@cello-protocol/daemon 0.0.180 → 0.0.182

package/dist/daemon.js

@@ -27,6 +27,7 @@
  */
 import { mkdir } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { dirname, join } from "node:path";
 import { loadAgents } from "./agent-loader.js";
 import { RestartSealResolver } from "./restart-seal-resolver.js";
@@ -35,13 +36,18 @@ import { acquireLock, removeLockIfOwned } from "./lock-file.js";
 import { acquireSingletonLock } from "./singleton-lock.js";
 import { createIpcServer } from "./ipc-server.js";
 import { renderForSurface } from "./vocabulary.js";
+import { RandomizedPollScheduler } from "./manifest-poll-scheduler.js";
+import { startManifestValidityWatch, classifyManifestValidity, describeManifestValidity } from "./manifest-validity.js";
+import { describeDirectoryAuth, directoryAuthRequired } from "./directory-auth-posture.js";
+import { SealFailureStore } from "./seal-failure-store.js";
+import { startRosterSweep, classifyRosterReading, describeRosterFreshness, ROSTER_SWEEP_INTERVAL_MS, } from "./roster-freshness.js";
 import { SessionNodeManager, REVIVAL_WINDOW_MS, REVIVAL_BOUND_SWEEP_MS } from "./session-node-manager.js";
 import { registerGatewayConfigHandlers } from "./gateway-config-handlers.js";
 import { RetryQueue } from "./retry-queue.js";
 import { NonceDedupStore } from "./nonce-dedup.js";
 import { ContentParkClient } from "./content-park-client.js";
 import { NotificationDispatcher } from "./notification-dispatcher.js";
-import { createNode, SignalingManager } from "@cello-protocol/transport";
+import { createNode, SignalingManager, } from "@cello-protocol/transport";
 import { createSignalingConnect } from "./signaling-connect.js";
 import { DbRegistrationPersistence, DbIdentityStore } from "./db-identity-store.js";
 import { DbManifestVersionStore } from "./manifest-version-store-db.js";
@@ -55,7 +61,7 @@ const MAX_SUBMISSION_BODY_CHARS = 4000;
 // CELLO-M7-MSG-001 (AC-013/AC-018): the single application content-size cap, enforced
 // at the send point here (the receive point lives in the transport content decode).
 import { sealParkEnvelope } from "./park-envelope.js";
-import { AgentRelayClient, extractErrorMessage } from "./session-relay-client.js";
+import { LEAF_KIND_MSG, AgentRelayClient, extractErrorMessage } from "./session-relay-client.js";
 import { createReconnectDrain } from "./reconnect-drain.js";
 import { resolveCelloEnv, createTransportSelector, isProductionVariant, } from "./transport-composition.js";
 import { whoLabel } from "./who-label.js";
@@ -68,8 +74,13 @@ import { createSealCoordinator } from "./seal-coordinator.js";
 import { createTelegramDoorbell } from "./telegram-doorbell.js";
 import { registerSessionContentHandlers } from "./session-content-handlers.js";
 import { createDocumentLayer, agentPublicKeyFromId } from "./document-layer.js";
+import { isDocumentFrame } from "./document-frame-router.js";
+import { INBOUND_INJECTION_BLOCKED } from "@cello-protocol/gateway";
 import { registerDocumentHandlers } from "./document-handlers.js";
-import { wireContentHash } from "./wire-content-hash.js";
+// `wireContentHash` is no longer imported here: every outbound hash in this file now comes from
+// `SessionNodeManager.contentHashForSession`, which returns the hash and its ALGORITHM together
+// (`DOD-M15-SEALWIRE-1` part B2b). A direct call would be a hash computed without deciding — or
+// recording — how it was made, which is the state that made a version skew look like a tamper.
 import { DocumentPublish } from "./document-publish.js";
 import { createDocumentDeliveryTransport } from "./document-delivery-transport.js";
 import { ReconcileScheduler } from "./document-reconcile-scheduler.js";
@@ -79,6 +90,9 @@ import { createInboundSessions } from "./inbound-sessions.js";
 import { createOutboundSessions } from "./outbound-sessions.js";
 import { registerSessionReadHandlers } from "./session-read-handlers.js";
 import { pullSealCertificate } from "./seal-certificate-pull.js";
+import { createBackup, inspectBackup } from "./backup-restore.js";
+import { resolveCurrentAgentFor } from "./agent-selection.js";
+import { REFUSAL_REASONS, CAPACITY_REASONS } from "./refusal-reasons.js";
 import { revocabilityOf } from "./signal-revocability.js";
 import { registerAgentHandlers } from "./agent-handlers.js";
 import { registerRegisterHandler } from "./register-handler.js";
@@ -107,6 +121,20 @@ const SESSION_NODE_KEY_STUB = {
 };
 // Production session node factory — wraps createNode from @cello-protocol/transport
 export class ProductionSessionNodeFactory {
+    logger;
+    /**
+     * DOD-M15-IDLE-CONNS-1 — OPTIONAL, and optional for one reason only: this factory is constructed
+     * with no arguments in four existing tests, and requiring a logger would turn them into type
+     * errors for a unit that has nothing to do with them.
+     *
+     * The cost is stated rather than hidden: with no logger, a reaped connection is silent, which is
+     * exactly the "guard nobody hears" this milestone has found four times. `startDaemon` passes one
+     * — that is the production path — and the sweep only runs on nodes this factory builds as
+     * receivers, so the silent case is a test-only fixture.
+     */
+    constructor(logger) {
+        this.logger = logger;
+    }
     async createNode(config) {
         // DOD-NAT-REACHABILITY-1: the STANDING RECEIVER — the node that accepts every
         // inbound session — must bind a ROUTABLE interface by default. The old
@@ -143,6 +171,106 @@ export class ProductionSessionNodeFactory {
             // than passed as undefined) when absent, keeping createNode's "generate a fresh key" default
             // for every node that is not session-scoped.
             ...(config.transportPrivateKey ? { transportPrivateKey: config.transportPrivateKey } : {}),
+            /**
+             * DOD-M15-IDLE-CONNS-1 — the idle sweep is armed on the node that STARTS as a standing
+             * receiver.
+             *
+             * **It is NOT "the standing receiver only", and an earlier version of this comment said so
+             * and was false.** `acceptSession` does not build a new node: it moves this same `CelloNode`
+             * from `#standingReceivers` into `#activeNodes`, so the interval keeps running after
+             * promotion, against the session's own counterparty. Review measured the consequence — the
+             * counterparty was hung up mid-conversation and the next send failed with `no_connection`,
+             * with nothing anywhere naming the local sweep.
+             *
+             * That is survivable only because the spared predicate below names the counterparty. The
+             * arrangement is deliberate now rather than accidental: one node, one interval, and the gate
+             * decides who is off-limits as it narrows.
+             */
+            ...(isReceiver
+                ? {
+                    idleConnectionReaper: {
+                        /**
+                         * C3 — THE GUARD IS HEARD. A hang-up that tells nobody is indistinguishable from the
+                         * thing simply not happening, and review measured what that costs: the operator's
+                         * next send returns `no_connection`, `session.transport.redial.unavailable` says
+                         * "every send parks until they re-establish", and not one word in that chain names a
+                         * `setInterval` on their own machine.
+                         *
+                         * WARN and CONTINUE, deliberately: this is resource bounding, not a security event.
+                         * Nothing is refused and no session state changes — so it is loud, and it does not
+                         * block (Invariant 2's own distinction).
+                         */
+                        onReaped: (e) => {
+                            if (e.reason === "never_carried_a_stream") {
+                                this.logger?.warn("session.node.connection.reaped", {
+                                    sessionId: config.sessionId,
+                                    peerId: e.peerId,
+                                    ageMs: e.ageMs,
+                                    observation: "an inbound connection was hung up after never carrying a stream since it opened",
+                                    impact: "no session state changed and nothing was refused; if this peer returns it must dial again",
+                                });
+                                return;
+                            }
+                            // A sweep that cannot do its job is a different event and must not read as one that
+                            // did. `hangUp`'s `invalid_peer_id` is a NAMED reason written so a malformed id is
+                            // not read as a connection problem — preserved here rather than flattened.
+                            this.logger?.error("session.node.connection.reap_failed", {
+                                sessionId: config.sessionId,
+                                peerId: e.peerId,
+                                reason: e.reason,
+                                error: e.error,
+                                impact: "an idle connection was NOT closed; it continues to hold a slot against the connection cap",
+                            });
+                        },
+                        /**
+                         * C4 — THE COUNT THE DoD ASKS FOR, and the reason this callback exists at all.
+                         *
+                         * The line says *"measure a healthy daemon's connection count first"*, and nothing in
+                         * the tree reported one — not `cello_status`, not the CLI, not the log. Exposing the
+                         * CAPS without the COUNT would have been a capability nothing reads, which is this
+                         * milestone's own "no consumer, no ship". DEBUG because it is a census on a timer,
+                         * not an event: it exists to be greppable when a cap is finally tuned.
+                         */
+                        onObserved: (c) => {
+                            this.logger?.debug("transport.connections.observed", {
+                                sessionId: config.sessionId,
+                                total: c.total,
+                                inbound: c.inbound,
+                                neverSpoke: c.neverSpoke,
+                                maxConnections: c.maxConnections,
+                            });
+                        },
+                    },
+                }
+                : {}),
+        }).then((node) => {
+            /**
+             * SPARE WHAT REACHABILITY DEPENDS ON — two things, and the second was missing.
+             *
+             * **The reserved relay.** The same list `DOD-M15-FRAME-1`'s eviction sweep spares, for the
+             * reason its comment gives: reservation refreshes ride those peers, and hanging one up costs
+             * the agent its inbound reachability. A reservation is IDLE BY NATURE between refreshes,
+             * which is exactly the shape the sweep hunts.
+             *
+             * **The peer the gate currently names.** `getAllowedPeerId()` is the admitted dialer before
+             * promotion and the counterparty after it. Without this the sweep reaps the one peer the
+             * session exists for.
+             *
+             * READ LIVE on every sweep, never captured: reservations are lost and retaken constantly
+             * (2,675 `reservation.lost` in one daemon's log) and `#allowedPeerId` changes at offer,
+             * promotion and refusal. A set frozen at build time is wrong within minutes.
+             *
+             * WHAT IS LEFT TO REAP, stated because a guard with no population is theatre: a peer that was
+             * admitted by an offer which was then refused or expired. `closeInbound()` returns
+             * `#allowedPeerId` to null, and libp2p never re-runs a gater against a connection that
+             * already exists — so that peer stays attached, named by nobody, speaking nothing. That is
+             * the connection this unit removes.
+             */
+            const gater = config.connectionGater;
+            if (isReceiver && gater) {
+                node.setIdleReaperSpared((peerId) => gater.isAllowedOutboundPeer(peerId) || gater.getAllowedPeerId() === peerId);
+            }
+            return node;
         });
     }
 }
@@ -193,6 +321,43 @@ async function startDaemonHoldingLock(config, singletonLock) {
     if (manifestProvider && (!manifestRootKeys || !manifestThreshold || manifestThreshold <= 0)) {
         throw new Error("DaemonConfig: manifestProvider requires manifestRootKeys (non-empty) and manifestThreshold (positive integer >= 1)");
     }
+    /**
+     * DOD-M15-DIRAUTH-1 — an operator can DEMAND directory identity authentication.
+     *
+     * HERE, under the ADV-006/008 rule above, because this IS pure config validation: both operands
+     * are already in hand and it touches nothing.
+     *
+     * Review F1 caught me putting it ninety lines lower, next to ADV-002, on the reasoning that it
+     * "mirrors" it. It does not. ADV-002 sits down there because it MUST — it depends on
+     * `verifyStartupManifest`, which depends on the anti-rollback floor in the DB. This depends on
+     * nothing, and down there it ran AFTER: the irreversible flat-file → SQLCipher identity migration
+     * (which renames and unlinks files), the creation of `sessions.db` and its key, and the sweep that
+     * marks every `active` session `interrupted` with `interrupted_by='local'`.
+     *
+     * So a misconfigured daemon "failed to start" and changed the operator's record on the way out —
+     * two live sessions permanently interrupted, attributed to a local cause, by a config check that
+     * could have run before anything was touched.
+     */
+    if (directoryAuthRequired(process.env) && challengeVerifier === undefined) {
+        const url = config.directoryHttpUrl ?? resolveDirectoryUrl(process.env);
+        logger.error("directory.auth.required.unavailable", {
+            directoryUrl: url,
+            impact: "the daemon refused to start rather than connect without directory identity authentication.",
+            guidance: "CELLO_REQUIRE_DIRECTORY_AUTH is set, but no challenge verifier could be built for this " +
+                "directory URL. Point CELLO_DIRECTORY_URL at a bundled endpoint, or supply a manifest with " +
+                "CELLO_CONSORTIUM_MANIFEST plus CELLO_CONSORTIUM_ROOT_KEYS and CELLO_CONSORTIUM_THRESHOLD " +
+                "(all three are required together), or set CELLO_REQUIRE_DIRECTORY_AUTH to 0/false/no/off " +
+                "to accept the risk.",
+        });
+        throw new Error(`CELLO_REQUIRE_DIRECTORY_AUTH is set, but directory identity authentication (step 6) cannot ` +
+            `be enforced: no challenge verifier was supplied for this daemon. The directory URL is ` +
+            `compared against the bundled consortium roster after NORMALISATION (trimmed, trailing slash ` +
+            `dropped, lowercased) — so case and a trailing slash are forgiven, but a DNS hostname ` +
+            `pointing at exactly the right machine is NOT, which is the usual cause. Either use a bundled ` +
+            `endpoint address, or supply a manifest with CELLO_CONSORTIUM_MANIFEST plus ` +
+            `CELLO_CONSORTIUM_ROOT_KEYS and CELLO_CONSORTIUM_THRESHOLD (all three are required together), ` +
+            `or set CELLO_REQUIRE_DIRECTORY_AUTH to 0/false/no/off to start without step 6.`);
+    }
     // ── PERSIST-002: open the encrypted store FIRST (runs the one-time flat-file → SQLCipher migration
     // (AC-006) + creates the agents/manifest_state schema), under the single-instance lock. This must
     // precede the manifest verification below because the manifest version is now stored in the
@@ -228,7 +393,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // screening, so a wiring mistake shows up here instead of hiding behind a correct-looking line.
     logger.info("security.gateway.connected", { mode: securityGateway.mode });
     const sessionNodeManager = new SessionNodeManager({
-        factory: sessionNodeFactory ?? new ProductionSessionNodeFactory(),
+        factory: sessionNodeFactory ?? new ProductionSessionNodeFactory(logger),
         logger,
         dbPath: join(celloDir, "sessions.db"),
         contentTtfMs: config.contentTtfMs,
@@ -248,6 +413,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
         manifestThreshold,
         manifestVersionStore,
         logger,
+        // DOD-M15-STALEROSTER-1: the same injected fetch the sweep uses, so the startup probe and the
+        // background probe are exercised through one seam rather than one being untestable.
+        ...(config.fetchFn ? { fetchFn: config.fetchFn } : {}),
     });
     // ADV-002: an operator who configures manifestProvider has opted INTO manifest enforcement, so a
     // failed verification is fatal — never a warning we start anyway on.
@@ -266,7 +434,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
             "Check the logs for the specific failure reason (manifest_signature_invalid, manifest_expired, or manifest_version_rollback).");
     }
     // The manifest poll starts only AFTER the refuse above — a refused startup must not leak a timer.
-    const { resolveConsortiumRoster, failoverEndpointResolver, getFailoverEndpoint, getUnresolvedNodes, getUnresolvedSweptAt, stopHttpManifestPoll } = createConsortiumRouting({
+    const { resolveConsortiumRoster, failoverEndpointResolver, getFailoverEndpoint, getUnresolvedNodes, getUnresolvedSweptAt, getDeclaredNodeCount, stopHttpManifestPoll } = createConsortiumRouting({
         manifestProvider,
         manifestRootKeys,
         manifestThreshold,
@@ -280,7 +448,96 @@ async function startDaemonHoldingLock(config, singletonLock) {
         initialUnresolvedNodes: startupUnresolvedNodes,
         initialUnresolvedSweptAt: startupSweptAt,
         logger,
+        ...(config.fetchFn ? { fetchFn: config.fetchFn } : {}),
     });
+    /**
+     * DOD-M15-STALEROSTER-1 — keep measuring directory reachability even when nothing is wrong.
+     *
+     * Every existing caller of the sweep is ACTIVITY-driven — ceremonies, session setup,
+     * `cello_refresh`, the seal broker. So an IDLE daemon never re-measures, and sitting idle is what
+     * a daemon does between conversations: the reading it was seeded with at boot is the reading it
+     * still has an hour later. Measured twice, on two machines — node failures from minutes past
+     * displayed while `curl` reached all three nodes in 37–184 ms.
+     *
+     * (An earlier version of this comment said the sweep had ONE caller, the failover path, and that
+     * recovering was what stopped the measurement. That was wrong — there are ten — and it is
+     * corrected here rather than deleted because believing it is why the concurrent-sweep race in
+     * `consortium-bootstrap.ts` went unnoticed until review.)
+     *
+     * Skipped when there is no manifest provider: there is no node roster to enumerate, so a timer
+     * that can only ever re-measure nothing is noise. That case is NOT silent — `cello_status`
+     * reports `measurement: "not_configured"` and says why.
+     */
+    /**
+     * WHERE the held manifest came from, because it decides what the operator can actually DO about
+     * an expired one — `DOD-M15-MANIFEST-EXPIRY-LIVE-1` review F5.
+     *
+     * `EmbeddedManifestProvider` is the compiled-in bundled roster: there is no file to replace and no
+     * poll to adopt a replacement, so "rotate the manifest" is not an available action and telling
+     * that operator to do it routes them toward the one workaround that silently disables directory
+     * identity authentication. Detected by the provider's own constructor rather than by re-reading
+     * the env var, so a caller that injects a provider directly is classified by what it IS.
+     */
+    const manifestOrigin = manifestProvider?.constructor?.name === "EmbeddedManifestProvider" ? "bundled" : "file";
+    /** REVIEW F4: the last sweep failure, surfaced in `cello_status` alongside the log line. */
+    let lastRosterSweepError;
+    /**
+     * DOD-M15-MANIFEST-EXPIRY-LIVE-1 — re-check the trust anchor's validity while the daemon runs.
+     *
+     * The window is enforced at STARTUP and nowhere else. The manifest poll's expiry check looks at
+     * the manifest being FETCHED, never the one held, so a daemon past its expiry keeps polling, keeps
+     * correctly refusing expired replacements, and keeps using the lapsed anchor it already has.
+     *
+     * Rides the roster sweep rather than owning a timer: that tick already fires every 90–180 s on
+     * exactly the path where a manifest provider exists.
+     */
+    const checkManifestValidity = startManifestValidityWatch({
+        getManifest: () => manifestProvider?.getCurrentManifest() ?? null,
+        logger,
+    });
+    const rosterSweepScheduler = manifestProvider
+        ? config.rosterSweepScheduler ??
+            new RandomizedPollScheduler({ minMs: ROSTER_SWEEP_INTERVAL_MS, maxMs: ROSTER_SWEEP_INTERVAL_MS * 2 })
+        : undefined;
+    const stopRosterSweep = rosterSweepScheduler
+        ? startRosterSweep({
+            scheduler: rosterSweepScheduler,
+            // FAST_PROBE is deliberately NOT used here. It exists because the failover resolver runs
+            // inside the 10 s signaling wait; nothing waits on this sweep, so it can afford the
+            // patient probe and give the more trustworthy answer.
+            sweep: async () => {
+                /**
+                 * DOD-M15-MANIFEST-EXPIRY-LIVE-1: the anchor's validity is re-checked on the same tick.
+                 * BEFORE the probe, so an expired manifest is reported even on a cycle where every node is
+                 * unreachable and the roster resolve throws.
+                 *
+                 * Its OWN try/catch — review F11. Sharing the sweep's error path meant a throw in here
+                 * would surface as `directory.roster.sweep.failed` AND skip `resolveConsortiumRoster()`
+                 * entirely: the roster reading would freeze while the operator was pointed at the
+                 * directory. A manifest-check failure must never be reported as a directory failure, and
+                 * must never cost the measurement it rides along with.
+                 */
+                try {
+                    checkManifestValidity();
+                }
+                catch (err) {
+                    logger.error("directory.auth.manifest.check.failed", {
+                        error: err instanceof Error ? err.message : String(err),
+                        impact: "the manifest validity re-check did not run this cycle. cello_status still computes " +
+                            "it independently on every read, so the FIELD is unaffected; what is lost is the " +
+                            "unprompted log line on a transition.",
+                    });
+                }
+                return resolveConsortiumRoster();
+            },
+            logger,
+            // REVIEW F4: the failure reaches the agent's response, not just the log. Without this a
+            // sweep failing every cycle is invisible for the first two or three failures, because the
+            // reading is still inside its 5-minute freshness bound and reports stale:false.
+            onSweepError: (e) => { lastRosterSweepError = e; },
+            onSweepSuccess: () => { lastRosterSweepError = undefined; },
+        })
+        : undefined;
     // DOD-REGISTRY-1: type registry poll — daemon-level, runs even with zero agents.
     // When registryPubkey is configured, the daemon polls GET /registry, verifies the inner
     // Ed25519 signature, and updates the in-memory TypeRegistry. A poll failure never blanks
@@ -578,6 +835,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName,
             persistence: getPersistence(agentName),
             agentPubkeyHex,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): the co-sign path must check the root before this
+            // agent's key endorses it. Same predicate as the receiving path — one implementation, so the
+            // two halves cannot drift about what a mismatch is.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: agentKeyProvider,
             getNode: entry.getNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -590,6 +851,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName,
             persistence: getPersistence(agentName),
             agentPubkeyHex,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): the co-sign path must check the root before this
+            // agent's key endorses it. Same predicate as the receiving path — one implementation, so the
+            // two halves cannot drift about what a mismatch is.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: agentKeyProvider,
             getNode: entry.getNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -604,6 +869,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
         wireSessionOfferHandler({
             agentName,
             getStandingReceiverEndpoint: () => sessionNodeManager.getStandingReceiverInfo(agentName),
+            admitOfferedDialer: (peerId, sessionIdHex) => sessionNodeManager.admitOfferedDialer(agentName, peerId, sessionIdHex),
             signaling: mgr,
             logger,
         });
@@ -652,6 +918,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName: agent.name,
             persistence: getPersistence(agent.name),
             agentPubkeyHex: agent.pubkey,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): gate the co-signature on the root check.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: agent.keyProvider,
             getNode: noSharedDirectoryNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -663,6 +931,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName: agent.name,
             persistence: getPersistence(agent.name),
             agentPubkeyHex: agent.pubkey,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): gate the co-signature on the root check.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: agent.keyProvider,
             getNode: noSharedDirectoryNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -673,6 +943,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
         wireSessionOfferHandler({
             agentName: agent.name,
             getStandingReceiverEndpoint: () => sessionNodeManager.getStandingReceiverInfo(agent.name),
+            admitOfferedDialer: (peerId, sessionIdHex) => sessionNodeManager.admitOfferedDialer(agent.name, peerId, sessionIdHex),
             signaling: mgr,
             logger,
         });
@@ -888,6 +1159,22 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // whether its counterparty is quiet or its sibling was faster. Written at the destructive drain in
     // session-content-handlers; read at that handler's timeout. Delivery itself is unchanged.
     const contentTakes = new ContentTakeLedger();
+    /**
+     * In-flight background seal ceremonies — `DOD-M15-CLOSEWAIT-1` review MEDIUM-6.
+     *
+     * The close now answers at commitment and finishes the ceremony detached. Without this the tail
+     * was the ONE background task `stop()` could cut at an arbitrary point, while it cancels or awaits
+     * every other one.
+     */
+    const backgroundSeals = new Set();
+    /**
+     * DOD-M15-SEAL-FAILED-TERMINAL-1 — the last background seal failure per session.
+     *
+     * In memory on purpose: a restart makes "failed" the WRONG answer, because the boot sweep plus the
+     * restart seal resolver retry the session. A marker whose lifetime is the process matches the
+     * lifetime of the condition it describes.
+     */
+    const sealFailures = new SealFailureStore();
     // DOD-AWAY-WRAP-1 AC1: request text is a leave-a-message greeting; agentName is spliced in at
     // the call site so it names the specific away agent.
     // DOD-AWAY-ACK-ONESHOT-TEXT-1 (live defect 2026-07-24): the ack must state the one-shot rule —
@@ -977,9 +1264,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // FRONT precisely so [[WRAP]] keeps the end position the counterparty's detector anchors on.
                     const rejectText = markAsAutoReply("This inbox only accepts one message per visit. Closing. [[WRAP]]");
                     const rejectBytes = new TextEncoder().encode(rejectText);
-                    const rejectHash = wireContentHash(rejectBytes);
+                    // B2b: one decision point for the hash AND its algorithm — see `contentHashForSession`.
+                    const reject = await sessionNodeManager.contentHashForSession(agentName, sessionId, rejectBytes);
                     // Best-effort: a send failure still triggers the seal — we are closing regardless.
-                    const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, rejectBytes, new Uint8Array(rejectHash), randomUUID());
+                    const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, rejectBytes, new Uint8Array(reject.hash), randomUUID(), LEAF_KIND_MSG, reject.alg);
                     // M12-P13: commit the leaf when the rejection went out OR when it is durably queued —
                     // either way the relay already witnessed its sequence. This caller is the sharpest case
                     // of the three: the seal is initiated immediately below, so a hole here does not merely
@@ -987,7 +1275,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // counterparty will still receive content at. The roots then cannot agree, and the
                     // session is unsealable for good.
                     if (sendResult.ok || sendResult.durable) {
-                        const rejectHashHex = Buffer.from(rejectHash).toString("hex");
+                        const rejectHashHex = Buffer.from(reject.hash).toString("hex");
                         // DOD-M12B-INDEX-1: at the relay's position, not the tail. This is the riskiest append
                         // in the codebase for that — the seal is initiated a few lines below, so a leaf at the
                         // wrong index does not merely stall the far side, it seals a tree the counterparty can
@@ -1013,85 +1301,124 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // not have ingested it yet when the seal request arrives over the signaling channel.
                     // The relay path avoids this entirely — it posts a SEAL ctrl leaf and waits for the
                     // counterparty to independently co-seal; no bilateral leaf-count comparison needed.
-                    void (async () => {
-                        const correlationId = randomUUID();
-                        const sk = sealKey(agentName, sessionId);
-                        if (sealInterruptedInProgress.has(sk))
-                            return;
-                        sealInterruptedInProgress.add(sk);
-                        try {
-                            let resolveSeal;
-                            const sealedP = new Promise((r) => { resolveSeal = r; });
-                            pendingSealWaiters.set(sk, resolveSeal);
-                            const submit = await sessionNodeManager.submitSealLeaf(agentName, sessionId, correlationId);
-                            if (!submit.ok && submit.reason !== "responder_seal_already_submitted") {
-                                pendingSealWaiters.delete(sk);
-                                if (submit.reason === "relay_unavailable") {
-                                    const fallback = await handleActiveSealFlow(sessionId, record2, correlationId);
-                                    if (fallback.ok) {
-                                        logger.info("session.away.inbox.oneshot.seal_initiated", { agentName, sessionId, path: "signaling_fallback" });
+                    /**
+                     * DOD-M15-DIVERGE-1 (review HIGH-3) — the gate has to hold on the path with no operator.
+                     *
+                     * `cello_close_session` refuses a diverged record, but this autonomous path never
+                     * consulted `sealReadiness` at all: it read `placed.placed` and discarded
+                     * `placed.diverged`, then initiated the seal directly. So "a diverged session is blocked
+                     * from sealing" held for the close a human drives and not for the one that runs itself —
+                     * which is the worse of the two, because the append two lines above is, by its own
+                     * comment, "the riskiest append in the codebase" for exactly this reason.
+                     *
+                     * THE LOG IS THE SURFACE HERE, and that is not a weakening of Invariant 2. There is no
+                     * caller to answer — nothing is awaiting a response on this path — so the log carries the
+                     * whole warning rather than half of it.
+                     */
+                    const oneshotReadiness = sessionNodeManager.sealReadiness(agentName, sessionId);
+                    if (oneshotReadiness.diverged) {
+                        logger.warn("session.away.inbox.oneshot.seal_skipped_diverged", {
+                            agentName, sessionId,
+                            treeSize: oneshotReadiness.treeSize, highWaterSeq: oneshotReadiness.highWaterSeq,
+                            impact: "this side's tree parted from the relay's ordering, so the seal was NOT initiated — the session stays closeable by hand, where the operator is told what parted and can compare counts with the counterparty before deciding",
+                        });
+                    }
+                    else {
+                        void (async () => {
+                            const correlationId = randomUUID();
+                            const sk = sealKey(agentName, sessionId);
+                            if (sealInterruptedInProgress.has(sk))
+                                return;
+                            sealInterruptedInProgress.add(sk);
+                            try {
+                                // DOD-M15-SEALWIRE-1 bullet 2 (review F4): SealCompletion is now a union — a refused
+                                // certificate resolves the waiter rather than dropping it, so this path must handle it
+                                // too rather than treating a refusal as a seal.
+                                let resolveSeal;
+                                const sealedP = new Promise((r) => { resolveSeal = r; });
+                                pendingSealWaiters.set(sk, resolveSeal);
+                                const submit = await sessionNodeManager.submitSealLeaf(agentName, sessionId, correlationId);
+                                if (!submit.ok && submit.reason !== "responder_seal_already_submitted") {
+                                    pendingSealWaiters.delete(sk);
+                                    if (submit.reason === "relay_unavailable") {
+                                        const fallback = await handleActiveSealFlow(sessionId, record2, correlationId);
+                                        if (fallback.ok) {
+                                            logger.info("session.away.inbox.oneshot.seal_initiated", { agentName, sessionId, path: "signaling_fallback" });
+                                        }
+                                        else {
+                                            logger.warn("session.away.inbox.oneshot.seal_initiate_failed", { agentName, sessionId, reason: fallback.reason, path: "signaling_fallback" });
+                                        }
                                     }
                                     else {
-                                        logger.warn("session.away.inbox.oneshot.seal_initiate_failed", { agentName, sessionId, reason: fallback.reason, path: "signaling_fallback" });
+                                        logger.warn("session.away.inbox.oneshot.seal_initiate_failed", { agentName, sessionId, reason: submit.reason });
                                     }
+                                    return;
                                 }
-                                else {
-                                    logger.warn("session.away.inbox.oneshot.seal_initiate_failed", { agentName, sessionId, reason: submit.reason });
+                                logger.info("session.away.inbox.oneshot.seal_initiated", { agentName, sessionId, path: "relay" });
+                                const bilateralTimeoutMs = Number(process.env["CELLO_SEAL_BILATERAL_TIMEOUT_MS"]) || 660_000;
+                                let timer;
+                                const timeoutP = new Promise((r) => { timer = setTimeout(() => r(null), bilateralTimeoutMs); });
+                                const sealedCompletion = await Promise.race([sealedP, timeoutP]);
+                                clearTimeout(timer);
+                                pendingSealWaiters.delete(sk);
+                                if (sealedCompletion !== null) {
+                                    // DOD-M15-SEALWIRE-1 bullet 2 (review F4): a REFUSED certificate resolves the waiter
+                                    // now rather than being dropped, so this path must tell the two apart — logging a
+                                    // refusal as "sealed" would be the silent acceptance the whole bullet exists to stop.
+                                    if ("refused" in sealedCompletion) {
+                                        logger.error("session.away.inbox.oneshot.seal_refused", {
+                                            agentName, sessionId, reason: sealedCompletion.reason, detail: sealedCompletion.detail,
+                                            impact: "the away auto-seal was REFUSED: the directory returned a validly signed root " +
+                                                "that does not describe this conversation. The session is NOT sealed and nothing " +
+                                                "was signed with this agent's key.",
+                                        });
+                                        return;
+                                    }
+                                    logger.info("session.away.inbox.oneshot.sealed", { agentName, sessionId, sealedRoot: sealedCompletion.rootHex });
+                                    return;
                                 }
-                                return;
-                            }
-                            logger.info("session.away.inbox.oneshot.seal_initiated", { agentName, sessionId, path: "relay" });
-                            const bilateralTimeoutMs = Number(process.env["CELLO_SEAL_BILATERAL_TIMEOUT_MS"]) || 660_000;
-                            let timer;
-                            const timeoutP = new Promise((r) => { timer = setTimeout(() => r(null), bilateralTimeoutMs); });
-                            const sealedCompletion = await Promise.race([sealedP, timeoutP]);
-                            clearTimeout(timer);
-                            pendingSealWaiters.delete(sk);
-                            if (sealedCompletion !== null) {
-                                logger.info("session.away.inbox.oneshot.sealed", { agentName, sessionId, sealedRoot: sealedCompletion.rootHex });
-                                return;
-                            }
-                            // Bilateral timeout — escalate to unilateral seal.
-                            const escalation = submit.ok
-                                ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
-                                : submit.reason === "responder_seal_already_submitted" &&
-                                    typeof submit.reportedRootHex === "string" &&
-                                    typeof submit.sequenceNumber === "number"
+                                // Bilateral timeout — escalate to unilateral seal.
+                                const escalation = submit.ok
                                     ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
-                                    : null;
-                            if (!escalation) {
-                                logger.warn("session.away.inbox.oneshot.seal_pending", { agentName, sessionId });
-                                return;
-                            }
-                            // DOD-M12B-SEAL-ESCALATE-DUP-1: THE SHARED ESCALATION, not a second copy.
-                            //
-                            // This used to be a line-for-line duplicate with its own hardcoded 30 s timeout, and
-                            // it missed every refusal the other one gained: an empty carry, a gappy chain, two of
-                            // our own ctrl leaves (permanently unsealable), and a bilateral seal already running.
-                            // It spent the full timeout on each and then reported `seal_unilateral_timeout` — the
-                            // label that names our own wait. Sharing the body is what stops that drifting again.
-                            const uni = await runUnilateralEscalation({
-                                logger, sessionNodeManager, sendOver, pendingUnilateralWaiters, sealKey,
-                                getKeyProvider: (a) => keyProviders.get(a),
-                                timeoutMs: UNILATERAL_SEAL_TIMEOUT_MS,
-                            }, agentName, sessionId, escalation, correlationId, { refuseOnUnusableCarry: true });
-                            if (uni.ok) {
-                                logger.info("session.away.inbox.oneshot.sealed", { agentName, sessionId, sealedRoot: uni.sealed_root, sealType: "unilateral" });
+                                    : submit.reason === "responder_seal_already_submitted" &&
+                                        typeof submit.reportedRootHex === "string" &&
+                                        typeof submit.sequenceNumber === "number"
+                                        ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
+                                        : null;
+                                if (!escalation) {
+                                    logger.warn("session.away.inbox.oneshot.seal_pending", { agentName, sessionId });
+                                    return;
+                                }
+                                // DOD-M12B-SEAL-ESCALATE-DUP-1: THE SHARED ESCALATION, not a second copy.
+                                //
+                                // This used to be a line-for-line duplicate with its own hardcoded 30 s timeout, and
+                                // it missed every refusal the other one gained: an empty carry, a gappy chain, two of
+                                // our own ctrl leaves (permanently unsealable), and a bilateral seal already running.
+                                // It spent the full timeout on each and then reported `seal_unilateral_timeout` — the
+                                // label that names our own wait. Sharing the body is what stops that drifting again.
+                                const uni = await runUnilateralEscalation({
+                                    logger, sessionNodeManager, sendOver, pendingUnilateralWaiters, sealKey,
+                                    getKeyProvider: (a) => keyProviders.get(a),
+                                    timeoutMs: UNILATERAL_SEAL_TIMEOUT_MS,
+                                }, agentName, sessionId, escalation, correlationId, { refuseOnUnusableCarry: true });
+                                if (uni.ok) {
+                                    logger.info("session.away.inbox.oneshot.sealed", { agentName, sessionId, sealedRoot: uni.sealed_root, sealType: "unilateral" });
+                                }
+                                else {
+                                    // CARRY THE GUIDANCE. The four refusals this path just gained come with the
+                                    // sentence that tells an operator whether to retry or force-abandon — and the log
+                                    // is this path's ONLY surface, so dropping it leaves a nameable cause with no
+                                    // action attached. The old reasons had no guidance to lose; these do.
+                                    logger.warn("session.away.inbox.oneshot.seal_unilateral_failed", {
+                                        agentName, sessionId, reason: uni.reason, guidance: uni.guidance,
+                                    });
+                                }
                             }
-                            else {
-                                // CARRY THE GUIDANCE. The four refusals this path just gained come with the
-                                // sentence that tells an operator whether to retry or force-abandon — and the log
-                                // is this path's ONLY surface, so dropping it leaves a nameable cause with no
-                                // action attached. The old reasons had no guidance to lose; these do.
-                                logger.warn("session.away.inbox.oneshot.seal_unilateral_failed", {
-                                    agentName, sessionId, reason: uni.reason, guidance: uni.guidance,
-                                });
+                            finally {
+                                sealInterruptedInProgress.delete(sealKey(agentName, sessionId));
                             }
-                        }
-                        finally {
-                            sealInterruptedInProgress.delete(sealKey(agentName, sessionId));
-                        }
-                    })();
+                        })();
+                    }
                 }
             }
             return;
@@ -1148,8 +1475,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 ? new Uint8Array(awayVerdict.content)
                 : draftBytes;
             const contentBytes = new TextEncoder().encode(markAsAutoReply(new TextDecoder().decode(screenedBytes)));
-            const contentHash = wireContentHash(contentBytes);
-            const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, contentBytes, new Uint8Array(contentHash), randomUUID());
+            // B2b: one decision point for the hash AND its algorithm — see `contentHashForSession`.
+            const away = await sessionNodeManager.contentHashForSession(agentName, sessionId, contentBytes);
+            const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, contentBytes, new Uint8Array(away.hash), randomUUID(), LEAF_KIND_MSG, away.alg);
             if (!sendResult.ok && !sendResult.durable) {
                 // Reviewer MEDIUM fix: a transient failure must NOT permanently silence the rest of this
                 // away period — clear the guard so the next inbound arrival retries the ack.
@@ -1163,7 +1491,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 });
                 return;
             }
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
+            const contentHashHex = Buffer.from(away.hash).toString("hex");
             if (!sendResult.ok) {
                 // M12-P13 (found live 2026-08-05, M12 Entry 89): the reply is durably queued and already
                 // owns the sequence the relay witnessed for it, so its leaf MUST be committed here. Without
@@ -1380,6 +1708,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
         challengeVerifier,
         getManifestVersion: () => verifiedManifestVersion,
         loadedAgents,
+        // DOD-M15-ERRSTRING-1: so a session failure can say "and 2 of your 5 directories are
+        // unreachable", which is very often the actual cause and was reported nowhere the operator
+        // was looking.
+        getUnresolvedNodes,
+        getDeclaredNodeCount,
     });
     // Both use the same SQLite DB as the SessionNodeManager (daemon.db equivalent).
     // loadFromDb() must complete BEFORE IPC socket opens (AC-007).
@@ -1455,15 +1788,20 @@ async function startDaemonHoldingLock(config, singletonLock) {
         onPersisted: (agentName, sessionId, contentHashHex) => {
             retryQueue.markContentAcked(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"));
         },
-        onTtf: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor) => {
-            retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor);
+        // `DOD-M15-SEALWIRE-1` B2b-1 review F1 — `contentHashAlg` is the DURABLE WRITER for the column
+        // this unit added. Without it every queued row carries NULL, the crash backstop re-parks a salted
+        // message as sha256, and the recipient refuses it and re-pulls it forever. The commit that added
+        // the column said the producer "passes it"; the producer was passing a value nothing supplied,
+        // because these two hooks were never widened.
+        onTtf: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg) => {
+            retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor, contentHashAlg);
         },
         // M12-P12: same durable destination, different cause — a park deposit the relay refused. The
         // TTF timer is already cancelled on this path, so this is the only thing holding the content.
         // M12-P13 (review HIGH-1): the enqueue's own answer is returned, never a bare `true`. A dropped
         // copy that reports success now buys a committed hash-chain leaf for content that is gone.
-        onParkFailed: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor) => {
-            return retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor);
+        onParkFailed: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg) => {
+            return retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor, contentHashAlg);
         },
     });
     // MSG-001-3b (2b): the LIVE content-park deposit. On a not-confirmed send (direct delivery
@@ -1509,7 +1847,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
         logger.warn("session.seal.autoack.broker.unreachable", { agentName, brokerNode, correlationId });
         return null;
     });
-    sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor }) => {
+    sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg }) => {
         const node = sessionNodeManager.getStandingReceiverNode();
         if (!node) {
             const reason = "standing_receiver_unavailable";
@@ -1543,12 +1881,21 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // SEC-1: sealParkEnvelope is the SOLE producer — it signs (sender's K_local, over the
         // session/recipient/content binding) and seals in one place, so the two park sites cannot drift
         // apart on what gets signed.
+        //
+        // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
+        // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
+        // is salted is a fact about the message that was sent; what this side holds now says nothing
+        // about it. Still `sha256` everywhere, because no send path salts yet — the plumbing is proven
+        // carrying the value that cannot break anything, and only then does the value change.
         const ciphertext = await sealParkEnvelope({
             signer: senderKp,
             sessionIdHex: sessionId,
             recipientPubkey,
             contentHash: contentHashBytes,
             content,
+            // The algorithm the DIRECT frame named for this same message. The park copy must claim what
+            // the message actually is, not what this side would choose for it now.
+            contentHashAlg,
             structure1Cbor,
             structure2Cbor,
         });
@@ -1621,12 +1968,21 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // empty after a restart, so arrival order there means a wrong leaf index and a divergent tree.
         // SEC-1: same sole producer as the live hook — the backstop signs from the persisted
         // (sessionId, recipient, contentHash).
+        //
+        // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
+        // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
+        // is salted is a fact about the message that was sent; what this side holds now says nothing
+        // about it. Still `sha256` everywhere, because no send path salts yet — the plumbing is proven
+        // carrying the value that cannot break anything, and only then does the value change.
         const ciphertext = await sealParkEnvelope({
             signer: senderKp,
             sessionIdHex: entry.sessionId,
             recipientPubkey,
             contentHash: contentHashBytes,
             content: entry.contentBlob,
+            // The queued row's own record of how it was hashed. `undefined` for a row written before the
+            // column existed, which resolves to `sha256` — exactly what such a row actually used.
+            contentHashAlg: entry.contentHashAlg,
             structure1Cbor: entry.structure1Cbor,
             structure2Cbor: entry.structure2Cbor,
         });
@@ -1787,7 +2143,21 @@ async function startDaemonHoldingLock(config, singletonLock) {
             return {
                 name: a.name,
                 state,
+                /**
+                 * `selected` IS THIS CONNECTION'S VIEW, NOT THE AGENT'S — `DOD-M15-IPCVISIBLE-1` clause 3.
+                 *
+                 * Every `cello` CLI invocation opens a FRESH connection, which starts with no current
+                 * agent. So a client asking about its own state through the CLI always reads `false`, for
+                 * an agent it genuinely has selected in another session. Both Andre and a Hermes agent
+                 * misread it that way during one investigation, in opposite directions.
+                 *
+                 * The field name cannot be changed without breaking every reader, so it is ANNOTATED: the
+                 * sibling below says whose view this is, and `attended_by` says how many connections hold
+                 * this agent at all — which is the question people were actually asking.
+                 */
                 selected,
+                selected_by_this_connection: selected,
+                attended_by: countAttendance(perConnectionState, a.name),
                 pubkey: a.pubkey,
                 // M8B F14 (fix 5): per-agent standing-receiver readiness on the MCP surface
                 // (cello_status / cello_list_agents), so a deaf agent is visible to the operator.
@@ -2003,6 +2373,21 @@ async function startDaemonHoldingLock(config, singletonLock) {
             //
             // Omitted entirely when nothing is failing, so a healthy status stays quiet.
             ...(unresolvedNodesForStatus() ?? {}),
+            // DOD-M15-MANIFEST-EXPIRY-LIVE-1: contributes NOTHING while the manifest is comfortably in
+            // window. A field present on every status read for the years a manifest is valid is furniture,
+            // not a warning, and it teaches the reader to skip the block that matters.
+            ...(describeManifestValidity(classifyManifestValidity(manifestProvider?.getCurrentManifest() ?? null, Date.now()), manifestOrigin) ?? {}),
+            // DOD-M15-DIRAUTH-1: the posture is STATED, in both directions. Unlike every other field in
+            // this milestone the healthy case is reported too — the defect is precisely that "enforced"
+            // and "skipped" differ only by the absence of a log line, so an operator must be able to
+            // confirm it is on, not merely fail to find evidence that it is off.
+            ...describeDirectoryAuth({
+                verifierPresent: challengeVerifier !== undefined,
+                directoryUrl: directoryHttpUrl ?? resolveDirectoryUrl(process.env),
+                // Review F5: with neither set, `resolveDirectoryUrl` re-picks a RANDOM bundled endpoint on
+                // every call, so there is no configured URL to quote or to blame.
+                urlExplicitlyConfigured: directoryHttpUrl !== undefined || process.env["CELLO_DIRECTORY_URL"] !== undefined,
+            }),
             // M8B F14 (fix 5): per-agent standing-receiver readiness, so a deaf agent (online but
             // no armed receiver) is visible in cello_status instead of hiding behind the ANY-agent
             // aggregate below (kept for backward compatibility).
@@ -2115,16 +2500,95 @@ async function startDaemonHoldingLock(config, singletonLock) {
      * alice, alice was stopped, and the work lands on bob reporting success. A lost intent is not the
      * same as no intent, and it must fail loud (no_current_agent) rather than be guessed at.
      */
+    /**
+     * Which agent this call acts as — `DOD-M15-SELECTION-1`, logic in `agent-selection.ts`.
+     *
+     * It used to end with `if (onlineAgents.size === 1) return [...onlineAgents][0]`, so a connection
+     * that had selected nothing acted as whichever agent happened to be the only one online. On a
+     * shared daemon that can be a DIFFERENT operator's agent, and a live MCP session was being bound
+     * to an identity it never asked for.
+     *
+     * The resolution is now attributable: every path reports how it was reached, and `fallback` — the
+     * one that was invisible — is logged at INFO. `DOD-M15-IPCVISIBLE-1`.
+     */
+    /**
+     * The fallback notice owed to THIS REQUEST's response — `DOD-M15-SELECTION-1` clause 2.
+     *
+     * ─── Why an AsyncLocalStorage and not a per-connection map ─────────────────────────────────────
+     *
+     * The first cut keyed a `WeakMap` on the per-connection state object, so the notice belonged to
+     * the CONNECTION and was read back at the response boundary. Review found that hands the notice to
+     * whichever response finishes first, and Claude Code issues tool calls in parallel:
+     *
+     *   1. the agent calls `cello_receive` — nothing selected, so the fallback resolves and records
+     *      the notice, then the handler BLOCKS for up to 30 s waiting for content;
+     *   2. in the same turn it calls `cello_sessions {agent: "bob"}`, which names an agent explicitly
+     *      and never falls back;
+     *   3. `cello_sessions` returns first and takes the notice on its way out.
+     *
+     * Bob's response now says *"no agent was selected, so 'solo' was used"* — false, on the one call
+     * that did name an agent — and `cello_receive`, the call that actually fell back, says nothing.
+     * Exactly inverted.
+     *
+     * A notice is a fact about ONE CALL, so it is stored in that call's async context. The store is
+     * created per request in `renderedHandlers` and dies with it, which also means a handler that
+     * THROWS cannot leave a notice behind to attach itself to some later, unrelated response — the
+     * other half of the same review finding.
+     */
+    const fallbackNoticeStore = new AsyncLocalStorage();
     function resolveCurrentAgent(connState, explicitAgent) {
-        if (explicitAgent)
-            return explicitAgent;
-        if (connState?.currentAgent)
-            return connState.currentAgent;
-        if (connState?.clearedAgent)
-            return null;
-        if (onlineAgents.size === 1)
-            return [...onlineAgents][0];
-        return null;
+        return resolveCurrentAgentFor({
+            connState,
+            onlineAgents,
+            ...(explicitAgent !== undefined ? { explicitAgent } : {}),
+            onResolved: (agent, trigger) => {
+                // Only the FALLBACK is announced. `explicit` and `selected` are the ordinary cases and
+                // logging them would bury the one that matters — a signal that fires on the normal case is
+                // not a signal.
+                if (trigger !== "fallback")
+                    return;
+                /**
+                 * RECORDED FOR THE RESPONSE, not just the log — `DOD-M15-SELECTION-1` clause 2.
+                 *
+                 * The log tells whoever reads the daemon log. The RESPONSE tells the agent that just acted
+                 * as an identity it never selected, which is the one that stops the half-attended state
+                 * being read as the protocol dropping messages.
+                 */
+                /**
+                 * No `connState` guard. The first cut wrote the notice only `if (agent && connState)`, and
+                 * `perConnectionState` is populated at `ipc.connect` — which `withIpc` in the CLI
+                 * (`core/cli/src/commands.ts`) does not send. So every plain `cello` invocation fell back
+                 * and got a response that said nothing, while the log line below fired regardless: the
+                 * clause asks for explicit IN THE RESPONSE, and those callers had it explicit in the log
+                 * only. The store is per-REQUEST, so it exists whether or not the connection ever
+                 * handshook.
+                 */
+                const store = fallbackNoticeStore.getStore();
+                if (agent && store) {
+                    store.notice = {
+                        acting_as: agent,
+                        agent_selection: "fallback",
+                        agent_selection_guidance: `No agent was selected on this connection, so '${agent}' was used because it is the ` +
+                            `only one online. This is a per-call subject, NOT an attendance: doorbells route by ` +
+                            `the connection's registered agent and this does not set it. Two things follow — ` +
+                            `this session will not WAKE on an incoming message even though sending and reading ` +
+                            `work, and anyone who opens a session with you is sent an AWAY auto-reply while you ` +
+                            `sit here able to answer. Run cello_use_agent to fix both. Naming the agent on each ` +
+                            `call is NOT a remedy for either: it settles which agent a call is about and leaves ` +
+                            `the connection just as unattended.`,
+                    };
+                }
+                logger.info("agent.current.fallback", {
+                    agentName: agent,
+                    clientType: connState?.clientType ?? "cli",
+                    impact: "this call had no selected agent and exactly one was online, so that one was used. It " +
+                        "is a per-call subject, NOT an attendance: doorbells route by the connection's " +
+                        "registered agent, which this does not set.",
+                    guidance: "If this was not the intended agent, name it explicitly, or run cello_use_agent to " +
+                        "select one for the connection.",
+                });
+            },
+        });
     }
     // Agent lifecycle (agent-handlers.ts): create, remove, start, stop, select, list.
     registerAgentHandlers({
@@ -2214,6 +2678,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName,
             persistence: getPersistence(agentName),
             agentPubkeyHex: loaded.pubkey,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): gate the co-signature on the root check.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: loaded.keyProvider,
             getNode: entry.getNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -2258,6 +2724,28 @@ async function startDaemonHoldingLock(config, singletonLock) {
             subject_kind: r.subjectKind,
             subject: r.subject,
             issuer_kind: r.issuerKind,
+            /**
+             * DOD-M15-SAMEOP-FALSEPOS-1: WHO ISSUED IT. The listing carried `subject` — who the signal is
+             * ABOUT — and never who SAID it, so an operator could see "someone endorsed me" and not see
+             * who. For the decision this list exists to support (do I rely on this endorsement?) the
+             * author is the primary fact, and an endorsement nobody can attribute is worth roughly
+             * nothing.
+             *
+             * `issuer_kind` reads like it answers this and does not: it says `"agent"` or `"portal"`, a
+             * category. Elsewhere a field literally named `issuer` holds `"peer-claimed"` /
+             * `"platform-verified"` — also a category. Two fields whose names promise identity, neither
+             * carrying it.
+             *
+             * It also unblocks an investigation this omission stalled: four endorsements in a wallet all
+             * read `same_operator: true`, and **nothing in the response could say whether the stranger's
+             * was among them** — so "a stranger is flagged as self-dealing" and "the stranger's
+             * endorsement never arrived" were indistinguishable from the listing. Different bugs, in
+             * different places, and the field that separates them was already in the row.
+             *
+             * Discloses nothing new: the issuer pubkey is inside the notarized envelope the recipient
+             * already holds and can already present.
+             */
+            issuer_pubkey: r.issuerPubkey,
             status: r.status,
             issued_at: r.issuedAt,
             expires_at: r.expiresAt,
@@ -3047,32 +3535,78 @@ async function startDaemonHoldingLock(config, singletonLock) {
     });
     // ─── MCP-001: cello_status (per-connection perspective) ───
     /**
-     * The directory-reachability block for `cello_status`, or undefined when every node resolves.
+     * The directory-reachability block for `cello_status`.
+     *
+     * `undefined` — i.e. silence — is reserved for ONE state: a reading taken recently enough to
+     * speak for the present, which found nothing wrong. Every other combination emits, including an
+     * EMPTY node list, because an empty list is not proof of health: it also means nothing has
+     * looked, or looked too long ago to say. `DOD-M15-STALEROSTER-1`.
      *
-     * Reports the LAST resolve sweep. An empty list is not proof of health — it also means no sweep
-     * has run yet — so the shape says which nodes failed and why rather than asserting "all good".
+     * So presence of this block does NOT mean nodes are failing. Read `measurement` first —
+     * `current` | `stale` | `never` | `not_configured` — and only then the node list.
      */
     function unresolvedNodesForStatus() {
         const failures = getUnresolvedNodes();
-        if (failures.length === 0)
+        /**
+         * DOD-M15-STALEROSTER-1 — the block is now gated on the AGE of the reading, not just on whether
+         * it found anything.
+         *
+         * `if (failures.length === 0) return undefined` made two different states render identically:
+         * "all three nodes answered a moment ago" and "nothing has ever looked". The second is
+         * reachable — `verifyStartupManifest` returns without sweeping when the consortium manifest is
+         * missing, not yet valid, EXPIRED, or rolled back — so a daemon with an expired manifest
+         * reported no directory trouble at all.
+         *
+         * Silence is therefore reserved for the one case that has earned it: a RECENT reading that
+         * found nothing wrong. Every other case says why it cannot make that claim.
+         */
+        const freshness = describeRosterFreshness(classifyRosterReading(getUnresolvedSweptAt(), Date.now()), {
+            // REVIEW F2: "no manifest configured" is DESIGNED (local dev, the e2e harness, or a
+            // CELLO_DIRECTORY_URL that is not byte-equal to a bundled endpoint) and must not be dressed
+            // as an alarm — it would fire on every local run. It still EMITS, because the line forbids
+            // hiding the field; what differs is what the operator is told.
+            manifestConfigured: manifestProvider !== undefined,
+            ...(lastRosterSweepError ? { lastSweepError: lastRosterSweepError } : {}),
+        });
+        if (failures.length === 0 && freshness.measurement === "current")
             return undefined;
         return {
             directory_endpoints_unresolved: {
-                // WHEN this was measured. Without it the block asserts the PRESENT, and a transient blip
-                // reads as an ongoing outage: on 2026-08-09 all three endpoints failed with ENETUNREACH for
-                // under a minute — a network transition on the operator's machine — and the block went on
-                // reporting them unreachable long after they answered again. True when taken, false when read.
-                checked_at: getUnresolvedSweptAt(),
-                nodes: failures.map((f) => ({ node: f.nodeId, endpoint: f.endpoint, reason: f.reason, detail: f.detail })),
-                guidance: "AS OF checked_at (this is a point-in-time reading, not necessarily now), this daemon could not "
-                    + "resolve these directory endpoints, so the consortium roster was short and " +
-                    "threshold ceremonies will fail — sessions surface that as counterparty_offline, " +
-                    "directory_below_threshold, or ceremony_exhausted, none of which name the real cause. " +
-                    "Agents can still show 'online': signaling dials multiaddrs and does not need DNS. " +
-                    "If reason is dns_error after a directory restart or wake, the resolver is holding a cached " +
-                    "negative answer — flush it (macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder). " +
-                    "Verify with node -e 'require(\"dns\").lookup(host,console.log)', NOT dig: dig bypasses the " +
-                    "cache this daemon is stuck behind, so it reports success while the daemon still fails.",
+                // WHEN this was measured, and whether that is recent enough to mean anything. Without it the
+                // block asserts the PRESENT, and a transient blip reads as an ongoing outage: on 2026-08-09
+                // all three endpoints failed with ENETUNREACH for under a minute — a network transition on
+                // the operator's machine — and the block went on reporting them unreachable long after they
+                // answered again. True when taken, false when read.
+                ...freshness,
+                // DOD-M15-BOOTSTRAP-1: `attempts` distinguishes a node that answered definitively (one
+                // probe — a 404, a bad payload, its configuration) from one that never answered at all
+                // (every probe spent — the path to it). Those call for opposite responses, and without the
+                // count they rendered identically here.
+                nodes: failures.map((f) => ({ node: f.nodeId, endpoint: f.endpoint, reason: f.reason, detail: f.detail, attempts: f.attempts })),
+                guidance: failures.length === 0
+                    // The block is present with an EMPTY node list, which before DOD-M15-STALEROSTER-1 could
+                    // not happen. Saying "could not resolve these endpoints" here would be a flat lie — there
+                    // are no endpoints listed and the point is that nothing was measured. The empty list is
+                    // the ABSENCE of a reading, not a clean bill of health, and freshness_guidance above says
+                    // which of the two it is.
+                    ? "This block is present with NO nodes listed, which does not mean the nodes are healthy — " +
+                        "it means this reading cannot support that claim. See freshness_guidance above for " +
+                        "whether the daemon has never measured, or measured too long ago to speak for the " +
+                        "present. Directory reachability is what threshold ceremonies depend on, so an " +
+                        "unmeasured roster is an unknown, not an all-clear."
+                    : "AS OF checked_at (this is a point-in-time reading, not necessarily now), this daemon could not "
+                        + "resolve these directory endpoints, so the consortium roster was short and " +
+                        "threshold ceremonies will fail — sessions surface that as home_node_reports_no_receiver, " +
+                        "home_node_not_in_reachable_roster, directory_named_no_home, directory_below_threshold or " +
+                        "ceremony_exhausted, none of which name the real cause on their own (DOD-M15-ERRSTRING-1 " +
+                        "renamed the first three; they now append this shortfall to their own guidance). " +
+                        "Agents can still show 'online': signaling dials multiaddrs and does not need DNS. " +
+                        "If reason is dns_error after a directory restart or wake, the resolver is holding a cached " +
+                        "negative answer — flush it (macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder). " +
+                        "Verify with node -e 'require(\"dns\").lookup(host,console.log)', NOT dig: dig bypasses the " +
+                        "cache this daemon is stuck behind, so it reports success while the daemon still fails. "
+                        + "attempts:1 means the node ANSWERED and the answer was unusable — look at that node. "
+                        + "attempts:2+ means it never answered — look at the path to it.",
             },
         };
     }
@@ -3091,6 +3625,21 @@ async function startDaemonHoldingLock(config, singletonLock) {
             //
             // Omitted entirely when nothing is failing, so a healthy status stays quiet.
             ...(unresolvedNodesForStatus() ?? {}),
+            // DOD-M15-MANIFEST-EXPIRY-LIVE-1: contributes NOTHING while the manifest is comfortably in
+            // window. A field present on every status read for the years a manifest is valid is furniture,
+            // not a warning, and it teaches the reader to skip the block that matters.
+            ...(describeManifestValidity(classifyManifestValidity(manifestProvider?.getCurrentManifest() ?? null, Date.now()), manifestOrigin) ?? {}),
+            // DOD-M15-DIRAUTH-1: the posture is STATED, in both directions. Unlike every other field in
+            // this milestone the healthy case is reported too — the defect is precisely that "enforced"
+            // and "skipped" differ only by the absence of a log line, so an operator must be able to
+            // confirm it is on, not merely fail to find evidence that it is off.
+            ...describeDirectoryAuth({
+                verifierPresent: challengeVerifier !== undefined,
+                directoryUrl: directoryHttpUrl ?? resolveDirectoryUrl(process.env),
+                // Review F5: with neither set, `resolveDirectoryUrl` re-picks a RANDOM bundled endpoint on
+                // every call, so there is no configured URL to quote or to blame.
+                urlExplicitlyConfigured: directoryHttpUrl !== undefined || process.env["CELLO_DIRECTORY_URL"] !== undefined,
+            }),
             agents: getAgentsForConnection(connectionId),
             // M-1 PULL: live MCP clients must see interrupted sessions too, exactly as
             // the daemon-wide getStatus() surfaces them.
@@ -3171,6 +3720,14 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // cello_close_session (close-session-handler.ts). Fifteen dependencies — a long list, but a KNOWN
     // one, which is the whole difference from a closure over 73 shared locals.
     registerCloseSessionHandler({
+        // DOD-M15-CLOSEWAIT-1 review MEDIUM-6: a detached seal tail is registered here so stop() can
+        // drain it, like every other background worker. Self-evicting, so a long-running daemon does not
+        // accumulate settled promises.
+        sealFailures,
+        registerBackgroundSeal: (p) => {
+            backgroundSeals.add(p);
+            void p.finally(() => backgroundSeals.delete(p));
+        },
         // M12-P14: the pre-seal readiness gate drains the parked mailbox before judging, so a close
         // does not refuse over content the relay is still holding for us.
         recoverParkedContent: (agentName, trigger) => autoRecoverForAgent(agentName, trigger),
@@ -3208,9 +3765,74 @@ async function startDaemonHoldingLock(config, singletonLock) {
         handleActiveSealFlow,
         resolveConsortiumRoster,
     });
+    /**
+     * DOD-M15-BACKUP-1 — export the agent, so losing the machine does not lose the identity.
+     *
+     * `VACUUM INTO` takes a consistent snapshot with the database still open, so this is safe to call
+     * on a running daemon — which matters, because the daemon is what serves the tool.
+     */
+    handlers.set("cello_backup", async (params, _connectionId) => {
+        const outPath = typeof params?.["path"] === "string" ? params["path"] : "";
+        if (!outPath) {
+            return {
+                ok: false,
+                reason: "missing_path",
+                guidance: "Give an absolute path to write the backup to, e.g. { path: \"/Users/you/cello-agent.cello-backup\" }. " +
+                    "It is not written to a default location on purpose: the file contains the key to your agent, " +
+                    "so where it lands is a decision you should make deliberately.",
+            };
+        }
+        const res = await createBackup({
+            dbPath: join(celloDir, "sessions.db"),
+            outPath,
+            logger,
+            ...(params?.["overwrite"] === true ? { overwrite: true } : {}),
+        });
+        return res.ok
+            ? { ok: true, path: res.path, bytes: res.bytes, guidance: res.guidance }
+            : { ok: false, reason: res.reason, guidance: res.guidance };
+    });
+    /**
+     * RESTORE IS REFUSED WHILE THIS DAEMON IS RUNNING, and that is not a limitation to apologise for.
+     *
+     * The daemon holds the database open with a write lock. Overwriting the file underneath an open
+     * SQLite handle risks the handle flushing its own pages back over the restored ones — the restore
+     * appears to succeed and the database is a hybrid of two identities, which is worse than either
+     * failing cleanly.
+     *
+     * The capability itself lives in `backup-restore.ts` (a daemon module, per the DoD), and the CLI
+     * calls it with the daemon stopped. So the honest answer here is the exact sequence, not an
+     * attempt.
+     */
+    handlers.set("cello_restore", async (params, _connectionId) => {
+        const archivePath = typeof params?.["path"] === "string" ? params["path"] : "";
+        const inspected = archivePath ? await inspectBackup(archivePath) : null;
+        return {
+            ok: false,
+            reason: "daemon_running",
+            ...(inspected?.ok
+                ? { archive_verified: true, backup_created_at: new Date(inspected.createdAt).toISOString() }
+                : inspected
+                    ? { archive_verified: false, archive_problem: inspected.reason }
+                    : {}),
+            guidance: (inspected?.ok
+                ? `That archive is valid (taken ${new Date(inspected.createdAt).toISOString()}). `
+                : inspected
+                    ? `WARNING: that archive did not validate (${inspected.reason}) — fix that before going further. `
+                    : "") +
+                "Restoring REPLACES this machine's agent database, and it cannot be done while the daemon " +
+                "is holding it open — the running daemon could flush its own pages back over the restored " +
+                "ones and leave a database that is half one identity and half another. Stop the daemon " +
+                "first:\n\n  cello logout\n  cello restore " +
+                (archivePath || "<archive>") +
+                "\n  cello login\n\n" +
+                "Anything that happened on this machine since the backup was taken will be gone — restore " +
+                "replaces, it does not merge.",
+        };
+    });
     // ─── MCP-001: stubs for tools registered in cello-mcp.ts but not yet implemented ───
     // These return not_implemented (same as session tools) so LLMs get consistent guidance.
-    for (const tool of ["cello_backup", "cello_restore", "cello_get_inclusion_proof"]) {
+    for (const tool of ["cello_get_inclusion_proof"]) {
         handlers.set(tool, async (_params, _connectionId) => {
             return { ok: false, reason: "not_implemented", guidance: `'${tool}' is not yet implemented in the daemon. This feature will be available in a future milestone.` };
         });
@@ -3232,6 +3854,14 @@ async function startDaemonHoldingLock(config, singletonLock) {
         logger,
         sessionNodeManager,
         loadedAgents,
+        // DOD-M15-CLOSEWAIT-1 review HIGH-2: the SAME predicate cello_status uses, so the two surfaces
+        // cannot disagree about whether a ceremony is in flight. Both maps, because either can be the
+        // one running — pendingSealWaiters is the active close, sealInterruptedInProgress the interrupted.
+        isSealing: (agentName, sessionId) => pendingSealWaiters.has(sealKey(agentName, sessionId)) ||
+            sealInterruptedInProgress.has(sealKey(agentName, sessionId)),
+        // DOD-M15-SEAL-FAILED-TERMINAL-1: the SAME store the close handler writes, so a failure recorded
+        // by the detached tail is the one the receipt surface reads.
+        getSealFailure: (agentName, sessionId) => sealFailures.get(agentName, sessionId),
         getConnState: (connectionId) => perConnectionState.get(connectionId),
         resolveCurrentAgent,
         NO_CURRENT_AGENT_RESPONSE,
@@ -3306,7 +3936,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
             return { error: "no_current_agent", guidance: "Select an agent with cello_use_agent, or pass agentName." };
         }
         const agentId = sessionNodeManager.resolveAgentId(agentName);
-        retryQueue.enqueueAwaitingContent(agentId, sessionId, Buffer.from(contentHashHex, "hex"), Buffer.from(contentHex, "hex"));
+        // The fault-injection IPC seam. It states all three trailing values explicitly rather than
+        // relying on defaults (B2b-1 pass-2 F1): `undefined` for the ordering record and the algorithm
+        // is what this path genuinely has — it injects a bare queued entry — and saying so keeps the
+        // seam honest about what it is producing rather than inheriting whatever the signature assumed.
+        retryQueue.enqueueAwaitingContent(agentId, sessionId, Buffer.from(contentHashHex, "hex"), Buffer.from(contentHex, "hex"), undefined, undefined, undefined);
         return { queued: true, awaitingDepth: retryQueue.getAwaitingDepth(agentId, sessionId) };
     });
     // CELLO-M7-MSG-001: a `persisted` delivery ACK (or a confirmed park) clears the durable
@@ -3393,7 +4027,23 @@ async function startDaemonHoldingLock(config, singletonLock) {
             const sessionId = params?.sessionId;
             if (!agentName || !sessionId)
                 return { error: "missing_params", guidance: "Provide agentName and sessionId." };
-            recordRefusal(agentName, sessionId, params?.counterpartyPubkey ?? "", params?.reason ?? "test");
+            // The reason is VALIDATED against the closed union rather than cast through it. A test seam
+            // that can inject a reason production cannot produce would let a test prove the inbox handles a
+            // code no refusal path emits — which is the shape DOD-M15-GUARD-HEARD-1 exists to remove, and a
+            // seam is not exempt from it.
+            const asked = params?.reason ?? CAPACITY_REASONS.ABUSE_BOUND_SESSIONS_PER_SENDER;
+            const known = [
+                ...Object.values(REFUSAL_REASONS),
+                ...Object.values(CAPACITY_REASONS),
+            ];
+            if (!known.includes(asked)) {
+                return {
+                    error: "unknown_refusal_reason",
+                    guidance: `"${asked}" is not a reason any refusal path can emit. Use one of: ${known.join(", ")}. ` +
+                        `Seeding an invented reason would test the inbox against a code production never produces.`,
+                };
+            }
+            recordRefusal(agentName, sessionId, params?.counterpartyPubkey ?? "", asked);
             return { ok: true };
         });
         handlers.set("__test_delivery_open_begin", async (params, _connectionId) => {
@@ -3570,12 +4220,27 @@ async function startDaemonHoldingLock(config, singletonLock) {
             if (!handler)
                 return undefined;
             return async (params, connectionId) => {
-                const result = await handler(params, connectionId);
+                /**
+                 * ONE request, ONE store — and the fallback notice is spread in BEFORE `renderForSurface`.
+                 *
+                 * `DOD-M15-SELECTION-1` clause 2 first annotated the response out in `ipc-server.ts`, which
+                 * is downstream of this wrapper and therefore downstream of surface rendering. The notice
+                 * says *"Run cello_use_agent"*; `isInstructionKey` in `vocabulary.ts` rewrites any key
+                 * ending in `guidance`, so that WOULD have become `cello use-agent` for a terminal — but it
+                 * arrived after the rewrite had already run. An operator running `cello inbox` was handed a
+                 * verb that does not exist in a shell, which is the exact failure the vocabulary layer was
+                 * built to prevent. Annotating here puts it back in front of the renderer.
+                 */
+                const store = {};
+                const result = await fallbackNoticeStore.run(store, () => handler(params, connectionId));
+                const annotated = store.notice && result !== null && typeof result === "object" && !Array.isArray(result)
+                    ? { ...result, ...store.notice }
+                    : result;
                 // Default to "cli": a connection that never sent ipc.connect has no recorded surface, and
                 // the CLI verb is the safe answer — it is at least a real command an operator can run,
                 // whereas an MCP tool name is useless in a terminal.
                 const surface = perConnectionState.get(connectionId)?.clientType === "mcp" ? "mcp" : "cli";
-                return renderForSurface(result, surface);
+                return renderForSurface(annotated, surface);
             };
         },
     };
@@ -3629,6 +4294,63 @@ async function startDaemonHoldingLock(config, singletonLock) {
     const documentLayer = createDocumentLayer({
         db: sessionNodeManager.getDb(),
         logger,
+        // DOD-DOC-SCREEN-CONTENT-1 — the gateway, reached with TEXT for once.
+        //
+        // The same program that screens conversation messages, called from the document gate's shadow
+        // with the readable projected text instead of the signed binary envelope the wire carries.
+        //
+        // ── WHICH VERDICTS REFUSE, AND WHY IT IS NOT "ALL OF THEM" ────────────────────────────────
+        //
+        // ONLY the injection verdict. The gateway runs its whole inbound composition, and two of its
+        // other terminal blocks must not refuse a document:
+        //
+        //   - the LANGUAGE ALLOWLIST (default: Latin only). A shared document written in Japanese,
+        //     Arabic or Russian is ordinary use, and every update would be refused — permanently, since
+        //     the same bytes are the same language on redelivery. The allowlist exists so a jailbreak
+        //     phrased in a low-resource language cannot dodge English-trained screening; refusing a
+        //     colleague's document outright is a far worse trade than that gap, and the character
+        //     denylist still runs on every script.
+        //   - the SIZE CAP, which is the sanitizer's per-message cap and not this path's limit. The
+        //     gate already bounds an update and the whole document by its own numbers.
+        //
+        // A REDACT verdict is never honoured: rewriting one holder's replica is permanent divergence
+        // both sides converge on and neither can see.
+        //
+        // A TRANSIENT block means the gateway is DOWN or its screener faulted. The update is admitted —
+        // holding document convergence hostage to an optional layer breaks a layer that degrades by
+        // design — but it is LOGGED BY NAME, because a weaker guarantee that looks identical to the
+        // stronger one at every surface is how this whole class of defect survives.
+        screenProjected: async (text, ctx) => {
+            const verdict = await config.securityGateway.screenInbound(new TextEncoder().encode(text), {
+                direction: "inbound",
+                agentName: ctx.ownerAgentId,
+                sessionId: ctx.documentId,
+                ...(ctx.correlationId !== undefined ? { correlationId: ctx.correlationId } : {}),
+            });
+            if (verdict.disposition !== "block")
+                return { block: false };
+            if (verdict.terminal !== true) {
+                logger.warn("document.inbound.screen.unavailable", {
+                    documentId: ctx.documentId,
+                    senderAgentId: ctx.senderAgentId,
+                    reason: verdict.reason,
+                    consequence: "the update was admitted WITHOUT a semantic screen",
+                    correlationId: ctx.correlationId,
+                });
+                return { block: false };
+            }
+            if (verdict.reason !== INBOUND_INJECTION_BLOCKED) {
+                logger.info("document.inbound.screen.not_applicable", {
+                    documentId: ctx.documentId,
+                    senderAgentId: ctx.senderAgentId,
+                    reason: verdict.reason,
+                    consequence: "a terminal block this path does not apply to documents — admitted",
+                    correlationId: ctx.correlationId,
+                });
+                return { block: false };
+            }
+            return { block: true, reason: verdict.reason };
+        },
         // M14-D5: a remote agent's id IS its K_local pubkey hex, so this needs no lookup — and a lookup
         // on the critical path of every signature check is precisely what it must not have.
         publicKeyFor: agentPublicKeyFromId,
@@ -3694,7 +4416,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             return provider.sign(tbs);
         },
     });
-    sessionNodeManager.setOnDocumentFrame(documentLayer.onDocumentFrame);
+    // The classify-only half rides the same setter so the router and the ingest cannot disagree
+    // about what a document frame is (DOD-DOC-SCREEN-CLASSIFY-1).
+    sessionNodeManager.setOnDocumentFrame(documentLayer.onDocumentFrame, isDocumentFrame);
     // M14 / DOD-DOC-DELIVERY-2 — the outbound half, wired only now that INBOUND-2 is. The ordering
     // constraint on the DoD line is real and this is where it is honoured: a delivery worker with no
     // inbound counterpart publishes envelopes nobody can answer, so every document would stall at the
@@ -3767,7 +4491,22 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     logger.error("document.delivery.seal_failed", { agent, sessionId, reason: "close_handler_missing", correlationId });
                     return;
                 }
-                const sealed = (await close({ session_id: sessionId, agent }, `doc-delivery-${correlationId}`));
+                /**
+                 * `wait_for_seal: true` — DOD-M15-CLOSEWAIT-1 review MEDIUM-5.
+                 *
+                 * This is NOT an IPC caller. It is an in-process worker awaiting the close for a session
+                 * it opened itself, and the `ok !== true` check below is the only thing that ever reports
+                 * a failed document-delivery seal. The new default answers `ok: true` at COMMITMENT, so
+                 * without this flag that check could never fire for a ceremony failure again — §16.4's
+                 * "the autonomous session still carries the seal" would rest on a detached task nobody
+                 * awaited, retried or reported on.
+                 *
+                 * The whole point of answering early is that a human is watching a terminal. Nobody is
+                 * watching this one, so it takes the blocking form — which also stops each delivery
+                 * leaving a detached ceremony holding a visiting connection for up to eleven minutes,
+                 * overlapping instead of serialising.
+                 */
+                const sealed = (await close({ session_id: sessionId, agent, wait_for_seal: true }, `doc-delivery-${correlationId}`));
                 if (sealed?.ok !== true) {
                     // `cello_close_session` has distinct failure codes — session_already_sealed,
                     // seal_interrupted_*, signaling_reconnecting — and every one of them landed nowhere.
@@ -3780,7 +4519,14 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // transport asked for 0x04, the composition root threw it away, and every document leaf
             // still reached the relay as a MESSAGE. Verified on live traffic: daemon 0.0.145 shipped
             // the fix everywhere except here and the wire was unchanged.
-            sendContent: (agent, sessionId, content, contentHash, correlationId, leafKind) => sessionNodeManager.sendContent(agent, sessionId, content, contentHash, correlationId, leafKind),
+            //
+            // ⚠️ AND `contentHashAlg` IS THE SECOND PARAMETER THIS ADAPTER MUST NOT DROP. The note above
+            // is about `leafKind`, which this wrapper silently swallowed while every other caller passed
+            // it — a thin pass-through is exactly where a new argument goes missing, because nothing
+            // about the call site looks wrong afterwards. B2b's failure mode if it happens again: the
+            // document path sends a salted hash labelled `sha256`, and every peer refuses it.
+            sendContent: (agent, sessionId, content, contentHash, correlationId, leafKind, contentHashAlg) => sessionNodeManager.sendContent(agent, sessionId, content, contentHash, correlationId, leafKind, contentHashAlg),
+            contentHashForSession: (agent, sessionId, content) => sessionNodeManager.contentHashForSession(agent, sessionId, content),
             // The `0x04` doc leaf for a frame WE sent — the same step `cello_send` takes after its own
             // successful send. See the comment at the call site for why this is delivery-critical and
             // not audit bookkeeping.
@@ -3951,6 +4697,33 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // MCP-001: Clean up per-connection state when a connection disconnects
     // MCP-002: Also unregister from notification dispatcher
     ipcServer.onDisconnect((connectionId) => {
+        /**
+         * DOD-M15-IPCVISIBLE-1: SAY THAT IT CLOSED, and say what it was attending.
+         *
+         * `daemon.ipc.connected` fired on every open and nothing on close, so a live client and a dead
+         * one that was never cleaned up looked identical in the log. The attended agent is the field
+         * that matters: attendance dropping was silent, and an agent losing its last attendee changes
+         * whether away-messages fire and who receives doorbells — so a session that stopped waking is
+         * diagnosable from the log rather than by guesswork.
+         */
+        const closing = perConnectionState.get(connectionId);
+        const stillAttending = closing?.currentAgent
+            ? countAttendance(perConnectionState, closing.currentAgent) - 1
+            : null;
+        // RETURNED, not logged here — `ipcServer` merges this into its single
+        // `daemon.ipc.disconnected` line. A second line under the same name left neither carrying the
+        // whole picture and doubled every count (review F8).
+        const disconnectContext = {
+            clientType: closing?.clientType ?? "unknown",
+            attendedAgent: closing?.currentAgent ?? null,
+            ...(stillAttending !== null ? { remainingAttendance: stillAttending } : {}),
+            ...(stillAttending === 0
+                ? {
+                    impact: "that agent has no attending session left — inbound sessions are now answered with " +
+                        "its away message rather than a live reply, and its doorbells reach nobody",
+                }
+                : {}),
+        };
         perConnectionState.delete(connectionId);
         connectionCursors.delete(connectionId); // M8C-CURSOR-1: cursor is connection-scoped, dies with it
         // ...and so is the delivery bookmark (review F1). It is a SEPARATE map from the gate's cursor
@@ -3983,6 +4756,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
             else
                 inboundSessionWaiters.delete(agentName);
         }
+        return disconnectContext;
     });
     // Log daemon.login.validation.complete (stub — all unverified until SIGNAL-001)
     logger.info("daemon.login.validation.complete", {
@@ -4033,6 +4807,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
         if (manifestPollScheduler) {
             manifestPollScheduler.cancel();
         }
+        // DOD-M15-STALEROSTER-1: same discipline as the manifest poll — the stop function sets the
+        // flag so an in-flight sweep cannot re-arm, and the belt-and-suspenders cancel covers the
+        // scheduler-without-sweep case.
+        stopRosterSweep?.();
+        rosterSweepScheduler?.cancel();
         stopRegistryPoll?.();
         if (config.registryPollScheduler) {
             config.registryPollScheduler.cancel();
@@ -4042,6 +4821,32 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // outbound work is not draining. Above the `daemon.stopped` log with the other cancels, because
         // this is "stop making new work", not "tear down transports".
         await restartSealResolver?.stop();
+        /**
+         * DRAIN THE DETACHED SEAL TAILS — review MEDIUM-6, and it sits HERE for the same reason
+         * `restartSealResolver.stop()` does: both are directory ceremonies that must not be cut with
+         * the counterparty holding a commitment this side never acknowledged. Before
+         * `stopAllSignaling()`, because that is what severs the transport underneath them.
+         *
+         * BOUNDED. A ceremony can legitimately wait eleven minutes for a counterparty, and a shutdown
+         * must not. Past the bound they are abandoned deliberately and said out loud — the next boot
+         * resolves them, which is exactly what the restart seal resolver is for.
+         */
+        if (backgroundSeals.size > 0) {
+            const SHUTDOWN_SEAL_DRAIN_MS = 5_000;
+            logger.info("session.seal.background.draining", { count: backgroundSeals.size, budgetMs: SHUTDOWN_SEAL_DRAIN_MS });
+            const drained = await Promise.race([
+                Promise.allSettled([...backgroundSeals]).then(() => true),
+                new Promise((r) => { const t = setTimeout(() => r(false), SHUTDOWN_SEAL_DRAIN_MS); t.unref?.(); }),
+            ]);
+            if (!drained) {
+                logger.warn("session.seal.background.abandoned", {
+                    count: backgroundSeals.size,
+                    impact: "shutdown did not wait for these seal ceremonies. Each session holds a durable commitment " +
+                        "but no receipt yet, and the counterparty may hold a commitment this side never acknowledged.",
+                    guidance: "The next daemon start resolves them via the restart seal resolver; no operator action is needed.",
+                });
+            }
+        }
         logger.info("daemon.stopped", { pid: process.pid, reason });
         // DOD-LOGOUT-EXIT-1: what the teardown actually DID, carried to onStopped so the binary can
         // exit non-zero on a dirty stop. Without it a shutdown that threw halfway — sessions never