@cello-protocol/daemon 0.0.194 → 0.0.195

package/dist/held-content.d.ts

@@ -0,0 +1,141 @@
+/**
+ * CELLO Daemon — CONTENT WE HAVE BUT CANNOT SHOW YET
+ *
+ * Split out of `session-node-manager.ts` by 037-SESSIONCORE. A message that arrives out of order is
+ * verified and kept, not delivered: showing it would put the conversation in the wrong sequence, and
+ * dropping it would lose a message the sender believes landed. It is HELD until the gap ahead of it
+ * closes, then released down the path it came from.
+ *
+ * Moved verbatim, comments included.
+ *
+ * ⚠️ `origin` DECIDES THE RELEASE PATH, AND GETTING IT WRONG IS NOT COSMETIC. A held frame of OUR OWN
+ * must be released down the SENT path — appended and transcribed as sent. Releasing it down the
+ * received path would put our own words in the counterparty's mouth in the sealed record, and hand
+ * them back to our own agent through `cello_receive` as though they had just arrived.
+ */
+import type { Logger } from "./types.js";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { SessionQueries } from "./session-queries.js";
+import type { SessionRecords } from "./session-records.js";
+import type { SessionTree, WritableSessionTreeLeafKind } from "./session-tree.js";
+import type { SentAuthorship } from "./session-node-types.js";
+/** One piece of content held behind an ordering gap. */
+type HeldEntry = {
+    content: Uint8Array;
+    originalContent?: Uint8Array;
+    contentHashHex: string;
+    correlationId?: string;
+    screenedOut?: boolean;
+    origin?: "sent";
+    kind?: WritableSessionTreeLeafKind;
+    authorship?: SentAuthorship;
+    restoredAcrossRestart?: boolean;
+};
+/** What held content needs from the manager. */
+export interface HeldContentContext {
+    readonly logger: Logger;
+    readonly queries: SessionQueries;
+    readonly records: SessionRecords;
+    /** A function: the manager opens its database after construction. Re-exposed below as `#db`. */
+    db(): DaemonDatabase | null;
+    sessionKey(agentName: string, sessionId: string): string;
+    requireAgentId(agentName: string): string;
+    /**
+     * ⚠️ THE HELD MAP ITSELF, shared by reference rather than owned here — `ingestReceivedContent`,
+     * `placeOwnLeaf`, `sealReadiness` and `getUndeliverableSeqs` all read it and all stayed behind.
+     * Splitting the map would have meant two sources of truth for "what are we holding", which is
+     * worse than sharing one. It is only ever ASSIGNED once, at construction, so there is one Map
+     * object and no two-writer divergence.
+     */
+    readonly heldContent: Map<string, Map<number, HeldEntry>>;
+    readonly witnessedSeq: Map<string, Map<string, number>>;
+    getSessionTree(agentName: string, sessionId: string): SessionTree;
+    appendSessionLeaf(agentName: string, sessionId: string, kind: WritableSessionTreeLeafKind, leafHashHex: string, correlationId?: string): {
+        leafIndex: number;
+        newRootHex: string;
+    };
+    appendVerifiedContent(agentName: string, sessionId: string, content: Uint8Array, contentHashHex: string, senderPubkey: string, correlationId?: string, originalContent?: Uint8Array, verifiedAuthorship?: {
+        senderPubkey: Uint8Array;
+        senderSig: Uint8Array;
+    }): {
+        leafIndex: number;
+    };
+}
+export declare class HeldContent {
+    #private;
+    constructor(ctx: HeldContentContext);
+    /** M8C-ABUSE-1 (reviewer HIGH fix, D18): bytes currently sitting in the out-of-order hold
+     *  buffer for this session — NOT yet committed leaves, but real bytes in memory that would
+     *  otherwise let multiple held chunks each individually pass the size gate while cumulatively
+     *  exceeding it once #releaseHeld drains them. */
+    getHeldBytesTotal(agentName: string, sessionId: string): number;
+    /**
+     * DOD-M12B-STRAND-1 — restore this session's held frames into memory.
+     *
+     * Called when a session node is (re)created, which is the moment the session becomes able to
+     * append again. Loading at daemon boot instead would be wrong for the same reason the old code
+     * was wrong: a frame is only releasable against a tree, and the tree is loaded per session.
+     *
+     * A frame whose content the tree ALREADY HOLDS at that position is dropped — re-appending it
+     * would change the root a seal signs over. That test is `hashAt`, not `canonical_seq < frontier`:
+     * the two counters are different spaces and this file documents them drifting, so the index
+     * comparison alone would destroy a frame the tree never held. See the drift branch below.
+     */
+    ensureHeldRestored(agentName: string, sessionId: string, opts?: {
+        release?: boolean;
+    }): void;
+    restoreHeldContent(agentName: string, sessionId: string): void;
+    /**
+     * DOD-MSG-4: drain held out-of-order content in canonical order. After a leaf is appended, any
+     * held entry whose canonical sequence equals the new next-expected index is now in order — append
+     * it, then check again (a single fill can release a run of consecutive held messages).
+     */
+    releaseHeld(agentName: string, sessionId: string, senderPubkey: string): number;
+    /**
+     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
+     *
+     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
+     * exists on this side and is not in the tree, while the counterparty already has it from the relay
+     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
+     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
+     * it.
+     */
+    holdOwnLeafForTest(agentName: string, sessionId: string, canonicalSeq: number, contentHashHex: string): void;
+    /**
+     * ⚠️ **ORPHANED COMMENT, OWNER UNKNOWN — do not attach it to the method below.** It reads
+     * *"@returns true iff the UPDATE was executed without error (a failed write is logged, never
+     * thrown)"*, and `annexHeldContentOnTerminal` returns `void` and runs no such UPDATE. It was
+     * already stranded in `session-node-manager.ts` before 037 moved this code, and Rule C carried it
+     * verbatim rather than dropping a sentence that is true of SOMETHING.
+     *
+     * Kept, marked, and NOT reattached: the nearest candidate by behaviour is
+     * `SessionQueries.markCounterpartyAbandoned`, which already has its own doc — so attaching it
+     * there on a guess is the same defect this marker exists to stop. Delete it only once its owner is
+     * identified, or reattach it then.
+     */
+    /**
+     * DOD-M12B-STRAND-1 — move a terminal session's held frames to the annex.
+     *
+     * A held frame is content this agent RECEIVED and VERIFIED. When its session ends it can never
+     * join that chain (appending behind a committed root is not an option, and ingest refuses a
+     * terminal session outright), but it is still the operator's mail and no other copy exists —
+     * the sender was never acknowledged for it. `sealed_session_annex` is where M12-P17 already puts
+     * content that arrives for an ended session; this is the same content arriving slightly earlier.
+     *
+     * ANNEX FIRST, DELETE SECOND, per row. A crash between them costs a duplicate the annex's
+     * INSERT OR IGNORE absorbs; the other order costs the message. A row whose annex write fails is
+     * KEPT — the retention sweep will find it again, and a leftover row is cheaper than a lost one.
+     */
+    annexHeldContentOnTerminal(agentName: string, sessionId: string, status: "sealed" | "abandoned"): void;
+    /**
+     * Forget the restore/release bookkeeping for a torn-down session.
+     *
+     * The held CONTENT itself is not dropped here — the map is shared and the manager's eviction still
+     * owns that line. What goes is this module's memory of whether a session was already hydrated from
+     * disk and already released, which must not survive a teardown: a revived session has to re-read
+     * from durable state rather than trust a flag about a process that is gone.
+     */
+    evictSession(agentName: string, sessionId: string): void;
+}
+export {};
+//# sourceMappingURL=held-content.d.ts.map

package/dist/held-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"held-content.d.ts","sourceRoot":"","sources":["../src/held-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D,wDAAwD;AACxD,KAAK,SAAS,GAAG;IACf,OAAO,EAAE,UAAU,CAAC;IAAC,eAAe,CAAC,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAClG,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC;IAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACxG,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,gGAAgG;IAChG,EAAE,IAAI,cAAc,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAClE,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,2BAA2B,EACjC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,UAAU,EAC5B,kBAAkB,CAAC,EAAE;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,GACvE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAED,qBAAa,WAAW;;gBAGV,GAAG,EAAE,kBAAkB;IAWnC;;;sDAGkD;IAClD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAW/D;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IA8B5F,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAsG9D;;;;OAIG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAuF/E;;;;;;;;OAQG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAM5G;;;;;;;;;;;OAWG;IACH;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,IAAI;IAkDtG;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;CAKzD"}

package/dist/held-content.js

@@ -0,0 +1,388 @@
+export class HeldContent {
+    #ctx;
+    constructor(ctx) {
+        this.#ctx = ctx;
+    }
+    /** A getter so the moved queries still read `this.#db` and narrow exactly as they did. */
+    get #db() {
+        return this.#ctx.db();
+    }
+    #heldRestored = new Set();
+    #heldReleased = new Set();
+    /** M8C-ABUSE-1 (reviewer HIGH fix, D18): bytes currently sitting in the out-of-order hold
+     *  buffer for this session — NOT yet committed leaves, but real bytes in memory that would
+     *  otherwise let multiple held chunks each individually pass the size gate while cumulatively
+     *  exceeding it once #releaseHeld drains them. */
+    getHeldBytesTotal(agentName, sessionId) {
+        // DOD-M12B-STRAND-1: hydrate first. Reading the Map before the durable holds are back
+        // under-counts, and this gate exists to stop several held chunks each passing the size cap
+        // individually while cumulatively exceeding it — an under-count is the bypass.
+        this.ensureHeldRestored(agentName, sessionId);
+        const held = this.#ctx.heldContent.get(this.#ctx.sessionKey(agentName, sessionId));
+        if (!held)
+            return 0;
+        let total = 0;
+        for (const entry of held.values())
+            total += entry.content.length;
+        return total;
+    }
+    /**
+     * DOD-M12B-STRAND-1 — restore this session's held frames into memory.
+     *
+     * Called when a session node is (re)created, which is the moment the session becomes able to
+     * append again. Loading at daemon boot instead would be wrong for the same reason the old code
+     * was wrong: a frame is only releasable against a tree, and the tree is loaded per session.
+     *
+     * A frame whose content the tree ALREADY HOLDS at that position is dropped — re-appending it
+     * would change the root a seal signs over. That test is `hashAt`, not `canonical_seq < frontier`:
+     * the two counters are different spaces and this file documents them drifting, so the index
+     * comparison alone would destroy a frame the tree never held. See the drift branch below.
+     */
+    ensureHeldRestored(agentName, sessionId, opts) {
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        if (!this.#heldRestored.has(key)) {
+            // Set BEFORE restoring, so the #ensureHeldRestored inside #releaseHeld below returns straight
+            // away instead of recursing.
+            this.#heldRestored.add(key);
+            this.restoreHeldContent(agentName, sessionId);
+        }
+        // A RESTORED FRAME MAY ALREADY BE IN ORDER, and nothing else would ever notice.
+        //
+        // #releaseHeld has one caller: the tail of a successful inbound ingest. Every other way the tree
+        // grows — an outbound send leaf, a queued or rejected leaf — advances the frontier without
+        // draining. While holds died with the session node that cost seconds; now the hold is durable,
+        // so the stall is durable too: the counterparty's message sits on disk at exactly the next slot,
+        // is never delivered, and `sealReadiness` counts it, so the session cannot close either.
+        // Undeliverable AND unsealable, forever, from one restart.
+        //
+        // TRACKED SEPARATELY FROM THE HYDRATION. A read-only caller (the status surface) hydrates and
+        // must NOT release — otherwise `cello status` appends leaves, advances the session root, writes
+        // transcript rows and rings the doorbell, which makes a diagnostic command the thing that
+        // delivers messages. One shared flag would also let that read CONSUME the release the next real
+        // ingest was going to perform, which is the stall above, reintroduced.
+        if (opts?.release === false)
+            return;
+        if (this.#heldReleased.has(key))
+            return;
+        this.#heldReleased.add(key);
+        if (this.#ctx.heldContent.get(key)?.size) {
+            const counterparty = this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
+            if (counterparty)
+                this.releaseHeld(agentName, sessionId, counterparty);
+        }
+    }
+    restoreHeldContent(agentName, sessionId) {
+        if (!this.#db)
+            return;
+        let rows;
+        try {
+            rows = this.#db.prepare(`SELECT canonical_seq, content_blob, original_blob, content_hash_hex, screened_out, correlation_id, origin, leaf_kind
+           FROM held_content WHERE agent_id = ? AND session_id = ? ORDER BY canonical_seq ASC`).all(this.#ctx.requireAgentId(agentName), sessionId);
+        }
+        catch (err) {
+            this.#ctx.logger.error("session.content.held.restore.failed", {
+                agentName, sessionId,
+                impact: "verified content held before the restart is not in memory and cannot be released",
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return;
+        }
+        if (rows.length === 0)
+            return;
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        let held = this.#ctx.heldContent.get(key);
+        if (!held) {
+            held = new Map();
+            this.#ctx.heldContent.set(key, held);
+        }
+        const tree = this.#ctx.getSessionTree(agentName, sessionId);
+        const frontier = tree.size();
+        let restored = 0;
+        let superseded = 0;
+        let drifted = 0;
+        for (const row of rows) {
+            // ASK THE TREE WHAT IS AT THAT POSITION — do not infer it from the index.
+            //
+            // `canonical_seq` is the RELAY's sequence space; `frontier` is this tree's msg-leaf count.
+            // The two drift, on purpose and by documented cases: the relay counts CTRL leaves the tree
+            // never appends, and a first message whose relay submit failed leaves the tree one ahead.
+            // Under drift `canonical_seq < frontier` is TRUE for a frame the tree has never held, and
+            // deleting on that comparison destroys verified content while reporting it as tidy-up —
+            // the exact failure this unit exists to end, reintroduced on the recovery path.
+            const occupant = tree.hashAt(row.canonical_seq);
+            if (occupant === row.content_hash_hex) {
+                this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
+                superseded++;
+                continue;
+            }
+            if (row.canonical_seq < frontier) {
+                // The position is taken by DIFFERENT content. The frame cannot be appended (that would
+                // rewrite a committed leaf) and must not be deleted (it is verified content nobody else
+                // holds), so it goes to the annex that exists for exactly this — content that arrived for
+                // a chain that can no longer carry it — and only then does the row go.
+                const annexed = this.#ctx.queries.recordSealedAnnex(agentName, sessionId, row.content_hash_hex, new Uint8Array(row.content_blob), 
+                // DOD-M12B-INDEX-1: our own held send is attributed to US, never to the counterparty.
+                row.origin === "sent"
+                    ? this.#ctx.queries.ownPubkeyHex(agentName)
+                    : this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey ?? null);
+                this.#ctx.logger.error("session.content.held.position_drifted", {
+                    agentName, sessionId, canonicalSeq: row.canonical_seq, frontier,
+                    contentHash: row.content_hash_hex, occupant, annexed,
+                    correlationId: row.correlation_id ?? undefined,
+                    impact: annexed
+                        ? "the relay's position for this frame is occupied by different content — it cannot join the chain and is readable only from the annex"
+                        : "the relay's position for this frame is occupied by different content AND the annex write failed — the durable row is kept rather than destroyed",
+                });
+                if (annexed)
+                    this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
+                drifted++;
+                continue;
+            }
+            held.set(row.canonical_seq, {
+                content: new Uint8Array(row.content_blob),
+                ...(row.original_blob ? { originalContent: new Uint8Array(row.original_blob) } : {}),
+                contentHashHex: row.content_hash_hex,
+                ...(row.correlation_id ? { correlationId: row.correlation_id } : {}),
+                ...(row.screened_out ? { screenedOut: true } : {}),
+                ...(row.origin === "sent" ? { origin: "sent" } : {}),
+                ...(row.leaf_kind === "doc" ? { kind: "doc" } : {}),
+                /**
+                 * ⚠️ `restoredAcrossRestart` EXISTS TO NAME A LOSS, NOT TO CHANGE BEHAVIOUR — review pass 2, H1.
+                 *
+                 * `held_content` has no authorship columns, so a SENT message held behind a gap and released
+                 * after a daemon restart comes back with **no signature** — its transcript row records
+                 * `self_authored` with no proof, indistinguishable from an unwitnessed send. That is the
+                 * defect bullet 5 exists to end, reappearing on the recovery path, and it was silent.
+                 *
+                 * The proof cannot be reconstructed here: it was made over Structure-1 bytes this process no
+                 * longer holds. **So the honest move is to say so, not to fabricate one** — a proof that
+                 * cannot be checked, presented as one that can, is worse than the absence.
+                 *
+                 * Two BLOB columns would close it properly (this table already carries two `ALTER TABLE …
+                 * ADD COLUMN` migrations, so the pattern exists). Under a frozen gate a log is additive and
+                 * tightenable where a schema change is neither, so this announces the loss now and
+                 * `DOD-M15-HELD-AUTHORSHIP-1` carries the column.
+                 */
+                restoredAcrossRestart: true,
+            });
+            restored++;
+        }
+        if (held.size === 0)
+            this.#ctx.heldContent.delete(key);
+        this.#ctx.logger.info("session.content.held.restored", {
+            agentName, sessionId, restored, superseded, drifted, frontier,
+            canonicalSeqs: [...held.keys()].sort((a, b) => a - b),
+            // The flow ids of the frames that came back, so a restored message ties to the
+            // `session.content.held` that opened its flow before the restart.
+            correlationIds: rows.map((r) => r.correlation_id).filter((c) => c !== null),
+        });
+    }
+    /**
+     * DOD-MSG-4: drain held out-of-order content in canonical order. After a leaf is appended, any
+     * held entry whose canonical sequence equals the new next-expected index is now in order — append
+     * it, then check again (a single fill can release a run of consecutive held messages).
+     */
+    releaseHeld(agentName, sessionId, senderPubkey) {
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        // DOD-M12B-STRAND-1: hydrate before scanning. Restoring eagerly at session-node creation put
+        // it behind writes that can fail — one failed `sessions` row upsert and the frames stayed on
+        // disk, invisible, which is the same outcome as losing them.
+        this.ensureHeldRestored(agentName, sessionId);
+        const held = this.#ctx.heldContent.get(key);
+        if (!held)
+            return 0;
+        let released = 0;
+        for (;;) {
+            const nextExpected = this.#ctx.getSessionTree(agentName, sessionId).size();
+            const entry = held.get(nextExpected);
+            if (!entry)
+                break;
+            held.delete(nextExpected);
+            // DOD-M12B-STRAND-1: released content leaves the durable store in the same breath. A row
+            // that outlives its release would re-append the same content on the next boot — growing the
+            // tree and changing a root that has already been signed.
+            this.#ctx.queries.deleteHeldContent(agentName, sessionId, nextExpected);
+            // DOD-M12B-INDEX-1: OUR OWN held message. It leafs at its canonical index and is transcribed
+            // as SENT — never routed down the received path, which would attribute our words to the
+            // counterparty in the sealed record and hand them back to our own agent as inbound.
+            if (entry.origin === "sent") {
+                // The KIND the leaf was placed with, not a hardcoded "msg" — a document leaf that had to
+                // wait for its position must come back as a document leaf, or the two sides disagree about
+                // what the chain contains.
+                this.#ctx.appendSessionLeaf(agentName, sessionId, entry.kind ?? "msg", entry.contentHashHex, entry.correlationId);
+                // A DOCUMENT frame takes a leaf and NO transcript row — matching what the immediate-append
+                // path does for one. Writing one would put raw CBOR into the operator's transcript as
+                // something they said, which is the same attribution failure as releasing it inbound.
+                if (entry.kind === "doc") {
+                    released++;
+                    this.#ctx.logger.info("session.content.released", {
+                        sessionId, sequenceNumber: nextExpected, leafKind: "doc", correlationId: entry.correlationId,
+                    });
+                    if (held.size === 0) {
+                        this.#ctx.heldContent.delete(key);
+                        break;
+                    }
+                    continue;
+                }
+                // OBSERVED, not assumed — the received path already does this. The leaf commits either way,
+                // so a dropped transcript write means the operator's OWN message is missing from their own
+                // transcript with the chain saying it is there, and nothing anywhere said so.
+                // bullet 5: the proof was captured at submit time and rides the held entry — see #heldContent.
+                /**
+                 * THE RESTART LOSS, ANNOUNCED — review pass 2, H1. Only for an entry that actually crossed a
+                 * restart: an in-memory held entry carries its proof, and an unwitnessed send legitimately
+                 * has none, so warning on every absent proof would fire on a designed benign state and bury
+                 * the one occurrence that means something.
+                 */
+                if (entry.restoredAcrossRestart === true && entry.authorship === undefined) {
+                    this.#ctx.logger.warn("session.content.released.authorship.lost", {
+                        agentName, sessionId, sequenceNumber: nextExpected, correlationId: entry.correlationId,
+                        impact: "this message was held behind a gap, survived a daemon restart, and is now committed with " +
+                            "attribution 'self_authored' and NO signature. Its transcript row asserts its author rather " +
+                            "than proving one, and is indistinguishable from a send the relay never witnessed.",
+                        guidance: "Not recoverable after the fact — the signature covered Structure-1 bytes this process no longer " +
+                            "holds, and fabricating one would be worse than the absence. Tracked as DOD-M15-HELD-AUTHORSHIP-1: " +
+                            "held_content needs the two proof columns so a restart carries them.",
+                    });
+                }
+                if (!this.#ctx.records.recordTranscriptMessage(agentName, sessionId, nextExpected, "sent", entry.content, entry.correlationId, entry.authorship)) {
+                    this.#ctx.logger.error("session.content.released.transcript.failed", {
+                        agentName, sessionId, sequenceNumber: nextExpected, correlationId: entry.correlationId,
+                        impact: "this side's own message is committed to the chain but missing from its transcript",
+                    });
+                }
+            }
+            else if (entry.screenedOut) {
+                this.#ctx.appendSessionLeaf(agentName, sessionId, "msg", entry.contentHashHex, entry.correlationId);
+                // The SAME witness leak as the immediate-append terminal-block branch (see the block comment
+                // at the `if (terminalBlock)` append in `ingestReceivedContent`), on the held path. This
+                // branch also bypasses `#appendVerifiedContent`, where the drop lives — so a blocked message
+                // that arrived out of order left `missingLeaves` stuck at 1 and the session unsealable.
+                this.#ctx.witnessedSeq.get(key)?.delete(entry.contentHashHex);
+            }
+            else {
+                this.#ctx.appendVerifiedContent(agentName, sessionId, entry.content, entry.contentHashHex, senderPubkey, entry.correlationId, entry.originalContent);
+            }
+            released++;
+            this.#ctx.logger.info("session.content.released", {
+                sessionId,
+                sequenceNumber: nextExpected,
+                screenedOut: entry.screenedOut === true,
+                correlationId: entry.correlationId,
+            });
+            if (held.size === 0) {
+                this.#ctx.heldContent.delete(key);
+                break;
+            }
+        }
+        return released;
+    }
+    /**
+     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
+     *
+     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
+     * exists on this side and is not in the tree, while the counterparty already has it from the relay
+     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
+     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
+     * it.
+     */
+    holdOwnLeafForTest(agentName, sessionId, canonicalSeq, contentHashHex) {
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        let held = this.#ctx.heldContent.get(key);
+        if (!held) {
+            held = new Map();
+            this.#ctx.heldContent.set(key, held);
+        }
+        held.set(canonicalSeq, { content: new Uint8Array(), contentHashHex, origin: "sent", kind: "msg" });
+    }
+    /**
+     * ⚠️ **ORPHANED COMMENT, OWNER UNKNOWN — do not attach it to the method below.** It reads
+     * *"@returns true iff the UPDATE was executed without error (a failed write is logged, never
+     * thrown)"*, and `annexHeldContentOnTerminal` returns `void` and runs no such UPDATE. It was
+     * already stranded in `session-node-manager.ts` before 037 moved this code, and Rule C carried it
+     * verbatim rather than dropping a sentence that is true of SOMETHING.
+     *
+     * Kept, marked, and NOT reattached: the nearest candidate by behaviour is
+     * `SessionQueries.markCounterpartyAbandoned`, which already has its own doc — so attaching it
+     * there on a guess is the same defect this marker exists to stop. Delete it only once its owner is
+     * identified, or reattach it then.
+     */
+    /**
+     * DOD-M12B-STRAND-1 — move a terminal session's held frames to the annex.
+     *
+     * A held frame is content this agent RECEIVED and VERIFIED. When its session ends it can never
+     * join that chain (appending behind a committed root is not an option, and ingest refuses a
+     * terminal session outright), but it is still the operator's mail and no other copy exists —
+     * the sender was never acknowledged for it. `sealed_session_annex` is where M12-P17 already puts
+     * content that arrives for an ended session; this is the same content arriving slightly earlier.
+     *
+     * ANNEX FIRST, DELETE SECOND, per row. A crash between them costs a duplicate the annex's
+     * INSERT OR IGNORE absorbs; the other order costs the message. A row whose annex write fails is
+     * KEPT — the retention sweep will find it again, and a leftover row is cheaper than a lost one.
+     */
+    annexHeldContentOnTerminal(agentName, sessionId, status) {
+        if (!this.#db)
+            return;
+        let rows;
+        try {
+            rows = this.#db.prepare(`SELECT canonical_seq, content_blob, content_hash_hex, held_at, origin
+           FROM held_content WHERE agent_id = ? AND session_id = ? ORDER BY canonical_seq ASC`).all(this.#ctx.requireAgentId(agentName), sessionId);
+        }
+        catch (err) {
+            this.#ctx.logger.error("session.content.held.annex.scan.failed", {
+                agentName, sessionId, status,
+                impact: "held frames for a terminal session were not moved to the annex and remain unreadable",
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return;
+        }
+        if (rows.length === 0)
+            return;
+        const counterparty = this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey ?? null;
+        let annexed = 0;
+        let kept = 0;
+        for (const row of rows) {
+            // DOD-M12B-INDEX-1: ATTRIBUTION. A `sent` row is our own message. Stamping the counterparty's
+            // pubkey on it would put our words in their mouth in the one record that survives the
+            // session — the same failure the release path was changed to avoid, on the drain it did not
+            // touch. `#ownPubkeyHex` is null only when the identity cannot be resolved, and a null sender
+            // reads as "unattributed", which is true, rather than as a false attribution.
+            const sender = row.origin === "sent" ? this.#ctx.queries.ownPubkeyHex(agentName) : counterparty;
+            if (this.#ctx.queries.recordSealedAnnex(agentName, sessionId, row.content_hash_hex, new Uint8Array(row.content_blob), sender)) {
+                this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
+                // AND OUT OF THE IN-MEMORY MAP. Measured live 2026-08-17 on daemon 0.0.170: this frame is
+                // now safe in the annex and its durable row is gone — but teardown still found it in the
+                // map, counted `held_content` for the session, got 0, and fired
+                // `session.content.held.lost`: "verified content was destroyed". Ten frames were annexed
+                // and the same ten were reported destroyed, in the same second. A false alarm on the most
+                // serious event in the system is worse than no alarm, because the next investigation goes
+                // looking for content that was never lost.
+                this.#ctx.heldContent.get(this.#ctx.sessionKey(agentName, sessionId))?.delete(row.canonical_seq);
+                annexed++;
+            }
+            else {
+                kept++;
+            }
+        }
+        this.#ctx.logger.warn("session.content.held.annexed", {
+            agentName, sessionId, status, annexed, kept,
+            // The consumer of `held_at`: how long the oldest frame waited before its session ended.
+            oldestHeldMs: Date.now() - Math.min(...rows.map((r) => r.held_at)),
+            impact: "these messages arrived and verified but never joined the chain — they are readable from the annex, not the transcript",
+        });
+    }
+    /**
+     * Forget the restore/release bookkeeping for a torn-down session.
+     *
+     * The held CONTENT itself is not dropped here — the map is shared and the manager's eviction still
+     * owns that line. What goes is this module's memory of whether a session was already hydrated from
+     * disk and already released, which must not survive a teardown: a revived session has to re-read
+     * from durable state rather than trust a flag about a process that is gone.
+     */
+    evictSession(agentName, sessionId) {
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        this.#heldRestored.delete(key);
+        this.#heldReleased.delete(key);
+    }
+}
+//# sourceMappingURL=held-content.js.map

package/dist/held-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"held-content.js","sourceRoot":"","sources":["../src/held-content.ts"],"names":[],"mappings":"AAmEA,MAAM,OAAO,WAAW;IACb,IAAI,CAAqB;IAElC,YAAY,GAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,0FAA0F;IAC1F,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACxB,CAAC;IAED,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC;;;sDAGkD;IAClD,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;QACpD,sFAAsF;QACtF,2FAA2F;QAC3F,+EAA+E;QAC/E,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,SAAiB,EAAE,SAAiB,EAAE,IAA4B;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,8FAA8F;YAC9F,6BAA6B;YAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QACD,gFAAgF;QAChF,EAAE;QACF,iGAAiG;QACjG,2FAA2F;QAC3F,+FAA+F;QAC/F,iGAAiG;QACjG,yFAAyF;QACzF,2DAA2D;QAC3D,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,0FAA0F;QAC1F,gGAAgG;QAChG,uEAAuE;QACvE,IAAI,IAAI,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO;QACpC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QACxC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,CAAC;YACnG,IAAI,YAAY;gBAAE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,SAAiB,EAAE,SAAiB;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,IAA4M,CAAC;QACjN,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CACrB;8FACsF,CACvF,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAU,CAAC;QACjE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBAC5D,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,kFAAkF;gBAC1F,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,0EAA0E;YAC1E,EAAE;YACF,2FAA2F;YAC3F,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,wFAAwF;YACxF,gFAAgF;YAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAChD,IAAI,QAAQ,KAAK,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC7E,UAAU,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;gBACjC,uFAAuF;gBACvF,wFAAwF;gBACxF,0FAA0F;gBAC1F,uEAAuE;gBACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CACjD,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC5E,sFAAsF;gBACtF,GAAG,CAAC,MAAM,KAAK,MAAM;oBACnB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;oBAC3C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,IAAI,IAAI,CAC1F,CAAC;gBACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBAC9D,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,QAAQ;oBAC/D,WAAW,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,EAAE,OAAO;oBACpD,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;oBAC9C,MAAM,EAAE,OAAO;wBACb,CAAC,CAAC,qIAAqI;wBACvI,CAAC,CAAC,iJAAiJ;iBACtJ,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC1F,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC1B,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,cAAc,EAAE,GAAG,CAAC,gBAAgB;gBACpC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D;;;;;;;;;;;;;;;;mBAgBG;gBACH,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;YACH,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACrD,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;YAC7D,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,+EAA+E;YAC/E,kEAAkE;YAClE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SACzF,CAAC,CAAC;IACL,CAAC;IACD;;;;OAIG;IACH,WAAW,CAAC,SAAiB,EAAE,SAAiB,EAAE,YAAoB;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,6FAA6F;QAC7F,6FAA6F;QAC7F,6DAA6D;QAC7D,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,SAAS,CAAC;YACR,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1B,yFAAyF;YACzF,4FAA4F;YAC5F,yDAAyD;YACzD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACxE,6FAA6F;YAC7F,wFAAwF;YACxF,oFAAoF;YACpF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,yFAAyF;gBACzF,2FAA2F;gBAC3F,2BAA2B;gBAC3B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAClH,2FAA2F;gBAC3F,sFAAsF;gBACtF,sFAAsF;gBACtF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACzB,QAAQ,EAAE,CAAC;oBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;wBAChD,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;qBAC7F,CAAC,CAAC;oBACH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBAClE,SAAS;gBACX,CAAC;gBACD,4FAA4F;gBAC5F,2FAA2F;gBAC3F,8EAA8E;gBAC9E,+FAA+F;gBAC/F;;;;;mBAKG;gBACH,IAAI,KAAK,CAAC,qBAAqB,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;wBAChE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;wBACtF,MAAM,EACJ,2FAA2F;4BAC3F,6FAA6F;4BAC7F,mFAAmF;wBACrF,QAAQ,EACN,kGAAkG;4BAClG,oGAAoG;4BACpG,qEAAqE;qBACxE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjJ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;wBACnE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;wBACtF,MAAM,EAAE,mFAAmF;qBAC5F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBACpG,6FAA6F;gBAC7F,yFAAyF;gBACzF,6FAA6F;gBAC7F,wFAAwF;gBACxF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;YACvJ,CAAC;YACD,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBAChD,SAAS;gBACT,cAAc,EAAE,YAAY;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,IAAI;gBACvC,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QACpE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD;;;;;;;;OAQG;IACH,kBAAkB,CAAC,SAAiB,EAAE,SAAiB,EAAE,YAAoB,EAAE,cAAsB;QACnG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,UAAU,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;IACD;;;;;;;;;;;OAWG;IACH;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAA8B;QAC7F,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,IAAuH,CAAC;QAC5H,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CACrB;8FACsF,CACvF,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAU,CAAC;QACjE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;gBAC/D,SAAS,EAAE,SAAS,EAAE,MAAM;gBAC5B,MAAM,EAAE,sFAAsF;gBAC9F,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,IAAI,IAAI,CAAC;QAC3G,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,8FAA8F;YAC9F,sFAAsF;YACtF,4FAA4F;YAC5F,8FAA8F;YAC9F,8EAA8E;YAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAChG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC9H,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC7E,0FAA0F;gBAC1F,yFAAyF;gBACzF,gEAAgE;gBAChE,yFAAyF;gBACzF,0FAA0F;gBAC1F,0FAA0F;gBAC1F,2CAA2C;gBAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACjG,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YACpD,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI;YAC3C,wFAAwF;YACxF,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,EAAE,uHAAuH;SAChI,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,SAAiB,EAAE,SAAiB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;CACF"}