@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/seal-evidence-root-check.js

@@ -0,0 +1,199 @@
+/**
+ * CO-SIGN A ROOT FROM THE DIRECTORY'S EVIDENCE WHEN THIS SIDE'S OWN CARRY IS SHORT — and only when the
+ * evidence proves itself.
+ *
+ * ─── The failure this exists for ───────────────────────────────────────────────────────────────
+ *
+ * Live 2026-09-16, session `9bcfc168…`. A daemon restarted mid-conversation. Its session identity
+ * was gone, so for the rest of the session the relay refused its connection `not_a_participant` — it
+ * could still SEND its seal leaf, but it could never RECEIVE the counterparty's. Asked to co-sign, it
+ * held 1 of 2 SEAL leaves, `verifyCertifiedRoot` answered `cannot_judge`, and it correctly refused.
+ * No co-signature, so no certificate was ever stored — on any directory node — and nobody was told.
+ *
+ * The leaf it was missing was sitting in the request it was refusing. `seal_verified` carries
+ * `frontier_leaves`: the whole ordered leaf set the directory rebuilt the root from, each with its
+ * sender's signature. So this side does not need the stream it lost. It needs to check that evidence.
+ *
+ * ─── What must hold before signing, and why each one ──────────────────────────────────────────
+ *
+ * The directory is NOT trusted for any of this. Signing puts this agent's key on a durable,
+ * non-repudiable claim, so every condition is checked here against something the directory cannot
+ * forge:
+ *
+ *   1. EVERY LEAF THIS SIDE ALREADY HOLDS APPEARS IN THE EVIDENCE, AT THE SAME POSITION, WITH THE SAME
+ *      CONTENT HASH. The evidence may FILL gaps; it may never override a leaf this side witnessed. A
+ *      contradiction here is an accusation, not a gap — `mismatch`.
+ *   2. EVERY EVIDENCE LEAF IS SIGNED BY A PARTICIPANT OF THIS SESSION, FOR THIS SESSION. The
+ *      participants come from THIS side's own session record, never from the frame — the frame is the
+ *      thing being checked. The signature is verified over the exact Structure 1 bytes, the signer is
+ *      the key named inside them, and the session id inside them is this one.
+ *   3. THE EVIDENCE HASHES TO THE CERTIFIED ROOT, AND ITS SIZE IS THE CERTIFIED COUNT. Both are
+ *      recomputed here.
+ *
+ * With all three, the root this side signs is over a leaf set that agrees with everything it saw,
+ * whose remaining leaves the participants themselves signed, and which the certificate describes.
+ *
+ *   4. EACH SENDER'S LEAVES FORM AN UNBROKEN CHAIN FROM THE SESSION ANCHOR, IN EVIDENCE ORDER. Every
+ *      Structure 1 names its sender's previous leaf, and the relay refused any link that was not the
+ *      immediate predecessor. Walking those links is what fixes the position of a leaf this side
+ *      never saw — without it, a gap could be filled with a replay of a genuinely signed earlier
+ *      leaf. No two leaves may be byte-identical.
+ *
+ * ─── What this deliberately does NOT establish ─────────────────────────────────────────────────
+ *
+ * How the two senders' chains INTERLEAVE in positions this side never held. Each sender's own order
+ * is pinned; the relative order of one sender's unseen leaf against the other's rests on the
+ * directory's rebuild. `lastSeenHash` could narrow that and is not used here yet.
+ *
+ * Crypto refs: RFC 8032 (Ed25519 signature verification), RFC 6962 §2.1 (Merkle hash trees).
+ */
+import { buildMerkleTree, merkleRoot, verify } from "@cello-protocol/crypto";
+import { decodeStructure1 } from "@cello-protocol/protocol-types";
+/** Read one `frontier_leaves` entry off the wire, or null if it is not the three byte fields it must be. */
+export function parseEvidenceLeaf(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return null;
+    const o = raw;
+    // Arrays accepted as well as Uint8Array for the same reason the ceremony's own frontier parser
+    // accepts ArrayLike: the frame reaches here re-encoded across the daemon's IPC as well as off CBOR.
+    const bytes = (v) => v instanceof Uint8Array ? v : Array.isArray(v) ? Uint8Array.from(v) : null;
+    const s1 = bytes(o["structure1_cbor"]);
+    const pk = bytes(o["sender_pubkey"]);
+    const sig = bytes(o["sender_signature"]);
+    return s1 && pk && sig ? { structure1_cbor: s1, sender_pubkey: pk, sender_signature: sig } : null;
+}
+export function verifyCertifiedRootFromEvidence(args) {
+    const { ownCarry, evidence, sessionIdHex, participantsHex, certifiedRoot, certifiedLeafCount, genesis } = args;
+    if (participantsHex.length !== 2)
+        return { verdict: "cannot_judge", reason: "participants_unknown" };
+    // Without the anchor the chains cannot be walked, and an unwalked gap is exactly what a replay needs.
+    if (!genesis)
+        return { verdict: "cannot_judge", reason: "genesis_unknown" };
+    if (evidence.length === 0)
+        return { verdict: "cannot_judge", reason: "no_evidence" };
+    if (evidence.length !== certifiedLeafCount) {
+        return { verdict: "mismatch", detail: `evidence_size_disagrees: ${evidence.length} leaves, certificate claims ${certifiedLeafCount}` };
+    }
+    const participants = new Set(participantsHex.map((p) => p.toLowerCase()));
+    const hashes = [];
+    /**
+     * ⚠️ EACH LEAF CHECKED ALONE PROVES NOTHING ABOUT WHERE IT SITS — review, HIGH.
+     *
+     * A signed Structure 1 is valid wherever it is placed, and the root is built from content hashes
+     * only. So the first version accepted a set in which positions this side never saw held COPIES of
+     * a participant's earlier, genuinely signed leaves: a counterparty's "I withdraw the offer" and
+     * their closing leaf replaced by replays of their greeting. Every per-leaf check passed, the count
+     * and root agreed, and this agent's key went on a conversation that did not happen. What bounded it
+     * was the honest co-signing directories — i.e. nothing, against the colluding threshold this check
+     * exists to stand against.
+     *
+     * The leaves already say how they link. `prevOwnHash` names the SAME sender's previous leaf, and
+     * the relay refused every submission whose link was not the immediate predecessor — SEAL leaves
+     * included. So walking each sender's leaves in evidence order must reproduce that chain exactly,
+     * starting from the session anchor. A replay breaks it, a reordering breaks it, and a message
+     * dropped from the middle of a run breaks it. Byte-identical leaves are refused outright too.
+     */
+    const seen = new Set();
+    const lastBySender = new Map();
+    for (let i = 0; i < evidence.length; i++) {
+        const leaf = parseEvidenceLeaf(evidence[i]);
+        if (!leaf)
+            return { verdict: "cannot_judge", reason: `evidence_leaf_malformed: position ${i + 1}` };
+        const senderHex = Buffer.from(leaf.sender_pubkey).toString("hex");
+        // 2. A participant of THIS session — named by our own record, not by the frame.
+        if (!participants.has(senderHex)) {
+            return { verdict: "mismatch", detail: `evidence_sender_not_a_participant: position ${i + 1}` };
+        }
+        if (!verify(leaf.sender_pubkey, leaf.structure1_cbor, leaf.sender_signature)) {
+            return { verdict: "mismatch", detail: `evidence_signature_invalid: position ${i + 1}` };
+        }
+        const s1 = decodeStructure1(leaf.structure1_cbor);
+        if (!s1.ok)
+            return { verdict: "cannot_judge", reason: `evidence_structure1_undecodable: position ${i + 1}` };
+        // The key that signed must be the key the claim names, and the claim must be for THIS session. A
+        // valid signature over a claim for another conversation authorises nothing here.
+        if (Buffer.from(s1.fields.senderPubkey).toString("hex") !== senderHex) {
+            return { verdict: "mismatch", detail: `evidence_signer_is_not_the_named_sender: position ${i + 1}` };
+        }
+        if (Buffer.from(s1.fields.sessionId).toString("hex") !== sessionIdHex.toLowerCase()) {
+            return { verdict: "mismatch", detail: `evidence_leaf_is_for_another_session: position ${i + 1}` };
+        }
+        const bytesHex = Buffer.from(leaf.structure1_cbor).toString("hex");
+        if (seen.has(bytesHex))
+            return { verdict: "mismatch", detail: `evidence_leaf_repeated: position ${i + 1}` };
+        seen.add(bytesHex);
+        const expectedPrev = lastBySender.get(senderHex) ?? genesis;
+        if (Buffer.compare(Buffer.from(s1.fields.prevOwnHash), Buffer.from(expectedPrev)) !== 0) {
+            return { verdict: "mismatch", detail: `evidence_self_chain_broken: position ${i + 1}` };
+        }
+        lastBySender.set(senderHex, s1.fields.contentHash);
+        hashes.push(s1.fields.contentHash);
+    }
+    // 1. The evidence may fill gaps; it may never override what this side witnessed.
+    let held = 0;
+    for (const own of ownCarry) {
+        const s1 = decodeStructure1(own.structure1Cbor);
+        if (!s1.ok)
+            return { verdict: "cannot_judge", reason: `own_leaf_undecodable: sequence ${own.sequenceNumber}` };
+        const at = hashes[own.sequenceNumber - 1];
+        if (at === undefined || Buffer.compare(Buffer.from(at), Buffer.from(s1.fields.contentHash)) !== 0) {
+            return { verdict: "mismatch", detail: `evidence_contradicts_own_leaf: sequence ${own.sequenceNumber}` };
+        }
+        held += 1;
+    }
+    // 3. The certificate describes exactly this set.
+    const root = merkleRoot(buildMerkleTree(hashes.map((data) => ({ kind: "hash", data }))));
+    if (Buffer.compare(Buffer.from(root), Buffer.from(certifiedRoot)) !== 0) {
+        return { verdict: "mismatch", detail: "evidence_root_disagrees: the evidence does not hash to the certified root" };
+    }
+    return { verdict: "match", filled: evidence.length - held };
+}
+/**
+ * The daemon's entry point: consult the evidence for a seal this side's own carry could not judge,
+ * reading the participants from THIS side's session row.
+ *
+ * Lives here rather than in `session-seal.ts` so the whole decision — where the participants come
+ * from, what is logged, what each verdict becomes — sits beside the rules it applies.
+ */
+export function judgeFromEvidence(deps, a) {
+    const record = sessionFromRecord(deps.db, a.agentPubkeyHex, a.sessionIdHex);
+    const checked = verifyCertifiedRootFromEvidence({
+        ownCarry: deps.ownCarry, evidence: a.evidence, sessionIdHex: a.sessionIdHex,
+        participantsHex: record?.participantsHex ?? [],
+        genesis: record?.genesis,
+        certifiedRoot: a.certifiedRoot, certifiedLeafCount: a.certifiedLeafCount,
+    });
+    if (checked.verdict === "match") {
+        deps.logger.info("session.seal.carry.completed_from_evidence", {
+            sessionId: a.sessionIdHex, filled: checked.filled, ownVerdict: a.ownReason,
+            impact: "this side was missing leaves it never received; the co-sign request's own signed evidence filled them, agreed with every leaf this side held, and hashed to the certified root",
+        });
+        return { verdict: "match" };
+    }
+    return checked.verdict === "mismatch"
+        ? { verdict: "mismatch", ownRootHex: null, detail: checked.detail }
+        : { verdict: "cannot_judge", reason: `${a.ownReason}; evidence: ${checked.reason}` };
+}
+/**
+ * Both participants and the session's chain anchor, from THIS side's own record — never from a frame,
+ * because the frame is what is being checked. `null` when the record is missing, which refuses.
+ *
+ * ⚠️ BY `agent_id`, WITH NO AGENT NAME ANYWHERE. The first version selected `agent_name` to key the
+ * anchor lookup, which is the mutable-label join `DOD-AGENT-ID-JOINKEY-1` exists to stop — a retired
+ * name reused by another keypair would hand this check the wrong session's anchor. The row already
+ * holds the anchor: `genesis_prev_root` is written from the same live value the leaves were chained
+ * from, and it is the copy a restarted daemon reads anyway.
+ */
+function sessionFromRecord(db, agentPubkeyHex, sessionIdHex) {
+    if (!db)
+        return null;
+    const row = db
+        .prepare("SELECT s.counterparty_pubkey AS cp, s.genesis_prev_root AS g FROM sessions s JOIN agents a ON a.agent_id = s.agent_id WHERE a.k_local_pubkey = ? AND s.session_id = ?")
+        .get(agentPubkeyHex, sessionIdHex);
+    if (!row)
+        return null;
+    const g = row.g instanceof Uint8Array ? row.g : Buffer.isBuffer(row.g) ? new Uint8Array(row.g) : null;
+    // A stored value of the wrong width is not an anchor; refusing beats walking a chain from garbage.
+    return { participantsHex: [agentPubkeyHex.toLowerCase(), row.cp.toLowerCase()], genesis: g && g.length === 32 ? g : undefined };
+}
+//# sourceMappingURL=seal-evidence-root-check.js.map

package/dist/seal-evidence-root-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-evidence-root-check.js","sourceRoot":"","sources":["../src/seal-evidence-root-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAclE,4GAA4G;AAC5G,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,+FAA+F;IAC/F,oGAAoG;IACpG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAqB,EAAE,CAC9C,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAgB/C;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/G,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACrG,sGAAsG;IACtG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,4BAA4B,QAAQ,CAAC,MAAM,+BAA+B,kBAAkB,EAAE,EAAE,CAAC;IACzI,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,qCAAqC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACpG,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClE,gFAAgF;QAChF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,+CAA+C,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,6CAA6C,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC7G,iGAAiG;QACjG,iFAAiF;QACjF,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,qDAAqD,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,kDAAkD,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACpG,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oCAAoC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC5G,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC;QAC5D,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACxF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC1F,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED,iFAAiF;IACjF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,kCAAkC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/G,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAClG,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,2CAA2C,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1G,CAAC;QACD,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IAED,iDAAiD;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,2EAA2E,EAAE,CAAC;IACtH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAIC,EACD,CAOC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY;QAC3E,eAAe,EAAE,MAAM,EAAE,eAAe,IAAI,EAAE;QAC9C,OAAO,EAAE,MAAM,EAAE,OAAO;QACxB,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;KACzE,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;YAC7D,SAAS,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS;YAC1E,MAAM,EAAE,gLAAgL;SACzL,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;QACnE,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,eAAe,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;AACzF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CACxB,EAA2E,EAC3E,cAAsB,EACtB,YAAoB;IAEpB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,uKAAuK,CAAC;SAChL,GAAG,CAAC,cAAc,EAAE,YAAY,CAA2C,CAAC;IAC/E,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,mGAAmG;IACnG,OAAO,EAAE,eAAe,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAClI,CAAC"}

package/dist/seal-failure-store.d.ts

@@ -0,0 +1,139 @@
+/**
+ * DOD-M15-SEAL-FAILED-TERMINAL-1 — a seal that FAILED is discoverable, not just a slow one.
+ *
+ * ─── The gap this closes ───────────────────────────────────────────────────────────────────────
+ *
+ * `DOD-M15-CLOSEWAIT-1` made the close answer at commitment and notarize in the background. Review
+ * HIGH-1 pointed out the half that left open: a background ceremony that **throws** leaves the
+ * session `active`, with a durable commitment, no receipt, and nothing retrying until a daemon
+ * restart — while the agent is holding an `ok: true` and has no reason to suspect anything.
+ *
+ * `seal_in_progress` (added in that unit) distinguishes RUNNING from NO-CEREMONY. It cannot
+ * distinguish either from DEAD. The only account of a dead one was a line in `daemon.log`, which is
+ * not a surface an agent can read.
+ *
+ * ─── Why in memory and NOT a column on the session row ─────────────────────────────────────────
+ *
+ * The review said "persist … so it survives the read", and a database column is the reflex. It is
+ * the wrong storage here, for a reason that is about correctness rather than cost:
+ *
+ * **A restart makes "failed" the wrong answer.** The boot sweep flips `active → interrupted,
+ * interrupted_by='local'`, and `RestartSealResolver` then picks the session up and retries the seal.
+ * So a persisted failure would outlive its own truth: the operator would read `seal_failed` about a
+ * ceremony that is, at that moment, being retried. A marker whose lifetime is the process is exactly
+ * right, because the condition it describes has the same lifetime.
+ *
+ * It also avoids a client-side schema migration, which this milestone treats as expensive on its own
+ * terms — unrecoverable on an operator's machine if it goes wrong, and owed its own reviewed unit.
+ * That is a real saving, but it is the second reason, not the first.
+ *
+ * ─── The two populations the restart does NOT retry (review MEDIUM-6) ──────────────────────────
+ *
+ * The argument above holds for an ordinary conversation, and that was verified rather than assumed.
+ * `listRestartOrphanedSessions` excludes two shapes, and this docstring used to imply neither
+ * existed:
+ *
+ *   `message_count > 0` — a closed session that carried no messages is never retried. Harmless: no
+ *   receipt was obtainable over nothing.
+ *
+ *   `restart_seal_gave_up_at IS NULL` — a session the resolver already exhausted. This one WAS a
+ *   real hole: nothing ever cleared that column, so a gave-up session that was later revived, used,
+ *   and closed could lose its in-memory marker at restart, be excluded from recovery forever, and
+ *   then be force-abandoned by the revival sweep (which explicitly includes `IS NOT NULL`) — a
+ *   receipt permanently forfeited with no surface ever saying so. `reviveSessionNode` now clears it:
+ *   a session something is talking to again is not the "hopeless session" the column was written for.
+ */
+export interface SealFailure {
+    /** The upstream error, carried through rather than replaced with a label. */
+    reason: string;
+    /** ISO timestamp of the failure. */
+    at: string;
+    /**
+     * HOW the ceremony died, and this distinction is the whole of review HIGH-1.
+     *
+     * The first cut recorded only on the detached tail's `.catch` — and `escalateToUnilateralSeal`
+     * contains **zero `throw`s**. All nine of its failure paths RESOLVE with `{ ok: false, reason }`:
+     * `seal_unilateral_timeout`, `seal_carry_empty`, `seal_counterparty_pending`,
+     * `seal_agent_key_unavailable`, and the rest. So every ordinary dead ceremony landed on the branch
+     * that recorded nothing, and the receipt surface answered `not_sealed_yet` exactly as before — the
+     * unit closed roughly a tenth of the gap it was written for, and its own test had to INJECT a
+     * throwing key provider to reach the path it covered.
+     *
+     *   `unresolved` — the ceremony ran to completion and produced no receipt. The common case.
+     *   `threw`      — an exception escaped it. Rare, and usually a local fault (a locked key vault,
+     *                  a DB error) rather than anything about the conversation.
+     *
+     * They get different guidance, because they have different fixes.
+     */
+    kind: "unresolved" | "threw" | "refused";
+    /**
+     * DOD-M15-SEALREFUSED-STUCK-1 — this reason came from the DIRECTORY and OUTRANKS a later symptom.
+     *
+     * ⚠️ IT DOES NOT MEAN THE CEREMONY IS OVER, and an earlier draft of this said it did. A refused
+     * BILATERAL seal falls through to a SOLO seal — `close-session-handler.ts` logs
+     * `session.seal.refused.escalating` and calls `escalateToUnilateralSeal`, which can still produce
+     * a receipt. Treating the refusal as the end made `cello_sealed_receipt` tell the operator no
+     * receipt would ever exist, while the ceremony that could produce one was still running, and
+     * invited `{ force: true }` on that basis — permanently forfeiting it. This flag governs which
+     * REASON is reported, and nothing else.
+     */
+    fromDirectory?: true;
+}
+/**
+ * The last background seal failure per (agent, session), for the life of the process.
+ *
+ * Deliberately tiny and deliberately not exported as a singleton: the daemon owns one instance and
+ * hands it to the writer (the close handler's detached tail) and the reader (`cello_sealed_receipt`),
+ * so the two cannot drift onto different copies.
+ */
+export declare class SealFailureStore {
+    #private;
+    /**
+     * Record a background ceremony that ended without a receipt — resolved, thrown, or REFUSED.
+     *
+     * ⚠️ **A TERMINAL VERDICT IS NEVER OVERWRITTEN BY A LATER SYMPTOM** — `DOD-M15-SEALREFUSED-STUCK-1`.
+     *
+     * This was a plain `set`, so the last writer won. Measured on session `dab46e16` (2026-09-08):
+     * the directory refused at 09:17:13.834 with `seal_parties_disagree` — the two transcripts do
+     * not match — and at 09:28:52.077 the background escalation, which had never learned of the
+     * refusal, timed out and overwrote it with `seal_unilateral_timeout`. Both operators were then
+     * told their COUNTERPARTY had not closed, about a seal the directory had decided against eleven
+     * minutes earlier. That sends them to ask the one party who did nothing wrong.
+     */
+    record(agentName: string, sessionId: string, reason: string, at: string, kind: SealFailure["kind"]): void;
+    /** Did this session's recorded reason come from the directory? Read by tests and diagnostics. */
+    isFromDirectory(agentName: string, sessionId: string): boolean;
+    /**
+     * Forget any failure for this session.
+     *
+     * Called when a ceremony STARTS as well as when one succeeds. Starting matters: a re-close is the
+     * documented remedy for a failed seal, and if the marker survived the retry the agent would be
+     * told the seal is dead while it is running — the same "stale reading presented as current" defect
+     * `DOD-M15-STALEROSTER-1` exists to stop, in a different subsystem.
+     */
+    clear(agentName: string, sessionId: string): void;
+    get(agentName: string, sessionId: string): SealFailure | undefined;
+    get size(): number;
+}
+/**
+ * The agent-facing answer for a session whose background seal died.
+ *
+ * ORDERING MATTERS AND IS THE CALLER'S JOB: a RUNNING ceremony outranks a recorded failure, because
+ * a re-close after a failure starts a new ceremony and the old marker must not shadow it. The read
+ * handler checks `isSealing` first.
+ */
+/**
+ * Has the counterparty closed? True when this side holds a SEAL (control, kind 2) leaf authored by
+ * someone other than itself — the relay delivered their close, so they did everything a close needs.
+ */
+export declare function counterpartyHasClosed(carry: ReadonlyArray<{
+    senderPubkeyHex: string;
+    leafKind: number;
+}>, ownPubkeyHex: string): boolean;
+export declare function describeSealFailed(opts: {
+    sessionId: string;
+    failure: SealFailure;
+    /** From `counterpartyHasClosed` — decides between "wait for them" and "they already closed". */
+    counterpartyClosed?: boolean;
+}): Record<string, unknown>;
+//# sourceMappingURL=seal-failure-store.d.ts.map

package/dist/seal-failure-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-failure-store.d.ts","sourceRoot":"","sources":["../src/seal-failure-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;IACzC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;;IAW3B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI;IAMzG,iGAAiG;IACjG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAI9D;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAIjD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIlE,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED;;;;;;GAMG;AACH;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,CAAC;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,EACnE,YAAY,EAAE,MAAM,GACnB,OAAO,CAGT;AAkBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4E1B"}

package/dist/seal-failure-store.js

@@ -0,0 +1,207 @@
+/**
+ * DOD-M15-SEAL-FAILED-TERMINAL-1 — a seal that FAILED is discoverable, not just a slow one.
+ *
+ * ─── The gap this closes ───────────────────────────────────────────────────────────────────────
+ *
+ * `DOD-M15-CLOSEWAIT-1` made the close answer at commitment and notarize in the background. Review
+ * HIGH-1 pointed out the half that left open: a background ceremony that **throws** leaves the
+ * session `active`, with a durable commitment, no receipt, and nothing retrying until a daemon
+ * restart — while the agent is holding an `ok: true` and has no reason to suspect anything.
+ *
+ * `seal_in_progress` (added in that unit) distinguishes RUNNING from NO-CEREMONY. It cannot
+ * distinguish either from DEAD. The only account of a dead one was a line in `daemon.log`, which is
+ * not a surface an agent can read.
+ *
+ * ─── Why in memory and NOT a column on the session row ─────────────────────────────────────────
+ *
+ * The review said "persist … so it survives the read", and a database column is the reflex. It is
+ * the wrong storage here, for a reason that is about correctness rather than cost:
+ *
+ * **A restart makes "failed" the wrong answer.** The boot sweep flips `active → interrupted,
+ * interrupted_by='local'`, and `RestartSealResolver` then picks the session up and retries the seal.
+ * So a persisted failure would outlive its own truth: the operator would read `seal_failed` about a
+ * ceremony that is, at that moment, being retried. A marker whose lifetime is the process is exactly
+ * right, because the condition it describes has the same lifetime.
+ *
+ * It also avoids a client-side schema migration, which this milestone treats as expensive on its own
+ * terms — unrecoverable on an operator's machine if it goes wrong, and owed its own reviewed unit.
+ * That is a real saving, but it is the second reason, not the first.
+ *
+ * ─── The two populations the restart does NOT retry (review MEDIUM-6) ──────────────────────────
+ *
+ * The argument above holds for an ordinary conversation, and that was verified rather than assumed.
+ * `listRestartOrphanedSessions` excludes two shapes, and this docstring used to imply neither
+ * existed:
+ *
+ *   `message_count > 0` — a closed session that carried no messages is never retried. Harmless: no
+ *   receipt was obtainable over nothing.
+ *
+ *   `restart_seal_gave_up_at IS NULL` — a session the resolver already exhausted. This one WAS a
+ *   real hole: nothing ever cleared that column, so a gave-up session that was later revived, used,
+ *   and closed could lose its in-memory marker at restart, be excluded from recovery forever, and
+ *   then be force-abandoned by the revival sweep (which explicitly includes `IS NOT NULL`) — a
+ *   receipt permanently forfeited with no surface ever saying so. `reviveSessionNode` now clears it:
+ *   a session something is talking to again is not the "hopeless session" the column was written for.
+ */
+/**
+ * The last background seal failure per (agent, session), for the life of the process.
+ *
+ * Deliberately tiny and deliberately not exported as a singleton: the daemon owns one instance and
+ * hands it to the writer (the close handler's detached tail) and the reader (`cello_sealed_receipt`),
+ * so the two cannot drift onto different copies.
+ */
+export class SealFailureStore {
+    #failures = new Map();
+    #key(agentName, sessionId) {
+        // EXPLICIT ESCAPE, not a literal control character. It was a raw U+001F byte, which is
+        // invisible in a diff, in a grep, and in most editors — I "proved" a key collision against a
+        // hand-written copy of this function and only the real one disagreed. A separator nobody can
+        // see is a separator someone will delete.
+        return `${agentName}\x1f${sessionId}`;
+    }
+    /**
+     * Record a background ceremony that ended without a receipt — resolved, thrown, or REFUSED.
+     *
+     * ⚠️ **A TERMINAL VERDICT IS NEVER OVERWRITTEN BY A LATER SYMPTOM** — `DOD-M15-SEALREFUSED-STUCK-1`.
+     *
+     * This was a plain `set`, so the last writer won. Measured on session `dab46e16` (2026-09-08):
+     * the directory refused at 09:17:13.834 with `seal_parties_disagree` — the two transcripts do
+     * not match — and at 09:28:52.077 the background escalation, which had never learned of the
+     * refusal, timed out and overwrote it with `seal_unilateral_timeout`. Both operators were then
+     * told their COUNTERPARTY had not closed, about a seal the directory had decided against eleven
+     * minutes earlier. That sends them to ask the one party who did nothing wrong.
+     */
+    record(agentName, sessionId, reason, at, kind) {
+        const key = this.#key(agentName, sessionId);
+        if (this.#failures.get(key)?.fromDirectory)
+            return;
+        this.#failures.set(key, { reason, at, kind, ...(kind === "refused" ? { fromDirectory: true } : {}) });
+    }
+    /** Did this session's recorded reason come from the directory? Read by tests and diagnostics. */
+    isFromDirectory(agentName, sessionId) {
+        return this.#failures.get(this.#key(agentName, sessionId))?.fromDirectory === true;
+    }
+    /**
+     * Forget any failure for this session.
+     *
+     * Called when a ceremony STARTS as well as when one succeeds. Starting matters: a re-close is the
+     * documented remedy for a failed seal, and if the marker survived the retry the agent would be
+     * told the seal is dead while it is running — the same "stale reading presented as current" defect
+     * `DOD-M15-STALEROSTER-1` exists to stop, in a different subsystem.
+     */
+    clear(agentName, sessionId) {
+        this.#failures.delete(this.#key(agentName, sessionId));
+    }
+    get(agentName, sessionId) {
+        return this.#failures.get(this.#key(agentName, sessionId));
+    }
+    get size() {
+        return this.#failures.size;
+    }
+}
+/**
+ * The agent-facing answer for a session whose background seal died.
+ *
+ * ORDERING MATTERS AND IS THE CALLER'S JOB: a RUNNING ceremony outranks a recorded failure, because
+ * a re-close after a failure starts a new ceremony and the old marker must not shadow it. The read
+ * handler checks `isSealing` first.
+ */
+/**
+ * Has the counterparty closed? True when this side holds a SEAL (control, kind 2) leaf authored by
+ * someone other than itself — the relay delivered their close, so they did everything a close needs.
+ */
+export function counterpartyHasClosed(carry, ownPubkeyHex) {
+    const own = ownPubkeyHex.toLowerCase();
+    return carry.some((l) => l.leafKind === 2 && l.senderPubkeyHex.toLowerCase() !== own);
+}
+/**
+ * Agreed with Andre 2026-09-17 (option D), verbatim. For a failed seal where BOTH sides closed.
+ *
+ * Live, session d8b15d09: both sides closed, the signer lost the directories, and both were told
+ * "the other side has not closed yet" and to wait or retry. They had closed, and a retry with both
+ * online failed identically. Everything a seal needs — both closes, the signed messages, the relay's
+ * acknowledgements — stays on the operator's machine, and the per-party seal redesign seals from
+ * exactly that record; that commitment is what makes "a future update will seal it" true. Keep them
+ * in step: if that redesign is dropped, this sentence must change with it.
+ */
+const BOTH_CLOSED_GUIDANCE = "Both sides closed, but this seal couldn't be completed right now. The failure is on CELLO's " +
+    "side, not yours. Your conversation and both closes are safely recorded on your machine, and " +
+    "a future update will seal it from that record. Leave the session as it is. Do not use " +
+    "force: true, which would discard that record.";
+export function describeSealFailed(opts) {
+    const threw = opts.failure.kind === "threw";
+    if (opts.counterpartyClosed === true && !threw && opts.failure.kind !== "refused") {
+        return {
+            ok: false,
+            reason: "seal_failed",
+            seal_status: "unresolved",
+            session_id: opts.sessionId,
+            seal_failure_reason: opts.failure.reason,
+            seal_failed_at: opts.failure.at,
+            both_closed: true,
+            guidance: BOTH_CLOSED_GUIDANCE,
+        };
+    }
+    /**
+     * DOD-M15-SEALREFUSED-STUCK-1 — a REFUSAL is neither of the other two, and the difference decides
+     * what the operator does next. `unresolved` invites them to wait for a counterparty who has not
+     * closed; a refusal means the directory examined the seal and declined it, so waiting achieves
+     * nothing and the counterparty is not the thing to chase.
+     */
+    if (opts.failure.kind === "refused") {
+        return {
+            ok: false,
+            reason: "seal_failed",
+            seal_status: "refused",
+            session_id: opts.sessionId,
+            seal_failure_reason: opts.failure.reason,
+            seal_failed_at: opts.failure.at,
+            guidance: `The DIRECTORY REFUSED to certify the BILATERAL seal at ${opts.failure.at}: ` +
+                `${opts.failure.reason}. That is a verdict about the two-party seal and it will not change ` +
+                "— but it is NOT the end of the ceremony: the close falls through to a SOLO seal over this " +
+                "side's own chain, which can still produce a receipt. Your transcript is UNTOUCHED and " +
+                "nothing was signed with your key. The usual cause is that the two sides' records of the " +
+                "conversation differ, so compare the transcripts (cello_transcript) rather than chasing " +
+                "the network or the counterparty's availability — they are not the problem here. " +
+                "⚠️ Do NOT use { force: true }: a solo seal may still be running or retriable, and forcing " +
+                "PERMANENTLY forfeits the receipt it would produce.",
+        };
+    }
+    return {
+        ok: false,
+        reason: "seal_failed",
+        // Two different facts, two different words. "failed" is an exception; "unresolved" is a ceremony
+        // that ran and produced nothing, which is the ordinary shape and often means the counterparty
+        // simply has not closed yet.
+        seal_status: threw ? "failed" : "unresolved",
+        session_id: opts.sessionId,
+        // The upstream cause, preserved. "The seal failed" tells an operator nothing about whether their
+        // directory is unreachable, their agent is not started, or the carry was unusable.
+        seal_failure_reason: opts.failure.reason,
+        seal_failed_at: opts.failure.at,
+        guidance: threw
+            ? `The background seal ceremony for this session hit an ERROR at ${opts.failure.at}: ` +
+                `${opts.failure.reason}. This is not "still running" — nothing is retrying it. An exception ` +
+                "here is usually a LOCAL fault (a key that could not be loaded, a database error) rather " +
+                "than anything about the conversation, so check the daemon log around that timestamp. Your " +
+                "SEAL commitment is still durable and the conversation is intact: the receipt is unproduced, " +
+                "not lost. Call cello_close_session again once the local cause is addressed. Do NOT use " +
+                "{ force: true } — that abandons the session and PERMANENTLY forfeits the receipt, the one " +
+                "outcome that cannot be undone."
+            : `The background seal ceremony for this session finished at ${opts.failure.at} WITHOUT ` +
+                `producing a receipt: ${opts.failure.reason}. This is not "still running" — nothing is ` +
+                "retrying it right now. Read the reason before acting: seal_counterparty_pending and " +
+                "seal_unilateral_timeout mean the other side has not closed yet, and the fix is to wait for " +
+                "them (or retry later, once the directory's delivery-grace window has elapsed and a " +
+                "unilateral seal becomes available). seal_counterparty_present means the opposite — they " +
+                "are ONLINE, so close together and the seal completes bilaterally. " +
+                "seal_high_stakes_evidence_required means this conversation was opened high-stakes and no " +
+                "relay ever saw the counterparty leave, so waiting helps only if they connect and then go. " +
+                "Reasons naming this daemon — an agent that is not " +
+                "started, a directory it cannot reach — are fixed locally; check cello_status. Your SEAL " +
+                "commitment is durable and the conversation is intact, so the receipt is unproduced rather " +
+                "than lost. Retry with cello_close_session. Do NOT use { force: true }: that abandons the " +
+                "session and PERMANENTLY forfeits the receipt.",
+    };
+}
+//# sourceMappingURL=seal-failure-store.js.map

package/dist/seal-failure-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-failure-store.js","sourceRoot":"","sources":["../src/seal-failure-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAuCH;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IAClB,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEpD,IAAI,CAAC,SAAiB,EAAE,SAAiB;QACvC,uFAAuF;QACvF,6FAA6F;QAC7F,6FAA6F;QAC7F,0CAA0C;QAC1C,OAAO,GAAG,SAAS,OAAO,SAAS,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAAc,EAAE,EAAU,EAAE,IAAyB;QAChG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;YAAE,OAAO;QACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,iGAAiG;IACjG,eAAe,CAAC,SAAiB,EAAE,SAAiB;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IACrF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAiB,EAAE,SAAiB;QACxC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,GAAG,CAAC,SAAiB,EAAE,SAAiB;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;GAMG;AACH;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAmE,EACnE,YAAoB;IAEpB,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GACxB,8FAA8F;IAC9F,8FAA8F;IAC9F,wFAAwF;IACxF,+CAA+C,CAAC;AAElD,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC;IAC5C,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,YAAY;YACzB,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YACxC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC/B,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,oBAAoB;SAC/B,CAAC;IACJ,CAAC;IACD;;;;;OAKG;IACH,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YACxC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC/B,QAAQ,EACN,0DAA0D,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI;gBAC7E,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,sEAAsE;gBAC5F,4FAA4F;gBAC5F,wFAAwF;gBACxF,0FAA0F;gBAC1F,yFAAyF;gBACzF,kFAAkF;gBAClF,4FAA4F;gBAC5F,oDAAoD;SACvD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,aAAa;QACrB,iGAAiG;QACjG,8FAA8F;QAC9F,6BAA6B;QAC7B,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;QAC5C,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,iGAAiG;QACjG,mFAAmF;QACnF,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;QACxC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;QAC/B,QAAQ,EAAE,KAAK;YACb,CAAC,CAAC,iEAAiE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI;gBACpF,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,uEAAuE;gBAC7F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,8FAA8F;gBAC9F,yFAAyF;gBACzF,4FAA4F;gBAC5F,gCAAgC;YAClC,CAAC,CAAC,6DAA6D,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW;gBACvF,wBAAwB,IAAI,CAAC,OAAO,CAAC,MAAM,6CAA6C;gBACxF,sFAAsF;gBACtF,6FAA6F;gBAC7F,qFAAqF;gBACrF,0FAA0F;gBAC1F,oEAAoE;gBACpE,2FAA2F;gBAC3F,4FAA4F;gBAC5F,oDAAoD;gBACpD,0FAA0F;gBAC1F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,+CAA+C;KACpD,CAAC;AACJ,CAAC"}