@c4roa0/agentpay-user 0.3.4 → 0.3.6

package/doc/TODO.md

@@ -1,19 +1,27 @@
 # User TODO
 
+- [x] Preserve maintenance error guidance and original request identity; controlled HTTP/IPC verification (2026-11-10).
+- [ ] Include maintenance guidance in the next reviewed npm release; no release performed by this change.
+
 ## Existing Market address update
 
+- [x] Allow source-to-npm reconnect without an onboarding draft; verify Policy contracts and preserve missing files.
+- [x] Publish 0.3.5 and independently verify registry integrity.
+- [x] Retry the participant address update without old onboarding files. Observed User 0.3.5 / Wallet 0.3.2 on 2026-11-09.
+
 - [x] Reauthenticate and verify original account, Wallet tuple and Policy connection before replacing an address.
 - [x] Verify unchanged deployment; preserve RPC, key, Policy, history/cache and original cancellation IDs.
 - [x] Apply under installer lock, restart managed Runtime, retain retry marker and show incomplete update in status.
 - [x] Full regression (387 checks), followed by targeted reconnect-boundary/transaction checks.
-- [ ] Publish a reviewed version and verify the existing participant installation against HTTPS.
+- [x] Publish User 0.3.4 through v0.3.4; workflow and independent registry integrity verification passed.
+- [x] Verify the existing participant installation and explicit address update against HTTPS. Observed User 0.3.5 / Wallet 0.3.2 on 2026-11-09.
 
 ## Directory npm update, then HTTPS
 
 - [x] Support directory-local npm update without replacing source/link installs.
 - [x] Verify real npm directory upgrade and isolated preflight; nine regression checks passed.
 - [x] Publish 0.3.3 via v0.3.3 and independently verify registry archive/dependency pins.
-- [ ] Verify participant directory install/update.
+- [x] Verify participant directory install/update. Observed User 0.3.5 / Wallet 0.3.2 on 2026-11-09.
 
 ## Tag-triggered publication
 
@@ -29,14 +37,15 @@
 - [x] Verify website visibility and independently reconcile Settlement/chain outcome; prepare User 0.3.2 candidate.
 - [x] Pin the verified public Wallet 0.3.2; align package/lockfile/update-pair.
 - [x] Publish User 0.3.2 through tag-triggered OIDC; verify public registry archive.
-- [ ] Accept a real participant npm update/restart.
+- [x] Accept a real participant npm update/restart. Observed User 0.3.5 / Wallet 0.3.2 on 2026-11-09.
 
 
 ## Fixed Skill download loop — 2026-11-08
 
 - [x] Request the official ZIP by the built-in SHA-256; reject unavailable/substituted versions without fallback.
 - [x] Complete fixed-download regression/type checks and publication/deletion review; the separate Market schema-fixture issue was resolved in its later regression.
-- [ ] After Market API/Web/nginx support is live, publish the next User version (not 0.3.1 again) and verify old pinned ZIP download and participant upgrade.
+- [x] Publish later User versions and accept participant update through 0.3.5.
+- [ ] Independently verify retained old pinned ZIP download; current package acceptance alone does not close historical-version availability.
 
 
 ## Running-version release loop — 2026-11-07
@@ -47,7 +56,7 @@
 - [x] Wallet 0.3.1 published through the configured workflow; public npm version/dependencies verified.
 - [x] Pin User 0.3.1 to published Wallet 0.3.1; pairing metadata/lockfile and standalone archive verification complete.
 - [x] Publish User 0.3.1; verify public npm/latest and successful Wallet/User OIDC runs.
-- [ ] Verify real published-version update/restart on the participant installation.
+- [x] Verify real published-version update/restart on the participant installation. Observed User 0.3.5 / Wallet 0.3.2 on 2026-11-09.
 
 
 ## npm update follow-up — 2026-11-07
@@ -55,7 +64,7 @@
 - [x] Implement confirmed `agentpay update [-f]`, exact User target and matching Wallet; invoke new repair and pinned official Skill check.
 - [x] Fix relocation preparation ordering, matching legacy purge and packaged document links.
 - [x] Complete update/migration regressions (374 full-suite and 35 final targeted checks) and real npm replacement of local candidate artifacts; controlled service/registry dependencies.
-- [ ] After User release, verify a real published-version npm upgrade and participant service recovery.
+- [x] Verify published-version directory npm update and participant service recovery: User 0.3.5 / Wallet 0.3.2, 2026-11-09. Deliberate interruption remains separate.
 
 ## npm client distribution — 2026-11-07
 
@@ -66,7 +75,8 @@
 - [x] Step 3: migrate User to Wallet npm dependency and `agentpay` entry; remove sibling/build assumptions; isolated tarball/process acceptance passed.
 - [x] Step 4a: exact installed-package checks, service-path/client relocation, installer lock, recovery-safe preparation and explicit uninstall modes.
 - [x] Step 4b implementation: installed/running version and interface checks.
-- [ ] Step 4b acceptance: participant upgrade/interruption recovery (same gate as the running-version loop above).
+- [x] Step 4b participant existing-installation update/restart and HTTPS original-Order read recovery (2026-11-09).
+- [ ] Step 4b deliberate interrupted-upgrade acceptance; normal restart recovery does not close this case.
 - [ ] Step 5: publish Wallet then User via OIDC; verify registry installs and update Market guides.
   - [x] Wallet 0.3.0 first Token publication; registry integrity/latest and fresh public install/CLI/IPC verified.
   - [x] Owner configured Wallet npm Trusted Publisher; validated by 0.3.1 publication.

package/doc/runbooks/market-connection.md

@@ -46,9 +46,13 @@ lock, confirm no installer is running before following the lock-review guidance;
 User does not break an unknown live lock automatically. Existing cancellation requests keep their
 original IDs; recovery checks refresh observations from the new Settlement.
 Keep any old SSH tunnels until the update succeeds and `status` confirms operation.
-This feature requires User 0.3.4 or newer. Updating software does not change
+This feature requires User 0.3.5 or newer. Updating software does not change
 your saved addresses; run the command above to review the change.
 
+Older source installations may leave onboarding files outside the npm package.
+Address updates use the saved Wallet Policy and Runtime settings; they do not
+require or recreate an old onboarding draft.
+
 ## Wallet identity and Policy access
 
 A Wallet is identified by network + Module + Safe + execution address. Its nickname

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@c4roa0/agentpay-user",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "type": "module",
   "dependencies": {
     "@c4roa0/agentpay-protocol": "0.14.3",
-    "@c4roa0/agentpay-wallet": "0.3.2",
+    "@c4roa0/agentpay-wallet": "0.3.3",
     "ethers": "^6.17.0",
     "fs-native-extensions": "1.5.3"
   },

package/progress.md

@@ -1,12 +1,65 @@
 # AgentPay User progress
 
-## User 0.3.4 release candidate — 2026-11-09
+## User 0.3.6 release candidate — 2026-11-10
+
+Pins published Wallet 0.3.3, retaining Protocol 0.14.3. Maintenance errors provide
+same-request guidance without automatic write retries. Package manifest, lockfile
+and update-pair metadata agree. Publication uses the matching v0.3.6 tag after
+independent installation and behavior checks; completion is not implied by this
+candidate record. No local data, Policy or service changes occur on publication.
+
+
+## Maintenance guidance — 2026-11-10
+
+Added explicit maintenance guidance without automatic write retries or replacement
+purchases. Controlled HTTP/IPC tests verify that retry retains original request
+identifiers. This is source verification, not live financial acceptance. Changes
+have not been published to npm.
+
+
+## Acceptance bookkeeping — 2026-11-10
+
+Existing-installation npm update/restart and HTTPS original-Order read recovery
+are closed by the 2026-11-09 participant evidence below. Older pending publication
+and migration paragraphs are historical checkpoints, not instructions to repeat
+the accepted update. Deliberate upgrade interruption, clean installation/uninstall
+and historical pinned-download availability remain separate acceptance items.
+No runtime code or package version changed in this documentation closeout.
+
+
+## Participant HTTPS address update accepted — 2026-11-09
+
+Participant directory-npm installation reports User 0.3.5 / Wallet 0.3.2.
+Market reconnect completed with the existing Wallet and Policy. With Anvil 8547
+forwarded, explicit Settlement Order read succeeded over HTTPS; subsequent Runtime
+status recovered to 2 saved / 2 settled / 0 waiting. The one older missing result
+predates this update and is retained. Initial unavailable checks cleared on retry.
+No new paid Order, Policy replacement or result recovery was performed. This closes
+the observed existing-installation update/address/read-recovery loop, not fresh
+installation, a new HTTPS paid journey or real-network acceptance.
+
+## Missing onboarding draft during npm address update — 2026-11-09
+
+Participant 0.3.4 reconnect stopped before address writes because an old onboarding
+file was absent. Address updates now validate the saved Policy and service settings
+without requiring that draft; existing draft/public files are updated only if
+present. No RPC, Policy, test configuration or private history is synthesized.
+389 full regressions passed, followed by targeted error-guidance checks. Missing
+drafts still reject contract drift; preflight errors explain the stage, preserved
+state and retry action, while interrupted writes warn about partial updates.
+User 0.3.5 published from tag v0.3.5 (6c57c12). GitHub run 42575980847
+and independent registry archive verification passed;
+participant migration remains unverified.
+
+## User 0.3.4 published — 2026-11-09
 
 Release the explicit Market address update with unchanged Wallet 0.3.2 and
 Protocol 0.14.3 pins. No participant data or running services are changed by
 publication. Independent npm archive installation and real isolated local-service
-startup passed; all 388 release regressions passed. Tag publication, registry verification and participant migration
-are separate gates; participant acceptance remains pending.
+startup passed; all 388 release regressions passed. Tag v0.3.4 identifies c63ff80.
+GitHub run 42574859894 completed OIDC publication and registry verification.
+Independent registry integrity comparison matched the reviewed local archive.
+Participant address migration remains pending.
 
 
 ## Explicit Market address update — 2026-11-09
@@ -385,9 +438,11 @@ approval. Detailed operational records are not distributed in this repository.
 
 ## Next work
 
-Public source preparation is complete within the recorded review scope. Next is the approved
-[distribution plan](doc/plans/user-wallet-distribution.md): a supported public Wallet
-client/version boundary and combined release archive. No automatic source updater.
+Public npm distribution and the existing-participant update/HTTPS loop are verified
+within the recorded scope. User pins Wallet and Protocol packages; npm update is
+available. Combined release archives remain optional, not the next installation
+prerequisite. Remaining compatibility and fresh-install checks follow the
+[distribution plan](doc/plans/user-wallet-distribution.md).
 
 Official test network mapping, deployment/artifact handoff, complete interrupted owner
 signing and real-network acceptance remain open. macOS and graphical unlock remain

package/src/connect-market.mjs

@@ -273,7 +273,21 @@ export async function connectMarket(
         String(p.policyId).toLowerCase() === String(previous.connection.policyId).toLowerCase());
     if (changingOrigin && !originalConnectionMatches)
       throw Error("Your original Wallet connection was not found at this address. The previous connection and addresses were kept.");
-    const endpoints = previous ? await prepareEndpoints({dataDir,origin,scope,fetchJson,changingOrigin}) : {changed:false,apply:async()=>{}};
+    let endpoints;
+    try {
+      endpoints = previous ? await prepareEndpoints({dataDir,origin,scope,fetchJson,changingOrigin}) : {changed:false,apply:async()=>{}};
+    } catch (error) {
+      const networkFailure = ["AbortError", "TimeoutError"].includes(error.name) ||
+        ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "ETIMEDOUT"].includes(error.code || error.cause?.code) || error.message === "fetch failed";
+      const reason = networkFailure
+        ? "Could not reach the platform to check its settings. Check your network and the Market address."
+        : error.message;
+      write("\n[!] Platform address check stopped");
+      write(reason);
+      write("No local settings were changed by this check. Your Wallet and Order records are kept.");
+      write("Next: resolve the issue above, then retry this command.");
+      return 1;
+    }
     if (endpoints.changed && (previous?.accountId !== signedIn.developer.id || !originalConnectionMatches))
       throw Error("Platform addresses changed, but your original account and Wallet connection could not be confirmed. Current addresses were kept.");
     if (existing) write(`Using your Wallet name: ${existing.label}`);

package/src/platform-endpoints.mjs

@@ -63,25 +63,32 @@ export async function preparePlatformEndpoints({dataDir,origin,scope,userDir=ins
  // changed origin or an interrupted update owns transport changes.
  if(!changingOrigin&&!pending)return {changed:false,apply:async()=>{}};
  const setup=await readPrivateJson(await deploymentFilePath(dataDir,userDir,'anvil-onboarding.json'));
- if(!setup)throw Error('Local setup settings are missing. Run agentpay setup before connecting Market.');
+ // A source-to-npm installation may have no copied onboarding draft. The
+ // bound Policy and live service settings remain the authoritative local state.
+ // Never synthesize a draft or replace its RPC/test configuration from Market.
  const policy=await readPrivateJson(join(dataDir,'wallet/policy.json'));
+ if(!policy)throw Error('Saved spending permission is missing (wallet/policy.json). Check your data folder with agentpay wallet info and restore its backup before retrying. Do not create a replacement Policy to fix this.');
  if(!policy||policy.policyId?.toLowerCase()!==scope.policyId?.toLowerCase()||policy.safe?.toLowerCase()!==scope.safe?.toLowerCase()||`eip155:${policy.chainId}`!==scope.network||policy.module?.toLowerCase()!==scope.module?.toLowerCase())
   throw Error('Wallet authorization changed. Run agentpay market connect again.');
  const connectionBefore=await readPrivateJson(join(dataDir,'market-connection.json'));
  if(pending&&(pending.version!==1||pending.origin!==origin||pending.policyId!==policy.policyId))
   throw Error('Finish the pending address update with the same Policy. Retry: agentpay market connect --market '+pending.origin);
  const {response,result}=await fetchJson(origin+'/market/web/onboarding/user-config',{method:'GET'},15000);
- if(!response.ok)throw Error('Market settings could not be checked. Your current addresses are kept.');
+ if(!response.ok)throw Error('Market deployment settings are unavailable. Check the website address and your connection, then retry.');
  const proposed=validatePublicDeployment(result);
- const settings=await readServiceSettings(dataDir);
+ let settings;
+ try{settings=await readServiceSettings(dataDir);}catch(e){
+  if(e.code==='ENOENT')throw Error('Runtime settings are missing (runtime/local-services.json). Run agentpay repair, then retry this command.');
+  throw Error('Runtime settings could not be read safely. Check the selected data folder with agentpay wallet info before retrying.');
+ }
  const urls={settlementUrl:proposed.settlementUrl,marketBundleMetadataUrl:proposed.marketBundleMetadataUrl};
- const changed=Object.keys(urls).some(key=>normalize(setup[key])!==normalize(urls[key]))||normalize(settings.settlementUrl)!==normalize(urls.settlementUrl)||!!pending;
+ const changed=!!setup&&Object.keys(urls).some(key=>normalize(setup[key])!==normalize(urls[key]))||normalize(settings.settlementUrl)!==normalize(urls.settlementUrl)||!!pending;
  // RPC is participant-owned: a different local tunnel must never be overwritten.
  // A Market connection alone is not authority to rotate contracts or test packages.
  const publicPath=await deploymentFilePath(dataDir,userDir,'user-deployment.json');
  const previousPublic=await readPrivateJson(publicPath);
  if(!changed&&!changingOrigin)return {changed:false,apply:async()=>{}};
- if(deploymentChanges(policy,proposed).length||deploymentChanges(setup,proposed).length||setup.mode!==proposed.mode||setup.tokenDecimals!==proposed.tokenDecimals||setup.tokenSymbol!==proposed.tokenSymbol)
+ if(deploymentChanges(policy,proposed).length||(setup&&(deploymentChanges(setup,proposed).length||setup.mode!==proposed.mode||setup.tokenDecimals!==proposed.tokenDecimals||setup.tokenSymbol!==proposed.tokenSymbol)))
   throw Error('This Market uses different network or contract settings. Address update stopped; your current Policy and Orders are kept.');
 
  // Query an unknown service to inspect deployment identity without depending on
@@ -101,6 +108,7 @@ export async function preparePlatformEndpoints({dataDir,origin,scope,userDir=ins
   if(!stat.isDirectory()||stat.isSymbolicLink()||stat.uid!==process.getuid()||(stat.mode&0o077))throw Error('Unsafe installation state directory.');
   const lockPath=join(stateDir,'install.lock');let lock;
   try{lock=await open(lockPath,'wx',0o600);}catch(e){if(e.code==='EEXIST')throw Error('Another setup or update is running. Retry market connect when it finishes.');throw e;}
+  let updating=false;
   try{
    if(!same(await readPrivateJson(join(dataDir,'market-connection.json')),connectionBefore)||!same(await readPrivateJson(join(dataDir,'wallet/policy.json')),policy)||!same(await readServiceSettings(dataDir),settings)||!same(await readPrivateJson(publicPath),previousPublic)||!same(await readPrivateJson(await deploymentFilePath(dataDir,userDir,'anvil-onboarding.json')),setup))
     throw Error('Local settings changed during connection. Retry market connect; no addresses were changed.');
@@ -114,16 +122,17 @@ export async function preparePlatformEndpoints({dataDir,origin,scope,userDir=ins
    // A durable marker makes interruptions retryable even after settings are written.
    // Write the alias before the new active address; never mutate cancellation IDs.
    await durableJson(pendingPath(dataDir),{version:1,origin,policyId:policy.policyId});
+   updating=true;
    await saveConnection();
    await manage('stop',{dataDir,settings});
    await durableJson(aliasesPath(dataDir),aliases);
    if(previousPublic)await durableJson(join(dataDir,'user-deployment.json'),{...previousPublic,...urls});
-   await durableJson(join(dataDir,'anvil-onboarding.json'),{...setup,...urls});
+   if(setup)await durableJson(join(dataDir,'anvil-onboarding.json'),{...setup,...urls});
    await durableJson(join(dataDir,'runtime/local-services.json'),{...settings,settlementUrl:normalize(urls.settlementUrl)});
    await manage('start',{dataDir,settings:{...settings,settlementUrl:normalize(urls.settlementUrl)}});
    await unlink(pendingPath(dataDir));
    write('Platform addresses updated. Your Wallet, permission and Order records were kept.');
-  }catch(e){throw Error('Address update did not finish. Run agentpay market connect --market '+origin+' again. '+e.message);}
+  }catch(e){throw Error('Address update did not finish.\n'+e.message+'\n'+(updating?'Some connection settings may already be saved. Wallet keys, Policies and Orders were kept.':'No connection addresses were changed.')+'\nNext: agentpay market connect --market '+origin);}
   finally{await lock.close();await unlink(lockPath);}
  }};
 }

package/src/runtime-client.mjs

@@ -676,7 +676,7 @@ async function invokeSaved(
       WALLET_LOCKED:
         "From the User repository, run agentpay wallet unlock, then resume this request.",
       SERVICE_MAINTENANCE:
-        "Service is under maintenance. Resume this request later.",
+        "The service is under maintenance. Try this same request later; do not create a replacement purchase.",
       SERVICE_NOT_READY:
         "Service is not ready. Check its status, then resume this request.",
     };

package/update-pair.json

@@ -1,6 +1,6 @@
 {
   "format": "agentpay.local-update-pair.v1",
-  "userVersion": "0.3.4",
-  "walletVersion": "0.3.2",
+  "userVersion": "0.3.6",
+  "walletVersion": "0.3.3",
   "typesDependency": "0.14.3"
 }