@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/boot-parked-content.js

@@ -1,528 +0,0 @@
-/**
- * Phase 4 of boot: parked content, and every path that gets it moving again.
- *
- * The retry queue and its durable rows, the park retry timers, the startup park sweep, and the flush
- * that drains what was waiting once an agent's link comes back. One topic: content that could not be
- * delivered when it was written, and the several distinct ways it stops being stuck.
- *
- * Nine dependencies, under the order's bound — counted after the extraction, not before: an earlier
- * draft carried a seal-failure store and a `stop` getter the moved code never calls.
- *
- * ⚠️ AN EARLIER VERSION OF THIS HEADER CLAIMED TWO OF THEM HAD TO BE GETTERS "because the
- * outbound-session module is constructed BELOW this phase". It is constructed 27 lines ABOVE it.
- * Both are plain values now. The wrong version is recorded rather than deleted because of what it
- * would have taught the next phase: "getter by default", when the rule that catches the real defect
- * is narrower — check whether the value is ASSIGNED BELOW the call site, and a `let` that is, is the
- * only shape that fails silently.
- */
-import { randomUUID } from "node:crypto";
-import { RetryQueue } from "./retry-queue.js";
-import { ContentParkClient } from "./content-park-client.js";
-import { AgentRelayClient } from "./session-relay-client.js";
-import { sealParkEnvelope } from "./park-envelope.js";
-import { extractErrorMessage } from "./error-message.js";
-export function startBootParkedContent(deps) {
-    const { config, logger, sessionNodeManager, agents, keyProviders, resolveConsortiumRoster, waitForSignalingConnected, openVisitingConnection, crossNodeBrokerBySession, } = deps;
-    // Both use the same SQLite DB as the SessionNodeManager (daemon.db equivalent).
-    // loadFromDb() must complete BEFORE IPC socket opens (AC-007).
-    const retryQueue = new RetryQueue(sessionNodeManager.getDb(), logger);
-    retryQueue.loadFromDb();
-    // DOD-RETRYQ-STRAND-1: the terminal-transition hook below only fires for sessions that go
-    // terminal while this daemon runs. A session already sealed/abandoned before boot never
-    // transitions again — close-session returns `already_abandoned` without reaching abandonSession —
-    // so without this its rows are unreachable by every removal path and retryQueueDepth stays pinned
-    // forever. That is exactly the row found on the live daemon, 25.6h old. Runs after loadFromDb so
-    // the in-memory queues are dropped in step with the rows, and before the IPC socket opens so no
-    // client ever observes the stale depth.
-    retryQueue.reapAlreadyTerminalSessions();
-    // CELLO-M7-MSG-001 (AC-001/AC-003/AC-019): wire the awaiting-ACK lifecycle's durable
-    // side effects to the retry_queue. A `persisted` delivery ACK clears the durable
-    // entry; a TTF expiry records the un-acked content for the crash backstop (the relay
-    // park deposit itself is added in 3b). Both side effects are best-effort and never
-    // throw into the content stream handler.
-    // DOD-AGENT-ID-JOINKEY-1: RetryQueue owns an agent-scoped table, so it is handed the STABLE
-    // agent_id. The daemon resolves the operator-facing name ONCE, here at its own boundary.
-    // M12-P15: let a session with NO in-memory node still reach its relay to seal. The manager
-    // deliberately holds no K_local, so the client is built here where the keys live. This is what
-    // makes the detached path work after a RESTART — the exact situation that marked the session
-    // interrupted and then left it unsealable, with force-abandon (no receipt) as the only exit.
-    sessionNodeManager.setDetachedRelayClientBuilder((agentName, relayPeerId, relayAddrs, stores) => {
-        const kp = keyProviders.get(agentName);
-        const agent = agents.find((a) => a.name === agentName);
-        if (!kp || !agent?.pubkey)
-            return undefined;
-        return new AgentRelayClient({
-            relayPeerId,
-            relayAddrs,
-            keyProvider: kp,
-            senderPubkey: Buffer.from(agent.pubkey, "hex"),
-            logger,
-            // Review HIGH-1: a client that can submit but cannot RECORD drops the durable evidence the
-            // seal depends on — silently, while reporting success.
-            receiptStore: stores.receiptStore,
-            sealLeafStore: stores.sealLeafStore,
-            // `DOD-M15-SELFCHAIN-1` — without this the client cannot chain a message to this agent's own
-            // previous one, and says so rather than signing an unlinked claim.
-            ownChainStore: stores.ownChainStore,
-            // DOD-M15-RELAYSLOTS-1: the manager owns the current token and hands the accessor down, so
-            // this client reads a fresh one at every auth instead of a snapshot taken here at build time.
-            onlineToken: stores.onlineToken,
-            // DOD-M15-CORROBORATE-1: the DETACHED client needs this as much as the live one — a session
-            // being sealed after a restart is exactly when its operator is not watching.
-            onWitnessAlert: (alert) => { sessionNodeManager.recordRelayWitnessAlert(agentName, alert); },
-            onWitnessUnreadable: (peerId, why) => { sessionNodeManager.recordRelayWitnessUnreadable(agentName, peerId, why); },
-        });
-    });
-    // DOD-RETRYQ-STRAND-1: a direct-resend row is reachable only by drainSession, which has no
-    // production caller — so once its session can never drain again the row is unreachable by every
-    // removal path that exists, and pins retryQueueDepth forever. Found live: one row stranded 25.6h,
-    // after which the metric could no longer tell a real delivery backlog from a corpse.
-    sessionNodeManager.setSessionTerminalHook((sessionId, terminalStatus) => {
-        retryQueue.reapTerminalSession(sessionId, terminalStatus);
-    });
-    /**
-     * DOD-M12B-SESSION-SEED-1 — the retry drain is DELIBERATELY NOT WIRED. Review HIGH-1.
-     *
-     * It was wired, and it was worse than the problem it solved. `retryQueue.enqueue` runs only on the
-     * `!sendResult.durable` branch — content that got NO local leaf and NO transcript row, because as
-     * that branch's own comment says, *"A LOST message gets no leaf — that would commit a sequence no
-     * content will ever fill."*
-     *
-     * The hook re-sent those rows with `sendContent`, which is wire-and-witness only: it consumes a
-     * canonical relay sequence and returns one, and the hook discarded it without calling
-     * `placeOwnLeaf` or writing the transcript. So the counterparty would silently receive the message
-     * while OUR tree kept a permanent hole at that sequence. Every later message would be held behind
-     * the gap with guidance blaming the counterparty for a message they already sent, the two roots
-     * would have parted, and the session could never seal.
-     *
-     * A stranded queue row is recoverable. A parted hash chain is not. So this stays unwired until the
-     * drain routes through the same commit path `cello_send` uses (place the leaf at the returned
-     * sequence, write the transcript, keep the row on failure) rather than calling `sendContent` raw.
-     *
-     * The operator-facing consequence of leaving it unwired is unchanged from before this milestone:
-     * a message that fails this way is reported lost and must be re-sent by hand. That is honest, and
-     * it is what the guidance already says.
-     */
-    sessionNodeManager.setAwaitingAckHooks({
-        onPersisted: (agentName, sessionId, contentHashHex) => {
-            retryQueue.markContentAcked(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"));
-        },
-        // `DOD-M15-SEALWIRE-1` B2b-1 review F1 — `contentHashAlg` is the DURABLE WRITER for the column
-        // this unit added. Without it every queued row carries NULL, the crash backstop re-parks a salted
-        // message as sha256, and the recipient refuses it and re-pulls it forever. The commit that added
-        // the column said the producer "passes it"; the producer was passing a value nothing supplied,
-        // because these two hooks were never widened.
-        onTtf: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind) => {
-            retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind);
-        },
-        // M12-P12: same durable destination, different cause — a park deposit the relay refused. The
-        // TTF timer is already cancelled on this path, so this is the only thing holding the content.
-        // M12-P13 (review HIGH-1): the enqueue's own answer is returned, never a bare `true`. A dropped
-        // copy that reports success now buys a committed hash-chain leaf for content that is gone.
-        onParkFailed: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind) => {
-            return retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind);
-        },
-    });
-    // MSG-001-3b (2b): the LIVE content-park deposit. On a not-confirmed send (direct delivery
-    // failed, or TTF with no `persisted` ACK) the session manager calls this with the recipient +
-    // the session's relay endpoint; we seal the content to the recipient (E2E — the relay never sees
-    // plaintext, INV-3) and deposit it to that relay's store-and-forward mailbox via the standing
-    // receiver node. The recipient pulls + recovers it at the witnessed sequence (R1) on next online.
-    // Fix #1 EXTENSION (cross-node seal-liveness) — the AUTO-ACKNOWLEDGE half.
-    //
-    // close-session-handler already re-opens a transient visiting connection to the broker for its
-    // own path. The auto-ack path had no such guard, and it is the one that fires FIRST whenever the
-    // counterparty closes first: it submits a seal leaf, the directory answers within ~60ms by pushing
-    // `seal_verified` to the INITIATOR, finds no stream (the initiator released its visiting
-    // connection after setup), ENQUEUES the frame, and then blocks waiting for a co-signature it never
-    // asked for. Proven on GCP — leaf 18:41:56.555, directory `seal.certificate.deferred`
-    // (initiator_stream_absent) 18:41:56.615, broker reconnect 18:42:01.529: five seconds too late.
-    //
-    // Returns null for same-node sessions (no broker entry) — those reach the initiator on its home
-    // stream and need no visiting connection.
-    sessionNodeManager.setEnsureSealBroker(async (agentName, sessionId) => {
-        const brokerNode = crossNodeBrokerBySession.get(`${agentName}:${sessionId}`);
-        if (!brokerNode)
-            return null;
-        const kp = keyProviders.get(agentName);
-        if (!kp) {
-            logger.warn("session.seal.autoack.broker.no_keyprovider", { agentName, brokerNode });
-            return null;
-        }
-        const pubHex = Buffer.from(await kp.getPublicKey()).toString("hex");
-        const roster = await resolveConsortiumRoster();
-        const target = roster?.find((e) => e.nodeId === brokerNode) ?? null;
-        if (!target) {
-            logger.warn("session.seal.autoack.broker.unresolved", { agentName, brokerNode });
-            return null;
-        }
-        const correlationId = randomUUID();
-        const conn = openVisitingConnection(agentName, kp, pubHex, { peerId: target.peerId, multiaddr: target.multiaddr }, correlationId, brokerNode);
-        if (await waitForSignalingConnected(conn.mgr, 10_000)) {
-            logger.info("session.seal.autoack.broker.reconnected", { agentName, brokerNode, correlationId });
-            return conn;
-        }
-        await conn.stop("autoack-seal-broker-unreachable");
-        logger.warn("session.seal.autoack.broker.unreachable", { agentName, brokerNode, correlationId });
-        return null;
-    });
-    /**
-     * DOD-M15-RELAYABUSE-1: scheduled park-retry timers, tracked so shutdown can clear them.
-     *
-     * ⚠️ Every other daemon timer is cleared in `stop()`; an untracked one lets an in-process restart
-     * leave a stale timer that drains into a torn-down manager. Unref'd already, so it cannot hold the
-     * process open — this is about a clean teardown, not about exiting.
-     */
-    const parkRetryTimers = new Set();
-    /**
-     * DOD-M15-RELAYABUSE-1: schedule ONE drain at the delay the relay asked for.
-     *
-     * ⚠️ ONE implementation, used by both park paths. The live-send path and the drain path both need
-     * this and a second copy is how the clamp ends up on only one of them — which is exactly the shape
-     * review found here (the number had a consumer on one path and was dropped on the other).
-     *
-     * CLAMPED, because the value comes from another party's software and an unclamped one inverts the
-     * fix: Node's `setTimeout` holds an int32, so a relay reporting `3_000_000_000` overflows it and
-     * fires in about ONE MILLISECOND — re-parking instantly into the limit that just refused, and
-     * printing a `TimeoutOverflowWarning` from a daemon whose convention forbids console output.
-     */
-    function scheduleParkRetry(retryAfterMs, filterAgentName, source) {
-        const MIN_RETRY_MS = 1_000;
-        const MAX_RETRY_MS = 5 * 60_000;
-        const delay = Math.min(Math.max(retryAfterMs, MIN_RETRY_MS), MAX_RETRY_MS);
-        if (delay !== retryAfterMs) {
-            logger.warn("content.park.retry.clamped", {
-                source,
-                requestedMs: retryAfterMs,
-                usedMs: delay,
-                impact: "the relay asked for a retry delay outside the range this daemon will schedule, so it was " +
-                    "clamped — an unclamped value can overflow the timer and fire immediately, which would " +
-                    "re-park straight into the limit that just refused",
-            });
-        }
-        logger.info("content.park.retry.scheduled", { source, delayMs: delay, ...(filterAgentName !== undefined ? { agentName: filterAgentName } : {}) });
-        const timer = setTimeout(() => {
-            parkRetryTimers.delete(timer);
-            void flushAwaitingContent(filterAgentName).catch((err) => {
-                logger.warn("content.park.retry.timer.failed", {
-                    source,
-                    reason: extractErrorMessage(err),
-                    impact: "the scheduled drain threw; the ordinary event triggers (boot, agent start, reconnect) still apply",
-                });
-            });
-        }, delay);
-        timer.unref?.();
-        parkRetryTimers.add(timer);
-    }
-    sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor, structure1Signature, leafKind, contentHashAlg }) => {
-        const node = sessionNodeManager.getStandingReceiverNode();
-        if (!node) {
-            const reason = "standing_receiver_unavailable";
-            // M12-P12 (review F4): `standing_receiver_unavailable` is the exit-point label that already
-            // misnamed this incident 102 times; standingReceiverAbsenceReason() names WHICH of the four
-            // causes it is. That distinction is what separates "mid-rebuild, a retry in seconds works"
-            // from "agent offline, this will never work" — the difference between a backstop that helps
-            // and one that spins. The wire reason stays put; the cause rides alongside.
-            const cause = sessionNodeManager.standingReceiverAbsenceReason(agentName);
-            logger.warn("content.park.deposit.failed", { sessionId, contentHash: contentHashHex, reason, cause });
-            // DOD-LEAVEMSG-1 (reviewer HIGH fix): return the typed failure, never resolve as if this
-            // were a success — #parkContent's caller (sendContent) shapes a live "dispatched to relay"
-            // response from this, and a silently-resolved void here would report a message as safely
-            // parked when nothing was ever deposited.
-            return { ok: false, reason, cause };
-        }
-        // SEC-1: sign the entry as the SENDING agent. Without a key we cannot produce an envelope the
-        // recipient will accept, so fail LOUD rather than depositing something that will be refused on
-        // recovery (a deposit the recipient must reject is worse than no deposit — it looks delivered).
-        const senderKp = keyProviders.get(agentName);
-        if (!senderKp) {
-            const reason = "signing_key_unavailable";
-            logger.warn("content.park.deposit.failed", { agentName, sessionId, contentHash: contentHashHex, reason });
-            return { ok: false, reason };
-        }
-        const recipientPubkey = Buffer.from(recipientPubkeyHex, "hex");
-        const contentHashBytes = Buffer.from(contentHashHex, "hex");
-        logger.info("content.park.signed", { agentName, sessionId, contentHash: contentHashHex });
-        // DOD-MSG-4 (2b): seal the ORDERING ENVELOPE (content + the relay's signed Structure2), not bare
-        // content, so the parked entry is self-ordering on recover. The relay still holds only ciphertext.
-        // SEC-1: sealParkEnvelope is the SOLE producer — it signs (sender's K_local, over the
-        // session/recipient/content binding) and seals in one place, so the two park sites cannot drift
-        // apart on what gets signed.
-        //
-        // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
-        // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
-        // is salted is a fact about the message that was sent; what this side holds now says nothing
-        // about it.
-        //
-        // ⛔ THIS COMMENT USED TO SAY "Still `sha256` everywhere, because no send path salts yet — the
-        // plumbing is proven carrying the value that cannot break anything, and only then does the value
-        // change." That described B2b, and B2b-2 then CHANGED THE VALUE: a session holding an agreed
-        // salt hashes under `hmac-sha256-salt-v1`, so this path really does carry a salted algorithm
-        // now. Rewritten rather than deleted — a stale reassurance is what `CLAIM-COMMENTS-1` is for,
-        // and on 2026-08-24 a test declared `sha256` on the strength of this sentence and got a tamper
-        // verdict on an honest message.
-        const ciphertext = await sealParkEnvelope({
-            signer: senderKp,
-            sessionIdHex: sessionId,
-            recipientPubkey,
-            contentHash: contentHashBytes,
-            content,
-            // The algorithm the DIRECT frame named for this same message. The park copy must claim what
-            // the message actually is, not what this side would choose for it now.
-            contentHashAlg,
-            structure1Cbor,
-            structure2Cbor,
-            // 034-CARRYLEAF: promotes the envelope to v4 when present, which is what lets the recipient
-            // witness this leaf if its author never does.
-            structure1Signature,
-            leafKind,
-        });
-        const client = new ContentParkClient({ relayPeerId, relayAddrs: [...relayAddrs], logger });
-        const res = await client.deposit(node, {
-            recipientPubkey,
-            contentHash: Buffer.from(contentHashHex, "hex"),
-            sessionId: Buffer.from(sessionId, "hex"),
-            ciphertext,
-        });
-        if (res.ok) {
-            logger.info("content.park.deposited", { sessionId, contentHash: contentHashHex, recipientPubkey: recipientPubkeyHex.slice(0, 16) });
-            return { ok: true };
-        }
-        logger.warn("content.park.deposit.failed", {
-            sessionId,
-            contentHash: contentHashHex,
-            reason: res.reason,
-            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
-        });
-        /**
-         * DOD-M15-RELAYABUSE-1 — **GIVE THE RELAY'S "WHEN" A CONSUMER.**
-         *
-         * A deferred park is otherwise retried only on EVENTS — boot, agent start, the drain hook, a
-         * signaling reconnect. None of those is coming for a throttle: the relay is healthy, the link
-         * never dropped, and the condition clears on a timer nobody is watching. So the one refusal that
-         * self-heals in about a minute was the one that waited longest, purely because the number the
-         * relay had already computed had no reader.
-         *
-         * Scheduled ONCE per refusal, unref'd so it can never hold the process open, and best-effort:
-         * the existing event triggers remain the guarantee, and this is a shortcut on top of them. It
-         * deliberately does not retry-on-retry — a timer that reschedules itself on failure is a
-         * self-inflicted flood, which is what the limiter exists to stop.
-         */
-        if (res.retryAfterMs !== undefined && res.retryAfterMs > 0) {
-            /**
-             * ⚠️ CLAMPED, because the number comes from ANOTHER PARTY'S SOFTWARE and an unclamped one is
-             * not merely wrong — it inverts the fix. Node's `setTimeout` holds an int32: a relay reporting
-             * `3_000_000_000` overflows it and the timer fires in about **one millisecond**, re-parking
-             * instantly into the limit that just refused, and printing a `TimeoutOverflowWarning` on
-             * stderr from a daemon whose convention forbids console output. A reported `1` does the same
-             * thing 250 ms later.
-             *
-             * The floor is a second and the ceiling five minutes: long enough that a shortcut is a
-             * shortcut, short enough that it stays one. A clamp is announced rather than silent — a relay
-             * asking us to wait 35 days is a fact an operator wants.
-             */
-            scheduleParkRetry(res.retryAfterMs, agentName, "send");
-        }
-        return {
-            ok: false,
-            reason: res.reason ?? "relay_deposit_failed",
-            // DOD-M15-RELAYABUSE-1 review MEDIUM-6: the guidance quotes the relay's OWN window instead of
-            // guessing "about a minute", which is a hardcoded assumption about a configurable value.
-            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
-        };
-    });
-    // CELLO-M7-MSG-001 (AC-004/AC-005, D-d): startup flush of locally-persisted un-acked
-    // content (the crash backstop). Runs HERE — before the IPC socket opens, consistent
-    // with DAEMON-003 startup loading (AC-007) — so a sender that crashed before its TTF
-    // park confirmed re-parks its un-acked content to the relay store-and-forward queue on
-    // restart. Best-effort: a failed park stays queued (drainAwaitingToPark does not evict
-    // on failure), to be retried at the next startup flush or reconnect.
-    //
-    // Re-home note (Option A): the park target (config.contentParkFn) is supplied natively
-    // by the daemon's own send path — NOT by a hosted CelloClient. When it is absent (e.g.
-    // a daemon started without the content send path wired, or unit tests), the flush is a
-    // documented no-op (content.park.flush.deferred at WARN) and the durable awaiting
-    // entries simply remain queued for the next startup that has a park target.
-    // MSG-2 startup-flush park target: seal + deposit an un-acked awaiting entry sourced from
-    // PERSISTED session state (the in-memory entry is gone after a restart). Same seal + deposit
-    // as the live hook above; the endpoint + recipient come from the sessions row.
-    const startupParkFn = async (entry) => {
-        // The durable row carries the OWNING agent's stable id. Resolve it back to a name for the
-        // name-addressed session/standing-receiver lookups. A retired owner resolves fine and then has no
-        // standing receiver, so the park fails loudly below rather than silently re-parking as someone else.
-        const ownerName = sessionNodeManager.agentNameForId(entry.agentId);
-        if (ownerName === null)
-            return { parked: false, error: "owning_agent_not_found" };
-        const ep = sessionNodeManager.getPersistedRelayEndpoint(ownerName, entry.sessionId);
-        const record = sessionNodeManager.getSessionRecord(ownerName, entry.sessionId);
-        if (!ep)
-            return { parked: false, error: "no_persisted_relay_endpoint" };
-        if (!record?.counterparty_pubkey)
-            return { parked: false, error: "no_counterparty" };
-        // DOD-LOOP-1: the re-park must originate from the session's OWNING agent (the original
-        // sender), so use THAT agent's standing-receiver node — not "any" agent's. Post-DOD-LOOP-1 the
-        // owning agent's SR exists only once it is online, which is why the native flush is
-        // (re-)triggered per-agent on agent-online (see flushAwaitingContent / cello_start_agent), not
-        // only at pre-IPC startup when no agent is online yet.
-        const node = sessionNodeManager.getStandingReceiverNode(record.agent_name);
-        if (!node)
-            return { parked: false, error: "standing_receiver_unavailable" };
-        // SEC-1: the crash backstop must sign too — an unsigned re-park would be REFUSED on recovery,
-        // which would turn the message-loss backstop into a message-loss cause. The SEC-1 signature
-        // binds to the sender's own K_local, which the owning agent still holds after a crash.
-        // M12-P12 (review F2): the ordering record IS now persisted (retry_queue.structure{1,2}_cbor),
-        // so a re-park is self-ordering whenever the row carries one. Rows written before that column
-        // existed carry none and still recover in arrival order — the pre-existing behaviour, now the
-        // exception rather than the rule.
-        const senderKp = keyProviders.get(ownerName);
-        if (!senderKp)
-            return { parked: false, error: "signing_key_unavailable" };
-        const recipientPubkey = Buffer.from(record.counterparty_pubkey, "hex");
-        const contentHashBytes = Buffer.from(entry.contentHashHex, "hex");
-        logger.info("content.park.signed", { agentName: ownerName, sessionId: entry.sessionId, contentHash: entry.contentHashHex, source: "startup_flush" });
-        // DOD-MSG-4 (2b): ONE envelope format on the recover side. M12-P12 (F2): carry the persisted
-        // ordering record when the row has one, so the recipient places the content at its WITNESSED
-        // sequence rather than its arrival index — the receiver's #witnessedSeq map is in-memory and
-        // empty after a restart, so arrival order there means a wrong leaf index and a divergent tree.
-        // SEC-1: same sole producer as the live hook — the backstop signs from the persisted
-        // (sessionId, recipient, contentHash).
-        //
-        // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
-        // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
-        // is salted is a fact about the message that was sent; what this side holds now says nothing
-        // about it.
-        //
-        // ⛔ THIS COMMENT USED TO SAY "Still `sha256` everywhere, because no send path salts yet — the
-        // plumbing is proven carrying the value that cannot break anything, and only then does the value
-        // change." That described B2b, and B2b-2 then CHANGED THE VALUE: a session holding an agreed
-        // salt hashes under `hmac-sha256-salt-v1`, so this path really does carry a salted algorithm
-        // now. Rewritten rather than deleted — a stale reassurance is what `CLAIM-COMMENTS-1` is for,
-        // and on 2026-08-24 a test declared `sha256` on the strength of this sentence and got a tamper
-        // verdict on an honest message.
-        const ciphertext = await sealParkEnvelope({
-            signer: senderKp,
-            sessionIdHex: entry.sessionId,
-            recipientPubkey,
-            contentHash: contentHashBytes,
-            content: entry.contentBlob,
-            // The queued row's own record of how it was hashed. `undefined` for a row written before the
-            // column existed, which resolves to `sha256` — exactly what such a row actually used.
-            contentHashAlg: entry.contentHashAlg,
-            structure1Cbor: entry.structure1Cbor,
-            structure2Cbor: entry.structure2Cbor,
-            // 034-CARRYLEAF: a re-parked message must reach its recipient in a shape they can WITNESS on
-            // the sender's behalf, or a crash re-opens the withholding hole on the mailbox route.
-            structure1Signature: entry.structure1Signature,
-            leafKind: entry.leafKind,
-        });
-        const client = new ContentParkClient({ relayPeerId: ep.relayPeerId, relayAddrs: [...ep.relayAddrs], logger });
-        const res = await client.deposit(node, {
-            recipientPubkey,
-            contentHash: Buffer.from(entry.contentHashHex, "hex"),
-            sessionId: Buffer.from(entry.sessionId, "hex"),
-            ciphertext,
-        });
-        if (res.ok) {
-            logger.info("content.park.deposited", { sessionId: entry.sessionId, contentHash: entry.contentHashHex, source: "startup_flush" });
-            return { parked: true };
-        }
-        return {
-            parked: false,
-            error: res.reason ?? "deposit_failed",
-            // DOD-M15-RELAYABUSE-1 review HIGH-2: carry the relay's own "when" out of the DRAIN path too.
-            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
-        };
-    };
-    // Re-park un-acked awaiting content to the relay store-and-forward queue. Runs once pre-IPC
-    // (the crash backstop) and again per-agent when an agent comes online — because post-DOD-LOOP-1
-    // the native `startupParkFn` needs the OWNING agent's standing receiver, which exists only once
-    // that agent is online. `filterAgentName` scopes the drain to one agent's sessions on the agent-
-    // online re-run; with no filter it attempts all (the pre-IPC pass / injected-target test path).
-    // M12-P12 (review pass 2): the sender flush now has FOUR triggers (boot, agent start, the parked-
-    // drain hook, signaling reconnect), and two of them fire deterministically together on agent start
-    // — the drain hook runs inside ensureStandingReceiver, whose own .then() then calls this again
-    // while the first pass is still dialling the relay. The receiver twin (contentPark) already
-    // coalesces for exactly this reason; adding triggers to the sender half without the same guard was
-    // an asymmetry, not a decision. Re-run once at the end if a trigger arrived mid-flight, so a
-    // coalesced call never DROPS work — it defers it.
-    const flushInFlight = new Set();
-    const flushRerunRequested = new Set();
-    async function flushAwaitingContent(filterAgentName) {
-        const flushKey = filterAgentName ?? "*";
-        if (flushInFlight.has(flushKey)) {
-            flushRerunRequested.add(flushKey);
-            return;
-        }
-        flushInFlight.add(flushKey);
-        try {
-            await flushAwaitingContentInner(filterAgentName);
-        }
-        finally {
-            flushInFlight.delete(flushKey);
-        }
-        if (flushRerunRequested.delete(flushKey)) {
-            await flushAwaitingContent(filterAgentName);
-        }
-    }
-    async function flushAwaitingContentInner(filterAgentName) {
-        // DOD-AGENT-ID-JOINKEY-1: the queue is keyed by the STABLE agent_id, but the caller (and the
-        // human-readable log) speak the NAME. Resolve once here; log the name, filter by the id.
-        const filterAgentId = filterAgentName !== undefined
-            ? sessionNodeManager.resolveAgentId(filterAgentName)
-            : undefined;
-        const all = retryQueue.getAwaitingSessions();
-        const sessions = filterAgentId === undefined
-            ? all
-            : all.filter((s) => s.agentId === filterAgentId);
-        if (sessions.length === 0)
-            return;
-        const parkFn = config.contentParkFn ?? startupParkFn;
-        if (!parkFn) {
-            const pendingCount = sessions.reduce((n, s) => n + retryQueue.getAwaitingDepth(s.agentId, s.sessionId), 0);
-            logger.warn("content.park.flush.deferred", {
-                sessionCount: sessions.length,
-                pendingCount,
-                reason: "no_content_park_target",
-            });
-            return;
-        }
-        let parkedTotal = 0;
-        for (const s of sessions) {
-            try {
-                parkedTotal += await retryQueue.drainAwaitingToPark(s.agentId, s.sessionId, parkFn, (retryAfterMs) => {
-                    /**
-                     * DOD-M15-RELAYABUSE-1 review HIGH-2 — **the drain path can now schedule its own
-                     * follow-up, which is what makes the retry work for a BACKLOG rather than one message.**
-                     *
-                     * Before this, only the live send path heard the relay's delay. With a backlog larger than
-                     * one rate-limit window, the drain deposited what the window allowed, every remaining item
-                     * was refused, and all of them fell back to waiting for an unrelated reconnect — the exact
-                     * condition the retry timer was added to remove.
-                     *
-                     * ONE timer per pass (the drain reports the largest delay it saw, not one per item), and
-                     * it deliberately does not chain beyond that: the next pass schedules the next one only if
-                     * it is refused again, so a permanently-full relay costs one timer per window rather than
-                     * an accelerating stream of them.
-                     */
-                    scheduleParkRetry(retryAfterMs, filterAgentName, "drain");
-                });
-            }
-            catch (err) {
-                logger.error("content.park.flush.failed", {
-                    sessionId: s.sessionId,
-                    error: extractErrorMessage(err),
-                });
-            }
-        }
-        logger.info("content.park.flush.completed", {
-            sessionCount: sessions.length,
-            parkedCount: parkedTotal,
-            ...(filterAgentName !== undefined ? { agentName: filterAgentName } : {}),
-        });
-    }
-    // `scheduleParkRetry` and `startupParkFn` are NOT returned: their only callers moved with them.
-    // A returned name implies a consumer, and widening the surface for none is the same claim about
-    // coupling that an unused dependency makes.
-    return { retryQueue, parkRetryTimers, flushAwaitingContent };
-}
-//# sourceMappingURL=boot-parked-content.js.map

package/dist/boot-parked-content.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"boot-parked-content.js","sourceRoot":"","sources":["../src/boot-parked-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAKtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAmBzD,MAAM,UAAU,sBAAsB,CAAC,IAA2B;IAChE,MAAM,EACJ,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EACxD,uBAAuB,EAAE,yBAAyB,EAClD,sBAAsB,EAAE,wBAAwB,GACjD,GAAG,IAAI,CAAC;IAET,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,UAAU,CAAC,UAAU,EAAE,CAAC;IACxB,0FAA0F;IAC1F,wFAAwF;IACxF,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,gGAAgG;IAChG,wCAAwC;IACxC,UAAU,CAAC,2BAA2B,EAAE,CAAC;IAEzC,qFAAqF;IACrF,iFAAiF;IACjF,qFAAqF;IACrF,mFAAmF;IACnF,yCAAyC;IACzC,4FAA4F;IAC5F,yFAAyF;IACzF,2FAA2F;IAC3F,+FAA+F;IAC/F,6FAA6F;IAC7F,6FAA6F;IAC7F,kBAAkB,CAAC,6BAA6B,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;QAC9F,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,IAAI,gBAAgB,CAAC;YAC1B,WAAW;YACX,UAAU;YACV,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC;YAC9C,MAAM;YACN,2FAA2F;YAC3F,uDAAuD;YACvD,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,6FAA6F;YAC7F,mEAAmE;YACnE,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,2FAA2F;YAC3F,8FAA8F;YAC9F,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,4FAA4F;YAC5F,6EAA6E;YAC7E,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,mBAAmB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;SACnH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,gGAAgG;IAChG,kGAAkG;IAClG,qFAAqF;IACrF,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE;QACtE,UAAU,CAAC,mBAAmB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEH,kBAAkB,CAAC,mBAAmB,CAAC;QACrC,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE;YACpD,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3H,CAAC;QACD,+FAA+F;QAC/F,kGAAkG;QAClG,iGAAiG;QACjG,+FAA+F;QAC/F,8CAA8C;QAC9C,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE;YACtI,UAAU,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACzN,CAAC;QACD,6FAA6F;QAC7F,8FAA8F;QAC9F,gGAAgG;QAChG,2FAA2F;QAC3F,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE;YAC7I,OAAO,UAAU,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAChO,CAAC;KACF,CAAC,CAAC;IAEH,2FAA2F;IAC3F,8FAA8F;IAC9F,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,2EAA2E;IAC3E,EAAE;IACF,+FAA+F;IAC/F,iGAAiG;IACjG,mGAAmG;IACnG,yFAAyF;IACzF,mGAAmG;IACnG,sFAAsF;IACtF,gGAAgG;IAChG,EAAE;IACF,gGAAgG;IAChG,0CAA0C;IAC1C,kBAAkB,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;QACpE,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QAC9I,IAAI,MAAM,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,eAAmC,EAAE,MAAwB;QAC5G,MAAM,YAAY,GAAG,KAAK,CAAC;QAC3B,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QAC3E,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACxC,MAAM;gBACN,WAAW,EAAE,YAAY;gBACzB,MAAM,EAAE,KAAK;gBACb,MAAM,EACJ,2FAA2F;oBAC3F,wFAAwF;oBACxF,mDAAmD;aACtD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClJ,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,KAAK,oBAAoB,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAChE,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBAC7C,MAAM;oBACN,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;oBAChC,MAAM,EAAE,mGAAmG;iBAC5G,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE;QAC5N,MAAM,IAAI,GAAG,kBAAkB,CAAC,uBAAuB,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,+BAA+B,CAAC;YAC/C,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,4FAA4F;YAC5F,4EAA4E;YAC5E,MAAM,KAAK,GAAG,kBAAkB,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACtG,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,0CAA0C;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;QACD,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,yBAAyB,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1F,iGAAiG;QACjG,mGAAmG;QACnG,sFAAsF;QACtF,gGAAgG;QAChG,6BAA6B;QAC7B,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,6FAA6F;QAC7F,YAAY;QACZ,EAAE;QACF,8FAA8F;QAC9F,iGAAiG;QACjG,6FAA6F;QAC7F,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,gCAAgC;QAChC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,SAAS;YACvB,eAAe;YACf,WAAW,EAAE,gBAAgB;YAC7B,OAAO;YACP,4FAA4F;YAC5F,uEAAuE;YACvE,cAAc;YACd,cAAc;YACd,cAAc;YACd,4FAA4F;YAC5F,8CAA8C;YAC9C,mBAAmB;YACnB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;YACrC,eAAe;YACf,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC;YAC/C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;YACxC,UAAU;SACX,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACpI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YACzC,SAAS;YACT,WAAW,EAAE,cAAc;YAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH;;;;;;;;;;;;;WAaG;QACH,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC3D;;;;;;;;;;;eAWG;YACH,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,sBAAsB;YAC5C,8FAA8F;YAC9F,yFAAyF;YACzF,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qFAAqF;IACrF,oFAAoF;IACpF,qFAAqF;IACrF,uFAAuF;IACvF,uFAAuF;IACvF,qEAAqE;IACrE,EAAE;IACF,uFAAuF;IACvF,uFAAuF;IACvF,uFAAuF;IACvF,kFAAkF;IAClF,4EAA4E;IAC5E,0FAA0F;IAC1F,6FAA6F;IAC7F,+EAA+E;IAC/E,MAAM,aAAa,GAAsC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvE,0FAA0F;QAC1F,kGAAkG;QAClG,qGAAqG;QACrG,MAAM,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAClF,MAAM,EAAE,GAAG,kBAAkB,CAAC,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,mBAAmB;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACrF,uFAAuF;QACvF,+FAA+F;QAC/F,oFAAoF;QACpF,+FAA+F;QAC/F,uDAAuD;QACvD,MAAM,IAAI,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAC5E,8FAA8F;QAC9F,4FAA4F;QAC5F,uFAAuF;QACvF,+FAA+F;QAC/F,8FAA8F;QAC9F,8FAA8F;QAC9F,kCAAkC;QAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC1E,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACrJ,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;QAC7F,+FAA+F;QAC/F,qFAAqF;QACrF,uCAAuC;QACvC,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,6FAA6F;QAC7F,YAAY;QACZ,EAAE;QACF,8FAA8F;QAC9F,iGAAiG;QACjG,6FAA6F;QAC7F,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,gCAAgC;QAChC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK,CAAC,SAAS;YAC7B,eAAe;YACf,WAAW,EAAE,gBAAgB;YAC7B,OAAO,EAAE,KAAK,CAAC,WAAW;YAC1B,6FAA6F;YAC7F,sFAAsF;YACtF,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,6FAA6F;YAC7F,sFAAsF;YACtF,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;YACrC,eAAe;YACf,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC;YACrD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC;YAC9C,UAAU;SACX,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAClI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,gBAAgB;YACrC,8FAA8F;YAC9F,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC,CAAC;IAEF,4FAA4F;IAC5F,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,mGAAmG;IACnG,+FAA+F;IAC/F,4FAA4F;IAC5F,mGAAmG;IACnG,6FAA6F;IAC7F,kDAAkD;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,KAAK,UAAU,oBAAoB,CAAC,eAAwB;QAC1D,MAAM,QAAQ,GAAG,eAAe,IAAI,GAAG,CAAC;QACxC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,yBAAyB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,UAAU,yBAAyB,CAAC,eAAwB;QAC/D,6FAA6F;QAC7F,yFAAyF;QACzF,MAAM,aAAa,GAAG,eAAe,KAAK,SAAS;YACjD,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,eAAe,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,UAAU,CAAC,mBAAmB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,aAAa,KAAK,SAAS;YAC1C,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACzC,YAAY,EAAE,QAAQ,CAAC,MAAM;gBAC7B,YAAY;gBACZ,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,WAAW,IAAI,MAAM,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE;oBACnG;;;;;;;;;;;;;uBAaG;oBACH,iBAAiB,CAAC,YAAY,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;oBACxC,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC1C,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,WAAW,EAAE,WAAW;YACxB,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IACD,gGAAgG;IAChG,gGAAgG;IAChG,4CAA4C;IAC5C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC;AAC/D,CAAC"}

package/dist/boot-sweeps.d.ts

@@ -1,22 +0,0 @@
-/**
- * ONE of the daemon's two background sweeps — the revival-bound sweep — and the timer that re-arms
- * it. The other, the document reconcile sweep, is still in the composition root beside the document
- * wiring it drives.
- *
- * A sweep is not a one-off: a session interrupted at 09:00 on a daemon that stays up all week would
- * otherwise be swept only at the next boot, and a long-lived daemon is the normal case. The timer
- * `unref`s so a pending tick never holds the process open.
- *
- * The timer is returned rather than started-and-forgotten because shutdown has to clear it, and a
- * timer nobody holds a handle to is a process that will not exit.
- */
-import type { Logger } from "./types.js";
-import { type SessionNodeManager } from "./session-node-manager.js";
-export interface BootSweepsDeps {
-    logger: Logger;
-    sessionNodeManager: SessionNodeManager;
-}
-export declare function startBootSweeps(deps: BootSweepsDeps): {
-    revivalBoundSweepTimer: NodeJS.Timeout;
-};
-//# sourceMappingURL=boot-sweeps.d.ts.map

package/dist/boot-sweeps.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"boot-sweeps.d.ts","sourceRoot":"","sources":["../src/boot-sweeps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAA6C,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/G,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc;;EAkDnD"}

package/dist/boot-sweeps.js

@@ -1,51 +0,0 @@
-import { REVIVAL_WINDOW_MS, REVIVAL_BOUND_SWEEP_MS } from "./session-node-manager.js";
-import { extractErrorMessage } from "./error-message.js";
-export function startBootSweeps(deps) {
-    const { logger, sessionNodeManager } = deps;
-    /**
-     * DOD-M12B-REVIVAL-BOUND-1 — close the interrupted sessions the revival window has expired.
-     *
-     * Runs at boot beside the restart-seal resolver, and is its complement: the resolver takes the
-     * sessions we can describe truthfully (`interrupted_by = 'local'`) and gets them a receipt; this
-     * takes everything else and shuts the door without asserting a cause.
-     *
-     * It must run even though nothing has revived a session yet — the reason is Andre's 2026-08-18
-     * tenet, *"leave nothing open that is no longer needed."* `ingestReceivedContent` accepts content
-     * into an `interrupted` session by design, so a session that can never be revived is a write
-     * surface a reprogrammed peer can use for as long as the row exists. Boot is where the store is
-     * swept for exactly that.
-     *
-     * NOT AWAITED, and caught: this is a best-effort sweep over rows that have already waited a day.
-     * Blocking the daemon's startup on a directory-free DB walk buys nothing, and a throw here would
-     * take down a daemon that is otherwise healthy.
-     */
-    const runRevivalBoundSweep = () => {
-        void sessionNodeManager
-            .closeExpiredUnrevivableSessions(Date.now(), REVIVAL_WINDOW_MS)
-            .catch((err) => {
-            logger.warn("session.revival_bound.sweep.failed", {
-                error: extractErrorMessage(err),
-                impact: "expired sessions were not closed this pass and still accept content",
-            });
-        });
-    };
-    runRevivalBoundSweep();
-    /**
-     * RE-ARMED, because boot alone is not a bound.
-     *
-     * A session interrupted at 09:00 on a daemon that stays up all week would otherwise be writable
-     * for the whole week — and a long-lived daemon is the normal case, not the exception. Boot-only
-     * would have made the control fire exactly when it is least needed (a machine that restarts often
-     * is a machine whose sessions get swept often) and never when it is most needed.
-     *
-     * Hourly against a 24-hour window: the overshoot is at most an hour on a bound measured in days,
-     * and the pass is a single indexed DB walk with no network in it. `unref` so a pending timer
-     * never holds the process open, matching `reconcileSweepTimer` beside it.
-     */
-    const revivalBoundSweepTimer = setInterval(runRevivalBoundSweep, REVIVAL_BOUND_SWEEP_MS);
-    revivalBoundSweepTimer.unref?.();
-    // The sweep function itself is not returned — its only callers are here (once at construction,
-    // then on the timer). Only the timer escapes, because shutdown has to clear it.
-    return { revivalBoundSweepTimer };
-}
-//# sourceMappingURL=boot-sweeps.js.map

package/dist/boot-sweeps.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"boot-sweeps.js","sourceRoot":"","sources":["../src/boot-sweeps.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAA2B,MAAM,2BAA2B,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAOzD,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAE5C;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,oBAAoB,GAAG,GAAS,EAAE;QACtC,KAAK,kBAAkB;aACpB,+BAA+B,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC;aAC9D,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EAAE,qEAAqE;aAC9E,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,oBAAoB,EAAE,CAAC;IAEvB;;;;;;;;;;;OAWG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACzF,sBAAsB,CAAC,KAAK,EAAE,EAAE,CAAC;IAEjC,+FAA+F;IAC/F,gFAAgF;IAChF,OAAO,EAAE,sBAAsB,EAAE,CAAC;AACpC,CAAC"}