@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/boot-agents.js

@@ -0,0 +1,241 @@
+/**
+ * Phase 2 of boot: the agents this daemon holds, and everything that acts on their behalf.
+ *
+ * Identities loaded from the encrypted `agents` table, their signing keys, the content park and its
+ * recovery path, the reconnect drain, and the queue that retries a submission the directory would
+ * not take. Phase 1 built the machinery; this is where it acquires subjects.
+ *
+ * ⚠️ FOUR VALUES ARRIVE AS GETTERS BECAUSE THEY DO NOT EXIST YET — `flushAwaitingContent`,
+ * `onlineAgents`, `sharedSignaling` and `perAgentSignaling`, all declared BELOW this phase and all
+ * read from callbacks that run long after boot.
+ *
+ * **They are LOUD, not silent, and the difference is the thing to remember.** Three of the four are
+ * `const`, so a by-value pass is a temporal-dead-zone `ReferenceError` at boot — every test red
+ * immediately. (An earlier version of this comment said `onlineAgents` would "freeze as an empty
+ * set". It would not: it is a `const` below the call, and it is a `Set`, so even declared above it
+ * would pass by reference and track later additions. Wrong twice over.)
+ *
+ * **The SILENT shape is a `let` that is assigned further down** — still `undefined`, no error, no
+ * type complaint. That is what unit 4 shipped. Two of them are still live in the composition root
+ * and every later phase crosses them: `reconcileScheduler` and `documentOwnerKeyForHook`. The test
+ * to apply is "is this a `let` assigned below?", not "would this value freeze?" — the freezing cases
+ * announce themselves.
+ */
+import { loadAgents } from "./agent-loader.js";
+import { DbRegistrationPersistence } from "./db-identity-store.js";
+import { createContentPark } from "./content-park.js";
+import { createReconnectDrain } from "./reconnect-drain.js";
+import { SubmissionRetryQueue } from "./submission-retry.js";
+import { TrustSignalStore } from "./trust-signal-store.js";
+import { sendSealedSubmission } from "./signal-submission.js";
+import { extractErrorMessage } from "./error-message.js";
+export async function startBootAgents(deps) {
+    const { config, logger, sessionNodeManager, securityGateway, getFlushAwaitingContent, getOnlineAgents, getSharedSignaling, getPerAgentSignaling, } = deps;
+    // Load agent identities from the encrypted `agents` table (PERSIST-002 AC-007 — one path).
+    // (The encrypted store + lock were established above, before manifest verification.)
+    const { loaded: loadedAgents, failed: failedAgents } = await loadAgents(sessionNodeManager.getDb(), logger);
+    // PERSIST-002: per-agent DB-backed identity persistence. The registration handler and the
+    // ceremony/seal signer-reconstruction load the FROST share (and persist the identity) through this
+    // seam — the encrypted `agents` row, never a flat file.
+    const getPersistence = (agentName) => new DbRegistrationPersistence({ db: sessionNodeManager.getDb(), agentName, logger });
+    // Build agent state. `state` here is the LOAD outcome only — whether the identity opened at all.
+    // The state an operator sees is derived per call by resolveAgentState (agent-state.ts), because
+    // most of what it depends on (started, signaling, attendance, paused) changes while the daemon
+    // runs and cannot be baked into a record at boot.
+    const agents = [
+        ...loadedAgents.map((a) => ({
+            name: a.name,
+            state: "stopped",
+            pubkey: a.pubkey,
+        })),
+        ...failedAgents.map((a) => ({
+            name: a.name,
+            state: "load_failed",
+            error: a.error,
+        })),
+    ];
+    // M7-SESSION-001 (H-1): retain each agent's K_local signing key so the daemon
+    // can produce K_local-signed SEAL-INTERRUPTED leaves (both as initiator and as
+    // the bilateral responder). The KeyProvider keeps the private scalar internal —
+    // only signatures leave it.
+    const keyProviders = new Map();
+    for (const a of loadedAgents) {
+        keyProviders.set(a.name, a.keyProvider);
+    }
+    // DOD-M15-EPHEMERAL-AUTH-1: the session manager signs each session's throwaway key with the
+    // agent's identity, so it needs the same providers. Injected here rather than through the
+    // constructor because this map is built after the manager exists — the same reason
+    // `setParkedDrainHook` is a setter.
+    sessionNodeManager.setKeyProviderResolver((agentName) => keyProviders.get(agentName));
+    // Constructed HERE, before ANY boot-time caller. autoRecoverForAgent is invoked from an agent's
+    // onConnected and from the seal-upgrade content gate — both of which run long before the IPC
+    // handler map exists. Its handlers register later (phase 2), which is what lets this sit up here.
+    const contentPark = createContentPark({
+        logger,
+        sessionNodeManager,
+        agents,
+        getKeyProvider: (agentName) => keyProviders.get(agentName),
+        // M12-P17: annexed content bypasses the live inbound funnel, so it is screened here instead.
+        securityGateway,
+    });
+    const autoRecoverForAgent = (agentName, trigger) => contentPark.autoRecoverForAgent(agentName, trigger);
+    // DOD-PARK-DRAIN-1: drain where the parking actually happens. Content parks when the RELAY link
+    // drops, and the manager tells us on every event that changes this agent's ability to pull — the
+    // first ensure, a reservation LOST, a reservation REGAINED, the slow backstop sweep. (056-SLOTDEAD:
+    // was "watchdog rebuild, auth_ok rebuild"; neither exists, and the pair names the cause instead.)
+    sessionNodeManager.setParkedDrainHook((agentName, reason) => {
+        // M12-P12 (review F1): the SENDER half of the same event. A refused park deposit leaves a
+        // durable retry_queue row, and until this call existed the only things that drained it were a
+        // daemon restart and cello_start_agent — so the fix made a lost message restart-recoverable
+        // while the DoD line promises "no restart". A lost reservation is where parking actually happens,
+        // so it is where the re-park fires (056-SLOTDEAD: was "the watchdog rebuild", now deleted).
+        void getFlushAwaitingContent()(agentName).catch((err) => {
+            logger.warn("content.park.flush.failed", { agentName, trigger: reason, stage: "drain_hook", error: extractErrorMessage(err) });
+        });
+        void autoRecoverForAgent(agentName, reason).catch((err) => {
+            // autoRecoverForAgent catches per-relay errors internally; this is the backstop, and it uses
+            // extractErrorMessage because the transport rejects with structured plain objects that
+            // String() renders as "[object Object]" — the reason 100+ real failures were undiagnosable.
+            logger.warn("content.recover.auto.failed", { agentName, trigger: reason, stage: "drain_hook", error: extractErrorMessage(err) });
+        });
+    });
+    // DOD-PARK-DRAIN-1: what an agent's signaling reconnect does — ensure THEN drain, never both at
+    // once. Constructed here, beside the content park it drains; `onlineAgents` is read inside the
+    // callback (at connect time), never during this construction, so its later declaration is not a
+    // temporal-dead-zone hazard.
+    const onSignalingConnected = createReconnectDrain({
+        logger,
+        isAgentOnline: (agentName) => getOnlineAgents().has(agentName),
+        ensureStandingReceiver: (agentName) => sessionNodeManager.ensureStandingReceiverForAgent(agentName),
+        drainParked: (agentName) => autoRecoverForAgent(agentName, "signaling_reconnect"),
+        // M12-P12 (review F1): ordered AFTER ensureStandingReceiver by createReconnectDrain's own
+        // ensure→drain contract — a re-park needs the receiver that the ensure step rebuilds.
+        flushSender: (agentName) => getFlushAwaitingContent()(agentName),
+    });
+    /**
+     * DOD-M15-ENDORSE-RETRY-1 — sealed submissions whose send reached no directory node.
+     *
+     * The consortium has three nodes and a submission used to die with whichever one this daemon
+     * happened to be connected to. It is held here instead and re-sent when the SignalingManager
+     * reconnects — that reconnect IS the failover, and nothing in this daemon picks a node for a
+     * submission (`sendSealedSubmission`'s header rules that out). Safe because `submission_id` is
+     * derived from the signed plaintext: a second node stores it once and the portal mints once.
+     */
+    const submissionRetries = new SubmissionRetryQueue({
+        logger,
+        send: async (pending) => {
+            /**
+             * THE AGENT MUST STILL BE HERE TO SIGN, and this failure has its own name.
+             *
+             * It borrowed `submission_refused_by_node` at first, which states that a directory node
+             * decoded, evaluated and refused the submission — none of which happened. Stacked on the
+             * give-up reason it produced, the operator saw two labels both pointing at the directory for
+             * a cause that is entirely local (review M5).
+             *
+             * Neither branch is reachable in this daemon today — nothing removes from `keyProviders` or
+             * `loadedAgents` — so this is a guard against a future unload path rather than a live case.
+             * That is said plainly instead of being implied by a comment describing a state the code
+             * cannot reach.
+             */
+            /**
+             * READ the agent's manager; never CREATE one, and this ONE guard is the whole check.
+             *
+             * `getAgentSignaling` is not a getter — for an agent with no manager it constructs one, which
+             * dials, authenticates, and installs an unbounded reconnect loop. `dropAgentSignaling` exists
+             * to stop and forget a manager for an agent whose registration failed terminally, and a
+             * background retry that silently rebuilt it would undo that decision from a timer nobody is
+             * watching.
+             *
+             * It replaces a `keyProviders` + `loadedAgents` pair that is now dead: the manager was built
+             * WITH this agent's key provider and pubkey, so its presence is the accurate statement of
+             * "this daemon can still send as this agent", and nothing prunes either of those two maps.
+             *
+             * There is always a manager here in practice — the first-pass send built one before this
+             * submission could ever have been held. Its absence means it was deliberately dropped, and
+             * the right answer is to stop trying, not to resurrect it.
+             */
+            // The SAME resolution `getAgentSignaling` performs, minus the construction: the shared
+            // manager first (the in-process path, where `getPerAgentSignaling()` is never populated at all),
+            // then this agent's own. Reading only the per-agent map would refuse every retry on the
+            // shared path — which is how this fix first failed its own live test.
+            const existing = getSharedSignaling()
+                ? { signaling: getSharedSignaling() }
+                : getPerAgentSignaling().get(pending.agentName);
+            if (!existing) {
+                return {
+                    ok: false,
+                    reason: "submission_agent_unloaded",
+                    guidance: `The directory connection for '${pending.agentName}' has been torn down, so the held ` +
+                        "submission cannot be sent. Start the agent with cello_start_agent and issue it again — " +
+                        "re-sending is safe, the submission id is derived from the content.",
+                };
+            }
+            return sendSealedSubmission({
+                signaling: existing.signaling,
+                submissionId: pending.submissionId,
+                intakeKeyId: pending.intakeKeyId,
+                ciphertext: pending.ciphertext,
+                logger,
+            });
+        },
+        onAccepted: (pending, stored) => {
+            // THE STABLE ID THE ENQUEUE CAPTURED, not a re-resolution from the mutable name (review M6).
+            // `agentName` is a display label and is reusable after a retire; re-deriving it here would
+            // write the accepted row under a different agent's id if a name were retired and reused
+            // inside the retry window. The correct value is already in the struct.
+            recordIssuedSubmission(pending.agentName, pending.agentId, {
+                submissionId: pending.submissionId,
+                subject: pending.subject,
+                op: pending.op,
+                intakeKeyId: pending.intakeKeyId,
+                stored,
+            });
+        },
+        ...(config.submissionRetryIntervalsMs?.staggerMs === undefined
+            ? {}
+            : { staggerMs: config.submissionRetryIntervalsMs.staggerMs }),
+        ...(config.submissionRetryIntervalsMs?.localPreconditionRetryMs === undefined
+            ? {}
+            : { localPreconditionRetryMs: config.submissionRetryIntervalsMs.localPreconditionRetryMs }),
+    });
+    /**
+     * KEEP THE HANDLE, or a withdrawal has nothing to name. The submission id is content-derived and
+     * so reproducible in principle, but only by re-composing the exact original body — which the
+     * operator no longer has once they have sent it.
+     *
+     * Best-effort on purpose: the submission IS accepted by the time this runs, and failing the call
+     * over a local bookkeeping write would turn a success into a reported failure and invite a
+     * re-send of something already queued. Logged loudly instead.
+     *
+     * Shared by the first-pass send and the retry, so the two cannot drift about what a landed
+     * submission records.
+     */
+    function recordIssuedSubmission(agentName, 
+    /** The STABLE key, supplied by the caller. Never re-derived from `agentName` here — that is a
+     *  display label, and this table is keyed by identity. */
+    agentId, s) {
+        try {
+            const store = new TrustSignalStore(sessionNodeManager.getDb(), logger);
+            store.recordIssuedSubmission({
+                agentId,
+                submissionId: s.submissionId,
+                subjectPubkey: s.subject,
+                op: s.op,
+                intakeKeyId: s.intakeKeyId,
+                stored: s.stored,
+            });
+        }
+        catch (err) {
+            logger.error("signal.submission.record_failed", {
+                agentName,
+                submissionId: s.submissionId,
+                reason: extractErrorMessage(err),
+            });
+        }
+    }
+    return {
+        loadedAgents, getPersistence, agents, keyProviders, contentPark,
+        autoRecoverForAgent, onSignalingConnected, submissionRetries, recordIssuedSubmission,
+    };
+}
+//# sourceMappingURL=boot-agents.js.map

package/dist/boot-agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-agents.js","sourceRoot":"","sources":["../src/boot-agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAwBzD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAoB;IACxD,MAAM,EACJ,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,eAAe,EACnD,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,oBAAoB,GACnF,GAAG,IAAI,CAAC;IAET,2FAA2F;IAC3F,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAE5G,0FAA0F;IAC1F,mGAAmG;IACnG,wDAAwD;IACxD,MAAM,cAAc,GAAG,CAAC,SAAiB,EAA6B,EAAE,CACtE,IAAI,yBAAyB,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvF,iGAAiG;IACjG,gGAAgG;IAChG,+FAA+F;IAC/F,kDAAkD;IAClD,MAAM,MAAM,GAAgB;QAC1B,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,SAAkB;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;QACH,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,aAAsB;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;KACJ,CAAC;IAEF,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwD,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,4FAA4F;IAC5F,0FAA0F;IAC1F,mFAAmF;IACnF,oCAAoC;IACpC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,SAAiB,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAE9F,gGAAgG;IAChG,6FAA6F;IAC7F,kGAAkG;IAClG,MAAM,WAAW,GAAG,iBAAiB,CAAC;QACpC,MAAM;QACN,kBAAkB;QAClB,MAAM;QACN,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;QAClE,6FAA6F;QAC7F,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAE,OAAgB,EAAiB,EAAE,CACjF,WAAW,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEtD,gGAAgG;IAChG,iGAAiG;IACjG,oGAAoG;IACpG,kGAAkG;IAClG,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE;QAC1E,0FAA0F;QAC1F,8FAA8F;QAC9F,4FAA4F;QAC5F,kGAAkG;QAClG,4FAA4F;QAC5F,KAAK,uBAAuB,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC/D,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjI,CAAC,CAAC,CAAC;QACH,KAAK,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACjE,6FAA6F;YAC7F,uFAAuF;YACvF,4FAA4F;YAC5F,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnI,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gGAAgG;IAChG,+FAA+F;IAC/F,gGAAgG;IAChG,6BAA6B;IAC7B,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;QAChD,MAAM;QACN,aAAa,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;QACtE,sBAAsB,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,SAAS,CAAC;QAC3G,WAAW,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,qBAAqB,CAAC;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,WAAW,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,uBAAuB,EAAE,CAAC,SAAS,CAAC;KACzE,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,MAAM,iBAAiB,GAAG,IAAI,oBAAoB,CAAC;QACjD,MAAM;QACN,IAAI,EAAE,KAAK,EAAE,OAA0B,EAAE,EAAE;YACzC;;;;;;;;;;;;eAYG;YACH;;;;;;;;;;;;;;;;eAgBG;YACH,uFAAuF;YACvF,iGAAiG;YACjG,wFAAwF;YACxF,sEAAsE;YACtE,MAAM,QAAQ,GAAG,kBAAkB,EAAE;gBACnC,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAG,EAAE;gBACtC,CAAC,CAAC,oBAAoB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,EAAE,EAAE,KAAc;oBAClB,MAAM,EAAE,2BAAoC;oBAC5C,QAAQ,EACN,iCAAiC,OAAO,CAAC,SAAS,oCAAoC;wBACtF,yFAAyF;wBACzF,oEAAoE;iBACvE,CAAC;YACJ,CAAC;YACD,OAAO,oBAAoB,CAAC;gBAC1B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9B,6FAA6F;YAC7F,2FAA2F;YAC3F,wFAAwF;YACxF,uEAAuE;YACvE,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE;gBACzD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,0BAA0B,EAAE,SAAS,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,0BAA0B,EAAE,wBAAwB,KAAK,SAAS;YAC3E,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,0BAA0B,CAAC,wBAAwB,EAAE,CAAC;KAC9F,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,SAAS,sBAAsB,CAC7B,SAAiB;IACjB;8DAC0D;IAC1D,OAAe,EACf,CAAoG;QAEpG,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;YACvE,KAAK,CAAC,sBAAsB,CAAC;gBAC3B,OAAO;gBACP,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,aAAa,EAAE,CAAC,CAAC,OAAO;gBACxB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBAC9C,SAAS;gBACT,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW;QAC/D,mBAAmB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB;KACrF,CAAC;AACJ,CAAC"}

package/dist/boot-connection-state.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Phase 3 of boot: what the daemon remembers per IPC CONNECTION, rather than per agent.
+ *
+ * Which agent a connection has selected, which agents are online or explicitly offline, and the two
+ * read positions — where a connection has read up to in a session, and how far the durable watermark
+ * has been advanced on its behalf. A connection is not an agent: several connections can attend one
+ * agent at once, and each keeps its own place in the conversation.
+ *
+ * ONE dependency — the session manager — and nothing late-bound.
+ *
+ * ⚠️ `forgetConnection` LIVES HERE FOR THE SAME REASON THE MAPS DO. A first cut left the eviction in
+ * the composition root, 1,600 lines from the containers it releases, and with it the two comments
+ * that say WHY each must die with its connection: the delivery bookmark was once the one
+ * per-connection structure that outlived its connection — an unbounded leak on a daemon the CLI
+ * reconnects to on every command — and a surviving take ledger made every reconnect look like a
+ * theft, because a fresh connection starts at cursor -1 and every take the dead one recorded sits
+ * above that bar. A module holding state with no visible release path reads as a leak. This was pure state with a few guards over it, sitting in
+ * the middle of the boot sequence because that is where it happened to get written.
+ */
+import type { SessionNodeManager } from "./session-node-manager.js";
+export interface BootConnectionStateDeps {
+    sessionNodeManager: SessionNodeManager;
+}
+export declare function startBootConnectionState(deps: BootConnectionStateDeps): {
+    perConnectionState: Map<string, {
+        currentAgent: string | null;
+        clearedAgent?: string;
+        clientType: string;
+    }>;
+    onlineAgents: Set<string>;
+    explicitlyOfflineAgents: Set<string>;
+    forgetConnection: (connectionId: string) => void;
+    getConnectionCursor: (connectionId: string, sessionId: string) => number;
+    advanceConnectionCursor: (connectionId: string, sessionId: string, seq: number) => void;
+    safeCursorAdvance: (connectionId: string, sessionId: string, deliveredSeqs: ReadonlySet<number>) => void;
+    safeWatermarkAdvance: (agentName: string, sessionId: string, deliveredSeqs: ReadonlySet<number>) => void;
+};
+//# sourceMappingURL=boot-connection-state.d.ts.map

package/dist/boot-connection-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-connection-state.d.ts","sourceRoot":"","sources":["../src/boot-connection-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,uBAAuB;;sBAQT,MAAM,GAAG,IAAI;uBAAiB,MAAM;oBAAc,MAAM;;;;qCAwE3E,MAAM,KAAG,IAAI;wCAjDV,MAAM,aAAa,MAAM,KAAG,MAAM;4CAG9B,MAAM,aAAa,MAAM,OAAO,MAAM,KAAG,IAAI;sCAenD,MAAM,aAAa,MAAM,iBAAiB,WAAW,CAAC,MAAM,CAAC,KAAG,IAAI;sCAqBpE,MAAM,aAAa,MAAM,iBAAiB,WAAW,CAAC,MAAM,CAAC,KAAG,IAAI;EAsB9G"}

package/dist/boot-connection-state.js

@@ -0,0 +1,95 @@
+export function startBootConnectionState(deps) {
+    const { sessionNodeManager } = deps;
+    // Per-connection state: tracks which agent is "current" for each IPC connection.
+    // Key = connectionId (assigned by IPC server), Value = current agent name or null.
+    // `clearedAgent` remembers a selection this connection ONCE made and that was taken away (the agent
+    // was stopped or retired). It is what stops resolveCurrentAgent from quietly re-targeting the next
+    // call at some other agent that happens to be online — see there.
+    const perConnectionState = new Map();
+    // Set of agents currently in "online" state (transitioned via cello_start_agent)
+    const onlineAgents = new Set();
+    /**
+     * M12-P16 (review F1): agents an operator DELIBERATELY took offline.
+     *
+     * Deliberately NOT `onlineAgents`. That set answers "has this agent been started through
+     * cello_start_agent", which is not the same question as "may this agent receive": several
+     * legitimate paths serve inbound sessions without ever populating it, so gating the inbound path
+     * on it refuses real traffic (proven — it broke 27 tests across 7 suites). This set is empty
+     * unless someone actually pressed the switch, so it can only ever refuse what the operator asked
+     * to have refused.
+     */
+    const explicitlyOfflineAgents = new Set();
+    // M8C-CURSOR-1: per-connection, per-session read cursor (read-before-write gating).
+    // Distinct from message_watermarks (INBOX-1, per-AGENT delivery watermark, persisted) — this is
+    // per-CONNECTION, in-memory only, and intentionally dies with the connection (a fresh connection
+    // has read nothing yet, so it must catch up before it may send — the WhatsApp-group-chat model
+    // for two attended sessions on one agent). Key = connectionId → sessionId → highest sequence this
+    // connection has read (or authored). Absent entry = -1 (nothing read yet).
+    const connectionCursors = new Map();
+    function getConnectionCursor(connectionId, sessionId) {
+        return connectionCursors.get(connectionId)?.get(sessionId) ?? -1;
+    }
+    function advanceConnectionCursor(connectionId, sessionId, seq) {
+        let byId = connectionCursors.get(connectionId);
+        if (!byId) {
+            byId = new Map();
+            connectionCursors.set(connectionId, byId);
+        }
+        const prior = byId.get(sessionId) ?? -1;
+        if (seq > prior)
+            byId.set(sessionId, seq); // monotonic — never lowers
+    }
+    // M8C-CURSOR-1 (cello-unit-reviewer HIGH finding, confirmed by live reproduction): a
+    // received-only delivery (cello_get_transcript's received view) must NOT blindly advance the
+    // cursor to the max sequence it happened to see — leaf indices are shared and strictly
+    // contiguous across BOTH directions (appendSessionLeaf always assigns leafCount, no gaps), so a
+    // gap between the connection's actual cursor and that max can hide an unread SENT leaf authored
+    // by a DIFFERENT local connection. Advancing past it would silently let this connection send
+    // without ever having seen it — defeating the read-before-write guarantee (C4/C5). Only advance
+    // through a CONTIGUOUS run of sequence numbers that were actually in this delivery, starting
+    // right after the connection's current cursor; stop at the first gap.
+    function safeCursorAdvance(connectionId, sessionId, deliveredSeqs) {
+        let cursor = getConnectionCursor(connectionId, sessionId);
+        while (deliveredSeqs.has(cursor + 1))
+            cursor += 1;
+        advanceConnectionCursor(connectionId, sessionId, cursor);
+    }
+    // The per-connection DELIVERY bookmark that lived here is gone (2026-09-13). It started empty on
+    // every new connection, so a reconnect re-served the whole conversation. `cello_receive` now reads
+    // against the agent's persisted watermark — one bookmark per (agent, session).
+    /**
+     * DOD-CURSOR-DURABLE-1: the same hole-safe walk, applied to the PERSISTED per-(agent, session)
+     * read watermark. Used by cello_get_transcript, whose delivery covers BOTH directions.
+     *
+     * Walks a CONTIGUOUS run from the agent's current watermark, stopping at the first gap — for the
+     * identical reason safeCursorAdvance does: leaf indices are contiguous across both directions, so
+     * a gap can hide an unread RECEIVED message (e.g. a row that failed to decrypt is absent from
+     * `messages`). Advancing past it would mark unseen counterparty content as read and unblock a
+     * send that never saw it — defeating the very guarantee this gate exists to enforce. Monotonic:
+     * advanceLastDeliveredSeq takes MAX, so this can never lower a watermark.
+     */
+    function safeWatermarkAdvance(agentName, sessionId, deliveredSeqs) {
+        let frontier = sessionNodeManager.getLastDeliveredSeq(agentName, sessionId);
+        while (deliveredSeqs.has(frontier + 1))
+            frontier += 1;
+        if (frontier >= 0)
+            sessionNodeManager.advanceLastDeliveredSeq(agentName, sessionId, frontier);
+    }
+    /**
+     * Release everything this connection held. The log context is built by the CALLER — the IPC server
+     * merges it into its single `daemon.ipc.disconnected` line, and a second line under the same name
+     * left neither carrying the whole picture.
+     */
+    function forgetConnection(connectionId) {
+        perConnectionState.delete(connectionId);
+        connectionCursors.delete(connectionId); // M8C-CURSOR-1: cursor is connection-scoped, dies with it
+    }
+    // The two cursor MAPS are not returned — nothing outside reads them directly now that eviction
+    // lives here. What escapes is the operations over them.
+    return {
+        perConnectionState, onlineAgents, explicitlyOfflineAgents, forgetConnection,
+        getConnectionCursor, advanceConnectionCursor, safeCursorAdvance,
+        safeWatermarkAdvance,
+    };
+}
+//# sourceMappingURL=boot-connection-state.js.map

package/dist/boot-connection-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-connection-state.js","sourceRoot":"","sources":["../src/boot-connection-state.ts"],"names":[],"mappings":"AAyBA,MAAM,UAAU,wBAAwB,CAAC,IAA6B;IACpE,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAEpC,iFAAiF;IACjF,mFAAmF;IACnF,oGAAoG;IACpG,mGAAmG;IACnG,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAsF,CAAC;IAEzH,iFAAiF;IACjF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC;;;;;;;;;OASG;IACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAElD,oFAAoF;IACpF,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,2EAA2E;IAC3E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA+B,CAAC;IACjE,SAAS,mBAAmB,CAAC,YAAoB,EAAE,SAAiB;QAClE,OAAO,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,SAAS,uBAAuB,CAAC,YAAoB,EAAE,SAAiB,EAAE,GAAW;QACnF,IAAI,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,GAAG,GAAG,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,2BAA2B;IACxE,CAAC;IACD,qFAAqF;IACrF,6FAA6F;IAC7F,uFAAuF;IACvF,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,6FAA6F;IAC7F,sEAAsE;IACtE,SAAS,iBAAiB,CAAC,YAAoB,EAAE,SAAiB,EAAE,aAAkC;QACpG,IAAI,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC1D,OAAO,aAAa,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,CAAC;QAClD,uBAAuB,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,iGAAiG;IACjG,mGAAmG;IACnG,+EAA+E;IAE/E;;;;;;;;;;OAUG;IACH,SAAS,oBAAoB,CAAC,SAAiB,EAAE,SAAiB,EAAE,aAAkC;QACpG,IAAI,QAAQ,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5E,OAAO,aAAa,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAE,QAAQ,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,kBAAkB,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChG,CAAC;IACD;;;;OAIG;IACH,SAAS,gBAAgB,CAAC,YAAoB;QAC5C,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,0DAA0D;IACpG,CAAC;IAED,+FAA+F;IAC/F,wDAAwD;IACxD,OAAO;QACL,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB;QAC3E,mBAAmB,EAAE,uBAAuB,EAAE,iBAAiB;QAC/D,oBAAoB;KACrB,CAAC;AACJ,CAAC"}

package/dist/boot-core.d.ts

@@ -0,0 +1,36 @@
+import type { SecurityGatewayClient } from "@cello-protocol/gateway";
+import { SessionNodeManager } from "./session-node-manager.js";
+import { type ManifestOrigin } from "./manifest-validity.js";
+import type { DaemonConfig, Logger } from "./types.js";
+export interface BootCoreDeps {
+    config: DaemonConfig;
+    logger: Logger;
+    /** The configured directory URL, or undefined when nothing was configured. */
+    directoryHttpUrl: string | undefined;
+}
+export declare function startBootCore(deps: BootCoreDeps): Promise<{
+    failoverEndpointResolver: (() => Promise<import("./signaling-connect.js").DirectoryEndpoint | null>) | undefined;
+    getDeclaredNodeCount: () => number | null;
+    getFailoverEndpoint: () => Promise<import("./signaling-connect.js").DirectoryEndpoint | null>;
+    getUnresolvedNodes: () => import("./directory-bootstrap.js").NodeResolveFailure[];
+    getUnresolvedSweptAt: () => string | null;
+    manifestOrigin: ManifestOrigin;
+    manifestVerified: boolean;
+    resolveConsortiumRoster: () => Promise<import("./directory-bootstrap.js").ConsortiumEndpoint[] | null>;
+    rosterSweepScheduler: import("@cello-protocol/transport").IManifestPollScheduler | undefined;
+    securityGateway: SecurityGatewayClient;
+    sessionNodeManager: SessionNodeManager;
+    stopHttpManifestPoll: (() => void) | undefined;
+    stopRosterSweep: (() => void) | undefined;
+    transportSelector: import("./transport-selector.js").ITransportSelector;
+    verifiedManifest: import("@cello-protocol/protocol-types").ConsortiumManifest | null;
+    verifiedManifestVersion: number;
+    /** A READER. See the header — a snapshot here reports a healthy roster forever. */
+    lastRosterSweepError: () => {
+        event: string;
+        error: string;
+        at: string;
+        consecutive: number;
+    } | undefined;
+}>;
+//# sourceMappingURL=boot-core.d.ts.map

package/dist/boot-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-core.d.ts","sourceRoot":"","sources":["../src/boot-core.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/D,OAAO,EAA8B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGvD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,YAAY;;;;;;;;;;;;;;;;;IAgSlD,mFAAmF;;;;;;;GAGtF"}