@cello-protocol/daemon 0.0.168 → 0.0.170

package/dist/daemon.js

@@ -67,13 +67,10 @@ import { createTelegramDoorbell } from "./telegram-doorbell.js";
 import { registerSessionContentHandlers } from "./session-content-handlers.js";
 import { createDocumentLayer, agentPublicKeyFromId } from "./document-layer.js";
 import { registerDocumentHandlers } from "./document-handlers.js";
-import { createDocumentControlNotifier } from "./document-control-notifier.js";
 import { wireContentHash } from "./wire-content-hash.js";
 import { DocumentPublish } from "./document-publish.js";
 import { createDocumentDeliveryTransport } from "./document-delivery-transport.js";
-import { DocumentDelivery } from "./document-delivery.js";
-import { sweepAgentEvicting } from "./delivery-sweep-bound.js";
-import { encodeDocumentUpdateEnvelope, DOCUMENT_UPDATE_ENCODING_V1 } from "@cello-protocol/protocol-types";
+import { ReconcileScheduler } from "./document-reconcile-scheduler.js";
 import { createSealFlows } from "./seal-flows.js";
 import { registerCloseSessionHandler } from "./close-session-handler.js";
 import { createInboundSessions } from "./inbound-sessions.js";
@@ -94,7 +91,8 @@ import { startRegistryPoll } from "./registry-poll.js";
 import { CONSENT_ACCEPTED } from "./consent-migration.js";
 import { TrustSignalStore } from "./trust-signal-store.js";
 import { countAttendance, ContentTakeLedger } from "./co-attendance.js";
-import { isOwnAwayAutoReply, AWAY_AUTO_REPLY_TEXTS } from "./away-detection.js";
+import { isOwnAwayAutoReply, AWAY_AUTO_REPLY_TEXTS, markAsAutoReply, isAutoReplyMarked } from "./away-detection.js";
+import { createDeliveryOpenRegistry } from "./delivery-open-registry.js";
 import { FrontierMismatchStore, renderFrontierMismatch } from "./frontier-mismatch.js";
 import { decodeCbor } from "@cello-protocol/protocol-types";
 // Minimal no-op KeyProvider stub for session nodes.
@@ -933,6 +931,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     logger.info("session.away.mutual.skipped", {
                         agentName,
                         sessionId,
+                        // DOD-M12B-AWAY-MARK-1: WHICH branch matched. The marker is in-band and therefore
+                        // typeable, so prefixing every message with it skips the one-shot auto-close for free —
+                        // the cost of that attack fell from "reproduce the exact away wording" to "type 15
+                        // characters". This field is what makes a peer doing it on every message visible;
+                        // without it the line reads as routine machine-to-machine traffic.
+                        matched: isAutoReplyMarked(text) ? "marker" : "legacy_exact",
                         impact: "no away reply and no one-shot seal — two away agents must not notarize a conversation nobody had",
                     });
                     return;
@@ -956,7 +960,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // Reviewer F2: token at the END — the daemon's own output must honor the
                     // DOD-SIGNAL-TOKEN-1 append-at-end contract that DOD-WRAP-SUBSTRING-1 detection
                     // is anchored on (a counterparty daemon's end-anchored detector must see this close).
-                    const rejectText = "This inbox only accepts one message per visit. Closing. [[WRAP]]";
+                    // DOD-M12B-AWAY-MARK-1: machine-generated, so it is marked — and the marker goes at the
+                    // FRONT precisely so [[WRAP]] keeps the end position the counterparty's detector anchors on.
+                    const rejectText = markAsAutoReply("This inbox only accepts one message per visit. Closing. [[WRAP]]");
                     const rejectBytes = new TextEncoder().encode(rejectText);
                     const rejectHash = wireContentHash(rejectBytes);
                     // Best-effort: a send failure still triggers the seal — we are closing regardless.
@@ -969,9 +975,15 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // session is unsealable for good.
                     if (sendResult.ok || sendResult.durable) {
                         const rejectHashHex = Buffer.from(rejectHash).toString("hex");
-                        const { leafIndex } = sessionNodeManager.appendSessionLeaf(agentName, sessionId, "msg", rejectHashHex, randomUUID());
-                        sessionNodeManager.recordTranscriptMessage(agentName, sessionId, leafIndex, "sent", rejectBytes, randomUUID());
-                        logger.info("session.away.inbox.oneshot.rejected", { agentName, sessionId, sequenceNumber: leafIndex, queued: !sendResult.ok });
+                        // DOD-M12B-INDEX-1: at the relay's position, not the tail. This is the riskiest append
+                        // in the codebase for that — the seal is initiated a few lines below, so a leaf at the
+                        // wrong index does not merely stall the far side, it seals a tree the counterparty can
+                        // never agree with.
+                        const placed = sessionNodeManager.placeOwnLeaf(agentName, sessionId, rejectHashHex, rejectBytes, sendResult.sequenceNumber, randomUUID());
+                        if (placed.placed) {
+                            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placed.leafIndex, "sent", rejectBytes, randomUUID());
+                        }
+                        logger.info("session.away.inbox.oneshot.rejected", { agentName, sessionId, sequenceNumber: placed.placed ? placed.leafIndex : placed.heldAt, committed: placed.placed, queued: !sendResult.ok });
                     }
                     else {
                         // Not queued anywhere — the rejection is gone. We still seal (we are closing regardless),
@@ -1105,6 +1117,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
         try {
             // DOD-AWAY-TIER-1: resolve most-specific-first — per-contact away_message → per-tier away
             // (settings) → agent default (settings) → the system default (code, per kind). Total.
+            // DOD-M12B-AWAY-MARK-1: THE choke point. Every away reply this daemon sends passes through
+            // this one expression — the per-contact message, the per-tier message, the agent default, the
+            // system default and the stranger ack — so marking here is what makes "an operator's
+            // CONFIGURED away message is indistinguishable from a person" go away, which is the half
+            // exact-text matching could not reach by construction. markAsAutoReply is idempotent, so the
+            // system defaults (already marked at their source) do not pick up a second token.
             const awayText = sessionNodeManager.resolveAwayMessage(agentName, record.counterparty_pubkey)
                 ?? (isKnown ? systemDefault : STRANGER_TEXT);
             const draftBytes = new TextEncoder().encode(awayText);
@@ -1123,9 +1141,16 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 logger.error("session.away.response.redact_without_content", { agentName, sessionId, kind });
                 return;
             }
-            const contentBytes = awayVerdict.disposition === "redact" && awayVerdict.content !== undefined
+            // DOD-M12B-AWAY-MARK-1: mark AFTER screening, never before. A redact verdict REPLACES the
+            // bytes, and marking the draft would let that replacement silently strip the marker — an away
+            // reply back on the wire indistinguishable from a person, with no log line saying so. Marking
+            // here also means the gateway screens the operator's actual disclosure rather than a daemon
+            // token bolted to the front of it. markAsAutoReply is idempotent and the system defaults are
+            // marked at their source, so nothing gains a second token.
+            const screenedBytes = awayVerdict.disposition === "redact" && awayVerdict.content !== undefined
                 ? new Uint8Array(awayVerdict.content)
                 : draftBytes;
+            const contentBytes = new TextEncoder().encode(markAsAutoReply(new TextDecoder().decode(screenedBytes)));
             const contentHash = wireContentHash(contentBytes);
             const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, contentBytes, new Uint8Array(contentHash), randomUUID());
             if (!sendResult.ok && !sendResult.durable) {
@@ -1151,17 +1176,31 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 //
                 // The dedup guard deliberately STAYS SET: a queued reply is coming, and re-sending on the
                 // next arrival would mint a second greeting at a second sequence.
-                const { leafIndex: queuedLeaf } = sessionNodeManager.appendSessionLeaf(agentName, sessionId, "msg", contentHashHex, randomUUID());
-                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, queuedLeaf, "sent", contentBytes, randomUUID());
+                // DOD-M12B-INDEX-1: the queued reply owns the position the relay witnessed for it, and
+                // that is where its leaf goes.
+                const placedQueued = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID());
+                if (placedQueued.placed) {
+                    sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedQueued.leafIndex, "sent", contentBytes, randomUUID());
+                }
                 logger.info("session.away.response.deferred", {
-                    agentName, sessionId, kind, isKnown, sequenceNumber: queuedLeaf,
+                    agentName, sessionId, kind, isKnown,
+                    sequenceNumber: placedQueued.placed ? placedQueued.leafIndex : placedQueued.heldAt,
+                    committed: placedQueued.placed,
                     reason: sendResult.reason, cause: sendResult.cause,
                 });
                 return;
             }
-            const { leafIndex } = sessionNodeManager.appendSessionLeaf(agentName, sessionId, "msg", contentHashHex, randomUUID());
-            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, leafIndex, "sent", contentBytes, randomUUID());
-            logger.info("session.away.response.sent", { agentName, sessionId, kind, isKnown, sequenceNumber: leafIndex });
+            // DOD-M12B-INDEX-1: the away responder fires while inbound is still arriving, so it is the
+            // path most likely to have a gap open under it — exactly where a tail append does damage.
+            const placedReply = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID());
+            if (placedReply.placed) {
+                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedReply.leafIndex, "sent", contentBytes, randomUUID());
+            }
+            logger.info("session.away.response.sent", {
+                agentName, sessionId, kind, isKnown,
+                sequenceNumber: placedReply.placed ? placedReply.leafIndex : placedReply.heldAt,
+                committed: placedReply.placed,
+            });
         }
         catch (err) {
             // Reviewer MEDIUM fix: same as above — an unexpected throw must not permanently lock out
@@ -1213,10 +1252,88 @@ async function startDaemonHoldingLock(config, singletonLock) {
         });
         return { who: resolved.who, whoKnown: resolved.whoKnown };
     }
+    // SYNC-P5: assigned when the document layer is wired (below); the state-change hook runs for
+    // sessions, which exist only after startup completes — the guard covers the boot window where
+    // agent restoration can dispatch state events before the scheduler exists.
+    let reconcileScheduler;
+    let documentOwnerKeyForHook;
+    // DOD-M12B-DELIVERY-QUIET-1: which peers this daemon's document delivery worker is mid-dial to.
+    // Read by BOTH reachability triggers and by the doorbell below. See delivery-open-registry.ts for
+    // why this records an intent keyed on the peer rather than the session id — the short version is
+    // that the directory mints the id and pushes the assignment to the counterparty before the opener
+    // ever sees it, so on a one-daemon pair the inbound doorbell fires first and a session-id
+    // registry is always too late.
+    const deliveryOpens = createDeliveryOpenRegistry();
+    /**
+     * An agent's own pubkey, synchronously. The registry keys on PUBKEYS at both ends because that is
+     * the only pair the dialling side and the accepting side can both name — the accepting side never
+     * learns the dialler's local agent name, and the dialling side never learns ours.
+     */
+    const pubkeyOfAgent = (name) => loadedAgents.find((a) => a.name === name)?.pubkey ?? "";
+    /**
+     * Is a delivery worker mid-dial from `openerPubkey` to `targetPubkey`?
+     *
+     * One predicate, passed to every consumer, so the doorbell, the phone and both reachability
+     * triggers cannot drift apart on the answer. An unresolvable agent yields "" and never matches,
+     * which fails OPEN — an unknown agent rings rather than being silently muted.
+     */
+    const isDeliveryOpenInFlight = (openerPubkey, targetPubkey) => openerPubkey !== "" && targetPubkey !== "" && deliveryOpens.isDeliveryOpening(openerPubkey, targetPubkey);
+    /**
+     * The ACCEPTING side's question: "did a delivery worker on `openerPubkey`'s daemon dial the local
+     * agent `targetAgentName`?"
+     *
+     * A named predicate rather than a reversed call, because getting the order wrong here is exactly
+     * the defect this line was re-opened to fix: the accepting side naturally reaches for its own
+     * agent first, which compares the receiver's tuple against a registry holding the dialler's and
+     * silently never matches.
+     */
+    const isDeliveryOpenToAgent = (openerPubkey, targetAgentName) => isDeliveryOpenInFlight(openerPubkey, pubkeyOfAgent(targetAgentName));
     function dispatchSessionStateChangedWithTelegram(agentName, sessionId, state, counterpartyPubkey) {
+        // DOD-M12B-DELIVERY-QUIET-1: this session came up because a DELIVERY WORKER dialled, so its
+        // creation is machine traffic — not news about the peer, not a conversation, and not something
+        // to buzz a phone about. Scoped to `created` on purpose: a session going DOWN is news whoever
+        // opened it, and it is the operator's only signal that a conversation was cut off.
+        //
+        // ARGUMENTS ARE REVERSED HERE, AND THAT IS THE POINT. This function runs on the side that
+        // ACCEPTED, so the opener is the COUNTERPARTY and the target is US. Asking
+        // `(agentName, counterpartyPubkey)` — our own agent first, like the initiator half does — is
+        // what made the first version of this guard unreachable in production: it compared the
+        // receiver's tuple against a registry holding the dialler's.
+        if (state === "created" && counterpartyPubkey !== null && isDeliveryOpenToAgent(counterpartyPubkey, agentName)) {
+            // Suppression is LOGGED. A doorbell that silently stops ringing is the next defect, and the
+            // measured storm was so hard to read precisely because nothing named its cause.
+            logger.info("session.doorbell.suppressed_delivery", {
+                agentName, sessionId, state, opener: counterpartyPubkey.slice(0, 16),
+                impact: "document delivery opened this session — no doorbell, no phone push, no backoff reset",
+            });
+            return;
+        }
         // MONIKER-4 AC2: stamp who/whoKnown on the counterparty-bearing frame. Resolved BEFORE the
-        // offered-name drop below so a terminal state's own doorbell still shows the name.
+        // offered-name drop below so a terminal state's own doorbell still shows the name. Below the
+        // guard: on a suppressed event it was computed and thrown away.
         const who = counterpartyPubkey ? resolveWho(agentName, counterpartyPubkey, sessionId) : undefined;
+        // SYNC-P5 (R39): a session coming up IS the party-became-reachable signal — every shared
+        // document gets a reconcile attempt, and the scheduler's backoff resets (they just answered).
+        // Sound ONLY when the peer caused it, which is what the guard above establishes.
+        if (reconcileScheduler && documentOwnerKeyForHook && counterpartyPubkey && state === "created") {
+            const ownerAgentId = documentOwnerKeyForHook(agentName);
+            if (ownerAgentId !== null) {
+                // DOD-M12B-DELIVERY-QUIET-1: the trigger FIRING is logged, not only its failure. This is
+                // the storm driver — it zeroes the backoff and sweeps every shared document — and it was
+                // invisible in the log unless it threw, so 321 attempts in 85 minutes named no cause. It is
+                // also the only way either direction of the delivery exemption is observable.
+                logger.info("document.reconcile.reachable_trigger_fired", {
+                    agentName, trigger: "inbound_session_created", peer: counterpartyPubkey.slice(0, 16),
+                });
+                void reconcileScheduler
+                    .onReachable(ownerAgentId, counterpartyPubkey.toLowerCase())
+                    .catch((err) => {
+                    logger.warn("document.reconcile.reachable_trigger_failed", {
+                        agentName, reason: err instanceof Error ? err.message : String(err),
+                    });
+                });
+            }
+        }
         notificationDispatcher.dispatchSessionStateChanged(agentName, sessionId, state, counterpartyPubkey, who);
         void sendTelegramDoorbell(agentName, sessionId, "state_change", `Session ${state}`);
         // Reviewer HIGH fix (a60d68ed): telegramRungUnread had NO cleanup at all — a session that
@@ -1608,7 +1725,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // down below the module. Construction is synchronous and its deps are all ready — the handlers
     // it registers are fine this early because the handler map already exists.
     // Seam 2: inbound session establishment — the counterparty side (inbound-sessions.ts).
-    const { registerHandlers: registerInboundSessionHandlers, wirePerAgentSessionInbound, handleTrustSignalPickup, enqueueInboundSession, reapExpiredInboundSessions, inboundSessionQueues, inboundSessionWaiters, expiredSessionRequests, refusedSessionRequests, offeredMonikers, offerKey, } = createInboundSessions({
+    const { registerHandlers: registerInboundSessionHandlers, wirePerAgentSessionInbound, handleTrustSignalPickup, enqueueInboundSession, recordRefusal, reapExpiredInboundSessions, inboundSessionQueues, inboundSessionWaiters, expiredSessionRequests, refusedSessionRequests, offeredMonikers, offerKey, } = createInboundSessions({
         logger,
         sessionNodeManager,
         agents,
@@ -1625,6 +1742,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
         sendAwayResponse,
         dispatchSessionStateChangedWithTelegram,
         sendTelegramDoorbell,
+        isDeliveryOpenToAgent,
     });
     if (!sharedSignaling) {
         for (const agent of loadedAgents) {
@@ -1671,6 +1789,29 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // unbounded and confuse. The list is also capped; the full, queryable history is `cello sessions`
     // / cello_list_sessions (with filter + limit flags).
     const STATUS_RESUMABLE_CAP = 10;
+    /**
+     * DOD-M12B-SEAL-STUCK-1 — ask the seal gate for ONE session, and never let the answer take the
+     * status response with it.
+     *
+     * This runs per session on every `cello status` and every `cello_status`, and it touches the
+     * database. An unguarded throw here rejects the whole response, after which the CLI finds the
+     * singleton lock still held and prints `daemon: "broken_shutdown"` — telling the operator their
+     * healthy daemon has failed to stop, over one session row it could not read. There is a
+     * documented precedent in this codebase for exactly that shape.
+     *
+     * A failure yields `unknown`, never `ready`: "we could not check" must not read as "safe to
+     * close", because a close on a short chain is terminal.
+     */
+    function probeSealReadiness(agentName, sessionId) {
+        try {
+            return sessionNodeManager.sealReadinessView(agentName, sessionId);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logger.warn("session.seal.readiness.probe.failed", { agentName, sessionId, error: message });
+            return { state: "unknown", reason: `probe_failed: ${message}` };
+        }
+    }
     function buildInterruptedSessions() {
         return sessionNodeManager
             .getSessionsByStatus("interrupted")
@@ -1685,6 +1826,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // DOD-SESSION-NAME-1 (AC-A11): an interrupted session is one you may want to resume or seal
             // — the name is how you tell which one it was.
             sessionName: row.session_name ?? null,
+            // DOD-M12B-SEAL-STUCK-1: the same answer the active list carries, for the same reason —
+            // an interrupted session can seal, so it can also be blocked from sealing by a gap, and
+            // that is knowable here instead of only after a failed close. A plain property, never a
+            // spread: a spread bypasses excess-property checking, which is how `frontierMismatch`
+            // below came to typecheck while no renderer could read it.
+            sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
             // DOD-FRONTIER-STRAND-1 AC3: if a seal exchange has already proved the two sides disagree on
             // how many messages this session holds, SAY SO HERE. Otherwise a stranded session is listed
             // exactly like a healthy paused one, and the only way to learn it can never seal is to
@@ -1716,7 +1863,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 continue;
             if (now - row.created_at <= HALF_OPEN_TTL_MS)
                 continue; // too young — may just be setting up
-            if (sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id) === "alive")
+            // DOD-M12B-ACK-1: 'impaired' counts as live HERE. This reaper's question is "did the
+            // counterparty ever establish?", and impaired means it did — the connection is up, only
+            // delivery on it is failing. Reaping on impaired would abandon exactly the sessions this
+            // milestone exists to repair.
+            const liveness = sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id);
+            if (liveness === "alive" || liveness === "impaired")
                 continue; // live
             if (sessionNodeManager.countReceivedMessages(row.agent_name, row.session_id) > 0)
                 continue; // counterparty spoke
@@ -1741,13 +1893,19 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // was invisible to the operator.
     function buildActiveSessions() {
         reapDeadHalfOpenSessions(); // CC-5/F21: drop provably-dead half-open sessions before surfacing active ones
-        return sessionNodeManager.getSessionsByStatus("active").map((row) => ({
-            sessionId: row.session_id,
-            agentName: row.agent_name,
-            counterpartyPubkey: row.counterparty_pubkey,
-            liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
-            sessionName: row.session_name ?? null, // DOD-SESSION-NAME-1 (AC-A11)
-        }));
+        return sessionNodeManager.getSessionsByStatus("active").map((row) => {
+            // DOD-M12B-SEAL-STUCK-1: ask the SAME gate the close path asks, so the surface and the
+            // refusal can never disagree. Computed here rather than cached because the answer changes
+            // the moment a gap fills, and a stale "stuck" is its own lie.
+            return {
+                sessionId: row.session_id,
+                agentName: row.agent_name,
+                counterpartyPubkey: row.counterparty_pubkey,
+                liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
+                sessionName: row.session_name ?? null, // DOD-SESSION-NAME-1 (AC-A11)
+                sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
+            };
+        });
     }
     /**
      * The state an operator sees, for one agent — used by BOTH status surfaces.
@@ -2927,6 +3085,38 @@ async function startDaemonHoldingLock(config, singletonLock) {
         handlers,
         logger,
         sessionNodeManager,
+        // SYNC-P5 (R39, review F5): the INITIATOR-side reachable trigger — the inbound side fires
+        // from the session-state dispatch; without this half, only the answering daemon reconciled
+        // on session-up and the initiator waited out a sweep interval.
+        onSessionOpened: (agentName, counterpartyPubkey) => {
+            if (!reconcileScheduler || !documentOwnerKeyForHook)
+                return;
+            // DOD-M12B-DELIVERY-QUIET-1: the INITIATOR half of the same circularity. This hook fires
+            // inside openSessionAs, which the delivery worker's adapter brackets with begin/release — so
+            // the intent is still in flight here and the check needs no plumbing of its own. Resetting
+            // the backoff on a session WE opened to deliver a frame wipes a refusal the peer may have
+            // given seconds ago and immediately sweeps every document, which opens more sessions.
+            // We are the OPENER here, so our own pubkey goes first — the mirror of the inbound half above.
+            if (isDeliveryOpenInFlight(pubkeyOfAgent(agentName), counterpartyPubkey)) {
+                logger.debug("document.reconcile.reachable_trigger_skipped", {
+                    agentName, reason: "session_opened_by_document_delivery",
+                });
+                return;
+            }
+            const ownerAgentId = documentOwnerKeyForHook(agentName);
+            if (ownerAgentId === null)
+                return;
+            logger.info("document.reconcile.reachable_trigger_fired", {
+                agentName, trigger: "outbound_session_opened", peer: counterpartyPubkey.slice(0, 16),
+            });
+            void reconcileScheduler
+                .onReachable(ownerAgentId, counterpartyPubkey.toLowerCase())
+                .catch((err) => {
+                logger.warn("document.reconcile.reachable_trigger_failed", {
+                    agentName, reason: err instanceof Error ? err.message : String(err),
+                });
+            });
+        },
         getConnState: (connectionId) => perConnectionState.get(connectionId),
         resolveCurrentAgent,
         NO_CURRENT_AGENT_RESPONSE,
@@ -3145,6 +3335,45 @@ async function startDaemonHoldingLock(config, singletonLock) {
             }
             return { ok: true };
         });
+        // DOD-M12B-DELIVERY-QUIET-1: drive the delivery-open intent directly, so the doorbell exemption
+        // is testable without standing up a document, a peer daemon and a real directory negotiation.
+        // The registry's begin() hands back a closure, so the releases are held here by key.
+        // The hook takes AGENT NAMES and resolves both to pubkeys through `pubkeyOfAgent`, exactly as the
+        // real delivery adapter does. That is deliberate: the first version of this hook let a test
+        // register a tuple production never produces — an agent registered as the dialler and then
+        // emitted as the receiver of its own dial — so the suite proved the guard's boolean logic and
+        // nothing about the wiring, and stayed green against a guard that could never fire.
+        const testDeliveryReleases = new Map();
+        // DOD-M12B-INBOX-TRUTH-1: seed a refusal, so the ended-unread return branch's lost
+        // `refused_session_requests` has a regression test. The field had none before or after the fix.
+        handlers.set("__test_record_refusal", async (params, _connectionId) => {
+            const agentName = params?.agentName;
+            const sessionId = params?.sessionId;
+            if (!agentName || !sessionId)
+                return { error: "missing_params", guidance: "Provide agentName and sessionId." };
+            recordRefusal(agentName, sessionId, params?.counterpartyPubkey ?? "", params?.reason ?? "test");
+            return { ok: true };
+        });
+        handlers.set("__test_delivery_open_begin", async (params, _connectionId) => {
+            const openerAgent = params?.openerAgent;
+            const targetAgent = params?.targetAgent;
+            if (!openerAgent || !targetAgent)
+                return { error: "missing_params", guidance: "Provide openerAgent and targetAgent (both agent NAMES)." };
+            const openerPubkey = pubkeyOfAgent(openerAgent);
+            const targetPubkey = pubkeyOfAgent(targetAgent);
+            testDeliveryReleases.set(`${openerAgent}>${targetAgent}`, deliveryOpens.begin(openerPubkey, targetPubkey));
+            return { ok: true, openerPubkey, targetPubkey };
+        });
+        handlers.set("__test_delivery_open_end", async (params, _connectionId) => {
+            const openerAgent = params?.openerAgent;
+            const targetAgent = params?.targetAgent;
+            if (!openerAgent || !targetAgent)
+                return { error: "missing_params", guidance: "Provide openerAgent and targetAgent (both agent NAMES)." };
+            const key = `${openerAgent}>${targetAgent}`;
+            testDeliveryReleases.get(key)?.();
+            testDeliveryReleases.delete(key);
+            return { ok: true };
+        });
         // M8C-INBOX-1: test hook to enqueue a pending inbound session request (mirrors the real inbound
         // flow's enqueueInboundSession) so cello_check_notifications' pending_session_requests is testable
         // without standing up the full libp2p inbound path.
@@ -3310,14 +3539,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
     };
     // Create and start IPC server
     const ipcServer = createIpcServer({ socketPath, maxConnections, logger }, renderedHandlers);
-    try {
-        await ipcServer.start();
-    }
-    catch (err) {
-        // As above: startDaemon's catch releases the singleton lock for us.
-        await removeLockIfOwned(lockFilePath, process.pid, logger);
-        throw err;
-    }
+    // THE SOCKET OPENS LAST — see the deferred start below. Accepting clients here would accept
+    // `cello_start_agent`, which brings an agent online, creates its standing receiver, and drains
+    // parked content — all of it arriving before the document frame hook exists.
     // MCP-002: Instantiate NotificationDispatcher (wired to IPC server)
     const notificationDispatcher = new NotificationDispatcher({
         logger,
@@ -3387,6 +3611,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             });
             return sent.ok ? { ok: true } : { ok: false, reason: sent.reason };
         },
+        // Read LAZILY: the scheduler is constructed after this layer (it consumes the layer's sweep
+        // targets), so the binding must be resolved at call time rather than captured here.
+        onPeerRefusal: (ownerAgentId, peerAgentId, terminal) => reconcileScheduler?.noteRefusal(ownerAgentId, peerAgentId, terminal),
         // ONE implementation, shared with the two-party test. It was a closure here, and that is exactly
         // how the surface tests passed while the feature did nothing: the test wired this seam to
         // `async () => ({ ok: true })`, which reported success, sent nothing, and agreed with whatever
@@ -3399,38 +3626,6 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 return;
             notificationDispatcher.dispatchDocumentWatch(agentName, documentId, paths);
         },
-        notifyPeer: createDocumentControlNotifier({
-            get store() {
-                // Lazily, because `documentLayer` is what is being constructed. The notifier is only ever
-                // called from lifecycle, long after construction returns.
-                return documentLayer.store;
-            },
-            owners: () => loadedAgents
-                .filter((a) => a.pubkey)
-                .map((a) => ({ agentName: a.name, ownerAgentId: a.pubkey.toLowerCase() })),
-            // DOD-MP-CONTROL-N-1 — the ONE implementation, on the layer, shared with every test fixture.
-            // A closure here instead would be untested by construction and hand-copied into fixtures
-            // that cannot disagree with it, which is exactly how the original defect survived.
-            holders: (ownerAgentId, documentId) => documentLayer.controlHolders(ownerAgentId, documentId),
-            sign: async (agentName, tbs) => {
-                const provider = keyProviders.get(agentName);
-                if (!provider)
-                    throw new Error(`document_control_unsigned: no key provider for ${agentName}`);
-                return provider.sign(tbs);
-            },
-            send: (agentName, input) => documentTransportFor(agentName).sendBytes(input),
-            // Given a logger so a signing failure is REPORTED rather than swallowed — the reason a
-            // local key fault used to reach the operator dressed as an absent peer.
-            logger,
-            now: () => Date.now(),
-        }),
-        rollback: () => ({
-            // Likewise: withdraw REFUSES rather than claiming a rollback that did not happen. Reporting
-            // success having reverted nothing tells an operator their update was retracted while their
-            // file still contains it.
-            ok: false,
-            reason: "document_rollback_not_wired",
-        }),
         sign: async (ownerAgentId, tbs) => {
             // Signs as the OWNING agent, over the rejection's canonical preimage (DOD-DOC-REJECT-2).
             //
@@ -3467,14 +3662,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // agent, sessions belong to one agent, and `openSessionFor` signs as one agent. A single worker
     // with an agent-shaped hole in it is how a delivery ends up sent under the wrong identity.
     //
-    // CACHED per agent. A worker rebuilt every tick has its own re-entry guard (`#inFlight`)
-    // constructed away — permanently null, and the comment claiming it protected anything was wrong.
-    // The sweep's serial loop happens to cover it today; a cached worker means it is covered because
-    // the guard exists, not by accident of loop shape.
-    const documentDeliveryWorkers = new Map();
-    // Cached separately from the worker because the OPERATOR SURFACE needs it too: a proposal is not
-    // in the envelope log — there is no document yet — so it has no delivery record to schedule, and
-    // it still has to travel the same open-or-reuse-then-seal path an update does.
+    // The frame carrier, cached per agent (SYNC-P4: the delivery worker and its sweep are deleted —
+    // scheduling returns as the P5 reconcile triggers).
     const documentTransports = new Map();
     const documentTransportFor = (agentName) => {
         const cached = documentTransports.get(agentName);
@@ -3504,13 +3693,25 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 .map((row) => row.session_id)
                 .reverse(),
             openSession: async (agent, peerAgentId, correlationId) => {
-                // The same path `cello_initiate_session` takes, now callable without an IPC connection.
-                const res = (await openSessionFor(agent, { targetPubkey: peerAgentId }));
-                if (res.ok !== true || typeof res.sessionId !== "string") {
-                    return { ok: false, reason: res.reason ?? "session_open_failed", guidance: res.guidance };
+                // DOD-M12B-DELIVERY-QUIET-1: THIS is the only place the delivery worker opens a session,
+                // so bracketing it is what makes "who opened this" knowable everywhere else. The window
+                // must cover the whole open — the inbound doorbell on a co-resident pair fires DURING
+                // negotiation, and the initiator-side reachability hook fires just before this returns.
+                // Released in `finally`: a throw that left the intent registered would silence this
+                // peer's doorbell for the life of the process, which is a worse outage than the storm.
+                const releaseDeliveryOpen = deliveryOpens.begin(pubkeyOfAgent(agent), peerAgentId);
+                try {
+                    // The same path `cello_initiate_session` takes, now callable without an IPC connection.
+                    const res = (await openSessionFor(agent, { targetPubkey: peerAgentId }));
+                    if (res.ok !== true || typeof res.sessionId !== "string") {
+                        return { ok: false, reason: res.reason ?? "session_open_failed", guidance: res.guidance };
+                    }
+                    logger.info("document.delivery.session_opened", { agent, peerAgentId, sessionId: res.sessionId, correlationId });
+                    return { ok: true, sessionId: res.sessionId };
+                }
+                finally {
+                    releaseDeliveryOpen();
                 }
-                logger.info("document.delivery.session_opened", { agent, peerAgentId, sessionId: res.sessionId, correlationId });
-                return { ok: true, sessionId: res.sessionId };
             },
             sealSession: async (agent, sessionId, correlationId) => {
                 // §16.4: the autonomous session still carries the seal — the ceremony goes to zero, the
@@ -3541,97 +3742,25 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // The `0x04` doc leaf for a frame WE sent — the same step `cello_send` takes after its own
             // successful send. See the comment at the call site for why this is delivery-critical and
             // not audit bookkeeping.
-            appendLeaf: (agent, sessionId, contentHash, correlationId) => {
-                sessionNodeManager.appendSessionLeaf(agent, sessionId, "doc", Buffer.from(contentHash).toString("hex"), correlationId);
-            },
-            encodeEnvelope: (envelope) => {
-                const bytes = encodeDocumentUpdateEnvelope({
-                    type: "document_update",
-                    document_id: envelope.documentId,
-                    epoch_id: envelope.epochId,
-                    doc_prev_hash: envelope.docPrevHash,
-                    sender_agent_id: envelope.senderAgentId,
-                    sender_client_id: envelope.senderClientId ?? 0,
-                    update_encoding: DOCUMENT_UPDATE_ENCODING_V1,
-                    state_vector: envelope.stateVector,
-                    update: envelope.payload ?? new Uint8Array(0),
-                    signature: envelope.signature,
-                });
-                // Same defect as `sendBytes` had, on the UPDATE path: the receiver recomputes with the
-                // `0x00` domain prefix, so a bare hash is discarded at the authenticity check.
-                return { bytes, hash: wireContentHash(bytes) };
-            },
-            // The owner KEY, not the agent name — every document row is scoped by our own pubkey hex
-            // (M14-D5), and the store query behind this reads that column. Passing the name here
-            // returns no rows and the wait times out on every delivery.
-            awaitAck: async (envelopeHash, expectedAckerAgentId, timeoutMs) => {
-                const ownerKey = documentOwnerKeyFor(agentName);
-                if (ownerKey === null) {
-                    // NOT "the peer stayed silent". `false` means the grace expired with no answer, and the
-                    // caller logs exactly that — `graceMs: 10000`, a claim that ten seconds elapsed when
-                    // none did, about a peer that was never asked. A delivery worker running for an agent
-                    // whose own pubkey cannot be resolved is a wiring bug, and it says so here rather than
-                    // arriving downstream dressed as a fact about the counterparty. Same distinction
-                    // `abandoned_at` exists to keep: giving up is our decision, not evidence about them.
-                    logger.error("document.delivery.ack_wait_unwired", { agentName, envelopeHash });
-                    return null;
-                }
-                return documentLayer.awaitAck(ownerKey, envelopeHash, expectedAckerAgentId, timeoutMs);
-            },
-            drainHeld: async (sessionId, correlationId) => {
-                // ONLY WHEN THERE IS A GAP. `sealReadiness` already answers exactly this question, and
-                // gating on it keeps the ordinary delivery — the overwhelming majority — free of a relay
-                // round trip it does not need.
-                const readiness = sessionNodeManager.sealReadiness(agentName, sessionId);
-                if (readiness.heldCount === 0 && readiness.missingLeaves === 0)
-                    return;
-                logger.info("document.delivery.drain_held", {
-                    agentName,
-                    sessionId,
-                    heldCount: readiness.heldCount,
-                    missingLeaves: readiness.missingLeaves,
-                    correlationId,
-                });
-                await autoRecoverForAgent(agentName, "delivery_ack_grace").catch((err) => {
-                    // CONTAINED. A recovery that fails leaves the ack held and the grace expires — the same
-                    // outcome as before, and never a reason to fail a delivery whose content already left.
-                    logger.warn("document.delivery.drain_held_failed", {
-                        agentName,
-                        sessionId,
-                        correlationId,
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                });
+            appendLeaf: (agent, sessionId, contentHash, frameBytes, correlationId, assignedSeq) => {
+                // DOD-M12B-INDEX-1: a document leaf takes a position in the CONVERSATION's sequence space
+                // (deliberate — f75ea09), so it obeys the same discipline a message does — including
+                // being HELD when the position is ahead of the tail, which is why the real frame bytes
+                // have to travel with it.
+                const placed = sessionNodeManager.placeOwnLeaf(agent, sessionId, Buffer.from(contentHash).toString("hex"), frameBytes, assignedSeq, correlationId, "doc");
+                return { placed: placed.placed, leafIndex: placed.placed ? placed.leafIndex : null };
             },
         });
         documentTransports.set(agentName, transport);
         return transport;
     };
-    const documentDeliveryFor = (agentName) => {
-        const existing = documentDeliveryWorkers.get(agentName);
-        if (existing)
-            return existing;
-        const worker = new DocumentDelivery(documentLayer.store, documentTransportFor(agentName), logger, 
-        // DOD-MP-CONTROL-DURABLE-1 — control frames derive their recipients the way the NOTIFIER
-        // does, not the way envelopes do. `holdersFor` returns null for a document with no stored
-        // genesis proposal; `controlHolders` has an explicit legacy branch for it. Deriving the two
-        // halves differently turned a seeded row into a permanent no-op.
-        (documentId) => {
-            const ownerAgentId = documentOwnerKeyFor(agentName);
-            if (ownerAgentId === null) {
-                return { ok: false, reason: "document_owner_key_unavailable" };
-            }
-            return documentLayer.controlHolders(ownerAgentId, documentId);
-        });
-        documentDeliveryWorkers.set(agentName, worker);
-        return worker;
-    };
     // M14 / DOD-DOC-TOOLS-1 — the OPERATOR SURFACE. Registered last of the document wiring, because
     // it is the only part that can create a document, and everything it creates has to have somewhere
     // to go: without the inbound path a peer's answer is unroutable, and without the delivery worker a
     // published update never leaves.
     const documentPublish = new DocumentPublish({
         holdersFor: (ownerAgentId, documentId) => documentLayer.holdersFor(ownerAgentId, documentId),
+        governanceFrontierFor: (ownerAgentId, documentId) => documentLayer.governanceFrontierFor(ownerAgentId, documentId),
         store: documentLayer.store,
         engine: documentLayer.engine,
         logger,
@@ -3651,6 +3780,30 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // different facts that happen to coincide — see DocumentStore.pendingDeliveries.
         senderIdFor: (ownerAgentId) => ownerAgentId,
         canPublish: (ownerAgentId, documentId) => documentLayer.lifecycle.canPublish(ownerAgentId, documentId),
+        // SYNC-P4 (R39's first trigger): each seat gets an initiated reconcile exchange — the
+        // envelope rides the exchange's own difference computation. Fire-and-forget by contract.
+        nudgeSeats: (ownerAgentId, documentId, seats) => {
+            for (const seat of seats) {
+                void documentLayer
+                    .initiateReconcile(ownerAgentId, seat, [documentId])
+                    .then((sent) => {
+                    if (!sent.ok) {
+                        // NOT SILENT (review F3): a lost nudge is legal for correctness (any later
+                        // exchange recomputes the difference — R40), but until P5's sweeps exist this
+                        // line is the only trace an operator has for "my edit never arrived".
+                        logger.warn("document.reconcile.nudge_failed", {
+                            documentId, peerAgentId: seat, reason: sent.reason,
+                        });
+                    }
+                })
+                    .catch((err) => {
+                    logger.warn("document.reconcile.nudge_failed", {
+                        documentId, peerAgentId: seat,
+                        reason: err instanceof Error ? err.message : String(err),
+                    });
+                });
+            }
+        },
     });
     registerDocumentHandlers({
         handlers,
@@ -3668,128 +3821,95 @@ async function startDaemonHoldingLock(config, singletonLock) {
         },
         now: () => Date.now(),
     });
-    /**
-     * The delivery tick.
-     *
-     * Interval-driven rather than event-driven because the event we are actually waiting for — the
-     * peer coming back online — is not one this daemon observes. There is no presence subscription
-     * (parked, M14-P4), so the honest substitute is to ask periodically and let the per-envelope
-     * backoff keep the cost down: a peer that has been away an hour is checked at the cap, not every
-     * tick.
-     *
-     * Slow on purpose. Publish is fire-and-forget and nothing waits on this; a document that syncs a
-     * minute later is working correctly, while a tight loop over every attended agent is a cost paid
-     * forever for a case that is rare.
-     */
-    //
-    // Overridable for tests, the way `CELLO_SEAL_BILATERAL_TIMEOUT_MS` already is. The live enforcers
-    // spend their wall clock waiting for this tick — two of them is four minutes — and a test that
-    // must sit out a production-paced timer either runs slowly or is written with a window so tight
-    // that adding a second test to the file makes the first one fail. Both happened.
-    //
-    // Floored, so a misread env cannot turn the sweep into a busy loop against the directory.
-    const tickOverride = Number(process.env["CELLO_DOCUMENT_DELIVERY_TICK_MS"]);
-    const DOCUMENT_DELIVERY_TICK_MS = Number.isFinite(tickOverride) && tickOverride >= 250 ? tickOverride : 60_000;
-    // DOD-MP-SWEEP-ALIVE-1 — how long ONE agent's pass may run before the sweep stops waiting for
-    // it. Generous relative to real work (the ack-grace budget for a whole pass is 30s) and finite,
-    // which is the only property that matters: the defect is an unbounded wait, not a slow one.
-    // Generous relative to what a HEALTHY pass can legitimately spend: the discovery lookup is
-    // bounded at 10s per (document, holder), the whole-pass ack grace is 30s, and only the dial is
-    // unbounded. Six pairs against a slow directory is already ~90s, so a 120s bound would warn on
-    // the normal case — and a signal that fires when nothing is wrong teaches an operator to ignore
-    // the one that matters. Scales with the tick so the fast-tick test path does not sit out minutes.
-    const DOCUMENT_DELIVERY_PASS_TIMEOUT_MS = Math.max(180_000, DOCUMENT_DELIVERY_TICK_MS * 3);
-    let documentDeliveryRunning = false;
-    let documentDeliveryStopping = false;
-    let documentDeliveryInFlight = null;
-    const documentDeliveryTimer = setInterval(() => {
-        // NO OVERLAP. A tick that dials a slow peer can outlast the interval, and a second pass would
-        // re-send envelopes already in flight — the worker's own re-entry guard covers one agent, this
-        // covers the sweep across all of them.
-        if (documentDeliveryRunning)
-            return;
-        documentDeliveryRunning = true;
-        documentDeliveryInFlight = (async () => {
+    // SYNC-P5 (R39–R43) — WHEN reconciling is attempted: the periodic sweep and the party-became-
+    // reachable trigger. All state volatile (R41); a lost tick costs latency, never correctness.
+    reconcileScheduler = new ReconcileScheduler({
+        now: () => Date.now(),
+        logger,
+        sweepTargets: (ownerAgentId) => documentLayer.sweepTargets(ownerAgentId),
+        partySync: (ownerAgentId, documentId, partyAgentId) => documentLayer.partySync(ownerAgentId, documentId, partyAgentId),
+        initiateReconcile: (ownerAgentId, peerAgentId, documentIds) => documentLayer.initiateReconcile(ownerAgentId, peerAgentId, documentIds),
+        ...(Number.isFinite(Number(process.env["CELLO_DOCUMENT_RECONCILE_BACKOFF_MS"])) &&
+            Number(process.env["CELLO_DOCUMENT_RECONCILE_BACKOFF_MS"]) >= 250
+            ? { backoffBaseMs: Number(process.env["CELLO_DOCUMENT_RECONCILE_BACKOFF_MS"]) }
+            : {}),
+        ...(Number.isFinite(Number(process.env["CELLO_DOCUMENT_RECONCILE_CURRENT_MS"])) &&
+            Number(process.env["CELLO_DOCUMENT_RECONCILE_CURRENT_MS"]) >= 250
+            ? { believedCurrentMs: Number(process.env["CELLO_DOCUMENT_RECONCILE_CURRENT_MS"]) }
+            : {}),
+    });
+    // Overridable for tests (the delivery tick precedent); floored so a misread env cannot busy-loop.
+    const reconcileTickOverride = Number(process.env["CELLO_DOCUMENT_RECONCILE_SWEEP_MS"]);
+    const RECONCILE_SWEEP_MS = Number.isFinite(reconcileTickOverride) && reconcileTickOverride >= 250
+        ? reconcileTickOverride
+        : 120_000;
+    // Review F2: the guard is TIME-STAMPED, not a bare boolean — a pass that never settles (a
+    // dial with no timeout) would otherwise end the sweep silently for the daemon's lifetime,
+    // the exact R42 stall one level above the module that fixed it. Past the bound the wedge is
+    // WARNED and the guard force-released; the abandoned pass's own scheduler marks are
+    // themselves time-bounded, so double-attempts are latency, never correctness.
+    const RECONCILE_PASS_BOUND_MS = 5 * 60_000;
+    let reconcileSweepStartedAt = null;
+    const reconcileSweepTimer = setInterval(() => {
+        if (reconcileSweepStartedAt !== null) {
+            if (Date.now() - reconcileSweepStartedAt < RECONCILE_PASS_BOUND_MS)
+                return;
+            logger.warn("document.reconcile.sweep_wedged", {
+                heldMs: Date.now() - reconcileSweepStartedAt,
+                impact: "a sweep pass never settled; the guard is force-released so sweeping continues",
+            });
+        }
+        reconcileSweepStartedAt = Date.now();
+        void (async () => {
             try {
-                let agentsSwept = 0;
-                let stuck = 0;
-                let attempted = 0;
-                let delivered = 0;
-                let failed = 0;
                 for (const agentName of perAgentSignaling.keys()) {
-                    // M2: a tick already running when the daemon stops must not keep dialling into a
-                    // half-torn-down transport. `clearInterval` stops the NEXT tick, not this one.
-                    if (documentDeliveryStopping)
-                        break;
                     const ownerAgentId = documentOwnerKeyFor(agentName);
-                    // M14-D5: the owner key is our own pubkey hex. It is what BOTH halves scope by — the
-                    // inbound router resolves the same function — and it is what the wire sender id is.
-                    // Scoping the two halves differently returns nothing pending, reports nothing attempted,
-                    // and leaves a fully synced document invisible with no error on any path.
                     if (ownerAgentId === null)
                         continue;
-                    // COUNTED AFTER THE PASS, not before — an agent whose pass never finished was not swept,
-                    // and saying it was is what made the stall indistinguishable from an idle daemon.
-                    // FANOUT-1: targets are the DERIVED holders minus ourselves — never per-sender
-                    // config, never the genesis peer column (§7-1's silent-divergence hazard).
-                    const holdersFor = (documentId) => {
-                        const holders = documentLayer.holdersFor(ownerAgentId, documentId);
-                        return holders === null ? null : holders.filter((h) => h !== ownerAgentId);
-                    };
-                    // DOD-MP-SWEEP-ALIVE-1 — BOUNDED. The `finally` below releases the overlap guard only
-                    // when this body settles, so an await that never settles ends document delivery for the
-                    // life of the process, silently: the interval keeps firing, returns at the guard, and
-                    // logs nothing. Observed live 2026-08-13. One wedged agent now degrades alone and loudly
-                    // instead of taking every other agent's documents down with it.
-                    const bounded = await sweepAgentEvicting({
-                        logger,
-                        timeoutMs: DOCUMENT_DELIVERY_PASS_TIMEOUT_MS,
-                        agentName,
-                        // Evicting the wedged worker is what makes the recovery real: `DocumentDelivery.tick`
-                        // caches its pass and would otherwise hand back the same hung promise forever, so the
-                        // agent would never deliver again AND every later pass would pay the full bound
-                        // waiting for it — a 2x sweep-interval regression for every healthy agent.
-                        workers: documentDeliveryWorkers,
-                        run: () => documentDeliveryFor(agentName).tick(ownerAgentId, holdersFor, Date.now(), {
-                            senderAgentId: ownerAgentId,
-                        }),
-                    });
-                    if (!bounded.completed) {
-                        stuck += 1;
-                        continue;
+                    const result = await reconcileScheduler.sweep(ownerAgentId);
+                    if (result.attempted > 0 || result.failed > 0) {
+                        logger.debug("document.reconcile.sweep", { agentName, ...result });
                     }
-                    agentsSwept++;
-                    const result = bounded.value;
-                    attempted += result.attempted;
-                    delivered += result.delivered;
-                    failed += result.failed;
-                }
-                // H3: a sweep that delivers nothing was byte-for-byte identical to a healthy idle one, which
-                // is what made every scoping bug above invisible. One line per tick, always.
-                // `stuck` IS PART OF THE LINE. Counting a wedged agent as swept reported `agents: 3,
-                // attempted: 0` — byte-for-byte a healthy idle sweep, which is the exact shape the comment
-                // below exists to prevent, on the one occasion it matters most.
-                logger.debug("document.delivery.sweep", { agents: agentsSwept, stuck, attempted, delivered, failed });
-                if (agentsSwept === 0 && documentLayer.store.anyDocumentExists()) {
-                    logger.warn("document.delivery.sweep_empty", {
-                        reason: "documents exist but no agent was swept — nothing will ever be delivered",
-                    });
                 }
             }
             catch (err) {
-                // Contained: one agent's delivery failure must not stop the sweep, and an unhandled
-                // rejection out of a timer takes the daemon down.
-                logger.warn("document.delivery.tick.failed", { reason: extractErrorMessage(err) });
+                logger.warn("document.reconcile.sweep_threw", {
+                    reason: err instanceof Error ? err.message : String(err),
+                });
             }
             finally {
-                documentDeliveryRunning = false;
-                documentDeliveryInFlight = null;
+                reconcileSweepStartedAt = null;
             }
         })();
-        void documentDeliveryInFlight;
-    }, DOCUMENT_DELIVERY_TICK_MS);
-    // Never hold the process open on account of document delivery.
-    documentDeliveryTimer.unref?.();
+    }, RECONCILE_SWEEP_MS);
+    reconcileSweepTimer.unref?.();
+    documentOwnerKeyForHook = documentOwnerKeyFor;
+    // ── THE SOCKET OPENS ONLY NOW, and the ordering is load-bearing (2026-08-16). ──
+    //
+    // This used to run ~120 lines earlier, immediately after the server was created — before
+    // `setOnDocumentFrame` above. That opened a window on every daemon start: a client connects,
+    // calls `cello_start_agent`, the agent comes online, its standing receiver drains whatever the
+    // relay parked — and any DOCUMENT frame in that drain found `#onDocumentFrame` still unset. The
+    // routing fork in session-node-manager treats an unconsumed frame as conversation, so those
+    // frames were appended as `msg` leaves, written to the durable transcript, rang the doorbell,
+    // and were handed to the agent by `cello_receive` as raw canonical CBOR.
+    //
+    // Reported from the live fleet by a counterparty who pasted the bytes back
+    // (`dtyperdocument_reconcile…`), reproduced in `j-stale-session.spine.test.ts`, and it is why
+    // documents accumulated unaccepted: the frames were not lost in transit, they were EATEN as
+    // messages, so the document layer never saw them while the sender was told they were delivered.
+    //
+    // The comment at that fork claimed an unwired hook "cannot change the conversation path". It
+    // can, and did. Nothing between here and the server's creation needs a live socket, so the
+    // honest fix is to finish wiring before anyone can knock.
+    try {
+        await ipcServer.start();
+    }
+    catch (err) {
+        // As above: startDaemon's catch releases the singleton lock for us.
+        await removeLockIfOwned(lockFilePath, process.pid, logger);
+        throw err;
+    }
     // MCP-001: Clean up per-connection state when a connection disconnects
     // MCP-002: Also unregister from notification dispatcher
     ipcServer.onDisconnect((connectionId) => {
@@ -3847,40 +3967,23 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // per daemon no matter how many times stop() is called.
     let stoppedHookFired = false;
     async function stop(reason) {
-        // M14: stop the document delivery sweep first — it opens sessions, and a tick landing during
-        // teardown would dial into a daemon that is going away.
-        clearInterval(documentDeliveryTimer);
-        // `clearInterval` stops the NEXT tick; the flag stops the running one at its next agent.
-        documentDeliveryStopping = true;
-        // BOUNDED. This was a bare `await documentDeliveryInFlight`, and shutdown is the one place that
-        // must not block on the network: a sweep mid-dial against an unreachable peer held `stop()`
-        // open, so the interrupt-marking writes that follow did not complete before the process died —
-        // and sessions came back `active` after a restart, which is the exact defect AC-009 exists to
-        // catch. It failed on CI, where a directory node times out at 5s, and passed locally, where it
-        // does not.
-        //
-        // A tick still gets a moment to finish so the common case is orderly; after that we proceed
-        // without it. What the sweep leaves half-done is safe by construction — delivery state is
-        // derived from the log, so an interrupted pass is re-derived on the next start.
-        // NOT AWAITED AT ALL. Two attempts at waiting for it were both wrong, and the second was worse
-        // than the first:
-        //
-        //   1. a bare await blocked shutdown on the network — a sweep mid-dial against an unreachable
-        //      peer held `stop()` open past the point where the interrupt-marking writes had to happen;
-        //   2. bounding it with `setTimeout(...).unref()` looked like the fix and could HANG FOREVER: an
-        //      unref'd timer does not hold the event loop open, so while the loop is draining during
-        //      shutdown it may never fire, the race never settles, and `stop()` never reaches the line
-        //      that logs `daemon.stopped` — which is exactly what CI showed, a daemon whose log ends at
-        //      `daemon.started` with no shutdown events at all.
-        //
-        // There is nothing to wait for. `documentDeliveryStopping` stops the loop at its next agent, and
-        // whatever a half-finished sweep leaves behind is safe by construction: delivery state is
-        // DERIVED from the envelope log, so an interrupted pass is simply re-derived on the next start —
-        // the property the offline enforcer proves against two real daemons.
-        //
-        // The rule this cost two CI round trips to learn: shutdown may not await anything that can
-        // block on I/O, and a timeout that can outlive the event loop is not a bound.
-        void documentDeliveryInFlight;
+        clearInterval(reconcileSweepTimer);
+        // DOD-M12B-SHUTDOWN-1: clearing the timer only stops the NEXT tick. The pass already running
+        // walks every agent, and each step dials a peer and opens a session — which is why a daemon
+        // reported down, with its socket already removed, was still logging `document.reconcile.sweep`
+        // 30 seconds later and had to be signalled to exit. This is what stops the pass in flight, and
+        // it also blocks `onReachable`, so a session tearing down during shutdown cannot hand the
+        // sweeper a fresh reason to dial on the way out.
+        // `?.` is a TYPE requirement, not a runtime one: TypeScript discards the narrowing of a
+        // captured `let` inside a hoisted function declaration, though it keeps it in the arrow a few
+        // lines up. The scheduler is in fact always wired by the time this can run — the IPC socket,
+        // the only route to `stop` besides the returned handle, opens after it.
+        reconcileScheduler?.stop();
+        // DOD-M12B-SHUTDOWN-1: the scheduler is one of FOUR callers of initiateReconcile. `nudgeSeats`
+        // and the two invite notices reach it directly, and every document verb is still served while
+        // the rest of this function runs — the IPC server is the last thing stopped. Refusing at the
+        // choke point is what actually closes "no new outbound work".
+        documentLayer?.stopReconciling();
         // M8C-TGDOOR-1: stop the single long-lived getUpdates poller (no-op if never started) — bump
         // the generation so the running loop's while-condition fails on its next check.
         stopTelegramPoller(); // M8C-TGDOOR-1: invalidate the poll loop; it exits on its next generation check