Operations & recovery
Archive before sealing. Reconcile with the chain. Publish before retiring.
Archive discipline
The worker persists an encrypted manifest and private ledger transition before submitting a seal. Maintain independent backups of ciphertext and key material. Public ciphertext alone does not recover a lost key.
On restart, reconstruct the canonical private ledger from confirmed PackSealed events and their matching archives. Discard orphaned chain assumptions after a reorg. Reuse a paid request only while it remains pending and unexpired; never account for a failed transaction as issuance.
Shutdown handoff
Start shutdown onchain first so sealed transfers are frozen. Export the public shutdown handoff through GET /shutdown/export on the collector API. The export contains transaction-ready reveal and aggregate actions, and preserves earlier handoff actions. It must not expose encryption keys.
Execute remaining refunds, reveals, disclosures, and expired-decision settlement through any RPC client. Record receipts, mirror the handoff, and check closure counters directly. Operators can retire only after all obligations are met.
When something fails
A stale candidate price or inventory root invalidates a proof; regenerate against canonical state while the request is live. An expired unsealed request is refunded in full. A missing reveal archive is a recovery incident, not permission to sweep funds.
Back up deployment manifests and verify chain ID, genesis hash, bytecode, policy hash, and contract relationships before reconnecting an indexer. The local monitor reconciles token custody and protected cash against onchain obligations.