@cello-protocol/daemon 0.0.49 → 0.0.51

package/dist/bin/cello-daemon.js

@@ -14,6 +14,10 @@ import { join } from "node:path";
 import { startDaemon } from "../daemon.js";
 import { createDirectoryEndpointResolver } from "../directory-bootstrap.js";
 import { buildManifestDeps } from "../manifest-deps.js";
+// EXIT_ALREADY_RUNNING is distinct from 1 (generic startup failure) so a caller can tell "lost the
+// race" from "broken" — connectOrStart relies on exactly that distinction, so the constant is shared
+// rather than written down twice.
+import { DaemonAlreadyRunningError, EXIT_ALREADY_RUNNING } from "../singleton-lock.js";
 const MAX_CONNECTIONS = 16;
 // Composition root: stdout JSON logger
 const logger = {
@@ -111,6 +115,15 @@ async function main() {
     });
 }
 main().catch((err) => {
+    // DOD-SINGLE-DAEMON-1 (AC2): losing the singleton race is not a crash — it is the system working.
+    // Say so in one plain line an operator can act on, name the pid that holds the lock, and exit
+    // non-zero without a stack trace. Two daemons is the silent, wrong outcome; this is the loud, right
+    // one.
+    if (err instanceof DaemonAlreadyRunningError) {
+        logger.info("daemon.start.refused", { reason: "already_running", holderPid: err.holderPid });
+        process.stderr.write(`${err.message}\n`);
+        process.exit(EXIT_ALREADY_RUNNING);
+    }
     logger.error("daemon.startup.failed", {
         error: err instanceof Error ? err.message : String(err),
     });

package/dist/bin/cello-daemon.js.map

@@ -1 +1 @@
-{"version":3,"file":"cello-daemon.js","sourceRoot":"","sources":["../../src/bin/cello-daemon.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,uCAAuC;AACvC,MAAM,MAAM,GAAW;IACrB,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACpE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;AAErD,KAAK,UAAU,IAAI;IACjB,gFAAgF;IAChF,iFAAiF;IACjF,8EAA8E;IAC9E,0BAA0B;IAC1B,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpG,6FAA6F;IAC7F,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,4FAA4F;IAC5F,mGAAmG;IACnG,2EAA2E;IAC3E,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,QAAQ;QACR,UAAU;QACV,YAAY;QACZ,cAAc,EAAE,eAAe;QAC/B,OAAO;QACP,MAAM;QACN,yBAAyB;QACzB,GAAG,QAAQ;KACZ,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACzC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;QACpC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cello-daemon.js","sourceRoot":"","sources":["../../src/bin/cello-daemon.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,mGAAmG;AACnG,qGAAqG;AACrG,kCAAkC;AAClC,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGvF,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,uCAAuC;AACvC,MAAM,MAAM,GAAW;IACrB,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACpE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;AAErD,KAAK,UAAU,IAAI;IACjB,gFAAgF;IAChF,iFAAiF;IACjF,8EAA8E;IAC9E,0BAA0B;IAC1B,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpG,6FAA6F;IAC7F,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,4FAA4F;IAC5F,mGAAmG;IACnG,2EAA2E;IAC3E,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,QAAQ;QACR,UAAU;QACV,YAAY;QACZ,cAAc,EAAE,eAAe;QAC/B,OAAO;QACP,MAAM;QACN,yBAAyB;QACzB,GAAG,QAAQ;KACZ,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACzC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,kGAAkG;IAClG,8FAA8F;IAC9F,oGAAoG;IACpG,OAAO;IACP,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;QACpC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/connect-or-start.d.ts

@@ -3,17 +3,17 @@
  *
  * Pseudocode:
  * 1. connectOrStart(celloDir, logger):
- *    a. Read lock file at ~/.cello/daemon.lock
- *    b. If lock exists:
- *       - Check if PID is alive (signal 0)
- *       - If alive, attempt to connect to socket
- *       - If connection succeeds, return existing daemon client
- *       - If connection fails (socket gone), remove stale lock and start fresh
- *    c. If lock doesn't exist or is stale:
- *       - Remove stale lock (log daemon_lock_stale_removed)
- *       - Spawn daemon as detached child process
- *       - Wait for daemon.started event (read from child stdout)
- *       - Return client connected to new daemon
+ *    a. Try to connect to the daemon socket. If it answers, we are done.
+ *    b. Otherwise ask the KERNEL whether a daemon holds the singleton lock (DOD-SINGLE-DAEMON-1):
+ *       - HELD  → a daemon is alive but not answering (mid-startup, or its socket was destroyed).
+ *                 Retry the connection, then fail loudly. NEVER spawn a second daemon beside it,
+ *                 and never delete its lock.
+ *       - FREE  → no daemon is running, whatever daemon.lock claims. Clear the stale lock, spawn,
+ *                 and wait for the socket to accept connections.
+ *
+ * The lock FILE is not consulted to make this decision — only the OS lock is. A pid in a JSON file
+ * can be dead, or REUSED by an unrelated process (in which case `isProcessAlive` says "alive"
+ * forever, and a daemon that trusted it would never start again).
  */
 import { type IpcClient } from "./ipc-client.js";
 import type { Logger } from "./types.js";

package/dist/connect-or-start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-or-start.d.ts","sourceRoot":"","sources":["../src/connect-or-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,CAAC,CAiCxB"}
+{"version":3,"file":"connect-or-start.d.ts","sourceRoot":"","sources":["../src/connect-or-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,CAAC,CAqDxB"}

package/dist/connect-or-start.js

@@ -3,58 +3,105 @@
  *
  * Pseudocode:
  * 1. connectOrStart(celloDir, logger):
- *    a. Read lock file at ~/.cello/daemon.lock
- *    b. If lock exists:
- *       - Check if PID is alive (signal 0)
- *       - If alive, attempt to connect to socket
- *       - If connection succeeds, return existing daemon client
- *       - If connection fails (socket gone), remove stale lock and start fresh
- *    c. If lock doesn't exist or is stale:
- *       - Remove stale lock (log daemon_lock_stale_removed)
- *       - Spawn daemon as detached child process
- *       - Wait for daemon.started event (read from child stdout)
- *       - Return client connected to new daemon
+ *    a. Try to connect to the daemon socket. If it answers, we are done.
+ *    b. Otherwise ask the KERNEL whether a daemon holds the singleton lock (DOD-SINGLE-DAEMON-1):
+ *       - HELD  → a daemon is alive but not answering (mid-startup, or its socket was destroyed).
+ *                 Retry the connection, then fail loudly. NEVER spawn a second daemon beside it,
+ *                 and never delete its lock.
+ *       - FREE  → no daemon is running, whatever daemon.lock claims. Clear the stale lock, spawn,
+ *                 and wait for the socket to accept connections.
+ *
+ * The lock FILE is not consulted to make this decision — only the OS lock is. A pid in a JSON file
+ * can be dead, or REUSED by an unrelated process (in which case `isProcessAlive` says "alive"
+ * forever, and a daemon that trusted it would never start again).
  */
 import { spawn } from "node:child_process";
 import { openSync } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { mkdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { readLock, removeLock, isProcessAlive } from "./lock-file.js";
+import { readLock, removeLock } from "./lock-file.js";
+import { probeSingletonLock, SINGLETON_LOCK_FILENAME, EXIT_ALREADY_RUNNING } from "./singleton-lock.js";
 import { connectToDaemon } from "./ipc-client.js";
 export async function connectOrStart(celloDir, logger, daemonBin) {
+    // A CELLO_DIR that does not exist yet (first ever run) would make the singleton probe below fail to
+    // open its lock file, and "I could not ask the kernel" would be reported as "I don't know whether a
+    // daemon is running" — a blind spot invented out of an empty directory. Create it first; the daemon
+    // does the same on startup, so this changes nothing except the quality of the answer.
+    await mkdir(celloDir, { recursive: true });
     const lockFilePath = join(celloDir, "daemon.lock");
-    // Read existing lock
     const lock = await readLock(lockFilePath);
+    // The socket path is deterministic; the lock's copy is metadata, and it may be stale.
+    const socketPath = lock?.socketPath ?? join(celloDir, "daemon.sock");
+    // 1. If a daemon is answering, we are done. This is the overwhelmingly common path.
+    try {
+        return { client: await connectToDaemon(socketPath), alreadyRunning: true };
+    }
+    catch {
+        // Not answering. WHY it is not answering is the whole question — see below.
+    }
+    // 2. Ask the KERNEL whether a daemon is alive, not `daemon.lock`.
+    //
+    // DOD-SINGLE-DAEMON-1 (AC3): the old code asked `isProcessAlive(lock.pid)` and, when the socket
+    // did not answer, called the lock "stale", deleted it, and spawned a second daemon onto the live
+    // one's database. Both of its beliefs were unreliable: a pid can be REUSED (so a dead daemon's lock
+    // looks alive forever), and a live daemon can legitimately not answer yet (it is mid-startup, or an
+    // exiting orphan deleted its socket). The lock file cannot tell these apart. The OS lock can.
+    const probe = probeSingletonLock(celloDir, logger);
+    if (probe === "held") {
+        // A daemon is holding the lock right now. Spawning beside it is never correct. It may simply be
+        // mid-startup, so give it a moment to come up.
+        const client = await connectWithRetry(celloDir, socketPath, logger, lock?.pid ?? null);
+        return { client, alreadyRunning: true };
+    }
+    if (probe === "unknown") {
+        // We could not ask the kernel. That is NOT permission to spawn: "I don't know whether a daemon is
+        // running" must never be resolved by starting a second one. Fail loud with the real reason.
+        throw new Error("Could not determine whether a daemon is already running (the singleton lock could not be " +
+            `checked at ${celloDir}). Refusing to start a second daemon on a guess. See the ` +
+            "daemon.singleton.probe.failed log line for the underlying error.");
+    }
+    // 3. The lock is genuinely free, so no daemon is running — whatever `daemon.lock` claims. Only now
+    //    is spawning correct.
     if (lock) {
-        if (isProcessAlive(lock.pid)) {
-            // Try connecting to the existing daemon
-            try {
-                const client = await connectToDaemon(lock.socketPath);
-                return { client, alreadyRunning: true };
-            }
-            catch (err) {
-                logger.info("daemon.lock.stale", {
-                    pid: lock.pid,
-                    reason: "socket_unreachable",
-                    error: err instanceof Error ? err.message : String(err),
-                });
-                await removeLock(lockFilePath, logger);
-            }
-        }
-        else {
-            // PID is dead — stale lock
-            logger.info("daemon.lock.stale", {
-                pid: lock.pid,
-                reason: "process_dead",
-            });
-            await removeLock(lockFilePath, logger);
-        }
+        logger.info("daemon.lock.stale", { pid: lock.pid, reason: "no_singleton_holder" });
+        await removeLock(lockFilePath, logger);
     }
-    // Start a new daemon
     const client = await spawnDaemon(celloDir, daemonBin, lockFilePath, logger);
     return { client, alreadyRunning: false };
 }
-async function spawnDaemon(celloDir, daemonBin, _lockFilePath, _logger) {
+/**
+ * A daemon holds the singleton lock but is not answering. Wait for it, then fail LOUDLY.
+ *
+ * The loud failure is the point (SI). The alternative — the old behaviour — was to quietly start a
+ * second daemon, which is the very thing that gives one machine two writers on one hash chain. An
+ * operator who is told "a daemon is running but not answering" can act; an operator silently given a
+ * second daemon cannot even see the problem.
+ */
+async function connectWithRetry(celloDir, socketPath, logger, holderPid) {
+    const deadline = Date.now() + 10_000;
+    let lastError;
+    while (Date.now() < deadline) {
+        try {
+            return await connectToDaemon(socketPath);
+        }
+        catch (err) {
+            lastError = err;
+            await new Promise((r) => setTimeout(r, 150));
+        }
+    }
+    logger.error("daemon.unreachable", { holderPid, socketPath });
+    // The pid comes from daemon.lock — the very file this unit exists because it cannot be trusted. It
+    // may be stale, or name a process that merely inherited the number. So it is offered as a hint, and
+    // the operator is pointed at the authoritative answer: whoever holds the lock file open IS the
+    // daemon. Telling someone to `kill` an unverified pid is how you get them to kill something else.
+    const hint = holderPid === null ? "" : ` (daemon.lock names pid ${holderPid}, which may be stale)`;
+    throw new Error(`A daemon is already running${hint} and holds the singleton lock, but is not answering on ` +
+        `${socketPath} (${lastError instanceof Error ? lastError.message : String(lastError)}). ` +
+        "Refusing to start a second daemon beside it — two daemons on one database is the failure this " +
+        `prevents. To find the real holder: \`lsof ${join(celloDir, SINGLETON_LOCK_FILENAME)}\`, then stop ` +
+        "that process and try again.");
+}
+async function spawnDaemon(celloDir, daemonBin, lockFilePath, logger) {
     const socketPath = join(celloDir, "daemon.sock");
     const logPath = join(celloDir, "daemon.log");
     // The daemon's stdout/stderr go to a LOG FILE, never a pipe to this process.
@@ -91,6 +138,17 @@ async function spawnDaemon(celloDir, daemonBin, _lockFilePath, _logger) {
             // Not accepting yet (ENOENT/ECONNREFUSED). If the child has already exited, it
             // died during startup — surface the log tail rather than spinning to the deadline.
             if (exitCode !== undefined) {
+                // ...unless it exited because it LOST THE SINGLETON RACE. Two callers can legitimately probe
+                // "free" at the same instant (the probe is not a reservation) and both spawn; the kernel then
+                // picks exactly one winner and the other exits EXIT_ALREADY_RUNNING. That is the design
+                // working, not a failure: a healthy daemon is coming up right now. Reporting "Daemon exited
+                // (code 3) during startup" to an operator whose daemon is fine would be this unit's own lie.
+                // The distinct exit code exists precisely so we can tell these apart — so use it.
+                if (exitCode === EXIT_ALREADY_RUNNING) {
+                    const winner = await readLock(lockFilePath);
+                    logger.info("daemon.spawn.lost_race", { holderPid: winner?.pid ?? null });
+                    return await connectWithRetry(celloDir, socketPath, logger, winner?.pid ?? null);
+                }
                 throw new Error(`Daemon exited (code ${exitCode}) during startup.\n${await daemonLogTail(logPath)}`);
             }
             await new Promise((r) => setTimeout(r, 150));

package/dist/connect-or-start.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-or-start.js","sourceRoot":"","sources":["../src/connect-or-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAQlE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,MAAc,EACd,SAAiB;IAEjB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEnD,qBAAqB;IACrB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE1C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,wCAAwC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;oBAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,MAAM,EAAE,oBAAoB;oBAC5B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,MAAM,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,2BAA2B;YAC3B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;gBAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,MAAM,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAgB,EAChB,SAAiB,EACjB,aAAqB,EACrB,OAAe;IAEf,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE7C,6EAA6E;IAC7E,iFAAiF;IACjF,yFAAyF;IACzF,qFAAqF;IACrF,uFAAuF;IACvF,2EAA2E;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;QACjD,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC;QAC3B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,SAAS,EAAE,QAAQ;SACpB;KACF,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,uEAAuE;IACvE,mFAAmF;IACnF,oFAAoF;IACpF,IAAI,UAAU,GAAiB,IAAI,CAAC;IACpC,IAAI,QAAmC,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU;YAAE,MAAM,UAAU,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,mFAAmF;YACnF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,sBAAsB,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChG,OAAO,uCAAuC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,OAAO,GAAG,CAAC;IACzC,CAAC;AACH,CAAC"}
+{"version":3,"file":"connect-or-start.js","sourceRoot":"","sources":["../src/connect-or-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAQlE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,MAAc,EACd,SAAiB;IAEjB,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,sFAAsF;IACtF,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1C,sFAAsF;IACtF,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAErE,oFAAoF;IACpF,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IAED,kEAAkE;IAClE,EAAE;IACF,gGAAgG;IAChG,iGAAiG;IACjG,oGAAoG;IACpG,oGAAoG;IACpG,8FAA8F;IAC9F,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,gGAAgG;QAChG,+CAA+C;QAC/C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;QACvF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,kGAAkG;QAClG,4FAA4F;QAC5F,MAAM,IAAI,KAAK,CACb,2FAA2F;YAC3F,cAAc,QAAQ,2DAA2D;YACjF,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,mGAAmG;IACnG,0BAA0B;IAC1B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACnF,MAAM,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAgB,EAChB,UAAkB,EAClB,MAAc,EACd,SAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,IAAI,SAAkB,CAAC;IACvB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,SAAS,GAAG,GAAG,CAAC;YAChB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9D,mGAAmG;IACnG,oGAAoG;IACpG,+FAA+F;IAC/F,kGAAkG;IAClG,MAAM,IAAI,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2BAA2B,SAAS,uBAAuB,CAAC;IACnG,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,yDAAyD;QAC3F,GAAG,UAAU,KAAK,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK;QACzF,gGAAgG;QAChG,6CAA6C,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,gBAAgB;QACpG,6BAA6B,CAC9B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAgB,EAChB,SAAiB,EACjB,YAAoB,EACpB,MAAc;IAEd,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE7C,6EAA6E;IAC7E,iFAAiF;IACjF,yFAAyF;IACzF,qFAAqF;IACrF,uFAAuF;IACvF,2EAA2E;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;QACjD,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC;QAC3B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,SAAS,EAAE,QAAQ;SACpB;KACF,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,uEAAuE;IACvE,mFAAmF;IACnF,oFAAoF;IACpF,IAAI,UAAU,GAAiB,IAAI,CAAC;IACpC,IAAI,QAAmC,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU;YAAE,MAAM,UAAU,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,mFAAmF;YACnF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,6FAA6F;gBAC7F,8FAA8F;gBAC9F,wFAAwF;gBACxF,4FAA4F;gBAC5F,6FAA6F;gBAC7F,kFAAkF;gBAClF,IAAI,QAAQ,KAAK,oBAAoB,EAAE,CAAC;oBACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;oBAC5C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;oBAC1E,OAAO,MAAM,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;gBACnF,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,sBAAsB,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChG,OAAO,uCAAuC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,OAAO,GAAG,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/daemon.d.ts

@@ -62,5 +62,16 @@ export interface DaemonHandle {
     getAutoNatService(): IAutoNatService;
 }
 export declare const INBOUND_SESSION_TTL_MS: number;
+/**
+ * DOD-SINGLE-DAEMON-1: take the singleton lock, and make sure it is released if startup fails
+ * ANYWHERE after that point — not just on the two failure paths that happened to think of it.
+ *
+ * The real binary exits on a startup failure and the kernel reclaims the lock regardless, so this is
+ * not a production-safety hole. It is a DIAGNOSTIC one, and a nasty kind: an in-process caller (every
+ * vitest daemon, any embedder) whose startup throws — a corrupt database, a bad key, an EACCES on the
+ * lock file — would leak the lock and then be told, on the next attempt in that process, "another
+ * daemon is already running". The true cause is replaced by a lie, and the directory is wedged for the
+ * life of the process.
+ */
 export declare function startDaemon(config: DaemonConfig): Promise<DaemonHandle>;
 //# sourceMappingURL=daemon.d.ts.map

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAU/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAkhM7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAU/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAuB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}

package/dist/daemon.js

@@ -29,7 +29,8 @@ import { mkdir } from "node:fs/promises";
 import { randomUUID, createHash } from "node:crypto";
 import { dirname, join } from "node:path";
 import { loadAgents } from "./agent-loader.js";
-import { acquireLock, removeLock } from "./lock-file.js";
+import { acquireLock, removeLockIfOwned } from "./lock-file.js";
+import { acquireSingletonLock } from "./singleton-lock.js";
 import { createIpcServer } from "./ipc-server.js";
 import { renderForSurface } from "./vocabulary.js";
 import { SessionNodeManager } from "./session-node-manager.js";
@@ -48,12 +49,13 @@ import { RegistrationManager } from "./registration-manager.js";
 import { DaemonRegistrationContext } from "./registration-context.js";
 import { DbRegistrationPersistence, DbIdentityStore } from "./db-identity-store.js";
 import { DbManifestVersionStore } from "./manifest-version-store-db.js";
-import { verify as ed25519Verify, sealToRecipient, generateKLocalSeed, InMemoryKeyProvider, hash as cryptoHash } from "@cello-protocol/crypto";
+import { verify as ed25519Verify, generateKLocalSeed, InMemoryKeyProvider, hash as cryptoHash } from "@cello-protocol/crypto";
 import { attemptSealUpgrade as attemptSealUpgradeImpl, verifyUpgradeConfirmedCert } from "./seal-upgrade.js";
 import { upgradeAbsentToRecovered, hasAbsentParticipant } from "./seal-receipt-upgrade.js";
 // CELLO-M7-MSG-001 (AC-013/AC-018): the single application content-size cap, enforced
 // at the send point here (the receive point lives in the transport content decode).
 import { MAX_CONTENT_BYTES, computeGenesisPrevRoot, buildAgentRevocationTbs, MONIKER_RE, validateMoniker } from "@cello-protocol/protocol-types";
+import { sealParkEnvelope } from "./park-envelope.js";
 import { resolveCelloEnv, createTransportSelector, isProductionVariant, } from "./transport-composition.js";
 import { selectAdvertisedAddress } from "./transport-selector.js";
 import { parseSessionAssignment, sessionRequestErrorReason, parseDiscoveryLookupResult, discoveryLookupErrorReason, extractOfferedMoniker, resolveOutboundMoniker } from "./session-assignment-parser.js";
@@ -183,7 +185,29 @@ class ProductionSessionNodeFactory {
 // M8C-TTL-1: receiver-side session-request TTL. CORE ships the DoD's own 24h default;
 // per-agent configurability is PARKED on M9-CFG-001 (D17 — same pattern as D14/D15/D16).
 export const INBOUND_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * DOD-SINGLE-DAEMON-1: take the singleton lock, and make sure it is released if startup fails
+ * ANYWHERE after that point — not just on the two failure paths that happened to think of it.
+ *
+ * The real binary exits on a startup failure and the kernel reclaims the lock regardless, so this is
+ * not a production-safety hole. It is a DIAGNOSTIC one, and a nasty kind: an in-process caller (every
+ * vitest daemon, any embedder) whose startup throws — a corrupt database, a bad key, an EACCES on the
+ * lock file — would leak the lock and then be told, on the next attempt in that process, "another
+ * daemon is already running". The true cause is replaced by a lie, and the directory is wedged for the
+ * life of the process.
+ */
 export async function startDaemon(config) {
+    await mkdir(config.celloDir, { recursive: true });
+    const singletonLock = acquireSingletonLock(config.celloDir, config.logger);
+    try {
+        return await startDaemonHoldingLock(config, singletonLock);
+    }
+    catch (err) {
+        singletonLock.release();
+        throw err;
+    }
+}
+async function startDaemonHoldingLock(config, singletonLock) {
     const { celloDir, socketPath, lockFilePath, maxConnections, version, logger, manifestProvider, manifestRootKeys, manifestThreshold, manifestVersionStore: injectedManifestVersionStore, manifestPollScheduler, directoryHttpUrl, signalingConnect, challengeVerifier, directoryEndpointResolver, sessionNodeFactory, sessionNegotiator, getRelayCircuitAddress, telegramBotClient: injectedTelegramBotClient, } = config;
     // CELLO-M7-TRANSPORT-001: composition-root selection of the transport selector.
     // Driven by CELLO_ENV; fails fast at startup (here, not at first session) when a
@@ -211,6 +235,14 @@ export async function startDaemon(config) {
     // encrypted DB (AC-008), not a manifest-version.json file. ──
     await mkdir(celloDir, { recursive: true });
     await mkdir(dirname(socketPath), { recursive: true });
+    // DOD-SINGLE-DAEMON-1: the caller already took the kernel's exclusive lock (see startDaemon) —
+    // BEFORE this function touches anything that assumes a single writer. A daemon that loses that race
+    // never reaches here at all: it never opens the database, never registers an agent, never connects
+    // to the directory. Two daemons sharing an identity is how a hash chain gets two leaves at the same
+    // index, and the seal then attests to the damage.
+    //
+    // AC4: the advisory JSON keeps its metadata role (it is how the NEXT process learns our pid), but
+    // the OS lock is what decides whether a daemon may run. This file never gates startup.
     await acquireLock(lockFilePath, { pid: process.pid, socketPath, version });
     // M9-CORE-001: one security-gateway client, shared by both seams — the outbound screen in
     // cello_send and the inbound screen inside SessionNodeManager. Absent config falls back to a
@@ -341,7 +373,9 @@ export async function startDaemon(config) {
             sessionNodeManager.getDb().close();
         }
         catch { /* ignore */ }
-        await removeLock(lockFilePath, logger).catch(() => { });
+        await removeLockIfOwned(lockFilePath, process.pid, logger).catch(() => { });
+        // The singleton lock is released by startDaemon's catch — every throw out of this function goes
+        // through it, so no failure path can leak the lock by forgetting.
         throw new Error("Manifest verification failed. The daemon cannot start with an unverified manifest when manifestProvider is configured. " +
             "Check the logs for the specific failure reason (manifest_signature_invalid, manifest_expired, or manifest_version_rollback).");
     }
@@ -1508,7 +1542,7 @@ export async function startDaemon(config) {
     // the session's relay endpoint; we seal the content to the recipient (E2E — the relay never sees
     // plaintext, INV-3) and deposit it to that relay's store-and-forward mailbox via the standing
     // receiver node. The recipient pulls + recovers it at the witnessed sequence (R1) on next online.
-    sessionNodeManager.setContentParkHook(async ({ sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor }) => {
+    sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor }) => {
         const node = sessionNodeManager.getStandingReceiverNode();
         if (!node) {
             const reason = "standing_receiver_unavailable";
@@ -1519,10 +1553,32 @@ export async function startDaemon(config) {
             // parked when nothing was ever deposited.
             return { ok: false, reason };
         }
+        // SEC-1: sign the entry as the SENDING agent. Without a key we cannot produce an envelope the
+        // recipient will accept, so fail LOUD rather than depositing something that will be refused on
+        // recovery (a deposit the recipient must reject is worse than no deposit — it looks delivered).
+        const senderKp = keyProviders.get(agentName);
+        if (!senderKp) {
+            const reason = "signing_key_unavailable";
+            logger.warn("content.park.deposit.failed", { agentName, sessionId, contentHash: contentHashHex, reason });
+            return { ok: false, reason };
+        }
         const recipientPubkey = Buffer.from(recipientPubkeyHex, "hex");
+        const contentHashBytes = Buffer.from(contentHashHex, "hex");
+        logger.info("content.park.signed", { agentName, sessionId, contentHash: contentHashHex });
         // DOD-MSG-4 (2b): seal the ORDERING ENVELOPE (content + the relay's signed Structure2), not bare
         // content, so the parked entry is self-ordering on recover. The relay still holds only ciphertext.
-        const ciphertext = sealToRecipient(recipientPubkey, sessionNodeManager.encodeParkEnvelope(content, structure1Cbor, structure2Cbor));
+        // SEC-1: sealParkEnvelope is the SOLE producer — it signs (sender's K_local, over the
+        // session/recipient/content binding) and seals in one place, so the two park sites cannot drift
+        // apart on what gets signed.
+        const ciphertext = await sealParkEnvelope({
+            signer: senderKp,
+            sessionIdHex: sessionId,
+            recipientPubkey,
+            contentHash: contentHashBytes,
+            content,
+            structure1Cbor,
+            structure2Cbor,
+        });
         const client = new ContentParkClient({ relayPeerId, relayAddrs: [...relayAddrs], logger });
         const res = await client.deposit(node, {
             recipientPubkey,
@@ -1573,11 +1629,29 @@ export async function startDaemon(config) {
         const node = sessionNodeManager.getStandingReceiverNode(record.agent_name);
         if (!node)
             return { parked: false, error: "standing_receiver_unavailable" };
+        // SEC-1: the crash backstop must sign too — an unsigned re-park would be REFUSED on recovery,
+        // which would turn the message-loss backstop into a message-loss cause. This is why the SEC-1
+        // signature binds to the sender's own K_local and NOT to the relay's ordering record: the
+        // ordering record is not persisted in retry_queue (see below) and so cannot be reproduced here,
+        // but the KEY can — the owning agent still holds it after a crash. Hence: NO schema migration.
+        const senderKp = keyProviders.get(ownerName);
+        if (!senderKp)
+            return { parked: false, error: "signing_key_unavailable" };
         const recipientPubkey = Buffer.from(record.counterparty_pubkey, "hex");
+        const contentHashBytes = Buffer.from(entry.contentHashHex, "hex");
+        logger.info("content.park.signed", { agentName: ownerName, sessionId: entry.sessionId, contentHash: entry.contentHashHex, source: "startup_flush" });
         // DOD-MSG-4 (2b): seal the envelope shape too (content only — the durable awaiting queue does not
         // persist the ordering record, so a crash-backstop re-park recovers in arrival order; the common
         // live-park path above carries the full Structure2). Keeps ONE envelope format on the recover side.
-        const ciphertext = sealToRecipient(recipientPubkey, sessionNodeManager.encodeParkEnvelope(entry.contentBlob));
+        // SEC-1: same sole producer as the live hook — the backstop signs from the persisted
+        // (sessionId, recipient, contentHash), which is why it survives a crash with NO schema migration.
+        const ciphertext = await sealParkEnvelope({
+            signer: senderKp,
+            sessionIdHex: entry.sessionId,
+            recipientPubkey,
+            contentHash: contentHashBytes,
+            content: entry.contentBlob,
+        });
         const client = new ContentParkClient({ relayPeerId: ep.relayPeerId, relayAddrs: [...ep.relayAddrs], logger });
         const res = await client.deposit(node, {
             recipientPubkey,
@@ -3706,22 +3780,28 @@ export async function startDaemon(config) {
         const client = new ContentParkClient({ relayPeerId, relayAddrs, logger });
         const entries = await client.pull(node, Buffer.from(recipientPubkey, "hex"), kp);
         let recovered = 0;
+        // SEC-1 / review M2: a REFUSED entry must not vanish behind `ok:true`. Report it — an operator
+        // seeing {ok:true, pulled:3, recovered:0} would otherwise have three messages evaporate with the
+        // only explanation buried in the daemon log. This is both the injection signal and, given the
+        // deliberate no-tolerant-window rollout, the lagging-peer signal.
+        const refusals = [];
+        // AC7: one correlationId per recover flow, threaded through every event it emits.
+        const correlationId = randomUUID();
         for (const e of entries) {
             const unsealed = await kp.openContentSeal(e.ciphertext);
             if (!unsealed) {
                 logger.warn("content.recover.unseal_failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex });
                 continue;
             }
-            // DOD-MSG-4 (2b): the unsealed blob is the ordering envelope (content + the relay's signed
-            // Structure2). Extract the content; if the record is present, verify it and feed the strict-in-
-            // order gate the canonical sequence BEFORE ingest — so recovered messages order the same way a
-            // direct frame does (closes review finding #3). Old/bare-content seals decode to content alone.
-            const env = sessionNodeManager.decodeParkEnvelope(unsealed);
+            // SEC-1: authenticate THEN ingest — fused in recoverParkedEntry, which is now the ONLY way
+            // parked content can enter the transcript. It verifies the sender's signature over
+            // (session_id, recipient_pubkey, content_hash) and that the signer is this session's
+            // counterparty, and it still verifies + records the DOD-MSG-4 ordering record when present.
+            // Relay deposit is unauthenticated and the seal is anonymous, so WITHOUT this gate anyone
+            // holding the recipient's public key — the relay above all — could inject content that gets
+            // attributed to the honest counterparty and then notarized by the bilateral seal.
             const contentHashBytes = Buffer.from(e.contentHashHex, "hex");
-            if (env.structure1Cbor && env.structure2Cbor) {
-                sessionNodeManager.recordOrderingRecord(recipientAgent.name, e.sessionIdHex, env.structure1Cbor, env.structure2Cbor, contentHashBytes);
-            }
-            const ingest = await sessionNodeManager.ingestReceivedContent(recipientAgent.name, e.sessionIdHex, env.content, contentHashBytes);
+            const ingest = await sessionNodeManager.recoverParkedEntry(recipientAgent.name, e.sessionIdHex, Buffer.from(recipientPubkey, "hex"), unsealed, contentHashBytes, correlationId);
             if (ingest.ok && ingest.held) {
                 // DOD-MSG-4 (review finding #4): a held entry is NOT yet an appended leaf — its sequence is
                 // the FUTURE canonical index, not a completed recovery. Do not count it as recovered; log it
@@ -3758,10 +3838,14 @@ export async function startDaemon(config) {
                 }
             }
             else {
-                logger.warn("content.recover.ingest_failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, reason: ingest.reason });
+                // SEC-1 (M2): carry the refusal out to the caller, not just to the log. Deliberately still
+                // NOT confirm-deleted — a forgery must not be able to evict itself from the mailbox, and a
+                // genuine v1-peer message must not be destroyed by our refusing it.
+                refusals.push({ contentHash: e.contentHashHex, sessionId: e.sessionIdHex, reason: ingest.reason });
+                logger.warn("content.recover.ingest_failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, reason: ingest.reason, correlationId });
             }
         }
-        return { ok: true, recovered, pulled: entries.length };
+        return { ok: true, recovered, pulled: entries.length, refused: refusals.length, refusals };
     }
     // DOD-MSG-4 (auto-recover-on-reconnect): when an agent comes online, drain its parked mailbox from
     // every relay it has sessions on — symmetric to the SENDER's flushAwaitingContent. Without this,
@@ -5828,7 +5912,8 @@ export async function startDaemon(config) {
         await ipcServer.start();
     }
     catch (err) {
-        await removeLock(lockFilePath, logger);
+        // As above: startDaemon's catch releases the singleton lock for us.
+        await removeLockIfOwned(lockFilePath, process.pid, logger);
         throw err;
     }
     // MCP-002: Instantiate NotificationDispatcher (wired to IPC server)
@@ -5909,14 +5994,30 @@ export async function startDaemon(config) {
             manifestPollScheduler.cancel();
         }
         logger.info("daemon.stopped", { pid: process.pid, reason });
-        // CONN-001 (code-review LOW): stopAllSignaling() stops the shared manager AND every per-agent
-        // manager (best-effort). The previously-separate per-agent stop loop here was redundant and
-        // unguarded (would abort the rest of shutdown if stop() ever threw on a second call) — removed.
-        await stopAllSignaling();
-        // Gracefully mark active sessions interrupted (AC-009) before stopping IPC
-        await sessionNodeManager.gracefulShutdown();
-        await ipcServer.stop();
-        await removeLock(lockFilePath, logger);
+        try {
+            // CONN-001 (code-review LOW): stopAllSignaling() stops the shared manager AND every per-agent
+            // manager (best-effort). The previously-separate per-agent stop loop here was redundant and
+            // unguarded (would abort the rest of shutdown if stop() ever threw on a second call) — removed.
+            await stopAllSignaling();
+            // Gracefully mark active sessions interrupted (AC-009) before stopping IPC
+            await sessionNodeManager.gracefulShutdown();
+            await ipcServer.stop();
+        }
+        finally {
+            // DOD-SINGLE-DAEMON-1: in a `finally`, because a throw anywhere above must not leave the lock
+            // held. In the real binary the process exits and the kernel reclaims it — but an in-process
+            // caller (vitest, an embedder) whose shutdown throws would otherwise find every subsequent
+            // startDaemon in that process reporting "another daemon is already running", with the real
+            // cause thrown away. That is the same leak F2 fixed on the startup path.
+            //
+            // DOD-DAEMON-CLEANUP-1 (AC1): the lock file goes only if it is still OURS. Another daemon may
+            // have taken it over while we ran, and deleting a live daemon's lock is what makes `cello
+            // logout` say "No daemon running" and the next `cello login` spawn a third one.
+            await removeLockIfOwned(lockFilePath, process.pid, logger).catch(() => { });
+            // Released LAST: while we hold it, no successor daemon can start, which is what lets
+            // ipcServer.stop()'s socket re-check above be race-free.
+            singletonLock.release();
+        }
     }
     function getSessionNodeManager() {
         return sessionNodeManager;