@cello-protocol/daemon 0.0.175 → 0.0.177

package/dist/session-node-manager.js

@@ -26,7 +26,7 @@ import { TIER, normalizeTier, isKnownTierValue, tierBoundsFor, DEFAULT_TIER_BOUN
 import { migrateCborBlobsToCanonical } from "./cbor-blob-migration.js";
 import { ensureTrustSignalSchema } from "./trust-signal-store.js";
 import { boundSettingKey, settableTierName, isValidSettingKey, awayTierSettingKey, AWAY_DEFAULT_KEY } from "./agent-settings-keys.js";
-import { randomUUID, createHash } from "node:crypto";
+import { randomUUID, createHash, randomBytes } from "node:crypto";
 import * as lp from "it-length-prefixed";
 import { decode } from "cbor-x";
 import { encodeCbor } from "@cello-protocol/protocol-types";
@@ -173,6 +173,33 @@ export const ABUSE_MAX_UNKNOWN_SESSIONS_GLOBAL = 50;
  * the leak the old destructive read was accidentally preventing.
  */
 const RECEIVED_BUFFER_CAP = 32;
+/**
+ * DOD-M12B-REVIVAL-BOUND-1 — how long an interrupted session stays revivable before it is closed.
+ *
+ * 24 hours. The bound exists because of Andre's 2026-08-18 tenet — *"leave nothing open that is no
+ * longer needed"* — and its value is set by the case it must not break: a laptop closed for the
+ * night. A window shorter than a night's sleep would abandon exactly the sessions case A/B exist to
+ * rescue, which is why this is not zero and not an hour.
+ *
+ * It is deliberately a plain constant and not a setting. A per-operator knob here is a knob that
+ * turns the guarantee off, and the guarantee is the security property, not a preference.
+ */
+export const REVIVAL_WINDOW_MS = 24 * 60 * 60 * 1000;
+/**
+ * DOD-M12B-REVIVAL-BOUND-1 — how often the revival bound is applied.
+ *
+ * Hourly. The window is 24 hours, so the worst-case overshoot is ~4% of the bound, and the pass is
+ * one DB walk with no network in it. Boot-only was the first build and it is not a bound at all: a
+ * daemon left up for a week never applies it, and a long-lived daemon is the normal case.
+ */
+export const REVIVAL_BOUND_SWEEP_MS = 60 * 60 * 1000;
+/** DOD-M12B-SESSION-SEED-1: per-relay deadline when a revived node asks for a circuit reservation.
+ *  Three seconds — a relay that has a slot answers well inside it, and one that does not never
+ *  answers at all (measured: 10,002ms and still waiting). */
+export const REVIVE_RESERVATION_TIMEOUT_MS = 3_000;
+/** How many relays a revival will ask before settling for a plain node. Two: the worst case is then
+ *  ~6s to a usable session, against a measured "never" for the unbounded form. */
+export const REVIVE_RESERVATION_CANDIDATES = 2;
 export class SessionNodeManager {
     #factory;
     #logger;
@@ -287,6 +314,31 @@ export class SessionNodeManager {
     // `hasReservation`: this receiver came up holding a /p2p-circuit address. The
     // watchdog uses it to tell "lost its reservation" (must recover) apart from
     // "never had one" (already degraded, and already loud) — see #reservationWatchdogTick.
+    /**
+     * DOD-M12B-SESSION-SEED-1 — session id → the transport seed its node identity derives from.
+     *
+     * **DELIBERATELY NOT ON `ActiveSessionEntry`.** That entry is deleted the instant a session is
+     * interrupted (`markInterruptedWithDetails` and `destroySessionNode` both do it), which is exactly
+     * the moment the seed becomes necessary — storing it there would destroy it precisely when the
+     * session needs to come back. It has to outlive the NODE without outliving the SESSION.
+     *
+     * Andre's 2026-08-18 tenet is the lifetime rule: *"it should be possible to revive that session on
+     * those peer IDs. But after that, those peer IDs and that peer connection needs to be shut down."*
+     * So this map is cleared in the same step that writes a terminal status (`#updateSessionStatus`),
+     * not on a later sweep — and the bytes are zeroed before the reference is dropped, because a seed
+     * that stays readable in the heap is exactly the "left open" the tenet forbids.
+     *
+     * It holds the counterparty's session peer id alongside the seed, and not for convenience: that
+     * value lives ONLY on `ActiveSessionEntry` and is destroyed with it on interruption, so without a
+     * copy here we could rebuild our own identity and still not know who to let back in. Both halves
+     * of the revival have the same lifetime, so they are destroyed in one step.
+     *
+     * In memory only, never persisted. A daemon restart genuinely destroys these identities, which is
+     * why restart is `RESTART-SEAL-1`'s case (resolve with a receipt) and not a revival case.
+     */
+    #sessionSeeds = new Map();
+    /** DOD-M12B-SESSION-SEED-1: see setRetryDrainHook — fired when a session is revived. */
+    #retryDrainHook = null;
     #standingReceivers = new Map();
     #standingReceiverCreating = new Set();
     // M8B F14: agents that SHOULD have a standing receiver — marked by
@@ -2176,6 +2228,9 @@ export class SessionNodeManager {
         let node;
         let gater;
         let autoNat;
+        // DOD-M12B-SESSION-SEED-1: whichever branch below runs, the session ends up owning a seed.
+        // Promotion inherits the receiver's; a freshly-built node mints its own.
+        let seed;
         if (reuseStandingReceiver) {
             const sr = this.#standingReceivers.get(agentName);
             if (!sr) {
@@ -2189,7 +2244,7 @@ export class SessionNodeManager {
                     guidance: "The standing receiver node is initializing (completes within 200ms). Retry the session in a moment.",
                 };
             }
-            ({ node, gater, autoNat } = sr);
+            ({ node, gater, autoNat, seed } = sr);
             gater.setAllowedPeer(counterpartyPeerId);
             // Hand this agent's standing receiver off to this session; a replacement is spun up below.
             this.#standingReceivers.delete(agentName);
@@ -2201,7 +2256,8 @@ export class SessionNodeManager {
                 logger: this.#logger,
             });
             try {
-                node = await this.#factory.createNode({ sessionId, connectionGater: gater, nodeType: "session" });
+                seed = randomBytes(32);
+                node = await this.#factory.createNode({ sessionId, connectionGater: gater, nodeType: "session", transportPrivateKey: seed });
                 await node.start();
             }
             catch (err) {
@@ -2262,7 +2318,7 @@ export class SessionNodeManager {
         // Log observability event (session.node.created)
         //
         // `counterpartySessionPeerId` IS LOGGED because it is recorded here ONCE and never refreshed,
-        // while a standing receiver is rebuilt with a fresh libp2p keypair on every signaling reconnect
+        // while a standing receiver is rebuilt with a fresh libp2p keypair on a lost relay reservation
         // and every lost reservation. If the peer rebuilds between advertising its endpoint and this
         // handoff, we record an identity that no longer exists — and since `newStream` never dials, it
         // only ever looks for an ALREADY-OPEN connection filed under exactly this string, so every send
@@ -2288,6 +2344,7 @@ export class SessionNodeManager {
             counterpartySessionPeerId: counterpartyPeerId,
             autoNat,
         });
+        this.#rememberSessionSeed(agentName, sessionId, seed, counterpartyPeerId, counterpartyPubkey);
         // DAEMON-004: register the content stream handler so inbound content_frames
         // are cross-checked, appended to the daemon-owned tree, and buffered.
         await this.#registerContentHandler(agentName, sessionId, node, counterpartyPubkey);
@@ -2311,6 +2368,60 @@ export class SessionNodeManager {
      * and leaves relayClient undefined — the session is NOT destroyed and the direct
      * content path keeps working (the relay-park/recovery path is MSG-001-3b's domain).
      */
+    /**
+     * DOD-M12B-REVIVE-RELAY-1 — the relay witness leaf handler, shared by establishment and revival.
+     *
+     * Extracted because a REVIVED session must register the same handler. It was inline in
+     * `#connectSessionRelay`, so revival — which never called that at all — had no live inbound path:
+     * every message fell back to the five-minute mailbox poll, which is why a reconnected session took
+     * three minutes to deliver what a fresh one delivers in seconds, and why doorbells stopped firing.
+     *
+     * A revived session that behaves differently from a fresh one is the defect. This is one of the
+     * two halves of making them the same.
+     */
+    #relayLeafHandler(agentName, sessionId, correlationId) {
+        return (frame) => {
+            // The counterparty's witnessed leaf arrived with its canonical sequence. The
+            // plaintext is delivered separately over the direct content stream; this is the
+            // ordering/witness signal. Full canonical-sequence reconciliation against the
+            // local tree is MSG-001-3b (J-CONTENT).
+            this.#logger.info("session.relay.leaf.delivered", {
+                sessionId,
+                sequenceNumber: frame.sequence_number,
+                leafKind: frame.leaf_kind,
+                correlationId,
+            });
+            // DOD-MSG-4 (strict in-order): record the relay-witnessed canonical sequence for the
+            // counterparty's MSG leaves. The relay is the ordering authority; structure1_cbor =
+            // [1, content_hash(32), sender_pubkey, session_id, last_seen_seq, ts]. The relay sequence
+            // is 1-based and global per session; the daemon tree is 0-based — normalize with -1. Only
+            // COUNTERPARTY leaves (the ones B will ingest); our own echoed leaf already lands via the
+            // send path. The gate (ingestReceivedContent) reads this map to hold out-of-order arrivals.
+            if (!frame.authored_by_us && frame.leaf_kind !== LEAF_KIND_CTRL) {
+                try {
+                    const s1 = decode(frame.structure1_cbor);
+                    const contentHash = s1?.[1];
+                    if (contentHash instanceof Uint8Array && frame.sequence_number > 0) {
+                        this.recordWitnessedSequence(agentName, sessionId, Buffer.from(contentHash).toString("hex"), frame.sequence_number - 1);
+                    }
+                }
+                catch (err) {
+                    this.#logger.warn("session.relay.leaf.witness.decode.failed", {
+                        sessionId,
+                        error: err instanceof Error ? err.message : String(err),
+                        correlationId,
+                    });
+                }
+            }
+            // M7-UPGRADE-002: auto-acknowledge close. When the COUNTERPARTY's SEAL ctrl leaf (0x02)
+            // arrives and B has verified the content, B's OWN node auto-co-signs the responder SEAL
+            // leaf — no agent prompt — so the bilateral seal completes promptly instead of degrading
+            // to unilateral on a slow/busy/crashed agent. Never auto-ack our OWN echoed ctrl leaf.
+            if (frame.leaf_kind === LEAF_KIND_CTRL && !frame.authored_by_us) {
+                this.#maybeAutoAcknowledgeSeal(agentName, sessionId, correlationId);
+            }
+        };
+    }
     async #connectSessionRelay(sessionId, node, agentName, relay, correlationId) {
         try {
             // The session node's gater admits only the counterparty; the relay witness is a
@@ -2344,47 +2455,7 @@ export class SessionNodeManager {
                 this.#relayClients.set(clientKey, client);
             }
             const sessionIdHexForRelay = Buffer.from(relay.sessionIdBytes).toString("hex");
-            client.registerSession(sessionIdHexForRelay, node, (frame) => {
-                // The counterparty's witnessed leaf arrived with its canonical sequence. The
-                // plaintext is delivered separately over the direct content stream; this is the
-                // ordering/witness signal. Full canonical-sequence reconciliation against the
-                // local tree is MSG-001-3b (J-CONTENT).
-                this.#logger.info("session.relay.leaf.delivered", {
-                    sessionId,
-                    sequenceNumber: frame.sequence_number,
-                    leafKind: frame.leaf_kind,
-                    correlationId,
-                });
-                // DOD-MSG-4 (strict in-order): record the relay-witnessed canonical sequence for the
-                // counterparty's MSG leaves. The relay is the ordering authority; structure1_cbor =
-                // [1, content_hash(32), sender_pubkey, session_id, last_seen_seq, ts]. The relay sequence
-                // is 1-based and global per session; the daemon tree is 0-based — normalize with -1. Only
-                // COUNTERPARTY leaves (the ones B will ingest); our own echoed leaf already lands via the
-                // send path. The gate (ingestReceivedContent) reads this map to hold out-of-order arrivals.
-                if (!frame.authored_by_us && frame.leaf_kind !== LEAF_KIND_CTRL) {
-                    try {
-                        const s1 = decode(frame.structure1_cbor);
-                        const contentHash = s1?.[1];
-                        if (contentHash instanceof Uint8Array && frame.sequence_number > 0) {
-                            this.recordWitnessedSequence(agentName, sessionId, Buffer.from(contentHash).toString("hex"), frame.sequence_number - 1);
-                        }
-                    }
-                    catch (err) {
-                        this.#logger.warn("session.relay.leaf.witness.decode.failed", {
-                            sessionId,
-                            error: err instanceof Error ? err.message : String(err),
-                            correlationId,
-                        });
-                    }
-                }
-                // M7-UPGRADE-002: auto-acknowledge close. When the COUNTERPARTY's SEAL ctrl leaf (0x02)
-                // arrives and B has verified the content, B's OWN node auto-co-signs the responder SEAL
-                // leaf — no agent prompt — so the bilateral seal completes promptly instead of degrading
-                // to unilateral on a slow/busy/crashed agent. Never auto-ack our OWN echoed ctrl leaf.
-                if (frame.leaf_kind === LEAF_KIND_CTRL && !frame.authored_by_us) {
-                    this.#maybeAutoAcknowledgeSeal(agentName, sessionId, correlationId);
-                }
-            }, relay.assignment);
+            client.registerSession(sessionIdHexForRelay, node, this.#relayLeafHandler(agentName, sessionId, correlationId), relay.assignment);
             const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
             if (entry) {
                 entry.relayClient = client;
@@ -2483,6 +2554,26 @@ export class SessionNodeManager {
         node.onPeerConnect((peerId) => {
             if (!isCounterparty(peerId))
                 return;
+            /**
+             * DOD-M12B-RESPONDER-ADDR-1 (review MEDIUM-4) — LEARN THE ADDRESS HERE, where it cannot race.
+             *
+             * The accept-time read was a race between two independent async chains: the responder accepts
+             * off a signaling frame, while the initiator dials only after its own `createSessionNode`. If
+             * accept looked before the dial landed it saw nothing, and the responder was back to holding
+             * no address — the state that made every reply after an interruption park forever.
+             *
+             * This fires exactly when the counterparty connects: on both sides, on the first connection,
+             * on every reconnect, and on a revived node too. It also REFRESHES, which the accept-time read
+             * never did — a counterparty that rebuilds its receiver would otherwise leave us dialling a
+             * dead address for the life of the session.
+             */
+            const observed = node
+                .getConnections()
+                .filter((c) => c.peerId === peerId && typeof c.remoteAddr === "string")
+                .map((c) => c.remoteAddr);
+            if (observed.length > 0) {
+                this.#counterpartyAddrs.set(key, [...new Set(observed)]);
+            }
             const prior = this.#sessionLiveness.get(key);
             this.#sessionLiveness.set(key, "alive");
             if (prior !== "alive") {
@@ -2736,7 +2827,7 @@ export class SessionNodeManager {
                     "Close an existing session before starting a new one.",
             };
         }
-        const { node, gater, autoNat } = inboundSr;
+        const { node, gater, autoNat, seed } = inboundSr;
         // AC-015: update gater BEFORE retrieving multiaddr / returning to caller
         gater.setAllowedPeer(initiatorPeerId);
         const peerId = node.getPeerId();
@@ -2747,6 +2838,11 @@ export class SessionNodeManager {
         // pointed at this initiator.
         if (!this.#insertSessionRow(sessionId, agentName, counterpartyPubkey, "active")) {
             this.#standingReceivers.delete(agentName);
+            // DOD-M12B-SESSION-SEED-1 (review F8): this abort happens BEFORE `#rememberSessionSeed`, so
+            // the identity is not being handed to a session — it is being discarded, and is zeroed like
+            // any other discard. (The two PROMOTION sites deliberately do not zero: there the same bytes
+            // become the session's.)
+            inboundSr.seed.fill(0);
             try {
                 await node.stop();
             }
@@ -2792,9 +2888,55 @@ export class SessionNodeManager {
             counterpartySessionPeerId: initiatorPeerId,
             autoNat,
         });
+        this.#rememberSessionSeed(agentName, sessionId, seed, initiatorPeerId, counterpartyPubkey);
         // DAEMON-004: register the content stream handler for the inbound session.
         await this.#registerContentHandler(agentName, sessionId, node, counterpartyPubkey);
         // M7-SESSION-003 AC-004: act on the inbound session node's peer events too.
+        /**
+         * DOD-M12B-RESPONDER-ADDR-1 — LEARN THE INITIATOR'S ADDRESS, because we will need it and this is
+         * the only moment we have it.
+         *
+         * MEASURED LIVE 2026-08-18. After an interruption the responder's re-dial reported
+         * `session.transport.redial.unavailable` — *"this side holds no address for the counterparty, so
+         * every send parks until they re-establish"* — and every reply it tried to send failed. The
+         * initiator can always come back because it kept the addresses it dialled; the responder dialled
+         * nothing, so it kept nothing.
+         *
+         * In plain terms that meant: whoever ANSWERED a conversation could not restart it. Their replies
+         * went nowhere until the other side spoke first.
+         *
+         * The live connection has known the address all along — the responder is holding it right now,
+         * because the initiator just dialled in on it. `#counterpartyAddrs` is the same store the
+         * initiator fills from its signed relay assignment, and `#evictSessionCaches` hands both to the
+         * revival record on the way down, so this needs no separate lifetime.
+         */
+        const inboundAddrs = node
+            .getConnections()
+            .filter((c) => c.peerId === initiatorPeerId && typeof c.remoteAddr === "string")
+            .map((c) => c.remoteAddr);
+        if (inboundAddrs.length > 0) {
+            this.#counterpartyAddrs.set(this.#k(agentName, sessionId), [...new Set(inboundAddrs)]);
+            this.#logger.info("session.counterparty.addr.learned", {
+                agentName,
+                sessionId,
+                addrs: inboundAddrs.length,
+                source: "inbound_connection",
+                impact: "this side can now re-dial after an interruption instead of parking every reply",
+            });
+        }
+        else {
+            // NOT A WARNING. Review MEDIUM-4: accept runs off a signaling frame and the initiator dials
+            // separately, so "no connection yet" is the ordinary in-flight case — warning on it puts a
+            // signal on the normal path, which is how the one occurrence that matters gets buried. The
+            // race-free capture is in `#wireSessionLiveness`'s onPeerConnect, which fires when the dial
+            // actually lands; this read is only a fast path for when it already has.
+            this.#logger.debug("session.counterparty.addr.deferred", {
+                agentName,
+                sessionId,
+                initiatorPeerId,
+                impact: "no connection observed yet; the address is captured when the counterparty connects",
+            });
+        }
         this.#wireSessionLiveness(agentName, sessionId, node, counterpartyPubkey, correlationId, initiatorPeerId);
         // M7 DOD-SPINE-6 / MSG-001-3b: the receiver also connects to the relay witness so
         // the relay can deliver the initiator's witnessed leaves (leaf_deliver) to it.
@@ -3028,6 +3170,16 @@ export class SessionNodeManager {
         this.#heldRestored.delete(key);
         this.#heldReleased.delete(key);
         this.#diverged.delete(key);
+        // DOD-M12B-SESSION-SEED-1: HAND THEM TO THE REVIVAL RECORD BEFORE DROPPING THEM. This eviction
+        // runs on every teardown, including the interruption a revival is meant to undo — so clearing
+        // the addresses here is what left a revived session unable to dial anyone. The revival record
+        // has exactly the right lifetime for them: it dies when the session reaches a terminal status.
+        const survivingAddrs = this.#counterpartyAddrs.get(key);
+        if (survivingAddrs && survivingAddrs.length > 0) {
+            const identity = this.#sessionSeeds.get(key);
+            if (identity)
+                identity.counterpartyAddrs = [...survivingAddrs];
+        }
         this.#counterpartyAddrs.delete(key);
         this.#redialNotBefore.delete(key);
         this.#highWaterSeq.delete(key);
@@ -3150,6 +3302,13 @@ export class SessionNodeManager {
         // plaintext must not survive shutdown in memory).
         this.#trees.clear();
         this.#receivedContent.clear();
+        // DOD-M12B-SESSION-SEED-1 (review F5): transport identities are key material and belong in the
+        // same sentence as the plaintext above. Shutdown marks every active row `interrupted` by direct
+        // SQL, so no `#updateSessionStatus` destroy fires for them — without this, every live session's
+        // seed survives the shutdown in memory for as long as the process lingers.
+        for (const identity of this.#sessionSeeds.values())
+            identity.seed.fill(0);
+        this.#sessionSeeds.clear();
         // Stop ALL per-agent standing receivers (DOD-LOOP-1). In PARALLEL and BOUNDED: this was a
         // sequential await per agent with no deadline, so five agents meant five chances for one stuck
         // libp2p teardown to hold the exit — and it sits between the operator being told the daemon is
@@ -3168,6 +3327,10 @@ export class SessionNodeManager {
                 });
             }
         })), "standing_receivers", this.#standingReceivers.size);
+        // Same reason: a receiver's seed is the identity it has already advertised in
+        // `session_offer_accept` for any session it is mid-handshake on.
+        for (const sr of this.#standingReceivers.values())
+            sr.seed.fill(0);
         this.#standingReceivers.clear();
         this.#srReservationRetry.clear();
         this.#srLastRejectionReason.clear();
@@ -3207,9 +3370,38 @@ export class SessionNodeManager {
             .all(status);
     }
     /**
-     * DOD-M12B-RESTART-SEAL-1 — the sessions OUR OWN stop orphaned, and only those.
+     * DOD-M12B-RESTART-SEAL-1 / DOD-M12B-PENDING-RESOLVE-1 — sessions that need a receipt and have
+     * nobody asking for one. TWO populations, one queue, each with its own safety argument.
+     *
+     * **(2) `seal_interrupted_pending` — a seal commitment nobody notarized.** Measured 2026-08-18 on
+     * the live store: 28 sessions, aged 0.3 to 12.8 days, one of them 14 messages long, 26 holding
+     * relay-witnessed seal leaves, and **not one with a sealed root**.
      *
-     * `interrupted_by` is the whole safety argument. `'local'` means the boot sweep, the shutdown
+     * **HALF OF THEM ARE NOT BILATERAL, and the first version of this comment claimed they were.**
+     * Measured split: 14 initiator rows, each carrying the counterparty's signed leaf — and 14
+     * responder rows with `counterparty_leaf = NULL`. A responder row is written by
+     * `inbound-seal-request.ts` from an UNSIGNED `seal_interrupted_request` frame, before its ack is
+     * even sent, so an ordinary send failure produces a one-sided pending row.
+     *
+     * So the licence is NOT "both parties signed". It is **somebody chose to end this**, on two
+     * branches: an initiator row carries the counterparty's signature, and a responder row exists
+     * because the counterparty sent a request to seal. And what makes the result VERIFIABLE is
+     * neither — it is that the directory rebuilds the tree from relay-witnessed leaves and checks
+     * their signatures, never consulting the commitment at all. The commitment is what makes it
+     * legitimate to ASK. (`close-session-handler.ts` states this in full; the first draft of this
+     * header contradicted it 200 lines away.) `PENDING-EXIT-1` built their exit and it works — but only when an operator runs
+     * `cello_close_session` on that session by hand, having somehow deduced they should. Nothing
+     * enumerated them, because both sweeps filtered `status = 'interrupted'`. An exit nobody is told
+     * about is not an exit.
+     *
+     * `interrupted_by` is deliberately NOT consulted for that population. It answers "did WE cause
+     * this, and may we therefore describe it" — and that is the wrong question once a seal was
+     * requested or signed. **SI-001 is not weakened:** it forbids notarizing *"a conversation nobody
+     * chose to end"*, and every row here was chosen to be ended by one side or the other. The only
+     * thing missing is the request to notarize it.
+     *
+     * **(1) `interrupted` — sessions our own stop orphaned, and only those.** Here `interrupted_by` is
+     * the whole safety argument. `'local'` means the boot sweep, the shutdown
      * sweep, or the operator's own kill switch ended this session — nobody else did, and it cannot be
      * resumed because the transport keypairs died with the process. Those are the ones the resolver
      * may seal on its own.
@@ -3238,9 +3430,23 @@ export class SessionNodeManager {
         // `restart_seal_gave_up_at IS NULL` — a session we have already exhausted. Without it a
         // machine restarting ~6 times a day re-runs five ceremonies against a hopeless session on
         // every boot, forever.
-        `SELECT s.session_id AS session_id, s.message_count AS message_count, a.agent_name AS agent_name
+        `SELECT s.session_id AS session_id, s.message_count AS message_count, a.agent_name AS agent_name,
+                s.status AS status
          FROM sessions s JOIN agents a ON a.agent_id = s.agent_id
-         WHERE s.status = 'interrupted' AND s.interrupted_by = 'local' AND a.state != 'retired'
+         WHERE a.state != 'retired'
+           AND (
+                 -- (1) OURS, and we can say so. SI-001 holds: an interrupted session with an
+                 -- unknown cause has no signatures behind it and must not be notarized.
+                 (s.status = 'interrupted' AND s.interrupted_by = 'local')
+                 -- (2) A seal commitment with nobody asking for it. review F5: the EXISTS is
+                 -- STRUCTURAL, not decoration. The header's licence is "a commitment was made", and
+                 -- a status check alone asserts that in prose while the query checks something
+                 -- else. Today status implies an artifact row by construction, which is exactly the
+                 -- kind of invariant that holds until someone adds a fourth writer.
+                 OR (s.status = 'seal_interrupted_pending'
+                     AND EXISTS (SELECT 1 FROM seal_interrupted_artifacts sa
+                                 WHERE sa.agent_id = s.agent_id AND sa.session_id = s.session_id))
+               )
            AND s.message_count > 0
            AND s.restart_seal_gave_up_at IS NULL
          ORDER BY s.updated_at ASC`)
@@ -3249,8 +3455,216 @@ export class SessionNodeManager {
             agentName: r.agent_name,
             sessionId: r.session_id,
             messageCount: r.message_count ?? 0,
+            // Carried so a give-up can say something TRUE about this session: the two populations need
+            // different words, and force-abandon is right for one and destructive for the other.
+            status: r.status === "seal_interrupted_pending" ? "seal_interrupted_pending" : "interrupted",
         }));
     }
+    /**
+     * DOD-M12B-REVIVAL-BOUND-1 — interrupted sessions that can no longer be revived, and must close.
+     *
+     * Andre, 2026-08-18: *"after that, those peer IDs and that peer connection needs to be shut down.
+     * It is an open connection that a malicious agent can farm for."* The tenet is **leave nothing
+     * open that is no longer needed**, and the threat model is a daemon that has been reprogrammed —
+     * so the guarantee has to hold on the side that is not the attacker.
+     *
+     * WHAT IS OPEN. `ingestReceivedContent` refuses `sealed`, `seal_interrupted_pending` and
+     * `abandoned`, but deliberately ACCEPTS `interrupted` — that acceptance is the only reason
+     * recovery can work. Nothing else ever leaves `interrupted`, so it means accepts FOREVER.
+     *
+     * **THIS IS THE BACKSTOP, NOT THE COMPLEMENT.** The seal path gets first refusal on every
+     * local-cause session, because a session whose ending we can describe truthfully earns a
+     * notarized receipt. But "the seal path owns it" is not the same as "the seal path will finish
+     * it", and two populations fall through the gap between those:
+     *
+     *   - **The resolver gave up.** `markRestartSealGaveUp` writes only `restart_seal_gave_up_at`;
+     *     the status stays `interrupted`, and `listRestartOrphanedSessions` then excludes the row by
+     *     `restart_seal_gave_up_at IS NULL` so it is never retried. `TERMINAL_SEAL_REFUSALS` has ten
+     *     entries and the measured figure is that 59% of seals that start never finish, so this is
+     *     the common case, not a corner.
+     *   - **Zero-message local sessions.** The resolver requires `message_count > 0` — a dead
+     *     handshake is not worth a ceremony. It is still an open write surface.
+     *
+     * Excluding those left them permanently interrupted and permanently writable, which is the exact
+     * condition this line exists to end. And the population is about to become the majority: no row
+     * has ever carried `interrupted_by = 'local'` yet, and from the next shutdown onward every
+     * shutdown-orphaned session will. So the sweep takes a local-cause session once the seal path
+     * has either declined it or exhausted it — never before.
+     *
+     * **THE CLOCK MUST BE ONE THE COUNTERPARTY CANNOT MOVE.** The obvious fallback for a row with no
+     * `interrupted_at` is `updated_at` — and it is exactly wrong. `ingestReceivedContent` accepts
+     * content into an `interrupted` session (that acceptance is this whole line's premise), and a
+     * successful ingest runs `UPDATE sessions SET message_count = ?, updated_at = <now>`. So
+     * `updated_at` is a clock the reprogrammed peer holds: one message every 24 hours and the session
+     * never expires, forever. The fallback would have handed the attacker the off switch for the
+     * control built to stop them.
+     *
+     * Instead the missing timestamps are STAMPED ONCE, by `#stampMissingInterruptedAt` immediately
+     * before this query runs, and this query reads `interrupted_at` and nothing else. The stamp is
+     * written under `WHERE interrupted_at IS NULL`, so it is monotone — set once, never moved, by us
+     * and not by a peer. A legacy row therefore gets its full window starting from the first sweep
+     * that sees it, which is later than the true interruption but is the only bound that is sound.
+     *
+     * Same retired-agent INNER JOIN as the sibling query: a retired agent's rows are kept for
+     * accountability, are not resumable, and are not writable either.
+     *
+     * **THE TIME ARITHMETIC IS LOAD-BEARING, AND BOTH OBVIOUS FORMS OF IT ARE WRONG.** These two
+     * columns do not hold the same kind of value:
+     *
+     *   `interrupted_at`  TEXT,    an ISO-8601 string — `new Date(now).toISOString()`.
+     *   `updated_at`      INTEGER, epoch milliseconds.
+     *
+     * There are FOUR writers of `status = 'interrupted'`, not three. The fourth is
+     * `destroySessionNode` → `#updateSessionStatus(…, "interrupted", "local")`, which historically
+     * wrote `interrupted_by` and **no timestamp at all** — and it is the path that produced the two
+     * rows in Entry 41. It now stamps `interrupted_at` like the others, so NULL is a legacy state
+     * rather than one production keeps creating.
+     *
+     * So a bare `interrupted_at <= ?` against a numeric bound is **always false** — the column has
+     * TEXT affinity and the bound parameter has none, so SQLite applies TEXT affinity to the
+     * parameter and compares them as STRINGS (`'2026-08-18T05:32:04.183Z' <= 1755000000000` → 0).
+     * The query silently returns nothing forever and reads as "nothing has expired yet". And
+     * `CAST(interrupted_at AS
+     * INTEGER)` is worse than useless: SQLite casts by taking the leading digits, so
+     * `'2026-08-18T05:32:04Z'` becomes **2026**, which is older than any epoch bound. That form
+     * abandons every interrupted session on the next boot, immediately, whatever its age. It was
+     * written, and `session-001`/`cello-list-sessions` failed on it in the gate.
+     *
+     * `strftime('%s', …) * 1000` parses the ISO string properly and returns NULL for anything it
+     * cannot parse — so a malformed or differently-formatted value falls through the COALESCE to
+     * `updated_at` rather than being read as the year 2026.
+     */
+    listExpiredUnrevivableSessions(nowMs, windowMs) {
+        if (!this.#db) {
+            // ABSENT IS NOT FINE. An empty array here is indistinguishable from "the store is clean",
+            // which is the state this line exists to end — so the one boot where the sweep could not
+            // read the store must not look like the boots where it read it and found nothing.
+            this.#logger.error("session.revival_bound.enumerate.failed", {
+                error: "db not initialized",
+                impact: "no interrupted session was checked against the revival window this boot; any that "
+                    + "have expired are still accepting content",
+            });
+            return [];
+        }
+        const rows = this.#db
+            .prepare(`SELECT s.session_id AS session_id, s.interrupted_by AS cause, a.agent_name AS agent_name
+         FROM sessions s JOIN agents a ON a.agent_id = s.agent_id
+         WHERE s.status = 'interrupted' AND a.state != 'retired'
+           AND (COALESCE(s.interrupted_by, '') != 'local'
+                OR s.restart_seal_gave_up_at IS NOT NULL
+                OR s.message_count = 0)
+           AND CAST(strftime('%s', s.interrupted_at) AS INTEGER) * 1000 <= ?
+         ORDER BY CAST(strftime('%s', s.interrupted_at) AS INTEGER) * 1000 ASC`)
+            .all(nowMs - windowMs);
+        return rows.map((r) => ({ agentName: r.agent_name, sessionId: r.session_id, cause: r.cause }));
+    }
+    /**
+     * DOD-M12B-REVIVAL-BOUND-1 — give every timestamp-less interrupted session a clock, once.
+     *
+     * A row with `interrupted_at IS NULL` has no bound that can be evaluated, and skipping such rows
+     * would exempt the oldest sessions in the store from the control permanently — the same "open
+     * forever" failure wearing a different NULL. The two rows measured in Entry 41 are exactly this
+     * shape, written by a `destroySessionNode` path that set the cause and no timestamp.
+     *
+     * **`WHERE interrupted_at IS NULL` is the security property, not an optimisation.** It makes the
+     * stamp write-once: this can run on every sweep forever and a row's clock still cannot be moved
+     * after the first one. That is what disqualifies `updated_at`, which a peer moves with every
+     * message it sends into the still-accepting session.
+     *
+     * The cost is honest and bounded: a legacy row's window starts at the first sweep that sees it
+     * rather than at its true interruption, so it survives up to one window longer than it should.
+     * A late close is recoverable; a clock the counterparty winds is not.
+     *
+     * @returns how many rows were stamped.
+     */
+    #stampMissingInterruptedAt(nowMs) {
+        if (!this.#db)
+            return 0;
+        try {
+            const res = this.#db
+                .prepare("UPDATE sessions SET interrupted_at = ? WHERE status = 'interrupted' AND interrupted_at IS NULL")
+                .run(new Date(nowMs).toISOString());
+            const stamped = Number(res?.changes ?? 0);
+            if (stamped > 0) {
+                this.#logger.info("session.revival_bound.clock.stamped", {
+                    stamped,
+                    impact: "these sessions had no interruption timestamp; their revival window starts now",
+                });
+            }
+            return stamped;
+        }
+        catch (err) {
+            this.#logger.error("session.revival_bound.clock.stamp.failed", {
+                error: err instanceof Error ? err.message : String(err),
+                impact: "sessions with no interruption timestamp cannot be evaluated and stay open",
+            });
+            return 0;
+        }
+    }
+    /**
+     * DOD-M12B-REVIVAL-BOUND-1 — close every session the revival window has expired.
+     *
+     * `abandonSession` is the right instrument and already exists: it flips the status FIRST and
+     * synchronously, annexes held content so the operator does not lose mail that has nowhere to go,
+     * and retires the node. It notarizes nothing, which is the point — we are closing a door, not
+     * asserting how it came to be open.
+     *
+     * One session's failure must not strand the rest, so each is caught and logged; the sweep runs at
+     * boot beside the restart-seal resolver and a throw there would take the daemon with it.
+     *
+     * @returns how many sessions actually flipped — not how many were attempted.
+     */
+    async closeExpiredUnrevivableSessions(nowMs, windowMs) {
+        // Stamp FIRST. A row with no clock cannot be evaluated by the query below, and this is the only
+        // thing that gives it one. Running it before every sweep is safe because the write is scoped to
+        // rows that have no timestamp yet.
+        this.#stampMissingInterruptedAt(nowMs);
+        const expired = this.listExpiredUnrevivableSessions(nowMs, windowMs);
+        let closed = 0;
+        for (const s of expired) {
+            try {
+                if (await this.abandonSession(s.agentName, s.sessionId)) {
+                    closed += 1;
+                    this.#logger.info("session.revival_bound.closed", {
+                        agentName: s.agentName,
+                        sessionId: s.sessionId,
+                        // The cause we could NOT establish is the reason this ends without a receipt — log it
+                        // so an operator asking "why no certificate?" gets the answer here.
+                        interruptedBy: s.cause ?? "unknown",
+                        windowMs,
+                        // NAME THE FORFEIT. Until this sweep ran, `cello_close_session` (without `force`) still
+                        // accepted this session — it takes `status IN ('active','interrupted')` — so the
+                        // operator could have come back days later and obtained a real seal. `abandoned` is in
+                        // TERMINAL_SEAL_REFUSALS, so after this they cannot. That is a deliberate trade (SI-001
+                        // forbids auto-sealing a session nobody chose to end) and it costs something real, so
+                        // it is stated rather than left implicit in a WHERE clause.
+                        forfeited: "a seal was still obtainable by hand until now; it is not after this",
+                    });
+                }
+            }
+            catch (err) {
+                this.#logger.warn("session.revival_bound.close.failed", {
+                    agentName: s.agentName,
+                    sessionId: s.sessionId,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+        }
+        // UNCONDITIONAL. A sweep that found nothing and a sweep that never really ran must not produce
+        // the same silence — this line is the only proof the control executed at all.
+        this.#logger.info("session.revival_bound.sweep", { expired: expired.length, closed, windowMs });
+        if (closed !== expired.length) {
+            // Not arithmetic for the reader to do: a session the security control failed to close is one
+            // that is still interrupted and still accepting content.
+            this.#logger.warn("session.revival_bound.sweep.incomplete", {
+                expired: expired.length,
+                closed,
+                failed: expired.length - closed,
+                impact: "these sessions are still interrupted and still accept content from any peer that dials them",
+            });
+        }
+        return closed;
+    }
     /**
      * DOD-M12B-RESTART-SEAL-1 — record that automatic sealing has exhausted this session.
      *
@@ -3562,7 +3976,18 @@ export class SessionNodeManager {
         const result = this.#db
             .prepare("UPDATE sessions SET status = 'seal_interrupted_pending', updated_at = ? WHERE agent_id = ? AND session_id = ? AND status IN ('active', 'interrupted')")
             .run(now, this.#requireAgentId(opts.agentName), opts.sessionId);
-        return Number(result.changes) > 0;
+        const landed = Number(result.changes) > 0;
+        if (landed) {
+            // DOD-M12B-SESSION-SEED-1 (review F3): `seal_interrupted_pending` is NOT a state revival
+            // exists for, and the first build's comment wrongly grouped it with `interrupted`.
+            // `ingestReceivedContent` refuses it outright, and BOTH sweeps that could otherwise close a
+            // session — `listRestartOrphanedSessions` and `listExpiredUnrevivableSessions` — filter
+            // `status = 'interrupted'`, so a pending-seal session is unrevivable AND unswept. Keeping its
+            // identity meant holding it until the process exited. Entry 42's own measurement is that 59%
+            // of seals that start never finish, so that is the common path, not a corner.
+            this.#destroySessionSeed(opts.agentName, opts.sessionId);
+        }
+        return landed;
     }
     /**
      * M7-SESSION-001 (H-1): read back the persisted bilateral commitment artifacts
@@ -4112,9 +4537,12 @@ export class SessionNodeManager {
             // like a protocol mystery for a night.
             //
             // `counterpartySessionPeerId` is the load-bearing field. It is recorded ONCE at session
-            // establishment and never refreshed, while a standing receiver is rebuilt with a fresh keypair
-            // on every signaling reconnect — so if the two ever cross, every send goes one-way forever and
-            // nothing says so. With this line that becomes a single grep instead of a night.
+            // establishment and never refreshed. (CORRECTED 2026-08-18: this used to say a standing
+            // receiver is rebuilt "on every signaling reconnect" — it is not. `ensureStandingReceiverForAgent`
+            // no-ops on a healthy receiver; the only rebuild triggers are a LOST RELAY RESERVATION and the
+            // one-shot upgrade when relay endpoints first arrive.) If the two ever cross, every send goes
+            // one-way forever and nothing says so. With this line that becomes a single grep instead of a
+            // night.
             this.#logger.warn("session.content.direct.send.failed", {
                 agentName,
                 sessionId,
@@ -6882,6 +7310,22 @@ export class SessionNodeManager {
             const sr = this.#standingReceivers.get(agentName);
             if (sr) {
                 this.#standingReceivers.delete(agentName);
+                /**
+                 * DOD-M12B-SESSION-SEED-1 (review F8): drop it zeroed, like every other seed.
+                 *
+                 * (review F7, DECIDED AGAINST — deliberately NOT reusing this seed for the replacement.)
+                 * Reuse is attractive: this receiver's peer id may already be inside a `session_offer_accept`
+                 * the counterparty is acting on, and a rebuild in that window is the documented "we record
+                 * an identity that no longer exists… every send in this direction parks forever" defect. But
+                 * a preserved identity would have to be handed to the candidate loop in
+                 * `#startReceiverNode`, whose rejected candidates are stopped WITHOUT awaiting `start()` —
+                 * so two nodes could be briefly live on one advertised peer id, which is review F1, a HIGH,
+                 * and the reason each candidate now mints its own. Fixing F7 properly means bounding and
+                 * awaiting the loser's teardown first, and an unawaited stop is precisely what the current
+                 * code chose to avoid a stuck libp2p teardown blocking receiver creation. Filed as
+                 * follow-on work rather than trading a MEDIUM fix for a HIGH regression.
+                 */
+                sr.seed.fill(0);
                 try {
                     sr.autoNat.stop();
                     await sr.node.stop();
@@ -7166,11 +7610,25 @@ export class SessionNodeManager {
      */
     async #startReceiverNode(agentName, sessionId, gater, candidateCircuitAddrs, correlationId) {
         for (const circuitAddr of candidateCircuitAddrs) {
+            // DOD-M12B-SESSION-SEED-1: A SEED PER CANDIDATE, NOT ONE FOR THE LOOP.
+            //
+            // A rejected candidate is stopped with an unawaited `void …then(() => candidate.stop())`
+            // while its `start()` may still be in flight, so two candidate nodes can briefly be live at
+            // once. Sharing one seed would give both the SAME peer id — and the loser would then be a
+            // second live node under the identity we advertise in `session_offer_accept`, sharing this
+            // gater (so it admits dials) with no content handler registered. Inbound arriving there goes
+            // nowhere, and it is an open endpoint under our advertised id: the "connection a malicious
+            // agent can farm for" the tenet names. Before seeds existed the loser had its own random key
+            // and was harmless; introducing a shared seed is what would have made it dangerous.
+            //
+            // Nothing reads the seed before the winner is installed, so per-candidate costs nothing.
+            const candidateSeed = randomBytes(32);
             const candidate = await this.#factory.createNode({
                 sessionId,
                 connectionGater: gater,
                 nodeType: "standing_receiver",
                 circuitRelayListenAddrs: [circuitAddr],
+                transportPrivateKey: candidateSeed,
             });
             let timer;
             const timedOut = Symbol("reservation_timeout");
@@ -7196,7 +7654,7 @@ export class SessionNodeManager {
             // completes the handshake and simply grants nothing, leaving a node that looks
             // started and is reachable by nobody.
             if (outcome === "started" && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
-                return candidate;
+                return { node: candidate, seed: candidateSeed };
             }
             const rejectionReason = outcome === "started"
                 ? "relay_granted_no_reservation"
@@ -7217,13 +7675,15 @@ export class SessionNodeManager {
                 .then(() => candidate.stop())
                 .catch(() => { });
         }
+        const plainSeed = randomBytes(32);
         const plain = await this.#factory.createNode({
             sessionId,
             connectionGater: gater,
             nodeType: "standing_receiver",
+            transportPrivateKey: plainSeed,
         });
         await plain.start();
-        return plain;
+        return { node: plain, seed: plainSeed };
     }
     /** One standing-receiver create attempt (extracted for the M8B F14 retry loop). */
     async #tryCreateStandingReceiver(agentName, correlationId) {
@@ -7242,8 +7702,21 @@ export class SessionNodeManager {
             gater.setAllowedOutboundPeer(relayPeerId);
         }
         let node;
+        /**
+         * DOD-M12B-SESSION-SEED-1 — the transport identity of the receiver that actually survived.
+         *
+         * Minted per CANDIDATE inside `#startReceiverNode` and returned with the winner, not minted
+         * here: a rejected candidate is stopped without awaiting its `start()`, so two candidates can
+         * be briefly live, and one shared seed would put both on the same advertised peer id.
+         *
+         * FRESH EVERY TIME, which is the privacy property rather than an implementation detail. A
+         * receiver serves at most one session (it is promoted into the session at handoff and replaced),
+         * so no identifier is ever shared between two sessions and the 2026-04-11 rationale —
+         * unlinkability of an agent's sessions to a passive observer — survives intact.
+         */
+        let seed;
         try {
-            node = await this.#startReceiverNode(agentName, sessionId, gater, reservations.addrs, correlationId);
+            ({ node, seed } = await this.#startReceiverNode(agentName, sessionId, gater, reservations.addrs, correlationId));
         }
         catch (err) {
             // extractErrorMessage, NOT String(err): the transport throws structured
@@ -7314,6 +7787,7 @@ export class SessionNodeManager {
             node,
             gater,
             autoNat,
+            seed,
             hasReservation: circuitAddrs > 0,
             ...(reservedRelayPeerId !== undefined ? { relayPeerId: reservedRelayPeerId } : {}),
         });
@@ -7355,6 +7829,627 @@ export class SessionNodeManager {
      * M8B F14: also called from the inbound accept path (ensure on demand). Marks the agent as
      * WANTING a receiver, which arms the teardown re-arm in destroySessionNode/retireSessionNode.
      */
+    /**
+     * DOD-M12B-SESSION-SEED-1 test seam: the seed the agent's current standing receiver holds.
+     *
+     * The property under test — "the receiver built behind a promoted one never reuses its seed" — is
+     * about an identity that by design never leaves the process, so there is no observable surface for
+     * it short of a live two-node dial. Reading it here is the narrowest way to pin it.
+     */
+    /** DOD-M12B-SESSION-SEED-1: record the identity this session must be able to return at. */
+    #rememberSessionSeed(agentName, sessionId, seed, counterpartyPeerId, counterpartyPubkey) {
+        const key = this.#k(agentName, sessionId);
+        // Defensive: unreachable today because `insertSessionRow` PK-conflicts on a repeat, but an
+        // overwrite that dropped a live seed un-zeroed would leave the one copy we are responsible for
+        // in the heap with nothing tracking it.
+        this.#sessionSeeds.get(key)?.seed.fill(0);
+        // `counterpartyAddrs` starts empty: at creation the signed assignment has not necessarily
+        // arrived yet. It is filled by `#evictSessionCaches` on the way down, which is the last moment
+        // the live addresses exist.
+        this.#sessionSeeds.set(key, { seed, counterpartyPeerId, counterpartyPubkey, counterpartyAddrs: [] });
+    }
+    /**
+     * DOD-M12B-SESSION-SEED-1 — destroy a session's transport identity.
+     *
+     * Called from `#updateSessionStatus` on a terminal status, in the SAME step that writes it, so
+     * there is no window in which a session is closed on paper and still revivable in memory.
+     *
+     * **WHAT THE ZERO-FILL DOES AND DOES NOT DO** — checked against the derivation, not assumed.
+     * `createNode` hands the buffer to `generateKeyPairFromSeed`, and `@libp2p/crypto` COPIES it
+     * (`uint8arrayConcat([seed, publicKeyRaw])`, then `Uint8Array.from`). Two consequences:
+     *   - zeroing after the node has started is SAFE — the running node holds its own copy;
+     *   - it does NOT erase the key from the heap. An identical usable copy is the first 32 bytes of
+     *     `privateKey.raw` on the node object until that node is dropped.
+     * So this removes OUR long-lived copy — the one that would otherwise sit in a map for the life of
+     * the process, decoupled from any node — and that is worth doing. It is not a heap scrub, and
+     * the DoD already says the bound rather than secrecy is the control.
+     */
+    #destroySessionSeed(agentName, sessionId) {
+        const key = this.#k(agentName, sessionId);
+        const identity = this.#sessionSeeds.get(key);
+        if (identity === undefined)
+            return;
+        identity.seed.fill(0);
+        this.#sessionSeeds.delete(key);
+        this.#logger.debug("session.seed.destroyed", { agentName, sessionId });
+    }
+    /**
+     * DOD-M12B-SESSION-SEED-1 — build a revived session node that is REACHABLE, without ever hanging.
+     *
+     * MEASURED 2026-08-18, live, three ways:
+     *   - handed 2 relay addrs at once, no deadline:  `start()` never completes (10,002ms and counting)
+     *   - handed none:                                `start()` in 1ms, but NOBODY can dial the node —
+     *                                                 the counterparty's re-dial fails
+     *                                                 `counterparty_dial_failed` and every message in
+     *                                                 both directions has to go the relay park route
+     *   - this:                                       one candidate at a time, each raced against its
+     *                                                 own deadline, plain node as the floor
+     *
+     * The middle option is what shipped for one test run and it made the session half-dead: revived,
+     * `active`, and unreachable. The first is what shipped before that and it hung. Neither is a
+     * choice between "fast" and "reliable" — the per-candidate race is how `#startReceiverNode` has
+     * always done it, and it is the shape that works in production every day.
+     *
+     * A FAILED CANDIDATE IS TORN DOWN AT SETTLEMENT. The first version awaited `stop()` immediately
+     * and claimed that made seed reuse safe; it did not — `libp2p.stop()` returns at once unless the
+     * node is `'started'`, and during the timeout window it is `'starting'` (review HIGH-3, verified
+     * against libp2p 3.3.2). The teardown is now chained onto the candidate's OWN start promise, so it
+     * runs whenever that settles, however late.
+     *
+     * A BRIEF OVERLAP IS THEREFORE POSSIBLE and is stated rather than denied: a candidate that grants
+     * at 4s comes up on this session's peer id and is stopped immediately after. What is guaranteed is
+     * that it dies, not that it never lives. The receiver path avoids even that by minting a seed per
+     * candidate; here the identity is fixed, which is the whole point of a revival, so that option
+     * does not exist.
+     *
+     * The floor is a plain node: a session that is usable over the relay park route beats no session.
+     */
+    async #buildRevivedNode(sessionId, gater, seed, candidateAddrs, agentName) {
+        for (const circuitAddr of candidateAddrs.slice(0, REVIVE_RESERVATION_CANDIDATES)) {
+            const candidate = await this.#factory.createNode({
+                sessionId,
+                connectionGater: gater,
+                nodeType: "session",
+                inboundReachable: true,
+                transportPrivateKey: seed,
+                circuitRelayListenAddrs: [circuitAddr],
+            });
+            // KEEP THE START PROMISE. Review HIGH-3: `libp2p.stop()` opens with
+            // `if (this.status !== 'started') return`, and during the whole timeout window the status is
+            // `'starting'` — so awaiting `stop()` on a timed-out candidate stopped nothing and waited for
+            // nothing. The abandoned `start()` stayed in flight, and if the relay answered late the node
+            // went live holding THIS SESSION'S peer id, sharing the gater (so it admits the counterparty)
+            // with no content handler registered, and with no reference left to stop it. Verified against
+            // libp2p 3.3.2 rather than assumed.
+            const startP = candidate.start();
+            let startError;
+            const started = await Promise.race([
+                startP.then(() => true),
+                new Promise((res) => setTimeout(() => res(false), REVIVE_RESERVATION_TIMEOUT_MS).unref?.()),
+            ]).catch((err) => { startError = err; return false; });
+            if (started && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
+                this.#logger.info("session.revive.reservation.granted", { agentName, sessionId });
+                return candidate;
+            }
+            // Started but granted nothing, or never started. Either way this node is not the one.
+            //
+            // Review MEDIUM-5: name WHICH of the three causes this was, the way `#startReceiverNode` does.
+            // "declined" alone stood for a relay that is full, a relay that is unreachable, and a relay
+            // that is merely slow — three different problems with three different responses, and the
+            // thrown error was discarded entirely.
+            const declineReason = started
+                ? "relay_granted_no_reservation"
+                : startError !== undefined
+                    ? "relay_unreachable"
+                    : "reservation_did_not_complete_in_time";
+            const isLast = circuitAddr === candidateAddrs.slice(0, REVIVE_RESERVATION_CANDIDATES).at(-1);
+            this.#logger.warn("session.revive.reservation.declined", {
+                agentName,
+                sessionId,
+                circuitAddr,
+                reason: declineReason,
+                ...(startError !== undefined ? { error: extractErrorMessage(startError) } : {}),
+                impact: isLast
+                    ? "no relay granted; the session comes up reachable only via the relay park route"
+                    : "trying the next relay",
+            });
+            // Teardown at SETTLEMENT, not now: a `stop()` issued while the node is still starting is a
+            // no-op (see above), so the only way to guarantee this node dies is to wait for its own start
+            // to finish first. Not awaited, so a hung start cannot hold the revival up — the point is that
+            // the teardown eventually happens, not that it happens before the next candidate.
+            void startP.then(() => candidate.stop().catch(() => { }), () => { });
+        }
+        // THE FLOOR. No reservation, so the counterparty cannot dial us directly — but their messages
+        // park at the relay and drain, which is how every message in the 2026-08-18 test arrived. A
+        // session usable one way beats a session that never comes back.
+        const plain = await this.#factory.createNode({
+            sessionId,
+            connectionGater: gater,
+            nodeType: "session",
+            inboundReachable: true,
+            transportPrivateKey: seed,
+        });
+        await plain.start();
+        if (candidateAddrs.length > 0) {
+            this.#logger.warn("session.revive.reservation.none", {
+                agentName,
+                sessionId,
+                candidates: candidateAddrs.length,
+                impact: "the revived session holds no circuit address — the counterparty cannot dial it, so "
+                    + "delivery in both directions depends on relay store-and-forward until it is rebuilt",
+            });
+        }
+        return plain;
+    }
+    /**
+     * DOD-M12B-REVIVE-RELAY-1 — reconnect the session's relay WITNESS, which revival never did.
+     *
+     * THE FIRST-PRINCIPLES DEFECT, and the one that explains every symptom chased separately before
+     * it. Establishment does five things: build the node, register the content handler, wire liveness,
+     * **connect the relay**, and dial the counterparty. Revival did the first three. A revived session
+     * was therefore not a session — it looked live, reported `active`, and had no live inbound path at
+     * all.
+     *
+     * MEASURED 2026-08-18 with two real agents: a message on a reconnected session took **three
+     * minutes**, against seconds on a fresh one, because only the five-minute mailbox backstop ever
+     * found it. Doorbells stopped firing for the same reason — the relay stream is what rings them.
+     * And `#parkContent` refuses without `entry.relayClient`, so sends could not park either.
+     *
+     * NO ASSIGNMENT IS PRESENTED, and that is by design rather than omission: `RelayConnectParams`
+     * documents the reconnect mode itself — *"absent … on the restart/persisted reconnect path (the
+     * relay already recorded the session at first establishment) — the client then just reconnects
+     * without re-recording."* A revival is exactly that path.
+     *
+     * Best-effort and non-fatal: a session that comes back without its witness is still better than
+     * one that does not come back, and the failure is named rather than silent.
+     */
+    async #reconnectRevivedSessionRelay(agentName, sessionId, node, gater, correlationId, ep) {
+        if (!ep) {
+            this.#logger.warn("session.revive.relay.absent", {
+                agentName,
+                sessionId,
+                impact: "no relay is recorded for this session, so it comes back with no live inbound path — "
+                    + "messages arrive only on the periodic mailbox poll, and a failed send cannot park and is "
+                    + "reported lost",
+            });
+            return;
+        }
+        try {
+            // The gater admits only the counterparty inbound; the relay is a third peer and must be
+            // permitted OUTBOUND or our own gate refuses the dial (INV-5 keeps inbound counterparty-only).
+            gater.setAllowedOutboundPeer(ep.relayPeerId);
+            const clientKey = `${agentName}::${ep.relayPeerId}`;
+            let client = this.#relayClients.get(clientKey);
+            if (!client) {
+                if (!this.#relayReceiptStore && this.#db)
+                    this.#relayReceiptStore = new RelayReceiptStore(this.#db, this.#logger);
+                if (!this.#sealLeafStore && this.#db)
+                    this.#sealLeafStore = new SessionSealLeafStore(this.#db, this.#logger);
+                client = this.#detachedRelayClientBuilder?.(agentName, ep.relayPeerId, [...ep.relayAddrs], {
+                    receiptStore: this.#relayReceiptStore ?? undefined,
+                    sealLeafStore: this.#sealLeafStore ?? undefined,
+                });
+                if (!client) {
+                    this.#logger.warn("session.revive.relay.builder_absent", {
+                        agentName,
+                        sessionId,
+                        impact: "no relay client could be built, so this revived session has no live inbound path",
+                    });
+                    return;
+                }
+                this.#relayClients.set(clientKey, client);
+            }
+            client.registerSession(sessionId, node, this.#relayLeafHandler(agentName, sessionId, correlationId));
+            const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+            if (entry) {
+                entry.relayClient = client;
+                entry.relaySessionIdBytes = Uint8Array.from(Buffer.from(sessionId, "hex"));
+                entry.relayClientKey = clientKey;
+            }
+            /**
+             * THE STEP THIS METHOD IS NAMED AFTER, and the first version did not take it (review HIGH-2).
+             *
+             * `registerSession` files a handler in a Map. It opens nothing — no dial, no auth, no reader
+             * loop. `#connectSessionRelay` ends with exactly this line and the reconnect ended without it,
+             * so a revived session registered a handler on a client whose stream was `null` and then
+             * logged that its live inbound path was back. It was not: the counterparty's leaves queued at
+             * the relay, no doorbell fired, and delivery fell back to the five-minute mailbox poll — the
+             * three-minutes-versus-seconds symptom the whole unit exists to remove.
+             *
+             * Worse, the client is usually BRAND NEW here: `markInterruptedWithDetails` closes and drops
+             * the client for the last session on a relay, so a single-session agent always lands in the
+             * build branch above with a fresh, unconnected client.
+             *
+             * `#ensureConnected` is idempotent, so this also repairs the cached-but-dead-stream case.
+             */
+            await client.connect(node);
+            this.#logger.info("session.revive.relay.connected", {
+                agentName,
+                sessionId,
+                relayPeerId: ep.relayPeerId,
+                impact: "the revived session has its live inbound path back — messages arrive promptly "
+                    + "instead of waiting for the periodic mailbox poll",
+            });
+        }
+        catch (err) {
+            this.#logger.warn("session.revive.relay.failed", {
+                agentName,
+                sessionId,
+                error: err instanceof Error ? err.message : String(err),
+                impact: "the session is back but without its witness — delivery falls back to the periodic poll",
+            });
+        }
+    }
+    /**
+     * DOD-M12B-SESSION-SEED-1 — bring an interrupted session back on the peer id it already has.
+     *
+     * THE DEFECT THIS CLOSES. `markInterruptedWithDetails` and `destroySessionNode` stop the node and
+     * delete it from `#activeNodes`, and until now **nothing anywhere recreated one**. A laptop-close
+     * session stayed stuck even though both processes were alive and both keypairs were still in
+     * memory — the trace on 2026-08-17 found no missing transport capability, just a missing edge.
+     *
+     * TWO THINGS HAVE TO HAPPEN, and doing only one leaves the session exactly as stuck:
+     *   1. the NODE comes back, at the same peer id, or the counterparty can never dial us again;
+     *   2. the STATUS comes back to `active`, or every send still refuses with `session_not_active`.
+     *
+     * **DEMAND-DRIVEN ONLY.** Nothing calls this on a timer. That is the `REDIAL-1` discipline and it
+     * is also Andre's tenet — a background rebuilder would hold a dialable endpoint open for a session
+     * nobody is using, which is the "open connection a malicious agent can farm for" in as many words.
+     *
+     * **TERMINAL IS TERMINAL.** A sealed or abandoned session had its seed zeroed in the same step
+     * that wrote its status, so there is nothing to come back on. This refuses by name rather than
+     * minting a fresh identity — a revival that quietly mints would hand one session a second peer id
+     * and break the invariant while appearing to work.
+     *
+     * Idempotent: a session that already has a live node returns ok without building a second one.
+     */
+    async reviveSessionNode(agentName, sessionId) {
+        const key = this.#k(agentName, sessionId);
+        const live = this.#activeNodes.get(key);
+        if (live)
+            return { ok: true, peerId: live.node.getPeerId() };
+        const record = this.getSessionRecord(agentName, sessionId);
+        if (!record)
+            return { ok: false, reason: "session_not_found" };
+        if (record.status === "sealed" || record.status === "abandoned" || record.status === "seal_interrupted_pending") {
+            return {
+                ok: false,
+                reason: "session_terminal",
+                guidance: `Session is '${record.status}'. A session that has ended cannot be revived; start a new one.`,
+            };
+        }
+        /**
+         * THE CAP APPLIES TO A REVIVAL TOO (review: parity gap). Establishment refuses at
+         * `MAX_SESSION_NODES` because each node is a real libp2p instance with listeners, connections
+         * and a relay reservation. A revival builds exactly the same thing, so letting it past the cap
+         * would let a daemon walk over the limit one reconnect at a time — and the limit exists to stop
+         * a machine being taken down by its own session count.
+         *
+         * Refused by name, so the caller can say something true: this is a local resource limit, not a
+         * problem with the session or the counterparty.
+         */
+        if (this.#activeNodes.size >= MAX_SESSION_NODES) {
+            this.#logger.warn("session.revive.cap.reached", {
+                agentName,
+                sessionId,
+                activeCount: this.#activeNodes.size,
+                maxCount: MAX_SESSION_NODES,
+                impact: "this session stays interrupted until another session ends and frees a node slot",
+            });
+            return {
+                ok: false,
+                reason: "session_node_cap_reached",
+                guidance: `This daemon already holds ${MAX_SESSION_NODES} active session nodes, so this session ` +
+                    "cannot be brought back yet. Close a session you have finished with and try again.",
+            };
+        }
+        const identity = this.#sessionSeeds.get(key);
+        if (identity === undefined) {
+            // The honest case: the daemon restarted, so the keypair is genuinely gone. That is
+            // RESTART-SEAL-1's territory (resolve with a receipt), not a revival — and saying so is the
+            // difference between an operator waiting for a reconnect that cannot happen and one closing
+            // the session.
+            return {
+                ok: false,
+                reason: "session_identity_lost",
+                guidance: "This session's transport identity did not survive a daemon restart, so it cannot be " +
+                    "revived. It will be sealed automatically, or you can close it now to get its receipt.",
+            };
+        }
+        const gater = new SessionConnectionGater({
+            sessionId,
+            allowedPeerId: identity.counterpartyPeerId,
+            logger: this.#logger,
+        });
+        // The relay peers must be allowed OUTBOUND before the node starts, or the reservation the line
+        // below depends on is refused by our own gater — the same ordering the receiver builder uses.
+        const reservations = this.#reservationCircuitAddrs(agentName);
+        for (const relayPeerId of reservations.relayPeerIds)
+            gater.setAllowedOutboundPeer(relayPeerId);
+        let node;
+        const t0 = Date.now();
+        this.#logger.info("session.revive.node.building", {
+            agentName,
+            sessionId,
+            circuitAddrs: reservations.addrs.length,
+            relayPeerIds: reservations.relayPeerIds.length,
+        });
+        try {
+            node = await this.#buildRevivedNode(sessionId, gater, identity.seed, reservations.addrs, agentName);
+            this.#logger.info("session.revive.node.started", {
+                agentName,
+                sessionId,
+                startMs: Date.now() - t0,
+                listenAddrs: node.listenAddresses().length,
+                circuitListen: node.listenAddresses().filter((a) => a.includes("/p2p-circuit")).length,
+            });
+        }
+        catch (err) {
+            this.#logger.error("session.revive.node.failed", {
+                agentName,
+                sessionId,
+                error: err instanceof Error ? err.message : String(err),
+                impact: "the session stays interrupted; the next send will attempt this again",
+            });
+            return { ok: false, reason: "session_node_creation_failed" };
+        }
+        const autoNat = new NodeAutoNatService({
+            node,
+            logger: this.#logger,
+            nodeType: "session",
+            probers: this.#autoNatProbers(),
+        });
+        autoNat.emitInitialResult();
+        // DOD-M12B-SESSION-SEED-1: give the re-dial its addresses back BEFORE the session goes active,
+        // so the first send after a revival has somewhere to go. Without this the send fails instantly
+        // on a connection that was never made, and — measured live — is lost rather than parked.
+        if (identity.counterpartyAddrs.length > 0) {
+            this.#counterpartyAddrs.set(key, [...identity.counterpartyAddrs]);
+        }
+        const correlationId = randomUUID();
+        /**
+         * DOD-M12B-REVIVE-PARK-1 — RESTORE THE RELAY, or a revived session cannot park and every failed
+         * send is declared lost.
+         *
+         * This is the defect behind five identical live failures on 2026-08-18. `#parkContent` opens
+         * with `if (!hook || !entry || !entry.relayPeerId || !entry.relayAddrs) return "unconfigured"`,
+         * and a revived entry carried none of it — so the park was skipped and the send fell through to
+         * *"could NOT be queued for retry — it is lost. Send it again."* The relay was recorded on the
+         * session row the whole time, and store-and-forward would have delivered the message: the
+         * counterparty's own sends park through it successfully in the same minute.
+         *
+         * What it cost the operator: their reply was accepted, discarded, and they were told to retype
+         * it — which is how a transcript gets duplicates of a message that was never lost in the first
+         * place.
+         *
+         * Read from the row rather than carried in the revival record on purpose: the row is where the
+         * relay assignment is durable, and it is the same source `getPersistedRelayEndpoint` already
+         * serves the startup flush from — a path that exists precisely because in-memory entries are
+         * gone by then, which is exactly the situation a revival is in.
+         */
+        // ONE lookup, and ONE event for the absent case (review LOW-8). This used to read the endpoint
+        // here and again inside the relay reconnect, and both logged `session.revive.relay.absent` with
+        // different `impact` text — one event name standing for two meanings, fired twice for a single
+        // condition. `#reconnectRevivedSessionRelay` takes it as a parameter now.
+        const persistedRelay = this.getPersistedRelayEndpoint(agentName, sessionId);
+        this.#activeNodes.set(key, {
+            node,
+            agentName,
+            sessionId,
+            counterpartyPubkey: identity.counterpartyPubkey,
+            gater,
+            correlationId,
+            counterpartySessionPeerId: identity.counterpartyPeerId,
+            autoNat,
+            ...(persistedRelay
+                ? { relayPeerId: persistedRelay.relayPeerId, relayAddrs: persistedRelay.relayAddrs }
+                : {}),
+        });
+        await this.#registerContentHandler(agentName, sessionId, node, identity.counterpartyPubkey);
+        /**
+         * review HIGH-2 — REWIRE LIVENESS, or this session can never be interrupted again.
+         *
+         * Both creation paths call this; the first build of the revival did not. Without it the revived
+         * session is pinned `active`: a later disconnect fires no transition, no `session_state_changed`
+         * reaches the MCP client, and the receive surface renders unknown liveness as healthy-and-quiet.
+         * So the SECOND laptop close would leave the operator staring at a session that reports fine and
+         * is dead — this milestone's founding defect, one revival later, and with no status change left
+         * to trigger the next revival either.
+         */
+        this.#wireSessionLiveness(agentName, sessionId, node, identity.counterpartyPubkey, correlationId, identity.counterpartyPeerId);
+        // DOD-M12B-REVIVE-RELAY-1: the step revival skipped. Establishment connects the relay witness
+        // here; without it the session comes back with no live inbound path at all.
+        await this.#reconnectRevivedSessionRelay(agentName, sessionId, node, gater, correlationId, persistedRelay);
+        // THE REVERSE EDGE. A transport event took this session out of `active` and nothing has ever
+        // put one back. Written after the node is live and its handler registered, so the row never
+        // claims `active` for a session that cannot yet receive.
+        //
+        // review MEDIUM-3: the result is CHECKED. `#updateSessionStatus` returns false when the write
+        // matched no row or the DB errored — and reporting revival ok on a row that still says
+        // `interrupted` leaves a live, talking session where REVIVAL-BOUND-1's sweep can seal or abandon
+        // it. Failing here means tearing the node back down rather than running in that split state.
+        if (!this.#updateSessionStatus(agentName, sessionId, "active")) {
+            this.#activeNodes.delete(key);
+            try {
+                await node.stop();
+            }
+            catch { /* best-effort: the status write already failed and is logged with its cause */ }
+            return {
+                ok: false,
+                reason: "session_status_write_failed",
+                guidance: "The session node was rebuilt but its status could not be written, so it was torn back " +
+                    "down rather than left live under an interrupted row. The daemon logged the cause.",
+            };
+        }
+        // The messages that failed while this session was down were queued on a promise of "retried on
+        // reconnect". This is that reconnect — fire it before anyone is told the session is back.
+        if (this.#retryDrainHook !== null) {
+            try {
+                this.#retryDrainHook(agentName, sessionId);
+            }
+            catch (err) {
+                this.#logger.warn("session.revive.retry_drain.failed", {
+                    agentName,
+                    sessionId,
+                    error: err instanceof Error ? err.message : String(err),
+                    impact: "messages queued while this session was down are still queued",
+                });
+            }
+        }
+        const peerId = node.getPeerId();
+        this.#logger.info("session.revived", {
+            agentName,
+            sessionId,
+            peerId,
+            // The whole claim of this line, in the log: the id did not change, so the counterparty's
+            // stored dial target is still correct and they do not need to be told anything.
+            identityPreserved: true,
+        });
+        return { ok: true, peerId };
+    }
+    /**
+     * DOD-M12B-SESSION-SEED-1 — the DEMAND edge: a send on an interrupted session revives it.
+     *
+     * One of TWO production callers of `reviveSessionNode` — `reviveIfNeededForRead` is the other —
+     * and both are deliberately demand paths rather than timers. The `REDIAL-1` discipline and Andre's tenet say the same thing from two
+     * directions: nothing may re-open on its own, because a background rebuilder would hold a dialable
+     * endpoint open for a session nobody is using — the *"open connection a malicious agent can farm
+     * for"*. The operator sending is the demand; there is no other trigger.
+     *
+     * A no-op for the normal case. An `active` session with a live node returns immediately without
+     * touching it — this sits on the hot path of every send, and replacing a healthy node would be
+     * churn that changes the peer id for no reason.
+     */
+    async reviveIfNeededForSend(agentName, sessionId) {
+        const record = this.getSessionRecord(agentName, sessionId);
+        if (!record)
+            return { ok: false, reason: "session_not_found" };
+        // The overwhelmingly common case: nothing to do, and no node was disturbed to find that out.
+        if (record.status === "active" && this.#activeNodes.has(this.#k(agentName, sessionId)))
+            return { ok: true };
+        const revived = await this.reviveSessionNode(agentName, sessionId);
+        if (!revived.ok) {
+            this.#logger.info("session.revive.declined", {
+                agentName,
+                sessionId,
+                previousStatus: record.status,
+                trigger: "send",
+                reason: revived.reason,
+            });
+            return revived;
+        }
+        this.#logger.info("session.revived.on_demand", {
+            agentName,
+            sessionId,
+            previousStatus: record.status,
+            trigger: "send",
+        });
+        return { ok: true };
+    }
+    /**
+     * DOD-M12B-SESSION-SEED-1 (case B) — the INBOUND half of the demand edge.
+     *
+     * `reviveIfNeededForSend` covers the operator waking first. Case B's triggers are symmetric — a
+     * wifi hop, a relay restart, a directory node cycling — so half the time the COUNTERPARTY wakes
+     * first. They send; we have no node yet, because revival is demand-driven and we have demanded
+     * nothing. Their content parks at the relay, which is the backstop working as designed.
+     *
+     * Then the operator comes back and READS, and until now that told them nothing: the receive
+     * handler reads the transcript and never gates on status, so it happily reports what is already
+     * stored while messages sit parked, waiting for a node that will not exist until the operator
+     * happens to SEND. An operator who only reads was stuck forever with a surface that looked fine.
+     *
+     * **WHY A READ MAY TRIGGER THIS AND AN INBOUND DIAL MAY NOT.** Andre's tenet is about what a
+     * REMOTE party can cause: *"an open connection that a malicious agent can farm for."* Reviving
+     * because a peer dialled us would hand that lever straight to the peer — a stranger could keep our
+     * endpoints open indefinitely by poking dead sessions. A read is the OPERATOR asking, on their own
+     * machine, for their own session: the same class of demand as a send, and the class the tenet
+     * allows. That distinction is the whole reason this is a separate entry point rather than a
+     * revival triggered from the inbound handler.
+     */
+    async reviveIfNeededForRead(agentName, sessionId) {
+        const record = this.getSessionRecord(agentName, sessionId);
+        if (!record)
+            return { ok: false, reason: "session_not_found" };
+        if (record.status === "active" && this.#activeNodes.has(this.#k(agentName, sessionId)))
+            return { ok: true };
+        // Reading the transcript of an ended session is normal and must keep working — the CALLER does
+        // not treat this refusal as an error, it just reads what is stored. What must not happen is the
+        // read bringing the session back: the receipt is issued and the identity is gone.
+        const revived = await this.reviveSessionNode(agentName, sessionId);
+        if (!revived.ok) {
+            // review MEDIUM-4: the absence of a success line was the only signal that a session could not
+            // come back. `session_identity_lost` is the one an operator most needs, and it was generated
+            // and destroyed one stack frame later with nothing written down.
+            this.#logger.info("session.revive.declined", {
+                agentName,
+                sessionId,
+                previousStatus: record.status,
+                trigger: "read",
+                reason: revived.reason,
+            });
+            return revived;
+        }
+        this.#logger.info("session.revived.on_demand", {
+            agentName,
+            sessionId,
+            previousStatus: record.status,
+            trigger: "read",
+        });
+        // Fetch what is waiting NOW. Review MEDIUM-5 corrected the claim this used to make: the drain
+        // runs off the AGENT's standing receiver, not the session node, and the 5-minute backstop would
+        // have delivered this content anyway. So this is an accelerator, not a rescue — worth having,
+        // and worth describing accurately. (The send path deliberately does not fire one: the same
+        // backstop covers it, at a cost of at most one interval.)
+        this.#fireParkedDrain(agentName, "session_revived");
+        return { ok: true };
+    }
+    /** DOD-M12B-REVIVE-PARK-1 test seam: the relay the live entry will park to. Not otherwise
+     *  observable — `#activeNodes` is private and the park's own refusal is silent about which of its
+     *  four preconditions was missing. */
+    getSessionRelayForTest(agentName, sessionId) {
+        const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+        if (!entry)
+            return null;
+        return {
+            ...(entry.relayPeerId !== undefined ? { relayPeerId: entry.relayPeerId } : {}),
+            ...(entry.relayAddrs !== undefined ? { relayAddrs: entry.relayAddrs } : {}),
+        };
+    }
+    /** DOD-M12B-SESSION-SEED-1 test seams: the counterparty addresses a re-dial depends on. Not
+     *  otherwise observable — they are set from a signed relay assignment that a fixture cannot mint. */
+    setCounterpartyAddrsForTest(agentName, sessionId, addrs) {
+        this.#counterpartyAddrs.set(this.#k(agentName, sessionId), [...addrs]);
+    }
+    getCounterpartyAddrsForTest(agentName, sessionId) {
+        return this.#counterpartyAddrs.get(this.#k(agentName, sessionId)) ?? [];
+    }
+    /** DOD-M12B-SESSION-SEED-1 test seam: drop a seed WITHOUT zeroing or a status change — what a
+     *  process restart does to it. The refusal that follows is the one an operator most needs named. */
+    forgetSessionSeedForTest(agentName, sessionId) {
+        this.#sessionSeeds.delete(this.#k(agentName, sessionId));
+    }
+    /**
+     * DOD-M12B-SESSION-SEED-1 — drain the direct-resend queue when a session comes back.
+     *
+     * `retryQueue.drainSession` had NO production caller. The send path enqueues into it on a failed
+     * delivery and tells the operator the message will be "retried on reconnect", and nothing ever
+     * reconnected it — the row sat there until the session went terminal and was reaped. Measured
+     * live 2026-08-18: two of the operator's messages went in, and the response told them both were
+     * lost and to send again, which is how a transcript gets duplicates.
+     *
+     * A revival IS the reconnect that sentence promised. This is the hook that makes it true.
+     */
+    setRetryDrainHook(fn) {
+        this.#retryDrainHook = fn;
+    }
+    /** DOD-M12B-SESSION-SEED-1 test seam: does this session still hold a revivable identity? */
+    hasSessionSeedForTest(agentName, sessionId) {
+        return this.#sessionSeeds.has(this.#k(agentName, sessionId));
+    }
+    getStandingReceiverSeedForTest(agentName) {
+        return this.#standingReceivers.get(agentName)?.seed;
+    }
     async ensureStandingReceiverForAgent(agentName) {
         this.#agentsWantingReceiver.add(agentName);
         this.#startReservationWatchdog();
@@ -7385,7 +8480,11 @@ export class SessionNodeManager {
                 this.#standingReceiverRemoving.add(agentName);
             return;
         }
+        const removed = this.#standingReceivers.get(agentName);
         this.#standingReceivers.delete(agentName);
+        // DOD-M12B-SESSION-SEED-1 (review F8): the operator took this agent offline — its advertised
+        // identity is not needed any more, and the tenet's rule is that nothing unneeded stays live.
+        removed?.seed.fill(0);
         // Best-effort teardown, but NOT silent: a standing receiver that failed to stop keeps a libp2p
         // node live on the network. For a removal/retire (a revocation-class action) that must be visible,
         // so the caller and the operator can see the leak rather than trust a false "torn down". autoNat is
@@ -7428,6 +8527,34 @@ export class SessionNodeManager {
     /** CC-5/F21: count of RECEIVED messages on a session — the "did the counterparty ever speak"
      *  signal the dead-half-open reaper uses (message_count also counts our own auto-"Dispatched." ack,
      *  so it is NOT a reliable half-open discriminator). Mirrors #getReceivedBytesTotal. */
+    /**
+     * DOD-M12B-REAP-HELD-1 — did the counterparty EVER establish? Counted from every place their
+     * messages can be, not just the one.
+     *
+     * OBSERVED LIVE 2026-08-18: the half-open reaper abandoned session `d28db475…` — twenty leaves in
+     * the chain and sixteen more frames verified and held, ten of them from the counterparty — while
+     * the restart-seal resolver was actively trying to notarize it. The receipt was forfeited.
+     *
+     * `countReceivedMessages` asks the TRANSCRIPT, and **held content never reaches the transcript**;
+     * it sits in `held_content` until it can join the chain. So the very condition that holds content
+     * — an interrupted session — is the condition that makes the counterparty's messages invisible,
+     * and a fully-established conversation reads identically to an offer nobody ever answered.
+     *
+     * `origin = 'received'` is load-bearing. Our OWN held frames prove nothing about them, and
+     * counting those would make every session we ever spoke into un-reapable — which is exactly the
+     * clutter the reaper exists to clear. D18 also depends on the zero case staying zero: reaping only
+     * genuinely 0-received ghosts is what stops a stranger whose first handshakes died from being
+     * locked out by the acceptance bound forever.
+     */
+    countEstablishedReceived(agentName, sessionId) {
+        if (!this.#db)
+            return 0;
+        const agentId = this.#requireAgentId(agentName);
+        const held = this.#db
+            .prepare("SELECT COUNT(*) AS n FROM held_content WHERE agent_id = ? AND session_id = ? AND origin = 'received'")
+            .get(agentId, sessionId);
+        return this.countReceivedMessages(agentName, sessionId) + (held?.n ?? 0);
+    }
     countReceivedMessages(agentName, sessionId) {
         if (!this.#db)
             return 0;
@@ -7522,6 +8649,26 @@ export class SessionNodeManager {
     interruptedBy) {
         if (!this.#db)
             return false;
+        /**
+         * DOD-M12B-SESSION-SEED-1 (review F2) — the identity dies on terminal INTENT, not on a
+         * successful UPDATE.
+         *
+         * The first build destroyed the seed only after the write landed. `#requireAgentId` THROWS for
+         * a retired agent, so every terminal write for a revoked agent's sessions fell into the catch
+         * and kept its transport identity for the life of the process — an identity whose agent has
+         * just been revoked in the directory, held with nothing reporting it, and REVIVAL-BOUND-1's
+         * sweep excludes retired agents so nothing else closed it either. The same held for a
+         * `session.status.write.missed` and for any DB error.
+         *
+         * Coupling a security teardown to a database write is backwards: the write can fail, and the
+         * failure is exactly when we least want a live key lying around. So it runs FIRST and
+         * unconditionally, and if the write then fails the session is one we can no longer revive —
+         * which is the safe direction, and is reported loudly below rather than inferred from the
+         * absence of a debug line.
+         */
+        if (status === "sealed" || status === "abandoned") {
+            this.#destroySessionSeed(agentName, sessionId);
+        }
         // THE TERMINAL GUARD LIVES HERE, not in one wrapper, because there are three writers of
         // "sealed": markSealed, destroySessionNode, and retireSession on the witnessed-submit path.
         // Guarding only the wrapper asserts the invariant in a test while two other paths still break
@@ -7557,10 +8704,22 @@ export class SessionNodeManager {
         const now = Date.now();
         try {
             const res = this.#db
-                .prepare(interruptedBy === undefined
-                ? "UPDATE sessions SET status = ?, updated_at = ? WHERE agent_id = ? AND session_id = ?"
-                : "UPDATE sessions SET status = ?, updated_at = ?, interrupted_by = 'local' WHERE agent_id = ? AND session_id = ?")
-                .run(status, now, this.#requireAgentId(agentName), sessionId);
+                .prepare(
+            // DOD-M12B-REVIVAL-BOUND-1: this is the FOURTH writer of `status = 'interrupted'`, and
+            // until now the only one that wrote no `interrupted_at`. That is where Entry 41's two
+            // timestamp-less rows came from, and a row with no timestamp has no revival bound that
+            // can be evaluated. `COALESCE` matches the three sibling producers: the FIRST
+            // interruption is the clock, so re-entering the status cannot push the deadline out.
+            status === "interrupted"
+                ? (interruptedBy === undefined
+                    ? "UPDATE sessions SET status = ?, updated_at = ?, interrupted_at = COALESCE(interrupted_at, ?) WHERE agent_id = ? AND session_id = ?"
+                    : "UPDATE sessions SET status = ?, updated_at = ?, interrupted_at = COALESCE(interrupted_at, ?), interrupted_by = 'local' WHERE agent_id = ? AND session_id = ?")
+                : (interruptedBy === undefined
+                    ? "UPDATE sessions SET status = ?, updated_at = ? WHERE agent_id = ? AND session_id = ?"
+                    : "UPDATE sessions SET status = ?, updated_at = ?, interrupted_by = 'local' WHERE agent_id = ? AND session_id = ?"))
+                .run(...(status === "interrupted"
+                ? [status, now, new Date(now).toISOString(), this.#requireAgentId(agentName), sessionId]
+                : [status, now, this.#requireAgentId(agentName), sessionId]));
             // "Did not throw" is NOT "landed". An UPDATE whose WHERE matches no row — a wrong agent_id, a
             // session_id with no row — succeeds silently and changes nothing. Reporting that as a written
             // status flip is what let a disposition hook delete a live session's content, so the row count
@@ -7571,7 +8730,11 @@ export class SessionNodeManager {
                     sessionId,
                     status,
                     agentName,
-                    impact: "no session row matched — the status was NOT changed and no disposition was run",
+                    impact: (status === "sealed" || status === "abandoned")
+                        ? "no session row matched — the status was NOT changed and no disposition was run, AND "
+                            + "this session's transport identity has already been destroyed, so it can no longer "
+                            + "be revived even though its row still says it is open"
+                        : "no session row matched — the status was NOT changed and no disposition was run",
                 });
                 return false;
             }