@cello-protocol/daemon 0.0.171 → 0.0.172

package/dist/daemon.js

@@ -29,6 +29,7 @@ import { mkdir } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { loadAgents } from "./agent-loader.js";
+import { RestartSealResolver } from "./restart-seal-resolver.js";
 import { acquireLock, removeLockIfOwned } from "./lock-file.js";
 import { acquireSingletonLock } from "./singleton-lock.js";
 import { createIpcServer } from "./ipc-server.js";
@@ -276,6 +277,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // classification (INV-TYPE-CARRY). Absent pubkey = polling disabled, all types unclassified.
     const typeRegistry = new TypeRegistry();
     let stopRegistryPoll;
+    // DOD-M12B-RESTART-SEAL-1: assigned as the last act of boot, stopped in stop().
+    let restartSealResolver;
     if (config.registryPubkey && config.registryPollScheduler) {
         const registryVersionStore = new DbRegistryVersionStore(sessionNodeManager.getDb(), logger);
         stopRegistryPoll = startRegistryPoll({
@@ -4003,6 +4006,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
         if (config.registryPollScheduler) {
             config.registryPollScheduler.cancel();
         }
+        // DOD-M12B-RESTART-SEAL-1: stop opening directory ceremonies. A seal is the most outbound thing
+        // this daemon does, and DOD-M12B-SHUTDOWN-1's rule is that a shutdown which keeps starting new
+        // outbound work is not draining. Above the `daemon.stopped` log with the other cancels, because
+        // this is "stop making new work", not "tear down transports".
+        await restartSealResolver?.stop();
         logger.info("daemon.stopped", { pid: process.pid, reason });
         // DOD-LOGOUT-EXIT-1: what the teardown actually DID, carried to onStopped so the binary can
         // exit non-zero on a dirty stop. Without it a shutdown that threw halfway — sessions never
@@ -4101,6 +4109,57 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // M8C-TGDOOR-1: cold-capable — start the poller if a token was already configured from a
     // prior run, without waiting for any agent to come online or any client to attach.
     startTelegramPollerIfConfigured();
+    // DOD-M12B-RESTART-SEAL-1: seal the sessions the LAST shutdown orphaned.
+    //
+    // 114 of 118 interrupted sessions on one operator's machine were flipped by our own shutdown
+    // sweep and then sat there, because nothing has ever moved a session out of `interrupted`. Their
+    // only exit was a force-abandon, which forfeits the notarized receipt.
+    //
+    // Started last, like the Telegram poller, and resolved LAZILY out of the live `handlers` map: the
+    // close handler is registered far earlier, but reading it inside the callback is what lets a test
+    // swap it after boot and prove this wiring exists rather than assume it.
+    restartSealResolver = new RestartSealResolver({
+        logger,
+        listRestartOrphans: () => sessionNodeManager.listRestartOrphanedSessions(),
+        ...(config.restartSealInitialDelayMs !== undefined
+            ? { initialDelayMs: config.restartSealInitialDelayMs }
+            : {}),
+        ...(config.restartSealStaggerMs !== undefined ? { staggerMs: config.restartSealStaggerMs } : {}),
+        sealSession: async (agentName, sessionId) => {
+            const close = handlers.get("cello_close_session");
+            if (!close)
+                return { ok: false, reason: "close_handler_missing" };
+            const res = (await close({ session_id: sessionId, agent: agentName }, `restart-seal-${sessionId}`));
+            // SUCCESS IS A RECEIPT, NOT AN `ok`. The interrupted close answers `ok: true` for a bilateral
+            // COMMITMENT that nobody has notarized — `seal_interrupted_pending`, the status this resolver
+            // exists to stop producing. Reading `ok` as success logged "resolved" for 137 sessions that
+            // got no receipt at all. `sealed_root` is present only when a notarization actually happened.
+            if (typeof res?.["sealed_root"] === "string" && res["sealed_root"].length > 0) {
+                return { ok: true };
+            }
+            // Everything the close computed about WHY, carried instead of collapsed. `reason` is an exit
+            // point — `seal_interrupted_rejected_by_counterparty` alone stands for six distinct causes,
+            // and the close already put the discriminating detail on the response.
+            const detail = {};
+            for (const k of ["rejection_reason", "your_leaf_count", "their_leaf_count", "diverging_leaf_index",
+                "seal_pending_reason", "seal_receipt", "missing_leaves", "held_messages", "status"]) {
+                if (res?.[k] !== undefined)
+                    detail[k] = res[k];
+            }
+            const retry = res?.["retry_after_seconds"];
+            return {
+                ok: false,
+                reason: (typeof res?.["seal_pending_reason"] === "string" ? res["seal_pending_reason"] : undefined)
+                    ?? (typeof res?.["reason"] === "string" ? res["reason"] : undefined)
+                    ?? "close_returned_no_receipt",
+                ...(typeof retry === "number" ? { retryAfterSeconds: retry } : {}),
+                ...(typeof res?.["guidance"] === "string" ? { guidance: res["guidance"] } : {}),
+                ...(Object.keys(detail).length > 0 ? { detail } : {}),
+            };
+        },
+        markGaveUp: (agentName, sessionId, reason) => sessionNodeManager.markRestartSealGaveUp(agentName, sessionId, reason),
+    });
+    restartSealResolver.start();
     /**
      * The live handler map.
      *