[codex] Fix SWM Sender Key setup after joined CG approval

[Jurij89]

Summary

• Addresses PR [codex] Fix SWM Sender Key setup after joined CG approval #900 review feedback on SWM Sender Key setup retry semantics for joined/private context graphs.
• Adds a backward-compatible structured reasonCode field to SwmSenderKeyPackageAck so receiver-side rejection classes are machine-readable while reason remains operator-facing text.
• Uses structured receiver errors (SwmSenderKeySetupRejectionError plus the existing StaleSenderKeyTargetError) rather than parsing human-readable error strings to populate ACK reason codes.
• Keeps delivered negative Sender Key setup ACKs hard. In particular, reasonCode: stale-target is not soft-queued, because the original package targets an obsolete recipientKeyId and resending the same bytes cannot recover. A future soft path would need to re-resolve and rebuild the package against a current recipient key.
• Preserves pending Sender Key retry for cases where no application-level rejection was delivered: no advertised peer ID and transport-level queued/offline delivery. Those queued packages are retried on connection:open and during later publishes when recipient resolution now supplies a peer ID.
• Extracts the pending-drain send/ACK/removal bookkeeping into a shared helper used by both reconnect and publish-time drains. Only accepted=true ACKs count as successfully drained; hard rejections and malformed/legacy ACKs are terminal for that queued package but are not reported as successful drains.

Related

• Review follow-up on PR [codex] Fix SWM Sender Key setup after joined CG approval #900.
• Related analysis: PR fix: stabilize V10 publish runtime paths #899 touches SWM publish/runtime plumbing but does not replace this Sender Key setup work.

Files changed

File	What
packages/core/src/proto/swm-sender-key.ts	Adds the optional ACK reasonCode protobuf field and exported TypeScript union for structured Sender Key setup rejection reasons.
packages/core/src/proto/index.ts	Re-exports the ACK reason-code type.
packages/core/test/swm-sender-key-proto.test.ts	Pins ACK reasonCode encode/decode roundtrip behavior.
packages/agent/src/dkg-agent.ts	Emits structured ACK reason codes from receiver-side errors; keeps delivered negative ACKs hard; retries only no-peer/transport-queued pending setup packages on reconnect or later publish; shares pending-drain bookkeeping across both retry triggers.
packages/agent/test/swm-sender-key-pending-by-agent.test.ts	Adds regression coverage for later-publish drain, fatal stale-target/auth/key/unknown delivered ACKs, hard rejection drain semantics, malformed ACK drain semantics, reconnect drain, and pending epoch supersession.

Test plan

• Ran TypeScript build for the affected package graph:

  node node_modules/typescript/bin/tsc -b packages/core packages/storage packages/query packages/publisher packages/chain packages/random-sampling packages/agent

• Ran core Sender Key protobuf tests:

  node node_modules/vitest/vitest.mjs run --reporter verbose test/swm-sender-key-proto.test.ts

  Result: 1 passed, 3 passed.

• Ran focused agent Sender Key pending/fanout tests with the temporary no-global-setup config:

  node node_modules/vitest/vitest.mjs run --config $env:TEMP\vitest-dkg-agent-swm.config.mjs --reporter verbose test/swm-sender-key-pending-by-agent.test.ts test/swm-sender-key-parallel-fanout.test.ts

  Latest result: 2 passed, 16 passed.

• Ran git diff --check.

Verification notes and constraints

• The normal package install path in this Windows worktree remains blocked by @cyfrin/aderyn postinstall rejecting Windows_NT; dependency linking was already sufficient for direct package binaries, so verification used those binaries directly.
• The default packages/agent Vitest config invokes chain global setup. These Sender Key tests do not need chain state, so the focused run used the temporary no-global-setup config already used for this PR.

Risk

Medium. This changes the ACK wire schema in a backward-compatible way by appending an optional string field and tightens delivered rejection handling compared with the first draft. Older peers that do not send reasonCode continue to produce hard delivered rejections. Pending retry remains limited to no-peer and transport-queued setup packages, where the original package can still become deliverable once a peer ID or connection becomes available.

[github-actions]

Codex review completed — no issues found.