committed) {
 function registrationWalletAuthAuthority(input) {
 	return walletAuthAuthorityFromRegistrationAuthority(input);
 }
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error || "");
-}
 function assertNeverSponsoredNamedNearAccountCreationResult(value) {
 	throw new Error(`Unexpected sponsored NEAR account creation result: ${String(value)}`);
 }
 function isRegistrationEcdsaReadyReceipt(receipt) {
 	return receipt.committed.kind === "ecdsa_ready";
 }
-function isRegistrationNearPendingReceipt(receipt) {
-	return receipt.committed.kind === "near_pending";
-}
 function isRegistrationNearReadyReceipt(receipt) {
 	return receipt.committed.kind === "near_ready";
 }
@@ -551,24 +533,6 @@ async function cleanupFinalizedRegistrationCeremony(input) {
 		await input.store.deleteCeremony(input.registrationCeremonyId);
 	} catch {}
 }
-function createD1RegistrationRouteTimingRecorder(route) {
-	return {
-		route,
-		entries: []
-	};
-}
-function startD1RegistrationRouteTiming(name) {
-	return {
-		name,
-		startedAtMs: Date.now()
-	};
-}
-function finishD1RegistrationRouteTiming(recorder, mark) {
-	recorder.entries.push({
-		name: mark.name,
-		durationMs: Math.max(0, Date.now() - mark.startedAtMs)
-	});
-}
 function d1RegistrationRouteDiagnostics(recorder) {
 	return {
 		kind: "wallet_registration_route_diagnostics_v1",
@@ -580,7 +544,6 @@ function d1RegistrationRouteDiagnostics(recorder) {
 	};
 }
 function withD1RegistrationRouteDiagnostics(response, recorder) {
-	if (!response.ok) return response;
 	return {
 		...response,
 		registrationDiagnostics: d1RegistrationRouteDiagnostics(recorder)
@@ -602,48 +565,6 @@ function hasEcdsaKeyHandleSetMismatch(expectedKeyHandles, actualKeyHandles) {
 	for (const keyHandle of expected) if (!actual.has(keyHandle)) return true;
 	return false;
 }
-function registrationIntentSignerBranches(intent) {
-	const plan = registrationSignerPlanFromSelection(intent.signerSelection);
-	if (!plan.ok) return plan;
-	return {
-		ok: true,
-		value: registrationSignerBranchesFromPlan(plan.value)
-	};
-}
-function registrationSignerBranchesFromPlan(plan) {
-	return {
-		plan,
-		nearEd25519: findRegistrationSignerPlanNearEd25519Branch(plan),
-		evmFamilyEcdsa: findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan)
-	};
-}
-function resolveRegistrationPreparedContextFromPlan(input) {
-	const branches = registrationSignerBranchesFromPlan(input.signerPlan);
-	const ecdsaChainTargets = branches.evmFamilyEcdsa ? normalizeThresholdEcdsaChainTargets(branches.evmFamilyEcdsa.chainTargets) : null;
-	if (branches.evmFamilyEcdsa && !ecdsaChainTargets) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration contains an invalid chain target"
-	};
-	try {
-		return {
-			ok: true,
-			preparedContext: buildStoredWalletRegistrationPreparedContext({
-				signingRootId: input.signingRootId,
-				signingRootVersion: input.signingRootVersion,
-				runtimePolicyScope: input.runtimePolicyScope || null,
-				ecdsaChainTargets
-			}),
-			ecdsaChainTargets
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(error) || "registration prepared context is invalid"
-		};
-	}
-}
 function registrationPreparedContextRuntimePolicyScope(preparedContext) {
 	return preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? preparedContext.runtimePolicy.scope : void 0;
 }
@@ -659,9 +580,6 @@ function registrationTenantRootIdentity(preparedContext) {
 	});
 	return identity.ok ? identity.value : null;
 }
-function registrationPreparedContextEcdsaChainTargets(preparedContext) {
-	return preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? preparedContext.ecdsa.chainTargets : null;
-}
 /**
 * A verified authority must name the same wallet the intent does. A ceremony
 * still awaiting its proof has no authority to disagree with, so it matches
@@ -837,7 +755,6 @@ async function buildActivatedEcdsaFamilyBootstrap(input) {
 		publicIdentity,
 		clientShareRetryCounter: input.publicFacts.clientShareRetryCounter,
 		relayerShareRetryCounter: identity.server_share_retry_counter,
-		publicTranscriptDigest32B64u: input.publicFacts.proofTranscriptDigestB64u,
 		keyHandle,
 		signingRootId: prepare.signingRootId,
 		signingRootVersion: prepare.signingRootVersion,
@@ -936,19 +853,14 @@ function mergeRouterServerTiming(target, header) {
 		}
 	}
 }
-function recordRegistrationServerTiming(sink, name, startedAtMs) {
-	sink.push([name, Math.max(0, Date.now() - startedAtMs)]);
-}
-async function recordRegistrationPromiseTiming(args) {
-	try {
-		return await args.promise;
-	} finally {
-		recordRegistrationServerTiming(args.sink, args.name, args.startedAtMs);
-	}
-}
 var CloudflareD1WalletRegistrationService = class {
 	constructor(input) {
+		this.home = input.home;
+		this.executionAuthority = input.executionAuthority;
+		this.registrationAuthority = input.registrationAuthority;
+		this.startRegistrationWallets = input.startRegistrationWallets;
 		this.authorizationService = input.authorizationService;
+		this.registrationSessionStore = input.registrationSessionStore;
 		this.authorizationTenantId = input.authorizationTenantId;
 		this.createSponsoredNamedNearAccount = input.createSponsoredNamedNearAccount;
 		this.emailOtpRegistrationEnrollmentFinalizer = input.emailOtpRegistrationEnrollmentFinalizer;
@@ -958,7 +870,7 @@ var CloudflareD1WalletRegistrationService = class {
 		this.tenantRootCustodyLineage = input.tenantRootCustodyLineage;
 		this.getWalletStore = input.getWalletStore;
 		this.activateSideEffects = input.activateSideEffects;
-		this.nearProvisioningSideEffects = input.nearProvisioningSideEffects;
+		this.registrationRead = input.registrationRead;
 		this.walletRegistrationCommitStore = input.walletRegistrationCommitStore;
 		this.walletCustodyCommitStore = input.walletCustodyCommitStore;
 		this.walletAuthMethods = input.walletAuthMethods;
@@ -968,7 +880,7 @@ var CloudflareD1WalletRegistrationService = class {
 	async resolveEd25519MaterialActivation(input) {
 		try {
 			const walletId = walletIdFromString(input.walletId);
-			const signer = await this.getWalletStore().getEd25519SignerByMaterialActivation({
+			const signer = input.signerRead ? input.signerRead.resolve(walletId, input.materialActivation) : await this.getWalletStore().getEd25519SignerByMaterialActivation({
 				walletId,
 				materialActivation: input.materialActivation
 			});
@@ -1029,14 +941,15 @@ var CloudflareD1WalletRegistrationService = class {
 					exportIdentity: await ed25519ExportIdentityFromLinkedProjection(projection, active.capability)
 				};
 			}
-			const active = await yaoRuntime.resolveActiveCapability({
+			const lookup = {
 				kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
 				walletId: input.walletId,
 				nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
 				signerSlot: signer.signerSlot,
 				signingWorkerId: signer.signingWorkerId,
 				participantIds: signer.participantIds
-			});
+			};
+			const active = input.signerRead?.resolveActiveCapability(lookup) ?? await yaoRuntime.resolveActiveCapability(lookup);
 			if (!active.ok) {
 				if (active.code === "unknown_capability") {
 					if (!sameRouterAbMpcMaterialActivationRef(signer.activeYaoCapability.activationResult.binding.material_activation, input.materialActivation)) return {
@@ -1202,8 +1115,15 @@ var CloudflareD1WalletRegistrationService = class {
 				code: "not_found",
 				message: "ECDSA tenant root is not active"
 			};
+			const home = await this.executionAuthority.admitEstablishedHome({ walletId: walletIdFromString(input.walletId) });
+			if (!home.ok) return {
+				ok: false,
+				code: "invalid_state",
+				message: home.message
+			};
 			return {
 				ok: true,
+				ownershipGeneration: home.ownershipGeneration,
 				...tenantRoot
 			};
 		} catch (error) {
@@ -1664,148 +1584,14 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	/**
-	* `/wallets/register/setup` — grant, intent, and start in one request, with
-	* one D1 write.
-	*
-	* Setup runs before the client's WebAuthn create, because it issues the
-	* challenge that create signs. So the ECDSA prepare and the Ed25519
-	* admission — the two Router calls that dominated the measured cold path —
-	* overlap the authenticator prompt instead of being serialized after it.
-	* They are started before either is awaited: they share no state and neither
-	* can invalidate the other.
-	*/
 	async setupWalletRegistration(input) {
-		const timing = createD1RegistrationRouteTimingRecorder("wallets_register_setup");
-		const total = startD1RegistrationRouteTiming("registerSetupTotalMs");
-		try {
-			const normalized = normalizeWalletRegistrationSetupRequest(input.request);
-			if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
-			const wallet = resolveWalletRegistrationSetupWalletId({
-				wallet: input.request?.wallet,
-				parseProvided: parseWalletIdForIntent,
-				createServerAllocated: createD1ServerAllocatedWalletId
-			});
-			if (!wallet.ok) return walletRegistrationSetupError(wallet.code, wallet.message);
-			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot({
-				orgId: input.orgId,
-				signingRootId: input.signingRootId,
-				signingRootVersion: input.signingRootVersion
-			});
-			const signingRootId = normalizeOptionalTrimmedString(input.signingRootId) || (runtimePolicyScope ? deriveSigningRootId(runtimePolicyScope) : "");
-			const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion) || runtimePolicyScope?.signingRootVersion || "default";
-			if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
-			const registrationOperation = allocateWalletRegistrationOperationPrepared();
-			const intent = buildRegistrationIntent({
-				walletId: wallet.walletId,
-				authMethod: normalized.authMethod,
-				signerSelection: normalized.signerSelection,
-				foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
-				...runtimePolicyScope ? { runtimePolicyScope } : {}
-			});
-			const digestB64u = await walletRegistrationSetupIntentDigest(intent);
-			const branches = registrationIntentSignerBranches(intent);
-			if (!branches.ok) return walletRegistrationSetupError(branches.code, branches.message);
-			const ecdsaBranch = branches.value.evmFamilyEcdsa;
-			const nearEd25519Branch = branches.value.nearEd25519;
-			if (!ecdsaBranch && !nearEd25519Branch) return walletRegistrationSetupError("invalid_body", "registration signer branch is required");
-			const preparedContext = resolveRegistrationPreparedContextFromPlan({
-				signerPlan: branches.value.plan,
-				runtimePolicyScope,
-				signingRootId,
-				signingRootVersion
-			});
-			if (!preparedContext.ok) return walletRegistrationSetupError(preparedContext.code, preparedContext.message);
-			if (ecdsaBranch && !runtimePolicyScope) return walletRegistrationSetupError("invalid_body", "ECDSA registration requires an exact runtime policy scope");
-			const chainTargets = ecdsaBranch ? registrationPreparedContextEcdsaChainTargets(preparedContext.preparedContext) : null;
-			if (ecdsaBranch && !chainTargets) return walletRegistrationSetupError("invalid_body", "ECDSA chain targets are required");
-			const expiresAtMs = walletRegistrationSetupExpiresAtMs(Date.now());
-			const { registrationCeremonyId, registrationPreparationId } = walletRegistrationSetupIds();
-			const ecdsaPrepared = ecdsaBranch && chainTargets && runtimePolicyScope ? await buildD1EvmFamilyEcdsaRegistrationPrepare({
-				registrationPurpose: "wallet_registration",
-				registrationCeremonyId,
-				registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
-				walletId: wallet.walletId,
-				signingRootId,
-				signingRootVersion,
-				chainTargets,
-				participantIds: [...ecdsaBranch.participantIds],
-				strictRegistration: this.ecdsaStrictRegistration,
-				runtimePolicyScope
-			}) : null;
-			if (ecdsaPrepared && !ecdsaPrepared.ok) return walletRegistrationSetupError(ecdsaPrepared.code, ecdsaPrepared.message);
-			const storedBranches = [];
-			if (ecdsaPrepared?.ok && ecdsaBranch) storedBranches.push(buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch({
-				branchKey: ecdsaBranch.branchKey,
-				ecdsa: {
-					kind: ecdsaPrepared.ecdsa.kind,
-					chainTargets: ecdsaPrepared.ecdsa.chainTargets,
-					prepare: ecdsaPrepared.ecdsa.prepare,
-					strictRegistration: ecdsaPrepared.ecdsa.strictRegistration,
-					strictRegistrationBindingJson: routerAbEcdsaStrictRegistrationFactsBindingJson(ecdsaPrepared.ecdsa.strictRegistration)
-				}
-			}));
-			const ceremony = {
-				registrationCeremonyId,
-				foundingWalletAuthorityId: registrationOperation.walletAuthorityId,
-				foundingDeviceId: registrationOperation.deviceId,
-				foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
-				intent,
-				digestB64u,
-				signerPlan: branches.value.plan,
-				preparedContext: preparedContext.preparedContext,
-				orgId: normalizeOptionalTrimmedString(input.orgId) || "",
-				signingRootId,
-				signingRootVersion,
-				...input.expectedOrigin ? { expectedOrigin: input.expectedOrigin } : {},
-				expiresAtMs,
-				authorityState: {
-					kind: "awaiting_proof",
-					authMethod: normalized.authMethod
-				},
-				signerState: {
-					kind: "signer_set_registration",
-					branches: storedBranches
-				}
-			};
-			const ceremonyWriteTiming = startD1RegistrationRouteTiming("registrationCeremonyInsertMs");
-			try {
-				await this.getRegistrationCeremonyIntentStore().putCeremony(ceremony);
-			} finally {
-				finishD1RegistrationRouteTiming(timing, ceremonyWriteTiming);
-			}
-			const { signedSetup } = await buildWalletRegistrationSetupSignature({
-				signer: input.signer,
-				ceremony,
-				expectedOrigin: input.expectedOrigin
-			});
-			finishD1RegistrationRouteTiming(timing, total);
-			const success = {
-				ok: true,
-				registrationCeremonyId,
-				walletId: String(wallet.walletId),
-				walletAuthMethodId: registrationOperation.walletAuthMethodId,
-				registrationIntentDigestB64u: digestB64u,
-				intent,
-				signedSetup
-			};
-			if (!ecdsaPrepared?.ok || !ecdsaBranch) return {
-				...success,
-				kind: "near_ed25519"
-			};
-			return {
-				...success,
-				kind: nearEd25519Branch ? "near_ed25519_and_evm_family_ecdsa" : "evm_family_ecdsa",
-				ecdsa: {
-					kind: ecdsaPrepared.ecdsa.kind,
-					chainTargets: ecdsaPrepared.ecdsa.chainTargets,
-					prepare: ecdsaPrepared.ecdsa.prepare,
-					strictRegistration: ecdsaPrepared.ecdsa.strictRegistration
-				}
-			};
-		} catch (error) {
-			return walletRegistrationSetupError("internal", errorMessage(error) || "Failed to set up wallet registration");
-		}
+		return executeD1WalletRegistrationSetup(input, {
+			home: this.home,
+			reservation: this.registrationAuthority,
+			store: this.getRegistrationCeremonyIntentStore(),
+			ecdsaStrictRegistration: this.ecdsaStrictRegistration,
+			startRegistrationWallets: this.startRegistrationWallets
+		});
 	}
 	async authorizeWalletRegistrationNearAdmission(input) {
 		try {
@@ -1847,6 +1633,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verifiedSetup.code,
 				message: verifiedSetup.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: ceremony.registrationCeremonyId,
+				walletId: ceremony.intent.walletId
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
 			if (!registrationBearerToken) return {
 				ok: false,
@@ -1877,7 +1668,8 @@ var CloudflareD1WalletRegistrationService = class {
 				ceremony,
 				branch: branches.nearEd25519,
 				authority: verifiedAuthority.authority,
-				registrationBearerToken
+				registrationBearerToken,
+				ownershipGeneration: homeAdmission.ownershipGeneration
 			});
 			if (!admitted.ok) return admitted;
 			if (!admitted.deferred) return {
@@ -1906,9 +1698,19 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
+			const verifiedSetup = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
+				registrationCeremonyId: input.registrationCeremonyId,
+				nowMs: Date.now()
+			});
+			if (!verifiedSetup.ok) return verifiedSetup;
 			const loadStartedAtMs = Date.now();
-			const snapshot = await store.getCeremonySnapshot(input.registrationCeremonyId);
+			const homeAdmission = await this.registrationRead.readRespond({
+				ceremonyId: verifiedSetup.claims.registrationCeremonyId,
+				walletId: walletIdFromString(verifiedSetup.claims.walletId)
+			});
 			mark("ecdsa_respond_d1_load", loadStartedAtMs);
+			if (!homeAdmission.ok) return homeAdmission;
+			const snapshot = homeAdmission.snapshot;
 			if (!snapshot) return {
 				ok: false,
 				code: "not_found",
@@ -1930,24 +1732,23 @@ var CloudflareD1WalletRegistrationService = class {
 				signingRootVersion: normalizeOptionalTrimmedString(ceremony.signingRootVersion) || "",
 				expectedOrigin
 			});
-			const verifiedSetup = await verifySignedWalletRegistrationSetup(input.verifier, input.signedSetup, {
-				registrationCeremonyId: ceremony.registrationCeremonyId,
-				setupDigestB64u,
-				nowMs: Date.now()
-			});
-			if (!verifiedSetup.ok) return {
+			if (verifiedSetup.claims.setupDigestB64u !== setupDigestB64u || verifiedSetup.claims.walletId !== ceremony.intent.walletId) return {
 				ok: false,
-				code: verifiedSetup.code,
-				message: verifiedSetup.message
+				code: "invalid_grant",
+				message: "signedSetup does not match this registration setup"
 			};
+			const ecdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+			const planNearEd25519 = registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519;
+			const startedDispatchRoot = !ecdsaBranch && planNearEd25519 && !storedRespondEd25519DeferredWork(ceremony.signerState) ? this.getEd25519YaoProductRegistration()?.startRegistrationDispatchRoot({
+				signing_root_id: normalizeOptionalTrimmedString(ceremony.signingRootId) || "",
+				root_share_epoch: normalizeOptionalTrimmedString(ceremony.signingRootVersion) || ""
+			}) ?? null : null;
 			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
 			if (!registrationBearerToken) return {
 				ok: false,
 				code: "invalid_body",
 				message: "signedSetup is required"
 			};
-			const ecdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
-			const planNearEd25519 = registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519;
 			if (!ecdsaBranch && !planNearEd25519) return {
 				ok: false,
 				code: "invalid_state",
@@ -1965,6 +1766,8 @@ var CloudflareD1WalletRegistrationService = class {
 				branch: planNearEd25519,
 				authorityInput: input.authority,
 				registrationBearerToken,
+				ownershipGeneration: homeAdmission.ownershipGeneration,
+				startedDispatchRoot,
 				expectedOrigin,
 				...input.userAgent ? { userAgent: input.userAgent } : {}
 			});
@@ -2078,6 +1881,7 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "ECDSA response claim is invalid"
 			};
 			const tenantRoot = {
+				ownershipGeneration: homeAdmission.ownershipGeneration,
 				projectEnvironmentId: claimedBranch.projectEnvironmentId,
 				identityDigestB64u: claimedBranch.tenantRootIdentityDigestB64u,
 				custodyLineageB64u: claimedBranch.tenantRootCustodyLineageB64u
@@ -2099,14 +1903,22 @@ var CloudflareD1WalletRegistrationService = class {
 				ceremony,
 				branch: nearEd25519Branch,
 				authority,
-				registrationBearerToken
+				registrationBearerToken,
+				ownershipGeneration: homeAdmission.ownershipGeneration
 			})]);
 			mark("ecdsa_respond_router", routerStartedAtMs);
 			if (!strictResult.ok) {
-				if (!strictResult.retryable) await store.cancelTerminalCeremony({
-					registrationCeremonyId: ceremony.registrationCeremonyId,
-					walletId: ceremony.intent.walletId
-				});
+				if (!strictResult.retryable) {
+					const completedHome = await cancelRegistrationHome(this.registrationAuthority, {
+						ceremonyId: ceremony.registrationCeremonyId,
+						walletId: ceremony.intent.walletId
+					});
+					if (!completedHome.ok) return completedHome;
+					await store.cancelTerminalCeremony({
+						registrationCeremonyId: ceremony.registrationCeremonyId,
+						walletId: ceremony.intent.walletId
+					});
+				}
 				return {
 					ok: false,
 					code: strictResult.code,
@@ -2178,34 +1990,6 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	/**
-	* The Ed25519 commit core, extracted so deferred provisioning reaches it
-	* without going through the standalone finalize wrapper. The operation row
-	* owns idempotency here, so the commit keeps no replay cache of its own.
-	*/
-	async readRegistrationOwnerProofContext(registrationCeremonyId) {
-		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
-		if (!ceremony) {
-			const committed = await this.readCommittedRegistrationInstallation(registrationCeremonyId);
-			if (!committed) return null;
-			if (!isRegistrationEcdsaReadyReceipt(committed.receipt)) throw new Error("Committed registration installation has no ECDSA session receipt");
-			const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(committed.projection.preparedContext);
-			if (!runtimePolicyScope) throw new Error("Committed registration is missing its runtime policy scope");
-			return {
-				expectedOrigin: committed.receipt.expectedOrigin,
-				runtimePolicyScope,
-				expiresAtMs: committed.receipt.expiresAtMs
-			};
-		}
-		const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
-		const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
-		if (!expectedOrigin || !runtimePolicyScope) throw new Error("Registration is missing its session origin or runtime policy scope");
-		return {
-			expectedOrigin,
-			runtimePolicyScope,
-			expiresAtMs: ceremony.expiresAtMs
-		};
-	}
 	/** For callers that must read the context before finalize tombstones it. */
 	async registrationOwnerProofWithContext(context, input) {
 		return await buildRegistrationOwnerProof({
@@ -2228,7 +2012,7 @@ var CloudflareD1WalletRegistrationService = class {
 			nowMs
 		});
 		if (!issued) return null;
-		const active = await this.walletAuthMethods.readActiveRegistrationAuthority(installation.projection.registrationAuthority);
+		const active = await this.walletAuthMethods.readActiveRegistrationIdentity(installation.projection.registrationAuthority);
 		if (!active || issued.session.walletId !== installation.projection.walletId || issued.session.authorityId !== installation.receipt.foundingAuthority.authorityId || issued.session.walletAuthMethodId !== installation.receipt.walletAuthMethodId || active.walletAuthMethodId !== issued.session.walletAuthMethodId || active.authority.authorityId !== issued.session.authorityId || active.authority.authorityDigestB64u !== issued.session.authorityDigestB64u || active.authority.revocationEpoch !== issued.session.authorityRevocationEpoch || active.authority.revocationEpoch !== installation.receipt.foundingAuthority.revocationEpoch || issued.session.expiresAtMs <= nowMs) return null;
 		const originalSubjects = installation.receipt.committed.session.walletSession.capabilitySubjects;
 		for (const subject of originalSubjects) if (!issued.session.capabilitySubjects.some(sameRegistrationContinuationSubject.bind(void 0, subject))) return null;
@@ -2269,64 +2053,70 @@ var CloudflareD1WalletRegistrationService = class {
 		});
 		const nearPlan = projection.signerPlan.branches.find((branch) => branch.kind === "near_ed25519");
 		const ecdsaPlan = projection.signerPlan.branches.find((branch) => branch.kind === "evm_family_ecdsa");
-		if (projection.registrationCeremonyId !== registrationCeremonyId || projection.walletId !== receipt.walletId || projection.registrationAuthority.walletId !== receipt.walletId || projection.orgId !== (projection.preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? projection.preparedContext.runtimePolicy.scope.orgId : "") || !nearPlan || !ecdsaPlan || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, projection.preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? projection.preparedContext.ecdsa.chainTargets : []) || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, receipt.committed.ecdsa.walletKeys.map((walletKey) => walletKey.chainTarget)) || receipt.committed.ecdsa.walletKeys.some((walletKey) => walletKey.walletId !== String(receipt.walletId) || walletKey.signingRootId !== projection.preparedContext.signingRootId || walletKey.signingRootVersion !== projection.preparedContext.signingRootVersion || walletKey.participantIds.length !== ecdsaPlan.participantIds.length || walletKey.participantIds.some((participantId, index) => participantId !== ecdsaPlan.participantIds[index])) || projection.nearEd25519.branchKey !== nearPlan.branchKey || projection.nearEd25519.admissionRequest.scope.lifecycle_id !== registrationCeremonyId || projection.nearEd25519.admissionRequest.scope.account_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.scope.root_share_epoch !== projection.preparedContext.signingRootVersion || projection.nearEd25519.admissionRequest.scope.signer_set_id !== String(nearPlan.branchKey) || projection.nearEd25519.admissionRequest.application_binding.wallet_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.application_binding.signing_root_id !== projection.preparedContext.signingRootId || projection.nearEd25519.admissionRequest.application_binding.key_creation_signer_slot !== nearPlan.signerSlot || projection.nearEd25519.admissionRequest.participant_ids.length !== nearPlan.participantIds.length || projection.nearEd25519.admissionRequest.participant_ids.some((participantId, index) => participantId !== nearPlan.participantIds[index]) || !walletAuthAuthoritiesMatch(derivedAuthority, receipt.authority) || record.prepared.walletAuthorityId !== receipt.foundingAuthority.authorityId || record.prepared.deviceId !== foundingDeviceId || record.prepared.walletAuthMethodId !== receipt.walletAuthMethodId) throw new Error("registration activation receipt installation identity is invalid");
+		if (projection.registrationCeremonyId !== registrationCeremonyId || projection.walletId !== receipt.walletId || projection.registrationAuthority.walletId !== receipt.walletId || projection.orgId !== (projection.preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? projection.preparedContext.runtimePolicy.scope.orgId : "") || !nearPlan || !ecdsaPlan || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, projection.preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? projection.preparedContext.ecdsa.chainTargets : []) || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, receipt.committed.ecdsa.walletKeys.map((walletKey) => walletKey.chainTarget)) || receipt.committed.ecdsa.walletKeys.some((walletKey) => walletKey.walletId !== String(receipt.walletId) || walletKey.signingRootId !== projection.preparedContext.signingRootId || walletKey.signingRootVersion !== projection.preparedContext.signingRootVersion || walletKey.participantIds.length !== ecdsaPlan.participantIds.length || walletKey.participantIds.some((participantId, index) => participantId !== ecdsaPlan.participantIds[index])) || projection.nearEd25519.branchKey !== nearPlan.branchKey || projection.nearEd25519.admissionRequest.scope.lifecycle_id !== registrationCeremonyId || projection.nearEd25519.admissionRequest.scope.account_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.scope.root_share_epoch !== projection.preparedContext.signingRootVersion || projection.nearEd25519.admissionRequest.scope.signer_set_id !== String(nearPlan.branchKey) || projection.nearEd25519.admissionRequest.application_binding.wallet_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.application_binding.signing_root_id !== projection.preparedContext.signingRootId || projection.nearEd25519.admissionRequest.application_binding.key_creation_signer_slot !== nearPlan.signerSlot || projection.nearEd25519.admissionRequest.participant_ids.length !== nearPlan.participantIds.length || projection.nearEd25519.admissionRequest.participant_ids.some((participantId, index) => participantId !== nearPlan.participantIds[index]) || !walletAuthAuthoritiesMatch(derivedAuthority, receipt.authority) || record.prepared.walletId !== receipt.walletId || record.prepared.walletAuthorityId !== receipt.foundingAuthority.authorityId || record.prepared.deviceId !== foundingDeviceId || record.prepared.walletAuthMethodId !== receipt.walletAuthMethodId) throw new Error("registration activation receipt installation identity is invalid");
 		return {
 			receipt,
 			projection,
 			prepared: record.prepared
 		};
 	}
-	async prepareNearProvisioningOperation(registrationCeremonyId, allocated, installed) {
-		const ceremony = installed ? null : await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
+	/** Carries the preparation's ceremony into this request's execution. */
+	async prepareNearProvisioningOperation(registrationCeremonyId, allocated, source) {
+		const ceremony = source.kind === "ceremony" ? source.ceremony : null;
 		if (!ceremony) {
-			const committed = installed ?? await this.readCommittedRegistrationInstallation(registrationCeremonyId);
+			const committed = source.kind === "installation" ? source.installation : await this.readCommittedRegistrationInstallation(registrationCeremonyId);
 			if (!committed) throw new Error("Registration ceremony is unavailable for identity preparation");
-			if (allocated && (allocated.walletAuthorityId !== committed.prepared.walletAuthorityId || allocated.deviceId !== committed.prepared.deviceId || allocated.walletAuthMethodId !== committed.prepared.walletAuthMethodId)) throw new Error("registration operation identity does not match its committed installation");
-			return committed.prepared;
+			if (allocated && (allocated.walletId !== committed.prepared.walletId || allocated.walletAuthorityId !== committed.prepared.walletAuthorityId || allocated.deviceId !== committed.prepared.deviceId || allocated.walletAuthMethodId !== committed.prepared.walletAuthMethodId)) throw new Error("registration operation identity does not match its committed installation");
+			return {
+				prepared: committed.prepared,
+				ceremony: null
+			};
 		}
-		const prepared = allocated ?? walletRegistrationOperationPreparedFromCeremony(ceremony);
-		const authority = verifiedRegistrationCeremonyAuthority(ceremony);
-		if (!authority) return prepared;
-		const persisted = await this.walletAuthMethods.readActiveRegistrationIdentity(authority);
-		if (!persisted) return prepared;
 		return {
-			kind: prepared.kind,
-			walletAuthorityId: persisted.walletAuthorityId,
-			deviceId: prepared.deviceId,
-			walletAuthMethodId: persisted.walletAuthMethodId
+			prepared: walletRegistrationOperationPreparedFromCeremony(ceremony, allocated),
+			ceremony
 		};
 	}
 	async commitDeferredEd25519Signer(args, prepared) {
+		const sourceStartedAtMs = Date.now();
 		const committedInstallation = args.authoritySource.kind === "committed_mixed" ? args.authoritySource.installation : null;
 		if (committedInstallation && !isRegistrationEcdsaReadyReceipt(committedInstallation.receipt)) throw new Error("Committed mixed registration receipt is not ECDSA-ready");
-		const ownerProofContext = committedInstallation ? {
-			expectedOrigin: committedInstallation.receipt.expectedOrigin,
-			runtimePolicyScope: registrationPreparedContextRuntimePolicyScope(committedInstallation.projection.preparedContext),
-			expiresAtMs: committedInstallation.receipt.expiresAtMs
-		} : await this.readRegistrationOwnerProofContext(args.input.registrationCeremonyId);
-		if (!ownerProofContext) throw new Error("Registration owner proof context is unavailable");
-		if (!ownerProofContext.runtimePolicyScope) throw new Error("Committed registration is missing its runtime policy scope");
-		const ceremony = committedInstallation ? null : await this.getRegistrationCeremonyIntentStore().getCeremony(args.input.registrationCeremonyId);
-		let recovery = null;
-		let registrationAuthority;
+		const preparedCeremony = committedInstallation ? null : args.preparedCeremony();
+		const ceremony = committedInstallation || preparedCeremony ? preparedCeremony : await this.getRegistrationCeremonyIntentStore().getCeremony(args.input.registrationCeremonyId);
+		let source;
+		let ownerProofContext;
+		let effectivePrepared;
 		let sessionPredecessor;
 		if (ceremony) {
-			const authority = verifiedRegistrationCeremonyAuthority(ceremony);
-			if (!authority) throw new Error("Registration authority is unavailable before finalize");
-			registrationAuthority = authority;
+			source = {
+				kind: "stored_ceremony",
+				ceremony
+			};
+			ownerProofContext = registrationOwnerProofContextFromCeremony(ceremony);
+			if (!verifiedRegistrationCeremonyAuthority(ceremony)) throw new Error("Registration authority is unavailable before finalize");
 			sessionPredecessor = { kind: "ed25519_only" };
+			effectivePrepared = walletRegistrationOperationPreparedFromCeremony(ceremony, prepared);
 		} else {
 			const committed = committedInstallation ?? await this.readCommittedRegistrationInstallation(args.input.registrationCeremonyId);
 			if (!committed) throw new Error("Committed registration installation is unavailable");
-			recovery = registrationFinalizeRecoveryFromCommittedInstallation({
+			source = registrationFinalizeRecoveryFromCommittedInstallation({
 				setupClaims: args.setupClaims,
 				projection: committed.projection
 			});
-			const authority = verifiedRegistrationCeremonyAuthority(recovery.ceremony);
-			if (!authority) throw new Error("Committed registration installation has no verified authority");
-			registrationAuthority = authority;
+			if (!verifiedRegistrationCeremonyAuthority(source.ceremony)) throw new Error("Committed registration installation has no verified authority");
 			const activationReceipt = committed.receipt;
 			if (!isRegistrationEcdsaReadyReceipt(activationReceipt)) throw new Error("Committed mixed registration receipt is not ECDSA-ready");
+			const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(committed.projection.preparedContext);
+			if (!runtimePolicyScope) throw new Error("Committed registration is missing its runtime policy scope");
+			ownerProofContext = {
+				expectedOrigin: activationReceipt.expectedOrigin,
+				runtimePolicyScope,
+				expiresAtMs: activationReceipt.expiresAtMs
+			};
+			effectivePrepared = (await this.prepareNearProvisioningOperation(args.input.registrationCeremonyId, prepared, {
+				kind: "installation",
+				installation: committed
+			})).prepared;
 			if (activationReceipt.committed.session.tokens.kind !== "evm_family_ecdsa") throw new Error("Committed mixed registration is missing its ECDSA session projection");
 			if (args.input.authorization.kind === "wallet_session") {
 				const authorization = args.authoritySource.kind === "committed_mixed" ? args.authoritySource.authorization : null;
@@ -2341,57 +2131,100 @@ var CloudflareD1WalletRegistrationService = class {
 				ecdsa: activationReceipt.committed.session.tokens.ecdsa
 			};
 		}
-		const effectivePrepared = await this.prepareNearProvisioningOperation(args.input.registrationCeremonyId, prepared, committedInstallation ?? void 0);
-		const committed = await this.executeWalletRegistrationFinalize({
-			kind: "near_ed25519",
-			registrationCeremonyId: args.input.registrationCeremonyId,
-			idempotencyKey: args.input.idempotencyKey,
-			ed25519: args.input.ed25519,
-			emailOtpEnrollment: args.input.emailOtpEnrollment,
-			walletCustodyCommit: args.input.walletCustodyCommit
-		}, effectivePrepared, recovery);
-		const finalized = committed.ok ? committed : throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(committed);
-		if (!finalized.ok || finalized.kind !== "near_ed25519") return unissuedRegistrationCommit(finalized);
+		recordRegistrationServerTiming(args.serverTiming, "near_finalize_source", sourceStartedAtMs);
+		const ceremonyAuthority = verifiedRegistrationCeremonyAuthority(source.ceremony);
+		if (!ceremonyAuthority) throw new Error("Registration authority is unavailable before finalize");
+		const sessionAuthority = registrationWalletAuthAuthority({
+			authority: ceremonyAuthority,
+			walletAuthMethodId: effectivePrepared.walletAuthMethodId
+		});
 		const proof = await buildRegistrationOwnerProof({
 			registrationCeremonyId: args.input.registrationCeremonyId,
-			authMethod: finalized.authMethod,
-			authority: finalized.authority,
+			authMethod: walletRegistrationFinalizeAuthMethodFromAuthority(ceremonyAuthority),
+			authority: sessionAuthority,
 			tenantId: this.authorizationTenantId,
 			expectedOrigin: ownerProofContext.expectedOrigin,
 			expiresAtMs: args.input.authorization.kind === "wallet_session" ? args.setupClaims.expiresAtMs : ownerProofContext.expiresAtMs
 		});
-		const issuedRegistrationSession = await issueDirectRegistrationEstablishedEd25519Session({
-			authorizationService: this.authorizationService,
-			authorizationTenantId: this.authorizationTenantId,
-			walletAuthMethods: this.walletAuthMethods,
+		const initialSessionPlan = sessionPredecessor.kind === "ed25519_only" && !registrationSignerBranchesFromPlan(source.ceremony.signerPlan).evmFamilyEcdsa ? {
+			kind: "initial_near",
+			store: this.registrationSessionStore,
+			request: {
+				authorizationService: this.authorizationService,
+				authorizationTenantId: this.authorizationTenantId,
+				registrationCeremonyId: args.input.registrationCeremonyId,
+				authority: sessionAuthority,
+				walletAuthMethodId: effectivePrepared.walletAuthMethodId,
+				expiresAtMs: Date.now() + DEFAULT_WALLET_SESSION_TTL_MS,
+				remainingUses: 3,
+				proof
+			}
+		} : { kind: "separate" };
+		const execution = await this.executeWalletRegistrationFinalize({
+			kind: "near_ed25519",
 			registrationCeremonyId: args.input.registrationCeremonyId,
-			authority: finalized.authority,
-			registrationAuthority,
-			walletAuthMethodId: effectivePrepared.walletAuthMethodId,
-			expiresAtMs: Date.now() + DEFAULT_WALLET_SESSION_TTL_MS,
-			remainingUses: 3,
-			publicResult: finalized.ed25519,
-			predecessor: sessionPredecessor,
-			keyManifestDigestB64u: finalized.custodyKeyManifestDigestB64u,
-			proof
-		});
+			idempotencyKey: args.input.idempotencyKey,
+			ed25519: args.input.ed25519,
+			emailOtpEnrollment: args.input.emailOtpEnrollment,
+			walletCustodyCommit: args.input.walletCustodyCommit
+		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision);
+		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
+		const finalized = execution.finalized;
+		if (finalized.kind !== "near_ed25519") {
+			await execution.custody;
+			return unissuedRegistrationCommit({
+				ok: false,
+				code: "internal",
+				message: "NEAR provisioning committed a non-NEAR branch"
+			});
+		}
+		if (!this.registrationAuthority) throw new Error("Registration home completion is unavailable");
+		const [issuance, custody] = await Promise.allSettled([recordRegistrationPromiseTiming({
+			sink: args.serverTiming,
+			name: "near_finalize_session_issue",
+			startedAtMs: Date.now(),
+			promise: issueDirectRegistrationEstablishedEd25519Session({
+				homeCompletion: this.registrationAuthority,
+				authorizationService: this.authorizationService,
+				authorizationTenantId: this.authorizationTenantId,
+				foundingAuthority: finalized.foundingAuthority,
+				registrationCeremonyId: args.input.registrationCeremonyId,
+				authority: finalized.authority,
+				walletAuthMethodId: effectivePrepared.walletAuthMethodId,
+				expiresAtMs: Date.now() + DEFAULT_WALLET_SESSION_TTL_MS,
+				remainingUses: 3,
+				publicResult: finalized.ed25519,
+				predecessor: sessionPredecessor,
+				initialSession: execution.initialSession,
+				keyManifestDigestB64u: finalized.custodyKeyManifestDigestB64u,
+				proof,
+				onSessionCommitted: finalized.authMethod.kind === "passkey" ? args.input.onSessionCommitted : void 0
+			})
+		}), execution.custody]);
+		if (issuance.status === "rejected") throw issuance.reason;
+		if (custody.status === "rejected") throw custody.reason;
+		const issuedRegistrationSession = issuance.value;
+		const custodyField = custody.value.status === "not_requested" ? {} : { walletCustody: custody.value };
 		switch (issuedRegistrationSession.kind) {
 			case "issued": return {
 				kind: "session_issued",
 				response: {
 					...finalized,
+					...custodyField,
 					registrationEstablishedSession: {
 						kind: "issued",
 						session: issuedRegistrationSession.session
 					}
 				},
 				issuedAtMs: issuedRegistrationSession.issuedAtMs,
-				expectedOrigin: ownerProofContext.expectedOrigin
+				expectedOrigin: ownerProofContext.expectedOrigin,
+				activation: issuedRegistrationSession.activation
 			};
 			case "already_committed": return {
 				kind: "session_issued",
 				response: {
 					...finalized,
+					...custodyField,
 					registrationEstablishedSession: {
 						kind: "already_committed",
 						session: issuedRegistrationSession.session,
@@ -2399,7 +2232,8 @@ var CloudflareD1WalletRegistrationService = class {
 					}
 				},
 				issuedAtMs: issuedRegistrationSession.issuedAtMs,
-				expectedOrigin: ownerProofContext.expectedOrigin
+				expectedOrigin: ownerProofContext.expectedOrigin,
+				activation: issuedRegistrationSession.activation
 			};
 			default: return assertNeverD1RegistrationSessionIssuance(issuedRegistrationSession);
 		}
@@ -2408,29 +2242,6 @@ var CloudflareD1WalletRegistrationService = class {
 		if (receipt.operation !== "registration_activate") throw new Error("Registration activation receipt operation is invalid");
 		switch (receipt.committed.kind) {
 			case "error": return replayedRegistrationCommit(receipt.committed.error);
-			case "near_pending": {
-				if (!isRegistrationNearPendingReceipt(receipt)) throw new Error("Registration pending receipt branch is invalid");
-				const authMethod = registrationReplayAuthMethodFields(receipt);
-				if (authMethod.kind === "passkey") return replayedRegistrationCommit({
-					ok: true,
-					kind: "near_ed25519",
-					walletId: receipt.walletId,
-					authority: receipt.authority,
-					authMethod: authMethod.authMethod,
-					rpId: authMethod.rpId,
-					...receipt.registrationDiagnostics ? { registrationDiagnostics: receipt.registrationDiagnostics } : {},
-					nearProvisioning: { status: "near_pending" }
-				});
-				return replayedRegistrationCommit({
-					ok: true,
-					kind: "near_ed25519",
-					walletId: receipt.walletId,
-					authority: receipt.authority,
-					authMethod: authMethod.authMethod,
-					...receipt.registrationDiagnostics ? { registrationDiagnostics: receipt.registrationDiagnostics } : {},
-					nearProvisioning: { status: "near_pending" }
-				});
-			}
 			case "ecdsa_ready": {
 				if (!isRegistrationEcdsaReadyReceipt(receipt)) throw new Error("Registration activation receipt branch is invalid");
 				const registrationEstablishedSession = replayDirectRegistrationEstablishedEcdsaSession(receipt);
@@ -2499,15 +2310,7 @@ var CloudflareD1WalletRegistrationService = class {
 			authMethod: authMethod.authMethod
 		});
 	}
-	/**
-	* Deferred NEAR provisioning. Verifies the signed setup, then reuses the
-	* existing deferred Ed25519 commit — the same path lazy-Yao 4+5 built — so
-	* signer installation and the implicit-account projection keep one
-	* implementation across both plans.
-	*
-	* A retryable failure leaves the pending wallet intact: the wallet must not
-	* be destroyed because its signer ceremony needs another attempt.
-	*/
+	/** Verifies registration or continuation authority without destroying retryable state. */
 	async verifyNearProvisioningAuthority(input) {
 		if (input.authorization.kind === "registration_grant") {
 			const verified = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
@@ -2553,7 +2356,7 @@ var CloudflareD1WalletRegistrationService = class {
 			}
 		};
 	}
-	async completeWalletRegistrationNearProvisioning(input, timingSink) {
+	async completeWalletRegistrationNearProvisioning(input, timingSink, waitUntil) {
 		const serverTiming = timingSink ?? [];
 		const totalStartedAtMs = Date.now();
 		try {
@@ -2565,6 +2368,14 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verified.code,
 				message: verified.message
 			};
+			const admissionStartedAtMs = Date.now();
+			const operationKey = `near-provisioning:${input.registrationCeremonyId}:${input.idempotencyKey}`;
+			const initial = await this.registrationRead.readFinalization({
+				ceremonyId: verified.claims.registrationCeremonyId,
+				walletId: walletIdFromString(verified.claims.walletId)
+			}, operationKey);
+			recordRegistrationServerTiming(serverTiming, "near_finalize_initial_read", admissionStartedAtMs);
+			if (!initial.ok) return initial;
 			const fingerprintStartedAtMs = Date.now();
 			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
 				version: "wallet_registration_near_provisioning_digest_v1",
@@ -2576,19 +2387,34 @@ var CloudflareD1WalletRegistrationService = class {
 			})));
 			recordRegistrationServerTiming(serverTiming, "near_finalize_fingerprint", fingerprintStartedAtMs);
 			const sideEffectStartedAtMs = Date.now();
-			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.nearProvisioningSideEffects, {
+			let preparedCeremony = null;
+			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.registrationRead.operations, {
 				kind: "prepared_resumable",
 				operation: "near_provisioning",
-				key: `near-provisioning:${input.registrationCeremonyId}:${input.idempotencyKey}`,
+				key: operationKey,
+				initialRecord: initial.operation,
 				requestFingerprint,
 				resumeAfterMs: D1_WALLET_REGISTRATION_OPERATION_RESUME_AFTER_MS,
 				nowMs: Date.now,
-				prepare: async () => await this.prepareNearProvisioningOperation(input.registrationCeremonyId, void 0, verified.source.kind === "committed_mixed" ? verified.source.installation : void 0),
+				prepare: async () => {
+					const preparation = await this.prepareNearProvisioningOperation(input.registrationCeremonyId, null, verified.source.kind === "committed_mixed" ? {
+						kind: "installation",
+						installation: verified.source.installation
+					} : {
+						kind: "ceremony",
+						ceremony: await initial.readCeremony()
+					});
+					preparedCeremony = preparation.ceremony;
+					return preparation.prepared;
+				},
 				derivePreparedArtifactFingerprint: async (prepared) => base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared))),
 				execute: this.commitDeferredEd25519Signer.bind(this, {
 					input,
+					serverTiming,
 					setupClaims: verified.claims,
-					authoritySource: verified.source
+					authoritySource: verified.source,
+					preparedCeremony: () => preparedCeremony,
+					lifecycleDecision: initial.decision
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "near_provisioning",
@@ -2596,6 +2422,7 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: input.registrationCeremonyId,
 					execution
 				}),
+				completionWrite: registrationCommitActivation,
 				replay: this.replayWalletRegistrationNearProvisioningCommit.bind(this)
 			});
 			recordRegistrationServerTiming(serverTiming, "near_finalize_side_effect", sideEffectStartedAtMs);
@@ -2651,6 +2478,7 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: input.registrationCeremonyId
 				})
 			});
+			if (waitUntil) waitUntil(cleanup);
 			if (input.authorization.kind === "wallet_session") {
 				const projectionStartedAtMs = Date.now();
 				const [current] = await Promise.all([recordRegistrationPromiseTiming({
@@ -2662,7 +2490,7 @@ var CloudflareD1WalletRegistrationService = class {
 						token: input.authorization.credential,
 						nowMs: Date.now()
 					})
-				}), cleanup]);
+				}), waitUntil ? void 0 : cleanup]);
 				const tokens = committed.registrationEstablishedSession.session.tokens;
 				if (!current || tokens.kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("NEAR continuation Wallet Session is no longer active");
 				recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);
@@ -2676,7 +2504,7 @@ var CloudflareD1WalletRegistrationService = class {
 					nearProvisioning: { status: "near_ready" }
 				};
 			}
-			await cleanup;
+			if (!waitUntil) await cleanup;
 			recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);
 			return {
 				...committed,
@@ -2693,100 +2521,6 @@ var CloudflareD1WalletRegistrationService = class {
 		}
 	}
 	/**
-	* Persists the Ed25519-only wallet in `near_pending`: wallet, profile, and
-	* authentication state, and no signer record — the signer does not exist
-	* until deferred Yao produces it.
-	*
-	* The terminal response carries no signer, resolved account, or key
-	* identity, because none of those are known yet. Reporting them would be
-	* fabricating readiness.
-	*/
-	async commitEd25519PendingWallet(input) {
-		const now = Date.now();
-		const ceremony = input.ceremony;
-		const authority = input.authority;
-		const wallet = buildD1WalletRecord({
-			walletId: ceremony.intent.walletId,
-			now
-		});
-		const walletAuthAuthority = registrationWalletAuthAuthority({
-			authority,
-			walletAuthMethodId: input.walletAuthMethodId
-		});
-		switch (authority.kind) {
-			case "passkey":
-				await this.walletRegistrationCommitStore.commit({
-					kind: "passkey_wallet_registration_commit_v1",
-					wallet,
-					walletSigners: [],
-					authority,
-					now,
-					decisionStatements: []
-				});
-				break;
-			case "email_otp": {
-				const enrollment = await this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationFinalize({
-					authority,
-					request: input.enrollment,
-					walletId: ceremony.intent.walletId,
-					orgId: ceremony.orgId,
-					nowMs: now
-				});
-				if (!enrollment.ok) return enrollment;
-				if (!enrollment.persistence) return {
-					ok: false,
-					code: "invalid_state",
-					message: "Email OTP registration is missing enrollment persistence state"
-				};
-				await this.walletRegistrationCommitStore.commit({
-					kind: "email_otp_wallet_registration_commit_v1",
-					wallet,
-					walletSigners: [],
-					authority,
-					emailOtp: this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(enrollment.persistence),
-					now,
-					decisionStatements: []
-				});
-				const completedIdentity = await this.emailOtpRegistrationEnrollmentFinalizer.completeRegistrationIdentity({
-					authority,
-					walletId: ceremony.intent.walletId
-				});
-				if (!completedIdentity.ok) return completedIdentity;
-				break;
-			}
-		}
-		const authMethod = walletRegistrationFinalizeAuthMethodFromAuthority(authority);
-		if (authMethod.kind === "passkey") {
-			if (!isPasskeyWalletAuthAuthority(walletAuthAuthority)) return {
-				ok: false,
-				code: "internal",
-				message: "Passkey registration returned a different authority"
-			};
-			return buildWalletRegistrationActivatePendingPasskeyResponse({
-				walletId: ceremony.intent.walletId,
-				authority: walletAuthAuthority,
-				authMethod,
-				rpId: finalizePasskeyRpId(authority)
-			});
-		}
-		if (!isEmailOtpWalletAuthAuthority(walletAuthAuthority)) return {
-			ok: false,
-			code: "internal",
-			message: "Email OTP registration returned a different authority"
-		};
-		return buildWalletRegistrationActivatePendingEmailOtpResponse({
-			walletId: ceremony.intent.walletId,
-			authority: walletAuthAuthority,
-			authMethod
-		});
-	}
-	/**
-	* Ed25519-only respond. The wallet's sole signer is Yao, and that is
-	* deliberately not a reason to block: the admission is returned as deferred
-	* work exactly as on a mixed plan, and the wallet lives in `near_pending`
-	* until the computation completes.
-	*/
-	/**
 	* Respond replay stays authority-bound.
 	*
 	* `signedSetup` is client-carried, so possession of it must never recover a
@@ -2828,6 +2562,7 @@ var CloudflareD1WalletRegistrationService = class {
 	async respondEd25519OnlyRegistration(input) {
 		const ceremony = input.ceremony;
 		const stored = storedRespondEd25519DeferredWork(ceremony.signerState);
+		let authority;
 		if (stored) {
 			const replayAuthority = await this.verifyRespondReplayAuthority({
 				ceremony,
@@ -2835,74 +2570,95 @@ var CloudflareD1WalletRegistrationService = class {
 				expectedOrigin: input.expectedOrigin,
 				...input.userAgent ? { userAgent: input.userAgent } : {}
 			});
-			if (!replayAuthority.ok) return {
+			if (!replayAuthority.ok) return replayAuthority;
+			const retainedAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
+			if (!retainedAuthority) return {
 				ok: false,
-				code: replayAuthority.code,
-				message: replayAuthority.message
+				code: "invalid_state",
+				message: "Registration authority is unavailable"
 			};
-			return {
-				ok: true,
-				registrationCeremonyId: ceremony.registrationCeremonyId,
-				kind: "near_ed25519",
-				ed25519: stored
+			authority = retainedAuthority;
+		} else {
+			const verified = await this.walletAuthMethods.verifyRegistrationAuthorityForIntent({
+				orgId: ceremony.orgId,
+				authority: input.authorityInput,
+				expectedDigestB64u: ceremony.digestB64u,
+				expectedOrigin: input.expectedOrigin,
+				intent: ceremony.intent,
+				verificationOperationId: ceremony.registrationCeremonyId,
+				verificationReceiptExpiresAtMs: ceremony.expiresAtMs,
+				...input.userAgent ? { userAgent: input.userAgent } : {}
+			});
+			if (!verified.ok) return {
+				ok: false,
+				code: verified.code,
+				message: verified.message
 			};
+			authority = verified.authority;
 		}
-		const verifiedAuthority = await this.walletAuthMethods.verifyRegistrationAuthorityForIntent({
-			orgId: ceremony.orgId,
-			authority: input.authorityInput,
-			expectedDigestB64u: ceremony.digestB64u,
-			expectedOrigin: input.expectedOrigin,
-			intent: ceremony.intent,
-			verificationOperationId: ceremony.registrationCeremonyId,
-			verificationReceiptExpiresAtMs: ceremony.expiresAtMs,
-			...input.userAgent ? { userAgent: input.userAgent } : {}
-		});
-		if (!verifiedAuthority.ok) return {
-			ok: false,
-			code: verifiedAuthority.code,
-			message: verifiedAuthority.message
-		};
-		const authority = verifiedAuthority.authority;
 		if (authority.walletId !== ceremony.intent.walletId) return {
 			ok: false,
 			code: "scope_mismatch",
 			message: "registration authority walletId does not match the ceremony"
 		};
-		const admitted = await this.authorizeRespondEd25519Branch({
+		const runtime = this.getEd25519YaoProductRegistration();
+		if (!runtime) return {
+			ok: false,
+			code: "not_configured",
+			message: "Ed25519 Yao registration is unavailable"
+		};
+		const admissionRequest = stored ? stored.admissionRequest : await buildRespondEd25519AdmissionRequest({
 			ceremony,
 			branch: input.branch,
 			authority,
-			registrationBearerToken: input.registrationBearerToken
+			signingWorkerId: runtime.signingWorkerId
 		});
+		const verifiedAuthority = authority;
+		const branchKey = input.branch.branchKey;
+		const ceremonyStore = this.getRegistrationCeremonyIntentStore();
+		const authorizedCeremony = (bound) => ({
+			...ceremony,
+			authorityState: {
+				kind: "verified",
+				authority: verifiedAuthority
+			},
+			signerState: {
+				kind: "signer_set_registration",
+				branches: [buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch({
+					branchKey,
+					admissionRequest: bound
+				})]
+			}
+		});
+		const admitted = await runtime.bindAndAdmitVerifiedRegistration({
+			kind: "verified_registration_intent",
+			ownershipGeneration: input.ownershipGeneration,
+			registrationIntentGrant: registrationIntentGrantFromString(input.registrationBearerToken),
+			intent: ceremony.intent,
+			admissionRequest,
+			expiresAtMs: ceremony.expiresAtMs
+		}, stored ? null : (bound) => ceremonyStore.prepareEcdsaClaimCommit({
+			expected: input.snapshot,
+			next: authorizedCeremony(bound)
+		}), input.startedDispatchRoot);
 		if (!admitted.ok) return {
 			ok: false,
 			code: admitted.code,
 			message: admitted.message
 		};
-		if (!admitted.branch || !admitted.deferred) return {
-			ok: false,
-			code: "internal",
-			message: "Ed25519 admission produced no branch"
-		};
-		await this.getRegistrationCeremonyIntentStore().commitEcdsaClaim({
+		if (!stored && admitted.companionWrite === "not_committed") await ceremonyStore.commitEcdsaClaim({
 			expected: input.snapshot,
-			next: {
-				...ceremony,
-				authorityState: {
-					kind: "verified",
-					authority
-				},
-				signerState: {
-					kind: "signer_set_registration",
-					branches: [admitted.branch]
-				}
-			}
+			next: authorizedCeremony(admitted.admissionRequest)
 		});
 		return {
 			ok: true,
 			registrationCeremonyId: ceremony.registrationCeremonyId,
 			kind: "near_ed25519",
-			ed25519: admitted.deferred
+			ed25519: {
+				status: "admitted",
+				admissionRequest: admitted.admissionRequest,
+				admissionReceipt: admitted.value
+			}
 		};
 	}
 	/**
@@ -2923,21 +2679,15 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "not_configured",
 			message: "Ed25519 Yao product registration is not configured"
 		};
-		const admissionRequest = await buildRouterAbEd25519YaoProductAdmissionRequestV1({
-			registrationCeremonyId: input.ceremony.registrationCeremonyId,
-			walletId: input.ceremony.intent.walletId,
-			signingRootId: normalizeOptionalTrimmedString(input.ceremony.signingRootId) || "",
-			signingRootVersion: normalizeOptionalTrimmedString(input.ceremony.signingRootVersion) || "",
-			authorityScope: registrationEd25519AuthorityScopeFromAuthority(input.authority),
+		const admissionRequest = await buildRespondEd25519AdmissionRequest({
+			ceremony: input.ceremony,
 			branch: input.branch,
-			signingWorkerId: yaoRuntime.signingWorkerId,
-			materialActivation: createRouterAbEd25519YaoMaterialActivationRefV1({
-				walletId: input.ceremony.intent.walletId,
-				signingWorkerId: yaoRuntime.signingWorkerId
-			})
+			authority: input.authority,
+			signingWorkerId: yaoRuntime.signingWorkerId
 		});
 		const admitted = await yaoRuntime.bindVerifiedIntent({
 			kind: "verified_registration_intent",
+			ownershipGeneration: input.ownershipGeneration,
 			registrationIntentGrant: registrationIntentGrantFromString(input.registrationBearerToken),
 			intent: input.ceremony.intent,
 			admissionRequest,
@@ -2990,6 +2740,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verifiedSetup.code,
 				message: verifiedSetup.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: verifiedSetup.claims.registrationCeremonyId,
+				walletId: walletIdFromString(verifiedSetup.claims.walletId)
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const claims = verifiedSetup.claims;
 			const idempotencyKey = normalizeOptionalTrimmedString(input.idempotencyKey);
 			if (!idempotencyKey) return {
@@ -3009,10 +2764,14 @@ var CloudflareD1WalletRegistrationService = class {
 				kind: "prepared_resumable",
 				operation: "registration_activate",
 				key: `registration-activate:${claims.registrationCeremonyId}:${idempotencyKey}`,
+				initialRecord: await this.activateSideEffects.read(`registration-activate:${claims.registrationCeremonyId}:${idempotencyKey}`),
 				requestFingerprint: activateDigestB64u,
 				resumeAfterMs: D1_WALLET_REGISTRATION_OPERATION_RESUME_AFTER_MS,
 				nowMs: Date.now,
-				prepare: async () => await this.prepareNearProvisioningOperation(claims.registrationCeremonyId),
+				prepare: async () => (await this.prepareNearProvisioningOperation(claims.registrationCeremonyId, null, {
+					kind: "ceremony",
+					ceremony: await this.getRegistrationCeremonyIntentStore().getCeremony(claims.registrationCeremonyId)
+				})).prepared,
 				derivePreparedArtifactFingerprint: async (prepared) => base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared))),
 				execute: this.executeWalletRegistrationActivation.bind(this, {
 					registrationCeremonyId: claims.registrationCeremonyId,
@@ -3027,6 +2786,7 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: claims.registrationCeremonyId,
 					execution
 				}),
+				completionWrite: registrationCommitActivation,
 				replay: this.replayWalletRegistrationActivateCommit.bind(this)
 			});
 			switch (run.kind) {
@@ -3078,36 +2838,15 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "not_found",
 			message: "registration ceremony not found"
 		});
-		const ceremonyAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
-		if (!ceremonyAuthority) return unissuedRegistrationCommit({
+		if (!verifiedRegistrationCeremonyAuthority(ceremony)) return unissuedRegistrationCommit({
 			ok: false,
 			code: "invalid_state",
 			message: "registration ceremony has not verified its authority proof"
 		});
-		if (!registrationSignerBranchesFromPlan(ceremony.signerPlan).evmFamilyEcdsa) {
-			const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
-			if (!expectedOrigin) return unissuedRegistrationCommit({
-				ok: false,
-				code: "invalid_state",
-				message: "registration ceremony has no expected origin"
-			});
-			const pending = await this.commitEd25519PendingWallet({
-				ceremony,
-				authority: ceremonyAuthority,
-				walletAuthMethodId: prepared.walletAuthMethodId,
-				enrollment: { ...context.input.emailOtpEnrollment ? { emailOtpEnrollment: context.input.emailOtpEnrollment } : {} }
-			});
-			if (!pending.ok) return unissuedRegistrationCommit(pending);
-			return {
-				kind: "near_pending",
-				response: pending,
-				expectedOrigin
-			};
-		}
-		if (!context.input.ecdsa) return unissuedRegistrationCommit({
+		if (!registrationSignerBranchesFromPlan(ceremony.signerPlan).evmFamilyEcdsa) return unissuedRegistrationCommit({
 			ok: false,
-			code: "invalid_body",
-			message: "browser-verified clientActivation is required for this signer plan"
+			code: "scope_mismatch",
+			message: "NEAR-only registration commits through NEAR finalization"
 		});
 		const ecdsa = context.input.ecdsa;
 		const activated = await this.activateWalletRegistrationEcdsa({
@@ -3127,22 +2866,30 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "internal",
 			message: "ECDSA activation completed without a key handle to commit"
 		});
-		const ownerProofContext = await this.readRegistrationOwnerProofContext(context.registrationCeremonyId);
-		if (!ownerProofContext) throw new Error("Registration owner proof context is unavailable");
-		const commit = await this.executeWalletRegistrationFinalize({
+		const activatedCeremony = await this.getRegistrationCeremonyIntentStore().getCeremony(context.registrationCeremonyId);
+		if (!activatedCeremony) throw new Error("Registration owner proof context is unavailable");
+		const ownerProofContext = registrationOwnerProofContextFromCeremony(activatedCeremony);
+		const execution = await this.executeWalletRegistrationFinalize({
 			kind: "evm_family_ecdsa",
 			registrationCeremonyId: context.registrationCeremonyId,
 			idempotencyKey: context.idempotencyKey,
 			ecdsa: { expectedKeyHandles: [keyHandle] },
 			...context.input.emailOtpEnrollment ? { emailOtpEnrollment: context.input.emailOtpEnrollment } : {},
 			...context.input.walletCustodyCommit !== void 0 ? { walletCustodyCommit: context.input.walletCustodyCommit } : {}
-		}, prepared, null);
-		if (!commit.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(commit));
-		if (commit.kind !== "evm_family_ecdsa") return unissuedRegistrationCommit({
-			ok: false,
-			code: "internal",
-			message: "registration activation committed a non-ECDSA branch"
-		});
+		}, prepared, {
+			kind: "stored_ceremony",
+			ceremony: activatedCeremony
+		}, [], { kind: "separate" }, null);
+		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
+		const commit = execution.finalized;
+		if (commit.kind !== "evm_family_ecdsa") {
+			await execution.custody;
+			return unissuedRegistrationCommit({
+				ok: false,
+				code: "internal",
+				message: "registration activation committed a non-ECDSA branch"
+			});
+		}
 		let installationProjection = null;
 		if (registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519) {
 			const committedCeremony = await this.getRegistrationCeremonyIntentStore().getCeremony(context.registrationCeremonyId);
@@ -3151,25 +2898,30 @@ var CloudflareD1WalletRegistrationService = class {
 		}
 		const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
 		if (!runtimePolicyScope) throw new Error("ECDSA registration is missing runtime policy scope");
-		const registrationEstablishedSession = await issueDirectRegistrationEstablishedEcdsaSession({
+		if (!this.registrationAuthority) throw new Error("Registration home completion is unavailable");
+		const proof = await this.registrationOwnerProofWithContext(ownerProofContext, {
+			registrationCeremonyId: context.registrationCeremonyId,
+			authMethod: commit.authMethod,
+			authority: commit.authority
+		});
+		const [issuance, custody] = await Promise.allSettled([issueDirectRegistrationEstablishedEcdsaSession({
+			homeCompletion: this.registrationAuthority,
 			authorizationService: this.authorizationService,
 			authorizationTenantId: this.authorizationTenantId,
-			walletAuthMethods: this.walletAuthMethods,
+			foundingAuthority: commit.foundingAuthority,
 			registrationCeremonyId: context.registrationCeremonyId,
 			authority: commit.authority,
-			registrationAuthority: ceremonyAuthority,
 			walletAuthMethodId: prepared.walletAuthMethodId,
 			expiresAtMs: activated.ecdsa.bootstrap.expiresAtMs,
 			remainingUses: activated.ecdsa.bootstrap.remainingUses,
 			bootstrap: activated.ecdsa.bootstrap,
 			runtimePolicyScope,
 			keyManifestDigestB64u: commit.custodyKeyManifestDigestB64u,
-			proof: await this.registrationOwnerProofWithContext(ownerProofContext, {
-				registrationCeremonyId: context.registrationCeremonyId,
-				authMethod: commit.authMethod,
-				authority: commit.authority
-			})
-		});
+			proof
+		}), execution.custody]);
+		if (issuance.status === "rejected") throw issuance.reason;
+		if (custody.status === "rejected") throw custody.reason;
+		const registrationEstablishedSession = issuance.value;
 		const registrationEstablishedSessionResult = registrationEstablishedSessionResultFromIssuance(registrationEstablishedSession);
 		const responseBase = {
 			ok: true,
@@ -3179,7 +2931,7 @@ var CloudflareD1WalletRegistrationService = class {
 			foundingAuthority: commit.foundingAuthority,
 			foundingAuthMethod: commit.foundingAuthMethod,
 			...commit.registrationDiagnostics ? { registrationDiagnostics: commit.registrationDiagnostics } : {},
-			...commit.walletCustody ? { walletCustody: commit.walletCustody } : {},
+			...custody.value.status === "not_requested" ? {} : { walletCustody: custody.value },
 			custodyKeyManifestDigestB64u: commit.custodyKeyManifestDigestB64u,
 			ecdsa: {
 				...commit.ecdsa,
@@ -3191,7 +2943,8 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 		const issuedContext = {
 			issuedAtMs: registrationEstablishedSession.issuedAtMs,
-			expectedOrigin: ownerProofContext.expectedOrigin
+			expectedOrigin: ownerProofContext.expectedOrigin,
+			activation: registrationEstablishedSession.activation
 		};
 		if (commit.authMethod.kind === "passkey") {
 			if (!commit.rpId) throw new Error("Passkey registration activation is missing its RP ID");
@@ -3389,7 +3142,6 @@ var CloudflareD1WalletRegistrationService = class {
 						publicIdentity: bootstrap.publicIdentity,
 						clientShareRetryCounter: bootstrap.clientShareRetryCounter,
 						relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
-						publicTranscriptDigest32B64u: bootstrap.publicTranscriptDigest32B64u,
 						keyHandle: bootstrap.keyHandle,
 						signingRootId: bootstrap.signingRootId,
 						signingRootVersion: bootstrap.signingRootVersion,
@@ -3463,9 +3215,10 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	async executeWalletRegistrationFinalize(request, prepared, recovery) {
+	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision) {
 		const finalizeTiming = createD1RegistrationRouteTimingRecorder("wallets_register_finalize");
 		const totalTiming = startD1RegistrationRouteTiming("registerFinalizeTotalMs");
+		let startedCustody = null;
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
 			if (!normalizeOptionalTrimmedString(request.idempotencyKey)) return {
@@ -3474,29 +3227,20 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "registration finalize idempotencyKey is required"
 			};
 			const requestFingerprint = await walletRegistrationFinalizeRequestFingerprint(request);
-			const ceremonyLoadTiming = startD1RegistrationRouteTiming("registrationCeremonyLoadMs");
-			let storedCeremony;
-			try {
-				storedCeremony = await store.getCeremony(request.registrationCeremonyId);
-			} finally {
-				finishD1RegistrationRouteTiming(finalizeTiming, ceremonyLoadTiming);
-			}
-			let ceremony;
-			if (storedCeremony) {
-				if (storedCeremony.signerState.kind !== "signer_set_registration") return {
-					ok: false,
-					code: "invalid_state",
-					message: "signer-set registration state is required"
-				};
-				ceremony = registrationFinalizeCeremonyFromStored(storedCeremony);
-			} else if (recovery) {
+			const storedCeremony = source.kind === "stored_ceremony" ? source.ceremony : null;
+			const ceremony = source.kind === "stored_ceremony" ? registrationFinalizeCeremonyFromStored(source.ceremony) : source.ceremony;
+			if (ceremony.registrationCeremonyId !== request.registrationCeremonyId) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "registration ceremony mismatch"
+			};
+			if (source.kind === "committed_mixed_installation") {
 				if (request.kind !== "near_ed25519") return {
 					ok: false,
 					code: "invalid_state",
 					message: "committed mixed registration can only finalize NEAR Ed25519"
 				};
-				ceremony = recovery.ceremony;
-			} else return {
+			} else if (ceremony.expiresAtMs <= Date.now()) return {
 				ok: false,
 				code: "not_found",
 				message: "registration ceremony not found"
@@ -3521,7 +3265,7 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "registration signer set requires a signer branch"
 			};
 			const storedEcdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
-			const ecdsaAlreadyFinalized = storedCeremony === null && recovery !== null || storedEcdsaBranch?.kind === "evm_family_ecdsa_finalized";
+			const ecdsaAlreadyFinalized = source.kind === "committed_mixed_installation" || storedEcdsaBranch?.kind === "evm_family_ecdsa_finalized";
 			const sequenceFailure = finalizeSignerWorkSequenceFailure({
 				request,
 				hasNearEd25519: requestedNearEd25519 !== null,
@@ -3648,8 +3392,26 @@ var CloudflareD1WalletRegistrationService = class {
 			let ed25519SignerRecord = null;
 			let ed25519MaterialActivation = null;
 			let ed25519RegisteredPublicKeyB64u = null;
-			let ed25519CapabilityInstallation = null;
 			let yaoDecision = null;
+			let yaoDecisionFound = null;
+			let commitWallet;
+			const reserveCustody = () => recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_custody_reserve",
+				startedAtMs: Date.now(),
+				promise: reserveRegistrationCustody({
+					payload: walletCustodyCommitPayload,
+					verifiedWalletId: ceremony.intent.walletId,
+					verifiedAuthority: walletAuthAuthority,
+					...emailOtpEnrollment.persistence ? { verifiedEmailOtpEnrollment: {
+						enrollmentId: emailOtpEnrollment.persistence.enrollment.enrollmentId,
+						enrollmentSealKeyVersion: emailOtpEnrollment.persistence.enrollment.enrollmentSealKeyVersion
+					} } : {},
+					nowMs: now,
+					store: this.walletCustodyCommitStore
+				})
+			});
+			let custodyReservation;
 			if (finalizeNearEd25519) {
 				const yaoRuntime = this.getEd25519YaoProductRegistration();
 				if (!yaoRuntime) return {
@@ -3675,13 +3437,24 @@ var CloudflareD1WalletRegistrationService = class {
 					code: "scope_mismatch",
 					message: "Ed25519 activation reference does not belong to this registration ceremony"
 				};
-				const consumed = await yaoRuntime.consumeActivated({
-					reference: {
-						lifecycleId: activationReference.lifecycle_id,
-						sessionId: activationReference.session_id
-					},
-					consumerBinding: requestFingerprint
-				});
+				custodyReservation = reserveCustody();
+				startedCustody = custodyReservation;
+				const [activationConsumption, authorityReservation] = await Promise.allSettled([recordRegistrationPromiseTiming({
+					sink: serverTiming,
+					name: "near_finalize_router_consume",
+					startedAtMs: Date.now(),
+					promise: yaoRuntime.consumeActivated({
+						reference: {
+							lifecycleId: activationReference.lifecycle_id,
+							sessionId: activationReference.session_id
+						},
+						consumerBinding: requestFingerprint
+					})
+				}), this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority)]);
+				if (activationConsumption.status === "rejected") throw activationConsumption.reason;
+				if (authorityReservation.status === "rejected") throw authorityReservation.reason;
+				const consumed = activationConsumption.value;
+				commitWallet = authorityReservation.value;
 				if (!consumed.ok) return {
 					ok: false,
 					code: consumed.code,
@@ -3713,6 +3486,7 @@ var CloudflareD1WalletRegistrationService = class {
 				const sponsoredAccountId = sponsoredNamedRegistrationAccountId(finalizeNearEd25519.accountProvisioning);
 				if (sponsoredAccountId) {
 					const created = await this.createSponsoredNamedNearAccount({
+						walletId: ceremony.intent.walletId,
 						accountId: sponsoredAccountId,
 						publicKey,
 						idempotencyKey: bytesToUnprefixedHex(Uint8Array.from(consumed.activation.result.binding.session_id))
@@ -3744,7 +3518,7 @@ var CloudflareD1WalletRegistrationService = class {
 				});
 				if (!resolved.ok) return resolved;
 				resolvedNearAccount = resolved.value;
-				ed25519CapabilityInstallation = {
+				const activeYaoCapability = buildRouterAbEd25519YaoRegistrationCapabilityRecordV1({
 					kind: "router_ab_ed25519_yao_registration_finalize_capability_v1",
 					activeCapabilityBinding: consumed.activation.result.binding.session_id,
 					nearAccountId,
@@ -3752,8 +3526,7 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationAdmissionReceipt: consumed.activation.admissionReceipt,
 					registrationResult: consumed.activation.result,
 					runtimePolicyScope
-				};
-				const activeYaoCapability = buildRouterAbEd25519YaoRegistrationCapabilityRecordV1(ed25519CapabilityInstallation);
+				});
 				if (!activeYaoCapability.ok) return {
 					ok: false,
 					code: activeYaoCapability.code,
@@ -3766,6 +3539,7 @@ var CloudflareD1WalletRegistrationService = class {
 					consumerBinding: requestFingerprint,
 					capability: activeYaoCapability.record
 				});
+				yaoDecisionFound = routerAbEd25519YaoLifecycleDecisionLookupV1(yaoDecision, lifecycleDecision);
 				const activatedEd25519PublicResult = {
 					signerSlot: finalizeNearEd25519.signerSlot,
 					nearAccountId,
@@ -3801,14 +3575,18 @@ var CloudflareD1WalletRegistrationService = class {
 					custodyKeyManifestDigestB64u,
 					now
 				});
+			} else {
+				custodyReservation = reserveCustody();
+				startedCustody = custodyReservation;
+				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority);
 			}
-			const yaoDecisionFound = yaoDecision ? routerAbEd25519YaoLifecycleDecisionLookupV1(yaoDecision, await this.yaoLifecycleDecisions.read(yaoDecision.lifecycleId)) : null;
 			if (yaoDecisionFound?.kind === "decided_otherwise") return {
 				ok: false,
 				code: "invalid_state",
 				message: "Ed25519 Yao registration lifecycle was finalized by another request"
 			};
 			let foundingAuthorityRecords = null;
+			let initialSession = { kind: "uncommitted" };
 			if (yaoDecisionFound?.kind !== "decided") {
 				const wallet = buildD1WalletRecord({
 					walletId: ceremony.intent.walletId,
@@ -3934,6 +3712,7 @@ var CloudflareD1WalletRegistrationService = class {
 				}
 				const decisionStatements = yaoDecision ? this.yaoLifecycleDecisions.prepareDecideStatements(yaoDecision, now) : [];
 				const persistenceTiming = startD1RegistrationRouteTiming("relayPersistenceMs");
+				const walletCommitStartedAtMs = Date.now();
 				try {
 					switch (ceremonyAuthority.kind) {
 						case "passkey":
@@ -3942,24 +3721,22 @@ var CloudflareD1WalletRegistrationService = class {
 								code: "invalid_state",
 								message: "Passkey registration cannot persist Email OTP enrollment state"
 							};
-							if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
+							if (foundingAuthorityRecords) initialSession = await commitWalletRegistration(commitWallet, {
 								kind: "passkey_wallet_registration_commit_v1",
 								wallet,
 								walletSigners,
-								authority: ceremonyAuthority,
 								foundingAuthority: foundingAuthorityRecords.authority,
 								foundingAuthMethod: foundingAuthorityRecords.authMethod,
 								now,
 								decisionStatements
-							});
-							else await this.walletRegistrationCommitStore.commit({
+							}, initialSessionPlan);
+							else initialSession = await commitWalletRegistration(commitWallet, {
 								kind: "passkey_wallet_registration_commit_v1",
 								wallet,
 								walletSigners,
-								authority: ceremonyAuthority,
 								now,
 								decisionStatements
-							});
+							}, initialSessionPlan);
 							break;
 						case "email_otp": {
 							if (!emailOtpEnrollment.persistence) return {
@@ -3968,31 +3745,30 @@ var CloudflareD1WalletRegistrationService = class {
 								message: "Email OTP registration is missing enrollment persistence state"
 							};
 							const emailOtp = this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(emailOtpEnrollment.persistence);
-							if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
+							if (foundingAuthorityRecords) initialSession = await commitWalletRegistration(commitWallet, {
 								kind: "email_otp_wallet_registration_commit_v1",
 								wallet,
 								walletSigners,
-								authority: ceremonyAuthority,
 								emailOtp,
 								foundingAuthority: foundingAuthorityRecords.authority,
 								foundingAuthMethod: foundingAuthorityRecords.authMethod,
 								now,
 								decisionStatements
-							});
-							else await this.walletRegistrationCommitStore.commit({
+							}, initialSessionPlan);
+							else initialSession = await commitWalletRegistration(commitWallet, {
 								kind: "email_otp_wallet_registration_commit_v1",
 								wallet,
 								walletSigners,
-								authority: ceremonyAuthority,
 								emailOtp,
 								now,
 								decisionStatements
-							});
+							}, initialSessionPlan);
 							break;
 						}
 					}
 				} finally {
 					finishD1RegistrationRouteTiming(finalizeTiming, persistenceTiming);
+					recordRegistrationServerTiming(serverTiming, "near_finalize_wallet_commit", walletCommitStartedAtMs);
 				}
 			}
 			const completedRegistrationIdentity = await this.emailOtpRegistrationEnrollmentFinalizer.completeRegistrationIdentity({
@@ -4008,36 +3784,20 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			const foundingAuthority = persistedFoundingRecords.authority;
 			const foundingAuthMethod = persistedFoundingRecords.authMethod;
-			if (ed25519CapabilityInstallation) {
-				const yaoRuntime = this.getEd25519YaoProductRegistration();
-				if (!yaoRuntime) return {
-					ok: false,
-					code: "not_configured",
-					message: "Ed25519 Yao product registration is not configured"
-				};
-				const installed = await yaoRuntime.installRegistrationFinalizeCapability(ed25519CapabilityInstallation);
-				if (!installed.ok) return {
-					ok: false,
-					code: installed.code,
-					message: installed.message
-				};
-			}
-			const walletCustody = await commitRegistrationCustody({
-				payload: walletCustodyCommitPayload,
-				verifiedWalletId: ceremony.intent.walletId,
-				verifiedAuthority: walletAuthAuthority,
-				...emailOtpEnrollment.persistence ? { verifiedEmailOtpEnrollment: {
-					enrollmentId: emailOtpEnrollment.persistence.enrollment.enrollmentId,
-					enrollmentSealKeyVersion: emailOtpEnrollment.persistence.enrollment.enrollmentSealKeyVersion
-				} } : {},
-				nowMs: now,
-				store: this.walletCustodyCommitStore
-			});
-			if (walletCustody.status === "rejected") console.warn("[wallet-registration] custody commit rejected", {
-				registrationCeremonyId: ceremony.registrationCeremonyId,
-				reason: walletCustody.reason
+			const custody = custodyReservation.then(async (commitCustody) => {
+				const walletCustody = await recordRegistrationPromiseTiming({
+					sink: serverTiming,
+					name: "near_finalize_custody_commit",
+					startedAtMs: Date.now(),
+					promise: commitCustody()
+				});
+				if (walletCustody.status === "rejected") console.warn("[wallet-registration] custody commit rejected", {
+					registrationCeremonyId: ceremony.registrationCeremonyId,
+					reason: walletCustody.reason
+				});
+				return walletCustody;
 			});
-			const custodyField = walletCustody.status === "not_requested" ? {} : { walletCustody };
+			startedCustody = custody;
 			const authMethod = walletRegistrationFinalizeAuthMethodFromAuthority(ceremonyAuthority);
 			let response;
 			if (ed25519PublicResult && finalizeNearEd25519 && resolvedNearAccount) {
@@ -4051,7 +3811,6 @@ var CloudflareD1WalletRegistrationService = class {
 					foundingAuthMethod,
 					rpId: finalizePasskeyRpId(ceremonyAuthority),
 					authMethod,
-					...custodyField,
 					custodyKeyManifestDigestB64u,
 					authorityScope,
 					accountProvisioning: finalizeNearEd25519.accountProvisioning,
@@ -4065,7 +3824,6 @@ var CloudflareD1WalletRegistrationService = class {
 					foundingAuthority,
 					foundingAuthMethod,
 					authMethod,
-					...custodyField,
 					custodyKeyManifestDigestB64u,
 					authorityScope,
 					accountProvisioning: finalizeNearEd25519.accountProvisioning,
@@ -4081,7 +3839,6 @@ var CloudflareD1WalletRegistrationService = class {
 				foundingAuthMethod,
 				rpId: finalizePasskeyRpId(ceremonyAuthority),
 				authMethod,
-				...custodyField,
 				custodyKeyManifestDigestB64u,
 				ecdsa: { walletKeys: ecdsaWalletKeys }
 			} : {
@@ -4092,7 +3849,6 @@ var CloudflareD1WalletRegistrationService = class {
 				foundingAuthority,
 				foundingAuthMethod,
 				authMethod,
-				...custodyField,
 				custodyKeyManifestDigestB64u,
 				ecdsa: { walletKeys: ecdsaWalletKeys }
 			};
@@ -4126,16 +3882,30 @@ var CloudflareD1WalletRegistrationService = class {
 					}
 				});
 				finishD1RegistrationRouteTiming(finalizeTiming, totalTiming);
-				return withD1RegistrationRouteDiagnostics(response, finalizeTiming);
+				startedCustody = null;
+				return {
+					ok: true,
+					finalized: withD1RegistrationRouteDiagnostics(response, finalizeTiming),
+					custody,
+					initialSession
+				};
 			}
 			finishD1RegistrationRouteTiming(finalizeTiming, totalTiming);
-			return withD1RegistrationRouteDiagnostics(response, finalizeTiming);
+			startedCustody = null;
+			return {
+				ok: true,
+				finalized: withD1RegistrationRouteDiagnostics(response, finalizeTiming),
+				custody,
+				initialSession
+			};
 		} catch (error) {
 			return {
 				ok: false,
 				code: "internal",
 				message: errorMessage(error) || "Failed to finalize wallet registration ceremony"
 			};
+		} finally {
+			await startedCustody;
 		}
 	}
 };