@cogcoin/client 0.5.14 → 1.0.0

package/dist/wallet/lifecycle.js

@@ -7,25 +7,21 @@ import { attachOrStartManagedBitcoindService, createManagedWalletReplica, probeM
 import { resolveManagedServicePaths } from "../bitcoind/service-paths.js";
 import { createRpcClient } from "../bitcoind/node.js";
 import { openSqliteStore } from "../sqlite/index.js";
-import { readPortableWalletArchive, writePortableWalletArchive } from "./archive.js";
-import { DEFAULT_PROACTIVE_RESERVE_SATS, normalizeWalletStateRecord, persistWalletCoinControlStateIfNeeded, } from "./coin-control.js";
+import { normalizeWalletStateRecord, persistWalletCoinControlStateIfNeeded, } from "./coin-control.js";
 import { normalizeWalletDescriptorState, persistNormalizedWalletDescriptorStateIfNeeded, persistWalletStateUpdate, resolveNormalizedWalletDescriptorState, stripDescriptorChecksum, } from "./descriptor-normalization.js";
-import { acquireFileLock, clearOrphanedFileLock } from "./fs/lock.js";
+import { acquireFileLock, clearOrphanedFileLock, readLockMetadata } from "./fs/lock.js";
 import { createInternalCoreWalletPassphrase, createMnemonicConfirmationChallenge, deriveWalletMaterialFromMnemonic, generateWalletMaterial, isEnglishMnemonicWord, validateEnglishMnemonic, } from "./material.js";
 import { deriveWalletRuntimePathsForSeed, resolveWalletRuntimePathsForTesting, } from "./runtime.js";
-import { requestMiningGenerationPreemption } from "./mining/coordination.js";
+import { readMiningGenerationActivity } from "./mining/coordination.js";
 import { loadClientConfig } from "./mining/config.js";
-import { inspectMiningHookState } from "./mining/hooks.js";
 import { loadMiningRuntimeStatus, saveMiningRuntimeStatus } from "./mining/runtime-artifacts.js";
 import { normalizeMiningStateRecord } from "./mining/state.js";
 import { renderWalletMnemonicRevealArt } from "./mnemonic-art.js";
-import { clearWalletExplicitLock, loadWalletExplicitLock, saveWalletExplicitLock, } from "./state/explicit-lock.js";
 import { clearWalletPendingInitializationState, loadWalletPendingInitializationStateOrNull, saveWalletPendingInitializationState, } from "./state/pending-init.js";
-import { clearUnlockSession, loadUnlockSession, saveUnlockSession } from "./state/session.js";
 import { addImportedWalletSeedRecord, assertValidImportedWalletSeedName, ensureMainWalletSeedIndexRecord, findWalletSeedRecord, loadWalletSeedIndex, removeWalletSeedRecord, } from "./state/seed-index.js";
-import { createDefaultWalletSecretProvider, createWalletPendingInitSecretReference, createWalletRootId, createWalletSecretReference, } from "./state/provider.js";
+import { createDefaultWalletSecretProvider, ensureClientPasswordConfigured, createWalletPendingInitSecretReference, createWalletRootId, createWalletSecretReference, withInteractiveWalletSecretProvider, } from "./state/provider.js";
+import { clearLegacyWalletLockArtifacts, withUnlockedManagedCoreWallet, } from "./managed-core-wallet.js";
 import { extractWalletRootIdHintFromWalletStateEnvelope, loadRawWalletStateEnvelope, loadWalletState, saveWalletState, } from "./state/storage.js";
-export const DEFAULT_UNLOCK_DURATION_MS = 15 * 60 * 1000;
 export { previewResetWallet, resetWallet, } from "./reset.js";
 function sanitizeWalletName(walletRootId) {
     return `cogcoin-${walletRootId}`.replace(/[^a-zA-Z0-9._-]+/g, "-").slice(0, 63);
@@ -99,16 +95,12 @@ async function loadOrCreatePendingInitializationMaterial(options) {
 }
 function createInitialWalletState(options) {
     return {
-        schemaVersion: 1,
+        schemaVersion: 5,
         stateRevision: 1,
         lastWrittenAtUnixMs: options.nowUnixMs,
         walletRootId: options.walletRootId,
         network: "mainnet",
-        anchorValueSats: 2_000,
-        proactiveReserveSats: DEFAULT_PROACTIVE_RESERVE_SATS,
-        proactiveReserveOutpoints: [],
-        nextDedicatedIndex: 1,
-        fundingIndex: 0,
+        localScriptPubKeyHexes: [options.material.funding.scriptPubKeyHex],
         mnemonic: {
             phrase: options.material.mnemonic.phrase,
             language: options.material.mnemonic.language,
@@ -135,21 +127,12 @@ function createInitialWalletState(options) {
             walletName: sanitizeWalletName(options.walletRootId),
             internalPassphrase: options.internalCoreWalletPassphrase,
             descriptorChecksum: null,
-            fundingAddress0: null,
-            fundingScriptPubKeyHex0: null,
+            walletAddress: null,
+            walletScriptPubKeyHex: null,
             proofStatus: "not-proven",
             lastImportedAtUnixMs: null,
             lastVerifiedAtUnixMs: null,
         },
-        identities: [
-            {
-                index: 0,
-                scriptPubKeyHex: options.material.funding.scriptPubKeyHex,
-                address: options.material.funding.address,
-                status: "funding",
-                assignedDomainNames: [],
-            },
-        ],
         domains: [],
         miningState: {
             runMode: "stopped",
@@ -172,7 +155,7 @@ function createInitialWalletState(options) {
             currentBlockTargetHeight: null,
             currentReferencedBlockHashDisplay: null,
             currentIntentFingerprintHex: null,
-            liveMiningFamilyInMempool: null,
+            livePublishInMempool: null,
             currentPublishDecision: null,
             replacementCount: 0,
             currentBlockFeeSpentSats: "0",
@@ -180,44 +163,11 @@ function createInitialWalletState(options) {
             lifetimeFeeSpentSats: "0",
             sharedMiningConflictOutpoint: null,
         },
-        hookClientState: {
-            mining: {
-                mode: "builtin",
-                validationState: "never",
-                lastValidationAtUnixMs: null,
-                lastValidationError: null,
-                validatedLaunchFingerprint: null,
-                validatedFullFingerprint: null,
-                fullTrustWarningAcknowledgedAtUnixMs: null,
-                consecutiveFailureCount: 0,
-                cooldownUntilUnixMs: null,
-            },
-        },
-        proactiveFamilies: [],
         pendingMutations: [],
     };
 }
-function createUnlockSession(state, unlockUntilUnixMs, secretKeyId, nowUnixMs) {
-    return {
-        schemaVersion: 1,
-        walletRootId: state.walletRootId,
-        sessionId: randomBytes(16).toString("hex"),
-        createdAtUnixMs: nowUnixMs,
-        unlockUntilUnixMs,
-        sourceStateRevision: state.stateRevision,
-        wrappedSessionKeyMaterial: secretKeyId,
-    };
-}
-function createWalletExplicitLock(walletRootId, nowUnixMs) {
-    return {
-        schemaVersion: 1,
-        walletRootId,
-        lockedAtUnixMs: nowUnixMs,
-    };
-}
-async function normalizeUnlockedWalletStateIfNeeded(options) {
+async function normalizeLoadedWalletStateIfNeeded(options) {
     let state = options.state;
-    let session = options.session;
     let source = options.source;
     if (options.dataDir !== undefined) {
         const node = await (options.attachService ?? attachOrStartManagedBitcoindService)({
@@ -233,14 +183,12 @@ async function normalizeUnlockedWalletStateIfNeeded(options) {
                     provider: options.provider,
                     secretReference: createWalletSecretReference(state.walletRootId),
                 },
-                session,
                 paths: options.paths,
                 nowUnixMs: options.nowUnixMs,
                 replacePrimary: options.source === "backup",
                 rpc: (options.rpcFactory ?? createRpcClient)(node.rpc),
             });
             state = normalized.state;
-            session = normalized.session ?? session;
             source = normalized.changed ? "primary" : options.source;
             const coinControl = await persistWalletCoinControlStateIfNeeded({
                 state,
@@ -248,14 +196,12 @@ async function normalizeUnlockedWalletStateIfNeeded(options) {
                     provider: options.provider,
                     secretReference: createWalletSecretReference(state.walletRootId),
                 },
-                session,
                 paths: options.paths,
                 nowUnixMs: options.nowUnixMs,
                 replacePrimary: source === "backup",
                 rpc: createRpcClient(node.rpc),
             });
             state = coinControl.state;
-            session = coinControl.session ?? session;
             source = coinControl.changed ? "primary" : source;
         }
         finally {
@@ -263,7 +209,6 @@ async function normalizeUnlockedWalletStateIfNeeded(options) {
         }
     }
     return {
-        session,
         state: normalizeWalletStateRecord({
             ...state,
             miningState: normalizeMiningStateRecord(state.miningState),
@@ -271,106 +216,6 @@ async function normalizeUnlockedWalletStateIfNeeded(options) {
         source,
     };
 }
-function createPortableWalletArchivePayload(state, exportedAtUnixMs) {
-    return {
-        schemaVersion: 1,
-        exportedAtUnixMs,
-        walletRootId: state.walletRootId,
-        network: state.network,
-        anchorValueSats: state.anchorValueSats,
-        proactiveReserveSats: state.proactiveReserveSats,
-        proactiveReserveOutpoints: state.proactiveReserveOutpoints,
-        nextDedicatedIndex: state.nextDedicatedIndex,
-        fundingIndex: state.fundingIndex,
-        mnemonic: {
-            phrase: state.mnemonic.phrase,
-            language: state.mnemonic.language,
-        },
-        expected: {
-            masterFingerprintHex: state.keys.masterFingerprintHex,
-            accountPath: state.keys.accountPath,
-            accountXpub: state.keys.accountXpub,
-            publicExternalDescriptor: stripDescriptorChecksum(state.descriptor.publicExternal),
-            descriptorChecksum: state.descriptor.checksum,
-            rangeEnd: state.descriptor.rangeEnd,
-            safetyMargin: state.descriptor.safetyMargin,
-            fundingAddress0: state.funding.address,
-            fundingScriptPubKeyHex0: state.funding.scriptPubKeyHex,
-            walletBirthTime: state.walletBirthTime,
-        },
-        identities: state.identities,
-        domains: state.domains,
-        miningState: normalizeMiningStateRecord(state.miningState),
-        hookClientState: state.hookClientState,
-        proactiveFamilies: state.proactiveFamilies.filter((family) => family.status === "confirmed" || family.status === "canceled"),
-    };
-}
-function createWalletStateFromPortableArchive(options) {
-    const material = deriveWalletMaterialFromMnemonic(options.payload.mnemonic.phrase);
-    if (material.keys.masterFingerprintHex !== options.payload.expected.masterFingerprintHex
-        || material.keys.accountPath !== options.payload.expected.accountPath
-        || material.keys.accountXpub !== options.payload.expected.accountXpub
-        || stripDescriptorChecksum(material.descriptor.publicExternal) !== stripDescriptorChecksum(options.payload.expected.publicExternalDescriptor)
-        || material.funding.address !== options.payload.expected.fundingAddress0
-        || material.funding.scriptPubKeyHex !== options.payload.expected.fundingScriptPubKeyHex0) {
-        throw new Error("wallet_import_material_mismatch");
-    }
-    const baseState = createInitialWalletState({
-        walletRootId: options.payload.walletRootId,
-        nowUnixMs: options.nowUnixMs,
-        material,
-        internalCoreWalletPassphrase: options.internalCoreWalletPassphrase,
-    });
-    return {
-        ...baseState,
-        walletRootId: options.payload.walletRootId,
-        network: options.payload.network,
-        anchorValueSats: options.payload.anchorValueSats,
-        proactiveReserveSats: options.payload.proactiveReserveSats,
-        proactiveReserveOutpoints: options.payload.proactiveReserveOutpoints,
-        nextDedicatedIndex: options.payload.nextDedicatedIndex,
-        fundingIndex: options.payload.fundingIndex,
-        walletBirthTime: options.payload.expected.walletBirthTime,
-        descriptor: {
-            ...baseState.descriptor,
-            checksum: options.payload.expected.descriptorChecksum,
-            rangeEnd: options.payload.expected.rangeEnd,
-            safetyMargin: options.payload.expected.safetyMargin,
-        },
-        identities: options.payload.identities,
-        domains: options.payload.domains,
-        miningState: normalizeMiningStateRecord(options.payload.miningState),
-        hookClientState: options.payload.hookClientState,
-        proactiveFamilies: options.payload.proactiveFamilies,
-        pendingMutations: [],
-    };
-}
-function isExportBlockedByLocalState(state) {
-    if (state.miningState.state === "repair-required"
-        || state.miningState.currentPublishState === "broadcasting"
-        || state.miningState.currentPublishState === "broadcast-unknown"
-        || state.miningState.currentPublishState === "in-mempool") {
-        return "wallet_export_requires_quiescent_local_state";
-    }
-    if (state.proactiveFamilies.some((family) => family.status === "draft"
-        || family.status === "broadcasting"
-        || family.status === "broadcast-unknown"
-        || family.status === "live"
-        || family.status === "repair-required")) {
-        return "wallet_export_requires_quiescent_local_state";
-    }
-    if (state.domains.some((domain) => domain.localAnchorIntent === "repair-required")) {
-        return "wallet_export_requires_quiescent_local_state";
-    }
-    if ((state.pendingMutations ?? []).some((mutation) => mutation.status === "draft"
-        || mutation.status === "broadcasting"
-        || mutation.status === "broadcast-unknown"
-        || mutation.status === "live"
-        || mutation.status === "repair-required")) {
-        return "wallet_export_requires_quiescent_local_state";
-    }
-    return null;
-}
 async function promptRequiredValue(prompter, message) {
     const value = (await prompter.prompt(message)).trim();
     if (value === "") {
@@ -384,14 +229,6 @@ async function promptHiddenValue(prompter, message) {
         : await prompter.prompt(message);
     return value.trim();
 }
-async function promptForArchivePassphrase(prompter, promptPrefix) {
-    const first = await promptRequiredValue(prompter, `${promptPrefix} passphrase: `);
-    const second = await promptRequiredValue(prompter, `Confirm ${promptPrefix.toLowerCase()} passphrase: `);
-    if (first !== second) {
-        throw new Error("wallet_archive_passphrase_mismatch");
-    }
-    return first;
-}
 async function promptForRestoreMnemonic(prompter) {
     const words = [];
     for (let index = 0; index < 24; index += 1) {
@@ -419,38 +256,12 @@ async function confirmRestoreReplacement(prompter) {
         throw new Error("wallet_restore_replace_confirmation_required");
     }
 }
-async function confirmOverwriteIfNeeded(prompter, path) {
-    if (!await pathExists(path)) {
-        return;
-    }
-    const answer = (await prompter.prompt(`Archive ${path} already exists. Overwrite it? Type yes to continue: `)).trim().toLowerCase();
-    if (answer !== "yes") {
-        throw new Error("wallet_export_overwrite_declined");
-    }
-}
 async function confirmYesNo(prompter, message) {
     const answer = (await prompter.prompt(message)).trim().toLowerCase();
     if (answer !== "yes") {
         throw new Error("wallet_delete_confirmation_required");
     }
 }
-async function readManagedSnapshotTip(options) {
-    const daemon = await attachOrStartIndexerDaemon({
-        dataDir: options.dataDir,
-        databasePath: options.databasePath,
-        walletRootId: options.walletRootId,
-    });
-    try {
-        const lease = await readSnapshotWithRetry(daemon, options.walletRootId);
-        return {
-            nodeBestHeight: lease.status.coreBestHeight,
-            snapshotHeight: lease.payload.tip?.height ?? null,
-        };
-    }
-    finally {
-        await daemon.close().catch(() => undefined);
-    }
-}
 async function recreateManagedCoreWalletReplica(state, provider, paths, dataDir, nowUnixMs, options = {}) {
     const walletName = sanitizeWalletName(state.walletRootId);
     const walletDir = join(dataDir, "wallets", walletName);
@@ -739,14 +550,14 @@ function applyRepairStoppedMiningState(state) {
         miningState: {
             ...miningState,
             runMode: "stopped",
-            state: miningState.liveMiningFamilyInMempool
+            state: miningState.livePublishInMempool
                 ? miningState.state === "paused-stale"
                     ? "paused-stale"
                     : "paused"
                 : miningState.state === "repair-required"
                     ? "repair-required"
                     : "idle",
-            pauseReason: miningState.liveMiningFamilyInMempool
+            pauseReason: miningState.livePublishInMempool
                 ? miningState.state === "paused-stale"
                     ? "stale-block-context"
                     : "wallet-repair"
@@ -766,11 +577,121 @@ function createStoppedBackgroundRuntimeSnapshot(snapshot, nowUnixMs) {
         backgroundWorkerHeartbeatAtUnixMs: null,
         backgroundWorkerHealth: null,
         currentPhase: "idle",
-        note: snapshot.liveMiningFamilyInMempool
+        note: snapshot.livePublishInMempool
             ? "Background mining stopped for wallet repair. The last mining transaction may still confirm from mempool."
             : "Background mining stopped for wallet repair.",
     };
 }
+function resolveMiningGenerationRequestPath(paths) {
+    return join(paths.miningRoot, "generation-request.json");
+}
+function resolveMiningGenerationActivityPath(paths) {
+    return join(paths.miningRoot, "generation-activity.json");
+}
+function normalizeRepairMiningPid(value) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0
+        ? value
+        : null;
+}
+function createRepairStoppedMiningNote(livePublishInMempool) {
+    return livePublishInMempool
+        ? "Background mining stopped for wallet repair. The last mining transaction may still confirm from mempool."
+        : "Background mining stopped for wallet repair.";
+}
+function createStoppedMiningRuntimeSnapshotForRepair(options) {
+    const stoppedMiningState = normalizeMiningStateRecord(applyRepairStoppedMiningState(options.state).miningState);
+    const note = createRepairStoppedMiningNote(stoppedMiningState.livePublishInMempool);
+    if (options.snapshot !== null) {
+        return {
+            ...createStoppedBackgroundRuntimeSnapshot(options.snapshot, options.nowUnixMs),
+            miningState: stoppedMiningState.state,
+            currentPublishState: stoppedMiningState.currentPublishState,
+            targetBlockHeight: stoppedMiningState.currentBlockTargetHeight,
+            referencedBlockHashDisplay: stoppedMiningState.currentReferencedBlockHashDisplay,
+            currentDomainId: stoppedMiningState.currentDomainId,
+            currentDomainName: stoppedMiningState.currentDomain,
+            currentSentenceDisplay: stoppedMiningState.currentSentence,
+            currentTxid: stoppedMiningState.currentTxid,
+            currentWtxid: stoppedMiningState.currentWtxid,
+            livePublishInMempool: stoppedMiningState.livePublishInMempool,
+            currentFeeRateSatVb: stoppedMiningState.currentFeeRateSatVb,
+            currentAbsoluteFeeSats: stoppedMiningState.currentAbsoluteFeeSats,
+            currentBlockFeeSpentSats: stoppedMiningState.currentBlockFeeSpentSats,
+            sessionFeeSpentSats: stoppedMiningState.sessionFeeSpentSats,
+            lifetimeFeeSpentSats: stoppedMiningState.lifetimeFeeSpentSats,
+            currentPublishDecision: stoppedMiningState.currentPublishDecision,
+            pauseReason: stoppedMiningState.pauseReason,
+            note,
+        };
+    }
+    return {
+        schemaVersion: 1,
+        walletRootId: options.state.walletRootId,
+        workerApiVersion: null,
+        workerBinaryVersion: null,
+        workerBuildId: null,
+        updatedAtUnixMs: options.nowUnixMs,
+        runMode: "stopped",
+        backgroundWorkerPid: null,
+        backgroundWorkerRunId: null,
+        backgroundWorkerHeartbeatAtUnixMs: null,
+        backgroundWorkerHealth: null,
+        indexerDaemonState: null,
+        indexerDaemonInstanceId: null,
+        indexerSnapshotSeq: null,
+        indexerSnapshotOpenedAtUnixMs: null,
+        indexerTruthSource: undefined,
+        indexerHeartbeatAtUnixMs: null,
+        coreBestHeight: null,
+        coreBestHash: null,
+        indexerTipHeight: null,
+        indexerTipHash: null,
+        indexerReorgDepth: null,
+        indexerTipAligned: null,
+        corePublishState: null,
+        providerState: null,
+        lastSuspendDetectedAtUnixMs: null,
+        reconnectSettledUntilUnixMs: null,
+        tipSettledUntilUnixMs: null,
+        miningState: stoppedMiningState.state,
+        currentPhase: "idle",
+        currentPublishState: stoppedMiningState.currentPublishState,
+        targetBlockHeight: stoppedMiningState.currentBlockTargetHeight,
+        referencedBlockHashDisplay: stoppedMiningState.currentReferencedBlockHashDisplay,
+        currentDomainId: stoppedMiningState.currentDomainId,
+        currentDomainName: stoppedMiningState.currentDomain,
+        currentSentenceDisplay: stoppedMiningState.currentSentence,
+        currentCanonicalBlend: null,
+        currentTxid: stoppedMiningState.currentTxid,
+        currentWtxid: stoppedMiningState.currentWtxid,
+        livePublishInMempool: stoppedMiningState.livePublishInMempool,
+        currentFeeRateSatVb: stoppedMiningState.currentFeeRateSatVb,
+        currentAbsoluteFeeSats: stoppedMiningState.currentAbsoluteFeeSats,
+        currentBlockFeeSpentSats: stoppedMiningState.currentBlockFeeSpentSats,
+        sessionFeeSpentSats: stoppedMiningState.sessionFeeSpentSats,
+        lifetimeFeeSpentSats: stoppedMiningState.lifetimeFeeSpentSats,
+        sameDomainCompetitorSuppressed: null,
+        higherRankedCompetitorDomainCount: null,
+        dedupedCompetitorDomainCount: null,
+        competitivenessGateIndeterminate: null,
+        mempoolSequenceCacheStatus: null,
+        currentPublishDecision: stoppedMiningState.currentPublishDecision,
+        lastMempoolSequence: null,
+        lastCompetitivenessGateAtUnixMs: null,
+        pauseReason: stoppedMiningState.pauseReason,
+        providerConfigured: false,
+        providerKind: null,
+        bitcoindHealth: "unavailable",
+        bitcoindServiceState: null,
+        bitcoindReplicaStatus: null,
+        nodeHealth: "unavailable",
+        indexerHealth: "unavailable",
+        tipsAligned: null,
+        lastEventAtUnixMs: null,
+        lastError: null,
+        note,
+    };
+}
 async function persistRepairState(options) {
     return await persistWalletStateUpdate({
         state: options.state,
@@ -783,41 +704,57 @@ async function persistRepairState(options) {
         replacePrimary: options.replacePrimary,
     });
 }
-async function stopBackgroundMiningForRepair(options) {
-    const pid = options.snapshot.backgroundWorkerPid;
-    if (pid !== null) {
-        try {
-            process.kill(pid, "SIGKILL");
+async function cleanupMiningForRepair(options) {
+    const controlLockMetadata = await readLockMetadata(options.paths.miningControlLockPath).catch(() => null);
+    const generationActivity = await readMiningGenerationActivity(options.paths).catch(() => null);
+    const controlLockPid = normalizeRepairMiningPid(controlLockMetadata?.processId);
+    const backgroundWorkerPid = normalizeRepairMiningPid(options.snapshot?.backgroundWorkerPid);
+    const generationOwnerPid = normalizeRepairMiningPid(generationActivity?.generationOwnerPid);
+    const discoveredPids = new Set();
+    let backgroundWorkerAlive = false;
+    let foregroundWorkerAlive = false;
+    const pidSources = [
+        { pid: backgroundWorkerPid, source: "background" },
+        { pid: controlLockPid, source: "foreground" },
+        { pid: generationOwnerPid, source: "foreground" },
+    ];
+    for (const source of pidSources) {
+        if (source.pid === null || source.pid === process.pid || !await isProcessAlive(source.pid)) {
+            continue;
         }
-        catch (error) {
-            if (!(error instanceof Error) || !("code" in error) || error.code !== "ESRCH") {
-                throw error;
-            }
+        discoveredPids.add(source.pid);
+        if (source.source === "background") {
+            backgroundWorkerAlive = true;
         }
-        await waitForProcessExit(pid, 15_000, "background_mining_stop_timeout");
+        else {
+            foregroundWorkerAlive = true;
+        }
+    }
+    for (const pid of discoveredPids) {
+        await stopRecordedManagedProcess(pid, "mining_process_stop_timeout");
     }
-    await saveMiningRuntimeStatus(options.paths.miningStatusPath, createStoppedBackgroundRuntimeSnapshot(options.snapshot, options.nowUnixMs));
+    await rm(options.paths.miningControlLockPath, { force: true }).catch(() => undefined);
+    await rm(resolveMiningGenerationRequestPath(options.paths), { force: true }).catch(() => undefined);
+    await rm(resolveMiningGenerationActivityPath(options.paths), { force: true }).catch(() => undefined);
+    await saveMiningRuntimeStatus(options.paths.miningStatusPath, createStoppedMiningRuntimeSnapshotForRepair({
+        state: options.state,
+        snapshot: options.snapshot,
+        nowUnixMs: options.nowUnixMs,
+    }));
+    return {
+        preRepairRunMode: backgroundWorkerAlive
+            ? "background"
+            : foregroundWorkerAlive
+                ? "foreground"
+                : "stopped",
+    };
 }
 async function canResumeBackgroundMiningAfterRepair(options) {
-    if (options.unlockUntilUnixMs === null
-        || options.unlockUntilUnixMs <= options.nowUnixMs
-        || options.bitcoindPostRepairHealth !== "ready"
+    if (options.bitcoindPostRepairHealth !== "ready"
         || options.indexerPostRepairHealth !== "synced"
         || normalizeMiningStateRecord(options.repairedState.miningState).state === "repair-required") {
         return false;
     }
-    const hookMode = options.repairedState.hookClientState.mining?.mode ?? "builtin";
-    if (hookMode === "custom") {
-        const inspection = await inspectMiningHookState({
-            hookRootPath: options.paths.hooksMiningDir,
-            entrypointPath: options.paths.hooksMiningEntrypointPath,
-            packagePath: options.paths.hooksMiningPackageJsonPath,
-            localState: options.repairedState.hookClientState.mining ?? null,
-            verify: false,
-            nowUnixMs: options.nowUnixMs,
-        });
-        return inspection.operatorValidationState === "current" && !inspection.cooldownActive;
-    }
     try {
         const config = await loadClientConfig({
             path: options.paths.clientConfigPath,
@@ -829,29 +766,6 @@ async function canResumeBackgroundMiningAfterRepair(options) {
         return false;
     }
 }
-export function parseUnlockDurationToMs(raw) {
-    if (raw == null || raw.trim() === "") {
-        return DEFAULT_UNLOCK_DURATION_MS;
-    }
-    const match = /^([1-9][0-9]*)([smhd])$/i.exec(raw.trim());
-    if (match == null) {
-        throw new Error("wallet_unlock_duration_invalid");
-    }
-    const value = Number.parseInt(match[1], 10);
-    const unit = match[2].toLowerCase();
-    const multiplier = unit === "s"
-        ? 1_000
-        : unit === "m"
-            ? 60_000
-            : unit === "h"
-                ? 3_600_000
-                : 86_400_000;
-    const duration = value * multiplier;
-    if (!Number.isFinite(duration) || duration <= 0) {
-        throw new Error("wallet_unlock_duration_invalid");
-    }
-    return duration;
-}
 async function ensureWalletNotInitialized(paths, provider) {
     if (await pathExists(paths.walletStatePath) || await pathExists(paths.walletStateBackupPath)) {
         await clearPendingInitialization(paths, provider);
@@ -860,8 +774,7 @@ async function ensureWalletNotInitialized(paths, provider) {
 }
 function isWalletSecretAccessError(error) {
     const message = error instanceof Error ? error.message : String(error);
-    return message === "wallet_envelope_missing_secret_provider"
-        || message.startsWith("wallet_secret_missing_")
+    return message.startsWith("wallet_secret_missing_")
         || message.startsWith("wallet_secret_provider_");
 }
 function writeMnemonicReveal(prompter, phrase, introLines) {
@@ -898,22 +811,23 @@ async function importDescriptorIntoManagedCoreWallet(state, provider, paths, dat
     });
     const normalizedDescriptors = await resolveNormalizedWalletDescriptorState(state, rpc);
     const walletName = sanitizeWalletName(state.walletRootId);
-    await rpc.walletPassphrase(walletName, state.managedCoreWallet.internalPassphrase, 10);
-    try {
-        const importResults = await rpc.importDescriptors(walletName, [{
-                desc: normalizedDescriptors.privateExternal,
-                timestamp: state.walletBirthTime,
-                active: false,
-                internal: false,
-                range: [0, state.descriptor.rangeEnd],
-            }]);
-        if (!importResults.every((result) => result.success)) {
-            throw new Error(`wallet_descriptor_import_failed_${JSON.stringify(importResults)}`);
-        }
-    }
-    finally {
-        await rpc.walletLock(walletName).catch(() => undefined);
-    }
+    await withUnlockedManagedCoreWallet({
+        rpc,
+        walletName,
+        internalPassphrase: state.managedCoreWallet.internalPassphrase,
+        run: async () => {
+            const importResults = await rpc.importDescriptors(walletName, [{
+                    desc: normalizedDescriptors.privateExternal,
+                    timestamp: state.walletBirthTime,
+                    active: false,
+                    internal: false,
+                    range: [0, state.descriptor.rangeEnd],
+                }]);
+            if (!importResults.every((result) => result.success)) {
+                throw new Error(`wallet_descriptor_import_failed_${JSON.stringify(importResults)}`);
+            }
+        },
+    });
     const derivedFunding = await rpc.deriveAddresses(normalizedDescriptors.publicExternal, [0, 0]);
     if (derivedFunding[0] !== state.funding.address) {
         throw new Error("wallet_funding_address_verification_failed");
@@ -950,8 +864,8 @@ async function importDescriptorIntoManagedCoreWallet(state, provider, paths, dat
             ...state.managedCoreWallet,
             walletName,
             descriptorChecksum: normalizedDescriptors.checksum,
-            fundingAddress0: verifiedReplica.fundingAddress0 ?? null,
-            fundingScriptPubKeyHex0: verifiedReplica.fundingScriptPubKeyHex0 ?? null,
+            walletAddress: verifiedReplica.fundingAddress0 ?? null,
+            walletScriptPubKeyHex: verifiedReplica.fundingScriptPubKeyHex0 ?? null,
             proofStatus: "ready",
             lastImportedAtUnixMs: nowUnixMs,
             lastVerifiedAtUnixMs: nowUnixMs,
@@ -991,8 +905,8 @@ export async function verifyManagedCoreWalletReplica(state, dataDir, dependencie
                 created: false,
                 proofStatus: "missing",
                 descriptorChecksum: state.managedCoreWallet.descriptorChecksum,
-                fundingAddress0: state.managedCoreWallet.fundingAddress0,
-                fundingScriptPubKeyHex0: state.managedCoreWallet.fundingScriptPubKeyHex0,
+                fundingAddress0: state.managedCoreWallet.walletAddress,
+                fundingScriptPubKeyHex0: state.managedCoreWallet.walletScriptPubKeyHex,
                 message: "Expected descriptor is missing from the managed Core wallet.",
             };
         }
@@ -1036,133 +950,40 @@ export async function verifyManagedCoreWalletReplica(state, dataDir, dependencie
             created: false,
             proofStatus: "not-proven",
             descriptorChecksum: state.managedCoreWallet.descriptorChecksum,
-            fundingAddress0: state.managedCoreWallet.fundingAddress0,
-            fundingScriptPubKeyHex0: state.managedCoreWallet.fundingScriptPubKeyHex0,
+            fundingAddress0: state.managedCoreWallet.walletAddress,
+            fundingScriptPubKeyHex0: state.managedCoreWallet.walletScriptPubKeyHex,
             message: error instanceof Error ? error.message : String(error),
         };
     }
 }
-export async function loadUnlockedWalletState(options = {}) {
+async function loadWalletStateForAccess(options = {}) {
     const provider = options.provider ?? createDefaultWalletSecretProvider();
     const nowUnixMs = options.nowUnixMs ?? Date.now();
     const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
-    try {
-        let session = await loadUnlockSession(paths.walletUnlockSessionPath, {
-            provider,
-        });
-        if (session.unlockUntilUnixMs <= nowUnixMs) {
-            await clearUnlockSession(paths.walletUnlockSessionPath);
-            return null;
-        }
-        const loaded = await loadWalletState({
-            primaryPath: paths.walletStatePath,
-            backupPath: paths.walletStateBackupPath,
-        }, {
-            provider,
-        });
-        if (loaded.state.walletRootId !== session.walletRootId
-            || loaded.state.stateRevision !== session.sourceStateRevision) {
-            await clearUnlockSession(paths.walletUnlockSessionPath);
-            return null;
-        }
-        return await normalizeUnlockedWalletStateIfNeeded({
-            provider,
-            session,
-            state: loaded.state,
-            source: loaded.source,
-            nowUnixMs,
-            paths,
-            dataDir: options.dataDir,
-            attachService: options.attachService,
-            rpcFactory: options.rpcFactory,
-        });
-    }
-    catch {
-        return null;
-    }
-}
-export async function loadOrAutoUnlockWalletState(options = {}) {
-    const provider = options.provider ?? createDefaultWalletSecretProvider();
-    const nowUnixMs = options.nowUnixMs ?? Date.now();
-    const unlockDurationMs = options.unlockDurationMs ?? DEFAULT_UNLOCK_DURATION_MS;
-    const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
-    const loadExisting = () => loadUnlockedWalletState({
+    const loaded = await loadWalletState({
+        primaryPath: paths.walletStatePath,
+        backupPath: paths.walletStateBackupPath,
+    }, {
+        provider,
+    });
+    return normalizeLoadedWalletStateIfNeeded({
         provider,
+        state: loaded.state,
+        source: loaded.source,
         nowUnixMs,
         paths,
         dataDir: options.dataDir,
         attachService: options.attachService,
         rpcFactory: options.rpcFactory,
     });
-    const existing = await loadExisting();
-    if (existing !== null) {
-        return existing;
-    }
-    const loadAndMaybeAutoUnlock = async () => {
-        const reloaded = await loadExisting();
-        if (reloaded !== null) {
-            return reloaded;
-        }
-        let loaded;
-        try {
-            loaded = await loadWalletState({
-                primaryPath: paths.walletStatePath,
-                backupPath: paths.walletStateBackupPath,
-            }, {
-                provider,
-            });
-        }
-        catch {
-            return null;
-        }
-        const explicitLock = await loadWalletExplicitLock(paths.walletExplicitLockPath);
-        if (explicitLock !== null) {
-            if (explicitLock.walletRootId === loaded.state.walletRootId) {
-                await clearUnlockSession(paths.walletUnlockSessionPath);
-                return null;
-            }
-            await clearWalletExplicitLock(paths.walletExplicitLockPath);
-        }
-        const secretReference = createWalletSecretReference(loaded.state.walletRootId);
-        const unlockUntilUnixMs = nowUnixMs + unlockDurationMs;
-        const session = createUnlockSession(loaded.state, unlockUntilUnixMs, secretReference.keyId, nowUnixMs);
-        await saveUnlockSession(paths.walletUnlockSessionPath, session, {
-            provider,
-            secretReference,
-        });
-        return await normalizeUnlockedWalletStateIfNeeded({
-            provider,
-            session,
-            state: loaded.state,
-            source: loaded.source,
-            nowUnixMs,
-            paths,
-            dataDir: options.dataDir,
-            attachService: options.attachService,
-            rpcFactory: options.rpcFactory,
-        });
-    };
-    if (options.controlLockHeld) {
-        return await loadAndMaybeAutoUnlock();
-    }
-    const controlLock = await acquireFileLock(paths.walletControlLockPath, {
-        purpose: "wallet-auto-unlock",
-        walletRootId: null,
-    });
-    try {
-        return await loadAndMaybeAutoUnlock();
-    }
-    finally {
-        await controlLock.release();
-    }
 }
 export async function initializeWallet(options) {
     if (!options.prompter.isInteractive) {
         throw new Error("wallet_init_requires_tty");
     }
     const provider = options.provider ?? createDefaultWalletSecretProvider();
+    const interactiveProvider = withInteractiveWalletSecretProvider(provider, options.prompter);
     const nowUnixMs = options.nowUnixMs ?? Date.now();
-    const unlockDurationMs = options.unlockDurationMs ?? DEFAULT_UNLOCK_DURATION_MS;
     const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
     if (paths.selectedSeedName !== "main") {
         throw new Error("wallet_init_seed_not_supported");
@@ -1172,9 +993,28 @@ export async function initializeWallet(options) {
         walletRootId: null,
     });
     try {
-        await ensureWalletNotInitialized(paths, provider);
+        const passwordAction = await ensureClientPasswordConfigured(provider, options.prompter);
+        const hasWalletState = await pathExists(paths.walletStatePath) || await pathExists(paths.walletStateBackupPath);
+        if (hasWalletState) {
+            await clearPendingInitialization(paths, interactiveProvider);
+            const loaded = await loadWalletStateForAccess({
+                provider: interactiveProvider,
+                nowUnixMs,
+                paths,
+                dataDir: options.dataDir,
+                attachService: options.attachService,
+                rpcFactory: options.rpcFactory,
+            });
+            return {
+                passwordAction,
+                walletAction: "already-initialized",
+                walletRootId: loaded.state.walletRootId,
+                fundingAddress: loaded.state.funding.address,
+                state: loaded.state,
+            };
+        }
         const material = await loadOrCreatePendingInitializationMaterial({
-            provider,
+            provider: interactiveProvider,
             paths,
             nowUnixMs,
         });
@@ -1200,7 +1040,7 @@ export async function initializeWallet(options) {
         const internalCoreWalletPassphrase = createInternalCoreWalletPassphrase();
         const secretReference = createWalletSecretReference(walletRootId);
         const secret = randomBytes(32);
-        await provider.storeSecret(secretReference.keyId, secret);
+        await interactiveProvider.storeSecret(secretReference.keyId, secret);
         const initialState = createInitialWalletState({
             walletRootId,
             nowUnixMs,
@@ -1215,27 +1055,23 @@ export async function initializeWallet(options) {
                 primaryPath: paths.walletStatePath,
                 backupPath: paths.walletStateBackupPath,
             }, initialState, {
-                provider,
+                provider: interactiveProvider,
                 secretReference,
             });
-            return importDescriptorIntoManagedCoreWallet(initialState, provider, paths, options.dataDir, nowUnixMs, options.attachService, options.rpcFactory);
-        });
-        const unlockUntilUnixMs = nowUnixMs + unlockDurationMs;
-        await clearWalletExplicitLock(paths.walletExplicitLockPath);
-        await saveUnlockSession(paths.walletUnlockSessionPath, createUnlockSession(verifiedState, unlockUntilUnixMs, secretReference.keyId, nowUnixMs), {
-            provider,
-            secretReference,
+            return importDescriptorIntoManagedCoreWallet(initialState, interactiveProvider, paths, options.dataDir, nowUnixMs, options.attachService, options.rpcFactory);
         });
-        await clearPendingInitialization(paths, provider);
+        await clearLegacyWalletLockArtifacts(paths.walletRuntimeRoot);
+        await clearPendingInitialization(paths, interactiveProvider);
         await ensureMainWalletSeedIndexRecord({
             paths: resolveMainWalletPaths(paths),
             walletRootId,
             nowUnixMs,
         });
         return {
+            passwordAction,
+            walletAction: "initialized",
             walletRootId,
             fundingAddress: verifiedState.funding.address,
-            unlockUntilUnixMs,
             state: verifiedState,
         };
     }
@@ -1248,6 +1084,7 @@ export async function showWalletMnemonic(options) {
         throw new Error("wallet_show_mnemonic_requires_tty");
     }
     const provider = options.provider ?? createDefaultWalletSecretProvider();
+    const interactiveProvider = withInteractiveWalletSecretProvider(provider, options.prompter);
     const nowUnixMs = options.nowUnixMs ?? Date.now();
     const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
     const controlLock = await acquireFileLock(paths.walletControlLockPath, {
@@ -1262,32 +1099,19 @@ export async function showWalletMnemonic(options) {
         if (!hasPrimaryStateFile && !hasBackupStateFile) {
             throw new Error("wallet_uninitialized");
         }
-        const unlocked = await loadOrAutoUnlockWalletState({
-            provider,
+        const loaded = await loadWalletStateForAccess({
+            provider: interactiveProvider,
             nowUnixMs,
             paths,
-            controlLockHeld: true,
-        });
-        if (unlocked === null) {
-            try {
-                await loadWalletState({
-                    primaryPath: paths.walletStatePath,
-                    backupPath: paths.walletStateBackupPath,
-                }, {
-                    provider,
-                });
-            }
-            catch (error) {
-                if (isWalletSecretAccessError(error)) {
-                    throw new Error("wallet_locked");
-                }
-                throw new Error("local-state-corrupt");
+        }).catch((error) => {
+            if (isWalletSecretAccessError(error)) {
+                throw new Error("wallet_secret_provider_unavailable");
             }
-            throw new Error("wallet_locked");
-        }
+            throw new Error("local-state-corrupt");
+        });
         await confirmTypedAcknowledgement(options.prompter, "show mnemonic", "Type \"show mnemonic\" to continue: ", "wallet_show_mnemonic_typed_ack_required");
         let mnemonicRevealed = false;
-        writeMnemonicReveal(options.prompter, unlocked.state.mnemonic.phrase, [
+        writeMnemonicReveal(options.prompter, loaded.state.mnemonic.phrase, [
             "Cogcoin Wallet Recovery Phrase",
             "This 24-word recovery phrase controls the wallet.",
             "",
@@ -1308,239 +1132,13 @@ export async function showWalletMnemonic(options) {
         await controlLock.release();
     }
 }
-export async function unlockWallet(options = {}) {
-    const provider = options.provider ?? createDefaultWalletSecretProvider();
-    const nowUnixMs = options.nowUnixMs ?? Date.now();
-    const unlockDurationMs = options.unlockDurationMs ?? DEFAULT_UNLOCK_DURATION_MS;
-    const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
-    const controlLock = await acquireFileLock(paths.walletControlLockPath, {
-        purpose: "wallet-unlock",
-        walletRootId: null,
-    });
-    try {
-        const loaded = await loadWalletState({
-            primaryPath: paths.walletStatePath,
-            backupPath: paths.walletStateBackupPath,
-        }, {
-            provider,
-        });
-        const secretReference = createWalletSecretReference(loaded.state.walletRootId);
-        const unlockUntilUnixMs = nowUnixMs + unlockDurationMs;
-        await clearWalletExplicitLock(paths.walletExplicitLockPath);
-        await saveUnlockSession(paths.walletUnlockSessionPath, createUnlockSession(loaded.state, unlockUntilUnixMs, secretReference.keyId, nowUnixMs), {
-            provider,
-            secretReference,
-        });
-        return {
-            unlockUntilUnixMs,
-            state: loaded.state,
-            source: loaded.source,
-        };
-    }
-    finally {
-        await controlLock.release();
-    }
-}
-export async function lockWallet(options) {
-    const provider = options.provider ?? createDefaultWalletSecretProvider();
-    const nowUnixMs = options.nowUnixMs ?? Date.now();
-    const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
-    const controlLock = await acquireFileLock(paths.walletControlLockPath, {
-        purpose: "wallet-lock",
-        walletRootId: null,
-    });
-    try {
-        let walletRootId = null;
-        let coreLocked = false;
-        try {
-            const loaded = await loadWalletState({
-                primaryPath: paths.walletStatePath,
-                backupPath: paths.walletStateBackupPath,
-            }, {
-                provider,
-            });
-            walletRootId = loaded.state.walletRootId;
-            try {
-                const node = await (options.attachService ?? attachOrStartManagedBitcoindService)({
-                    dataDir: options.dataDir,
-                    chain: "main",
-                    startHeight: 0,
-                    walletRootId,
-                });
-                const rpc = (options.rpcFactory ?? createRpcClient)(node.rpc);
-                await rpc.walletLock(loaded.state.managedCoreWallet.walletName).catch(() => undefined);
-                coreLocked = true;
-            }
-            catch {
-                coreLocked = false;
-            }
-        }
-        catch {
-            walletRootId = null;
-        }
-        await clearUnlockSession(paths.walletUnlockSessionPath);
-        if (walletRootId !== null) {
-            await saveWalletExplicitLock(paths.walletExplicitLockPath, createWalletExplicitLock(walletRootId, nowUnixMs));
-        }
-        return {
-            walletRootId,
-            coreLocked,
-        };
-    }
-    finally {
-        await controlLock.release();
-    }
-}
-export async function exportWallet(options) {
-    if (!options.prompter.isInteractive) {
-        throw new Error("wallet_export_requires_tty");
-    }
-    const provider = options.provider ?? createDefaultWalletSecretProvider();
-    const nowUnixMs = options.nowUnixMs ?? Date.now();
-    const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
-    const controlLock = await acquireFileLock(paths.walletControlLockPath, {
-        purpose: "wallet-export",
-        walletRootId: null,
-    });
-    try {
-        const unlocked = await loadOrAutoUnlockWalletState({
-            provider,
-            nowUnixMs,
-            paths,
-            controlLockHeld: true,
-        });
-        if (unlocked === null) {
-            throw new Error("wallet_locked");
-        }
-        const blockedReason = isExportBlockedByLocalState(unlocked.state);
-        if (blockedReason !== null) {
-            throw new Error(blockedReason);
-        }
-        const replica = await verifyManagedCoreWalletReplica(unlocked.state, options.dataDir, {
-            attachService: options.attachService,
-            rpcFactory: options.rpcFactory,
-        });
-        if (replica.proofStatus !== "ready") {
-            throw new Error("wallet_export_core_replica_not_ready");
-        }
-        const tips = await (options.readSnapshotTip ?? readManagedSnapshotTip)({
-            dataDir: options.dataDir,
-            databasePath: options.databasePath,
-            walletRootId: unlocked.state.walletRootId,
-        });
-        if (tips.snapshotHeight === null || tips.nodeBestHeight === null || tips.snapshotHeight !== tips.nodeBestHeight) {
-            throw new Error("wallet_export_tip_mismatch");
-        }
-        await confirmOverwriteIfNeeded(options.prompter, options.archivePath);
-        const passphrase = await promptForArchivePassphrase(options.prompter, "Archive");
-        await writePortableWalletArchive(options.archivePath, createPortableWalletArchivePayload(unlocked.state, nowUnixMs), passphrase);
-        return {
-            archivePath: options.archivePath,
-            walletRootId: unlocked.state.walletRootId,
-        };
-    }
-    finally {
-        await controlLock.release();
-    }
-}
-export async function importWallet(options) {
-    if (!options.prompter.isInteractive) {
-        throw new Error("wallet_import_requires_tty");
-    }
-    const provider = options.provider ?? createDefaultWalletSecretProvider();
-    const nowUnixMs = options.nowUnixMs ?? Date.now();
-    const unlockDurationMs = options.unlockDurationMs ?? DEFAULT_UNLOCK_DURATION_MS;
-    const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
-    if (paths.selectedSeedName !== "main") {
-        throw new Error("wallet_import_seed_not_supported");
-    }
-    const controlLock = await acquireFileLock(paths.walletControlLockPath, {
-        purpose: "wallet-import",
-        walletRootId: null,
-    });
-    try {
-        const archivePassphrase = await promptRequiredValue(options.prompter, "Archive passphrase: ");
-        const payload = await readPortableWalletArchive(options.archivePath, archivePassphrase);
-        const replacementStateExists = await pathExists(paths.walletStatePath) || await pathExists(paths.walletStateBackupPath);
-        const importedWalletDir = join(options.dataDir, "wallets", sanitizeWalletName(payload.walletRootId));
-        const replacementCoreWalletExists = await pathExists(importedWalletDir);
-        await clearPendingInitialization(paths, provider);
-        if (replacementStateExists || replacementCoreWalletExists) {
-            await confirmTypedAcknowledgement(options.prompter, "IMPORT", "Type IMPORT to replace the existing local wallet state and managed Core wallet replica: ");
-        }
-        let previousWalletRootId = null;
-        try {
-            const loaded = await loadWalletState({
-                primaryPath: paths.walletStatePath,
-                backupPath: paths.walletStateBackupPath,
-            }, {
-                provider,
-            });
-            previousWalletRootId = loaded.state.walletRootId;
-        }
-        catch {
-            previousWalletRootId = null;
-        }
-        const secretReference = createWalletSecretReference(payload.walletRootId);
-        const replacementSecret = randomBytes(32);
-        await provider.storeSecret(secretReference.keyId, replacementSecret);
-        const initialState = createWalletStateFromPortableArchive({
-            payload,
-            nowUnixMs,
-            internalCoreWalletPassphrase: createInternalCoreWalletPassphrase(),
-        });
-        await clearUnlockSession(paths.walletUnlockSessionPath);
-        await clearWalletExplicitLock(paths.walletExplicitLockPath);
-        await saveWalletState({
-            primaryPath: paths.walletStatePath,
-            backupPath: paths.walletStateBackupPath,
-        }, initialState, {
-            provider,
-            secretReference,
-        });
-        const importedState = await recreateManagedCoreWalletReplica(initialState, provider, paths, options.dataDir, nowUnixMs, {
-            attachService: options.attachService,
-            rpcFactory: options.rpcFactory,
-        });
-        const unlockUntilUnixMs = nowUnixMs + unlockDurationMs;
-        await clearWalletExplicitLock(paths.walletExplicitLockPath);
-        await saveUnlockSession(paths.walletUnlockSessionPath, createUnlockSession(importedState, unlockUntilUnixMs, secretReference.keyId, nowUnixMs), {
-            provider,
-            secretReference,
-        });
-        await clearPendingInitialization(paths, provider);
-        if (previousWalletRootId !== null && previousWalletRootId !== payload.walletRootId) {
-            await provider.deleteSecret(createWalletSecretReference(previousWalletRootId).keyId).catch(() => undefined);
-        }
-        await (options.attachIndexerDaemon ?? attachOrStartIndexerDaemon)({
-            dataDir: options.dataDir,
-            databasePath: options.databasePath,
-            walletRootId: importedState.walletRootId,
-        }).then((daemon) => daemon.close());
-        await ensureMainWalletSeedIndexRecord({
-            paths: resolveMainWalletPaths(paths),
-            walletRootId: importedState.walletRootId,
-            nowUnixMs,
-        });
-        return {
-            archivePath: options.archivePath,
-            walletRootId: importedState.walletRootId,
-            fundingAddress: importedState.funding.address,
-            unlockUntilUnixMs,
-            state: importedState,
-        };
-    }
-    finally {
-        await controlLock.release();
-    }
-}
 export async function restoreWalletFromMnemonic(options) {
     if (!options.prompter.isInteractive) {
         throw new Error("wallet_restore_requires_tty");
     }
     const provider = options.provider ?? createDefaultWalletSecretProvider();
+    const interactiveProvider = withInteractiveWalletSecretProvider(provider, options.prompter);
     const nowUnixMs = options.nowUnixMs ?? Date.now();
-    const unlockDurationMs = options.unlockDurationMs ?? DEFAULT_UNLOCK_DURATION_MS;
     const paths = options.paths ?? resolveWalletRuntimePathsForTesting();
     const seedName = assertValidImportedWalletSeedName(paths.selectedSeedName);
     const controlLock = await acquireFileLock(paths.walletControlLockPath, {
@@ -1556,7 +1154,8 @@ export async function restoreWalletFromMnemonic(options) {
         if (findWalletSeedRecord(seedIndex, seedName) !== null) {
             throw new Error("wallet_seed_name_exists");
         }
-        await ensureWalletNotInitialized(paths, provider);
+        const passwordAction = await ensureClientPasswordConfigured(provider, options.prompter);
+        await ensureWalletNotInitialized(paths, interactiveProvider);
         let promptPhaseStarted = false;
         let mnemonicPhrase;
         try {
@@ -1568,39 +1167,33 @@ export async function restoreWalletFromMnemonic(options) {
                 await options.prompter.clearSensitiveDisplay?.("restore-mnemonic-entry");
             }
         }
-        await clearPendingInitialization(paths, provider);
+        await clearPendingInitialization(paths, interactiveProvider);
         const material = deriveWalletMaterialFromMnemonic(mnemonicPhrase);
         const walletRootId = createWalletRootId();
         const internalCoreWalletPassphrase = createInternalCoreWalletPassphrase();
         const secretReference = createWalletSecretReference(walletRootId);
         const secret = randomBytes(32);
-        await provider.storeSecret(secretReference.keyId, secret);
+        await interactiveProvider.storeSecret(secretReference.keyId, secret);
         const initialState = createInitialWalletState({
             walletRootId,
             nowUnixMs,
             material,
             internalCoreWalletPassphrase,
         });
-        await clearUnlockSession(paths.walletUnlockSessionPath);
-        await clearWalletExplicitLock(paths.walletExplicitLockPath);
+        await clearLegacyWalletLockArtifacts(paths.walletRuntimeRoot);
         await saveWalletState({
             primaryPath: paths.walletStatePath,
             backupPath: paths.walletStateBackupPath,
         }, initialState, {
-            provider,
+            provider: interactiveProvider,
             secretReference,
         });
-        const restoredState = await recreateManagedCoreWalletReplica(initialState, provider, paths, options.dataDir, nowUnixMs, {
+        const restoredState = await recreateManagedCoreWalletReplica(initialState, interactiveProvider, paths, options.dataDir, nowUnixMs, {
             attachService: options.attachService,
             rpcFactory: options.rpcFactory,
         });
-        const unlockUntilUnixMs = nowUnixMs + unlockDurationMs;
-        await clearWalletExplicitLock(paths.walletExplicitLockPath);
-        await saveUnlockSession(paths.walletUnlockSessionPath, createUnlockSession(restoredState, unlockUntilUnixMs, secretReference.keyId, nowUnixMs), {
-            provider,
-            secretReference,
-        });
-        await clearPendingInitialization(paths, provider);
+        await clearLegacyWalletLockArtifacts(paths.walletRuntimeRoot);
+        await clearPendingInitialization(paths, interactiveProvider);
         await addImportedWalletSeedRecord({
             paths: mainPaths,
             seedName,
@@ -1608,10 +1201,10 @@ export async function restoreWalletFromMnemonic(options) {
             nowUnixMs,
         });
         return {
+            passwordAction,
             seedName,
             walletRootId,
             fundingAddress: restoredState.funding.address,
-            unlockUntilUnixMs,
             state: restoredState,
             warnings: [],
         };
@@ -1670,8 +1263,7 @@ export async function deleteImportedWalletSeed(options) {
                 await rpc.unloadWallet(walletName, false).catch(() => undefined);
             }
         }
-        await clearUnlockSession(paths.walletUnlockSessionPath).catch(() => undefined);
-        await clearWalletExplicitLock(paths.walletExplicitLockPath).catch(() => undefined);
+        await clearLegacyWalletLockArtifacts(paths.walletRuntimeRoot).catch(() => undefined);
         await clearPendingInitialization(paths, provider).catch(() => undefined);
         await provider.deleteSecret(createWalletSecretReference(seedRecord.walletRootId).keyId).catch(() => undefined);
         await rm(paths.walletStateRoot, { recursive: true, force: true }).catch(() => undefined);
@@ -1703,7 +1295,6 @@ export async function repairWallet(options) {
     const attachManagedBitcoind = options.attachService ?? attachOrStartManagedBitcoindService;
     const probeManagedIndexerDaemon = options.probeIndexerDaemon ?? probeIndexerDaemon;
     const attachManagedIndexerDaemon = options.attachIndexerDaemon ?? attachOrStartIndexerDaemon;
-    const requestMiningPreemptionForRepair = options.requestMiningPreemption ?? requestMiningGenerationPreemption;
     await clearOrphanedRepairLocks([
         paths.walletControlLockPath,
         paths.miningControlLockPath,
@@ -1713,7 +1304,6 @@ export async function repairWallet(options) {
         walletRootId: null,
     });
     try {
-        let miningPreemption = null;
         let loaded;
         try {
             loaded = await loadWalletState({
@@ -1723,7 +1313,7 @@ export async function repairWallet(options) {
                 provider,
             });
         }
-        catch {
+        catch (error) {
             throw new Error("local-state-corrupt");
         }
         const recoveredFromBackup = loaded.source === "backup";
@@ -1736,25 +1326,15 @@ export async function repairWallet(options) {
             servicePaths.indexerDaemonLockPath,
         ]);
         const preRepairMiningRuntime = await loadMiningRuntimeStatus(paths.miningStatusPath).catch(() => null);
-        const backgroundWorkerAlive = preRepairMiningRuntime?.runMode === "background"
-            && preRepairMiningRuntime.backgroundWorkerPid !== null
-            && await isProcessAlive(preRepairMiningRuntime.backgroundWorkerPid);
-        const preRepairUnlockedState = await loadUnlockedWalletState({
-            provider,
-            nowUnixMs,
+        const miningCleanup = await cleanupMiningForRepair({
             paths,
+            state: repairedState,
+            snapshot: preRepairMiningRuntime,
+            nowUnixMs,
         });
-        const miningPreRepairRunMode = backgroundWorkerAlive
-            ? "background"
-            : preRepairMiningRuntime?.runMode === "foreground"
-                ? "foreground"
-                : "stopped";
+        const miningPreRepairRunMode = miningCleanup.preRepairRunMode;
         const miningWasResumable = miningPreRepairRunMode === "background"
-            && preRepairUnlockedState !== null
             && normalizeMiningStateRecord(repairedState.miningState).state !== "repair-required";
-        const savedUnlockUntilUnixMs = miningWasResumable
-            ? preRepairUnlockedState?.session.unlockUntilUnixMs ?? null
-            : null;
         let initialBitcoindProbe = {
             compatibility: "unreachable",
             status: null,
@@ -1770,340 +1350,305 @@ export async function repairWallet(options) {
             : "none";
         let miningPostRepairRunMode = "stopped";
         let miningResumeError = null;
+        if (miningPreRepairRunMode !== "stopped" || preRepairMiningRuntime?.runMode !== "stopped") {
+            repairedState = applyRepairStoppedMiningState(repairedState);
+            repairStateNeedsPersist = true;
+        }
+        if (!(options.assumeYes ?? false)) {
+            await ensureIndexerDatabaseHealthy({
+                databasePath: options.databasePath,
+                dataDir: options.dataDir,
+                walletRootId: repairedState.walletRootId,
+                resetIfNeeded: false,
+            });
+        }
+        const bitcoindLock = await acquireFileLock(servicePaths.bitcoindLockPath, {
+            purpose: "managed-bitcoind-repair",
+            walletRootId: repairedState.walletRootId,
+            dataDir: options.dataDir,
+        });
+        let resetIndexerDatabase = false;
+        let bitcoindHandle = null;
+        let bitcoindPostRepairHealth = "unavailable";
         try {
-            miningPreemption = await requestMiningPreemptionForRepair({
-                paths,
-                reason: "wallet-repair",
+            initialBitcoindProbe = await probeManagedBitcoind({
+                dataDir: options.dataDir,
+                chain: "main",
+                startHeight: 0,
+                walletRootId: repairedState.walletRootId,
             });
-            if (backgroundWorkerAlive && preRepairMiningRuntime !== null) {
-                const miningLock = await acquireFileLock(paths.miningControlLockPath, {
-                    purpose: "wallet-repair-stop-background",
-                });
+            bitcoindCompatibilityIssue = mapBitcoindCompatibilityToRepairIssue(initialBitcoindProbe.compatibility);
+            if (initialBitcoindProbe.compatibility === "service-version-mismatch"
+                || initialBitcoindProbe.compatibility === "wallet-root-mismatch"
+                || initialBitcoindProbe.compatibility === "runtime-mismatch") {
+                const processId = initialBitcoindProbe.status?.processId ?? null;
+                if (processId === null) {
+                    throw new Error("managed_bitcoind_process_id_unavailable");
+                }
                 try {
-                    await stopBackgroundMiningForRepair({
-                        paths,
-                        snapshot: preRepairMiningRuntime,
-                        nowUnixMs,
-                    });
+                    process.kill(processId, "SIGTERM");
                 }
-                finally {
-                    await miningLock.release();
+                catch (error) {
+                    if (!(error instanceof Error) || !("code" in error) || error.code !== "ESRCH") {
+                        throw error;
+                    }
                 }
-                repairedState = applyRepairStoppedMiningState(repairedState);
-                repairStateNeedsPersist = true;
-            }
-            if (!(options.assumeYes ?? false)) {
-                await ensureIndexerDatabaseHealthy({
-                    databasePath: options.databasePath,
-                    dataDir: options.dataDir,
-                    walletRootId: repairedState.walletRootId,
-                    resetIfNeeded: false,
-                });
+                await waitForProcessExit(processId, 15_000, "managed_bitcoind_stop_timeout");
+                await clearManagedBitcoindArtifacts(servicePaths);
+                bitcoindServiceAction = "stopped-incompatible-service";
             }
-            const bitcoindLock = await acquireFileLock(servicePaths.bitcoindLockPath, {
-                purpose: "managed-bitcoind-repair",
-                walletRootId: repairedState.walletRootId,
-                dataDir: options.dataDir,
-            });
-            let resetIndexerDatabase = false;
-            let bitcoindHandle = null;
-            let bitcoindPostRepairHealth = "unavailable";
-            try {
-                initialBitcoindProbe = await probeManagedBitcoind({
-                    dataDir: options.dataDir,
-                    chain: "main",
-                    startHeight: 0,
-                    walletRootId: repairedState.walletRootId,
-                });
-                bitcoindCompatibilityIssue = mapBitcoindCompatibilityToRepairIssue(initialBitcoindProbe.compatibility);
-                if (initialBitcoindProbe.compatibility === "service-version-mismatch"
-                    || initialBitcoindProbe.compatibility === "wallet-root-mismatch"
-                    || initialBitcoindProbe.compatibility === "runtime-mismatch") {
-                    const processId = initialBitcoindProbe.status?.processId ?? null;
-                    if (processId === null) {
-                        throw new Error("managed_bitcoind_process_id_unavailable");
-                    }
-                    try {
-                        process.kill(processId, "SIGTERM");
-                    }
-                    catch (error) {
-                        if (!(error instanceof Error) || !("code" in error) || error.code !== "ESRCH") {
-                            throw error;
-                        }
-                    }
-                    await waitForProcessExit(processId, 15_000, "managed_bitcoind_stop_timeout");
+            else if (initialBitcoindProbe.compatibility === "unreachable") {
+                const hasStaleArtifacts = await pathExists(servicePaths.bitcoindStatusPath)
+                    || await pathExists(servicePaths.bitcoindPidPath)
+                    || await pathExists(servicePaths.bitcoindReadyPath)
+                    || await pathExists(servicePaths.bitcoindWalletStatusPath);
+                if (hasStaleArtifacts) {
                     await clearManagedBitcoindArtifacts(servicePaths);
-                    bitcoindServiceAction = "stopped-incompatible-service";
+                    bitcoindServiceAction = "cleared-stale-artifacts";
                 }
-                else if (initialBitcoindProbe.compatibility === "unreachable") {
-                    const hasStaleArtifacts = await pathExists(servicePaths.bitcoindStatusPath)
-                        || await pathExists(servicePaths.bitcoindPidPath)
-                        || await pathExists(servicePaths.bitcoindReadyPath)
-                        || await pathExists(servicePaths.bitcoindWalletStatusPath);
-                    if (hasStaleArtifacts) {
-                        await clearManagedBitcoindArtifacts(servicePaths);
-                        bitcoindServiceAction = "cleared-stale-artifacts";
-                    }
-                }
-                else if (initialBitcoindProbe.compatibility === "protocol-error") {
-                    throw new Error(initialBitcoindProbe.error ?? "managed_bitcoind_protocol_error");
-                }
-            }
-            finally {
-                await bitcoindLock.release();
             }
-            bitcoindHandle = await attachManagedBitcoind({
-                dataDir: options.dataDir,
-                chain: "main",
-                startHeight: 0,
-                walletRootId: repairedState.walletRootId,
-            });
-            const bitcoindRpc = (options.rpcFactory ?? createRpcClient)(bitcoindHandle.rpc);
-            const normalizedDescriptorState = await normalizeWalletDescriptorState(repairedState, bitcoindRpc);
-            if (normalizedDescriptorState.changed) {
-                repairedState = normalizedDescriptorState.state;
-                repairStateNeedsPersist = true;
+            else if (initialBitcoindProbe.compatibility === "protocol-error") {
+                throw new Error(initialBitcoindProbe.error ?? "managed_bitcoind_protocol_error");
             }
-            const reconciledCoinControl = await persistWalletCoinControlStateIfNeeded({
-                state: repairedState,
-                access: {
-                    provider,
-                    secretReference,
-                },
-                paths,
-                nowUnixMs,
-                replacePrimary: recoveredFromBackup && !repairStateNeedsPersist,
-                rpc: createRpcClient(bitcoindHandle.rpc),
+        }
+        finally {
+            await bitcoindLock.release();
+        }
+        bitcoindHandle = await attachManagedBitcoind({
+            dataDir: options.dataDir,
+            chain: "main",
+            startHeight: 0,
+            walletRootId: repairedState.walletRootId,
+        });
+        const bitcoindRpc = (options.rpcFactory ?? createRpcClient)(bitcoindHandle.rpc);
+        const normalizedDescriptorState = await normalizeWalletDescriptorState(repairedState, bitcoindRpc);
+        if (normalizedDescriptorState.changed) {
+            repairedState = normalizedDescriptorState.state;
+            repairStateNeedsPersist = true;
+        }
+        const reconciledCoinControl = await persistWalletCoinControlStateIfNeeded({
+            state: repairedState,
+            access: {
+                provider,
+                secretReference,
+            },
+            paths,
+            nowUnixMs,
+            replacePrimary: recoveredFromBackup && !repairStateNeedsPersist,
+            rpc: (options.rpcFactory ?? createRpcClient)(bitcoindHandle.rpc),
+        });
+        repairedState = reconciledCoinControl.state;
+        if (reconciledCoinControl.changed) {
+            repairStateNeedsPersist = false;
+        }
+        let replica = await verifyManagedCoreWalletReplica(repairedState, options.dataDir, {
+            nodeHandle: bitcoindHandle,
+            attachService: options.attachService,
+            rpcFactory: options.rpcFactory,
+        });
+        let recreatedManagedCoreWallet = false;
+        if (replica.proofStatus !== "ready") {
+            repairedState = await recreateManagedCoreWalletReplica(repairedState, provider, paths, options.dataDir, nowUnixMs, {
+                attachService: options.attachService,
+                rpcFactory: options.rpcFactory,
             });
-            repairedState = reconciledCoinControl.state;
-            if (reconciledCoinControl.changed) {
-                repairStateNeedsPersist = false;
-            }
-            let replica = await verifyManagedCoreWalletReplica(repairedState, options.dataDir, {
+            recreatedManagedCoreWallet = true;
+            managedCoreReplicaAction = "recreated";
+            repairStateNeedsPersist = false;
+            replica = await verifyManagedCoreWalletReplica(repairedState, options.dataDir, {
                 nodeHandle: bitcoindHandle,
                 attachService: options.attachService,
                 rpcFactory: options.rpcFactory,
             });
-            let recreatedManagedCoreWallet = false;
-            if (replica.proofStatus !== "ready") {
-                repairedState = await recreateManagedCoreWalletReplica(repairedState, provider, paths, options.dataDir, nowUnixMs, {
-                    attachService: options.attachService,
-                    rpcFactory: options.rpcFactory,
-                });
-                recreatedManagedCoreWallet = true;
-                managedCoreReplicaAction = "recreated";
-                repairStateNeedsPersist = false;
-                replica = await verifyManagedCoreWalletReplica(repairedState, options.dataDir, {
-                    nodeHandle: bitcoindHandle,
-                    attachService: options.attachService,
-                    rpcFactory: options.rpcFactory,
-                });
-            }
-            const finalBitcoindStatus = await bitcoindHandle.refreshServiceStatus?.() ?? null;
-            const chainInfo = await bitcoindRpc.getBlockchainInfo();
-            bitcoindPostRepairHealth = mapBitcoindRepairHealth({
-                serviceState: finalBitcoindStatus?.state ?? null,
-                catchingUp: chainInfo.blocks < chainInfo.headers,
-                replica,
-            });
-            if (bitcoindServiceAction === "none" && initialBitcoindProbe.compatibility === "unreachable") {
-                bitcoindServiceAction = "restarted-compatible-service";
-            }
-            let initialIndexerDaemonInstanceId = null;
-            let preAttachIndexerDaemonInstanceId = null;
-            const indexerLock = await acquireFileLock(servicePaths.indexerDaemonLockPath, {
-                purpose: "indexer-daemon-repair",
-                walletRootId: repairedState.walletRootId,
+        }
+        const finalBitcoindStatus = await bitcoindHandle.refreshServiceStatus?.() ?? null;
+        const chainInfo = await bitcoindRpc.getBlockchainInfo();
+        bitcoindPostRepairHealth = mapBitcoindRepairHealth({
+            serviceState: finalBitcoindStatus?.state ?? null,
+            catchingUp: chainInfo.blocks < chainInfo.headers,
+            replica,
+        });
+        if (bitcoindServiceAction === "none" && initialBitcoindProbe.compatibility === "unreachable") {
+            bitcoindServiceAction = "restarted-compatible-service";
+        }
+        let initialIndexerDaemonInstanceId = null;
+        let preAttachIndexerDaemonInstanceId = null;
+        const indexerLock = await acquireFileLock(servicePaths.indexerDaemonLockPath, {
+            purpose: "indexer-daemon-repair",
+            walletRootId: repairedState.walletRootId,
+            dataDir: options.dataDir,
+            databasePath: options.databasePath,
+        });
+        try {
+            const initialProbe = await probeManagedIndexerDaemon({
                 dataDir: options.dataDir,
-                databasePath: options.databasePath,
+                walletRootId: repairedState.walletRootId,
             });
-            try {
-                const initialProbe = await probeManagedIndexerDaemon({
-                    dataDir: options.dataDir,
-                    walletRootId: repairedState.walletRootId,
-                });
-                indexerCompatibilityIssue = mapIndexerCompatibilityToRepairIssue(initialProbe.compatibility);
-                initialIndexerDaemonInstanceId = initialProbe.status?.daemonInstanceId ?? null;
-                if (initialProbe.compatibility === "compatible") {
-                    await initialProbe.client?.close().catch(() => undefined);
+            indexerCompatibilityIssue = mapIndexerCompatibilityToRepairIssue(initialProbe.compatibility);
+            initialIndexerDaemonInstanceId = initialProbe.status?.daemonInstanceId ?? null;
+            if (initialProbe.compatibility === "compatible") {
+                await initialProbe.client?.close().catch(() => undefined);
+            }
+            else if (initialProbe.compatibility === "service-version-mismatch"
+                || initialProbe.compatibility === "wallet-root-mismatch"
+                || initialProbe.compatibility === "schema-mismatch") {
+                const processId = initialProbe.status?.processId ?? null;
+                if (processId === null) {
+                    throw new Error("indexer_daemon_process_id_unavailable");
                 }
-                else if (initialProbe.compatibility === "service-version-mismatch"
-                    || initialProbe.compatibility === "wallet-root-mismatch"
-                    || initialProbe.compatibility === "schema-mismatch") {
-                    const processId = initialProbe.status?.processId ?? null;
-                    if (processId === null) {
-                        throw new Error("indexer_daemon_process_id_unavailable");
-                    }
-                    try {
-                        process.kill(processId, "SIGTERM");
-                    }
-                    catch (error) {
-                        if (!(error instanceof Error) || !("code" in error) || error.code !== "ESRCH") {
-                            throw error;
-                        }
-                    }
-                    await waitForProcessExit(processId);
-                    await clearIndexerDaemonArtifacts(servicePaths);
-                    indexerDaemonAction = "stopped-incompatible-daemon";
+                try {
+                    process.kill(processId, "SIGTERM");
                 }
-                else if (initialProbe.compatibility === "unreachable") {
-                    const hasStaleArtifacts = await pathExists(servicePaths.indexerDaemonSocketPath)
-                        || await pathExists(servicePaths.indexerDaemonStatusPath);
-                    if (hasStaleArtifacts) {
-                        await clearIndexerDaemonArtifacts(servicePaths);
-                        indexerDaemonAction = "cleared-stale-artifacts";
+                catch (error) {
+                    if (!(error instanceof Error) || !("code" in error) || error.code !== "ESRCH") {
+                        throw error;
                     }
                 }
-                else {
-                    throw new Error(initialProbe.error ?? "indexer_daemon_protocol_error");
-                }
-                resetIndexerDatabase = await ensureIndexerDatabaseHealthy({
-                    databasePath: options.databasePath,
-                    dataDir: options.dataDir,
-                    walletRootId: repairedState.walletRootId,
-                    resetIfNeeded: options.assumeYes ?? false,
-                });
+                await waitForProcessExit(processId);
+                await clearIndexerDaemonArtifacts(servicePaths);
+                indexerDaemonAction = "stopped-incompatible-daemon";
             }
-            finally {
-                await indexerLock.release();
+            else if (initialProbe.compatibility === "unreachable") {
+                const hasStaleArtifacts = await pathExists(servicePaths.indexerDaemonSocketPath)
+                    || await pathExists(servicePaths.indexerDaemonStatusPath);
+                if (hasStaleArtifacts) {
+                    await clearIndexerDaemonArtifacts(servicePaths);
+                    indexerDaemonAction = "cleared-stale-artifacts";
+                }
             }
-            if (recoveredFromBackup) {
-                repairedState = await persistRepairState({
-                    state: repairedState,
-                    provider,
-                    paths,
-                    nowUnixMs,
-                    replacePrimary: true,
-                });
-                repairStateNeedsPersist = false;
+            else {
+                throw new Error(initialProbe.error ?? "indexer_daemon_protocol_error");
             }
-            else if (repairStateNeedsPersist) {
-                repairedState = await persistRepairState({
-                    state: repairedState,
-                    provider,
-                    paths,
-                    nowUnixMs,
-                });
-                repairStateNeedsPersist = false;
-            }
-            const preAttachProbe = await probeManagedIndexerDaemon({
+            resetIndexerDatabase = await ensureIndexerDatabaseHealthy({
+                databasePath: options.databasePath,
                 dataDir: options.dataDir,
                 walletRootId: repairedState.walletRootId,
+                resetIfNeeded: options.assumeYes ?? false,
             });
-            if (preAttachProbe.compatibility === "compatible") {
-                preAttachIndexerDaemonInstanceId = preAttachProbe.status?.daemonInstanceId ?? null;
-                await preAttachProbe.client?.close().catch(() => undefined);
-            }
-            else if (preAttachProbe.compatibility !== "unreachable") {
-                throw new Error(preAttachProbe.error ?? "indexer_daemon_protocol_error");
-            }
-            const daemon = await attachManagedIndexerDaemon({
+        }
+        finally {
+            await indexerLock.release();
+        }
+        if (recoveredFromBackup) {
+            repairedState = await persistRepairState({
+                state: repairedState,
+                provider,
+                paths,
+                nowUnixMs,
+                replacePrimary: true,
+            });
+            repairStateNeedsPersist = false;
+        }
+        else if (repairStateNeedsPersist) {
+            repairedState = await persistRepairState({
+                state: repairedState,
+                provider,
+                paths,
+                nowUnixMs,
+            });
+            repairStateNeedsPersist = false;
+        }
+        const preAttachProbe = await probeManagedIndexerDaemon({
+            dataDir: options.dataDir,
+            walletRootId: repairedState.walletRootId,
+        });
+        if (preAttachProbe.compatibility === "compatible") {
+            preAttachIndexerDaemonInstanceId = preAttachProbe.status?.daemonInstanceId ?? null;
+            await preAttachProbe.client?.close().catch(() => undefined);
+        }
+        else if (preAttachProbe.compatibility !== "unreachable") {
+            throw new Error(preAttachProbe.error ?? "indexer_daemon_protocol_error");
+        }
+        const daemon = await attachManagedIndexerDaemon({
+            dataDir: options.dataDir,
+            databasePath: options.databasePath,
+            walletRootId: repairedState.walletRootId,
+        });
+        try {
+            const { health: indexerPostRepairHealth, daemonInstanceId: postRepairDaemonInstanceId, } = await verifyIndexerPostRepairHealth({
+                daemon,
+                probeIndexerDaemon: probeManagedIndexerDaemon,
                 dataDir: options.dataDir,
-                databasePath: options.databasePath,
                 walletRootId: repairedState.walletRootId,
+                nowUnixMs,
             });
-            try {
-                const { health: indexerPostRepairHealth, daemonInstanceId: postRepairDaemonInstanceId, } = await verifyIndexerPostRepairHealth({
-                    daemon,
-                    probeIndexerDaemon: probeManagedIndexerDaemon,
-                    dataDir: options.dataDir,
-                    walletRootId: repairedState.walletRootId,
-                    nowUnixMs,
+            const restartedIndexerDaemon = indexerDaemonAction !== "none" || preAttachProbe.compatibility === "unreachable";
+            if (restartedIndexerDaemon
+                && initialIndexerDaemonInstanceId !== null
+                && postRepairDaemonInstanceId === initialIndexerDaemonInstanceId) {
+                throw new Error("indexer_daemon_repair_identity_not_rotated");
+            }
+            if (!restartedIndexerDaemon
+                && preAttachProbe.compatibility === "compatible"
+                && preAttachIndexerDaemonInstanceId !== null
+                && postRepairDaemonInstanceId !== preAttachIndexerDaemonInstanceId) {
+                throw new Error("indexer_daemon_repair_identity_changed");
+            }
+            if (indexerDaemonAction === "none" && preAttachProbe.compatibility === "unreachable") {
+                indexerDaemonAction = "restarted-compatible-daemon";
+            }
+            if (miningWasResumable) {
+                const postRepairResumeReady = await canResumeBackgroundMiningAfterRepair({
+                    provider,
+                    paths,
+                    repairedState,
+                    bitcoindPostRepairHealth,
+                    indexerPostRepairHealth,
                 });
-                const restartedIndexerDaemon = indexerDaemonAction !== "none" || preAttachProbe.compatibility === "unreachable";
-                if (restartedIndexerDaemon
-                    && initialIndexerDaemonInstanceId !== null
-                    && postRepairDaemonInstanceId === initialIndexerDaemonInstanceId) {
-                    throw new Error("indexer_daemon_repair_identity_not_rotated");
-                }
-                if (!restartedIndexerDaemon
-                    && preAttachProbe.compatibility === "compatible"
-                    && preAttachIndexerDaemonInstanceId !== null
-                    && postRepairDaemonInstanceId !== preAttachIndexerDaemonInstanceId) {
-                    throw new Error("indexer_daemon_repair_identity_changed");
-                }
-                if (indexerDaemonAction === "none" && preAttachProbe.compatibility === "unreachable") {
-                    indexerDaemonAction = "restarted-compatible-daemon";
+                if (!postRepairResumeReady) {
+                    miningResumeAction = "skipped-post-repair-blocked";
                 }
-                let keepUnlockSession = false;
-                if (miningWasResumable) {
-                    const postRepairResumeReady = await canResumeBackgroundMiningAfterRepair({
-                        provider,
-                        paths,
-                        repairedState,
-                        nowUnixMs,
-                        bitcoindPostRepairHealth,
-                        indexerPostRepairHealth,
-                        unlockUntilUnixMs: savedUnlockUntilUnixMs,
-                    });
-                    if (!postRepairResumeReady) {
-                        miningResumeAction = "skipped-post-repair-blocked";
-                    }
-                    else if (savedUnlockUntilUnixMs === null || savedUnlockUntilUnixMs <= nowUnixMs) {
-                        miningResumeAction = "skipped-post-repair-blocked";
-                    }
-                    else {
-                        await saveUnlockSession(paths.walletUnlockSessionPath, createUnlockSession(repairedState, savedUnlockUntilUnixMs, secretReference.keyId, nowUnixMs), {
+                else {
+                    try {
+                        const startBackgroundMining = options.startBackgroundMining
+                            ?? (await import("./mining/runner.js")).startBackgroundMining;
+                        const resumed = await startBackgroundMining({
+                            dataDir: options.dataDir,
+                            databasePath: options.databasePath,
                             provider,
-                            secretReference,
+                            paths,
+                            prompter: createSilentNonInteractivePrompter(),
                         });
-                        keepUnlockSession = true;
-                        try {
-                            const startBackgroundMining = options.startBackgroundMining
-                                ?? (await import("./mining/runner.js")).startBackgroundMining;
-                            const resumed = await startBackgroundMining({
-                                dataDir: options.dataDir,
-                                databasePath: options.databasePath,
-                                provider,
-                                paths,
-                                prompter: createSilentNonInteractivePrompter(),
-                            });
-                            if (resumed.snapshot?.runMode === "background") {
-                                miningResumeAction = "resumed-background";
-                                miningPostRepairRunMode = "background";
-                            }
-                            else {
-                                miningResumeAction = "resume-failed";
-                                miningResumeError = "Background mining did not report a background runtime after repair.";
-                            }
+                        if (resumed.snapshot?.runMode === "background") {
+                            miningResumeAction = "resumed-background";
+                            miningPostRepairRunMode = "background";
                         }
-                        catch (error) {
+                        else {
                             miningResumeAction = "resume-failed";
-                            miningResumeError = error instanceof Error ? error.message : String(error);
+                            miningResumeError = "Background mining did not report a background runtime after repair.";
                         }
                     }
+                    catch (error) {
+                        miningResumeAction = "resume-failed";
+                        miningResumeError = error instanceof Error ? error.message : String(error);
+                    }
                 }
-                if (!keepUnlockSession) {
-                    await clearUnlockSession(paths.walletUnlockSessionPath);
-                }
-                return {
-                    walletRootId: repairedState.walletRootId,
-                    recoveredFromBackup,
-                    recreatedManagedCoreWallet,
-                    resetIndexerDatabase,
-                    bitcoindServiceAction,
-                    bitcoindCompatibilityIssue,
-                    managedCoreReplicaAction,
-                    bitcoindPostRepairHealth,
-                    indexerDaemonAction,
-                    indexerCompatibilityIssue,
-                    indexerPostRepairHealth,
-                    miningPreRepairRunMode,
-                    miningResumeAction,
-                    miningPostRepairRunMode,
-                    miningResumeError,
-                    note: resetIndexerDatabase
-                        ? "Indexer artifacts were reset and may still be catching up."
-                        : null,
-                };
-            }
-            finally {
-                await daemon.close().catch(() => undefined);
-                await bitcoindHandle?.stop?.().catch(() => undefined);
             }
+            await clearLegacyWalletLockArtifacts(paths.walletRuntimeRoot);
+            return {
+                walletRootId: repairedState.walletRootId,
+                recoveredFromBackup,
+                recreatedManagedCoreWallet,
+                resetIndexerDatabase,
+                bitcoindServiceAction,
+                bitcoindCompatibilityIssue,
+                managedCoreReplicaAction,
+                bitcoindPostRepairHealth,
+                indexerDaemonAction,
+                indexerCompatibilityIssue,
+                indexerPostRepairHealth,
+                miningPreRepairRunMode,
+                miningResumeAction,
+                miningPostRepairRunMode,
+                miningResumeError,
+                note: resetIndexerDatabase
+                    ? "Indexer artifacts were reset and may still be catching up."
+                    : null,
+            };
         }
         finally {
-            await miningPreemption?.release().catch(() => undefined);
+            await daemon.close().catch(() => undefined);
+            await bitcoindHandle?.stop?.().catch(() => undefined);
         }
     }
     finally {