@cello-protocol/daemon 0.0.181 → 0.0.182

package/dist/backup-restore.d.ts

@@ -0,0 +1,102 @@
+/**
+ * DOD-M15-BACKUP-1 — export an agent's identity, and put it back on another machine.
+ *
+ * ─── What a backup has to contain, and why the obvious answer is wrong ─────────────────────────
+ *
+ * The DoD line says *"Backup = exporting the SQLCipher database for transport."* Exporting the
+ * database alone produces a file nobody can ever open.
+ *
+ * The database is encrypted and its key is a separate 32-byte file at `<db>.key` — `sqlcipher-db.ts`
+ * calls it "the ONE plaintext key file on disk". A fresh daemon on a new machine mints its own key,
+ * which cannot open a database encrypted under a different one. An operator restoring a
+ * database-only archive would be told it worked, and find out on the day they needed it that the
+ * contents are unreadable forever.
+ *
+ * So the archive carries BOTH, and the round-trip test restores into a directory holding a
+ * different key precisely to prove it.
+ *
+ * ─── The consequence of that, which the tool must say out loud ─────────────────────────────────
+ *
+ * A file containing that key IS the agent. Whoever holds it can sign as them, read every
+ * transcript, and use their identity. Nothing about the word "backup" suggests a file this
+ * dangerous, so the response says it at the moment one is written. `DOD-M15-CLAIM-SCREEN-1`'s rule
+ * applies to affordances as much as claims: silence is not an option.
+ *
+ * ─── Why `VACUUM INTO` rather than copying the file ────────────────────────────────────────────
+ *
+ * The daemon holds the database open with a write lock. Copying the file byte-for-byte while it is
+ * open can capture a torn page or miss a WAL frame, producing an archive that restores into a
+ * corrupt database — the worst outcome available here, because it looks like a successful backup.
+ * `VACUUM INTO` asks SQLite for a consistent snapshot, and on SQLCipher the target inherits the
+ * source's cipher settings, so the snapshot is encrypted under the same key.
+ *
+ * ─── Restore is validated in full BEFORE anything is touched ───────────────────────────────────
+ *
+ * Restore OVERWRITES. A truncated or wrong file that is accepted destroys the working agent the
+ * operator still had — the backup tool becomes the thing that loses the identity. So the container
+ * is parsed, its checksum verified and its payloads decompressed entirely in memory first; only
+ * then does anything reach the disk.
+ *
+ * ─── V1 scope, per the DoD ─────────────────────────────────────────────────────────────────────
+ *
+ * Export plus overwrite-restore. MERGE — restoring onto a device that has its own live state — is
+ * explicitly deferred, and this module does not pretend otherwise: restore replaces, and says so.
+ */
+import type { Logger } from "./types.js";
+export type BackupResult = {
+    ok: true;
+    path: string;
+    bytes: number;
+    guidance: string;
+} | {
+    ok: false;
+    reason: string;
+    guidance: string;
+};
+export type RestoreResult = {
+    ok: true;
+    dbPath: string;
+    guidance: string;
+} | {
+    ok: false;
+    reason: string;
+    guidance: string;
+};
+/**
+ * Take a consistent snapshot of the live database and write a portable archive.
+ *
+ * `dbPath` is the live database. It may be open in this process; `VACUUM INTO` is safe against that
+ * and is why the snapshot goes through SQLite rather than a file copy.
+ */
+export declare function createBackup(opts: {
+    dbPath: string;
+    outPath: string;
+    logger: Logger;
+    keyPath?: string;
+    /** A backup is not a scratch file: replacing one is deliberate, never incidental. */
+    overwrite?: boolean;
+}): Promise<BackupResult>;
+/** Read an archive's metadata without restoring it. */
+export declare function inspectBackup(archivePath: string): Promise<{
+    ok: true;
+    createdAt: number;
+    hasKey: boolean;
+    dbBytes: number;
+} | {
+    ok: false;
+    reason: string;
+}>;
+/**
+ * Replace this machine's database and key with the archive's.
+ *
+ * OVERWRITE, not merge — merge is explicitly deferred, and pretending otherwise would silently pick
+ * a winner between two divergent histories. The caller is responsible for the daemon not holding
+ * the database open; the handler enforces that.
+ */
+export declare function restoreBackup(opts: {
+    archivePath: string;
+    dbPath: string;
+    logger: Logger;
+    keyPath?: string;
+}): Promise<RestoreResult>;
+//# sourceMappingURL=backup-restore.d.ts.map

package/dist/backup-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-restore.d.ts","sourceRoot":"","sources":["../src/backup-restore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAQH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAoCzC,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAYpD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0FxB;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAS5G;AA0DD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CA6FzB"}

package/dist/backup-restore.js

@@ -0,0 +1,340 @@
+/**
+ * DOD-M15-BACKUP-1 — export an agent's identity, and put it back on another machine.
+ *
+ * ─── What a backup has to contain, and why the obvious answer is wrong ─────────────────────────
+ *
+ * The DoD line says *"Backup = exporting the SQLCipher database for transport."* Exporting the
+ * database alone produces a file nobody can ever open.
+ *
+ * The database is encrypted and its key is a separate 32-byte file at `<db>.key` — `sqlcipher-db.ts`
+ * calls it "the ONE plaintext key file on disk". A fresh daemon on a new machine mints its own key,
+ * which cannot open a database encrypted under a different one. An operator restoring a
+ * database-only archive would be told it worked, and find out on the day they needed it that the
+ * contents are unreadable forever.
+ *
+ * So the archive carries BOTH, and the round-trip test restores into a directory holding a
+ * different key precisely to prove it.
+ *
+ * ─── The consequence of that, which the tool must say out loud ─────────────────────────────────
+ *
+ * A file containing that key IS the agent. Whoever holds it can sign as them, read every
+ * transcript, and use their identity. Nothing about the word "backup" suggests a file this
+ * dangerous, so the response says it at the moment one is written. `DOD-M15-CLAIM-SCREEN-1`'s rule
+ * applies to affordances as much as claims: silence is not an option.
+ *
+ * ─── Why `VACUUM INTO` rather than copying the file ────────────────────────────────────────────
+ *
+ * The daemon holds the database open with a write lock. Copying the file byte-for-byte while it is
+ * open can capture a torn page or miss a WAL frame, producing an archive that restores into a
+ * corrupt database — the worst outcome available here, because it looks like a successful backup.
+ * `VACUUM INTO` asks SQLite for a consistent snapshot, and on SQLCipher the target inherits the
+ * source's cipher settings, so the snapshot is encrypted under the same key.
+ *
+ * ─── Restore is validated in full BEFORE anything is touched ───────────────────────────────────
+ *
+ * Restore OVERWRITES. A truncated or wrong file that is accepted destroys the working agent the
+ * operator still had — the backup tool becomes the thing that loses the identity. So the container
+ * is parsed, its checksum verified and its payloads decompressed entirely in memory first; only
+ * then does anything reach the disk.
+ *
+ * ─── V1 scope, per the DoD ─────────────────────────────────────────────────────────────────────
+ *
+ * Export plus overwrite-restore. MERGE — restoring onto a device that has its own live state — is
+ * explicitly deferred, and this module does not pretend otherwise: restore replaces, and says so.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { gzipSync, gunzipSync } from "node:zlib";
+import { readFile, writeFile, rm, mkdir, chmod, open as fsOpen, rename } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { openEncryptedDatabase, dbKeyPathFor } from "./sqlcipher-db.js";
+/**
+ * Write 0600, fsync, rename — and fsync the directory so the rename itself survives a power loss.
+ *
+ * Restore OVERWRITES an identity. A partially written database is the one failure that opens and is
+ * WRONG rather than failing loudly, because page 1 is enough for `sqlite_master` to read. Rename is
+ * atomic: the path is either the old file or the whole new one.
+ */
+async function writeFileDurably(path, bytes) {
+    const tmp = `${path}.restore-${randomBytes(6).toString("hex")}`;
+    const fh = await fsOpen(tmp, "wx", 0o600);
+    try {
+        await fh.write(bytes);
+        await fh.sync();
+    }
+    finally {
+        await fh.close();
+    }
+    await rename(tmp, path);
+    const dir = await fsOpen(dirname(path), "r");
+    try {
+        await dir.sync();
+    }
+    finally {
+        await dir.close();
+    }
+}
+/** Magic + version, so a wrong file is refused by shape before anything else is attempted. */
+const MAGIC = "CELLO-BACKUP-v1";
+/**
+ * THE SENSITIVITY NOTICE. One string, used by every path that writes an archive, so a second call
+ * site cannot ship a quieter version of it.
+ */
+const SENSITIVITY = "TREAT THIS FILE LIKE A PRIVATE KEY. It contains your agent's encrypted database AND the key that " +
+    "opens it, because a backup without the key restores to something nobody can read. Anyone who has " +
+    "this file can sign as your agent and read every transcript in it. Store it where you would store " +
+    "a private key — not a shared drive, not a chat message.";
+/**
+ * Take a consistent snapshot of the live database and write a portable archive.
+ *
+ * `dbPath` is the live database. It may be open in this process; `VACUUM INTO` is safe against that
+ * and is why the snapshot goes through SQLite rather than a file copy.
+ */
+export async function createBackup(opts) {
+    const keyPath = opts.keyPath ?? dbKeyPathFor(opts.dbPath);
+    if (!existsSync(opts.dbPath)) {
+        return {
+            ok: false,
+            reason: "database_not_found",
+            guidance: `No database at ${opts.dbPath}. Start the daemon at least once before taking a backup — there is no identity to export yet.`,
+        };
+    }
+    if (!existsSync(keyPath)) {
+        // Refused rather than exported-without-key: an archive that cannot be opened is worse than no
+        // archive, because the operator stops worrying about it.
+        return {
+            ok: false,
+            reason: "key_file_not_found",
+            guidance: `The database at ${opts.dbPath} has no key file at ${keyPath}. Exporting the database without it would produce a backup nobody can ever open, so nothing was written.`,
+        };
+    }
+    if (existsSync(opts.outPath) && opts.overwrite !== true) {
+        return {
+            ok: false,
+            reason: "archive_exists",
+            guidance: `${opts.outPath} already exists. Replacing a backup silently is a way to lose an identity while believing you hold two copies of it — pass overwrite to replace it deliberately, or choose another path.`,
+        };
+    }
+    // A snapshot beside the real database, then read and discard it. `VACUUM INTO` refuses to write
+    // to an existing path, so the name is fresh per call.
+    // BESIDE THE ARCHIVE, not in the shared temp dir (review F11). On macOS `$TMPDIR` is per-user
+    // 0700, but on Linux it is `/tmp` and SQLite creates the snapshot at `0644 & ~umask`. The contents
+    // are encrypted — verified empirically, the header is ciphertext and it is unopenable without the
+    // key — so that is ciphertext exposure rather than key exposure. It is still a full copy of the
+    // database, and the `finally` below only covers throws: a SIGKILL mid-backup would leave it there.
+    const snapshot = join(dirname(opts.outPath), `.cello-backup-snapshot-${randomBytes(8).toString("hex")}.db`);
+    try {
+        const key = await readFile(keyPath);
+        const db = openEncryptedDatabase(opts.dbPath, new Uint8Array(key));
+        try {
+            db.exec(`VACUUM INTO '${snapshot.replace(/'/g, "''")}'`);
+        }
+        finally {
+            db.close();
+        }
+        const dbBytes = await readFile(snapshot);
+        const envelope = {
+            magic: MAGIC,
+            version: 1,
+            created_at: Date.now(),
+            db_sha256: createHash("sha256").update(dbBytes).digest("hex"),
+            db_b64: dbBytes.toString("base64"),
+            key_b64: key.toString("base64"),
+        };
+        const packed = gzipSync(Buffer.from(JSON.stringify(envelope), "utf8"));
+        await writeFile(opts.outPath, packed, { mode: 0o600 });
+        /**
+         * CHMOD AFTER THE WRITE, because `mode` is honoured only at `O_CREAT` — review F5, measured on
+         * this machine:
+         *
+         *     existing 0644 file + writeFile(mode 0600)  →  still 0644
+         *     existing 0666 file + writeFile(mode 0600)  →  still 0666
+         *     fresh file                                  →  0600
+         *
+         * So the `--force` path — overwriting yesterday's archive — kept whatever mode was already
+         * there. A file that arrived at 0644 (scp, a shell redirect under umask 022, an iCloud
+         * round-trip) would hold a WORLD-READABLE plaintext signing key. The comment claimed the
+         * property; only the create path enforced it.
+         */
+        await chmod(opts.outPath, 0o600);
+        opts.logger.info("agent.backup.written", {
+            path: opts.outPath,
+            bytes: packed.length,
+            impact: "the agent's identity, key shares, contacts, transcripts and seals are now exportable to another machine",
+            guidance: SENSITIVITY,
+        });
+        return { ok: true, path: opts.outPath, bytes: packed.length, guidance: SENSITIVITY };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        opts.logger.error("agent.backup.failed", { path: opts.outPath, reason });
+        return {
+            ok: false,
+            reason: "backup_failed",
+            guidance: `The backup could not be written: ${reason}. Nothing was changed on this machine.`,
+        };
+    }
+    finally {
+        await rm(snapshot, { force: true }).catch(() => { });
+    }
+}
+/** Read an archive's metadata without restoring it. */
+export async function inspectBackup(archivePath) {
+    const parsed = await parseArchive(archivePath);
+    if (!parsed.ok)
+        return { ok: false, reason: parsed.reason };
+    return {
+        ok: true,
+        createdAt: parsed.envelope.created_at,
+        hasKey: parsed.envelope.key_b64.length > 0,
+        dbBytes: parsed.dbBytes.length,
+    };
+}
+/**
+ * Parse and FULLY VALIDATE an archive in memory.
+ *
+ * Everything that can fail happens here, before `restoreBackup` touches the disk. That ordering is
+ * the whole safety property: a restore that fails must leave the machine exactly as it was.
+ */
+async function parseArchive(archivePath) {
+    if (!existsSync(archivePath))
+        return { ok: false, reason: "archive_not_found" };
+    let raw;
+    try {
+        raw = await readFile(archivePath);
+    }
+    catch (err) {
+        return { ok: false, reason: `archive_unreadable: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    let json;
+    try {
+        json = gunzipSync(raw).toString("utf8");
+    }
+    catch {
+        // A truncated file usually dies here — gzip carries its own length and CRC, which is why the
+        // container is compressed rather than raw JSON.
+        return { ok: false, reason: "archive_corrupt_or_not_a_cello_backup" };
+    }
+    let envelope;
+    try {
+        envelope = JSON.parse(json);
+    }
+    catch {
+        return { ok: false, reason: "archive_corrupt_or_not_a_cello_backup" };
+    }
+    if (envelope.magic !== MAGIC || envelope.version !== 1) {
+        return { ok: false, reason: "archive_wrong_format_or_version" };
+    }
+    if (typeof envelope.db_b64 !== "string" || typeof envelope.key_b64 !== "string") {
+        return { ok: false, reason: "archive_missing_payload" };
+    }
+    const dbBytes = Buffer.from(envelope.db_b64, "base64");
+    const keyBytes = Buffer.from(envelope.key_b64, "base64");
+    if (dbBytes.length === 0)
+        return { ok: false, reason: "archive_missing_database" };
+    if (keyBytes.length !== 32) {
+        // Without a well-formed key the restored database is unopenable — the exact failure this unit
+        // exists to prevent, so it is refused rather than restored hopefully.
+        return { ok: false, reason: "archive_missing_or_malformed_key" };
+    }
+    const actual = createHash("sha256").update(dbBytes).digest("hex");
+    if (actual !== envelope.db_sha256)
+        return { ok: false, reason: "archive_checksum_mismatch" };
+    return { ok: true, envelope, dbBytes, keyBytes };
+}
+/**
+ * Replace this machine's database and key with the archive's.
+ *
+ * OVERWRITE, not merge — merge is explicitly deferred, and pretending otherwise would silently pick
+ * a winner between two divergent histories. The caller is responsible for the daemon not holding
+ * the database open; the handler enforces that.
+ */
+export async function restoreBackup(opts) {
+    const keyPath = opts.keyPath ?? dbKeyPathFor(opts.dbPath);
+    const parsed = await parseArchive(opts.archivePath);
+    if (!parsed.ok) {
+        opts.logger.error("agent.restore.refused", {
+            archivePath: opts.archivePath,
+            reason: parsed.reason,
+            impact: "nothing was written — the agent currently on this machine is untouched",
+        });
+        return {
+            ok: false,
+            reason: parsed.reason,
+            guidance: `That file was not restored: ${parsed.reason}. NOTHING on this machine was changed — the ` +
+                `archive is validated completely before anything is written, because a restore overwrites ` +
+                `and a bad archive must never be able to destroy the agent you still have.`,
+        };
+    }
+    try {
+        // 0700, matching `resolveDbKey`'s own mkdir. On a fresh machine THIS is what creates the CELLO
+        // directory, and it holds a signing key (review F12).
+        await mkdir(dirname(opts.dbPath), { recursive: true, mode: 0o700 });
+        /**
+         * ORDER AND ATOMICITY — review F6/F7, and the previous comment here had it backwards.
+         *
+         * It said "key first, because a database without its key is the unopenable state". On a machine
+         * that ALREADY has an agent that is true but harmless — a key/db mismatch throws
+         * `db_encryption_key_mismatch`, loudly, and re-running the restore fixes it.
+         *
+         * On a FRESH machine — the actual restore use case — key-first is the dangerous order. Crash
+         * between the two writes and the key is present with NO database, so `resolveDbKey` loads the
+         * key and SQLCipher CREATES A FRESH EMPTY ONE. The daemon boots clean with zero agents and says
+         * nothing. That is the only crash state that opens, is wrong, and is silent.
+         *
+         * Worse, a crash MID-write left a truncated database whose page 1 was present, so
+         * `sqlite_master` read and the open SUCCEEDED against a partial file.
+         *
+         * Both are closed by writing to a temp sibling, fsync'ing, and renaming — rename is atomic, so
+         * the file either is the old one or is the whole new one, never half. The sidecars go first:
+         * stale WAL frames encrypted under the OLD key must not be present when the new database
+         * appears. Then the database, then the key — so the surviving crash state is db-present /
+         * key-absent, which `resolveDbKey` refuses loudly by design.
+         *
+         * The key write is fsync'd for the reason `sqlcipher-db.ts` gives where it writes the same file:
+         * "so a crash right after a fresh install can't lose the key while the encrypted DB exists".
+         * Returning ok:true with the key only in page cache re-opens that hole.
+         */
+        await rm(`${opts.dbPath}-wal`, { force: true }).catch(() => { });
+        await rm(`${opts.dbPath}-shm`, { force: true }).catch(() => { });
+        await writeFileDurably(opts.dbPath, parsed.dbBytes);
+        await writeFileDurably(keyPath, parsed.keyBytes);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        opts.logger.error("agent.restore.failed", { archivePath: opts.archivePath, reason });
+        return {
+            ok: false,
+            reason: "restore_write_failed",
+            guidance: `The restore could not complete: ${reason}. The database may be in a partial state — restore again from the same archive before starting the daemon.`,
+        };
+    }
+    // Prove it opens, here, rather than letting the daemon discover it at next boot.
+    try {
+        const db = openEncryptedDatabase(opts.dbPath, new Uint8Array(parsed.keyBytes));
+        db.close();
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        opts.logger.error("agent.restore.unopenable", { dbPath: opts.dbPath, reason });
+        return {
+            ok: false,
+            reason: "restored_database_unopenable",
+            guidance: `The archive was written but the restored database could not be opened: ${reason}. This should not happen — the archive carries its own key. Keep the archive and report it.`,
+        };
+    }
+    const createdAt = new Date(parsed.envelope.created_at).toISOString();
+    opts.logger.info("agent.restore.completed", {
+        dbPath: opts.dbPath,
+        backupCreatedAt: createdAt,
+        impact: "this machine's agent database and key were REPLACED by the archive's",
+    });
+    return {
+        ok: true,
+        dbPath: opts.dbPath,
+        guidance: `Restored from a backup taken ${createdAt}. This machine's previous agent database was ` +
+            `REPLACED, not merged — anything that happened here since that backup is gone. Restart the ` +
+            `daemon (cello logout && cello login) so it opens the restored database.`,
+    };
+}
+//# sourceMappingURL=backup-restore.js.map

package/dist/backup-restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-restore.js","sourceRoot":"","sources":["../src/backup-restore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGxE;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACzD,MAAM,GAAG,GAAG,GAAG,IAAI,YAAY,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC;QAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAC1D,CAAC;AAED,8FAA8F;AAC9F,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAoBhC;;;GAGG;AACH,MAAM,WAAW,GACf,mGAAmG;IACnG,mGAAmG;IACnG,mGAAmG;IACnG,yDAAyD,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAOlC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,QAAQ,EAAE,kBAAkB,IAAI,CAAC,MAAM,+FAA+F;SACvI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,8FAA8F;QAC9F,yDAAyD;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,QAAQ,EAAE,mBAAmB,IAAI,CAAC,MAAM,uBAAuB,OAAO,0GAA0G;SACjL,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,0LAA0L;SACpN,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,sDAAsD;IACtD,8FAA8F;IAC9F,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,0BAA0B,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAmB;YAC/B,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAChC,CAAC;QAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD;;;;;;;;;;;;WAYG;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YACvC,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,MAAM,EAAE,yGAAyG;YACjH,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACvF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,oCAAoC,MAAM,wCAAwC;SAC7F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAqB,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACrC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,WAAmB;IAEnB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEhF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,gDAAgD;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,QAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3B,8FAA8F;QAC9F,sEAAsE;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,QAAQ,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAE7F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAKnC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;YACzC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,wEAAwE;SACjF,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EACN,+BAA+B,MAAM,CAAC,MAAM,8CAA8C;gBAC1F,2FAA2F;gBAC3F,2EAA2E;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,+FAA+F;QAC/F,sDAAsD;QACtD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChE,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EAAE,mCAAmC,MAAM,4GAA4G;SAChK,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/E,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8BAA8B;YACtC,QAAQ,EAAE,0EAA0E,MAAM,6FAA6F;SACxL,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,SAAS;QAC1B,MAAM,EAAE,sEAAsE;KAC/E,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EACN,gCAAgC,SAAS,+CAA+C;YACxF,4FAA4F;YAC5F,yEAAyE;KAC5E,CAAC;AACJ,CAAC"}

package/dist/bin/cello-daemon.js

@@ -92,6 +92,16 @@ async function startSecurityLayer(correlationId) {
             },
         });
         logger.info("security.gateway.spawned", { pid: sidecar.pid ?? -1, socketPath, ...(correlationId !== undefined ? { correlationId } : {}) });
+        // WHETHER THE SEMANTIC LAYER IS RUNNING, in the daemon log, at every boot.
+        //
+        // `mode: "enforcing"` on the next line says the gateway is REACHABLE, not that it judges
+        // meaning — and for every shipped build before daemon 0.0.181 it judged none, while reporting
+        // exactly that. This is the line that makes the difference legible, and `off:` carries the
+        // reason so the answer to "why" is in the same place as the answer to "whether".
+        logger.info("security.gateway.layer2", {
+            state: sidecar.layer2,
+            ...(correlationId !== undefined ? { correlationId } : {}),
+        });
         sidecar.process.once("exit", (code, signal) => {
             // No auto-restart (M9B-D14). Every subsequent screen fails closed with a real cause; this
             // line is how the operator learns the screening process died rather than inferring it from
@@ -173,7 +183,87 @@ async function main() {
         if (!restarted.sidecar)
             throw new Error("the screening process did not come back up");
     };
-    const handle = await startDaemon({
+    /**
+     * ⚠️ THE SIGNAL HANDLERS ARE REGISTERED BEFORE `startDaemon` IS AWAITED, AND THE ORDER IS THE BUG.
+     *
+     * `daemon.started` is logged INSIDE `startDaemon` (`daemon.ts`), and the handlers used to be
+     * registered ~50 lines BELOW the `await` that resolves it. So between the daemon announcing it had
+     * started and it being able to handle a shutdown, there was a window in which **SIGTERM's default
+     * action kills the process** — no handler, no `handle.stop()`, no `UPDATE sessions SET status =
+     * 'interrupted'`. The daemon dies claiming nothing and every active session stays `active`.
+     *
+     * ⚠️ THIS IS A PRODUCTION DEFECT, NOT A TEST ARTIFACT, and it is worth being explicit because it
+     * was found through a test. Anything that starts the daemon and stops it promptly — `systemctl
+     * stop` on a slow boot, a supervisor restarting a flapping unit, an operator hitting Ctrl-C
+     * because startup looked stuck — lands in that window. The sessions are then indistinguishable
+     * from ones abandoned mid-conversation, which is the state `interrupted` exists to prevent.
+     *
+     * HOW IT WAS FOUND, because the route matters: `AC-009` failed twice in CI, passed locally twice,
+     * and its message could not say why. Instrumenting both sides — `rowsMarkedInterrupted` on the
+     * daemon, and refusing to treat `code === null` as a clean exit in the test — produced, on the
+     * very next run: *"Daemon was KILLED by SIGTERM rather than exiting — the SIGTERM handler never
+     * ran."* Not a WAL snapshot race, which is what it had been attributed to and "fixed" as once.
+     *
+     * A signal arriving during startup now WAITS for startup to finish and then shuts down properly,
+     * rather than being dropped. The alternative — exiting immediately — would be the same data loss
+     * with a tidier exit code.
+     */
+    let handle = null;
+    let startupFailed = false;
+    const shutdown = async (signal) => {
+        if (!handle) {
+            // The signal beat startup. Wait for it rather than dying with sessions still marked active —
+            // this is the window that produced the defect above.
+            logger.info("daemon.shutdown.awaiting_startup", {
+                signal,
+                impact: "the signal arrived before startup finished. Waiting for it so sessions are marked interrupted rather than left active by a daemon that died before it could handle a shutdown.",
+            });
+            const deadline = Date.now() + 30_000;
+            while (!handle && !startupFailed && Date.now() < deadline) {
+                await new Promise((r) => setTimeout(r, 25));
+            }
+            if (!handle) {
+                logger.error("daemon.shutdown.startup_never_completed", {
+                    signal,
+                    startupFailed,
+                    impact: "the daemon is exiting without marking any session interrupted, because startup never produced a handle to stop. Sessions left 'active' in the database were not touched by this process.",
+                    guidance: "Check the lines above for why startup did not complete — a singleton-lock loss, a security-gateway failure, or a manifest refusal all land here.",
+                });
+                process.exit(1);
+            }
+        }
+        // handle.stop() runs onShutdown (stopSecurityLayer) for us — the teardown lives there so that
+        // `cello logout`, which stops the daemon over IPC and never reaches this handler, tears the
+        // sidecar down too.
+        //
+        // DOD-LOGOUT-EXIT-1: stop()'s onStopped hook exits, so this await does not return while the
+        // hook is wired below — the line after is unreachable in the shipped binary. It is kept so that
+        // removing the hook cannot silently produce a signal path that never exits, which is the state
+        // the IPC path was in before this unit.
+        await handle.stop(signal);
+        process.exit(0);
+    };
+    const onSignal = (signal) => () => {
+        try {
+            shutdown(signal).catch((err) => {
+                logger.error("daemon.shutdown.failed", {
+                    signal,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                process.exit(1);
+            });
+        }
+        catch (err) {
+            logger.error("daemon.shutdown.failed", {
+                signal,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            process.exit(1);
+        }
+    };
+    process.on("SIGTERM", onSignal("SIGTERM"));
+    process.on("SIGINT", onSignal("SIGINT"));
+    handle = await startDaemon({
         celloDir,
         socketPath,
         lockFilePath,
@@ -208,54 +298,6 @@ async function main() {
         registryPubkey: REGISTRY_SIGNER_PUBKEY,
         registryPollScheduler: new RandomizedPollScheduler({ minMs: REGISTRY_POLL_MIN_MS, maxMs: REGISTRY_POLL_MAX_MS }),
     });
-    const shutdown = async (signal) => {
-        // handle.stop() runs onShutdown (stopSecurityLayer) for us — the teardown lives there so that
-        // `cello logout`, which stops the daemon over IPC and never reaches this handler, tears the
-        // sidecar down too.
-        //
-        // DOD-LOGOUT-EXIT-1: stop()'s onStopped hook exits, so this await does not return while the
-        // hook is wired above — the line below is unreachable in the shipped binary. It is kept so that
-        // removing the hook cannot silently produce a signal path that never exits, which is the state
-        // the IPC path was in before this unit.
-        await handle.stop(signal);
-        process.exit(0);
-    };
-    process.on("SIGTERM", () => {
-        try {
-            shutdown("SIGTERM").catch((err) => {
-                logger.error("daemon.shutdown.failed", {
-                    signal: "SIGTERM",
-                    error: err instanceof Error ? err.message : String(err),
-                });
-                process.exit(1);
-            });
-        }
-        catch (err) {
-            logger.error("daemon.shutdown.failed", {
-                signal: "SIGTERM",
-                error: err instanceof Error ? err.message : String(err),
-            });
-            process.exit(1);
-        }
-    });
-    process.on("SIGINT", () => {
-        try {
-            shutdown("SIGINT").catch((err) => {
-                logger.error("daemon.shutdown.failed", {
-                    signal: "SIGINT",
-                    error: err instanceof Error ? err.message : String(err),
-                });
-                process.exit(1);
-            });
-        }
-        catch (err) {
-            logger.error("daemon.shutdown.failed", {
-                signal: "SIGINT",
-                error: err instanceof Error ? err.message : String(err),
-            });
-            process.exit(1);
-        }
-    });
 }
 main().catch((err) => {
     // DOD-SINGLE-DAEMON-1 (AC2): losing the singleton race is not a crash — it is the system working.