@antseed/node 0.2.99 → 0.2.101

package/dist/payments/seller-payment-manager.js

@@ -10,6 +10,15 @@ const DEFAULT_MIN_BUDGET_PER_REQUEST = '500000';
 /** ~200× typical Base settle gas cost at 0.006 gwei. */
 export const DEFAULT_MIN_SETTLE_DELTA_STR = '2000';
 const DEFAULT_MIN_SETTLE_DELTA = BigInt(DEFAULT_MIN_SETTLE_DELTA_STR);
+/**
+ * How long a buyer-requested close waits for an in-flight SpendingAuth to land
+ * before declaring the channel still mid-accumulation. Mirrors the request
+ * path's catch-up wait: the buyer's auth for the last response may still be on
+ * the wire when the close request arrives.
+ */
+const CLOSE_CATCH_UP_WAIT_MS = 5_000;
+/** `retryAfterMs` hint returned with 'busy' / 'pending_auth' rejections. */
+const CLOSE_RETRY_AFTER_MS = 2_000;
 const TOP_UP_THRESHOLD_NOT_MET_SELECTOR = '0x1ea4506b';
 const INSUFFICIENT_BALANCE_SELECTOR = '0xf4d678b8';
 const IN_FLIGHT_TX_LIMIT_PHRASE = 'in-flight transaction limit';
@@ -67,8 +76,20 @@ export class SellerPaymentManager {
     _pendingTopUp = new Map();
     /** Channels that must not serve more paid work until closed/renegotiated. */
     _blockedChannels = new Set();
-    /** channelIds with an in-flight close() tx/estimate. Prevents duplicate close submissions. */
-    _closingChannels = new Set();
+    /**
+     * channelId -> in-flight close() result. Every close path shares this map so
+     * replacement negotiation can await an existing close instead of submitting
+     * a duplicate transaction.
+     */
+    _closingChannels = new Map();
+    /**
+     * buyerPeerId -> number of billable requests currently being served.
+     * Incremented before the provider call and decremented only after the
+     * request's spend has been recorded and its NeedAuth sent, so a non-zero
+     * count means "this buyer is still accumulating" and the channel must not be
+     * closed out from under it.
+     */
+    _inFlightRequests = new Map();
     /** channelId -> cumulative amount last successfully settled on-chain by this
      *  process. Lets the idle-settle loop skip the `getSession` RPC when the
      *  local accepted cumulative hasn't moved since our last settle. */
@@ -182,16 +203,40 @@ export class SellerPaymentManager {
         this._spent.delete(channelId);
         this._latestAuth.delete(channelId);
         this._closeRetryCount.delete(channelId);
-        this._closingChannels.delete(channelId);
         this._hydratedChannelIds.delete(channelId);
         this._reserveMax.delete(channelId);
         this._pendingTopUp.delete(channelId);
         this._blockedChannels.delete(channelId);
         this._lastSettledCumulative.delete(channelId);
         this._releaseAcceptedWaiters(channelId);
-        this._activeBuyers.delete(peerId);
+        this._deactivateBuyerForChannel(peerId, channelId);
         debugLog(`[SellerPayment] Evicted stale channel ${channelId.slice(0, 18)}... — ${reason}`);
     }
+    /** Remove connectivity only if it still belongs to the channel being cleaned up. */
+    _deactivateBuyerForChannel(peerId, channelId) {
+        const current = this._channelStore.getActiveChannelByPeer(peerId, CHANNEL_ROLE.SELLER);
+        if (!current || current.sessionId === channelId) {
+            this._activeBuyers.delete(peerId);
+        }
+    }
+    /**
+     * Submit at most one close transaction per channel and share its outcome.
+     * Callers that join an in-flight close receive the amount that close actually
+     * submitted, not the one they asked for — persist that, not `amount`.
+     */
+    _submitClose(channelId, amount, submit) {
+        const existing = this._closingChannels.get(channelId);
+        if (existing)
+            return existing;
+        const operation = submit().then((txHash) => ({ closed: true, amount, txHash }), (error) => ({ closed: false, error }));
+        this._closingChannels.set(channelId, operation);
+        void operation.finally(() => {
+            if (this._closingChannels.get(channelId) === operation) {
+                this._closingChannels.delete(channelId);
+            }
+        });
+        return operation;
+    }
     /**
      * Restore a persisted SpendingAuth after in-memory cleanup. This prevents the
      * timeout checker from mistaking an active channel with a durable signed auth
@@ -359,6 +404,15 @@ export class SellerPaymentManager {
                     return 'rejected';
                 }
                 debugLog(`[SellerPayment] ReserveAuth verified for buyer ${buyerPeerId.slice(0, 12)}...`);
+                const superseded = this._channelStore.getActiveChannelByPeer(buyerPeerId, CHANNEL_ROLE.SELLER);
+                if (superseded && superseded.sessionId !== channelId) {
+                    const closed = await this._closeSupersededChannel(superseded);
+                    if (!closed) {
+                        debugWarn(`[SellerPayment] Cannot reserve replacement channel ${channelId.slice(0, 18)}... ` +
+                            `while prior channel ${superseded.sessionId.slice(0, 18)}... remains active`);
+                        return 'rejected';
+                    }
+                }
                 debugLog(`[SellerPayment] Reserving channel ${channelId.slice(0, 18)}... on-chain`);
                 const reserveSalt = payload.reserveSalt ?? channelId;
                 await this._channelsClient.reserve(this._signer, buyerEvmAddr, reserveSalt, reserveMaxAmount, BigInt(reserveDeadline), payload.spendingAuthSig);
@@ -383,7 +437,10 @@ export class SellerPaymentManager {
                     settledAmount: null,
                     status: CHANNEL_STATUS.ACTIVE,
                     latestBuyerSig: payload.spendingAuthSig,
-                    latestSpendingAuthSig: payload.spendingAuthSig,
+                    // The initial signature is a ReserveAuth, not a SpendingAuth. Keep it
+                    // out of the persisted SpendingAuth column so restart hydration cannot
+                    // restore it under the wrong EIP-712 type and repeatedly fail close().
+                    latestSpendingAuthSig: null,
                     latestMetadata: payload.metadata,
                     createdAt: now,
                     updatedAt: now,
@@ -781,10 +838,6 @@ export class SellerPaymentManager {
         this._channelStore.updateTokensDelivered(sessionId, newSpent.toString(), 0);
     }
     // ── Settlement ──────────────────────────────────────────────
-    /**
-     * Close a completed session on-chain using the latest buyer-signed dual signatures.
-     * Uses close() for final settlement (releases remaining deposit to buyer).
-     */
     /** Get the latest SpendingAuth params for a channel, or zero-auth if none exists. */
     _getSettleParams(channelId) {
         const latestAuth = this._latestAuth.get(channelId);
@@ -823,54 +876,77 @@ export class SellerPaymentManager {
             return;
         }
         else {
-            if (this._closingChannels.has(channelId)) {
-                debugLog(`[SellerPayment] Close already in flight for ${channelId.slice(0, 18)}... — skipping duplicate request`);
-                return;
-            }
             const retries = this._closeRetryCount.get(channelId) ?? 0;
             if (retries >= SellerPaymentManager.MAX_CLOSE_RETRIES) {
                 debugWarn(`[SellerPayment] close() failed ${retries} times for ${channelId.slice(0, 18)}... — falling back to timeout path`);
+                this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.TIMEOUT);
             }
             else {
                 debugLog(`[SellerPayment] Closing channel ${channelId.slice(0, 18)}... cumulative=${amount} (attempt ${retries + 1}/${SellerPaymentManager.MAX_CLOSE_RETRIES})`);
-                this._closingChannels.add(channelId);
-                try {
-                    await this._channelsClient.close(this._signer, channelId, amount, metadata, sig);
-                    this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.SETTLED, amount.toString());
+                const closeResult = await this._submitClose(channelId, amount, () => this._channelsClient.close(this._signer, channelId, amount, metadata, sig));
+                if (closeResult.closed) {
+                    this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.SETTLED, closeResult.amount.toString());
                     this._closeRetryCount.delete(channelId);
                 }
-                catch (err) {
-                    if (this._isRetryableTxSubmissionFailure(err)) {
+                else {
+                    if (this._isRetryableTxSubmissionFailure(closeResult.error)) {
                         debugWarn(`[SellerPayment] Close hit transaction backpressure for ${channelId.slice(0, 18)}... ` +
-                            `— keeping channel state for retry: ${this._formatError(err)}`);
+                            `— keeping channel state for retry: ${this._formatError(closeResult.error)}`);
                         if (cleanupOnFailure) {
-                            this._activeBuyers.delete(buyerPeerId);
+                            this._deactivateBuyerForChannel(buyerPeerId, channelId);
                         }
                         return;
                     }
-                    debugWarn(`[SellerPayment] Failed to close channel (attempt ${retries + 1}): ${err instanceof Error ? err.message : err}`);
-                    this._closeRetryCount.set(channelId, retries + 1);
-                    if (!cleanupOnFailure)
+                    const failedAttempts = retries + 1;
+                    debugWarn(`[SellerPayment] Failed to close channel (attempt ${failedAttempts}): ${this._formatError(closeResult.error)}`);
+                    this._closeRetryCount.set(channelId, failedAttempts);
+                    if (failedAttempts < SellerPaymentManager.MAX_CLOSE_RETRIES) {
+                        if (cleanupOnFailure) {
+                            this._deactivateBuyerForChannel(buyerPeerId, channelId);
+                        }
                         return;
-                }
-                finally {
-                    this._closingChannels.delete(channelId);
+                    }
+                    debugWarn(`[SellerPayment] close() failed ${failedAttempts} times for ${channelId.slice(0, 18)}... — falling back to timeout path`);
+                    this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.TIMEOUT);
                 }
             }
         }
         // Clean up maps after successful close, zero-cumulative deferral, or exhausted retries
+        this._forgetChannel(channelId, buyerPeerId);
+    }
+    /**
+     * Drop all in-memory state for a channel that is no longer live. Does not
+     * touch persisted status — callers set that first (SETTLED / TIMEOUT).
+     */
+    _forgetChannel(channelId, buyerPeerId) {
         this._acceptedCumulative.delete(channelId);
         this._spent.delete(channelId);
         this._latestAuth.delete(channelId);
         this._closeRetryCount.delete(channelId);
-        this._closingChannels.delete(channelId);
         this._reserveMax.delete(channelId);
         this._pendingTopUp.delete(channelId);
         this._blockedChannels.delete(channelId);
         this._lastSettledCumulative.delete(channelId);
         this._hydratedChannelIds.delete(channelId);
         this._releaseAcceptedWaiters(channelId);
-        this._activeBuyers.delete(buyerPeerId);
+        this._deactivateBuyerForChannel(buyerPeerId, channelId);
+    }
+    // ── In-flight request tracking ────────────────────────────────
+    /** Mark a billable request as started for this buyer. */
+    beginBillableRequest(buyerPeerId) {
+        this._inFlightRequests.set(buyerPeerId, (this._inFlightRequests.get(buyerPeerId) ?? 0) + 1);
+    }
+    /** Mark a billable request as fully accounted for (spend recorded, NeedAuth sent). */
+    endBillableRequest(buyerPeerId) {
+        const next = (this._inFlightRequests.get(buyerPeerId) ?? 0) - 1;
+        if (next > 0)
+            this._inFlightRequests.set(buyerPeerId, next);
+        else
+            this._inFlightRequests.delete(buyerPeerId);
+    }
+    /** Whether this buyer has requests still being served and billed. */
+    hasInFlightRequests(buyerPeerId) {
+        return (this._inFlightRequests.get(buyerPeerId) ?? 0) > 0;
     }
     // ── Disconnect handling ───────────────────────────────────────
     onBuyerDisconnect(buyerPeerId) {
@@ -949,6 +1025,47 @@ export class SellerPaymentManager {
             }
         }
     }
+    /**
+     * Close the seller's previous channel before accepting a replacement
+     * ReserveAuth from the same buyer. Buyers may lose local channel state and
+     * generate a new channel ID while the previous reserve remains active
+     * on-chain. The contract rejects a second active channel for the same pair,
+     * so recover synchronously using the seller's durable state instead of
+     * leaving both peers in an unrecoverable negotiation loop.
+     */
+    async _closeSupersededChannel(channel) {
+        const channelId = channel.sessionId;
+        const accepted = this._acceptedCumulative.get(channelId)
+            ?? this._restorePersistedSpendingAuth(channel)
+            ?? 0n;
+        try {
+            if (accepted > 0n) {
+                const { amount, metadata, sig } = this._getSettleParams(channelId);
+                const closeResult = await this._submitClose(channelId, amount, () => this._channelsClient.close(this._signer, channelId, amount, metadata, sig));
+                if (!closeResult.closed)
+                    return false;
+                this._evictStaleChannel(channelId, channel.peerId, 'closed before replacement reserve', CHANNEL_STATUS.SETTLED);
+            }
+            else {
+                const onChainState = classifyOnChainChannel(await this._channelsClient.getSession(channelId));
+                if (!onChainState.exists || onChainState.status !== 'active') {
+                    this._evictStaleChannel(channelId, channel.peerId, `replacement reserve: on-chain status=${onChainState.exists ? onChainState.status : 'missing'}`);
+                }
+                else {
+                    const closeResult = await this._submitClose(channelId, onChainState.channel.settled, () => this._channelsClient.close(this._signer, channelId, onChainState.channel.settled, '0x', '0x'));
+                    if (!closeResult.closed)
+                        return false;
+                    this._evictStaleChannel(channelId, channel.peerId, 'zero-auth channel closed before replacement reserve', CHANNEL_STATUS.SETTLED);
+                }
+            }
+            return true;
+        }
+        catch (err) {
+            debugWarn(`[SellerPayment] Failed to close superseded channel ${channelId.slice(0, 18)}...: ` +
+                `${err instanceof Error ? err.message : err}`);
+            return false;
+        }
+    }
     /**
      * Close a zombie channel (buyer gone, no signed auth) using the current
      * on-chain settled cumulative as finalAmount. This intentionally settles no
@@ -956,35 +1073,25 @@ export class SellerPaymentManager {
      * remaining reserved deposit back to the buyer.
      */
     async _closeWithoutAuth(channelId, peerId, onChainSettled) {
-        if (this._closingChannels.has(channelId)) {
-            debugLog(`[SellerPayment] Close already in flight for ${channelId.slice(0, 18)}... — skipping zombie close`);
-            return;
-        }
         const retries = this._closeRetryCount.get(channelId) ?? 0;
         if (retries >= SellerPaymentManager.MAX_CLOSE_RETRIES) {
             debugWarn(`[SellerPayment] Zombie close failed ${retries} times for ${channelId.slice(0, 18)}... — falling back to local eviction`);
             this._evictStaleChannel(channelId, peerId, 'no auths, past deadline, close retries exhausted', CHANNEL_STATUS.TIMEOUT);
             return;
         }
-        this._closingChannels.add(channelId);
         debugLog(`[SellerPayment] Closing zombie channel ${channelId.slice(0, 18)}... finalAmount=${onChainSettled} (attempt ${retries + 1}/${SellerPaymentManager.MAX_CLOSE_RETRIES})`);
-        try {
-            await this._channelsClient.close(this._signer, channelId, onChainSettled, '0x', '0x');
+        const closeResult = await this._submitClose(channelId, onChainSettled, () => this._channelsClient.close(this._signer, channelId, onChainSettled, '0x', '0x'));
+        if (closeResult.closed) {
             this._closeRetryCount.delete(channelId);
             this._evictStaleChannel(channelId, peerId, 'zombie closed on-chain', CHANNEL_STATUS.SETTLED);
         }
-        catch (err) {
-            if (this._isRetryableTxSubmissionFailure(err)) {
-                debugWarn(`[SellerPayment] Zombie close hit transaction backpressure for ${channelId.slice(0, 18)}... ` +
-                    `— keeping channel for retry: ${this._formatError(err)}`);
-            }
-            else {
-                this._closeRetryCount.set(channelId, retries + 1);
-                debugWarn(`[SellerPayment] Zombie close failed (attempt ${retries + 1}): ${err instanceof Error ? err.message : err}`);
-            }
+        else if (this._isRetryableTxSubmissionFailure(closeResult.error)) {
+            debugWarn(`[SellerPayment] Zombie close hit transaction backpressure for ${channelId.slice(0, 18)}... ` +
+                `— keeping channel for retry: ${this._formatError(closeResult.error)}`);
         }
-        finally {
-            this._closingChannels.delete(channelId);
+        else {
+            this._closeRetryCount.set(channelId, retries + 1);
+            debugWarn(`[SellerPayment] Zombie close failed (attempt ${retries + 1}): ${this._formatError(closeResult.error)}`);
         }
     }
     // ── Queries ───────────────────────────────────────────────────
@@ -1043,6 +1150,184 @@ export class SellerPaymentManager {
             ...(pricing?.cachedInputUsdPerMillion != null ? { cachedInputUsdPerMillion: pricing.cachedInputUsdPerMillion } : {}),
         };
     }
+    // ── Buyer-requested cooperative close ─────────────────────────
+    /**
+     * Handle a buyer's CloseChannelRequest: close the channel on-chain right
+     * away so the buyer's reserve is released without the `requestClose()` →
+     * 15-minute grace → `withdraw()` detour.
+     *
+     * The seller only agrees when it is not mid-accumulation with this buyer:
+     * no billable request in flight, and no served work the buyer has not signed
+     * for. It closes at `max(own last-accepted auth, buyer-supplied auth)`, so a
+     * buyer cannot use this path to settle below what it already owes, and a
+     * seller that lost the buyer's latest auth can still be paid in full by the
+     * copy the buyer attaches.
+     */
+    async handleCloseChannelRequest(buyerPeerId, payload, paymentMux) {
+        const reject = (code, reason, extra = {}) => {
+            debugLog(`[SellerPayment] Declining close of ${payload.channelId.slice(0, 18)}... — ${code}: ${reason}`);
+            return { version: 1, channelId: payload.channelId, status: 'rejected', code, reason, ...extra };
+        };
+        let session = this._channelStore.getActiveChannelByPeer(buyerPeerId, CHANNEL_ROLE.SELLER);
+        if (!session) {
+            return reject('no_channel', 'no active channel for this buyer');
+        }
+        if (session.sessionId.toLowerCase() !== payload.channelId.toLowerCase()) {
+            return reject('no_channel', `active channel is ${session.sessionId}, not the requested channel`);
+        }
+        const channelId = session.sessionId;
+        if (this.hasInFlightRequests(buyerPeerId)) {
+            return reject('busy', 'a request is still being served on this channel', {
+                retryAfterMs: CLOSE_RETRY_AFTER_MS,
+            });
+        }
+        if (this._closingChannels.has(channelId)) {
+            return reject('busy', 'a close is already in flight for this channel', {
+                retryAfterMs: CLOSE_RETRY_AFTER_MS,
+            });
+        }
+        // Let any SpendingAuth already being processed finish before reading the
+        // accepted cumulative, then re-check the channel still exists.
+        await this.waitForPendingAuths(buyerPeerId);
+        session = this._channelStore.getActiveChannelByPeer(buyerPeerId, CHANNEL_ROLE.SELLER);
+        if (!session || session.sessionId !== channelId) {
+            return reject('no_channel', 'channel was retired while the close request was being processed');
+        }
+        // Verify the buyer's optional auth before comparing it with our own.
+        let buyerAuth;
+        try {
+            buyerAuth = await this._verifyBuyerCloseAuth(session, payload);
+        }
+        catch (err) {
+            return reject('invalid_auth', err instanceof Error ? err.message : String(err));
+        }
+        if (buyerAuth) {
+            this._adoptBuyerCloseAuth(channelId, buyerAuth);
+        }
+        // Anything served but not yet signed for is unclaimable — ask for the
+        // catch-up auth rather than closing at a loss.
+        let spent = this._spent.get(channelId) ?? 0n;
+        let best = this._getSettleParams(channelId);
+        if (spent > best.amount) {
+            await this.awaitAcceptedAtLeast(channelId, spent, CLOSE_CATCH_UP_WAIT_MS);
+            spent = this._spent.get(channelId) ?? 0n;
+            best = this._getSettleParams(channelId);
+        }
+        if (spent > best.amount) {
+            const accepted = this._acceptedCumulative.get(channelId) ?? 0n;
+            try {
+                paymentMux.sendNeedAuth({
+                    channelId,
+                    requiredCumulativeAmount: spent.toString(),
+                    currentAcceptedCumulative: accepted.toString(),
+                    deposit: session.authMax ?? '0',
+                });
+            }
+            catch (err) {
+                debugWarn(`[SellerPayment] Failed to send catch-up NeedAuth before close: ${this._formatError(err)}`);
+            }
+            return reject('pending_auth', `unsigned spend outstanding (spent=${spent} signed=${best.amount})`, {
+                retryAfterMs: CLOSE_RETRY_AFTER_MS,
+                requiredCumulativeAmount: spent.toString(),
+            });
+        }
+        // The contract rejects a finalAmount at or below what is already settled
+        // (InvalidAmount) and skips signature verification when they are equal, so
+        // fall back to an unsigned close-at-settled when we have nothing better.
+        let onChainSettled;
+        try {
+            onChainSettled = (await this._channelsClient.getSession(channelId)).settled;
+        }
+        catch (err) {
+            return reject('close_failed', `could not read on-chain channel state: ${this._formatError(err)}`);
+        }
+        const useSignedAuth = best.sig !== '0x' && best.amount > onChainSettled;
+        const finalAmount = useSignedAuth ? best.amount : onChainSettled;
+        const metadata = useSignedAuth ? best.metadata : '0x';
+        const sig = useSignedAuth ? best.sig : '0x';
+        debugLog(`[SellerPayment] Buyer-requested close of ${channelId.slice(0, 18)}... ` +
+            `finalAmount=${finalAmount} (signed=${useSignedAuth})`);
+        // Share the close with every other close path. The busy check above runs
+        // before several awaits, so a background close can still start in between —
+        // report that transaction rather than submitting a competing one.
+        const closeResult = await this._submitClose(channelId, finalAmount, () => this._channelsClient.close(this._signer, channelId, finalAmount, metadata, sig));
+        if (!closeResult.closed) {
+            const message = this._formatError(closeResult.error);
+            debugWarn(`[SellerPayment] Buyer-requested close failed for ${channelId.slice(0, 18)}...: ${message}`);
+            return reject('close_failed', message, {
+                ...(this._isRetryableTxSubmissionFailure(closeResult.error) ? { retryAfterMs: CLOSE_RETRY_AFTER_MS } : {}),
+            });
+        }
+        this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.SETTLED, closeResult.amount.toString());
+        this._forgetChannel(channelId, buyerPeerId);
+        debugLog(`[SellerPayment] Channel ${channelId.slice(0, 18)}... closed on buyer request (tx=${closeResult.txHash})`);
+        return {
+            version: 1,
+            channelId,
+            status: 'closed',
+            txHash: closeResult.txHash,
+            finalAmount: closeResult.amount.toString(),
+        };
+    }
+    /**
+     * Verify a SpendingAuth attached to a CloseChannelRequest. Returns null when
+     * the buyer attached nothing; throws with a caller-safe message when the
+     * attached auth does not check out.
+     */
+    async _verifyBuyerCloseAuth(session, payload) {
+        const { cumulativeAmount, metadataHash, metadata, spendingAuthSig } = payload;
+        if (cumulativeAmount === undefined || metadataHash === undefined
+            || metadata === undefined || spendingAuthSig === undefined) {
+            return null;
+        }
+        let amount;
+        try {
+            amount = BigInt(cumulativeAmount);
+        }
+        catch {
+            throw new Error(`cumulativeAmount "${cumulativeAmount}" is not an integer`);
+        }
+        if (amount < 0n)
+            throw new Error('cumulativeAmount must not be negative');
+        if (keccak256(metadata).toLowerCase() !== metadataHash.toLowerCase()) {
+            throw new Error('metadataHash does not match metadata');
+        }
+        const { channels } = await this._resolvedAddresses;
+        const channelsDomain = makeChannelsDomain(this._config.chainId, channels);
+        const recovered = verifyTypedData(channelsDomain, SPENDING_AUTH_TYPES, { channelId: session.sessionId, cumulativeAmount: amount, metadataHash }, spendingAuthSig);
+        if (recovered.toLowerCase() !== session.buyerEvmAddr.toLowerCase()) {
+            throw new Error(`signature recovers to ${recovered}, not the channel buyer`);
+        }
+        return { spendingAuthSig, cumulativeAmount: amount, metadataHash, metadata };
+    }
+    /**
+     * Take the buyer-supplied auth as our latest when it authorizes strictly more
+     * than what we already hold. Persisted so a crash between here and close()
+     * doesn't lose the higher claim.
+     */
+    _adoptBuyerCloseAuth(channelId, buyerAuth) {
+        const current = this._latestAuth.get(channelId);
+        if (current && current.spendingAuthSig.length > 0 && current.cumulativeAmount >= buyerAuth.cumulativeAmount) {
+            return;
+        }
+        this._latestAuth.set(channelId, buyerAuth);
+        const accepted = this._acceptedCumulative.get(channelId) ?? 0n;
+        if (buyerAuth.cumulativeAmount > accepted) {
+            this._acceptedCumulative.set(channelId, buyerAuth.cumulativeAmount);
+            this._notifyAcceptedUpdate(channelId, buyerAuth.cumulativeAmount);
+        }
+        const stored = this._channelStore.getChannel(channelId);
+        if (stored) {
+            stored.authMax = (buyerAuth.cumulativeAmount > BigInt(stored.authMax || '0') ? buyerAuth.cumulativeAmount : BigInt(stored.authMax)).toString();
+            stored.latestBuyerSig = buyerAuth.spendingAuthSig;
+            stored.latestSpendingAuthSig = buyerAuth.spendingAuthSig;
+            stored.latestMetadata = buyerAuth.metadata;
+            stored.updatedAt = Date.now();
+            this._channelStore.upsertChannel(stored);
+        }
+        debugLog(`[SellerPayment] Adopted buyer-supplied close auth for ${channelId.slice(0, 18)}... ` +
+            `cumulative=${buyerAuth.cumulativeAmount} (was ${current?.cumulativeAmount ?? 0n})`);
+    }
     // ── CloseRequested handling ───────────────────────────────────
     /**
      * Handle a CloseRequested event for a channel this seller manages.
@@ -1054,15 +1339,14 @@ export class SellerPaymentManager {
         if (accepted > 0n) {
             const { amount, metadata, sig } = this._getSettleParams(channelId);
             debugLog(`[SellerPayment] CloseRequested for channel ${channelId.slice(0, 18)}... — closing with cumulative=${amount}`);
-            try {
-                await this._channelsClient.close(this._signer, channelId, amount, metadata, sig);
-                this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.SETTLED, amount.toString());
-                debugLog(`[SellerPayment] Channel ${channelId.slice(0, 18)}... closed successfully after CloseRequested`);
-            }
-            catch (err) {
-                debugWarn(`[SellerPayment] Failed to close channel ${channelId.slice(0, 18)}... after CloseRequested: ${err instanceof Error ? err.message : err}`);
+            const closeResult = await this._submitClose(channelId, amount, () => this._channelsClient.close(this._signer, channelId, amount, metadata, sig));
+            if (!closeResult.closed) {
+                debugWarn(`[SellerPayment] Failed to close channel ${channelId.slice(0, 18)}... ` +
+                    `after CloseRequested: ${this._formatError(closeResult.error)}`);
                 return;
             }
+            this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.SETTLED, closeResult.amount.toString());
+            debugLog(`[SellerPayment] Channel ${channelId.slice(0, 18)}... closed successfully after CloseRequested`);
         }
         else {
             // No voucher — seller can't claim anything. Clean up locally;
@@ -1070,23 +1354,8 @@ export class SellerPaymentManager {
             debugLog(`[SellerPayment] CloseRequested for channel ${channelId.slice(0, 18)}... — no SpendingAuth, cleaning up locally`);
             this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.TIMEOUT);
         }
-        // Clean up in-memory state
-        this._acceptedCumulative.delete(channelId);
-        this._spent.delete(channelId);
-        this._latestAuth.delete(channelId);
-        this._closeRetryCount.delete(channelId);
-        this._closingChannels.delete(channelId);
-        this._reserveMax.delete(channelId);
-        this._pendingTopUp.delete(channelId);
-        this._blockedChannels.delete(channelId);
-        this._lastSettledCumulative.delete(channelId);
-        this._hydratedChannelIds.delete(channelId);
-        this._releaseAcceptedWaiters(channelId);
-        // Find and remove buyer from active set
-        const channel = this._channelStore.getChannel(channelId);
-        if (channel) {
-            this._activeBuyers.delete(channel.peerId);
-        }
+        // Clean up in-memory state, including removing the buyer from the active set
+        this._forgetChannel(channelId, this._channelStore.getChannel(channelId)?.peerId ?? '');
     }
     /**
      * Poll for CloseRequested events and handle any that match active channels.