@antseed/node 0.2.85 → 0.2.87

package/dist/payments/seller-payment-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seller-payment-manager.d.ts","sourceRoot":"","sources":["../../src/payments/seller-payment-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAU1D,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGtE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD,wDAAwD;AACxD,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAWnD;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAe;IAC7C;;;;6EAIyE;IACzE,OAAO,CAAC,kBAAkB,CAKT;IACjB,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAEhE,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IAEjE,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqF;IAEtH,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAE9D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IAEtD;;wEAEoE;IACpE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA6B;IAEpE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAK;gBAElC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY;IAkDvF;;;;OAIG;IACG,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoD/C,OAAO,CAAC,kBAAkB;IAc1B;;;;;OAKG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA+B5F,OAAO,CAAC,qBAAqB;IAY7B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAO/B,IAAI,cAAc,IAAI,cAAc,CAEnC;IAID;;;;OAIG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAYhD;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAO/C,wBAAwB;YA6OxB,sBAAsB;IA8EpC,OAAO,CAAC,gBAAgB;IAkBxB;;;OAGG;IACG,qBAAqB,CACzB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,OAAO,CAAC;IA0EnB;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAgBtD;;;OAGG;IACH,qFAAqF;IACrF,OAAO,CAAC,gBAAgB;IAYxB;;;;;;OAMG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,gBAAwB,EAAE,UAAkB,EAAE;;;KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAmG9G,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAyB5C;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAoCpC,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIxC,wDAAwD;IACxD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAI3D,qEAAqE;IACrE,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI7C,gEAAgE;IAChE,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIhD,6DAA6D;IAC7D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAc;IAE9D;;OAEG;IACH,sBAAsB,CACpB,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;KAAE,GACzG,sBAAsB;IAyBzB;;;;OAIG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC5D;;;OAGG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuB5D,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"seller-payment-manager.d.ts","sourceRoot":"","sources":["../../src/payments/seller-payment-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAU1D,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGtE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD,wDAAwD;AACxD,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAgBnD;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAe;IAC7C;;;;6EAIyE;IACzE,OAAO,CAAC,kBAAkB,CAKT;IACjB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IAEnD,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAEhE,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IAEjE,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqF;IAEtH,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAE9D;;;;sCAIkC;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyF;IAEvH,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IAEtD,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IAEtD;;wEAEoE;IACpE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA6B;IAEpE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAK;gBAElC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY;IAmDvF;;;;OAIG;IACG,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC;IAoD/C,OAAO,CAAC,kBAAkB;IAiB1B;;;;OAIG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;OAKG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA+B5F,OAAO,CAAC,qBAAqB;IAY7B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAO/B,IAAI,cAAc,IAAI,cAAc,CAEnC;IAID;;;;OAIG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAYhD;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAO/C,wBAAwB;IAwRtC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,iBAAiB;YAwBX,iBAAiB;YA2DjB,kBAAkB;YAoDlB,sBAAsB;IA8EpC,OAAO,CAAC,gBAAgB;IAmBxB;;;OAGG;IACG,qBAAqB,CACzB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,OAAO,CAAC;IAqFnB;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAgBtD;;;OAGG;IACH,qFAAqF;IACrF,OAAO,CAAC,gBAAgB;IAYxB;;;;;;OAMG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,gBAAwB,EAAE,UAAkB,EAAE;;;KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IA4D9G,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAyB5C;;;;;;;;;OASG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAkDpC;;;;;OAKG;YACW,iBAAiB;IA6B/B,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIxC,wDAAwD;IACxD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAI3D,qEAAqE;IACrE,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI7C,gEAAgE;IAChE,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIhD,6DAA6D;IAC7D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIxC,iHAAiH;IACjH,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjD,mEAAmE;IACnE,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI5C,2DAA2D;IAC3D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAc;IAE9D;;OAEG;IACH,sBAAsB,CACpB,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;KAAE,GACzG,sBAAsB;IAyBzB;;;;OAIG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyC5D;;;OAGG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuB5D,KAAK,IAAI,IAAI;CAGd"}

package/dist/payments/seller-payment-manager.js

@@ -9,6 +9,8 @@ const DEFAULT_MIN_BUDGET_PER_REQUEST = '500000';
 /** ~200× typical Base settle gas cost at 0.006 gwei. */
 export const DEFAULT_MIN_SETTLE_DELTA_STR = '2000';
 const DEFAULT_MIN_SETTLE_DELTA = BigInt(DEFAULT_MIN_SETTLE_DELTA_STR);
+const TOP_UP_THRESHOLD_NOT_MET_SELECTOR = '0x1ea4506b';
+const INSUFFICIENT_BALANCE_SELECTOR = '0xf4d678b8';
 /**
  * Manages seller-side payment sessions.
  * The buyer sends a single SpendingAuth signature with a monotonically
@@ -26,8 +28,14 @@ export class SellerPaymentManager {
      *  this resolves to the underlying channels contract via the facade's
      *  `channelsAddress()` view. Otherwise equals the configured address. */
     _resolvedAddresses = null;
-    /** In-memory cache of active buyer peerIds for fast has-session checks. */
+    /**
+     * In-memory cache of buyer peerIds with an active payment session. Hydrated
+     * sessions are included for existing hasSession() semantics; `_hydratedChannelIds`
+     * lets timeout cleanup distinguish restart-only zero-auth zombies.
+     */
     _activeBuyers = new Set();
+    /** Channels restored from disk before the buyer has proven it reconnected. */
+    _hydratedChannelIds = new Set();
     /** Per-buyer mutex to prevent concurrent handleSpendingAuth for the same buyer. */
     _buyerLocks = new Map();
     /** channelId -> highest accepted cumulativeAmount from buyer's SpendingAuth */
@@ -49,6 +57,14 @@ export class SellerPaymentManager {
     _acceptedWaiters = new Map();
     /** channelId -> number of failed close() attempts. In-memory only; resets on node restart. */
     _closeRetryCount = new Map();
+    /** channelId -> deferred topUp params when on-chain topUp failed (e.g. TopUpThresholdNotMet).
+     *  Retried after the next SpendingAuth raises the settle amount high enough.
+     *  Latest / largest top-up intent wins: if multiple deferred ReserveAuths arrive
+     *  before a retry succeeds, we keep the most recent higher ceiling because it
+     *  subsumes the older request. */
+    _pendingTopUp = new Map();
+    /** Channels that must not serve more paid work until closed/renegotiated. */
+    _blockedChannels = new Set();
     /** channelIds with an in-flight close() tx/estimate. Prevents duplicate close submissions. */
     _closingChannels = new Set();
     /** channelId -> cumulative amount last successfully settled on-chain by this
@@ -88,6 +104,7 @@ export class SellerPaymentManager {
         const activeChannels = this._channelStore.getActiveChannels('seller');
         for (const channel of activeChannels) {
             this._activeBuyers.add(channel.peerId);
+            this._hydratedChannelIds.add(channel.sessionId);
             this._acceptedCumulative.set(channel.sessionId, BigInt(channel.authMax));
             this._spent.set(channel.sessionId, BigInt(channel.tokensDelivered));
             // Hydrate reserveMax from previousConsumption (repurposed field)
@@ -164,12 +181,42 @@ export class SellerPaymentManager {
         this._latestAuth.delete(channelId);
         this._closeRetryCount.delete(channelId);
         this._closingChannels.delete(channelId);
+        this._hydratedChannelIds.delete(channelId);
         this._reserveMax.delete(channelId);
+        this._pendingTopUp.delete(channelId);
+        this._blockedChannels.delete(channelId);
         this._lastSettledCumulative.delete(channelId);
         this._releaseAcceptedWaiters(channelId);
         this._activeBuyers.delete(peerId);
         debugLog(`[SellerPayment] Evicted stale channel ${channelId.slice(0, 18)}... — ${reason}`);
     }
+    /**
+     * Restore a persisted SpendingAuth after in-memory cleanup. This prevents the
+     * timeout checker from mistaking an active channel with a durable signed auth
+     * for a zero-auth zombie and closing it at the already-settled amount.
+     */
+    _restorePersistedSpendingAuth(channel) {
+        const persistedCumulative = BigInt(channel.authMax || '0');
+        if (persistedCumulative <= 0n || !channel.latestSpendingAuthSig) {
+            return null;
+        }
+        this._acceptedCumulative.set(channel.sessionId, persistedCumulative);
+        this._latestAuth.set(channel.sessionId, {
+            spendingAuthSig: channel.latestSpendingAuthSig,
+            cumulativeAmount: persistedCumulative,
+            metadataHash: '',
+            metadata: channel.latestMetadata ?? '',
+        });
+        this._spent.set(channel.sessionId, BigInt(channel.tokensDelivered || '0'));
+        const storedReserveMax = BigInt(channel.previousConsumption || '0');
+        if (storedReserveMax > 0n) {
+            this._reserveMax.set(channel.sessionId, storedReserveMax);
+        }
+        this._hydratedChannelIds.delete(channel.sessionId);
+        this._notifyAcceptedUpdate(channel.sessionId, persistedCumulative);
+        debugLog(`[SellerPayment] Restored persisted SpendingAuth for ${channel.sessionId.slice(0, 18)}... cumulative=${persistedCumulative}`);
+        return persistedCumulative;
+    }
     /**
      * Block until `acceptedCumulative(channelId)` reaches `target`, or `timeoutMs`
      * elapses. Returns true if the target was reached, false on timeout. Used by
@@ -374,17 +421,43 @@ export class SellerPaymentManager {
                 // Call topUp() on-chain — includes settle of current cumulative spend
                 const { amount: settleAmount, metadata: settleMetadata, sig: settleSig } = this._getSettleParams(channelId);
                 debugLog(`[SellerPayment] Top-up verified: channel=${channelId.slice(0, 18)}... ceiling ${currentReserveMax} → ${newMaxAmount} (settling cumulative=${settleAmount})`);
-                await this._channelsClient.topUp(this._signer, channelId, settleAmount, settleMetadata, settleSig, newMaxAmount, BigInt(topUpDeadline), payload.spendingAuthSig);
-                // Update tracking
-                this._reserveMax.set(channelId, newMaxAmount);
-                const session = this._channelStore.getChannel(channelId);
-                if (session) {
-                    session.previousConsumption = newMaxAmount.toString(); // repurposed: stores reserveMax
-                    session.deadline = topUpDeadline;
-                    session.updatedAt = Date.now();
-                    this._channelStore.upsertChannel(session);
+                try {
+                    await this._channelsClient.topUp(this._signer, channelId, settleAmount, settleMetadata, settleSig, newMaxAmount, BigInt(topUpDeadline), payload.spendingAuthSig);
+                    // Update tracking
+                    this._hydratedChannelIds.delete(channelId);
+                    this._reserveMax.set(channelId, newMaxAmount);
+                    const session = this._channelStore.getChannel(channelId);
+                    if (session) {
+                        session.previousConsumption = newMaxAmount.toString(); // repurposed: stores reserveMax
+                        session.deadline = topUpDeadline;
+                        session.updatedAt = Date.now();
+                        this._channelStore.upsertChannel(session);
+                    }
+                    debugLog(`[SellerPayment] Top-up completed: channel=${channelId.slice(0, 18)}... new ceiling=${newMaxAmount}`);
+                }
+                catch (topUpErr) {
+                    const failureKind = this._classifyTopUpFailure(topUpErr);
+                    if (failureKind === 'retryable-threshold') {
+                        // TopUpThresholdNotMet is a timing/settlement race: keep the
+                        // ReserveAuth pending and retry after a later SpendingAuth raises
+                        // the settle amount enough to satisfy the contract's 85% gate.
+                        debugWarn(`[SellerPayment] Top-up threshold not met: channel=${channelId.slice(0, 18)}... ` +
+                            `error=${this._formatError(topUpErr)} — ` +
+                            `deferring topUp (will retry after next SpendingAuth)`);
+                        this._storePendingTopUp(channelId, {
+                            newMaxAmount,
+                            deadline: topUpDeadline,
+                            reserveAuthSig: payload.spendingAuthSig,
+                        });
+                        return 'accepted';
+                    }
+                    debugWarn(`[SellerPayment] Top-up on-chain failed permanently: channel=${channelId.slice(0, 18)}... ` +
+                        `kind=${failureKind} error=${this._formatError(topUpErr)} — closing latest auth and rejecting topUp`);
+                    this._pendingTopUp.delete(channelId);
+                    this._blockedChannels.add(channelId);
+                    await this.settleSession(buyerPeerId);
+                    return 'rejected';
                 }
-                debugLog(`[SellerPayment] Top-up completed: channel=${channelId.slice(0, 18)}... new ceiling=${newMaxAmount}`);
                 return 'accepted';
             }
             else {
@@ -416,15 +489,20 @@ export class SellerPaymentManager {
                         `cumulative=${cumulativeAmount} < spent=${spent} channel=${channelId.slice(0, 18)}...`);
                     return 'rejected';
                 }
-                // Reject if cumulative exceeds on-chain deposit — the contract would revert
-                // and we'd lose the last valid auth signature that close() could use.
+                // Reject if cumulative exceeds the on-chain deposit. Pending topUps do
+                // not count here: until topUp() succeeds, the extra funds are not
+                // locked, and accepting an over-reserve SpendingAuth would leave the
+                // seller with an auth the contract cannot settle.
                 const currentReserveMax = this._reserveMax.get(channelId) ?? 0n;
+                const pendingTopUpForCheck = this._pendingTopUp.get(channelId);
                 if (currentReserveMax > 0n && cumulativeAmount > currentReserveMax) {
                     debugWarn(`[SellerPayment] Rejecting SpendingAuth exceeding deposit ceiling: ` +
-                        `cumulative=${cumulativeAmount} > reserveMax=${currentReserveMax} channel=${channelId.slice(0, 18)}...`);
+                        `cumulative=${cumulativeAmount} > reserveMax=${currentReserveMax}` +
+                        `${pendingTopUpForCheck ? ` (pending topUp to ${pendingTopUpForCheck.newMaxAmount})` : ''} channel=${channelId.slice(0, 18)}...`);
                     return 'rejected';
                 }
                 // Update tracking
+                this._hydratedChannelIds.delete(channelId);
                 this._acceptedCumulative.set(channelId, cumulativeAmount);
                 this._latestAuth.set(channelId, {
                     spendingAuthSig: payload.spendingAuthSig,
@@ -444,6 +522,12 @@ export class SellerPaymentManager {
                     this._channelStore.upsertChannel(session);
                 }
                 debugLog(`[SellerPayment] Budget updated: channel=${channelId.slice(0, 18)}... cumulative=${cumulativeAmount}`);
+                // Retry any deferred topUp now that we have a higher settle amount.
+                const pendingTopUp = this._pendingTopUp.get(channelId);
+                if (pendingTopUp) {
+                    const { amount: retrySettleAmount, metadata: retryMetadata, sig: retrySig } = this._getSettleParams(channelId);
+                    await this._retryPendingTopUp(buyerPeerId, channelId, pendingTopUp, retrySettleAmount, retryMetadata, retrySig);
+                }
                 return 'accepted';
             }
         }
@@ -452,6 +536,139 @@ export class SellerPaymentManager {
             return 'rejected';
         }
     }
+    _storePendingTopUp(channelId, pending) {
+        const existing = this._pendingTopUp.get(channelId);
+        if (!existing || pending.newMaxAmount >= existing.newMaxAmount) {
+            this._pendingTopUp.set(channelId, pending);
+        }
+    }
+    _formatError(err) {
+        const text = this._flattenErrorText(err);
+        const formatted = text.length > 0 ? text : String(err);
+        return formatted.length > 500 ? `${formatted.slice(0, 500)}…` : formatted;
+    }
+    _classifyTopUpFailure(err) {
+        const text = this._flattenErrorText(err).toLowerCase();
+        if (text.includes('topupthresholdnotmet') || text.includes(TOP_UP_THRESHOLD_NOT_MET_SELECTOR)) {
+            return 'retryable-threshold';
+        }
+        if (text.includes('insufficientbalance') || text.includes(INSUFFICIENT_BALANCE_SELECTOR)) {
+            return 'insufficient-balance';
+        }
+        return 'non-retryable';
+    }
+    _flattenErrorText(value, seen = new Set(), depth = 0) {
+        if (value == null || depth > 5)
+            return '';
+        if (typeof value === 'string')
+            return value;
+        if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint')
+            return String(value);
+        if (typeof value !== 'object')
+            return '';
+        if (seen.has(value))
+            return '';
+        seen.add(value);
+        const parts = [];
+        if (value instanceof Error) {
+            parts.push(value.name, value.message);
+            if ('cause' in value) {
+                parts.push(this._flattenErrorText(value.cause, seen, depth + 1));
+            }
+        }
+        for (const key of Object.getOwnPropertyNames(value)) {
+            if (key === 'stack')
+                continue;
+            const nested = value[key];
+            parts.push(key);
+            parts.push(this._flattenErrorText(nested, seen, depth + 1));
+        }
+        return parts.filter(Boolean).join(' ');
+    }
+    async _settleLatestAuth(channelId, reason, { respectMinSettleDelta = true } = {}) {
+        const { amount, metadata, sig } = this._getSettleParams(channelId);
+        if (amount <= 0n || sig === '0x') {
+            debugLog(`[SellerPayment] Skipping settle after ${reason}: channel=${channelId.slice(0, 18)}... no signed spend`);
+            return;
+        }
+        let delta = null;
+        if (respectMinSettleDelta) {
+            // Skip the getSession RPC entirely when our local cumulative hasn't
+            // moved since we last settled this channel — the contract would revert
+            // with InvalidAmount (strict `>` check) and we'd waste an RPC round-trip.
+            const lastSettled = this._lastSettledCumulative.get(channelId);
+            if (lastSettled !== undefined && amount <= lastSettled) {
+                debugLog(`[SellerPayment] Skip settle ${channelId.slice(0, 18)}... — cumulative unchanged since last settle (${amount})`);
+                return;
+            }
+            // Cache miss (e.g. after restart) or local cumulative has advanced —
+            // confirm against on-chain state in case another process settled.
+            let onChainSettled;
+            try {
+                const onChain = await this._channelsClient.getSession(channelId);
+                onChainSettled = onChain.settled;
+            }
+            catch (err) {
+                debugWarn(`[SellerPayment] getSession failed for ${channelId.slice(0, 18)}...: ${err instanceof Error ? err.message : err} — attempting settle anyway`);
+                onChainSettled = 0n;
+            }
+            delta = amount - onChainSettled;
+            if (delta <= 0n) {
+                // Resync the cache so we stop hitting the RPC on every idle tick.
+                this._lastSettledCumulative.set(channelId, onChainSettled);
+                debugLog(`[SellerPayment] Skip settle ${channelId.slice(0, 18)}... — already settled on-chain (local=${amount}, onChain=${onChainSettled})`);
+                return;
+            }
+            if (delta < this._minSettleDelta) {
+                // Mark this cumulative as a no-op so the next tick short-circuits
+                // without re-querying getSession until amount actually advances.
+                this._lastSettledCumulative.set(channelId, amount);
+                debugLog(`[SellerPayment] Skip settle ${channelId.slice(0, 18)}... — delta=${delta} below minSettleDelta=${this._minSettleDelta}`);
+                return;
+            }
+        }
+        const deltaText = delta === null ? '' : ` delta=${delta}`;
+        debugLog(`[SellerPayment] Settling channel ${channelId.slice(0, 18)}... cumulative=${amount}${deltaText} (${reason})`);
+        try {
+            await this._channelsClient.settle(this._signer, channelId, amount, metadata, sig);
+            this._lastSettledCumulative.set(channelId, amount);
+            debugLog(`[SellerPayment] Settled channel ${channelId.slice(0, 18)}... — channel remains open`);
+        }
+        catch (err) {
+            debugWarn(`[SellerPayment] Failed to settle channel after ${reason}: ${err instanceof Error ? err.message : err}`);
+        }
+    }
+    async _retryPendingTopUp(buyerPeerId, channelId, pendingTopUp, settleAmount, settleMetadata, settleSig) {
+        this._pendingTopUp.delete(channelId);
+        debugLog(`[SellerPayment] Retrying deferred topUp: channel=${channelId.slice(0, 18)}... settling=${settleAmount} newMax=${pendingTopUp.newMaxAmount}`);
+        try {
+            await this._channelsClient.topUp(this._signer, channelId, settleAmount, settleMetadata, settleSig, pendingTopUp.newMaxAmount, BigInt(pendingTopUp.deadline), pendingTopUp.reserveAuthSig);
+            this._reserveMax.set(channelId, pendingTopUp.newMaxAmount);
+            const topUpSession = this._channelStore.getChannel(channelId);
+            if (topUpSession) {
+                topUpSession.previousConsumption = pendingTopUp.newMaxAmount.toString();
+                topUpSession.deadline = pendingTopUp.deadline;
+                topUpSession.updatedAt = Date.now();
+                this._channelStore.upsertChannel(topUpSession);
+            }
+            debugLog(`[SellerPayment] Deferred topUp succeeded: channel=${channelId.slice(0, 18)}... new ceiling=${pendingTopUp.newMaxAmount}`);
+            return 'succeeded';
+        }
+        catch (retryErr) {
+            const failureKind = this._classifyTopUpFailure(retryErr);
+            if (failureKind === 'retryable-threshold') {
+                debugWarn(`[SellerPayment] Deferred topUp threshold not met: channel=${channelId.slice(0, 18)}... ` +
+                    `error=${this._formatError(retryErr)} — keeping pending`);
+                this._storePendingTopUp(channelId, pendingTopUp);
+                return 'retryable-failure';
+            }
+            debugWarn(`[SellerPayment] Deferred topUp failed permanently: channel=${channelId.slice(0, 18)}... ` +
+                `kind=${failureKind} error=${this._formatError(retryErr)} — closing latest auth and dropping pending topUp`);
+            this._blockedChannels.add(channelId);
+            await this.settleSession(buyerPeerId);
+            return 'permanent-failure';
+        }
+    }
     async _recoverOnChainSession(buyerPeerId, buyerEvmAddr, payload, cumulativeAmount, paymentMux, channelsDomain) {
         const channelId = payload.channelId;
         const onChainState = classifyOnChainChannel(await this._channelsClient.getSession(channelId));
@@ -512,6 +729,7 @@ export class SellerPaymentManager {
     }
     _activateSession(session, buyerPeerId, cumulativeAmount, reserveMaxAmount, spent, latestAuth) {
         this._channelStore.upsertChannel(session);
+        this._hydratedChannelIds.delete(session.sessionId);
         this._acceptedCumulative.set(session.sessionId, cumulativeAmount);
         this._reserveMax.set(session.sessionId, reserveMaxAmount);
         this._spent.set(session.sessionId, spent);
@@ -562,6 +780,13 @@ export class SellerPaymentManager {
             debugWarn(`[SellerPayment] validateAndAcceptAuth: cumulative decreased from ${existingCumulative} to ${newCumulative}`);
             return false;
         }
+        const reserveMax = this._reserveMax.get(channelId) ?? 0n;
+        if (reserveMax > 0n && newCumulative > reserveMax) {
+            debugWarn(`[SellerPayment] validateAndAcceptAuth: cumulative exceeds reserve ceiling ` +
+                `(${newCumulative} > ${reserveMax}) channel=${channelId.slice(0, 18)}...`);
+            return false;
+        }
+        this._hydratedChannelIds.delete(channelId);
         // Update if strictly greater
         if (newCumulative > existingCumulative) {
             this._acceptedCumulative.set(channelId, newCumulative);
@@ -642,50 +867,7 @@ export class SellerPaymentManager {
             debugLog(`[SellerPayment] Zero-cumulative channel ${channelId.slice(0, 18)}... — deferring to timeout checker`);
         }
         else if (settleOnly) {
-            if (amount === 0n)
-                return;
-            // Skip the getSession RPC entirely when our local cumulative hasn't
-            // moved since we last settled this channel — the contract would revert
-            // with InvalidAmount (strict `>` check) and we'd waste an RPC round-trip.
-            const lastSettled = this._lastSettledCumulative.get(channelId);
-            if (lastSettled !== undefined && amount <= lastSettled) {
-                debugLog(`[SellerPayment] Skip settle ${channelId.slice(0, 18)}... — cumulative unchanged since last settle (${amount})`);
-                return;
-            }
-            // Cache miss (e.g. after restart) or local cumulative has advanced —
-            // confirm against on-chain state in case another process settled.
-            let onChainSettled;
-            try {
-                const onChain = await this._channelsClient.getSession(channelId);
-                onChainSettled = onChain.settled;
-            }
-            catch (err) {
-                debugWarn(`[SellerPayment] getSession failed for ${channelId.slice(0, 18)}...: ${err instanceof Error ? err.message : err} — attempting settle anyway`);
-                onChainSettled = 0n;
-            }
-            const delta = amount - onChainSettled;
-            if (delta <= 0n) {
-                // Resync the cache so we stop hitting the RPC on every idle tick.
-                this._lastSettledCumulative.set(channelId, onChainSettled);
-                debugLog(`[SellerPayment] Skip settle ${channelId.slice(0, 18)}... — already settled on-chain (local=${amount}, onChain=${onChainSettled})`);
-                return;
-            }
-            if (delta < this._minSettleDelta) {
-                // Mark this cumulative as a no-op so the next tick short-circuits
-                // without re-querying getSession until amount actually advances.
-                this._lastSettledCumulative.set(channelId, amount);
-                debugLog(`[SellerPayment] Skip settle ${channelId.slice(0, 18)}... — delta=${delta} below minSettleDelta=${this._minSettleDelta}`);
-                return;
-            }
-            debugLog(`[SellerPayment] Settling channel ${channelId.slice(0, 18)}... cumulative=${amount} delta=${delta} (keeping open)`);
-            try {
-                await this._channelsClient.settle(this._signer, channelId, amount, metadata, sig);
-                this._lastSettledCumulative.set(channelId, amount);
-                debugLog(`[SellerPayment] Settled channel ${channelId.slice(0, 18)}... — channel remains open`);
-            }
-            catch (err) {
-                debugWarn(`[SellerPayment] Failed to settle channel: ${err instanceof Error ? err.message : err}`);
-            }
+            await this._settleLatestAuth(channelId, 'idle settle', { respectMinSettleDelta: true });
             return;
         }
         else {
@@ -722,7 +904,11 @@ export class SellerPaymentManager {
         this._latestAuth.delete(channelId);
         this._closeRetryCount.delete(channelId);
         this._closingChannels.delete(channelId);
+        this._reserveMax.delete(channelId);
+        this._pendingTopUp.delete(channelId);
+        this._blockedChannels.delete(channelId);
         this._lastSettledCumulative.delete(channelId);
+        this._hydratedChannelIds.delete(channelId);
         this._releaseAcceptedWaiters(channelId);
         this._activeBuyers.delete(buyerPeerId);
     }
@@ -750,17 +936,22 @@ export class SellerPaymentManager {
     // ── Stale session cleanup ────────────────────────────────────
     /**
      * Check for stale sessions and attempt to close them.
-     * The seller can only close() with a valid SpendingAuth — it cannot
-     * requestClose or withdraw (those are buyer-only on-chain).
-     * If the seller has no auths, the session remains open until the buyer
-     * calls requestClose → withdraw on-chain.
+     * - Channels with a buyer SpendingAuth go through `settleSession()`.
+     * - Zombie channels (buyer gone, no auth, deadline elapsed) can be closed
+     *   on-chain with `finalAmount == channel.settled`, which intentionally
+     *   skips SpendingAuth verification and lets the seller release the lock,
+     *   decrement activeChannelCount, and advance channel stats without buyer
+     *   cooperation.
      * Called periodically and on startup for recovery.
      */
     async checkTimeouts() {
         const nowSecs = Math.floor(Date.now() / 1000);
         const activeChannels = this._channelStore.getActiveChannels('seller');
         for (const channel of activeChannels) {
-            const accepted = this._acceptedCumulative.get(channel.sessionId) ?? 0n;
+            let accepted = this._acceptedCumulative.get(channel.sessionId) ?? 0n;
+            if (accepted === 0n) {
+                accepted = this._restorePersistedSpendingAuth(channel) ?? accepted;
+            }
             try {
                 // Validate on-chain state — evict if channel no longer exists
                 const onChainState = classifyOnChainChannel(await this._channelsClient.getSession(channel.sessionId));
@@ -768,16 +959,28 @@ export class SellerPaymentManager {
                     this._evictStaleChannel(channel.sessionId, channel.peerId, `periodic check: on-chain status=${onChainState.exists ? onChainState.status : 'missing'}`);
                     continue;
                 }
+                const buyerDisconnected = !this._activeBuyers.has(channel.peerId);
+                const hydratedZeroAuthExpired = accepted === 0n
+                    && this._hydratedChannelIds.has(channel.sessionId)
+                    && nowSecs > channel.deadline;
                 // If we have auths and the buyer is disconnected, try to close
-                if (accepted > 0n && !this._activeBuyers.has(channel.peerId)) {
+                if (accepted > 0n && buyerDisconnected) {
                     debugLog(`[SellerPayment] Channel ${channel.sessionId.slice(0, 18)}... buyer disconnected — attempting close`);
                     await this.settleSession(channel.peerId);
+                    continue;
                 }
-                // If no auths and buyer disconnected, nothing the seller can do on-chain.
-                // The buyer must call requestClose → withdraw. We just clean up locally
-                // after a reasonable period (e.g. deadline passed).
-                if (accepted === 0n && !this._activeBuyers.has(channel.peerId) && nowSecs > channel.deadline) {
-                    this._evictStaleChannel(channel.sessionId, channel.peerId, 'no auths, past deadline', 'timeout');
+                // No auths, buyer gone, deadline elapsed: close with the current
+                // on-chain settled amount. The contract skips signature verification
+                // when finalAmount == settled, so this safely cleans up zombie
+                // channels without claiming any unproven spend.
+                if (accepted === 0n && (buyerDisconnected || hydratedZeroAuthExpired) && nowSecs > channel.deadline) {
+                    if (onChainState.status !== 'active') {
+                        // 'unknown' means the RPC returned partial data. Evict locally
+                        // rather than risking a close() against an ambiguous channel.
+                        this._evictStaleChannel(channel.sessionId, channel.peerId, 'no auths, past deadline, on-chain status unknown', 'timeout');
+                        continue;
+                    }
+                    await this._closeWithoutAuth(channel.sessionId, channel.peerId, onChainState.channel.settled);
                 }
             }
             catch (err) {
@@ -785,6 +988,38 @@ export class SellerPaymentManager {
             }
         }
     }
+    /**
+     * Close a zombie channel (buyer gone, no signed auth) using the current
+     * on-chain settled cumulative as finalAmount. This intentionally settles no
+     * additional spend, but still marks the channel closed and releases the
+     * remaining reserved deposit back to the buyer.
+     */
+    async _closeWithoutAuth(channelId, peerId, onChainSettled) {
+        if (this._closingChannels.has(channelId)) {
+            debugLog(`[SellerPayment] Close already in flight for ${channelId.slice(0, 18)}... — skipping zombie close`);
+            return;
+        }
+        const retries = this._closeRetryCount.get(channelId) ?? 0;
+        if (retries >= SellerPaymentManager.MAX_CLOSE_RETRIES) {
+            debugWarn(`[SellerPayment] Zombie close failed ${retries} times for ${channelId.slice(0, 18)}... — falling back to local eviction`);
+            this._evictStaleChannel(channelId, peerId, 'no auths, past deadline, close retries exhausted', 'timeout');
+            return;
+        }
+        this._closingChannels.add(channelId);
+        debugLog(`[SellerPayment] Closing zombie channel ${channelId.slice(0, 18)}... finalAmount=${onChainSettled} (attempt ${retries + 1}/${SellerPaymentManager.MAX_CLOSE_RETRIES})`);
+        try {
+            await this._channelsClient.close(this._signer, channelId, onChainSettled, '0x', '0x');
+            this._closeRetryCount.delete(channelId);
+            this._evictStaleChannel(channelId, peerId, 'zombie closed on-chain', 'settled');
+        }
+        catch (err) {
+            this._closeRetryCount.set(channelId, retries + 1);
+            debugWarn(`[SellerPayment] Zombie close failed (attempt ${retries + 1}): ${err instanceof Error ? err.message : err}`);
+        }
+        finally {
+            this._closingChannels.delete(channelId);
+        }
+    }
     // ── Queries ───────────────────────────────────────────────────
     hasSession(buyerPeerId) {
         return this._activeBuyers.has(buyerPeerId);
@@ -805,6 +1040,18 @@ export class SellerPaymentManager {
     getReserveMax(sessionId) {
         return this._reserveMax.get(sessionId) ?? 0n;
     }
+    /** Get the effective reserve max for serving decisions. Pending topUps do not count until confirmed on-chain. */
+    getEffectiveReserveMax(sessionId) {
+        return this.getReserveMax(sessionId);
+    }
+    /** Whether this channel is blocked from serving more paid work. */
+    isChannelBlocked(sessionId) {
+        return this._blockedChannels.has(sessionId);
+    }
+    /** Whether a topUp is pending (on-chain call deferred). */
+    hasPendingTopUp(sessionId) {
+        return this._pendingTopUp.has(sessionId);
+    }
     static DEFAULT_SUGGESTED_AMOUNT = 1000000n; // $1.00 — matches contract FIRST_SIGN_CAP and buyer default
     /**
      * Build the PaymentRequired payload for a buyer that doesn't have a session.
@@ -863,7 +1110,10 @@ export class SellerPaymentManager {
         this._closeRetryCount.delete(channelId);
         this._closingChannels.delete(channelId);
         this._reserveMax.delete(channelId);
+        this._pendingTopUp.delete(channelId);
+        this._blockedChannels.delete(channelId);
         this._lastSettledCumulative.delete(channelId);
+        this._hydratedChannelIds.delete(channelId);
         this._releaseAcceptedWaiters(channelId);
         // Find and remove buyer from active set
         const channel = this._channelStore.getChannel(channelId);