@botbuddy/cli 1.47.0 → 1.48.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/api.mjs

@@ -353,7 +353,7 @@ export async function resolveCallAuth({
       if (typeof session.token !== "string" || !AGENT_KEY_RE.test(session.token)) {
         return { error: { ok: false, auth: true, error: "session_token_malformed", source: session.source ?? null } };
       }
-      return { auth: { "x-agent-api-key": session.token }, source: session.source ?? null };
+      return { auth: { "x-agent-api-key": session.token }, source: session.source ?? null, sessionToken: true };
     }
   }
   const owner = await resolveOwner();
@@ -392,12 +392,20 @@ function toolEndpoint(tenant) {
   return url.toString();
 }
 
-export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal, auth: pinnedAuth = null, tenant = null, resolvePin = resolveDefaultTenantPin } = {}) {
+export async function callToolJson(toolName, args = {}, {
+  fetchImpl = fetch, signal, auth: pinnedAuth = null, tenant = null, resolvePin = resolveDefaultTenantPin,
+  requireSessionToken = false, resolveAuth = resolveCallAuth,
+} = {}) {
   let auth = pinnedAuth;
+  let sessionTokenSelected = false;
   if (!auth) {
-    const resolved = await resolveCallAuth();
+    const resolved = await resolveAuth({ toolName, preferSession: requireSessionToken });
     if (resolved.error) return resolved.error;
     auth = resolved.auth;
+    sessionTokenSelected = resolved.sessionToken === true;
+  }
+  if (requireSessionToken && !sessionTokenSelected) {
+    return { ok: false, auth: true, error: "session_token_required" };
   }
   // BOT-1571 (Codex P1, round 2): `botbuddy stack` and every other
   // callToolJson caller that passes no explicit tenant would send a USER token

package/src/commands.mjs

@@ -13,6 +13,7 @@ import { agentProfileKeyLabel } from "./credential-kinds.mjs";
 import { buildAcquireResourcesPayload, LocksUsageError } from "./locks.mjs";
 import { CallUsageError, discoveryUrlFor, formatDiscovery, parseCallArgs } from "./discovery.mjs";
 import { cmdStack } from "./stack.mjs";
+import { cmdManagedAllocation } from "./managed-allocation.mjs";
 import { cmdDocker } from "./docker-hygiene.mjs";
 import { cmdRun } from "./run.mjs";
 import { cmdTest } from "./test-lane.mjs";
@@ -59,6 +60,7 @@ export async function run(argv, {
   warnStale = maybeWarnStale,
   errorLog = (line) => console.error(line),
   bootstrap = cmdBootstrap,
+  managedAllocation = cmdManagedAllocation,
 } = {}) {
   const [command, ...args] = argv;
   // BOT-2069: `bootstrap close` can retire a live server session. Parse its
@@ -89,6 +91,7 @@ export async function run(argv, {
     case "unlock": return cmdUnlock(args);
     // BOT-1220: batch-scoped local stack leases (request/park/status/touch/done).
     case "stack": return cmdStack(args);
+    case "allocation": return managedAllocation(args);
     case "docker": return cmdDocker(args);
     case "run": return cmdRun(args);
     case "telemetry": return cmdTelemetry(args);
@@ -209,6 +212,7 @@ ${bold("STACK LEASES")}
   stack touch  <lease_id>    Bump the lease idle clock
   stack done   <lease_id>    Release (done) a lease — reap the stack
   stack help                 Full stack usage + exit codes
+  allocation status <id> <generation> <target_revision>  Verify managed placement before Compose
 
 ${bold("DOCKER HYGIENE")}
   docker hygiene [options]   Dry-run/apply safe stale Supabase cleanup on OrbStack

package/src/managed-allocation.mjs

@@ -0,0 +1,77 @@
+import { callToolJson, CALL_EXIT } from "./api.mjs";
+import { readMachineUuid } from "./machine-id.mjs";
+
+export function parseManagedAllocationArgs(args) {
+  if (args.length === 1 && ["help", "--help", "-h"].includes(args[0])) return { help: true };
+  if (args.length !== 4 || args[0] !== "status") {
+    return { error: "Usage: bb allocation status <allocation_uuid> <generation> <target_revision>" };
+  }
+  const [, id, rawGeneration, rawRevision] = args;
+  const uuid = String(id).trim().toLowerCase();
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(uuid)) {
+    return { error: "allocation id must be a canonical UUID" };
+  }
+  const generation = Number(rawGeneration);
+  const targetRevision = Number(rawRevision);
+  if (!Number.isSafeInteger(generation) || generation < 1 || !Number.isSafeInteger(targetRevision) || targetRevision < 1) {
+    return { error: "generation and target_revision must be positive integers" };
+  }
+  return { command: "status", allocationId: uuid, generation, targetRevision };
+}
+
+export function evaluateLocalStartEligibility(receipt, localMachineUuid) {
+  const server = receipt?.server_start_eligibility;
+  if (server?.eligible !== true) return { eligible: false, reason: server?.reason ?? "server_placement_unverified" };
+  if (typeof localMachineUuid !== "string" || !localMachineUuid.trim()) {
+    return { eligible: false, reason: "local_machine_identity_unavailable" };
+  }
+  const selected = receipt?.placement?.hardware_uuid;
+  if (typeof selected !== "string" || !selected.trim()) {
+    return { eligible: false, reason: "machine_binding_unavailable" };
+  }
+  if (selected.trim().toLowerCase() !== localMachineUuid.trim().toLowerCase()) {
+    return { eligible: false, reason: "selected_machine_mismatch" };
+  }
+  return { eligible: true, reason: null };
+}
+
+export const MANAGED_ALLOCATION_HELP = `bb allocation status <allocation_uuid> <generation> <target_revision>
+
+Read the exact managed-container placement and cleanup receipt using the current
+bb_agent_ work-session token, then compare its enrolled machine binding with this
+machine's OS-reported identity. An active registered session is required. This
+command is read-only; it never starts Docker or Compose.`;
+
+export async function cmdManagedAllocation(args, {
+  call = callToolJson,
+  machineUuid = () => readMachineUuid({ env: {} }),
+  log = (line) => process.stdout.write(`${line}\n`),
+  errorLog = (line) => process.stderr.write(`${line}\n`),
+} = {}) {
+  const parsed = parseManagedAllocationArgs(args);
+  if (parsed.help) { log(MANAGED_ALLOCATION_HELP); return 0; }
+  if (parsed.error) { errorLog(parsed.error); return 4; }
+  const response = await call("get_managed_container_allocation_status", {
+    allocation_id: parsed.allocationId,
+    generation: parsed.generation,
+    target_revision: parsed.targetRevision,
+  }, { requireSessionToken: true });
+  if (!response?.ok || response.isError) {
+    const sessionRequired = response?.error === "session_token_required";
+    const payload = { schema_version: 1, outcome: "error",
+      code: response?.code ?? response?.error_code ?? response?.data?.code ?? (sessionRequired ? "session_token_required" : response?.isError ? "allocation_status_denied" : "status_unavailable"),
+      error: response?.error ?? response?.data?.error ?? (response?.isError ? "managed allocation status was refused by the server" : "managed allocation status unavailable") };
+    log(JSON.stringify(payload));
+    return response?.auth ? CALL_EXIT.AUTH : response?.isError ? CALL_EXIT.ERROR
+      : response?.status == null || response.status >= 500 ? CALL_EXIT.TRANSPORT : CALL_EXIT.ERROR;
+  }
+  const receipt = response.data;
+  const result = {
+    ...receipt,
+    local_start_eligibility: evaluateLocalStartEligibility(receipt, machineUuid()),
+  };
+  log(JSON.stringify(result));
+  // Keep shell chaining safe: a status receipt that shows the wrong/unknown
+  // machine must not look like a successful preflight to `&&` callers.
+  return result.local_start_eligibility.eligible ? 0 : CALL_EXIT.ERROR;
+}

package/src/wait-core.mjs

@@ -28,6 +28,13 @@ export const EXIT = Object.freeze({
   // reap_failed) before it was granted — re-request the lease. BOT-1754 reserves the name
   // LEASE_LOST and forbids reusing 2-8; 9 is the first free code.
   LEASE_LOST: 9,
+  // BOT-2330: an exact managed-allocation cleanup failed. The waiter must not
+  // report a successful terminal match when the signed Helper outcome failed.
+  MANAGED_ALLOCATION_FAILED: 10,
+  // BOT-2360: the server ended this wait while the client was still parked on it — the
+  // liveness reaper abandoned it, it was cancelled, or its row is gone. The relay
+  // refuses the stream with a typed `wait_abandoned` error frame; re-arm from next_cursor.
+  ABANDONED: 11,
 });
 
 // BOT-2013: the uuid spellings Postgres accepts for a lease id (uuid_in), mirrored by the SQL
@@ -50,6 +57,16 @@ export function leaseLostDetail(signal, condition) {
   };
 }
 
+function managedAllocationFailureDetail(signal, condition) {
+  if (condition?.type !== "managed-allocation" || signal?.signal_type !== "managed_allocation" || signal.payload?.state !== "cleanup_failed") return null;
+  return {
+    allocation_id: signal.payload.allocation_id,
+    generation: signal.payload.generation,
+    target_revision: signal.payload.target_revision,
+    cleanup_error: typeof signal.payload.cleanup_error === "string" ? signal.payload.cleanup_error : "cleanup_failed",
+  };
+}
+
 // BOT-1249: the internal CONTROL signal_type the reconciler emits when a wait's
 // resource identity is canonicalized away. runWaitLoop treats a wait_superseded frame
 // targeting its OWN wait_session as terminal (exit 8) before matchFrame sees it. It is
@@ -190,6 +207,24 @@ const VALIDATORS = {
     const id = hex ? `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}` : raw;
     return { id };
   },
+  // BOT-2330: terminal state for one owner/session-bound managed allocation.
+  // Both fences are required so a stale wait cannot observe a later reuse.
+  "managed-allocation"(p) {
+    const unexpected = Object.keys(p).filter((key) => !["id", "generation", "target_revision"].includes(key));
+    if (unexpected.length) throw new Error(`managed-allocation does not accept ${unexpected.join(", ")}`);
+    const id = String(p.id ?? "").trim().toLowerCase();
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(id)) {
+      throw new Error("managed-allocation needs id=<canonical allocation UUID>");
+    }
+    const generation = Number(p.generation);
+    const targetRevision = Number(p.target_revision);
+    if (!Number.isSafeInteger(generation) || generation < 1 || !Number.isSafeInteger(targetRevision) || targetRevision < 1) {
+      throw new Error("managed-allocation needs positive integer generation=<n> and target_revision=<n>");
+    }
+    // Keep the condition parameters in the event-stream wire shape. The server
+    // validates `target_revision` before it normalizes this saved condition.
+    return { id, generation, target_revision: targetRevision };
+  },
   // BOT-1064 / BOT-2112 — linear: wake on a logical state change of a named
   // issue in any Linear team bound to the authenticated tenant.
   // The spine subject_key is the issue identifier as stored on the tickets
@@ -933,6 +968,14 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
       // →active). The relay only delivers it to the lease's owning agent, so any
       // stack_lease frame for this lease id is ours to wake on.
       return signal.signal_type === "stack_lease" && signal.subject_key === `lease:${params.id}`;
+    case "managed-allocation": {
+      const p = signal.payload;
+      return signal.signal_type === "managed_allocation" && signal.subject_key === `allocation:${params.id}` &&
+        p?.allocation_id === params.id && p?.generation === params.generation &&
+        p?.target_revision === params.target_revision &&
+        ((p?.state === "released" && p?.permit_count === 0 && p?.cleanup_receipt_accepted === true) ||
+          (p?.state === "cleanup_failed" && p?.cleanup_receipt_accepted === true));
+    }
     case "linear": {
       if (signal.signal_type !== "linear_issue") return false;
       // Identity (BOT-1260): prefer the STABLE Linear issue UUID when BOTH the wait
@@ -1355,10 +1398,15 @@ export async function runWaitLoop({
   // reaped: that wait ends lease_lost (BOT-2013) so the caller can re-request instead of
   // provisioning against a dead lease.
   const finalizeMatch = async (entry, signal) => {
-    const lost = leaseLostDetail(signal, conditions.find((c) => c.id === entry.condition_id));
+    const condition = conditions.find((c) => c.id === entry.condition_id);
+    const lost = leaseLostDetail(signal, condition);
     if (lost) {
       return finalize("lease_lost", { exitCode: EXIT.LEASE_LOST, matched: [entry], state: lost, error: "lease_lost" });
     }
+    const allocationFailure = managedAllocationFailureDetail(signal, condition);
+    if (allocationFailure) {
+      return finalize("error", { exitCode: EXIT.MANAGED_ALLOCATION_FAILED, matched: [entry], state: allocationFailure, error: allocationFailure.cleanup_error });
+    }
     return finalize("matched", { exitCode: EXIT.MATCHED, matched: [entry] });
   };
 
@@ -1712,6 +1760,20 @@ export async function runWaitLoop({
         if (parsed.error === "unauthorized" || parsed.error === "forbidden") {
           return finalize("error", { exitCode: EXIT.AUTH, error: parsed.error });
         }
+        // BOT-2360: the relay refuses a stream bound to a wait the server already ended
+        // (prod a0cd7b11 parked 54 min on one). Never reconnect to it: exit typed, with the
+        // confirmed cursor so a re-arm replays everything after it.
+        if (parsed.error === "wait_abandoned") {
+          return finalize("abandoned", {
+            exitCode: EXIT.ABANDONED,
+            error: "wait_abandoned",
+            state: {
+              wait_session_id: typeof parsed.wait_session_id === "string" ? parsed.wait_session_id : waitSessionId ?? null,
+              status: typeof parsed.status === "string" ? parsed.status : null,
+              reason: typeof parsed.reason === "string" ? parsed.reason : null,
+            },
+          });
+        }
         return finalize("error", { exitCode: EXIT.INTERNAL, error: parsed.error || "stream_error" });
       }
 

package/src/wait.mjs

@@ -180,7 +180,12 @@ OUTPUT
               8 superseded (wait replaced server-side) · 9 lease lost (a
                 lease:id= wait whose lease was reaped before it was granted;
                 receipt outcome lease_lost + reap_reason — request a new
-                lease). If the receipt has
+                lease) · 10 managed-allocation cleanup failed (BOT-2330)
+                · 11 abandoned (the server ended this wait while it
+                was parked — reaped after 180 s without a live stream,
+                or cancelled; receipt outcome abandoned +
+                state.status/reason — re-arm with --since <next_cursor>).
+                If the receipt has
                 reacquire_lock (claim=true), acquire_lock again FIRST and re-run
                 only on a queued/busy result (granted = you hold it — just resume);
                 otherwise re-run from the receipt's next_cursor. docs/agent-wait.md.
@@ -548,11 +553,28 @@ export function leaseLostNotice(receipt) {
     `(reap_reason=${st.reap_reason ?? "unknown"}) — request a new lease (exit ${EXIT.LEASE_LOST})`;
 }
 
+/**
+ * BOT-2360: the one stderr line for an `abandoned` receipt (null for any other outcome). The
+ * server ended this wait (its liveness reaper or a cancel) while the client was
+ * still parked; re-arming from next_cursor replays everything after the last frame consumed.
+ */
+export function waitAbandonedNotice(receipt) {
+  if (receipt?.outcome !== "abandoned") return null;
+  const st = receipt.state ?? {};
+  const since = receipt.next_cursor != null ? ` --since ${receipt.next_cursor}` : "";
+  return `bb-wait: wait ${st.wait_session_id ?? "?"} was ended server-side (status=${st.status ?? "abandoned"}, ` +
+    `reason=${st.reason ?? "unknown"}) — re-arm the same conditions with${since || " a fresh wait"} (exit ${EXIT.ABANDONED})`;
+}
+
 function writeLeaseLostNotice(receipt) {
-  const notice = leaseLostNotice(receipt);
+  const notice = leaseLostNotice(receipt) ?? waitAbandonedNotice(receipt);
   if (notice) process.stderr.write(`${notice}\n`);
 }
 
+// BOT-1228 / BOT-2360: outcomes whose wait_session the server already ended. The client
+// never finalizes them (finalize_wait_session only transitions from active).
+const SERVER_ENDED_OUTCOMES = new Set(["superseded", "abandoned"]);
+
 // Record the terminal outcome. Best-effort AND bounded: the receipt has already
 // been written to stdout before this runs, so a slow/failing finalize must never
 // delay the agent's wake or change the exit path. A short abort timeout caps how
@@ -596,7 +618,7 @@ async function finalizeWait(opts, waitSessionId, receipt, timeoutMs = 5000) {
 // A real SSE connection to the relay's spine tail. Returns an async iterable of
 // parsed frames. Server emits `id: <seq>` per signal and replays `seq > since`
 // on connect, so a reconnect never loses an event.
-function makeConnect(opts) {
+export function makeConnect(opts) {
   // BOT-1649: mirror the relay's keepalive expiry roll into the 0600 cache. The
   // server bumps session_token_expires_at on connect and every keepalive, but
   // the cache keeps its register-time deadline — so a wait near the 8 h cap goes
@@ -633,16 +655,25 @@ function makeConnect(opts) {
     // signal tears the stalled socket down immediately, then the read rejects and
     // the stream ends so runWaitLoop reconnects.
     const ac = new AbortController();
-    const res = await fetch(url, {
-      headers: {
-        Authorization: `Bearer ${opts.token}`,
-        "x-agent-api-key": opts.token || "",
-        Accept: "text/event-stream",
-        // BOT-741: never let a proxy gzip-buffer an SSE stream.
-        "Accept-Encoding": "identity",
-      },
-      signal: ac.signal,
-    });
+    // BOT-2360: bound the wait for response headers. Unbounded, a connect that hangs on a
+    // loaded host or a stuck proxy sits silent past the wait reaper's grace (undici's own
+    // headers timeout is 300 s); bounded, the worst silent reconnect stays inside it.
+    const connectTimer = setTimeout(() => ac.abort(new Error("relay connect timed out")), waitConnectTimeoutMs());
+    let res;
+    try {
+      res = await fetch(url, {
+        headers: {
+          Authorization: `Bearer ${opts.token}`,
+          "x-agent-api-key": opts.token || "",
+          Accept: "text/event-stream",
+          // BOT-741: never let a proxy gzip-buffer an SSE stream.
+          "Accept-Encoding": "identity",
+        },
+        signal: ac.signal,
+      });
+    } finally {
+      clearTimeout(connectTimer);
+    }
     if (res.status === 401) return errorStream("unauthorized");
     if (res.status === 403) return errorStream("forbidden");
     if (!res.ok || !res.body) throw new Error(`relay responded ${res.status}`);
@@ -655,7 +686,7 @@ function makeConnect(opts) {
 // runs the global bb_wait_linear_feed_lagging RPC) whether the Linear ingest
 // feed is stale. Any failure -> false (non-fatal: the wait keeps its last known
 // degraded state rather than flapping on a probe blip).
-const FEED_LAG_PROBE_TIMEOUT_MS = 10_000;
+export const FEED_LAG_PROBE_TIMEOUT_MS = 10_000;
 
 function makeFeedLagProbe(opts) {
   // `issues` = the armed `linear` conditions' target ticket keys. The relay
@@ -715,9 +746,20 @@ function makeFeedLagProbe(opts) {
 // runWaitLoop reconnects from the cursor, which re-bumps wait_sessions.last_seen_at
 // (and, with --heartbeat, agents.last_heartbeat) before the reaper's grace.
 // 70s ≈ 2.3 missed keepalives — long enough to never false-trip on jitter, short
-// enough that the reconnect lands inside the 90s last_seen reap window.
+// enough that the reconnect lands inside the 180 s last_seen reap window (BOT-2360).
 export const DEFAULT_SSE_IDLE_TIMEOUT_MS = 70_000;
 
+// BOT-2360: the longest a (re)connect may wait for the relay's response headers. With the
+// idle watchdog (70 s), the backoff cap (15 s) and the feed-lag probe (10 s) it bounds a
+// healthy client's worst silent gap at 125 s, under the 180 s wait-reaper grace with 55 s
+// to spare (asserted in bot2360-abandoned-wait.test.mjs against the registered cron job).
+export const WAIT_CONNECT_TIMEOUT_MS = 30_000;
+
+function waitConnectTimeoutMs() {
+  const raw = Number(process.env.BOTBUDDY_WAIT_CONNECT_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : WAIT_CONNECT_TIMEOUT_MS;
+}
+
 function sseIdleTimeoutMs() {
   const raw = Number(process.env.BOTBUDDY_WAIT_IDLE_TIMEOUT_MS);
   return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_SSE_IDLE_TIMEOUT_MS;
@@ -1194,7 +1236,7 @@ async function deliverTerminalFinalization(checkpoint) {
 async function flushPendingFinalization(store, checkpoint) {
   if (!checkpoint.cloud_wait_session_id || !checkpoint.terminal_receipt ||
       (checkpoint.cloud_finalize_pending === false && checkpoint.cloud_finalized_at)) return checkpoint;
-  if (checkpoint.terminal_receipt.outcome === "superseded") {
+  if (SERVER_ENDED_OUTCOMES.has(checkpoint.terminal_receipt.outcome)) {
     return store.update(checkpoint.local_wait_id, {
       cloud_finalize_pending: false,
       cloud_finalized_at: new Date().toISOString(),
@@ -1296,6 +1338,7 @@ function exitForRecoveredOutcome(receipt) {
   if (receipt?.outcome === "cancelled") return EXIT.MATCHED;
   if (receipt?.outcome === "timeout") return EXIT.TIMEOUT;
   if (receipt?.outcome === "superseded") return EXIT.SUPERSEDED;
+  if (receipt?.outcome === "abandoned") return EXIT.ABANDONED;
   if (receipt?.error === "cursor_expired") return EXIT.CURSOR_EXPIRED;
   if (receipt?.error === "unauthorized" || receipt?.error === "forbidden") return EXIT.AUTH;
   return EXIT.BACKEND;
@@ -2095,7 +2138,7 @@ export async function runWait(argv, { recoveryLocalWaitId = null } = {}) {
             terminal_receipt: terminalReceipt,
             exit_code: state.exitCode,
             safe_cursor: terminalReceipt.next_cursor ?? state.cursor ?? checkpoint.safe_cursor,
-            cloud_finalize_pending: Boolean(waitSessionId && terminalReceipt.outcome !== "superseded"),
+            cloud_finalize_pending: Boolean(waitSessionId && !SERVER_ENDED_OUTCOMES.has(terminalReceipt.outcome)),
           });
           terminalPersistedFromFrame = true;
           return;
@@ -2125,7 +2168,7 @@ export async function runWait(argv, { recoveryLocalWaitId = null } = {}) {
         terminal_receipt: terminalReceipt,
         exit_code: exitCode,
         safe_cursor: terminalReceipt.next_cursor ?? checkpoint.safe_cursor ?? null,
-        cloud_finalize_pending: Boolean(waitSessionId && terminalReceipt.outcome !== "superseded"),
+        cloud_finalize_pending: Boolean(waitSessionId && !SERVER_ENDED_OUTCOMES.has(terminalReceipt.outcome)),
       });
     }
     emitReceipt(terminalReceipt, { versioned: true });
@@ -2134,7 +2177,8 @@ export async function runWait(argv, { recoveryLocalWaitId = null } = {}) {
     // ended_at/updated_at stamped). Skip the client finalize: the row is already
     // terminal (finalize_wait_session only transitions from active, so it'd be a
     // no-op) and `superseded` isn't a wait_session_status enum value anyway.
-    if (waitSessionId && receipt.outcome !== "superseded") {
+    // BOT-2360: likewise `abandoned` — the relay refused the stream because the row is ended.
+    if (waitSessionId && !SERVER_ENDED_OUTCOMES.has(receipt.outcome)) {
       const finalized = await finalizeWait(opts, waitSessionId, terminalReceipt);
       try {
         checkpoint = await store.update(checkpoint.local_wait_id, finalized.delivered