@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, bytesToUnprefixedHex, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import "../../../../shared-ts/src/utils/encoders.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
@@ -20,13 +20,12 @@ import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, compute
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
@@ -38,37 +37,34 @@ import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStored
 import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
-import { admitRegistrationReservationHome, completeRegistrationReservation } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
+import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
-import { commitRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
+import { reserveRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
 import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
-import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
+import { walletRegistrationOperationPreparedFromCeremony } from "./d1WalletRegistrationPreparation.js";
+import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
+import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
+import { projectWalletRegistrationSessionCommitReceiptV2, registrationCommitActivation, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
+import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
+import { commitWalletRegistration } from "./d1WalletRegistrationInitialSession.js";
 import { storedRespondEd25519DeferredWork, walletRegistrationRespondResult } from "./d1WalletRegistrationSetup.js";
 import { executeD1WalletRegistrationSetup } from "./d1WalletRegistrationSetupExecution.js";
-import { projectWalletRegistrationSessionCommitReceiptV2, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
-import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationService.ts
-function buildWalletRegistrationActivatePendingPasskeyResponse(input) {
-	return {
-		ok: true,
-		kind: "near_ed25519",
-		walletId: input.walletId,
-		authority: input.authority,
-		authMethod: input.authMethod,
-		rpId: input.rpId,
-		nearProvisioning: { status: "near_pending" }
-	};
-}
-function buildWalletRegistrationActivatePendingEmailOtpResponse(input) {
-	return {
-		ok: true,
-		kind: "near_ed25519",
-		walletId: input.walletId,
-		authority: input.authority,
-		authMethod: input.authMethod,
-		nearProvisioning: { status: "near_pending" }
-	};
+async function buildRespondEd25519AdmissionRequest(input) {
+	return buildRouterAbEd25519YaoProductAdmissionRequestV1({
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		walletId: input.ceremony.intent.walletId,
+		signingRootId: normalizeOptionalTrimmedString(input.ceremony.signingRootId) || "",
+		signingRootVersion: normalizeOptionalTrimmedString(input.ceremony.signingRootVersion) || "",
+		authorityScope: registrationEd25519AuthorityScopeFromAuthority(input.authority),
+		branch: input.branch,
+		signingWorkerId: input.signingWorkerId,
+		materialActivation: createRouterAbEd25519YaoMaterialActivationRefV1({
+			walletId: input.ceremony.intent.walletId,
+			signingWorkerId: input.signingWorkerId
+		})
+	});
 }
 function sameEd25519ParticipantIds(left, right) {
 	return left[0] === right[0] && left[1] === right[1];
@@ -202,15 +198,6 @@ function requirePreparedRegistrationId(result, label) {
 	if (!result.ok) throw new Error(`${label} is invalid: ${result.error.message}`);
 	return result.value;
 }
-function walletRegistrationOperationPreparedFromCeremony(ceremony) {
-	if (String(ceremony.foundingWalletAuthMethodId) !== String(ceremony.intent.foundingWalletAuthMethodId)) throw new Error("registration ceremony and intent name different founding auth methods");
-	return {
-		kind: "d1_wallet_registration_operation_prepared_v1",
-		walletAuthorityId: ceremony.foundingWalletAuthorityId,
-		deviceId: ceremony.foundingDeviceId,
-		walletAuthMethodId: ceremony.foundingWalletAuthMethodId
-	};
-}
 function committedInstallationProjectionFromCeremony(ceremony) {
 	const registrationAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
 	if (ceremony.signerState.kind !== "signer_set_registration" || registrationAuthority === null) return null;
@@ -406,6 +393,16 @@ async function buildFoundingAuthorityRecords(input) {
 function assertNeverFoundingSignerFacts(value) {
 	throw new Error(`Unsupported founding signer facts: ${String(value)}`);
 }
+function registrationOwnerProofContextFromCeremony(ceremony) {
+	const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
+	const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
+	if (!expectedOrigin || !runtimePolicyScope) throw new Error("Registration is missing its session origin or runtime policy scope");
+	return {
+		expectedOrigin,
+		runtimePolicyScope,
+		expiresAtMs: ceremony.expiresAtMs
+	};
+}
 function registrationFinalizeCeremonyFromStored(ceremony) {
 	if (ceremony.signerState.kind !== "signer_set_registration") throw new Error("signer-set registration state is required");
 	return {
@@ -525,9 +522,6 @@ function assertNeverSponsoredNamedNearAccountCreationResult(value) {
 function isRegistrationEcdsaReadyReceipt(receipt) {
 	return receipt.committed.kind === "ecdsa_ready";
 }
-function isRegistrationNearPendingReceipt(receipt) {
-	return receipt.committed.kind === "near_pending";
-}
 function isRegistrationNearReadyReceipt(receipt) {
 	return receipt.committed.kind === "near_ready";
 }
@@ -550,7 +544,6 @@ function d1RegistrationRouteDiagnostics(recorder) {
 	};
 }
 function withD1RegistrationRouteDiagnostics(response, recorder) {
-	if (!response.ok) return response;
 	return {
 		...response,
 		registrationDiagnostics: d1RegistrationRouteDiagnostics(recorder)
@@ -860,20 +853,14 @@ function mergeRouterServerTiming(target, header) {
 		}
 	}
 }
-function recordRegistrationServerTiming(sink, name, startedAtMs) {
-	sink.push([name, Math.max(0, Date.now() - startedAtMs)]);
-}
-async function recordRegistrationPromiseTiming(args) {
-	try {
-		return await args.promise;
-	} finally {
-		recordRegistrationServerTiming(args.sink, args.name, args.startedAtMs);
-	}
-}
 var CloudflareD1WalletRegistrationService = class {
 	constructor(input) {
+		this.home = input.home;
+		this.executionAuthority = input.executionAuthority;
 		this.registrationAuthority = input.registrationAuthority;
+		this.startRegistrationWallets = input.startRegistrationWallets;
 		this.authorizationService = input.authorizationService;
+		this.registrationSessionStore = input.registrationSessionStore;
 		this.authorizationTenantId = input.authorizationTenantId;
 		this.createSponsoredNamedNearAccount = input.createSponsoredNamedNearAccount;
 		this.emailOtpRegistrationEnrollmentFinalizer = input.emailOtpRegistrationEnrollmentFinalizer;
@@ -883,7 +870,7 @@ var CloudflareD1WalletRegistrationService = class {
 		this.tenantRootCustodyLineage = input.tenantRootCustodyLineage;
 		this.getWalletStore = input.getWalletStore;
 		this.activateSideEffects = input.activateSideEffects;
-		this.nearProvisioningSideEffects = input.nearProvisioningSideEffects;
+		this.registrationRead = input.registrationRead;
 		this.walletRegistrationCommitStore = input.walletRegistrationCommitStore;
 		this.walletCustodyCommitStore = input.walletCustodyCommitStore;
 		this.walletAuthMethods = input.walletAuthMethods;
@@ -893,7 +880,7 @@ var CloudflareD1WalletRegistrationService = class {
 	async resolveEd25519MaterialActivation(input) {
 		try {
 			const walletId = walletIdFromString(input.walletId);
-			const signer = await this.getWalletStore().getEd25519SignerByMaterialActivation({
+			const signer = input.signerRead ? input.signerRead.resolve(walletId, input.materialActivation) : await this.getWalletStore().getEd25519SignerByMaterialActivation({
 				walletId,
 				materialActivation: input.materialActivation
 			});
@@ -954,14 +941,15 @@ var CloudflareD1WalletRegistrationService = class {
 					exportIdentity: await ed25519ExportIdentityFromLinkedProjection(projection, active.capability)
 				};
 			}
-			const active = await yaoRuntime.resolveActiveCapability({
+			const lookup = {
 				kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
 				walletId: input.walletId,
 				nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
 				signerSlot: signer.signerSlot,
 				signingWorkerId: signer.signingWorkerId,
 				participantIds: signer.participantIds
-			});
+			};
+			const active = input.signerRead?.resolveActiveCapability(lookup) ?? await yaoRuntime.resolveActiveCapability(lookup);
 			if (!active.ok) {
 				if (active.code === "unknown_capability") {
 					if (!sameRouterAbMpcMaterialActivationRef(signer.activeYaoCapability.activationResult.binding.material_activation, input.materialActivation)) return {
@@ -1127,8 +1115,15 @@ var CloudflareD1WalletRegistrationService = class {
 				code: "not_found",
 				message: "ECDSA tenant root is not active"
 			};
+			const home = await this.executionAuthority.admitEstablishedHome({ walletId: walletIdFromString(input.walletId) });
+			if (!home.ok) return {
+				ok: false,
+				code: "invalid_state",
+				message: home.message
+			};
 			return {
 				ok: true,
+				ownershipGeneration: home.ownershipGeneration,
 				...tenantRoot
 			};
 		} catch (error) {
@@ -1591,9 +1586,11 @@ var CloudflareD1WalletRegistrationService = class {
 	}
 	async setupWalletRegistration(input) {
 		return executeD1WalletRegistrationSetup(input, {
+			home: this.home,
 			reservation: this.registrationAuthority,
 			store: this.getRegistrationCeremonyIntentStore(),
-			ecdsaStrictRegistration: this.ecdsaStrictRegistration
+			ecdsaStrictRegistration: this.ecdsaStrictRegistration,
+			startRegistrationWallets: this.startRegistrationWallets
 		});
 	}
 	async authorizeWalletRegistrationNearAdmission(input) {
@@ -1671,7 +1668,8 @@ var CloudflareD1WalletRegistrationService = class {
 				ceremony,
 				branch: branches.nearEd25519,
 				authority: verifiedAuthority.authority,
-				registrationBearerToken
+				registrationBearerToken,
+				ownershipGeneration: homeAdmission.ownershipGeneration
 			});
 			if (!admitted.ok) return admitted;
 			if (!admitted.deferred) return {
@@ -1700,9 +1698,19 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
+			const verifiedSetup = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
+				registrationCeremonyId: input.registrationCeremonyId,
+				nowMs: Date.now()
+			});
+			if (!verifiedSetup.ok) return verifiedSetup;
 			const loadStartedAtMs = Date.now();
-			const snapshot = await store.getCeremonySnapshot(input.registrationCeremonyId);
+			const homeAdmission = await this.registrationRead.readRespond({
+				ceremonyId: verifiedSetup.claims.registrationCeremonyId,
+				walletId: walletIdFromString(verifiedSetup.claims.walletId)
+			});
 			mark("ecdsa_respond_d1_load", loadStartedAtMs);
+			if (!homeAdmission.ok) return homeAdmission;
+			const snapshot = homeAdmission.snapshot;
 			if (!snapshot) return {
 				ok: false,
 				code: "not_found",
@@ -1724,29 +1732,23 @@ var CloudflareD1WalletRegistrationService = class {
 				signingRootVersion: normalizeOptionalTrimmedString(ceremony.signingRootVersion) || "",
 				expectedOrigin
 			});
-			const verifiedSetup = await verifySignedWalletRegistrationSetup(input.verifier, input.signedSetup, {
-				registrationCeremonyId: ceremony.registrationCeremonyId,
-				setupDigestB64u,
-				nowMs: Date.now()
-			});
-			if (!verifiedSetup.ok) return {
+			if (verifiedSetup.claims.setupDigestB64u !== setupDigestB64u || verifiedSetup.claims.walletId !== ceremony.intent.walletId) return {
 				ok: false,
-				code: verifiedSetup.code,
-				message: verifiedSetup.message
+				code: "invalid_grant",
+				message: "signedSetup does not match this registration setup"
 			};
-			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
-				ceremonyId: ceremony.registrationCeremonyId,
-				walletId: ceremony.intent.walletId
-			});
-			if (!homeAdmission.ok) return homeAdmission;
+			const ecdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+			const planNearEd25519 = registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519;
+			const startedDispatchRoot = !ecdsaBranch && planNearEd25519 && !storedRespondEd25519DeferredWork(ceremony.signerState) ? this.getEd25519YaoProductRegistration()?.startRegistrationDispatchRoot({
+				signing_root_id: normalizeOptionalTrimmedString(ceremony.signingRootId) || "",
+				root_share_epoch: normalizeOptionalTrimmedString(ceremony.signingRootVersion) || ""
+			}) ?? null : null;
 			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
 			if (!registrationBearerToken) return {
 				ok: false,
 				code: "invalid_body",
 				message: "signedSetup is required"
 			};
-			const ecdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
-			const planNearEd25519 = registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519;
 			if (!ecdsaBranch && !planNearEd25519) return {
 				ok: false,
 				code: "invalid_state",
@@ -1764,6 +1766,8 @@ var CloudflareD1WalletRegistrationService = class {
 				branch: planNearEd25519,
 				authorityInput: input.authority,
 				registrationBearerToken,
+				ownershipGeneration: homeAdmission.ownershipGeneration,
+				startedDispatchRoot,
 				expectedOrigin,
 				...input.userAgent ? { userAgent: input.userAgent } : {}
 			});
@@ -1877,6 +1881,7 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "ECDSA response claim is invalid"
 			};
 			const tenantRoot = {
+				ownershipGeneration: homeAdmission.ownershipGeneration,
 				projectEnvironmentId: claimedBranch.projectEnvironmentId,
 				identityDigestB64u: claimedBranch.tenantRootIdentityDigestB64u,
 				custodyLineageB64u: claimedBranch.tenantRootCustodyLineageB64u
@@ -1898,15 +1903,15 @@ var CloudflareD1WalletRegistrationService = class {
 				ceremony,
 				branch: nearEd25519Branch,
 				authority,
-				registrationBearerToken
+				registrationBearerToken,
+				ownershipGeneration: homeAdmission.ownershipGeneration
 			})]);
 			mark("ecdsa_respond_router", routerStartedAtMs);
 			if (!strictResult.ok) {
 				if (!strictResult.retryable) {
-					const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
+					const completedHome = await cancelRegistrationHome(this.registrationAuthority, {
 						ceremonyId: ceremony.registrationCeremonyId,
-						walletId: ceremony.intent.walletId,
-						outcome: "cancelled"
+						walletId: ceremony.intent.walletId
 					});
 					if (!completedHome.ok) return completedHome;
 					await store.cancelTerminalCeremony({
@@ -1985,34 +1990,6 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	/**
-	* The Ed25519 commit core, extracted so deferred provisioning reaches it
-	* without going through the standalone finalize wrapper. The operation row
-	* owns idempotency here, so the commit keeps no replay cache of its own.
-	*/
-	async readRegistrationOwnerProofContext(registrationCeremonyId) {
-		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
-		if (!ceremony) {
-			const committed = await this.readCommittedRegistrationInstallation(registrationCeremonyId);
-			if (!committed) return null;
-			if (!isRegistrationEcdsaReadyReceipt(committed.receipt)) throw new Error("Committed registration installation has no ECDSA session receipt");
-			const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(committed.projection.preparedContext);
-			if (!runtimePolicyScope) throw new Error("Committed registration is missing its runtime policy scope");
-			return {
-				expectedOrigin: committed.receipt.expectedOrigin,
-				runtimePolicyScope,
-				expiresAtMs: committed.receipt.expiresAtMs
-			};
-		}
-		const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
-		const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
-		if (!expectedOrigin || !runtimePolicyScope) throw new Error("Registration is missing its session origin or runtime policy scope");
-		return {
-			expectedOrigin,
-			runtimePolicyScope,
-			expiresAtMs: ceremony.expiresAtMs
-		};
-	}
 	/** For callers that must read the context before finalize tombstones it. */
 	async registrationOwnerProofWithContext(context, input) {
 		return await buildRegistrationOwnerProof({
@@ -2035,7 +2012,7 @@ var CloudflareD1WalletRegistrationService = class {
 			nowMs
 		});
 		if (!issued) return null;
-		const active = await this.walletAuthMethods.readActiveRegistrationAuthority(installation.projection.registrationAuthority);
+		const active = await this.walletAuthMethods.readActiveRegistrationIdentity(installation.projection.registrationAuthority);
 		if (!active || issued.session.walletId !== installation.projection.walletId || issued.session.authorityId !== installation.receipt.foundingAuthority.authorityId || issued.session.walletAuthMethodId !== installation.receipt.walletAuthMethodId || active.walletAuthMethodId !== issued.session.walletAuthMethodId || active.authority.authorityId !== issued.session.authorityId || active.authority.authorityDigestB64u !== issued.session.authorityDigestB64u || active.authority.revocationEpoch !== issued.session.authorityRevocationEpoch || active.authority.revocationEpoch !== installation.receipt.foundingAuthority.revocationEpoch || issued.session.expiresAtMs <= nowMs) return null;
 		const originalSubjects = installation.receipt.committed.session.walletSession.capabilitySubjects;
 		for (const subject of originalSubjects) if (!issued.session.capabilitySubjects.some(sameRegistrationContinuationSubject.bind(void 0, subject))) return null;
@@ -2076,64 +2053,70 @@ var CloudflareD1WalletRegistrationService = class {
 		});
 		const nearPlan = projection.signerPlan.branches.find((branch) => branch.kind === "near_ed25519");
 		const ecdsaPlan = projection.signerPlan.branches.find((branch) => branch.kind === "evm_family_ecdsa");
-		if (projection.registrationCeremonyId !== registrationCeremonyId || projection.walletId !== receipt.walletId || projection.registrationAuthority.walletId !== receipt.walletId || projection.orgId !== (projection.preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? projection.preparedContext.runtimePolicy.scope.orgId : "") || !nearPlan || !ecdsaPlan || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, projection.preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? projection.preparedContext.ecdsa.chainTargets : []) || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, receipt.committed.ecdsa.walletKeys.map((walletKey) => walletKey.chainTarget)) || receipt.committed.ecdsa.walletKeys.some((walletKey) => walletKey.walletId !== String(receipt.walletId) || walletKey.signingRootId !== projection.preparedContext.signingRootId || walletKey.signingRootVersion !== projection.preparedContext.signingRootVersion || walletKey.participantIds.length !== ecdsaPlan.participantIds.length || walletKey.participantIds.some((participantId, index) => participantId !== ecdsaPlan.participantIds[index])) || projection.nearEd25519.branchKey !== nearPlan.branchKey || projection.nearEd25519.admissionRequest.scope.lifecycle_id !== registrationCeremonyId || projection.nearEd25519.admissionRequest.scope.account_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.scope.root_share_epoch !== projection.preparedContext.signingRootVersion || projection.nearEd25519.admissionRequest.scope.signer_set_id !== String(nearPlan.branchKey) || projection.nearEd25519.admissionRequest.application_binding.wallet_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.application_binding.signing_root_id !== projection.preparedContext.signingRootId || projection.nearEd25519.admissionRequest.application_binding.key_creation_signer_slot !== nearPlan.signerSlot || projection.nearEd25519.admissionRequest.participant_ids.length !== nearPlan.participantIds.length || projection.nearEd25519.admissionRequest.participant_ids.some((participantId, index) => participantId !== nearPlan.participantIds[index]) || !walletAuthAuthoritiesMatch(derivedAuthority, receipt.authority) || record.prepared.walletAuthorityId !== receipt.foundingAuthority.authorityId || record.prepared.deviceId !== foundingDeviceId || record.prepared.walletAuthMethodId !== receipt.walletAuthMethodId) throw new Error("registration activation receipt installation identity is invalid");
+		if (projection.registrationCeremonyId !== registrationCeremonyId || projection.walletId !== receipt.walletId || projection.registrationAuthority.walletId !== receipt.walletId || projection.orgId !== (projection.preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? projection.preparedContext.runtimePolicy.scope.orgId : "") || !nearPlan || !ecdsaPlan || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, projection.preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? projection.preparedContext.ecdsa.chainTargets : []) || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, receipt.committed.ecdsa.walletKeys.map((walletKey) => walletKey.chainTarget)) || receipt.committed.ecdsa.walletKeys.some((walletKey) => walletKey.walletId !== String(receipt.walletId) || walletKey.signingRootId !== projection.preparedContext.signingRootId || walletKey.signingRootVersion !== projection.preparedContext.signingRootVersion || walletKey.participantIds.length !== ecdsaPlan.participantIds.length || walletKey.participantIds.some((participantId, index) => participantId !== ecdsaPlan.participantIds[index])) || projection.nearEd25519.branchKey !== nearPlan.branchKey || projection.nearEd25519.admissionRequest.scope.lifecycle_id !== registrationCeremonyId || projection.nearEd25519.admissionRequest.scope.account_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.scope.root_share_epoch !== projection.preparedContext.signingRootVersion || projection.nearEd25519.admissionRequest.scope.signer_set_id !== String(nearPlan.branchKey) || projection.nearEd25519.admissionRequest.application_binding.wallet_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.application_binding.signing_root_id !== projection.preparedContext.signingRootId || projection.nearEd25519.admissionRequest.application_binding.key_creation_signer_slot !== nearPlan.signerSlot || projection.nearEd25519.admissionRequest.participant_ids.length !== nearPlan.participantIds.length || projection.nearEd25519.admissionRequest.participant_ids.some((participantId, index) => participantId !== nearPlan.participantIds[index]) || !walletAuthAuthoritiesMatch(derivedAuthority, receipt.authority) || record.prepared.walletId !== receipt.walletId || record.prepared.walletAuthorityId !== receipt.foundingAuthority.authorityId || record.prepared.deviceId !== foundingDeviceId || record.prepared.walletAuthMethodId !== receipt.walletAuthMethodId) throw new Error("registration activation receipt installation identity is invalid");
 		return {
 			receipt,
 			projection,
 			prepared: record.prepared
 		};
 	}
-	async prepareNearProvisioningOperation(registrationCeremonyId, allocated, installed) {
-		const ceremony = installed ? null : await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
+	/** Carries the preparation's ceremony into this request's execution. */
+	async prepareNearProvisioningOperation(registrationCeremonyId, allocated, source) {
+		const ceremony = source.kind === "ceremony" ? source.ceremony : null;
 		if (!ceremony) {
-			const committed = installed ?? await this.readCommittedRegistrationInstallation(registrationCeremonyId);
+			const committed = source.kind === "installation" ? source.installation : await this.readCommittedRegistrationInstallation(registrationCeremonyId);
 			if (!committed) throw new Error("Registration ceremony is unavailable for identity preparation");
-			if (allocated && (allocated.walletAuthorityId !== committed.prepared.walletAuthorityId || allocated.deviceId !== committed.prepared.deviceId || allocated.walletAuthMethodId !== committed.prepared.walletAuthMethodId)) throw new Error("registration operation identity does not match its committed installation");
-			return committed.prepared;
+			if (allocated && (allocated.walletId !== committed.prepared.walletId || allocated.walletAuthorityId !== committed.prepared.walletAuthorityId || allocated.deviceId !== committed.prepared.deviceId || allocated.walletAuthMethodId !== committed.prepared.walletAuthMethodId)) throw new Error("registration operation identity does not match its committed installation");
+			return {
+				prepared: committed.prepared,
+				ceremony: null
+			};
 		}
-		const prepared = allocated ?? walletRegistrationOperationPreparedFromCeremony(ceremony);
-		const authority = verifiedRegistrationCeremonyAuthority(ceremony);
-		if (!authority) return prepared;
-		const persisted = await this.walletAuthMethods.readActiveRegistrationIdentity(authority);
-		if (!persisted) return prepared;
 		return {
-			kind: prepared.kind,
-			walletAuthorityId: persisted.walletAuthorityId,
-			deviceId: prepared.deviceId,
-			walletAuthMethodId: persisted.walletAuthMethodId
+			prepared: walletRegistrationOperationPreparedFromCeremony(ceremony, allocated),
+			ceremony
 		};
 	}
 	async commitDeferredEd25519Signer(args, prepared) {
+		const sourceStartedAtMs = Date.now();
 		const committedInstallation = args.authoritySource.kind === "committed_mixed" ? args.authoritySource.installation : null;
 		if (committedInstallation && !isRegistrationEcdsaReadyReceipt(committedInstallation.receipt)) throw new Error("Committed mixed registration receipt is not ECDSA-ready");
-		const ownerProofContext = committedInstallation ? {
-			expectedOrigin: committedInstallation.receipt.expectedOrigin,
-			runtimePolicyScope: registrationPreparedContextRuntimePolicyScope(committedInstallation.projection.preparedContext),
-			expiresAtMs: committedInstallation.receipt.expiresAtMs
-		} : await this.readRegistrationOwnerProofContext(args.input.registrationCeremonyId);
-		if (!ownerProofContext) throw new Error("Registration owner proof context is unavailable");
-		if (!ownerProofContext.runtimePolicyScope) throw new Error("Committed registration is missing its runtime policy scope");
-		const ceremony = committedInstallation ? null : await this.getRegistrationCeremonyIntentStore().getCeremony(args.input.registrationCeremonyId);
-		let recovery = null;
-		let registrationAuthority;
+		const preparedCeremony = committedInstallation ? null : args.preparedCeremony();
+		const ceremony = committedInstallation || preparedCeremony ? preparedCeremony : await this.getRegistrationCeremonyIntentStore().getCeremony(args.input.registrationCeremonyId);
+		let source;
+		let ownerProofContext;
+		let effectivePrepared;
 		let sessionPredecessor;
 		if (ceremony) {
-			const authority = verifiedRegistrationCeremonyAuthority(ceremony);
-			if (!authority) throw new Error("Registration authority is unavailable before finalize");
-			registrationAuthority = authority;
+			source = {
+				kind: "stored_ceremony",
+				ceremony
+			};
+			ownerProofContext = registrationOwnerProofContextFromCeremony(ceremony);
+			if (!verifiedRegistrationCeremonyAuthority(ceremony)) throw new Error("Registration authority is unavailable before finalize");
 			sessionPredecessor = { kind: "ed25519_only" };
+			effectivePrepared = walletRegistrationOperationPreparedFromCeremony(ceremony, prepared);
 		} else {
 			const committed = committedInstallation ?? await this.readCommittedRegistrationInstallation(args.input.registrationCeremonyId);
 			if (!committed) throw new Error("Committed registration installation is unavailable");
-			recovery = registrationFinalizeRecoveryFromCommittedInstallation({
+			source = registrationFinalizeRecoveryFromCommittedInstallation({
 				setupClaims: args.setupClaims,
 				projection: committed.projection
 			});
-			const authority = verifiedRegistrationCeremonyAuthority(recovery.ceremony);
-			if (!authority) throw new Error("Committed registration installation has no verified authority");
-			registrationAuthority = authority;
+			if (!verifiedRegistrationCeremonyAuthority(source.ceremony)) throw new Error("Committed registration installation has no verified authority");
 			const activationReceipt = committed.receipt;
 			if (!isRegistrationEcdsaReadyReceipt(activationReceipt)) throw new Error("Committed mixed registration receipt is not ECDSA-ready");
+			const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(committed.projection.preparedContext);
+			if (!runtimePolicyScope) throw new Error("Committed registration is missing its runtime policy scope");
+			ownerProofContext = {
+				expectedOrigin: activationReceipt.expectedOrigin,
+				runtimePolicyScope,
+				expiresAtMs: activationReceipt.expiresAtMs
+			};
+			effectivePrepared = (await this.prepareNearProvisioningOperation(args.input.registrationCeremonyId, prepared, {
+				kind: "installation",
+				installation: committed
+			})).prepared;
 			if (activationReceipt.committed.session.tokens.kind !== "evm_family_ecdsa") throw new Error("Committed mixed registration is missing its ECDSA session projection");
 			if (args.input.authorization.kind === "wallet_session") {
 				const authorization = args.authoritySource.kind === "committed_mixed" ? args.authoritySource.authorization : null;
@@ -2148,57 +2131,100 @@ var CloudflareD1WalletRegistrationService = class {
 				ecdsa: activationReceipt.committed.session.tokens.ecdsa
 			};
 		}
-		const effectivePrepared = await this.prepareNearProvisioningOperation(args.input.registrationCeremonyId, prepared, committedInstallation ?? void 0);
-		const committed = await this.executeWalletRegistrationFinalize({
-			kind: "near_ed25519",
-			registrationCeremonyId: args.input.registrationCeremonyId,
-			idempotencyKey: args.input.idempotencyKey,
-			ed25519: args.input.ed25519,
-			emailOtpEnrollment: args.input.emailOtpEnrollment,
-			walletCustodyCommit: args.input.walletCustodyCommit
-		}, effectivePrepared, recovery);
-		const finalized = committed.ok ? committed : throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(committed);
-		if (!finalized.ok || finalized.kind !== "near_ed25519") return unissuedRegistrationCommit(finalized);
+		recordRegistrationServerTiming(args.serverTiming, "near_finalize_source", sourceStartedAtMs);
+		const ceremonyAuthority = verifiedRegistrationCeremonyAuthority(source.ceremony);
+		if (!ceremonyAuthority) throw new Error("Registration authority is unavailable before finalize");
+		const sessionAuthority = registrationWalletAuthAuthority({
+			authority: ceremonyAuthority,
+			walletAuthMethodId: effectivePrepared.walletAuthMethodId
+		});
 		const proof = await buildRegistrationOwnerProof({
 			registrationCeremonyId: args.input.registrationCeremonyId,
-			authMethod: finalized.authMethod,
-			authority: finalized.authority,
+			authMethod: walletRegistrationFinalizeAuthMethodFromAuthority(ceremonyAuthority),
+			authority: sessionAuthority,
 			tenantId: this.authorizationTenantId,
 			expectedOrigin: ownerProofContext.expectedOrigin,
 			expiresAtMs: args.input.authorization.kind === "wallet_session" ? args.setupClaims.expiresAtMs : ownerProofContext.expiresAtMs
 		});
-		const issuedRegistrationSession = await issueDirectRegistrationEstablishedEd25519Session({
-			authorizationService: this.authorizationService,
-			authorizationTenantId: this.authorizationTenantId,
-			walletAuthMethods: this.walletAuthMethods,
+		const initialSessionPlan = sessionPredecessor.kind === "ed25519_only" && !registrationSignerBranchesFromPlan(source.ceremony.signerPlan).evmFamilyEcdsa ? {
+			kind: "initial_near",
+			store: this.registrationSessionStore,
+			request: {
+				authorizationService: this.authorizationService,
+				authorizationTenantId: this.authorizationTenantId,
+				registrationCeremonyId: args.input.registrationCeremonyId,
+				authority: sessionAuthority,
+				walletAuthMethodId: effectivePrepared.walletAuthMethodId,
+				expiresAtMs: Date.now() + DEFAULT_WALLET_SESSION_TTL_MS,
+				remainingUses: 3,
+				proof
+			}
+		} : { kind: "separate" };
+		const execution = await this.executeWalletRegistrationFinalize({
+			kind: "near_ed25519",
 			registrationCeremonyId: args.input.registrationCeremonyId,
-			authority: finalized.authority,
-			registrationAuthority,
-			walletAuthMethodId: effectivePrepared.walletAuthMethodId,
-			expiresAtMs: Date.now() + DEFAULT_WALLET_SESSION_TTL_MS,
-			remainingUses: 3,
-			publicResult: finalized.ed25519,
-			predecessor: sessionPredecessor,
-			keyManifestDigestB64u: finalized.custodyKeyManifestDigestB64u,
-			proof
-		});
+			idempotencyKey: args.input.idempotencyKey,
+			ed25519: args.input.ed25519,
+			emailOtpEnrollment: args.input.emailOtpEnrollment,
+			walletCustodyCommit: args.input.walletCustodyCommit
+		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision);
+		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
+		const finalized = execution.finalized;
+		if (finalized.kind !== "near_ed25519") {
+			await execution.custody;
+			return unissuedRegistrationCommit({
+				ok: false,
+				code: "internal",
+				message: "NEAR provisioning committed a non-NEAR branch"
+			});
+		}
+		if (!this.registrationAuthority) throw new Error("Registration home completion is unavailable");
+		const [issuance, custody] = await Promise.allSettled([recordRegistrationPromiseTiming({
+			sink: args.serverTiming,
+			name: "near_finalize_session_issue",
+			startedAtMs: Date.now(),
+			promise: issueDirectRegistrationEstablishedEd25519Session({
+				homeCompletion: this.registrationAuthority,
+				authorizationService: this.authorizationService,
+				authorizationTenantId: this.authorizationTenantId,
+				foundingAuthority: finalized.foundingAuthority,
+				registrationCeremonyId: args.input.registrationCeremonyId,
+				authority: finalized.authority,
+				walletAuthMethodId: effectivePrepared.walletAuthMethodId,
+				expiresAtMs: Date.now() + DEFAULT_WALLET_SESSION_TTL_MS,
+				remainingUses: 3,
+				publicResult: finalized.ed25519,
+				predecessor: sessionPredecessor,
+				initialSession: execution.initialSession,
+				keyManifestDigestB64u: finalized.custodyKeyManifestDigestB64u,
+				proof,
+				onSessionCommitted: finalized.authMethod.kind === "passkey" ? args.input.onSessionCommitted : void 0
+			})
+		}), execution.custody]);
+		if (issuance.status === "rejected") throw issuance.reason;
+		if (custody.status === "rejected") throw custody.reason;
+		const issuedRegistrationSession = issuance.value;
+		const custodyField = custody.value.status === "not_requested" ? {} : { walletCustody: custody.value };
 		switch (issuedRegistrationSession.kind) {
 			case "issued": return {
 				kind: "session_issued",
 				response: {
 					...finalized,
+					...custodyField,
 					registrationEstablishedSession: {
 						kind: "issued",
 						session: issuedRegistrationSession.session
 					}
 				},
 				issuedAtMs: issuedRegistrationSession.issuedAtMs,
-				expectedOrigin: ownerProofContext.expectedOrigin
+				expectedOrigin: ownerProofContext.expectedOrigin,
+				activation: issuedRegistrationSession.activation
 			};
 			case "already_committed": return {
 				kind: "session_issued",
 				response: {
 					...finalized,
+					...custodyField,
 					registrationEstablishedSession: {
 						kind: "already_committed",
 						session: issuedRegistrationSession.session,
@@ -2206,7 +2232,8 @@ var CloudflareD1WalletRegistrationService = class {
 					}
 				},
 				issuedAtMs: issuedRegistrationSession.issuedAtMs,
-				expectedOrigin: ownerProofContext.expectedOrigin
+				expectedOrigin: ownerProofContext.expectedOrigin,
+				activation: issuedRegistrationSession.activation
 			};
 			default: return assertNeverD1RegistrationSessionIssuance(issuedRegistrationSession);
 		}
@@ -2215,29 +2242,6 @@ var CloudflareD1WalletRegistrationService = class {
 		if (receipt.operation !== "registration_activate") throw new Error("Registration activation receipt operation is invalid");
 		switch (receipt.committed.kind) {
 			case "error": return replayedRegistrationCommit(receipt.committed.error);
-			case "near_pending": {
-				if (!isRegistrationNearPendingReceipt(receipt)) throw new Error("Registration pending receipt branch is invalid");
-				const authMethod = registrationReplayAuthMethodFields(receipt);
-				if (authMethod.kind === "passkey") return replayedRegistrationCommit({
-					ok: true,
-					kind: "near_ed25519",
-					walletId: receipt.walletId,
-					authority: receipt.authority,
-					authMethod: authMethod.authMethod,
-					rpId: authMethod.rpId,
-					...receipt.registrationDiagnostics ? { registrationDiagnostics: receipt.registrationDiagnostics } : {},
-					nearProvisioning: { status: "near_pending" }
-				});
-				return replayedRegistrationCommit({
-					ok: true,
-					kind: "near_ed25519",
-					walletId: receipt.walletId,
-					authority: receipt.authority,
-					authMethod: authMethod.authMethod,
-					...receipt.registrationDiagnostics ? { registrationDiagnostics: receipt.registrationDiagnostics } : {},
-					nearProvisioning: { status: "near_pending" }
-				});
-			}
 			case "ecdsa_ready": {
 				if (!isRegistrationEcdsaReadyReceipt(receipt)) throw new Error("Registration activation receipt branch is invalid");
 				const registrationEstablishedSession = replayDirectRegistrationEstablishedEcdsaSession(receipt);
@@ -2306,15 +2310,7 @@ var CloudflareD1WalletRegistrationService = class {
 			authMethod: authMethod.authMethod
 		});
 	}
-	/**
-	* Deferred NEAR provisioning. Verifies the signed setup, then reuses the
-	* existing deferred Ed25519 commit — the same path lazy-Yao 4+5 built — so
-	* signer installation and the implicit-account projection keep one
-	* implementation across both plans.
-	*
-	* A retryable failure leaves the pending wallet intact: the wallet must not
-	* be destroyed because its signer ceremony needs another attempt.
-	*/
+	/** Verifies registration or continuation authority without destroying retryable state. */
 	async verifyNearProvisioningAuthority(input) {
 		if (input.authorization.kind === "registration_grant") {
 			const verified = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
@@ -2360,7 +2356,7 @@ var CloudflareD1WalletRegistrationService = class {
 			}
 		};
 	}
-	async completeWalletRegistrationNearProvisioning(input, timingSink) {
+	async completeWalletRegistrationNearProvisioning(input, timingSink, waitUntil) {
 		const serverTiming = timingSink ?? [];
 		const totalStartedAtMs = Date.now();
 		try {
@@ -2372,11 +2368,14 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verified.code,
 				message: verified.message
 			};
-			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+			const admissionStartedAtMs = Date.now();
+			const operationKey = `near-provisioning:${input.registrationCeremonyId}:${input.idempotencyKey}`;
+			const initial = await this.registrationRead.readFinalization({
 				ceremonyId: verified.claims.registrationCeremonyId,
 				walletId: walletIdFromString(verified.claims.walletId)
-			});
-			if (!homeAdmission.ok) return homeAdmission;
+			}, operationKey);
+			recordRegistrationServerTiming(serverTiming, "near_finalize_initial_read", admissionStartedAtMs);
+			if (!initial.ok) return initial;
 			const fingerprintStartedAtMs = Date.now();
 			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
 				version: "wallet_registration_near_provisioning_digest_v1",
@@ -2388,19 +2387,34 @@ var CloudflareD1WalletRegistrationService = class {
 			})));
 			recordRegistrationServerTiming(serverTiming, "near_finalize_fingerprint", fingerprintStartedAtMs);
 			const sideEffectStartedAtMs = Date.now();
-			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.nearProvisioningSideEffects, {
+			let preparedCeremony = null;
+			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.registrationRead.operations, {
 				kind: "prepared_resumable",
 				operation: "near_provisioning",
-				key: `near-provisioning:${input.registrationCeremonyId}:${input.idempotencyKey}`,
+				key: operationKey,
+				initialRecord: initial.operation,
 				requestFingerprint,
 				resumeAfterMs: D1_WALLET_REGISTRATION_OPERATION_RESUME_AFTER_MS,
 				nowMs: Date.now,
-				prepare: async () => await this.prepareNearProvisioningOperation(input.registrationCeremonyId, void 0, verified.source.kind === "committed_mixed" ? verified.source.installation : void 0),
+				prepare: async () => {
+					const preparation = await this.prepareNearProvisioningOperation(input.registrationCeremonyId, null, verified.source.kind === "committed_mixed" ? {
+						kind: "installation",
+						installation: verified.source.installation
+					} : {
+						kind: "ceremony",
+						ceremony: await initial.readCeremony()
+					});
+					preparedCeremony = preparation.ceremony;
+					return preparation.prepared;
+				},
 				derivePreparedArtifactFingerprint: async (prepared) => base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared))),
 				execute: this.commitDeferredEd25519Signer.bind(this, {
 					input,
+					serverTiming,
 					setupClaims: verified.claims,
-					authoritySource: verified.source
+					authoritySource: verified.source,
+					preparedCeremony: () => preparedCeremony,
+					lifecycleDecision: initial.decision
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "near_provisioning",
@@ -2408,6 +2422,7 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: input.registrationCeremonyId,
 					execution
 				}),
+				completionWrite: registrationCommitActivation,
 				replay: this.replayWalletRegistrationNearProvisioningCommit.bind(this)
 			});
 			recordRegistrationServerTiming(serverTiming, "near_finalize_side_effect", sideEffectStartedAtMs);
@@ -2454,12 +2469,6 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "NEAR provisioning did not establish a Wallet Session",
 				nearProvisioning: { status: "near_failed_retryable" }
 			};
-			const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
-				ceremonyId: input.registrationCeremonyId,
-				walletId: walletIdFromString(committed.walletId),
-				outcome: "established"
-			});
-			if (!completedHome.ok) return completedHome;
 			const cleanup = recordRegistrationPromiseTiming({
 				sink: serverTiming,
 				name: "near_finalize_cleanup",
@@ -2469,6 +2478,7 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: input.registrationCeremonyId
 				})
 			});
+			if (waitUntil) waitUntil(cleanup);
 			if (input.authorization.kind === "wallet_session") {
 				const projectionStartedAtMs = Date.now();
 				const [current] = await Promise.all([recordRegistrationPromiseTiming({
@@ -2480,7 +2490,7 @@ var CloudflareD1WalletRegistrationService = class {
 						token: input.authorization.credential,
 						nowMs: Date.now()
 					})
-				}), cleanup]);
+				}), waitUntil ? void 0 : cleanup]);
 				const tokens = committed.registrationEstablishedSession.session.tokens;
 				if (!current || tokens.kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("NEAR continuation Wallet Session is no longer active");
 				recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);
@@ -2494,7 +2504,7 @@ var CloudflareD1WalletRegistrationService = class {
 					nearProvisioning: { status: "near_ready" }
 				};
 			}
-			await cleanup;
+			if (!waitUntil) await cleanup;
 			recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);
 			return {
 				...committed,
@@ -2511,100 +2521,6 @@ var CloudflareD1WalletRegistrationService = class {
 		}
 	}
 	/**
-	* Persists the Ed25519-only wallet in `near_pending`: wallet, profile, and
-	* authentication state, and no signer record — the signer does not exist
-	* until deferred Yao produces it.
-	*
-	* The terminal response carries no signer, resolved account, or key
-	* identity, because none of those are known yet. Reporting them would be
-	* fabricating readiness.
-	*/
-	async commitEd25519PendingWallet(input) {
-		const now = Date.now();
-		const ceremony = input.ceremony;
-		const authority = input.authority;
-		const wallet = buildD1WalletRecord({
-			walletId: ceremony.intent.walletId,
-			now
-		});
-		const walletAuthAuthority = registrationWalletAuthAuthority({
-			authority,
-			walletAuthMethodId: input.walletAuthMethodId
-		});
-		switch (authority.kind) {
-			case "passkey":
-				await this.walletRegistrationCommitStore.commit({
-					kind: "passkey_wallet_registration_commit_v1",
-					wallet,
-					walletSigners: [],
-					authority,
-					now,
-					decisionStatements: []
-				});
-				break;
-			case "email_otp": {
-				const enrollment = await this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationFinalize({
-					authority,
-					request: input.enrollment,
-					walletId: ceremony.intent.walletId,
-					orgId: ceremony.orgId,
-					nowMs: now
-				});
-				if (!enrollment.ok) return enrollment;
-				if (!enrollment.persistence) return {
-					ok: false,
-					code: "invalid_state",
-					message: "Email OTP registration is missing enrollment persistence state"
-				};
-				await this.walletRegistrationCommitStore.commit({
-					kind: "email_otp_wallet_registration_commit_v1",
-					wallet,
-					walletSigners: [],
-					authority,
-					emailOtp: this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(enrollment.persistence),
-					now,
-					decisionStatements: []
-				});
-				const completedIdentity = await this.emailOtpRegistrationEnrollmentFinalizer.completeRegistrationIdentity({
-					authority,
-					walletId: ceremony.intent.walletId
-				});
-				if (!completedIdentity.ok) return completedIdentity;
-				break;
-			}
-		}
-		const authMethod = walletRegistrationFinalizeAuthMethodFromAuthority(authority);
-		if (authMethod.kind === "passkey") {
-			if (!isPasskeyWalletAuthAuthority(walletAuthAuthority)) return {
-				ok: false,
-				code: "internal",
-				message: "Passkey registration returned a different authority"
-			};
-			return buildWalletRegistrationActivatePendingPasskeyResponse({
-				walletId: ceremony.intent.walletId,
-				authority: walletAuthAuthority,
-				authMethod,
-				rpId: finalizePasskeyRpId(authority)
-			});
-		}
-		if (!isEmailOtpWalletAuthAuthority(walletAuthAuthority)) return {
-			ok: false,
-			code: "internal",
-			message: "Email OTP registration returned a different authority"
-		};
-		return buildWalletRegistrationActivatePendingEmailOtpResponse({
-			walletId: ceremony.intent.walletId,
-			authority: walletAuthAuthority,
-			authMethod
-		});
-	}
-	/**
-	* Ed25519-only respond. The wallet's sole signer is Yao, and that is
-	* deliberately not a reason to block: the admission is returned as deferred
-	* work exactly as on a mixed plan, and the wallet lives in `near_pending`
-	* until the computation completes.
-	*/
-	/**
 	* Respond replay stays authority-bound.
 	*
 	* `signedSetup` is client-carried, so possession of it must never recover a
@@ -2646,6 +2562,7 @@ var CloudflareD1WalletRegistrationService = class {
 	async respondEd25519OnlyRegistration(input) {
 		const ceremony = input.ceremony;
 		const stored = storedRespondEd25519DeferredWork(ceremony.signerState);
+		let authority;
 		if (stored) {
 			const replayAuthority = await this.verifyRespondReplayAuthority({
 				ceremony,
@@ -2653,74 +2570,95 @@ var CloudflareD1WalletRegistrationService = class {
 				expectedOrigin: input.expectedOrigin,
 				...input.userAgent ? { userAgent: input.userAgent } : {}
 			});
-			if (!replayAuthority.ok) return {
+			if (!replayAuthority.ok) return replayAuthority;
+			const retainedAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
+			if (!retainedAuthority) return {
 				ok: false,
-				code: replayAuthority.code,
-				message: replayAuthority.message
+				code: "invalid_state",
+				message: "Registration authority is unavailable"
 			};
-			return {
-				ok: true,
-				registrationCeremonyId: ceremony.registrationCeremonyId,
-				kind: "near_ed25519",
-				ed25519: stored
+			authority = retainedAuthority;
+		} else {
+			const verified = await this.walletAuthMethods.verifyRegistrationAuthorityForIntent({
+				orgId: ceremony.orgId,
+				authority: input.authorityInput,
+				expectedDigestB64u: ceremony.digestB64u,
+				expectedOrigin: input.expectedOrigin,
+				intent: ceremony.intent,
+				verificationOperationId: ceremony.registrationCeremonyId,
+				verificationReceiptExpiresAtMs: ceremony.expiresAtMs,
+				...input.userAgent ? { userAgent: input.userAgent } : {}
+			});
+			if (!verified.ok) return {
+				ok: false,
+				code: verified.code,
+				message: verified.message
 			};
+			authority = verified.authority;
 		}
-		const verifiedAuthority = await this.walletAuthMethods.verifyRegistrationAuthorityForIntent({
-			orgId: ceremony.orgId,
-			authority: input.authorityInput,
-			expectedDigestB64u: ceremony.digestB64u,
-			expectedOrigin: input.expectedOrigin,
-			intent: ceremony.intent,
-			verificationOperationId: ceremony.registrationCeremonyId,
-			verificationReceiptExpiresAtMs: ceremony.expiresAtMs,
-			...input.userAgent ? { userAgent: input.userAgent } : {}
-		});
-		if (!verifiedAuthority.ok) return {
-			ok: false,
-			code: verifiedAuthority.code,
-			message: verifiedAuthority.message
-		};
-		const authority = verifiedAuthority.authority;
 		if (authority.walletId !== ceremony.intent.walletId) return {
 			ok: false,
 			code: "scope_mismatch",
 			message: "registration authority walletId does not match the ceremony"
 		};
-		const admitted = await this.authorizeRespondEd25519Branch({
+		const runtime = this.getEd25519YaoProductRegistration();
+		if (!runtime) return {
+			ok: false,
+			code: "not_configured",
+			message: "Ed25519 Yao registration is unavailable"
+		};
+		const admissionRequest = stored ? stored.admissionRequest : await buildRespondEd25519AdmissionRequest({
 			ceremony,
 			branch: input.branch,
 			authority,
-			registrationBearerToken: input.registrationBearerToken
+			signingWorkerId: runtime.signingWorkerId
+		});
+		const verifiedAuthority = authority;
+		const branchKey = input.branch.branchKey;
+		const ceremonyStore = this.getRegistrationCeremonyIntentStore();
+		const authorizedCeremony = (bound) => ({
+			...ceremony,
+			authorityState: {
+				kind: "verified",
+				authority: verifiedAuthority
+			},
+			signerState: {
+				kind: "signer_set_registration",
+				branches: [buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch({
+					branchKey,
+					admissionRequest: bound
+				})]
+			}
 		});
+		const admitted = await runtime.bindAndAdmitVerifiedRegistration({
+			kind: "verified_registration_intent",
+			ownershipGeneration: input.ownershipGeneration,
+			registrationIntentGrant: registrationIntentGrantFromString(input.registrationBearerToken),
+			intent: ceremony.intent,
+			admissionRequest,
+			expiresAtMs: ceremony.expiresAtMs
+		}, stored ? null : (bound) => ceremonyStore.prepareEcdsaClaimCommit({
+			expected: input.snapshot,
+			next: authorizedCeremony(bound)
+		}), input.startedDispatchRoot);
 		if (!admitted.ok) return {
 			ok: false,
 			code: admitted.code,
 			message: admitted.message
 		};
-		if (!admitted.branch || !admitted.deferred) return {
-			ok: false,
-			code: "internal",
-			message: "Ed25519 admission produced no branch"
-		};
-		await this.getRegistrationCeremonyIntentStore().commitEcdsaClaim({
+		if (!stored && admitted.companionWrite === "not_committed") await ceremonyStore.commitEcdsaClaim({
 			expected: input.snapshot,
-			next: {
-				...ceremony,
-				authorityState: {
-					kind: "verified",
-					authority
-				},
-				signerState: {
-					kind: "signer_set_registration",
-					branches: [admitted.branch]
-				}
-			}
+			next: authorizedCeremony(admitted.admissionRequest)
 		});
 		return {
 			ok: true,
 			registrationCeremonyId: ceremony.registrationCeremonyId,
 			kind: "near_ed25519",
-			ed25519: admitted.deferred
+			ed25519: {
+				status: "admitted",
+				admissionRequest: admitted.admissionRequest,
+				admissionReceipt: admitted.value
+			}
 		};
 	}
 	/**
@@ -2741,21 +2679,15 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "not_configured",
 			message: "Ed25519 Yao product registration is not configured"
 		};
-		const admissionRequest = await buildRouterAbEd25519YaoProductAdmissionRequestV1({
-			registrationCeremonyId: input.ceremony.registrationCeremonyId,
-			walletId: input.ceremony.intent.walletId,
-			signingRootId: normalizeOptionalTrimmedString(input.ceremony.signingRootId) || "",
-			signingRootVersion: normalizeOptionalTrimmedString(input.ceremony.signingRootVersion) || "",
-			authorityScope: registrationEd25519AuthorityScopeFromAuthority(input.authority),
+		const admissionRequest = await buildRespondEd25519AdmissionRequest({
+			ceremony: input.ceremony,
 			branch: input.branch,
-			signingWorkerId: yaoRuntime.signingWorkerId,
-			materialActivation: createRouterAbEd25519YaoMaterialActivationRefV1({
-				walletId: input.ceremony.intent.walletId,
-				signingWorkerId: yaoRuntime.signingWorkerId
-			})
+			authority: input.authority,
+			signingWorkerId: yaoRuntime.signingWorkerId
 		});
 		const admitted = await yaoRuntime.bindVerifiedIntent({
 			kind: "verified_registration_intent",
+			ownershipGeneration: input.ownershipGeneration,
 			registrationIntentGrant: registrationIntentGrantFromString(input.registrationBearerToken),
 			intent: input.ceremony.intent,
 			admissionRequest,
@@ -2832,10 +2764,14 @@ var CloudflareD1WalletRegistrationService = class {
 				kind: "prepared_resumable",
 				operation: "registration_activate",
 				key: `registration-activate:${claims.registrationCeremonyId}:${idempotencyKey}`,
+				initialRecord: await this.activateSideEffects.read(`registration-activate:${claims.registrationCeremonyId}:${idempotencyKey}`),
 				requestFingerprint: activateDigestB64u,
 				resumeAfterMs: D1_WALLET_REGISTRATION_OPERATION_RESUME_AFTER_MS,
 				nowMs: Date.now,
-				prepare: async () => await this.prepareNearProvisioningOperation(claims.registrationCeremonyId),
+				prepare: async () => (await this.prepareNearProvisioningOperation(claims.registrationCeremonyId, null, {
+					kind: "ceremony",
+					ceremony: await this.getRegistrationCeremonyIntentStore().getCeremony(claims.registrationCeremonyId)
+				})).prepared,
 				derivePreparedArtifactFingerprint: async (prepared) => base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared))),
 				execute: this.executeWalletRegistrationActivation.bind(this, {
 					registrationCeremonyId: claims.registrationCeremonyId,
@@ -2850,19 +2786,12 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: claims.registrationCeremonyId,
 					execution
 				}),
+				completionWrite: registrationCommitActivation,
 				replay: this.replayWalletRegistrationActivateCommit.bind(this)
 			});
 			switch (run.kind) {
 				case "executed":
 				case "exact_replay":
-					if (run.value.response.ok && run.value.response.kind !== "near_ed25519") {
-						const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
-							ceremonyId: claims.registrationCeremonyId,
-							walletId: walletIdFromString(run.value.response.walletId),
-							outcome: "established"
-						});
-						if (!completedHome.ok) return completedHome;
-					}
 					if (run.value.response.ok && run.value.response.kind === "evm_family_ecdsa") await cleanupFinalizedRegistrationCeremony({
 						store: this.getRegistrationCeremonyIntentStore(),
 						registrationCeremonyId: claims.registrationCeremonyId
@@ -2909,36 +2838,15 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "not_found",
 			message: "registration ceremony not found"
 		});
-		const ceremonyAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
-		if (!ceremonyAuthority) return unissuedRegistrationCommit({
+		if (!verifiedRegistrationCeremonyAuthority(ceremony)) return unissuedRegistrationCommit({
 			ok: false,
 			code: "invalid_state",
 			message: "registration ceremony has not verified its authority proof"
 		});
-		if (!registrationSignerBranchesFromPlan(ceremony.signerPlan).evmFamilyEcdsa) {
-			const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
-			if (!expectedOrigin) return unissuedRegistrationCommit({
-				ok: false,
-				code: "invalid_state",
-				message: "registration ceremony has no expected origin"
-			});
-			const pending = await this.commitEd25519PendingWallet({
-				ceremony,
-				authority: ceremonyAuthority,
-				walletAuthMethodId: prepared.walletAuthMethodId,
-				enrollment: { ...context.input.emailOtpEnrollment ? { emailOtpEnrollment: context.input.emailOtpEnrollment } : {} }
-			});
-			if (!pending.ok) return unissuedRegistrationCommit(pending);
-			return {
-				kind: "near_pending",
-				response: pending,
-				expectedOrigin
-			};
-		}
-		if (!context.input.ecdsa) return unissuedRegistrationCommit({
+		if (!registrationSignerBranchesFromPlan(ceremony.signerPlan).evmFamilyEcdsa) return unissuedRegistrationCommit({
 			ok: false,
-			code: "invalid_body",
-			message: "browser-verified clientActivation is required for this signer plan"
+			code: "scope_mismatch",
+			message: "NEAR-only registration commits through NEAR finalization"
 		});
 		const ecdsa = context.input.ecdsa;
 		const activated = await this.activateWalletRegistrationEcdsa({
@@ -2958,22 +2866,30 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "internal",
 			message: "ECDSA activation completed without a key handle to commit"
 		});
-		const ownerProofContext = await this.readRegistrationOwnerProofContext(context.registrationCeremonyId);
-		if (!ownerProofContext) throw new Error("Registration owner proof context is unavailable");
-		const commit = await this.executeWalletRegistrationFinalize({
+		const activatedCeremony = await this.getRegistrationCeremonyIntentStore().getCeremony(context.registrationCeremonyId);
+		if (!activatedCeremony) throw new Error("Registration owner proof context is unavailable");
+		const ownerProofContext = registrationOwnerProofContextFromCeremony(activatedCeremony);
+		const execution = await this.executeWalletRegistrationFinalize({
 			kind: "evm_family_ecdsa",
 			registrationCeremonyId: context.registrationCeremonyId,
 			idempotencyKey: context.idempotencyKey,
 			ecdsa: { expectedKeyHandles: [keyHandle] },
 			...context.input.emailOtpEnrollment ? { emailOtpEnrollment: context.input.emailOtpEnrollment } : {},
 			...context.input.walletCustodyCommit !== void 0 ? { walletCustodyCommit: context.input.walletCustodyCommit } : {}
-		}, prepared, null);
-		if (!commit.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(commit));
-		if (commit.kind !== "evm_family_ecdsa") return unissuedRegistrationCommit({
-			ok: false,
-			code: "internal",
-			message: "registration activation committed a non-ECDSA branch"
-		});
+		}, prepared, {
+			kind: "stored_ceremony",
+			ceremony: activatedCeremony
+		}, [], { kind: "separate" }, null);
+		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
+		const commit = execution.finalized;
+		if (commit.kind !== "evm_family_ecdsa") {
+			await execution.custody;
+			return unissuedRegistrationCommit({
+				ok: false,
+				code: "internal",
+				message: "registration activation committed a non-ECDSA branch"
+			});
+		}
 		let installationProjection = null;
 		if (registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519) {
 			const committedCeremony = await this.getRegistrationCeremonyIntentStore().getCeremony(context.registrationCeremonyId);
@@ -2982,25 +2898,30 @@ var CloudflareD1WalletRegistrationService = class {
 		}
 		const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
 		if (!runtimePolicyScope) throw new Error("ECDSA registration is missing runtime policy scope");
-		const registrationEstablishedSession = await issueDirectRegistrationEstablishedEcdsaSession({
+		if (!this.registrationAuthority) throw new Error("Registration home completion is unavailable");
+		const proof = await this.registrationOwnerProofWithContext(ownerProofContext, {
+			registrationCeremonyId: context.registrationCeremonyId,
+			authMethod: commit.authMethod,
+			authority: commit.authority
+		});
+		const [issuance, custody] = await Promise.allSettled([issueDirectRegistrationEstablishedEcdsaSession({
+			homeCompletion: this.registrationAuthority,
 			authorizationService: this.authorizationService,
 			authorizationTenantId: this.authorizationTenantId,
-			walletAuthMethods: this.walletAuthMethods,
+			foundingAuthority: commit.foundingAuthority,
 			registrationCeremonyId: context.registrationCeremonyId,
 			authority: commit.authority,
-			registrationAuthority: ceremonyAuthority,
 			walletAuthMethodId: prepared.walletAuthMethodId,
 			expiresAtMs: activated.ecdsa.bootstrap.expiresAtMs,
 			remainingUses: activated.ecdsa.bootstrap.remainingUses,
 			bootstrap: activated.ecdsa.bootstrap,
 			runtimePolicyScope,
 			keyManifestDigestB64u: commit.custodyKeyManifestDigestB64u,
-			proof: await this.registrationOwnerProofWithContext(ownerProofContext, {
-				registrationCeremonyId: context.registrationCeremonyId,
-				authMethod: commit.authMethod,
-				authority: commit.authority
-			})
-		});
+			proof
+		}), execution.custody]);
+		if (issuance.status === "rejected") throw issuance.reason;
+		if (custody.status === "rejected") throw custody.reason;
+		const registrationEstablishedSession = issuance.value;
 		const registrationEstablishedSessionResult = registrationEstablishedSessionResultFromIssuance(registrationEstablishedSession);
 		const responseBase = {
 			ok: true,
@@ -3010,7 +2931,7 @@ var CloudflareD1WalletRegistrationService = class {
 			foundingAuthority: commit.foundingAuthority,
 			foundingAuthMethod: commit.foundingAuthMethod,
 			...commit.registrationDiagnostics ? { registrationDiagnostics: commit.registrationDiagnostics } : {},
-			...commit.walletCustody ? { walletCustody: commit.walletCustody } : {},
+			...custody.value.status === "not_requested" ? {} : { walletCustody: custody.value },
 			custodyKeyManifestDigestB64u: commit.custodyKeyManifestDigestB64u,
 			ecdsa: {
 				...commit.ecdsa,
@@ -3022,7 +2943,8 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 		const issuedContext = {
 			issuedAtMs: registrationEstablishedSession.issuedAtMs,
-			expectedOrigin: ownerProofContext.expectedOrigin
+			expectedOrigin: ownerProofContext.expectedOrigin,
+			activation: registrationEstablishedSession.activation
 		};
 		if (commit.authMethod.kind === "passkey") {
 			if (!commit.rpId) throw new Error("Passkey registration activation is missing its RP ID");
@@ -3293,9 +3215,10 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	async executeWalletRegistrationFinalize(request, prepared, recovery) {
+	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision) {
 		const finalizeTiming = createD1RegistrationRouteTimingRecorder("wallets_register_finalize");
 		const totalTiming = startD1RegistrationRouteTiming("registerFinalizeTotalMs");
+		let startedCustody = null;
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
 			if (!normalizeOptionalTrimmedString(request.idempotencyKey)) return {
@@ -3304,29 +3227,20 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "registration finalize idempotencyKey is required"
 			};
 			const requestFingerprint = await walletRegistrationFinalizeRequestFingerprint(request);
-			const ceremonyLoadTiming = startD1RegistrationRouteTiming("registrationCeremonyLoadMs");
-			let storedCeremony;
-			try {
-				storedCeremony = await store.getCeremony(request.registrationCeremonyId);
-			} finally {
-				finishD1RegistrationRouteTiming(finalizeTiming, ceremonyLoadTiming);
-			}
-			let ceremony;
-			if (storedCeremony) {
-				if (storedCeremony.signerState.kind !== "signer_set_registration") return {
-					ok: false,
-					code: "invalid_state",
-					message: "signer-set registration state is required"
-				};
-				ceremony = registrationFinalizeCeremonyFromStored(storedCeremony);
-			} else if (recovery) {
+			const storedCeremony = source.kind === "stored_ceremony" ? source.ceremony : null;
+			const ceremony = source.kind === "stored_ceremony" ? registrationFinalizeCeremonyFromStored(source.ceremony) : source.ceremony;
+			if (ceremony.registrationCeremonyId !== request.registrationCeremonyId) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "registration ceremony mismatch"
+			};
+			if (source.kind === "committed_mixed_installation") {
 				if (request.kind !== "near_ed25519") return {
 					ok: false,
 					code: "invalid_state",
 					message: "committed mixed registration can only finalize NEAR Ed25519"
 				};
-				ceremony = recovery.ceremony;
-			} else return {
+			} else if (ceremony.expiresAtMs <= Date.now()) return {
 				ok: false,
 				code: "not_found",
 				message: "registration ceremony not found"
@@ -3351,7 +3265,7 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "registration signer set requires a signer branch"
 			};
 			const storedEcdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
-			const ecdsaAlreadyFinalized = storedCeremony === null && recovery !== null || storedEcdsaBranch?.kind === "evm_family_ecdsa_finalized";
+			const ecdsaAlreadyFinalized = source.kind === "committed_mixed_installation" || storedEcdsaBranch?.kind === "evm_family_ecdsa_finalized";
 			const sequenceFailure = finalizeSignerWorkSequenceFailure({
 				request,
 				hasNearEd25519: requestedNearEd25519 !== null,
@@ -3478,8 +3392,26 @@ var CloudflareD1WalletRegistrationService = class {
 			let ed25519SignerRecord = null;
 			let ed25519MaterialActivation = null;
 			let ed25519RegisteredPublicKeyB64u = null;
-			let ed25519CapabilityInstallation = null;
 			let yaoDecision = null;
+			let yaoDecisionFound = null;
+			let commitWallet;
+			const reserveCustody = () => recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_custody_reserve",
+				startedAtMs: Date.now(),
+				promise: reserveRegistrationCustody({
+					payload: walletCustodyCommitPayload,
+					verifiedWalletId: ceremony.intent.walletId,
+					verifiedAuthority: walletAuthAuthority,
+					...emailOtpEnrollment.persistence ? { verifiedEmailOtpEnrollment: {
+						enrollmentId: emailOtpEnrollment.persistence.enrollment.enrollmentId,
+						enrollmentSealKeyVersion: emailOtpEnrollment.persistence.enrollment.enrollmentSealKeyVersion
+					} } : {},
+					nowMs: now,
+					store: this.walletCustodyCommitStore
+				})
+			});
+			let custodyReservation;
 			if (finalizeNearEd25519) {
 				const yaoRuntime = this.getEd25519YaoProductRegistration();
 				if (!yaoRuntime) return {
@@ -3505,13 +3437,24 @@ var CloudflareD1WalletRegistrationService = class {
 					code: "scope_mismatch",
 					message: "Ed25519 activation reference does not belong to this registration ceremony"
 				};
-				const consumed = await yaoRuntime.consumeActivated({
-					reference: {
-						lifecycleId: activationReference.lifecycle_id,
-						sessionId: activationReference.session_id
-					},
-					consumerBinding: requestFingerprint
-				});
+				custodyReservation = reserveCustody();
+				startedCustody = custodyReservation;
+				const [activationConsumption, authorityReservation] = await Promise.allSettled([recordRegistrationPromiseTiming({
+					sink: serverTiming,
+					name: "near_finalize_router_consume",
+					startedAtMs: Date.now(),
+					promise: yaoRuntime.consumeActivated({
+						reference: {
+							lifecycleId: activationReference.lifecycle_id,
+							sessionId: activationReference.session_id
+						},
+						consumerBinding: requestFingerprint
+					})
+				}), this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority)]);
+				if (activationConsumption.status === "rejected") throw activationConsumption.reason;
+				if (authorityReservation.status === "rejected") throw authorityReservation.reason;
+				const consumed = activationConsumption.value;
+				commitWallet = authorityReservation.value;
 				if (!consumed.ok) return {
 					ok: false,
 					code: consumed.code,
@@ -3575,7 +3518,7 @@ var CloudflareD1WalletRegistrationService = class {
 				});
 				if (!resolved.ok) return resolved;
 				resolvedNearAccount = resolved.value;
-				ed25519CapabilityInstallation = {
+				const activeYaoCapability = buildRouterAbEd25519YaoRegistrationCapabilityRecordV1({
 					kind: "router_ab_ed25519_yao_registration_finalize_capability_v1",
 					activeCapabilityBinding: consumed.activation.result.binding.session_id,
 					nearAccountId,
@@ -3583,8 +3526,7 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationAdmissionReceipt: consumed.activation.admissionReceipt,
 					registrationResult: consumed.activation.result,
 					runtimePolicyScope
-				};
-				const activeYaoCapability = buildRouterAbEd25519YaoRegistrationCapabilityRecordV1(ed25519CapabilityInstallation);
+				});
 				if (!activeYaoCapability.ok) return {
 					ok: false,
 					code: activeYaoCapability.code,
@@ -3597,6 +3539,7 @@ var CloudflareD1WalletRegistrationService = class {
 					consumerBinding: requestFingerprint,
 					capability: activeYaoCapability.record
 				});
+				yaoDecisionFound = routerAbEd25519YaoLifecycleDecisionLookupV1(yaoDecision, lifecycleDecision);
 				const activatedEd25519PublicResult = {
 					signerSlot: finalizeNearEd25519.signerSlot,
 					nearAccountId,
@@ -3632,14 +3575,18 @@ var CloudflareD1WalletRegistrationService = class {
 					custodyKeyManifestDigestB64u,
 					now
 				});
+			} else {
+				custodyReservation = reserveCustody();
+				startedCustody = custodyReservation;
+				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority);
 			}
-			const yaoDecisionFound = yaoDecision ? routerAbEd25519YaoLifecycleDecisionLookupV1(yaoDecision, await this.yaoLifecycleDecisions.read(yaoDecision.lifecycleId)) : null;
 			if (yaoDecisionFound?.kind === "decided_otherwise") return {
 				ok: false,
 				code: "invalid_state",
 				message: "Ed25519 Yao registration lifecycle was finalized by another request"
 			};
 			let foundingAuthorityRecords = null;
+			let initialSession = { kind: "uncommitted" };
 			if (yaoDecisionFound?.kind !== "decided") {
 				const wallet = buildD1WalletRecord({
 					walletId: ceremony.intent.walletId,
@@ -3765,6 +3712,7 @@ var CloudflareD1WalletRegistrationService = class {
 				}
 				const decisionStatements = yaoDecision ? this.yaoLifecycleDecisions.prepareDecideStatements(yaoDecision, now) : [];
 				const persistenceTiming = startD1RegistrationRouteTiming("relayPersistenceMs");
+				const walletCommitStartedAtMs = Date.now();
 				try {
 					switch (ceremonyAuthority.kind) {
 						case "passkey":
@@ -3773,24 +3721,22 @@ var CloudflareD1WalletRegistrationService = class {
 								code: "invalid_state",
 								message: "Passkey registration cannot persist Email OTP enrollment state"
 							};
-							if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
+							if (foundingAuthorityRecords) initialSession = await commitWalletRegistration(commitWallet, {
 								kind: "passkey_wallet_registration_commit_v1",
 								wallet,
 								walletSigners,
-								authority: ceremonyAuthority,
 								foundingAuthority: foundingAuthorityRecords.authority,
 								foundingAuthMethod: foundingAuthorityRecords.authMethod,
 								now,
 								decisionStatements
-							});
-							else await this.walletRegistrationCommitStore.commit({
+							}, initialSessionPlan);
+							else initialSession = await commitWalletRegistration(commitWallet, {
 								kind: "passkey_wallet_registration_commit_v1",
 								wallet,
 								walletSigners,
-								authority: ceremonyAuthority,
 								now,
 								decisionStatements
-							});
+							}, initialSessionPlan);
 							break;
 						case "email_otp": {
 							if (!emailOtpEnrollment.persistence) return {
@@ -3799,31 +3745,30 @@ var CloudflareD1WalletRegistrationService = class {
 								message: "Email OTP registration is missing enrollment persistence state"
 							};
 							const emailOtp = this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(emailOtpEnrollment.persistence);
-							if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
+							if (foundingAuthorityRecords) initialSession = await commitWalletRegistration(commitWallet, {
 								kind: "email_otp_wallet_registration_commit_v1",
 								wallet,
 								walletSigners,
-								authority: ceremonyAuthority,
 								emailOtp,
 								foundingAuthority: foundingAuthorityRecords.authority,
 								foundingAuthMethod: foundingAuthorityRecords.authMethod,
 								now,
 								decisionStatements
-							});
-							else await this.walletRegistrationCommitStore.commit({
+							}, initialSessionPlan);
+							else initialSession = await commitWalletRegistration(commitWallet, {
 								kind: "email_otp_wallet_registration_commit_v1",
 								wallet,
 								walletSigners,
-								authority: ceremonyAuthority,
 								emailOtp,
 								now,
 								decisionStatements
-							});
+							}, initialSessionPlan);
 							break;
 						}
 					}
 				} finally {
 					finishD1RegistrationRouteTiming(finalizeTiming, persistenceTiming);
+					recordRegistrationServerTiming(serverTiming, "near_finalize_wallet_commit", walletCommitStartedAtMs);
 				}
 			}
 			const completedRegistrationIdentity = await this.emailOtpRegistrationEnrollmentFinalizer.completeRegistrationIdentity({
@@ -3839,36 +3784,20 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			const foundingAuthority = persistedFoundingRecords.authority;
 			const foundingAuthMethod = persistedFoundingRecords.authMethod;
-			if (ed25519CapabilityInstallation) {
-				const yaoRuntime = this.getEd25519YaoProductRegistration();
-				if (!yaoRuntime) return {
-					ok: false,
-					code: "not_configured",
-					message: "Ed25519 Yao product registration is not configured"
-				};
-				const installed = await yaoRuntime.installRegistrationFinalizeCapability(ed25519CapabilityInstallation);
-				if (!installed.ok) return {
-					ok: false,
-					code: installed.code,
-					message: installed.message
-				};
-			}
-			const walletCustody = await commitRegistrationCustody({
-				payload: walletCustodyCommitPayload,
-				verifiedWalletId: ceremony.intent.walletId,
-				verifiedAuthority: walletAuthAuthority,
-				...emailOtpEnrollment.persistence ? { verifiedEmailOtpEnrollment: {
-					enrollmentId: emailOtpEnrollment.persistence.enrollment.enrollmentId,
-					enrollmentSealKeyVersion: emailOtpEnrollment.persistence.enrollment.enrollmentSealKeyVersion
-				} } : {},
-				nowMs: now,
-				store: this.walletCustodyCommitStore
-			});
-			if (walletCustody.status === "rejected") console.warn("[wallet-registration] custody commit rejected", {
-				registrationCeremonyId: ceremony.registrationCeremonyId,
-				reason: walletCustody.reason
+			const custody = custodyReservation.then(async (commitCustody) => {
+				const walletCustody = await recordRegistrationPromiseTiming({
+					sink: serverTiming,
+					name: "near_finalize_custody_commit",
+					startedAtMs: Date.now(),
+					promise: commitCustody()
+				});
+				if (walletCustody.status === "rejected") console.warn("[wallet-registration] custody commit rejected", {
+					registrationCeremonyId: ceremony.registrationCeremonyId,
+					reason: walletCustody.reason
+				});
+				return walletCustody;
 			});
-			const custodyField = walletCustody.status === "not_requested" ? {} : { walletCustody };
+			startedCustody = custody;
 			const authMethod = walletRegistrationFinalizeAuthMethodFromAuthority(ceremonyAuthority);
 			let response;
 			if (ed25519PublicResult && finalizeNearEd25519 && resolvedNearAccount) {
@@ -3882,7 +3811,6 @@ var CloudflareD1WalletRegistrationService = class {
 					foundingAuthMethod,
 					rpId: finalizePasskeyRpId(ceremonyAuthority),
 					authMethod,
-					...custodyField,
 					custodyKeyManifestDigestB64u,
 					authorityScope,
 					accountProvisioning: finalizeNearEd25519.accountProvisioning,
@@ -3896,7 +3824,6 @@ var CloudflareD1WalletRegistrationService = class {
 					foundingAuthority,
 					foundingAuthMethod,
 					authMethod,
-					...custodyField,
 					custodyKeyManifestDigestB64u,
 					authorityScope,
 					accountProvisioning: finalizeNearEd25519.accountProvisioning,
@@ -3912,7 +3839,6 @@ var CloudflareD1WalletRegistrationService = class {
 				foundingAuthMethod,
 				rpId: finalizePasskeyRpId(ceremonyAuthority),
 				authMethod,
-				...custodyField,
 				custodyKeyManifestDigestB64u,
 				ecdsa: { walletKeys: ecdsaWalletKeys }
 			} : {
@@ -3923,7 +3849,6 @@ var CloudflareD1WalletRegistrationService = class {
 				foundingAuthority,
 				foundingAuthMethod,
 				authMethod,
-				...custodyField,
 				custodyKeyManifestDigestB64u,
 				ecdsa: { walletKeys: ecdsaWalletKeys }
 			};
@@ -3957,16 +3882,30 @@ var CloudflareD1WalletRegistrationService = class {
 					}
 				});
 				finishD1RegistrationRouteTiming(finalizeTiming, totalTiming);
-				return withD1RegistrationRouteDiagnostics(response, finalizeTiming);
+				startedCustody = null;
+				return {
+					ok: true,
+					finalized: withD1RegistrationRouteDiagnostics(response, finalizeTiming),
+					custody,
+					initialSession
+				};
 			}
 			finishD1RegistrationRouteTiming(finalizeTiming, totalTiming);
-			return withD1RegistrationRouteDiagnostics(response, finalizeTiming);
+			startedCustody = null;
+			return {
+				ok: true,
+				finalized: withD1RegistrationRouteDiagnostics(response, finalizeTiming),
+				custody,
+				initialSession
+			};
 		} catch (error) {
 			return {
 				ok: false,
 				code: "internal",
 				message: errorMessage(error) || "Failed to finalize wallet registration ceremony"
 			};
+		} finally {
+			await startedCustody;
 		}
 	}
 };