@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/boot-parked-content.js

@@ -0,0 +1,528 @@
+/**
+ * Phase 4 of boot: parked content, and every path that gets it moving again.
+ *
+ * The retry queue and its durable rows, the park retry timers, the startup park sweep, and the flush
+ * that drains what was waiting once an agent's link comes back. One topic: content that could not be
+ * delivered when it was written, and the several distinct ways it stops being stuck.
+ *
+ * Nine dependencies, under the order's bound — counted after the extraction, not before: an earlier
+ * draft carried a seal-failure store and a `stop` getter the moved code never calls.
+ *
+ * ⚠️ AN EARLIER VERSION OF THIS HEADER CLAIMED TWO OF THEM HAD TO BE GETTERS "because the
+ * outbound-session module is constructed BELOW this phase". It is constructed 27 lines ABOVE it.
+ * Both are plain values now. The wrong version is recorded rather than deleted because of what it
+ * would have taught the next phase: "getter by default", when the rule that catches the real defect
+ * is narrower — check whether the value is ASSIGNED BELOW the call site, and a `let` that is, is the
+ * only shape that fails silently.
+ */
+import { randomUUID } from "node:crypto";
+import { RetryQueue } from "./retry-queue.js";
+import { ContentParkClient } from "./content-park-client.js";
+import { AgentRelayClient } from "./session-relay-client.js";
+import { sealParkEnvelope } from "./park-envelope.js";
+import { extractErrorMessage } from "./error-message.js";
+export function startBootParkedContent(deps) {
+    const { config, logger, sessionNodeManager, agents, keyProviders, resolveConsortiumRoster, waitForSignalingConnected, openVisitingConnection, crossNodeBrokerBySession, } = deps;
+    // Both use the same SQLite DB as the SessionNodeManager (daemon.db equivalent).
+    // loadFromDb() must complete BEFORE IPC socket opens (AC-007).
+    const retryQueue = new RetryQueue(sessionNodeManager.getDb(), logger);
+    retryQueue.loadFromDb();
+    // DOD-RETRYQ-STRAND-1: the terminal-transition hook below only fires for sessions that go
+    // terminal while this daemon runs. A session already sealed/abandoned before boot never
+    // transitions again — close-session returns `already_abandoned` without reaching abandonSession —
+    // so without this its rows are unreachable by every removal path and retryQueueDepth stays pinned
+    // forever. That is exactly the row found on the live daemon, 25.6h old. Runs after loadFromDb so
+    // the in-memory queues are dropped in step with the rows, and before the IPC socket opens so no
+    // client ever observes the stale depth.
+    retryQueue.reapAlreadyTerminalSessions();
+    // CELLO-M7-MSG-001 (AC-001/AC-003/AC-019): wire the awaiting-ACK lifecycle's durable
+    // side effects to the retry_queue. A `persisted` delivery ACK clears the durable
+    // entry; a TTF expiry records the un-acked content for the crash backstop (the relay
+    // park deposit itself is added in 3b). Both side effects are best-effort and never
+    // throw into the content stream handler.
+    // DOD-AGENT-ID-JOINKEY-1: RetryQueue owns an agent-scoped table, so it is handed the STABLE
+    // agent_id. The daemon resolves the operator-facing name ONCE, here at its own boundary.
+    // M12-P15: let a session with NO in-memory node still reach its relay to seal. The manager
+    // deliberately holds no K_local, so the client is built here where the keys live. This is what
+    // makes the detached path work after a RESTART — the exact situation that marked the session
+    // interrupted and then left it unsealable, with force-abandon (no receipt) as the only exit.
+    sessionNodeManager.setDetachedRelayClientBuilder((agentName, relayPeerId, relayAddrs, stores) => {
+        const kp = keyProviders.get(agentName);
+        const agent = agents.find((a) => a.name === agentName);
+        if (!kp || !agent?.pubkey)
+            return undefined;
+        return new AgentRelayClient({
+            relayPeerId,
+            relayAddrs,
+            keyProvider: kp,
+            senderPubkey: Buffer.from(agent.pubkey, "hex"),
+            logger,
+            // Review HIGH-1: a client that can submit but cannot RECORD drops the durable evidence the
+            // seal depends on — silently, while reporting success.
+            receiptStore: stores.receiptStore,
+            sealLeafStore: stores.sealLeafStore,
+            // `DOD-M15-SELFCHAIN-1` — without this the client cannot chain a message to this agent's own
+            // previous one, and says so rather than signing an unlinked claim.
+            ownChainStore: stores.ownChainStore,
+            // DOD-M15-RELAYSLOTS-1: the manager owns the current token and hands the accessor down, so
+            // this client reads a fresh one at every auth instead of a snapshot taken here at build time.
+            onlineToken: stores.onlineToken,
+            // DOD-M15-CORROBORATE-1: the DETACHED client needs this as much as the live one — a session
+            // being sealed after a restart is exactly when its operator is not watching.
+            onWitnessAlert: (alert) => { sessionNodeManager.recordRelayWitnessAlert(agentName, alert); },
+            onWitnessUnreadable: (peerId, why) => { sessionNodeManager.recordRelayWitnessUnreadable(agentName, peerId, why); },
+        });
+    });
+    // DOD-RETRYQ-STRAND-1: a direct-resend row is reachable only by drainSession, which has no
+    // production caller — so once its session can never drain again the row is unreachable by every
+    // removal path that exists, and pins retryQueueDepth forever. Found live: one row stranded 25.6h,
+    // after which the metric could no longer tell a real delivery backlog from a corpse.
+    sessionNodeManager.setSessionTerminalHook((sessionId, terminalStatus) => {
+        retryQueue.reapTerminalSession(sessionId, terminalStatus);
+    });
+    /**
+     * DOD-M12B-SESSION-SEED-1 — the retry drain is DELIBERATELY NOT WIRED. Review HIGH-1.
+     *
+     * It was wired, and it was worse than the problem it solved. `retryQueue.enqueue` runs only on the
+     * `!sendResult.durable` branch — content that got NO local leaf and NO transcript row, because as
+     * that branch's own comment says, *"A LOST message gets no leaf — that would commit a sequence no
+     * content will ever fill."*
+     *
+     * The hook re-sent those rows with `sendContent`, which is wire-and-witness only: it consumes a
+     * canonical relay sequence and returns one, and the hook discarded it without calling
+     * `placeOwnLeaf` or writing the transcript. So the counterparty would silently receive the message
+     * while OUR tree kept a permanent hole at that sequence. Every later message would be held behind
+     * the gap with guidance blaming the counterparty for a message they already sent, the two roots
+     * would have parted, and the session could never seal.
+     *
+     * A stranded queue row is recoverable. A parted hash chain is not. So this stays unwired until the
+     * drain routes through the same commit path `cello_send` uses (place the leaf at the returned
+     * sequence, write the transcript, keep the row on failure) rather than calling `sendContent` raw.
+     *
+     * The operator-facing consequence of leaving it unwired is unchanged from before this milestone:
+     * a message that fails this way is reported lost and must be re-sent by hand. That is honest, and
+     * it is what the guidance already says.
+     */
+    sessionNodeManager.setAwaitingAckHooks({
+        onPersisted: (agentName, sessionId, contentHashHex) => {
+            retryQueue.markContentAcked(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"));
+        },
+        // `DOD-M15-SEALWIRE-1` B2b-1 review F1 — `contentHashAlg` is the DURABLE WRITER for the column
+        // this unit added. Without it every queued row carries NULL, the crash backstop re-parks a salted
+        // message as sha256, and the recipient refuses it and re-pulls it forever. The commit that added
+        // the column said the producer "passes it"; the producer was passing a value nothing supplied,
+        // because these two hooks were never widened.
+        onTtf: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind) => {
+            retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind);
+        },
+        // M12-P12: same durable destination, different cause — a park deposit the relay refused. The
+        // TTF timer is already cancelled on this path, so this is the only thing holding the content.
+        // M12-P13 (review HIGH-1): the enqueue's own answer is returned, never a bare `true`. A dropped
+        // copy that reports success now buys a committed hash-chain leaf for content that is gone.
+        onParkFailed: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind) => {
+            return retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind);
+        },
+    });
+    // MSG-001-3b (2b): the LIVE content-park deposit. On a not-confirmed send (direct delivery
+    // failed, or TTF with no `persisted` ACK) the session manager calls this with the recipient +
+    // the session's relay endpoint; we seal the content to the recipient (E2E — the relay never sees
+    // plaintext, INV-3) and deposit it to that relay's store-and-forward mailbox via the standing
+    // receiver node. The recipient pulls + recovers it at the witnessed sequence (R1) on next online.
+    // Fix #1 EXTENSION (cross-node seal-liveness) — the AUTO-ACKNOWLEDGE half.
+    //
+    // close-session-handler already re-opens a transient visiting connection to the broker for its
+    // own path. The auto-ack path had no such guard, and it is the one that fires FIRST whenever the
+    // counterparty closes first: it submits a seal leaf, the directory answers within ~60ms by pushing
+    // `seal_verified` to the INITIATOR, finds no stream (the initiator released its visiting
+    // connection after setup), ENQUEUES the frame, and then blocks waiting for a co-signature it never
+    // asked for. Proven on GCP — leaf 18:41:56.555, directory `seal.certificate.deferred`
+    // (initiator_stream_absent) 18:41:56.615, broker reconnect 18:42:01.529: five seconds too late.
+    //
+    // Returns null for same-node sessions (no broker entry) — those reach the initiator on its home
+    // stream and need no visiting connection.
+    sessionNodeManager.setEnsureSealBroker(async (agentName, sessionId) => {
+        const brokerNode = crossNodeBrokerBySession.get(`${agentName}:${sessionId}`);
+        if (!brokerNode)
+            return null;
+        const kp = keyProviders.get(agentName);
+        if (!kp) {
+            logger.warn("session.seal.autoack.broker.no_keyprovider", { agentName, brokerNode });
+            return null;
+        }
+        const pubHex = Buffer.from(await kp.getPublicKey()).toString("hex");
+        const roster = await resolveConsortiumRoster();
+        const target = roster?.find((e) => e.nodeId === brokerNode) ?? null;
+        if (!target) {
+            logger.warn("session.seal.autoack.broker.unresolved", { agentName, brokerNode });
+            return null;
+        }
+        const correlationId = randomUUID();
+        const conn = openVisitingConnection(agentName, kp, pubHex, { peerId: target.peerId, multiaddr: target.multiaddr }, correlationId, brokerNode);
+        if (await waitForSignalingConnected(conn.mgr, 10_000)) {
+            logger.info("session.seal.autoack.broker.reconnected", { agentName, brokerNode, correlationId });
+            return conn;
+        }
+        await conn.stop("autoack-seal-broker-unreachable");
+        logger.warn("session.seal.autoack.broker.unreachable", { agentName, brokerNode, correlationId });
+        return null;
+    });
+    /**
+     * DOD-M15-RELAYABUSE-1: scheduled park-retry timers, tracked so shutdown can clear them.
+     *
+     * ⚠️ Every other daemon timer is cleared in `stop()`; an untracked one lets an in-process restart
+     * leave a stale timer that drains into a torn-down manager. Unref'd already, so it cannot hold the
+     * process open — this is about a clean teardown, not about exiting.
+     */
+    const parkRetryTimers = new Set();
+    /**
+     * DOD-M15-RELAYABUSE-1: schedule ONE drain at the delay the relay asked for.
+     *
+     * ⚠️ ONE implementation, used by both park paths. The live-send path and the drain path both need
+     * this and a second copy is how the clamp ends up on only one of them — which is exactly the shape
+     * review found here (the number had a consumer on one path and was dropped on the other).
+     *
+     * CLAMPED, because the value comes from another party's software and an unclamped one inverts the
+     * fix: Node's `setTimeout` holds an int32, so a relay reporting `3_000_000_000` overflows it and
+     * fires in about ONE MILLISECOND — re-parking instantly into the limit that just refused, and
+     * printing a `TimeoutOverflowWarning` from a daemon whose convention forbids console output.
+     */
+    function scheduleParkRetry(retryAfterMs, filterAgentName, source) {
+        const MIN_RETRY_MS = 1_000;
+        const MAX_RETRY_MS = 5 * 60_000;
+        const delay = Math.min(Math.max(retryAfterMs, MIN_RETRY_MS), MAX_RETRY_MS);
+        if (delay !== retryAfterMs) {
+            logger.warn("content.park.retry.clamped", {
+                source,
+                requestedMs: retryAfterMs,
+                usedMs: delay,
+                impact: "the relay asked for a retry delay outside the range this daemon will schedule, so it was " +
+                    "clamped — an unclamped value can overflow the timer and fire immediately, which would " +
+                    "re-park straight into the limit that just refused",
+            });
+        }
+        logger.info("content.park.retry.scheduled", { source, delayMs: delay, ...(filterAgentName !== undefined ? { agentName: filterAgentName } : {}) });
+        const timer = setTimeout(() => {
+            parkRetryTimers.delete(timer);
+            void flushAwaitingContent(filterAgentName).catch((err) => {
+                logger.warn("content.park.retry.timer.failed", {
+                    source,
+                    reason: extractErrorMessage(err),
+                    impact: "the scheduled drain threw; the ordinary event triggers (boot, agent start, reconnect) still apply",
+                });
+            });
+        }, delay);
+        timer.unref?.();
+        parkRetryTimers.add(timer);
+    }
+    sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor, structure1Signature, leafKind, contentHashAlg }) => {
+        const node = sessionNodeManager.getStandingReceiverNode();
+        if (!node) {
+            const reason = "standing_receiver_unavailable";
+            // M12-P12 (review F4): `standing_receiver_unavailable` is the exit-point label that already
+            // misnamed this incident 102 times; standingReceiverAbsenceReason() names WHICH of the four
+            // causes it is. That distinction is what separates "mid-rebuild, a retry in seconds works"
+            // from "agent offline, this will never work" — the difference between a backstop that helps
+            // and one that spins. The wire reason stays put; the cause rides alongside.
+            const cause = sessionNodeManager.standingReceiverAbsenceReason(agentName);
+            logger.warn("content.park.deposit.failed", { sessionId, contentHash: contentHashHex, reason, cause });
+            // DOD-LEAVEMSG-1 (reviewer HIGH fix): return the typed failure, never resolve as if this
+            // were a success — #parkContent's caller (sendContent) shapes a live "dispatched to relay"
+            // response from this, and a silently-resolved void here would report a message as safely
+            // parked when nothing was ever deposited.
+            return { ok: false, reason, cause };
+        }
+        // SEC-1: sign the entry as the SENDING agent. Without a key we cannot produce an envelope the
+        // recipient will accept, so fail LOUD rather than depositing something that will be refused on
+        // recovery (a deposit the recipient must reject is worse than no deposit — it looks delivered).
+        const senderKp = keyProviders.get(agentName);
+        if (!senderKp) {
+            const reason = "signing_key_unavailable";
+            logger.warn("content.park.deposit.failed", { agentName, sessionId, contentHash: contentHashHex, reason });
+            return { ok: false, reason };
+        }
+        const recipientPubkey = Buffer.from(recipientPubkeyHex, "hex");
+        const contentHashBytes = Buffer.from(contentHashHex, "hex");
+        logger.info("content.park.signed", { agentName, sessionId, contentHash: contentHashHex });
+        // DOD-MSG-4 (2b): seal the ORDERING ENVELOPE (content + the relay's signed Structure2), not bare
+        // content, so the parked entry is self-ordering on recover. The relay still holds only ciphertext.
+        // SEC-1: sealParkEnvelope is the SOLE producer — it signs (sender's K_local, over the
+        // session/recipient/content binding) and seals in one place, so the two park sites cannot drift
+        // apart on what gets signed.
+        //
+        // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
+        // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
+        // is salted is a fact about the message that was sent; what this side holds now says nothing
+        // about it.
+        //
+        // ⛔ THIS COMMENT USED TO SAY "Still `sha256` everywhere, because no send path salts yet — the
+        // plumbing is proven carrying the value that cannot break anything, and only then does the value
+        // change." That described B2b, and B2b-2 then CHANGED THE VALUE: a session holding an agreed
+        // salt hashes under `hmac-sha256-salt-v1`, so this path really does carry a salted algorithm
+        // now. Rewritten rather than deleted — a stale reassurance is what `CLAIM-COMMENTS-1` is for,
+        // and on 2026-08-24 a test declared `sha256` on the strength of this sentence and got a tamper
+        // verdict on an honest message.
+        const ciphertext = await sealParkEnvelope({
+            signer: senderKp,
+            sessionIdHex: sessionId,
+            recipientPubkey,
+            contentHash: contentHashBytes,
+            content,
+            // The algorithm the DIRECT frame named for this same message. The park copy must claim what
+            // the message actually is, not what this side would choose for it now.
+            contentHashAlg,
+            structure1Cbor,
+            structure2Cbor,
+            // 034-CARRYLEAF: promotes the envelope to v4 when present, which is what lets the recipient
+            // witness this leaf if its author never does.
+            structure1Signature,
+            leafKind,
+        });
+        const client = new ContentParkClient({ relayPeerId, relayAddrs: [...relayAddrs], logger });
+        const res = await client.deposit(node, {
+            recipientPubkey,
+            contentHash: Buffer.from(contentHashHex, "hex"),
+            sessionId: Buffer.from(sessionId, "hex"),
+            ciphertext,
+        });
+        if (res.ok) {
+            logger.info("content.park.deposited", { sessionId, contentHash: contentHashHex, recipientPubkey: recipientPubkeyHex.slice(0, 16) });
+            return { ok: true };
+        }
+        logger.warn("content.park.deposit.failed", {
+            sessionId,
+            contentHash: contentHashHex,
+            reason: res.reason,
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        });
+        /**
+         * DOD-M15-RELAYABUSE-1 — **GIVE THE RELAY'S "WHEN" A CONSUMER.**
+         *
+         * A deferred park is otherwise retried only on EVENTS — boot, agent start, the drain hook, a
+         * signaling reconnect. None of those is coming for a throttle: the relay is healthy, the link
+         * never dropped, and the condition clears on a timer nobody is watching. So the one refusal that
+         * self-heals in about a minute was the one that waited longest, purely because the number the
+         * relay had already computed had no reader.
+         *
+         * Scheduled ONCE per refusal, unref'd so it can never hold the process open, and best-effort:
+         * the existing event triggers remain the guarantee, and this is a shortcut on top of them. It
+         * deliberately does not retry-on-retry — a timer that reschedules itself on failure is a
+         * self-inflicted flood, which is what the limiter exists to stop.
+         */
+        if (res.retryAfterMs !== undefined && res.retryAfterMs > 0) {
+            /**
+             * ⚠️ CLAMPED, because the number comes from ANOTHER PARTY'S SOFTWARE and an unclamped one is
+             * not merely wrong — it inverts the fix. Node's `setTimeout` holds an int32: a relay reporting
+             * `3_000_000_000` overflows it and the timer fires in about **one millisecond**, re-parking
+             * instantly into the limit that just refused, and printing a `TimeoutOverflowWarning` on
+             * stderr from a daemon whose convention forbids console output. A reported `1` does the same
+             * thing 250 ms later.
+             *
+             * The floor is a second and the ceiling five minutes: long enough that a shortcut is a
+             * shortcut, short enough that it stays one. A clamp is announced rather than silent — a relay
+             * asking us to wait 35 days is a fact an operator wants.
+             */
+            scheduleParkRetry(res.retryAfterMs, agentName, "send");
+        }
+        return {
+            ok: false,
+            reason: res.reason ?? "relay_deposit_failed",
+            // DOD-M15-RELAYABUSE-1 review MEDIUM-6: the guidance quotes the relay's OWN window instead of
+            // guessing "about a minute", which is a hardcoded assumption about a configurable value.
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        };
+    });
+    // CELLO-M7-MSG-001 (AC-004/AC-005, D-d): startup flush of locally-persisted un-acked
+    // content (the crash backstop). Runs HERE — before the IPC socket opens, consistent
+    // with DAEMON-003 startup loading (AC-007) — so a sender that crashed before its TTF
+    // park confirmed re-parks its un-acked content to the relay store-and-forward queue on
+    // restart. Best-effort: a failed park stays queued (drainAwaitingToPark does not evict
+    // on failure), to be retried at the next startup flush or reconnect.
+    //
+    // Re-home note (Option A): the park target (config.contentParkFn) is supplied natively
+    // by the daemon's own send path — NOT by a hosted CelloClient. When it is absent (e.g.
+    // a daemon started without the content send path wired, or unit tests), the flush is a
+    // documented no-op (content.park.flush.deferred at WARN) and the durable awaiting
+    // entries simply remain queued for the next startup that has a park target.
+    // MSG-2 startup-flush park target: seal + deposit an un-acked awaiting entry sourced from
+    // PERSISTED session state (the in-memory entry is gone after a restart). Same seal + deposit
+    // as the live hook above; the endpoint + recipient come from the sessions row.
+    const startupParkFn = async (entry) => {
+        // The durable row carries the OWNING agent's stable id. Resolve it back to a name for the
+        // name-addressed session/standing-receiver lookups. A retired owner resolves fine and then has no
+        // standing receiver, so the park fails loudly below rather than silently re-parking as someone else.
+        const ownerName = sessionNodeManager.agentNameForId(entry.agentId);
+        if (ownerName === null)
+            return { parked: false, error: "owning_agent_not_found" };
+        const ep = sessionNodeManager.getPersistedRelayEndpoint(ownerName, entry.sessionId);
+        const record = sessionNodeManager.getSessionRecord(ownerName, entry.sessionId);
+        if (!ep)
+            return { parked: false, error: "no_persisted_relay_endpoint" };
+        if (!record?.counterparty_pubkey)
+            return { parked: false, error: "no_counterparty" };
+        // DOD-LOOP-1: the re-park must originate from the session's OWNING agent (the original
+        // sender), so use THAT agent's standing-receiver node — not "any" agent's. Post-DOD-LOOP-1 the
+        // owning agent's SR exists only once it is online, which is why the native flush is
+        // (re-)triggered per-agent on agent-online (see flushAwaitingContent / cello_start_agent), not
+        // only at pre-IPC startup when no agent is online yet.
+        const node = sessionNodeManager.getStandingReceiverNode(record.agent_name);
+        if (!node)
+            return { parked: false, error: "standing_receiver_unavailable" };
+        // SEC-1: the crash backstop must sign too — an unsigned re-park would be REFUSED on recovery,
+        // which would turn the message-loss backstop into a message-loss cause. The SEC-1 signature
+        // binds to the sender's own K_local, which the owning agent still holds after a crash.
+        // M12-P12 (review F2): the ordering record IS now persisted (retry_queue.structure{1,2}_cbor),
+        // so a re-park is self-ordering whenever the row carries one. Rows written before that column
+        // existed carry none and still recover in arrival order — the pre-existing behaviour, now the
+        // exception rather than the rule.
+        const senderKp = keyProviders.get(ownerName);
+        if (!senderKp)
+            return { parked: false, error: "signing_key_unavailable" };
+        const recipientPubkey = Buffer.from(record.counterparty_pubkey, "hex");
+        const contentHashBytes = Buffer.from(entry.contentHashHex, "hex");
+        logger.info("content.park.signed", { agentName: ownerName, sessionId: entry.sessionId, contentHash: entry.contentHashHex, source: "startup_flush" });
+        // DOD-MSG-4 (2b): ONE envelope format on the recover side. M12-P12 (F2): carry the persisted
+        // ordering record when the row has one, so the recipient places the content at its WITNESSED
+        // sequence rather than its arrival index — the receiver's #witnessedSeq map is in-memory and
+        // empty after a restart, so arrival order there means a wrong leaf index and a divergent tree.
+        // SEC-1: same sole producer as the live hook — the backstop signs from the persisted
+        // (sessionId, recipient, contentHash).
+        //
+        // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
+        // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
+        // is salted is a fact about the message that was sent; what this side holds now says nothing
+        // about it.
+        //
+        // ⛔ THIS COMMENT USED TO SAY "Still `sha256` everywhere, because no send path salts yet — the
+        // plumbing is proven carrying the value that cannot break anything, and only then does the value
+        // change." That described B2b, and B2b-2 then CHANGED THE VALUE: a session holding an agreed
+        // salt hashes under `hmac-sha256-salt-v1`, so this path really does carry a salted algorithm
+        // now. Rewritten rather than deleted — a stale reassurance is what `CLAIM-COMMENTS-1` is for,
+        // and on 2026-08-24 a test declared `sha256` on the strength of this sentence and got a tamper
+        // verdict on an honest message.
+        const ciphertext = await sealParkEnvelope({
+            signer: senderKp,
+            sessionIdHex: entry.sessionId,
+            recipientPubkey,
+            contentHash: contentHashBytes,
+            content: entry.contentBlob,
+            // The queued row's own record of how it was hashed. `undefined` for a row written before the
+            // column existed, which resolves to `sha256` — exactly what such a row actually used.
+            contentHashAlg: entry.contentHashAlg,
+            structure1Cbor: entry.structure1Cbor,
+            structure2Cbor: entry.structure2Cbor,
+            // 034-CARRYLEAF: a re-parked message must reach its recipient in a shape they can WITNESS on
+            // the sender's behalf, or a crash re-opens the withholding hole on the mailbox route.
+            structure1Signature: entry.structure1Signature,
+            leafKind: entry.leafKind,
+        });
+        const client = new ContentParkClient({ relayPeerId: ep.relayPeerId, relayAddrs: [...ep.relayAddrs], logger });
+        const res = await client.deposit(node, {
+            recipientPubkey,
+            contentHash: Buffer.from(entry.contentHashHex, "hex"),
+            sessionId: Buffer.from(entry.sessionId, "hex"),
+            ciphertext,
+        });
+        if (res.ok) {
+            logger.info("content.park.deposited", { sessionId: entry.sessionId, contentHash: entry.contentHashHex, source: "startup_flush" });
+            return { parked: true };
+        }
+        return {
+            parked: false,
+            error: res.reason ?? "deposit_failed",
+            // DOD-M15-RELAYABUSE-1 review HIGH-2: carry the relay's own "when" out of the DRAIN path too.
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        };
+    };
+    // Re-park un-acked awaiting content to the relay store-and-forward queue. Runs once pre-IPC
+    // (the crash backstop) and again per-agent when an agent comes online — because post-DOD-LOOP-1
+    // the native `startupParkFn` needs the OWNING agent's standing receiver, which exists only once
+    // that agent is online. `filterAgentName` scopes the drain to one agent's sessions on the agent-
+    // online re-run; with no filter it attempts all (the pre-IPC pass / injected-target test path).
+    // M12-P12 (review pass 2): the sender flush now has FOUR triggers (boot, agent start, the parked-
+    // drain hook, signaling reconnect), and two of them fire deterministically together on agent start
+    // — the drain hook runs inside ensureStandingReceiver, whose own .then() then calls this again
+    // while the first pass is still dialling the relay. The receiver twin (contentPark) already
+    // coalesces for exactly this reason; adding triggers to the sender half without the same guard was
+    // an asymmetry, not a decision. Re-run once at the end if a trigger arrived mid-flight, so a
+    // coalesced call never DROPS work — it defers it.
+    const flushInFlight = new Set();
+    const flushRerunRequested = new Set();
+    async function flushAwaitingContent(filterAgentName) {
+        const flushKey = filterAgentName ?? "*";
+        if (flushInFlight.has(flushKey)) {
+            flushRerunRequested.add(flushKey);
+            return;
+        }
+        flushInFlight.add(flushKey);
+        try {
+            await flushAwaitingContentInner(filterAgentName);
+        }
+        finally {
+            flushInFlight.delete(flushKey);
+        }
+        if (flushRerunRequested.delete(flushKey)) {
+            await flushAwaitingContent(filterAgentName);
+        }
+    }
+    async function flushAwaitingContentInner(filterAgentName) {
+        // DOD-AGENT-ID-JOINKEY-1: the queue is keyed by the STABLE agent_id, but the caller (and the
+        // human-readable log) speak the NAME. Resolve once here; log the name, filter by the id.
+        const filterAgentId = filterAgentName !== undefined
+            ? sessionNodeManager.resolveAgentId(filterAgentName)
+            : undefined;
+        const all = retryQueue.getAwaitingSessions();
+        const sessions = filterAgentId === undefined
+            ? all
+            : all.filter((s) => s.agentId === filterAgentId);
+        if (sessions.length === 0)
+            return;
+        const parkFn = config.contentParkFn ?? startupParkFn;
+        if (!parkFn) {
+            const pendingCount = sessions.reduce((n, s) => n + retryQueue.getAwaitingDepth(s.agentId, s.sessionId), 0);
+            logger.warn("content.park.flush.deferred", {
+                sessionCount: sessions.length,
+                pendingCount,
+                reason: "no_content_park_target",
+            });
+            return;
+        }
+        let parkedTotal = 0;
+        for (const s of sessions) {
+            try {
+                parkedTotal += await retryQueue.drainAwaitingToPark(s.agentId, s.sessionId, parkFn, (retryAfterMs) => {
+                    /**
+                     * DOD-M15-RELAYABUSE-1 review HIGH-2 — **the drain path can now schedule its own
+                     * follow-up, which is what makes the retry work for a BACKLOG rather than one message.**
+                     *
+                     * Before this, only the live send path heard the relay's delay. With a backlog larger than
+                     * one rate-limit window, the drain deposited what the window allowed, every remaining item
+                     * was refused, and all of them fell back to waiting for an unrelated reconnect — the exact
+                     * condition the retry timer was added to remove.
+                     *
+                     * ONE timer per pass (the drain reports the largest delay it saw, not one per item), and
+                     * it deliberately does not chain beyond that: the next pass schedules the next one only if
+                     * it is refused again, so a permanently-full relay costs one timer per window rather than
+                     * an accelerating stream of them.
+                     */
+                    scheduleParkRetry(retryAfterMs, filterAgentName, "drain");
+                });
+            }
+            catch (err) {
+                logger.error("content.park.flush.failed", {
+                    sessionId: s.sessionId,
+                    error: extractErrorMessage(err),
+                });
+            }
+        }
+        logger.info("content.park.flush.completed", {
+            sessionCount: sessions.length,
+            parkedCount: parkedTotal,
+            ...(filterAgentName !== undefined ? { agentName: filterAgentName } : {}),
+        });
+    }
+    // `scheduleParkRetry` and `startupParkFn` are NOT returned: their only callers moved with them.
+    // A returned name implies a consumer, and widening the surface for none is the same claim about
+    // coupling that an unused dependency makes.
+    return { retryQueue, parkRetryTimers, flushAwaitingContent };
+}
+//# sourceMappingURL=boot-parked-content.js.map

package/dist/boot-parked-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-parked-content.js","sourceRoot":"","sources":["../src/boot-parked-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAKtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAmBzD,MAAM,UAAU,sBAAsB,CAAC,IAA2B;IAChE,MAAM,EACJ,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EACxD,uBAAuB,EAAE,yBAAyB,EAClD,sBAAsB,EAAE,wBAAwB,GACjD,GAAG,IAAI,CAAC;IAET,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,UAAU,CAAC,UAAU,EAAE,CAAC;IACxB,0FAA0F;IAC1F,wFAAwF;IACxF,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,gGAAgG;IAChG,wCAAwC;IACxC,UAAU,CAAC,2BAA2B,EAAE,CAAC;IAEzC,qFAAqF;IACrF,iFAAiF;IACjF,qFAAqF;IACrF,mFAAmF;IACnF,yCAAyC;IACzC,4FAA4F;IAC5F,yFAAyF;IACzF,2FAA2F;IAC3F,+FAA+F;IAC/F,6FAA6F;IAC7F,6FAA6F;IAC7F,kBAAkB,CAAC,6BAA6B,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;QAC9F,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,IAAI,gBAAgB,CAAC;YAC1B,WAAW;YACX,UAAU;YACV,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC;YAC9C,MAAM;YACN,2FAA2F;YAC3F,uDAAuD;YACvD,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,6FAA6F;YAC7F,mEAAmE;YACnE,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,2FAA2F;YAC3F,8FAA8F;YAC9F,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,4FAA4F;YAC5F,6EAA6E;YAC7E,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,mBAAmB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;SACnH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,gGAAgG;IAChG,kGAAkG;IAClG,qFAAqF;IACrF,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE;QACtE,UAAU,CAAC,mBAAmB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEH,kBAAkB,CAAC,mBAAmB,CAAC;QACrC,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE;YACpD,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3H,CAAC;QACD,+FAA+F;QAC/F,kGAAkG;QAClG,iGAAiG;QACjG,+FAA+F;QAC/F,8CAA8C;QAC9C,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE;YACtI,UAAU,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACzN,CAAC;QACD,6FAA6F;QAC7F,8FAA8F;QAC9F,gGAAgG;QAChG,2FAA2F;QAC3F,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE;YAC7I,OAAO,UAAU,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAChO,CAAC;KACF,CAAC,CAAC;IAEH,2FAA2F;IAC3F,8FAA8F;IAC9F,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,2EAA2E;IAC3E,EAAE;IACF,+FAA+F;IAC/F,iGAAiG;IACjG,mGAAmG;IACnG,yFAAyF;IACzF,mGAAmG;IACnG,sFAAsF;IACtF,gGAAgG;IAChG,EAAE;IACF,gGAAgG;IAChG,0CAA0C;IAC1C,kBAAkB,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;QACpE,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QAC9I,IAAI,MAAM,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,eAAmC,EAAE,MAAwB;QAC5G,MAAM,YAAY,GAAG,KAAK,CAAC;QAC3B,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QAC3E,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACxC,MAAM;gBACN,WAAW,EAAE,YAAY;gBACzB,MAAM,EAAE,KAAK;gBACb,MAAM,EACJ,2FAA2F;oBAC3F,wFAAwF;oBACxF,mDAAmD;aACtD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClJ,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,KAAK,oBAAoB,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAChE,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBAC7C,MAAM;oBACN,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;oBAChC,MAAM,EAAE,mGAAmG;iBAC5G,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE;QAC5N,MAAM,IAAI,GAAG,kBAAkB,CAAC,uBAAuB,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,+BAA+B,CAAC;YAC/C,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,4FAA4F;YAC5F,4EAA4E;YAC5E,MAAM,KAAK,GAAG,kBAAkB,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACtG,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,0CAA0C;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;QACD,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,yBAAyB,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1F,iGAAiG;QACjG,mGAAmG;QACnG,sFAAsF;QACtF,gGAAgG;QAChG,6BAA6B;QAC7B,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,6FAA6F;QAC7F,YAAY;QACZ,EAAE;QACF,8FAA8F;QAC9F,iGAAiG;QACjG,6FAA6F;QAC7F,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,gCAAgC;QAChC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,SAAS;YACvB,eAAe;YACf,WAAW,EAAE,gBAAgB;YAC7B,OAAO;YACP,4FAA4F;YAC5F,uEAAuE;YACvE,cAAc;YACd,cAAc;YACd,cAAc;YACd,4FAA4F;YAC5F,8CAA8C;YAC9C,mBAAmB;YACnB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;YACrC,eAAe;YACf,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC;YAC/C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;YACxC,UAAU;SACX,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACpI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YACzC,SAAS;YACT,WAAW,EAAE,cAAc;YAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH;;;;;;;;;;;;;WAaG;QACH,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC3D;;;;;;;;;;;eAWG;YACH,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,sBAAsB;YAC5C,8FAA8F;YAC9F,yFAAyF;YACzF,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qFAAqF;IACrF,oFAAoF;IACpF,qFAAqF;IACrF,uFAAuF;IACvF,uFAAuF;IACvF,qEAAqE;IACrE,EAAE;IACF,uFAAuF;IACvF,uFAAuF;IACvF,uFAAuF;IACvF,kFAAkF;IAClF,4EAA4E;IAC5E,0FAA0F;IAC1F,6FAA6F;IAC7F,+EAA+E;IAC/E,MAAM,aAAa,GAAsC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvE,0FAA0F;QAC1F,kGAAkG;QAClG,qGAAqG;QACrG,MAAM,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAClF,MAAM,EAAE,GAAG,kBAAkB,CAAC,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,mBAAmB;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACrF,uFAAuF;QACvF,+FAA+F;QAC/F,oFAAoF;QACpF,+FAA+F;QAC/F,uDAAuD;QACvD,MAAM,IAAI,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAC5E,8FAA8F;QAC9F,4FAA4F;QAC5F,uFAAuF;QACvF,+FAA+F;QAC/F,8FAA8F;QAC9F,8FAA8F;QAC9F,kCAAkC;QAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC1E,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACrJ,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;QAC7F,+FAA+F;QAC/F,qFAAqF;QACrF,uCAAuC;QACvC,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,6FAA6F;QAC7F,YAAY;QACZ,EAAE;QACF,8FAA8F;QAC9F,iGAAiG;QACjG,6FAA6F;QAC7F,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,gCAAgC;QAChC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK,CAAC,SAAS;YAC7B,eAAe;YACf,WAAW,EAAE,gBAAgB;YAC7B,OAAO,EAAE,KAAK,CAAC,WAAW;YAC1B,6FAA6F;YAC7F,sFAAsF;YACtF,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,6FAA6F;YAC7F,sFAAsF;YACtF,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;YACrC,eAAe;YACf,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC;YACrD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC;YAC9C,UAAU;SACX,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAClI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,gBAAgB;YACrC,8FAA8F;YAC9F,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC,CAAC;IAEF,4FAA4F;IAC5F,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,mGAAmG;IACnG,+FAA+F;IAC/F,4FAA4F;IAC5F,mGAAmG;IACnG,6FAA6F;IAC7F,kDAAkD;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,KAAK,UAAU,oBAAoB,CAAC,eAAwB;QAC1D,MAAM,QAAQ,GAAG,eAAe,IAAI,GAAG,CAAC;QACxC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,yBAAyB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,UAAU,yBAAyB,CAAC,eAAwB;QAC/D,6FAA6F;QAC7F,yFAAyF;QACzF,MAAM,aAAa,GAAG,eAAe,KAAK,SAAS;YACjD,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,eAAe,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,UAAU,CAAC,mBAAmB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,aAAa,KAAK,SAAS;YAC1C,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACzC,YAAY,EAAE,QAAQ,CAAC,MAAM;gBAC7B,YAAY;gBACZ,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,WAAW,IAAI,MAAM,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE;oBACnG;;;;;;;;;;;;;uBAaG;oBACH,iBAAiB,CAAC,YAAY,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;oBACxC,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC1C,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,WAAW,EAAE,WAAW;YACxB,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IACD,gGAAgG;IAChG,gGAAgG;IAChG,4CAA4C;IAC5C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC;AAC/D,CAAC"}

package/dist/boot-sweeps.d.ts

@@ -0,0 +1,22 @@
+/**
+ * ONE of the daemon's two background sweeps — the revival-bound sweep — and the timer that re-arms
+ * it. The other, the document reconcile sweep, is still in the composition root beside the document
+ * wiring it drives.
+ *
+ * A sweep is not a one-off: a session interrupted at 09:00 on a daemon that stays up all week would
+ * otherwise be swept only at the next boot, and a long-lived daemon is the normal case. The timer
+ * `unref`s so a pending tick never holds the process open.
+ *
+ * The timer is returned rather than started-and-forgotten because shutdown has to clear it, and a
+ * timer nobody holds a handle to is a process that will not exit.
+ */
+import type { Logger } from "./types.js";
+import { type SessionNodeManager } from "./session-node-manager.js";
+export interface BootSweepsDeps {
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+}
+export declare function startBootSweeps(deps: BootSweepsDeps): {
+    revivalBoundSweepTimer: NodeJS.Timeout;
+};
+//# sourceMappingURL=boot-sweeps.d.ts.map

package/dist/boot-sweeps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-sweeps.d.ts","sourceRoot":"","sources":["../src/boot-sweeps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAA6C,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/G,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc;;EAkDnD"}

package/dist/boot-sweeps.js

@@ -0,0 +1,51 @@
+import { REVIVAL_WINDOW_MS, REVIVAL_BOUND_SWEEP_MS } from "./session-node-manager.js";
+import { extractErrorMessage } from "./error-message.js";
+export function startBootSweeps(deps) {
+    const { logger, sessionNodeManager } = deps;
+    /**
+     * DOD-M12B-REVIVAL-BOUND-1 — close the interrupted sessions the revival window has expired.
+     *
+     * Runs at boot beside the restart-seal resolver, and is its complement: the resolver takes the
+     * sessions we can describe truthfully (`interrupted_by = 'local'`) and gets them a receipt; this
+     * takes everything else and shuts the door without asserting a cause.
+     *
+     * It must run even though nothing has revived a session yet — the reason is Andre's 2026-08-18
+     * tenet, *"leave nothing open that is no longer needed."* `ingestReceivedContent` accepts content
+     * into an `interrupted` session by design, so a session that can never be revived is a write
+     * surface a reprogrammed peer can use for as long as the row exists. Boot is where the store is
+     * swept for exactly that.
+     *
+     * NOT AWAITED, and caught: this is a best-effort sweep over rows that have already waited a day.
+     * Blocking the daemon's startup on a directory-free DB walk buys nothing, and a throw here would
+     * take down a daemon that is otherwise healthy.
+     */
+    const runRevivalBoundSweep = () => {
+        void sessionNodeManager
+            .closeExpiredUnrevivableSessions(Date.now(), REVIVAL_WINDOW_MS)
+            .catch((err) => {
+            logger.warn("session.revival_bound.sweep.failed", {
+                error: extractErrorMessage(err),
+                impact: "expired sessions were not closed this pass and still accept content",
+            });
+        });
+    };
+    runRevivalBoundSweep();
+    /**
+     * RE-ARMED, because boot alone is not a bound.
+     *
+     * A session interrupted at 09:00 on a daemon that stays up all week would otherwise be writable
+     * for the whole week — and a long-lived daemon is the normal case, not the exception. Boot-only
+     * would have made the control fire exactly when it is least needed (a machine that restarts often
+     * is a machine whose sessions get swept often) and never when it is most needed.
+     *
+     * Hourly against a 24-hour window: the overshoot is at most an hour on a bound measured in days,
+     * and the pass is a single indexed DB walk with no network in it. `unref` so a pending timer
+     * never holds the process open, matching `reconcileSweepTimer` beside it.
+     */
+    const revivalBoundSweepTimer = setInterval(runRevivalBoundSweep, REVIVAL_BOUND_SWEEP_MS);
+    revivalBoundSweepTimer.unref?.();
+    // The sweep function itself is not returned — its only callers are here (once at construction,
+    // then on the timer). Only the timer escapes, because shutdown has to clear it.
+    return { revivalBoundSweepTimer };
+}
+//# sourceMappingURL=boot-sweeps.js.map

package/dist/boot-sweeps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-sweeps.js","sourceRoot":"","sources":["../src/boot-sweeps.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAA2B,MAAM,2BAA2B,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAOzD,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAE5C;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,oBAAoB,GAAG,GAAS,EAAE;QACtC,KAAK,kBAAkB;aACpB,+BAA+B,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC;aAC9D,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EAAE,qEAAqE;aAC9E,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,oBAAoB,EAAE,CAAC;IAEvB;;;;;;;;;;;OAWG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACzF,sBAAsB,CAAC,KAAK,EAAE,EAAE,CAAC;IAEjC,+FAA+F;IAC/F,gFAAgF;IAChF,OAAO,EAAE,sBAAsB,EAAE,CAAC;AACpC,CAAC"}