@cello-protocol/daemon 0.0.166 → 0.0.168

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAMrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAmC,KAAK,UAAU,EAAsB,MAAM,iBAAiB,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiB7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAS5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA6BnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAWlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACxC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CA8B3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAMrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAmC,KAAK,UAAU,EAAsB,MAAM,iBAAiB,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiB7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAS5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA8BnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAWlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACxC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CA8B3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}

package/dist/daemon.js

@@ -72,6 +72,7 @@ import { wireContentHash } from "./wire-content-hash.js";
 import { DocumentPublish } from "./document-publish.js";
 import { createDocumentDeliveryTransport } from "./document-delivery-transport.js";
 import { DocumentDelivery } from "./document-delivery.js";
+import { sweepAgentEvicting } from "./delivery-sweep-bound.js";
 import { encodeDocumentUpdateEnvelope, DOCUMENT_UPDATE_ENCODING_V1 } from "@cello-protocol/protocol-types";
 import { createSealFlows } from "./seal-flows.js";
 import { registerCloseSessionHandler } from "./close-session-handler.js";
@@ -3610,7 +3611,18 @@ async function startDaemonHoldingLock(config, singletonLock) {
         const existing = documentDeliveryWorkers.get(agentName);
         if (existing)
             return existing;
-        const worker = new DocumentDelivery(documentLayer.store, documentTransportFor(agentName), logger);
+        const worker = new DocumentDelivery(documentLayer.store, documentTransportFor(agentName), logger, 
+        // DOD-MP-CONTROL-DURABLE-1 — control frames derive their recipients the way the NOTIFIER
+        // does, not the way envelopes do. `holdersFor` returns null for a document with no stored
+        // genesis proposal; `controlHolders` has an explicit legacy branch for it. Deriving the two
+        // halves differently turned a seeded row into a permanent no-op.
+        (documentId) => {
+            const ownerAgentId = documentOwnerKeyFor(agentName);
+            if (ownerAgentId === null) {
+                return { ok: false, reason: "document_owner_key_unavailable" };
+            }
+            return documentLayer.controlHolders(ownerAgentId, documentId);
+        });
         documentDeliveryWorkers.set(agentName, worker);
         return worker;
     };
@@ -3678,6 +3690,15 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // Floored, so a misread env cannot turn the sweep into a busy loop against the directory.
     const tickOverride = Number(process.env["CELLO_DOCUMENT_DELIVERY_TICK_MS"]);
     const DOCUMENT_DELIVERY_TICK_MS = Number.isFinite(tickOverride) && tickOverride >= 250 ? tickOverride : 60_000;
+    // DOD-MP-SWEEP-ALIVE-1 — how long ONE agent's pass may run before the sweep stops waiting for
+    // it. Generous relative to real work (the ack-grace budget for a whole pass is 30s) and finite,
+    // which is the only property that matters: the defect is an unbounded wait, not a slow one.
+    // Generous relative to what a HEALTHY pass can legitimately spend: the discovery lookup is
+    // bounded at 10s per (document, holder), the whole-pass ack grace is 30s, and only the dial is
+    // unbounded. Six pairs against a slow directory is already ~90s, so a 120s bound would warn on
+    // the normal case — and a signal that fires when nothing is wrong teaches an operator to ignore
+    // the one that matters. Scales with the tick so the fast-tick test path does not sit out minutes.
+    const DOCUMENT_DELIVERY_PASS_TIMEOUT_MS = Math.max(180_000, DOCUMENT_DELIVERY_TICK_MS * 3);
     let documentDeliveryRunning = false;
     let documentDeliveryStopping = false;
     let documentDeliveryInFlight = null;
@@ -3691,6 +3712,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
         documentDeliveryInFlight = (async () => {
             try {
                 let agentsSwept = 0;
+                let stuck = 0;
                 let attempted = 0;
                 let delivered = 0;
                 let failed = 0;
@@ -3706,23 +3728,48 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // and leaves a fully synced document invisible with no error on any path.
                     if (ownerAgentId === null)
                         continue;
-                    agentsSwept++;
+                    // COUNTED AFTER THE PASS, not before — an agent whose pass never finished was not swept,
+                    // and saying it was is what made the stall indistinguishable from an idle daemon.
                     // FANOUT-1: targets are the DERIVED holders minus ourselves — never per-sender
                     // config, never the genesis peer column (§7-1's silent-divergence hazard).
                     const holdersFor = (documentId) => {
                         const holders = documentLayer.holdersFor(ownerAgentId, documentId);
                         return holders === null ? null : holders.filter((h) => h !== ownerAgentId);
                     };
-                    const result = await documentDeliveryFor(agentName).tick(ownerAgentId, holdersFor, Date.now(), {
-                        senderAgentId: ownerAgentId,
+                    // DOD-MP-SWEEP-ALIVE-1 — BOUNDED. The `finally` below releases the overlap guard only
+                    // when this body settles, so an await that never settles ends document delivery for the
+                    // life of the process, silently: the interval keeps firing, returns at the guard, and
+                    // logs nothing. Observed live 2026-08-13. One wedged agent now degrades alone and loudly
+                    // instead of taking every other agent's documents down with it.
+                    const bounded = await sweepAgentEvicting({
+                        logger,
+                        timeoutMs: DOCUMENT_DELIVERY_PASS_TIMEOUT_MS,
+                        agentName,
+                        // Evicting the wedged worker is what makes the recovery real: `DocumentDelivery.tick`
+                        // caches its pass and would otherwise hand back the same hung promise forever, so the
+                        // agent would never deliver again AND every later pass would pay the full bound
+                        // waiting for it — a 2x sweep-interval regression for every healthy agent.
+                        workers: documentDeliveryWorkers,
+                        run: () => documentDeliveryFor(agentName).tick(ownerAgentId, holdersFor, Date.now(), {
+                            senderAgentId: ownerAgentId,
+                        }),
                     });
+                    if (!bounded.completed) {
+                        stuck += 1;
+                        continue;
+                    }
+                    agentsSwept++;
+                    const result = bounded.value;
                     attempted += result.attempted;
                     delivered += result.delivered;
                     failed += result.failed;
                 }
                 // H3: a sweep that delivers nothing was byte-for-byte identical to a healthy idle one, which
                 // is what made every scoping bug above invisible. One line per tick, always.
-                logger.debug("document.delivery.sweep", { agents: agentsSwept, attempted, delivered, failed });
+                // `stuck` IS PART OF THE LINE. Counting a wedged agent as swept reported `agents: 3,
+                // attempted: 0` — byte-for-byte a healthy idle sweep, which is the exact shape the comment
+                // below exists to prevent, on the one occasion it matters most.
+                logger.debug("document.delivery.sweep", { agents: agentsSwept, stuck, attempted, delivered, failed });
                 if (agentsSwept === 0 && documentLayer.store.anyDocumentExists()) {
                     logger.warn("document.delivery.sweep_empty", {
                         reason: "documents exist but no agent was swept — nothing will ever be delivered",