@securecoms/agent-bridge 0.11.0 → 0.11.1

package/dist/bin.js

@@ -1216,6 +1216,28 @@ async function agentPausedErrorFromResponse(res) {
   const err = detail?.error;
   return err === "agent_paused" ? new AgentPausedError() : null;
 }
+var MalformedCommitterWorkError = class extends ConnectSdkError {
+  channelId;
+  field;
+  receivedType;
+  constructor(channelId, field, receivedType) {
+    super(`committer-work for channel ${channelId} returned a malformed body: \`${field}\` is ${receivedType}, expected array`);
+    this.channelId = channelId;
+    this.field = field;
+    this.receivedType = receivedType;
+  }
+};
+var MalformedGroupRosterError = class extends ConnectSdkError {
+  endpoint;
+  channelId;
+  receivedType;
+  constructor(endpoint, channelId, receivedType) {
+    super(`${endpoint} for channel ${channelId} returned a malformed group roster: \`member_device_ids\` is ${receivedType}, expected a non-empty array`);
+    this.endpoint = endpoint;
+    this.channelId = channelId;
+    this.receivedType = receivedType;
+  }
+};
 
 // ../connect-sdk-ts/dist/envelope-builder.js
 async function buildOutboundEnvelope(p) {
@@ -1324,8 +1346,23 @@ import { hmac } from "@noble/hashes/hmac";
 import { sha256 as sha2562 } from "@noble/hashes/sha256";
 import { bytesToHex } from "@agentvault/crypto";
 
+// ../connect-sdk-ts/dist/groupkey/crypto-patch-guard.js
+import { MLSGroupManager } from "@agentvault/crypto";
+var CryptoPatchMissingError = class extends Error {
+  constructor() {
+    super("MLSGroupManager.leafIndicesForKeyPackage is missing \u2014 the @agentvault/crypto patch did not apply. Expected patches/@agentvault+crypto+0.4.1.patch to be applied by the root postinstall (`patch-package --error-on-fail --error-on-warn`). Re-run `npm ci` at the repo root, and check that @agentvault/crypto resolved to exactly 0.4.1.");
+    this.name = "CryptoPatchMissingError";
+  }
+};
+function leafIndicesForKeyPackage(mgr, kp) {
+  if (typeof MLSGroupManager.prototype.leafIndicesForKeyPackage !== "function") {
+    throw new CryptoPatchMissingError();
+  }
+  return mgr.leafIndicesForKeyPackage(kp);
+}
+
 // ../connect-sdk-ts/dist/groupkey/mls.js
-import { MLSGroupManager, bytesToHex as bytesToHex2, hexToBytes, verifyApprovalArtifact } from "@agentvault/crypto";
+import { MLSGroupManager as MLSGroupManager2, bytesToHex as bytesToHex2, hexToBytes, verifyApprovalArtifact } from "@agentvault/crypto";
 
 // ../connect-sdk-ts/dist/groupkey/operation-queue.js
 var MlsOperationQueue = class {
@@ -1389,6 +1426,51 @@ function classifyFailedRow(i) {
   return "defer";
 }
 
+// ../connect-sdk-ts/dist/groupkey/admission-rule.js
+function canAdmit(input) {
+  if (input.targetDeviceId === input.ownDeviceId)
+    return { decision: "refuse", reason: "self" };
+  if (input.boundLeaves.some((b) => b.device === input.targetDeviceId)) {
+    return { decision: "refuse", reason: "already-bound" };
+  }
+  if (input.targetLeaves.length > 0) {
+    if (input.deltaVouches)
+      return { decision: "refuse", reason: "identity-leaf-present" };
+    if (input.targetLeaves.length > 1)
+      return { decision: "refuse", reason: "identity-leaf-present" };
+    const t = input.targetLeaves[0];
+    if (!input.identityLeaves.some((l) => l.leafIndex === t))
+      return { decision: "refuse", reason: "already-bound" };
+    if (input.identityLeaves.some((l) => l.leafIndex !== t && l.leafIndex !== input.ownLeafIndex))
+      return { decision: "refuse", reason: "identity-leaf-present" };
+    return { decision: "already-present" };
+  }
+  if (input.targetIdentityId === null)
+    return { decision: "refuse", reason: "unknown-identity" };
+  if (input.identityLeaves.length === 0)
+    return { decision: "admit" };
+  const allUnbound = input.identityLeaves.every((l) => l.device === null);
+  const ownLeafUnreadable = allUnbound && input.ownLeafIndex === null;
+  const exemptionApplies = allUnbound && input.ownLeafIndex !== null && input.identityLeaves.every((l) => l.leafIndex === input.ownLeafIndex);
+  if (exemptionApplies)
+    return { decision: "admit" };
+  if (input.deltaVouches)
+    return { decision: "admit" };
+  return {
+    decision: "refuse",
+    reason: ownLeafUnreadable ? "unknown-own-leaf" : "identity-leaf-present"
+  };
+}
+function hasMalformedBinding(identityLeaves) {
+  return identityLeaves.some((l) => l.malformed);
+}
+
+// ../connect-sdk-ts/dist/groupkey/kp-expiry.js
+var SKEW_GUARD_MS = 5 * 60 * 1e3;
+function isServerExpired(exp, nowMs) {
+  return nowMs - SKEW_GUARD_MS >= exp.getTime();
+}
+
 // ../connect-sdk-ts/dist/groupkey/mls.js
 var LABEL = "agentvault-connect-v1";
 var DEFAULT_STUCK_THRESHOLD = 2;
@@ -1436,6 +1518,30 @@ var ForgedCredentialError = class extends Error {
     this.name = "ForgedCredentialError";
   }
 };
+var SelfAddRefusedError = class extends Error {
+  deviceId;
+  channelId;
+  constructor(deviceId, channelId) {
+    super(`addMemberToLiveGroup: refusing to Add this committer's OWN device ${deviceId} to channel ${channelId} \u2014 a self-Add mints a second, permanent leaf for a device that already holds one. Terminal; this is never a retryable condition.`);
+    this.deviceId = deviceId;
+    this.channelId = channelId;
+    this.name = "SelfAddRefusedError";
+  }
+};
+var AddRefusedError = class extends Error {
+  reason;
+  deviceId;
+  identityId;
+  identityLeafCount;
+  constructor(reason, deviceId, identityId, identityLeafCount) {
+    super(`addMemberToLiveGroup: refusing Add of device ${deviceId} (${reason}) \u2014 identity ${identityId ?? "<undecodable>"} holds ${identityLeafCount} leaf/leaves in this device's view of the tree. A plain Add here risks an irreversible duplicate leaf; the repair path is Remove+Add, never a plain Add.`);
+    this.reason = reason;
+    this.deviceId = deviceId;
+    this.identityId = identityId;
+    this.identityLeafCount = identityLeafCount;
+    this.name = "AddRefusedError";
+  }
+};
 var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   o;
   suite;
@@ -1707,6 +1813,24 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * ONE active leaf. Used by the guest reconcile sweep when an approved guest
    * sits in `joining`.
    *
+   * ⛔ AS OF SLICE B (ADR-0014 Decision B) THE WORKING DEVICE SWAP IS GONE.
+   * When `priorDeviceId` names a device whose leaf still carries this guest
+   * identity — the case the swap existed for — the Add chokepoint's admission
+   * rule refuses (AddRefusedError, reason `identity-leaf-present`) and this
+   * method THROWS before reaching the eviction below.
+   *
+   * ⚠️ That does NOT make the eviction block unreachable, and an earlier
+   * revision of this note wrongly said it did. Pass a `priorDeviceId` that
+   * differs from `newDeviceId` while the guest identity holds NO leaf and the
+   * rule admits on clause 2's first arm, the Add commits, and the block DOES
+   * run — then throws `LeafRosterMismatchError`, because the identity owns one
+   * leaf where the default `orderedDeviceIds` names two. So the reachable
+   * outcomes for a caller passing `priorDeviceId` are a refusal or a roster
+   * mismatch, never a completed swap. The block is retained because it is still
+   * correct and is what a Remove-then-Add re-enablement (or slice 5's
+   * device-bound leaf) will build on. See the body comment for why the
+   * count-only attestation that used to open that path was retired.
+   *
    * Add then evict: we commit the Add first so the new leaf exists before the
    * old one is dropped (the guest is never momentarily leaf-less in the group).
    * The eviction uses the per-DEVICE removal path (removeDeviceFromLiveGroup),
@@ -1722,16 +1846,19 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * equals newDeviceId (the same device re-admitted).
    */
   async admitGuestDevice(channelId, g) {
-    await this.addMemberToLiveGroup(channelId, g.newDeviceId, {
-      knownLeafDevices: g.priorDeviceId ? [g.priorDeviceId] : []
+    const outcome = await this.addMemberToLiveGroup(channelId, g.newDeviceId, {
+      expectedIdentityId: g.identityId
     });
-    if (g.priorDeviceId && g.priorDeviceId !== g.newDeviceId) {
+    if (outcome === "committed" && g.priorDeviceId && g.priorDeviceId !== g.newDeviceId) {
       const orderedDeviceIds = g.orderedDeviceIds ?? [g.priorDeviceId, g.newDeviceId];
       await this.removeDeviceFromLiveGroup(channelId, g.priorDeviceId, {
         identity: g.identityId,
         orderedDeviceIds
       });
+    } else if (outcome !== "committed" && g.priorDeviceId && g.priorDeviceId !== g.newDeviceId) {
+      console.warn(`admitGuestDevice: channel ${channelId} \u2014 Add of ${g.newDeviceId} was a no-op (${outcome}), so the eviction of prior device ${g.priorDeviceId} was SKIPPED. The prior leaf is intact and no swap occurred; re-drive the swap only after the new device holds its own leaf.`);
     }
+    return outcome;
   }
   /** Load (or reuse) the per-channel manager from the store. Throws if no state. */
   async manager(channelId) {
@@ -1744,7 +1871,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       return again;
     if (!saved)
       throw new Error(`MlsGroupKeyProvider: no MLS state for channel ${channelId} (call ensureSession first)`);
-    const mgr = new MLSGroupManager(saved.ciphersuite);
+    const mgr = new MLSGroupManager2(saved.ciphersuite);
     mgr.importState(saved);
     this.managers.set(channelId, mgr);
     return mgr;
@@ -1946,11 +2073,21 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     return w?.connect_channel_id ?? null;
   }
   /**
-   * Initialize the ts-mls libsodium (WASM) backend ONCE before any store
-   * operation that deserializes a persisted KeyPackage. generateKeyPackage
-   * awaits sodium.ready and is pure in-memory (it neither publishes to the
-   * backend nor writes the store), so the throwaway bundle is a side-effect-free
-   * warm-up. Without it, the FIRST loadPendingBundle at boot (the republish
+   * Give the ts-mls libsodium (WASM) backend time to initialize before any
+   * store operation that deserializes a persisted KeyPackage. generateKeyPackage
+   * is pure in-memory (it neither publishes to the backend nor writes the
+   * store), so the throwaway bundle is a side-effect-free warm-up.
+   *
+   * ⛔ IT IS A RACE, NOT A BARRIER, and do not read it as one. Nothing on this
+   * path awaits sodium.ready: MLSGroupManager defaults _provider to
+   * nobleCryptoProvider, and _ensureCiphersuite passes that provider to
+   * getCiphersuiteImpl. What the warm-up actually does is BURN WALL CLOCK while
+   * libsodium's WASM initializes in PARALLEL. The margin is roughly 1.7 ms and
+   * it DRIFTS: libsodium-sumo is reached through a caret and its init timing
+   * sets the margin, so an install can move it with no change in this repo.
+   * See 02f47e15 (PR #87), whose commit body carries the correct diagnosis.
+   *
+   * Without it, the FIRST loadPendingBundle at boot (the republish
    * guard, and the join path) runs while WASM is still cold, throws deep in the
    * crypto ("Cannot read properties of undefined (reading '_malloc')"), is caught
    * and misread as "no held bundle", and the daemon mints + republishes a FRESH
@@ -1961,7 +2098,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   async ensureCryptoReady() {
     if (this.cryptoWarmed)
       return;
-    await new MLSGroupManager().generateKeyPackage(this.o.identity);
+    await new MLSGroupManager2().generateKeyPackage(this.o.identity);
     this.cryptoWarmed = true;
   }
   async publishKeyPackage() {
@@ -2012,7 +2149,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       const bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
       if (!bundle)
         return false;
-      const heldHex = bytesToHex2(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
+      const heldHex = bytesToHex2(MLSGroupManager2.serializeKeyPackage(bundle.publicPackage));
       const published = await this.o.backend.fetchKeyPackages([this.o.deviceId]);
       const pubHex = published[this.o.deviceId];
       return !!pubHex && pubHex === heldHex;
@@ -2022,13 +2159,20 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   }
   async publishKeyPackageUnlocked() {
     if (await this.o.store.loadPendingBundle(this.o.deviceId)) {
-      console.warn("publishKeyPackage: pending bundle exists; skipping republish");
-      return await this.o.store.loadLastKpId(this.o.deviceId) ?? "";
+      const kpId = await this.o.store.loadLastKpId(this.o.deviceId) ?? "";
+      const exp = kpId === "" ? null : await this.o.backend.fetchKeyPackageExpiry(kpId);
+      const expired = exp !== null && isServerExpired(exp, this.o.now?.() ?? Date.now());
+      if (!expired) {
+        console.warn("publishKeyPackage: pending bundle exists; skipping republish");
+        return kpId;
+      }
+      console.warn(`publishKeyPackage: server KeyPackage expired for device ${this.o.deviceId.slice(0, 8)}; rotating`);
+      await this.o.store.deletePendingBundle(this.o.deviceId);
     }
     console.warn(`publishKeyPackage: minting a fresh KeyPackage (rotation) for device ${this.o.deviceId.slice(0, 8)}`);
-    const mgr = new MLSGroupManager();
+    const mgr = new MLSGroupManager2();
     const bundle = await mgr.generateKeyPackage(this.o.identity);
-    const hex = bytesToHex2(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
+    const hex = bytesToHex2(MLSGroupManager2.serializeKeyPackage(bundle.publicPackage));
     const id = await this.o.backend.publishKeyPackage(this.o.deviceId, hex);
     await this.o.store.saveLastKpAndBundle(this.o.deviceId, id, bundle);
     return id;
@@ -2056,14 +2200,14 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     if (opts.forceReinit) {
       const others = [...new Set(opts.otherDeviceIds ?? [])].filter((d) => d !== this.o.deviceId);
       const reinit = await this.o.backend.reinitConnectChannelGroup(channelId, [this.o.deviceId, ...others]);
-      const mgr = new MLSGroupManager();
+      const mgr = new MLSGroupManager2();
       await mgr.createGroup(new TextEncoder().encode(reinit.group_id), bundle);
       const kps = await this.o.backend.fetchKeyPackages(others);
       const pkgs = others.map((d) => {
         const hex = kps[d];
         if (!hex)
           throw new Error(`ensureSession(forceReinit): no published KeyPackage for device ${d}`);
-        return MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+        return MLSGroupManager2.deserializeKeyPackage(hexToBytes(hex));
       });
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(reinit.group_id, {
@@ -2082,7 +2226,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
       if (init.created === false)
         throw new BootstrapRaceLostError();
-      const mgr = new MLSGroupManager();
+      const mgr = new MLSGroupManager2();
       await mgr.createGroup(new TextEncoder().encode(init.group_id), bundle);
       const others = [...new Set(opts.otherDeviceIds ?? [])].filter((d) => d !== this.o.deviceId);
       const kps = await this.o.backend.fetchKeyPackages(others);
@@ -2090,7 +2234,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         const hex = kps[d];
         if (!hex)
           throw new Error(`ensureSession: no published KeyPackage for device ${d}`);
-        return MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+        return MLSGroupManager2.deserializeKeyPackage(hexToBytes(hex));
       });
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(init.group_id, {
@@ -2108,7 +2252,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       const w = rows.find((r) => r.message_type === "welcome" && (r.connect_channel_id === channelId || r.connect_channel_id == null));
       if (!w)
         throw new Error("ensureSession(join): no Welcome available yet for this channel");
-      const mgr = new MLSGroupManager();
+      const mgr = new MLSGroupManager2();
       try {
         await mgr.joinFromWelcome(hexToBytes(w.payload), bundle);
       } catch (err) {
@@ -2144,36 +2288,66 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     const hex = kps[newDeviceId];
     if (!hex)
       throw new Error(`addMemberToLiveGroup: no published KeyPackage for device ${newDeviceId}`);
-    const pkg = MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
-    if (_attempt === 0) {
-      let adds;
-      try {
-        adds = (await this.o.backend.getCommitterWork(channelId)).adds;
-      } catch (e) {
-        throw new Error(`addMemberToLiveGroup: committer-work unreachable for channel ${channelId} \u2014 refusing plain Add for device ${newDeviceId} (fail closed): ` + (e instanceof Error ? e.message : String(e)));
+    const pkg = MLSGroupManager2.deserializeKeyPackage(hexToBytes(hex));
+    const cred = pkg.leafNode.credential;
+    const claimedIdentity = cred.credentialType === "basic" ? new TextDecoder().decode(cred.identity) : null;
+    if (opts?.expectedIdentityId && claimedIdentity !== opts.expectedIdentityId) {
+      throw new ForgedCredentialError(opts.expectedIdentityId, claimedIdentity ?? "");
+    }
+    const targetLeaves = leafIndicesForKeyPackage(mgr, pkg);
+    let deltaVouches = false;
+    try {
+      deltaVouches = (await this.o.backend.getCommitterWork(channelId)).adds.includes(newDeviceId);
+    } catch (e) {
+      if (targetLeaves.length > 0) {
+        throw new Error(`addMemberToLiveGroup: committer-work unreachable for channel ${channelId} while device ${newDeviceId}'s published KeyPackage already holds ${targetLeaves.length} leaf/leaves here (indices ${targetLeaves.join(",")}) \u2014 refusing to report a no-op success on a delta we could not read (fail closed): ` + (e instanceof Error ? e.message : String(e)));
       }
-      if (!adds.includes(newDeviceId)) {
-        const cred = pkg.leafNode.credential;
-        const claimed = cred.credentialType === "basic" ? new TextDecoder().decode(cred.identity) : null;
-        const leaves = claimed === null ? null : mgr.leafIndicesForIdentity(claimed);
-        if (leaves === null || leaves.length > 0) {
-          const known = opts?.knownLeafDevices ? [...new Set(opts.knownLeafDevices)] : null;
-          const swapSafe = leaves !== null && known !== null && !known.includes(newDeviceId) && known.length === leaves.length;
-          if (!swapSafe) {
-            console.warn(`addMemberToLiveGroup: device ${newDeviceId.slice(0, 8)} is outside the committer-work add-delta and its identity already holds a leaf \u2014 terminal skip (no commit)`);
-            return;
-          }
+      deltaVouches = false;
+    }
+    const identityLeaves = claimedIdentity === null ? [] : mgr.leafIndicesForIdentity(claimedIdentity).map((leafIndex) => ({
+      leafIndex,
+      device: null,
+      // SLICE 5: read the LeafNode extension here.
+      malformed: false
+      // SLICE 5: set from a failed extension decode.
+    }));
+    const ownLeaf = this.ownLeafIndex(mgr);
+    const verdict = canAdmit({
+      targetDeviceId: newDeviceId,
+      targetIdentityId: claimedIdentity,
+      ownDeviceId: this.o.deviceId,
+      ownLeafIndex: ownLeaf,
+      boundLeaves: [],
+      // SLICE 5: the whole-tree bound-leaf scan replaces this literal.
+      identityLeaves,
+      targetLeaves,
+      deltaVouches
+    });
+    if (hasMalformedBinding(identityLeaves)) {
+      console.warn(`addMemberToLiveGroup: channel ${channelId} has a leaf with an unreadable device binding for identity ${claimedIdentity ?? "?"} \u2014 treated as UNBOUND, never as absent`);
+    }
+    if (targetLeaves.length > 0 && deltaVouches) {
+      console.warn(`addMemberToLiveGroup: channel ${channelId} \u2014 the server's add-delta vouches for device ${newDeviceId} while its published KeyPackage is ALREADY a leaf here (indices ${targetLeaves.join(",")}). An honest retry cannot produce this pair: attempt 0's init unions the device into the roster, so the delta can never list it again. Treat as a possible KeyPackage substitution, or as a lost race against a peer's Add that will self-heal on the next sweep pass.`);
+    }
+    if (targetLeaves.length > 1) {
+      console.warn(`addMemberToLiveGroup: channel ${channelId} \u2014 device ${newDeviceId}'s published KeyPackage already occupies ${targetLeaves.length} leaves (indices ${targetLeaves.join(",")}). This is a pre-existing duplicate leaf; nothing on this path can repair it and heal refuses an identity holding more than one leaf.`);
+    }
+    switch (verdict.decision) {
+      case "admit":
+        break;
+      case "already-present":
+        return "already-present";
+      case "refuse":
+        if (verdict.reason === "self") {
+          throw new SelfAddRefusedError(newDeviceId, channelId);
         }
+        throw new AddRefusedError(verdict.reason, newDeviceId, claimedIdentity, identityLeaves.length);
+      default: {
+        const _never = verdict;
+        throw new Error(`unhandled admission verdict: ${JSON.stringify(_never)}`);
       }
     }
     const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId, newDeviceId]);
-    if (opts?.expectedIdentityId) {
-      const cred = pkg.leafNode.credential;
-      const claimed = cred.credentialType === "basic" ? new TextDecoder().decode(cred.identity) : "";
-      if (claimed !== opts.expectedIdentityId) {
-        throw new ForgedCredentialError(opts.expectedIdentityId, claimed);
-      }
-    }
     const priorEpoch = Number(mgr.epoch);
     const { commit, welcome } = await mgr.addMembers([pkg]);
     const members = [.../* @__PURE__ */ new Set([...init.member_device_ids ?? [this.o.deviceId], newDeviceId])];
@@ -2195,15 +2369,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
       } catch {
       }
-      try {
-        const work = await this.o.backend.getCommitterWork(channelId);
-        if (!work.adds.includes(newDeviceId))
-          return;
-      } catch {
-      }
       return this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, _attempt + 1, opts);
     }
     await this.o.store.save(channelId, mgr.exportState());
+    return "committed";
   }
   /**
    * Committer-side: REMOVE a member from a live group (Phase C eviction).
@@ -2421,6 +2590,37 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    *   - MORE THAN ONE leaf → ambiguous (no add-order roster to disambiguate which
    *     leaf is the stale one) → REFUSE rather than risk evicting a healthy device.
    *
+   * ⛔⛔ LIMITATION — A MULTI-DEVICE MEMBER IS UNHEALABLE BY THIS METHOD, AND THE
+   * FAILURE IS SILENT AND DESTRUCTIVE. READ THIS BEFORE CALLING IT.
+   *
+   * Leaf credentials encode the IDENTITY and not the device, so the leaf
+   * resolution above is only exact when the identity's leaf set is unambiguous.
+   * The `> 1` case refuses. The `=== 1` case DOES NOT, and it is the worse one:
+   * heal device B of an identity whose device A holds the only leaf and A is
+   * evicted while the call reports a clean heal. Every downstream check is
+   * satisfied — the cardinality guard in `removeDeviceFromLiveGroupUnlocked`
+   * compares this call site's single-element `orderedDeviceIds` against a
+   * single-element leaf set, a coincidence of counts, and `leaves[0]` is A's.
+   * `mls.heal-multidevice.test.ts` measures exactly that against real MLS.
+   *
+   * ⛔ NO GUARD IS AVAILABLE HERE, and this is a measured conclusion rather than
+   * an unexplored one. The device-level predicate that would settle it (leaf
+   * indices whose LeafNode signature key equals the fetched KeyPackage's — the
+   * same evidence the Add chokepoint uses) was implemented and it refused EVERY
+   * production heal: the repair contract requires the member to republish first,
+   * `forceRepublishKeyPackage` mints a NEW SIGNING KEY, and a diverged device's
+   * fresh KeyPackage therefore matches no leaf, including its own. A guard built
+   * on it is a blanket disable, not a guard.
+   *
+   * ⚠️ CALLER CONTRACT UNTIL SLICE 5: do not drive this for a member you know to
+   * hold more than one device. The caller is the only layer that has a roster,
+   * and nothing in the tree binds a leaf to a device id, so the refusal has to
+   * live above this function. connect-web's `foreign-identity-heal.ts` declines a
+   * member whose identity holds two or more LEAVES; the residual it cannot see —
+   * two DEVICES sharing one leaf — is the shape described above and is open.
+   * It resolves when the leaf credential carries a device binding (slice 5),
+   * which cannot be retrofitted without re-keying every live group.
+   *
    * The Add fetches the device's freshly published KeyPackage from the backend,
    * exactly like a normal add — the CALLER is responsible for the member having
    * re-published one first (mirrors addMemberToLiveGroup's "no published
@@ -2437,7 +2637,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       const hex = kps[memberDeviceId];
       if (!hex)
         throw new Error(`healDivergedMember: no published KeyPackage for device ${memberDeviceId}`);
-      const cred = MLSGroupManager.deserializeKeyPackage(hexToBytes(hex)).leafNode.credential;
+      const pkg = MLSGroupManager2.deserializeKeyPackage(hexToBytes(hex));
+      const cred = pkg.leafNode.credential;
       if (cred.credentialType !== "basic") {
         throw new Error(`healDivergedMember: unexpected credential type ${cred.credentialType} (expected basic)`);
       }
@@ -2450,6 +2651,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       if (leaves.length > 1) {
         throw new Error(`healDivergedMember: identity owns ${leaves.length} leaves; ambiguous stale-leaf resolution (refusing to guess)`);
       }
+      if (leaves.length === 1) {
+        console.warn(`[heal] channel ${channelId}: about to Remove the single leaf held by identity ${identity} in order to re-Add device ${memberDeviceId}, WITHOUT being able to prove that leaf is that device's. Leaf credentials encode the identity, not the device. If this member holds more than one device, the leaf being evicted may belong to a SIBLING device that was never diverged, and this call will still report a clean heal. Multi-device members are unhealable until leaf\u2192device attribution exists.`);
+      }
       let removeLanded = false;
       if (leaves.length === 1) {
         await this.removeDeviceFromLiveGroupUnlocked(channelId, memberDeviceId, { identity, orderedDeviceIds: [memberDeviceId] }, 0);
@@ -2460,13 +2664,20 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           throw new Error(`healDivergedMember: expected 0 leaves for the Add-only branch but found ${stillZero.length} (a leaf reappeared under the held lock \u2014 refusing to create a duplicate leaf)`);
         }
       }
+      let outcome;
       try {
-        await this.addMemberToLiveGroupUnlocked(channelId, memberDeviceId, 0, opts);
+        outcome = await this.addMemberToLiveGroupUnlocked(channelId, memberDeviceId, 0, opts);
       } catch (e) {
         if (removeLanded)
           throw new HealAddAfterRemoveError(e);
         throw e;
       }
+      if (outcome !== "committed") {
+        const err = new Error(`healDivergedMember: the re-Add of ${memberDeviceId} on channel ${channelId} committed nothing (outcome "${outcome}") \u2014 refusing to report a clean heal for a device that may hold no leaf at the live epoch.`);
+        if (removeLanded)
+          throw new HealAddAfterRemoveError(err);
+        throw err;
+      }
     }));
   }
   /** Re-Welcome a fallen-behind GUEST (same device, stale leaf) back to the live
@@ -2573,14 +2784,14 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         throw new Error("resetSessionSupersede: call publishKeyPackage() first");
       const others = [...new Set(opts.otherDeviceIds)].filter((d) => d !== this.o.deviceId);
       const reinit = await this.o.backend.resetReinitConnectChannelGroup(channelId, [this.o.deviceId, ...others], { newGroupId: opts.newGroupId, signatureHex: opts.signatureHex, nonceHex: opts.nonceHex, signedContentHex: opts.signedContentHex });
-      const mgr = new MLSGroupManager();
+      const mgr = new MLSGroupManager2();
       await mgr.createGroup(new TextEncoder().encode(reinit.group_id), bundle);
       const kps = await this.o.backend.fetchKeyPackages(others);
       const pkgs = others.map((d) => {
         const hex = kps[d];
         if (!hex)
           throw new Error(`resetSessionSupersede: no published KeyPackage for device ${d}`);
-        return MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+        return MLSGroupManager2.deserializeKeyPackage(hexToBytes(hex));
       });
       const { commit, welcome } = await mgr.addMembers(pkgs);
       await this.o.backend.distribute(reinit.group_id, {
@@ -2655,6 +2866,29 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     const mgr = await this.manager(channelId);
     return mgr.leafIndicesForIdentity(identityId).length;
   }
+  /**
+   * Cache-only leaf count for `identityId` in `channelId`, or **null** when
+   * there is no in-memory manager (a cold channel).
+   *
+   * The non-throwing sibling of {@link leafCountForIdentity}, with the same
+   * cold-channel semantics as {@link hasLeafForIdentity}. It exists because the
+   * join confirmer needs to know whether a leaf can be ATTRIBUTED to a device,
+   * and a boolean cannot answer that: leaf credentials encode the identity, not
+   * the device, so "the identity holds a leaf" is true off ANY of its devices'
+   * leaves. `null` and any count other than 1 both mean "cannot attribute", and
+   * a caller that clears state on attribution must treat them as such.
+   *
+   * ⚠️ This is still an IDENTITY-level read. It does not name which device
+   * holds which leaf and it cannot until leaves carry a device binding
+   * (ADR-0014 Decision B, slice 5). What it buys today is the ability to REFUSE
+   * to attribute rather than to guess.
+   */
+  leafCountForIdentityCached(channelId, identityId) {
+    const mgr = this.managers.get(channelId);
+    if (!mgr)
+      return null;
+    return mgr.leafIndicesForIdentity(identityId).length;
+  }
   /** Returns true when the live in-memory MLS tree for `channelId` contains at
    * least one leaf bearing `identityId` as its credential. Used by the agent
    * admission watcher (liveness §4.3) to decide whether an Add+Welcome is still
@@ -2772,7 +3006,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       return refuse("supersede refused: no pending KeyPackage bundle to open the new Welcome");
     }
     return await this.locks.run(channelId, async () => {
-      const mgr = new MLSGroupManager();
+      const mgr = new MLSGroupManager2();
       try {
         await mgr.joinFromWelcome(hexToBytes(row.payload), bundle);
       } catch (err) {
@@ -3516,6 +3750,24 @@ var RestTransport = class {
 };
 
 // ../connect-sdk-ts/dist/mls/rest-backend.js
+function describeType(v) {
+  if (v === void 0)
+    return "missing";
+  if (v === null)
+    return "null";
+  if (Array.isArray(v))
+    return "array";
+  return typeof v;
+}
+function parseGroupRoster(endpoint, channelId, value) {
+  if (!Array.isArray(value)) {
+    throw new MalformedGroupRosterError(endpoint, channelId, describeType(value));
+  }
+  if (value.length === 0) {
+    throw new MalformedGroupRosterError(endpoint, channelId, "empty array");
+  }
+  return value.map(String);
+}
 var RestMlsBackend = class {
   opts;
   f;
@@ -3591,7 +3843,10 @@ var RestMlsBackend = class {
     return {
       group_id: String(j.group_id),
       current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : [],
+      // #230: fail loud on an absent / non-array / empty roster rather than
+      // coerce to `[]` (which pre-empts the consumers' `?? [self]` fallback and
+      // gets POSTed back as a wipe on distribute).
+      member_device_ids: parseGroupRoster("init", channelId, j.member_device_ids),
       // Back-compat: servers that predate the created field return nothing;
       // treat absence as true (they always created a fresh group).
       created: j.created === void 0 ? true : Boolean(j.created)
@@ -3616,10 +3871,14 @@ var RestMlsBackend = class {
     return {
       group_id: String(j.group_id),
       current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : [],
+      // #230: same guard as init. This field has ZERO consumers today
+      // (resetSessionSupersede reads only stale_member_device_ids), so this is
+      // defense in depth: a future consumer cannot inherit the silent-`[]` trap.
+      member_device_ids: parseGroupRoster("reinit", channelId, j.member_device_ids),
       // Absent on a backend that predates the dropped-member report; an empty
       // list is the correct read of "the server told us nothing", since the old
-      // server also never dropped anyone for an expired KeyPackage.
+      // server also never dropped anyone for an expired KeyPackage. UNCHANGED:
+      // empty here is legitimate, the opposite of member_device_ids (§3.3).
       stale_member_device_ids: Array.isArray(j.stale_member_device_ids) ? j.stale_member_device_ids.map(String) : []
     };
   }
@@ -3635,6 +3894,22 @@ var RestMlsBackend = class {
       return null;
     }
   }
+  async fetchKeyPackageExpiry(kpId) {
+    try {
+      const j = await this.get(`/api/v1/mls/key-packages/by-id/${kpId}/expiry`);
+      const raw = j.expires_at;
+      if (typeof raw !== "string")
+        return null;
+      if (!/(?:Z|[+-]\d{2}:?\d{2})$/.test(raw))
+        return null;
+      const ms = Date.parse(raw);
+      if (Number.isNaN(ms))
+        return null;
+      return new Date(ms);
+    } catch {
+      return null;
+    }
+  }
   async distribute(groupId, req) {
     await this.post(`/api/v1/mls/groups/${groupId}/distribute`, {
       ...req,
@@ -3659,10 +3934,14 @@ var RestMlsBackend = class {
   }
   async getCommitterWork(channelId) {
     const j = await this.get(`/api/v1/mls/connect-channels/${channelId}/committer-work`);
-    return {
-      adds: Array.isArray(j.adds) ? j.adds.map(String) : [],
-      removes: Array.isArray(j.removes) ? j.removes.map(String) : []
+    const requireList = (field) => {
+      const v = j?.[field];
+      if (!Array.isArray(v)) {
+        throw new MalformedCommitterWorkError(channelId, field, describeType(v));
+      }
+      return v.map(String);
     };
+    return { adds: requireList("adds"), removes: requireList("removes") };
   }
   async acquireCommitLease(channelId) {
     const res = await this.f(this.opts.baseUrl + `/api/v1/mls/connect-channels/${channelId}/commit-lease`, { method: "POST", headers: this.headers(), body: JSON.stringify({}) });
@@ -3693,6 +3972,390 @@ var RestMlsBackend = class {
 
 // ../connect-sdk-ts/dist/mls/fake-backend.js
 import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes2 } from "@agentvault/crypto";
+var FakeConnectBackend = class _FakeConnectBackend {
+  // Key-package store: deviceId → hex-encoded KeyPackage
+  kps = /* @__PURE__ */ new Map();
+  // Server-assigned KeyPackage ids: deviceId → id (last publish wins, mirroring
+  // the real backend's single-row-per-device semantics).
+  kpIds = /* @__PURE__ */ new Map();
+  _kpSeq = 0;
+  /** Server TTL stamps: kp_id → expiry epoch-ms. Keyed by ID, not by device, so a
+   * SUPERSEDED id has no entry at all — mirroring `publish_key_package`, whose
+   * first statement DELETEs every prior row for the device
+   * (`mls_key_package_service.py:26-28`), which makes a superseded id 404. */
+  kpExpiry = /* @__PURE__ */ new Map();
+  /** Injectable clock, so a test can place a row inside or just outside the guard's
+   * skew grace. The fake's stamp, its `fetchKeyPackages` filter, and the provider's
+   * comparison must all read ONE clock or the grace is not expressible. */
+  now = () => Date.now();
+  /** The real server's default KeyPackage TTL. */
+  static TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+  // Per-device delivery queues
+  queues = /* @__PURE__ */ new Map();
+  // Per-channel state (the real backend scopes membership + epoch per group;
+  // keying these by channel keeps a multi-channel test from cross-contaminating).
+  membersByChannel = /* @__PURE__ */ new Map();
+  epochByChannel = /* @__PURE__ */ new Map();
+  groupIdByChannel = /* @__PURE__ */ new Map();
+  channelByGroup = /* @__PURE__ */ new Map();
+  // identity_id → device_id, recorded at registerDevice so ingestApplication can
+  // exclude the sender's own device on fanout (mirrors sendApplication's
+  // senderDeviceId exclusion when only the envelope's sender_id is known).
+  deviceByIdentity = /* @__PURE__ */ new Map();
+  // Owner-attested reset: settable attestation map keyed by NEW groupId, read by
+  // fetchResetAttestation (agent verify path) + written by resetReinitConnectChannelGroup.
+  resetAttestations = /* @__PURE__ */ new Map();
+  // Optional signer id the owner-side resetReinit records on the attestation it
+  // stores (Task 9). Undefined in Task-6 tests, which set resetAttestations directly.
+  ownerIdentityId;
+  // Monotonic counter for generating unique IDs
+  /** Ported-from-gen2 replay support: every distributed commit, in order, so
+   *  syncGroup() can serve a real catch-up instead of a stub. */
+  commitLog = /* @__PURE__ */ new Map();
+  /** Gap beyond which syncGroup answers "rejoin" (mirrors REJOIN_THRESHOLD). */
+  rejoinThreshold = 100;
+  _seq = 0;
+  // Dedicated monotonic counter for reinit group ids (see reinitConnectChannelGroup).
+  _reinitSeq = 0;
+  /** Returns (and lazily creates) the delivery queue for a device. */
+  q(deviceId) {
+    let queue = this.queues.get(deviceId);
+    if (!queue) {
+      queue = [];
+      this.queues.set(deviceId, queue);
+    }
+    return queue;
+  }
+  // ── MlsBackend implementation ──────────────────────────────────────────────
+  /** Test stub: a FIXED 32-byte challenge hex. The real backend mints a fresh
+   * single-use nonce; tests that exercise the PoP path sign over this constant
+   * and re-derive the same message to verify. Deterministic so a register spy
+   * can reconstruct and check the proof. */
+  async getRegisterChallenge() {
+    return "ab".repeat(32);
+  }
+  async registerDevice(req) {
+    const deviceId = "fake-device-" + this._seq++;
+    if (req.identity_id)
+      this.deviceByIdentity.set(req.identity_id, deviceId);
+    return { device_id: deviceId };
+  }
+  /** Test seam: record an identity→device link for a provider constructed with a
+   * fixed deviceId (the SDK e2e wires providers directly, bypassing registerDevice).
+   * The real backend resolves removed_identity_id → device(s) from the devices
+   * table FK; this mirrors that resolution so op==="remove" can subtract the
+   * removed identity's device(s) from the roster + delivery, exactly like the
+   * server's purge_device_queue. */
+  linkIdentityDevice(identityId, deviceId) {
+    this.deviceByIdentity.set(identityId, deviceId);
+  }
+  async publishKeyPackage(deviceId, keyPackageHex) {
+    this.kps.set(deviceId, keyPackageHex);
+    const prior = this.kpIds.get(deviceId);
+    if (prior)
+      this.kpExpiry.delete(prior);
+    const id = `kp_${deviceId}_${this._kpSeq = (this._kpSeq ?? 0) + 1}`;
+    this.kpIds.set(deviceId, id);
+    this.kpExpiry.set(id, this.now() + _FakeConnectBackend.TTL_MS);
+    return id;
+  }
+  /** Test seam: move a recorded expiry to an absolute epoch-ms instant. Named
+   * rather than letting a test write `kpExpiry` directly, so the id-keyed shape
+   * stays an implementation detail. A hard-coded past value would make T2
+   * (the fresh-KeyPackage negative control) unbuildable. */
+  setKeyPackageExpiry(kpId, expiresAtMs) {
+    this.kpExpiry.set(kpId, expiresAtMs);
+  }
+  async fetchKeyPackageExpiry(kpId) {
+    const ms = this.kpExpiry.get(kpId);
+    return ms === void 0 ? null : new Date(ms);
+  }
+  async getConnectChannelGroup(channelId) {
+    const groupId = this.groupIdByChannel.get(channelId) ?? null;
+    if (!groupId)
+      return { exists: false, group_id: null, current_epoch: null };
+    return {
+      exists: true,
+      group_id: groupId,
+      current_epoch: this.epochByChannel.get(channelId) ?? 0
+    };
+  }
+  async initConnectChannelGroup(channelId, memberDeviceIds) {
+    const alreadyExists = this.groupIdByChannel.has(channelId);
+    let groupId = this.groupIdByChannel.get(channelId);
+    if (!groupId) {
+      groupId = `00000000-0000-0000-0000-${String(this.groupIdByChannel.size + 1).padStart(12, "0")}`;
+      this.groupIdByChannel.set(channelId, groupId);
+      this.channelByGroup.set(groupId, channelId);
+      this.epochByChannel.set(channelId, 0);
+    }
+    const members = [.../* @__PURE__ */ new Set([...this.membersByChannel.get(channelId) ?? [], ...memberDeviceIds])];
+    this.membersByChannel.set(channelId, members);
+    return {
+      group_id: groupId,
+      current_epoch: this.epochByChannel.get(channelId) ?? 0,
+      member_device_ids: members,
+      // Real semantics: created=true on first call (group was just created),
+      // created=false on idempotent return (group already existed). Without
+      // this, race tests silently pass wrong (fake is laxer than the server).
+      created: !alreadyExists
+    };
+  }
+  async reinitConnectChannelGroup(channelId, memberDeviceIds) {
+    const groupId = `00000000-0000-0000-0000-${String(1e3 + (this._reinitSeq = (this._reinitSeq ?? 0) + 1)).padStart(12, "0")}`;
+    this.groupIdByChannel.set(channelId, groupId);
+    this.channelByGroup.set(groupId, channelId);
+    this.epochByChannel.set(channelId, 0);
+    const members = [...new Set(memberDeviceIds)];
+    this.membersByChannel.set(channelId, members);
+    return { group_id: groupId, current_epoch: 0, member_device_ids: members };
+  }
+  async resetReinitConnectChannelGroup(channelId, memberDeviceIds, att) {
+    this.groupIdByChannel.set(channelId, att.newGroupId);
+    this.channelByGroup.set(att.newGroupId, channelId);
+    this.epochByChannel.set(channelId, 0);
+    const members = [...new Set(memberDeviceIds)];
+    this.membersByChannel.set(channelId, members);
+    this.resetAttestations.set(att.newGroupId, {
+      signedContent: new TextDecoder().decode(hexToBytes2(att.signedContentHex)),
+      signatureHex: att.signatureHex,
+      signerIdentityId: this.ownerIdentityId ?? "owner"
+    });
+    return {
+      group_id: att.newGroupId,
+      current_epoch: 0,
+      member_device_ids: members,
+      // The fake honours the roster verbatim, so nothing is ever dropped here.
+      // Tests that need the dropped-member path stub this method directly.
+      stale_member_device_ids: []
+    };
+  }
+  async fetchKeyPackages(deviceIds) {
+    const out = {};
+    for (const id of deviceIds) {
+      const kpId = this.kpIds.get(id);
+      const exp = kpId === void 0 ? void 0 : this.kpExpiry.get(kpId);
+      if (exp !== void 0 && exp <= this.now())
+        continue;
+      out[id] = this.kps.get(id);
+    }
+    return out;
+  }
+  async fetchKeyPackageById(kpId) {
+    for (const [deviceId, id] of this.kpIds) {
+      if (id === kpId) {
+        return this.kps.get(deviceId) ?? null;
+      }
+    }
+    return null;
+  }
+  async syncGroup(groupId, lastEpoch, _deviceId) {
+    const channelId = this.channelByGroup.get(groupId);
+    const current = channelId ? this.epochByChannel.get(channelId) ?? 0 : 0;
+    if (current - lastEpoch > this.rejoinThreshold)
+      return { action: "rejoin", messages: [] };
+    const log = this.commitLog.get(groupId) ?? [];
+    return {
+      action: "replay",
+      messages: log.filter((c) => c.epoch > lastEpoch).sort((a, b) => a.epoch - b.epoch).map((c) => ({
+        id: c.id,
+        epoch: c.epoch,
+        message_type: "commit",
+        sender_device_id: c.sender_device_id,
+        payload: c.payload
+      }))
+    };
+  }
+  async distribute(groupId, req) {
+    const channelId = this.channelByGroup.get(groupId);
+    if (!channelId)
+      throw new Error(`FakeConnectBackend.distribute: unknown group ${groupId}`);
+    if (req.commit && req.expected_epoch != null) {
+      const current = this.epochByChannel.get(channelId) ?? 0;
+      if (req.expected_epoch !== current) {
+        const e = new Error(`connect backend post failed: 409 EPOCH_CONFLICT (expected ${req.expected_epoch}, current ${current})`);
+        e.status = 409;
+        throw e;
+      }
+    }
+    if (req.commit) {
+      const log = this.commitLog.get(groupId) ?? [];
+      log.push({
+        id: `c${++this._seq}`,
+        epoch: Number(req.commit_epoch ?? 0),
+        payload: String(req.commit),
+        sender_device_id: String(req.device_id ?? "")
+      });
+      this.commitLog.set(groupId, log);
+    }
+    const priorMembers = this.membersByChannel.get(channelId) ?? [];
+    this.epochByChannel.set(channelId, req.commit_epoch ?? this.epochByChannel.get(channelId) ?? 0);
+    let evictedDevice;
+    if (req.op === "remove") {
+      if (!req.removed_identity_id) {
+        throw new Error("removed_identity_id required");
+      }
+      evictedDevice = req.removed_device_id ?? (req.removed_identity_id ? this.deviceByIdentity.get(req.removed_identity_id) : void 0);
+      const remaining = (this.membersByChannel.get(channelId) ?? []).filter((d) => d !== evictedDevice);
+      this.membersByChannel.set(channelId, remaining);
+      if (evictedDevice)
+        this.queues.delete(evictedDevice);
+    } else {
+      const members = [.../* @__PURE__ */ new Set([...this.membersByChannel.get(channelId) ?? [], ...req.member_device_ids ?? []])];
+      this.membersByChannel.set(channelId, members);
+    }
+    if (req.commit) {
+      for (const dev of priorMembers) {
+        if (dev === req.device_id)
+          continue;
+        if (dev === evictedDevice)
+          continue;
+        this.q(dev).push({
+          queue_id: "q-" + this._seq++,
+          message_id: "m-commit-" + this._seq++,
+          group_id: groupId,
+          message_type: "commit",
+          sender_device_id: req.device_id,
+          epoch: this.epochByChannel.get(channelId) ?? 0,
+          payload: req.commit,
+          connect_channel_id: channelId,
+          created_at: ""
+        });
+      }
+    }
+    for (const w of req.welcomes ?? []) {
+      this.q(w.target_device_id).push({
+        queue_id: "q-" + this._seq++,
+        message_id: "m-welcome-" + this._seq++,
+        group_id: groupId,
+        message_type: "welcome",
+        sender_device_id: req.device_id,
+        epoch: this.epochByChannel.get(channelId) ?? 0,
+        payload: w.payload,
+        connect_channel_id: channelId,
+        created_at: ""
+      });
+    }
+  }
+  async pullDelivery(deviceId) {
+    return this.queues.get(deviceId) ?? [];
+  }
+  async ackDelivery(deviceId, queueIds) {
+    const queue = this.queues.get(deviceId);
+    if (queue) {
+      this.queues.set(deviceId, queue.filter((r) => !queueIds.includes(r.queue_id)));
+    }
+  }
+  requestWelcomeCalls = [];
+  async requestWelcome(groupId, deviceId, freshKpId) {
+    this.requestWelcomeCalls.push({ groupId, deviceId, freshKpId });
+  }
+  // ADR 0004 C1: committer-work + lease stubs (in-memory for unit tests;
+  // no sweep driver runs against the fake backend, so these are no-ops).
+  async getCommitterWork(_channelId) {
+    return { adds: [], removes: [] };
+  }
+  async acquireCommitLease(_channelId) {
+    return "fake-lease-token";
+  }
+  async releaseCommitLease(_channelId, _token) {
+  }
+  async fetchResetAttestation(groupId) {
+    return this.resetAttestations.get(groupId) ?? null;
+  }
+  // ── E2E helper: seal + fanout (mirrors the Python edge's Task-7 path) ──────
+  async sendApplication(p) {
+    const key = await p.sender.exporterKey(p.enclaveId, p.channelId, p.epoch);
+    const messageId = "m-" + this._seq++;
+    const replayNonce = bytesToBase64(crypto.getRandomValues(new Uint8Array(24)));
+    const policy_binding = {
+      binding_id: "b",
+      version: "1",
+      agent_skill_id: null,
+      delegation_id: null,
+      client_stage5_outcome: "allow",
+      client_stage5_evaluators: []
+    };
+    const aad = await buildAssociatedData({
+      message_id: messageId,
+      channel_id: p.channelId,
+      sender_id: p.senderId,
+      mls_group_epoch: p.epoch,
+      replay_nonce: replayNonce,
+      policy_binding
+    });
+    const sealed = sealPayload({
+      plaintext: new TextEncoder().encode(p.plaintext),
+      key,
+      associatedData: aad,
+      suite: "xchacha20poly1305"
+    });
+    const envelope = {
+      av_version: "1.0",
+      message_id: messageId,
+      channel_id: p.channelId,
+      enclave_id: p.enclaveId,
+      message_type: "text",
+      sender_id: p.senderId,
+      sender_type: "agent",
+      identity_proof: { signature: "", algo: "ed25519", attested: false, canonicalization: "RFC8785" },
+      trace_context: { traceparent: "" },
+      policy_binding,
+      mls_group_epoch: p.epoch,
+      replay_nonce: replayNonce,
+      payload_encrypted: bytesToBase64(sealed),
+      references: []
+    };
+    const canonical = await canonicalEnvelopeBytes(envelope);
+    const members = this.membersByChannel.get(p.channelId) ?? [];
+    const groupId = this.groupIdByChannel.get(p.channelId) ?? "";
+    for (const dev of members) {
+      if (dev === p.senderDeviceId)
+        continue;
+      this.q(dev).push({
+        queue_id: "q-" + this._seq++,
+        message_id: messageId,
+        group_id: groupId,
+        message_type: "application",
+        sender_device_id: p.senderDeviceId,
+        epoch: p.epoch,
+        payload: bytesToHex3(canonical),
+        connect_channel_id: p.channelId,
+        created_at: ""
+      });
+    }
+  }
+  // ── E2E helper: ingest an already-built envelope (client-side build/seal) ──
+  //
+  // Mirrors sendApplication's storage + fanout, but takes an AgentVaultEnvelope
+  // the *client* already built, sealed, and signed (via buildOutboundEnvelope) —
+  // exactly what the owner client hands to its injected `publish`. The server
+  // edge stores the canonical envelope bytes (hex) and fans out one delivery row
+  // per active member device except the sender's. We resolve the sender's device
+  // from sender_id (recorded at registerDevice); if unknown, every member gets it.
+  async ingestApplication(envelope) {
+    const channelId = envelope.channel_id;
+    const canonical = await canonicalEnvelopeBytes(envelope);
+    const members = this.membersByChannel.get(channelId) ?? [];
+    const groupId = this.groupIdByChannel.get(channelId) ?? "";
+    const senderDeviceId = this.deviceByIdentity.get(envelope.sender_id);
+    for (const dev of members) {
+      if (dev === senderDeviceId)
+        continue;
+      this.q(dev).push({
+        queue_id: "q-" + this._seq++,
+        message_id: envelope.message_id,
+        group_id: groupId,
+        message_type: "application",
+        sender_device_id: senderDeviceId ?? "",
+        epoch: envelope.mls_group_epoch,
+        payload: bytesToHex3(canonical),
+        connect_channel_id: channelId,
+        created_at: ""
+      });
+    }
+  }
+};
 
 // ../connect-sdk-ts/dist/receive/inbox-cipher.js
 import { hkdf } from "@noble/hashes/hkdf";
@@ -3742,7 +4405,7 @@ var HKDF_INFO = new TextEncoder().encode("connect-guest-recovery-wrap-v1");
 
 // ../connect-mls-store/dist/sqlite-store.js
 import { DatabaseSync } from "node:sqlite";
-import { MLSGroupManager as MLSGroupManager2, bytesToHex as bytesToHex4, hexToBytes as hexToBytes3 } from "@agentvault/crypto";
+import { MLSGroupManager as MLSGroupManager3, bytesToHex as bytesToHex4, hexToBytes as hexToBytes3 } from "@agentvault/crypto";
 
 // ../connect-mls-store/dist/schema.js
 var SCHEMA_VERSION = 6;
@@ -3858,7 +4521,7 @@ var MlsStoreSealError = class extends Error {
 function encodeBundle(bundle) {
   const pp = bundle.privatePackage;
   const obj = {
-    pub: bytesToHex4(MLSGroupManager2.serializeKeyPackage(bundle.publicPackage)),
+    pub: bytesToHex4(MLSGroupManager3.serializeKeyPackage(bundle.publicPackage)),
     initPriv: bytesToHex4(pp.initPrivateKey),
     hpkePriv: bytesToHex4(pp.hpkePrivateKey),
     sigPriv: bytesToHex4(pp.signaturePrivateKey)
@@ -3868,7 +4531,7 @@ function encodeBundle(bundle) {
 function decodeBundle(bytes) {
   const obj = JSON.parse(new TextDecoder().decode(bytes));
   return {
-    publicPackage: MLSGroupManager2.deserializeKeyPackage(hexToBytes3(obj.pub)),
+    publicPackage: MLSGroupManager3.deserializeKeyPackage(hexToBytes3(obj.pub)),
     privatePackage: {
       initPrivateKey: hexToBytes3(obj.initPriv),
       hpkePrivateKey: hexToBytes3(obj.hpkePriv),
@@ -4413,9 +5076,10 @@ function mimeForName(name) {
   return MIME_BY_EXT[name.slice(dot + 1).toLowerCase()] ?? "application/octet-stream";
 }
 async function prepareAttachment(filePath, caption, channelId, deps) {
+  await deps.ready();
   const bytes = await deps.readFile(filePath);
   const name = basename(filePath);
-  const { encryptedData, fileKey, fileNonce, digest } = deps.encryptFile(bytes);
+  const { encryptedData, fileKey, fileNonce, digest } = await deps.encryptFile(bytes);
   const blobId = await deps.uploadBlob(encryptedData, channelId);
   const body = {
     v: 1,
@@ -4432,12 +5096,13 @@ async function prepareAttachment(filePath, caption, channelId, deps) {
   return body;
 }
 async function materializeAttachment(body, ctx, deps) {
+  await deps.ready();
   const ciphertext = await deps.downloadBlob(body.blobId);
-  const sha2566 = deps.computeFileDigest(ciphertext);
+  const sha2566 = await deps.computeFileDigest(ciphertext);
   if (sha2566 !== body.digest) {
     throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
   }
-  const plain = deps.decryptFile(
+  const plain = await deps.decryptFile(
     ciphertext,
     deps.base64ToBytes(body.fileKey),
     deps.base64ToBytes(body.fileNonce)
@@ -4450,6 +5115,16 @@ async function materializeAttachment(body, ctx, deps) {
   return { filename: safeName, mime: body.mime, size: plain.length, path, sha256: sha2566 };
 }
 
+// src/sodium-ready.ts
+import { generateEphemeralKeypair } from "@agentvault/crypto";
+var warming = null;
+function ensureSodiumReady() {
+  return warming ??= generateEphemeralKeypair().then(() => void 0).catch((e) => {
+    warming = null;
+    throw e;
+  });
+}
+
 // src/memory/hermes-session-map.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 import { homedir } from "node:os";
@@ -5347,6 +6022,10 @@ var BridgeAgent = class _BridgeAgent {
   }
   async start() {
     this.startedAt = Date.now();
+    try {
+      await this.ingestOnce();
+    } catch {
+    }
     await this.provider.publishKeyPackage();
     this.startReceivePump();
     if (this.selfHealSweepEnabled) {
@@ -5550,6 +6229,50 @@ var BridgeAgent = class _BridgeAgent {
    * DEVICE never held a leaf can 403 on the signal call. That's harmless and
    * must not abort the sweep for every other channel.
    */
+  /**
+   * One best-effort device-level KeyPackage rotation attempt.
+   *
+   * `publishKeyPackage` is a cheap no-op skip unless the SERVER says the held
+   * KeyPackage is expired, so calling it every cycle costs one read and rotates at
+   * most once per TTL. The catch logs once and continues: it MUST NOT rethrow, MUST
+   * NOT abort the sweep, and MUST NOT retry inside the cycle. A KeyPackage that
+   * cannot be rotated this cycle is retried on the next interval, and the sweep's
+   * per-channel repair work is independent of it.
+   */
+  /**
+   * Tri-state: "is this device STILL serving a server-expired KeyPackage at the end
+   * of the cycle that just tried to fix it?"
+   *
+   * `false` is the only healthy value, and it requires a POSITIVE, current proof of
+   * non-expiry. `null` is unknown and reads exactly like `true` in `degraded`, so a
+   * daemon that cannot prove itself un-expired stops reporting healthy. That is the
+   * OPPOSITE direction to the rotation guard, which never rotates on unknown.
+   * Conflating the two directions recreates the lie this change removes.
+   *
+   * Initialised `null` and written only by `selfHealSweep`, so a sweep-off daemon
+   * reads `null` and therefore degraded.
+   */
+  keypackageExpired = null;
+  /** Resolve the flag from the SAME two inputs the guard uses, with every unknown
+   * mapped to `null`. Never throws: a failure to measure is itself unknown. */
+  async resolveKeypackageExpired() {
+    try {
+      const kpId = await this.provider.getLastPublishedKpId();
+      if (kpId === null || kpId === "") return null;
+      const exp = await this.backend.fetchKeyPackageExpiry(kpId);
+      if (exp === null) return null;
+      return isServerExpired(exp, Date.now());
+    } catch {
+      return null;
+    }
+  }
+  async rotateDeviceKeyPackage() {
+    try {
+      await this.provider.publishKeyPackage();
+    } catch (e) {
+      console.error("[bridge] selfHealSweep: device KeyPackage rotation failed (continuing):", e);
+    }
+  }
   async selfHealSweep() {
     if (typeof this.provider.resyncByReplay !== "function" || typeof this.provider.heldGroupIdFor !== "function") {
       this.providerCapabilityMissing = true;
@@ -5558,7 +6281,16 @@ var BridgeAgent = class _BridgeAgent {
       );
       return;
     }
+    if (typeof this.backend?.fetchKeyPackageExpiry !== "function") {
+      this.providerCapabilityMissing = true;
+      console.error(
+        "[bridge] selfHealSweep ABORTED: backend is missing fetchKeyPackageExpiry \u2014 the SDK dist is STALE (it predates KeyPackage expiry rotation). Rebuild the SDK dist THEN the bridge dist. KeyPackage rotation and healing are NOT running; observations are reported STALE."
+      );
+      return;
+    }
     this.providerCapabilityMissing = false;
+    await this.rotateDeviceKeyPackage();
+    this.keypackageExpired = await this.resolveKeypackageExpired();
     const enclaves = await this.enclavesToCover();
     this.enclaveListEverSucceeded.add(this.cfg.enclaveId);
     const seen = /* @__PURE__ */ new Set();
@@ -5806,12 +6538,24 @@ var BridgeAgent = class _BridgeAgent {
   }
   sendDeps() {
     return {
+      ready: () => ensureSodiumReady(),
       uploadBlob: (ciphertext, channelId) => this.uploadBlobImpl(ciphertext, channelId),
       encryptFile,
       bytesToBase64: bytesToBase642,
       readFile: (p) => fsp.readFile(p).then((b) => new Uint8Array(b))
     };
   }
+  receiveDeps() {
+    return {
+      ready: () => ensureSodiumReady(),
+      downloadBlob: this.downloadBlobImpl,
+      decryptFile,
+      computeFileDigest,
+      base64ToBytes: base64ToBytes2,
+      mkdirp: (d) => fsp.mkdir(d, { recursive: true }).then(() => void 0),
+      writeFile: (p, data) => fsp.writeFile(p, data)
+    };
+  }
   async sendAttachment(channelId, filePath, caption) {
     this.enforceRateFloor("attachment", channelId);
     const joined = await this.reconcileJoin(channelId);
@@ -5867,8 +6611,11 @@ var BridgeAgent = class _BridgeAgent {
   /**
    * List channels in one enclave (default: the daemon's own home enclave).
    * Task 3: called per-*known* enclave by refreshChannelMeta so a
-   * cross-enclave room's is_dm gets resolved — see the scope caveat there
-   * (same-tenant only; a cross-tenant enclave 404s under the agent's bearer).
+   * cross-enclave room's is_dm gets resolved. ⚠️ The old "same-tenant only; a
+   * cross-tenant enclave 404s under the agent's bearer" caveat here is refuted
+   * — see the CROSS-TENANT LISTING note on enclavesToCover. This route admits
+   * any enclave the caller holds a live membership row in, partner tenants
+   * included.
    */
   async listChannels(enclaveId = this.cfg.enclaveId) {
     const url = `${this.cfg.apiBase}/api/v1/enclaves/${enclaveId}/channels?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
@@ -5923,12 +6670,16 @@ var BridgeAgent = class _BridgeAgent {
    * room is never listed under the home-enclave-only call, so its is_dm never
    * resolves and the @mention filter fails open for that room.
    *
-   * Each enclave is wrapped in its own try/catch (scope caveat — audit
-   * H2/tenant): list_channels_in_enclave filters on tenant_id, so a
-   * same-tenant enclave the agent has learned about resolves fine, but a
-   * cross-TENANT federated-partner enclave 404s under this agent's bearer;
-   * that enclave's channels are left unresolved (fail open) without aborting
-   * the other enclaves in the set.
+   * Each enclave is wrapped in its own try/catch so one enclave's listing
+   * failure leaves only that enclave's channels unresolved (fail open) without
+   * aborting the other enclaves in the set.
+   *
+   * ⚠️ The old scope caveat here (audit H2/tenant) said
+   * `list_channels_in_enclave` filters on tenant_id and 404s a cross-TENANT
+   * federated-partner enclave. That is refuted — see the CROSS-TENANT LISTING
+   * note on enclavesToCover. A partner enclave with a live membership row
+   * resolves like any other, so the try/catch now covers transport errors,
+   * 5xx, and genuine non-member 404s only.
    */
   async refreshChannelMeta() {
     const enclaves = await this.enclavesToCover();
@@ -5956,12 +6707,20 @@ var BridgeAgent = class _BridgeAgent {
    * failure right after a restart would read as "never succeeded" and slip
    * through the expected-gap branch — weaker than the old abort-on-failure).
    * A failure of a member of this set is a REGRESSION and degrades health; a
-   * failure of a never-succeeded enclave (partner: tenant-scoped 404, permanent
-   * pending backend authz) is an EXPECTED gap — reported, not degrading, or
-   * every federated agent would peg degraded forever. */
+   * failure of a never-succeeded enclave is reported but does not degrade.
+   *
+   * ⚠️ The old justification for that asymmetry named a partner enclave's
+   * "tenant-scoped 404, permanent pending backend authz" as the expected gap.
+   * That premise is refuted — see the CROSS-TENANT LISTING note on
+   * enclavesToCover; a partner enclave with a live membership row lists fine.
+   * The asymmetry is kept on its remaining merit: an enclave this process has
+   * never listed may simply be one this agent holds no live membership in, and
+   * pegging health degraded forever on that is noise, not signal. */
   enclaveListEverSucceeded = /* @__PURE__ */ new Set();
   /** Warn-once-per-failure-streak, keyed by enclave id (cleared on success):
-   * a permanently-404ing partner enclave must not log 1440 lines a day. */
+   * a persistently-failing enclave must not log 1440 lines a day. (The old
+   * wording named "a permanently-404ing partner enclave" — refuted, see the
+   * CROSS-TENANT LISTING note on enclavesToCover.) */
   enclaveListWarned = /* @__PURE__ */ new Set();
   static ENCLAVE_ENUM_TTL_MS = 5 * 6e4;
   enclaveEnumWarned = false;
@@ -5989,11 +6748,35 @@ var BridgeAgent = class _BridgeAgent {
    * membership changes are picked up within one TTL, which matches the sweep
    * cadence this exists to serve.
    *
-   * ⚠️ Residual gap, stated: the enumeration RETURNS cross-tenant partner
-   * enclaves, but `list_channels_in_enclave` is tenant-scoped and 404s them
-   * under this agent's bearer — so a partner enclave in this set still yields
-   * no channels. Callers must treat a per-enclave listing failure as skip-one,
-   * never abort-all. Closing that needs backend authz work, not daemon work.
+   * ── CROSS-TENANT LISTING: the canonical statement for this file ──────────
+   *
+   * ⚠️ CORRECTED 2026-08-21 (#280 spec F6). This block, and five other comments
+   * in this file, used to state that `list_channels_in_enclave` is tenant-
+   * scoped and 404s a cross-tenant partner enclave under this agent's bearer,
+   * leaving a partner enclave in this set with no channels. That has been FALSE
+   * since #187 (`d7cc685a`, 2026-07-31). Verified by opening the code:
+   *
+   *  - `list_channels_in_enclave` calls `_resolve_enclave_membership(...,
+   *    host_only=False)` (backend/app/api/v1/connect_channels.py:897-900).
+   *  - `host_only=False` OMITS the `ConnectEnclave.tenant_id == auth.tenant_id`
+   *    predicate and runs the membership query under `bypass_rls`, so the
+   *    host-owned enclave row is visible to a partner session (same file
+   *    :519-520, :531-543). The gate is membership, not tenancy.
+   *  - The channel query it then runs (same file :902-919) reads
+   *    `connect_channels` joined to `connect_channel_members`, and BOTH tables
+   *    are among the eight the schema deliberately leaves without RLS for
+   *    having no `tenant_id` column (alembic 0001_connect_initial_schema.py:
+   *    750-755, :778-780). No policy filters those rows by tenant.
+   *
+   * So a partner-tenant agent holding a live `ConnectEnclaveMember` row
+   * (`removed_at IS NULL`) gets 200 with that enclave's real channels. There is
+   * no partner-enclave listing gap left to close, and no backend authz work
+   * pending for it.
+   *
+   * What DOES still reach a per-enclave listing failure: a transport error, a
+   * 5xx, or a genuine 404 for an enclave this agent holds no live membership
+   * in. Those are real outages, so the skip-one, never-abort-all rule stands on
+   * its own merit — it just no longer has a standing partner-enclave case.
    */
   async enclavesToCover() {
     const now = Date.now();
@@ -6449,14 +7232,7 @@ var BridgeAgent = class _BridgeAgent {
               const meta = await materializeAttachment(
                 parsed,
                 { attachmentsDir: this.attachmentsDirImpl, channelId: m.channelId, messageId: m.messageId },
-                {
-                  downloadBlob: this.downloadBlobImpl,
-                  decryptFile,
-                  computeFileDigest,
-                  base64ToBytes: base64ToBytes2,
-                  mkdirp: (d) => fsp.mkdir(d, { recursive: true }).then(() => void 0),
-                  writeFile: (p, data) => fsp.writeFile(p, data)
-                }
+                this.receiveDeps()
               );
               this.buffer.push({
                 channel_id: m.channelId,
@@ -6639,8 +7415,10 @@ var BridgeAgent = class _BridgeAgent {
       sweep_enabled: this.selfHealSweepEnabled,
       observations_stale: observationsStale,
       diverged_channels: divergedChannels,
+      keypackage_expired: this.keypackageExpired,
       // A2: the truthful roll-up gates read instead of `status` (D-3).
-      degraded: divergedChannels > 0 || observationsStale || sweepCoverageLost,
+      // `!== false` and not `=== true`: unknown must never read healthy.
+      degraded: divergedChannels > 0 || observationsStale || sweepCoverageLost || this.keypackageExpired !== false,
       channels: liveChannels,
       sweep_enclaves_failed: [...this.sweepEnclavesFailed],
       identity_id: this.cfg.identityId,