Seller does not write handover after successful BUY match (funded TokenContract remains unopened)

[h2so4nackl-code]

Environment:
dexdo v0.0.15
Shellnet 4.0.27

Flow:
BUY → escrow → match succeeded

Result:
TokenContract funded=true
opened=false

Failure:
Seller did not write handover within 300 seconds.

Buyer locked:
2,050,000 raw units

No retry or cleanup submitted.

[tbuza]

Confirming this on v0.0.16 (Linux x86_64, shellnet 4.0.27) with a real remote third-party buyer — and adding the seller-side view, which makes the root cause clearer: the seller reports the open/handover as done while the chain says it never happened.

Timeline (2026-07-25, UTC, seller logs)

• Seller resting on book qwen--qwen3.6--27b (0:3a977af6…), offer RESTED, gateway up.
• 17:56:2x — remote buyer's model-only BUY matches. Seller logs:

  seller_match_opened token_contract=0:389753fcda5d39048ec1c8bd047325f842b4b5f0e26348d86469ac2c58692650 ...
  INFO dexdo::cli::seller: stream open; serving until shutdown
  

• Minutes later, seller-side dexdo status <TC> shows the local-handle view: state=probe active=true funded=true opened=true (reason=buyer_silent_probe).
• ~40 min later, the same status now reflects on-chain truth:

  state=funded-but-never-opened active=true funded=true opened=false disputed=false
  accounting finalized_owed=25000 buyer_locked=0
  

  i.e. the buyer was auto-refunded (SellerNoShow on their side — exactly what this issue reports), the seller kept only the 25000-raw probe commission, and the seller process was still running, "serving" a stream that never existed on-chain.

Why I think it's a missing on-chain confirm

• The same stack, same day, same-host (buyer and seller on one machine) works end-to-end: handover lands in ~21 s, stream delivers, clean close. Only the remote path fails.
• This seller's link to shellnet.ackinacki.org logged 7 transient GraphQL errors + 1 hard process exit the same day (seller_match_watch_network_error × 7 — the v0.0.16 match-watch retry works — plus one fatal connection reset on a path without retry).
• Hypothesis: the open/handover submission is fired into that flaky link and treated as success without verifying inclusion. v0.0.16 release notes added "close reports success confirmed on-chain before completion" — the open/handover write appears to lack the same confirm-before-report.

Suggested fix

After submitting the open/handover, poll the TC until opened=true (with retry/backoff and re-submission on timeout) before emitting seller_match_opened / "stream open". If it cannot be confirmed within the buyer's handover deadline, cancel/retire cleanly instead of serving a phantom stream — right now the seller wedges in "serving" while the buyer sees SellerNoShow.

Full journal excerpt available if useful. This reproduced twice today with a real external buyer.

[tbuza]

Update / correction to my earlier comment: on a later deal today I verified the TokenContract from a second machine with no local deal handle (dexdo status <TC> → handle=(raw)), and the chain genuinely shows state=probe funded=true opened=true while the deal is live — so the seller's open/handover tx is not being lost, my missing-confirm hypothesis was wrong for this case.

The failure signature is sharper now:

• chain: opened=true, escrow locked, probe running;
• the remote buyer's v0.0.16 client still reports "seller never completed handover" → declares SellerNoShow → auto-reclaims (their reclaim is what later flips the TC to funded-but-never-opened / refund);
• the buyer never opens a single TCP/TLS connection to the gateway after the on-chain open (verified: zero inbound handshakes, zero established sockets on the gateway port), although their pre-buy preflight connections DID reach the same gateway earlier.

So the divergence is between the buyer client's view of the handover and the chain state — the client either cannot see or cannot use (decrypt/parse) the handover the chain says is present. Same-host buyer↔seller on the identical stack works end-to-end, so it is specific to the remote-buyer path. Possibly related: every remote connection to the gateway logs rustls WARN Illegal SNI extension: ignoring IP address presented as hostname (gateway advertised as raw IP:port).

Next diagnostic when the buyer retries: dexdo buyer --resume --token-contract <TC> output from their side — it should either attach to the open deal or name the exact handover failure.

[tbuza]

Consolidated findings — 5 cross-party deals between two independent operators, all dexdo v0.0.16, shellnet 4.0.27, 2026-07-25. (Both parties in this thread; the counterparty verified the buyer-side numbers.)

#	Deal	Seller open on-chain?	Buyer live-poll saw handover?	--resume	Consumed?	Close	Paid (finalized_owed)
A	remote buy vs seller S1	✅ raw read opened=true	❌ never	not tried in time	❌	buyer auto-reclaim (SellerNoShow)	0
B	same, second attempt	✅ then reverted	❌ never	✅ attached later	✅ HTTP 200	cleanup_unopened_after_timeout	0
C	roles swapped: buy vs seller S2	❌ never (opened=false, last_advance=0 whole life)	❌ (nothing to see)	❌ HANDOVER_TIMEOUT (nothing to read)	❌	buyer reclaim → closed	0
D	scripted retry vs S1: BUY → ~90s → --resume → consume → close	✅ confirmed	❌ (skipped by design)	✅ attached, no double-pay	✅ 3× HTTP 200 real inference	buyer streamStop OK → stopped	0

Three distinct defects fall out:

1. Buyer live-buy handover poll never sees a handover that raw chain reads show exists (deals A/B/D: dexdo status <TC> from a handle-less machine reads state=probe funded=true opened=true while the live buyer still reports "seller did not write handover"). --resume reads the same handover fine. So the delivery path is healthy; the live-poll path is the broken one — matching my earlier update.

2. Seller-side open write can also genuinely fail (deal C: opened=false, last_advance=0 for the whole deal life — the literal title of this issue, on a different operator's seller/host). So the original report here is real too; it's environment-dependent, distinct from defect 1.

3. opened=true does not survive to settlement even on consumed deals. In deal D the open was confirmed on-chain, the buyer consumed 3 real completions through the gateway, and closed gracefully — yet the final chain state is stopped, opened=false, finalized_owed=0, buyer_locked=0, and the seller's probe-advance dies with drive_advance: ERR_NOT_OPEN is terminal for this unopened/no-money deal (reason=err_not_open_unopened_no_money). Escrow refunds, the seller is paid nothing.

Net effect: on v0.0.16, remote sellers cannot get paid at all — delivery works (via --resume), graceful close works, but settlement accounting is disconnected from both. Happy to provide journals/TC addresses for all five deals.

[Futurizt]

Current v0.0.17 external-seller replay is active. Shellnet currently has no eligible current-generation external SELL; the exact request for a live independent seller/ask is posted in #74: #74 (comment). This replay will also adjudicate this issue by fact. No old-generation ask will be purchased.