@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/restart-seal-resolver.d.ts

@@ -0,0 +1,110 @@
+/**
+ * DOD-M12B-RESTART-SEAL-1 — resolve the sessions our own stop orphaned, with a receipt.
+ *
+ * A daemon shutdown flips every open session to `interrupted` on the way out, and nothing has ever
+ * moved them again: their transport keypairs died with the process, so they cannot be resumed, and
+ * the only exit is `cello_close_session {force:true}`, which forfeits the notarized receipt.
+ *
+ * This walks them on startup and SEALS them instead — bilateral if the counterparty answers,
+ * unilateral once the directory's delivery grace has elapsed. When the directory refuses
+ * `seal_unilateral_too_early` it hands back exactly how long is left; that number becomes a
+ * scheduled retry rather than a sentence asking a human to come back.
+ *
+ * SCOPE IS THE WHOLE SAFETY ARGUMENT, and after DOD-M12B-PENDING-RESOLVE-1 it has TWO branches.
+ *
+ *   1. `interrupted` with `interrupted_by = 'local'` — OURS. Our own boot sweep, shutdown sweep or
+ *      kill switch ended it; nobody else did, and it cannot be resumed because the keypairs died
+ *      with the process.
+ *   2. `seal_interrupted_pending` — a seal commitment that nobody ever asked the directory to
+ *      notarize. **This population includes sessions the COUNTERPARTY asked to end**, which is why
+ *      the SI-001 boundary in `close-session-handler.ts` had to be restated rather than left as
+ *      "nothing the counterparty caused is auto-sealed". SI-001 forbids notarizing a conversation
+ *      NOBODY chose to end; here somebody always did — an initiator row carries the counterparty's
+ *      signed leaf, and a responder row exists because the counterparty sent a request to seal.
+ *
+ * Serial and staggered on purpose: a seal is a directory ceremony, and a machine holding hundreds of
+ * orphans must not answer a restart with hundreds of simultaneous ceremonies.
+ */
+import type { Logger } from "./types.js";
+/** A session our own stop left behind. */
+export interface RestartOrphan {
+    agentName: string;
+    sessionId: string;
+    messageCount: number;
+    /**
+     * DOD-M12B-PENDING-RESOLVE-1: which population this is. Two statuses now reach this queue and
+     * they need different words in a give-up: an `interrupted` session may legitimately be
+     * force-abandoned, and a `seal_interrupted_pending` one must not be, because forcing forfeits a
+     * signed commitment and the relay-witnessed leaves that are one request away from a receipt.
+     */
+    status: "interrupted" | "seal_interrupted_pending";
+}
+/**
+ * The result of one seal attempt. `retryAfterSeconds` is the directory's own countdown from
+ * `seal_unilateral_too_early` — the delivery grace that has to elapse before a unilateral seal is
+ * allowed. It is a WAIT the directory named, not a guess.
+ */
+export type SealOutcome = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+    retryAfterSeconds?: number;
+    /** The close path's own guidance. Carried, never replaced — see the give-up log. */
+    guidance?: string;
+    /** Everything the close computed about WHY, so `reason` stops being the only fact. */
+    detail?: Record<string, unknown>;
+};
+export interface ScheduledTask {
+    cancel: () => void;
+}
+export interface RestartSealResolverDeps {
+    logger: Logger;
+    /**
+     * DOD-M12B-PENDING-RESOLVE-1 — TWO populations, each with its own safety argument:
+     *   - `interrupted` AND `interrupted_by = 'local'` — our own stop ended it, so we may describe it.
+     *   - `seal_interrupted_pending` — a seal commitment nobody asked the directory to notarize.
+     * Nothing else is eligible.
+     */
+    listRestartOrphans: () => RestartOrphan[];
+    sealSession: (agentName: string, sessionId: string) => Promise<SealOutcome>;
+    /**
+     * Record DURABLY that this session was given up on, so the next boot does not start over.
+     * Without it a machine restarting ~6 times a day re-attempts a hopeless session forever.
+     *
+     * REQUIRED, not optional. There is exactly one composition root, so optionality buys nothing and
+     * costs the compiler's ability to catch a wiring that was never done — and the whole
+     * justification for the two new columns is that this call happens.
+     */
+    markGaveUp: (agentName: string, sessionId: string, reason: string) => void;
+    now?: () => number;
+    schedule?: (fn: () => void, ms: number) => ScheduledTask;
+    /** Gap between two seal attempts. */
+    staggerMs?: number;
+    /**
+     * How long to wait after boot before the first attempt. A seal needs the directory, and at the
+     * instant the daemon finishes starting, signaling is still being established — firing
+     * immediately would spend an attempt on a connection that does not exist yet.
+     */
+    initialDelayMs?: number;
+    /** Hard ceiling on attempts for one session before it is reported as needing a manual decision. */
+    maxAttemptsPerSession?: number;
+    /**
+     * Ceiling on ONE seal attempt. A close that never settles would otherwise leave `#running` true
+     * with no timer armed and no log line — the resolver stalls, holding a full queue, silently.
+     */
+    attemptTimeoutMs?: number;
+}
+export declare class RestartSealResolver {
+    #private;
+    constructor(deps: RestartSealResolverDeps);
+    /** Enqueue every restart orphan and begin working through them. Idempotent. */
+    start(): void;
+    /**
+     * Stop, and start nothing further. A shutdown that keeps opening directory ceremonies is not
+     * draining (DOD-M12B-SHUTDOWN-1) — and the flag, not the cancelled timer, is what an attempt
+     * already in flight checks when it lands.
+     */
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=restart-seal-resolver.d.ts.map

package/dist/restart-seal-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restart-seal-resolver.d.ts","sourceRoot":"","sources":["../src/restart-seal-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,aAAa,GAAG,0BAA0B,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,aAAa,EAAE,CAAC;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5E;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,aAAa,CAAC;IACzD,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAoHD,qBAAa,mBAAmB;;gBAkBlB,IAAI,EAAE,uBAAuB;IAUzC,+EAA+E;IAC/E,KAAK,IAAI,IAAI;IA+Bb;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA8LtB"}

package/dist/restart-seal-resolver.js

@@ -0,0 +1,353 @@
+import { extractErrorMessage } from "./error-message.js";
+/**
+ * Refusals no retry can ever help, so they cost ONE attempt and not fifteen minutes.
+ *
+ * Measured 2026-08-17 across 443 submitted seal leaves and 183 completed seals — 59% of seals that
+ * start never finish, and these are the reasons where trying again is not persistence:
+ *
+ *   session_abandoned                          10× — terminal by definition; the receipt is gone.
+ *   leaf_count_mismatch                         4× — the two trees genuinely disagree.
+ *   seal_interrupted_rejected_by_counterparty  18× — they said NO. Asking again is worse than
+ *                                                    noise: it is a machine badgering a peer who
+ *                                                    already declined.
+ *
+ * `seal_carry_bilateral_in_progress` is deliberately NOT here either: it means the relay has what
+ * it needs to seal BILATERALLY, so the right move is to come back and find the session already
+ * sealed — which then answers `session_already_sealed`, which IS terminal.
+ *
+ * `session_incomplete` and `seal_unilateral_timeout` are deliberately NOT here. The first can be
+ * fixed by a relay pull filling the gap — the close's own guidance says so — and the second is a
+ * directory that did not answer in time, which the next attempt may well get.
+ */
+/**
+ * DOD-M12B-PENDING-RESOLVE-1 (review F2) — refusals that mean "WE were not ready", not "this session
+ * is hopeless".
+ *
+ * Every one of these is a local precondition of OURS. The close handler says so itself:
+ * *"`standing_receiver_unavailable` is simply 'the agent is not started yet', which a freshly booted
+ * daemon reports for every session."* And a freshly booted daemon is the only time this resolver
+ * runs — the receiver is created when `cello_start_agent` reaches the daemon, which on a boot where
+ * no client has attached yet has not happened for any agent.
+ *
+ * Left in the ordinary budget they cost five attempts in ~15 minutes and then a DURABLE
+ * `restart_seal_gave_up_at`, which removes the session from the only queue that would ever look at
+ * it again. For the `seal_interrupted_pending` population that is materially worse than doing
+ * nothing: those rows hold signed commitments and relay-witnessed leaves that are ready to notarize,
+ * and the give-up reaches no operator surface at all — it is a warn line in `daemon.log`.
+ *
+ * So these retry on the same backoff but do NOT consume the attempt budget and can never be the
+ * reason for a permanent give-up. They are bounded instead by wall-clock (`#localPreconditionCap`),
+ * so a genuinely dead daemon still stops eventually rather than retrying forever.
+ */
+const LOCAL_PRECONDITION_REFUSALS = new Set([
+    "standing_receiver_unavailable",
+    "no_persisted_relay_endpoint",
+    "relay_unavailable",
+    "directory_unreachable",
+    "transport_unavailable",
+    /**
+     * `DOD-M15-TOKENSTALE-1` review F2 — the textbook member of this set, and it only started arriving
+     * under its own name when that unit split the submit boundary. Before, it was `relay_unavailable`
+     * and was already covered.
+     *
+     * It clears on a relogin, so it is exactly the "local precondition that will pass later" this set
+     * is for. Left out, it consumes the attempt budget and then writes a DURABLE give-up — removing
+     * sessions holding signed commitments from the only queue that would ever enumerate them again,
+     * which is the 28-session outcome the comment above records.
+     */
+    "online_token_expired",
+    "online_token_required",
+    "online_token_pubkey_mismatch",
+]);
+const TERMINAL_SEAL_REFUSALS = new Set([
+    "session_abandoned",
+    "seal_interrupted_rejected_by_counterparty",
+    "session_already_sealed",
+    // OUR OWN verification finding a genuine divergence between the two trees. Distinct from the
+    // counterparty's `leaf_count_mismatch`, which never reaches here as a top-level reason — it
+    // arrives as `detail.rejection_reason` under the rejection above. Naming the bare string here
+    // was inert: the close cannot produce it.
+    "seal_interrupted_leaf_count_mismatch",
+    // DOD-M15-DIVERGE-1: this side's tree parted from the relay's ordering. Nothing backfills or
+    // re-numbers a leaf, so the refusal is identical on every attempt — spending the retry budget on
+    // it only delays the durable `restart_seal_gave_up_at` it was always going to reach. The operator
+    // decides between comparing counts with the counterparty and force-abandoning; a resolver cannot
+    // do either.
+    "session_record_diverged",
+    "session_not_found",
+    // The relay released the session (it drops one 24 h after the last message), so there is nothing
+    // left for any directory to rebuild the record from. No amount of retrying brings it back.
+    "seal_carry_empty",
+    // Two of our SEAL ctrl leaves in one durable carry. No directory can ever notarize it, and no
+    // retry changes the carry.
+    "seal_carry_duplicate_own_ctrl_leaf",
+    // The lookup that answers "is a ctrl leaf already posted?" failed. Refusing is correct — a second
+    // leaf is permanent — but retrying it five times cannot make the database readable.
+    "seal_leaf_recovery_unavailable",
+    // Not protocol outcomes — a wiring or caller fault. Retrying re-runs the same bug.
+    "session_not_closeable",
+    "close_handler_missing",
+    "missing_params",
+]);
+const DEFAULT_STAGGER_MS = 5_000;
+/** Long enough for the directory handshake started moments earlier to have landed. */
+const DEFAULT_INITIAL_DELAY_MS = 30_000;
+const DEFAULT_MAX_ATTEMPTS = 5;
+/** Backoff for a failure the directory gave no deadline for. Doubles, so a bounded run spans ~1 h. */
+const BASE_BACKOFF_MS = 60_000;
+/** Generous: a close does discovery, a broker dial, a relay submit and a directory round. */
+const DEFAULT_ATTEMPT_TIMEOUT_MS = 120_000;
+function defaultSchedule(fn, ms) {
+    const t = setTimeout(fn, ms);
+    // A background resolver must never be the reason a daemon will not exit.
+    t.unref?.();
+    return { cancel: () => clearTimeout(t) };
+}
+export class RestartSealResolver {
+    #deps;
+    #now;
+    #schedule;
+    #staggerMs;
+    #maxAttempts;
+    #initialDelayMs;
+    #attemptTimeoutMs;
+    /** Resolves when no attempt is in flight — awaited by stop() so a shutdown does not cut a
+     *  ceremony in half and leave the two sides permanently divergent. */
+    #inFlight = null;
+    #queue = new Map();
+    #timer = null;
+    #started = false;
+    #stopped = false;
+    #running = false;
+    constructor(deps) {
+        this.#deps = deps;
+        this.#now = deps.now ?? (() => Date.now());
+        this.#schedule = deps.schedule ?? defaultSchedule;
+        this.#staggerMs = deps.staggerMs ?? DEFAULT_STAGGER_MS;
+        this.#maxAttempts = deps.maxAttemptsPerSession ?? DEFAULT_MAX_ATTEMPTS;
+        this.#initialDelayMs = deps.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;
+        this.#attemptTimeoutMs = deps.attemptTimeoutMs ?? DEFAULT_ATTEMPT_TIMEOUT_MS;
+    }
+    /** Enqueue every restart orphan and begin working through them. Idempotent. */
+    start() {
+        if (this.#started || this.#stopped)
+            return;
+        this.#started = true;
+        let orphans;
+        try {
+            orphans = this.#deps.listRestartOrphans();
+        }
+        catch (err) {
+            // ABSENT IS NOT FINE. If we cannot read the list, say so — silence here reads exactly like
+            // "there was nothing to resolve", which is the state this unit exists to end.
+            this.#deps.logger.error("session.restart_seal.enumerate.failed", {
+                error: extractErrorMessage(err),
+                impact: "sessions the last shutdown orphaned will stay interrupted and unsealed",
+            });
+            return;
+        }
+        if (orphans.length === 0)
+            return;
+        const now = this.#now();
+        const firstAt = now + this.#initialDelayMs;
+        for (const orphan of orphans) {
+            this.#queue.set(`${orphan.agentName}:${orphan.sessionId}`, { orphan, attempts: 0, nextAt: firstAt });
+        }
+        this.#deps.logger.info("session.restart_seal.enqueued", {
+            count: orphans.length,
+            impact: "sessions the last shutdown left open will be sealed rather than left for a force-abandon",
+        });
+        this.#arm(this.#initialDelayMs);
+    }
+    /**
+     * Stop, and start nothing further. A shutdown that keeps opening directory ceremonies is not
+     * draining (DOD-M12B-SHUTDOWN-1) — and the flag, not the cancelled timer, is what an attempt
+     * already in flight checks when it lands.
+     */
+    stop() {
+        this.#stopped = true;
+        this.#timer?.cancel();
+        this.#timer = null;
+        this.#queue.clear();
+        // AWAIT what is already in flight. Severing signaling under a half-finished seal-interrupted
+        // exchange leaves the counterparty holding a commitment we never acknowledged: their session
+        // advances to `seal_interrupted_pending` and ours stays `interrupted`, permanently divergent
+        // and produced automatically on every shutdown.
+        //
+        // WHAT IS AWAITED IS THE BOUNDED RACE, NOT THE CLOSE. Returning the raw `sealSession` promise
+        // would hang shutdown forever on a close that never settles — and shutdown holds the SQLCipher
+        // write lock, so "forever" means a daemon that cannot be restarted. `attemptTimeoutMs` bounds
+        // this wait because the raced promise is what is stored.
+        //
+        // THE RESIDUAL WINDOW IS ACCEPTED, NOT CLOSED, and it is stated here rather than implied.
+        // Once the timeout wins the race, `#inFlight` is cleared while the underlying close may still
+        // be running — so a `stop()` arriving after that point returns immediately and can still sever
+        // signaling under a half-finished exchange. That is the deliberate trade: a bounded shutdown is
+        // worth more than a guaranteed-clean one, because an unbounded wait here wedges the daemon
+        // permanently while the divergence it prevents is repairable by the next close. An attempt
+        // taking longer than `attemptTimeoutMs` is not pathological — the interrupted path can spend
+        // 30 s in the seal flow, 30 s in a retry after discovery, and 30 s in the escalation.
+        return this.#inFlight ? this.#inFlight.then(() => undefined, () => undefined) : Promise.resolve();
+    }
+    /** Arm the next pass only while there is still work. An empty queue must leave NO timer behind —
+     *  a resolver that keeps a dead timer alive is a resolver that shows up in a shutdown trace. */
+    #armIfWork() {
+        if (this.#queue.size === 0)
+            return;
+        this.#arm(this.#staggerMs);
+    }
+    #arm(delayMs) {
+        if (this.#stopped)
+            return;
+        this.#timer?.cancel();
+        this.#timer = this.#schedule(() => {
+            this.#timer = null;
+            void this.#pump();
+        }, delayMs);
+    }
+    async #pump() {
+        if (this.#stopped || this.#running)
+            return;
+        if (this.#queue.size === 0)
+            return;
+        const now = this.#now();
+        let due = null;
+        for (const item of this.#queue.values()) {
+            if (item.nextAt <= now && (due === null || item.nextAt < due.nextAt))
+                due = item;
+        }
+        if (due === null) {
+            // Nothing is due yet — sleep until the earliest deadline rather than polling.
+            let earliest = Infinity;
+            for (const item of this.#queue.values())
+                earliest = Math.min(earliest, item.nextAt);
+            if (earliest !== Infinity)
+                this.#arm(Math.max(0, earliest - now));
+            return;
+        }
+        const item = due;
+        const key = `${item.orphan.agentName}:${item.orphan.sessionId}`;
+        item.attempts += 1;
+        this.#running = true;
+        let outcome;
+        let attemptTimer = null;
+        try {
+            const attempt = this.#deps.sealSession(item.orphan.agentName, item.orphan.sessionId);
+            // A close that never settles must not wedge the queue silently.
+            const timeout = new Promise((resolve) => {
+                attemptTimer = this.#schedule(() => resolve({ ok: false, reason: "restart_seal_attempt_timeout" }), this.#attemptTimeoutMs);
+            });
+            // The RACE is what stop() awaits — see stop(). Storing the raw attempt here would make a
+            // hung close a hung shutdown; storing the race makes the wait bounded by attemptTimeoutMs.
+            const raced = Promise.race([attempt, timeout]);
+            this.#inFlight = raced;
+            // A rejected `attempt` still settles the race, and #inFlight is only ever awaited with both
+            // handlers attached (stop()), so this cannot surface as an unhandled rejection.
+            attempt.catch(() => { });
+            outcome = await raced;
+        }
+        catch (err) {
+            outcome = { ok: false, reason: extractErrorMessage(err) };
+        }
+        finally {
+            attemptTimer?.cancel();
+            this.#inFlight = null;
+            this.#running = false;
+        }
+        // Re-checked AFTER the await: stop() can land while a ceremony is in flight, and the queue it
+        // cleared must not be repopulated by this attempt's bookkeeping.
+        if (this.#stopped)
+            return;
+        if (outcome.ok) {
+            this.#queue.delete(key);
+            this.#deps.logger.info("session.restart_seal.resolved", {
+                agentName: item.orphan.agentName,
+                sessionId: item.orphan.sessionId,
+                attempts: item.attempts,
+                messageCount: item.orphan.messageCount,
+            });
+            this.#armIfWork();
+            return;
+        }
+        const terminal = TERMINAL_SEAL_REFUSALS.has(outcome.reason);
+        /**
+         * review F2 — a local precondition is not a verdict on the session.
+         *
+         * `attempts` is decremented back so this pass costs nothing from the budget: the session is
+         * retried on the same backoff, and only a refusal that says something about the SESSION can
+         * exhaust it. Without this, all 28 pending sessions were durably given up on ~15 minutes after
+         * every boot, and no future boot would ever enumerate them again.
+         */
+        const localPrecondition = !terminal && LOCAL_PRECONDITION_REFUSALS.has(outcome.reason);
+        if (localPrecondition) {
+            item.attempts = Math.max(0, item.attempts - 1);
+            this.#deps.logger.info("session.restart_seal.not_ready", {
+                agentName: item.orphan.agentName,
+                sessionId: item.orphan.sessionId,
+                reason: outcome.reason,
+                impact: "a local precondition, not a verdict on the session — retried without spending an attempt",
+            });
+        }
+        if (terminal || (!localPrecondition && item.attempts >= this.#maxAttempts)) {
+            this.#queue.delete(key);
+            // DURABLE, so the next boot does not start the same five attempts over. A machine restarting
+            // ~6 times a day would otherwise re-try a hopeless session forever, which is the burst the
+            // stagger exists to prevent, merely spread out.
+            try {
+                this.#deps.markGaveUp(item.orphan.agentName, item.orphan.sessionId, outcome.reason);
+            }
+            catch (err) {
+                this.#deps.logger.warn("session.restart_seal.mark_gave_up.failed", {
+                    sessionId: item.orphan.sessionId,
+                    error: extractErrorMessage(err),
+                    impact: "this session will be re-attempted on every future boot",
+                });
+            }
+            this.#deps.logger.warn("session.restart_seal.gave_up", {
+                agentName: item.orphan.agentName,
+                sessionId: item.orphan.sessionId,
+                attempts: item.attempts,
+                reason: outcome.reason,
+                // WHY it stopped, not just that it did. "We stopped because they refused" and "we stopped
+                // because we ran out of tries" are different facts and lead to different operator actions.
+                stoppedBecause: terminal ? "refusal_is_terminal" : "attempts_exhausted",
+                // The detail the close COMPUTED and used to drop one function later: which of the six
+                // causes behind `seal_interrupted_rejected_by_counterparty` this was, and the leaf counts
+                // that identify a frontier strand.
+                ...(outcome.detail ? { detail: outcome.detail } : {}),
+                // THE CLOSE'S OWN GUIDANCE WINS. A fixed string here told the operator to force-abandon —
+                // and for `session_already_sealed` the close handler says in capitals NOT to, because
+                // forcing there permanently forfeits a half that is still recoverable.
+                // review F4: the fallback must not tell a `seal_interrupted_pending` session it is
+                // "interrupted", nor point at force-abandon — forcing there forfeits a signed commitment and
+                // the relay-witnessed leaves that are ready to notarize.
+                guidance: outcome.guidance ??
+                    (item.orphan.status === "seal_interrupted_pending"
+                        ? ("This session holds a seal commitment and could not be notarized automatically. The " +
+                            "commitment and the full transcript are intact — retry cello_close_session once the " +
+                            "agent is started and the daemon reports healthy. Do NOT force-abandon it: that ends " +
+                            "it WITHOUT the receipt it is one request away from having.")
+                        : ("This session could not be sealed automatically and is still interrupted. Close it with " +
+                            "cello_close_session, or force-abandon it — which ends it WITHOUT a notarized receipt.")),
+            });
+            this.#armIfWork();
+            return;
+        }
+        // The directory named a deadline: wait exactly that long. Anything else either batters it with
+        // refusals or leaves the session sitting after the grace has elapsed.
+        const waitMs = typeof outcome.retryAfterSeconds === "number" && outcome.retryAfterSeconds >= 0
+            ? outcome.retryAfterSeconds * 1_000
+            : BASE_BACKOFF_MS * 2 ** (item.attempts - 1);
+        item.nextAt = this.#now() + waitMs;
+        this.#deps.logger.info("session.restart_seal.waiting", {
+            agentName: item.orphan.agentName,
+            sessionId: item.orphan.sessionId,
+            attempts: item.attempts,
+            reason: outcome.reason,
+            ...(typeof outcome.retryAfterSeconds === "number" ? { retryAfterSeconds: outcome.retryAfterSeconds } : {}),
+            retryInMs: waitMs,
+        });
+        this.#arm(Math.min(this.#staggerMs, waitMs));
+    }
+}
+//# sourceMappingURL=restart-seal-resolver.js.map

package/dist/restart-seal-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restart-seal-resolver.js","sourceRoot":"","sources":["../src/restart-seal-resolver.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA2EzD;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAC/D,+BAA+B;IAC/B,6BAA6B;IAC7B,mBAAmB;IACnB,uBAAuB;IACvB,uBAAuB;IACvB;;;;;;;;;OASG;IACH,sBAAsB;IACtB,uBAAuB;IACvB,8BAA8B;CAC/B,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,mBAAmB;IACnB,2CAA2C;IAC3C,wBAAwB;IACxB,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,0CAA0C;IAC1C,sCAAsC;IACtC,6FAA6F;IAC7F,iGAAiG;IACjG,kGAAkG;IAClG,iGAAiG;IACjG,aAAa;IACb,yBAAyB;IACzB,mBAAmB;IACnB,iGAAiG;IACjG,2FAA2F;IAC3F,kBAAkB;IAClB,8FAA8F;IAC9F,2BAA2B;IAC3B,oCAAoC;IACpC,kGAAkG;IAClG,oFAAoF;IACpF,gCAAgC;IAChC,mFAAmF;IACnF,uBAAuB;IACvB,uBAAuB;IACvB,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,sGAAsG;AACtG,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,6FAA6F;AAC7F,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAQ3C,SAAS,eAAe,CAAC,EAAc,EAAE,EAAU;IACjD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7B,yEAAyE;IACzE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAA0B;IAC/B,IAAI,CAAe;IACnB,SAAS,CAAgD;IACzD,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,iBAAiB,CAAS;IACnC;0EACsE;IACtE,SAAS,GAA4B,IAAI,CAAC;IAEjC,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC/C,MAAM,GAAyB,IAAI,CAAC;IACpC,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,IAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,qBAAqB,IAAI,oBAAoB,CAAC;QACvE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACvE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAC/E,CAAC;IAED,+EAA+E;IAC/E,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,OAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBAC/D,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EAAE,wEAAwE;aACjF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACtD,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,MAAM,EAAE,0FAA0F;SACnG,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;QAC7F,gDAAgD;QAChD,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,yDAAyD;QACzD,EAAE;QACF,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,2FAA2F;QAC3F,6FAA6F;QAC7F,sFAAsF;QACtF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACpG,CAAC;IAED;oGACgG;IAChG,UAAU;QACR,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,GAAqB,IAAI,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBAAE,GAAG,GAAG,IAAI,CAAC;QACnF,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,8EAA8E;YAC9E,IAAI,QAAQ,GAAG,QAAQ,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACpF,IAAI,QAAQ,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAChE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,OAAoB,CAAC;QACzB,IAAI,YAAY,GAAyB,IAAI,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrF,gEAAgE;YAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;gBACnD,YAAY,GAAG,IAAI,CAAC,SAAS,CAC3B,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,EACpE,IAAI,CAAC,iBAAiB,CACvB,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,yFAAyF;YACzF,2FAA2F;YAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;YACvB,4FAA4F;YAC5F,gFAAgF;YAChF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAoC,CAAC,CAAC,CAAC;YAC1D,OAAO,GAAG,MAAM,KAAK,CAAC;QACxB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,CAAC;gBAAS,CAAC;YACR,YAAqC,EAAE,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,8FAA8F;QAC9F,iEAAiE;QACjE,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBACtD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACvC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D;;;;;;;WAOG;QACH,MAAM,iBAAiB,GAAG,CAAC,QAAQ,IAAI,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvF,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACvD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,0FAA0F;aACnG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,6FAA6F;YAC7F,2FAA2F;YAC3F,gDAAgD;YAChD,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAC5F,OAAO,GAAY,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;oBACjE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAChC,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;oBAC/B,MAAM,EAAE,wDAAwD;iBACjE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBACrD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,0FAA0F;gBAC1F,2FAA2F;gBAC3F,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB;gBACvE,sFAAsF;gBACtF,0FAA0F;gBAC1F,mCAAmC;gBACnC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,0FAA0F;gBAC1F,sFAAsF;gBACtF,uEAAuE;gBACvE,mFAAmF;gBACnF,6FAA6F;gBAC7F,yDAAyD;gBACzD,QAAQ,EACN,OAAO,CAAC,QAAQ;oBAChB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,0BAA0B;wBAChD,CAAC,CAAC,CAAC,qFAAqF;4BACrF,qFAAqF;4BACrF,sFAAsF;4BACtF,4DAA4D,CAAC;wBAChE,CAAC,CAAC,CAAC,yFAAyF;4BACzF,uFAAuF,CAAC,CAAC;aACjG,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,+FAA+F;QAC/F,sEAAsE;QACtE,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC;YAC7E,CAAC,CAAC,OAAO,CAAC,iBAAiB,GAAG,KAAK;YACnC,CAAC,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YACrD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/resume-last-seen.d.ts

@@ -0,0 +1,15 @@
+import type { SessionSealLeafStore } from "./session-seal-leaf-store.js";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+/** Record an acknowledgement the live path just made. Forward-only: an earlier position is ignored. */
+export declare function recordLastAck(db: DaemonDatabase, a: {
+    agentId: string;
+    sessionId: string;
+    seq: number;
+    hash: Uint8Array;
+}): void;
+export declare function lastSeenFromRecord(store: SessionSealLeafStore, logger: Logger, ownPubkey: Uint8Array, sessionIdHex: string): {
+    seq: number;
+    hash: Uint8Array;
+} | undefined;
+//# sourceMappingURL=resume-last-seen.d.ts.map

package/dist/resume-last-seen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-last-seen.d.ts","sourceRoot":"","sources":["../src/resume-last-seen.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,uGAAuG;AACvG,wBAAgB,aAAa,CAC3B,EAAE,EAAE,cAAc,EAClB,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACvE,IAAI,CAMN;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,SAAS,CAgB/C"}

package/dist/resume-last-seen.js

@@ -0,0 +1,44 @@
+/**
+ * Where a resumed session's acknowledgement starts — from the durable record, not from nothing.
+ *
+ * The relay client keeps "the last position I saw from you" in memory. A session interrupted after
+ * messages (Ctrl-C, a restart) came back at position 0, so every close claimed "I have seen nothing
+ * from you". The relay refuses that as stale, because the other side's messages are filed after 0,
+ * and the re-sign waits for a new message that never comes: the session could never seal (live,
+ * 2026-09-14).
+ *
+ * Two durable sources, both holding RELAY positions — never a position guessed from the local leaf
+ * index, which can drift one ahead of the relay:
+ *   - `session_last_ack`: what the live path acknowledged, written at the moment it did, for every
+ *     route a message can arrive by (relay, direct, recovered park, screened-out);
+ *   - the seal leaf store: every leaf the other side authored that the relay delivered, with the
+ *     Structure 1 they signed.
+ * The higher of the two is where the live path would have been.
+ */
+import { decodeStructure1 } from "@cello-protocol/protocol-types";
+/** Record an acknowledgement the live path just made. Forward-only: an earlier position is ignored. */
+export function recordLastAck(db, a) {
+    db.prepare(`INSERT INTO session_last_ack (agent_id, session_id, relay_seq, hash_hex) VALUES (?, ?, ?, ?)
+     ON CONFLICT (agent_id, session_id) DO UPDATE SET relay_seq = excluded.relay_seq, hash_hex = excluded.hash_hex
+     WHERE excluded.relay_seq > session_last_ack.relay_seq`).run(a.agentId, a.sessionId, a.seq, Buffer.from(a.hash).toString("hex"));
+}
+export function lastSeenFromRecord(store, logger, ownPubkey, sessionIdHex) {
+    const own = Buffer.from(ownPubkey);
+    let best = store.recordedAcknowledgement(own.toString("hex"), sessionIdHex);
+    for (const leaf of store.getCarry(own.toString("hex"), sessionIdHex)) {
+        const s1 = decodeStructure1(leaf.structure1Cbor);
+        if (!s1.ok) {
+            logger.warn("session.relay.last_seen.resume_leaf_unreadable", {
+                sessionId: sessionIdHex, sequenceNumber: leaf.sequenceNumber, reason: s1.reason,
+                impact: "this stored leaf is skipped when resuming, so a close may claim an earlier position and be refused as stale",
+            });
+            continue;
+        }
+        if (Buffer.from(s1.fields.senderPubkey).equals(own))
+            continue;
+        if (!best || leaf.sequenceNumber > best.seq)
+            best = { seq: leaf.sequenceNumber, hash: s1.fields.contentHash };
+    }
+    return best;
+}
+//# sourceMappingURL=resume-last-seen.js.map

package/dist/resume-last-seen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-last-seen.js","sourceRoot":"","sources":["../src/resume-last-seen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAKlE,uGAAuG;AACvG,MAAM,UAAU,aAAa,CAC3B,EAAkB,EAClB,CAAwE;IAExE,EAAE,CAAC,OAAO,CACR;;2DAEuD,CACxD,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA2B,EAC3B,MAAc,EACd,SAAqB,EACrB,YAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,IAAI,GAAG,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBAC5D,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;gBAC/E,MAAM,EAAE,6GAA6G;aACtH,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG;YAAE,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAChH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}