@cello-protocol/daemon 0.0.169 → 0.0.170

package/dist/daemon.js

@@ -91,7 +91,8 @@ import { startRegistryPoll } from "./registry-poll.js";
 import { CONSENT_ACCEPTED } from "./consent-migration.js";
 import { TrustSignalStore } from "./trust-signal-store.js";
 import { countAttendance, ContentTakeLedger } from "./co-attendance.js";
-import { isOwnAwayAutoReply, AWAY_AUTO_REPLY_TEXTS } from "./away-detection.js";
+import { isOwnAwayAutoReply, AWAY_AUTO_REPLY_TEXTS, markAsAutoReply, isAutoReplyMarked } from "./away-detection.js";
+import { createDeliveryOpenRegistry } from "./delivery-open-registry.js";
 import { FrontierMismatchStore, renderFrontierMismatch } from "./frontier-mismatch.js";
 import { decodeCbor } from "@cello-protocol/protocol-types";
 // Minimal no-op KeyProvider stub for session nodes.
@@ -930,6 +931,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     logger.info("session.away.mutual.skipped", {
                         agentName,
                         sessionId,
+                        // DOD-M12B-AWAY-MARK-1: WHICH branch matched. The marker is in-band and therefore
+                        // typeable, so prefixing every message with it skips the one-shot auto-close for free —
+                        // the cost of that attack fell from "reproduce the exact away wording" to "type 15
+                        // characters". This field is what makes a peer doing it on every message visible;
+                        // without it the line reads as routine machine-to-machine traffic.
+                        matched: isAutoReplyMarked(text) ? "marker" : "legacy_exact",
                         impact: "no away reply and no one-shot seal — two away agents must not notarize a conversation nobody had",
                     });
                     return;
@@ -953,7 +960,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // Reviewer F2: token at the END — the daemon's own output must honor the
                     // DOD-SIGNAL-TOKEN-1 append-at-end contract that DOD-WRAP-SUBSTRING-1 detection
                     // is anchored on (a counterparty daemon's end-anchored detector must see this close).
-                    const rejectText = "This inbox only accepts one message per visit. Closing. [[WRAP]]";
+                    // DOD-M12B-AWAY-MARK-1: machine-generated, so it is marked — and the marker goes at the
+                    // FRONT precisely so [[WRAP]] keeps the end position the counterparty's detector anchors on.
+                    const rejectText = markAsAutoReply("This inbox only accepts one message per visit. Closing. [[WRAP]]");
                     const rejectBytes = new TextEncoder().encode(rejectText);
                     const rejectHash = wireContentHash(rejectBytes);
                     // Best-effort: a send failure still triggers the seal — we are closing regardless.
@@ -966,9 +975,15 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // session is unsealable for good.
                     if (sendResult.ok || sendResult.durable) {
                         const rejectHashHex = Buffer.from(rejectHash).toString("hex");
-                        const { leafIndex } = sessionNodeManager.appendSessionLeaf(agentName, sessionId, "msg", rejectHashHex, randomUUID());
-                        sessionNodeManager.recordTranscriptMessage(agentName, sessionId, leafIndex, "sent", rejectBytes, randomUUID());
-                        logger.info("session.away.inbox.oneshot.rejected", { agentName, sessionId, sequenceNumber: leafIndex, queued: !sendResult.ok });
+                        // DOD-M12B-INDEX-1: at the relay's position, not the tail. This is the riskiest append
+                        // in the codebase for that — the seal is initiated a few lines below, so a leaf at the
+                        // wrong index does not merely stall the far side, it seals a tree the counterparty can
+                        // never agree with.
+                        const placed = sessionNodeManager.placeOwnLeaf(agentName, sessionId, rejectHashHex, rejectBytes, sendResult.sequenceNumber, randomUUID());
+                        if (placed.placed) {
+                            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placed.leafIndex, "sent", rejectBytes, randomUUID());
+                        }
+                        logger.info("session.away.inbox.oneshot.rejected", { agentName, sessionId, sequenceNumber: placed.placed ? placed.leafIndex : placed.heldAt, committed: placed.placed, queued: !sendResult.ok });
                     }
                     else {
                         // Not queued anywhere — the rejection is gone. We still seal (we are closing regardless),
@@ -1102,6 +1117,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
         try {
             // DOD-AWAY-TIER-1: resolve most-specific-first — per-contact away_message → per-tier away
             // (settings) → agent default (settings) → the system default (code, per kind). Total.
+            // DOD-M12B-AWAY-MARK-1: THE choke point. Every away reply this daemon sends passes through
+            // this one expression — the per-contact message, the per-tier message, the agent default, the
+            // system default and the stranger ack — so marking here is what makes "an operator's
+            // CONFIGURED away message is indistinguishable from a person" go away, which is the half
+            // exact-text matching could not reach by construction. markAsAutoReply is idempotent, so the
+            // system defaults (already marked at their source) do not pick up a second token.
             const awayText = sessionNodeManager.resolveAwayMessage(agentName, record.counterparty_pubkey)
                 ?? (isKnown ? systemDefault : STRANGER_TEXT);
             const draftBytes = new TextEncoder().encode(awayText);
@@ -1120,9 +1141,16 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 logger.error("session.away.response.redact_without_content", { agentName, sessionId, kind });
                 return;
             }
-            const contentBytes = awayVerdict.disposition === "redact" && awayVerdict.content !== undefined
+            // DOD-M12B-AWAY-MARK-1: mark AFTER screening, never before. A redact verdict REPLACES the
+            // bytes, and marking the draft would let that replacement silently strip the marker — an away
+            // reply back on the wire indistinguishable from a person, with no log line saying so. Marking
+            // here also means the gateway screens the operator's actual disclosure rather than a daemon
+            // token bolted to the front of it. markAsAutoReply is idempotent and the system defaults are
+            // marked at their source, so nothing gains a second token.
+            const screenedBytes = awayVerdict.disposition === "redact" && awayVerdict.content !== undefined
                 ? new Uint8Array(awayVerdict.content)
                 : draftBytes;
+            const contentBytes = new TextEncoder().encode(markAsAutoReply(new TextDecoder().decode(screenedBytes)));
             const contentHash = wireContentHash(contentBytes);
             const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, contentBytes, new Uint8Array(contentHash), randomUUID());
             if (!sendResult.ok && !sendResult.durable) {
@@ -1148,17 +1176,31 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 //
                 // The dedup guard deliberately STAYS SET: a queued reply is coming, and re-sending on the
                 // next arrival would mint a second greeting at a second sequence.
-                const { leafIndex: queuedLeaf } = sessionNodeManager.appendSessionLeaf(agentName, sessionId, "msg", contentHashHex, randomUUID());
-                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, queuedLeaf, "sent", contentBytes, randomUUID());
+                // DOD-M12B-INDEX-1: the queued reply owns the position the relay witnessed for it, and
+                // that is where its leaf goes.
+                const placedQueued = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID());
+                if (placedQueued.placed) {
+                    sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedQueued.leafIndex, "sent", contentBytes, randomUUID());
+                }
                 logger.info("session.away.response.deferred", {
-                    agentName, sessionId, kind, isKnown, sequenceNumber: queuedLeaf,
+                    agentName, sessionId, kind, isKnown,
+                    sequenceNumber: placedQueued.placed ? placedQueued.leafIndex : placedQueued.heldAt,
+                    committed: placedQueued.placed,
                     reason: sendResult.reason, cause: sendResult.cause,
                 });
                 return;
             }
-            const { leafIndex } = sessionNodeManager.appendSessionLeaf(agentName, sessionId, "msg", contentHashHex, randomUUID());
-            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, leafIndex, "sent", contentBytes, randomUUID());
-            logger.info("session.away.response.sent", { agentName, sessionId, kind, isKnown, sequenceNumber: leafIndex });
+            // DOD-M12B-INDEX-1: the away responder fires while inbound is still arriving, so it is the
+            // path most likely to have a gap open under it — exactly where a tail append does damage.
+            const placedReply = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID());
+            if (placedReply.placed) {
+                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedReply.leafIndex, "sent", contentBytes, randomUUID());
+            }
+            logger.info("session.away.response.sent", {
+                agentName, sessionId, kind, isKnown,
+                sequenceNumber: placedReply.placed ? placedReply.leafIndex : placedReply.heldAt,
+                committed: placedReply.placed,
+            });
         }
         catch (err) {
             // Reviewer MEDIUM fix: same as above — an unexpected throw must not permanently lock out
@@ -1215,15 +1257,74 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // agent restoration can dispatch state events before the scheduler exists.
     let reconcileScheduler;
     let documentOwnerKeyForHook;
+    // DOD-M12B-DELIVERY-QUIET-1: which peers this daemon's document delivery worker is mid-dial to.
+    // Read by BOTH reachability triggers and by the doorbell below. See delivery-open-registry.ts for
+    // why this records an intent keyed on the peer rather than the session id — the short version is
+    // that the directory mints the id and pushes the assignment to the counterparty before the opener
+    // ever sees it, so on a one-daemon pair the inbound doorbell fires first and a session-id
+    // registry is always too late.
+    const deliveryOpens = createDeliveryOpenRegistry();
+    /**
+     * An agent's own pubkey, synchronously. The registry keys on PUBKEYS at both ends because that is
+     * the only pair the dialling side and the accepting side can both name — the accepting side never
+     * learns the dialler's local agent name, and the dialling side never learns ours.
+     */
+    const pubkeyOfAgent = (name) => loadedAgents.find((a) => a.name === name)?.pubkey ?? "";
+    /**
+     * Is a delivery worker mid-dial from `openerPubkey` to `targetPubkey`?
+     *
+     * One predicate, passed to every consumer, so the doorbell, the phone and both reachability
+     * triggers cannot drift apart on the answer. An unresolvable agent yields "" and never matches,
+     * which fails OPEN — an unknown agent rings rather than being silently muted.
+     */
+    const isDeliveryOpenInFlight = (openerPubkey, targetPubkey) => openerPubkey !== "" && targetPubkey !== "" && deliveryOpens.isDeliveryOpening(openerPubkey, targetPubkey);
+    /**
+     * The ACCEPTING side's question: "did a delivery worker on `openerPubkey`'s daemon dial the local
+     * agent `targetAgentName`?"
+     *
+     * A named predicate rather than a reversed call, because getting the order wrong here is exactly
+     * the defect this line was re-opened to fix: the accepting side naturally reaches for its own
+     * agent first, which compares the receiver's tuple against a registry holding the dialler's and
+     * silently never matches.
+     */
+    const isDeliveryOpenToAgent = (openerPubkey, targetAgentName) => isDeliveryOpenInFlight(openerPubkey, pubkeyOfAgent(targetAgentName));
     function dispatchSessionStateChangedWithTelegram(agentName, sessionId, state, counterpartyPubkey) {
+        // DOD-M12B-DELIVERY-QUIET-1: this session came up because a DELIVERY WORKER dialled, so its
+        // creation is machine traffic — not news about the peer, not a conversation, and not something
+        // to buzz a phone about. Scoped to `created` on purpose: a session going DOWN is news whoever
+        // opened it, and it is the operator's only signal that a conversation was cut off.
+        //
+        // ARGUMENTS ARE REVERSED HERE, AND THAT IS THE POINT. This function runs on the side that
+        // ACCEPTED, so the opener is the COUNTERPARTY and the target is US. Asking
+        // `(agentName, counterpartyPubkey)` — our own agent first, like the initiator half does — is
+        // what made the first version of this guard unreachable in production: it compared the
+        // receiver's tuple against a registry holding the dialler's.
+        if (state === "created" && counterpartyPubkey !== null && isDeliveryOpenToAgent(counterpartyPubkey, agentName)) {
+            // Suppression is LOGGED. A doorbell that silently stops ringing is the next defect, and the
+            // measured storm was so hard to read precisely because nothing named its cause.
+            logger.info("session.doorbell.suppressed_delivery", {
+                agentName, sessionId, state, opener: counterpartyPubkey.slice(0, 16),
+                impact: "document delivery opened this session — no doorbell, no phone push, no backoff reset",
+            });
+            return;
+        }
         // MONIKER-4 AC2: stamp who/whoKnown on the counterparty-bearing frame. Resolved BEFORE the
-        // offered-name drop below so a terminal state's own doorbell still shows the name.
+        // offered-name drop below so a terminal state's own doorbell still shows the name. Below the
+        // guard: on a suppressed event it was computed and thrown away.
         const who = counterpartyPubkey ? resolveWho(agentName, counterpartyPubkey, sessionId) : undefined;
         // SYNC-P5 (R39): a session coming up IS the party-became-reachable signal — every shared
         // document gets a reconcile attempt, and the scheduler's backoff resets (they just answered).
+        // Sound ONLY when the peer caused it, which is what the guard above establishes.
         if (reconcileScheduler && documentOwnerKeyForHook && counterpartyPubkey && state === "created") {
             const ownerAgentId = documentOwnerKeyForHook(agentName);
             if (ownerAgentId !== null) {
+                // DOD-M12B-DELIVERY-QUIET-1: the trigger FIRING is logged, not only its failure. This is
+                // the storm driver — it zeroes the backoff and sweeps every shared document — and it was
+                // invisible in the log unless it threw, so 321 attempts in 85 minutes named no cause. It is
+                // also the only way either direction of the delivery exemption is observable.
+                logger.info("document.reconcile.reachable_trigger_fired", {
+                    agentName, trigger: "inbound_session_created", peer: counterpartyPubkey.slice(0, 16),
+                });
                 void reconcileScheduler
                     .onReachable(ownerAgentId, counterpartyPubkey.toLowerCase())
                     .catch((err) => {
@@ -1624,7 +1725,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // down below the module. Construction is synchronous and its deps are all ready — the handlers
     // it registers are fine this early because the handler map already exists.
     // Seam 2: inbound session establishment — the counterparty side (inbound-sessions.ts).
-    const { registerHandlers: registerInboundSessionHandlers, wirePerAgentSessionInbound, handleTrustSignalPickup, enqueueInboundSession, reapExpiredInboundSessions, inboundSessionQueues, inboundSessionWaiters, expiredSessionRequests, refusedSessionRequests, offeredMonikers, offerKey, } = createInboundSessions({
+    const { registerHandlers: registerInboundSessionHandlers, wirePerAgentSessionInbound, handleTrustSignalPickup, enqueueInboundSession, recordRefusal, reapExpiredInboundSessions, inboundSessionQueues, inboundSessionWaiters, expiredSessionRequests, refusedSessionRequests, offeredMonikers, offerKey, } = createInboundSessions({
         logger,
         sessionNodeManager,
         agents,
@@ -1641,6 +1742,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
         sendAwayResponse,
         dispatchSessionStateChangedWithTelegram,
         sendTelegramDoorbell,
+        isDeliveryOpenToAgent,
     });
     if (!sharedSignaling) {
         for (const agent of loadedAgents) {
@@ -1687,6 +1789,29 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // unbounded and confuse. The list is also capped; the full, queryable history is `cello sessions`
     // / cello_list_sessions (with filter + limit flags).
     const STATUS_RESUMABLE_CAP = 10;
+    /**
+     * DOD-M12B-SEAL-STUCK-1 — ask the seal gate for ONE session, and never let the answer take the
+     * status response with it.
+     *
+     * This runs per session on every `cello status` and every `cello_status`, and it touches the
+     * database. An unguarded throw here rejects the whole response, after which the CLI finds the
+     * singleton lock still held and prints `daemon: "broken_shutdown"` — telling the operator their
+     * healthy daemon has failed to stop, over one session row it could not read. There is a
+     * documented precedent in this codebase for exactly that shape.
+     *
+     * A failure yields `unknown`, never `ready`: "we could not check" must not read as "safe to
+     * close", because a close on a short chain is terminal.
+     */
+    function probeSealReadiness(agentName, sessionId) {
+        try {
+            return sessionNodeManager.sealReadinessView(agentName, sessionId);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logger.warn("session.seal.readiness.probe.failed", { agentName, sessionId, error: message });
+            return { state: "unknown", reason: `probe_failed: ${message}` };
+        }
+    }
     function buildInterruptedSessions() {
         return sessionNodeManager
             .getSessionsByStatus("interrupted")
@@ -1701,6 +1826,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // DOD-SESSION-NAME-1 (AC-A11): an interrupted session is one you may want to resume or seal
             // — the name is how you tell which one it was.
             sessionName: row.session_name ?? null,
+            // DOD-M12B-SEAL-STUCK-1: the same answer the active list carries, for the same reason —
+            // an interrupted session can seal, so it can also be blocked from sealing by a gap, and
+            // that is knowable here instead of only after a failed close. A plain property, never a
+            // spread: a spread bypasses excess-property checking, which is how `frontierMismatch`
+            // below came to typecheck while no renderer could read it.
+            sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
             // DOD-FRONTIER-STRAND-1 AC3: if a seal exchange has already proved the two sides disagree on
             // how many messages this session holds, SAY SO HERE. Otherwise a stranded session is listed
             // exactly like a healthy paused one, and the only way to learn it can never seal is to
@@ -1732,7 +1863,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 continue;
             if (now - row.created_at <= HALF_OPEN_TTL_MS)
                 continue; // too young — may just be setting up
-            if (sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id) === "alive")
+            // DOD-M12B-ACK-1: 'impaired' counts as live HERE. This reaper's question is "did the
+            // counterparty ever establish?", and impaired means it did — the connection is up, only
+            // delivery on it is failing. Reaping on impaired would abandon exactly the sessions this
+            // milestone exists to repair.
+            const liveness = sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id);
+            if (liveness === "alive" || liveness === "impaired")
                 continue; // live
             if (sessionNodeManager.countReceivedMessages(row.agent_name, row.session_id) > 0)
                 continue; // counterparty spoke
@@ -1757,13 +1893,19 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // was invisible to the operator.
     function buildActiveSessions() {
         reapDeadHalfOpenSessions(); // CC-5/F21: drop provably-dead half-open sessions before surfacing active ones
-        return sessionNodeManager.getSessionsByStatus("active").map((row) => ({
-            sessionId: row.session_id,
-            agentName: row.agent_name,
-            counterpartyPubkey: row.counterparty_pubkey,
-            liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
-            sessionName: row.session_name ?? null, // DOD-SESSION-NAME-1 (AC-A11)
-        }));
+        return sessionNodeManager.getSessionsByStatus("active").map((row) => {
+            // DOD-M12B-SEAL-STUCK-1: ask the SAME gate the close path asks, so the surface and the
+            // refusal can never disagree. Computed here rather than cached because the answer changes
+            // the moment a gap fills, and a stale "stuck" is its own lie.
+            return {
+                sessionId: row.session_id,
+                agentName: row.agent_name,
+                counterpartyPubkey: row.counterparty_pubkey,
+                liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
+                sessionName: row.session_name ?? null, // DOD-SESSION-NAME-1 (AC-A11)
+                sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
+            };
+        });
     }
     /**
      * The state an operator sees, for one agent — used by BOTH status surfaces.
@@ -2949,9 +3091,24 @@ async function startDaemonHoldingLock(config, singletonLock) {
         onSessionOpened: (agentName, counterpartyPubkey) => {
             if (!reconcileScheduler || !documentOwnerKeyForHook)
                 return;
+            // DOD-M12B-DELIVERY-QUIET-1: the INITIATOR half of the same circularity. This hook fires
+            // inside openSessionAs, which the delivery worker's adapter brackets with begin/release — so
+            // the intent is still in flight here and the check needs no plumbing of its own. Resetting
+            // the backoff on a session WE opened to deliver a frame wipes a refusal the peer may have
+            // given seconds ago and immediately sweeps every document, which opens more sessions.
+            // We are the OPENER here, so our own pubkey goes first — the mirror of the inbound half above.
+            if (isDeliveryOpenInFlight(pubkeyOfAgent(agentName), counterpartyPubkey)) {
+                logger.debug("document.reconcile.reachable_trigger_skipped", {
+                    agentName, reason: "session_opened_by_document_delivery",
+                });
+                return;
+            }
             const ownerAgentId = documentOwnerKeyForHook(agentName);
             if (ownerAgentId === null)
                 return;
+            logger.info("document.reconcile.reachable_trigger_fired", {
+                agentName, trigger: "outbound_session_opened", peer: counterpartyPubkey.slice(0, 16),
+            });
             void reconcileScheduler
                 .onReachable(ownerAgentId, counterpartyPubkey.toLowerCase())
                 .catch((err) => {
@@ -3178,6 +3335,45 @@ async function startDaemonHoldingLock(config, singletonLock) {
             }
             return { ok: true };
         });
+        // DOD-M12B-DELIVERY-QUIET-1: drive the delivery-open intent directly, so the doorbell exemption
+        // is testable without standing up a document, a peer daemon and a real directory negotiation.
+        // The registry's begin() hands back a closure, so the releases are held here by key.
+        // The hook takes AGENT NAMES and resolves both to pubkeys through `pubkeyOfAgent`, exactly as the
+        // real delivery adapter does. That is deliberate: the first version of this hook let a test
+        // register a tuple production never produces — an agent registered as the dialler and then
+        // emitted as the receiver of its own dial — so the suite proved the guard's boolean logic and
+        // nothing about the wiring, and stayed green against a guard that could never fire.
+        const testDeliveryReleases = new Map();
+        // DOD-M12B-INBOX-TRUTH-1: seed a refusal, so the ended-unread return branch's lost
+        // `refused_session_requests` has a regression test. The field had none before or after the fix.
+        handlers.set("__test_record_refusal", async (params, _connectionId) => {
+            const agentName = params?.agentName;
+            const sessionId = params?.sessionId;
+            if (!agentName || !sessionId)
+                return { error: "missing_params", guidance: "Provide agentName and sessionId." };
+            recordRefusal(agentName, sessionId, params?.counterpartyPubkey ?? "", params?.reason ?? "test");
+            return { ok: true };
+        });
+        handlers.set("__test_delivery_open_begin", async (params, _connectionId) => {
+            const openerAgent = params?.openerAgent;
+            const targetAgent = params?.targetAgent;
+            if (!openerAgent || !targetAgent)
+                return { error: "missing_params", guidance: "Provide openerAgent and targetAgent (both agent NAMES)." };
+            const openerPubkey = pubkeyOfAgent(openerAgent);
+            const targetPubkey = pubkeyOfAgent(targetAgent);
+            testDeliveryReleases.set(`${openerAgent}>${targetAgent}`, deliveryOpens.begin(openerPubkey, targetPubkey));
+            return { ok: true, openerPubkey, targetPubkey };
+        });
+        handlers.set("__test_delivery_open_end", async (params, _connectionId) => {
+            const openerAgent = params?.openerAgent;
+            const targetAgent = params?.targetAgent;
+            if (!openerAgent || !targetAgent)
+                return { error: "missing_params", guidance: "Provide openerAgent and targetAgent (both agent NAMES)." };
+            const key = `${openerAgent}>${targetAgent}`;
+            testDeliveryReleases.get(key)?.();
+            testDeliveryReleases.delete(key);
+            return { ok: true };
+        });
         // M8C-INBOX-1: test hook to enqueue a pending inbound session request (mirrors the real inbound
         // flow's enqueueInboundSession) so cello_check_notifications' pending_session_requests is testable
         // without standing up the full libp2p inbound path.
@@ -3343,14 +3539,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
     };
     // Create and start IPC server
     const ipcServer = createIpcServer({ socketPath, maxConnections, logger }, renderedHandlers);
-    try {
-        await ipcServer.start();
-    }
-    catch (err) {
-        // As above: startDaemon's catch releases the singleton lock for us.
-        await removeLockIfOwned(lockFilePath, process.pid, logger);
-        throw err;
-    }
+    // THE SOCKET OPENS LAST — see the deferred start below. Accepting clients here would accept
+    // `cello_start_agent`, which brings an agent online, creates its standing receiver, and drains
+    // parked content — all of it arriving before the document frame hook exists.
     // MCP-002: Instantiate NotificationDispatcher (wired to IPC server)
     const notificationDispatcher = new NotificationDispatcher({
         logger,
@@ -3420,6 +3611,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             });
             return sent.ok ? { ok: true } : { ok: false, reason: sent.reason };
         },
+        // Read LAZILY: the scheduler is constructed after this layer (it consumes the layer's sweep
+        // targets), so the binding must be resolved at call time rather than captured here.
+        onPeerRefusal: (ownerAgentId, peerAgentId, terminal) => reconcileScheduler?.noteRefusal(ownerAgentId, peerAgentId, terminal),
         // ONE implementation, shared with the two-party test. It was a closure here, and that is exactly
         // how the surface tests passed while the feature did nothing: the test wired this seam to
         // `async () => ({ ok: true })`, which reported success, sent nothing, and agreed with whatever
@@ -3499,13 +3693,25 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 .map((row) => row.session_id)
                 .reverse(),
             openSession: async (agent, peerAgentId, correlationId) => {
-                // The same path `cello_initiate_session` takes, now callable without an IPC connection.
-                const res = (await openSessionFor(agent, { targetPubkey: peerAgentId }));
-                if (res.ok !== true || typeof res.sessionId !== "string") {
-                    return { ok: false, reason: res.reason ?? "session_open_failed", guidance: res.guidance };
+                // DOD-M12B-DELIVERY-QUIET-1: THIS is the only place the delivery worker opens a session,
+                // so bracketing it is what makes "who opened this" knowable everywhere else. The window
+                // must cover the whole open — the inbound doorbell on a co-resident pair fires DURING
+                // negotiation, and the initiator-side reachability hook fires just before this returns.
+                // Released in `finally`: a throw that left the intent registered would silence this
+                // peer's doorbell for the life of the process, which is a worse outage than the storm.
+                const releaseDeliveryOpen = deliveryOpens.begin(pubkeyOfAgent(agent), peerAgentId);
+                try {
+                    // The same path `cello_initiate_session` takes, now callable without an IPC connection.
+                    const res = (await openSessionFor(agent, { targetPubkey: peerAgentId }));
+                    if (res.ok !== true || typeof res.sessionId !== "string") {
+                        return { ok: false, reason: res.reason ?? "session_open_failed", guidance: res.guidance };
+                    }
+                    logger.info("document.delivery.session_opened", { agent, peerAgentId, sessionId: res.sessionId, correlationId });
+                    return { ok: true, sessionId: res.sessionId };
+                }
+                finally {
+                    releaseDeliveryOpen();
                 }
-                logger.info("document.delivery.session_opened", { agent, peerAgentId, sessionId: res.sessionId, correlationId });
-                return { ok: true, sessionId: res.sessionId };
             },
             sealSession: async (agent, sessionId, correlationId) => {
                 // §16.4: the autonomous session still carries the seal — the ceremony goes to zero, the
@@ -3536,8 +3742,13 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // The `0x04` doc leaf for a frame WE sent — the same step `cello_send` takes after its own
             // successful send. See the comment at the call site for why this is delivery-critical and
             // not audit bookkeeping.
-            appendLeaf: (agent, sessionId, contentHash, correlationId) => {
-                sessionNodeManager.appendSessionLeaf(agent, sessionId, "doc", Buffer.from(contentHash).toString("hex"), correlationId);
+            appendLeaf: (agent, sessionId, contentHash, frameBytes, correlationId, assignedSeq) => {
+                // DOD-M12B-INDEX-1: a document leaf takes a position in the CONVERSATION's sequence space
+                // (deliberate — f75ea09), so it obeys the same discipline a message does — including
+                // being HELD when the position is ahead of the tail, which is why the real frame bytes
+                // have to travel with it.
+                const placed = sessionNodeManager.placeOwnLeaf(agent, sessionId, Buffer.from(contentHash).toString("hex"), frameBytes, assignedSeq, correlationId, "doc");
+                return { placed: placed.placed, leafIndex: placed.placed ? placed.leafIndex : null };
             },
         });
         documentTransports.set(agentName, transport);
@@ -3673,6 +3884,32 @@ async function startDaemonHoldingLock(config, singletonLock) {
     }, RECONCILE_SWEEP_MS);
     reconcileSweepTimer.unref?.();
     documentOwnerKeyForHook = documentOwnerKeyFor;
+    // ── THE SOCKET OPENS ONLY NOW, and the ordering is load-bearing (2026-08-16). ──
+    //
+    // This used to run ~120 lines earlier, immediately after the server was created — before
+    // `setOnDocumentFrame` above. That opened a window on every daemon start: a client connects,
+    // calls `cello_start_agent`, the agent comes online, its standing receiver drains whatever the
+    // relay parked — and any DOCUMENT frame in that drain found `#onDocumentFrame` still unset. The
+    // routing fork in session-node-manager treats an unconsumed frame as conversation, so those
+    // frames were appended as `msg` leaves, written to the durable transcript, rang the doorbell,
+    // and were handed to the agent by `cello_receive` as raw canonical CBOR.
+    //
+    // Reported from the live fleet by a counterparty who pasted the bytes back
+    // (`dtyperdocument_reconcile…`), reproduced in `j-stale-session.spine.test.ts`, and it is why
+    // documents accumulated unaccepted: the frames were not lost in transit, they were EATEN as
+    // messages, so the document layer never saw them while the sender was told they were delivered.
+    //
+    // The comment at that fork claimed an unwired hook "cannot change the conversation path". It
+    // can, and did. Nothing between here and the server's creation needs a live socket, so the
+    // honest fix is to finish wiring before anyone can knock.
+    try {
+        await ipcServer.start();
+    }
+    catch (err) {
+        // As above: startDaemon's catch releases the singleton lock for us.
+        await removeLockIfOwned(lockFilePath, process.pid, logger);
+        throw err;
+    }
     // MCP-001: Clean up per-connection state when a connection disconnects
     // MCP-002: Also unregister from notification dispatcher
     ipcServer.onDisconnect((connectionId) => {
@@ -3731,6 +3968,22 @@ async function startDaemonHoldingLock(config, singletonLock) {
     let stoppedHookFired = false;
     async function stop(reason) {
         clearInterval(reconcileSweepTimer);
+        // DOD-M12B-SHUTDOWN-1: clearing the timer only stops the NEXT tick. The pass already running
+        // walks every agent, and each step dials a peer and opens a session — which is why a daemon
+        // reported down, with its socket already removed, was still logging `document.reconcile.sweep`
+        // 30 seconds later and had to be signalled to exit. This is what stops the pass in flight, and
+        // it also blocks `onReachable`, so a session tearing down during shutdown cannot hand the
+        // sweeper a fresh reason to dial on the way out.
+        // `?.` is a TYPE requirement, not a runtime one: TypeScript discards the narrowing of a
+        // captured `let` inside a hoisted function declaration, though it keeps it in the arrow a few
+        // lines up. The scheduler is in fact always wired by the time this can run — the IPC socket,
+        // the only route to `stop` besides the returned handle, opens after it.
+        reconcileScheduler?.stop();
+        // DOD-M12B-SHUTDOWN-1: the scheduler is one of FOUR callers of initiateReconcile. `nudgeSeats`
+        // and the two invite notices reach it directly, and every document verb is still served while
+        // the rest of this function runs — the IPC server is the last thing stopped. Refusing at the
+        // choke point is what actually closes "no new outbound work".
+        documentLayer?.stopReconciling();
         // M8C-TGDOOR-1: stop the single long-lived getUpdates poller (no-op if never started) — bump
         // the generation so the running loop's while-condition fails on its next check.
         stopTelegramPoller(); // M8C-TGDOOR-1: invalidate the poll loop; it exits on its next generation check