@cello-protocol/daemon 0.0.180 → 0.0.182

package/dist/session-node-manager.js

@@ -17,7 +17,12 @@
 // The daemon DB is SQLCipher (whole-file AES-256 at rest), never `node:sqlite`. `DaemonDatabase` is
 // the thin varargs surface; `openEncryptedDatabase` opens with a PRAGMA key and `resolveDbKey`
 // manages the single plaintext key file.
-import { wireContentHash } from "./wire-content-hash.js";
+// `wireContentHash` is gone from this file on purpose: its ONE use was the receive-path cross-check,
+// which now goes through `contentHashFor` so the comparison runs under the algorithm the sender
+// named. A direct call here would be a hash computed without asking what the frame said (part B1).
+import { contentHashFor, resolveContentHashAlg, CONTENT_HASH_ALGS } from "./wire-content-hash.js";
+import { CAPACITY_REASONS } from "./refusal-reasons.js";
+import { onPeerSaltFrame, ownSaltFrame, SALT_ADOPTION_LABELS, SALT_FREEZE_GUIDANCE, } from "./session-salt-agreement.js";
 import { openEncryptedDatabase, resolveDbKey, dbKeyPathFor, } from "./sqlcipher-db.js";
 import { migrateToEncryptedIfNeeded } from "./identity-migration.js";
 import { ensureIdentitySchema } from "./db-identity-store.js";
@@ -34,14 +39,17 @@ import { MAX_SESSION_NODES, STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 import { SessionConnectionGater } from "./session-connection-gater.js";
 import { SessionTree, sessionTreeLeafKindFromDb } from "./session-tree.js";
 import { CELLO_CONTENT_PROTOCOL_ID, NodeAutoNatService } from "@cello-protocol/transport";
-import { verify } from "@cello-protocol/crypto";
+import { verify, buildMerkleTree, merkleRoot, generateSaltContribution, SESSION_SALT_BYTES } from "@cello-protocol/crypto";
 import { encodeSealPayload, MONIKER_RE, validateMoniker } from "@cello-protocol/protocol-types";
-import { decodeParkEnvelope, authenticateParkedEntry, pubkeyMatchesHex } from "./park-envelope.js";
+import { decodeParkEnvelope, authenticateParkedEntry, pubkeyMatchesHex, ParkEnvelopeError, PARK_ENVELOPE_REASONS } from "./park-envelope.js";
 import { isValidMultiaddr } from "@cello-protocol/transport";
-import { AgentRelayClient, LEAF_KIND_CTRL, LEAF_KIND_MSG, isTerminalRelayRefusal, extractErrorMessage } from "./session-relay-client.js";
+// `LEAF_KIND_MSG` is no longer imported here: `sendContent`'s `leafKind` stopped defaulting to it
+// (B2b-1 review F4), so this file no longer names a default — every caller states its own kind.
+import { AgentRelayClient, LEAF_KIND_CTRL, isTerminalRelayRefusal, extractErrorMessage } from "./session-relay-client.js";
 import { terminalRelayRefusal } from "./session-terminal-refusal.js";
 import { RelayReceiptStore } from "./relay-receipt-store.js";
 import { SessionSealLeafStore } from "./session-seal-leaf-store.js";
+import { addColumnIfMissing } from "./column-birth.js";
 import { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, } from "@cello-protocol/gateway";
 /** SEC-1 / review M4: cap on the refused-parked-entry memo (remote-fed → must be bounded). */
 /**
@@ -52,6 +60,89 @@ import { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, } from "@cello-protocol/gatewa
  */
 const AUTOACK_BROKER_GRACE_MS = 30_000;
 const MAX_REFUSED_PARKED_ENTRIES = 512;
+/**
+ * Per-session cap on remembered unreadable-algorithm frames (`DOD-M15-SEALWIRE-1` part B1).
+ *
+ * Fed by a REMOTE party — a peer on a newer build refuses every frame it sends — so it needs a
+ * bound for the same reason `MAX_REFUSED_PARKED_ENTRIES` does. Small on purpose: the entries exist
+ * only to reconcile a refusal with its park-route redelivery, which happens within seconds, and
+ * losing an old one costs a log line rather than correctness.
+ */
+const MAX_UNREADABLE_ALG_FRAMES = 64;
+/**
+ * How long the first send waits for an in-flight salt agreement before giving up on it —
+ * `DOD-M15-SEALWIRE-1` B2b-2 constraint 2.
+ *
+ * The agreement is ONE round trip on a stream that is already open, so a healthy exchange finishes
+ * in milliseconds; this bound is not sized for the normal case, it is sized for how long an operator
+ * should wait before their message goes out unsalted instead of not going out.
+ *
+ * Five seconds because both errors cost real things. Too short and a merely slow counterparty makes
+ * the session permanently unsalted for no reason — the decision is irreversible, so the bound should
+ * be generous relative to the round trip. Too long and the first message of every conversation with
+ * a peer on an older build visibly hangs, which is the failure a user actually notices and blames
+ * the product for. This is only ever paid by a session that HAS an agreement outstanding: a
+ * park-only session never starts one and never waits (constraint 5).
+ */
+const SALT_AGREEMENT_WAIT_MS = 5_000;
+/**
+ * WHY a session is hashing unsalted — review Finding 1, and this exists because one sentence was
+ * carrying five different situations.
+ *
+ * `#saltForHashing` returns null for five distinct upstream conditions, and the single guidance
+ * string asserted one of them: *"expected when your counterparty runs a build that predates the salt
+ * agreement… start a new session once they upgrade."* An operator whose counterparty was merely
+ * OFFLINE when they sent their first message — the most common case by far, since a parked first
+ * message unsalts the session by design — read that and went and told a fully up-to-date
+ * counterparty to upgrade.
+ *
+ * That is the `directory_unreachable` shape this project keeps re-learning: the message names the
+ * exit point and points at the wrong machine. A closed set of reasons with its own guidance per
+ * reason is the fix, and a closed set is what stops a sixth condition quietly inheriting a fifth's
+ * explanation.
+ */
+const UNSALTED_REASONS = {
+    /** No agreement was ever started — the counterparty has not connected. The park-only case. */
+    NO_AGREEMENT_STARTED: "no_agreement_started",
+    /** We announced and they did not answer inside the bound. */
+    AGREEMENT_TIMED_OUT: "agreement_timed_out",
+    /** They answered, terminally: they have already hashed content and can never adopt. */
+    PEER_CLOSED_ADOPTION: "peer_closed_adoption",
+    /** The session was torn down while the first send was still waiting. */
+    SESSION_TORN_DOWN: "session_torn_down",
+    /** This side already hashed, leafed, held or has in flight — adoption closed here. */
+    ADOPTION_CLOSED_LOCALLY: "adoption_closed_locally",
+    /** They answered in time and OUR OWN write failed. Nothing about their build is involved. */
+    OUR_PERSIST_FAILED: "our_persist_failed",
+    /**
+     * OUR announce never left this machine — review pass 2, F2. Reusing `AGREEMENT_TIMED_OUT` here
+     * told the operator *"your counterparty did not answer"* about a frame we never sent, which is the
+     * exact substitution this closed set was created to end, re-entering through the settle site the
+     * previous pass asked for.
+     */
+    ANNOUNCE_FAILED: "our_announce_failed",
+    /**
+     * They answered, we stored it, and reading it back FAILED — review pass 2, F4. Distinct from
+     * `OUR_PERSIST_FAILED` because the two point at different log lines, and the guidance names one.
+     */
+    OUR_READ_FAILED: "our_read_failed",
+};
+/**
+ * What the operator should DO about each. TOTAL by construction — a `Record` over the union, so a
+ * new reason cannot be added without something for the reader to act on. Same shape, and the same
+ * reason, as `refusal-reasons.ts`: that file exists because a free-form `reason: string` let a new
+ * code slip past every test in its own guard file.
+ */
+const UNSALTED_GUIDANCE = {
+    [UNSALTED_REASONS.NO_AGREEMENT_STARTED]: "Your counterparty was not connected when you sent this, so there was nobody to agree a salt with — most often they are simply offline and this message is going to their relay mailbox. Nothing is wrong with either build. The agreement only runs at session open, so this session stays unsalted even after they come online; a session started while you are both connected will be salted.",
+    [UNSALTED_REASONS.AGREEMENT_TIMED_OUT]: "Your counterparty was connected but did not answer the salt agreement in time. Almost always they are on a build that predates it, in which case this is expected and permanent for this session — start a new session once they upgrade. If you know they are on the same version, look for session.salt.persist.failed on this side and session.salt.announce.failed on either.",
+    [UNSALTED_REASONS.PEER_CLOSED_ADOPTION]: "Your counterparty declined the salt because their side of this session had already hashed messages — their conversation started before yours could agree one. Both builds are fine and both sides know. Start a new session if you want the protection.",
+    [UNSALTED_REASONS.SESSION_TORN_DOWN]: "This session was closed or reset while the message was still being prepared. This line is about the salt only; look for the close or freeze event just before it for what actually happened to the session.",
+    [UNSALTED_REASONS.ADOPTION_CLOSED_LOCALLY]: "This session had already hashed or sent messages before a salt could be agreed, so adopting one now would leave half the conversation verifiable by one rule and half by another. That is permanent for this session and both builds are fine. Start a new session if you want the protection.",
+    [UNSALTED_REASONS.OUR_PERSIST_FAILED]: "Your counterparty answered in time and THIS side failed to store the agreed salt — the fault is local, not theirs. Do not ask them to upgrade. Look for session.salt.persist.failed immediately above this line; it names the write that failed.",
+    [UNSALTED_REASONS.ANNOUNCE_FAILED]: "THIS side could not send the salt agreement to your counterparty — the frame never left this machine, so they were never asked and their build is not involved. Do not ask them to upgrade. Look for session.salt.announce.failed immediately above this line for the connection error; most often the direct link to them dropped between connecting and sending.",
+    [UNSALTED_REASONS.OUR_READ_FAILED]: "A salt was agreed for this session and THIS side could not read it back — the fault is local storage, not your counterparty. Do not ask them to upgrade. Look for session.salt.read.failed immediately above this line; a wrong-width or unreadable row is named there.",
+};
 /**
  * DOD-M12B-ACK-1 — inbound `/cello/content/1.0.0` streams allowed per connection.
  *
@@ -361,6 +452,24 @@ export class SessionNodeManager {
     #leafFetchGraceMs = LEAF_FETCH_GRACE_MS;
     #standingReceivers = new Map();
     #standingReceiverCreating = new Set();
+    /**
+     * (agentName, sessionId) → the peer id that session's `session_offer` named as the dialer.
+     *
+     * KEYED BY SESSION, not by agent (review F1). Keyed by agent alone, two overlapping inbound
+     * sessions destroyed each other: offer P narrows to peer P, offer Q overwrites with peer Q, then
+     * assignment P arrives and MISMATCHES — refusing a legitimate session while accusing the directory
+     * of naming two dialers, which it had not. It then cleared Q's record too, so assignment Q passed
+     * unchecked. An attacker could therefore disarm the check by provoking one mismatch.
+     *
+     * The gap between offer and assignment spans a cross-region threshold ceremony, so overlapping
+     * sessions are ordinary, not exotic. `DOD-M15-OFFER-EXPIRY-1` already prescribed this fix shape —
+     * "bind the narrowing to the session id it came from" — and the session id was in hand at both
+     * ends the whole time.
+     *
+     * DOD-M15-OFFER-SIGNED-1: read back when the SIGNED assignment arrives, so an unsigned offer
+     * cannot name a peer the signed document does not.
+     */
+    #offeredDialer = new Map();
     // M8B F14: agents that SHOULD have a standing receiver — marked by
     // ensureStandingReceiverForAgent (cello_start_agent / the inbound accept path) and
     // unmarked by removeStandingReceiverForAgent (cello_set_agent_offline). Consulted by the
@@ -446,13 +555,165 @@ export class SessionNodeManager {
     // safe to close — the close would be signed, refused as `leaf_count_mismatch`, and the receipt
     // lost for good.
     #diverged = new Set();
+    /**
+     * Rehydrate `#diverged` from `sessions.diverged_at` — `DOD-M15-DIVERGE-DURABLE-1`.
+     *
+     * The Set stays as the hot read (the seal gate consults it per close), and the column is the
+     * truth. Loaded once at boot rather than queried per read so the gate's cost does not change.
+     */
+    #loadDivergedFromDb() {
+        if (!this.#db)
+            return;
+        const rows = this.#db
+            .prepare(`SELECT s.session_id AS sid, a.agent_name AS agent
+           FROM sessions s JOIN agents a ON a.agent_id = s.agent_id
+          WHERE s.diverged_at IS NOT NULL`)
+            .all();
+        for (const r of rows)
+            this.#diverged.add(this.#k(r.agent, r.sid));
+        if (rows.length > 0) {
+            this.#logger.info("session.diverged.restored", {
+                count: rows.length,
+                impact: "these sessions provably cannot seal bilaterally and are refused at the seal gate — before " +
+                    "this was durable, a restart made them read as healthy",
+            });
+        }
+    }
+    /**
+     * Record that this session's tree and the relay's counter have provably parted.
+     *
+     * Idempotent, and deliberately does NOT touch `updated_at`: that column drives the inbox's
+     * last-spoke ordering, and divergence is not activity.
+     */
+    markSessionDiverged(agentName, sessionId) {
+        this.#diverged.add(this.#k(agentName, sessionId));
+        if (!this.#db)
+            return;
+        /**
+         * KEYED ON (agent_id, session_id) — review F3, and the loopback case makes it concrete.
+         *
+         * This was `WHERE session_id = ?` alone. The table's PK is composite for a documented reason
+         * (`DOD-LOOP-1`, on the CREATE TABLE above): **two of one operator's agents can hold both ends
+         * of the SAME session_id on ONE daemon**, so `sessions` holds two rows. Unkeyed, marking one
+         * side diverged marked BOTH, and the clear below wiped BOTH — so side B sealing its half
+         * erased side A's divergence, and after a restart A's seal gate read healthy and signed a close
+         * that could only be refused. The line's own defect, produced by the line's own clear.
+         *
+         * Every other per-session UPDATE in this file keys on both columns; these two were the
+         * exceptions.
+         */
+        this.#db
+            .prepare("UPDATE sessions SET diverged_at = ? WHERE agent_id = ? AND session_id = ? AND diverged_at IS NULL")
+            .run(Date.now(), this.#requireAgentId(agentName), sessionId);
+    }
+    /** Whether this session has provably parted from the relay's ordering. */
+    isSessionDiverged(agentName, sessionId) {
+        return this.#diverged.has(this.#k(agentName, sessionId));
+    }
+    // DOD-M15-FRAME-1 (review F1): sessions frozen because a frame failed to verify against the
+    // expected counterparty. Consulted by `reviveSessionNode` — a teardown writes `interrupted`,
+    // which is the REVIVABLE status, so without this the next `cello_receive` silently rebuilt the
+    // session and re-admitted the same peer. NOT cleared by `#evictSessionCaches`: the freeze is a
+    // fact about the session, not about the node that was torn down to enforce it.
+    //
+    // DOD-M15-SEALWIRE-1 (part A): a MAP, not a Set, and the value is load-bearing. It was a Set when
+    // the identity freeze was the only freeze, so `reviveSessionNode` could hardcode its refusal —
+    // *"a message failed to verify against the expected counterparty's key"*. A salt disagreement now
+    // freezes through the same path, and that sentence would accuse a counterparty who did nothing:
+    // the ordinary cause is two builds that do not match. The refusal carries the freezing site's own
+    // words instead.
+    #frozenSessions = new Map();
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 6 (part A) — the salt agreement's two pieces of per-session state.
+     *
+     * `#saltContributions` — OUR random half, MINTED ONCE PER SESSION. This being a map rather than a
+     * fresh call at each send is the whole correctness of the exchange: we re-announce on every
+     * counterparty connect, and a contribution regenerated per reconnect would have both sides
+     * deriving against a moving value with the fingerprints never settling — a session that
+     * reconnects and still disagrees, which reads as a network fault rather than a bug here.
+     *
+     * `#sessionSalts` — a CACHE over `sessions.content_salt`, which is the durable copy. Both are
+     * cleared by `#evictSessionCaches`: the contribution is worthless once a salt exists, and the
+     * salt is re-read from the row on revival, which is exactly what Decision #8 persists it for.
+     */
+    #saltContributions = new Map();
+    #sessionSalts = new Map();
+    /**
+     * The peer half we last answered with a repair, hex — review F14, and it is what makes the repair
+     * TERMINATE. Without it, two daemons that already hold the same salt trade contributions forever
+     * once a reconnect leaves a stale copy queued on each side. See `onPeerSaltFrame`'s
+     * `alreadyRepairedAgainstPeerHalf`.
+     */
+    #saltRepairedAgainst = new Map();
+    /**
+     * ─── B2b-2 state: what the SEND path needs that the row cannot answer ─────────────────────────
+     *
+     * `#saltPending` — an agreement that has actually gone out and not yet been answered. The first
+     * send waits on it (constraint 2). Absent means *nothing is in flight*, which is not the same as
+     * "no salt": a park-only session never starts one at all, and must not wait (constraint 5).
+     *
+     * `#hashedWithoutSalt` — this session has already computed an unsalted content hash. Decision #8
+     * closes adoption at the moment content is HASHED, and for a session's first message that is a
+     * full network round trip before any leaf, held row or in-flight entry exists. Without this flag
+     * the frontier count reads empty for exactly the window in which adopting would split the
+     * transcript.
+     *
+     * `#unsaltedAnnounced` — the fallback has been stated for this session. Decision #15 says once per
+     * session; a per-message warning is a filter waiting to be written.
+     *
+     * All three are per-session and in-memory by design, and are dropped with the rest of a session's
+     * caches on eviction — a revived session re-reads its salt from the row, re-derives its frontier
+     * from durable state, and starts a fresh agreement if it reconnects.
+     */
+    #saltPending = new Map();
+    /**
+     * HOW THE LAST AGREEMENT ENDED, kept after `#saltPending` is cleared.
+     *
+     * ⚠️ FOUND BY FALSIFYING MY OWN FIX. `#settleSaltPending` deletes the pending entry, so a send that
+     * arrives AFTER an agreement has already failed finds nothing pending and is told
+     * `no_agreement_started` — *"your counterparty was not connected"* — when in fact they were
+     * connected and our own dial to them failed. The outcome was observable only to a send that
+     * happened to already be waiting, which is the minority case.
+     *
+     * So the verdict outlives the wait. An ABSENT entry still means what it always meant — no
+     * agreement was ever started, the park-only case — and that distinction is the whole reason this
+     * is a separate map rather than a default.
+     */
+    #saltLastOutcome = new Map();
+    #hashedWithoutSalt = new Map();
+    #unsaltedAnnounced = new Set();
     // DOD-M12B-ACK-1: pending linger-resets for inbound content streams the peer has not closed.
     // Held so shutdown can drop them rather than leave timers pointing at a torn-down node.
     #lingeringStreams = new Set();
     // M7-UPGRADE-002: sessions whose content integrity could NOT be verified (a content_hash
     // mismatch = tamper was observed). The auto-acknowledge gate (SI-002) refuses to auto-co-sign
     // for a desynced session — B must never blind-sign a tail it cannot verify. Keyed by sessionId hex.
-    #contentDesynced = new Set();
+    //
+    // DOD-M15-SEALWIRE-1 part B1 (review F1): a MAP, not a Set, and the value is the whole fix.
+    //
+    // It was a Set because a content_hash mismatch was the only way in, so "present" could mean
+    // "tampered". B1 added two more ways for a frame to fail verification — an algorithm we cannot
+    // read, and a salted frame we hold no salt for — and BOTH ARE ORDINARY. An honest peer on a newer
+    // build produces the first. So the gate must still fire (never sign content you could not verify)
+    // while the LABEL must not accuse anyone: `unverifiable` is not `tampered`.
+    //
+    // One structure with two labels rather than two sets, deliberately: a second set is a second thing
+    // for every gate to remember to consult, and the one that gets forgotten is the one that matters.
+    #contentDesynced = new Map();
+    /**
+     * Frames refused because they named a content-hash algorithm this build cannot read, keyed by
+     * session → the refused frame's content hash → the name it used. Review F2, corrected by F-D.
+     *
+     * ⚠️ KEYED BY THE FRAME, NOT THE SESSION, and the first version was keyed by the session. That
+     * made it fire on the NORMAL case: after one junk-alg frame, every subsequent park recovery on
+     * that session logged a WARN forever, for entirely unrelated messages — and the text asserted the
+     * two events were "the same message arriving twice by different routes", which nothing had
+     * established. A warning that fires on the benign steady state is not a signal.
+     *
+     * Hash-keyed, the claim becomes a fact and the event fires exactly once per affected message: the
+     * entry is removed the moment it is reconciled.
+     */
+    #unreadableAlgSeen = new Map();
     // DOD-MSG-4 (strict in-order): the RELAY is the ordering authority (Structure 2). For each
     // message the relay witnesses, it delivers B a (content_hash -> canonical sequence) binding via
     // the leaf_deliver stream. B records it here — keyed #k(agent,session) -> (contentHashHex -> seq)
@@ -517,6 +778,13 @@ export class SessionNodeManager {
      * The router it calls never logs them.
      */
     #onDocumentFrame = null;
+    /**
+     * DOD-DOC-SCREEN-CLASSIFY-1: the classify-only half of the hook above — is this a document
+     * frame, deciding nothing else. Injected together with it so the two cannot disagree about what
+     * a document frame is. Null means every frame takes the full inbound screen, exactly as before
+     * the document layer existed.
+     */
+    #isDocumentFrame = null;
     // A send is NOT fire-and-forget. After a content_frame is delivered over the direct session
     // channel, the sender arms a TTF timer and waits for an unsigned, transport-authenticated
     // `persisted` delivery ACK on the same /cello/content/1.0.0 protocol. A persisted ACK cancels the
@@ -749,7 +1017,17 @@ export class SessionNodeManager {
      * fire this from an async backstop with no live caller (the TTF-expiry path) may ignore the
      * result — the deposit itself and its logging are unchanged either way.
      */
-    async #parkContent(agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor) {
+    /**
+     * `contentHashAlg` is `string | undefined`, NOT optional — B2b-1 review F4's shape, applied to the
+     * last place it was missing.
+     *
+     * Optional, dropping it at a call site was neither a typecheck error nor a test failure, because
+     * absent silently means `sha256` and that is the only value in play today. Measured: the
+     * direct-dial-fail route's mutant SURVIVED the whole daemon suite. Requiring the argument — even
+     * when its value is `undefined` — forces each of the three callers to state what this message was
+     * hashed under, so a new fourth caller cannot omit it by accident.
+     */
+    async #parkContent(agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg) {
         // Fault injection FIRST, so it reproduces the real shape: the refusal happens at the same point
         // the live hook refuses (before any deposit), with the same event and the same `cause`.
         if (this.#parkFaultRemaining > 0) {
@@ -785,6 +1063,9 @@ export class SessionNodeManager {
                 // on recover too (sealed INTO the ciphertext envelope — INV-3: the relay still sees only ciphertext).
                 structure1Cbor,
                 structure2Cbor,
+                // B2b: the park route must name the same algorithm the direct frame did, or the recipient
+                // verifies the same message two different ways depending on which route it took.
+                contentHashAlg,
             });
             // DOD-LEAVEMSG-1 (reviewer HIGH fix): check the TYPED result, not just "didn't throw" — the
             // production hook's own failure branches (standing receiver unavailable, relay explicitly
@@ -802,12 +1083,30 @@ export class SessionNodeManager {
             return { outcome: "parked" };
         }
         catch (err) {
+            /**
+             * THE CODE GOES IN `cause`, THE PARAGRAPH GOES IN THE LOG — B2b-2 constraint 6.
+             *
+             * `cause` is documented as the machine-readable half and is handed to callers that branch on
+             * it. Putting `err.message` there meant a producer-side refusal — this build cannot seal that
+             * algorithm — was indistinguishable from a relay outage, so it inherited the relay's guidance:
+             * *"queued, and will be re-sent when the relay link is back."* The relay was never asked, and
+             * every re-park throws in the same place, so that sends the operator to the wrong subsystem
+             * and then tells them to wait for a recovery that cannot happen.
+             *
+             * `instanceof`, not a string test: an untyped failure keeps the old behaviour exactly, so this
+             * narrows what the caller can distinguish without changing anything it could not.
+             */
+            const coded = err instanceof ParkEnvelopeError ? err : null;
             this.#logger.warn("content.park.deposit.failed", {
                 sessionId,
                 contentHash: contentHashHex,
+                ...(coded === null ? {} : { reason: coded.reason, detail: coded.detail }),
                 error: err instanceof Error ? err.message : String(err),
             });
-            return { outcome: "refused", cause: err instanceof Error ? err.message : String(err) };
+            return {
+                outcome: "refused",
+                cause: coded?.reason ?? (err instanceof Error ? err.message : String(err)),
+            };
         }
     }
     // ─── Initialization ──────────────────────────────────────────────────────
@@ -847,6 +1146,47 @@ export class SessionNodeManager {
         for (const ddl of [
             "ALTER TABLE sessions ADD COLUMN message_count INTEGER NOT NULL DEFAULT 0",
             "ALTER TABLE sessions ADD COLUMN interrupted_at TEXT",
+            /**
+             * Decisions Carried #8 — THE SESSION SALT, persisted.
+             *
+             * Agreed once at session open from BOTH sides' random contributions, and unchanged for the
+             * life of the session. It is NOT a key: it decrypts nothing, and it is what lets this
+             * operator's own transcript stay verifiable — the content hash is recomputed from stored
+             * plaintext on the receive path and again for any later check, and salted it is underivable
+             * without this value.
+             *
+             * PERSISTED because the alternative is silent corruption. ⚠️ FUTURE TENSE, deliberately
+             * (review F10): NOTHING WRITES OR READS THIS COLUMN YET. `DOD-M15-SEALWIRE-1` will add the
+             * contribution exchange and the lookup — "does this session already have a salt? yes → use it,
+             * no → agree one" — and without the column that lookup would fail after a restart, mint a
+             * fresh salt, and split the transcript at the crash: every leaf before it unverifiable, with
+             * nothing saying so. The column lands now because it must exist before the code that needs it.
+             *
+             * NULL for every session opened before this column existed; those keep the unsalted hash.
+             */
+            "ALTER TABLE sessions ADD COLUMN content_salt BLOB",
+            /**
+             * DOD-M15-FREEZE-STATUS-1 — carried here for the OTHER LANE (`CELLO_Support`), agreed in
+             * session `e3adcaa7…`. Two lanes must not both edit this file (§2e, one file two branches), so
+             * the columns land in one migration and every line of behaviour stays on their side. Nothing
+             * in this lane reads or writes them.
+             *
+             *   `frozen_at`     epoch-ms when `#freezeOnIdentityFailure` fired. NULL = never frozen.
+             *   `frozen_reason` the `reason` already passed to that method. NULL iff `frozen_at` is NULL.
+             *
+             * ⚠️ THE WRITE MUST LAND BEFORE `destroySessionNode`, NOT AFTER — FRAME-1 review F1's
+             * ordering, and the reason the in-memory `#frozenSessions.add` already sits before the
+             * teardown. `destroySessionNode` writes `interrupted`, which is the REVIVABLE status, so a
+             * durable mark landing after it lets a read race the teardown and revive the session out from
+             * under the freeze — the disk reproducing the bug the memory mark was moved early to fix.
+             *
+             * Why it earns a slot rather than waiting: `#frozenSessions` is memory-only today, so a
+             * restart UN-FREEZES a session that was frozen because a party signed with a key that was not
+             * the counterparty's. The next read revives it and re-admits that peer, while the log still
+             * says the session will not be revived.
+             */
+            "ALTER TABLE sessions ADD COLUMN frozen_at INTEGER",
+            "ALTER TABLE sessions ADD COLUMN frozen_reason TEXT",
             // MSG-001-3b (MSG-2 startup-flush): persist the session's relay endpoint so the
             // crash-backstop flush can deposit un-acked content after a restart, when the
             // in-memory entry is gone. relay_addrs is a JSON array of multiaddr strings.
@@ -893,6 +1233,18 @@ export class SessionNodeManager {
             // several times a day re-runs the whole budget against a hopeless session on every boot.
             "ALTER TABLE sessions ADD COLUMN restart_seal_gave_up_at INTEGER",
             "ALTER TABLE sessions ADD COLUMN restart_seal_gave_up_reason TEXT",
+            // DOD-M15-DIVERGE-DURABLE-1: epoch-ms when this session's tree and the relay's counter
+            // provably parted, so it can never seal bilaterally. NULL = not diverged.
+            //
+            // DURABLE, and the reason is that the read site cannot tell "not diverged" from "forgotten":
+            // both are false and both read READY. `#diverged` was in memory, so a restart turned a
+            // session that provably cannot seal into one the gate was happy to close.
+            //
+            // NOT the trade `frontier-mismatch.ts` makes on purpose. A frontier mismatch is re-detected
+            // by the very next close, so losing it costs a recomputation. Divergence is re-detected only
+            // by the next send that gets an ack behind the frontier — which on a finished conversation
+            // never comes. Losing it costs a WRONG ANSWER.
+            "ALTER TABLE sessions ADD COLUMN diverged_at INTEGER",
         ]) {
             try {
                 this.#db.exec(ddl);
@@ -1063,6 +1415,27 @@ export class SessionNodeManager {
         direction TEXT NOT NULL,        -- 'sent' | 'received'
         blob BLOB NOT NULL,             -- readable plaintext bytes (whole-DB SQLCipher-encrypted at rest)
         created_at INTEGER NOT NULL,
+        -- ─── DOD-M15-SEALWIRE-1 bullet 5: the row proves AUTHORSHIP, or says it cannot ──────────
+        --
+        -- Before this, a row was (message, direction) and attribution came entirely from local
+        -- session state: "this arrived on the socket I believed was Bob's". That is fine while the
+        -- transcript is only ever read by its owner, and worthless the moment it is shown to anyone
+        -- else — which is the whole point of a notarized record.
+        --
+        -- sender_sig is the Structure-2 signature, and it is stored ONLY after the receiver has
+        -- already verified it against the pubkey inside the sender's own signed bytes
+        -- (#recordFrameOrdering). A stored signature here is a VERIFIED one, never a claimed one.
+        --
+        -- attribution is NOT NULL ON PURPOSE, and it is the load-bearing column. There is a soft
+        -- path — session.content.ordering.decode_failed falls back to hash-dedup — that ingests a
+        -- message with no verified signature, so rows legitimately without one WILL exist. A
+        -- nullable signature column and nothing else would rebuild the defect this bullet exists to
+        -- fix: a table that IMPLIES every row carries authorship proof, where some carry none and
+        -- nothing distinguishes them. Forcing every writer to name which it is makes silent NULL
+        -- impossible rather than merely discouraged.
+        sender_pubkey TEXT,             -- from INSIDE the sender's signed bytes; NULL unless verified
+        sender_sig BLOB,                -- the VERIFIED Structure-2 signature; NULL unless verified
+        attribution TEXT NOT NULL DEFAULT 'local_session_state',  -- verified_signature | self_authored | local_session_state
         PRIMARY KEY (agent_id, session_id, sequence, direction)
       )
     `);
@@ -1114,6 +1487,32 @@ export class SessionNodeManager {
         PRIMARY KEY (agent_id, contact_pubkey, signal_hash)
       )
     `);
+        /**
+         * DOD-M15-SEALWIRE-1 bullet 5: authorship columns on an EXISTING transcript.
+         *
+         * BEFORE `migrateSessionTablesToAgentId` — the rebuild copies the intersection of old and new
+         * columns, so a column added after it would be dropped on the upgrade boot and re-added empty.
+         * These have their second entry in that migration's pinned DDL; `DOD-M15-MIGRATION-GUARD-1`
+         * fails the build if the two ever disagree.
+         *
+         * `addColumnIfMissing` rather than a bare try/catch: it swallows ONLY `duplicate column name`
+         * and rethrows anything else, so broken DDL cannot be mistaken for "already applied".
+         */
+        // Written as three LITERAL statements rather than a loop over a column array. A loop needs its
+        // own parser in the guard (as retry_queue does); literals are read by the guard's generic one,
+        // so these are replayed automatically and cannot fall outside it.
+        addColumnIfMissing(this.#db, this.#logger, {
+            table: "transcript", column: "sender_pubkey",
+            sql: "ALTER TABLE transcript ADD COLUMN sender_pubkey TEXT",
+        });
+        addColumnIfMissing(this.#db, this.#logger, {
+            table: "transcript", column: "sender_sig",
+            sql: "ALTER TABLE transcript ADD COLUMN sender_sig BLOB",
+        });
+        addColumnIfMissing(this.#db, this.#logger, {
+            table: "transcript", column: "attribution",
+            sql: "ALTER TABLE transcript ADD COLUMN attribution TEXT NOT NULL DEFAULT 'local_session_state'",
+        });
         const contactCols = this.#db.prepare("PRAGMA table_info(contacts)").all();
         if (!contactCols.some((c) => c.name === "moniker")) {
             this.#db.exec("ALTER TABLE contacts ADD COLUMN moniker TEXT");
@@ -1127,6 +1526,16 @@ export class SessionNodeManager {
         // database it already exists here and is re-keyed in the same transaction; on a fresh one it is
         // absent, is skipped, and RetryQueue then creates it directly in the re-keyed shape.
         migrateSessionTablesToAgentId(this.#db, this.#logger);
+        /**
+         * DOD-M15-DIVERGE-DURABLE-1: rehydrate the divergence set from `sessions.diverged_at`.
+         *
+         * AFTER `migrateSessionTablesToAgentId`, not with the column migrations that create the field.
+         * The query joins `sessions.agent_id` to `agents`, and on a database written before REMOVE-001
+         * that column does not exist until this migration adds it — placing the load earlier failed
+         * with `no such column: s.agent_id` on exactly those legacy databases, which are the ones a
+         * restart matters most for.
+         */
+        this.#loadDivergedFromDb();
         // DOD-TIER-1 (address-book Step 1): give `contacts` its tier metadata (tier / provenance /
         // last_offered_moniker / away_message). Pure ADD COLUMN, no rebuild — so it runs AFTER the
         // agent-id re-key above (it never needs to appear in that migration's pinned DDL) and BEFORE any
@@ -1269,6 +1678,101 @@ export class SessionNodeManager {
      * directory for the OFFLINE tree rebuild. Empty when no leaves were logged (e.g. a direct-only session
      * with no relay witness) — the caller then has nothing to carry and the seal stays bilateral/pending.
      */
+    /**
+     * REBUILD THE CERTIFIED ROOT FROM THIS DAEMON'S OWN LEAVES — `DOD-M15-SEALWIRE-1` bullet 2.
+     *
+     * The receipt used to prove only that the directory signed SOMETHING: the client took the sealed
+     * root off the wire, confirmed the directory's signature over those bytes, stored it, and threw
+     * away the root it had computed a step earlier. At co-signing time that means **your key signs a
+     * root you never checked.**
+     *
+     * Bullet 1 moved the certified root into the content-hash domain, which is the domain this daemon
+     * can actually rebuild — each carry leaf's `content_hash` is the leaf hash (RFC 6962 §2.1 "hash"
+     * leaves are used as-is), and the carry is ordered by the relay's canonical `sequence_number`,
+     * which is the order the directory rebuilds in.
+     *
+     * ─── Why this returns "cannot judge" instead of always answering ───────────────────────────
+     *
+     * A root comparison that is WRONG makes every session unsealable, and force-abandon — no receipt —
+     * becomes the only exit. That failure is worse than the one being guarded, and this file already
+     * carries two comments saying so about other gates.
+     *
+     * The carry is this daemon's view, and it is not guaranteed complete at the instant a certificate
+     * arrives: the counterparty's SEAL ctrl leaf is what TRIGGERS the seal, so it may not have been
+     * witnessed here yet. So completeness is checked FIRST, against the certificate's own leaf count.
+     * A short carry means this daemon cannot judge — which is a different answer from "the roots
+     * disagree", and conflating them would turn a local timing gap into an accusation.
+     */
+    verifyCertifiedRoot(agentPubkeyHex, sessionIdHex, certifiedRoot, certifiedLeafCount) {
+        const carry = this.getSealCarry(agentPubkeyHex, sessionIdHex);
+        if (carry.length === 0)
+            return { verdict: "cannot_judge", reason: "no_carry" };
+        /**
+         * COMPLETENESS IS ESTABLISHED FROM THE CARRY'S OWN EVIDENCE, NEVER FROM THE CERTIFICATE.
+         *
+         * Review F3, and the first cut had this exactly backwards. It gated on
+         * `carry.length !== certifiedLeafCount`, where `certifiedLeafCount` is a field the DIRECTORY
+         * chooses and signs — so the party being checked controlled whether it was checked. A directory
+         * certifying a root over a different conversation had only to state a `leaf_count` that did not
+         * match, and the client answered "cannot judge" and accepted. The signature still verified,
+         * because the count is signed inside the same TBS.
+         *
+         * That is the hole §2b names in as many words: *"an attacker who wants to evade a mismatch check
+         * simply never supplies a checkable proof. Treating 'we could not tell' as harmless is the
+         * hole."* I defended against a false POSITIVE and left the false NEGATIVE one field away.
+         *
+         * The carry can answer the question by itself. A complete bilateral leaf set is:
+         *   - sequences contiguous from 1 — no gap where a leaf this daemon never saw would sit; and
+         *   - exactly two SEAL ctrl leaves, from two DISTINCT senders — which is what a bilateral seal
+         *     is, and is the condition that says the counterparty's closing leaf has landed here.
+         * Both predicates already exist in `seal-escalation.ts`; this reuses their shape rather than
+         * inventing a second opinion about the same question.
+         *
+         * When the carry IS self-evidently complete, a `leaf_count` that disagrees is no longer "I
+         * cannot tell" — it is the certificate describing a different leaf set, which is a MISMATCH.
+         */
+        const sequences = carry.map((l) => l.sequenceNumber).sort((a, b) => a - b);
+        const contiguousFromOne = sequences.every((n, i) => n === i + 1);
+        const ctrlSenders = new Set(carry.filter((l) => l.leafKind === LEAF_KIND_CTRL).map((l) => l.senderPubkeyHex));
+        const selfEvidentlyComplete = contiguousFromOne && ctrlSenders.size === 2;
+        if (!selfEvidentlyComplete) {
+            return {
+                verdict: "cannot_judge",
+                reason: contiguousFromOne
+                    ? `carry_incomplete: ${ctrlSenders.size} of 2 SEAL ctrl leaves witnessed here`
+                    : `carry_noncontiguous: hold ${carry.length} leaves with a gap in the relay sequence`,
+            };
+        }
+        if (carry.length !== certifiedLeafCount) {
+            // The carry proves itself complete and the certificate claims a different size, so the
+            // certificate is over a different leaf set. Accusing is correct here.
+            return {
+                verdict: "mismatch",
+                ownRootHex: null, // no root computed — the sets differ in SIZE, which is decisive on its own
+                detail: `leaf_count_disagrees: this daemon holds a provably complete ${carry.length}-leaf set, the certificate claims ${certifiedLeafCount}`,
+            };
+        }
+        const inputs = [];
+        for (const leaf of carry) {
+            let contentHash;
+            try {
+                // Canonical Structure 1 is [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp].
+                contentHash = decode(leaf.structure1Cbor)[1];
+            }
+            catch {
+                return { verdict: "cannot_judge", reason: "structure1_decode_failed" };
+            }
+            if (!(contentHash instanceof Uint8Array) || contentHash.length !== 32) {
+                return { verdict: "cannot_judge", reason: "structure1_content_hash_missing" };
+            }
+            inputs.push({ kind: "hash", data: contentHash });
+        }
+        const ownRoot = merkleRoot(buildMerkleTree(inputs));
+        const ownRootHex = Buffer.from(ownRoot).toString("hex");
+        return Buffer.compare(Buffer.from(ownRoot), Buffer.from(certifiedRoot)) === 0
+            ? { verdict: "match" }
+            : { verdict: "mismatch", ownRootHex, detail: "root_disagrees: same leaf count, different leaves or different order" };
+    }
     getSealCarry(agentPubkeyHex, sessionIdHex) {
         if (!this.#sealLeafStore && this.#db) {
             this.#sealLeafStore = new SessionSealLeafStore(this.#db, this.#logger);
@@ -1286,16 +1790,40 @@ export class SessionNodeManager {
      * lost row only cost the unread count. Delivery reads the transcript now, so a swallowed received
      * row is TOTAL content loss and the caller has to know.
      */
-    recordTranscriptMessage(agentName, sessionId, sequence, direction, plaintext, correlationId) {
+    recordTranscriptMessage(agentName, sessionId, sequence, direction, plaintext, correlationId, 
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 5: the VERIFIED authorship proof, when there is one.
+     *
+     * Optional because there legitimately is not always one — the ordering decode can fail SOFT and
+     * the message is still ingested via hash-dedup. Optional is NOT the same as unremarked: absence
+     * is written into the row as `attribution = 'local_session_state'`, so a reader can tell a row
+     * whose author was proven from one whose author was assumed. That distinction is the bullet.
+     */
+    authorship) {
         if (!this.#db)
             return false;
         try {
             const agentId = this.#requireAgentId(agentName);
             const blob = Buffer.from(plaintext);
             this.#db
-                .prepare(`INSERT OR IGNORE INTO transcript (agent_id, session_id, sequence, direction, blob, created_at)
-           VALUES (?, ?, ?, ?, ?, ?)`)
-                .run(agentId, sessionId, sequence, direction, blob, Date.now());
+                .prepare(`INSERT OR IGNORE INTO transcript
+             (agent_id, session_id, sequence, direction, blob, created_at, sender_pubkey, sender_sig, attribution)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(agentId, sessionId, sequence, direction, blob, Date.now(), authorship ? Buffer.from(authorship.senderPubkey).toString("hex") : null, authorship ? Buffer.from(authorship.senderSig) : null, 
+            /**
+             * THREE values, not two — caught by CELLO_Coder_1 reviewing the first version, and it was
+             * the same defect this column exists to prevent, surviving one layer up in the enum.
+             *
+             * `local_session_state` covered two OPPOSITE rows: one this agent AUTHORED (provenance
+             * fully known, merely not third-party-provable) and one RECEIVED on the soft fallback
+             * (provenance unknown — something arrived on a socket and was trusted). A reader shown the
+             * transcript later could not separate "he wrote this himself" from "nobody checked".
+             * Structurally identical rows with different trustworthiness is exactly what I refused to
+             * ship when I rejected a nullable signature column.
+             *
+             * No plumbing needed: `direction` already carries the answer at write time.
+             */
+            authorship ? "verified_signature" : direction === "sent" ? "self_authored" : "local_session_state");
             this.#logger.info("transcript.message.recorded", { sessionId, agentName, sequence, direction, correlationId });
             return true;
         }
@@ -1819,7 +2347,54 @@ export class SessionNodeManager {
         // DOD-RENAME-1: a removed contact has no pending rename to resolve.
         if (res.changes > 0)
             this.clearRenameNotice(agentName, pubkey);
-        return res.changes > 0;
+        /**
+         * OUTSIDE the `changes > 0` guard — review N2, and inside it the F2 fix did nothing for the
+         * case that matters.
+         *
+         * The pin is written on every ACCEPTED INBOUND session. A contact row is written only on an
+         * outbound initiate, an explicit add, a reply, or a trust-signal presentation — and an inbound
+         * requester is deliberately NOT auto-added. So a counterparty you never replied to (away-mode
+         * auto-ack is exactly this) has a pin and no contact row.
+         *
+         * Guarded, `cello_contact_remove` for them returned `{ ok: true, removed: false }`, cleared
+         * nothing, and the identity refusal stayed permanent — the original lockout, now wearing an
+         * `ok: true`, which is harder to notice than the original.
+         */
+        const pinsCleared = this.clearPinnedCounterpartyPrimary(agentName, pubkey);
+        return res.changes > 0 || pinsCleared > 0;
+    }
+    /**
+     * Forget the pinned threshold group key for a counterparty, so the next session re-pins.
+     *
+     * DOD-M15-OFFER-SIGNED-1 review F2 — WITHOUT THIS THE REFUSAL WAS PERMANENT. The identity-change
+     * check refuses a counterparty whose group key differs from the one recorded in an earlier
+     * session, and its guidance told the operator to confirm out of band and then remove the contact
+     * so the new identity is pinned afresh. `removeContact` deleted a row in `contacts`; the pin lives
+     * in `sessions.counterparty_primary_pubkey`, and nothing in the daemon ever cleared it.
+     *
+     * So an operator who did exactly as instructed — called their counterparty, confirmed the
+     * re-registration was genuine, removed the contact, retried — got the identical refusal, with no
+     * way out short of editing the database. A security control that cannot be reset by the person it
+     * protects is a lockout, and the printed remedy made it worse by reading as though it worked.
+     *
+     * Nulls the column rather than deleting the session rows: those rows are the transcript record,
+     * and a re-pin is not a reason to lose them.
+     */
+    clearPinnedCounterpartyPrimary(agentName, counterpartyPubkeyHex) {
+        if (!this.#db)
+            return 0;
+        const res = this.#db
+            .prepare(
+        // NO `updated_at` BUMP — review N6. `CAP_COUNTS` counts an interrupted session only while
+        // `updated_at` is inside the staleness window, so touching it here reset the clock on every
+        // stale session with that counterparty, re-inflating their per-sender cap — while removing
+        // the contact simultaneously dropped them to UNKNOWN tier, which LOWERS it. The operator
+        // follows the printed remedy and their counterparty's next session is refused for cap,
+        // through a reason string deliberately identical to every other refusal. A second lockout
+        // that says nothing. Nothing needs the timestamp: every candidate row ends up NULL.
+        "UPDATE sessions SET counterparty_primary_pubkey = NULL WHERE agent_id = ? AND counterparty_pubkey = ?")
+            .run(this.#requireAgentId(agentName), counterpartyPubkeyHex);
+        return Number(res.changes);
     }
     /** MONIKER-4: the operator's pet name for a pubkey (whoLabel's top tier), or null. Read-only
      *  and tolerant of a not-yet-open DB (a missing label degrades the doorbell, never blocks it). */
@@ -1934,14 +2509,14 @@ export class SessionNodeManager {
             // over-cap UNKNOWN must be indistinguishable, or the refusal tells someone they are blocked.
             // The operator's alarm needs numbers, so it asks for them SEPARATELY via capDiagnostics;
             // hanging them off this object would put a distinguishing oracle in the return value.
-            return { ok: false, reason: "abuse_bound_sessions_per_sender" };
+            return { ok: false, reason: CAPACITY_REASONS.ABUSE_BOUND_SESSIONS_PER_SENDER };
         }
         // The global stranger cap is only for the UNKNOWN pool. A KNOWN+ sender is past it by trust;
         // a BLOCKED sender was already refused above (cap 0).
         if (tier === TIER.UNKNOWN) {
             const globalUnknown = this.countActiveSessionsFromUnknownSenders(agentName);
             if (globalUnknown >= ABUSE_MAX_UNKNOWN_SESSIONS_GLOBAL) {
-                return { ok: false, reason: "abuse_bound_unknown_sessions_global" };
+                return { ok: false, reason: CAPACITY_REASONS.ABUSE_BOUND_UNKNOWN_SESSIONS_GLOBAL };
             }
         }
         return { ok: true };
@@ -2058,7 +2633,11 @@ export class SessionNodeManager {
         const retry = this.#srReservationRetry.get(agentName);
         return retry !== undefined && retry.attempts > SR_RESERVATION_MAX_RETRIES ? "unreachable" : "retrying";
     }
-    /** First ready standing receiver (any agent) — for agent-agnostic OUTBOUND use (gater-open). */
+    /**
+     * First ready standing receiver (any agent) — for agent-agnostic OUTBOUND use. Its gater admits
+     * nobody INBOUND until a session names them (DOD-M15-ASSIGN-1); outbound stays open, which is the
+     * property these callers depend on.
+     */
     #anyStandingReceiver() {
         for (const sr of this.#standingReceivers.values())
             return sr;
@@ -2081,10 +2660,115 @@ export class SessionNodeManager {
         return { peerId: sr.node.getPeerId(), addrs: sr.node.listenAddresses() };
     }
     /**
-     * The standing receiver's libp2p node — a general-purpose, OPEN-gater node usable for
-     * OUTBOUND dials that are not session-scoped (e.g. the content-park deposit/pull to the
-     * relay, MSG-001-3b). Session nodes have restrictive gaters; the standing receiver does not.
-     * Returns null until the receiver is ready.
+     * DOD-M15-ASSIGN-1 — name the one peer allowed to dial this agent's standing receiver, at the
+     * moment the directory's `session_offer` says who is coming.
+     *
+     * This is what makes the receiver's deny-by-default safe. The offer names
+     * `initiator_session_peer_id`, and the responder answers it by advertising its OWN address in
+     * `session_offer_accept`. Narrowing here — BEFORE that answer goes out — means the door opens to
+     * exactly one peer at the same instant the address that reaches them is published, and never
+     * before. The initiator cannot know where to dial until the accept it triggers has been sent.
+     *
+     * Returns WHICH failure it was, never a bare false (review F6). The caller reports a distinct
+     * reason per cause: "no receiver" and "the directory named nobody" are different subsystems, and
+     * collapsing them sent the operator to the directory for a local problem. This method never
+     * widens the gate to compensate.
+     *
+     * Narrows INBOUND ONLY. The receiver is still the daemon's general-purpose dialer at this point
+     * — no assignment exists yet — so revoking its outbound latitude here would break content
+     * parking and restart-seal submission (review F2).
+     */
+    admitOfferedDialer(agentName, initiatorSessionPeerId, sessionIdHex) {
+        const sr = this.#standingReceivers.get(agentName);
+        if (!sr)
+            return "no_receiver";
+        if (initiatorSessionPeerId === "")
+            return "no_peer_named";
+        sr.gater.admitInboundPeer(initiatorSessionPeerId);
+        this.#offeredDialer.set(this.#k(agentName, sessionIdHex), initiatorSessionPeerId);
+        return "narrowed";
+    }
+    /**
+     * What the UNSIGNED offer claimed, so the SIGNED assignment can be checked against it.
+     *
+     * DOD-M15-OFFER-SIGNED-1. Decision 2 rules that the listening socket is "gated on the
+     * assignment", and the gate is narrowed from `session_offer` — a frame carrying no signature —
+     * because that is the only thing that arrives early enough. Timing forced the offer; it does not
+     * excuse trusting it.
+     *
+     * Keeping what the offer said turns the two frames into a CHECK ON EACH OTHER. The assignment is
+     * FROST-signed by the initiator's own threshold group, which no single directory can produce, and
+     * it names the same peer id. A directory that says one peer in the offer and another in the
+     * assignment is naming two different dialers for one session — which a truthful directory never
+     * does, and which is exactly the move a compromised one would make to slip a peer past the gate
+     * before the signed document arrives.
+     */
+    getOfferedDialer(agentName, sessionIdHex) {
+        return this.#offeredDialer.get(this.#k(agentName, sessionIdHex)) ?? null;
+    }
+    /**
+     * Which peer this agent's standing receiver is currently admitting INBOUND — `null` for nobody.
+     *
+     * Read-only, and it answers a question the daemon otherwise cannot: *"whose dial would this
+     * receiver accept right now?"* The gate is narrowed and re-closed from several paths (an offer
+     * arrives, an assignment is refused, a session is promoted), and until now the only way to know
+     * where it had ended up was to reproduce the sequence in your head.
+     *
+     * Added for `DOD-M15-RESPONDER-VERIFY-1`, where a refusal for one session was closing the gate a
+     * DIFFERENT session had narrowed — a defect with no observable symptom short of the second
+     * session's initiator being refused with "nothing invited it".
+     */
+    getStandingReceiverAllowedPeer(agentName) {
+        return this.#standingReceivers.get(agentName)?.gater.getAllowedPeerId() ?? null;
+    }
+    /** Forget the offered dialer for ONE session — called on BOTH the claim and the refusal paths. */
+    clearOfferedDialer(agentName, sessionIdHex) {
+        this.#offeredDialer.delete(this.#k(agentName, sessionIdHex));
+    }
+    /**
+     * RE-CLOSE the standing receiver — but ONLY if this session is still the one holding it.
+     *
+     * DOD-M15-OFFER-SIGNED-1 review F4, then N1. The first version closed the gate unconditionally,
+     * and that was worse than the defect it fixed: an agent has ONE standing receiver with ONE allowed
+     * peer, so a refusal for session P closed the gate that offer Q had narrowed. Q's initiator —
+     * invited, legitimate — was then refused with *"nothing invited it"*, which this daemon had.
+     *
+     * That is the same cross-session interference F1 was written to remove, moved one method along,
+     * and triggerable the same way: one bogus offer/assignment pair collapses a concurrent real
+     * session.
+     *
+     * So the gate is closed only when it still names the peer THIS session opened it to. If a later
+     * offer has already re-narrowed it, that offer owns the receiver and its narrowing stands.
+     *
+     * NO EVICTION SWEEP, deliberately (N4). The sweep evicts by "not the allowed peer", and
+     * `getConnections()` returns OUTBOUND connections too — including the content-park and
+     * restart-seal dials this node makes as the daemon's general-purpose dialer, whose targets are on
+     * no allowlist by construction. Sweeping here hung those up, and the failure surfaced as
+     * `relay_unavailable`: a transport label for a local decision, which is the exact substitution
+     * that comment was written to prevent. The load-bearing control is `DOD-M15-FRAME-1`'s frame gate,
+     * which refuses what an unauthorised peer sends; closing the door is enough here.
+     */
+    revokeOfferedDialer(agentName, sessionIdHex, offeredPeerId) {
+        this.clearOfferedDialer(agentName, sessionIdHex);
+        const sr = this.#standingReceivers.get(agentName);
+        if (!sr || offeredPeerId === null)
+            return;
+        if (sr.gater.getAllowedPeerId() !== offeredPeerId) {
+            // A later offer already owns the receiver. Closing it would refuse THAT session's initiator.
+            this.#logger.debug("session.gate.revoke.skipped", {
+                agentName,
+                sessionId: sessionIdHex,
+                reason: "a later offer has re-narrowed this receiver; its narrowing stands",
+            });
+            return;
+        }
+        sr.gater.closeInbound();
+    }
+    /**
+     * The standing receiver's libp2p node — a general-purpose node usable for OUTBOUND dials that
+     * are not session-scoped (e.g. the content-park deposit/pull to the relay, MSG-001-3b). Its
+     * gater admits nobody INBOUND until a session names them (DOD-M15-ASSIGN-1), but leaves these
+     * outbound errands open. Returns null until the receiver is ready.
      */
     getStandingReceiverNode(agentName) {
         // With an agentName: that agent's own standing-receiver node (needed when the dial must
@@ -2137,8 +2821,9 @@ export class SessionNodeManager {
         this.#onContentArrived = cb;
     }
     /** M14 / DOD-DOC-INBOUND-2: inject the document-frame interception. See the field's note. */
-    setOnDocumentFrame(cb) {
+    setOnDocumentFrame(cb, classifyOnly) {
         this.#onDocumentFrame = cb;
+        this.#isDocumentFrame = classifyOnly ?? null;
     }
     /**
      * DOD-LOOP-1: the session core is keyed by (agentName, sessionId), NOT sessionId alone. Two of
@@ -2266,6 +2951,7 @@ export class SessionNodeManager {
             }
             ({ node, gater, autoNat, seed } = sr);
             gater.setAllowedPeer(counterpartyPeerId);
+            await this.#evictPeersOutsideGate(node, gater, sessionId, counterpartyPeerId, "outbound_promotion");
             // Hand this agent's standing receiver off to this session; a replacement is spun up below.
             this.#standingReceivers.delete(agentName);
         }
@@ -2606,6 +3292,21 @@ export class SessionNodeManager {
                     correlationId,
                 });
             }
+            /**
+             * DOD-M15-SEALWIRE-1 bullet 6 (part A) — ANNOUNCE OUR SALT STATE, here and nowhere else.
+             *
+             * This is the only hook that fires on BOTH sides for every way a session's direct path comes
+             * up: the initiator's first dial, the responder's inbound connection, every reconnect, and a
+             * revived node. `newStream` never dials — it only finds an already-open connection — so a
+             * send placed at `createSessionNode` would be an announcement to a peer that is not attached
+             * yet, and the responder's half has no dial of its own to hang one on at all.
+             *
+             * Fire-and-forget: a failed announcement must not turn a peer-connect handler into a rejected
+             * promise, and there is nothing to await it. We re-announce on the next connect, and
+             * `#handleSaltFrame` answers a peer contribution on a connection that is provably up — so a
+             * single lost frame does not strand the agreement.
+             */
+            void this.#sendSaltFrame(agentName, sessionId, correlationId);
         });
         node.onPeerDisconnect((peerId) => {
             if (!isCounterparty(peerId)) {
@@ -2822,6 +3523,12 @@ export class SessionNodeManager {
      * unexpected peer could connect during the hand-off.
      */
     async acceptSession(sessionId, agentName, counterpartyPubkey, initiatorPeerId, correlationId, relay) {
+        // DOD-M15-OFFER-SIGNED-1 review N5: the offer record has done its job the moment this session is
+        // claimed. Keying it by session (the F1 fix) removed the accidental bound that agent-keying gave
+        // it — each new offer used to overwrite the last — so without a clear on the SUCCESS path the
+        // map gained one permanent entry per offer ever received, on directory-supplied keys. Cleared
+        // here rather than only on refusal, which is what the doc comment always claimed.
+        this.clearOfferedDialer(agentName, sessionId);
         const inboundSr = this.#standingReceivers.get(agentName);
         if (!inboundSr) {
             // DOD-LOOP-1: per-agent — kick off (idempotent) creation so a retry finds it.
@@ -2850,6 +3557,7 @@ export class SessionNodeManager {
         const { node, gater, autoNat, seed } = inboundSr;
         // AC-015: update gater BEFORE retrieving multiaddr / returning to caller
         gater.setAllowedPeer(initiatorPeerId);
+        await this.#evictPeersOutsideGate(node, gater, sessionId, initiatorPeerId, "inbound_promotion");
         const peerId = node.getPeerId();
         const addrs = node.listenAddresses();
         // Persist to SQLite. D4 review F1 (same as createSessionNode): a swallowed row-write failure
@@ -3114,10 +3822,47 @@ export class SessionNodeManager {
         this.#sessionLiveness.delete(key);
         // M7-UPGRADE-002: drop the auto-acknowledge bookkeeping for a torn-down session.
         this.#contentDesynced.delete(key);
+        // DOD-M15-REFUSED-INBOUND-SILENT-1: and the unshown refusals. Bounded (a fixed set of reasons
+        // per session) so leaving them was a slow leak rather than a bug — but this list IS the
+        // documented teardown set, and a map that is not in it drifts out of everyone's mental model.
+        this.#contentRefusals.delete(key);
+        this.#unreadableAlgSeen.delete(key);
         this.#responderSealSubmitted.delete(key);
         // DOD-MSG-4: drop the strict-in-order bookkeeping (witness map, held plaintext, high-water)
         // so a torn-down session retains no stale ordering state or buffered plaintext.
         this.#witnessedSeq.delete(key);
+        /**
+         * DOD-M15-SEALWIRE-1 bullet 6 (part A) — both salt maps are CACHES and both go.
+         *
+         * The salt is re-read from `sessions.content_salt` on revival, which is the reason Decision #8
+         * persists it. The contribution is worthless once a salt exists, and if none was agreed yet, a
+         * revival minting a fresh one is correct: the peer either also holds nothing (both re-derive
+         * from the two current halves and reach the same bytes), or it derived against our old half
+         * while we were down — in which case the agreement refuses by name, which is the outcome
+         * Decision #10 asks for. What must never happen is a NEW contribution mid-session without a
+         * teardown, and that is why `#saltContributionFor` mints once rather than per send.
+         */
+        this.#saltContributions.delete(key);
+        this.#sessionSalts.delete(key);
+        this.#saltRepairedAgainst.delete(key);
+        /**
+         * B2b-2's three, and the pending one is SETTLED rather than dropped.
+         *
+         * A `delete` alone leaves any send waiting on that promise waiting until its own timer fires —
+         * five seconds of a torn-down session holding a message that has nowhere to go. `closed` is the
+         * truthful outcome: the agreement is over, because the session is.
+         *
+         * `#hashedWithoutSalt` and `#unsaltedAnnounced` go with the caches, and that is correct rather
+         * than merely tidy. A revived session re-derives its frontier from durable state — leaves, held
+         * rows, queued rows — so the adoption question is answered from disk, not from a flag that would
+         * be a stale in-memory claim about a process that no longer exists. Re-announcing the fallback
+         * once per revival is the right frequency too: it is what an operator reading a fresh log needs
+         * in order to know why this session has no salt.
+         */
+        this.#settleSaltPending(agentName, sessionId, "closed");
+        this.#hashedWithoutSalt.delete(key);
+        this.#unsaltedAnnounced.delete(key);
+        this.#saltLastOutcome.delete(key);
         // HELD CONTENT IS LOST HERE, AND IT MUST SAY SO.
         //
         // These are frames we RECEIVED and VERIFIED and could not yet append, because the relay's
@@ -3189,7 +3934,24 @@ export class SessionNodeManager {
         // this unit exists to stop.
         this.#heldRestored.delete(key);
         this.#heldReleased.delete(key);
-        this.#diverged.delete(key);
+        // DOD-M15-DIVERGE-1: `#diverged` is NOT evicted here, and the omission is the point.
+        //
+        // It was, and that made the gate that reads it best-effort in exactly the population it targets.
+        // This eviction runs on EVERY teardown including `destroySessionNode` with a non-sealed reason,
+        // which writes status `interrupted` — one of the two statuses the seal gate is scoped to. So a
+        // session that diverged and was then torn down arrived at the gate with the fact already
+        // forgotten, and the read site cannot tell "not diverged" from "we forgot": both are
+        // `has() === false`, both read ready, and the close proceeds.
+        //
+        // Divergence is a fact about the DURABLE TREE, not about the live node — the tree keeps the
+        // misplaced leaf whether or not a node exists — so it does not belong to a cache keyed on node
+        // lifetime. It is cleared where it actually stops being true: `clearDivergedOnTerminal`, below.
+        //
+        // NOT YET DURABLE ACROSS A RESTART, stated here rather than left to be rediscovered — the same
+        // way `frontier-mismatch.ts` states its own trade. A daemon restart still empties this set, and
+        // unlike a frontier mismatch (re-detected by the very next close) divergence is only
+        // re-detected by the next send that gets an ack behind the frontier. Until it has a column, a
+        // restarted daemon can read a diverged session as ready. Tracked as `DOD-M15-DIVERGE-DURABLE-1`.
         // DOD-M12B-SESSION-SEED-1: HAND THEM TO THE REVIVAL RECORD BEFORE DROPPING THEM. This eviction
         // runs on every teardown, including the interruption a revival is meant to undo — so clearing
         // the addresses here is what left a revived session unable to dial anyone. The revival record
@@ -3277,9 +4039,42 @@ export class SessionNodeManager {
         else {
             const interruptedAt = new Date(now).toISOString();
             try {
-                this.#db.prepare(
+                const res = this.#db.prepare(
                 // DOD-CAP-SELF-HEAL-1: OURS. Our own shutdown ended these, not the counterparty.
                 "UPDATE sessions SET status = 'interrupted', updated_at = ?, interrupted_at = COALESCE(interrupted_at, ?), interrupted_by = 'local' WHERE status = 'active'").run(now, interruptedAt);
+                /**
+                 * ⚠️ THE AUTHORITATIVE PERSISTENCE STEP WAS SILENT ON SUCCESS, AND THAT IS WHY ITS OWN TEST
+                 * CANNOT BE DIAGNOSED.
+                 *
+                 * `AC-009 (binary): SIGTERM marks active sessions interrupted` failed twice in a row on CI
+                 * and blocked a publish. The captured daemon log ends at `daemon.started` with nothing after
+                 * it — because the ONLY thing this block could ever log was a thrown error. So the evidence
+                 * is equally consistent with two very different failures:
+                 *
+                 *   - the shutdown never ran (signal handler, early exit, teardown ordering), or
+                 *   - it ran and the UPDATE matched ZERO rows (visibility, or the rows genuinely were not
+                 *     `active` at that moment).
+                 *
+                 * Nothing in the log separates them, so the test's own comment picked one — *"the daemon's
+                 * connection can begin its shutdown UPDATE against a snapshot that predates this commit"* —
+                 * added a `wal_checkpoint(TRUNCATE)` for it, and the test failed again. One diagnosis, one
+                 * fix, one recurrence: the point at which the diagnosis is the thing to doubt.
+                 *
+                 * `changes` was on the result object the whole time and nobody read it. It discriminates the
+                 * two outright, and this is the last line the daemon writes before it dies, so it is the last
+                 * thing anyone investigating a bad shutdown will see.
+                 *
+                 * ⚠️ INFO AND NOT AN ERROR EVEN AT ZERO. Zero is the ordinary case for a daemon with no
+                 * active sessions — most shutdowns. Making it a warning would fire on nearly every clean exit
+                 * and train operators to filter the one signal that matters.
+                 */
+                this.#logger.info("session.interrupt.db.write.complete", {
+                    sessionId: "__all__",
+                    rowsMarkedInterrupted: Number(res.changes),
+                    impact: Number(res.changes) === 0
+                        ? "no session rows were 'active' at shutdown, so none was marked interrupted. Ordinary for a daemon with no live sessions — but if a session WAS expected to be interrupted, the UPDATE ran and matched nothing, which is a visibility or state question and NOT a shutdown that failed to run."
+                        : "these sessions are recorded as interrupted by OUR OWN shutdown, so they can be resumed or sealed rather than read as abandoned.",
+                });
             }
             catch (err) {
                 this.#logger.error("session.interrupt.db.write.failed", {
@@ -3711,6 +4506,27 @@ export class SessionNodeManager {
      * cello_get_sealed_receipt) depend on — without it an agent has no way to learn
      * its own session ids after a restart or from a fresh MCP connection.
      */
+    /**
+     * DOD-M15-REFUSED-INBOUND-SILENT-1, the DECLINED PROTECTION half — a FIELD, not an alert.
+     *
+     * An unsalted session is exactly as verifiable as every session shipped before salting existed,
+     * so there is nothing to interrupt the operator with and no event to fire. What was missing is
+     * STATE: nothing let anyone tell *"unsalted because this build predates the feature"* from
+     * *"unsalted because adoption was refused"* — and only the second says something about their
+     * setup. The session's own status now answers it, which costs nothing per message and cannot
+     * become a flood.
+     *
+     * The raw salt is dropped on the way out rather than passed through. `SELECT *` was handing the
+     * BLOB to a listing surface that has no use for it; the boolean is the whole question a reader of
+     * this list is asking, and shipping key material to answer a yes/no is not a trade worth making.
+     */
+    #saltStatusOf(row) {
+        const { content_salt, ...rest } = row;
+        return {
+            ...rest,
+            content_hashes_salted: content_salt != null && content_salt.length > 0,
+        };
+    }
     getSessionsForAgent(agentName) {
         if (!this.#db)
             return [];
@@ -3720,7 +4536,7 @@ export class SessionNodeManager {
         const rows = this.#db
             .prepare("SELECT * FROM sessions WHERE agent_id = ? ORDER BY updated_at DESC")
             .all(this.#requireAgentId(agentName));
-        return rows.map((r) => ({ ...r, agent_name: agentName }));
+        return rows.map((r) => ({ ...this.#saltStatusOf(r), agent_name: agentName }));
     }
     /**
      * Every persisted session across ALL agents, most-recently-updated first. Backs the daemon-wide
@@ -3737,7 +4553,8 @@ export class SessionNodeManager {
             .prepare(`SELECT s.*, a.agent_name AS agent_name
          FROM sessions s LEFT JOIN agents a ON a.agent_id = s.agent_id
          ORDER BY s.updated_at DESC`)
-            .all();
+            .all()
+            .map((r) => this.#saltStatusOf(r));
     }
     /**
      * M7-SESSION-004 (AC-005): persist the seal certificate's legibility object with the
@@ -3807,6 +4624,35 @@ export class SessionNodeManager {
      * signature locally. Best-effort — a missing row (race) is a no-op; the seal then falls back to
      * accept-without-verify (still sound: the live frame arrives over the authenticated Noise channel).
      */
+    /**
+     * The counterparty's threshold group key as this agent has seen it BEFORE — trust on first use.
+     *
+     * DOD-M15-OFFER-SIGNED-1 / RESPONDER-VERIFY-1. The responder does not verify the assignment's
+     * signature (deferred to SESSION-004), so every field in it is whatever the directory said. That
+     * makes a same-frame check circular: a compromised directory just says the same thing twice.
+     *
+     * This is the one anchor the responder holds that a directory CANNOT retroactively change — its
+     * own memory of previous sessions with this counterparty. A directory that names a different
+     * threshold group key for someone you have already talked to is either substituting an identity
+     * or has been compromised since; neither is a session to accept quietly.
+     *
+     * THE BOUND, stated rather than glossed: this is worth nothing on FIRST contact, which is the
+     * definition of trust-on-first-use. It hardens every session after it, which is where a long-lived
+     * counterparty relationship actually lives.
+     *
+     * Keyed on `counterparty_pubkey` — the K_local IDENTITY, which is the stable thing — not on a
+     * session id or a display name.
+     */
+    getPinnedCounterpartyPrimary(agentName, counterpartyPubkeyHex) {
+        if (!this.#db)
+            return null;
+        const row = this.#db
+            .prepare(`SELECT counterparty_primary_pubkey FROM sessions
+          WHERE agent_id = ? AND counterparty_pubkey = ? AND counterparty_primary_pubkey IS NOT NULL
+          ORDER BY updated_at DESC LIMIT 1`)
+            .get(this.#requireAgentId(agentName), counterpartyPubkeyHex);
+        return row?.counterparty_primary_pubkey ?? null;
+    }
     recordCounterpartyPrimary(agentName, sessionId, primaryPubkeyHex) {
         if (!this.#db)
             return;
@@ -4327,14 +5173,45 @@ export class SessionNodeManager {
      *     cross-process ordering (and thus AC-002 root agreement under concurrent
      *     bidirectional traffic) requires the relay-assigned sequence from MSG-001.
      */
-    async sendContent(agentName, sessionId, content, contentHash, correlationId, 
+    async sendContent(agentName, sessionId, content, contentHash, 
+    /**
+     * Required alongside the two below — every production caller already passes one, and an optional
+     * parameter in front of a required one is what TypeScript refuses. Making it explicit costs
+     * nothing and removes the last place a positional argument can silently shift.
+     */
+    correlationId, 
     /**
      * The DOMAIN this content belongs to, as the relay and the directory will see it. Defaults to
      * MESSAGE so `cello_send` is unchanged; the document path passes 0x04/0x05. Not cosmetic — the
      * directory computes `final_message` and `answered` from the witnessed kind, and both of its
      * document exclusions were dead while every document leaf arrived here as a message.
+     *
+     * ⚠️ ALSO REQUIRED NOW, and for the same reason as `contentHashAlg` below — this parameter is the
+     * precedent, not a bystander. It defaulted to MESSAGE, the document adapter in `daemon.ts`
+     * silently dropped it, and the wire was wrong for a whole release: *"0.0.145 shipped the fix
+     * everywhere except here."* A default that matches the common case makes the omission invisible
+     * at every call site and at typecheck. Every caller states its kind now.
      */
-    leafKind = LEAF_KIND_MSG) {
+    leafKind, 
+    /**
+     * `DOD-M15-SEALWIRE-1` part B2b — the algorithm `contentHash` was produced under, taken from
+     * `contentHashForSession` by the caller that computed the hash.
+     *
+     * Passed rather than re-derived HERE, deliberately: re-deriving would ask "how would this
+     * session hash something now?", and the answer can differ from how THIS message was actually
+     * hashed. A hash and its label must travel together or the peer refuses a message nobody touched.
+     *
+     * ⚠️ REQUIRED, NOT DEFAULTED — review B2b-1 F4, and the default is what made four mutants
+     * unfalsifiable. It was `= CONTENT_HASH_ALGS.SHA256`, which equals the only value in play today,
+     * so DROPPING THE ARGUMENT AT ANY OF THE FIVE HOPS produced byte-identical output and the whole
+     * 2,800-test daemon suite stayed green. Measured at all four send sites individually.
+     *
+     * A default that equals the current value makes every threading edit invisible until the value
+     * changes — and the day it changes, the dropped argument mislabels the message and every peer
+     * refuses it as a tamper. Required makes a dropped argument a TYPECHECK failure instead of a
+     * test question nobody can answer.
+     */
+    contentHashAlg) {
         const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
         if (!entry) {
             // M12-P13: no node, so nothing was witnessed and nothing was queued — the caller must NOT
@@ -4442,6 +5319,26 @@ export class SessionNodeManager {
                         // document for a killed conversation, which is a strictly worse bug than the one this
                         // unit fixes. It still refuses the send; it just does not reach for the shovel.
                         retireSession: (id) => {
+                            /**
+                             * `session_sealed` retires as SEALED. `seal_refused` retires as ABANDONED —
+                             * `DOD-M15-TERMINAL-REASON-1`, and the distinction is the whole reason that unit
+                             * exists.
+                             *
+                             * A refused seal has NO certificate: a directory read it and rejected it. Writing
+                             * `sealed` here would be a fabricated notarization claim — `cello_close_session`
+                             * answering "already sealed, view its notarization" while the receipt read answers
+                             * "not sealed yet", which is the two-answers-pointing-at-each-other deadlock
+                             * described above. `abandoned` is the state invented for exactly this:
+                             * locally terminal with nothing to notarize.
+                             */
+                            if (witnessed.reason === "seal_refused") {
+                                // `abandonSession`, not a hand-rolled flip-then-teardown: it already does the
+                                // status write synchronously BEFORE the async teardown yields, which is the
+                                // ordering the comment above spends a paragraph on. Reimplementing it here would
+                                // be a second copy of that reasoning, free to drift from the first.
+                                void this.abandonSession(agentName, id);
+                                return;
+                            }
                             if (witnessed.reason !== "session_sealed")
                                 return;
                             // STATUS FIRST AND SYNCHRONOUS, teardown second — the order `abandonSession` uses,
@@ -4461,6 +5358,10 @@ export class SessionNodeManager {
                     this.#logger.warn("session.relay.hash.submit.failed", {
                         sessionId,
                         reason: witnessed.reason,
+                        // The relay's own words about what happened, when it sent any. `reason` is the class and
+                        // this is the cause — without it a refusal reaches the operator as a bare code, which is
+                        // the state this field existed to end and never actually did.
+                        ...(witnessed.detail === undefined ? {} : { detail: witnessed.detail }),
                         correlationId,
                     });
                     relayRefusal = witnessed.reason;
@@ -4494,7 +5395,7 @@ export class SessionNodeManager {
             // resolves it (content.delivery.acked) and TTF expiry hands it to the park
             // backstop. The correlationId rides in the frame so the receiver's
             // session.content.received shares ONE flow id with the sender.
-            this.#trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, orderingS1, orderingS2);
+            this.#trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, orderingS1, orderingS2, contentHashAlg);
             const frame = encodeCbor({
                 type: "content_frame",
                 session_id: sessionId,
@@ -4507,6 +5408,10 @@ export class SessionNodeManager {
                 // prev_root (order). Omitted if the relay was unreachable — receiver falls back to the witness.
                 structure1_cbor: orderingS1,
                 structure2_cbor: orderingS2,
+                // DOD-M15-SEALWIRE-1 part B2b: HOW `content_hash` was produced. An older peer ignores an
+                // unknown CBOR key, so emitting it is safe for every build in existence; a newer one reads
+                // it and verifies under the named algorithm instead of assuming.
+                content_hash_alg: contentHashAlg,
             });
             // Injected dial failure — thrown from inside the try so it lands in exactly the catch the
             // real connection_lost lands in, and the whole downstream path (untrack → park → durable
@@ -4575,7 +5480,7 @@ export class SessionNodeManager {
                 ...this.#streamCensus(entry.node, entry.counterpartySessionPeerId),
                 correlationId,
             });
-            const attempt = await this.#parkContent(agentName, sessionId, hashHex, content, orderingS1, orderingS2);
+            const attempt = await this.#parkContent(agentName, sessionId, hashHex, content, orderingS1, orderingS2, contentHashAlg);
             if (attempt.outcome === "parked") {
                 this.#noteImpairmentRetention(agentName, sessionId, "parked");
                 return { ok: true, delivered: false, parked: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
@@ -4602,7 +5507,10 @@ export class SessionNodeManager {
                         });
                     }
                     else {
-                        durable = this.#onParkFailed(agentName, sessionId, hashHex, content, orderingS1, orderingS2);
+                        // B2b-1 review F1: the DURABLE writer. Without the 7th argument the column this unit
+                        // added has no producer at all — every queued row would carry NULL, and the crash
+                        // backstop would re-park a salted message as sha256 and have it refused forever.
+                        durable = this.#onParkFailed(agentName, sessionId, hashHex, content, orderingS1, orderingS2, contentHashAlg);
                     }
                     if (!durable) {
                         if (this.#onParkFailed !== null) {
@@ -4678,9 +5586,24 @@ export class SessionNodeManager {
                 // died inside #parkContent. An operator keying on `reason` alone is sent to the transport
                 // when the blocker is the receiver.
                 ...(attempt.cause !== undefined ? { cause: attempt.cause } : {}),
-                guidance: durable
-                    ? "Direct delivery failed and the relay refused the hand-off, so the message is queued and will be re-sent automatically when the relay link is back. Do not re-send it: an identical re-send is not separately queued."
-                    : "Direct delivery failed and the message could NOT be queued for retry — it is lost. Send it again.",
+                /**
+                 * ⚠️ A FAULT THAT IS NOT THE RELAY MUST NOT SAY IT IS — B2b-2 constraint 6.
+                 *
+                 * The `durable` branch below is written for a relay that is down: queued, retried, nothing
+                 * for you to do. That is right for the case it was written for and WRONG for a producer-side
+                 * refusal, which reaches the same branch by the same route. There the relay was never asked,
+                 * and the drain re-parks the same entry into the same throw — so the message is genuinely
+                 * durable and will genuinely never leave. Telling that operator to wait costs them however
+                 * long they are willing to wait before they stop believing the message.
+                 *
+                 * This is the reason `cause` had to become a code first: the distinction is unbranchable
+                 * while the field holds an English paragraph.
+                 */
+                guidance: attempt.cause === PARK_ENVELOPE_REASONS.ALG_UNREADABLE
+                    ? "This message names a content-hash algorithm your build cannot produce, so it could not be sealed for hand-off. The relay is NOT involved and this will not clear on its own — the message is safely stored but every retry fails the same way. Upgrade to a build that knows the algorithm, or start a new session with this counterparty. Re-sending on this build changes nothing."
+                    : durable
+                        ? "Direct delivery failed and the relay refused the hand-off, so the message is queued and will be re-sent automatically when the relay link is back. Do not re-send it: an identical re-send is not separately queued."
+                        : "Direct delivery failed and the message could NOT be queued for retry — it is lost. Send it again.",
             };
         }
     }
@@ -4761,7 +5684,22 @@ export class SessionNodeManager {
             });
             // content_hash = SHA-256(0x02 || seal_payload) — the ctrl leaf kind byte is 0x02.
             const contentHash = new Uint8Array(createHash("sha256").update(new Uint8Array([LEAF_KIND_CTRL])).update(sealPayload).digest());
-            const result = await entry.relayClient.submitLeaf(entry.node, entry.relaySessionIdBytes, contentHash, LEAF_KIND_CTRL);
+            /**
+             * ⚠️ `sealPayload` IS PASSED, AND ITS ABSENCE WAS THE WHOLE DEFECT — `DOD-M15-SEALWIRE-1`
+             * bullets 3+4, review pass 1, F1.
+             *
+             * These exact bytes were computed two lines above, hashed, and then dropped: `submitLeaf` had
+             * no parameter for them. So the directory received a SHA-256 pre-image nobody transmitted, and
+             * the client's SIGNED `final_root` — the one value in the seal the relay cannot produce — was
+             * unrecoverable. Four legs of this line shipped and were reviewed green while the head of the
+             * chain did not exist.
+             *
+             * The payload and the hash MUST come from the same derivation. If they ever diverge the
+             * directory reports `seal_payload_unbound`, whose guidance says *"someone between them and here
+             * altered or fabricated the payload — the relay is the only party on that path"* — a correct
+             * relay accused by name, in an error written to sound like an attack, for a mismatch made here.
+             */
+            const result = await entry.relayClient.submitLeaf(entry.node, entry.relaySessionIdBytes, contentHash, LEAF_KIND_CTRL, sealPayload);
             if (!result.ok) {
                 // Clear the idempotency mark so a genuine retry (agent close / reconnect) can proceed (DB-001).
                 this.#responderSealSubmitted.delete(sealKey);
@@ -4810,7 +5748,19 @@ export class SessionNodeManager {
         const record = this.getSessionRecord(agentName, sessionId);
         return {
             known: !!record,
-            tampered: this.#contentDesynced.has(this.#k(agentName, sessionId)),
+            /**
+             * THE REASON TRAVELS WITH THE VERDICT — review F-A, correcting review F1's fix.
+             *
+             * F1 made the gate binary and moved the label into the log, and I did that in ONE consumer.
+             * This struct feeds a second one (`evaluateSealUpgrade`), which had only a boolean to read and
+             * therefore called every cause `content_tamper` — at ERROR, with no guidance. An honest peer on
+             * a newer build raised a security alarm on B's reconnect: exactly the harm the F1 fix was
+             * written to remove, reached through the consumer it did not check.
+             *
+             * Returning the LABEL rather than a boolean is what makes that impossible to reintroduce: a
+             * caller cannot flatten what it never receives flat.
+             */
+            unverifiable: this.#contentDesynced.get(this.#k(agentName, sessionId)) ?? null,
         };
     }
     /**
@@ -4844,17 +5794,41 @@ export class SessionNodeManager {
         // scope (already sealing, or needs the interrupted/upgrade path), not an auto-ack candidate.
         if (!record || record.status !== "active")
             return;
-        // SI-002 verifiability gate: never auto-sign a session whose content we could not verify.
-        // Today the ONLY tracked unverifiable cause is a content_hash mismatch = TAMPER (#contentDesynced
-        // is set only there). Genuine tamper is a SECURITY event — log it at ERROR with the distinct
-        // reason `content_tamper` so the AC-008 tamper alarm can fire (it keys on that reason). The other
-        // two specced reasons — `desynced` (B's tree is behind the canonical sealed tail) and
-        // `content_unverifiable` (parked content unrecoverable) — require the MSG-001-3b canonical-
-        // sequence reconciliation that is deferred; they are reserved for that follow-on.
-        if (this.#contentDesynced.has(ackKey)) {
+        /**
+         * SI-002 verifiability gate: never auto-sign a session whose content we could not verify.
+         *
+         * ⚠️ THIS COMMENT SAID THE OPPOSITE UNTIL `DOD-M15-SEALWIRE-1` part B1 (review F-C). It read
+         * *"Today the ONLY tracked unverifiable cause is a content_hash mismatch = TAMPER"*, which was
+         * true when a mismatch was the only way to fail the cross-check and is false now: B1 added an
+         * unreadable algorithm name and a salted frame with no salt, and **both are ordinary**.
+         *
+         * Genuine tamper is a SECURITY event — ERROR, reason `content_tamper`, which is what the AC-008
+         * alarm keys on. The other two must NOT wear that name, or the alarm fires on an honest peer
+         * running a newer build and the operator learns to dismiss it.
+         *
+         * 🚨 AND `content_unverifiable` IS RESERVED — DO NOT REUSE IT HERE. It is specced for *parked
+         * content unrecoverable*, one of the two reasons (with `desynced`, B's tree behind the canonical
+         * sealed tail) awaiting the deferred MSG-001-3b canonical-sequence reconciliation. B1's first
+         * attempt emitted exactly that string for a different condition, which would have made the two
+         * indistinguishable in the log the day the follow-on landed. Hence
+         * `content_verification_unavailable`, deliberately distinct.
+         */
+        const unverifiable = this.#contentDesynced.get(ackKey);
+        if (unverifiable) {
+            /**
+             * DOD-M15-SEALWIRE-1 part B1 (review F1) — THE GATE FIRES FOR BOTH, THE ALARM ONLY FOR ONE.
+             *
+             * `content_tamper` is what the AC-008 alarm keys on, and it must keep meaning what it says. A
+             * frame we could not verify because the peer named an algorithm this build cannot read is an
+             * ordinary version difference; raising a tamper alarm for it would train an operator to
+             * dismiss the alarm, which costs more than the skew.
+             *
+             * But the REFUSAL TO AUTO-SIGN is identical in both cases and non-negotiable: SI-002 is "never
+             * auto-sign a session whose content we could not verify", and "could not" covers both.
+             */
             this.#logger.error("session.seal.autoack.skipped", {
                 sessionId,
-                reason: "content_tamper",
+                reason: unverifiable === "tampered" ? "content_tamper" : "content_verification_unavailable",
                 correlationId,
             });
             // AC-002: the verifiability gate refused — surface counterparty_closing to B's agent as a
@@ -4966,36 +5940,206 @@ export class SessionNodeManager {
      *
      * @returns the appended leaf index (as sequenceNumber) on success.
      */
-    async ingestReceivedContent(agentName, sessionId, content, contentHash, correlationId, 
     /**
-     * DOD-FRONTIER-STRAND-1 AC1: the relay-assigned canonical position for THIS message, taken from
-     * the verified ordering record by the caller. Passed EXPLICITLY rather than recovered from
-     * `#witnessedSeq`, because that map is keyed by content hash — so two byte-identical messages
-     * collapse in it before dedup is ever consulted, which is the whole defect. Absent when the
-     * session has no relay witness (relay-degraded): see the announced fallback below.
+     * Mark this session's content unverifiable — review F1, and every path that fails the cross-check
+     * must come through here.
+     *
+     * It gates `getSealUpgradeReadiness().tampered` and the auto-acknowledge check, i.e. whether this
+     * agent's key signs anything covering content it could not check. Three refusal paths reach it and
+     * they carry different labels, because what the operator is told must differ; **what the gate does
+     * must not.**
+     *
+     * TAMPERED NEVER DOWNGRADES. A session that has already seen a hash mismatch stays `tampered` even
+     * if a later frame merely names an unreadable algorithm — otherwise a sender that had been caught
+     * could clear its own alarm by sending one more frame with a junk algorithm name, and the seal
+     * would auto-complete.
      */
-    canonicalSeqIn) {
-        // The transcript is frozen ONLY once it is COMMITTED + signed — 'sealed' or
-        // 'seal_interrupted_pending' (the bilateral seal commitment) — because a later FROST
-        // notarization attests that exact root; a late leaf would diverge from it.
-        //
-        // MSG-001-3b recovery: a merely 'interrupted' session is NOT yet committed. The
-        // counterparty's last message(s) may have been parked while this party was offline, so its
-        // local transcript is INCOMPLETE (not frozen-final). Recovering that parked content COMPLETES
-        // the local view to match the counterparty BEFORE the bilateral seal — it is not a resumption
-        // (no new activity, no re-accept) and its root was never committed. So allow 'active' AND
-        // 'interrupted'; reject only the two committed states.
-        const record = this.getSessionRecord(agentName, sessionId);
-        // DOD-UNREAD-1 D4a: NEVER record content you cannot attribute. With no sessions row there is
-        // no counterparty — the transcript has no counterparty column, so a row written here is
-        // unattributable forever, counted unread by getUnreadSummary, and unreadable by cello_receive
-        // (the phantom-session residue). The old "(No DB row = test-only path, allowed.)" fallback
-        // papered that in with senderPubkey="unknown". Refuse loudly instead; the content stays
-        // un-acked, so a live sender redelivers once the session actually exists. After D3
-        // (DOD-INBOUND-GUARD-1) this path is unreachable from the wire — a fail-loud assertion.
-        if (!record) {
-            this.#logger.warn("session.content.orphaned", { agentName, sessionId, correlationId });
-            return { ok: false, reason: "session_orphaned" };
+    /**
+     * Remember that THIS frame was refused for naming an unreadable algorithm, so the park path can
+     * say so if the same message comes back the other way (review F2/F-D).
+     *
+     * BOUNDED, and it has to be: a peer that keeps sending unreadable frames would otherwise grow this
+     * without limit, and it is fed entirely by a remote party. The cap is per session and it drops the
+     * OLDEST entry — losing one only costs a missing reconciliation line, whereas an unbounded map fed
+     * by a counterparty is the leak class this codebase has already caught twice.
+     */
+    #noteUnreadableAlgFrame(agentName, sessionId, contentHash, declaredAlg) {
+        const key = this.#k(agentName, sessionId);
+        let byHash = this.#unreadableAlgSeen.get(key);
+        if (!byHash) {
+            byHash = new Map();
+            this.#unreadableAlgSeen.set(key, byHash);
+        }
+        if (byHash.size >= MAX_UNREADABLE_ALG_FRAMES) {
+            const oldest = byHash.keys().next();
+            if (!oldest.done)
+                byHash.delete(oldest.value);
+        }
+        byHash.set(Buffer.from(contentHash).toString("hex"), declaredAlg);
+    }
+    /**
+     * ─── DOD-M15-REFUSED-INBOUND-SILENT-1: refusals the RECEIVING operator can actually see ───────
+     *
+     * Every inbound refusal already logs a `reason`, an `impact` and a `guidance` — and they are
+     * good. They had no reader. From the receiving operator's chair a refused message simply never
+     * arrives: the conversation goes quiet with a full explanation sitting in a file they have no
+     * reason to open, and they conclude the other person stopped replying.
+     *
+     * `content_hash_alg_unknown` is why this matters more than it sounds. It is a VERSION SKEW, so it
+     * affects every message from that counterparty, permanently — not a rare one-off.
+     *
+     * **DEDUPLICATED PER SESSION PER REASON, and that is the design, not an optimisation.** A skewed
+     * peer turns one problem into a flood: the first refusal of a kind is the signal, the ninetieth is
+     * noise that trains the operator to ignore the surface. `count` keeps the scale visible without
+     * repeating the alert.
+     *
+     * **NEVER carries the content.** It failed verification; surfacing it is the injection path the
+     * cross-check exists to close. The operator learns that a message was refused and why — never
+     * what it said.
+     *
+     * In memory, deliberately: a restart re-signalling a still-broken peer is correct behaviour, not
+     * duplication, and durability here would buy nothing the next refusal does not.
+     */
+    /**
+     * (agentName, sessionId) → reason → the notice. `firstAt` was dropped: it was written and read by
+     * nothing, and a field nobody consumes is a claim the code does not keep.
+     */
+    #contentRefusals = new Map();
+    /** Record an inbound refusal for the operator. First of its kind per session is the signal. */
+    noteContentRefusal(agentName, sessionId, reason, detail) {
+        const key = this.#k(agentName, sessionId);
+        let perSession = this.#contentRefusals.get(key);
+        if (!perSession) {
+            perSession = new Map();
+            this.#contentRefusals.set(key, perSession);
+        }
+        const existing = perSession.get(reason);
+        if (existing) {
+            existing.count += 1;
+            return;
+        }
+        perSession.set(reason, {
+            reason,
+            impact: detail?.impact,
+            guidance: detail?.guidance,
+            count: 1,
+            // Per CONSUMER, not one global flag. See `takeContentRefusals`.
+            surfacedTo: new Map(),
+        });
+    }
+    /**
+     * Drain the refusals a GIVEN CONSUMER has not been shown yet, and remember what it was shown.
+     *
+     * ─── Why this is keyed by connection, and not by a single flag ─────────────────────────────────
+     *
+     * It used to set one `surfaced: boolean` on the notice. Two MCP windows attending the same agent
+     * is the ordinary case, and under that flag whoever read FIRST consumed the notice — the second
+     * window was told nothing, permanently. **That is the same defect `takeReceivedContent` had**, and
+     * the comment above the delivery loop in `session-content-handlers.ts` spells out why it was
+     * removed: *"reading is non-destructive by construction. Nothing one consumer does mutates state
+     * another consumer reads."* The whole `taken_by_sibling` apparatus exists because this was paid
+     * for once already; re-introducing it on a different surface makes it no less true.
+     *
+     * ─── Why the count now has a reader ────────────────────────────────────────────────────────────
+     *
+     * The old docstring claimed *"count still grows underneath, so a later reader can ask how many
+     * without being told again."* **There was no later reader.** After the first surfacing the count
+     * incremented under a flag the drain skipped unconditionally, so 3 refusals became 903 and nothing
+     * anywhere could say so — while the comment asserted the opposite.
+     *
+     * So a reason RE-ANNOUNCES to a consumer when its count has grown by an order of magnitude since
+     * that consumer last saw it (1 → 10 → 100 → …), marked `repeat: true`. That keeps the first
+     * refusal the signal and the ninetieth silent, which is the dedup's point, while still making a
+     * skew that has swallowed hundreds of messages visible — at a handful of announcements per
+     * session, not one per message.
+     */
+    takeContentRefusals(agentName, sessionId, 
+    /**
+     * REQUIRED, deliberately — no default.
+     *
+     * It had one (`"default"`), and a default is the defect this method was rewritten to remove,
+     * lying in wait: any future call site that omits the argument silently shares ONE bucket across
+     * every window, the first reader consumes the notice for all the others, and nothing fails to
+     * compile and no test goes red. The parameter existing is not the protection; being unable to
+     * forget it is.
+     */
+    consumerId) {
+        const perSession = this.#contentRefusals.get(this.#k(agentName, sessionId));
+        if (!perSession)
+            return [];
+        const out = [];
+        for (const notice of perSession.values()) {
+            const shownAt = notice.surfacedTo.get(consumerId);
+            const firstTime = shownAt === undefined;
+            // `shownAt` is at least 1 whenever it is set, so this cannot loop on zero.
+            if (!firstTime && notice.count < shownAt * 10)
+                continue;
+            notice.surfacedTo.set(consumerId, notice.count);
+            out.push({
+                reason: notice.reason,
+                impact: notice.impact,
+                guidance: notice.guidance,
+                count: notice.count,
+                ...(firstTime ? {} : { repeat: true }),
+            });
+        }
+        return out;
+    }
+    #markContentUnverifiable(agentName, sessionId, why) {
+        const key = this.#k(agentName, sessionId);
+        if (why === "unverifiable" && this.#contentDesynced.get(key) === "tampered")
+            return;
+        this.#contentDesynced.set(key, why);
+    }
+    async ingestReceivedContent(agentName, sessionId, content, contentHash, correlationId, 
+    /**
+     * DOD-FRONTIER-STRAND-1 AC1: the relay-assigned canonical position for THIS message, taken from
+     * the verified ordering record by the caller. Passed EXPLICITLY rather than recovered from
+     * `#witnessedSeq`, because that map is keyed by content hash — so two byte-identical messages
+     * collapse in it before dedup is ever consulted, which is the whole defect. Absent when the
+     * session has no relay witness (relay-degraded): see the announced fallback below.
+     */
+    canonicalSeqIn, 
+    /**
+     * DOD-M15-SEALWIRE-1 part B1 — the algorithm the SENDER named on the frame, verbatim.
+     *
+     * `undefined` means the frame carried no name, which is a peer that predates the field and is
+     * the one case we may safely assume `sha256` for. It is threaded through rather than read off
+     * the session, because whether a hash is salted is a fact about the FRAME and its sender, never
+     * about what this side happens to hold.
+     */
+    contentHashAlgIn, 
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 5: the VERIFIED authorship proof for this message, when the caller
+     * has one. The caller is the only place that has it — `#recordFrameOrdering` verifies the
+     * signature against the key inside the sender's own signed bytes and matches the signer to this
+     * session's counterparty, and that result reaches here or nowhere.
+     *
+     * Optional, because the soft decode-failure path ingests without it. The row records which it
+     * was, so absence is never silent.
+     */
+    verifiedAuthorship) {
+        // The transcript is frozen ONLY once it is COMMITTED + signed — 'sealed' or
+        // 'seal_interrupted_pending' (the bilateral seal commitment) — because a later FROST
+        // notarization attests that exact root; a late leaf would diverge from it.
+        //
+        // MSG-001-3b recovery: a merely 'interrupted' session is NOT yet committed. The
+        // counterparty's last message(s) may have been parked while this party was offline, so its
+        // local transcript is INCOMPLETE (not frozen-final). Recovering that parked content COMPLETES
+        // the local view to match the counterparty BEFORE the bilateral seal — it is not a resumption
+        // (no new activity, no re-accept) and its root was never committed. So allow 'active' AND
+        // 'interrupted'; reject only the two committed states.
+        const record = this.getSessionRecord(agentName, sessionId);
+        // DOD-UNREAD-1 D4a: NEVER record content you cannot attribute. With no sessions row there is
+        // no counterparty — the transcript has no counterparty column, so a row written here is
+        // unattributable forever, counted unread by getUnreadSummary, and unreadable by cello_receive
+        // (the phantom-session residue). The old "(No DB row = test-only path, allowed.)" fallback
+        // papered that in with senderPubkey="unknown". Refuse loudly instead; the content stays
+        // un-acked, so a live sender redelivers once the session actually exists. After D3
+        // (DOD-INBOUND-GUARD-1) this path is unreachable from the wire — a fail-loud assertion.
+        if (!record) {
+            this.#logger.warn("session.content.orphaned", { agentName, sessionId, correlationId });
+            return { ok: false, reason: "session_orphaned" };
         }
         // DOD-TERMINAL-WAKE-1 (review F1): `abandoned` belongs here too. It is terminal and, unlike
         // `interrupted`, can NEVER complete — there is nothing left to append to and no seal to join.
@@ -5018,18 +6162,126 @@ export class SessionNodeManager {
             });
             return { ok: false, reason: "session_committed" };
         }
-        const computed = wireContentHash(content);
+        /**
+         * DOD-M15-SEALWIRE-1 part B1 — VERIFY UNDER THE ALGORITHM THE SENDER NAMED.
+         *
+         * Three outcomes and they must stay apart, because two of them are version differences and only
+         * the third is evidence of tampering. Collapsing them is how a routine skew becomes a security
+         * incident in the operator's log, and how a real tamper gets dismissed as a skew.
+         */
+        /**
+         * ⚠️ `content_hash_alg` IS NOT COVERED BY ANY SIGNATURE — review F1, and it shapes both branches
+         * below.
+         *
+         * The sender's signature is over `structure1_cbor`, which binds `content_hash`. It does NOT bind
+         * the frame envelope, so this field is an unauthenticated CLAIM by whoever sent the frame. That
+         * is fine for choosing how to verify — a wrong choice simply fails — but it means neither branch
+         * may state, as fact, anything it learned only from this field.
+         *
+         * It also means both branches MUST mark the session unverifiable. Before B1 every frame that
+         * failed the cross-check reached `#contentDesynced`, which gates auto-co-signing and unilateral
+         * ratification. Returning early here would have let a sender bypass the tamper detector by
+         * appending one unsigned string: sign hash H, send different bytes, add an unreadable algorithm
+         * name, and the receiver refuses politely, records nothing, and auto-co-signs at seal time.
+         */
+        const algResolved = resolveContentHashAlg(contentHashAlgIn);
+        if (!algResolved.ok) {
+            // A NAME WE CANNOT READ. Not a legacy peer — an unreadable one. There is no value to compare
+            // against, so `content_hash_mismatch` here would be an exit-point label standing in for
+            // "their build is newer than ours" (Invariant 2). Refused by its own name instead.
+            this.#markContentUnverifiable(agentName, sessionId, "unverifiable");
+            this.#noteUnreadableAlgFrame(agentName, sessionId, contentHash, algResolved.value);
+            this.#logger.error("session.content.cross_check.failed", {
+                sessionId, correlationId,
+                reason: "content_hash_alg_unknown",
+                declaredAlg: algResolved.value,
+                // States only what is KNOWN. The old wording said "nothing was altered and nobody did
+                // anything wrong" and "Do not treat this as a security event" — both inferred from the
+                // unsigned field, i.e. from the attacker in the case that matters.
+                impact: "this message could not be verified, so it was NOT ingested and NOT shown. The algorithm name is a claim by the sender and is not covered by any signature, so it does not establish what they actually did. This session will not auto-co-sign at close.",
+                guidance: "Almost always their CELLO build is newer than this one: ask which version they are running, and upgrade. If they are on the SAME version as you, that explanation does not hold and the frame was malformed or crafted — do not close the session by auto-acknowledgement.",
+            });
+            // DOD-M15-REFUSED-INBOUND-SILENT-1: the SAME strings the log just carried, to the operator.
+            // This reason is a version skew, so it affects every message from that counterparty — without
+            // this the conversation goes permanently quiet and they conclude the peer stopped replying.
+            this.noteContentRefusal(agentName, sessionId, "content_hash_alg_unknown", {
+                impact: "this message could not be verified, so it was NOT ingested and NOT shown. The algorithm name is a claim by the sender and is not covered by any signature, so it does not establish what they actually did. This session will not auto-co-sign at close.",
+                guidance: "Almost always their CELLO build is newer than this one: ask which version they are running, and upgrade. If they are on the SAME version as you, that explanation does not hold and the frame was malformed or crafted — do not close the session by auto-acknowledgement.",
+            });
+            return { ok: false, reason: "content_hash_alg_unknown" };
+        }
+        let computed;
+        try {
+            computed = contentHashFor(content, {
+                alg: algResolved.alg,
+                // The salt is OURS — the sender's frame never carries one, and could not be trusted if it
+                // did. A salted frame we hold no salt for throws below and is refused by name.
+                salt: this.#getSessionSalt(agentName, sessionId),
+            });
+        }
+        catch (err) {
+            // Reached when the peer named the salted algorithm and this side holds no salt for the
+            // session — the agreement never completed, or its record is gone. Distinct from a mismatch
+            // for the same reason as above: nothing was tampered with, we simply cannot check it.
+            this.#markContentUnverifiable(agentName, sessionId, "unverifiable");
+            this.#logger.error("session.content.cross_check.failed", {
+                sessionId, correlationId,
+                reason: "content_hash_salt_unavailable",
+                declaredAlg: algResolved.alg,
+                detail: extractErrorMessage(err),
+                // "Nothing was altered" was the same mistake as the branch above: it is not knowable from
+                // here. What IS knowable is that we could not check.
+                impact: "this message could not be verified — the sender says it is salted and this side holds no salt for the session — so it was NOT ingested and NOT shown. This session will not auto-co-sign at close.",
+                // Review F6: `#getSessionSalt` returns null for THREE conditions and only one of them wants
+                // a close. A read failure and a corrupt row both leave us holding no salt, which is exactly
+                // what makes the agreement re-offer a contribution and repair itself on the next connect.
+                //
+                // The adoption refusal is the FOURTH, added with the Decision #8 guard, and it is the only
+                // one that does not repair: this side declined the salt permanently for this session, so
+                // waiting for a reconnect is exactly the wrong advice. Leaving it out of this list would
+                // have sent an operator to look for a read failure that is not there and never will be.
+                guidance: "Look for session.salt.adoption.refused first: if it is there, this side declined the salt because the session had already hashed messages, that is permanent for this session, and reconnecting will NOT fix it — close the session and start a new one. Otherwise look for session.salt.read.failed or session.salt.persist.failed. If either is present the agreement re-runs on the next reconnect and this repairs itself — wait for that before doing anything. If none of the three is present, the agreement never completed with this counterparty: close the session and start a new one. In every case the transcript up to here is intact.",
+            });
+            // DOD-M15-REFUSED-INBOUND-SILENT-1 — and this branch needed it MORE than the two that had it.
+            //
+            // It was refused, logged with a full impact and guidance, not ingested, not shown — and the
+            // operator was told nothing. Twenty lines below the branches that were wired, in the same
+            // function, with the same shape.
+            //
+            // One of its four causes is permanent, and the guidance above says so in its own words: an
+            // adoption refusal means this side declined the salt for the life of the session and
+            // reconnecting will NOT fix it. So the failure this line exists to close — the conversation
+            // goes quiet, the explanation sits in a log nobody opens — was still live on the one branch
+            // that never repairs itself.
+            //
+            // The guidance is passed by reference to the log's own text rather than duplicated: a second
+            // copy is a second thing to keep true, and the log's version is the one that gets maintained.
+            this.noteContentRefusal(agentName, sessionId, "content_hash_salt_unavailable", {
+                impact: "this message could not be verified — the sender says it is salted and this side holds no salt for the session — so it was NOT ingested and NOT shown. This session will not auto-co-sign at close.",
+                guidance: "If this side refused the salt because the session had already hashed messages, that is PERMANENT for this session and reconnecting will not fix it — close the session and start a new one. Otherwise the salt agreement re-runs on the next reconnect and this repairs itself. Check session.salt.adoption.refused in the log to tell which. The transcript up to here is intact either way.",
+            });
+            return { ok: false, reason: "content_hash_salt_unavailable" };
+        }
         const contentHashHex = Buffer.from(contentHash).toString("hex");
         if (Buffer.from(computed).toString("hex") !== contentHashHex) {
             this.#logger.warn("session.content.cross_check.failed", {
                 sessionId,
                 reason: "content_hash_mismatch",
+                // WHICH algorithm the comparison ran under. Without it, a mismatch is unfalsifiable from the
+                // log: an operator cannot tell "the bytes were altered" from "we checked it the wrong way".
+                declaredAlg: algResolved.alg,
                 correlationId,
             });
             // M7-UPGRADE-002 (SI-002): a tamper makes this session's content unverifiable — the
             // auto-acknowledge gate must never auto-co-sign it. The session stays alive (DOD-MSG-7),
             // but the responder seal now requires the agent's explicit decision, not an auto-ack.
-            this.#contentDesynced.add(this.#k(agentName, sessionId));
+            this.#markContentUnverifiable(agentName, sessionId, "tampered");
+            // DOD-M15-REFUSED-INBOUND-SILENT-1. Deliberately does NOT include the content or the hashes:
+            // it failed verification, and showing it is the injection path this cross-check closes.
+            this.noteContentRefusal(agentName, sessionId, "content_hash_mismatch", {
+                impact: "a message arrived whose bytes do not match the hash the sender committed to, so it was NOT ingested and NOT shown. This session will not auto-co-sign at close.",
+                guidance: "Either the message was altered in transit or the sender's record is wrong. Ask the counterparty to resend. Do not close this session by auto-acknowledgement — seal it only by an explicit decision.",
+            });
             return { ok: false, reason: "content_hash_mismatch" };
         }
         const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
@@ -5183,12 +6435,36 @@ export class SessionNodeManager {
         // verdict means the content is NOT delivered to the agent: it is not held, not buffered, and
         // no leaf is appended — the message stays un-acked so the sender's TTF/park/retry redelivers
         // it once the gateway is reachable again (DB-001 fail-closed: hold, never expose ungated).
-        const inboundVerdict = await this.#securityGateway.screenInbound(content, {
-            direction: "inbound",
-            agentName,
-            sessionId,
-            correlationId,
-        });
+        // DOD-DOC-SCREEN-CLASSIFY-1: a DOCUMENT frame skips the gateway's content screen HERE, and is
+        // screened later on text instead of bytes. Every content step is inert or worse for one at this
+        // point — the sanitizer's rewrites are deliberately discarded by the funnel below (rewriting a
+        // signed envelope destroys it), and language/injection judge a UTF-8 decode of binary. Size stays
+        // bounded twice (MAX_DOCUMENT_FRAME_BYTES at classify, the gate's own cap).
+        //
+        // WHAT IS TRADED, stated plainly: the screen skipped here is fail-CLOSED (a gateway that is down
+        // returns a transient block, and the frame is held un-acked for redelivery). Its replacement —
+        // the gate's in-process rules, then the semantic screen at `document-inbound.ts` step 7a-bis —
+        // is fail-OPEN on that same condition, because holding document convergence hostage to an
+        // optional layer breaks a layer that degrades by design. That degradation is LOGGED BY NAME
+        // there (`document.inbound.screen.unavailable`); it is not silent, and it is not free.
+        //
+        // Logged by name so the skip is visible rather than assumed.
+        const isDocFrame = this.#isDocumentFrame?.(content) === true;
+        if (isDocFrame) {
+            this.#logger.info("session.content.screen.skipped_document_frame", {
+                sessionId,
+                agentName,
+                correlationId,
+            });
+        }
+        const inboundVerdict = isDocFrame
+            ? { disposition: "allow", content }
+            : await this.#securityGateway.screenInbound(content, {
+                direction: "inbound",
+                agentName,
+                sessionId,
+                correlationId,
+            });
         // M9 terminal-vs-transient split. A TERMINAL block (inboundVerdict.terminal) is a detector
         // rejecting the CONTENT itself — a confident non-allowlisted language (IN-003), a high-score
         // injection (IN-002), or an oversized payload (IN-001). The identical bytes would be rejected
@@ -5377,7 +6653,7 @@ export class SessionNodeManager {
         // agent (screenedOut); a delivered message buffers + leafs via #appendVerifiedContent.
         const leafIndex = terminalBlock
             ? this.appendSessionLeaf(agentName, sessionId, "msg", contentHashHex, correlationId).leafIndex
-            : this.#appendVerifiedContent(agentName, sessionId, deliverContent, contentHashHex, senderPubkey, correlationId, content).leafIndex;
+            : this.#appendVerifiedContent(agentName, sessionId, deliverContent, contentHashHex, senderPubkey, correlationId, content, verifiedAuthorship).leafIndex;
         // DOD-COATTEND-1 (review F2): the plaintext failed to reach the transcript, and since Tier 1 the
         // transcript IS the delivery path — so this message can never be handed to any session. Report
         // the ingest as failed. Reporting `ok: true` here is what let a local SQLCipher failure surface,
@@ -5580,11 +6856,20 @@ export class SessionNodeManager {
         // Review HIGH-2: NOT `(highWaterSeq + 1) - treeSize`. That subtraction silently assumes the
         // relay's sequence space and this tree's index space count the same things, and they do not:
         // `relay-node.ts` increments seq_counter for EVERY accepted leaf including CTRL (0x02), while
-        // `appendSessionLeaf` is only ever called with "msg" — `submitSealLeaf` deliberately computes
-        // its root without mutating the durable tree. So one seal ctrl leaf offsets the two spaces
-        // permanently, and any msg witnessed afterwards would read as a missing leaf FOREVER. That is a
-        // false positive, and a false positive here is worse than the bug it guards: it makes a healthy
+        // NOTHING APPENDS A CTRL LEAF TO THIS TREE — `submitSealLeaf` deliberately computes its root
+        // without mutating the durable tree. So one seal ctrl leaf offsets the two spaces permanently,
+        // and any msg witnessed afterwards would read as a missing leaf FOREVER. That is a false
+        // positive, and a false positive here is worse than the bug it guards: it makes a healthy
         // session unsealable, leaving force-abandon (no receipt) as the only exit. `seal-upgrade.ts`
+        //
+        // ⚠️ THIS SENTENCE USED TO READ *"`appendSessionLeaf` is only ever called with 'msg'"*, AND THAT
+        // WAS FALSE WHEN IT WAS WRITTEN — corrected, not deleted, per review pass 1 F8. Line ~7730
+        // appends "doc", and `WritableSessionTreeLeafKind` permits "ctrl" outright, so the type does not
+        // enforce it either. Doc leaves are harmless to this subtraction because they are witnessed by
+        // the relay too (LEAF_KIND_DOC) and counted in BOTH spaces; the load-bearing property is only
+        // ever about CTRL. Stating it as "msg only" made a narrower claim than the code supports and a
+        // stronger one than it holds — so a reader checking it would find a counter-example, conclude
+        // the reasoning was stale, and be one step from "fixing" the subtraction back.
         // already documents the same `leaf_count - 1` offset.
         //
         // `#witnessedSeq` answers the question directly instead of inferring it. It gains an entry when
@@ -5601,10 +6886,16 @@ export class SessionNodeManager {
         for (const e of this.#heldContent.get(key)?.values() ?? [])
             if (e.origin === "sent")
                 heldOwn++;
+        // DOD-M15-DIVERGE-1: the third term, and the one that closes the asymmetry. `#diverged` is set
+        // only where the parting is PROVEN — an ack came back behind our frontier — never where it is
+        // merely suspected, because a gate that refuses a healthy session forever is worse than the bug
+        // it guards: force-abandon, with no receipt, becomes the only exit.
+        const diverged = this.#diverged.has(key);
         return {
-            ready: missingLeaves === 0 && heldCount === 0,
+            ready: missingLeaves === 0 && heldCount === 0 && !diverged,
             treeSize, highWaterSeq, heldCount, missingLeaves,
             heldOwn, heldReceived: heldCount - heldOwn,
+            diverged,
         };
     }
     /**
@@ -5626,6 +6917,17 @@ export class SessionNodeManager {
     sealReadinessView(agentName, sessionId) {
         const key = this.#k(agentName, sessionId);
         const r = this.sealReadiness(agentName, sessionId);
+        // DOD-M15-DIVERGE-1: READ THIS BEFORE THE `!ready` BRANCH, and the order is load-bearing.
+        // `diverged` is now a term in `ready`, so a diverged session reaches `!ready` — where it would
+        // report `blocked` with awaitingArrival and heldBehindGap both ZERO, replacing an accurate,
+        // specific answer with one that describes nothing and invites a retry that can never work.
+        // Divergence is permanent and has its own state; the gap cases below are the ones that resolve.
+        if (r.diverged) {
+            // NOT `ready`. The tree is ahead of the relay's counter for good, so a close here signs a root
+            // the counterparty answers `leaf_count_mismatch` to — terminal, and the receipt is gone. The
+            // raw counters cannot see this: nothing is missing and nothing is held.
+            return { state: "unknown", reason: "record_diverged_from_relay" };
+        }
         if (!r.ready) {
             const oldestHeldMs = this.#oldestHeldMs(agentName, sessionId);
             return {
@@ -5638,12 +6940,6 @@ export class SessionNodeManager {
                 oldestHeldMs,
             };
         }
-        if (this.#diverged.has(key)) {
-            // NOT `ready`. The tree is ahead of the relay's counter for good, so a close here signs a root
-            // the counterparty answers `leaf_count_mismatch` to — terminal, and the receipt is gone. The
-            // raw counters cannot see this: nothing is missing and nothing is held.
-            return { state: "unknown", reason: "record_diverged_from_relay" };
-        }
         if (r.treeSize > 0 && !this.#orderingObserved.has(key)) {
             return {
                 state: "unknown",
@@ -5788,7 +7084,17 @@ export class SessionNodeManager {
      * CRDT is not a false positive, it is permanent divergence that both sides converge on and
      * neither can see.
      */
-    originalContent) {
+    originalContent, 
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 5: threaded from `ingestReceivedContent`, which is the only place
+     * that has it — `#recordFrameOrdering` verified this signature against the pubkey inside the
+     * sender's own signed bytes and matched the signer to this session's counterparty. It reaches
+     * the transcript row from here or not at all.
+     *
+     * Undefined on the held-release and soft-fallback paths; the row records that as
+     * `local_session_state` rather than leaving it indistinguishable from a proven one.
+     */
+    verifiedAuthorship) {
         // M14 / DOD-DOC-INBOUND-2 — DOCUMENT FRAMES DIVERGE HERE, and the three-way split is the whole
         // contract:
         //
@@ -5838,7 +7144,11 @@ export class SessionNodeManager {
         // DOD-LOG-1: persist the readable RECEIVED plaintext to the durable transcript, keyed by the
         // canonical leaf sequence so it joins the committed hash chain (survives restart; INV-3 — the
         // relay/directory never see this plaintext, only the hash).
-        const durable = this.recordTranscriptMessage(agentName, sessionId, leafIndex, "received", content, correlationId);
+        const durable = this.recordTranscriptMessage(agentName, sessionId, leafIndex, "received", content, correlationId, 
+        // DOD-M15-SEALWIRE-1 bullet 5: present only when the ordering record verified AND the signer
+        // matched this session's counterparty. Undefined on the soft fallback, which the row records
+        // as `local_session_state` rather than leaving indistinguishable.
+        verifiedAuthorship);
         const recvKey = this.#k(agentName, sessionId);
         if (!durable) {
             // The leaf is committed and the plaintext is not. Delivery reads the transcript, so this
@@ -6178,6 +7488,33 @@ export class SessionNodeManager {
         const nextExpected = this.getSessionTree(agentName, sessionId).size();
         if (assignedSeq === undefined) {
             const { leafIndex } = this.appendSessionLeaf(agentName, sessionId, kind, contentHashHex, correlationId);
+            /**
+             * ─── DOD-M15-UNWITNESSED-1(b): SAY IT HERE, where the code says the damage happens ────────
+             *
+             * This branch was entirely silent — no log, no flag — while the `position_behind_frontier`
+             * branch twenty lines below logs at ERROR and its own comment says the loss occurred
+             * *"at the unwitnessed append, not here."* So the system announced the consequence one send
+             * later than it announced nothing about the cause.
+             *
+             * **This does NOT gate the seal, deliberately.** The DoD bar is explicit: do not gate on
+             * suspicion, because a relay that has not witnessed a leaf YET is indistinguishable here from
+             * one that never will, and refusing on the first would make a healthy session unsealable —
+             * which is worse than the thing it guards. What was missing is not a refusal, it is the
+             * ERROR at the moment the code already believes something was lost.
+             */
+            this.#logger.error("session.tree.own_leaf_unwitnessed", {
+                sessionId,
+                leafIndex,
+                kind,
+                correlationId,
+                impact: "this message was appended to the local record with NO relay witness, so the ordering " +
+                    "authority has no copy of it. The counterparty's tree cannot gain this leaf from the " +
+                    "relay, so the two records may no longer agree — and a bilateral seal needs them to.",
+                guidance: "Usually the relay was briefly unreachable and the next send re-establishes ordering. If " +
+                    "it repeats, the relay is not carrying this session: check connectivity before closing, " +
+                    "because sealing on a record the counterparty cannot match produces a receipt only one " +
+                    "side can verify.",
+            });
             return { placed: true, leafIndex };
         }
         if (assignedSeq === nextExpected) {
@@ -6202,7 +7539,7 @@ export class SessionNodeManager {
                 agentName, sessionId, assignedSeq, nextExpected, contentHash: contentHashHex, correlationId,
                 impact: "this side's tree is ahead of the relay's counter, so the two can no longer agree on a root — the message is kept in the local record and this session can no longer be sealed bilaterally",
             });
-            this.#diverged.add(this.#k(agentName, sessionId));
+            this.markSessionDiverged(agentName, sessionId);
             const { leafIndex } = this.appendSessionLeaf(agentName, sessionId, kind, contentHashHex, correlationId);
             return { placed: true, leafIndex, diverged: true };
         }
@@ -6569,7 +7906,15 @@ export class SessionNodeManager {
      * `unref`'d so an in-flight wait never keeps the daemon process (or a test runner)
      * alive on its own.
      */
-    #trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, structure1Cbor, structure2Cbor) {
+    /**
+     * `contentHashAlg` is `string | undefined`, NOT optional — B2b-1 pass-2 F1.
+     *
+     * The previous fix applied this shape to `#parkContent` and left its SIBLING on the same code path
+     * optional, so dropping the argument here compiled clean and no test could see it — the TTF park
+     * route reads this map, and a v2 envelope omits the field entirely whenever the value is `sha256`,
+     * which is every value in play today. That re-opened the exact finding the fix closed.
+     */
+    #trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, structure1Cbor, structure2Cbor, contentHashAlg) {
         const hashHex = Buffer.from(contentHash).toString("hex");
         const ackKey = this.#k(agentName, sessionId);
         let bySession = this.#awaitingAck.get(ackKey);
@@ -6588,7 +7933,10 @@ export class SessionNodeManager {
             timer.unref();
         // DOD-MSG-4 (2b, review #1): retain the relay's ordering record so a TTF-triggered park carries
         // it too (not only the direct-dial-fail park) — so a TTF-parked entry is self-ordering on recover.
-        bySession.set(hashHex, { timer, content, correlationId, structure1Cbor, structure2Cbor });
+        // B2b-1 review F2: the algorithm rides WITH the entry. The TTF-expiry park route reads this map
+        // minutes later, in-process, and without it that copy names nothing (= sha256) while the direct
+        // frame named something else — the same message, two claims about what it is, no restart needed.
+        bySession.set(hashHex, { timer, content, correlationId, structure1Cbor, structure2Cbor, contentHashAlg });
     }
     /**
      * Resolve an awaiting-ACK entry on a `persisted` delivery ACK (AC-001/AC-002): cancel
@@ -6644,7 +7992,7 @@ export class SessionNodeManager {
             // M12-P12 (review pass 2): the ordering record travels on THIS path too. It is in hand — the
             // very next statement hands it to #parkContent — and a TTF row written without it re-parks in
             // arrival order, which is the divergent-leaf-index failure the durable columns exist to stop.
-            this.#onAwaitingTtf?.(agentName, sessionId, hashHex, entry.content, entry.structure1Cbor, entry.structure2Cbor);
+            this.#onAwaitingTtf?.(agentName, sessionId, hashHex, entry.content, entry.structure1Cbor, entry.structure2Cbor, entry.contentHashAlg);
         }
         catch (err) {
             this.#logger.error("content.park.backstop.failed", {
@@ -6658,7 +8006,8 @@ export class SessionNodeManager {
         // Fire-and-forget: unlike sendContent's live caller, nothing here is awaiting an IPC response
         // to shape (the TTF timer fires long after cello_send already returned) — the deposit's own
         // success/failure logging inside #parkContent is the only observability this path needs.
-        void this.#parkContent(agentName, sessionId, hashHex, entry.content, entry.structure1Cbor, entry.structure2Cbor);
+        // B2b-1 review F2 — the THIRD `#parkContent` caller, and the one that was left unthreaded.
+        void this.#parkContent(agentName, sessionId, hashHex, entry.content, entry.structure1Cbor, entry.structure2Cbor, entry.contentHashAlg);
     }
     /**
      * Send an unsigned `persisted` delivery ACK back to the sender over the same
@@ -6915,7 +8264,88 @@ export class SessionNodeManager {
             contentHash: contentHashHex,
             correlationId,
         });
-        return await this.ingestReceivedContent(agentName, sessionId, env.content, contentHash, correlationId, recoveredSeq ?? undefined);
+        /**
+         * DOD-M15-SEALWIRE-1 part B1 — RECOVERED-FROM-PARK CONTENT CARRIES NO ALGORITHM NAME, and that
+         * is correct today rather than an oversight.
+         *
+         * The park envelope has no field for one, so this passes `undefined`, which resolves to
+         * `sha256`. In part B1 that is exactly right and provably so: **no sender salts yet**, so every
+         * parked entry in existence was hashed unsalted.
+         *
+         * ✅ FIXED IN PART B2a, at BOTH sites: here, and the independent verifier in `content-park.ts`.
+         * The envelope carries the algorithm from v3 onward, and a v2 envelope's absent field resolves to
+         * `sha256` — which is what a peer predating the field actually used. Every envelope this build
+         * emits is still v2, because nothing salts yet.
+         *
+         * ─── AND THE REFUSAL DOES NOT HOLD — review F2 ────────────────────────────────────────────
+         *
+         * A direct-path refusal sends no delivery ACK, so the sender's TTF backstop parks the message
+         * and it arrives here seconds later, where `undefined` means `sha256` and it may well succeed.
+         * A frame refused BY NAME on one path is then accepted on the other, with nothing tying the two
+         * together in the log — an operator sees an ERROR and, ten seconds on, a healthy delivery.
+         *
+         * That is not repaired by refusing here as well: today's park entry genuinely IS `sha256`, and
+         * refusing it would drop good mail. What is wrong is the SILENCE, so the reconciliation is
+         * logged instead — the two events become one story, and B2 removes the ambiguity for real by
+         * putting the name in the envelope.
+         */
+        /**
+         * ⚠️ LOGGED AFTER THE INGEST, NOT BEFORE IT — review B2a F1, and the previous version of this
+         * block ANNOUNCED A DELIVERY THAT DOES NOT HAPPEN.
+         *
+         * It fired on a memo hit and said *"the message is being delivered by the other route"*, which
+         * was true-by-construction only while the park path passed `undefined` for the algorithm. Part
+         * B2a made the park path carry `env.contentHashAlg` — so a peer that names an unreadable
+         * algorithm on the direct path AND parks the same content as v3 with the same name is refused
+         * AGAIN here, re-arms the memo, is never confirm-deleted, and repeats on every drain. An
+         * unbounded stream of warnings asserting a delivery that never occurs, drowning the real
+         * reconciliation when the sender eventually re-parks as v2.
+         *
+         * The claim is only sound once the ingest has actually succeeded, so it is made there.
+         */
+        const memoKey = this.#k(agentName, sessionId);
+        const priorDeclaredAlg = this.#unreadableAlgSeen.get(memoKey)?.get(contentHashHex);
+        const result = await this.ingestReceivedContent(agentName, sessionId, env.content, contentHash, correlationId, recoveredSeq ?? undefined, 
+        // The envelope's own claim, verbatim — `undefined` on a v2 envelope, which resolves to
+        // `sha256` and is exactly right for a peer that predates the field.
+        env.contentHashAlg);
+        /**
+         * `ok` IS NOT "DELIVERED" — review B2a pass-2 F1, and this is the same class the F1 fix was
+         * raised for, one predicate over.
+         *
+         * `ingestReceivedContent` returns `ok` in three shapes and only one is a delivery:
+         *   `{ok, held: true}`       — buffered behind an ordering gap; not appended, not shown YET.
+         *   `{ok, screenedOut: true}` — leafed and PERMANENTLY never shown to the agent.
+         * Announcing *"the message was delivered by the other route"* for either is a false all-clear on
+         * the operator's one line about this message, and the memo is deleted in the same breath, so
+         * nothing ever re-raises it.
+         *
+         * Leaving the memo ARMED on `held` is deliberate: the release path re-enters ingest, which is
+         * when delivery actually happens, and the claim becomes true there.
+         *
+         * ⚠️ THE `screenedOut` CLAUSE IS UNREACHABLE TODAY and is kept anyway — said out loud so nobody
+         * reads it as covered. A terminal inbound block needs a detector the shipping security gateway
+         * does not wire, so it returns only `allow` and a fail-closed non-terminal `block`. Measured: a
+         * mutant dropping just that clause SURVIVES the suite. It stays because the day a detector is
+         * wired, this line is the difference between an all-clear and a permanent silent discard — and
+         * finding that then costs more than the clause costs now.
+         */
+        if (priorDeclaredAlg !== undefined && result.ok && result.held !== true && result.screenedOut !== true) {
+            // Cleared ONLY on a real reconciliation. Clearing on the lookup (as this did) forgets the
+            // refusal even when the recovery fails, so the next genuine reconciliation says nothing.
+            const byHash = this.#unreadableAlgSeen.get(memoKey);
+            byHash?.delete(contentHashHex);
+            if (byHash && byHash.size === 0)
+                this.#unreadableAlgSeen.delete(memoKey);
+            this.#logger.warn("content.recover.alg_refusal_reconciled", {
+                agentName, sessionId, correlationId,
+                contentHash: contentHashHex,
+                priorDeclaredAlg,
+                recoveredAlg: env.contentHashAlg ?? "(absent → sha256)",
+                impact: "THIS EXACT MESSAGE was refused on the direct path because it named an algorithm this build cannot read, and the same content has now been accepted via the relay park under an algorithm this build CAN read. The refusal did not hold: the message was delivered by the other route.",
+            });
+        }
+        return result;
     }
     /**
      * Review M4: bounded memo of parked entries we have already refused, so a mailbox stuffed with
@@ -6937,101 +8367,1349 @@ export class SessionNodeManager {
      * record (the recover handler lives in daemon.ts, which has no access to the private method).
      */
     recordOrderingRecord(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId) {
-        return this.#recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, "park");
-    }
-    #recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, source = "content_frame") {
+        // DOD-M15-FRAME-1: the POSITION only, deliberately — this path does not act on `fatal`, and the
+        // reason is that its identity proof is somewhere else and is already fail-closed. Parked content
+        // arrives inside a sealed envelope carrying the sender's signature over
+        // (session_id, recipient_pubkey, content_hash), and recovery already refuses a missing, bad, or
+        // wrong-signer envelope. Adding a second, weaker refusal here on the ordering record would gate
+        // mail retrieval on a record the relay-degraded path is allowed to omit, which is the
+        // false-positive shape this unit is careful to avoid. The live direct path is where the ordering
+        // record IS the proof, and that is where `fatal` is consumed.
+        return this.#recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, "park").seq;
+    }
+    /**
+     * DOD-M15-FRAME-1 — NARROWING THE GATE DOES NOT EVICT ANYONE ALREADY INSIDE. This does.
+     *
+     * libp2p consults the gater only when a connection is ESTABLISHED, so narrowing it never evicts a
+     * peer already attached. That is why this sweep exists and why it cannot be replaced by the gate.
+     *
+     * A peer that attached early can therefore hold its connection open, still be attached when the
+     * receiver is promoted, and be sitting there when the content protocol activates. DOD-M15-ASSIGN-1
+     * shrank who can get that foothold — an unclaimed standing receiver now admits nobody inbound,
+     * where it used to admit everyone — but it did not, and could not, change the constraint above.
+     *
+     * That is the foothold the whole injection path depends on — placed before the door narrows. The
+     * frame-level gate above refuses what they send; this closes the connection they send it on, so
+     * the stranger is not merely ineffective but gone, and is not sitting there for the next protocol
+     * to activate.
+     *
+     * BEST-EFFORT BY CONSTRUCTION, and it must stay that way. A failure to hang up one peer must not
+     * fail the session setup that is mid-flight — the frame gate is the load-bearing control and it
+     * does not depend on this succeeding. Relay peers are exempt: they are on the OUTBOUND allowlist
+     * because reservation refreshes ride them, and hanging one up would cost the agent its inbound
+     * reachability to remove a peer that cannot speak the content protocol anyway.
+     */
+    async #evictPeersOutsideGate(node, gater, sessionId, allowedPeerId, trigger) {
+        let connections;
         try {
-            const s1 = decode(structure1Cbor);
-            const s2 = decode(structure2Cbor);
-            const s1Hash = s1?.[1];
-            const s1Pubkey = s1?.[2];
-            const seq = typeof s2?.[0] === "number" ? s2[0] : -1;
-            const s2Sig = s2?.[3];
-            if (!(s1Hash instanceof Uint8Array) || !(s1Pubkey instanceof Uint8Array) || !(s2Sig instanceof Uint8Array) || seq < 1) {
-                this.#logger.warn("session.content.ordering.malformed", { sessionId, correlationId });
-                return null;
-            }
-            // The framed ordering record must bind to THIS content (its hash) — else it orders the wrong bytes.
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
-            if (Buffer.from(s1Hash).toString("hex") !== contentHashHex) {
-                this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
-                return null;
-            }
-            // Verify the SENDER's Ed25519 signature over the exact signed bytes (structure1_cbor) — the same
-            // check the relay performs. Proves the counterparty committed to this (content_hash @ sequence).
-            if (!verify(s1Pubkey, structure1Cbor, s2Sig)) {
-                this.#logger.warn("session.content.ordering.bad_signature", { sessionId, correlationId });
-                return null;
-            }
-            // Sovereign-node cross-check: the signer MUST be THIS session's counterparty, not an unrelated
-            // key. FAIL CLOSED (review L) — if the counterparty pubkey is unknown we cannot prove the signer,
-            // so we do NOT trust the framed ordering record (fall back to the witness stream / arrival). The
-            // "B does not trust the counterparty for ordering" invariant is non-negotiable; never fail open.
-            // Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from the
-            // IPC param and is never case-normalized, so a string compare would fail for a mixed-case
-            // pubkey and silently strip the canonical ordering from every message in that session.
-            const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
-            if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
-                this.#logger.warn("session.content.ordering.wrong_signer", {
-                    sessionId,
-                    reason: counterparty ? "signer_not_counterparty" : "counterparty_unknown",
-                    correlationId,
-                });
-                return null;
-            }
-            // Verified — record the relay-assigned canonical sequence (1-based → 0-based leaf index) for the gate.
-            this.recordWitnessedSequence(agentName, sessionId, contentHashHex, seq - 1);
-            this.#logger.info("session.content.ordering.recorded", {
-                sessionId,
-                canonicalSeq: seq - 1,
-                source,
-                correlationId,
-            });
-            return seq - 1;
+            connections = node.getConnections();
         }
         catch (err) {
-            this.#logger.warn("session.content.ordering.decode_failed", {
-                sessionId,
-                error: err instanceof Error ? err.message : String(err),
-                correlationId,
+            this.#logger.debug("session.gate.evict.unavailable", {
+                sessionId, trigger, error: extractErrorMessage(err),
             });
+            return;
         }
-        // No verified position — the caller falls back to the announced hash-dedup path.
-        return null;
+        const toEvict = connections
+            .map((c) => c.peerId)
+            .filter((peerId) => peerId !== allowedPeerId && !gater.isAllowedOutboundPeer(peerId));
+        /**
+         * CONCURRENT AND CAPPED, because the count is ATTACKER-CONTROLLED (review F4).
+         *
+         * This runs inside `acceptSession`, before the session row is written, and the standing receiver
+         * used to accept everyone (closed by DOD-M15-ASSIGN-1) — so opening N connections to an agent's advertised receiver used
+         * to make every later session setup on that agent wait for N sequential graceful closes.
+         * `hangUp` is libp2p's graceful close and takes no timeout, so the wait was unbounded in both
+         * directions. Evicting an injection foothold must not itself become the way to stall an agent.
+         *
+         * The cap is a LOGGED truncation, never a silent one: what is left behind still cannot inject
+         * (the frame gate refuses it and now hangs it up on first contact), and the next promotion
+         * sweeps again — but an operator reading this needs to know the sweep did not finish.
+         */
+        const EVICT_CAP = 32;
+        const batch = toEvict.slice(0, EVICT_CAP);
+        if (toEvict.length > batch.length) {
+            this.#logger.warn("session.gate.evict.capped", {
+                sessionId, trigger, attached: toEvict.length, evicting: batch.length,
+                impact: "more peers were attached outside the gate than one promotion evicts; the rest keep their connections until a later sweep, and are refused and hung up by the frame gate if they speak",
+            });
+        }
+        await Promise.allSettled(batch.map(async (peerId) => {
+            try {
+                await node.hangUp(peerId);
+                this.#logger.warn("session.gate.evicted", {
+                    sessionId, trigger, evictedPeerId: peerId, allowedPeerId,
+                    impact: "a peer attached to this node before the session narrowed its gate was disconnected; libp2p does not re-run the gater against live connections, so it would otherwise have stayed attached when the content protocol activated",
+                });
+            }
+            catch (err) {
+                // Best-effort: the frame gate still refuses anything this peer sends, and now hangs it up.
+                this.#logger.debug("session.gate.evict.failed", {
+                    sessionId, trigger, peerId, error: extractErrorMessage(err),
+                });
+            }
+        }));
     }
-    async #handleContentStream(agentName, sessionId, stream, remotePeerId) {
-        // CLOSING THIS STREAM IS WHAT KEEPS THE SESSION ALIVE PAST ITS 33RD MESSAGE.
-        //
-        // Every content frame and every delivery ACK opens a fresh /cello/content/1.0.0 stream on the
-        // one muxed connection the session holds, and libp2p caps INBOUND streams per protocol per
-        // connection. It enforces that cap AFTER multistream-select has answered, so an over-cap stream
-        // negotiates fine and is reset an instant later, and the SENDER's next `stream.send(...)`
-        // throws "Cannot write to a stream that is closed" — an error that names the exit point and not
-        // one thing about the cause.
-        //
-        // A stream leaves the muxer's set only on its `close` event, and closing our write end triggers
-        // that only once the peer has closed its end too. So a handler that reads its frame and returns
-        // leaves the stream half-open for the life of the connection and the count only ever rises.
-        // Measured on a live daemon: 115 failures over 3.5 hours, with EXACTLY 32 successful streams
-        // before the first one on both affected sessions (M12B Entry 10).
-        //
-        // The decoder is built INSIDE the try so a malformed stream cannot throw past the close below.
-        let iter;
-        try {
-            iter = lp.decode(stream)[Symbol.asyncIterator]();
-            const result = await iter.next();
-            if (result.done || result.value === undefined)
-                return;
-            const bytes = result.value instanceof Uint8Array ? result.value
-                : Buffer.isBuffer(result.value) ? new Uint8Array(result.value)
-                    : result.value.slice();
-            const frame = decode(bytes);
-            const correlationId = typeof frame["correlation_id"] === "string" ? frame["correlation_id"] : undefined;
-            // CELLO-M7-MSG-001 (AC-001/AC-002): a `persisted` delivery ACK arriving on the
-            // same /cello/content/1.0.0 protocol resolves the sender's awaiting-ACK timer.
-            // The protocol acts on `persisted` ONLY — any other level leaves the timer armed.
-            if (frame["type"] === "content_delivery_ack") {
-                const ackHash = frame["content_hash"];
+    /**
+     * DOD-M15-FRAME-1 — a proven identity failure ends the session, and says so as an OBSERVATION.
+     *
+     * SESSION-ENDING, NOT PER-MESSAGE. One frame that fails to verify against the expected
+     * counterparty is not a bad message to drop while hoping the next is better — it is evidence
+     * about the CONNECTION. Dropping the frame and continuing leaves the same peer able to try again
+     * with a frame that omits the proof entirely.
+     *
+     * THE WORDING IS NOT A VERDICT, and that is deliberate rather than squeamish. The identical
+     * signal comes from a real impersonation attempt and from our own infrastructure mishandling a
+     * fallback — a relay bug, a bad deploy, an uncovered edge in the direct-connection failover. The
+     * daemon cannot tell those apart from this signal, so it must not pretend to. This mirrors the
+     * account-recovery pattern already in the codebase, which anchors a compromise window to logged
+     * events and accepts that some evidence cannot separate misconduct from an innocent cause.
+     *
+     * IT MUST NEVER FEED A TRUST SIGNAL. An automatic reputation consequence driven by a signal this
+     * ambiguous would let a hostile peer — or a bad deploy of ours — manufacture a mark against an
+     * innocent counterparty. Recorded here because the absence of that wiring is a decision, not an
+     * omission, and the next person to reach for it should find this comment first.
+     *
+     * The accusatory half stays local for the same reason. Freezing what THIS daemon trusts is always
+     * safe unilaterally; asserting on the record that a counterparty misbehaved needs corroboration
+     * from a party the accusing client does not control, which is `DOD-M15-CORROBORATE-1` (the relay
+     * holds the sender's signed hash independently and never routes it through the receiver).
+     */
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 6 (part A) — THE SALT AGREEMENT, the I/O half.
+     *
+     * The decisions live in `session-salt-agreement.ts` as a pure function; everything here is the
+     * three things that function cannot do: read and write the durable row, put a frame on the wire,
+     * and stop a session.
+     *
+     * ─── Where a contribution may travel, and it is the one rule that cannot be fixed later ───────
+     *
+     * `/cello/content/1.0.0` ONLY. It rides circuit-relay-v2 carrying its own Noise session, so a
+     * relay forwarding it sees ciphertext. It must never be added to `session_offer` /
+     * `session_offer_accept` or anything a DIRECTORY brokers — and that is the trap, because the only
+     * round trip at session open today runs on the directory's signaling stream, which makes it the
+     * obvious place to put one. A session that shipped it there could not be repaired: the relay
+     * would already hold the salt and every hash it protects.
+     */
+    #saltContributionFor(agentName, sessionId) {
+        const key = this.#k(agentName, sessionId);
+        let contribution = this.#saltContributions.get(key);
+        if (!contribution) {
+            contribution = generateSaltContribution();
+            this.#saltContributions.set(key, contribution);
+        }
+        return contribution;
+    }
+    /**
+     * Our half for a session, **without minting one** — review F1, and the distinction is the whole
+     * safety of the repair.
+     *
+     * A session that already holds a salt must never mint a fresh half. If it did, the repair would
+     * offer the peer a half the stored salt was NOT derived from, they would compute a different salt,
+     * and both sides would believe they had agreed — silently, which is the one outcome worse than
+     * refusing. So `null` from here means exactly "we hold a salt and the half behind it is gone",
+     * and that is the only state the agreement is allowed to call unrepairable.
+     */
+    #ownSaltHalf(agentName, sessionId) {
+        return this.#saltContributions.get(this.#k(agentName, sessionId)) ?? null;
+    }
+    /**
+     * Test seam: force this session's own salt half, so the LOCAL-defect path is reachable.
+     *
+     * `generateSaltContribution` cannot produce a degenerate half, which is the point of it — so the
+     * only way to exercise "our own random source is broken" end-to-end is to stand in for the broken
+     * source. Named `…ForTest` like every other seam in this file, and it writes the same map
+     * production writes rather than a parallel one, so a test cannot pass against state the daemon
+     * never reads.
+     */
+    /**
+     * Test seam: run the auto-acknowledge gate, exactly as the counterparty's SEAL ctrl leaf does.
+     *
+     * `DOD-M15-SEALWIRE-1` part B1, review F-B. The gate has ONE production call site — inside the
+     * relay leaf handler, behind `leaf_kind === CTRL && !authored_by_us` — so reaching it from a test
+     * needs a live relay client delivering a real ctrl leaf. The consequence was measured: my
+     * "tampered never downgrades" test wrapped its decisive assertion in
+     * `if (skipped.length > 0)`, which was ALWAYS FALSE, so the whole `content_tamper` vs
+     * `content_verification_unavailable` branch had no coverage anywhere in the repo and two mutants
+     * on it survived the full gate.
+     *
+     * It calls the REAL private method rather than reproducing its logic, so a test cannot pass
+     * against a decision production does not make.
+     */
+    runAutoAcknowledgeGateForTest(agentName, sessionId, correlationId = "test") {
+        this.#maybeAutoAcknowledgeSeal(agentName, sessionId, correlationId);
+    }
+    setSaltContributionForTest(agentName, sessionId, contribution) {
+        this.#saltContributions.set(this.#k(agentName, sessionId), contribution);
+    }
+    /**
+     * Test seam: drop this session's own half while leaving the stored salt in place — the state every
+     * teardown produces, because `#evictSessionCaches` clears the map and the row survives.
+     *
+     * It clears the SAME map the eviction clears rather than a stand-in, so a test cannot pass against
+     * a state the daemon never reaches. Reproducing it through a real teardown/revive would also drag
+     * in node rebuild and relay reconnection, none of which this is about.
+     */
+    forgetSaltContributionForTest(agentName, sessionId) {
+        this.#saltContributions.delete(this.#k(agentName, sessionId));
+    }
+    /**
+     * The pair the agreement reasons over: our salt, and the half that goes with it.
+     *
+     * Minting is deliberate and conditional. With NO salt we are certain to need a half — to offer, or
+     * to derive with — so minting here is what makes the exchange work at all. WITH a salt we must
+     * never mint; see `#ownSaltHalf`.
+     */
+    #saltState(agentName, sessionId) {
+        const ownSalt = this.#getSessionSalt(agentName, sessionId);
+        return {
+            ownSalt,
+            ownContribution: ownSalt
+                ? this.#ownSaltHalf(agentName, sessionId)
+                : this.#saltContributionFor(agentName, sessionId),
+        };
+    }
+    /**
+     * THE ONE PLACE THAT DECIDES HOW A SESSION'S OUTBOUND CONTENT IS HASHED —
+     * `DOD-M15-SEALWIRE-1` part B2b.
+     *
+     * Returns the hash AND the algorithm that produced it, together, because the two must not be
+     * decided separately. `wire-content-hash.ts` exists for exactly this reason and says so in its own
+     * header: the expression was written out at five call sites, the two added last got it wrong, and
+     * the failure was invisible — *"the send succeeds, `parked: false`, the sender's log says the frame
+     * left, and the receiver discards it at the authenticity check."* It took two real daemons.
+     *
+     * There are FOUR outbound sites (`session-content-handlers.ts`, two in `daemon.ts`,
+     * `document-delivery-transport.ts`). Once salting is switchable, each of them independently
+     * deciding whether to salt is that defect again with a worse failure mode — a message hashed one
+     * way and LABELLED another is refused by every peer, including a correct one.
+     *
+     * ⚠️ ASYNC, AND THAT IS THE POINT — B2b-2 constraint 2, not an implementation detail.
+     *
+     * The agreement is in flight while the operator composes their first message. Hash without waiting
+     * and it comes out unsalted, and that first unsalted hash closes adoption for the LIFE of the
+     * session (Decision #8, unit 1). Every session would fall back permanently while every log line
+     * about it stayed true — the feature present, wired, tested, and never once reached.
+     *
+     * The wait lives HERE rather than at the four call sites for the same reason `contentHashAlg` is a
+     * required parameter rather than a defaulted one: a site that forgets it must fail to compile. A
+     * caller that drops the `await` gets a `Promise` where bytes belong, which is a typecheck error;
+     * a caller that forgot to call a separate `awaitSaltSettled()` would silently send unsalted.
+     */
+    async contentHashForSession(agentName, sessionId, content) {
+        const { salt, reason } = await this.#saltForHashing(agentName, sessionId);
+        if (salt !== null) {
+            const alg = CONTENT_HASH_ALGS.HMAC_SALT_V1;
+            return { hash: contentHashFor(content, { alg, salt }), alg };
+        }
+        /**
+         * ⚠️ MARKED BEFORE THE HASH IS RETURNED, and this closes a window the row cannot see.
+         *
+         * `#saltAdoptionClosed` counts leaves, held content and in-flight sends. For the FIRST message of
+         * a session none of the three exists at this moment — the leaf lands after `sendContent` returns,
+         * which is a network round trip later. A peer contribution arriving in that gap would be adopted,
+         * and the message already on the wire would become the single unsalted leaf in an otherwise
+         * salted transcript: the exact split Decision #8 forbids, reached by the one route every count
+         * reads as empty.
+         *
+         * In memory rather than in a column, and that is sufficient rather than convenient: if this
+         * process survives, the flag holds; if it does not, the message it protects either reached a
+         * durable form (leaf, held row, queued row — all of which the counts see) or never left, in which
+         * case there is nothing to split. The one remaining case — hashed, sent, and no local record —
+         * is covered from the other side, because the peer DID leaf it and closes its own adoption, and
+         * the wire state added in unit 1 tells us so.
+         */
+        /**
+         * ⚠️ NOT FOR A TORN-DOWN SESSION — review Finding 5. `#evictSessionCaches` settles the wait and
+         * clears both of these sets; a `.add()` afterwards re-populates a map whose eviction has already
+         * run, and the entries then outlive the session they describe. There is also nothing to protect:
+         * a session that no longer exists cannot adopt a salt or split a transcript.
+         */
+        if (reason !== UNSALTED_REASONS.SESSION_TORN_DOWN) {
+            /**
+             * ⚠️ A COUNT, NOT A BIT — review pass 2, F1 (HIGH). It was a `Set`, and that made it ONE FLAG
+             * PER SESSION for a fact that is per MESSAGE.
+             *
+             * The `sibling_send_in_flight` refusal path exists precisely when another connection is
+             * mid-send with an unsalted hash it computed itself — and `sendContent` awaits a full relay
+             * round trip before `#trackAwaitingAck` records anything. So: connection A hashes and sets the
+             * flag; A enters that round trip, visible in no count; connection B hashes, sees A's claim,
+             * refuses, and calls `abandonUnsaltedHash` — **deleting the flag A is still relying on.** The
+             * frontier then reads entirely empty, a salt frame arriving in that window is adopted, and A's
+             * message lands as leaf 0 hashed sha256 in a session that hashes everything after it under
+             * HMAC.
+             *
+             * That is the split transcript this unit exists to prevent, through a window a relay round
+             * trip wide. A count makes each in-flight hash hold its own claim.
+             */
+            const key = this.#k(agentName, sessionId);
+            this.#hashedWithoutSalt.set(key, (this.#hashedWithoutSalt.get(key) ?? 0) + 1);
+        }
+        /**
+         * NO `??` DEFAULT — review pass 2, F6. It read `reason ?? ADOPTION_CLOSED_LOCALLY`, which is the
+         * shape the closed set was built to eliminate: a seventh return path forgetting its reason would
+         * have been silently labelled *"you already hashed"* and inherited guidance about a frontier that
+         * never moved. `#saltForHashing` returns a discriminated union now, so a null salt without a
+         * reason does not compile.
+         */
+        this.#announceUnsaltedOnce(agentName, sessionId, reason);
+        const alg = CONTENT_HASH_ALGS.SHA256;
+        return { hash: contentHashFor(content, { alg, salt: null }), alg };
+    }
+    /**
+     * The salt to hash this session's next message under, waiting for a pending agreement if one is
+     * genuinely in flight — B2b-2 constraints 2 and 5.
+     *
+     * Three exits, and the order matters:
+     *
+     *   1. We already hold one. No wait, ever.
+     *   2. Adoption is closed — this session has hashed or leafed something already, so a salt could
+     *      never be adopted now even if one arrived. Waiting would be waiting for a value we would
+     *      then have to refuse.
+     *   3. Nothing is pending. **This is the park-only case (constraint 5)**: the announcement hangs
+     *      off `onPeerConnect`, an offline counterparty never connects, so no agreement was ever
+     *      started. Waiting the full bound there pauses every message to an offline peer and falls
+     *      back anyway — a stall bought for nothing.
+     *
+     * Only a session with an agreement actually in flight waits, and only until it settles or the
+     * bound expires.
+     */
+    async #saltForHashing(agentName, sessionId) {
+        const held = this.#getSessionSalt(agentName, sessionId);
+        if (held !== null)
+            return { salt: held };
+        const key = this.#k(agentName, sessionId);
+        if (this.#saltAdoptionClosed(agentName, sessionId).closed) {
+            return { salt: null, reason: UNSALTED_REASONS.ADOPTION_CLOSED_LOCALLY };
+        }
+        const pending = this.#saltPending.get(key);
+        if (pending === undefined) {
+            // An agreement that already ENDED is not an agreement that never started. Only the second is
+            // "your counterparty was not connected", and only an absent entry means it.
+            const last = this.#saltLastOutcome.get(key);
+            if (last !== undefined)
+                return { salt: null, reason: this.#reasonForOutcome(last) };
+            return { salt: null, reason: UNSALTED_REASONS.NO_AGREEMENT_STARTED };
+        }
+        const settled = await pending.settled;
+        if (settled === "agreed") {
+            const agreed = this.#getSessionSalt(agentName, sessionId);
+            /**
+             * A settled-`agreed` that reads back NULL is a READ failure, not a persist failure — pass 2,
+             * F4. `persist_failed` has its own outcome now, so the only way to arrive here empty is
+             * `#getSessionSalt` returning null after the salt was stored: a throwing read, or a
+             * wrong-width row, with the cache evicted in the microtask between settle and resume. Rare —
+             * and labelling it `our_persist_failed` sent the operator to look for a
+             * `session.salt.persist.failed` line that will not be there.
+             */
+            return agreed !== null
+                ? { salt: agreed }
+                : { salt: null, reason: UNSALTED_REASONS.OUR_READ_FAILED };
+        }
+        if (settled === "announce_failed") {
+            return { salt: null, reason: UNSALTED_REASONS.ANNOUNCE_FAILED };
+        }
+        if (settled === "persist_failed") {
+            // Named separately from the timeout on purpose: the peer answered in time and OUR write
+            // failed, so nothing about their build is involved and sending the operator there wastes them.
+            return { salt: null, reason: UNSALTED_REASONS.OUR_PERSIST_FAILED };
+        }
+        if (settled === "closed") {
+            /**
+             * Two very different things reach `closed`, and only one of them is about the counterparty.
+             *
+             * `#handleSaltFrame`'s terminal branch — the peer told us it cannot adopt — is a settled
+             * bilateral outcome and the session is fine. `#evictSessionCaches` — this session is being
+             * torn down underneath us — is not: there is no session left to be unsalted, and a caller that
+             * marks `#hashedWithoutSalt` for it re-populates a map whose eviction has already run
+             * (review Finding 5). `#saltPending` is gone by the time we look, so the live node is what
+             * distinguishes them.
+             */
+            return {
+                salt: null,
+                reason: this.#activeNodes.has(key)
+                    ? UNSALTED_REASONS.PEER_CLOSED_ADOPTION
+                    : UNSALTED_REASONS.SESSION_TORN_DOWN,
+            };
+        }
+        if (settled === "timeout") {
+            /**
+             * A DECISION, NOT A RETRY. Logged once, here, because this is the moment the session became
+             * permanently unsalted — and an operator reading a later `session.content.unsalted` needs to
+             * be able to find out WHY this session has no salt when their others do.
+             */
+            this.#logger.warn("session.salt.agreement.timeout", {
+                agentName, sessionId, waitedMs: pending.boundMs,
+                impact: "the counterparty did not answer the salt agreement in time, so this session is unsalted FOR ITS LIFE — the message is being sent now rather than held any longer. Nothing is lost and nothing is degraded relative to any shipped release.",
+                // Review F4: `session.salt.persist.failed` reaches this same timeout by a completely
+                // different route — the peer answered promptly and OUR OWN write failed, so we returned
+                // before announcing and nothing came back. Omitting it sent that operator to ask their
+                // counterparty about a version mismatch that was never involved.
+                guidance: "Most often the counterparty is on a build that predates the salt agreement, in which case this is expected and permanent for this session — a newer one will agree normally. If you know they are on the same version, look for session.salt.persist.failed on THIS side first (our own write failing produces this same timeout), then session.salt.announce.failed on either side.",
+            });
+            return { salt: null, reason: UNSALTED_REASONS.AGREEMENT_TIMED_OUT };
+        }
+        return { salt: null, reason: UNSALTED_REASONS.AGREEMENT_TIMED_OUT };
+    }
+    /**
+     * Decision #15's fallback announcement — ONCE per session, never per message.
+     *
+     * A warning that fires on every message of every unsalted session is not a signal, it is a reason
+     * to build a filter; and the operator who filters it also filters the one session where it meant
+     * something. Stated once, with what the session actually loses.
+     */
+    #announceUnsaltedOnce(agentName, sessionId, reason) {
+        const key = this.#k(agentName, sessionId);
+        if (this.#unsaltedAnnounced.has(key))
+            return;
+        this.#unsaltedAnnounced.add(key);
+        this.#logger.info("session.content.unsalted", {
+            agentName, sessionId,
+            // The REASON is the field that makes this line diagnosable, and it was the missing one. The
+            // impact is the same for all six; what to do about it is not.
+            reason,
+            impact: "this session hashes its messages the way every build before this feature did. Nothing is degraded relative to any shipped release and no message is affected — it only means a relay holding the hashes could confirm a guess at a short message in THIS conversation, which a salt would have prevented.",
+            guidance: UNSALTED_GUIDANCE[reason],
+        });
+    }
+    /**
+     * Register that a salt agreement is IN FLIGHT for this session, so the first send waits for it.
+     *
+     * Called where we announce our own state — not at session creation. That distinction is
+     * constraint 5: an agreement exists to be waited for only once a frame has actually gone out.
+     */
+    #markSaltPending(agentName, sessionId, boundMs = SALT_AGREEMENT_WAIT_MS) {
+        const key = this.#k(agentName, sessionId);
+        if (this.#saltPending.has(key))
+            return;
+        let resolve = () => { };
+        const settled = new Promise((r) => { resolve = r; });
+        const timer = setTimeout(() => this.#settleSaltPending(agentName, sessionId, "timeout"), boundMs);
+        // The daemon must be able to exit with this outstanding — a pending agreement is not a reason to
+        // hold the process open.
+        if (typeof timer.unref === "function")
+            timer.unref();
+        this.#saltPending.set(key, { settled, resolve, timer, boundMs });
+    }
+    /**
+     * ONE mapping from a settled outcome to the operator-facing reason, so the send that WAITED and the
+     * send that arrived afterwards cannot disagree about what happened.
+     */
+    #reasonForOutcome(outcome) {
+        if (outcome === "announce_failed")
+            return UNSALTED_REASONS.ANNOUNCE_FAILED;
+        if (outcome === "persist_failed")
+            return UNSALTED_REASONS.OUR_PERSIST_FAILED;
+        if (outcome === "closed")
+            return UNSALTED_REASONS.PEER_CLOSED_ADOPTION;
+        return UNSALTED_REASONS.AGREEMENT_TIMED_OUT;
+    }
+    /** Resolve a pending agreement. Idempotent: the first outcome wins and the timer is cleared. */
+    #settleSaltPending(agentName, sessionId, outcome) {
+        const key = this.#k(agentName, sessionId);
+        const pending = this.#saltPending.get(key);
+        if (pending === undefined)
+            return;
+        this.#saltPending.delete(key);
+        // `agreed` is not recorded: the salt itself is the record, and `#getSessionSalt` answers first.
+        if (outcome !== "agreed")
+            this.#saltLastOutcome.set(key, outcome);
+        clearTimeout(pending.timer);
+        pending.resolve(outcome);
+    }
+    /**
+     * THIS SESSION'S UNSALTED HASH NEVER BECAME A MESSAGE — release the permanent closure it caused.
+     *
+     * ⚠️ REVIEW FINDING 3, and it is the opposite of the direction the flag was written to defend.
+     * `#hashedWithoutSalt` closes adoption at hash time, because for a session's first message the
+     * leaf is a network round trip away and every frontier count reads zero in between. Correct — but
+     * `cello_send` has three paths that compute the hash and then produce NOTHING: a sibling send
+     * holding the in-flight claim, the frontier moving under the send, and a non-durable send failure
+     * whose bytes go to a queue with no production consumer.
+     *
+     * In all three the session was permanently unsalted for a message that exists nowhere: no leaf, no
+     * wire, no copy at the peer. And B2b-2 made two of them MORE likely on a first message, because
+     * the five-second wait widens the very window the frontier re-check is watching.
+     *
+     * Only safe because it is called on paths that provably sent nothing. It deliberately does NOT
+     * clear `#unsaltedAnnounced`: the announcement was true when it fired and re-announcing on the
+     * retry would be the per-message flood Decision #15 forbids.
+     *
+     * ─── THREE OTHER SITES HASH AND MAY SEND NOTHING, AND ARE EXEMPT ON PURPOSE (pass 2, F8) ──────
+     *
+     * `daemon.ts`'s one-shot rejection and away reply, and `document-delivery-transport.ts`'s frame
+     * send, can all fail after hashing. None of them needs to abandon, and the reason is the same in
+     * each: every one is a REPLY. The inbound message that triggered it has already been leafed on
+     * this side, so `#saltAdoptionClosed` is already closed by the leaf count and would stay closed
+     * whatever this flag said. Calling abandon there would be a no-op that looks like a guarantee.
+     *
+     * Written down rather than left to be re-derived: the next reader's first question is why the
+     * list is three and not six.
+     */
+    abandonUnsaltedHash(agentName, sessionId) {
+        const key = this.#k(agentName, sessionId);
+        const held = this.#hashedWithoutSalt.get(key) ?? 0;
+        if (held === 0)
+            return;
+        // DECREMENT, never delete — F1. Deleting released a sibling's claim along with this one.
+        if (held > 1) {
+            this.#hashedWithoutSalt.set(key, held - 1);
+            return;
+        }
+        this.#hashedWithoutSalt.delete(key);
+        /**
+         * INFO, not DEBUG — review pass 2, F3. `session.content.unsalted` has already told this operator
+         * at INFO that the session is unsalted *"permanently… start a new session if you want the
+         * protection."* That statement is now false, and a retraction logged below the level of the
+         * claim it retracts is not a retraction. The announcement itself is deliberately NOT re-armed —
+         * re-announcing on the retry is the per-message flood Decision #15 forbids.
+         */
+        this.#logger.info("session.content.unsalted.retracted", {
+            agentName, sessionId,
+            impact: "a hash computed unsalted never became a message — no leaf, nothing on the wire, no copy at the counterparty — so this session CAN still adopt a salt. An earlier session.content.unsalted line said the session was permanently unsalted; that no longer applies.",
+        });
+    }
+    /**
+     * TEST SEAM — put a session into the state a real one is in between announcing and being answered.
+     *
+     * Reaching that state for real needs a live counterparty connection, which the daemon-level
+     * fixtures do not have; without a seam the wait could only be tested by not testing it. It calls
+     * the same private registration the announce path calls, so it cannot drift from it.
+     */
+    markSaltAgreementPendingForTest(agentName, sessionId, boundMs) {
+        this.#markSaltPending(agentName, sessionId, boundMs);
+    }
+    /**
+     * PUBLIC read of a session's agreed salt — `DOD-M15-SEALWIRE-1` part B2a.
+     *
+     * `content-park.ts` runs a SECOND, independent content-hash verifier (the park signature does not
+     * cover the envelope content, so it checks before `ingestReceivedContent` is ever reached), and it
+     * hardcoded `sha256`. It needs the salt to verify a v3 envelope, and it is outside this class.
+     *
+     * Read-only and cache-backed, so exposing it adds no way to CHANGE the salt from outside — the
+     * only writer remains `#persistSessionSalt`, behind the one-salt-per-session predicate.
+     */
+    getSessionContentSalt(agentName, sessionId) {
+        return this.#getSessionSalt(agentName, sessionId);
+    }
+    /**
+     * This session's agreed salt, or null. Reads the durable row through a cache, because Decision #8
+     * persists it for exactly one reason: *"a restart silently splits the transcript"* if the lookup
+     * misses and a fresh salt is minted.
+     *
+     * A read failure returns null WITH a log rather than throwing — except the bare `!this.#db` guard,
+     * which is this file's convention at 60+ sites and only reachable during shutdown. Null means "we
+     * hold no salt", which drives the agreement to offer a contribution — and against a peer that does
+     * hold one that is a named, loud `salt_state_divergent` refusal. So the degraded path ends in a
+     * diagnosis, not in a session that quietly hashes under the wrong value.
+     *
+     * ⚠️ THIS PARAGRAPH SPENT A UNIT STRANDED 180 LINES AWAY, directly above `contentHashForSession`
+     * and followed by that method's own block — so a reader hovering the hash decision got prose about
+     * salt read failures. Harmless and exactly the kind of drift that makes a comment stop being read.
+     */
+    #getSessionSalt(agentName, sessionId) {
+        const key = this.#k(agentName, sessionId);
+        const cached = this.#sessionSalts.get(key);
+        if (cached)
+            return cached;
+        if (!this.#db)
+            return null;
+        try {
+            const row = this.#db
+                .prepare("SELECT content_salt FROM sessions WHERE agent_id = ? AND session_id = ?")
+                .get(this.#requireAgentId(agentName), sessionId);
+            const stored = row?.content_salt;
+            if (!stored || stored.length === 0)
+                return null;
+            /**
+             * A WRONG-WIDTH ROW IS NOT A SALT — review F8.
+             *
+             * Any non-empty blob used to be accepted, so a truncated row became "our salt", the digests
+             * then differed, and the operator was told *"one of you is running an older build — compare
+             * versions with them"*: sent to their counterparty over corruption on their own disk. Refusing
+             * it here makes this side hold NO salt, which re-offers a contribution and repairs.
+             */
+            if (stored.length !== SESSION_SALT_BYTES) {
+                this.#logger.error("session.salt.read.failed", {
+                    agentName, sessionId, storedBytes: stored.length, expected: SESSION_SALT_BYTES,
+                    reason: "wrong_width",
+                    impact: "the stored salt is the wrong size, so it is not used; this session is treated as holding no salt and will re-agree one with the counterparty rather than comparing a corrupt value and blaming their build",
+                });
+                return null;
+            }
+            const salt = new Uint8Array(stored);
+            this.#sessionSalts.set(key, salt);
+            return salt;
+        }
+        catch (err) {
+            this.#logger.error("session.salt.read.failed", {
+                agentName, sessionId, error: extractErrorMessage(err),
+                impact: "this session is treated as holding no salt, so it will offer a fresh contribution; against a counterparty that still holds theirs the agreement refuses by name rather than hashing under a value only one side has",
+            });
+            return null;
+        }
+    }
+    /**
+     * Is this session past the point where a salt can be adopted? — Decision #8, part B2b-2.
+     *
+     * ⚠️ THE PREDICATE IS "HAS ANYTHING BEEN HASHED", NOT "IS THERE A LEAF" — review F5. A leaf is
+     * APPENDED after `await sendContent(...)` returns, so a message can be hashed, put on the wire, and
+     * still be invisible to `tree.size()`. Adopting inside that window makes leaf 0 unsalted and the
+     * rest salted — the exact split this exists to prevent, with the guard green.
+     *
+     * ⚠️ HELD CONTENT COUNTS, AND MUST BE HYDRATED FIRST — review F6. `#ensureHeldRestored` is lazy and
+     * is not called at session-node creation, so a revived session whose first inbound frame is the
+     * salt frame reads a frontier that excludes durable `held_content` rows — rows already hashed
+     * unsalted, which `#releaseHeld` will append moments later. Every other frontier reader in this
+     * file hydrates first, for this reason. `release: false`, because a salt frame must never deliver
+     * messages as a side effect.
+     *
+     * ⚠️ "CANNOT TELL" IS CLOSED, NOT OPEN. `#requireAgentId` throws for a retired agent, and inferring
+     * "zero leaves" from a failure to count them is how a guard becomes a formality. The cost of
+     * refusing is an unsalted session; the cost of permitting is a transcript neither rule can verify.
+     */
+    #saltAdoptionClosed(agentName, sessionId) {
+        try {
+            this.#ensureHeldRestored(agentName, sessionId, { release: false });
+        }
+        catch { /* hydration is best-effort; the counts below still refuse on their own failure */ }
+        try {
+            const key = this.#k(agentName, sessionId);
+            const leaves = this.getSessionTree(agentName, sessionId).size();
+            const held = this.#heldContent.get(key)?.size ?? 0;
+            const inFlight = this.#awaitingAck.get(key)?.size ?? 0;
+            /**
+             * ⚠️ THE HASH ITSELF COUNTS — B2b-2, and none of the three counts above can see it.
+             *
+             * Decision #8 closes adoption when content is HASHED. For a session's first message the leaf
+             * lands after `sendContent` returns, a network round trip later; there is no held row and no
+             * in-flight entry yet either. So between the hash and the leaf every count reads zero, and a
+             * peer contribution arriving in that window would be adopted — leaving the message already on
+             * the wire as the one unsalted leaf in a salted transcript.
+             */
+            const hashed = this.#hashedWithoutSalt.get(key) ?? 0;
+            const total = leaves + held + inFlight + hashed;
+            return {
+                closed: total > 0,
+                // The label crosses the WIRE, so it carries no counts and no error text — only which of the
+                // two refusals this is. The counts stay in `why`, which stays local.
+                label: SALT_ADOPTION_LABELS.ALREADY_HASHING,
+                leafCount: total,
+                why: `leaves=${leaves} held=${held} awaiting_ack=${inFlight} hashed=${hashed}`,
+            };
+        }
+        catch (err) {
+            return {
+                closed: true,
+                label: SALT_ADOPTION_LABELS.FRONTIER_UNREADABLE,
+                leafCount: -1,
+                why: `frontier_unreadable: ${extractErrorMessage(err)}`,
+            };
+        }
+    }
+    /**
+     * Persist the agreed salt, and DO NOT ANNOUNCE ONE WE FAILED TO STORE.
+     *
+     * The caller sends its fingerprint only if this returns true. A salt held in memory and not on
+     * disk would confirm agreement to the counterparty and then be gone at the next restart — turning
+     * a loud `salt_state_divergent` refusal, which is the whole point of Decision #10, into the silent
+     * split it exists to prevent, one restart later.
+     *
+     * ⚠️ SECOND ORPHAN OF THE SAME KIND. This paragraph was stranded above `#saltAdoptionClosed` and
+     * followed by that method's own block, exactly like the `#getSessionSalt` one re-homed in the
+     * previous pass — which walked straight past this one sixty lines below it. Two in one file is not
+     * coincidence: inserting a method between a doc block and its subject leaves no error, no lint,
+     * and no test, so the drift is invisible until someone reads for it.
+     */
+    #persistSessionSalt(agentName, sessionId, salt) {
+        if (!this.#db) {
+            // NOT a silent return — review F7. The other two persist failures each emit an event, so a
+            // derive that could not store because the handle is closed was the ONE salt path producing no
+            // record at all. Only reachable during shutdown, which is exactly when a lone unexplained
+            // gap in the log is hardest to account for later.
+            this.#logger.error("session.salt.persist.failed", {
+                agentName, sessionId, reason: "db_closed",
+                impact: "the salt was NOT stored and is not announced; the agreement stays open and re-runs on the next connect",
+            });
+            return false;
+        }
+        try {
+            /**
+             * ORDER MATTERS HERE, and getting it wrong cost three findings — review F3, F4, F7.
+             *
+             * The adoption guard used to run FIRST, above `!this.#db` and outside this `try`. That:
+             *   - short-circuited the `salt_already_stored` discrimination below, so a session that DOES
+             *     hold a valid salt was told it "stays unsalted FOR THE LIFE of the session" after a
+             *     transient read failure — a refusal asserting something false about the row (F4);
+             *   - put `getSessionTree`'s `#requireAgentId` throw outside the `try`, where it surfaced as
+             *     *"the stream read failed"* instead of a named salt-persist failure (F7).
+             *
+             * So the row's own state is established first, and only a session with no salt at all reaches
+             * the adoption question.
+             */
+            const existingRow = this.#db
+                .prepare("SELECT length(content_salt) AS n FROM sessions WHERE agent_id = ? AND session_id = ?")
+                .get(this.#requireAgentId(agentName), sessionId);
+            if (existingRow?.n === SESSION_SALT_BYTES) {
+                this.#logger.error("session.salt.persist.failed", {
+                    agentName, sessionId, reason: "salt_already_stored",
+                    impact: "this session already has a salt and it was NOT replaced — Decision #8 is one salt per session. Reaching here means a read failure made this side believe it had none; the stored salt is intact, nothing was announced, and the agreement re-runs against it on the next connect.",
+                });
+                return false;
+            }
+            const adoption = this.#saltAdoptionClosed(agentName, sessionId);
+            if (adoption.closed) {
+                this.#logger.warn("session.salt.adoption.refused", {
+                    agentName, sessionId, reason: "already_hashing", leafCount: adoption.leafCount, frontier: adoption.why,
+                    impact: "this session has already hashed content under the unsalted rule, so the salt was NOT adopted — it stays unsalted FOR THE LIFE of the session. Adopting now would hash the rest of the conversation differently and leave a transcript that neither rule can verify end to end.",
+                    guidance: "Nothing is broken and no message was lost: an unsalted session is exactly as verifiable as every session before this feature existed. It only means a relay holding the hashes could confirm a guess at a short message in THIS conversation. If you want the protection, start a new session — the agreement runs at open, before anything is hashed.",
+                });
+                return false;
+            }
+            /**
+             * THE ROW COUNT IS THE CHECK, and without it this method reported success for a write that
+             * stored nothing.
+             *
+             * An `UPDATE` that matches no row does not throw — it returns `changes: 0`. So a session whose
+             * row is missing (retired agent, a row that failed to write at creation, an id that does not
+             * line up) took the success branch, cached the salt in memory, and announced our fingerprint
+             * to the counterparty. Agreement confirmed, nothing on disk, and the failure surfaces at the
+             * next restart as the divergence this whole design exists to make loud — except one restart
+             * late and with both sides believing they had agreed.
+             *
+             * Found by a mutant that removed the caller's `if (!persisted) return`: the suite stayed green,
+             * because nothing could produce a false from here.
+             */
+            /**
+             * ONE SALT PER SESSION, ENFORCED AT THE WRITE — review F18.
+             *
+             * This `UPDATE` was unconditional, so it could replace an already-stored VALID salt. The path
+             * is real: `#getSessionSalt` returns null on a transient read failure, which sends this side
+             * down the derive path, which then overwrote the perfectly good salt on disk. The read error
+             * was logged; the destruction of the durable value was not — and the read log actively said
+             * the wrong thing, promising only that we would "offer a fresh contribution".
+             *
+             * The predicate has to allow ONE overwrite: a wrong-width blob is refused by `#getSessionSalt`
+             * (F8) precisely so a corrupt row can be replaced rather than stranding the session forever.
+             * So: write when there is nothing there, or when what is there is not a salt.
+             */
+            const written = this.#db
+                .prepare("UPDATE sessions SET content_salt = ? WHERE agent_id = ? AND session_id = ? " +
+                "AND (content_salt IS NULL OR length(content_salt) <> ?)")
+                .run(Buffer.from(salt), this.#requireAgentId(agentName), sessionId, SESSION_SALT_BYTES);
+            if (Number(written.changes) !== 1) {
+                // WHICH of the two it was. "No row" is a broken session record; "a salt is already there" is
+                // this guard doing its job, and telling an operator the row is missing when it is not would
+                // send them to look at the wrong thing.
+                // The `salt_already_stored` case is decided above now, before the adoption question, so
+                // reaching here with a valid salt in the row is not possible. Re-read anyway rather than
+                // assume: a wrong-width blob also fails the predicate and must not be reported as a missing
+                // row, which would send the operator to look at session state for a corrupt value.
+                const existing = this.#db
+                    .prepare("SELECT length(content_salt) AS n FROM sessions WHERE agent_id = ? AND session_id = ?")
+                    .get(this.#requireAgentId(agentName), sessionId);
+                const alreadyStored = existing?.n === SESSION_SALT_BYTES;
+                this.#logger.error("session.salt.persist.failed", {
+                    agentName, sessionId, changes: Number(written.changes),
+                    reason: alreadyStored ? "salt_already_stored" : "no_session_row",
+                    impact: alreadyStored
+                        ? "this session already has a salt and it was NOT replaced — Decision #8 is one salt per session. Reaching here means a read failure made this side believe it had none; the stored salt is intact, nothing was announced, and the agreement re-runs against it on the next connect."
+                        : "the salt was NOT stored — no session row matched — so it is not announced either; the agreement stays open rather than being confirmed against a value that exists only in memory",
+                });
+                return false;
+            }
+            this.#sessionSalts.set(this.#k(agentName, sessionId), salt);
+            return true;
+        }
+        catch (err) {
+            this.#logger.error("session.salt.persist.failed", {
+                agentName, sessionId, error: extractErrorMessage(err),
+                impact: "the salt was NOT stored, so it is not announced to the counterparty either; the agreement stays open rather than being confirmed against a value that would vanish at the next restart",
+            });
+            return false;
+        }
+    }
+    /**
+     * Announce our state to the counterparty: a contribution if we hold no salt, a fingerprint if we
+     * do. Called on every counterparty connect — first connection, reconnect and revival alike — and
+     * on receiving a peer contribution.
+     *
+     * ⚠️ THIS PARAGRAPH USED TO SAY *"nothing hashes with the salt yet, so a frame that never lands
+     * costs nothing today"*, and ended by instructing the next unit not to carry it forward unchanged.
+     * **This is that unit, and pass 2 caught me leaving it** — I corrected the same claim inside
+     * `session.salt.announce.failed`'s `impact` in the previous pass and walked past the method header
+     * saying the opposite twenty lines above it.
+     *
+     * As it stands now: the SEND is still best-effort, but a frame that never lands is no longer free.
+     * A first send waiting on this agreement falls back to an unsalted hash, and that is permanent for
+     * the session. The catch therefore settles the pending under `announce_failed` rather than leaving
+     * the send to time out — so the cost is one dial attempt and an accurate reason, instead of five
+     * seconds and a diagnosis blaming the counterparty for a frame we never sent.
+     */
+    async #sendSaltFrame(agentName, sessionId, correlationId, override) {
+        const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+        if (!entry)
+            return;
+        // `override` is the repair and the mismatch notice: a frame the AGREEMENT chose, which is not
+        // the one our current state would produce. A side that holds a salt normally announces a
+        // fingerprint — the repair has it send its CONTRIBUTION instead, which is the whole mechanism.
+        /**
+         * `#saltState`, NOT a direct call to the minting accessor — review F15, and this one line was
+         * the difference between the safety argument written for the repair and the code that ran.
+         *
+         * It read `ownContribution: this.#saltContributionFor(...)`, which mints unconditionally. Both
+         * arguments are evaluated, so a session that already held a salt got a fresh half minted into
+         * `#saltContributions` even though `ownSaltFrame` discards it on that branch — and
+         * `#evictSessionCaches` drops the half on every teardown while the salt stays on disk, so ANY
+         * revived session hit it, before any inbound frame could be handled.
+         *
+         * The consequence was not cosmetic. `#ownSaltHalf` never returned null, so `STATE_DIVERGENT`
+         * was dead code, and a revived session would REPAIR its counterparty onto a half its salt was
+         * never built from — then both sides froze on `salt_fingerprint_mismatch`, whose guidance sends
+         * the operator to compare build versions with a counterparty that did nothing wrong.
+         */
+        const state = this.#saltState(agentName, sessionId);
+        const frame = override ?? ownSaltFrame(state);
+        if (!frame) {
+            // Neither a salt nor a half. `#saltState` does not produce this, so it is a defect rather
+            // than a state to paper over — and inventing a contribution here is exactly what F15 was.
+            this.#logger.error("session.salt.announce.failed", {
+                agentName, sessionId, correlationId, reason: "no_salt_and_no_contribution",
+                impact: "this side has neither an agreed salt nor a half to offer, so it announced nothing; no half was invented, because one minted now would not be the half any stored salt was built from",
+            });
+            return;
+        }
+        /**
+         * ⚠️ REGISTERED BEFORE THE DIAL, NOT AFTER IT — review Finding 2, and this ordering is the whole
+         * of constraint 2 for the case that actually happens.
+         *
+         * This sat after `await newStream(...)`, which negotiates the protocol with the peer and takes
+         * tens to hundreds of milliseconds. A `cello_send` landing inside that interval found nothing
+         * pending, took the park-only exit, hashed unsalted, and **closed adoption for the life of the
+         * session** — a session with a live counterparty and an agreement about to complete. The feature
+         * off forever, and the log telling the operator their counterparty was on an old build.
+         *
+         * That is precisely the failure constraint 2 exists to prevent, arriving by the one route the
+         * implementation did not cover: the gap between deciding to announce and the frame leaving.
+         *
+         * Park-only is untouched — it never reaches this line, because `#sendSaltFrame` returns at the
+         * `!entry` guard above when there is no active node. And a failed announce settles the waiter in
+         * the catch below rather than leaving a send to sit out the full bound for a frame that never
+         * left.
+         */
+        if (!frame.adoptionClosed)
+            this.#markSaltPending(agentName, sessionId);
+        // Held outside the try so the catch can retire a stream that was opened and then failed to
+        // write — the same leak, and the same fix, as `#sendDeliveryAck`.
+        let saltStream;
+        try {
+            const stream = await entry.node.newStream(entry.counterpartySessionPeerId, CELLO_CONTENT_PROTOCOL_ID);
+            saltStream = stream;
+            stream.send(lp.encode.single(encodeCbor({
+                type: "session_salt_agreement",
+                session_id: sessionId,
+                ...(frame.contribution ? { contribution: frame.contribution } : {}),
+                ...(frame.fingerprint ? { fingerprint: frame.fingerprint } : {}),
+                ...(frame.adoptionClosed ? { adoption_closed: frame.adoptionClosed } : {}),
+            })));
+            await stream.close();
+            this.#logger.debug("session.salt.announced", {
+                agentName, sessionId, correlationId,
+                /**
+                 * THREE STATES, not two. This read `fingerprint ? holds_salt : offering_contribution`, which
+                 * was exhaustive until the adoption refusal put a third frame on the wire — and a refusal
+                 * carries no fingerprint, so it logged as `offering_contribution`: the log claiming we asked
+                 * for a salt at the exact moment we told the peer we were declining one. An operator reading
+                 * the pair would see an offer that was never answered and go looking for a dropped frame.
+                 */
+                state: frame.adoptionClosed ? "adoption_closed" : frame.fingerprint ? "holds_salt" : "offering_contribution",
+            });
+        }
+        catch (err) {
+            /**
+             * ⚠️ RELEASE THE WAITER — the frame never left, so there is nothing to wait for.
+             *
+             * Registering before the dial (above) means a failed announce would otherwise leave a first
+             * send holding for the full five seconds against a frame that was never sent. Settling here
+             * makes the failure cost one dial attempt instead of the whole bound, and B2b-2 turned this
+             * from theory into something a user feels: it is the pause before their first message.
+             */
+            this.#settleSaltPending(agentName, sessionId, "announce_failed");
+            this.#logger.warn("session.salt.announce.failed", {
+                agentName, sessionId, correlationId, error: extractErrorMessage(err),
+                // Review F1: this used to end "so no message is affected", which was FALSE in the situation
+                // it fires in — a one-sided announce is exactly what put the two sides out of step, and the
+                // peer used to freeze the session over it. It converges now, so the claim is true again;
+                // it is stated with its reason rather than as a bare reassurance.
+                //
+                // ⚠️ B2b-2 CHANGED THE LAST CLAUSE'S TRUTH. "Nothing hashes with the salt yet" was true for
+                // part A and is now false: a first send waiting on this agreement falls back to sha256 when
+                // it fails, which permanently unsalts the session. Not a message LOST — a protection not
+                // taken, and the sentence has to stop promising otherwise.
+                impact: "the counterparty was not told our salt state on this attempt. We re-announce on every reconnect, and a side that is out of step re-offers its half rather than refusing, so the agreement converges from here. No message is affected, but a first send waiting on this agreement now falls back to an unsalted hash, which is permanent for this session.",
+            });
+            if (saltStream !== undefined) {
+                try {
+                    saltStream.abort(err instanceof Error ? err : new Error(String(err)));
+                }
+                catch { /* already gone */ }
+            }
+        }
+    }
+    /** Apply one inbound salt-agreement frame. The verdict is the pure function's; this executes it. */
+    async #handleSaltFrame(agentName, sessionId, frame, correlationId) {
+        const key = this.#k(agentName, sessionId);
+        const peerHalfHex = frame.contribution ? Buffer.from(frame.contribution).toString("hex") : null;
+        const adoption = this.#saltAdoptionClosed(agentName, sessionId);
+        const action = onPeerSaltFrame({
+            ...this.#saltState(agentName, sessionId),
+            // Review F2: the frontier is what decides whether THIS side can still adopt, and only the
+            // caller can count it. Without this the state machine derives, the persist refuses, and the
+            // peer never learns — which is how the two sides end up on opposite verdicts.
+            ownAdoption: adoption.closed
+                ? { closed: true, label: adoption.label, why: adoption.why }
+                : { closed: false },
+            // Keyed on the peer's BYTES, not on a repair counter: a genuinely NEW half from the peer must
+            // still get our contribution back, and only an identical re-offer is the loop (review F14).
+            alreadyRepairedAgainstPeerHalf: peerHalfHex !== null && this.#saltRepairedAgainst.get(key) === peerHalfHex,
+            frame,
+        });
+        if (action.action === "confirmed") {
+            this.#logger.info("session.salt.agreed", {
+                agentName, sessionId, correlationId, via: "fingerprint_match",
+            });
+            // B2b-2: release a first send that is waiting on this agreement. Both `confirmed` and
+            // `derive_and_announce` end with a salt this side can hash under, so both settle the wait.
+            this.#settleSaltPending(agentName, sessionId, "agreed");
+            return;
+        }
+        if (action.action === "derive_and_announce") {
+            /**
+             * ⚠️ I DEFENDED THE OPPOSITE OF THIS TWICE, AND BOTH DEFENCES WERE WRONG. The code now does
+             * what the "surviving mutant" did; recording that rather than quietly switching, because the
+             * reasoning is the useful part.
+             *
+             * A failed persist used to fall through with no settle, so a waiting first send sat out the
+             * FULL FIVE SECONDS and was then told, by the timeout path, to go and check its counterparty's
+             * build version — for a fault that was this machine's own disk.
+             *
+             * Defence #1 said releasing the waiter "would hand it a null it would hash unsalted under."
+             * True, and not a consequence: that is exactly what the timeout does. Defence #2 said the
+             * remaining bound gave a repair a chance to land — and the review showed that essentially
+             * cannot fire. This branch returns BEFORE the announce, so nothing goes out and nothing comes
+             * back; all five of `#sendSaltFrame`'s callers are triggered by a peer connect or an inbound
+             * frame. Only a counterparty reconnect inside those seconds could do it.
+             *
+             * So the real trade was a rare reconnect-within-five-seconds repair against five seconds of
+             * visible latency on the operator's first message AND a diagnosis pointing at the wrong
+             * machine. The repair loses. Settle immediately under its own name, so `#saltForHashing` can
+             * say *our own write failed* instead of *they did not answer*.
+             */
+            if (!this.#persistSessionSalt(agentName, sessionId, action.salt)) {
+                this.#settleSaltPending(agentName, sessionId, "persist_failed");
+                return;
+            }
+            this.#logger.info("session.salt.agreed", {
+                agentName, sessionId, correlationId, via: "derived",
+            });
+            this.#settleSaltPending(agentName, sessionId, "agreed");
+            // `void`, not `await` — review F10. This runs inside the INBOUND content-stream handler, so
+            // awaiting an outbound `newStream` here lets a stalled dial hold up the stream we are reading.
+            // The connect-side call is `void`-ed for the same reason and this is now consistent with it.
+            void this.#sendSaltFrame(agentName, sessionId, correlationId);
+            return;
+        }
+        if (action.action === "adoption_closed") {
+            // B2b-2: terminal means there is nothing left to wait for. A send still holding on the bound
+            // would otherwise sit out the full five seconds for an answer that has already arrived and
+            // said no — the slowest possible way to reach a decision both sides already agree on.
+            this.#settleSaltPending(agentName, sessionId, "closed");
+            /**
+             * Terminal, and NOT a freeze — review F1/F2. Both sides stay unsalted, which is exactly as
+             * verifiable as every session shipped before the salt existed; the thing that was broken was
+             * them disagreeing about it silently.
+             *
+             * WHICH SIDE DECLINED decides the level, and it is not decoration.
+             *
+             * If WE closed, an operator has lost a protection they could otherwise have had, and there is
+             * something they can do about it — that is a WARN under `session.salt.adoption.refused`, which
+             * keeps meaning what it has always meant.
+             *
+             * If we are merely LEARNING the peer closed, nothing about this machine is at fault and there
+             * is nothing for its operator to do. Logging that at WARN would fire on the innocent side of
+             * every such session and train them to ignore the name.
+             */
+            const shared = {
+                agentName, sessionId, correlationId, detail: action.detail,
+                impact: "neither side will use a content salt for this session, and both now know it. Messages are hashed the way every build before this feature hashed them — nothing is degraded relative to any shipped release, and no message is affected.",
+            };
+            if (adoption.closed) {
+                /**
+                 * ⚠️ TWO REFUSALS, TWO DIFFERENT THINGS TO DO — and this used to report both as
+                 * `already_hashing`.
+                 *
+                 * A session that has already sent messages is the feature working: the fix is a new session,
+                 * and it will work. A frontier this side could not READ is local storage trouble: a new
+                 * session will refuse in exactly the same way, so sending the operator to open one is
+                 * sending them somewhere that cannot help. `frontier` carries the counts (or the error) so
+                 * the two are separable from the log alone.
+                 */
+                const unreadable = adoption.label === SALT_ADOPTION_LABELS.FRONTIER_UNREADABLE;
+                this.#logger.warn("session.salt.adoption.refused", {
+                    ...shared,
+                    reason: adoption.label,
+                    leafCount: adoption.leafCount,
+                    frontier: adoption.why,
+                    guidance: unreadable
+                        ? "This side could not read its own message frontier, so it refused the salt rather than risk hashing half the session one way and half the other. Starting a new session will NOT help — it will refuse the same way. Look for session.content.held.restore.failed or other storage errors around this line; the conversation still works and every message is intact, it is just unsalted."
+                        : "Nothing is broken and no message was lost: an unsalted session is exactly as verifiable as every session before this feature existed. It only means a relay holding the hashes could confirm a guess at a short message in THIS conversation. If you want the protection, start a new session — the agreement runs at open, before anything is hashed.",
+                });
+            }
+            else {
+                this.#logger.info("session.salt.adoption.closed", shared);
+            }
+            if (action.announce) {
+                void this.#sendSaltFrame(agentName, sessionId, correlationId, action.announce);
+            }
+            return;
+        }
+        if (action.action === "repair") {
+            /**
+             * THE REPAIR — review F1. The two sides are out of step and CAN converge, so re-send our half
+             * rather than destroying the session.
+             *
+             * At INFO because it is a real event an operator may need to correlate with a
+             * `session.salt.announce.failed` or `session.salt.persist.failed` on either machine, and
+             * because a session that repairs REPEATEDLY is a signal even though each repair is benign.
+             */
+            this.#logger.info("session.salt.repair", {
+                agentName, sessionId, correlationId, detail: action.detail,
+                answeredWith: action.frame.contribution ? "contribution" : "fingerprint",
+            });
+            // Recorded ONLY for a repair that sent our half, because that is the one a second identical
+            // offer must not repeat (review F14). Recording the fingerprint answer too would be harmless
+            // but says nothing — that branch is already terminal for the peer.
+            if (peerHalfHex && action.frame.contribution)
+                this.#saltRepairedAgainst.set(key, peerHalfHex);
+            void this.#sendSaltFrame(agentName, sessionId, correlationId, action.frame);
+            return;
+        }
+        // `detail` is the primitive's own sentence wherever the primitive produced it — never a code of
+        // ours substituted for it (Invariant 2). `guidance` is what the operator can DO, and it comes
+        // from the total map so a reason can never reach a log without one.
+        this.#logger.error("session.salt.disagreement", {
+            agentName, sessionId, correlationId,
+            reason: action.reason,
+            detail: action.detail,
+            guidance: SALT_FREEZE_GUIDANCE[action.reason],
+        });
+        /**
+         * TELL THE PEER BEFORE TEARING DOWN — review F1's mirror.
+         *
+         * Only the fingerprint mismatch carries a notice, and only it can: the peer holds everything
+         * needed to run the identical comparison and has simply not been given our side of it. Without
+         * this the session stops answering and the far operator gets no reason at all, while ours gets a
+         * full explanation — Decision #10 asks for BOTH sides to refuse by name.
+         *
+         * Awaited, unlike the other sends, because `destroySessionNode` on the next line takes the node
+         * away and an un-awaited write would race its own transport. A failure is already handled
+         * inside — the refusal here has happened either way.
+         */
+        if (action.notifyPeer) {
+            await this.#sendSaltFrame(agentName, sessionId, correlationId, action.notifyPeer);
+        }
+        await this.#freezeSession(agentName, sessionId, action.reason, {
+            event: "session.salt.frozen",
+            observation: `the salt agreement could not be completed with this counterparty: ${action.detail}`,
+            impact: "the session was stopped rather than left to hash under a value the two sides do not share; no message was lost and the transcript is unaffected — only a NEW session moves this forward",
+            reviveReason: `session_frozen_${action.reason}`,
+            // The operator-facing sentence comes from the TOTAL guidance map, so a reason can never reach
+            // this refusal without one — and it is what stops a salt disagreement being reported to them
+            // as their counterparty failing a key check.
+            reviveGuidance: SALT_FREEZE_GUIDANCE[action.reason],
+        }, correlationId);
+    }
+    async #freezeOnIdentityFailure(agentName, sessionId, reason, correlationId) {
+        await this.#freezeSession(agentName, sessionId, reason, {
+            event: "session.content.identity.frozen",
+            observation: "a frame failed to verify against the expected counterparty's key; the session was frozen defensively; cause undetermined",
+            reviveReason: "session_frozen_identity_failure",
+            reviveGuidance: "This session was frozen because a message failed to verify against the expected counterparty's key. " +
+                "Cause undetermined — that signal looks the same whether someone was impersonating your counterparty or CELLO's own delivery mishandled a fallback, so it is recorded as an observation and nothing has been concluded about them.",
+            // Review F1: this said "no further content will be accepted on this session", which was FALSE
+            // as shipped — the next read revived it. It is true now, and it says how it is true, because
+            // an operator who reads "frozen" and then watches the session work again learns to distrust
+            // the log rather than the session.
+            impact: "the content was NOT ingested, NOT displayed and NOT attributed to anyone; the session will not be revived by a read or a send, and only a close or a fresh session moves it now",
+        }, correlationId);
+    }
+    /**
+     * Stop a session and refuse to revive it. Shared by the identity freeze and the salt
+     * disagreement, because the MECHANISM is identical — mark, then tear down — while the two have
+     * nothing else in common and must not describe each other. An identity failure is evidence about
+     * the counterparty; a salt disagreement is usually two builds that do not match, and telling an
+     * operator their counterparty failed a key check when they did not is worse than saying nothing.
+     * Hence the caller supplies both sentences.
+     */
+    async #freezeSession(agentName, sessionId, reason, narrative, correlationId) {
+        // Review F1: MARK BEFORE TEARING DOWN. `destroySessionNode` writes `interrupted`, which is the
+        // revivable status — if the mark landed after, a read racing the teardown could revive the
+        // session out from under the freeze.
+        //
+        // `reviveReason` is SPELLED OUT by the caller rather than built from `reason`. Deriving it looks
+        // tidier and silently changed a shipped contract: the identity freeze's `reason` is the specific
+        // ordering failure (`bad_signature`, `signer_not_counterparty`), so a derived code would have
+        // turned the stable `session_frozen_identity_failure` into a family of varying strings that no
+        // caller matches. Caught by that path's own test.
+        this.#frozenSessions.set(this.#k(agentName, sessionId), {
+            reason: narrative.reviveReason,
+            guidance: narrative.reviveGuidance,
+        });
+        // The EVENT NAME is the caller's, not this method's. Both freezes share a mechanism and nothing
+        // else, and a salt disagreement logged under `…identity.frozen` would tell an operator their
+        // counterparty failed a key check when they did not — a worse outcome than saying nothing.
+        this.#logger.error(narrative.event, {
+            agentName, sessionId, reason, correlationId,
+            observation: narrative.observation,
+            // Review F1: the identity path's impact line said "no further content will be accepted on this
+            // session", which was FALSE as shipped — the next read revived it. It is true now, and it says
+            // how it is true, because an operator who reads "frozen" and then watches the session work
+            // again learns to distrust the log rather than the session.
+            impact: narrative.impact,
+        });
+        try {
+            /**
+             * `"error"` maps to DB status `interrupted`, which is the SAME row an ordinary
+             * counterparty-gone teardown writes — so a freeze is distinguishable in the log and in
+             * behaviour, but not in the session record.
+             *
+             * ⚠️ THIS COMMENT USED TO SAY THE COLUMNS DID NOT EXIST. They do now: `frozen_at` and
+             * `frozen_reason` were added to `sessions` by the salt migration, which carried them for
+             * `DOD-M15-FREEZE-STATUS-1` so that two lanes would not both edit this file's migration list.
+             * What is still missing is a WRITER — that is `FREEZE-STATUS-1`'s work and it belongs to the
+             * other lane, so nothing here fills them in. The gap is unchanged; only the reason for it is.
+             */
+            await this.destroySessionNode(agentName, sessionId, "error");
+        }
+        catch (err) {
+            // The refusal already happened — the content did not ingest. A teardown failure must not
+            // turn a successful refusal into a thrown handler, which would close the stream on a path
+            // that reads as "nothing arrived".
+            this.#logger.warn("session.content.identity.freeze_teardown_failed", {
+                agentName, sessionId, error: extractErrorMessage(err), correlationId,
+            });
+        }
+    }
+    #recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, source = "content_frame") {
+        try {
+            const s1 = decode(structure1Cbor);
+            const s2 = decode(structure2Cbor);
+            const s1Hash = s1?.[1];
+            const s1Pubkey = s1?.[2];
+            const seq = typeof s2?.[0] === "number" ? s2[0] : -1;
+            const s2Sig = s2?.[3];
+            if (!(s1Hash instanceof Uint8Array) || !(s1Pubkey instanceof Uint8Array) || !(s2Sig instanceof Uint8Array) || seq < 1) {
+                // SOFT: we could not read the record, so we learned nothing about the signer either way.
+                // Position falls back to the witness stream, exactly as an absent record does.
+                this.#logger.warn("session.content.ordering.malformed", { sessionId, correlationId });
+                return { seq: null };
+            }
+            // The framed ordering record must bind to THIS content (its hash) — else it orders the wrong bytes.
+            const contentHashHex = Buffer.from(contentHash).toString("hex");
+            if (Buffer.from(s1Hash).toString("hex") !== contentHashHex) {
+                // SOFT: the record does not describe this content. Nothing is proven about the signer's
+                // identity — only that this record and these bytes do not belong together.
+                this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
+                return { seq: null };
+            }
+            // Verify the SENDER's Ed25519 signature over the exact signed bytes (structure1_cbor) — the same
+            // check the relay performs. Proves the counterparty committed to this (content_hash @ sequence).
+            if (!verify(s1Pubkey, structure1Cbor, s2Sig)) {
+                // FATAL. The sender supplied a signature and it does not verify against the key inside its
+                // own record. That is not an absence we could not resolve — it is a proof that failed.
+                this.#logger.warn("session.content.ordering.bad_signature", { sessionId, correlationId });
+                return { seq: null, fatal: { reason: "bad_signature" } };
+            }
+            // Sovereign-node cross-check: the signer MUST be THIS session's counterparty, not an unrelated
+            // key. FAIL CLOSED (review L) — if the counterparty pubkey is unknown we cannot prove the signer,
+            // so we do NOT trust the framed ordering record (fall back to the witness stream / arrival). The
+            // "B does not trust the counterparty for ordering" invariant is non-negotiable; never fail open.
+            // Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from the
+            // IPC param and is never case-normalized, so a string compare would fail for a mixed-case
+            // pubkey and silently strip the canonical ordering from every message in that session.
+            const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
+            if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
+                /**
+                 * FATAL when the counterparty is KNOWN and the signer is someone else. SOFT when we simply
+                 * do not know who the counterparty is.
+                 *
+                 * The fatal half is the session-open MITM detection from the 2026-08-21 T-of-N
+                 * investigation, which found this check *"fires correctly, and its answer is thrown away."*
+                 * A rogue quorum of the directories holding shares for agent B can sign a false
+                 * SessionAssignment naming M's key as B's, and everything downstream is genuinely real —
+                 * M signs with M's own valid key. Nothing is missing for A to notice. This comparison is
+                 * where the substitution shows, because `counterparty_pubkey` comes from A's own request
+                 * and is untouched by anything the directory returns.
+                 *
+                 * ⚠️ IT SHOWS ONLY WHEN THE RECORD IS PRESENT (review F3). An earlier version of this
+                 * comment said this was "the one place the substitution shows", full stop — and that
+                 * asserted a property the code does not have: M can decline to supply an ordering record
+                 * and be ingested without ever reaching this line. The caller logs
+                 * `session.content.ordering.absent` so the weaker case is at least visible, and closing it
+                 * needs a check that does not depend on the sender's cooperation — the relay's independent
+                 * copy, `DOD-M15-CORROBORATE-1`.
+                 *
+                 * The soft half stays soft deliberately: `counterparty_unknown` means we cannot prove the
+                 * signer either way, and refusing there would strand sessions whose record we failed to
+                 * read rather than sessions that are under attack.
+                 */
+                const reason = counterparty ? "signer_not_counterparty" : "counterparty_unknown";
+                this.#logger.warn("session.content.ordering.wrong_signer", { sessionId, reason, correlationId });
+                return counterparty ? { seq: null, fatal: { reason } } : { seq: null };
+            }
+            // Verified — record the relay-assigned canonical sequence (1-based → 0-based leaf index) for the gate.
+            this.recordWitnessedSequence(agentName, sessionId, contentHashHex, seq - 1);
+            this.#logger.info("session.content.ordering.recorded", {
+                sessionId,
+                canonicalSeq: seq - 1,
+                source,
+                correlationId,
+            });
+            /**
+             * DOD-M15-SEALWIRE-1 bullet 5: return the VERIFIED proof, not just the position.
+             *
+             * Three lines above, `verify(s1Pubkey, structure1Cbor, s2Sig)` has already passed and the
+             * signer has been matched to this session's counterparty. That is the strongest statement
+             * this daemon ever makes about who wrote a message — and until now it was made, used to
+             * decide a sequence number, and then discarded. The transcript row that outlives it recorded
+             * only a direction.
+             *
+             * Returned rather than stashed, for the same reason `seq` is: a caller that has to go looking
+             * for it in a side map is a caller that will not.
+             */
+            return { seq: seq - 1, senderPubkey: s1Pubkey, senderSig: s2Sig };
+        }
+        catch (err) {
+            this.#logger.warn("session.content.ordering.decode_failed", {
+                sessionId,
+                error: err instanceof Error ? err.message : String(err),
+                correlationId,
+            });
+        }
+        // No verified position — the caller falls back to the announced hash-dedup path. SOFT: a decode
+        // throw tells us nothing about the signer, so it is the absent case, not the refuted one.
+        return { seq: null };
+    }
+    async #handleContentStream(agentName, sessionId, stream, remotePeerId) {
+        // CLOSING THIS STREAM IS WHAT KEEPS THE SESSION ALIVE PAST ITS 33RD MESSAGE.
+        //
+        // Every content frame and every delivery ACK opens a fresh /cello/content/1.0.0 stream on the
+        // one muxed connection the session holds, and libp2p caps INBOUND streams per protocol per
+        // connection. It enforces that cap AFTER multistream-select has answered, so an over-cap stream
+        // negotiates fine and is reset an instant later, and the SENDER's next `stream.send(...)`
+        // throws "Cannot write to a stream that is closed" — an error that names the exit point and not
+        // one thing about the cause.
+        //
+        // A stream leaves the muxer's set only on its `close` event, and closing our write end triggers
+        // that only once the peer has closed its end too. So a handler that reads its frame and returns
+        // leaves the stream half-open for the life of the connection and the count only ever rises.
+        // Measured on a live daemon: 115 failures over 3.5 hours, with EXACTLY 32 successful streams
+        // before the first one on both affected sessions (M12B Entry 10).
+        //
+        // The decoder is built INSIDE the try so a malformed stream cannot throw past the close below.
+        let iter;
+        try {
+            iter = lp.decode(stream)[Symbol.asyncIterator]();
+            const result = await iter.next();
+            if (result.done || result.value === undefined)
+                return;
+            const bytes = result.value instanceof Uint8Array ? result.value
+                : Buffer.isBuffer(result.value) ? new Uint8Array(result.value)
+                    : result.value.slice();
+            const frame = decode(bytes);
+            const correlationId = typeof frame["correlation_id"] === "string" ? frame["correlation_id"] : undefined;
+            const frameType = typeof frame["type"] === "string" ? frame["type"] : "(absent)";
+            /**
+             * DOD-M15-FRAME-1 — ONE GATE, BEFORE THE DISPATCH, FOR EVERY FRAME ON THIS PROTOCOL.
+             *
+             * A stranger could dial an agent's standing receiver (it admitted everyone until DOD-M15-ASSIGN-1), hold
+             * the connection open through promotion — libp2p's gater runs only at connection
+             * establishment, so narrowing it does not evict anyone already attached — and then speak the
+             * content protocol the moment it activated. The frame was ingested, leafed, transcribed, and
+             * attributed to the legitimate counterparty, because attribution is read from local session
+             * state rather than from anything the frame proved.
+             *
+             * DELIBERATELY SHARED RATHER THAN COPIED INTO EACH BRANCH. `session_abandoned_notice` already
+             * had both checks, correct and complete, twenty lines below — and the other two frame types
+             * did not. Copying the pattern a third and fourth time would fix today's three and leave the
+             * fifth frame type, added later by someone who did not read this comment, unguarded again.
+             * Placing it above the dispatch makes the guard the DEFAULT: a new frame type is protected by
+             * construction and has to opt OUT visibly rather than opt in silently.
+             *
+             * Verified safe for all three current types by enumeration, not assumption — `content_frame`
+             * (:5169), `session_abandoned_notice` (:6663) and `content_delivery_ack` (:7439) are the only
+             * senders on `CELLO_CONTENT_PROTOCOL_ID`, and all three put `session_id` in the frame.
+             *
+             * MISSING, MALFORMED AND MISMATCHED TAKE ONE PATH. An attacker evading a mismatch check does
+             * not send a wrong value — it sends no value, and a guard that only fires on a present-and-
+             * wrong field is a guard that is trivially skipped. That is exactly what the old
+             * `content_frame` check did: `typeof x === "string" && x !== sessionId`.
+             */
+            const expectedPeer = this.#activeNodes.get(this.#k(agentName, sessionId))?.counterpartySessionPeerId;
+            if (!remotePeerId || !expectedPeer || remotePeerId !== expectedPeer) {
+                // Loud in the LOG — there is no caller to answer on an inbound stream, so this is the whole
+                // surface. Neutral wording: this is an observation, not a verdict about intent. The same
+                // signal comes from a real impersonation attempt and from our own fallback paths
+                // mishandling a reconnect, and nothing here can tell them apart.
+                this.#logger.warn("session.content.peer_mismatch", {
+                    agentName, sessionId, frameType,
+                    remotePeerId: remotePeerId ?? "(absent)", expected: expectedPeer ?? "(unknown)",
+                    impact: "a frame arrived on this session's content protocol from a peer that is not its counterparty; it was refused — not ingested, not attributed, not recorded — and the peer was disconnected",
+                });
+                /**
+                 * PEER-ENDING, NOT SESSION-ENDING — and the difference is a deliberate deviation from the
+                 * DoD clause (review F2).
+                 *
+                 * The clause says the refusal is session-ending. Applied HERE that would be a worse hole
+                 * than the one it closes: a pre-positioned stranger could kill any session on the machine
+                 * with a single frame, trading an injection hole for a denial-of-service hole. The
+                 * session-ending response belongs where the evidence is about the SESSION's counterparty —
+                 * `#freezeOnIdentityFailure`, reached when a party that IS the peer we dialled signs with a
+                 * key that is not theirs.
+                 *
+                 * Here the evidence is about the PEER: they are not party to this session at all. So the
+                 * connection goes and the session is untouched. Without this the stranger stayed attached
+                 * for the life of the session and the gate re-refused each frame forever — and the eviction
+                 * sweep's own fallback ("the frame gate still refuses anything this peer sends") only closes
+                 * the loop if the frame gate does something about the connection.
+                 *
+                 * Fire-and-forget: a hang-up that fails must not turn a successful refusal into a thrown
+                 * handler, and the refusal above has already done the load-bearing work.
+                 */
+                if (remotePeerId) {
+                    const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+                    void entry?.node.hangUp(remotePeerId).catch((err) => {
+                        this.#logger.debug("session.content.peer_mismatch.hangup_failed", {
+                            sessionId, peerId: remotePeerId, error: extractErrorMessage(err),
+                        });
+                    });
+                }
+                return;
+            }
+            const claimedSessionId = frame["session_id"];
+            if (typeof claimedSessionId !== "string" || claimedSessionId !== sessionId) {
+                this.#logger.warn("session.content.session_mismatch", {
+                    agentName, sessionId, frameType,
+                    claimedSessionId: typeof claimedSessionId === "string" ? claimedSessionId : "(absent)",
+                    impact: "the frame does not name the session whose stream it arrived on; it was refused rather than routed, because the authenticated stream is the better authority for where content belongs",
+                });
+                return;
+            }
+            // CELLO-M7-MSG-001 (AC-001/AC-002): a `persisted` delivery ACK arriving on the
+            // same /cello/content/1.0.0 protocol resolves the sender's awaiting-ACK timer.
+            // The protocol acts on `persisted` ONLY — any other level leaves the timer armed.
+            if (frame["type"] === "content_delivery_ack") {
+                const ackHash = frame["content_hash"];
                 const level = frame["level"];
                 if (ackHash instanceof Uint8Array && level === "persisted") {
                     this.#resolveAwaitingAck(agentName, sessionId, ackHash);
@@ -7042,36 +9720,41 @@ export class SessionNodeManager {
             // authenticated stream the delivery acknowledgement rides, and AFTER the session-id check
             // below cannot be skipped — the frame names its session and the handler is bound to one.
             if (frame["type"] === "session_abandoned_notice") {
-                // PINNED TO THE COUNTERPARTY. This frame ENDS a conversation, so the stream being
-                // authenticated is not enough — a session node is a promoted standing receiver, and a
-                // standing receiver accepts everyone. libp2p's gater runs at connection establishment and
-                // does not close connections that already exist, so a peer that dialled this node earlier
-                // still holds a live connection after `setAllowedPeer` narrows it. Without this check that
-                // peer could hang up a session it is not party to.
-                //
-                // `remotePeerId` is the Noise-authenticated transport identity, which the handler was
-                // throwing away. Absent means we cannot prove who is speaking, and an unprovable claim to
-                // end a session is refused.
-                const expected = this.#activeNodes.get(this.#k(agentName, sessionId))?.counterpartySessionPeerId;
-                if (!remotePeerId || !expected || remotePeerId !== expected) {
-                    this.#logger.warn("session.content.peer_mismatch", {
-                        sessionId, frameType: "session_abandoned_notice",
-                        remotePeerId: remotePeerId ?? "(absent)", expected: expected ?? "(unknown)",
-                    });
-                    return;
-                }
-                // REQUIRED and equal — absence is not a pass. The frame names its session and the handler
-                // is bound to one; treating a missing field as agreement is how a guard stops guarding.
-                const claimed = frame["session_id"];
-                if (typeof claimed !== "string" || claimed !== sessionId) {
-                    this.#logger.warn("session.content.session_mismatch", {
-                        sessionId, claimedSessionId: typeof claimed === "string" ? claimed : "(absent)",
-                    });
-                    return;
-                }
+                // DOD-M15-FRAME-1: the peer and session checks that used to live here now run above, for
+                // EVERY frame type, unchanged in substance — this branch was where they were written first
+                // and correctly, and it is the reference the shared gate was lifted from. Its comment is
+                // preserved there, including the reason the transport being authenticated is not enough.
+                // Left as a bare dispatch on purpose: a second copy of a guard is a second thing to keep in
+                // step, and the one that drifts is the one nobody is reading.
                 void this.retireOnCounterpartyAbandon(agentName, sessionId, correlationId);
                 return;
             }
+            /**
+             * DOD-M15-SEALWIRE-1 bullet 6 (part A) — the salt agreement.
+             *
+             * Placed BELOW the shared peer/session gate deliberately, which is the whole reason that gate
+             * was lifted above the dispatch: a new frame type is protected by construction rather than
+             * having to remember to opt in. A stranger's salt frame is refused before it reaches here, so
+             * nothing about this session's salt can be steered by a peer that is not its counterparty.
+             *
+             * The fields are read defensively into the frame shape rather than cast: an inbound value is
+             * whatever a peer chose to encode, and `onPeerSaltFrame` refuses both-fields and neither-field
+             * by name — so a non-Uint8Array in either slot must arrive at that function as ABSENT, not as
+             * a present-but-wrong value it would then try to use.
+             */
+            if (frame["type"] === "session_salt_agreement") {
+                const contribution = frame["contribution"];
+                const fingerprint = frame["fingerprint"];
+                const adoptionClosed = frame["adoption_closed"];
+                await this.#handleSaltFrame(agentName, sessionId, {
+                    ...(contribution instanceof Uint8Array ? { contribution } : {}),
+                    ...(fingerprint instanceof Uint8Array ? { fingerprint } : {}),
+                    // A non-string stays ABSENT rather than being coerced, exactly like the other two: the
+                    // decision function refuses a shape it cannot read, and must never be handed a `"42"`.
+                    ...(typeof adoptionClosed === "string" && adoptionClosed.length > 0 ? { adoptionClosed } : {}),
+                }, correlationId);
+                return;
+            }
             if (frame["type"] !== "content_frame") {
                 // LOGGED, not silently dropped. This handler is bound to one session, and a frame it does
                 // not understand arriving on that stream is either a peer speaking a newer protocol or a
@@ -7083,25 +9766,11 @@ export class SessionNodeManager {
                 });
                 return;
             }
-            // THE FRAME NAMES ITS SESSION, and until now nothing checked it.
-            //
-            // The stream binding decides where content lands, so the field was decorative — which is the
-            // problem. A peer holding TWO sessions with us could put content addressed to one on the
-            // other's stream and it was ingested, leafed, transcribed and SEALED under the wrong record.
-            // The sealed transcript is the artifact this protocol exists to produce; a message in it that
-            // its own author addressed elsewhere is exactly the thing it must not contain.
-            //
-            // Refused rather than re-routed: routing it to the session it names would honour a claim made
-            // by the party whose frame arrived in the wrong place, and the stream — which is authenticated
-            // — is the better authority. Refusing leaves the sender to redeliver on the right one.
-            const framedSessionId = frame["session_id"];
-            if (typeof framedSessionId === "string" && framedSessionId !== sessionId) {
-                this.#logger.warn("session.content.session_mismatch", {
-                    sessionId,
-                    claimedSessionId: framedSessionId,
-                });
-                return;
-            }
+            // DOD-M15-FRAME-1: the session-id check moved to the shared gate above, and its `&&` became
+            // `||` on the way. It read `typeof x === "string" && x !== sessionId` — firing only when the
+            // field was PRESENT and wrong, so omitting it passed. Its own sibling twenty lines up already
+            // refused absence, with a comment saying treating a missing field as agreement is how a guard
+            // stops guarding. Same file, same switch, opposite conclusion.
             const contentBytes = frame["content_bytes"];
             const contentHash = frame["content_hash"];
             if (!(contentBytes instanceof Uint8Array) || !(contentHash instanceof Uint8Array)) {
@@ -7118,17 +9787,70 @@ export class SessionNodeManager {
             // DOD-MSG-4 (self-ordering content frame): if the frame carries the relay's signed ordering
             // record, verify the sender signature and record the canonical sequence FROM THE FRAME, BEFORE
             // ingest — so the strict-in-order gate has the position without waiting on the separate
-            // leaf_deliver witness (removes the content-before-witness race). A bad/absent record is
-            // non-fatal: the content still ingests, ordered by the witness stream / arrival as before.
+            // leaf_deliver witness (removes the content-before-witness race).
+            //
+            // DOD-M15-FRAME-1 — POSITION MAY BE SOFT; IDENTITY MAY NOT. The old comment here read "A
+            // bad/absent record is non-fatal: the content still ingests", and it was accurate: a
+            // signature that failed to verify, and a signature by a key that is NOT this session's
+            // counterparty, both returned null and the content was ingested and attributed anyway. An
+            // ABSENT record stays soft — that is the documented relay-degraded path and refusing it would
+            // make the relay a precondition for reading mail. A record that is PRESENT and REFUTED is a
+            // different fact, and it is now refused.
             const s1Cbor = frame["structure1_cbor"];
             const s2Cbor = frame["structure2_cbor"];
             let framedSeq = null;
+            /**
+             * DOD-M15-SEALWIRE-1 bullet 5. Set ONLY when the ordering record verified — the signature
+             * checked against the pubkey inside the sender's own signed bytes AND the signer matched this
+             * session's counterparty. It is deliberately NOT set on the two soft paths below (no record
+             * supplied; decode failed), because on those the author is attested by local session state
+             * and the transcript row must say so rather than imply a proof it does not have.
+             */
+            let verifiedAuthorship;
             if (s1Cbor instanceof Uint8Array && s2Cbor instanceof Uint8Array) {
-                framedSeq = this.#recordFrameOrdering(agentName, sessionId, s1Cbor, s2Cbor, contentHash, correlationId);
+                const ordering = this.#recordFrameOrdering(agentName, sessionId, s1Cbor, s2Cbor, contentHash, correlationId);
+                if (ordering.fatal) {
+                    await this.#freezeOnIdentityFailure(agentName, sessionId, ordering.fatal.reason, correlationId);
+                    return;
+                }
+                framedSeq = ordering.seq;
+                if (ordering.senderPubkey !== undefined && ordering.senderSig !== undefined) {
+                    verifiedAuthorship = { senderPubkey: ordering.senderPubkey, senderSig: ordering.senderSig };
+                }
+            }
+            else {
+                /**
+                 * Review F3 — THE WEAKER GUARANTEE MUST NOT BE INDISTINGUISHABLE FROM THE STRONGER ONE.
+                 *
+                 * A frame with no ordering record is still ingested, and that is correct: it is the
+                 * documented relay-degraded path, and refusing it would make the relay a precondition for
+                 * reading mail. But it means the per-message signer check is **opt-in for the sender** — a
+                 * party that passed the peer gate and wants to avoid the comparison simply omits the proof.
+                 * Silently, until now: nothing recorded that a message arrived unverified, so the log looked
+                 * identical to one where every message had been checked.
+                 *
+                 * Not fatal, and deliberately not: an absent record proves nothing about the signer, and
+                 * refusing on an absence would strand every relay-degraded session. What closes the omission
+                 * case is relay-side corroboration — `DOD-M15-CORROBORATE-1` — where the relay holds the
+                 * sender's signed hash independently and never routes it through this daemon.
+                 */
+                this.#logger.info("session.content.ordering.absent", {
+                    agentName, sessionId, correlationId,
+                    impact: "this frame carried no signed ordering record, so its SIGNER was not verified for this message — it was ingested on the strength of the authenticated transport alone",
+                });
             }
             // AC-001: carry the sender's correlationId from the frame into the receive
             // path so both sides log the same flow id (never re-minted on receipt).
-            const ingest = await this.ingestReceivedContent(agentName, sessionId, contentBytes, contentHash, correlationId, framedSeq ?? undefined);
+            /**
+             * DOD-M15-SEALWIRE-1 part B1 — the algorithm the sender named, taken from the FRAME.
+             *
+             * Read as `unknown` and passed through verbatim, deliberately: `resolveContentHashAlg` is the
+             * one place that decides what a value means, and it distinguishes ABSENT (a peer predating
+             * the field — verify as `sha256`) from a non-string or an unreadable name (refuse by name).
+             * Coercing here would collapse that distinction and turn a version skew into a tamper report.
+             */
+            const declaredAlg = frame["content_hash_alg"];
+            const ingest = await this.ingestReceivedContent(agentName, sessionId, contentBytes, contentHash, correlationId, framedSeq ?? undefined, declaredAlg === undefined ? undefined : declaredAlg, verifiedAuthorship);
             // AC-001: after the content is durably ingested AND its hash cross-check
             // succeeds, emit an unsigned `persisted` delivery ACK back to the sender. A
             // rejected ingest (tamper / not-active) produces NO ACK, so the sender's TTF
@@ -7789,7 +10511,9 @@ export class SessionNodeManager {
         const sessionId = `standing_receiver_${randomUUID()}`;
         const gater = new SessionConnectionGater({
             sessionId,
-            allowedPeerId: null, // open — counterparty unknown at creation time
+            // No named peer: admits NOBODY inbound until a session offer names the dialer, while leaving
+            // this node's own outbound errands open (DOD-M15-ASSIGN-1). It does NOT mean "open".
+            allowedPeerId: null,
             logger: this.#logger,
         });
         // DOD-NAT-REACHABILITY-1: reserve with the agent's known relays. The relay
@@ -7882,6 +10606,10 @@ export class SessionNodeManager {
         const reservedRelayPeerId = circuitAddrs > 0
             ? (heldCircuitAddr?.match(CIRCUIT_RELAY_ID)?.[1] ?? reservations.addrs[0]?.match(CIRCUIT_RELAY_ID)?.[1])
             : undefined;
+        // DOD-M15-ASSIGN-1 review N3: the ONE relay this receiver actually reserved with earns the
+        // inbound AutoNAT carve-out — nothing else does. Set only when a reservation genuinely
+        // completed, so a directory that merely NAMES a relay cannot dial in behind it.
+        gater.setReservedRelayPeer(circuitAddrs > 0 && reservedRelayPeerId !== undefined ? reservedRelayPeerId : null);
         this.#standingReceivers.set(agentName, {
             node,
             gater,
@@ -8207,9 +10935,47 @@ export class SessionNodeManager {
         const live = this.#activeNodes.get(key);
         if (live)
             return { ok: true, peerId: live.node.getPeerId() };
+        // PARITY with `acceptSession` — and the parity guard in msg-022 is what caught its absence.
+        // A revived session's offer record has almost always been cleared already (it was cleared when
+        // the session was first accepted), so this is usually a no-op. It is here because "usually a
+        // no-op" is not a reason for establishment and revival to do different things: every divergence
+        // between those two paths in this file has been a defect, and the guard exists because one of
+        // them shipped past a green suite for two days.
+        this.clearOfferedDialer(agentName, sessionId);
         const record = this.getSessionRecord(agentName, sessionId);
         if (!record)
             return { ok: false, reason: "session_not_found" };
+        /**
+         * A REVIVED SESSION GETS ITS SEAL CHANCES BACK — `DOD-M15-SEAL-FAILED-TERMINAL-1` review
+         * MEDIUM-6, and without this a receipt can be lost permanently and silently.
+         *
+         * `restart_seal_gave_up_at` is written when the restart resolver exhausts its attempts, and
+         * NOTHING ever cleared it. Its stated purpose is narrow — *"a machine restarting ~6 times a day
+         * must not re-run five ceremonies against a hopeless session on every boot"* — and a session
+         * being revived is the opposite of hopeless: something is talking to it again.
+         *
+         * The path it closes: resolver gives up → the column is stamped → the session is REVIVED and
+         * carries live traffic → it is closed → the background ceremony dies → the in-memory failure
+         * marker is lost at the next restart → `listRestartOrphanedSessions` excludes the row forever on
+         * this column → and `listExpiredUnrevivableSessions` explicitly INCLUDES
+         * `restart_seal_gave_up_at IS NOT NULL`, so the revival sweep force-abandons it. Receipt gone,
+         * with no surface having ever said so.
+         *
+         * Bounded, because revival is not a boot-loop: it takes a live counterparty or an operator read.
+         */
+        // One statement, gated in SQL rather than on a field: `SessionRecord` does not carry this column
+        // and widening the type to read it once would spread it through every consumer. `changes` tells
+        // us whether it actually cleared, so the log stays a signal instead of firing on every revival.
+        const clearedGaveUp = this.#db
+            ?.prepare("UPDATE sessions SET restart_seal_gave_up_at = NULL, restart_seal_gave_up_reason = NULL " +
+            "WHERE agent_id = ? AND session_id = ? AND restart_seal_gave_up_at IS NOT NULL")
+            .run(this.resolveAgentId(agentName), sessionId);
+        if ((clearedGaveUp?.changes ?? 0) > 0) {
+            this.#logger.info("session.restart_seal.gave_up.cleared", {
+                agentName, sessionId,
+                impact: "this session is eligible for restart-seal recovery again — it is being revived, so it is not hopeless.",
+            });
+        }
         if (record.status === "sealed" || record.status === "abandoned" || record.status === "seal_interrupted_pending") {
             return {
                 ok: false,
@@ -8217,6 +10983,39 @@ export class SessionNodeManager {
                 guidance: `Session is '${record.status}'. A session that has ended cannot be revived; start a new one.`,
             };
         }
+        /**
+         * DOD-M15-FRAME-1 (review F1) — A DEFENSIVE FREEZE MUST NOT UNDO ITSELF ON THE NEXT READ.
+         *
+         * `#freezeOnIdentityFailure` tears the node down, and a teardown writes status `interrupted`.
+         * `interrupted` is not terminal — it is the *revivable* status — so `reviveIfNeededForRead`
+         * fired on the operator's very next `cello_receive`, rebuilt a node behind a gater allowing the
+         * SAME counterparty peer, flipped the row back to `active`, and logged it as a success.
+         *
+         * The freeze therefore lasted until the next keystroke, while the log line said *"no further
+         * content will be accepted on this session"*. A security decision that silently reverses itself,
+         * with a message asserting the opposite, is a worse defect than the one the freeze was added to
+         * fix — and it is the class this milestone exists to remove, reintroduced by its own fix.
+         *
+         * Checked BEFORE the cap and after the terminal statuses, so the answer names the freeze rather
+         * than whatever else the session would have been refused for.
+         *
+         * In memory, and so lost on a daemon restart — the same bound as `DOD-M15-DIVERGE-DURABLE-1`
+         * and for the same reason. The durable column is `DOD-M15-FREEZE-STATUS-1`; the reversibility
+         * could not wait for it.
+         */
+        const frozen = this.#frozenSessions.get(key);
+        if (frozen) {
+            // The REASON and the GUIDANCE both come from the site that froze it. Hardcoding them here was
+            // correct while an identity failure was the only way in, and became a false accusation the
+            // moment a second one existed — see the note on `#frozenSessions`.
+            return {
+                ok: false,
+                reason: frozen.reason,
+                guidance: `${frozen.guidance} It is not revived automatically, and reading or sending will not clear it. ` +
+                    `Your transcript up to the freeze is intact: cello_transcript ${sessionId} reads it. ` +
+                    `To end the session and keep what it earned, close it — cello_close_session ${sessionId}. To talk to them again, start a fresh session rather than reviving this one.`,
+            };
+        }
         /**
          * THE CAP APPLIES TO A REVIVAL TOO (review: parity gap). Establishment refuses at
          * `MAX_SESSION_NODES` because each node is a real libp2p instance with listeners, connections
@@ -8767,6 +11566,19 @@ export class SessionNodeManager {
          */
         if (status === "sealed" || status === "abandoned") {
             this.#destroySessionSeed(agentName, sessionId);
+            // DOD-M15-DIVERGE-1: divergence stops being true HERE and only here. It used to be dropped by
+            // `#evictSessionCaches` on every node teardown — including the one that writes `interrupted`,
+            // which is a status the seal gate still acts on, so the fact was forgotten while it was still
+            // load-bearing. A terminal status is the one point at which no future close can be refused,
+            // so the flag has nothing left to protect.
+            this.#diverged.delete(this.#k(agentName, sessionId));
+            // DURABLE too (DOD-M15-DIVERGE-DURABLE-1) — otherwise a sealed session comes back after a
+            // restart still carrying a refusal for a close that can no longer happen.
+            // (agent_id, session_id) — see markSessionDiverged. Unkeyed, one side sealing cleared the
+            // OTHER side's divergence on a loopback session.
+            this.#db
+                ?.prepare("UPDATE sessions SET diverged_at = NULL WHERE agent_id = ? AND session_id = ?")
+                .run(this.#requireAgentId(agentName), sessionId);
         }
         // THE TERMINAL GUARD LIVES HERE, not in one wrapper, because there are three writers of
         // "sealed": markSealed, destroySessionNode, and retireSession on the witnessed-submit path.