@cello-protocol/daemon 0.0.168 → 0.0.170

package/dist/types.d.ts

@@ -138,15 +138,64 @@ export interface DaemonStatusResponse {
      */
     active_sessions: ActiveSessionInfo[];
 }
+/**
+ * DOD-M12B-SEAL-STUCK-1 — whether a session can be sealed, as an operator surface.
+ *
+ * THREE STATES, because there are three answers and collapsing them is how this milestone's
+ * defects keep happening.
+ *
+ * `blocked` carries the two numbers separately, and they are NOT interchangeable:
+ *   - `heldBehindGap` — messages this side RECEIVED and verified, waiting for an earlier position.
+ *     Durable since DOD-M12B-STRAND-1, so this half survives a restart.
+ *   - `awaitingArrival` — positions the relay witnessed for which nothing has arrived at all.
+ *     Memory-only, so this half does NOT survive a restart, which is why `unknown` exists.
+ *   - `oldestHeldMs` separates "stuck since this morning" from "in flight 40 ms ago". Without it a
+ *     healthy mid-conversation window — the relay witnesses a counterparty leaf a moment before the
+ *     content arrives — reads exactly like a permanently stranded session, and a warning on
+ *     everything is a warning on nothing.
+ *
+ * `unknown` is NOT a soft `ready`. It is returned when this process cannot answer: the witness
+ * state that would show a never-arrived position is memory-only, so for a session that carries
+ * leaves from before this daemon started, "no gap recorded" means "not recorded", not "no gap".
+ * Reporting `ready` there would invite a close, and a short chain gets `leaf_count_mismatch` back —
+ * which is terminal, and the notarized receipt is gone for good.
+ *
+ * A `blocked` answer can still clear on its own: the close path drains parked relay content and
+ * re-checks before it refuses, which this read does not do. So this surface answers "right now",
+ * and a close may succeed against a session shown here as blocked.
+ */
+export type SealReadinessView = {
+    state: "ready";
+} | {
+    state: "blocked";
+    awaitingArrival: number;
+    heldBehindGap: number;
+    oldestHeldMs: number | null;
+} | {
+    state: "unknown";
+    reason: string;
+};
 /** One active session's status row (see DaemonStatusResponse.active_sessions). */
 export interface ActiveSessionInfo {
     sessionId: string;
     agentName: string;
     counterpartyPubkey: string;
-    /** Direct-path counterparty liveness; 'unknown' before any session-node observation. */
-    liveness: "alive" | "gone" | "unknown";
+    /** Direct-path counterparty liveness; 'unknown' before any session-node observation.
+     *  DOD-M12B-ACK-1: 'impaired' means the connection is up and our writes on it are failing —
+     *  distinct from 'gone' (the connection dropped), which is what cello_receive turns into "call
+     *  cello_close_session". It is daemon-local and is NOT the relay's SessionLiveness wire type. */
+    liveness: "alive" | "impaired" | "gone" | "unknown";
     /** DOD-SESSION-NAME-1: this agent's own label for the session; null when unnamed. */
     sessionName: string | null;
+    /**
+     * DOD-M12B-SEAL-STUCK-1 — whether this session can be sealed. See SealReadinessView.
+     *
+     * A chain with a gap cannot be co-signed, so the close refuses — correctly. But until this field
+     * existed the condition was only discoverable by ATTEMPTING a close on each session and reading
+     * the refusal, so 25 unsealable sessions accumulated on one daemon with every surface calling
+     * them ordinary active sessions, while each held a slot against the per-sender cap.
+     */
+    sealReadiness: SealReadinessView;
     /** DOD-FRONTIER-STRAND-1 AC3 — see SessionListEntry.frontierMismatch. Declared here because
      *  buildInterruptedSessions returns THIS type; it typechecked only because TS exempts spread
      *  properties from excess-property checking, so a renderer typed as this could not read it. */
@@ -419,6 +468,19 @@ export interface InterruptedSessionInfo {
     interruptedAt: string;
     /** DOD-SESSION-NAME-1: this agent's own label for the session; null when unnamed. */
     sessionName: string | null;
+    /**
+     * DOD-M12B-SEAL-STUCK-1 — whether this session can be sealed. See SealReadinessView.
+     *
+     * An interrupted session can seal (that is what seal-interrupted is for), so it can also be
+     * BLOCKED from sealing by a gap. `frontierMismatch` beside this reports a different, later
+     * condition: the two sides have already exchanged and disagreed. This one is the gap on OUR side,
+     * knowable before any exchange, and it is the more common of the two.
+     *
+     * A PLAIN PROPERTY, not optional — matching the active list. The optional form was built with a
+     * spread, which bypasses excess-property checking, and that is exactly how `frontierMismatch`
+     * four lines down came to typecheck while no renderer could read it.
+     */
+    sealReadiness: SealReadinessView;
 }
 /**
  * cello_sessions: one session in the discovery list for the current agent.

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,EACb,eAAe,EAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAKrE,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAGtC,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,GAC5B,CAAC;AAGF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAI3D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,eAAe,CAAC;AAIrD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAG,uBAAgC,CAAC;AAI7E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,UAAU,GAClB,aAAa,GACb,cAAc,GACd,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,QAAQ,CAAC;AAEb,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;AAE5E,MAAM,WAAW,cAAc;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAID,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,cAAc,GAAG,MAAM,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,CAAC;IAIpB;;;;OAIG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,oBAAoB,EAAE,sBAAsB,EAAE,CAAC;IAC/C;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;CACtC;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACvC,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;mGAE+F;IAC/F,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IAC/C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,2BAA2B,EAAE,mBAAmB,CAAC;IAC7E;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,kBAAkB,EAAE,MAAM,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,MAAM,CAAC;IACtC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,qBAAqB,CAAC;IACvC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,2BAA2B,EAAE,sBAAsB,CAAC;CACpF;AAID;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,0BAA0B,GAI1B,WAAW,CAAC;AAEhB,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,kBAAkB,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IAEF,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAID,eAAO,MAAM,UAAU;;;;;;;;;;CAUb,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,EACb,eAAe,EAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAKrE,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAGtC,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,GAC5B,CAAC;AAGF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAI3D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,eAAe,CAAC;AAIrD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAG,uBAAgC,CAAC;AAI7E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,UAAU,GAClB,aAAa,GACb,cAAc,GACd,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,QAAQ,CAAC;AAEb,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;AAE5E,MAAM,WAAW,cAAc;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAID,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,cAAc,GAAG,MAAM,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,CAAC;IAIpB;;;;OAIG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,oBAAoB,EAAE,sBAAsB,EAAE,CAAC;IAC/C;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;CACtC;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAClB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjG;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;qGAGiG;IACjG,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IACpD,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;OAOG;IACH,aAAa,EAAE,iBAAiB,CAAC;IACjC;;mGAE+F;IAC/F,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IAC/C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,2BAA2B,EAAE,mBAAmB,CAAC;IAC7E;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,kBAAkB,EAAE,MAAM,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,MAAM,CAAC;IACtC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,qBAAqB,CAAC;IACvC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,2BAA2B,EAAE,sBAAsB,CAAC;CACpF;AAID;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,0BAA0B,GAI1B,WAAW,CAAC;AAEhB,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,iBAAiB,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,kBAAkB,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IAEF,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAID,eAAO,MAAM,UAAU;;;;;;;;;;CAUb,CAAC"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgFH,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAgC,CAAC;AAyU7E,6BAA6B;AAE7B;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAmIpC,sBAAsB;AAEtB,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,yBAAyB,EAAE,2BAA2B;IACtD,yBAAyB,EAAE,2BAA2B;IACtD,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,6BAA6B,EAAE,+BAA+B;IAC9D,8BAA8B,EAAE,gCAAgC;IAChE,oBAAoB,EAAE,sBAAsB;IAC5C,4BAA4B,EAAE,8BAA8B;IAC5D,6BAA6B,EAAE,+BAA+B;CACtD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgFH,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAgC,CAAC;AAqX7E,6BAA6B;AAE7B;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAgJpC,sBAAsB;AAEtB,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,yBAAyB,EAAE,2BAA2B;IACtD,yBAAyB,EAAE,2BAA2B;IACtD,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,6BAA6B,EAAE,+BAA+B;IAC9D,8BAA8B,EAAE,gCAAgC;IAChE,oBAAoB,EAAE,sBAAsB;IAC5C,4BAA4B,EAAE,8BAA8B;IAC5D,6BAA6B,EAAE,+BAA+B;CACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cello-protocol/daemon",
-  "version": "0.0.168",
+  "version": "0.0.170",
   "private": false,
   "type": "module",
   "engines": {
@@ -35,10 +35,10 @@
     "@signalapp/sqlcipher": "^3.3.5",
     "cbor-x": "^1.6.0",
     "it-length-prefixed": "^10.0.1",
-    "@cello-protocol/crypto": "0.0.50",
-    "@cello-protocol/gateway": "0.0.34",
-    "@cello-protocol/protocol-types": "0.0.54",
-    "@cello-protocol/transport": "0.0.56"
+    "@cello-protocol/crypto": "0.0.52",
+    "@cello-protocol/protocol-types": "0.0.56",
+    "@cello-protocol/gateway": "0.0.36",
+    "@cello-protocol/transport": "0.0.58"
   },
   "devDependencies": {
     "@types/node": "^25.6.2",

package/dist/delivery-sweep-bound.d.ts

@@ -1,79 +0,0 @@
-/**
- * DOD-MP-SWEEP-ALIVE-1 — bound one agent's delivery pass so a hang cannot end delivery.
- *
- * ── WHY THIS EXISTS ───────────────────────────────────────────────────────────────────────────
- *
- * The daemon's sweep is guarded against overlap by a boolean released in the `finally` of an async
- * body. That release runs only when the body SETTLES. A throw is covered — there is a `catch` and
- * the `finally` still runs. **An await that never settles is not covered at all.**
- *
- * So one hung pass wedges the guard for the life of the process: the interval keeps firing, hits
- * `if (running) return`, and emits nothing. No log line, no error, no counter — while every
- * document edit sits undelivered and the document reports healthy on both sides.
- *
- * Observed live 2026-08-13: last completed sweep `17:06:28`; delivery work carrying a `dlv-`
- * correlation id at `17:07:38`; no sweep ever completed again. The peer daemon, same build, one
- * agent, swept on schedule throughout — so the hang is state-dependent, not a general code break.
- *
- * ── WHY IT BOUNDS THE CLASS, NOT THE INSTANCE ─────────────────────────────────────────────────
- *
- * `acquireSession` ends in `await deps.openSession(...)` with no timeout of its own, which makes it
- * the candidate. It is only a candidate: nothing in the log records which await hung. Closing just
- * that one would be a guess wearing a fix's clothes, and the wedge would survive anywhere else it
- * can happen. Bounding the pass holds however the hang arises.
- *
- * The bound does NOT cancel the hung work — it cannot; a promise has no abort. It stops the SWEEP
- * from waiting on it, so the remaining agents are swept and the next tick proceeds. A wedged agent
- * degrades alone and loudly, which is the fan-out-availability doctrine applied to the sweep
- * itself: one unreachable participant must never take the others down with it.
- *
- * ── THE BOUND ALONE IS NOT ENOUGH ─────────────────────────────────────────────────────────────
- *
- * `DocumentDelivery.tick` carries the IDENTICAL defect one layer down: it caches its pass in
- * `#inFlight` and clears it in a `finally`. So after a hang, every later tick for that agent
- * returns the SAME already-hung promise — the agent never delivers again, and each pass re-races it
- * for the full bound, which doubles the sweep interval for every healthy agent on the daemon.
- * Bounding without evicting therefore trades a silent outage for a slower one. `sweepAgentEvicting`
- * below drops the wedged worker so the next tick constructs a fresh one and re-enters the pass.
- *
- * Evicting cannot double-send: the pass claims each row (`recordHolderAttempt`) BEFORE it dials, so
- * anything the hung pass was holding is already scheduled into the future and is not due.
- *
- * ── ONE LOAD-BEARING CONSTRAINT, STATED WHERE IT BINDS ────────────────────────────────────────
- *
- * `setTimeout` inside a `Promise.race` is safe here ONLY because the daemon's `stop()` does not
- * await the in-flight sweep. If anyone restores that await, a race whose timer never fires during a
- * draining loop can hang shutdown — see the shutdown note in daemon.ts.
- */
-export interface BoundedPassDeps {
-    logger: {
-        warn(event: string, ctx: Record<string, unknown>): void;
-    };
-    /** How long one agent's pass may run before it is declared stuck. */
-    timeoutMs: number;
-    /** Named in the log line — an operator needs to know WHICH agent stopped delivering. */
-    agentName: string;
-}
-export type BoundedPassResult<T> = {
-    completed: true;
-    value: T;
-} | {
-    completed: false;
-};
-export declare function runAgentPassBounded<T>(deps: BoundedPassDeps, run: () => Promise<T>): Promise<BoundedPassResult<T>>;
-/**
- * One agent's pass, bounded AND evicted on a wedge.
- *
- * Separated from `runAgentPassBounded` because eviction needs the worker registry, and separated
- * from the daemon because the daemon's sweep cannot be constructed in a test — which is exactly why
- * the call site went uncovered while the helper beneath it was well tested.
- */
-export interface EvictingSweepDeps<T> extends BoundedPassDeps {
-    /** The per-agent worker registry. The wedged entry is dropped so the next tick builds a fresh one. */
-    workers: {
-        delete(agentName: string): unknown;
-    };
-    run: () => Promise<T>;
-}
-export declare function sweepAgentEvicting<T>(deps: EvictingSweepDeps<T>): Promise<BoundedPassResult<T>>;
-//# sourceMappingURL=delivery-sweep-bound.d.ts.map

package/dist/delivery-sweep-bound.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delivery-sweep-bound.d.ts","sourceRoot":"","sources":["../src/delivery-sweep-bound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE;QAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;IACpE,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAkD/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,CAAE,SAAQ,eAAe;IAC3D,sGAAsG;IACtG,OAAO,EAAE;QAAE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAChD,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;CACvB;AAED,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQ/B"}

package/dist/delivery-sweep-bound.js

@@ -1,109 +0,0 @@
-/**
- * DOD-MP-SWEEP-ALIVE-1 — bound one agent's delivery pass so a hang cannot end delivery.
- *
- * ── WHY THIS EXISTS ───────────────────────────────────────────────────────────────────────────
- *
- * The daemon's sweep is guarded against overlap by a boolean released in the `finally` of an async
- * body. That release runs only when the body SETTLES. A throw is covered — there is a `catch` and
- * the `finally` still runs. **An await that never settles is not covered at all.**
- *
- * So one hung pass wedges the guard for the life of the process: the interval keeps firing, hits
- * `if (running) return`, and emits nothing. No log line, no error, no counter — while every
- * document edit sits undelivered and the document reports healthy on both sides.
- *
- * Observed live 2026-08-13: last completed sweep `17:06:28`; delivery work carrying a `dlv-`
- * correlation id at `17:07:38`; no sweep ever completed again. The peer daemon, same build, one
- * agent, swept on schedule throughout — so the hang is state-dependent, not a general code break.
- *
- * ── WHY IT BOUNDS THE CLASS, NOT THE INSTANCE ─────────────────────────────────────────────────
- *
- * `acquireSession` ends in `await deps.openSession(...)` with no timeout of its own, which makes it
- * the candidate. It is only a candidate: nothing in the log records which await hung. Closing just
- * that one would be a guess wearing a fix's clothes, and the wedge would survive anywhere else it
- * can happen. Bounding the pass holds however the hang arises.
- *
- * The bound does NOT cancel the hung work — it cannot; a promise has no abort. It stops the SWEEP
- * from waiting on it, so the remaining agents are swept and the next tick proceeds. A wedged agent
- * degrades alone and loudly, which is the fan-out-availability doctrine applied to the sweep
- * itself: one unreachable participant must never take the others down with it.
- *
- * ── THE BOUND ALONE IS NOT ENOUGH ─────────────────────────────────────────────────────────────
- *
- * `DocumentDelivery.tick` carries the IDENTICAL defect one layer down: it caches its pass in
- * `#inFlight` and clears it in a `finally`. So after a hang, every later tick for that agent
- * returns the SAME already-hung promise — the agent never delivers again, and each pass re-races it
- * for the full bound, which doubles the sweep interval for every healthy agent on the daemon.
- * Bounding without evicting therefore trades a silent outage for a slower one. `sweepAgentEvicting`
- * below drops the wedged worker so the next tick constructs a fresh one and re-enters the pass.
- *
- * Evicting cannot double-send: the pass claims each row (`recordHolderAttempt`) BEFORE it dials, so
- * anything the hung pass was holding is already scheduled into the future and is not due.
- *
- * ── ONE LOAD-BEARING CONSTRAINT, STATED WHERE IT BINDS ────────────────────────────────────────
- *
- * `setTimeout` inside a `Promise.race` is safe here ONLY because the daemon's `stop()` does not
- * await the in-flight sweep. If anyone restores that await, a race whose timer never fires during a
- * draining loop can hang shutdown — see the shutdown note in daemon.ts.
- */
-export async function runAgentPassBounded(deps, run) {
-    let timer;
-    /** Set the moment the bound wins — the only state that makes a later rejection 'late'. */
-    let abandoned = false;
-    const bound = new Promise((resolve) => {
-        timer = setTimeout(() => {
-            abandoned = true;
-            deps.logger.warn("document.delivery.pass.stuck", {
-                agentName: deps.agentName,
-                timeoutMs: deps.timeoutMs,
-                // ACCURATE ABOUT RECOVERY. This said "until it clears", and it did not clear: the worker
-                // cached the hung pass and handed it back forever. It is true only because the caller now
-                // evicts the worker, so say what actually happens next rather than implying patience.
-                impact: "this agent's delivery pass did not finish, so the sweep stopped waiting for it and " +
-                    "dropped the worker — a fresh pass starts on the next tick. Repeats mean the dial " +
-                    "underneath is hanging, not that the pass is merely slow",
-            });
-            resolve({ completed: false });
-        }, deps.timeoutMs);
-        // Never hold the process open on account of the bound itself.
-        timer.unref?.();
-    });
-    try {
-        // A THROW PROPAGATES. Containment lives in the caller, which already logs
-        // `document.delivery.tick.failed` and releases its guard; swallowing it here would silently
-        // delete that reporting and make a failing pass indistinguishable from a healthy one.
-        const attempt = run();
-        // THE LOSING BRANCH IS STILL WATCHED. If a pass the sweep GAVE UP ON eventually rejects, the
-        // settled race absorbs it and the error is logged nowhere — discarding the single best piece of
-        // evidence about WHICH await hung, on a defect whose root cause is explicitly not established.
-        //
-        // ONLY WHEN IT IS ACTUALLY LATE. A pass that throws while the race is still pending propagates
-        // to the caller, which logs it; reporting that here too would double-report an ordinary failure
-        // and blunt the one event that means something unusual happened.
-        attempt.catch((err) => {
-            if (!abandoned)
-                return;
-            deps.logger.warn("document.delivery.pass.late_failure", {
-                agentName: deps.agentName,
-                reason: err instanceof Error ? err.message : String(err),
-                impact: "a pass the sweep had already given up on failed afterwards",
-            });
-        });
-        return await Promise.race([attempt.then((value) => ({ completed: true, value })), bound]);
-    }
-    finally {
-        // Cleared on EVERY exit, including the throw. Left armed, each pass would pin a timer per agent
-        // per tick for the life of a process whose whole purpose is to keep running.
-        if (timer !== undefined)
-            clearTimeout(timer);
-    }
-}
-export async function sweepAgentEvicting(deps) {
-    const outcome = await runAgentPassBounded(deps, deps.run);
-    if (!outcome.completed) {
-        // WITHOUT THIS the agent is finished: its worker keeps handing back the same hung promise, so
-        // it never delivers again and every future pass pays the full bound waiting for it.
-        deps.workers.delete(deps.agentName);
-    }
-    return outcome;
-}
-//# sourceMappingURL=delivery-sweep-bound.js.map

package/dist/delivery-sweep-bound.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delivery-sweep-bound.js","sourceRoot":"","sources":["../src/delivery-sweep-bound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAYH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAqB,EACrB,GAAqB;IAErB,IAAI,KAAgD,CAAC;IACrD,0FAA0F;IAC1F,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,EAAE;QAC1D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,yFAAyF;gBACzF,0FAA0F;gBAC1F,sFAAsF;gBACtF,MAAM,EACJ,qFAAqF;oBACrF,mFAAmF;oBACnF,yDAAyD;aAC5D,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,8DAA8D;QAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,0EAA0E;QAC1E,4FAA4F;QAC5F,sFAAsF;QACtF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,6FAA6F;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,iEAAiE;QACjE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC7B,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBACtD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,MAAM,EAAE,4DAA4D;aACrE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACrG,CAAC;YAAS,CAAC;QACT,gGAAgG;QAChG,6EAA6E;QAC7E,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,8FAA8F;QAC9F,oFAAoF;QACpF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/document-ack-inbound.d.ts

@@ -1,71 +0,0 @@
-/**
- * DOD-DOC-INBOUND-2 — consuming an arriving ACK. This is what closes DELIVERY-2's loop.
- *
- * Without it a sent envelope's outcome is `admitted: null` forever: the worker knows the content
- * left and nothing more, so it re-sends on the ack timeout and eventually stalls the document at
- * the unacked ceiling.
- *
- * ── EVERY CHECK HERE GUARDS ONE OF TWO IRREVERSIBLE CONSEQUENCES ──────────────────────────────
- *
- * An ack SETTLES an envelope. Admitted, it stops being redelivered; rejected, the sender rolls back
- * local work and supersedes. Both are things an unauthenticated party must not be able to cause, so
- * the order is:
- *
- *   1. DECODE            — refuse malformed input before interpreting any of it.
- *   2. KNOW the document — an ack for a document we do not hold settles nothing that exists.
- *   3. ACKER is the peer — a document is a pairwise agreement; nobody else's answer settles it.
- *   4. VERIFY            — before any write. An unsigned ack that silenced a delivery would drop
- *                          the content from the pending set with neither operator ever learning it
- *                          was never applied — the silent divergence the two-layer design exists to
- *                          prevent.
- *   5. THE ENVELOPE IS OURS — we authored it, and it is in the log. An ack for a peer-authored
- *                          envelope settles a delivery that was never ours to make; an ack for an
- *                          envelope that is not there is a bug or a probe, and recording it would
- *                          put a claim about a nonexistent delivery into a permanent record.
- *   6. SETTLE            — mark acked; on a rejection also record it durably on the publishing side,
- *                          because an operator needs to know WHY their work was refused after a
- *                          restart, not merely that it was.
- */
-import type { DocumentStore } from "./document-store.js";
-import type { DocumentRejections } from "./document-rejection.js";
-import type { Logger } from "./types.js";
-export type AckInboundResult = {
-    ok: true;
-    admitted: boolean;
-    envelopeHash: string;
-} | {
-    ok: false;
-    reason: string;
-    detail: string;
-};
-export interface DocumentAckInboundDeps {
-    store: DocumentStore;
-    rejections: DocumentRejections;
-    logger: Logger;
-    /**
-     * Verify the ack signature against `acker_agent_id`. INJECTED and REQUIRED — this module cannot
-     * resolve an agent id to a public key, and a default would be a default answer to the one
-     * question that must never have one.
-     */
-    verifySignature(ackerAgentId: string, tbs: Uint8Array, signature: Uint8Array): boolean;
-    /**
-     * M14B / FANOUT-1 — the CURRENT derived holders, or null when the chain does not derive.
-     * Null is the bilateral-legacy answer: only then does the genesis-peer clause stand alone.
-     * When the chain DERIVES, membership is the whole gate — a removed genesis peer's ack must
-     * refuse (review H2: `doc.peerAgentId` is a genesis fact that outlives the arrangement).
-     */
-    currentHolders(ownerAgentId: string, documentId: string): string[] | null;
-    /**
-     * Called once an envelope is SETTLED — admitted or rejected, both of which end the delivery.
-     *
-     * Exists so the sender can stop holding a session open waiting for an answer that has arrived.
-     * Optional because settling is complete without it; nothing here depends on anyone listening.
-     */
-    onSettled?(ownerAgentId: string, envelopeHash: string, ackerAgentId: string, admitted: boolean): void;
-}
-export declare class DocumentAckInbound {
-    #private;
-    constructor(deps: DocumentAckInboundDeps);
-    receive(ownerAgentId: string, wire: Uint8Array, nowMs: number, correlationId?: string): AckInboundResult;
-}
-//# sourceMappingURL=document-ack-inbound.d.ts.map

package/dist/document-ack-inbound.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-ack-inbound.d.ts","sourceRoot":"","sources":["../src/document-ack-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC;IACvF;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1E;;;;;OAKG;IACH,SAAS,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;CACvG;AAED,qBAAa,kBAAkB;;gBAGjB,IAAI,EAAE,sBAAsB;IAIxC,OAAO,CACL,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,SAAQ,GACpB,gBAAgB;CAwKpB"}

package/dist/document-ack-inbound.js

@@ -1,210 +0,0 @@
-/**
- * DOD-DOC-INBOUND-2 — consuming an arriving ACK. This is what closes DELIVERY-2's loop.
- *
- * Without it a sent envelope's outcome is `admitted: null` forever: the worker knows the content
- * left and nothing more, so it re-sends on the ack timeout and eventually stalls the document at
- * the unacked ceiling.
- *
- * ── EVERY CHECK HERE GUARDS ONE OF TWO IRREVERSIBLE CONSEQUENCES ──────────────────────────────
- *
- * An ack SETTLES an envelope. Admitted, it stops being redelivered; rejected, the sender rolls back
- * local work and supersedes. Both are things an unauthenticated party must not be able to cause, so
- * the order is:
- *
- *   1. DECODE            — refuse malformed input before interpreting any of it.
- *   2. KNOW the document — an ack for a document we do not hold settles nothing that exists.
- *   3. ACKER is the peer — a document is a pairwise agreement; nobody else's answer settles it.
- *   4. VERIFY            — before any write. An unsigned ack that silenced a delivery would drop
- *                          the content from the pending set with neither operator ever learning it
- *                          was never applied — the silent divergence the two-layer design exists to
- *                          prevent.
- *   5. THE ENVELOPE IS OURS — we authored it, and it is in the log. An ack for a peer-authored
- *                          envelope settles a delivery that was never ours to make; an ack for an
- *                          envelope that is not there is a bug or a probe, and recording it would
- *                          put a claim about a nonexistent delivery into a permanent record.
- *   6. SETTLE            — mark acked; on a rejection also record it durably on the publishing side,
- *                          because an operator needs to know WHY their work was refused after a
- *                          restart, not merely that it was.
- */
-import { decodeDocumentAck, buildDocumentAckTbs } from "@cello-protocol/protocol-types";
-export class DocumentAckInbound {
-    #d;
-    constructor(deps) {
-        this.#d = deps;
-    }
-    receive(ownerAgentId, wire, nowMs, correlationId = "ack") {
-        // 1. DECODE.
-        let ack;
-        try {
-            ack = decodeDocumentAck(wire);
-        }
-        catch (err) {
-            const detail = err instanceof Error ? err.message : String(err);
-            this.#d.logger.warn("document.ack.malformed", { detail, correlationId });
-            // One reason code with the upstream message in the detail — the decoder's named refusals and
-            // raw CBOR errors both arrive here, and building a code out of the message turns the second
-            // kind into English prose nothing can match on.
-            return { ok: false, reason: "document_ack_malformed", detail };
-        }
-        // 2. KNOW the document.
-        const doc = this.#d.store.getDocument(ownerAgentId, ack.document_id);
-        if (!doc) {
-            return {
-                ok: false,
-                reason: "document_unknown",
-                detail: `no document ${ack.document_id.slice(0, 16)}… for this agent`,
-            };
-        }
-        // 3. The acker must be a party. When the chain DERIVES, derived membership is the WHOLE
-        // gate — a removed genesis peer's ack refuses like any outsider's (review H2). Only when the
-        // chain cannot answer (bilateral legacy, no genesis record) does the genesis-peer column
-        // stand in.
-        const holders = this.#d.currentHolders(ownerAgentId, ack.document_id);
-        const isParty = holders === null
-            ? ack.acker_agent_id === doc.peerAgentId
-            : holders.includes(ack.acker_agent_id);
-        if (!isParty) {
-            this.#d.logger.warn("document.ack.not_peer", {
-                documentId: ack.document_id,
-                ackerAgentId: ack.acker_agent_id,
-                peerAgentId: doc.peerAgentId,
-                correlationId,
-            });
-            return {
-                ok: false,
-                reason: "document_ack_not_peer",
-                // The peer's identity is not disclosed to a party that has not authenticated.
-                detail: "you are not a party to this document",
-            };
-        }
-        // 4. VERIFY, before any write.
-        if (!this.#d.verifySignature(ack.acker_agent_id, buildDocumentAckTbs(ack), ack.signature)) {
-            this.#d.logger.error("document.ack.signature_invalid", {
-                documentId: ack.document_id,
-                ackerAgentId: ack.acker_agent_id,
-                envelopeHash: ack.envelope_hash,
-                correlationId,
-            });
-            return {
-                ok: false,
-                reason: "document_ack_signature_invalid",
-                detail: `the ack claims to come from ${ack.acker_agent_id} but its signature does not verify ` +
-                    `against that agent — nothing was settled`,
-            };
-        }
-        // 5. The envelope must be one WE authored, and it must exist.
-        const row = this.#d.store
-            .getEnvelopeLog(ownerAgentId, ack.document_id)
-            .find((e) => e.envelopeHash === ack.envelope_hash);
-        if (!row) {
-            return {
-                ok: false,
-                reason: "document_ack_envelope_unknown",
-                detail: `envelope ${ack.envelope_hash.slice(0, 16)}… is not in this document's log`,
-            };
-        }
-        if (row.senderAgentId !== ownerAgentId) {
-            return {
-                ok: false,
-                reason: "document_ack_not_author",
-                detail: `envelope ${ack.envelope_hash.slice(0, 16)}… was authored by ${row.senderAgentId}, not by ` +
-                    `you — there is no delivery of ours for this ack to settle`,
-            };
-        }
-        // 6. SETTLE ONCE. The wire type's own header states this contract: nothing binds an ack to the
-        // acker's chain, so one acker can produce a valid ADMISSION and a valid REJECTION for the same
-        // envelope. Applying the later one would let a peer that admitted an envelope later claim it
-        // refused it — and the sender would roll back work the peer already holds. A second,
-        // CONTRADICTING ack is an error; a second identical one is an ordinary redelivery.
-        // SETTLE-ONCE, PER ACKER (review M4). The envelope-level column stays null until ALL
-        // holders answer, so an envelope-scoped check let a holder that ADMITTED later send a
-        // REJECTION mid-fan-out — processed, rounds advanced, work rolled back that they already
-        // hold. The acker's own per-holder row is the record; the envelope-level check remains only
-        // for the zero-row bilateral legacy.
-        const holderPrior = this.#d.store.holderSettlement(ownerAgentId, ack.envelope_hash, ack.acker_agent_id);
-        const alreadyAcked = holderPrior !== null || row.ackedAtMs != null;
-        if (alreadyAcked) {
-            // ENVELOPE-scoped. The document-scoped reader answers a different question, and using it
-            // here would make a rejection of any OTHER envelope in this document read as a rejection of
-            // this one — so an honest redelivered admission would be refused as a contradiction the
-            // moment anything else in the document had ever been refused.
-            const previouslyRejected = holderPrior !== null
-                ? !holderPrior.admitted
-                : this.#d.store.rejectionReceivedFor(ownerAgentId, ack.document_id, ack.envelope_hash);
-            const contradicts = ack.admitted === previouslyRejected;
-            if (contradicts) {
-                this.#d.logger.error("document.ack.contradiction", {
-                    documentId: ack.document_id,
-                    envelopeHash: ack.envelope_hash,
-                    ackerAgentId: ack.acker_agent_id,
-                    nowSays: ack.admitted ? "admitted" : "rejected",
-                    correlationId,
-                });
-                return {
-                    ok: false,
-                    reason: "document_ack_contradiction",
-                    detail: `${ack.acker_agent_id} already settled envelope ${ack.envelope_hash.slice(0, 16)}… and ` +
-                        `now says the opposite — this envelope stays settled as it was, and both claims are ` +
-                        `retained`,
-                };
-            }
-            // An identical redelivery. Nothing to do, and nothing to complain about.
-            return { ok: true, admitted: ack.admitted, envelopeHash: ack.envelope_hash };
-        }
-        // FANOUT-1: the ACKING HOLDER settles THEIR row; the envelope-level record follows the ONE
-        // deterministic terminal rule (`reconcileEnvelopeSettlement` — review M3), identical from
-        // every reconciliation site. Bilateral legacy (zero rows) stays byte-identical: the
-        // reconcile no-ops and markAcked below still runs through it.
-        this.#d.store.ackHolderDelivery(ownerAgentId, ack.document_id, ack.envelope_hash, ack.acker_agent_id, nowMs);
-        const before = row.ackedAtMs != null;
-        this.#d.store.reconcileEnvelopeSettlement(ownerAgentId, ack.document_id, ack.envelope_hash, nowMs);
-        const legacy = this.#d.store.holderSettlement(ownerAgentId, ack.envelope_hash, ack.acker_agent_id) === null;
-        const first = legacy
-            ? this.#d.store.markAcked(ownerAgentId, ack.document_id, ack.envelope_hash, nowMs)
-            : !before;
-        // ANNOUNCE THE SETTLE, before the admitted/rejected split — both outcomes end the delivery, and
-        // a waiter that only heard about admissions would keep a session open through every rejection.
-        this.#d.onSettled?.(ownerAgentId, ack.envelope_hash, ack.acker_agent_id, ack.admitted);
-        if (!ack.admitted) {
-            // Durable on the publishing side. A log line would not survive the restart after which the
-            // operator asks why their work never landed — and this is also what bounds the retry on the
-            // side that actually loops.
-            this.#d.rejections.recordIncomingRejection(ownerAgentId, ack.document_id, {
-                rejectionEnvelopeHash: ackRecordHash(ack.envelope_hash),
-                rejectedEnvelopeHash: ack.envelope_hash,
-                reason: ack.rejection_reason ?? "document_rejected",
-                fromAgentId: ack.acker_agent_id,
-            });
-            return { ok: true, admitted: false, envelopeHash: ack.envelope_hash };
-        }
-        this.#d.logger.info("document.ack.admitted", {
-            documentId: ack.document_id,
-            envelopeHash: ack.envelope_hash,
-            firstAck: first,
-            correlationId,
-        });
-        return { ok: true, admitted: true, envelopeHash: ack.envelope_hash };
-    }
-}
-/**
- * The identity of the RECEIVED-rejection row: the REFUSED ENVELOPE, and nothing else.
- *
- * ONE REFUSED ENVELOPE IS ONE ROUND, however many acks for it arrive.
- *
- * This used to mix in the acker's `acked_at_ms` on the reasoning that both fields are signed, so a
- * redelivered ack would collapse onto the same row. That reasoning had a false premise: acks are
- * not stored and redelivered — `sendAck` builds a fresh `DocumentAck` with `acked_at_ms: Date.now()`
- * every time it answers. So two acks for the SAME envelope carried two different timestamps and
- * became two rows, advancing the round twice.
- *
- * That is not hypothetical. Delivery re-sends on a 1s first backoff, so an ordinary in-flight
- * overlap — the sender re-sends while the first ack is still on the wire, both land — produced two
- * rounds from one refusal. `MAX_REJECTED_ROUNDS` is 3, so routine delivery overlap could stall a
- * shared document with no hostility involved. That is the same denial of service the 5b
- * already-rejected guard in `document-inbound.ts` was written to close, arriving through the other
- * side of the same loop.
- */
-function ackRecordHash(envelopeHash) {
-    return envelopeHash;
-}
-//# sourceMappingURL=document-ack-inbound.js.map