@securecoms/agent-bridge 0.9.0 → 0.10.0

package/dist/bin.js

@@ -1387,6 +1387,18 @@ var LeafRosterMismatchError = class extends Error {
     this.name = "LeafRosterMismatchError";
   }
 };
+var AmbiguousOwnLeafError = class extends Error {
+  deviceId;
+  totalLeaves;
+  candidateLeaves;
+  constructor(deviceId, totalLeaves, candidateLeaves) {
+    super(`removeDeviceFromLiveGroup: cannot identify device ${deviceId}'s leaf \u2014 the identity owns ${totalLeaves} leaves and ${candidateLeaves} remain after excluding this committer's own. Leaf credentials carry the identity, not the device, so the target is genuinely ambiguous. Refusing rather than evicting a device that was never revoked.`);
+    this.deviceId = deviceId;
+    this.totalLeaves = totalLeaves;
+    this.candidateLeaves = candidateLeaves;
+    this.name = "AmbiguousOwnLeafError";
+  }
+};
 var HealAddAfterRemoveError = class extends Error {
   constructor(cause) {
     super("healDivergedMember: Add failed after Remove already landed \u2014 member detached, re-run heal to recover");
@@ -1406,7 +1418,7 @@ var ForgedCredentialError = class extends Error {
     this.name = "ForgedCredentialError";
   }
 };
-var MlsGroupKeyProvider = class {
+var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   o;
   suite;
   managers = /* @__PURE__ */ new Map();
@@ -1556,9 +1568,25 @@ var MlsGroupKeyProvider = class {
    * Snapshot of per-channel decrypt-error / stuck state (ADR-0002 observability).
    * Surfaces a wedged channel that would otherwise "look idle": the daemon serves
    * it on GET /v1/metrics and the web shell reads it via a selector. A channel is
-   * `stuck` once it has had `stuckThreshold` consecutive decrypt failures with no
-   * intervening successful decrypt. Returns a plain object keyed by channelId;
-   * absence of a key means zero errors observed for that channel.
+   * `stuck` once it has had `stuckThreshold` GENUINELY-WEDGED decrypt failures
+   * with no intervening successful decrypt. Returns a plain object keyed by
+   * channelId; absence of a key means zero errors observed for that channel.
+   *
+   * `stuck` gates on `wedgedRun`, NOT `consecutiveErrors` — the same correction
+   * the quarantine gate already got (P0a). `consecutiveErrors` is bumped at the
+   * top of the catch for EVERY failure, INCLUDING the benign past-epoch
+   * duplicate-commit churn that the `permanentlyDead` path immediately and
+   * safely auto-drains. Deriving the user-visible health signal from it meant
+   * ordinary at-least-once / committer-race traffic painted a perfectly healthy
+   * channel red.
+   *
+   * That is the prod symptom of 2026-07-31: a freshly-welcomed federated partner
+   * was queued the very Add commit its Welcome already contained. It joined the
+   * correct group at the correct epoch, correctly identified the replayed commit
+   * as dead and drained it — and still showed "This channel is stuck", because
+   * the drain happened AFTER the error had been counted. `wedgedRun` counts only
+   * rows left UN-acked (actually stuck), and a clean decrypt clears it, so a
+   * genuine wedge still reports exactly as before.
    */
   errorStats() {
     const out = {};
@@ -1567,7 +1595,7 @@ var MlsGroupKeyProvider = class {
         decryptErrors: e.decryptErrors,
         consecutiveErrors: e.consecutiveErrors,
         lastErrorAt: e.lastErrorAt,
-        stuck: e.consecutiveErrors >= this.stuckThreshold,
+        stuck: e.wedgedRun >= this.stuckThreshold,
         quarantined: e.quarantined
       };
     }
@@ -2232,6 +2260,25 @@ var MlsGroupKeyProvider = class {
    * `removed_device_id` (instead of removed_identity_id); the server resolves the
    * device's identity, asserts it matches, and purges that ONE device.
    */
+  /**
+   * This committer's OWN leaf index in the given group's ratchet tree, or null
+   * when it cannot be read.
+   *
+   * `MLSGroupManager.state` is marked `@internal` but is a declared (non-private)
+   * field, and `state.privatePath.leafIndex` is the same value ts-mls itself uses
+   * as the sender leaf when protecting application data. Reading it here avoids a
+   * change to `@agentvault/crypto`; if a public accessor is added later this
+   * should delegate to it.
+   *
+   * Returns null rather than throwing so every caller must decide explicitly what
+   * an unknown own-leaf means. The one caller today FAILS CLOSED on null by
+   * falling back to the positional path only for FOREIGN identities — it never
+   * uses null to justify guessing among an own identity's leaves.
+   */
+  ownLeafIndex(mgr) {
+    const idx = mgr.state?.privatePath?.leafIndex;
+    return typeof idx === "number" ? idx : null;
+  }
   async removeDeviceFromLiveGroup(channelId, deviceId, opts) {
     return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, 0)));
   }
@@ -2244,7 +2291,17 @@ var MlsGroupKeyProvider = class {
     if (leaves.length !== opts.orderedDeviceIds.length) {
       throw new LeafRosterMismatchError();
     }
-    const leafIndex = leaves[pos];
+    let leafIndex;
+    const ownLeaf = this.ownLeafIndex(mgr);
+    if (ownLeaf !== null && leaves.includes(ownLeaf)) {
+      const others = leaves.filter((i) => i !== ownLeaf);
+      if (others.length !== 1) {
+        throw new AmbiguousOwnLeafError(deviceId, leaves.length, others.length);
+      }
+      leafIndex = others[0];
+    } else {
+      leafIndex = leaves[pos];
+    }
     const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
     const priorEpoch = Number(mgr.epoch);
     const { commit } = await mgr.removeMembers([leafIndex]);
@@ -2497,7 +2554,7 @@ var MlsGroupKeyProvider = class {
       });
       await this.o.store.save(channelId, mgr.exportState());
       this.managers.set(channelId, mgr);
-      await this.o.store.deletePendingBundle(this.o.deviceId);
+      return { staleMemberDeviceIds: reinit.stale_member_device_ids ?? [] };
     });
   }
   /** Returns true when an in-memory MLS manager is live for the channel.
@@ -2573,7 +2630,60 @@ var MlsGroupKeyProvider = class {
    * ⇒ refuse, never call verify), then structural signer check, then attestation
    * verify against the NON-EMPTY pinned key, then post-join group-id assertion.
    */
+  /** C4 (split-brain Task 4): back-off for REFUSED supersedes, keyed
+   * `${channelId}:${groupId}`. A refused supersede leaves its row un-acked by
+   * design (it is not a stray), but pre-back-off that meant a full re-verify —
+   * including a fetchResetAttestation HTTP round-trip — on EVERY receive poll,
+   * forever, for a request that can never succeed (the nine production split
+   * channels all carry NULL-attestation legacy groups).
+   *
+   * ⚠️ ONLY POST-FETCH refusals enter the back-off. The step-0 pin guard and
+   * the retired-group check run BEFORE fetchResetAttestation, so they
+   * contribute zero HTTP to the storm — and the pin guard's precondition is
+   * TRANSIENT (cold owner cache / momentarily anomalous roster; the bridge
+   * warms the cache before receiveOnce for exactly this reason). Backing a
+   * pre-fetch refusal off buys nothing and converts a one-cycle stall into a
+   * ten-minute outage on a valid recovery.
+   *
+   * Of the backed-off refusals: no-attestation, unparseable content,
+   * channel/group mismatch and post-join mismatch are DETERMINISTIC per
+   * (channel, group) — the attestation columns are written at group creation
+   * and never change. Signer-mismatch, signature-verify and no-bundle are
+   * ASSUMED stable for the window; they are pin- or bundle-dependent, but by
+   * the time they run the fetch has already been paid, so suppressing the
+   * window bounds the storm at the cost of a ≤10-minute delay if the pin or
+   * bundle changes. Note the suppression means the reason is not RE-OBSERVED
+   * during the window — the underlying precondition can change freely; the
+   * window is a cost bound, not a claim of immutability.
+   *
+   * The reason lives in the VALUE for observability; the clearing rule lives
+   * in the KEY: the owner minting a FIXED replacement group arrives with a
+   * NEW group id — a different key, tried immediately. The un-openable path
+   * (verified Welcome, KP mismatch) is EXEMPT: onSupersedeUnopenable's own
+   * cooldown governs it. In-memory only: a reload/restart costs one extra
+   * fetch per stranded row — reload-bounded, not poll-bounded. */
+  supersedeRefusals = /* @__PURE__ */ new Map();
+  static SUPERSEDE_REFUSAL_BACKOFF_MS = 10 * 6e4;
+  /** True while (channelId, groupId) is inside its refusal back-off window.
+   * @internal exposed for diagnostics only — not part of the stable surface. */
+  supersedeBackoffActive(channelId, groupId) {
+    const rec = this.supersedeRefusals.get(`${channelId}:${groupId}`);
+    return rec !== void 0 && Date.now() < rec.until;
+  }
   async trySupersede(channelId, row, heldGroupId) {
+    const refuse = (msg) => {
+      this.recordDecryptError(row, new Error(msg));
+      const now = Date.now();
+      for (const [k, v] of this.supersedeRefusals) {
+        if (now >= v.until)
+          this.supersedeRefusals.delete(k);
+      }
+      this.supersedeRefusals.set(`${channelId}:${row.group_id}`, {
+        reason: msg,
+        until: now + _MlsGroupKeyProvider.SUPERSEDE_REFUSAL_BACKOFF_MS
+      });
+      return false;
+    };
     const owner = this.o.onResolvePinnedOwner ? await this.o.onResolvePinnedOwner(channelId) : null;
     if (!owner || !owner.publicKeyHex) {
       this.recordDecryptError(row, new Error("supersede refused: no pinned owner key (step-0 guard)"));
@@ -2586,33 +2696,27 @@ var MlsGroupKeyProvider = class {
     }
     const att = await this.o.backend.fetchResetAttestation(row.group_id);
     if (!att) {
-      this.recordDecryptError(row, new Error(`supersede refused: no attestation for group ${row.group_id}`));
-      return false;
+      return refuse(`supersede refused: no attestation for group ${row.group_id}`);
     }
     if (att.signerIdentityId !== owner.identityId) {
-      this.recordDecryptError(row, new Error("supersede refused: signer is not the pinned owner"));
-      return false;
+      return refuse("supersede refused: signer is not the pinned owner");
     }
     let content;
     try {
       content = JSON.parse(att.signedContent);
     } catch {
-      this.recordDecryptError(row, new Error("supersede refused: unparseable signed_content"));
-      return false;
+      return refuse("supersede refused: unparseable signed_content");
     }
     if (content.channel_id !== row.connect_channel_id || content.new_group_id !== row.group_id) {
-      this.recordDecryptError(row, new Error("supersede refused: attestation channel/group mismatch"));
-      return false;
+      return refuse("supersede refused: attestation channel/group mismatch");
     }
     const ok = await verifyApprovalArtifact({ content, signature: att.signatureHex, signerPublicKey: owner.publicKeyHex, createdAt: "", version: 1 }, owner.publicKeyHex);
     if (!ok) {
-      this.recordDecryptError(row, new Error("supersede refused: signature does not verify against pinned owner key"));
-      return false;
+      return refuse("supersede refused: signature does not verify against pinned owner key");
     }
     const bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
     if (!bundle) {
-      this.recordDecryptError(row, new Error("supersede refused: no pending KeyPackage bundle to open the new Welcome"));
-      return false;
+      return refuse("supersede refused: no pending KeyPackage bundle to open the new Welcome");
     }
     return await this.locks.run(channelId, async () => {
       const mgr = new MLSGroupManager();
@@ -2637,14 +2741,14 @@ var MlsGroupKeyProvider = class {
         return false;
       }
       if (new TextDecoder().decode(mgr.groupId) !== row.group_id) {
-        this.recordDecryptError(row, new Error("supersede refused: post-join group id != attested new_group_id"));
-        return false;
+        return refuse("supersede refused: post-join group id != attested new_group_id");
       }
       this.evictChannelState(channelId);
       await this.o.store.delete(channelId);
       await this.o.store.discardStaging(channelId);
       await this.o.store.addRetiredGroupId(channelId, heldGroupId);
       this.errors.delete(channelId);
+      this.supersedeRefusals.delete(`${channelId}:${row.group_id}`);
       this.managers.set(channelId, mgr);
       await this.o.store.save(channelId, mgr.exportState());
       await this.o.backend.ackDelivery(this.o.deviceId, [row.queue_id]);
@@ -2681,9 +2785,15 @@ var MlsGroupKeyProvider = class {
               if (heldGroupId !== null && heldGroupId === row.group_id) {
                 handshakeAcked.push(row.queue_id);
               } else if (heldGroupId !== null && heldGroupId !== row.group_id) {
-                const ok = await this.trySupersede(wcid, row, heldGroupId);
-                if (ok)
-                  supersededChannelIds.push(wcid);
+                if (this.supersedeBackoffActive(wcid, row.group_id)) {
+                  if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
+                    console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} g=${row.group_id.slice(0, 8)} -> SKIP(refusal back-off)`);
+                  }
+                } else {
+                  const ok = await this.trySupersede(wcid, row, heldGroupId);
+                  if (ok)
+                    supersededChannelIds.push(wcid);
+                }
               }
             } else if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
               console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} rowGroup=${(row.group_id || "-").slice(0, 8)} -> NO-LOCAL-STATE (leave un-acked for join path)`);
@@ -3386,19 +3496,8 @@ var RestMlsBackend = class {
       created: j.created === void 0 ? true : Boolean(j.created)
     };
   }
-  async reinitConnectChannelGroup(channelId, memberDeviceIds) {
-    const committer = memberDeviceIds[0];
-    if (!committer)
-      throw new Error("reinitConnectChannelGroup: empty member set");
-    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/reinit`, {
-      member_device_ids: memberDeviceIds,
-      committer_device_id: committer
-    });
-    return {
-      group_id: String(j.group_id),
-      current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
-    };
+  async reinitConnectChannelGroup() {
+    throw new Error("reinitConnectChannelGroup was removed (it minted unattested MLS groups that orphaned channel members permanently). Use resetReinitConnectChannelGroup with an owner attestation.");
   }
   async resetReinitConnectChannelGroup(channelId, memberDeviceIds, att) {
     const committer = memberDeviceIds[0];
@@ -3416,7 +3515,11 @@ var RestMlsBackend = class {
     return {
       group_id: String(j.group_id),
       current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : [],
+      // Absent on a backend that predates the dropped-member report; an empty
+      // list is the correct read of "the server told us nothing", since the old
+      // server also never dropped anyone for an expired KeyPackage.
+      stale_member_device_ids: Array.isArray(j.stale_member_device_ids) ? j.stale_member_device_ids.map(String) : []
     };
   }
   async fetchKeyPackages(deviceIds) {
@@ -5355,11 +5458,33 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.providerCapabilityMissing = false;
-    let chans;
-    try {
-      chans = await this.listChannels();
-    } catch (e) {
-      console.warn("[bridge] selfHealSweep aborted: listChannels failed:", e);
+    const enclaves = await this.enclavesToCover();
+    this.enclaveListEverSucceeded.add(this.cfg.enclaveId);
+    const seen = /* @__PURE__ */ new Set();
+    const chans = [];
+    const failed = [];
+    let listedAny = false;
+    for (const encId of enclaves) {
+      try {
+        for (const c of await this.listChannels(encId)) {
+          if (seen.has(c.channel_id)) continue;
+          seen.add(c.channel_id);
+          chans.push(c);
+        }
+        listedAny = true;
+        this.enclaveListEverSucceeded.add(encId);
+        this.enclaveListWarned.delete(encId);
+      } catch (e) {
+        failed.push(encId);
+        if (!this.enclaveListWarned.has(encId)) {
+          this.enclaveListWarned.add(encId);
+          console.warn(`[bridge] selfHealSweep: listChannels failed for enclave ${encId}; skipping (warn-once per streak):`, e);
+        }
+      }
+    }
+    this.sweepEnclavesFailed = failed;
+    if (!listedAny) {
+      console.warn("[bridge] selfHealSweep aborted: every enclave listing failed");
       return;
     }
     for (const c of chans) {
@@ -5705,7 +5830,7 @@ var BridgeAgent = class _BridgeAgent {
    * the other enclaves in the set.
    */
   async refreshChannelMeta() {
-    const enclaves = /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.store.distinctEnclaveIds()]);
+    const enclaves = await this.enclavesToCover();
     const now = Date.now();
     for (const encId of enclaves) {
       try {
@@ -5718,6 +5843,89 @@ var BridgeAgent = class _BridgeAgent {
       }
     }
   }
+  /** Cache for the server-side enclave enumeration (see enclavesToCover). */
+  enclaveEnumCache = null;
+  /** Enclaves whose channel listing failed on the NEWEST sweep (audit HIGH:
+   * skip-one deleted the sweep's partial-coverage signal — observations_stale
+   * is a global max, so one healthy enclave masked a failed one). Surfaced on
+   * health() so partial coverage is never silent. */
+  sweepEnclavesFailed = [];
+  /** Enclave ids whose channel listing has EVER succeeded this process, seeded
+   * with HOME (home is always expected to list; without the seed, a home
+   * failure right after a restart would read as "never succeeded" and slip
+   * through the expected-gap branch — weaker than the old abort-on-failure).
+   * A failure of a member of this set is a REGRESSION and degrades health; a
+   * failure of a never-succeeded enclave (partner: tenant-scoped 404, permanent
+   * pending backend authz) is an EXPECTED gap — reported, not degrading, or
+   * every federated agent would peg degraded forever. */
+  enclaveListEverSucceeded = /* @__PURE__ */ new Set();
+  /** Warn-once-per-failure-streak, keyed by enclave id (cleared on success):
+   * a permanently-404ing partner enclave must not log 1440 lines a day. */
+  enclaveListWarned = /* @__PURE__ */ new Set();
+  static ENCLAVE_ENUM_TTL_MS = 5 * 6e4;
+  enclaveEnumWarned = false;
+  /**
+   * C1 (split-brain Task 3): every enclave this agent must COVER — for the
+   * self-heal sweep and for channel-meta refresh alike. ONE helper on purpose:
+   * these two call sites had drifted (refreshChannelMeta looped home+learned,
+   * selfHealSweep looped nothing), and the drift is exactly what left both
+   * production agents with zero recovery coverage in their second enclave.
+   *
+   * The set is SERVER enumeration ∪ home ∪ store-learned:
+   *
+   *  - SERVER (`GET /api/v1/enclaves`, membership-scoped, federated included)
+   *    is the authoritative source. The store CANNOT be: channel_meta's only
+   *    writers are listChannels itself (circular — you learn enclave B by
+   *    having already listed B) and the receive pump's successfully-decrypted
+   *    loop, and a FORKED agent decrypts nothing, so the agent that most needs
+   *    sweeping in enclave B is precisely the one whose store never learned B.
+   *  - home + learned stay in the union as the degraded-mode floor: if the
+   *    enumeration endpoint is down, we sweep what we can rather than nothing,
+   *    and we warn (once) so the gap is diagnosable.
+   *
+   * The server result is cached for ENCLAVE_ENUM_TTL_MS so per-ingest-cycle
+   * callers (refreshChannelMeta) do not add an HTTP round-trip per cycle;
+   * membership changes are picked up within one TTL, which matches the sweep
+   * cadence this exists to serve.
+   *
+   * ⚠️ Residual gap, stated: the enumeration RETURNS cross-tenant partner
+   * enclaves, but `list_channels_in_enclave` is tenant-scoped and 404s them
+   * under this agent's bearer — so a partner enclave in this set still yields
+   * no channels. Callers must treat a per-enclave listing failure as skip-one,
+   * never abort-all. Closing that needs backend authz work, not daemon work.
+   */
+  async enclavesToCover() {
+    const now = Date.now();
+    if (!this.enclaveEnumCache || now - this.enclaveEnumCache.at > _BridgeAgent.ENCLAVE_ENUM_TTL_MS) {
+      try {
+        const url = `${this.cfg.apiBase}/api/v1/enclaves?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+        const res = await this.fetchImpl(url, {
+          headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+        });
+        if (!res.ok) throw new Error(`list_enclaves failed: ${res.status}`);
+        const rows = await res.json();
+        this.enclaveEnumCache = { ids: rows.map((r) => r.enclave_id), at: Date.now() };
+        this.enclaveEnumWarned = false;
+      } catch (e) {
+        if (!this.enclaveEnumWarned) {
+          this.enclaveEnumWarned = true;
+          console.warn(
+            "[bridge] enclave enumeration failed; sweep coverage degraded to home+learned enclaves:",
+            e
+          );
+        }
+      }
+    }
+    const fresh = this.enclaveEnumCache && Date.now() - this.enclaveEnumCache.at <= _BridgeAgent.ENCLAVE_ENUM_TTL_MS;
+    if (fresh) {
+      return /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.enclaveEnumCache.ids]);
+    }
+    return /* @__PURE__ */ new Set([
+      this.cfg.enclaveId,
+      ...this.store.distinctEnclaveIds(),
+      ...this.enclaveEnumCache?.ids ?? []
+    ]);
+  }
   /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
   freshRoster(channelId) {
     const hit = this.channelRoster.get(channelId);
@@ -6314,6 +6522,9 @@ var BridgeAgent = class _BridgeAgent {
     const stalePeriodMs = _BridgeAgent.SELF_HEAL_SWEEP_INTERVAL_MS + _BridgeAgent.SELF_HEAL_SWEEP_JITTER_MS;
     const observationsStale = this.providerCapabilityMissing || channels.length === 0 || Date.now() - newest > stalePeriodMs;
     const divergedChannels = channels.filter((o) => o.diverged === true).length;
+    const sweepCoverageLost = this.sweepEnclavesFailed.some(
+      (id) => this.enclaveListEverSucceeded.has(id)
+    );
     const liveChannels = channels.map((o) => ({
       ...o,
       last_decrypt_at: this.provider.lastDecryptAtFor?.(o.channel_id) ?? o.last_decrypt_at
@@ -6328,8 +6539,9 @@ var BridgeAgent = class _BridgeAgent {
       observations_stale: observationsStale,
       diverged_channels: divergedChannels,
       // A2: the truthful roll-up gates read instead of `status` (D-3).
-      degraded: divergedChannels > 0 || observationsStale,
+      degraded: divergedChannels > 0 || observationsStale || sweepCoverageLost,
       channels: liveChannels,
+      sweep_enclaves_failed: [...this.sweepEnclavesFailed],
       identity_id: this.cfg.identityId,
       joined_channels: joined,
       buffered: this.buffer.length,

package/dist/bridge-agent.d.ts

@@ -674,6 +674,58 @@ export declare class BridgeAgent {
      * the other enclaves in the set.
      */
     private refreshChannelMeta;
+    /** Cache for the server-side enclave enumeration (see enclavesToCover). */
+    private enclaveEnumCache;
+    /** Enclaves whose channel listing failed on the NEWEST sweep (audit HIGH:
+     * skip-one deleted the sweep's partial-coverage signal — observations_stale
+     * is a global max, so one healthy enclave masked a failed one). Surfaced on
+     * health() so partial coverage is never silent. */
+    private sweepEnclavesFailed;
+    /** Enclave ids whose channel listing has EVER succeeded this process, seeded
+     * with HOME (home is always expected to list; without the seed, a home
+     * failure right after a restart would read as "never succeeded" and slip
+     * through the expected-gap branch — weaker than the old abort-on-failure).
+     * A failure of a member of this set is a REGRESSION and degrades health; a
+     * failure of a never-succeeded enclave (partner: tenant-scoped 404, permanent
+     * pending backend authz) is an EXPECTED gap — reported, not degrading, or
+     * every federated agent would peg degraded forever. */
+    private readonly enclaveListEverSucceeded;
+    /** Warn-once-per-failure-streak, keyed by enclave id (cleared on success):
+     * a permanently-404ing partner enclave must not log 1440 lines a day. */
+    private readonly enclaveListWarned;
+    private static readonly ENCLAVE_ENUM_TTL_MS;
+    private enclaveEnumWarned;
+    /**
+     * C1 (split-brain Task 3): every enclave this agent must COVER — for the
+     * self-heal sweep and for channel-meta refresh alike. ONE helper on purpose:
+     * these two call sites had drifted (refreshChannelMeta looped home+learned,
+     * selfHealSweep looped nothing), and the drift is exactly what left both
+     * production agents with zero recovery coverage in their second enclave.
+     *
+     * The set is SERVER enumeration ∪ home ∪ store-learned:
+     *
+     *  - SERVER (`GET /api/v1/enclaves`, membership-scoped, federated included)
+     *    is the authoritative source. The store CANNOT be: channel_meta's only
+     *    writers are listChannels itself (circular — you learn enclave B by
+     *    having already listed B) and the receive pump's successfully-decrypted
+     *    loop, and a FORKED agent decrypts nothing, so the agent that most needs
+     *    sweeping in enclave B is precisely the one whose store never learned B.
+     *  - home + learned stay in the union as the degraded-mode floor: if the
+     *    enumeration endpoint is down, we sweep what we can rather than nothing,
+     *    and we warn (once) so the gap is diagnosable.
+     *
+     * The server result is cached for ENCLAVE_ENUM_TTL_MS so per-ingest-cycle
+     * callers (refreshChannelMeta) do not add an HTTP round-trip per cycle;
+     * membership changes are picked up within one TTL, which matches the sweep
+     * cadence this exists to serve.
+     *
+     * ⚠️ Residual gap, stated: the enumeration RETURNS cross-tenant partner
+     * enclaves, but `list_channels_in_enclave` is tenant-scoped and 404s them
+     * under this agent's bearer — so a partner enclave in this set still yields
+     * no channels. Callers must treat a per-enclave listing failure as skip-one,
+     * never abort-all. Closing that needs backend authz work, not daemon work.
+     */
+    private enclavesToCover;
     /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
     private freshRoster;
     /**
@@ -836,6 +888,12 @@ export declare class BridgeAgent {
         degraded: boolean;
         /** M6: per-channel observations, newest sweep. Read from cache; no I/O. */
         channels: ChannelObservation[];
+        /** C1: enclaves whose channel listing failed on the newest sweep. Non-empty
+         * means partial coverage — those enclaves' channels were NOT probed. A
+         * PREVIOUSLY-SUCCEEDING (or home) entry also flips `degraded`; a
+         * never-succeeded entry (partner enclave, tenant-scoped 404) is reported
+         * here without degrading. */
+        sweep_enclaves_failed: string[];
         /** Optional memory-adapter counters (e.g. Hermes provider); present only when the active provider exposes stats(). */
         hermes_no_session?: number;
         hermes_skipped?: number;

package/dist/index.js

@@ -1284,6 +1284,18 @@ var LeafRosterMismatchError = class extends Error {
     this.name = "LeafRosterMismatchError";
   }
 };
+var AmbiguousOwnLeafError = class extends Error {
+  deviceId;
+  totalLeaves;
+  candidateLeaves;
+  constructor(deviceId, totalLeaves, candidateLeaves) {
+    super(`removeDeviceFromLiveGroup: cannot identify device ${deviceId}'s leaf \u2014 the identity owns ${totalLeaves} leaves and ${candidateLeaves} remain after excluding this committer's own. Leaf credentials carry the identity, not the device, so the target is genuinely ambiguous. Refusing rather than evicting a device that was never revoked.`);
+    this.deviceId = deviceId;
+    this.totalLeaves = totalLeaves;
+    this.candidateLeaves = candidateLeaves;
+    this.name = "AmbiguousOwnLeafError";
+  }
+};
 var HealAddAfterRemoveError = class extends Error {
   constructor(cause) {
     super("healDivergedMember: Add failed after Remove already landed \u2014 member detached, re-run heal to recover");
@@ -1303,7 +1315,7 @@ var ForgedCredentialError = class extends Error {
     this.name = "ForgedCredentialError";
   }
 };
-var MlsGroupKeyProvider = class {
+var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   o;
   suite;
   managers = /* @__PURE__ */ new Map();
@@ -1453,9 +1465,25 @@ var MlsGroupKeyProvider = class {
    * Snapshot of per-channel decrypt-error / stuck state (ADR-0002 observability).
    * Surfaces a wedged channel that would otherwise "look idle": the daemon serves
    * it on GET /v1/metrics and the web shell reads it via a selector. A channel is
-   * `stuck` once it has had `stuckThreshold` consecutive decrypt failures with no
-   * intervening successful decrypt. Returns a plain object keyed by channelId;
-   * absence of a key means zero errors observed for that channel.
+   * `stuck` once it has had `stuckThreshold` GENUINELY-WEDGED decrypt failures
+   * with no intervening successful decrypt. Returns a plain object keyed by
+   * channelId; absence of a key means zero errors observed for that channel.
+   *
+   * `stuck` gates on `wedgedRun`, NOT `consecutiveErrors` — the same correction
+   * the quarantine gate already got (P0a). `consecutiveErrors` is bumped at the
+   * top of the catch for EVERY failure, INCLUDING the benign past-epoch
+   * duplicate-commit churn that the `permanentlyDead` path immediately and
+   * safely auto-drains. Deriving the user-visible health signal from it meant
+   * ordinary at-least-once / committer-race traffic painted a perfectly healthy
+   * channel red.
+   *
+   * That is the prod symptom of 2026-07-31: a freshly-welcomed federated partner
+   * was queued the very Add commit its Welcome already contained. It joined the
+   * correct group at the correct epoch, correctly identified the replayed commit
+   * as dead and drained it — and still showed "This channel is stuck", because
+   * the drain happened AFTER the error had been counted. `wedgedRun` counts only
+   * rows left UN-acked (actually stuck), and a clean decrypt clears it, so a
+   * genuine wedge still reports exactly as before.
    */
   errorStats() {
     const out = {};
@@ -1464,7 +1492,7 @@ var MlsGroupKeyProvider = class {
         decryptErrors: e.decryptErrors,
         consecutiveErrors: e.consecutiveErrors,
         lastErrorAt: e.lastErrorAt,
-        stuck: e.consecutiveErrors >= this.stuckThreshold,
+        stuck: e.wedgedRun >= this.stuckThreshold,
         quarantined: e.quarantined
       };
     }
@@ -2129,6 +2157,25 @@ var MlsGroupKeyProvider = class {
    * `removed_device_id` (instead of removed_identity_id); the server resolves the
    * device's identity, asserts it matches, and purges that ONE device.
    */
+  /**
+   * This committer's OWN leaf index in the given group's ratchet tree, or null
+   * when it cannot be read.
+   *
+   * `MLSGroupManager.state` is marked `@internal` but is a declared (non-private)
+   * field, and `state.privatePath.leafIndex` is the same value ts-mls itself uses
+   * as the sender leaf when protecting application data. Reading it here avoids a
+   * change to `@agentvault/crypto`; if a public accessor is added later this
+   * should delegate to it.
+   *
+   * Returns null rather than throwing so every caller must decide explicitly what
+   * an unknown own-leaf means. The one caller today FAILS CLOSED on null by
+   * falling back to the positional path only for FOREIGN identities — it never
+   * uses null to justify guessing among an own identity's leaves.
+   */
+  ownLeafIndex(mgr) {
+    const idx = mgr.state?.privatePath?.leafIndex;
+    return typeof idx === "number" ? idx : null;
+  }
   async removeDeviceFromLiveGroup(channelId, deviceId, opts) {
     return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, 0)));
   }
@@ -2141,7 +2188,17 @@ var MlsGroupKeyProvider = class {
     if (leaves.length !== opts.orderedDeviceIds.length) {
       throw new LeafRosterMismatchError();
     }
-    const leafIndex = leaves[pos];
+    let leafIndex;
+    const ownLeaf = this.ownLeafIndex(mgr);
+    if (ownLeaf !== null && leaves.includes(ownLeaf)) {
+      const others = leaves.filter((i) => i !== ownLeaf);
+      if (others.length !== 1) {
+        throw new AmbiguousOwnLeafError(deviceId, leaves.length, others.length);
+      }
+      leafIndex = others[0];
+    } else {
+      leafIndex = leaves[pos];
+    }
     const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
     const priorEpoch = Number(mgr.epoch);
     const { commit } = await mgr.removeMembers([leafIndex]);
@@ -2394,7 +2451,7 @@ var MlsGroupKeyProvider = class {
       });
       await this.o.store.save(channelId, mgr.exportState());
       this.managers.set(channelId, mgr);
-      await this.o.store.deletePendingBundle(this.o.deviceId);
+      return { staleMemberDeviceIds: reinit.stale_member_device_ids ?? [] };
     });
   }
   /** Returns true when an in-memory MLS manager is live for the channel.
@@ -2470,7 +2527,60 @@ var MlsGroupKeyProvider = class {
    * ⇒ refuse, never call verify), then structural signer check, then attestation
    * verify against the NON-EMPTY pinned key, then post-join group-id assertion.
    */
+  /** C4 (split-brain Task 4): back-off for REFUSED supersedes, keyed
+   * `${channelId}:${groupId}`. A refused supersede leaves its row un-acked by
+   * design (it is not a stray), but pre-back-off that meant a full re-verify —
+   * including a fetchResetAttestation HTTP round-trip — on EVERY receive poll,
+   * forever, for a request that can never succeed (the nine production split
+   * channels all carry NULL-attestation legacy groups).
+   *
+   * ⚠️ ONLY POST-FETCH refusals enter the back-off. The step-0 pin guard and
+   * the retired-group check run BEFORE fetchResetAttestation, so they
+   * contribute zero HTTP to the storm — and the pin guard's precondition is
+   * TRANSIENT (cold owner cache / momentarily anomalous roster; the bridge
+   * warms the cache before receiveOnce for exactly this reason). Backing a
+   * pre-fetch refusal off buys nothing and converts a one-cycle stall into a
+   * ten-minute outage on a valid recovery.
+   *
+   * Of the backed-off refusals: no-attestation, unparseable content,
+   * channel/group mismatch and post-join mismatch are DETERMINISTIC per
+   * (channel, group) — the attestation columns are written at group creation
+   * and never change. Signer-mismatch, signature-verify and no-bundle are
+   * ASSUMED stable for the window; they are pin- or bundle-dependent, but by
+   * the time they run the fetch has already been paid, so suppressing the
+   * window bounds the storm at the cost of a ≤10-minute delay if the pin or
+   * bundle changes. Note the suppression means the reason is not RE-OBSERVED
+   * during the window — the underlying precondition can change freely; the
+   * window is a cost bound, not a claim of immutability.
+   *
+   * The reason lives in the VALUE for observability; the clearing rule lives
+   * in the KEY: the owner minting a FIXED replacement group arrives with a
+   * NEW group id — a different key, tried immediately. The un-openable path
+   * (verified Welcome, KP mismatch) is EXEMPT: onSupersedeUnopenable's own
+   * cooldown governs it. In-memory only: a reload/restart costs one extra
+   * fetch per stranded row — reload-bounded, not poll-bounded. */
+  supersedeRefusals = /* @__PURE__ */ new Map();
+  static SUPERSEDE_REFUSAL_BACKOFF_MS = 10 * 6e4;
+  /** True while (channelId, groupId) is inside its refusal back-off window.
+   * @internal exposed for diagnostics only — not part of the stable surface. */
+  supersedeBackoffActive(channelId, groupId) {
+    const rec = this.supersedeRefusals.get(`${channelId}:${groupId}`);
+    return rec !== void 0 && Date.now() < rec.until;
+  }
   async trySupersede(channelId, row, heldGroupId) {
+    const refuse = (msg) => {
+      this.recordDecryptError(row, new Error(msg));
+      const now = Date.now();
+      for (const [k, v] of this.supersedeRefusals) {
+        if (now >= v.until)
+          this.supersedeRefusals.delete(k);
+      }
+      this.supersedeRefusals.set(`${channelId}:${row.group_id}`, {
+        reason: msg,
+        until: now + _MlsGroupKeyProvider.SUPERSEDE_REFUSAL_BACKOFF_MS
+      });
+      return false;
+    };
     const owner = this.o.onResolvePinnedOwner ? await this.o.onResolvePinnedOwner(channelId) : null;
     if (!owner || !owner.publicKeyHex) {
       this.recordDecryptError(row, new Error("supersede refused: no pinned owner key (step-0 guard)"));
@@ -2483,33 +2593,27 @@ var MlsGroupKeyProvider = class {
     }
     const att = await this.o.backend.fetchResetAttestation(row.group_id);
     if (!att) {
-      this.recordDecryptError(row, new Error(`supersede refused: no attestation for group ${row.group_id}`));
-      return false;
+      return refuse(`supersede refused: no attestation for group ${row.group_id}`);
     }
     if (att.signerIdentityId !== owner.identityId) {
-      this.recordDecryptError(row, new Error("supersede refused: signer is not the pinned owner"));
-      return false;
+      return refuse("supersede refused: signer is not the pinned owner");
     }
     let content;
     try {
       content = JSON.parse(att.signedContent);
     } catch {
-      this.recordDecryptError(row, new Error("supersede refused: unparseable signed_content"));
-      return false;
+      return refuse("supersede refused: unparseable signed_content");
     }
     if (content.channel_id !== row.connect_channel_id || content.new_group_id !== row.group_id) {
-      this.recordDecryptError(row, new Error("supersede refused: attestation channel/group mismatch"));
-      return false;
+      return refuse("supersede refused: attestation channel/group mismatch");
     }
     const ok = await verifyApprovalArtifact({ content, signature: att.signatureHex, signerPublicKey: owner.publicKeyHex, createdAt: "", version: 1 }, owner.publicKeyHex);
     if (!ok) {
-      this.recordDecryptError(row, new Error("supersede refused: signature does not verify against pinned owner key"));
-      return false;
+      return refuse("supersede refused: signature does not verify against pinned owner key");
     }
     const bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
     if (!bundle) {
-      this.recordDecryptError(row, new Error("supersede refused: no pending KeyPackage bundle to open the new Welcome"));
-      return false;
+      return refuse("supersede refused: no pending KeyPackage bundle to open the new Welcome");
     }
     return await this.locks.run(channelId, async () => {
       const mgr = new MLSGroupManager();
@@ -2534,14 +2638,14 @@ var MlsGroupKeyProvider = class {
         return false;
       }
       if (new TextDecoder().decode(mgr.groupId) !== row.group_id) {
-        this.recordDecryptError(row, new Error("supersede refused: post-join group id != attested new_group_id"));
-        return false;
+        return refuse("supersede refused: post-join group id != attested new_group_id");
       }
       this.evictChannelState(channelId);
       await this.o.store.delete(channelId);
       await this.o.store.discardStaging(channelId);
       await this.o.store.addRetiredGroupId(channelId, heldGroupId);
       this.errors.delete(channelId);
+      this.supersedeRefusals.delete(`${channelId}:${row.group_id}`);
       this.managers.set(channelId, mgr);
       await this.o.store.save(channelId, mgr.exportState());
       await this.o.backend.ackDelivery(this.o.deviceId, [row.queue_id]);
@@ -2578,9 +2682,15 @@ var MlsGroupKeyProvider = class {
               if (heldGroupId !== null && heldGroupId === row.group_id) {
                 handshakeAcked.push(row.queue_id);
               } else if (heldGroupId !== null && heldGroupId !== row.group_id) {
-                const ok = await this.trySupersede(wcid, row, heldGroupId);
-                if (ok)
-                  supersededChannelIds.push(wcid);
+                if (this.supersedeBackoffActive(wcid, row.group_id)) {
+                  if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
+                    console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} g=${row.group_id.slice(0, 8)} -> SKIP(refusal back-off)`);
+                  }
+                } else {
+                  const ok = await this.trySupersede(wcid, row, heldGroupId);
+                  if (ok)
+                    supersededChannelIds.push(wcid);
+                }
               }
             } else if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
               console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} rowGroup=${(row.group_id || "-").slice(0, 8)} -> NO-LOCAL-STATE (leave un-acked for join path)`);
@@ -3283,19 +3393,8 @@ var RestMlsBackend = class {
       created: j.created === void 0 ? true : Boolean(j.created)
     };
   }
-  async reinitConnectChannelGroup(channelId, memberDeviceIds) {
-    const committer = memberDeviceIds[0];
-    if (!committer)
-      throw new Error("reinitConnectChannelGroup: empty member set");
-    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/reinit`, {
-      member_device_ids: memberDeviceIds,
-      committer_device_id: committer
-    });
-    return {
-      group_id: String(j.group_id),
-      current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
-    };
+  async reinitConnectChannelGroup() {
+    throw new Error("reinitConnectChannelGroup was removed (it minted unattested MLS groups that orphaned channel members permanently). Use resetReinitConnectChannelGroup with an owner attestation.");
   }
   async resetReinitConnectChannelGroup(channelId, memberDeviceIds, att) {
     const committer = memberDeviceIds[0];
@@ -3313,7 +3412,11 @@ var RestMlsBackend = class {
     return {
       group_id: String(j.group_id),
       current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : [],
+      // Absent on a backend that predates the dropped-member report; an empty
+      // list is the correct read of "the server told us nothing", since the old
+      // server also never dropped anyone for an expired KeyPackage.
+      stale_member_device_ids: Array.isArray(j.stale_member_device_ids) ? j.stale_member_device_ids.map(String) : []
     };
   }
   async fetchKeyPackages(deviceIds) {
@@ -5211,11 +5314,33 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.providerCapabilityMissing = false;
-    let chans;
-    try {
-      chans = await this.listChannels();
-    } catch (e) {
-      console.warn("[bridge] selfHealSweep aborted: listChannels failed:", e);
+    const enclaves = await this.enclavesToCover();
+    this.enclaveListEverSucceeded.add(this.cfg.enclaveId);
+    const seen = /* @__PURE__ */ new Set();
+    const chans = [];
+    const failed = [];
+    let listedAny = false;
+    for (const encId of enclaves) {
+      try {
+        for (const c of await this.listChannels(encId)) {
+          if (seen.has(c.channel_id)) continue;
+          seen.add(c.channel_id);
+          chans.push(c);
+        }
+        listedAny = true;
+        this.enclaveListEverSucceeded.add(encId);
+        this.enclaveListWarned.delete(encId);
+      } catch (e) {
+        failed.push(encId);
+        if (!this.enclaveListWarned.has(encId)) {
+          this.enclaveListWarned.add(encId);
+          console.warn(`[bridge] selfHealSweep: listChannels failed for enclave ${encId}; skipping (warn-once per streak):`, e);
+        }
+      }
+    }
+    this.sweepEnclavesFailed = failed;
+    if (!listedAny) {
+      console.warn("[bridge] selfHealSweep aborted: every enclave listing failed");
       return;
     }
     for (const c of chans) {
@@ -5561,7 +5686,7 @@ var BridgeAgent = class _BridgeAgent {
    * the other enclaves in the set.
    */
   async refreshChannelMeta() {
-    const enclaves = /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.store.distinctEnclaveIds()]);
+    const enclaves = await this.enclavesToCover();
     const now = Date.now();
     for (const encId of enclaves) {
       try {
@@ -5574,6 +5699,89 @@ var BridgeAgent = class _BridgeAgent {
       }
     }
   }
+  /** Cache for the server-side enclave enumeration (see enclavesToCover). */
+  enclaveEnumCache = null;
+  /** Enclaves whose channel listing failed on the NEWEST sweep (audit HIGH:
+   * skip-one deleted the sweep's partial-coverage signal — observations_stale
+   * is a global max, so one healthy enclave masked a failed one). Surfaced on
+   * health() so partial coverage is never silent. */
+  sweepEnclavesFailed = [];
+  /** Enclave ids whose channel listing has EVER succeeded this process, seeded
+   * with HOME (home is always expected to list; without the seed, a home
+   * failure right after a restart would read as "never succeeded" and slip
+   * through the expected-gap branch — weaker than the old abort-on-failure).
+   * A failure of a member of this set is a REGRESSION and degrades health; a
+   * failure of a never-succeeded enclave (partner: tenant-scoped 404, permanent
+   * pending backend authz) is an EXPECTED gap — reported, not degrading, or
+   * every federated agent would peg degraded forever. */
+  enclaveListEverSucceeded = /* @__PURE__ */ new Set();
+  /** Warn-once-per-failure-streak, keyed by enclave id (cleared on success):
+   * a permanently-404ing partner enclave must not log 1440 lines a day. */
+  enclaveListWarned = /* @__PURE__ */ new Set();
+  static ENCLAVE_ENUM_TTL_MS = 5 * 6e4;
+  enclaveEnumWarned = false;
+  /**
+   * C1 (split-brain Task 3): every enclave this agent must COVER — for the
+   * self-heal sweep and for channel-meta refresh alike. ONE helper on purpose:
+   * these two call sites had drifted (refreshChannelMeta looped home+learned,
+   * selfHealSweep looped nothing), and the drift is exactly what left both
+   * production agents with zero recovery coverage in their second enclave.
+   *
+   * The set is SERVER enumeration ∪ home ∪ store-learned:
+   *
+   *  - SERVER (`GET /api/v1/enclaves`, membership-scoped, federated included)
+   *    is the authoritative source. The store CANNOT be: channel_meta's only
+   *    writers are listChannels itself (circular — you learn enclave B by
+   *    having already listed B) and the receive pump's successfully-decrypted
+   *    loop, and a FORKED agent decrypts nothing, so the agent that most needs
+   *    sweeping in enclave B is precisely the one whose store never learned B.
+   *  - home + learned stay in the union as the degraded-mode floor: if the
+   *    enumeration endpoint is down, we sweep what we can rather than nothing,
+   *    and we warn (once) so the gap is diagnosable.
+   *
+   * The server result is cached for ENCLAVE_ENUM_TTL_MS so per-ingest-cycle
+   * callers (refreshChannelMeta) do not add an HTTP round-trip per cycle;
+   * membership changes are picked up within one TTL, which matches the sweep
+   * cadence this exists to serve.
+   *
+   * ⚠️ Residual gap, stated: the enumeration RETURNS cross-tenant partner
+   * enclaves, but `list_channels_in_enclave` is tenant-scoped and 404s them
+   * under this agent's bearer — so a partner enclave in this set still yields
+   * no channels. Callers must treat a per-enclave listing failure as skip-one,
+   * never abort-all. Closing that needs backend authz work, not daemon work.
+   */
+  async enclavesToCover() {
+    const now = Date.now();
+    if (!this.enclaveEnumCache || now - this.enclaveEnumCache.at > _BridgeAgent.ENCLAVE_ENUM_TTL_MS) {
+      try {
+        const url = `${this.cfg.apiBase}/api/v1/enclaves?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+        const res = await this.fetchImpl(url, {
+          headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+        });
+        if (!res.ok) throw new Error(`list_enclaves failed: ${res.status}`);
+        const rows = await res.json();
+        this.enclaveEnumCache = { ids: rows.map((r) => r.enclave_id), at: Date.now() };
+        this.enclaveEnumWarned = false;
+      } catch (e) {
+        if (!this.enclaveEnumWarned) {
+          this.enclaveEnumWarned = true;
+          console.warn(
+            "[bridge] enclave enumeration failed; sweep coverage degraded to home+learned enclaves:",
+            e
+          );
+        }
+      }
+    }
+    const fresh = this.enclaveEnumCache && Date.now() - this.enclaveEnumCache.at <= _BridgeAgent.ENCLAVE_ENUM_TTL_MS;
+    if (fresh) {
+      return /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.enclaveEnumCache.ids]);
+    }
+    return /* @__PURE__ */ new Set([
+      this.cfg.enclaveId,
+      ...this.store.distinctEnclaveIds(),
+      ...this.enclaveEnumCache?.ids ?? []
+    ]);
+  }
   /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
   freshRoster(channelId) {
     const hit = this.channelRoster.get(channelId);
@@ -6170,6 +6378,9 @@ var BridgeAgent = class _BridgeAgent {
     const stalePeriodMs = _BridgeAgent.SELF_HEAL_SWEEP_INTERVAL_MS + _BridgeAgent.SELF_HEAL_SWEEP_JITTER_MS;
     const observationsStale = this.providerCapabilityMissing || channels.length === 0 || Date.now() - newest > stalePeriodMs;
     const divergedChannels = channels.filter((o) => o.diverged === true).length;
+    const sweepCoverageLost = this.sweepEnclavesFailed.some(
+      (id) => this.enclaveListEverSucceeded.has(id)
+    );
     const liveChannels = channels.map((o) => ({
       ...o,
       last_decrypt_at: this.provider.lastDecryptAtFor?.(o.channel_id) ?? o.last_decrypt_at
@@ -6184,8 +6395,9 @@ var BridgeAgent = class _BridgeAgent {
       observations_stale: observationsStale,
       diverged_channels: divergedChannels,
       // A2: the truthful roll-up gates read instead of `status` (D-3).
-      degraded: divergedChannels > 0 || observationsStale,
+      degraded: divergedChannels > 0 || observationsStale || sweepCoverageLost,
       channels: liveChannels,
+      sweep_enclaves_failed: [...this.sweepEnclavesFailed],
       identity_id: this.cfg.identityId,
       joined_channels: joined,
       buffered: this.buffer.length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",