@arcforgelabs/flow 2026.10.29 → 2026.10.30

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.29",
+  "version": "2026.10.30",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arcforgelabs/flow",
-      "version": "2026.10.29",
+      "version": "2026.10.30",
       "license": "MIT",
       "dependencies": {
         "@clerk/backend": "3.23.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.29",
+  "version": "2026.10.30",
   "description": "Invoicing, bill entry and a financial dashboard for labs, with Seazona and Xero integrations.",
   "license": "MIT",
   "repository": {

package/server/core/automations.js

@@ -1,5 +1,5 @@
 import { and, eq, sql } from 'drizzle-orm';
-import { automations, billingObligations } from '../db/schema.js';
+import { automations, billingObligations, invoices } from '../db/schema.js';
 import { FlowError, notFound } from './errors.js';
 import { autoDraftJobs } from './invoicing-rules.js';
 import { MAPPING_DEFAULTS, readMappingConfig, remapJobs } from './line-mapping.js';
@@ -17,6 +17,8 @@ import { setReady } from './ledger.js';
 //     are picked from those the work system reported (workStatuses).
 //   draft_when_ready: a job that is ready to invoice and passes the invoicing
 //     rules (invoicing-rules.js) gets a draft invoice in Flow.
+//   ready_when_drafted: a draft the draft routine made goes straight to Ready
+//     on the Invoices page, until a person changes it or moves it back.
 
 const BATCH = 500;
 
@@ -82,6 +84,14 @@ export const AUTOMATIONS = Object.freeze([
     defaults: { enabled: true, config: {} },
     readConfig: () => ({}),
   },
+  {
+    key: 'ready_when_drafted',
+    place: 'invoicing',
+    name: 'Ready when drafted',
+    hint: 'An automatic draft goes straight to Ready. A draft a person changed stays in Drafts.',
+    defaults: { enabled: true, config: {} },
+    readConfig: () => ({}),
+  },
 ]);
 
 const byKey = new Map(AUTOMATIONS.map((a) => [a.key, a]));
@@ -138,6 +148,25 @@ async function markReadyFromWorkStatus(db, organisationId, { statuses }) {
   return { marked };
 }
 
+// Marks ready each draft the draft routine made that no person has touched.
+// A person's edit or "back to drafts" moves the draft's updatedAt on from its
+// createdAt, so the routine leaves it to people from then on. A draft with a
+// problem shows in Problem whatever its ready mark (sending.js, invoiceViews).
+async function readyWhenDrafted(db, organisationId) {
+  const rows = await db.update(invoices).set({ readyAt: sql`now()`, readyBy: null })
+    .where(and(
+      eq(invoices.organisationId, organisationId),
+      eq(invoices.status, 'draft'),
+      sql`${invoices.readyAt} is null`,
+      sql`${invoices.updatedAt} = ${invoices.createdAt}`,
+      sql`exists (select 1 from billing_obligations o join obligation_events e on e.obligation_id = o.id
+        where o.organisation_id = ${invoices.organisationId} and o.invoice_id = ${invoices.id}
+          and e.kind = 'drafted' and e.actor = ${actorOf('draft_when_ready')})`,
+    ))
+    .returning({ id: invoices.id });
+  return { marked: rows.length };
+}
+
 // Runs every routine that is on. `accounting` is the integration whose copy
 // the draft routine checks; without one, Flow's own records are the check.
 export async function runAutomations(db, organisationId, { accounting = null, now = new Date() } = {}) {
@@ -148,6 +177,8 @@ export async function runAutomations(db, organisationId, { accounting = null, no
       summary[automation.key] = await markReadyFromWorkStatus(db, organisationId, automation.config);
     } else if (automation.key === 'draft_when_ready') {
       summary[automation.key] = await autoDraftJobs(db, organisationId, { accounting, now, actor: actorOf(automation.key) });
+    } else if (automation.key === 'ready_when_drafted') {
+      summary[automation.key] = await readyWhenDrafted(db, organisationId);
     }
   }
   return summary;

package/server/core/pipeline.js

@@ -9,7 +9,7 @@ import { readInvoicingSettings } from './invoicing-rules.js';
 import { observeJob, recordAccountingEvidence, setHold } from './ledger.js';
 import { loadMappingContext, mapLines } from './line-mapping.js';
 import { linkRecord, priorLinkFor } from './links.js';
-import { enqueueJob, runNextJob } from './queue.js';
+import { deadHoldSince, deadSince, enqueueJob, runNextJob } from './queue.js';
 
 // The pipeline (docs/DATA_SPINE.md, issue 58). It joins what the integrations
 // copy into Flow, and never writes to another system:
@@ -448,6 +448,7 @@ export async function runPipelineOnce(db, integrations, { now = new Date() } = {
 // systems' copies and writes Flow's own records.
 export function createPipelineWorker({ db, integrations, log = console, timers = { setTimeout, clearTimeout }, everyMs = RUN_EVERY_MS, firstDelayMs = 15_000 }) {
   const workerId = `pipeline-${randomUUID()}`;
+  const startedAtMs = Date.now();
   let timer = null;
   let running = null;
   let stopped = true;
@@ -467,6 +468,9 @@ export function createPipelineWorker({ db, integrations, log = console, timers =
         if (!integrations.with('pullWorkItems').length && !integrations.with('findInvoices').length) return;
         const organisationId = await soleOrganisation(db);
         if (!organisationId) return;
+        // Issue #101: a run that gave up waits for a person, a restart or the
+        // next day; the timer never starts it again by itself.
+        if (await deadSince(db, organisationId, { kind: PIPELINE_KIND, dedupeKey: 'all', since: deadHoldSince(startedAtMs) })) return;
         await enqueueJob(db, organisationId, { kind: PIPELINE_KIND, dedupeKey: 'all' });
         const ran = await runNextJob(db, {
           workerId,
@@ -474,8 +478,10 @@ export function createPipelineWorker({ db, integrations, log = console, timers =
           handlers: { [PIPELINE_KIND]: () => runPipelineOnce(db, integrations) },
         });
         const line = ran ? `${ran.outcome}: ${JSON.stringify(ran.job.result ?? ran.job.lastError ?? {})}` : '';
-        // Log a run only when its outcome differs from the last one.
-        if (line && line !== last) log.info?.(`[pipeline] ${line}`);
+        // Log a run only when its outcome differs from the last one. A run
+        // that gave up is reported once to the error services.
+        if (ran?.outcome === 'dead') log.error?.('[pipeline] the pipeline run gave up after its last attempt');
+        if (line && line !== last) (ran.outcome === 'succeeded' ? log.info : log.warn)?.(`[pipeline] ${line}`);
         last = line || last;
       } catch (error) {
         log.error?.(`[pipeline] ${error?.code ?? 'error'}: ${error?.message ?? error}`);

package/server/core/queue.js

@@ -38,6 +38,28 @@ export async function enqueueJob(db, organisationId, {
   return { job: open, queued: false };
 }
 
+// Issue #101: the newest job of this kind and key that gave up after `since`,
+// or null. A worker on a timer checks this before it queues the next run, so
+// a job that always fails is not started again and again: it waits for a
+// person (the review item), a restart on a new release, or the next day.
+export async function deadSince(db, organisationId, { kind, dedupeKey = '', since }) {
+  const [row] = await db.select().from(backgroundJobs).where(and(
+    eq(backgroundJobs.organisationId, organisationId),
+    eq(backgroundJobs.kind, kind),
+    eq(backgroundJobs.dedupeKey, dedupeKey),
+    eq(backgroundJobs.state, 'dead'),
+    sql`${backgroundJobs.updatedAt} > ${since}`,
+  )).orderBy(sql`${backgroundJobs.updatedAt} desc`).limit(1);
+  return row ?? null;
+}
+
+// When a timer may queue the job again after it gave up: the later of this
+// process's start and one day ago.
+export const DEAD_HOLD_MS = 24 * 60 * 60 * 1000;
+export function deadHoldSince(startedAtMs, nowMs = Date.now()) {
+  return new Date(Math.max(startedAtMs, nowMs - DEAD_HOLD_MS));
+}
+
 async function giveUp(tx, job, error) {
   const [row] = await tx.update(backgroundJobs)
     .set({ state: 'dead', lockedBy: null, lockedUntil: null, lastError: error, updatedAt: sql`now()` })

package/server/core/sending.js

@@ -4,7 +4,7 @@ import { invoiceLines, invoices } from '../db/schema.js';
 import { FlowError } from './errors.js';
 import { issueInvoice } from './invoices.js';
 import { soleOrganisation } from './pipeline.js';
-import { enqueueJob, runNextJob } from './queue.js';
+import { deadHoldSince, deadSince, enqueueJob, runNextJob } from './queue.js';
 
 // Drafts, Problem, Ready and Send all ready (docs/INVOICE_SENDING.md).
 //
@@ -124,9 +124,10 @@ export async function markReady(db, organisationId, invoiceIds, { personId, acco
   return { marked: good.length, refused: [...problems].map(([invoiceId, found]) => ({ invoiceId, problems: found })) };
 }
 
-// Back to drafts: the drafts need another look before they go.
+// Back to drafts: the drafts need another look before they go. The new
+// updatedAt keeps "Ready when drafted" (automations.js) off them.
 export async function markNotReady(db, organisationId, invoiceIds) {
-  const rows = await db.update(invoices).set({ readyAt: null, readyBy: null })
+  const rows = await db.update(invoices).set({ readyAt: null, readyBy: null, updatedAt: sql`now()` })
     .where(and(eq(invoices.organisationId, organisationId), eq(invoices.status, 'draft'), inArray(invoices.id, invoiceIds)))
     .returning({ id: invoices.id });
   return { moved: rows.length };
@@ -215,6 +216,7 @@ export async function sendQueued(db, organisationId, { accounting, limit = WORKE
         const error = result.error ?? { code: `send_${result.outcome}`, message: `Sending ended as ${result.outcome}.` };
         await settle(db, organisationId, result.invoiceId, { sendState: 'failed', sendError: { code: error.code, message: error.message } });
         summary.failed += 1;
+        summary.refused = [...new Set([...(summary.refused ?? []), error.code])];
       }
     }
   }
@@ -230,6 +232,7 @@ function settle(db, organisationId, invoiceId, fields) {
 // the job queue.
 export function createSendWorker({ db, integrations, log = console, timers = { setTimeout, clearTimeout }, everyMs = WORKER_EVERY_MS }) {
   const workerId = `send-${randomUUID()}`;
+  const startedAtMs = Date.now();
   let timer = null;
   let running = null;
   let stopped = true;
@@ -252,13 +255,22 @@ export function createSendWorker({ db, integrations, log = console, timers = { s
         const [waiting] = await db.select({ id: invoices.id }).from(invoices)
           .where(and(eq(invoices.organisationId, organisationId), eq(invoices.sendState, 'queued'))).limit(1);
         if (!waiting) return;
+        // Issue #101: a send run that gave up waits for a person, a restart or
+        // the next day; the timer never starts it again by itself.
+        if (await deadSince(db, organisationId, { kind: SEND_KIND, dedupeKey: 'all', since: deadHoldSince(startedAtMs) })) return;
         await enqueueJob(db, organisationId, { kind: SEND_KIND, dedupeKey: 'all' });
         const ran = await runNextJob(db, {
           workerId,
           leaseMs: LEASE_MS,
           handlers: { [SEND_KIND]: () => sendQueued(db, organisationId, { accounting }) },
         });
-        if (ran) log.info?.(`[sending] ${ran.outcome}: ${JSON.stringify(ran.job.result ?? ran.job.lastError ?? {})}`);
+        if (!ran) return;
+        const line = `[sending] ${ran.outcome}: ${JSON.stringify(ran.job.result ?? ran.job.lastError ?? {})}`;
+        // An invoice the accounting system refused waits in Problem for a
+        // person; it is reported once, when it is refused.
+        if (ran.outcome === 'dead') log.error?.('[sending] the send run gave up after its last attempt');
+        if (ran.job.result?.failed) log.error?.('[sending] the accounting system refused an invoice');
+        (ran.outcome === 'succeeded' && !ran.job.result?.failed ? log.info : log.warn)?.(line);
       } catch (error) {
         log.error?.(`[sending] ${error?.code ?? 'error'}: ${error?.message ?? error}`);
       }

package/server/integrations/port.js

@@ -234,7 +234,9 @@ export function createRegistry({ log = console, env = process.env } = {}) {
           tablesReady.add(id);
         }
         if (adapter.start) {
-          await adapter.start({ db: database, log, env: settingsEnv });
+          // A person changed the settings: an adapter may clear a stop that
+          // waits for a person (issue #101).
+          await adapter.start({ db: database, log, env: settingsEnv, reconfigured: true });
           running.push(adapter);
         }
       } catch (error) {

package/server/integrations/seazona/client.js

@@ -17,6 +17,8 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, Math.max(0, m
 // A failed Seazona request. The message names the method, the path and the
 // status or failure kind; never the host, the query or a credential.
 // kind: http, timeout, network, invalid_json, replay_miss, governor_timeout.
+// The governor's own SeazonaCallsStopped (kind calls_stopped) passes through
+// unchanged: no call was made.
 export class SeazonaApiError extends Error {
   constructor(message, { statusCode = null, kind = 'http', path = null, retryAfterMs = null } = {}) {
     super(message);
@@ -93,6 +95,10 @@ export function createSeazonaClient({
       requestsPerMinute: rate.requestsPerMinute,
       maxWaitMs: rate.maxWaitMs,
       telemetryRetentionMs: rate.telemetryRetentionMs,
+      circuitFailures: rate.circuitFailures,
+      circuitWindowMs: rate.circuitWindowMs,
+      circuitPauseMs: rate.circuitPauseMs,
+      dailyFailureBudget: rate.dailyFailureBudget,
       now,
       sleepFn,
     });

package/server/integrations/seazona/governor.js

@@ -10,9 +10,39 @@ import { MAX_REQUESTS_PER_MINUTE } from './settings.js';
 // admitted in the last minute, the minimum gap since the last admission has
 // passed, and no 429 cooldown is running. Admission takes a transaction-level
 // advisory lock per client, so two processes never admit the same slot.
+//
+// Issue #101: a vendor can cut off API access after many failed calls, even
+// inside the rate limit. So the governor also stops calls outright:
+//   - a 401 or 403 halts every call until a person acts (the adapter restarts
+//     with new or saved settings, which calls resume());
+//   - `circuitFailures` failed calls inside `circuitWindowMs` open the circuit:
+//     no call for `circuitPauseMs`, then one probe call; a failed probe opens
+//     it again for twice as long, to at most 6 hours, and a success closes it;
+//   - `dailyFailureBudget` failed calls in one UTC day stop calls until the
+//     next day.
+// A stopped call fails at once with SeazonaCallsStopped; it never waits.
 
 const WINDOW_MS = 60_000;
 const MAX_COOLDOWN_MS = 60_000;
+const MAX_CIRCUIT_PAUSE_MS = 6 * 60 * 60_000;
+const DAY_MS = 24 * 60 * 60_000;
+const EPOCH = new Date(0);
+
+// A call that failed in a way the vendor sees as a fault: no answer, a 5xx, a
+// 429, or a 4xx other than 404 (a 404 on one record means it was deleted).
+export function countsAsFailure({ statusCode = null, failureKind = null } = {}) {
+  if (failureKind) return true;
+  if (!Number.isInteger(statusCode)) return false;
+  return statusCode >= 500 || (statusCode >= 400 && statusCode !== 404);
+}
+
+const failedCall = sql`(${seazonaApiRequests.failureKind} is not null or ${seazonaApiRequests.statusCode} >= 500
+  or (${seazonaApiRequests.statusCode} >= 400 and ${seazonaApiRequests.statusCode} <> 404))`;
+
+const startOfUtcDay = (ms) => {
+  const date = new Date(ms);
+  return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
+};
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 
@@ -36,12 +66,34 @@ export class SeazonaGovernorTimeout extends Error {
   }
 }
 
+// Calls are stopped: halted for a person, circuit open, or the day's failed
+// calls are spent. `retryAfterMs` is null for a halt, which no wait clears.
+export class SeazonaCallsStopped extends Error {
+  constructor(reason, retryAfterMs = null) {
+    const what = {
+      halted: 'Seazona calls are stopped until a person checks the API client (it was refused)',
+      circuit_open: 'Seazona calls are paused after repeated failures',
+      budget_spent: "Seazona calls are stopped for today: the day's failed calls are spent",
+    }[reason];
+    super(what);
+    this.name = 'SeazonaCallsStopped';
+    this.code = { halted: 'seazona_api_halted', circuit_open: 'seazona_api_circuit_open', budget_spent: 'seazona_api_failure_budget_spent' }[reason];
+    this.kind = 'calls_stopped';
+    this.reason = reason;
+    this.retryAfterMs = retryAfterMs;
+  }
+}
+
 export function createSeazonaGovernor({
   db,
   clientKey,
   requestsPerMinute = MAX_REQUESTS_PER_MINUTE,
   maxWaitMs = 120_000,
   telemetryRetentionMs = 35 * 24 * 60 * 60_000,
+  circuitFailures = 5,
+  circuitWindowMs = 10 * 60_000,
+  circuitPauseMs = 5 * 60_000,
+  dailyFailureBudget = 50,
   now = Date.now,
   sleepFn = sleep,
 } = {}) {
@@ -59,6 +111,8 @@ export function createSeazonaGovernor({
       const nowAt = new Date(nowMs);
       await tx.insert(seazonaApiGovernor).values({ clientKey: key }).onConflictDoNothing();
       const [state] = await tx.select().from(seazonaApiGovernor).where(eq(seazonaApiGovernor.clientKey, key));
+      const stopped = await stoppedReason(tx, state, nowMs);
+      if (stopped) return { admitted: false, stopped };
       const windowStart = new Date(nowMs - WINDOW_MS);
       const [{ admitted, oldestMs }] = await tx
         .select({ admitted: count(), oldestMs: sql`(extract(epoch from min(${seazonaApiRequests.admittedAt})) * 1000)::float8` })
@@ -84,12 +138,31 @@ export function createSeazonaGovernor({
     });
   }
 
+  async function failuresSince(tx, fromMs) {
+    const [{ failed }] = await tx.select({ failed: count() }).from(seazonaApiRequests)
+      .where(and(eq(seazonaApiRequests.clientKey, key), gte(seazonaApiRequests.admittedAt, new Date(fromMs)), failedCall));
+    return Number(failed);
+  }
+
+  // Why no call may go now, or null.
+  async function stoppedReason(tx, state, nowMs) {
+    if (state.haltedReason) return { reason: 'halted', retryAfterMs: null };
+    const openUntil = state.circuitOpenUntil.getTime();
+    if (openUntil > nowMs) return { reason: 'circuit_open', retryAfterMs: openUntil - nowMs };
+    const dayStart = startOfUtcDay(nowMs);
+    if (await failuresSince(tx, dayStart) >= dailyFailureBudget) {
+      return { reason: 'budget_spent', retryAfterMs: dayStart + DAY_MS - nowMs };
+    }
+    return null;
+  }
+
   // Waits for a slot and records the admission. Returns { requestId }.
   async function reserve({ workflow = 'seazona', isRetry = false } = {}) {
     let waitedMs = 0;
     for (;;) {
       const decision = await tryAdmit(workflow, isRetry);
       if (decision.admitted) return { requestId: decision.requestId, waitedMs };
+      if (decision.stopped) throw new SeazonaCallsStopped(decision.stopped.reason, decision.stopped.retryAfterMs);
       const delay = Math.max(1, Math.min(decision.waitMs, maxWaitMs));
       if (waitedMs + delay > maxWaitMs) throw new SeazonaGovernorTimeout(waitedMs, delay);
       waitedMs += delay;
@@ -97,25 +170,67 @@ export function createSeazonaGovernor({
     }
   }
 
-  // Records how a request ended, and any cooldown a 429 asked for.
+  // Records how a request ended, any cooldown a 429 asked for, and what the
+  // ending does to the circuit. Answers { halted, opened } when this response
+  // stopped calls, so the caller can report it once.
   async function recordResponse({ requestId, path = null, statusCode = null, failureKind = null, durationMs = null, retryAfterMs = null } = {}) {
     const nowMs = Number(now());
-    await db.update(seazonaApiRequests).set({
-      requestPath: normaliseRequestPath(path),
-      statusCode: Number.isInteger(statusCode) ? statusCode : null,
-      failureKind: failureKind ? String(failureKind).slice(0, 40) : null,
-      durationMs: Number.isFinite(durationMs) ? Math.max(0, Math.round(durationMs)) : null,
-    }).where(and(eq(seazonaApiRequests.id, requestId), eq(seazonaApiRequests.clientKey, key)));
-    if (Number.isFinite(retryAfterMs) && retryAfterMs > 0) {
-      const until = new Date(nowMs + Math.min(retryAfterMs, MAX_COOLDOWN_MS));
-      await db.update(seazonaApiGovernor)
-        .set({ cooldownUntil: sql`greatest(${seazonaApiGovernor.cooldownUntil}, ${until})`, updatedAt: new Date(nowMs) })
+    const nowAt = new Date(nowMs);
+    const outcome = await db.transaction(async (tx) => {
+      await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext(${lockKey}))`);
+      await tx.update(seazonaApiRequests).set({
+        requestPath: normaliseRequestPath(path),
+        statusCode: Number.isInteger(statusCode) ? statusCode : null,
+        failureKind: failureKind ? String(failureKind).slice(0, 40) : null,
+        durationMs: Number.isFinite(durationMs) ? Math.max(0, Math.round(durationMs)) : null,
+      }).where(and(eq(seazonaApiRequests.id, requestId), eq(seazonaApiRequests.clientKey, key)));
+      if (Number.isFinite(retryAfterMs) && retryAfterMs > 0) {
+        const until = new Date(nowMs + Math.min(retryAfterMs, MAX_COOLDOWN_MS));
+        await tx.update(seazonaApiGovernor)
+          .set({ cooldownUntil: sql`greatest(${seazonaApiGovernor.cooldownUntil}, ${until})`, updatedAt: nowAt })
+          .where(eq(seazonaApiGovernor.clientKey, key));
+      }
+      const [state] = await tx.select().from(seazonaApiGovernor).where(eq(seazonaApiGovernor.clientKey, key));
+      if (!state) return {};
+      if (!countsAsFailure({ statusCode, failureKind })) {
+        if (state.circuitOpens > 0) {
+          await tx.update(seazonaApiGovernor).set({ circuitOpens: 0, updatedAt: nowAt }).where(eq(seazonaApiGovernor.clientKey, key));
+        }
+        return {};
+      }
+      if (statusCode === 401 || statusCode === 403) {
+        if (state.haltedReason) return {};
+        await tx.update(seazonaApiGovernor).set({ haltedReason: 'auth', haltedAt: nowAt, updatedAt: nowAt })
+          .where(eq(seazonaApiGovernor.clientKey, key));
+        return { halted: 'auth' };
+      }
+      const openUntil = state.circuitOpenUntil.getTime();
+      // After a pause the next call is a probe: if it fails, open again at once.
+      const probeFailed = state.circuitOpens > 0 && openUntil <= nowMs;
+      const counted = probeFailed ? 0 : await failuresSince(tx, Math.max(nowMs - circuitWindowMs, openUntil));
+      if (!probeFailed && counted < circuitFailures) return {};
+      if (!probeFailed && openUntil > nowMs) return {};
+      const pauseMs = Math.min(MAX_CIRCUIT_PAUSE_MS, circuitPauseMs * 2 ** Math.min(state.circuitOpens, 10));
+      const until = new Date(nowMs + pauseMs);
+      await tx.update(seazonaApiGovernor)
+        .set({ circuitOpenUntil: until, circuitOpens: state.circuitOpens + 1, updatedAt: nowAt })
         .where(eq(seazonaApiGovernor.clientKey, key));
-    }
+      return { opened: { until: until.toISOString(), pauseMs, opens: state.circuitOpens + 1 } };
+    });
     await db.delete(seazonaApiRequests).where(and(
       eq(seazonaApiRequests.clientKey, key),
       lt(seazonaApiRequests.admittedAt, new Date(nowMs - telemetryRetentionMs)),
     ));
+    return outcome;
+  }
+
+  // A person acted (new or saved settings, or the adapter turned on again):
+  // clear a halt and close the circuit. The day's failure budget stays.
+  async function resume() {
+    await db.insert(seazonaApiGovernor).values({ clientKey: key }).onConflictDoNothing();
+    await db.update(seazonaApiGovernor)
+      .set({ haltedReason: null, haltedAt: null, circuitOpenUntil: EPOCH, circuitOpens: 0, updatedAt: new Date(Number(now())) })
+      .where(eq(seazonaApiGovernor.clientKey, key));
   }
 
   // Counts for /health: the last minute, and the last day by status.
@@ -126,11 +241,21 @@ export function createSeazonaGovernor({
       .where(and(eq(seazonaApiRequests.clientKey, key), gte(seazonaApiRequests.admittedAt, new Date(nowMs - WINDOW_MS))));
     const day = await summarise({ from: new Date(nowMs - 24 * 60 * 60_000), to: new Date(nowMs) });
     const cooldownUntil = state && state.cooldownUntil.getTime() > nowMs ? state.cooldownUntil.toISOString() : null;
+    const openUntil = state?.circuitOpenUntil?.getTime() ?? 0;
+    const circuit = state?.haltedReason ? 'halted'
+      : openUntil > nowMs ? 'open'
+        : state?.circuitOpens > 0 ? 'half_open' : 'closed';
     return {
       limitPerMinute: limit,
       minIntervalMs,
       lastMinute: Number(lastMinute),
       cooldownUntil,
+      circuit,
+      circuitOpenUntil: openUntil > nowMs ? state.circuitOpenUntil.toISOString() : null,
+      haltedReason: state?.haltedReason ?? null,
+      haltedAt: state?.haltedAt?.toISOString() ?? null,
+      failedToday: await failuresSince(db, startOfUtcDay(nowMs)),
+      dailyFailureBudget,
       lastDay: { requests: day.requests, failed: day.failed, rateLimited: day.rateLimited, retries: day.retries },
     };
   }
@@ -170,5 +295,5 @@ export function createSeazonaGovernor({
     };
   }
 
-  return { clientKey: key, limitPerMinute: limit, minIntervalMs, reserve, recordResponse, status, summarise };
+  return { clientKey: key, limitPerMinute: limit, minIntervalMs, reserve, recordResponse, resume, status, summarise };
 }

package/server/integrations/seazona/index.js

@@ -2,6 +2,7 @@ import { createSeazonaClient } from './client.js';
 import { listClients, listWork, readBillableWork } from './feed.js';
 import { readSeazonaSyncHealth, runSeazonaSync } from './lanes.js';
 import { createSeazonaScheduler } from './scheduler.js';
+import { resetFailedLanes, resetStoppedLanes } from './store.js';
 import { describeSeazonaSettings, resolveSeazonaSettings } from './settings.js';
 import { seazonaSchema } from './tables.js';
 
@@ -58,9 +59,21 @@ export function createSeazonaAdapter({ env = null, fetchImpl = null, now = Date.
     schema: seazonaSchema,
     setup: SEAZONA_SETUP,
 
-    async start({ db, log = console, env: settingsEnv }) {
+    // `reconfigured` is true when a person saved the settings or turned
+    // Seazona on (issue #101): that clears a halt after a refused API client,
+    // closes the circuit, and runs every failed lane again. A plain start (a
+    // restart or a new release) runs again only the lanes stopped by a
+    // refused path; a halt still waits for a person.
+    async start({ db, log = console, env: settingsEnv, reconfigured = false }) {
       const settings = requireSeazonaSettings(env ?? settingsEnv ?? process.env);
       const client = createSeazonaClient({ settings, db, fetchImpl: fetchImpl ?? undefined, workflow: 'seazona-sync', now });
+      const at = new Date(Number(now()));
+      if (reconfigured) {
+        await client.governor?.resume();
+        await resetFailedLanes(db, { at });
+      } else {
+        await resetStoppedLanes(db, { at });
+      }
       const run = (options = {}) => runSeazonaSync(db, client, { settings, now, ...options });
       // The background sync starts in live mode only. A sandbox or replay
       // installation syncs only when someone asks (sync-once.js).