@cello-protocol/daemon 0.0.181 → 0.0.183

package/dist/daemon.js

@@ -27,6 +27,7 @@
  */
 import { mkdir } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { dirname, join } from "node:path";
 import { loadAgents } from "./agent-loader.js";
 import { RestartSealResolver } from "./restart-seal-resolver.js";
@@ -35,13 +36,18 @@ import { acquireLock, removeLockIfOwned } from "./lock-file.js";
 import { acquireSingletonLock } from "./singleton-lock.js";
 import { createIpcServer } from "./ipc-server.js";
 import { renderForSurface } from "./vocabulary.js";
+import { RandomizedPollScheduler } from "./manifest-poll-scheduler.js";
+import { startManifestValidityWatch, classifyManifestValidity, describeManifestValidity } from "./manifest-validity.js";
+import { describeDirectoryAuth, directoryAuthRequired } from "./directory-auth-posture.js";
+import { SealFailureStore } from "./seal-failure-store.js";
+import { startRosterSweep, classifyRosterReading, describeRosterFreshness, ROSTER_SWEEP_INTERVAL_MS, } from "./roster-freshness.js";
 import { SessionNodeManager, REVIVAL_WINDOW_MS, REVIVAL_BOUND_SWEEP_MS } from "./session-node-manager.js";
 import { registerGatewayConfigHandlers } from "./gateway-config-handlers.js";
 import { RetryQueue } from "./retry-queue.js";
 import { NonceDedupStore } from "./nonce-dedup.js";
 import { ContentParkClient } from "./content-park-client.js";
 import { NotificationDispatcher } from "./notification-dispatcher.js";
-import { createNode, SignalingManager } from "@cello-protocol/transport";
+import { createNode, SignalingManager, } from "@cello-protocol/transport";
 import { createSignalingConnect } from "./signaling-connect.js";
 import { DbRegistrationPersistence, DbIdentityStore } from "./db-identity-store.js";
 import { DbManifestVersionStore } from "./manifest-version-store-db.js";
@@ -55,7 +61,7 @@ const MAX_SUBMISSION_BODY_CHARS = 4000;
 // CELLO-M7-MSG-001 (AC-013/AC-018): the single application content-size cap, enforced
 // at the send point here (the receive point lives in the transport content decode).
 import { sealParkEnvelope } from "./park-envelope.js";
-import { AgentRelayClient, extractErrorMessage } from "./session-relay-client.js";
+import { LEAF_KIND_MSG, AgentRelayClient, extractErrorMessage } from "./session-relay-client.js";
 import { createReconnectDrain } from "./reconnect-drain.js";
 import { resolveCelloEnv, createTransportSelector, isProductionVariant, } from "./transport-composition.js";
 import { whoLabel } from "./who-label.js";
@@ -66,12 +72,15 @@ import { resolveDirectoryUrl } from "./directory-bootstrap.js";
 import { registerContactHandlers } from "./contact-handlers.js";
 import { createSealCoordinator } from "./seal-coordinator.js";
 import { createTelegramDoorbell } from "./telegram-doorbell.js";
-import { registerSessionContentHandlers } from "./session-content-handlers.js";
+import { registerSessionContentHandlers, sentAuthorship } from "./session-content-handlers.js";
 import { createDocumentLayer, agentPublicKeyFromId } from "./document-layer.js";
 import { isDocumentFrame } from "./document-frame-router.js";
 import { INBOUND_INJECTION_BLOCKED } from "@cello-protocol/gateway";
 import { registerDocumentHandlers } from "./document-handlers.js";
-import { wireContentHash } from "./wire-content-hash.js";
+// `wireContentHash` is no longer imported here: every outbound hash in this file now comes from
+// `SessionNodeManager.contentHashForSession`, which returns the hash and its ALGORITHM together
+// (`DOD-M15-SEALWIRE-1` part B2b). A direct call would be a hash computed without deciding — or
+// recording — how it was made, which is the state that made a version skew look like a tamper.
 import { DocumentPublish } from "./document-publish.js";
 import { createDocumentDeliveryTransport } from "./document-delivery-transport.js";
 import { ReconcileScheduler } from "./document-reconcile-scheduler.js";
@@ -81,6 +90,9 @@ import { createInboundSessions } from "./inbound-sessions.js";
 import { createOutboundSessions } from "./outbound-sessions.js";
 import { registerSessionReadHandlers } from "./session-read-handlers.js";
 import { pullSealCertificate } from "./seal-certificate-pull.js";
+import { createBackup, inspectBackup } from "./backup-restore.js";
+import { resolveCurrentAgentFor } from "./agent-selection.js";
+import { REFUSAL_REASONS, CAPACITY_REASONS } from "./refusal-reasons.js";
 import { revocabilityOf } from "./signal-revocability.js";
 import { registerAgentHandlers } from "./agent-handlers.js";
 import { registerRegisterHandler } from "./register-handler.js";
@@ -98,6 +110,7 @@ import { countAttendance, ContentTakeLedger } from "./co-attendance.js";
 import { isOwnAwayAutoReply, AWAY_AUTO_REPLY_TEXTS, markAsAutoReply, isAutoReplyMarked } from "./away-detection.js";
 import { createDeliveryOpenRegistry } from "./delivery-open-registry.js";
 import { FrontierMismatchStore, renderFrontierMismatch } from "./frontier-mismatch.js";
+import { relayOnlyState } from "./relay-only.js";
 import { decodeCbor } from "@cello-protocol/protocol-types";
 // Minimal no-op KeyProvider stub for session nodes.
 // Session nodes don't need signing keys — libp2p generates its own fresh
@@ -109,6 +122,20 @@ const SESSION_NODE_KEY_STUB = {
 };
 // Production session node factory — wraps createNode from @cello-protocol/transport
 export class ProductionSessionNodeFactory {
+    logger;
+    /**
+     * DOD-M15-IDLE-CONNS-1 — OPTIONAL, and optional for one reason only: this factory is constructed
+     * with no arguments in four existing tests, and requiring a logger would turn them into type
+     * errors for a unit that has nothing to do with them.
+     *
+     * The cost is stated rather than hidden: with no logger, a reaped connection is silent, which is
+     * exactly the "guard nobody hears" this milestone has found four times. `startDaemon` passes one
+     * — that is the production path — and the sweep only runs on nodes this factory builds as
+     * receivers, so the silent case is a test-only fixture.
+     */
+    constructor(logger) {
+        this.logger = logger;
+    }
     async createNode(config) {
         // DOD-NAT-REACHABILITY-1: the STANDING RECEIVER — the node that accepts every
         // inbound session — must bind a ROUTABLE interface by default. The old
@@ -136,15 +163,121 @@ export class ProductionSessionNodeFactory {
             listenAddresses: [listenAddr, ...(config.circuitRelayListenAddrs ?? [])],
             ...(announce ? { announceAddresses: announce } : {}),
             connectionGater: config.connectionGater,
+            // DOD-M15-RELAYONLY-1: an agent that asked never to be directly reachable must not hole-punch
+            // its way to a direct connection. dcutr's job is to UPGRADE a relayed connection, and the
+            // INBOUND side starts that upgrade — which is precisely the standing receiver. So filtering
+            // what the directory publishes is not enough on its own: the address a peer cannot be TOLD, a
+            // hole-punch still REVEALS, and it happens inside libp2p after every assertion has passed.
+            ...(config.relayOnly === true ? { holePunch: { enabled: false } } : {}),
             // Forward the role. After DOD-NAT-REACHABILITY-1, dcutr is on every node
-            // type; nodeType's remaining transport effect is the HOP gate (client
-            // types never advertise circuit-relay HOP).
+            // type unless relay-only turns it off above; nodeType's remaining transport effect is the HOP
+            // gate (client types never advertise circuit-relay HOP).
             nodeType: config.nodeType,
             // DOD-M12B-SESSION-SEED-1: forward the caller's transport seed when it supplied one, so a
             // rebuilt session node returns at the peer id the counterparty already holds. Omitted (rather
             // than passed as undefined) when absent, keeping createNode's "generate a fresh key" default
             // for every node that is not session-scoped.
             ...(config.transportPrivateKey ? { transportPrivateKey: config.transportPrivateKey } : {}),
+            /**
+             * DOD-M15-IDLE-CONNS-1 — the idle sweep is armed on the node that STARTS as a standing
+             * receiver.
+             *
+             * **It is NOT "the standing receiver only", and an earlier version of this comment said so
+             * and was false.** `acceptSession` does not build a new node: it moves this same `CelloNode`
+             * from `#standingReceivers` into `#activeNodes`, so the interval keeps running after
+             * promotion, against the session's own counterparty. Review measured the consequence — the
+             * counterparty was hung up mid-conversation and the next send failed with `no_connection`,
+             * with nothing anywhere naming the local sweep.
+             *
+             * That is survivable only because the spared predicate below names the counterparty. The
+             * arrangement is deliberate now rather than accidental: one node, one interval, and the gate
+             * decides who is off-limits as it narrows.
+             */
+            ...(isReceiver
+                ? {
+                    idleConnectionReaper: {
+                        /**
+                         * C3 — THE GUARD IS HEARD. A hang-up that tells nobody is indistinguishable from the
+                         * thing simply not happening, and review measured what that costs: the operator's
+                         * next send returns `no_connection`, `session.transport.redial.unavailable` says
+                         * "every send parks until they re-establish", and not one word in that chain names a
+                         * `setInterval` on their own machine.
+                         *
+                         * WARN and CONTINUE, deliberately: this is resource bounding, not a security event.
+                         * Nothing is refused and no session state changes — so it is loud, and it does not
+                         * block (Invariant 2's own distinction).
+                         */
+                        onReaped: (e) => {
+                            if (e.reason === "never_carried_a_stream") {
+                                this.logger?.warn("session.node.connection.reaped", {
+                                    sessionId: config.sessionId,
+                                    peerId: e.peerId,
+                                    ageMs: e.ageMs,
+                                    observation: "an inbound connection was hung up after never carrying a stream since it opened",
+                                    impact: "no session state changed and nothing was refused; if this peer returns it must dial again",
+                                });
+                                return;
+                            }
+                            // A sweep that cannot do its job is a different event and must not read as one that
+                            // did. `hangUp`'s `invalid_peer_id` is a NAMED reason written so a malformed id is
+                            // not read as a connection problem — preserved here rather than flattened.
+                            this.logger?.error("session.node.connection.reap_failed", {
+                                sessionId: config.sessionId,
+                                peerId: e.peerId,
+                                reason: e.reason,
+                                error: e.error,
+                                impact: "an idle connection was NOT closed; it continues to hold a slot against the connection cap",
+                            });
+                        },
+                        /**
+                         * C4 — THE COUNT THE DoD ASKS FOR, and the reason this callback exists at all.
+                         *
+                         * The line says *"measure a healthy daemon's connection count first"*, and nothing in
+                         * the tree reported one — not `cello_status`, not the CLI, not the log. Exposing the
+                         * CAPS without the COUNT would have been a capability nothing reads, which is this
+                         * milestone's own "no consumer, no ship". DEBUG because it is a census on a timer,
+                         * not an event: it exists to be greppable when a cap is finally tuned.
+                         */
+                        onObserved: (c) => {
+                            this.logger?.debug("transport.connections.observed", {
+                                sessionId: config.sessionId,
+                                total: c.total,
+                                inbound: c.inbound,
+                                neverSpoke: c.neverSpoke,
+                                maxConnections: c.maxConnections,
+                            });
+                        },
+                    },
+                }
+                : {}),
+        }).then((node) => {
+            /**
+             * SPARE WHAT REACHABILITY DEPENDS ON — two things, and the second was missing.
+             *
+             * **The reserved relay.** The same list `DOD-M15-FRAME-1`'s eviction sweep spares, for the
+             * reason its comment gives: reservation refreshes ride those peers, and hanging one up costs
+             * the agent its inbound reachability. A reservation is IDLE BY NATURE between refreshes,
+             * which is exactly the shape the sweep hunts.
+             *
+             * **The peer the gate currently names.** `getAllowedPeerId()` is the admitted dialer before
+             * promotion and the counterparty after it. Without this the sweep reaps the one peer the
+             * session exists for.
+             *
+             * READ LIVE on every sweep, never captured: reservations are lost and retaken constantly
+             * (2,675 `reservation.lost` in one daemon's log) and `#allowedPeerId` changes at offer,
+             * promotion and refusal. A set frozen at build time is wrong within minutes.
+             *
+             * WHAT IS LEFT TO REAP, stated because a guard with no population is theatre: a peer that was
+             * admitted by an offer which was then refused or expired. `closeInbound()` returns
+             * `#allowedPeerId` to null, and libp2p never re-runs a gater against a connection that
+             * already exists — so that peer stays attached, named by nobody, speaking nothing. That is
+             * the connection this unit removes.
+             */
+            const gater = config.connectionGater;
+            if (isReceiver && gater) {
+                node.setIdleReaperSpared((peerId) => gater.isAllowedOutboundPeer(peerId) || gater.getAllowedPeerId() === peerId);
+            }
+            return node;
         });
     }
 }
@@ -195,6 +328,43 @@ async function startDaemonHoldingLock(config, singletonLock) {
     if (manifestProvider && (!manifestRootKeys || !manifestThreshold || manifestThreshold <= 0)) {
         throw new Error("DaemonConfig: manifestProvider requires manifestRootKeys (non-empty) and manifestThreshold (positive integer >= 1)");
     }
+    /**
+     * DOD-M15-DIRAUTH-1 — an operator can DEMAND directory identity authentication.
+     *
+     * HERE, under the ADV-006/008 rule above, because this IS pure config validation: both operands
+     * are already in hand and it touches nothing.
+     *
+     * Review F1 caught me putting it ninety lines lower, next to ADV-002, on the reasoning that it
+     * "mirrors" it. It does not. ADV-002 sits down there because it MUST — it depends on
+     * `verifyStartupManifest`, which depends on the anti-rollback floor in the DB. This depends on
+     * nothing, and down there it ran AFTER: the irreversible flat-file → SQLCipher identity migration
+     * (which renames and unlinks files), the creation of `sessions.db` and its key, and the sweep that
+     * marks every `active` session `interrupted` with `interrupted_by='local'`.
+     *
+     * So a misconfigured daemon "failed to start" and changed the operator's record on the way out —
+     * two live sessions permanently interrupted, attributed to a local cause, by a config check that
+     * could have run before anything was touched.
+     */
+    if (directoryAuthRequired(process.env) && challengeVerifier === undefined) {
+        const url = config.directoryHttpUrl ?? resolveDirectoryUrl(process.env);
+        logger.error("directory.auth.required.unavailable", {
+            directoryUrl: url,
+            impact: "the daemon refused to start rather than connect without directory identity authentication.",
+            guidance: "CELLO_REQUIRE_DIRECTORY_AUTH is set, but no challenge verifier could be built for this " +
+                "directory URL. Point CELLO_DIRECTORY_URL at a bundled endpoint, or supply a manifest with " +
+                "CELLO_CONSORTIUM_MANIFEST plus CELLO_CONSORTIUM_ROOT_KEYS and CELLO_CONSORTIUM_THRESHOLD " +
+                "(all three are required together), or set CELLO_REQUIRE_DIRECTORY_AUTH to 0/false/no/off " +
+                "to accept the risk.",
+        });
+        throw new Error(`CELLO_REQUIRE_DIRECTORY_AUTH is set, but directory identity authentication (step 6) cannot ` +
+            `be enforced: no challenge verifier was supplied for this daemon. The directory URL is ` +
+            `compared against the bundled consortium roster after NORMALISATION (trimmed, trailing slash ` +
+            `dropped, lowercased) — so case and a trailing slash are forgiven, but a DNS hostname ` +
+            `pointing at exactly the right machine is NOT, which is the usual cause. Either use a bundled ` +
+            `endpoint address, or supply a manifest with CELLO_CONSORTIUM_MANIFEST plus ` +
+            `CELLO_CONSORTIUM_ROOT_KEYS and CELLO_CONSORTIUM_THRESHOLD (all three are required together), ` +
+            `or set CELLO_REQUIRE_DIRECTORY_AUTH to 0/false/no/off to start without step 6.`);
+    }
     // ── PERSIST-002: open the encrypted store FIRST (runs the one-time flat-file → SQLCipher migration
     // (AC-006) + creates the agents/manifest_state schema), under the single-instance lock. This must
     // precede the manifest verification below because the manifest version is now stored in the
@@ -230,7 +400,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // screening, so a wiring mistake shows up here instead of hiding behind a correct-looking line.
     logger.info("security.gateway.connected", { mode: securityGateway.mode });
     const sessionNodeManager = new SessionNodeManager({
-        factory: sessionNodeFactory ?? new ProductionSessionNodeFactory(),
+        factory: sessionNodeFactory ?? new ProductionSessionNodeFactory(logger),
         logger,
         dbPath: join(celloDir, "sessions.db"),
         contentTtfMs: config.contentTtfMs,
@@ -250,6 +420,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
         manifestThreshold,
         manifestVersionStore,
         logger,
+        // DOD-M15-STALEROSTER-1: the same injected fetch the sweep uses, so the startup probe and the
+        // background probe are exercised through one seam rather than one being untestable.
+        ...(config.fetchFn ? { fetchFn: config.fetchFn } : {}),
     });
     // ADV-002: an operator who configures manifestProvider has opted INTO manifest enforcement, so a
     // failed verification is fatal — never a warning we start anyway on.
@@ -268,7 +441,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
             "Check the logs for the specific failure reason (manifest_signature_invalid, manifest_expired, or manifest_version_rollback).");
     }
     // The manifest poll starts only AFTER the refuse above — a refused startup must not leak a timer.
-    const { resolveConsortiumRoster, failoverEndpointResolver, getFailoverEndpoint, getUnresolvedNodes, getUnresolvedSweptAt, stopHttpManifestPoll } = createConsortiumRouting({
+    const { resolveConsortiumRoster, failoverEndpointResolver, getFailoverEndpoint, getUnresolvedNodes, getUnresolvedSweptAt, getDeclaredNodeCount, stopHttpManifestPoll } = createConsortiumRouting({
         manifestProvider,
         manifestRootKeys,
         manifestThreshold,
@@ -282,7 +455,96 @@ async function startDaemonHoldingLock(config, singletonLock) {
         initialUnresolvedNodes: startupUnresolvedNodes,
         initialUnresolvedSweptAt: startupSweptAt,
         logger,
+        ...(config.fetchFn ? { fetchFn: config.fetchFn } : {}),
+    });
+    /**
+     * DOD-M15-STALEROSTER-1 — keep measuring directory reachability even when nothing is wrong.
+     *
+     * Every existing caller of the sweep is ACTIVITY-driven — ceremonies, session setup,
+     * `cello_refresh`, the seal broker. So an IDLE daemon never re-measures, and sitting idle is what
+     * a daemon does between conversations: the reading it was seeded with at boot is the reading it
+     * still has an hour later. Measured twice, on two machines — node failures from minutes past
+     * displayed while `curl` reached all three nodes in 37–184 ms.
+     *
+     * (An earlier version of this comment said the sweep had ONE caller, the failover path, and that
+     * recovering was what stopped the measurement. That was wrong — there are ten — and it is
+     * corrected here rather than deleted because believing it is why the concurrent-sweep race in
+     * `consortium-bootstrap.ts` went unnoticed until review.)
+     *
+     * Skipped when there is no manifest provider: there is no node roster to enumerate, so a timer
+     * that can only ever re-measure nothing is noise. That case is NOT silent — `cello_status`
+     * reports `measurement: "not_configured"` and says why.
+     */
+    /**
+     * WHERE the held manifest came from, because it decides what the operator can actually DO about
+     * an expired one — `DOD-M15-MANIFEST-EXPIRY-LIVE-1` review F5.
+     *
+     * `EmbeddedManifestProvider` is the compiled-in bundled roster: there is no file to replace and no
+     * poll to adopt a replacement, so "rotate the manifest" is not an available action and telling
+     * that operator to do it routes them toward the one workaround that silently disables directory
+     * identity authentication. Detected by the provider's own constructor rather than by re-reading
+     * the env var, so a caller that injects a provider directly is classified by what it IS.
+     */
+    const manifestOrigin = manifestProvider?.constructor?.name === "EmbeddedManifestProvider" ? "bundled" : "file";
+    /** REVIEW F4: the last sweep failure, surfaced in `cello_status` alongside the log line. */
+    let lastRosterSweepError;
+    /**
+     * DOD-M15-MANIFEST-EXPIRY-LIVE-1 — re-check the trust anchor's validity while the daemon runs.
+     *
+     * The window is enforced at STARTUP and nowhere else. The manifest poll's expiry check looks at
+     * the manifest being FETCHED, never the one held, so a daemon past its expiry keeps polling, keeps
+     * correctly refusing expired replacements, and keeps using the lapsed anchor it already has.
+     *
+     * Rides the roster sweep rather than owning a timer: that tick already fires every 90–180 s on
+     * exactly the path where a manifest provider exists.
+     */
+    const checkManifestValidity = startManifestValidityWatch({
+        getManifest: () => manifestProvider?.getCurrentManifest() ?? null,
+        logger,
     });
+    const rosterSweepScheduler = manifestProvider
+        ? config.rosterSweepScheduler ??
+            new RandomizedPollScheduler({ minMs: ROSTER_SWEEP_INTERVAL_MS, maxMs: ROSTER_SWEEP_INTERVAL_MS * 2 })
+        : undefined;
+    const stopRosterSweep = rosterSweepScheduler
+        ? startRosterSweep({
+            scheduler: rosterSweepScheduler,
+            // FAST_PROBE is deliberately NOT used here. It exists because the failover resolver runs
+            // inside the 10 s signaling wait; nothing waits on this sweep, so it can afford the
+            // patient probe and give the more trustworthy answer.
+            sweep: async () => {
+                /**
+                 * DOD-M15-MANIFEST-EXPIRY-LIVE-1: the anchor's validity is re-checked on the same tick.
+                 * BEFORE the probe, so an expired manifest is reported even on a cycle where every node is
+                 * unreachable and the roster resolve throws.
+                 *
+                 * Its OWN try/catch — review F11. Sharing the sweep's error path meant a throw in here
+                 * would surface as `directory.roster.sweep.failed` AND skip `resolveConsortiumRoster()`
+                 * entirely: the roster reading would freeze while the operator was pointed at the
+                 * directory. A manifest-check failure must never be reported as a directory failure, and
+                 * must never cost the measurement it rides along with.
+                 */
+                try {
+                    checkManifestValidity();
+                }
+                catch (err) {
+                    logger.error("directory.auth.manifest.check.failed", {
+                        error: err instanceof Error ? err.message : String(err),
+                        impact: "the manifest validity re-check did not run this cycle. cello_status still computes " +
+                            "it independently on every read, so the FIELD is unaffected; what is lost is the " +
+                            "unprompted log line on a transition.",
+                    });
+                }
+                return resolveConsortiumRoster();
+            },
+            logger,
+            // REVIEW F4: the failure reaches the agent's response, not just the log. Without this a
+            // sweep failing every cycle is invisible for the first two or three failures, because the
+            // reading is still inside its 5-minute freshness bound and reports stale:false.
+            onSweepError: (e) => { lastRosterSweepError = e; },
+            onSweepSuccess: () => { lastRosterSweepError = undefined; },
+        })
+        : undefined;
     // DOD-REGISTRY-1: type registry poll — daemon-level, runs even with zero agents.
     // When registryPubkey is configured, the daemon polls GET /registry, verifies the inner
     // Ed25519 signature, and updates the in-memory TypeRegistry. A poll failure never blanks
@@ -334,6 +596,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
     for (const a of loadedAgents) {
         keyProviders.set(a.name, a.keyProvider);
     }
+    // DOD-M15-EPHEMERAL-AUTH-1: the session manager signs each session's throwaway key with the
+    // agent's identity, so it needs the same providers. Injected here rather than through the
+    // constructor because this map is built after the manager exists — the same reason
+    // `setParkedDrainHook` is a setter.
+    sessionNodeManager.setKeyProviderResolver((agentName) => keyProviders.get(agentName));
     // Constructed HERE, before ANY boot-time caller. autoRecoverForAgent is invoked from an agent's
     // onConnected and from the seal-upgrade content gate — both of which run long before the IPC
     // handler map exists. Its handlers register later (phase 2), which is what lets this sit up here.
@@ -544,6 +811,18 @@ async function startDaemonHoldingLock(config, singletonLock) {
             onRelayEndpoints: (endpoints) => {
                 sessionNodeManager.setDirectoryRelayEndpoints(agentName, endpoints.map((e) => ({ relayPeerId: e.peerId, relayAddrs: e.addrs })));
             },
+            // DOD-M15-RELAYSLOTS-1: and the credential those relays require. Same frame, same cadence as
+            // the endpoints above — every connect and every reconnect, which is what keeps a token that
+            // expires within the hour current for a receiver that lives much longer than that.
+            onOnlineToken: (token) => {
+                sessionNodeManager.setDirectoryOnlineToken(agentName, token);
+            },
+            // Review M1: and when there is none, WHY — so the operator surface can say "this directory
+            // does not know this agent" instead of "check your directory connection" about a connection
+            // that just succeeded.
+            onOnlineTokenAbsent: (reason) => {
+                sessionNodeManager.setDirectoryOnlineTokenAbsent(agentName, reason);
+            },
         });
         const mgr = new SignalingManager({
             connect,
@@ -580,6 +859,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName,
             persistence: getPersistence(agentName),
             agentPubkeyHex,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): the co-sign path must check the root before this
+            // agent's key endorses it. Same predicate as the receiving path — one implementation, so the
+            // two halves cannot drift about what a mismatch is.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: agentKeyProvider,
             getNode: entry.getNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -592,6 +875,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName,
             persistence: getPersistence(agentName),
             agentPubkeyHex,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): the co-sign path must check the root before this
+            // agent's key endorses it. Same predicate as the receiving path — one implementation, so the
+            // two halves cannot drift about what a mismatch is.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: agentKeyProvider,
             getNode: entry.getNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -606,6 +893,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
         wireSessionOfferHandler({
             agentName,
             getStandingReceiverEndpoint: () => sessionNodeManager.getStandingReceiverInfo(agentName),
+            admitOfferedDialer: (peerId, sessionIdHex) => sessionNodeManager.admitOfferedDialer(agentName, peerId, sessionIdHex),
+            // DOD-M15-RELAYONLY-1: lets the handler tell "no addresses because relay-only filtered them"
+            // from "no addresses yet", which need opposite answers — a refusal, and the pre-existing path.
+            isRelayOnly: () => relayOnlyState((key) => sessionNodeManager.getSetting(agentName, key), sessionNodeManager.hasDatabase()) !== "off",
             signaling: mgr,
             logger,
         });
@@ -654,6 +945,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName: agent.name,
             persistence: getPersistence(agent.name),
             agentPubkeyHex: agent.pubkey,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): gate the co-signature on the root check.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: agent.keyProvider,
             getNode: noSharedDirectoryNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -665,6 +958,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName: agent.name,
             persistence: getPersistence(agent.name),
             agentPubkeyHex: agent.pubkey,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): gate the co-signature on the root check.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: agent.keyProvider,
             getNode: noSharedDirectoryNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -675,6 +970,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
         wireSessionOfferHandler({
             agentName: agent.name,
             getStandingReceiverEndpoint: () => sessionNodeManager.getStandingReceiverInfo(agent.name),
+            admitOfferedDialer: (peerId, sessionIdHex) => sessionNodeManager.admitOfferedDialer(agent.name, peerId, sessionIdHex),
+            // DOD-M15-RELAYONLY-1 — see the note on the sibling call site above.
+            isRelayOnly: () => relayOnlyState((key) => sessionNodeManager.getSetting(agent.name, key), sessionNodeManager.hasDatabase()) !== "off",
             signaling: mgr,
             logger,
         });
@@ -890,6 +1188,22 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // whether its counterparty is quiet or its sibling was faster. Written at the destructive drain in
     // session-content-handlers; read at that handler's timeout. Delivery itself is unchanged.
     const contentTakes = new ContentTakeLedger();
+    /**
+     * In-flight background seal ceremonies — `DOD-M15-CLOSEWAIT-1` review MEDIUM-6.
+     *
+     * The close now answers at commitment and finishes the ceremony detached. Without this the tail
+     * was the ONE background task `stop()` could cut at an arbitrary point, while it cancels or awaits
+     * every other one.
+     */
+    const backgroundSeals = new Set();
+    /**
+     * DOD-M15-SEAL-FAILED-TERMINAL-1 — the last background seal failure per session.
+     *
+     * In memory on purpose: a restart makes "failed" the WRONG answer, because the boot sweep plus the
+     * restart seal resolver retry the session. A marker whose lifetime is the process matches the
+     * lifetime of the condition it describes.
+     */
+    const sealFailures = new SealFailureStore();
     // DOD-AWAY-WRAP-1 AC1: request text is a leave-a-message greeting; agentName is spliced in at
     // the call site so it names the specific away agent.
     // DOD-AWAY-ACK-ONESHOT-TEXT-1 (live defect 2026-07-24): the ack must state the one-shot rule —
@@ -979,9 +1293,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // FRONT precisely so [[WRAP]] keeps the end position the counterparty's detector anchors on.
                     const rejectText = markAsAutoReply("This inbox only accepts one message per visit. Closing. [[WRAP]]");
                     const rejectBytes = new TextEncoder().encode(rejectText);
-                    const rejectHash = wireContentHash(rejectBytes);
+                    // B2b: one decision point for the hash AND its algorithm — see `contentHashForSession`.
+                    const reject = await sessionNodeManager.contentHashForSession(agentName, sessionId, rejectBytes);
                     // Best-effort: a send failure still triggers the seal — we are closing regardless.
-                    const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, rejectBytes, new Uint8Array(rejectHash), randomUUID());
+                    const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, rejectBytes, new Uint8Array(reject.hash), randomUUID(), LEAF_KIND_MSG, reject.alg);
                     // M12-P13: commit the leaf when the rejection went out OR when it is durably queued —
                     // either way the relay already witnessed its sequence. This caller is the sharpest case
                     // of the three: the seal is initiated immediately below, so a hole here does not merely
@@ -989,14 +1304,17 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // counterparty will still receive content at. The roots then cannot agree, and the
                     // session is unsealable for good.
                     if (sendResult.ok || sendResult.durable) {
-                        const rejectHashHex = Buffer.from(rejectHash).toString("hex");
+                        const rejectHashHex = Buffer.from(reject.hash).toString("hex");
                         // DOD-M12B-INDEX-1: at the relay's position, not the tail. This is the riskiest append
                         // in the codebase for that — the seal is initiated a few lines below, so a leaf at the
                         // wrong index does not merely stall the far side, it seals a tree the counterparty can
                         // never agree with.
-                        const placed = sessionNodeManager.placeOwnLeaf(agentName, sessionId, rejectHashHex, rejectBytes, sendResult.sequenceNumber, randomUUID());
+                        // The proof travels with the leaf, not only with the transcript row below: when this
+                        // append is HELD behind a gap, the `recordTranscriptMessage` call is skipped entirely
+                        // and the held entry is the only thing that reaches the row on release.
+                        const placed = sessionNodeManager.placeOwnLeaf(agentName, sessionId, rejectHashHex, rejectBytes, sendResult.sequenceNumber, randomUUID(), "msg", sentAuthorship(sendResult));
                         if (placed.placed) {
-                            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placed.leafIndex, "sent", rejectBytes, randomUUID());
+                            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placed.leafIndex, "sent", rejectBytes, randomUUID(), sentAuthorship(sendResult));
                         }
                         logger.info("session.away.inbox.oneshot.rejected", { agentName, sessionId, sequenceNumber: placed.placed ? placed.leafIndex : placed.heldAt, committed: placed.placed, queued: !sendResult.ok });
                     }
@@ -1015,85 +1333,124 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     // not have ingested it yet when the seal request arrives over the signaling channel.
                     // The relay path avoids this entirely — it posts a SEAL ctrl leaf and waits for the
                     // counterparty to independently co-seal; no bilateral leaf-count comparison needed.
-                    void (async () => {
-                        const correlationId = randomUUID();
-                        const sk = sealKey(agentName, sessionId);
-                        if (sealInterruptedInProgress.has(sk))
-                            return;
-                        sealInterruptedInProgress.add(sk);
-                        try {
-                            let resolveSeal;
-                            const sealedP = new Promise((r) => { resolveSeal = r; });
-                            pendingSealWaiters.set(sk, resolveSeal);
-                            const submit = await sessionNodeManager.submitSealLeaf(agentName, sessionId, correlationId);
-                            if (!submit.ok && submit.reason !== "responder_seal_already_submitted") {
-                                pendingSealWaiters.delete(sk);
-                                if (submit.reason === "relay_unavailable") {
-                                    const fallback = await handleActiveSealFlow(sessionId, record2, correlationId);
-                                    if (fallback.ok) {
-                                        logger.info("session.away.inbox.oneshot.seal_initiated", { agentName, sessionId, path: "signaling_fallback" });
+                    /**
+                     * DOD-M15-DIVERGE-1 (review HIGH-3) — the gate has to hold on the path with no operator.
+                     *
+                     * `cello_close_session` refuses a diverged record, but this autonomous path never
+                     * consulted `sealReadiness` at all: it read `placed.placed` and discarded
+                     * `placed.diverged`, then initiated the seal directly. So "a diverged session is blocked
+                     * from sealing" held for the close a human drives and not for the one that runs itself —
+                     * which is the worse of the two, because the append two lines above is, by its own
+                     * comment, "the riskiest append in the codebase" for exactly this reason.
+                     *
+                     * THE LOG IS THE SURFACE HERE, and that is not a weakening of Invariant 2. There is no
+                     * caller to answer — nothing is awaiting a response on this path — so the log carries the
+                     * whole warning rather than half of it.
+                     */
+                    const oneshotReadiness = sessionNodeManager.sealReadiness(agentName, sessionId);
+                    if (oneshotReadiness.diverged) {
+                        logger.warn("session.away.inbox.oneshot.seal_skipped_diverged", {
+                            agentName, sessionId,
+                            treeSize: oneshotReadiness.treeSize, highWaterSeq: oneshotReadiness.highWaterSeq,
+                            impact: "this side's tree parted from the relay's ordering, so the seal was NOT initiated — the session stays closeable by hand, where the operator is told what parted and can compare counts with the counterparty before deciding",
+                        });
+                    }
+                    else {
+                        void (async () => {
+                            const correlationId = randomUUID();
+                            const sk = sealKey(agentName, sessionId);
+                            if (sealInterruptedInProgress.has(sk))
+                                return;
+                            sealInterruptedInProgress.add(sk);
+                            try {
+                                // DOD-M15-SEALWIRE-1 bullet 2 (review F4): SealCompletion is now a union — a refused
+                                // certificate resolves the waiter rather than dropping it, so this path must handle it
+                                // too rather than treating a refusal as a seal.
+                                let resolveSeal;
+                                const sealedP = new Promise((r) => { resolveSeal = r; });
+                                pendingSealWaiters.set(sk, resolveSeal);
+                                const submit = await sessionNodeManager.submitSealLeaf(agentName, sessionId, correlationId);
+                                if (!submit.ok && submit.reason !== "responder_seal_already_submitted") {
+                                    pendingSealWaiters.delete(sk);
+                                    if (submit.reason === "relay_unavailable") {
+                                        const fallback = await handleActiveSealFlow(sessionId, record2, correlationId);
+                                        if (fallback.ok) {
+                                            logger.info("session.away.inbox.oneshot.seal_initiated", { agentName, sessionId, path: "signaling_fallback" });
+                                        }
+                                        else {
+                                            logger.warn("session.away.inbox.oneshot.seal_initiate_failed", { agentName, sessionId, reason: fallback.reason, path: "signaling_fallback" });
+                                        }
                                     }
                                     else {
-                                        logger.warn("session.away.inbox.oneshot.seal_initiate_failed", { agentName, sessionId, reason: fallback.reason, path: "signaling_fallback" });
+                                        logger.warn("session.away.inbox.oneshot.seal_initiate_failed", { agentName, sessionId, reason: submit.reason });
                                     }
+                                    return;
                                 }
-                                else {
-                                    logger.warn("session.away.inbox.oneshot.seal_initiate_failed", { agentName, sessionId, reason: submit.reason });
+                                logger.info("session.away.inbox.oneshot.seal_initiated", { agentName, sessionId, path: "relay" });
+                                const bilateralTimeoutMs = Number(process.env["CELLO_SEAL_BILATERAL_TIMEOUT_MS"]) || 660_000;
+                                let timer;
+                                const timeoutP = new Promise((r) => { timer = setTimeout(() => r(null), bilateralTimeoutMs); });
+                                const sealedCompletion = await Promise.race([sealedP, timeoutP]);
+                                clearTimeout(timer);
+                                pendingSealWaiters.delete(sk);
+                                if (sealedCompletion !== null) {
+                                    // DOD-M15-SEALWIRE-1 bullet 2 (review F4): a REFUSED certificate resolves the waiter
+                                    // now rather than being dropped, so this path must tell the two apart — logging a
+                                    // refusal as "sealed" would be the silent acceptance the whole bullet exists to stop.
+                                    if ("refused" in sealedCompletion) {
+                                        logger.error("session.away.inbox.oneshot.seal_refused", {
+                                            agentName, sessionId, reason: sealedCompletion.reason, detail: sealedCompletion.detail,
+                                            impact: "the away auto-seal was REFUSED: the directory returned a validly signed root " +
+                                                "that does not describe this conversation. The session is NOT sealed and nothing " +
+                                                "was signed with this agent's key.",
+                                        });
+                                        return;
+                                    }
+                                    logger.info("session.away.inbox.oneshot.sealed", { agentName, sessionId, sealedRoot: sealedCompletion.rootHex });
+                                    return;
                                 }
-                                return;
-                            }
-                            logger.info("session.away.inbox.oneshot.seal_initiated", { agentName, sessionId, path: "relay" });
-                            const bilateralTimeoutMs = Number(process.env["CELLO_SEAL_BILATERAL_TIMEOUT_MS"]) || 660_000;
-                            let timer;
-                            const timeoutP = new Promise((r) => { timer = setTimeout(() => r(null), bilateralTimeoutMs); });
-                            const sealedCompletion = await Promise.race([sealedP, timeoutP]);
-                            clearTimeout(timer);
-                            pendingSealWaiters.delete(sk);
-                            if (sealedCompletion !== null) {
-                                logger.info("session.away.inbox.oneshot.sealed", { agentName, sessionId, sealedRoot: sealedCompletion.rootHex });
-                                return;
-                            }
-                            // Bilateral timeout — escalate to unilateral seal.
-                            const escalation = submit.ok
-                                ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
-                                : submit.reason === "responder_seal_already_submitted" &&
-                                    typeof submit.reportedRootHex === "string" &&
-                                    typeof submit.sequenceNumber === "number"
+                                // Bilateral timeout — escalate to unilateral seal.
+                                const escalation = submit.ok
                                     ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
-                                    : null;
-                            if (!escalation) {
-                                logger.warn("session.away.inbox.oneshot.seal_pending", { agentName, sessionId });
-                                return;
-                            }
-                            // DOD-M12B-SEAL-ESCALATE-DUP-1: THE SHARED ESCALATION, not a second copy.
-                            //
-                            // This used to be a line-for-line duplicate with its own hardcoded 30 s timeout, and
-                            // it missed every refusal the other one gained: an empty carry, a gappy chain, two of
-                            // our own ctrl leaves (permanently unsealable), and a bilateral seal already running.
-                            // It spent the full timeout on each and then reported `seal_unilateral_timeout` — the
-                            // label that names our own wait. Sharing the body is what stops that drifting again.
-                            const uni = await runUnilateralEscalation({
-                                logger, sessionNodeManager, sendOver, pendingUnilateralWaiters, sealKey,
-                                getKeyProvider: (a) => keyProviders.get(a),
-                                timeoutMs: UNILATERAL_SEAL_TIMEOUT_MS,
-                            }, agentName, sessionId, escalation, correlationId, { refuseOnUnusableCarry: true });
-                            if (uni.ok) {
-                                logger.info("session.away.inbox.oneshot.sealed", { agentName, sessionId, sealedRoot: uni.sealed_root, sealType: "unilateral" });
+                                    : submit.reason === "responder_seal_already_submitted" &&
+                                        typeof submit.reportedRootHex === "string" &&
+                                        typeof submit.sequenceNumber === "number"
+                                        ? { reportedRootHex: submit.reportedRootHex, sequenceNumber: submit.sequenceNumber }
+                                        : null;
+                                if (!escalation) {
+                                    logger.warn("session.away.inbox.oneshot.seal_pending", { agentName, sessionId });
+                                    return;
+                                }
+                                // DOD-M12B-SEAL-ESCALATE-DUP-1: THE SHARED ESCALATION, not a second copy.
+                                //
+                                // This used to be a line-for-line duplicate with its own hardcoded 30 s timeout, and
+                                // it missed every refusal the other one gained: an empty carry, a gappy chain, two of
+                                // our own ctrl leaves (permanently unsealable), and a bilateral seal already running.
+                                // It spent the full timeout on each and then reported `seal_unilateral_timeout` — the
+                                // label that names our own wait. Sharing the body is what stops that drifting again.
+                                const uni = await runUnilateralEscalation({
+                                    logger, sessionNodeManager, sendOver, pendingUnilateralWaiters, sealKey,
+                                    getKeyProvider: (a) => keyProviders.get(a),
+                                    timeoutMs: UNILATERAL_SEAL_TIMEOUT_MS,
+                                }, agentName, sessionId, escalation, correlationId, { refuseOnUnusableCarry: true });
+                                if (uni.ok) {
+                                    logger.info("session.away.inbox.oneshot.sealed", { agentName, sessionId, sealedRoot: uni.sealed_root, sealType: "unilateral" });
+                                }
+                                else {
+                                    // CARRY THE GUIDANCE. The four refusals this path just gained come with the
+                                    // sentence that tells an operator whether to retry or force-abandon — and the log
+                                    // is this path's ONLY surface, so dropping it leaves a nameable cause with no
+                                    // action attached. The old reasons had no guidance to lose; these do.
+                                    logger.warn("session.away.inbox.oneshot.seal_unilateral_failed", {
+                                        agentName, sessionId, reason: uni.reason, guidance: uni.guidance,
+                                    });
+                                }
                             }
-                            else {
-                                // CARRY THE GUIDANCE. The four refusals this path just gained come with the
-                                // sentence that tells an operator whether to retry or force-abandon — and the log
-                                // is this path's ONLY surface, so dropping it leaves a nameable cause with no
-                                // action attached. The old reasons had no guidance to lose; these do.
-                                logger.warn("session.away.inbox.oneshot.seal_unilateral_failed", {
-                                    agentName, sessionId, reason: uni.reason, guidance: uni.guidance,
-                                });
+                            finally {
+                                sealInterruptedInProgress.delete(sealKey(agentName, sessionId));
                             }
-                        }
-                        finally {
-                            sealInterruptedInProgress.delete(sealKey(agentName, sessionId));
-                        }
-                    })();
+                        })();
+                    }
                 }
             }
             return;
@@ -1150,8 +1507,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 ? new Uint8Array(awayVerdict.content)
                 : draftBytes;
             const contentBytes = new TextEncoder().encode(markAsAutoReply(new TextDecoder().decode(screenedBytes)));
-            const contentHash = wireContentHash(contentBytes);
-            const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, contentBytes, new Uint8Array(contentHash), randomUUID());
+            // B2b: one decision point for the hash AND its algorithm — see `contentHashForSession`.
+            const away = await sessionNodeManager.contentHashForSession(agentName, sessionId, contentBytes);
+            const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, contentBytes, new Uint8Array(away.hash), randomUUID(), LEAF_KIND_MSG, away.alg);
             if (!sendResult.ok && !sendResult.durable) {
                 // Reviewer MEDIUM fix: a transient failure must NOT permanently silence the rest of this
                 // away period — clear the guard so the next inbound arrival retries the ack.
@@ -1165,7 +1523,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 });
                 return;
             }
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
+            const contentHashHex = Buffer.from(away.hash).toString("hex");
             if (!sendResult.ok) {
                 // M12-P13 (found live 2026-08-05, M12 Entry 89): the reply is durably queued and already
                 // owns the sequence the relay witnessed for it, so its leaf MUST be committed here. Without
@@ -1177,9 +1535,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 // next arrival would mint a second greeting at a second sequence.
                 // DOD-M12B-INDEX-1: the queued reply owns the position the relay witnessed for it, and
                 // that is where its leaf goes.
-                const placedQueued = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID());
+                // Witnessed and SIGNED — only the direct hand-off failed — so the proof exists and must
+                // reach the leaf. This is the site `sentAuthorship`'s own comment calls dead-by-construction
+                // under an `ok`-gated read; the same reasoning applies to the leaf, not just the row.
+                const placedQueued = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID(), "msg", sentAuthorship(sendResult));
                 if (placedQueued.placed) {
-                    sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedQueued.leafIndex, "sent", contentBytes, randomUUID());
+                    sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedQueued.leafIndex, "sent", contentBytes, randomUUID(), sentAuthorship(sendResult));
                 }
                 logger.info("session.away.response.deferred", {
                     agentName, sessionId, kind, isKnown,
@@ -1191,9 +1552,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             }
             // DOD-M12B-INDEX-1: the away responder fires while inbound is still arriving, so it is the
             // path most likely to have a gap open under it — exactly where a tail append does damage.
-            const placedReply = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID());
+            const placedReply = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID(), "msg", sentAuthorship(sendResult));
             if (placedReply.placed) {
-                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedReply.leafIndex, "sent", contentBytes, randomUUID());
+                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedReply.leafIndex, "sent", contentBytes, randomUUID(), sentAuthorship(sendResult));
             }
             logger.info("session.away.response.sent", {
                 agentName, sessionId, kind, isKnown,
@@ -1382,6 +1743,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
         challengeVerifier,
         getManifestVersion: () => verifiedManifestVersion,
         loadedAgents,
+        // DOD-M15-ERRSTRING-1: so a session failure can say "and 2 of your 5 directories are
+        // unreachable", which is very often the actual cause and was reported nowhere the operator
+        // was looking.
+        getUnresolvedNodes,
+        getDeclaredNodeCount,
     });
     // Both use the same SQLite DB as the SessionNodeManager (daemon.db equivalent).
     // loadFromDb() must complete BEFORE IPC socket opens (AC-007).
@@ -1421,6 +1787,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // seal depends on — silently, while reporting success.
             receiptStore: stores.receiptStore,
             sealLeafStore: stores.sealLeafStore,
+            // DOD-M15-RELAYSLOTS-1: the manager owns the current token and hands the accessor down, so
+            // this client reads a fresh one at every auth instead of a snapshot taken here at build time.
+            onlineToken: stores.onlineToken,
         });
     });
     // DOD-RETRYQ-STRAND-1: a direct-resend row is reachable only by drainSession, which has no
@@ -1457,15 +1826,20 @@ async function startDaemonHoldingLock(config, singletonLock) {
         onPersisted: (agentName, sessionId, contentHashHex) => {
             retryQueue.markContentAcked(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"));
         },
-        onTtf: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor) => {
-            retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor);
+        // `DOD-M15-SEALWIRE-1` B2b-1 review F1 — `contentHashAlg` is the DURABLE WRITER for the column
+        // this unit added. Without it every queued row carries NULL, the crash backstop re-parks a salted
+        // message as sha256, and the recipient refuses it and re-pulls it forever. The commit that added
+        // the column said the producer "passes it"; the producer was passing a value nothing supplied,
+        // because these two hooks were never widened.
+        onTtf: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg) => {
+            retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor, contentHashAlg);
         },
         // M12-P12: same durable destination, different cause — a park deposit the relay refused. The
         // TTF timer is already cancelled on this path, so this is the only thing holding the content.
         // M12-P13 (review HIGH-1): the enqueue's own answer is returned, never a bare `true`. A dropped
         // copy that reports success now buys a committed hash-chain leaf for content that is gone.
-        onParkFailed: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor) => {
-            return retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor);
+        onParkFailed: (agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg) => {
+            return retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content, structure1Cbor, structure2Cbor, contentHashAlg);
         },
     });
     // MSG-001-3b (2b): the LIVE content-park deposit. On a not-confirmed send (direct delivery
@@ -1511,7 +1885,55 @@ async function startDaemonHoldingLock(config, singletonLock) {
         logger.warn("session.seal.autoack.broker.unreachable", { agentName, brokerNode, correlationId });
         return null;
     });
-    sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor }) => {
+    /**
+     * DOD-M15-RELAYABUSE-1: scheduled park-retry timers, tracked so shutdown can clear them.
+     *
+     * ⚠️ Every other daemon timer is cleared in `stop()`; an untracked one lets an in-process restart
+     * leave a stale timer that drains into a torn-down manager. Unref'd already, so it cannot hold the
+     * process open — this is about a clean teardown, not about exiting.
+     */
+    const parkRetryTimers = new Set();
+    /**
+     * DOD-M15-RELAYABUSE-1: schedule ONE drain at the delay the relay asked for.
+     *
+     * ⚠️ ONE implementation, used by both park paths. The live-send path and the drain path both need
+     * this and a second copy is how the clamp ends up on only one of them — which is exactly the shape
+     * review found here (the number had a consumer on one path and was dropped on the other).
+     *
+     * CLAMPED, because the value comes from another party's software and an unclamped one inverts the
+     * fix: Node's `setTimeout` holds an int32, so a relay reporting `3_000_000_000` overflows it and
+     * fires in about ONE MILLISECOND — re-parking instantly into the limit that just refused, and
+     * printing a `TimeoutOverflowWarning` from a daemon whose convention forbids console output.
+     */
+    function scheduleParkRetry(retryAfterMs, filterAgentName, source) {
+        const MIN_RETRY_MS = 1_000;
+        const MAX_RETRY_MS = 5 * 60_000;
+        const delay = Math.min(Math.max(retryAfterMs, MIN_RETRY_MS), MAX_RETRY_MS);
+        if (delay !== retryAfterMs) {
+            logger.warn("content.park.retry.clamped", {
+                source,
+                requestedMs: retryAfterMs,
+                usedMs: delay,
+                impact: "the relay asked for a retry delay outside the range this daemon will schedule, so it was " +
+                    "clamped — an unclamped value can overflow the timer and fire immediately, which would " +
+                    "re-park straight into the limit that just refused",
+            });
+        }
+        logger.info("content.park.retry.scheduled", { source, delayMs: delay, ...(filterAgentName !== undefined ? { agentName: filterAgentName } : {}) });
+        const timer = setTimeout(() => {
+            parkRetryTimers.delete(timer);
+            void flushAwaitingContent(filterAgentName).catch((err) => {
+                logger.warn("content.park.retry.timer.failed", {
+                    source,
+                    reason: err instanceof Error ? err.message : String(err),
+                    impact: "the scheduled drain threw; the ordinary event triggers (boot, agent start, reconnect) still apply",
+                });
+            });
+        }, delay);
+        timer.unref?.();
+        parkRetryTimers.add(timer);
+    }
+    sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg }) => {
         const node = sessionNodeManager.getStandingReceiverNode();
         if (!node) {
             const reason = "standing_receiver_unavailable";
@@ -1545,12 +1967,28 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // SEC-1: sealParkEnvelope is the SOLE producer — it signs (sender's K_local, over the
         // session/recipient/content binding) and seals in one place, so the two park sites cannot drift
         // apart on what gets signed.
+        //
+        // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
+        // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
+        // is salted is a fact about the message that was sent; what this side holds now says nothing
+        // about it.
+        //
+        // ⛔ THIS COMMENT USED TO SAY "Still `sha256` everywhere, because no send path salts yet — the
+        // plumbing is proven carrying the value that cannot break anything, and only then does the value
+        // change." That described B2b, and B2b-2 then CHANGED THE VALUE: a session holding an agreed
+        // salt hashes under `hmac-sha256-salt-v1`, so this path really does carry a salted algorithm
+        // now. Rewritten rather than deleted — a stale reassurance is what `CLAIM-COMMENTS-1` is for,
+        // and on 2026-08-24 a test declared `sha256` on the strength of this sentence and got a tamper
+        // verdict on an honest message.
         const ciphertext = await sealParkEnvelope({
             signer: senderKp,
             sessionIdHex: sessionId,
             recipientPubkey,
             contentHash: contentHashBytes,
             content,
+            // The algorithm the DIRECT frame named for this same message. The park copy must claim what
+            // the message actually is, not what this side would choose for it now.
+            contentHashAlg,
             structure1Cbor,
             structure2Cbor,
         });
@@ -1565,8 +2003,48 @@ async function startDaemonHoldingLock(config, singletonLock) {
             logger.info("content.park.deposited", { sessionId, contentHash: contentHashHex, recipientPubkey: recipientPubkeyHex.slice(0, 16) });
             return { ok: true };
         }
-        logger.warn("content.park.deposit.failed", { sessionId, contentHash: contentHashHex, reason: res.reason });
-        return { ok: false, reason: res.reason ?? "relay_deposit_failed" };
+        logger.warn("content.park.deposit.failed", {
+            sessionId,
+            contentHash: contentHashHex,
+            reason: res.reason,
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        });
+        /**
+         * DOD-M15-RELAYABUSE-1 — **GIVE THE RELAY'S "WHEN" A CONSUMER.**
+         *
+         * A deferred park is otherwise retried only on EVENTS — boot, agent start, the drain hook, a
+         * signaling reconnect. None of those is coming for a throttle: the relay is healthy, the link
+         * never dropped, and the condition clears on a timer nobody is watching. So the one refusal that
+         * self-heals in about a minute was the one that waited longest, purely because the number the
+         * relay had already computed had no reader.
+         *
+         * Scheduled ONCE per refusal, unref'd so it can never hold the process open, and best-effort:
+         * the existing event triggers remain the guarantee, and this is a shortcut on top of them. It
+         * deliberately does not retry-on-retry — a timer that reschedules itself on failure is a
+         * self-inflicted flood, which is what the limiter exists to stop.
+         */
+        if (res.retryAfterMs !== undefined && res.retryAfterMs > 0) {
+            /**
+             * ⚠️ CLAMPED, because the number comes from ANOTHER PARTY'S SOFTWARE and an unclamped one is
+             * not merely wrong — it inverts the fix. Node's `setTimeout` holds an int32: a relay reporting
+             * `3_000_000_000` overflows it and the timer fires in about **one millisecond**, re-parking
+             * instantly into the limit that just refused, and printing a `TimeoutOverflowWarning` on
+             * stderr from a daemon whose convention forbids console output. A reported `1` does the same
+             * thing 250 ms later.
+             *
+             * The floor is a second and the ceiling five minutes: long enough that a shortcut is a
+             * shortcut, short enough that it stays one. A clamp is announced rather than silent — a relay
+             * asking us to wait 35 days is a fact an operator wants.
+             */
+            scheduleParkRetry(res.retryAfterMs, agentName, "send");
+        }
+        return {
+            ok: false,
+            reason: res.reason ?? "relay_deposit_failed",
+            // DOD-M15-RELAYABUSE-1 review MEDIUM-6: the guidance quotes the relay's OWN window instead of
+            // guessing "about a minute", which is a hardcoded assumption about a configurable value.
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        };
     });
     // CELLO-M7-MSG-001 (AC-004/AC-005, D-d): startup flush of locally-persisted un-acked
     // content (the crash backstop). Runs HERE — before the IPC socket opens, consistent
@@ -1623,12 +2101,28 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // empty after a restart, so arrival order there means a wrong leaf index and a divergent tree.
         // SEC-1: same sole producer as the live hook — the backstop signs from the persisted
         // (sessionId, recipient, contentHash).
+        //
+        // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
+        // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
+        // is salted is a fact about the message that was sent; what this side holds now says nothing
+        // about it.
+        //
+        // ⛔ THIS COMMENT USED TO SAY "Still `sha256` everywhere, because no send path salts yet — the
+        // plumbing is proven carrying the value that cannot break anything, and only then does the value
+        // change." That described B2b, and B2b-2 then CHANGED THE VALUE: a session holding an agreed
+        // salt hashes under `hmac-sha256-salt-v1`, so this path really does carry a salted algorithm
+        // now. Rewritten rather than deleted — a stale reassurance is what `CLAIM-COMMENTS-1` is for,
+        // and on 2026-08-24 a test declared `sha256` on the strength of this sentence and got a tamper
+        // verdict on an honest message.
         const ciphertext = await sealParkEnvelope({
             signer: senderKp,
             sessionIdHex: entry.sessionId,
             recipientPubkey,
             contentHash: contentHashBytes,
             content: entry.contentBlob,
+            // The queued row's own record of how it was hashed. `undefined` for a row written before the
+            // column existed, which resolves to `sha256` — exactly what such a row actually used.
+            contentHashAlg: entry.contentHashAlg,
             structure1Cbor: entry.structure1Cbor,
             structure2Cbor: entry.structure2Cbor,
         });
@@ -1643,7 +2137,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
             logger.info("content.park.deposited", { sessionId: entry.sessionId, contentHash: entry.contentHashHex, source: "startup_flush" });
             return { parked: true };
         }
-        return { parked: false, error: res.reason ?? "deposit_failed" };
+        return {
+            parked: false,
+            error: res.reason ?? "deposit_failed",
+            // DOD-M15-RELAYABUSE-1 review HIGH-2: carry the relay's own "when" out of the DRAIN path too.
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        };
     };
     // Re-park un-acked awaiting content to the relay store-and-forward queue. Runs once pre-IPC
     // (the crash backstop) and again per-agent when an agent comes online — because post-DOD-LOOP-1
@@ -1701,7 +2200,23 @@ async function startDaemonHoldingLock(config, singletonLock) {
         let parkedTotal = 0;
         for (const s of sessions) {
             try {
-                parkedTotal += await retryQueue.drainAwaitingToPark(s.agentId, s.sessionId, parkFn);
+                parkedTotal += await retryQueue.drainAwaitingToPark(s.agentId, s.sessionId, parkFn, (retryAfterMs) => {
+                    /**
+                     * DOD-M15-RELAYABUSE-1 review HIGH-2 — **the drain path can now schedule its own
+                     * follow-up, which is what makes the retry work for a BACKLOG rather than one message.**
+                     *
+                     * Before this, only the live send path heard the relay's delay. With a backlog larger than
+                     * one rate-limit window, the drain deposited what the window allowed, every remaining item
+                     * was refused, and all of them fell back to waiting for an unrelated reconnect — the exact
+                     * condition the retry timer was added to remove.
+                     *
+                     * ONE timer per pass (the drain reports the largest delay it saw, not one per item), and
+                     * it deliberately does not chain beyond that: the next pass schedules the next one only if
+                     * it is refused again, so a permanently-full relay costs one timer per window rather than
+                     * an accelerating stream of them.
+                     */
+                    scheduleParkRetry(retryAfterMs, filterAgentName, "drain");
+                });
             }
             catch (err) {
                 logger.error("content.park.flush.failed", {
@@ -1789,12 +2304,39 @@ async function startDaemonHoldingLock(config, singletonLock) {
             return {
                 name: a.name,
                 state,
+                /**
+                 * `selected` IS THIS CONNECTION'S VIEW, NOT THE AGENT'S — `DOD-M15-IPCVISIBLE-1` clause 3.
+                 *
+                 * Every `cello` CLI invocation opens a FRESH connection, which starts with no current
+                 * agent. So a client asking about its own state through the CLI always reads `false`, for
+                 * an agent it genuinely has selected in another session. Both Andre and a Hermes agent
+                 * misread it that way during one investigation, in opposite directions.
+                 *
+                 * The field name cannot be changed without breaking every reader, so it is ANNOTATED: the
+                 * sibling below says whose view this is, and `attended_by` says how many connections hold
+                 * this agent at all — which is the question people were actually asking.
+                 */
                 selected,
+                selected_by_this_connection: selected,
+                attended_by: countAttendance(perConnectionState, a.name),
                 pubkey: a.pubkey,
                 // M8B F14 (fix 5): per-agent standing-receiver readiness on the MCP surface
                 // (cello_status / cello_list_agents), so a deaf agent is visible to the operator.
                 standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
                 standing_receiver_reachability: sessionNodeManager.getStandingReceiverReachability(a.name),
+                /**
+                 * DOD-M15-RELAYSLOTS-1: WHY it is not reachable, and what to do about it.
+                 *
+                 * `standing_receiver_reachability` says `retrying` or `unreachable` and stops there, which
+                 * for the person reading it is indistinguishable from the product being broken. The relay
+                 * now refuses for reasons someone can act on — no token from a directory yet, too many
+                 * sessions still open, this relay is misconfigured — each with a different next step, and
+                 * every one of them is wasted if it only reaches a log file. Absent when the last attempt
+                 * succeeded.
+                 */
+                ...(sessionNodeManager.getStandingReceiverRefusal(a.name)
+                    ? { standing_receiver_refusal: sessionNodeManager.getStandingReceiverRefusal(a.name) }
+                    : {}),
                 // DOD-COATTEND-VISIBLE-1 AC2: how many sessions are driving this agent, including this
                 // one. Live, not a high-water mark — it drops when a session disconnects. `selected` says
                 // whether YOU hold it; this says whether anyone else does too.
@@ -2005,6 +2547,21 @@ async function startDaemonHoldingLock(config, singletonLock) {
             //
             // Omitted entirely when nothing is failing, so a healthy status stays quiet.
             ...(unresolvedNodesForStatus() ?? {}),
+            // DOD-M15-MANIFEST-EXPIRY-LIVE-1: contributes NOTHING while the manifest is comfortably in
+            // window. A field present on every status read for the years a manifest is valid is furniture,
+            // not a warning, and it teaches the reader to skip the block that matters.
+            ...(describeManifestValidity(classifyManifestValidity(manifestProvider?.getCurrentManifest() ?? null, Date.now()), manifestOrigin) ?? {}),
+            // DOD-M15-DIRAUTH-1: the posture is STATED, in both directions. Unlike every other field in
+            // this milestone the healthy case is reported too — the defect is precisely that "enforced"
+            // and "skipped" differ only by the absence of a log line, so an operator must be able to
+            // confirm it is on, not merely fail to find evidence that it is off.
+            ...describeDirectoryAuth({
+                verifierPresent: challengeVerifier !== undefined,
+                directoryUrl: directoryHttpUrl ?? resolveDirectoryUrl(process.env),
+                // Review F5: with neither set, `resolveDirectoryUrl` re-picks a RANDOM bundled endpoint on
+                // every call, so there is no configured URL to quote or to blame.
+                urlExplicitlyConfigured: directoryHttpUrl !== undefined || process.env["CELLO_DIRECTORY_URL"] !== undefined,
+            }),
             // M8B F14 (fix 5): per-agent standing-receiver readiness, so a deaf agent (online but
             // no armed receiver) is visible in cello_status instead of hiding behind the ANY-agent
             // aggregate below (kept for backward compatibility).
@@ -2020,6 +2577,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 state: agentStateFor(a),
                 standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
                 standing_receiver_reachability: sessionNodeManager.getStandingReceiverReachability(a.name),
+                // DOD-M15-RELAYSLOTS-1: the same cause-and-advice on the daemon-wide surface — see the note
+                // on the MCP one above. Two surfaces, one reason to exist.
+                ...(sessionNodeManager.getStandingReceiverRefusal(a.name)
+                    ? { standing_receiver_refusal: sessionNodeManager.getStandingReceiverRefusal(a.name) }
+                    : {}),
             })),
             standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(),
             retryQueueDepth: retryQueue.getTotalDepth(),
@@ -2051,14 +2613,37 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // Permissive by design (D12): an agent that exists goes online regardless of directory
     // registration state (online-without-registration is an established contract). Returns a
     // structured failure so callers can surface agent_start_failed with a real reason + guidance.
+    /**
+     * `standing_receiver` is part of the SUCCESS shape, not an optional extra — `DOD-M15-START-AGENT-
+     * UNAWAITED-1`. A bare `{ ok: true }` claimed the agent was started and reachable when only the
+     * first half was known, and the union makes the two states impossible to conflate at a call site.
+     */
     function startAgentInternal(name) {
         const agent = agents.find((a) => a.name === name);
         if (!agent || agent.state === "load_failed") {
             return { ok: false, reason: "agent_not_found", guidance: `Agent '${name}' does not exist. Run 'cello login' to register agents, or check agent names with cello_agents.` };
         }
         if (onlineAgents.has(name)) {
-            // Idempotent — already online, no event
-            return { ok: true };
+            // Idempotent — already online, no event.
+            //
+            // It still reports REAL readiness rather than a bare ok. "Already online" says this daemon
+            // marked the agent online at some earlier moment; it says nothing about whether the receiver
+            // that ensure was firing ever came up. An operator who calls start twice — which is exactly
+            // what someone does when the first one seemed not to work — would otherwise get the most
+            // reassuring answer in the run on the attempt where something is actually wrong.
+            const readyNow = sessionNodeManager.getStandingReceiverInfo(name) !== null;
+            if (readyNow)
+                return { ok: true, standing_receiver: "ready" };
+            const cause = sessionNodeManager.standingReceiverAbsenceReason(name);
+            return {
+                ok: true,
+                standing_receiver: "starting",
+                standing_receiver_cause: cause,
+                guidance: `'${name}' was already online, and its standing receiver is not up (${cause}). Outbound ` +
+                    `sends and cello_initiate_session ensure it on demand. An inbound session arriving before ` +
+                    `it is ready is refused with 'standing_receiver_unavailable' — this daemon, not the ` +
+                    `counterparty. If it stays this way, stop the agent and start it again.`,
+            };
         }
         onlineAgents.add(name);
         // Pressing start clears the deliberate-offline mark — that is what makes the switch reversible.
@@ -2084,7 +2669,18 @@ async function startDaemonHoldingLock(config, singletonLock) {
         void sessionNodeManager.ensureStandingReceiverForAgent(name)
             .then(() => flushAwaitingContent(name))
             .catch((err) => {
-            logger.warn("session.standing_receiver.ensure.failed", { agentName: name, reason: extractErrorMessage(err) });
+            logger.warn("session.standing_receiver.ensure.failed", {
+                agentName: name,
+                reason: extractErrorMessage(err),
+                // `DOD-M15-START-AGENT-UNAWAITED-1`. The operator has ALREADY been told `ok: true` — this
+                // handler answered before this promise settled — so nothing corrects that answer if this
+                // is permanent. Say what it costs them here, because this line is the only account.
+                impact: "cello_start_agent already answered ok for this agent, and its standing receiver did not " +
+                    "come up. The agent is online to the directory and CANNOT accept an inbound session: a " +
+                    "counterparty dialling it is refused standing_receiver_unavailable. Initiate and accept " +
+                    "each re-ensure on demand, so this may still recover on the next attempt; if it does not, " +
+                    "stop and restart the agent.",
+            });
         })
             // DOD-MSG-4 (auto-recover-on-reconnect): RECEIVER drains its parked mailbox from every relay it
             // has sessions on (symmetric to the sender re-park). Its own stage so a failure is labelled
@@ -2094,10 +2690,51 @@ async function startDaemonHoldingLock(config, singletonLock) {
             .catch((err) => {
             logger.warn("content.recover.auto.failed", { agentName: name, stage: "agent_start", error: extractErrorMessage(err) });
         });
-        logger.info("agent.online", { agentName: name, agentPubkey: agent.pubkey ?? "" });
+        /**
+         * `DOD-M15-START-AGENT-UNAWAITED-1` — SAY WHETHER THE AGENT CAN ACTUALLY HEAR YET.
+         *
+         * The ensure above is fire-and-forget and that is deliberate: initiate and accept both ensure on
+         * demand, and awaiting it here would turn a transient network failure into a failed start. **The
+         * defect was never the timing — it was the CLAIM.** `{ ok: true }` with nothing else reads as
+         * "your agent is running and reachable", and a session landing in the window before the receiver
+         * exists is refused `standing_receiver_unavailable` — a precondition on OUR side, surfacing to
+         * the operator as though the counterparty or the directory were at fault.
+         *
+         * ⚠️ **This field is only worth having because it can genuinely say `ready`.** Computed one line
+         * after firing an async ensure, a naive readiness flag would be `starting` on every call — a
+         * field that can never take its other value, which is the same defect as a log line reporting a
+         * verdict its producer cannot have. It escapes that because `ensureStandingReceiverForAgent` is
+         * IDEMPOTENT: an agent that already holds a receiver (a repeat start, or one whose receiver
+         * survived) has one at this instant and reports `ready` truthfully.
+         *
+         * `cause` is read from the same four-way answer the refusal path uses, so the response and the
+         * eventual error agree instead of describing the same state in two vocabularies.
+         */
+        const receiverReady = sessionNodeManager.getStandingReceiverInfo(name) !== null;
+        const startingCause = receiverReady ? undefined : sessionNodeManager.standingReceiverAbsenceReason(name);
+        logger.info("agent.online", {
+            agentName: name,
+            agentPubkey: agent.pubkey ?? "",
+            standingReceiver: receiverReady ? "ready" : "starting",
+            ...(startingCause !== undefined ? { standingReceiverCause: startingCause } : {}),
+        });
         // MCP-002: Broadcast agent_state_changed to ALL connections
         notificationDispatcher.dispatchAgentStateChanged(name, "online", "started");
-        return { ok: true };
+        if (receiverReady)
+            return { ok: true, standing_receiver: "ready" };
+        return {
+            ok: true,
+            standing_receiver: "starting",
+            standing_receiver_cause: startingCause,
+            // Invariant: an agent-facing response carries an affordance. Naming the refusal text is the
+            // load-bearing half — an operator who hits it in the next second can otherwise only conclude
+            // the other side is broken.
+            guidance: `'${name}' is online and its standing receiver is still being built. Outbound sends and ` +
+                `cello_initiate_session ensure it on demand, so ordinary use is fine. A session arriving in ` +
+                `the next moment can be refused with 'standing_receiver_unavailable' — that is this daemon ` +
+                `not being ready yet, NOT the counterparty being unreachable. It clears on its own; ` +
+                `cello_status reports the receiver once it is up.`,
+        };
     }
     // M8C-AUTOSTART-1 (F18): resolve which agent an agent-defaulting tool should act on for this
     // connection: an explicit { agent } wins; else the connection's current agent; else — when EXACTLY one
@@ -2117,16 +2754,95 @@ async function startDaemonHoldingLock(config, singletonLock) {
      * alice, alice was stopped, and the work lands on bob reporting success. A lost intent is not the
      * same as no intent, and it must fail loud (no_current_agent) rather than be guessed at.
      */
+    /**
+     * Which agent this call acts as — `DOD-M15-SELECTION-1`, logic in `agent-selection.ts`.
+     *
+     * It used to end with `if (onlineAgents.size === 1) return [...onlineAgents][0]`, so a connection
+     * that had selected nothing acted as whichever agent happened to be the only one online. On a
+     * shared daemon that can be a DIFFERENT operator's agent, and a live MCP session was being bound
+     * to an identity it never asked for.
+     *
+     * The resolution is now attributable: every path reports how it was reached, and `fallback` — the
+     * one that was invisible — is logged at INFO. `DOD-M15-IPCVISIBLE-1`.
+     */
+    /**
+     * The fallback notice owed to THIS REQUEST's response — `DOD-M15-SELECTION-1` clause 2.
+     *
+     * ─── Why an AsyncLocalStorage and not a per-connection map ─────────────────────────────────────
+     *
+     * The first cut keyed a `WeakMap` on the per-connection state object, so the notice belonged to
+     * the CONNECTION and was read back at the response boundary. Review found that hands the notice to
+     * whichever response finishes first, and Claude Code issues tool calls in parallel:
+     *
+     *   1. the agent calls `cello_receive` — nothing selected, so the fallback resolves and records
+     *      the notice, then the handler BLOCKS for up to 30 s waiting for content;
+     *   2. in the same turn it calls `cello_sessions {agent: "bob"}`, which names an agent explicitly
+     *      and never falls back;
+     *   3. `cello_sessions` returns first and takes the notice on its way out.
+     *
+     * Bob's response now says *"no agent was selected, so 'solo' was used"* — false, on the one call
+     * that did name an agent — and `cello_receive`, the call that actually fell back, says nothing.
+     * Exactly inverted.
+     *
+     * A notice is a fact about ONE CALL, so it is stored in that call's async context. The store is
+     * created per request in `renderedHandlers` and dies with it, which also means a handler that
+     * THROWS cannot leave a notice behind to attach itself to some later, unrelated response — the
+     * other half of the same review finding.
+     */
+    const fallbackNoticeStore = new AsyncLocalStorage();
     function resolveCurrentAgent(connState, explicitAgent) {
-        if (explicitAgent)
-            return explicitAgent;
-        if (connState?.currentAgent)
-            return connState.currentAgent;
-        if (connState?.clearedAgent)
-            return null;
-        if (onlineAgents.size === 1)
-            return [...onlineAgents][0];
-        return null;
+        return resolveCurrentAgentFor({
+            connState,
+            onlineAgents,
+            ...(explicitAgent !== undefined ? { explicitAgent } : {}),
+            onResolved: (agent, trigger) => {
+                // Only the FALLBACK is announced. `explicit` and `selected` are the ordinary cases and
+                // logging them would bury the one that matters — a signal that fires on the normal case is
+                // not a signal.
+                if (trigger !== "fallback")
+                    return;
+                /**
+                 * RECORDED FOR THE RESPONSE, not just the log — `DOD-M15-SELECTION-1` clause 2.
+                 *
+                 * The log tells whoever reads the daemon log. The RESPONSE tells the agent that just acted
+                 * as an identity it never selected, which is the one that stops the half-attended state
+                 * being read as the protocol dropping messages.
+                 */
+                /**
+                 * No `connState` guard. The first cut wrote the notice only `if (agent && connState)`, and
+                 * `perConnectionState` is populated at `ipc.connect` — which `withIpc` in the CLI
+                 * (`core/cli/src/commands.ts`) does not send. So every plain `cello` invocation fell back
+                 * and got a response that said nothing, while the log line below fired regardless: the
+                 * clause asks for explicit IN THE RESPONSE, and those callers had it explicit in the log
+                 * only. The store is per-REQUEST, so it exists whether or not the connection ever
+                 * handshook.
+                 */
+                const store = fallbackNoticeStore.getStore();
+                if (agent && store) {
+                    store.notice = {
+                        acting_as: agent,
+                        agent_selection: "fallback",
+                        agent_selection_guidance: `No agent was selected on this connection, so '${agent}' was used because it is the ` +
+                            `only one online. This is a per-call subject, NOT an attendance: doorbells route by ` +
+                            `the connection's registered agent and this does not set it. Two things follow — ` +
+                            `this session will not WAKE on an incoming message even though sending and reading ` +
+                            `work, and anyone who opens a session with you is sent an AWAY auto-reply while you ` +
+                            `sit here able to answer. Run cello_use_agent to fix both. Naming the agent on each ` +
+                            `call is NOT a remedy for either: it settles which agent a call is about and leaves ` +
+                            `the connection just as unattended.`,
+                    };
+                }
+                logger.info("agent.current.fallback", {
+                    agentName: agent,
+                    clientType: connState?.clientType ?? "cli",
+                    impact: "this call had no selected agent and exactly one was online, so that one was used. It " +
+                        "is a per-call subject, NOT an attendance: doorbells route by the connection's " +
+                        "registered agent, which this does not set.",
+                    guidance: "If this was not the intended agent, name it explicitly, or run cello_use_agent to " +
+                        "select one for the connection.",
+                });
+            },
+        });
     }
     // Agent lifecycle (agent-handlers.ts): create, remove, start, stop, select, list.
     registerAgentHandlers({
@@ -2216,6 +2932,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName,
             persistence: getPersistence(agentName),
             agentPubkeyHex: loaded.pubkey,
+            // DOD-M15-SEALWIRE-1 bullet 2 (review F1): gate the co-signature on the root check.
+            verifyCertifiedRoot: (pub, sid, root, leaves) => sessionNodeManager.verifyCertifiedRoot(pub, sid, root, leaves),
             keyProvider: loaded.keyProvider,
             getNode: entry.getNode,
             getDirectoryEndpoint: getFailoverEndpoint,
@@ -2260,6 +2978,28 @@ async function startDaemonHoldingLock(config, singletonLock) {
             subject_kind: r.subjectKind,
             subject: r.subject,
             issuer_kind: r.issuerKind,
+            /**
+             * DOD-M15-SAMEOP-FALSEPOS-1: WHO ISSUED IT. The listing carried `subject` — who the signal is
+             * ABOUT — and never who SAID it, so an operator could see "someone endorsed me" and not see
+             * who. For the decision this list exists to support (do I rely on this endorsement?) the
+             * author is the primary fact, and an endorsement nobody can attribute is worth roughly
+             * nothing.
+             *
+             * `issuer_kind` reads like it answers this and does not: it says `"agent"` or `"portal"`, a
+             * category. Elsewhere a field literally named `issuer` holds `"peer-claimed"` /
+             * `"platform-verified"` — also a category. Two fields whose names promise identity, neither
+             * carrying it.
+             *
+             * It also unblocks an investigation this omission stalled: four endorsements in a wallet all
+             * read `same_operator: true`, and **nothing in the response could say whether the stranger's
+             * was among them** — so "a stranger is flagged as self-dealing" and "the stranger's
+             * endorsement never arrived" were indistinguishable from the listing. Different bugs, in
+             * different places, and the field that separates them was already in the row.
+             *
+             * Discloses nothing new: the issuer pubkey is inside the notarized envelope the recipient
+             * already holds and can already present.
+             */
+            issuer_pubkey: r.issuerPubkey,
             status: r.status,
             issued_at: r.issuedAt,
             expires_at: r.expiresAt,
@@ -3049,32 +3789,78 @@ async function startDaemonHoldingLock(config, singletonLock) {
     });
     // ─── MCP-001: cello_status (per-connection perspective) ───
     /**
-     * The directory-reachability block for `cello_status`, or undefined when every node resolves.
+     * The directory-reachability block for `cello_status`.
+     *
+     * `undefined` — i.e. silence — is reserved for ONE state: a reading taken recently enough to
+     * speak for the present, which found nothing wrong. Every other combination emits, including an
+     * EMPTY node list, because an empty list is not proof of health: it also means nothing has
+     * looked, or looked too long ago to say. `DOD-M15-STALEROSTER-1`.
      *
-     * Reports the LAST resolve sweep. An empty list is not proof of health — it also means no sweep
-     * has run yet — so the shape says which nodes failed and why rather than asserting "all good".
+     * So presence of this block does NOT mean nodes are failing. Read `measurement` first —
+     * `current` | `stale` | `never` | `not_configured` — and only then the node list.
      */
     function unresolvedNodesForStatus() {
         const failures = getUnresolvedNodes();
-        if (failures.length === 0)
+        /**
+         * DOD-M15-STALEROSTER-1 — the block is now gated on the AGE of the reading, not just on whether
+         * it found anything.
+         *
+         * `if (failures.length === 0) return undefined` made two different states render identically:
+         * "all three nodes answered a moment ago" and "nothing has ever looked". The second is
+         * reachable — `verifyStartupManifest` returns without sweeping when the consortium manifest is
+         * missing, not yet valid, EXPIRED, or rolled back — so a daemon with an expired manifest
+         * reported no directory trouble at all.
+         *
+         * Silence is therefore reserved for the one case that has earned it: a RECENT reading that
+         * found nothing wrong. Every other case says why it cannot make that claim.
+         */
+        const freshness = describeRosterFreshness(classifyRosterReading(getUnresolvedSweptAt(), Date.now()), {
+            // REVIEW F2: "no manifest configured" is DESIGNED (local dev, the e2e harness, or a
+            // CELLO_DIRECTORY_URL that is not byte-equal to a bundled endpoint) and must not be dressed
+            // as an alarm — it would fire on every local run. It still EMITS, because the line forbids
+            // hiding the field; what differs is what the operator is told.
+            manifestConfigured: manifestProvider !== undefined,
+            ...(lastRosterSweepError ? { lastSweepError: lastRosterSweepError } : {}),
+        });
+        if (failures.length === 0 && freshness.measurement === "current")
             return undefined;
         return {
             directory_endpoints_unresolved: {
-                // WHEN this was measured. Without it the block asserts the PRESENT, and a transient blip
-                // reads as an ongoing outage: on 2026-08-09 all three endpoints failed with ENETUNREACH for
-                // under a minute — a network transition on the operator's machine — and the block went on
-                // reporting them unreachable long after they answered again. True when taken, false when read.
-                checked_at: getUnresolvedSweptAt(),
-                nodes: failures.map((f) => ({ node: f.nodeId, endpoint: f.endpoint, reason: f.reason, detail: f.detail })),
-                guidance: "AS OF checked_at (this is a point-in-time reading, not necessarily now), this daemon could not "
-                    + "resolve these directory endpoints, so the consortium roster was short and " +
-                    "threshold ceremonies will fail — sessions surface that as counterparty_offline, " +
-                    "directory_below_threshold, or ceremony_exhausted, none of which name the real cause. " +
-                    "Agents can still show 'online': signaling dials multiaddrs and does not need DNS. " +
-                    "If reason is dns_error after a directory restart or wake, the resolver is holding a cached " +
-                    "negative answer — flush it (macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder). " +
-                    "Verify with node -e 'require(\"dns\").lookup(host,console.log)', NOT dig: dig bypasses the " +
-                    "cache this daemon is stuck behind, so it reports success while the daemon still fails.",
+                // WHEN this was measured, and whether that is recent enough to mean anything. Without it the
+                // block asserts the PRESENT, and a transient blip reads as an ongoing outage: on 2026-08-09
+                // all three endpoints failed with ENETUNREACH for under a minute — a network transition on
+                // the operator's machine — and the block went on reporting them unreachable long after they
+                // answered again. True when taken, false when read.
+                ...freshness,
+                // DOD-M15-BOOTSTRAP-1: `attempts` distinguishes a node that answered definitively (one
+                // probe — a 404, a bad payload, its configuration) from one that never answered at all
+                // (every probe spent — the path to it). Those call for opposite responses, and without the
+                // count they rendered identically here.
+                nodes: failures.map((f) => ({ node: f.nodeId, endpoint: f.endpoint, reason: f.reason, detail: f.detail, attempts: f.attempts })),
+                guidance: failures.length === 0
+                    // The block is present with an EMPTY node list, which before DOD-M15-STALEROSTER-1 could
+                    // not happen. Saying "could not resolve these endpoints" here would be a flat lie — there
+                    // are no endpoints listed and the point is that nothing was measured. The empty list is
+                    // the ABSENCE of a reading, not a clean bill of health, and freshness_guidance above says
+                    // which of the two it is.
+                    ? "This block is present with NO nodes listed, which does not mean the nodes are healthy — " +
+                        "it means this reading cannot support that claim. See freshness_guidance above for " +
+                        "whether the daemon has never measured, or measured too long ago to speak for the " +
+                        "present. Directory reachability is what threshold ceremonies depend on, so an " +
+                        "unmeasured roster is an unknown, not an all-clear."
+                    : "AS OF checked_at (this is a point-in-time reading, not necessarily now), this daemon could not "
+                        + "resolve these directory endpoints, so the consortium roster was short and " +
+                        "threshold ceremonies will fail — sessions surface that as home_node_reports_no_receiver, " +
+                        "home_node_not_in_reachable_roster, directory_named_no_home, directory_below_threshold or " +
+                        "ceremony_exhausted, none of which name the real cause on their own (DOD-M15-ERRSTRING-1 " +
+                        "renamed the first three; they now append this shortfall to their own guidance). " +
+                        "Agents can still show 'online': signaling dials multiaddrs and does not need DNS. " +
+                        "If reason is dns_error after a directory restart or wake, the resolver is holding a cached " +
+                        "negative answer — flush it (macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder). " +
+                        "Verify with node -e 'require(\"dns\").lookup(host,console.log)', NOT dig: dig bypasses the " +
+                        "cache this daemon is stuck behind, so it reports success while the daemon still fails. "
+                        + "attempts:1 means the node ANSWERED and the answer was unusable — look at that node. "
+                        + "attempts:2+ means it never answered — look at the path to it.",
             },
         };
     }
@@ -3093,6 +3879,21 @@ async function startDaemonHoldingLock(config, singletonLock) {
             //
             // Omitted entirely when nothing is failing, so a healthy status stays quiet.
             ...(unresolvedNodesForStatus() ?? {}),
+            // DOD-M15-MANIFEST-EXPIRY-LIVE-1: contributes NOTHING while the manifest is comfortably in
+            // window. A field present on every status read for the years a manifest is valid is furniture,
+            // not a warning, and it teaches the reader to skip the block that matters.
+            ...(describeManifestValidity(classifyManifestValidity(manifestProvider?.getCurrentManifest() ?? null, Date.now()), manifestOrigin) ?? {}),
+            // DOD-M15-DIRAUTH-1: the posture is STATED, in both directions. Unlike every other field in
+            // this milestone the healthy case is reported too — the defect is precisely that "enforced"
+            // and "skipped" differ only by the absence of a log line, so an operator must be able to
+            // confirm it is on, not merely fail to find evidence that it is off.
+            ...describeDirectoryAuth({
+                verifierPresent: challengeVerifier !== undefined,
+                directoryUrl: directoryHttpUrl ?? resolveDirectoryUrl(process.env),
+                // Review F5: with neither set, `resolveDirectoryUrl` re-picks a RANDOM bundled endpoint on
+                // every call, so there is no configured URL to quote or to blame.
+                urlExplicitlyConfigured: directoryHttpUrl !== undefined || process.env["CELLO_DIRECTORY_URL"] !== undefined,
+            }),
             agents: getAgentsForConnection(connectionId),
             // M-1 PULL: live MCP clients must see interrupted sessions too, exactly as
             // the daemon-wide getStatus() surfaces them.
@@ -3173,6 +3974,14 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // cello_close_session (close-session-handler.ts). Fifteen dependencies — a long list, but a KNOWN
     // one, which is the whole difference from a closure over 73 shared locals.
     registerCloseSessionHandler({
+        // DOD-M15-CLOSEWAIT-1 review MEDIUM-6: a detached seal tail is registered here so stop() can
+        // drain it, like every other background worker. Self-evicting, so a long-running daemon does not
+        // accumulate settled promises.
+        sealFailures,
+        registerBackgroundSeal: (p) => {
+            backgroundSeals.add(p);
+            void p.finally(() => backgroundSeals.delete(p));
+        },
         // M12-P14: the pre-seal readiness gate drains the parked mailbox before judging, so a close
         // does not refuse over content the relay is still holding for us.
         recoverParkedContent: (agentName, trigger) => autoRecoverForAgent(agentName, trigger),
@@ -3210,9 +4019,74 @@ async function startDaemonHoldingLock(config, singletonLock) {
         handleActiveSealFlow,
         resolveConsortiumRoster,
     });
+    /**
+     * DOD-M15-BACKUP-1 — export the agent, so losing the machine does not lose the identity.
+     *
+     * `VACUUM INTO` takes a consistent snapshot with the database still open, so this is safe to call
+     * on a running daemon — which matters, because the daemon is what serves the tool.
+     */
+    handlers.set("cello_backup", async (params, _connectionId) => {
+        const outPath = typeof params?.["path"] === "string" ? params["path"] : "";
+        if (!outPath) {
+            return {
+                ok: false,
+                reason: "missing_path",
+                guidance: "Give an absolute path to write the backup to, e.g. { path: \"/Users/you/cello-agent.cello-backup\" }. " +
+                    "It is not written to a default location on purpose: the file contains the key to your agent, " +
+                    "so where it lands is a decision you should make deliberately.",
+            };
+        }
+        const res = await createBackup({
+            dbPath: join(celloDir, "sessions.db"),
+            outPath,
+            logger,
+            ...(params?.["overwrite"] === true ? { overwrite: true } : {}),
+        });
+        return res.ok
+            ? { ok: true, path: res.path, bytes: res.bytes, guidance: res.guidance }
+            : { ok: false, reason: res.reason, guidance: res.guidance };
+    });
+    /**
+     * RESTORE IS REFUSED WHILE THIS DAEMON IS RUNNING, and that is not a limitation to apologise for.
+     *
+     * The daemon holds the database open with a write lock. Overwriting the file underneath an open
+     * SQLite handle risks the handle flushing its own pages back over the restored ones — the restore
+     * appears to succeed and the database is a hybrid of two identities, which is worse than either
+     * failing cleanly.
+     *
+     * The capability itself lives in `backup-restore.ts` (a daemon module, per the DoD), and the CLI
+     * calls it with the daemon stopped. So the honest answer here is the exact sequence, not an
+     * attempt.
+     */
+    handlers.set("cello_restore", async (params, _connectionId) => {
+        const archivePath = typeof params?.["path"] === "string" ? params["path"] : "";
+        const inspected = archivePath ? await inspectBackup(archivePath) : null;
+        return {
+            ok: false,
+            reason: "daemon_running",
+            ...(inspected?.ok
+                ? { archive_verified: true, backup_created_at: new Date(inspected.createdAt).toISOString() }
+                : inspected
+                    ? { archive_verified: false, archive_problem: inspected.reason }
+                    : {}),
+            guidance: (inspected?.ok
+                ? `That archive is valid (taken ${new Date(inspected.createdAt).toISOString()}). `
+                : inspected
+                    ? `WARNING: that archive did not validate (${inspected.reason}) — fix that before going further. `
+                    : "") +
+                "Restoring REPLACES this machine's agent database, and it cannot be done while the daemon " +
+                "is holding it open — the running daemon could flush its own pages back over the restored " +
+                "ones and leave a database that is half one identity and half another. Stop the daemon " +
+                "first:\n\n  cello logout\n  cello restore " +
+                (archivePath || "<archive>") +
+                "\n  cello login\n\n" +
+                "Anything that happened on this machine since the backup was taken will be gone — restore " +
+                "replaces, it does not merge.",
+        };
+    });
     // ─── MCP-001: stubs for tools registered in cello-mcp.ts but not yet implemented ───
     // These return not_implemented (same as session tools) so LLMs get consistent guidance.
-    for (const tool of ["cello_backup", "cello_restore", "cello_get_inclusion_proof"]) {
+    for (const tool of ["cello_get_inclusion_proof"]) {
         handlers.set(tool, async (_params, _connectionId) => {
             return { ok: false, reason: "not_implemented", guidance: `'${tool}' is not yet implemented in the daemon. This feature will be available in a future milestone.` };
         });
@@ -3234,6 +4108,14 @@ async function startDaemonHoldingLock(config, singletonLock) {
         logger,
         sessionNodeManager,
         loadedAgents,
+        // DOD-M15-CLOSEWAIT-1 review HIGH-2: the SAME predicate cello_status uses, so the two surfaces
+        // cannot disagree about whether a ceremony is in flight. Both maps, because either can be the
+        // one running — pendingSealWaiters is the active close, sealInterruptedInProgress the interrupted.
+        isSealing: (agentName, sessionId) => pendingSealWaiters.has(sealKey(agentName, sessionId)) ||
+            sealInterruptedInProgress.has(sealKey(agentName, sessionId)),
+        // DOD-M15-SEAL-FAILED-TERMINAL-1: the SAME store the close handler writes, so a failure recorded
+        // by the detached tail is the one the receipt surface reads.
+        getSealFailure: (agentName, sessionId) => sealFailures.get(agentName, sessionId),
         getConnState: (connectionId) => perConnectionState.get(connectionId),
         resolveCurrentAgent,
         NO_CURRENT_AGENT_RESPONSE,
@@ -3308,7 +4190,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
             return { error: "no_current_agent", guidance: "Select an agent with cello_use_agent, or pass agentName." };
         }
         const agentId = sessionNodeManager.resolveAgentId(agentName);
-        retryQueue.enqueueAwaitingContent(agentId, sessionId, Buffer.from(contentHashHex, "hex"), Buffer.from(contentHex, "hex"));
+        // The fault-injection IPC seam. It states all three trailing values explicitly rather than
+        // relying on defaults (B2b-1 pass-2 F1): `undefined` for the ordering record and the algorithm
+        // is what this path genuinely has — it injects a bare queued entry — and saying so keeps the
+        // seam honest about what it is producing rather than inheriting whatever the signature assumed.
+        retryQueue.enqueueAwaitingContent(agentId, sessionId, Buffer.from(contentHashHex, "hex"), Buffer.from(contentHex, "hex"), undefined, undefined, undefined);
         return { queued: true, awaitingDepth: retryQueue.getAwaitingDepth(agentId, sessionId) };
     });
     // CELLO-M7-MSG-001: a `persisted` delivery ACK (or a confirmed park) clears the durable
@@ -3395,7 +4281,23 @@ async function startDaemonHoldingLock(config, singletonLock) {
             const sessionId = params?.sessionId;
             if (!agentName || !sessionId)
                 return { error: "missing_params", guidance: "Provide agentName and sessionId." };
-            recordRefusal(agentName, sessionId, params?.counterpartyPubkey ?? "", params?.reason ?? "test");
+            // The reason is VALIDATED against the closed union rather than cast through it. A test seam
+            // that can inject a reason production cannot produce would let a test prove the inbox handles a
+            // code no refusal path emits — which is the shape DOD-M15-GUARD-HEARD-1 exists to remove, and a
+            // seam is not exempt from it.
+            const asked = params?.reason ?? CAPACITY_REASONS.ABUSE_BOUND_SESSIONS_PER_SENDER;
+            const known = [
+                ...Object.values(REFUSAL_REASONS),
+                ...Object.values(CAPACITY_REASONS),
+            ];
+            if (!known.includes(asked)) {
+                return {
+                    error: "unknown_refusal_reason",
+                    guidance: `"${asked}" is not a reason any refusal path can emit. Use one of: ${known.join(", ")}. ` +
+                        `Seeding an invented reason would test the inbox against a code production never produces.`,
+                };
+            }
+            recordRefusal(agentName, sessionId, params?.counterpartyPubkey ?? "", asked);
             return { ok: true };
         });
         handlers.set("__test_delivery_open_begin", async (params, _connectionId) => {
@@ -3572,12 +4474,27 @@ async function startDaemonHoldingLock(config, singletonLock) {
             if (!handler)
                 return undefined;
             return async (params, connectionId) => {
-                const result = await handler(params, connectionId);
+                /**
+                 * ONE request, ONE store — and the fallback notice is spread in BEFORE `renderForSurface`.
+                 *
+                 * `DOD-M15-SELECTION-1` clause 2 first annotated the response out in `ipc-server.ts`, which
+                 * is downstream of this wrapper and therefore downstream of surface rendering. The notice
+                 * says *"Run cello_use_agent"*; `isInstructionKey` in `vocabulary.ts` rewrites any key
+                 * ending in `guidance`, so that WOULD have become `cello use-agent` for a terminal — but it
+                 * arrived after the rewrite had already run. An operator running `cello inbox` was handed a
+                 * verb that does not exist in a shell, which is the exact failure the vocabulary layer was
+                 * built to prevent. Annotating here puts it back in front of the renderer.
+                 */
+                const store = {};
+                const result = await fallbackNoticeStore.run(store, () => handler(params, connectionId));
+                const annotated = store.notice && result !== null && typeof result === "object" && !Array.isArray(result)
+                    ? { ...result, ...store.notice }
+                    : result;
                 // Default to "cli": a connection that never sent ipc.connect has no recorded surface, and
                 // the CLI verb is the safe answer — it is at least a real command an operator can run,
                 // whereas an MCP tool name is useless in a terminal.
                 const surface = perConnectionState.get(connectionId)?.clientType === "mcp" ? "mcp" : "cli";
-                return renderForSurface(result, surface);
+                return renderForSurface(annotated, surface);
             };
         },
     };
@@ -3828,7 +4745,22 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     logger.error("document.delivery.seal_failed", { agent, sessionId, reason: "close_handler_missing", correlationId });
                     return;
                 }
-                const sealed = (await close({ session_id: sessionId, agent }, `doc-delivery-${correlationId}`));
+                /**
+                 * `wait_for_seal: true` — DOD-M15-CLOSEWAIT-1 review MEDIUM-5.
+                 *
+                 * This is NOT an IPC caller. It is an in-process worker awaiting the close for a session
+                 * it opened itself, and the `ok !== true` check below is the only thing that ever reports
+                 * a failed document-delivery seal. The new default answers `ok: true` at COMMITMENT, so
+                 * without this flag that check could never fire for a ceremony failure again — §16.4's
+                 * "the autonomous session still carries the seal" would rest on a detached task nobody
+                 * awaited, retried or reported on.
+                 *
+                 * The whole point of answering early is that a human is watching a terminal. Nobody is
+                 * watching this one, so it takes the blocking form — which also stops each delivery
+                 * leaving a detached ceremony holding a visiting connection for up to eleven minutes,
+                 * overlapping instead of serialising.
+                 */
+                const sealed = (await close({ session_id: sessionId, agent, wait_for_seal: true }, `doc-delivery-${correlationId}`));
                 if (sealed?.ok !== true) {
                     // `cello_close_session` has distinct failure codes — session_already_sealed,
                     // seal_interrupted_*, signaling_reconnecting — and every one of them landed nowhere.
@@ -3841,7 +4773,14 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // transport asked for 0x04, the composition root threw it away, and every document leaf
             // still reached the relay as a MESSAGE. Verified on live traffic: daemon 0.0.145 shipped
             // the fix everywhere except here and the wire was unchanged.
-            sendContent: (agent, sessionId, content, contentHash, correlationId, leafKind) => sessionNodeManager.sendContent(agent, sessionId, content, contentHash, correlationId, leafKind),
+            //
+            // ⚠️ AND `contentHashAlg` IS THE SECOND PARAMETER THIS ADAPTER MUST NOT DROP. The note above
+            // is about `leafKind`, which this wrapper silently swallowed while every other caller passed
+            // it — a thin pass-through is exactly where a new argument goes missing, because nothing
+            // about the call site looks wrong afterwards. B2b's failure mode if it happens again: the
+            // document path sends a salted hash labelled `sha256`, and every peer refuses it.
+            sendContent: (agent, sessionId, content, contentHash, correlationId, leafKind, contentHashAlg) => sessionNodeManager.sendContent(agent, sessionId, content, contentHash, correlationId, leafKind, contentHashAlg),
+            contentHashForSession: (agent, sessionId, content) => sessionNodeManager.contentHashForSession(agent, sessionId, content),
             // The `0x04` doc leaf for a frame WE sent — the same step `cello_send` takes after its own
             // successful send. See the comment at the call site for why this is delivery-critical and
             // not audit bookkeeping.
@@ -3850,7 +4789,31 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 // (deliberate — f75ea09), so it obeys the same discipline a message does — including
                 // being HELD when the position is ahead of the tail, which is why the real frame bytes
                 // have to travel with it.
-                const placed = sessionNodeManager.placeOwnLeaf(agent, sessionId, Buffer.from(contentHash).toString("hex"), frameBytes, assignedSeq, correlationId, "doc");
+                const placed = sessionNodeManager.placeOwnLeaf(agent, sessionId, Buffer.from(contentHash).toString("hex"), frameBytes, assignedSeq, correlationId, "doc", 
+                /**
+                 * No proof — and the reason I first wrote here was FALSE, which review traced rather
+                 * than read.
+                 *
+                 * ⚠️ IT SAID *"the document transport does not go through `sendContent`, so no Structure-1
+                 * was signed."* Both halves are wrong. `document-delivery-transport.ts` calls
+                 * `deps.sendContent(...)`, wired straight to `sessionNodeManager.sendContent` a few lines
+                 * above this; and `session-relay-client.ts` signs the Structure-1 with no `leafKind` gate
+                 * at all, so a `0x04` doc leaf is signed exactly like a message. **A proof exists and is
+                 * discarded here.**
+                 *
+                 * That matters more than a wrong comment usually would, because this unit's whole thesis
+                 * is *"`undefined` is a claim the author made rather than one the signature made for
+                 * them"* — and the first claim made under the new signature was untrue.
+                 *
+                 * THE TRUE REASON, which is a better one: **no consumer.** A doc leaf released from a
+                 * hold writes no transcript row — `#releaseHeld` skips `recordTranscriptMessage` for
+                 * `kind === "doc"` — so there is nothing for the proof to reach. Discarding it is
+                 * no-consumer-no-ship, deliberately.
+                 *
+                 * **If doc rows ever reach the transcript, `appendLeaf` needs an authorship parameter**
+                 * and this `undefined` becomes a defect rather than a decision.
+                 */
+                undefined);
                 return { placed: placed.placed, leafIndex: placed.placed ? placed.leafIndex : null };
             },
         });
@@ -4012,6 +4975,33 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // MCP-001: Clean up per-connection state when a connection disconnects
     // MCP-002: Also unregister from notification dispatcher
     ipcServer.onDisconnect((connectionId) => {
+        /**
+         * DOD-M15-IPCVISIBLE-1: SAY THAT IT CLOSED, and say what it was attending.
+         *
+         * `daemon.ipc.connected` fired on every open and nothing on close, so a live client and a dead
+         * one that was never cleaned up looked identical in the log. The attended agent is the field
+         * that matters: attendance dropping was silent, and an agent losing its last attendee changes
+         * whether away-messages fire and who receives doorbells — so a session that stopped waking is
+         * diagnosable from the log rather than by guesswork.
+         */
+        const closing = perConnectionState.get(connectionId);
+        const stillAttending = closing?.currentAgent
+            ? countAttendance(perConnectionState, closing.currentAgent) - 1
+            : null;
+        // RETURNED, not logged here — `ipcServer` merges this into its single
+        // `daemon.ipc.disconnected` line. A second line under the same name left neither carrying the
+        // whole picture and doubled every count (review F8).
+        const disconnectContext = {
+            clientType: closing?.clientType ?? "unknown",
+            attendedAgent: closing?.currentAgent ?? null,
+            ...(stillAttending !== null ? { remainingAttendance: stillAttending } : {}),
+            ...(stillAttending === 0
+                ? {
+                    impact: "that agent has no attending session left — inbound sessions are now answered with " +
+                        "its away message rather than a live reply, and its doorbells reach nobody",
+                }
+                : {}),
+        };
         perConnectionState.delete(connectionId);
         connectionCursors.delete(connectionId); // M8C-CURSOR-1: cursor is connection-scoped, dies with it
         // ...and so is the delivery bookmark (review F1). It is a SEPARATE map from the gate's cursor
@@ -4044,6 +5034,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
             else
                 inboundSessionWaiters.delete(agentName);
         }
+        return disconnectContext;
     });
     // Log daemon.login.validation.complete (stub — all unverified until SIGNAL-001)
     logger.info("daemon.login.validation.complete", {
@@ -4068,6 +5059,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
     async function stop(reason) {
         clearInterval(reconcileSweepTimer);
         clearInterval(revivalBoundSweepTimer);
+        // DOD-M15-RELAYABUSE-1: scheduled park retries. Unref'd, so they never held the process open —
+        // cleared so an in-process restart cannot leave one draining into a torn-down manager.
+        for (const t of parkRetryTimers)
+            clearTimeout(t);
+        parkRetryTimers.clear();
         // DOD-M12B-SHUTDOWN-1: clearing the timer only stops the NEXT tick. The pass already running
         // walks every agent, and each step dials a peer and opens a session — which is why a daemon
         // reported down, with its socket already removed, was still logging `document.reconcile.sweep`
@@ -4094,6 +5090,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
         if (manifestPollScheduler) {
             manifestPollScheduler.cancel();
         }
+        // DOD-M15-STALEROSTER-1: same discipline as the manifest poll — the stop function sets the
+        // flag so an in-flight sweep cannot re-arm, and the belt-and-suspenders cancel covers the
+        // scheduler-without-sweep case.
+        stopRosterSweep?.();
+        rosterSweepScheduler?.cancel();
         stopRegistryPoll?.();
         if (config.registryPollScheduler) {
             config.registryPollScheduler.cancel();
@@ -4103,6 +5104,32 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // outbound work is not draining. Above the `daemon.stopped` log with the other cancels, because
         // this is "stop making new work", not "tear down transports".
         await restartSealResolver?.stop();
+        /**
+         * DRAIN THE DETACHED SEAL TAILS — review MEDIUM-6, and it sits HERE for the same reason
+         * `restartSealResolver.stop()` does: both are directory ceremonies that must not be cut with
+         * the counterparty holding a commitment this side never acknowledged. Before
+         * `stopAllSignaling()`, because that is what severs the transport underneath them.
+         *
+         * BOUNDED. A ceremony can legitimately wait eleven minutes for a counterparty, and a shutdown
+         * must not. Past the bound they are abandoned deliberately and said out loud — the next boot
+         * resolves them, which is exactly what the restart seal resolver is for.
+         */
+        if (backgroundSeals.size > 0) {
+            const SHUTDOWN_SEAL_DRAIN_MS = 5_000;
+            logger.info("session.seal.background.draining", { count: backgroundSeals.size, budgetMs: SHUTDOWN_SEAL_DRAIN_MS });
+            const drained = await Promise.race([
+                Promise.allSettled([...backgroundSeals]).then(() => true),
+                new Promise((r) => { const t = setTimeout(() => r(false), SHUTDOWN_SEAL_DRAIN_MS); t.unref?.(); }),
+            ]);
+            if (!drained) {
+                logger.warn("session.seal.background.abandoned", {
+                    count: backgroundSeals.size,
+                    impact: "shutdown did not wait for these seal ceremonies. Each session holds a durable commitment " +
+                        "but no receipt yet, and the counterparty may hold a commitment this side never acknowledged.",
+                    guidance: "The next daemon start resolves them via the restart seal resolver; no operator action is needed.",
+                });
+            }
+        }
         logger.info("daemon.stopped", { pid: process.pid, reason });
         // DOD-LOGOUT-EXIT-1: what the teardown actually DID, carried to onStopped so the binary can
         // exit non-zero on a dirty stop. Without it a shutdown that threw halfway — sessions never