@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/restart-seal-resolver.d.ts

@@ -1,110 +0,0 @@
-/**
- * DOD-M12B-RESTART-SEAL-1 — resolve the sessions our own stop orphaned, with a receipt.
- *
- * A daemon shutdown flips every open session to `interrupted` on the way out, and nothing has ever
- * moved them again: their transport keypairs died with the process, so they cannot be resumed, and
- * the only exit is `cello_close_session {force:true}`, which forfeits the notarized receipt.
- *
- * This walks them on startup and SEALS them instead — bilateral if the counterparty answers,
- * unilateral once the directory's delivery grace has elapsed. When the directory refuses
- * `seal_unilateral_too_early` it hands back exactly how long is left; that number becomes a
- * scheduled retry rather than a sentence asking a human to come back.
- *
- * SCOPE IS THE WHOLE SAFETY ARGUMENT, and after DOD-M12B-PENDING-RESOLVE-1 it has TWO branches.
- *
- *   1. `interrupted` with `interrupted_by = 'local'` — OURS. Our own boot sweep, shutdown sweep or
- *      kill switch ended it; nobody else did, and it cannot be resumed because the keypairs died
- *      with the process.
- *   2. `seal_interrupted_pending` — a seal commitment that nobody ever asked the directory to
- *      notarize. **This population includes sessions the COUNTERPARTY asked to end**, which is why
- *      the SI-001 boundary in `close-session-handler.ts` had to be restated rather than left as
- *      "nothing the counterparty caused is auto-sealed". SI-001 forbids notarizing a conversation
- *      NOBODY chose to end; here somebody always did — an initiator row carries the counterparty's
- *      signed leaf, and a responder row exists because the counterparty sent a request to seal.
- *
- * Serial and staggered on purpose: a seal is a directory ceremony, and a machine holding hundreds of
- * orphans must not answer a restart with hundreds of simultaneous ceremonies.
- */
-import type { Logger } from "./types.js";
-/** A session our own stop left behind. */
-export interface RestartOrphan {
-    agentName: string;
-    sessionId: string;
-    messageCount: number;
-    /**
-     * DOD-M12B-PENDING-RESOLVE-1: which population this is. Two statuses now reach this queue and
-     * they need different words in a give-up: an `interrupted` session may legitimately be
-     * force-abandoned, and a `seal_interrupted_pending` one must not be, because forcing forfeits a
-     * signed commitment and the relay-witnessed leaves that are one request away from a receipt.
-     */
-    status: "interrupted" | "seal_interrupted_pending";
-}
-/**
- * The result of one seal attempt. `retryAfterSeconds` is the directory's own countdown from
- * `seal_unilateral_too_early` — the delivery grace that has to elapse before a unilateral seal is
- * allowed. It is a WAIT the directory named, not a guess.
- */
-export type SealOutcome = {
-    ok: true;
-} | {
-    ok: false;
-    reason: string;
-    retryAfterSeconds?: number;
-    /** The close path's own guidance. Carried, never replaced — see the give-up log. */
-    guidance?: string;
-    /** Everything the close computed about WHY, so `reason` stops being the only fact. */
-    detail?: Record<string, unknown>;
-};
-export interface ScheduledTask {
-    cancel: () => void;
-}
-export interface RestartSealResolverDeps {
-    logger: Logger;
-    /**
-     * DOD-M12B-PENDING-RESOLVE-1 — TWO populations, each with its own safety argument:
-     *   - `interrupted` AND `interrupted_by = 'local'` — our own stop ended it, so we may describe it.
-     *   - `seal_interrupted_pending` — a seal commitment nobody asked the directory to notarize.
-     * Nothing else is eligible.
-     */
-    listRestartOrphans: () => RestartOrphan[];
-    sealSession: (agentName: string, sessionId: string) => Promise<SealOutcome>;
-    /**
-     * Record DURABLY that this session was given up on, so the next boot does not start over.
-     * Without it a machine restarting ~6 times a day re-attempts a hopeless session forever.
-     *
-     * REQUIRED, not optional. There is exactly one composition root, so optionality buys nothing and
-     * costs the compiler's ability to catch a wiring that was never done — and the whole
-     * justification for the two new columns is that this call happens.
-     */
-    markGaveUp: (agentName: string, sessionId: string, reason: string) => void;
-    now?: () => number;
-    schedule?: (fn: () => void, ms: number) => ScheduledTask;
-    /** Gap between two seal attempts. */
-    staggerMs?: number;
-    /**
-     * How long to wait after boot before the first attempt. A seal needs the directory, and at the
-     * instant the daemon finishes starting, signaling is still being established — firing
-     * immediately would spend an attempt on a connection that does not exist yet.
-     */
-    initialDelayMs?: number;
-    /** Hard ceiling on attempts for one session before it is reported as needing a manual decision. */
-    maxAttemptsPerSession?: number;
-    /**
-     * Ceiling on ONE seal attempt. A close that never settles would otherwise leave `#running` true
-     * with no timer armed and no log line — the resolver stalls, holding a full queue, silently.
-     */
-    attemptTimeoutMs?: number;
-}
-export declare class RestartSealResolver {
-    #private;
-    constructor(deps: RestartSealResolverDeps);
-    /** Enqueue every restart orphan and begin working through them. Idempotent. */
-    start(): void;
-    /**
-     * Stop, and start nothing further. A shutdown that keeps opening directory ceremonies is not
-     * draining (DOD-M12B-SHUTDOWN-1) — and the flag, not the cancelled timer, is what an attempt
-     * already in flight checks when it lands.
-     */
-    stop(): Promise<void>;
-}
-//# sourceMappingURL=restart-seal-resolver.d.ts.map

package/dist/restart-seal-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"restart-seal-resolver.d.ts","sourceRoot":"","sources":["../src/restart-seal-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,aAAa,GAAG,0BAA0B,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,aAAa,EAAE,CAAC;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5E;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,aAAa,CAAC;IACzD,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAoHD,qBAAa,mBAAmB;;gBAkBlB,IAAI,EAAE,uBAAuB;IAUzC,+EAA+E;IAC/E,KAAK,IAAI,IAAI;IA+Bb;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA8LtB"}

package/dist/restart-seal-resolver.js

@@ -1,353 +0,0 @@
-import { extractErrorMessage } from "./error-message.js";
-/**
- * Refusals no retry can ever help, so they cost ONE attempt and not fifteen minutes.
- *
- * Measured 2026-08-17 across 443 submitted seal leaves and 183 completed seals — 59% of seals that
- * start never finish, and these are the reasons where trying again is not persistence:
- *
- *   session_abandoned                          10× — terminal by definition; the receipt is gone.
- *   leaf_count_mismatch                         4× — the two trees genuinely disagree.
- *   seal_interrupted_rejected_by_counterparty  18× — they said NO. Asking again is worse than
- *                                                    noise: it is a machine badgering a peer who
- *                                                    already declined.
- *
- * `seal_carry_bilateral_in_progress` is deliberately NOT here either: it means the relay has what
- * it needs to seal BILATERALLY, so the right move is to come back and find the session already
- * sealed — which then answers `session_already_sealed`, which IS terminal.
- *
- * `session_incomplete` and `seal_unilateral_timeout` are deliberately NOT here. The first can be
- * fixed by a relay pull filling the gap — the close's own guidance says so — and the second is a
- * directory that did not answer in time, which the next attempt may well get.
- */
-/**
- * DOD-M12B-PENDING-RESOLVE-1 (review F2) — refusals that mean "WE were not ready", not "this session
- * is hopeless".
- *
- * Every one of these is a local precondition of OURS. The close handler says so itself:
- * *"`standing_receiver_unavailable` is simply 'the agent is not started yet', which a freshly booted
- * daemon reports for every session."* And a freshly booted daemon is the only time this resolver
- * runs — the receiver is created when `cello_start_agent` reaches the daemon, which on a boot where
- * no client has attached yet has not happened for any agent.
- *
- * Left in the ordinary budget they cost five attempts in ~15 minutes and then a DURABLE
- * `restart_seal_gave_up_at`, which removes the session from the only queue that would ever look at
- * it again. For the `seal_interrupted_pending` population that is materially worse than doing
- * nothing: those rows hold signed commitments and relay-witnessed leaves that are ready to notarize,
- * and the give-up reaches no operator surface at all — it is a warn line in `daemon.log`.
- *
- * So these retry on the same backoff but do NOT consume the attempt budget and can never be the
- * reason for a permanent give-up. They are bounded instead by wall-clock (`#localPreconditionCap`),
- * so a genuinely dead daemon still stops eventually rather than retrying forever.
- */
-const LOCAL_PRECONDITION_REFUSALS = new Set([
-    "standing_receiver_unavailable",
-    "no_persisted_relay_endpoint",
-    "relay_unavailable",
-    "directory_unreachable",
-    "transport_unavailable",
-    /**
-     * `DOD-M15-TOKENSTALE-1` review F2 — the textbook member of this set, and it only started arriving
-     * under its own name when that unit split the submit boundary. Before, it was `relay_unavailable`
-     * and was already covered.
-     *
-     * It clears on a relogin, so it is exactly the "local precondition that will pass later" this set
-     * is for. Left out, it consumes the attempt budget and then writes a DURABLE give-up — removing
-     * sessions holding signed commitments from the only queue that would ever enumerate them again,
-     * which is the 28-session outcome the comment above records.
-     */
-    "online_token_expired",
-    "online_token_required",
-    "online_token_pubkey_mismatch",
-]);
-const TERMINAL_SEAL_REFUSALS = new Set([
-    "session_abandoned",
-    "seal_interrupted_rejected_by_counterparty",
-    "session_already_sealed",
-    // OUR OWN verification finding a genuine divergence between the two trees. Distinct from the
-    // counterparty's `leaf_count_mismatch`, which never reaches here as a top-level reason — it
-    // arrives as `detail.rejection_reason` under the rejection above. Naming the bare string here
-    // was inert: the close cannot produce it.
-    "seal_interrupted_leaf_count_mismatch",
-    // DOD-M15-DIVERGE-1: this side's tree parted from the relay's ordering. Nothing backfills or
-    // re-numbers a leaf, so the refusal is identical on every attempt — spending the retry budget on
-    // it only delays the durable `restart_seal_gave_up_at` it was always going to reach. The operator
-    // decides between comparing counts with the counterparty and force-abandoning; a resolver cannot
-    // do either.
-    "session_record_diverged",
-    "session_not_found",
-    // The relay released the session (it drops one 24 h after the last message), so there is nothing
-    // left for any directory to rebuild the record from. No amount of retrying brings it back.
-    "seal_carry_empty",
-    // Two of our SEAL ctrl leaves in one durable carry. No directory can ever notarize it, and no
-    // retry changes the carry.
-    "seal_carry_duplicate_own_ctrl_leaf",
-    // The lookup that answers "is a ctrl leaf already posted?" failed. Refusing is correct — a second
-    // leaf is permanent — but retrying it five times cannot make the database readable.
-    "seal_leaf_recovery_unavailable",
-    // Not protocol outcomes — a wiring or caller fault. Retrying re-runs the same bug.
-    "session_not_closeable",
-    "close_handler_missing",
-    "missing_params",
-]);
-const DEFAULT_STAGGER_MS = 5_000;
-/** Long enough for the directory handshake started moments earlier to have landed. */
-const DEFAULT_INITIAL_DELAY_MS = 30_000;
-const DEFAULT_MAX_ATTEMPTS = 5;
-/** Backoff for a failure the directory gave no deadline for. Doubles, so a bounded run spans ~1 h. */
-const BASE_BACKOFF_MS = 60_000;
-/** Generous: a close does discovery, a broker dial, a relay submit and a directory round. */
-const DEFAULT_ATTEMPT_TIMEOUT_MS = 120_000;
-function defaultSchedule(fn, ms) {
-    const t = setTimeout(fn, ms);
-    // A background resolver must never be the reason a daemon will not exit.
-    t.unref?.();
-    return { cancel: () => clearTimeout(t) };
-}
-export class RestartSealResolver {
-    #deps;
-    #now;
-    #schedule;
-    #staggerMs;
-    #maxAttempts;
-    #initialDelayMs;
-    #attemptTimeoutMs;
-    /** Resolves when no attempt is in flight — awaited by stop() so a shutdown does not cut a
-     *  ceremony in half and leave the two sides permanently divergent. */
-    #inFlight = null;
-    #queue = new Map();
-    #timer = null;
-    #started = false;
-    #stopped = false;
-    #running = false;
-    constructor(deps) {
-        this.#deps = deps;
-        this.#now = deps.now ?? (() => Date.now());
-        this.#schedule = deps.schedule ?? defaultSchedule;
-        this.#staggerMs = deps.staggerMs ?? DEFAULT_STAGGER_MS;
-        this.#maxAttempts = deps.maxAttemptsPerSession ?? DEFAULT_MAX_ATTEMPTS;
-        this.#initialDelayMs = deps.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;
-        this.#attemptTimeoutMs = deps.attemptTimeoutMs ?? DEFAULT_ATTEMPT_TIMEOUT_MS;
-    }
-    /** Enqueue every restart orphan and begin working through them. Idempotent. */
-    start() {
-        if (this.#started || this.#stopped)
-            return;
-        this.#started = true;
-        let orphans;
-        try {
-            orphans = this.#deps.listRestartOrphans();
-        }
-        catch (err) {
-            // ABSENT IS NOT FINE. If we cannot read the list, say so — silence here reads exactly like
-            // "there was nothing to resolve", which is the state this unit exists to end.
-            this.#deps.logger.error("session.restart_seal.enumerate.failed", {
-                error: extractErrorMessage(err),
-                impact: "sessions the last shutdown orphaned will stay interrupted and unsealed",
-            });
-            return;
-        }
-        if (orphans.length === 0)
-            return;
-        const now = this.#now();
-        const firstAt = now + this.#initialDelayMs;
-        for (const orphan of orphans) {
-            this.#queue.set(`${orphan.agentName}:${orphan.sessionId}`, { orphan, attempts: 0, nextAt: firstAt });
-        }
-        this.#deps.logger.info("session.restart_seal.enqueued", {
-            count: orphans.length,
-            impact: "sessions the last shutdown left open will be sealed rather than left for a force-abandon",
-        });
-        this.#arm(this.#initialDelayMs);
-    }
-    /**
-     * Stop, and start nothing further. A shutdown that keeps opening directory ceremonies is not
-     * draining (DOD-M12B-SHUTDOWN-1) — and the flag, not the cancelled timer, is what an attempt
-     * already in flight checks when it lands.
-     */
-    stop() {
-        this.#stopped = true;
-        this.#timer?.cancel();
-        this.#timer = null;
-        this.#queue.clear();
-        // AWAIT what is already in flight. Severing signaling under a half-finished seal-interrupted
-        // exchange leaves the counterparty holding a commitment we never acknowledged: their session
-        // advances to `seal_interrupted_pending` and ours stays `interrupted`, permanently divergent
-        // and produced automatically on every shutdown.
-        //
-        // WHAT IS AWAITED IS THE BOUNDED RACE, NOT THE CLOSE. Returning the raw `sealSession` promise
-        // would hang shutdown forever on a close that never settles — and shutdown holds the SQLCipher
-        // write lock, so "forever" means a daemon that cannot be restarted. `attemptTimeoutMs` bounds
-        // this wait because the raced promise is what is stored.
-        //
-        // THE RESIDUAL WINDOW IS ACCEPTED, NOT CLOSED, and it is stated here rather than implied.
-        // Once the timeout wins the race, `#inFlight` is cleared while the underlying close may still
-        // be running — so a `stop()` arriving after that point returns immediately and can still sever
-        // signaling under a half-finished exchange. That is the deliberate trade: a bounded shutdown is
-        // worth more than a guaranteed-clean one, because an unbounded wait here wedges the daemon
-        // permanently while the divergence it prevents is repairable by the next close. An attempt
-        // taking longer than `attemptTimeoutMs` is not pathological — the interrupted path can spend
-        // 30 s in the seal flow, 30 s in a retry after discovery, and 30 s in the escalation.
-        return this.#inFlight ? this.#inFlight.then(() => undefined, () => undefined) : Promise.resolve();
-    }
-    /** Arm the next pass only while there is still work. An empty queue must leave NO timer behind —
-     *  a resolver that keeps a dead timer alive is a resolver that shows up in a shutdown trace. */
-    #armIfWork() {
-        if (this.#queue.size === 0)
-            return;
-        this.#arm(this.#staggerMs);
-    }
-    #arm(delayMs) {
-        if (this.#stopped)
-            return;
-        this.#timer?.cancel();
-        this.#timer = this.#schedule(() => {
-            this.#timer = null;
-            void this.#pump();
-        }, delayMs);
-    }
-    async #pump() {
-        if (this.#stopped || this.#running)
-            return;
-        if (this.#queue.size === 0)
-            return;
-        const now = this.#now();
-        let due = null;
-        for (const item of this.#queue.values()) {
-            if (item.nextAt <= now && (due === null || item.nextAt < due.nextAt))
-                due = item;
-        }
-        if (due === null) {
-            // Nothing is due yet — sleep until the earliest deadline rather than polling.
-            let earliest = Infinity;
-            for (const item of this.#queue.values())
-                earliest = Math.min(earliest, item.nextAt);
-            if (earliest !== Infinity)
-                this.#arm(Math.max(0, earliest - now));
-            return;
-        }
-        const item = due;
-        const key = `${item.orphan.agentName}:${item.orphan.sessionId}`;
-        item.attempts += 1;
-        this.#running = true;
-        let outcome;
-        let attemptTimer = null;
-        try {
-            const attempt = this.#deps.sealSession(item.orphan.agentName, item.orphan.sessionId);
-            // A close that never settles must not wedge the queue silently.
-            const timeout = new Promise((resolve) => {
-                attemptTimer = this.#schedule(() => resolve({ ok: false, reason: "restart_seal_attempt_timeout" }), this.#attemptTimeoutMs);
-            });
-            // The RACE is what stop() awaits — see stop(). Storing the raw attempt here would make a
-            // hung close a hung shutdown; storing the race makes the wait bounded by attemptTimeoutMs.
-            const raced = Promise.race([attempt, timeout]);
-            this.#inFlight = raced;
-            // A rejected `attempt` still settles the race, and #inFlight is only ever awaited with both
-            // handlers attached (stop()), so this cannot surface as an unhandled rejection.
-            attempt.catch(() => { });
-            outcome = await raced;
-        }
-        catch (err) {
-            outcome = { ok: false, reason: extractErrorMessage(err) };
-        }
-        finally {
-            attemptTimer?.cancel();
-            this.#inFlight = null;
-            this.#running = false;
-        }
-        // Re-checked AFTER the await: stop() can land while a ceremony is in flight, and the queue it
-        // cleared must not be repopulated by this attempt's bookkeeping.
-        if (this.#stopped)
-            return;
-        if (outcome.ok) {
-            this.#queue.delete(key);
-            this.#deps.logger.info("session.restart_seal.resolved", {
-                agentName: item.orphan.agentName,
-                sessionId: item.orphan.sessionId,
-                attempts: item.attempts,
-                messageCount: item.orphan.messageCount,
-            });
-            this.#armIfWork();
-            return;
-        }
-        const terminal = TERMINAL_SEAL_REFUSALS.has(outcome.reason);
-        /**
-         * review F2 — a local precondition is not a verdict on the session.
-         *
-         * `attempts` is decremented back so this pass costs nothing from the budget: the session is
-         * retried on the same backoff, and only a refusal that says something about the SESSION can
-         * exhaust it. Without this, all 28 pending sessions were durably given up on ~15 minutes after
-         * every boot, and no future boot would ever enumerate them again.
-         */
-        const localPrecondition = !terminal && LOCAL_PRECONDITION_REFUSALS.has(outcome.reason);
-        if (localPrecondition) {
-            item.attempts = Math.max(0, item.attempts - 1);
-            this.#deps.logger.info("session.restart_seal.not_ready", {
-                agentName: item.orphan.agentName,
-                sessionId: item.orphan.sessionId,
-                reason: outcome.reason,
-                impact: "a local precondition, not a verdict on the session — retried without spending an attempt",
-            });
-        }
-        if (terminal || (!localPrecondition && item.attempts >= this.#maxAttempts)) {
-            this.#queue.delete(key);
-            // DURABLE, so the next boot does not start the same five attempts over. A machine restarting
-            // ~6 times a day would otherwise re-try a hopeless session forever, which is the burst the
-            // stagger exists to prevent, merely spread out.
-            try {
-                this.#deps.markGaveUp(item.orphan.agentName, item.orphan.sessionId, outcome.reason);
-            }
-            catch (err) {
-                this.#deps.logger.warn("session.restart_seal.mark_gave_up.failed", {
-                    sessionId: item.orphan.sessionId,
-                    error: extractErrorMessage(err),
-                    impact: "this session will be re-attempted on every future boot",
-                });
-            }
-            this.#deps.logger.warn("session.restart_seal.gave_up", {
-                agentName: item.orphan.agentName,
-                sessionId: item.orphan.sessionId,
-                attempts: item.attempts,
-                reason: outcome.reason,
-                // WHY it stopped, not just that it did. "We stopped because they refused" and "we stopped
-                // because we ran out of tries" are different facts and lead to different operator actions.
-                stoppedBecause: terminal ? "refusal_is_terminal" : "attempts_exhausted",
-                // The detail the close COMPUTED and used to drop one function later: which of the six
-                // causes behind `seal_interrupted_rejected_by_counterparty` this was, and the leaf counts
-                // that identify a frontier strand.
-                ...(outcome.detail ? { detail: outcome.detail } : {}),
-                // THE CLOSE'S OWN GUIDANCE WINS. A fixed string here told the operator to force-abandon —
-                // and for `session_already_sealed` the close handler says in capitals NOT to, because
-                // forcing there permanently forfeits a half that is still recoverable.
-                // review F4: the fallback must not tell a `seal_interrupted_pending` session it is
-                // "interrupted", nor point at force-abandon — forcing there forfeits a signed commitment and
-                // the relay-witnessed leaves that are ready to notarize.
-                guidance: outcome.guidance ??
-                    (item.orphan.status === "seal_interrupted_pending"
-                        ? ("This session holds a seal commitment and could not be notarized automatically. The " +
-                            "commitment and the full transcript are intact — retry cello_close_session once the " +
-                            "agent is started and the daemon reports healthy. Do NOT force-abandon it: that ends " +
-                            "it WITHOUT the receipt it is one request away from having.")
-                        : ("This session could not be sealed automatically and is still interrupted. Close it with " +
-                            "cello_close_session, or force-abandon it — which ends it WITHOUT a notarized receipt.")),
-            });
-            this.#armIfWork();
-            return;
-        }
-        // The directory named a deadline: wait exactly that long. Anything else either batters it with
-        // refusals or leaves the session sitting after the grace has elapsed.
-        const waitMs = typeof outcome.retryAfterSeconds === "number" && outcome.retryAfterSeconds >= 0
-            ? outcome.retryAfterSeconds * 1_000
-            : BASE_BACKOFF_MS * 2 ** (item.attempts - 1);
-        item.nextAt = this.#now() + waitMs;
-        this.#deps.logger.info("session.restart_seal.waiting", {
-            agentName: item.orphan.agentName,
-            sessionId: item.orphan.sessionId,
-            attempts: item.attempts,
-            reason: outcome.reason,
-            ...(typeof outcome.retryAfterSeconds === "number" ? { retryAfterSeconds: outcome.retryAfterSeconds } : {}),
-            retryInMs: waitMs,
-        });
-        this.#arm(Math.min(this.#staggerMs, waitMs));
-    }
-}
-//# sourceMappingURL=restart-seal-resolver.js.map

package/dist/restart-seal-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"restart-seal-resolver.js","sourceRoot":"","sources":["../src/restart-seal-resolver.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA2EzD;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAC/D,+BAA+B;IAC/B,6BAA6B;IAC7B,mBAAmB;IACnB,uBAAuB;IACvB,uBAAuB;IACvB;;;;;;;;;OASG;IACH,sBAAsB;IACtB,uBAAuB;IACvB,8BAA8B;CAC/B,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,mBAAmB;IACnB,2CAA2C;IAC3C,wBAAwB;IACxB,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,0CAA0C;IAC1C,sCAAsC;IACtC,6FAA6F;IAC7F,iGAAiG;IACjG,kGAAkG;IAClG,iGAAiG;IACjG,aAAa;IACb,yBAAyB;IACzB,mBAAmB;IACnB,iGAAiG;IACjG,2FAA2F;IAC3F,kBAAkB;IAClB,8FAA8F;IAC9F,2BAA2B;IAC3B,oCAAoC;IACpC,kGAAkG;IAClG,oFAAoF;IACpF,gCAAgC;IAChC,mFAAmF;IACnF,uBAAuB;IACvB,uBAAuB;IACvB,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,sGAAsG;AACtG,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,6FAA6F;AAC7F,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAQ3C,SAAS,eAAe,CAAC,EAAc,EAAE,EAAU;IACjD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7B,yEAAyE;IACzE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAA0B;IAC/B,IAAI,CAAe;IACnB,SAAS,CAAgD;IACzD,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,iBAAiB,CAAS;IACnC;0EACsE;IACtE,SAAS,GAA4B,IAAI,CAAC;IAEjC,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC/C,MAAM,GAAyB,IAAI,CAAC;IACpC,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,IAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,qBAAqB,IAAI,oBAAoB,CAAC;QACvE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACvE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAC/E,CAAC;IAED,+EAA+E;IAC/E,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,OAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBAC/D,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EAAE,wEAAwE;aACjF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACtD,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,MAAM,EAAE,0FAA0F;SACnG,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;QAC7F,gDAAgD;QAChD,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,yDAAyD;QACzD,EAAE;QACF,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,2FAA2F;QAC3F,6FAA6F;QAC7F,sFAAsF;QACtF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACpG,CAAC;IAED;oGACgG;IAChG,UAAU;QACR,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,GAAqB,IAAI,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBAAE,GAAG,GAAG,IAAI,CAAC;QACnF,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,8EAA8E;YAC9E,IAAI,QAAQ,GAAG,QAAQ,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACpF,IAAI,QAAQ,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAChE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,OAAoB,CAAC;QACzB,IAAI,YAAY,GAAyB,IAAI,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrF,gEAAgE;YAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;gBACnD,YAAY,GAAG,IAAI,CAAC,SAAS,CAC3B,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,EACpE,IAAI,CAAC,iBAAiB,CACvB,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,yFAAyF;YACzF,2FAA2F;YAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;YACvB,4FAA4F;YAC5F,gFAAgF;YAChF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAoC,CAAC,CAAC,CAAC;YAC1D,OAAO,GAAG,MAAM,KAAK,CAAC;QACxB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,CAAC;gBAAS,CAAC;YACR,YAAqC,EAAE,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,8FAA8F;QAC9F,iEAAiE;QACjE,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBACtD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACvC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D;;;;;;;WAOG;QACH,MAAM,iBAAiB,GAAG,CAAC,QAAQ,IAAI,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvF,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACvD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,0FAA0F;aACnG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,6FAA6F;YAC7F,2FAA2F;YAC3F,gDAAgD;YAChD,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAC5F,OAAO,GAAY,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;oBACjE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAChC,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;oBAC/B,MAAM,EAAE,wDAAwD;iBACjE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBACrD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,0FAA0F;gBAC1F,2FAA2F;gBAC3F,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB;gBACvE,sFAAsF;gBACtF,0FAA0F;gBAC1F,mCAAmC;gBACnC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,0FAA0F;gBAC1F,sFAAsF;gBACtF,uEAAuE;gBACvE,mFAAmF;gBACnF,6FAA6F;gBAC7F,yDAAyD;gBACzD,QAAQ,EACN,OAAO,CAAC,QAAQ;oBAChB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,0BAA0B;wBAChD,CAAC,CAAC,CAAC,qFAAqF;4BACrF,qFAAqF;4BACrF,sFAAsF;4BACtF,4DAA4D,CAAC;wBAChE,CAAC,CAAC,CAAC,yFAAyF;4BACzF,uFAAuF,CAAC,CAAC;aACjG,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,+FAA+F;QAC/F,sEAAsE;QACtE,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC;YAC7E,CAAC,CAAC,OAAO,CAAC,iBAAiB,GAAG,KAAK;YACnC,CAAC,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YACrD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/resume-last-seen.d.ts

@@ -1,15 +0,0 @@
-import type { SessionSealLeafStore } from "./session-seal-leaf-store.js";
-import type { DaemonDatabase } from "./sqlcipher-db.js";
-import type { Logger } from "./types.js";
-/** Record an acknowledgement the live path just made. Forward-only: an earlier position is ignored. */
-export declare function recordLastAck(db: DaemonDatabase, a: {
-    agentId: string;
-    sessionId: string;
-    seq: number;
-    hash: Uint8Array;
-}): void;
-export declare function lastSeenFromRecord(store: SessionSealLeafStore, logger: Logger, ownPubkey: Uint8Array, sessionIdHex: string): {
-    seq: number;
-    hash: Uint8Array;
-} | undefined;
-//# sourceMappingURL=resume-last-seen.d.ts.map

package/dist/resume-last-seen.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resume-last-seen.d.ts","sourceRoot":"","sources":["../src/resume-last-seen.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,uGAAuG;AACvG,wBAAgB,aAAa,CAC3B,EAAE,EAAE,cAAc,EAClB,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACvE,IAAI,CAMN;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,SAAS,CAgB/C"}

package/dist/resume-last-seen.js

@@ -1,44 +0,0 @@
-/**
- * Where a resumed session's acknowledgement starts — from the durable record, not from nothing.
- *
- * The relay client keeps "the last position I saw from you" in memory. A session interrupted after
- * messages (Ctrl-C, a restart) came back at position 0, so every close claimed "I have seen nothing
- * from you". The relay refuses that as stale, because the other side's messages are filed after 0,
- * and the re-sign waits for a new message that never comes: the session could never seal (live,
- * 2026-09-14).
- *
- * Two durable sources, both holding RELAY positions — never a position guessed from the local leaf
- * index, which can drift one ahead of the relay:
- *   - `session_last_ack`: what the live path acknowledged, written at the moment it did, for every
- *     route a message can arrive by (relay, direct, recovered park, screened-out);
- *   - the seal leaf store: every leaf the other side authored that the relay delivered, with the
- *     Structure 1 they signed.
- * The higher of the two is where the live path would have been.
- */
-import { decodeStructure1 } from "@cello-protocol/protocol-types";
-/** Record an acknowledgement the live path just made. Forward-only: an earlier position is ignored. */
-export function recordLastAck(db, a) {
-    db.prepare(`INSERT INTO session_last_ack (agent_id, session_id, relay_seq, hash_hex) VALUES (?, ?, ?, ?)
-     ON CONFLICT (agent_id, session_id) DO UPDATE SET relay_seq = excluded.relay_seq, hash_hex = excluded.hash_hex
-     WHERE excluded.relay_seq > session_last_ack.relay_seq`).run(a.agentId, a.sessionId, a.seq, Buffer.from(a.hash).toString("hex"));
-}
-export function lastSeenFromRecord(store, logger, ownPubkey, sessionIdHex) {
-    const own = Buffer.from(ownPubkey);
-    let best = store.recordedAcknowledgement(own.toString("hex"), sessionIdHex);
-    for (const leaf of store.getCarry(own.toString("hex"), sessionIdHex)) {
-        const s1 = decodeStructure1(leaf.structure1Cbor);
-        if (!s1.ok) {
-            logger.warn("session.relay.last_seen.resume_leaf_unreadable", {
-                sessionId: sessionIdHex, sequenceNumber: leaf.sequenceNumber, reason: s1.reason,
-                impact: "this stored leaf is skipped when resuming, so a close may claim an earlier position and be refused as stale",
-            });
-            continue;
-        }
-        if (Buffer.from(s1.fields.senderPubkey).equals(own))
-            continue;
-        if (!best || leaf.sequenceNumber > best.seq)
-            best = { seq: leaf.sequenceNumber, hash: s1.fields.contentHash };
-    }
-    return best;
-}
-//# sourceMappingURL=resume-last-seen.js.map

package/dist/resume-last-seen.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resume-last-seen.js","sourceRoot":"","sources":["../src/resume-last-seen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAKlE,uGAAuG;AACvG,MAAM,UAAU,aAAa,CAC3B,EAAkB,EAClB,CAAwE;IAExE,EAAE,CAAC,OAAO,CACR;;2DAEuD,CACxD,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA2B,EAC3B,MAAc,EACd,SAAqB,EACrB,YAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,IAAI,GAAG,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBAC5D,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;gBAC/E,MAAM,EAAE,6GAA6G;aACtH,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG;YAAE,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAChH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}