@cello-protocol/daemon 0.0.170 → 0.0.172

package/dist/daemon.js

@@ -29,6 +29,7 @@ import { mkdir } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { loadAgents } from "./agent-loader.js";
+import { RestartSealResolver } from "./restart-seal-resolver.js";
 import { acquireLock, removeLockIfOwned } from "./lock-file.js";
 import { acquireSingletonLock } from "./singleton-lock.js";
 import { createIpcServer } from "./ipc-server.js";
@@ -276,6 +277,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // classification (INV-TYPE-CARRY). Absent pubkey = polling disabled, all types unclassified.
     const typeRegistry = new TypeRegistry();
     let stopRegistryPoll;
+    // DOD-M12B-RESTART-SEAL-1: assigned as the last act of boot, stopped in stop().
+    let restartSealResolver;
     if (config.registryPubkey && config.registryPollScheduler) {
         const registryVersionStore = new DbRegistryVersionStore(sessionNodeManager.getDb(), logger);
         stopRegistryPoll = startRegistryPoll({
@@ -1904,6 +1907,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
                 sessionName: row.session_name ?? null, // DOD-SESSION-NAME-1 (AC-A11)
                 sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
+                // DOD-M12B-CLOSE-SILENT-WAIT-1: both flows, because either can be the one blocking the
+                // operator's command — `pendingSealWaiters` is the active close, `sealInterruptedInProgress`
+                // the interrupted one.
+                sealing: pendingSealWaiters.has(sealKey(row.agent_name, row.session_id)) ||
+                    sealInterruptedInProgress.has(sealKey(row.agent_name, row.session_id)),
             };
         });
     }
@@ -3998,6 +4006,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
         if (config.registryPollScheduler) {
             config.registryPollScheduler.cancel();
         }
+        // DOD-M12B-RESTART-SEAL-1: stop opening directory ceremonies. A seal is the most outbound thing
+        // this daemon does, and DOD-M12B-SHUTDOWN-1's rule is that a shutdown which keeps starting new
+        // outbound work is not draining. Above the `daemon.stopped` log with the other cancels, because
+        // this is "stop making new work", not "tear down transports".
+        await restartSealResolver?.stop();
         logger.info("daemon.stopped", { pid: process.pid, reason });
         // DOD-LOGOUT-EXIT-1: what the teardown actually DID, carried to onStopped so the binary can
         // exit non-zero on a dirty stop. Without it a shutdown that threw halfway — sessions never
@@ -4096,6 +4109,57 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // M8C-TGDOOR-1: cold-capable — start the poller if a token was already configured from a
     // prior run, without waiting for any agent to come online or any client to attach.
     startTelegramPollerIfConfigured();
+    // DOD-M12B-RESTART-SEAL-1: seal the sessions the LAST shutdown orphaned.
+    //
+    // 114 of 118 interrupted sessions on one operator's machine were flipped by our own shutdown
+    // sweep and then sat there, because nothing has ever moved a session out of `interrupted`. Their
+    // only exit was a force-abandon, which forfeits the notarized receipt.
+    //
+    // Started last, like the Telegram poller, and resolved LAZILY out of the live `handlers` map: the
+    // close handler is registered far earlier, but reading it inside the callback is what lets a test
+    // swap it after boot and prove this wiring exists rather than assume it.
+    restartSealResolver = new RestartSealResolver({
+        logger,
+        listRestartOrphans: () => sessionNodeManager.listRestartOrphanedSessions(),
+        ...(config.restartSealInitialDelayMs !== undefined
+            ? { initialDelayMs: config.restartSealInitialDelayMs }
+            : {}),
+        ...(config.restartSealStaggerMs !== undefined ? { staggerMs: config.restartSealStaggerMs } : {}),
+        sealSession: async (agentName, sessionId) => {
+            const close = handlers.get("cello_close_session");
+            if (!close)
+                return { ok: false, reason: "close_handler_missing" };
+            const res = (await close({ session_id: sessionId, agent: agentName }, `restart-seal-${sessionId}`));
+            // SUCCESS IS A RECEIPT, NOT AN `ok`. The interrupted close answers `ok: true` for a bilateral
+            // COMMITMENT that nobody has notarized — `seal_interrupted_pending`, the status this resolver
+            // exists to stop producing. Reading `ok` as success logged "resolved" for 137 sessions that
+            // got no receipt at all. `sealed_root` is present only when a notarization actually happened.
+            if (typeof res?.["sealed_root"] === "string" && res["sealed_root"].length > 0) {
+                return { ok: true };
+            }
+            // Everything the close computed about WHY, carried instead of collapsed. `reason` is an exit
+            // point — `seal_interrupted_rejected_by_counterparty` alone stands for six distinct causes,
+            // and the close already put the discriminating detail on the response.
+            const detail = {};
+            for (const k of ["rejection_reason", "your_leaf_count", "their_leaf_count", "diverging_leaf_index",
+                "seal_pending_reason", "seal_receipt", "missing_leaves", "held_messages", "status"]) {
+                if (res?.[k] !== undefined)
+                    detail[k] = res[k];
+            }
+            const retry = res?.["retry_after_seconds"];
+            return {
+                ok: false,
+                reason: (typeof res?.["seal_pending_reason"] === "string" ? res["seal_pending_reason"] : undefined)
+                    ?? (typeof res?.["reason"] === "string" ? res["reason"] : undefined)
+                    ?? "close_returned_no_receipt",
+                ...(typeof retry === "number" ? { retryAfterSeconds: retry } : {}),
+                ...(typeof res?.["guidance"] === "string" ? { guidance: res["guidance"] } : {}),
+                ...(Object.keys(detail).length > 0 ? { detail } : {}),
+            };
+        },
+        markGaveUp: (agentName, sessionId, reason) => sessionNodeManager.markRestartSealGaveUp(agentName, sessionId, reason),
+    });
+    restartSealResolver.start();
     /**
      * The live handler map.
      *
@@ -4109,6 +4173,20 @@ async function startDaemonHoldingLock(config, singletonLock) {
      */
     const getHandlers = () => handlers;
     return {
+        /**
+         * DOD-M12B-CLOSE-SILENT-WAIT-1 test seam: put a session into the state a normal close sits in
+         * for up to eleven minutes, and emit the same start-of-wait line the close emits. Marks the
+         * REAL waiter map the status surface reads, so a test cannot pass against a flag production
+         * never sets.
+         */
+        markSealInFlightForTest(agentName, sessionId) {
+            const deadlineMs = Number(process.env["CELLO_SEAL_BILATERAL_TIMEOUT_MS"]) || 660_000;
+            pendingSealWaiters.set(sealKey(agentName, sessionId), () => { });
+            logger.warn("session.seal.awaiting_counterparty", {
+                sessionId, agentName, deadlineMs,
+                impact: `this close will not answer for up to ${Math.round(deadlineMs / 60_000)} minutes while it waits for the counterparty, then it escalates to a unilateral seal and produces a real receipt. It is working. Do NOT force-abandon it — that forfeits the receipt this wait is earning.`,
+            });
+        },
         stop, getStatus, getSessionNodeManager, getTransportSelector, getAutoNatService, getTypeRegistry,
         getHandlers,
     };