@securecoms/agent-bridge 0.9.0 → 0.11.0

package/dist/bin.js

@@ -1371,6 +1371,24 @@ var MlsOperationQueue = class {
   }
 };
 
+// ../connect-sdk-ts/dist/groupkey/receive-classifier.js
+function classifyFailedRow(i) {
+  if (i.messageType === "welcome")
+    return "defer";
+  if (i.messageType !== "commit" && i.messageType !== "application")
+    return "defer";
+  if (i.heldGroupId !== null && i.rowGroupId === i.heldGroupId) {
+    const epochForVerdict = i.messageType === "commit" ? i.liveCommitEpoch : i.snapshotEpoch;
+    if (epochForVerdict === void 0 || typeof i.rowEpoch !== "number")
+      return "defer";
+    const dead = i.messageType === "commit" ? i.rowEpoch <= epochForVerdict : i.rowEpoch < epochForVerdict;
+    return dead ? "permanentlySkipped" : "defer";
+  }
+  if (i.heldGroupId !== null && i.retiredGroupIds !== null && i.retiredGroupIds.includes(i.rowGroupId))
+    return "retiredDrained";
+  return "defer";
+}
+
 // ../connect-sdk-ts/dist/groupkey/mls.js
 var LABEL = "agentvault-connect-v1";
 var DEFAULT_STUCK_THRESHOLD = 2;
@@ -1387,6 +1405,18 @@ var LeafRosterMismatchError = class extends Error {
     this.name = "LeafRosterMismatchError";
   }
 };
+var AmbiguousOwnLeafError = class extends Error {
+  deviceId;
+  totalLeaves;
+  candidateLeaves;
+  constructor(deviceId, totalLeaves, candidateLeaves) {
+    super(`removeDeviceFromLiveGroup: cannot identify device ${deviceId}'s leaf \u2014 the identity owns ${totalLeaves} leaves and ${candidateLeaves} remain after excluding this committer's own. Leaf credentials carry the identity, not the device, so the target is genuinely ambiguous. Refusing rather than evicting a device that was never revoked.`);
+    this.deviceId = deviceId;
+    this.totalLeaves = totalLeaves;
+    this.candidateLeaves = candidateLeaves;
+    this.name = "AmbiguousOwnLeafError";
+  }
+};
 var HealAddAfterRemoveError = class extends Error {
   constructor(cause) {
     super("healDivergedMember: Add failed after Remove already landed \u2014 member detached, re-run heal to recover");
@@ -1406,7 +1436,7 @@ var ForgedCredentialError = class extends Error {
     this.name = "ForgedCredentialError";
   }
 };
-var MlsGroupKeyProvider = class {
+var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
   o;
   suite;
   managers = /* @__PURE__ */ new Map();
@@ -1475,6 +1505,11 @@ var MlsGroupKeyProvider = class {
    *  the past-epoch {@link permanentlySkipped} drain. Read via
    *  {@link quarantineDrainedCount}. */
   quarantineDrained = 0;
+  /** Cumulative count of rows ack-drained because their group_id is RETIRED for
+   *  the channel (superseded fork-loser traffic). Distinct from the same-group
+   *  past-epoch {@link permanentlySkipped} drain. Read via
+   *  {@link retiredDrainedCount}. */
+  retiredDrained = 0;
   constructor(o) {
     this.o = o;
     this.suite = o.suite ?? "xchacha20poly1305";
@@ -1556,9 +1591,25 @@ var MlsGroupKeyProvider = class {
    * Snapshot of per-channel decrypt-error / stuck state (ADR-0002 observability).
    * Surfaces a wedged channel that would otherwise "look idle": the daemon serves
    * it on GET /v1/metrics and the web shell reads it via a selector. A channel is
-   * `stuck` once it has had `stuckThreshold` consecutive decrypt failures with no
-   * intervening successful decrypt. Returns a plain object keyed by channelId;
-   * absence of a key means zero errors observed for that channel.
+   * `stuck` once it has had `stuckThreshold` GENUINELY-WEDGED decrypt failures
+   * with no intervening successful decrypt. Returns a plain object keyed by
+   * channelId; absence of a key means zero errors observed for that channel.
+   *
+   * `stuck` gates on `wedgedRun`, NOT `consecutiveErrors` — the same correction
+   * the quarantine gate already got (P0a). `consecutiveErrors` is bumped at the
+   * top of the catch for EVERY failure, INCLUDING the benign past-epoch
+   * duplicate-commit churn that the `permanentlyDead` path immediately and
+   * safely auto-drains. Deriving the user-visible health signal from it meant
+   * ordinary at-least-once / committer-race traffic painted a perfectly healthy
+   * channel red.
+   *
+   * That is the prod symptom of 2026-07-31: a freshly-welcomed federated partner
+   * was queued the very Add commit its Welcome already contained. It joined the
+   * correct group at the correct epoch, correctly identified the replayed commit
+   * as dead and drained it — and still showed "This channel is stuck", because
+   * the drain happened AFTER the error had been counted. `wedgedRun` counts only
+   * rows left UN-acked (actually stuck), and a clean decrypt clears it, so a
+   * genuine wedge still reports exactly as before.
    */
   errorStats() {
     const out = {};
@@ -1567,7 +1618,7 @@ var MlsGroupKeyProvider = class {
         decryptErrors: e.decryptErrors,
         consecutiveErrors: e.consecutiveErrors,
         lastErrorAt: e.lastErrorAt,
-        stuck: e.consecutiveErrors >= this.stuckThreshold,
+        stuck: e.wedgedRun >= this.stuckThreshold,
         quarantined: e.quarantined
       };
     }
@@ -1616,6 +1667,10 @@ var MlsGroupKeyProvider = class {
   quarantineDrainedCount() {
     return this.quarantineDrained;
   }
+  /** See {@link retiredDrained}. */
+  retiredDrainedCount() {
+    return this.retiredDrained;
+  }
   /** Evict the live in-memory MLS group manager for a channel. Used when the
    *  device leaves or deletes a channel: dropping the persisted store record is
    *  not enough on its own, because a warm manager keeps decrypting until the
@@ -1684,6 +1739,9 @@ var MlsGroupKeyProvider = class {
     if (cached)
       return cached;
     const saved = await this.o.store.load(channelId);
+    const again = this.managers.get(channelId);
+    if (again)
+      return again;
     if (!saved)
       throw new Error(`MlsGroupKeyProvider: no MLS state for channel ${channelId} (call ensureSession first)`);
     const mgr = new MLSGroupManager(saved.ciphersuite);
@@ -2232,6 +2290,34 @@ var MlsGroupKeyProvider = class {
    * `removed_device_id` (instead of removed_identity_id); the server resolves the
    * device's identity, asserts it matches, and purges that ONE device.
    */
+  /**
+   * This committer's OWN leaf index in the given group's ratchet tree, or null
+   * when it cannot be read.
+   *
+   * `MLSGroupManager.state` is marked `@internal` but is a declared (non-private)
+   * field, and `state.privatePath.leafIndex` is the same value ts-mls itself uses
+   * as the sender leaf when protecting application data. Reading it here avoids a
+   * change to `@agentvault/crypto`; if a public accessor is added later this
+   * should delegate to it.
+   *
+   * Returns null rather than throwing so every caller must decide explicitly what
+   * an unknown own-leaf means.
+   *
+   * ⚠️ The one caller today does NOT fail closed on null. In
+   * {@link removeDeviceFromLiveGroupUnlocked} the branch is
+   * `if (ownLeaf !== null && leaves.includes(ownLeaf))` — the `else` compares no
+   * identities at all, so a null return sends an OWN-identity removal down the
+   * positional `leaves[pos]` path, which is exactly the add-order guess the
+   * self-exclusion branch exists to avoid (RFC 9420 §7.1 leftmost-blank refill
+   * permutes that mapping after any Remove). Null is therefore currently
+   * indistinguishable from "foreign identity", and only the cardinality guard
+   * stands between it and evicting the wrong device of the same human.
+   * Correcting that is Phase 1b, not this comment.
+   */
+  ownLeafIndex(mgr) {
+    const idx = mgr.state?.privatePath?.leafIndex;
+    return typeof idx === "number" ? idx : null;
+  }
   async removeDeviceFromLiveGroup(channelId, deviceId, opts) {
     return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, 0)));
   }
@@ -2244,7 +2330,17 @@ var MlsGroupKeyProvider = class {
     if (leaves.length !== opts.orderedDeviceIds.length) {
       throw new LeafRosterMismatchError();
     }
-    const leafIndex = leaves[pos];
+    let leafIndex;
+    const ownLeaf = this.ownLeafIndex(mgr);
+    if (ownLeaf !== null && leaves.includes(ownLeaf)) {
+      const others = leaves.filter((i) => i !== ownLeaf);
+      if (others.length !== 1) {
+        throw new AmbiguousOwnLeafError(deviceId, leaves.length, others.length);
+      }
+      leafIndex = others[0];
+    } else {
+      leafIndex = leaves[pos];
+    }
     const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
     const priorEpoch = Number(mgr.epoch);
     const { commit } = await mgr.removeMembers([leafIndex]);
@@ -2497,7 +2593,7 @@ var MlsGroupKeyProvider = class {
       });
       await this.o.store.save(channelId, mgr.exportState());
       this.managers.set(channelId, mgr);
-      await this.o.store.deletePendingBundle(this.o.deviceId);
+      return { staleMemberDeviceIds: reinit.stale_member_device_ids ?? [] };
     });
   }
   /** Returns true when an in-memory MLS manager is live for the channel.
@@ -2533,13 +2629,27 @@ var MlsGroupKeyProvider = class {
     }
   }
   /**
-   * Return the number of leaves the given identity holds in the live tree for
-   * `channelId`. Loads the manager from the store if not already cached.
+   * Return the number of leaves the given identity holds in THIS DEVICE'S view
+   * of the ratchet tree for `channelId`. Reads the cached manager, else loads
+   * one from the store; it makes no backend call, so the answer is only as
+   * current as the commits this device has already processed. A device that is
+   * behind, forked, or holding a superseded group answers from that state, not
+   * from the server's.
+   *
+   * ⚠️ THROWS (`no MLS state for channel …`) when there is no local state at
+   * all — it does not report 0 for "we have not joined yet". Callers that may
+   * run before {@link ensureSession} must handle the throw; see
+   * {@link hasLeafForIdentity} for the non-throwing, cache-only variant.
    *
    * Primarily used by the gate (S20) to assert that a peer-committer 409-retry
-   * does NOT create a duplicate leaf for an already-added device. A return value
-   * of 1 is the expected healthy state; 0 means not yet a member; > 1 means a
-   * duplicate-leaf bug fired (the S3 guard failed to suppress the re-Add).
+   * does NOT create a duplicate leaf for an already-added device. In THAT
+   * scenario each identity owns exactly one device, so 1 is healthy and > 1
+   * means the S3 guard failed to suppress the re-Add. That reading does NOT
+   * generalise: leaf credentials encode the IDENTITY, not the device, so a
+   * multi-device identity legitimately holds ONE LEAF PER DEVICE — the same
+   * premise {@link removeDeviceFromLiveGroupUnlocked}'s
+   * `leaves.length !== orderedDeviceIds.length` guard is built on. Read the
+   * count against the identity's expected device count, not against 1.
    */
   async leafCountForIdentity(channelId, identityId) {
     const mgr = await this.manager(channelId);
@@ -2573,7 +2683,60 @@ var MlsGroupKeyProvider = class {
    * ⇒ refuse, never call verify), then structural signer check, then attestation
    * verify against the NON-EMPTY pinned key, then post-join group-id assertion.
    */
+  /** C4 (split-brain Task 4): back-off for REFUSED supersedes, keyed
+   * `${channelId}:${groupId}`. A refused supersede leaves its row un-acked by
+   * design (it is not a stray), but pre-back-off that meant a full re-verify —
+   * including a fetchResetAttestation HTTP round-trip — on EVERY receive poll,
+   * forever, for a request that can never succeed (the nine production split
+   * channels all carry NULL-attestation legacy groups).
+   *
+   * ⚠️ ONLY POST-FETCH refusals enter the back-off. The step-0 pin guard and
+   * the retired-group check run BEFORE fetchResetAttestation, so they
+   * contribute zero HTTP to the storm — and the pin guard's precondition is
+   * TRANSIENT (cold owner cache / momentarily anomalous roster; the bridge
+   * warms the cache before receiveOnce for exactly this reason). Backing a
+   * pre-fetch refusal off buys nothing and converts a one-cycle stall into a
+   * ten-minute outage on a valid recovery.
+   *
+   * Of the backed-off refusals: no-attestation, unparseable content,
+   * channel/group mismatch and post-join mismatch are DETERMINISTIC per
+   * (channel, group) — the attestation columns are written at group creation
+   * and never change. Signer-mismatch, signature-verify and no-bundle are
+   * ASSUMED stable for the window; they are pin- or bundle-dependent, but by
+   * the time they run the fetch has already been paid, so suppressing the
+   * window bounds the storm at the cost of a ≤10-minute delay if the pin or
+   * bundle changes. Note the suppression means the reason is not RE-OBSERVED
+   * during the window — the underlying precondition can change freely; the
+   * window is a cost bound, not a claim of immutability.
+   *
+   * The reason lives in the VALUE for observability; the clearing rule lives
+   * in the KEY: the owner minting a FIXED replacement group arrives with a
+   * NEW group id — a different key, tried immediately. The un-openable path
+   * (verified Welcome, KP mismatch) is EXEMPT: onSupersedeUnopenable's own
+   * cooldown governs it. In-memory only: a reload/restart costs one extra
+   * fetch per stranded row — reload-bounded, not poll-bounded. */
+  supersedeRefusals = /* @__PURE__ */ new Map();
+  static SUPERSEDE_REFUSAL_BACKOFF_MS = 10 * 6e4;
+  /** True while (channelId, groupId) is inside its refusal back-off window.
+   * @internal exposed for diagnostics only — not part of the stable surface. */
+  supersedeBackoffActive(channelId, groupId) {
+    const rec = this.supersedeRefusals.get(`${channelId}:${groupId}`);
+    return rec !== void 0 && Date.now() < rec.until;
+  }
   async trySupersede(channelId, row, heldGroupId) {
+    const refuse = (msg) => {
+      this.recordDecryptError(row, new Error(msg));
+      const now = Date.now();
+      for (const [k, v] of this.supersedeRefusals) {
+        if (now >= v.until)
+          this.supersedeRefusals.delete(k);
+      }
+      this.supersedeRefusals.set(`${channelId}:${row.group_id}`, {
+        reason: msg,
+        until: now + _MlsGroupKeyProvider.SUPERSEDE_REFUSAL_BACKOFF_MS
+      });
+      return false;
+    };
     const owner = this.o.onResolvePinnedOwner ? await this.o.onResolvePinnedOwner(channelId) : null;
     if (!owner || !owner.publicKeyHex) {
       this.recordDecryptError(row, new Error("supersede refused: no pinned owner key (step-0 guard)"));
@@ -2586,33 +2749,27 @@ var MlsGroupKeyProvider = class {
     }
     const att = await this.o.backend.fetchResetAttestation(row.group_id);
     if (!att) {
-      this.recordDecryptError(row, new Error(`supersede refused: no attestation for group ${row.group_id}`));
-      return false;
+      return refuse(`supersede refused: no attestation for group ${row.group_id}`);
     }
     if (att.signerIdentityId !== owner.identityId) {
-      this.recordDecryptError(row, new Error("supersede refused: signer is not the pinned owner"));
-      return false;
+      return refuse("supersede refused: signer is not the pinned owner");
     }
     let content;
     try {
       content = JSON.parse(att.signedContent);
     } catch {
-      this.recordDecryptError(row, new Error("supersede refused: unparseable signed_content"));
-      return false;
+      return refuse("supersede refused: unparseable signed_content");
     }
     if (content.channel_id !== row.connect_channel_id || content.new_group_id !== row.group_id) {
-      this.recordDecryptError(row, new Error("supersede refused: attestation channel/group mismatch"));
-      return false;
+      return refuse("supersede refused: attestation channel/group mismatch");
     }
     const ok = await verifyApprovalArtifact({ content, signature: att.signatureHex, signerPublicKey: owner.publicKeyHex, createdAt: "", version: 1 }, owner.publicKeyHex);
     if (!ok) {
-      this.recordDecryptError(row, new Error("supersede refused: signature does not verify against pinned owner key"));
-      return false;
+      return refuse("supersede refused: signature does not verify against pinned owner key");
     }
     const bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
     if (!bundle) {
-      this.recordDecryptError(row, new Error("supersede refused: no pending KeyPackage bundle to open the new Welcome"));
-      return false;
+      return refuse("supersede refused: no pending KeyPackage bundle to open the new Welcome");
     }
     return await this.locks.run(channelId, async () => {
       const mgr = new MLSGroupManager();
@@ -2637,14 +2794,14 @@ var MlsGroupKeyProvider = class {
         return false;
       }
       if (new TextDecoder().decode(mgr.groupId) !== row.group_id) {
-        this.recordDecryptError(row, new Error("supersede refused: post-join group id != attested new_group_id"));
-        return false;
+        return refuse("supersede refused: post-join group id != attested new_group_id");
       }
       this.evictChannelState(channelId);
       await this.o.store.delete(channelId);
       await this.o.store.discardStaging(channelId);
       await this.o.store.addRetiredGroupId(channelId, heldGroupId);
       this.errors.delete(channelId);
+      this.supersedeRefusals.delete(`${channelId}:${row.group_id}`);
       this.managers.set(channelId, mgr);
       await this.o.store.save(channelId, mgr.exportState());
       await this.o.backend.ackDelivery(this.o.deviceId, [row.queue_id]);
@@ -2653,16 +2810,45 @@ var MlsGroupKeyProvider = class {
   }
   async receiveOnce(deviceId) {
     const rows = await this.o.backend.pullDelivery(deviceId);
-    if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY && rows.length) {
-      console.warn(`[trace] receiveOnce pulled ${rows.length}: ` + rows.map((r) => `${r.message_type}@e${r.epoch}/ch${(r.connect_channel_id || "-").slice(0, 8)}/g${(r.group_id || "-").slice(0, 8)}`).join(", "));
-    }
     const appEntries = [];
     const handshakeAcked = [];
     const supersededChannelIds = [];
-    const order = { welcome: 0, commit: 1, application: 2 };
-    rows.sort((a, b) => order[a.message_type] - order[b.message_type]);
-    for (const row of rows) {
+    const welcomes = rows.filter((r) => r.message_type === "welcome");
+    const nonWelcomes = rows.filter((r) => r.message_type !== "welcome");
+    const ordered = [...welcomes, ...nonWelcomes];
+    if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY && ordered.length) {
+      console.warn(`[trace] receiveOnce pulled ${ordered.length}: ` + ordered.map((r) => `${r.message_type}@e${r.epoch}/ch${(r.connect_channel_id || "-").slice(0, 8)}/g${(r.group_id || "-").slice(0, 8)}`).join(", "));
+    }
+    const classCtx = /* @__PURE__ */ new Map();
+    const classCtxFor = async (cid) => {
+      let ctx = classCtx.get(cid);
+      if (!ctx) {
+        let heldGroupId = null;
+        let snapshotEpoch;
+        let retired = null;
+        try {
+          const mgr = await this.manager(cid);
+          heldGroupId = new TextDecoder().decode(mgr.groupId);
+          snapshotEpoch = Number(mgr.epoch);
+        } catch {
+          heldGroupId = null;
+          snapshotEpoch = void 0;
+        }
+        try {
+          retired = await this.o.store.loadRetiredGroupIds(cid);
+        } catch {
+          retired = null;
+        }
+        ctx = { heldGroupId, retired, snapshotEpoch, liveCommitEpoch: snapshotEpoch };
+        classCtx.set(cid, ctx);
+      }
+      return ctx;
+    };
+    for (const row of ordered) {
       try {
+        if (row.message_type !== "welcome" && row.connect_channel_id) {
+          await classCtxFor(row.connect_channel_id);
+        }
         if (row.message_type === "welcome") {
           const wcid = row.connect_channel_id;
           if (wcid) {
@@ -2681,9 +2867,15 @@ var MlsGroupKeyProvider = class {
               if (heldGroupId !== null && heldGroupId === row.group_id) {
                 handshakeAcked.push(row.queue_id);
               } else if (heldGroupId !== null && heldGroupId !== row.group_id) {
-                const ok = await this.trySupersede(wcid, row, heldGroupId);
-                if (ok)
-                  supersededChannelIds.push(wcid);
+                if (this.supersedeBackoffActive(wcid, row.group_id)) {
+                  if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
+                    console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} g=${row.group_id.slice(0, 8)} -> SKIP(refusal back-off)`);
+                  }
+                } else {
+                  const ok = await this.trySupersede(wcid, row, heldGroupId);
+                  if (ok)
+                    supersededChannelIds.push(wcid);
+                }
               }
             } else if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
               console.warn(`[trace] welcome ch=${wcid.slice(0, 8)} rowGroup=${(row.group_id || "-").slice(0, 8)} -> NO-LOCAL-STATE (leave un-acked for join path)`);
@@ -2693,15 +2885,25 @@ var MlsGroupKeyProvider = class {
           const cid = row.connect_channel_id;
           if (!cid)
             continue;
+          let advancedEpoch;
           await this.locks.run(cid, async () => {
             const mgr = await this.manager(cid);
             await mgr.decrypt(hexToBytes(row.payload));
             await this.o.store.save(cid, mgr.exportState());
+            advancedEpoch = Number(mgr.epoch);
           });
           this.recordDecryptSuccess(cid);
+          if (advancedEpoch !== void 0) {
+            const ctx = classCtx.get(cid);
+            if (ctx)
+              ctx.liveCommitEpoch = advancedEpoch;
+          }
           handshakeAcked.push(row.queue_id);
         } else {
           const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(row.payload)));
+          if (row.connect_channel_id != null && envelope.channel_id !== row.connect_channel_id) {
+            throw new Error(`envelope/row channel binding mismatch: row=${row.connect_channel_id} envelope=${envelope.channel_id}`);
+          }
           const key = await this.locks.run(envelope.channel_id, () => this.exporterKey(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch));
           const aad = await buildAssociatedData({
             message_id: envelope.message_id,
@@ -2729,18 +2931,25 @@ var MlsGroupKeyProvider = class {
         this.recordDecryptError(row, err);
         const cid = row.connect_channel_id;
         let drained = false;
-        if (cid && typeof row.epoch === "number") {
-          let liveEpoch;
-          try {
-            liveEpoch = await this.currentEpoch(cid);
-          } catch {
-            liveEpoch = void 0;
-          }
-          const permanentlyDead = liveEpoch !== void 0 && (row.message_type === "commit" ? row.epoch <= liveEpoch : row.message_type === "application" ? row.epoch < liveEpoch : false);
-          if (permanentlyDead) {
+        if (cid && row.message_type !== "welcome") {
+          const ctx = classCtx.get(cid);
+          const verdict = classifyFailedRow({
+            messageType: row.message_type,
+            rowGroupId: row.group_id,
+            rowEpoch: typeof row.epoch === "number" ? row.epoch : void 0,
+            heldGroupId: ctx?.heldGroupId ?? null,
+            retiredGroupIds: ctx?.retired ?? null,
+            snapshotEpoch: ctx?.snapshotEpoch,
+            liveCommitEpoch: ctx?.liveCommitEpoch
+          });
+          if (verdict === "permanentlySkipped") {
             handshakeAcked.push(row.queue_id);
             this.permanentlySkipped++;
             drained = true;
+          } else if (verdict === "retiredDrained") {
+            handshakeAcked.push(row.queue_id);
+            this.retiredDrained++;
+            drained = true;
           }
         }
         if (!drained && cid) {
@@ -2748,8 +2957,10 @@ var MlsGroupKeyProvider = class {
           if (e) {
             e.wedgedRun += 1;
             if (e.wedgedRun >= this.quarantineThreshold) {
-              handshakeAcked.push(row.queue_id);
-              this.quarantineDrained++;
+              if (row.message_type !== "welcome") {
+                handshakeAcked.push(row.queue_id);
+                this.quarantineDrained++;
+              }
               this.quarantineChannel(cid);
             }
           }
@@ -3386,19 +3597,8 @@ var RestMlsBackend = class {
       created: j.created === void 0 ? true : Boolean(j.created)
     };
   }
-  async reinitConnectChannelGroup(channelId, memberDeviceIds) {
-    const committer = memberDeviceIds[0];
-    if (!committer)
-      throw new Error("reinitConnectChannelGroup: empty member set");
-    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/reinit`, {
-      member_device_ids: memberDeviceIds,
-      committer_device_id: committer
-    });
-    return {
-      group_id: String(j.group_id),
-      current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
-    };
+  async reinitConnectChannelGroup() {
+    throw new Error("reinitConnectChannelGroup was removed (it minted unattested MLS groups that orphaned channel members permanently). Use resetReinitConnectChannelGroup with an owner attestation.");
   }
   async resetReinitConnectChannelGroup(channelId, memberDeviceIds, att) {
     const committer = memberDeviceIds[0];
@@ -3416,7 +3616,11 @@ var RestMlsBackend = class {
     return {
       group_id: String(j.group_id),
       current_epoch: Number(j.current_epoch),
-      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : [],
+      // Absent on a backend that predates the dropped-member report; an empty
+      // list is the correct read of "the server told us nothing", since the old
+      // server also never dropped anyone for an expired KeyPackage.
+      stale_member_device_ids: Array.isArray(j.stale_member_device_ids) ? j.stale_member_device_ids.map(String) : []
     };
   }
   async fetchKeyPackages(deviceIds) {
@@ -5355,11 +5559,33 @@ var BridgeAgent = class _BridgeAgent {
       return;
     }
     this.providerCapabilityMissing = false;
-    let chans;
-    try {
-      chans = await this.listChannels();
-    } catch (e) {
-      console.warn("[bridge] selfHealSweep aborted: listChannels failed:", e);
+    const enclaves = await this.enclavesToCover();
+    this.enclaveListEverSucceeded.add(this.cfg.enclaveId);
+    const seen = /* @__PURE__ */ new Set();
+    const chans = [];
+    const failed = [];
+    let listedAny = false;
+    for (const encId of enclaves) {
+      try {
+        for (const c of await this.listChannels(encId)) {
+          if (seen.has(c.channel_id)) continue;
+          seen.add(c.channel_id);
+          chans.push(c);
+        }
+        listedAny = true;
+        this.enclaveListEverSucceeded.add(encId);
+        this.enclaveListWarned.delete(encId);
+      } catch (e) {
+        failed.push(encId);
+        if (!this.enclaveListWarned.has(encId)) {
+          this.enclaveListWarned.add(encId);
+          console.warn(`[bridge] selfHealSweep: listChannels failed for enclave ${encId}; skipping (warn-once per streak):`, e);
+        }
+      }
+    }
+    this.sweepEnclavesFailed = failed;
+    if (!listedAny) {
+      console.warn("[bridge] selfHealSweep aborted: every enclave listing failed");
       return;
     }
     for (const c of chans) {
@@ -5705,7 +5931,7 @@ var BridgeAgent = class _BridgeAgent {
    * the other enclaves in the set.
    */
   async refreshChannelMeta() {
-    const enclaves = /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.store.distinctEnclaveIds()]);
+    const enclaves = await this.enclavesToCover();
     const now = Date.now();
     for (const encId of enclaves) {
       try {
@@ -5718,6 +5944,89 @@ var BridgeAgent = class _BridgeAgent {
       }
     }
   }
+  /** Cache for the server-side enclave enumeration (see enclavesToCover). */
+  enclaveEnumCache = null;
+  /** Enclaves whose channel listing failed on the NEWEST sweep (audit HIGH:
+   * skip-one deleted the sweep's partial-coverage signal — observations_stale
+   * is a global max, so one healthy enclave masked a failed one). Surfaced on
+   * health() so partial coverage is never silent. */
+  sweepEnclavesFailed = [];
+  /** Enclave ids whose channel listing has EVER succeeded this process, seeded
+   * with HOME (home is always expected to list; without the seed, a home
+   * failure right after a restart would read as "never succeeded" and slip
+   * through the expected-gap branch — weaker than the old abort-on-failure).
+   * A failure of a member of this set is a REGRESSION and degrades health; a
+   * failure of a never-succeeded enclave (partner: tenant-scoped 404, permanent
+   * pending backend authz) is an EXPECTED gap — reported, not degrading, or
+   * every federated agent would peg degraded forever. */
+  enclaveListEverSucceeded = /* @__PURE__ */ new Set();
+  /** Warn-once-per-failure-streak, keyed by enclave id (cleared on success):
+   * a permanently-404ing partner enclave must not log 1440 lines a day. */
+  enclaveListWarned = /* @__PURE__ */ new Set();
+  static ENCLAVE_ENUM_TTL_MS = 5 * 6e4;
+  enclaveEnumWarned = false;
+  /**
+   * C1 (split-brain Task 3): every enclave this agent must COVER — for the
+   * self-heal sweep and for channel-meta refresh alike. ONE helper on purpose:
+   * these two call sites had drifted (refreshChannelMeta looped home+learned,
+   * selfHealSweep looped nothing), and the drift is exactly what left both
+   * production agents with zero recovery coverage in their second enclave.
+   *
+   * The set is SERVER enumeration ∪ home ∪ store-learned:
+   *
+   *  - SERVER (`GET /api/v1/enclaves`, membership-scoped, federated included)
+   *    is the authoritative source. The store CANNOT be: channel_meta's only
+   *    writers are listChannels itself (circular — you learn enclave B by
+   *    having already listed B) and the receive pump's successfully-decrypted
+   *    loop, and a FORKED agent decrypts nothing, so the agent that most needs
+   *    sweeping in enclave B is precisely the one whose store never learned B.
+   *  - home + learned stay in the union as the degraded-mode floor: if the
+   *    enumeration endpoint is down, we sweep what we can rather than nothing,
+   *    and we warn (once) so the gap is diagnosable.
+   *
+   * The server result is cached for ENCLAVE_ENUM_TTL_MS so per-ingest-cycle
+   * callers (refreshChannelMeta) do not add an HTTP round-trip per cycle;
+   * membership changes are picked up within one TTL, which matches the sweep
+   * cadence this exists to serve.
+   *
+   * ⚠️ Residual gap, stated: the enumeration RETURNS cross-tenant partner
+   * enclaves, but `list_channels_in_enclave` is tenant-scoped and 404s them
+   * under this agent's bearer — so a partner enclave in this set still yields
+   * no channels. Callers must treat a per-enclave listing failure as skip-one,
+   * never abort-all. Closing that needs backend authz work, not daemon work.
+   */
+  async enclavesToCover() {
+    const now = Date.now();
+    if (!this.enclaveEnumCache || now - this.enclaveEnumCache.at > _BridgeAgent.ENCLAVE_ENUM_TTL_MS) {
+      try {
+        const url = `${this.cfg.apiBase}/api/v1/enclaves?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+        const res = await this.fetchImpl(url, {
+          headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+        });
+        if (!res.ok) throw new Error(`list_enclaves failed: ${res.status}`);
+        const rows = await res.json();
+        this.enclaveEnumCache = { ids: rows.map((r) => r.enclave_id), at: Date.now() };
+        this.enclaveEnumWarned = false;
+      } catch (e) {
+        if (!this.enclaveEnumWarned) {
+          this.enclaveEnumWarned = true;
+          console.warn(
+            "[bridge] enclave enumeration failed; sweep coverage degraded to home+learned enclaves:",
+            e
+          );
+        }
+      }
+    }
+    const fresh = this.enclaveEnumCache && Date.now() - this.enclaveEnumCache.at <= _BridgeAgent.ENCLAVE_ENUM_TTL_MS;
+    if (fresh) {
+      return /* @__PURE__ */ new Set([this.cfg.enclaveId, ...this.enclaveEnumCache.ids]);
+    }
+    return /* @__PURE__ */ new Set([
+      this.cfg.enclaveId,
+      ...this.store.distinctEnclaveIds(),
+      ...this.enclaveEnumCache?.ids ?? []
+    ]);
+  }
   /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
   freshRoster(channelId) {
     const hit = this.channelRoster.get(channelId);
@@ -6314,6 +6623,9 @@ var BridgeAgent = class _BridgeAgent {
     const stalePeriodMs = _BridgeAgent.SELF_HEAL_SWEEP_INTERVAL_MS + _BridgeAgent.SELF_HEAL_SWEEP_JITTER_MS;
     const observationsStale = this.providerCapabilityMissing || channels.length === 0 || Date.now() - newest > stalePeriodMs;
     const divergedChannels = channels.filter((o) => o.diverged === true).length;
+    const sweepCoverageLost = this.sweepEnclavesFailed.some(
+      (id) => this.enclaveListEverSucceeded.has(id)
+    );
     const liveChannels = channels.map((o) => ({
       ...o,
       last_decrypt_at: this.provider.lastDecryptAtFor?.(o.channel_id) ?? o.last_decrypt_at
@@ -6328,8 +6640,9 @@ var BridgeAgent = class _BridgeAgent {
       observations_stale: observationsStale,
       diverged_channels: divergedChannels,
       // A2: the truthful roll-up gates read instead of `status` (D-3).
-      degraded: divergedChannels > 0 || observationsStale,
+      degraded: divergedChannels > 0 || observationsStale || sweepCoverageLost,
       channels: liveChannels,
+      sweep_enclaves_failed: [...this.sweepEnclavesFailed],
       identity_id: this.cfg.identityId,
       joined_channels: joined,
       buffered: this.buffer.length,
@@ -6337,6 +6650,8 @@ var BridgeAgent = class _BridgeAgent {
       filtered_room: this.filteredRoomMessages,
       rate_limited: this.rateLimitedSends,
       permanently_skipped: this.provider.permanentlySkippedCount(),
+      quarantine_drained: this.provider.quarantineDrainedCount(),
+      retired_drained: this.provider.retiredDrainedCount(),
       failed_attachments: this.failedAttachments,
       delivery_pings: this.pingsReceived,
       agent_sessions: this.authSessions,
@@ -6382,8 +6697,11 @@ var BridgeAgent = class _BridgeAgent {
       filteredRoomMessages: this.filteredRoomMessages,
       rateLimitedSends: this.rateLimitedSends,
       permanentlySkipped: this.provider.permanentlySkippedCount(),
+      quarantineDrained: this.provider.quarantineDrainedCount(),
+      retiredDrained: this.provider.retiredDrainedCount(),
       welcomeRequestsSent: this.welcomeRequestsSent,
-      failedAttachments: this.failedAttachments
+      failedAttachments: this.failedAttachments,
+      build: BRIDGE_VERSION
     };
   }
   async close() {