@cello-protocol/daemon 0.0.182 → 0.0.184

package/dist/session-node-manager.js

@@ -22,7 +22,8 @@
 // named. A direct call here would be a hash computed without asking what the frame said (part B1).
 import { contentHashFor, resolveContentHashAlg, CONTENT_HASH_ALGS } from "./wire-content-hash.js";
 import { CAPACITY_REASONS } from "./refusal-reasons.js";
-import { onPeerSaltFrame, ownSaltFrame, SALT_ADOPTION_LABELS, SALT_FREEZE_GUIDANCE, } from "./session-salt-agreement.js";
+import { onPeerSaltFrame, ownSaltFrame, SALT_ADOPTION_LABEL_MAX, SALT_ADOPTION_LABELS, SALT_FREEZE_GUIDANCE, } from "./session-salt-agreement.js";
+import { CONTENT_ENCRYPTION_REASONS, CONTENT_ENCRYPTION_GUIDANCE, SESSION_CONTENT_ENCRYPTION_V1, } from "./content-encryption-status.js";
 import { openEncryptedDatabase, resolveDbKey, dbKeyPathFor, } from "./sqlcipher-db.js";
 import { migrateToEncryptedIfNeeded } from "./identity-migration.js";
 import { ensureIdentitySchema } from "./db-identity-store.js";
@@ -31,6 +32,7 @@ import { TIER, normalizeTier, isKnownTierValue, tierBoundsFor, DEFAULT_TIER_BOUN
 import { migrateCborBlobsToCanonical } from "./cbor-blob-migration.js";
 import { ensureTrustSignalSchema } from "./trust-signal-store.js";
 import { boundSettingKey, settableTierName, isValidSettingKey, awayTierSettingKey, AWAY_DEFAULT_KEY } from "./agent-settings-keys.js";
+import { publishableEndpoint, relayOnlyState } from "./relay-only.js";
 import { randomUUID, createHash, randomBytes } from "node:crypto";
 import * as lp from "it-length-prefixed";
 import { decode } from "cbor-x";
@@ -39,9 +41,13 @@ import { MAX_SESSION_NODES, STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 import { SessionConnectionGater } from "./session-connection-gater.js";
 import { SessionTree, sessionTreeLeafKindFromDb } from "./session-tree.js";
 import { CELLO_CONTENT_PROTOCOL_ID, NodeAutoNatService } from "@cello-protocol/transport";
-import { verify, buildMerkleTree, merkleRoot, generateSaltContribution, SESSION_SALT_BYTES } from "@cello-protocol/crypto";
+import { verify, buildMerkleTree, merkleRoot, generateSaltContribution, SESSION_SALT_BYTES, generateSessionEphemeral, destroySessionEphemeral, deriveSessionSecrets, signSessionEphemeral, verifySessionEphemeral, sealSessionContent, openSessionContent, } from "@cello-protocol/crypto";
 import { encodeSealPayload, MONIKER_RE, validateMoniker } from "@cello-protocol/protocol-types";
-import { decodeParkEnvelope, authenticateParkedEntry, pubkeyMatchesHex, ParkEnvelopeError, PARK_ENVELOPE_REASONS } from "./park-envelope.js";
+// `PARK_ENVELOPE_REASONS` is deliberately NOT imported here. The reason codes are compared inside
+// `park-envelope.ts` itself (`parkRefusalGuidance`) and asserted in its own test; this file only ever
+// receives the already-classified `ParkAuthFailure`, so importing the code table here would invite a
+// second, drifting copy of the classification logic.
+import { decodeParkEnvelope, authenticateParkedEntry, pubkeyMatchesHex, ParkEnvelopeError, parkRefusalGuidance } from "./park-envelope.js";
 import { isValidMultiaddr } from "@cello-protocol/transport";
 // `LEAF_KIND_MSG` is no longer imported here: `sendContent`'s `leafKind` stopped defaulting to it
 // (B2b-1 review F4), so this file no longer names a default — every caller states its own kind.
@@ -49,6 +55,7 @@ import { AgentRelayClient, LEAF_KIND_CTRL, isTerminalRelayRefusal, extractErrorM
 import { terminalRelayRefusal } from "./session-terminal-refusal.js";
 import { RelayReceiptStore } from "./relay-receipt-store.js";
 import { SessionSealLeafStore } from "./session-seal-leaf-store.js";
+import { certifiedLeafSetFrom } from "./sealed-leaf-set.js";
 import { addColumnIfMissing } from "./column-birth.js";
 import { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, } from "@cello-protocol/gateway";
 /** SEC-1 / review M4: cap on the refused-parked-entry memo (remote-fed → must be bounded). */
@@ -85,6 +92,15 @@ const MAX_UNREADABLE_ALG_FRAMES = 64;
  * park-only session never starts one and never waits (constraint 5).
  */
 const SALT_AGREEMENT_WAIT_MS = 5_000;
+/**
+ * How many times this side re-attempts its session-key announce, and the base delay between them.
+ *
+ * Bounded on purpose (review F5): the announce rides `onPeerConnect`, so a connection that stays up
+ * after one failed attempt would never produce another — encryption off for the life of the session,
+ * with guidance pointing at a reconnect that never comes.
+ */
+const SESSION_KEY_ANNOUNCE_RETRIES = 4;
+const SESSION_KEY_ANNOUNCE_RETRY_MS = 250;
 /**
  * WHY a session is hashing unsalted — review Finding 1, and this exists because one sentence was
  * carrying five different situations.
@@ -106,8 +122,35 @@ const UNSALTED_REASONS = {
     NO_AGREEMENT_STARTED: "no_agreement_started",
     /** We announced and they did not answer inside the bound. */
     AGREEMENT_TIMED_OUT: "agreement_timed_out",
-    /** They answered, terminally: they have already hashed content and can never adopt. */
+    /**
+     * They answered, terminally: they have already hashed content and can never adopt.
+     *
+     * ⚠️ THIS IS ONE OF FOUR THINGS THE PEER CAN SAY, AND IT USED TO BE ALL OF THEM — 006-CRYPTO
+     * finding 2. The wire frame carries WHICH reason, and `SaltAgreementFrame.adoptionClosed` is a
+     * label rather than a boolean precisely so a caller cannot say `closed` without saying why. That
+     * distinction reached the log and was then dropped one call before the operator, who was told
+     * "they had already hashed messages" no matter which of the four it was.
+     */
     PEER_CLOSED_ADOPTION: "peer_closed_adoption",
+    /**
+     * They answered terminally because their side could NOT READ its own frontier — local storage
+     * trouble on their machine, not a conversation that started early.
+     *
+     * Kept apart from `PEER_CLOSED_ADOPTION` because the remedies are opposites: a new session fixes
+     * the already-hashing case and does nothing at all for this one.
+     */
+    PEER_FRONTIER_UNREADABLE: "peer_frontier_unreadable",
+    /** They answered terminally because the two sides could not converge — 006-CRYPTO finding 1. */
+    PEER_EXCHANGE_STALLED: "peer_exchange_stalled",
+    /**
+     * They closed adoption naming a reason THIS build does not recognise.
+     *
+     * Deliberately non-asserting. The peer chooses this string, so the safe rendering states what we
+     * know — they declined, and the label is in the log line above — and asserts nothing about why.
+     * Guessing here is how an operator ends up asking a counterparty to change something that was
+     * never the problem.
+     */
+    PEER_CLOSED_UNSPECIFIED: "peer_closed_unspecified",
     /** The session was torn down while the first send was still waiting. */
     SESSION_TORN_DOWN: "session_torn_down",
     /** This side already hashed, leafed, held or has in flight — adoption closed here. */
@@ -137,6 +180,9 @@ const UNSALTED_GUIDANCE = {
     [UNSALTED_REASONS.NO_AGREEMENT_STARTED]: "Your counterparty was not connected when you sent this, so there was nobody to agree a salt with — most often they are simply offline and this message is going to their relay mailbox. Nothing is wrong with either build. The agreement only runs at session open, so this session stays unsalted even after they come online; a session started while you are both connected will be salted.",
     [UNSALTED_REASONS.AGREEMENT_TIMED_OUT]: "Your counterparty was connected but did not answer the salt agreement in time. Almost always they are on a build that predates it, in which case this is expected and permanent for this session — start a new session once they upgrade. If you know they are on the same version, look for session.salt.persist.failed on this side and session.salt.announce.failed on either.",
     [UNSALTED_REASONS.PEER_CLOSED_ADOPTION]: "Your counterparty declined the salt because their side of this session had already hashed messages — their conversation started before yours could agree one. Both builds are fine and both sides know. Start a new session if you want the protection.",
+    [UNSALTED_REASONS.PEER_FRONTIER_UNREADABLE]: "Your counterparty declined the salt because their machine could not read its own record of this conversation — their local storage is not answering. Nothing is wrong with your machine or with either build, and they did not do anything wrong. STARTING A NEW SESSION WILL NOT HELP: the next one will decline the same way until their storage is working. Ask them, out of band, to look for session.salt.adoption.refused on their side; it names the read that failed.",
+    [UNSALTED_REASONS.PEER_EXCHANGE_STALLED]: "Your counterparty holds a salt for this session and this side never managed to store one, so the two of you could not converge and both agreed to stop rather than trade messages about it forever. Nobody is at fault and no message was lost. Look for session.salt.persist.failed on this side — if it is there, a write to local storage failed and that is the whole cause. Start a new session; it will agree a salt normally.",
+    [UNSALTED_REASONS.PEER_CLOSED_UNSPECIFIED]: "Your counterparty declined the salt for a reason this build does not recognise — most likely they are on a newer build that names a case this one predates. Both sides agree there is no salt, so nothing is broken and no message was lost. The exact reason they gave is in the session.salt.adoption.closed line just above. Start a new session once you both know why.",
     [UNSALTED_REASONS.SESSION_TORN_DOWN]: "This session was closed or reset while the message was still being prepared. This line is about the salt only; look for the close or freeze event just before it for what actually happened to the session.",
     [UNSALTED_REASONS.ADOPTION_CLOSED_LOCALLY]: "This session had already hashed or sent messages before a salt could be agreed, so adopting one now would leave half the conversation verifiable by one rule and half by another. That is permanent for this session and both builds are fine. Start a new session if you want the protection.",
     [UNSALTED_REASONS.OUR_PERSIST_FAILED]: "Your counterparty answered in time and THIS side failed to store the agreed salt — the fault is local, not theirs. Do not ask them to upgrade. Look for session.salt.persist.failed immediately above this line; it names the write that failed.",
@@ -216,6 +262,15 @@ const REDIAL_COOLDOWN_MS = 15_000;
  * span about 2.5 hours.
  */
 export const SR_RESERVATION_MAX_RETRIES = 5;
+/**
+ * DOD-M15-RELAYSLOTS-1 — how long an agent skips a relay that refused it for a relay-side fault.
+ *
+ * Ten minutes: long enough that the agent is not re-asking a relay that cannot serve it every time
+ * its receiver rebuilds, short enough that when someone fixes that relay the agent finds it again
+ * without needing its own restart. The fault is on somebody else's machine and nobody tells us when
+ * it is fixed, so this has to expire on its own.
+ */
+export const RELAY_QUARANTINE_MS = 10 * 60 * 1000;
 export const CAP_INTERRUPTED_TTL_MS = Number(process.env["CELLO_CAP_INTERRUPTED_TTL_MS"]) || 2 * 60 * 60 * 1000;
 /**
  * DOD-CAP-SELF-HEAL-1 — what counts against a per-sender acceptance bound.
@@ -302,6 +357,43 @@ export const REVIVE_RESERVATION_CANDIDATES = 2;
  * the healthy direct latency and far below anything a person would notice.
  */
 export const LEAF_FETCH_GRACE_MS = 2_000;
+/**
+ * The relay's peer id out of a circuit listen address, or `null` if the address does not name one.
+ *
+ * Returns null rather than throwing or guessing: an unreadable address means we cannot tell which
+ * relay this candidate was for, and every caller has a real thing to do with that answer.
+ */
+function relayPeerIdOf(circuitAddr) {
+    return /\/p2p\/([^/]+)\/p2p-circuit/.exec(circuitAddr)?.[1] ?? null;
+}
+/**
+ * The Merkle leaf inputs for a seal carry: each leaf's `content_hash`, read out of the bytes its
+ * SENDER SIGNED (`structure1_cbor`), never out of an envelope field somebody else filled in.
+ *
+ * `null` when any leaf is unreadable — the caller must then answer "I cannot judge", never "we
+ * disagree". A decode failure is this daemon's limitation, not evidence against anyone.
+ *
+ * Canonical Structure 1 is
+ * `[protocol_version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp]`, and the
+ * content hash is used AS the leaf hash (RFC 6962 §2.1 "hash" leaves are taken as-is), which is the
+ * domain the certified root lives in.
+ */
+function carryContentHashInputs(carry) {
+    const inputs = [];
+    for (const leaf of carry) {
+        let contentHash;
+        try {
+            contentHash = decode(leaf.structure1Cbor)[1];
+        }
+        catch {
+            return null;
+        }
+        if (!(contentHash instanceof Uint8Array) || contentHash.length !== 32)
+            return null;
+        inputs.push({ kind: "hash", data: contentHash });
+    }
+    return inputs;
+}
 export class SessionNodeManager {
     #factory;
     #logger;
@@ -335,6 +427,13 @@ export class SessionNodeManager {
      * manager deliberately does not hold. Only consulted on the detached seal path — an ACTIVE session
      * always uses its own registered client.
      */
+    /**
+     * DOD-M15-RELAYSLOTS-1: `onlineToken` is REQUIRED on the dependency bag, not optional. Every
+     * relay client needs the directory's token or the relay refuses it a reservation slot, and the
+     * failure is invisible from the client side — the agent comes up, reports itself online, and is
+     * reachable by nobody. Making it required means a call site that forgets to pass it is a type
+     * error rather than an agent that quietly stops being dialable.
+     */
     #detachedRelayClientBuilder = null;
     setDetachedRelayClientBuilder(fn) {
         this.#detachedRelayClientBuilder = fn;
@@ -390,6 +489,8 @@ export class SessionNodeManager {
             client = this.#detachedRelayClientBuilder?.(agentName, ep.relayPeerId, [...ep.relayAddrs], {
                 receiptStore: this.#relayReceiptStore ?? undefined,
                 sealLeafStore: this.#sealLeafStore ?? undefined,
+                // DOD-M15-RELAYSLOTS-1: read at each auth, never snapshotted — the token expires hourly.
+                onlineToken: () => this.getDirectoryOnlineToken(agentName),
             });
             if (!client)
                 return { error: "relay_client_unavailable" };
@@ -405,8 +506,353 @@ export class SessionNodeManager {
         // relay_session_gone` branch — which exists to tell "the relay never had it" apart from "the
         // relay swept or sealed it" — can never fire, so the operator is handed a first-message-race
         // label for a swept session.
-        client.registerSession(sessionId, node);
-        return { node, relayClient: client, relaySessionIdBytes: new Uint8Array(Buffer.from(sessionId, "hex")) };
+        /**
+         * DOD-M15-RELAYLEAK-1 — **RE-REGISTERING A SESSION THAT IS ALREADY REGISTERED BLINDS IT.**
+         *
+         * `registerSession` REPLACES the entry's `onLeafDeliver` with `onLeafDeliver ?? (() => {})`, and
+         * unlike `assignment` / `recorded` it does NOT carry the existing handler forward. **This path
+         * passes no handler.** So a detached seal on a session that still holds a live registration
+         * would swap that session's inbound leaf delivery for a no-op: the counterparty's leaves keep
+         * arriving at the relay client and are dropped on the floor, while the operator sees a healthy
+         * session that has simply gone quiet.
+         *
+         * A call that finds the session already registered is therefore a PASSENGER: it uses the client
+         * and touches nothing. It also does not release — ownership is never inferred, only claimed.
+         *
+         * ⚠️ **This is NOT justified by a concurrency race, and an earlier version of this comment said
+         * it was.** Review checked: `#resolveSealTransport` and everything above the first `await` are
+         * synchronous, and a second caller plants/hits `#responderSealSubmitted` and returns
+         * `responder_seal_already_submitted` before ever reaching `submitLeaf`. Two callers cannot be in
+         * the client at once through the only caller, so "the second one closes the client the first is
+         * awaiting" **cannot happen**. The wrong reason mattered: it invites a future reader to delete
+         * this guard as defensive clutter once they notice the race is impossible — taking the
+         * handler-clobbering protection with it.
+         */
+        const claimedRegistration = !client.hasSession(sessionId);
+        if (claimedRegistration) {
+            client.registerSession(sessionId, node);
+        }
+        else {
+            /**
+             * Review MEDIUM-1 — **A PATH THAT DECLINES TO FIX A LEAK MUST SAY SO.**
+             *
+             * Reaching here means the session is registered on this client while `#activeNodes` holds no
+             * entry for it — and the ways that happens are all orphans: a previous `releaseDetached()`
+             * that threw (loud once, then silent forever after), or a revival that registered and then
+             * failed to hang the client on an entry. Declining to unregister is right — we cannot prove
+             * no live session owns it — but without this line the orphan is invisible, which is the exact
+             * shape this whole line exists to remove.
+             */
+            this.#logger.info("session.seal.transport.registration_shared", {
+                agentName,
+                sessionId,
+                impact: "this seal is using a relay registration it did not create, so it will not release it. If " +
+                    "no live session owns that registration the client is held until process exit.",
+            });
+        }
+        /**
+         * DOD-M15-RELAYLEAK-1 — **`releaseOnDone` IS THE RELEASE SIGNAL, and its absence was the leak.**
+         *
+         * This branch (no `#activeNodes` entry) CACHES a relay client and registers a session on it, and
+         * nothing ever unregistered. `#detachSessionRelay` closes a client only when
+         * `!client.hasSessions()`, so a registration that is never removed keeps that predicate false
+         * **forever** — the client, its authenticated stream and its reader survive for the process
+         * lifetime. The LIVE branch above registers nothing here, so only this one needs releasing, and
+         * marking it is what lets the caller tell them apart without guessing.
+         */
+        return {
+            node,
+            relayClient: client,
+            relaySessionIdBytes: new Uint8Array(Buffer.from(sessionId, "hex")),
+            // Not `true` unconditionally: a passenger call must not release a registration it did not
+            // claim — see the note above `claimedRegistration`.
+            ...(claimedRegistration ? { releaseOnDone: true } : {}),
+        };
+    }
+    /**
+     * DOD-M15-RELAYAUTH-1: authenticate a fresh standing receiver to its reservation relay over the
+     * CELLO relay protocol — proof of K_local key possession, not a session. Reuses the SAME
+     * `#relayClients` cache `#connectSessionRelay`/`#resolveSealTransport` read from, keyed
+     * identically (`${agentName}::${relayPeerId}`), so a session created moments later on this same
+     * relay finds an already-authenticated client instead of dialing and authenticating twice.
+     *
+     * The manager holds no K_local (M12-P15's own rationale for `#detachedRelayClientBuilder`) —
+     * without a builder wired (a narrow startup race, or a test harness that never wires one), this
+     * is a no-op and the relay's own grace-window revoke is the backstop, not a defect in this path.
+     */
+    async #authenticateStandingReceiver(agentName, node, relayPeerId, heldCircuitAddr, correlationId) {
+        const clientKey = `${agentName}::${relayPeerId}`;
+        let client = this.#relayClients.get(clientKey);
+        if (!client) {
+            if (!this.#relayReceiptStore && this.#db)
+                this.#relayReceiptStore = new RelayReceiptStore(this.#db, this.#logger);
+            if (!this.#sealLeafStore && this.#db)
+                this.#sealLeafStore = new SessionSealLeafStore(this.#db, this.#logger);
+            /**
+             * ⚠️ SPLIT, NOT AN ANCHORED STRIP. The held address is
+             * `/ip4/…/tcp/…/p2p/<relay>/p2p-circuit/p2p/<self>` — the `/p2p-circuit` marker is in the
+             * MIDDLE, not at the end, so a `/\/p2p-circuit$/` replace matches nothing and silently
+             * hands the relay client a circuit address as its DIAL address. Measured, not assumed:
+             * that first version failed this file's own test because the client could not dial.
+             */
+            const baseRelayAddr = heldCircuitAddr.split("/p2p-circuit")[0] ?? heldCircuitAddr;
+            client = this.#detachedRelayClientBuilder?.(agentName, relayPeerId, [baseRelayAddr], {
+                receiptStore: this.#relayReceiptStore ?? undefined,
+                sealLeafStore: this.#sealLeafStore ?? undefined,
+                // DOD-M15-RELAYSLOTS-1: read at each auth, never snapshotted — the token expires hourly.
+                onlineToken: () => this.getDirectoryOnlineToken(agentName),
+            });
+            if (!client) {
+                /**
+                 * Review M5: this was a `debug` line, and it is not a debug-level event.
+                 *
+                 * If no builder is wired we return without proving key possession, the relay revokes this
+                 * receiver's reservation about fifteen seconds later, and the agent stops being reachable
+                 * from behind NAT — while reporting itself perfectly healthy. Calling that "a narrow startup
+                 * race" in a comment concedes it happens in production, and a system that is unreachable
+                 * must not be quieter about it than a system that is merely slow.
+                 */
+                this.#logger.warn("session.standing_receiver.relay_auth.no_builder", {
+                    agentName,
+                    relayPeerId,
+                    correlationId,
+                    impact: "this receiver cannot prove key possession, so the relay will revoke its reservation and " +
+                        "the agent becomes unreachable from behind NAT — nobody can start a session with it — " +
+                        "even though it still reports itself online.",
+                });
+                return;
+            }
+            this.#relayClients.set(clientKey, client);
+        }
+        /**
+         * ⚠️ `proveReservation`, NOT `connect`. Review HIGH-1: `connect()` short-circuits on the
+         * client's cached stream, which belongs to whichever node connected FIRST — so every
+         * REPLACEMENT standing receiver (the one built behind each new session) sent nothing, the relay
+         * never saw its transport identity, and its reservation was revoked ~15s later. The agent then
+         * churned reserve→revoke→rebuild for the life of the conversation, holding no usable circuit
+         * address, so while you were talking to one person nobody else could reach you.
+         *
+         * `proveReservation` always opens its own stream from THIS node, and marks it so the relay
+         * proves possession without rebinding the agent's delivery target away from the live session.
+         */
+        const proven = await client.proveReservation(node);
+        /**
+         * DOD-M15-RELAYSLOTS-1: keep the relay's refusal where the OPERATOR can reach it.
+         *
+         * The log line below is a good log line and it is not an answer to "why is my agent
+         * unreachable?" — nobody opens the file. The relay now refuses for reasons a person can act on
+         * (no token yet, too many sessions still open, this relay is misconfigured), each with its own
+         * next step, and every one of them is useless if it stops at a log.
+         */
+        if (!proven) {
+            const refusal = client.getLastAuthRefusal();
+            /**
+             * Review L2: the `else` is not symmetry for its own sake. `proveReservation` also fails for
+             * transport reasons, which leave `getLastAuthRefusal()` null — and without this branch the
+             * PREVIOUS refusal stayed in the map, so `cello_status` went on showing a cause and an
+             * affordance for something that was no longer what was wrong.
+             */
+            if (refusal)
+                this.#srRelayRefusal.set(agentName, { ...this.#withDirectoryCause(agentName, refusal), relayPeerId });
+            else
+                this.#srRelayRefusal.delete(agentName);
+            /**
+             * DOD-M15-RELAYSLOTS-1 clause 9 — **ACT on the classification, do not merely record it.**
+             * A relay-side fault means a different relay will work now, so quarantine this one and
+             * rebuild the receiver against the rest of the pool. Everything else stays put: a token
+             * problem reproduces on every relay, and walking the fleet would turn one client fault into
+             * what looks like a fleet-wide outage.
+             */
+            if (refusal?.tryAnotherRelay && !this.#shuttingDown) {
+                this.#quarantineRelay(agentName, relayPeerId, refusal.reason);
+                void this.#rebuildStandingReceiver(agentName);
+            }
+        }
+        else {
+            this.#srRelayRefusal.delete(agentName);
+        }
+        this.#logger.info("session.standing_receiver.relay_auth.result", {
+            agentName,
+            relayPeerId,
+            // The node that actually proved itself — without this, HIGH-1 was invisible in the logs: the
+            // line said `connected: true` for a receiver that had sent nothing.
+            nodePeerId: node.getPeerId(),
+            proven,
+            ...(proven ? {} : {
+                refusalReason: client.getLastAuthRefusal()?.reason ?? "no_relay_verdict",
+                tryAnotherRelay: client.getLastAuthRefusal()?.tryAnotherRelay ?? false,
+            }),
+            correlationId,
+        });
+    }
+    /**
+     * DOD-M15-CORROBORATE-1: witness alerts this agent's relays have reported, oldest first, capped.
+     *
+     * ⚠️ **IN MEMORY, AND A DAEMON RESTART LOSES THEM** — review F4. This comment used to say a relay
+     * that still holds the observation re-delivers it on the next connection. It does not:
+     * `drainWitnessAlerts` splices, so once an alert has been delivered the relay no longer holds it.
+     * Nothing here is a durable record of anything; the relay operator's own log is, and so is the
+     * signature on the alert, which the operator can keep. Said plainly rather than left as an implied
+     * guarantee.
+     *
+     * Nothing clears the list before that restart, and that is deliberate: an alert an operator can
+     * silence is one an attacker can wait out.
+     */
+    #witnessAlerts = new Map();
+    /**
+     * ⚠️ **THE CAP KEEPS THE FIRST, NOT THE LAST** — review F1, and the direction is the whole point.
+     *
+     * The relay's own queue drops the NEWEST when full, precisely so a flood cannot push the first
+     * real observation out. This list did the opposite (`slice(-20)`), which handed the mute button
+     * straight back one layer up: at the relay's 120-submits-per-minute limit, about ten seconds of
+     * fabricated alerts evicted the genuine one before any operator read it. Repeats of one event also
+     * collapse — see the dedupe in `recordRelayWitnessAlert` — so a flood cannot even fill it.
+     */
+    static #WITNESS_ALERT_CAP = 20;
+    /**
+     * Review F7: relays that sent a witness alert this build could not read or verify, per agent.
+     * Peer id → cause + count. NO session and NO party: it reports that our witness layer is not
+     * working, never anything about a participant.
+     */
+    #witnessUnreadable = new Map();
+    /**
+     * Agents whose alert list hit the cap — fallback-finder LOW 2. Without this the inbox renders a
+     * full list that looks complete, and "twenty alerts" is indistinguishable from "twenty of some
+     * larger number". A marker the operator can see costs one boolean.
+     */
+    #witnessTruncated = new Set();
+    /**
+     * Record what one relay says it saw on one of this agent's sessions, for the operator to read.
+     *
+     * ⚠️ **IT DOES NOT FREEZE THE SESSION, AND THAT IS THE DESIGN.** A client freezing on its OWN
+     * verification is safe: it limits only what that client trusts. Freezing on a REMOTE party's
+     * say-so hands any single relay the power to end any conversation it carries, and to write an
+     * accusatory record about a counterparty who did nothing. The identity freeze stays where it is —
+     * on this daemon's own check of an inbound frame — and this surfaces a second, independent
+     * observation next to it. One witness reports; it does not rule.
+     */
+    recordRelayWitnessAlert(agentName, alert) {
+        const list = this.#witnessAlerts.get(agentName) ?? [];
+        /**
+         * ONE ROW PER (WITNESS, SESSION) — review F1's second half. A relay reports every refused
+         * submission, and a determined submitter can produce a great many; twenty rows saying the same
+         * thing is not twenty facts, it is one fact and nineteen ways to push another one off the list.
+         * The repeat updates the count and the last-seen time and leaves the row where it is.
+         */
+        /**
+         * Keyed on the relay's PEER ID, not on `relayId` — fallback-finder LOW 1. `relayId` is absent
+         * for any relay that could not sign, so two DIFFERENT such relays reporting on one session
+         * collapsed into a single row and the operator read one witness where there were two. The peer
+         * id is the transport identity this client is actually talking to and is always known.
+         */
+        const key = `${alert.witnessPeerId}::${alert.sessionIdHex}`;
+        const existing = list.find((n) => n.key === key);
+        if (existing) {
+            existing.occurrences += 1;
+            existing.lastObservedAt = alert.observedAt;
+            // A later repeat that IS verifiable upgrades the row: the operator should end up holding the
+            // strongest form of the claim they were sent, never the weakest one that arrived first.
+            existing.alert = alert.verifiable ? alert : existing.alert;
+            // `firstObservedAt` is deliberately untouched — see its note on the type.
+        }
+        else if (list.length >= SessionNodeManager.#WITNESS_ALERT_CAP) {
+            // Keep the first. See the cap's own note for why this direction is load-bearing.
+            this.#witnessTruncated.add(agentName);
+            this.#logger.warn("session.witness.alert.list_full", {
+                agentName, held: list.length,
+                impact: "this alert was not recorded; the earlier ones are kept and still shown, and the " +
+                    "inbox now says the list is incomplete rather than looking whole",
+            });
+            return;
+        }
+        else {
+            list.push({ key, alert, occurrences: 1, firstObservedAt: alert.observedAt, lastObservedAt: alert.observedAt });
+        }
+        this.#witnessAlerts.set(agentName, list);
+        this.#logger.error("session.witness.alert.recorded", {
+            agentName,
+            sessionId: alert.sessionIdHex,
+            relayId: alert.relayId ?? "(unnamed)",
+            submitterIsCounterparty: alert.submitterIsCounterparty,
+            verifiable: alert.verifiable,
+            impact: "surfaced to the operator on the next cello_inbox; the session is NOT frozen by it",
+        });
+    }
+    /** The witness alerts an agent has been told about, oldest first, one row per witness+session. */
+    getWitnessAlerts(agentName) {
+        return this.#witnessAlerts.get(agentName) ?? [];
+    }
+    /** Whether this agent's alert list hit its cap, so the inbox can say the list is incomplete. */
+    witnessAlertsTruncated(agentName) {
+        return this.#witnessTruncated.has(agentName);
+    }
+    /**
+     * Review F7: a relay sent a witness alert this build could not read or could not verify.
+     *
+     * Recorded so a version skew that silently kills the witness layer is visible to the operator
+     * instead of living only in a log file. Carries no session and no party by construction.
+     */
+    recordRelayWitnessUnreadable(agentName, relayPeerId, why) {
+        const byRelay = this.#witnessUnreadable.get(agentName) ?? new Map();
+        const prior = byRelay.get(relayPeerId);
+        byRelay.set(relayPeerId, { why, count: (prior?.count ?? 0) + 1 });
+        this.#witnessUnreadable.set(agentName, byRelay);
+        this.#logger.error("session.witness.unreadable.recorded", {
+            agentName, relayPeerId, why,
+            impact: "this agent's witness layer is not working against that relay — no observation it " +
+                "sends can be read, and nothing has been concluded about any participant",
+        });
+    }
+    /** Relays whose witness alerts this build could not read, for the agent's inbox. */
+    getWitnessUnreadable(agentName) {
+        return [...(this.#witnessUnreadable.get(agentName) ?? new Map()).entries()]
+            .map(([relayPeerId, v]) => ({ relayPeerId, why: v.why, count: v.count }));
+    }
+    /**
+     * DOD-M15-RELAYSLOTS-1: the last relay refusal per agent, with the advice that goes with it.
+     * Written where the refusal is actually known; read by whatever tells the operator.
+     */
+    #srRelayRefusal = new Map();
+    /**
+     * Why this agent's standing receiver could not hold a reservation, in words the person running it
+     * can act on — or null when the last attempt succeeded or none has been made.
+     *
+     * This is the surface DoD clause 7 is about: the assertion that matters is what the CLIENT can
+     * show someone, not what the relay wrote in its own log.
+     */
+    getStandingReceiverRefusal(agentName) {
+        return this.#srRelayRefusal.get(agentName) ?? null;
+    }
+    /**
+     * DOD-M15-RELAYSLOTS-1 review M1 — **replace the relay's guess with the directory's fact.**
+     *
+     * The relay can only say "no token was presented"; the DIRECTORY knows why there was none, and
+     * the two most useful answers point somewhere the relay's own advice does not. Left alone,
+     * `online_token_required` tells the operator to check that their agent is reaching a directory —
+     * which, in the `not_registered_here` case, it plainly is.
+     */
+    #withDirectoryCause(agentName, refusal) {
+        if (refusal.reason !== "online_token_required")
+            return refusal;
+        const absent = this.#directoryOnlineTokenAbsent.get(agentName);
+        if (absent === "not_registered_here") {
+            return {
+                ...refusal,
+                advice: "The directory this agent is connected to holds no profile for its key, so it " +
+                    "issued no token and no relay will grant a reservation. The directory connection itself " +
+                    "is fine — either this agent registered against a different sovereign node and its " +
+                    "profile has not replicated here yet, or it is not registered at all.",
+            };
+        }
+        if (absent === "issue_failed") {
+            return {
+                ...refusal,
+                advice: "The directory could not issue this agent a token — its own lookup or signing " +
+                    "failed. That is a fault on the directory, not on this agent or on any relay; it usually " +
+                    "clears on the next connection.",
+            };
+        }
+        return refusal;
     }
     // DOD-LOOP-1: the standing receiver is PER-AGENT, not per-daemon. A daemon hosting two agents
     // (the loopback case) needs each agent to have its OWN inbound receiver node — otherwise the
@@ -645,6 +1091,89 @@ export class SessionNodeManager {
      * `alreadyRepairedAgainstPeerHalf`.
      */
     #saltRepairedAgainst = new Map();
+    /**
+     * THE MIRROR OF THE ABOVE — the peer FINGERPRINT we last answered with our half, hex.
+     *
+     * 006-CRYPTO finding 1. `#saltRepairedAgainst` terminates the salt-HOLDER's direction only. A side
+     * holding no salt answered every fingerprint with its contribution, and a latched holder answers
+     * every contribution with its fingerprint — so after one failed persist plus a reconnect, two
+     * healthy daemons repair at each other for the life of the session, one new stream and one INFO
+     * line each per round trip. Keyed on the peer's fingerprint BYTES for the same reason the other
+     * map is keyed on its half: a genuinely NEW fingerprint is new information and must still be
+     * answered; only an identical re-offer is the loop.
+     */
+    #saltRepairedAgainstFingerprint = new Map();
+    /**
+     * THE LABEL THE PEER GAVE when it closed adoption — 006-CRYPTO finding 2.
+     *
+     * The wire carries WHY, `session-salt-agreement.ts` makes it a union so a caller cannot close
+     * without saying why, and the agreement's `detail` puts it in the log. It was going no further:
+     * `#settleSaltPending(..., "closed")` recorded only that it was closed, so every one of the four
+     * reasons arrived at the operator as "they had already hashed messages".
+     *
+     * Stored raw and rendered through `#peerClosedReason`, which maps anything outside the known set
+     * to a non-asserting reason — the peer chooses these bytes.
+     */
+    #saltPeerClosedLabel = new Map();
+    /**
+     * THIS SESSION'S THROWAWAY KEYPAIR — `DOD-M15-KEYAGREE-1`, the lifecycle half (006-CRYPTO).
+     *
+     * **A `Map`, never a field on the session row, and that is the whole point.** The secret is held
+     * in memory and nowhere else: not in SQLite, not in a backup, not in an export. Forward secrecy is
+     * not a property of minting a fresh key — it is a property of the old one being GONE — so anything
+     * that made this durable would void it permanently and silently.
+     *
+     * Minted ONCE per session, at the moment the session becomes active, and destroyed at every site
+     * that drops the `#activeNodes` entry — see `#destroySessionEphemeralFor`, which explains why it
+     * is keyed to the entry rather than to the cache eviction. A revived session therefore mints a
+     * FRESH one and re-keys, which is Decisions Carried #5; that is only true because the interrupt
+     * path destroys, and an earlier version of this comment asserted it while the interrupt path
+     * silently kept the old key for hours.
+     *
+     * ⚠️ NOTHING SENDS THE PUBLIC HALF YET. The exchange, the signature over it, and encrypting
+     * content with the agreed secret are `007-CRYPTO`, and they are one wire format that ships
+     * together. Until that lands, this keypair is minted, held and destroyed correctly and no message
+     * is encrypted with it — which `#contentEncryptionStatus` states on the session itself rather than
+     * leaving a reader to assume.
+     */
+    #sessionEphemerals = new Map();
+    /**
+     * THE AGREED CONTENT KEY — `DOD-M15-EPHEMERAL-AUTH-1` (007-CRYPTO).
+     *
+     * Present only once the peer's SIGNED ephemeral has been verified against the counterparty
+     * identity this session is with. Absent means every message body on this session goes out under
+     * the transport's protection alone, and `#contentEncryptionState` says which of the reasons that
+     * is — never silence.
+     *
+     * In memory only, and destroyed with the ephemeral it came from. It is the same secret one step
+     * on, so persisting it would void forward secrecy exactly as persisting the ephemeral would.
+     */
+    #sessionContentKeys = new Map();
+    /**
+     * WHICH peer ephemeral produced the key we hold, hex — 007-CRYPTO, review F1.
+     *
+     * The idempotence guard keys on THIS rather than on "a key exists", because a re-keying peer sends
+     * a DIFFERENT half and must be adopted, while the same half re-announced on every connect must
+     * not churn. Keying on presence meant the side that never restarted kept a stale key and every
+     * message failed to decrypt — reported to its operator as possible tampering.
+     */
+    #sessionContentKeyPeerHalf = new Map();
+    /**
+     * WHY this session has no content key, when it has none. A closed reason, never a free string.
+     */
+    #contentEncryptionReasons = new Map();
+    /**
+     * Resolve an agent's long-term identity signer.
+     *
+     * Injected after construction, like `setParkedDrainHook`, because the daemon builds its agent key
+     * providers after this manager exists. Absent resolver, or an agent it does not know, means this
+     * side cannot sign its ephemeral — reported as `NO_LOCAL_IDENTITY` rather than quietly skipping
+     * the exchange, because "we could not" and "they would not" send the operator to opposite
+     * machines.
+     */
+    #keyProviderResolver = null;
+    /** Test-only observer of decoded inbound content frames — see `observeInboundContentFramesForTest`. */
+    #inboundFrameObserver = null;
     /**
      * ─── B2b-2 state: what the SEND path needs that the row cannot answer ─────────────────────────
      *
@@ -681,6 +1210,60 @@ export class SessionNodeManager {
      */
     #saltLastOutcome = new Map();
     #hashedWithoutSalt = new Map();
+    /**
+     * `#hashedWithSalt` — how many content hashes this session has computed UNDER its salt and not yet
+     * landed anywhere a count can see (`DOD-M15-SALTSPLIT-1`, review HIGH-2).
+     *
+     * The mirror of `#hashedWithoutSalt`, and it exists for the same window: a hash is computed, then a
+     * relay round trip happens, and only afterwards does the message appear as a leaf, a hold or an
+     * awaiting-ack entry. In between, every count reads zero.
+     *
+     * It is read by `#discardUnspentSalt` alone. "Unspent" must mean *nothing has been hashed under
+     * it*, and without this the answer is *nothing has FINISHED being hashed under it* — which is the
+     * question nobody asked, answered destructively.
+     *
+     * Never decremented on success: a salted hash that reaches the wire is spent forever, and unlike
+     * the unsalted counter there is no `abandonUnsaltedHash` equivalent to undo. It is cleared only
+     * with the rest of the session's caches. **For a discard decision, erring toward "spent" is the
+     * safe direction** — a salt kept is recoverable, a salt erased is not.
+     */
+    #hashedWithSalt = new Map();
+    /**
+     * `#saltSuspended` — the peer has told us it can never hold a salt, so ours must not be USED. The
+     * bytes stay on disk (`DOD-M15-SALTSPLIT-1`, the other lane's authorization argument).
+     *
+     * ⚠️ THIS REPLACED AN IMMEDIATE, IRREVERSIBLE ERASE, AND THE REFRAMING IS THE WHOLE POINT.
+     *
+     * I defended the erase as a compatibility question — a legacy peer might send the misleading frame,
+     * we are pre-launch, do not carry weight for a state nobody is in. All true, and it does not reach
+     * the question. **It is an AUTHORIZATION question:** the receiver performed an irreversible
+     * destruction of durable key material on a peer's bare assertion with nothing to check it against.
+     * Re-derived against an empty database — *would I let one side erase the other's key material on an
+     * unauthenticated claim carrying no evidence?* No. My own empty-database rule argued FOR a guard,
+     * not against one.
+     *
+     * And my own trigger was the proof I walked past: `frontier_unreadable` is not a legacy peer, it is
+     * a **healthy current peer having one bad second**. Fixing the producer made our side stop emitting
+     * it wrongly and left the receiver built to obey it — *one side of that exchange correct by
+     * construction, the other still correct by luck.*
+     *
+     * A salt that cannot be used is inert. The destruction is what turned a transient disagreement into
+     * a permanent one, so **nothing irreversible hangs on the claim any more** and proving the claim
+     * stops being load-bearing.
+     *
+     * ⚠️ IN MEMORY ON PURPOSE, AND THE ERASE IS DEFERRED RATHER THAN CANCELLED. A durable mark needs a
+     * column, and this milestone has lost data twice in the rebuild DDL. In-memory alone would split
+     * the transcript at the next restart — unsalted now, salted after a reboot — so the salt IS erased,
+     * at the first unsalted hash, which is the moment erasing becomes both harmless (nothing was hashed
+     * under it) and REQUIRED (keeping it would re-salt after a restart). Before that moment a corrected
+     * announce carrying a matching fingerprint un-suspends and the session recovers fully salted, which
+     * erasure makes impossible even in principle: the far side cannot re-derive without both halves.
+     *
+     * A restart before either outcome loses the mark, we are salted again, the peer refuses one message,
+     * and the announce re-runs and re-suspends. **One refused message, then convergence** — against a
+     * dead session.
+     */
+    #saltSuspended = new Set();
     #unsaltedAnnounced = new Set();
     // DOD-M12B-ACK-1: pending linger-resets for inbound content streams the peer has not closed.
     // Held so shutdown can drop them rather than leave timers pointing at a torn-down node.
@@ -726,6 +1309,15 @@ export class SessionNodeManager {
     // of being appended out of order. Once the missing in-between sequence(s) land (recovered from the
     // relay mailbox), #releaseHeld drains the held entries in canonical order. content is plaintext in
     // memory only — evicted on teardown, same as #receivedContent.
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 5 — `authorship` rides the held entry.
+     *
+     * A SENT message that lands ahead of our tree tail is held here and its transcript row is written
+     * later, on release. The hold happens AFTER the submit, so it was signed exactly like an unheld
+     * one — without carrying the proof through, a message that happened to queue behind a gap became
+     * permanently less provable than the identical message that did not, for a reason with nothing to
+     * do with authorship.
+     */
     #heldContent = new Map();
     // DOD-MSG-4: the relay's high-water canonical sequence for this session — the largest sequence the
     // relay has witnessed (max over leaf_deliver). Keyed #k(agent,session). EXPOSED for the next
@@ -777,6 +1369,25 @@ export class SessionNodeManager {
      * signature. That is unavoidable: deciding whether bytes are a document frame requires the bytes.
      * The router it calls never logs them.
      */
+    /**
+     * ⚠️ THE RETURN TYPE USED TO DECLARE `ok?: boolean; reason?: string`, AND THE PRODUCER CANNOT
+     * SUPPLY EITHER. Narrowed so reading them is a compile error rather than a silent `undefined`.
+     *
+     * The implementation is `DocumentFrameRouter.routeSync`, whose own return type
+     * (`FrameClassification`) is exactly `{consumed:false} | {consumed:true; kind}` — it has no such
+     * fields at all. The wider shape here was a promise only this declaration made, and it was
+     * assignable precisely because the extra members were optional.
+     *
+     * It is not an oversight in the router: `routeSync` dispatches with `void this.#enqueue(...)`, so
+     * when it returns, the frame has been classified and queued and **no verdict exists yet**. A
+     * synchronous caller cannot be told an asynchronous outcome.
+     *
+     * **The cost of the lie was a wrong lead.** `j-stale-session`'s investigation read those fields'
+     * absence from every log line as "the router returned neither" and filed it as the next thread to
+     * pull. There was no thread: a JSON logger omits `undefined`, so a field that can never be set is
+     * indistinguishable from one that was set to nothing. The verdict lives on
+     * `document.frame.refused`, joined by `correlationId`.
+     */
     #onDocumentFrame = null;
     /**
      * DOD-DOC-SCREEN-CLASSIFY-1: the classify-only half of the hook above — is this a document
@@ -1078,7 +1689,11 @@ export class SessionNodeManager {
                     reason: result.reason,
                     cause: result.cause,
                 });
-                return { outcome: "refused", cause: result.cause ?? result.reason };
+                return {
+                    outcome: "refused",
+                    cause: result.cause ?? result.reason,
+                    ...(result.retryAfterMs !== undefined ? { retryAfterMs: result.retryAfterMs } : {}),
+                };
             }
             return { outcome: "parked" };
         }
@@ -1338,6 +1953,52 @@ export class SessionNodeManager {
         -- DOD-LOOP-1: composite key so each agent's end has its own append-ordered tree.
         PRIMARY KEY (agent_id, session_id, leaf_index)
       )
+    `);
+        // DOD-M15-INCLUSION-1: the leaf set the DIRECTORY certified — a different tree from the one
+        // above, and the distinction is the whole reason this table exists.
+        //
+        // `session_tree_leaves` holds this agent's CONTENT leaves. The certified root covers every leaf
+        // the relay ordered, CONTROL leaves included, and nothing appends a ctrl leaf to the local tree
+        // (`submitSealLeaf` computes its root without mutating it). So an audit path built from
+        // `session_tree_leaves` lands on a root no certificate names — it proves this machine agrees
+        // with itself, which is worth nothing to the third party a proof is FOR.
+        //
+        // Rows land only after the Merkle root over them reproduces the FROST-signed `sealed_root`
+        // (`certifiedLeafSetFrom`), so what is stored here is the consortium's leaf set and not the
+        // directory's word for it. Written once at seal time; read only by the inclusion-proof surface,
+        // ORDER BY leaf_index.
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS session_certified_leaves (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        leaf_index INTEGER NOT NULL,
+        content_hash_hex TEXT NOT NULL,
+        recorded_at INTEGER NOT NULL,
+        -- DOD-LOOP-1: composite key so each agent's end of a loopback session keeps its own set.
+        PRIMARY KEY (agent_id, session_id, leaf_index)
+      )
+    `);
+        // WHY a session has no certified leaf set — fallback-finder finding 1, and the reason it is a
+        // TABLE rather than a log line.
+        //
+        // `getCertifiedLeafSet` returns null for four different situations: no seal frame ever carried
+        // the leaves, the directory shipped a set that does not reproduce the root it signed, a leaf was
+        // malformed, or the write failed. The worst of those — a directory contradicting its own FROST
+        // signature — is the strongest misbehaviour signal this client can produce, and it was going to
+        // one ERROR line while the operator was told the most benign of the four: "normal for the party
+        // that was absent at seal time." A detection whose only consumer is a log is not a control.
+        //
+        // One row per session, replaced on every attempt, so the state is the LAST thing that happened
+        // rather than a history. Read only by the inclusion-proof surface, to name the cause.
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS session_certified_leaves_state (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        state TEXT NOT NULL,
+        detail TEXT,
+        recorded_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id)
+      )
     `);
         // DOD-M12B-STRAND-1 — content we RECEIVED and VERIFIED but cannot append yet.
         //
@@ -1422,9 +2083,22 @@ export class SessionNodeManager {
         -- transcript is only ever read by its owner, and worthless the moment it is shown to anyone
         -- else — which is the whole point of a notarized record.
         --
-        -- sender_sig is the Structure-2 signature, and it is stored ONLY after the receiver has
-        -- already verified it against the pubkey inside the sender's own signed bytes
-        -- (#recordFrameOrdering). A stored signature here is a VERIFIED one, never a claimed one.
+        -- sender_sig holds one of TWO things, and which one is told by direction:
+        --   RECEIVED row -> the Structure-2 signature, stored ONLY after the receiver verified it
+        --                   against the pubkey inside the sender's own signed bytes
+        --                   (#recordFrameOrdering). Verified, never claimed.
+        --   SENT row     -> OUR OWN signature over the Structure-1 bytes we put on the wire, taken
+        --                   from the submit result. Produced, not verified — there was no
+        --                   counterparty in the act, so it must NEVER be labelled verified_signature.
+        --
+        -- ⚠️ self_authored COVERS TWO PROVENANCES, and sender_sig IS NOT NULL is the discriminator.
+        -- Named here because it is the same shape this column exists to prevent, one level up: a
+        -- provable sent row and an unprovable one share a label, so a reader keying on attribution
+        -- alone cannot tell them apart. An unprovable sent row is legitimate — an UNWITNESSED send
+        -- never put a Structure 1 on the wire, so there is nothing signed to store — but the reader
+        -- has to be told where the distinction lives, or it will be rediscovered as a bug.
+        --   self_authored + sender_sig NOT NULL -> we wrote it and can prove we did
+        --   self_authored + sender_sig NULL     -> we wrote it; the relay never witnessed it
         --
         -- attribution is NOT NULL ON PURPOSE, and it is the load-bearing column. There is a soft
         -- path — session.content.ordering.decode_failed falls back to hash-dedup — that ingests a
@@ -1663,6 +2337,59 @@ export class SessionNodeManager {
         }
         return this.#db;
     }
+    /**
+     * DOD-M15-RELAYONLY-1: is the settings store readable RIGHT NOW?
+     *
+     * ⚠️ Exists because `getSetting` cannot answer it. That method returns `null` for BOTH "the key is
+     * unset" and "there is no database", and a security setting must tell those apart: unset-means-off
+     * is correct, db-gone-means-off publishes the operator's real address during the shutdown window.
+     * `getDb()` cannot stand in either — it THROWS when there is no database, which on a catch-less
+     * ceremony path is worse than the wrong answer.
+     */
+    hasDatabase() {
+        return this.#db !== null;
+    }
+    /**
+     * DOD-M15-RELAYONLY-1: build a transport node for THIS AGENT, with its privacy posture applied.
+     *
+     * ⚠️ THE CHOKE POINT FOR NODE CREATION, and it exists for the same reason as the one around
+     * `getStandingReceiverInfo`. Five call sites construct nodes; passing `relayOnly` at each would be
+     * a hand-kept list, and the SIXTH — added next month by someone who has never read this line —
+     * would build a node that hole-punches its way to a direct connection for an operator who asked
+     * never to be directly reachable. Here, a new caller inherits the posture instead of being told.
+     *
+     * `unknown` counts as ON, matching the publish and dial halves: a node that declines to hole-punch
+     * is reachable over the relay, while a disclosed address cannot be recalled.
+     */
+    // ⚠️ NOT `async`. This wrapper sits in the standing-receiver startup path, and making it async
+    // added ONE extra microtask hop before the receiver was installed in `#standingReceivers` — which
+    // was enough for `createSessionNode` to run first and answer `standing_receiver_unavailable`. Two
+    // tests in `msg-021-session-seed` caught it. Returning the factory's promise directly keeps the
+    // await count identical to the call it replaced. **This is a real fragility in the install path,
+    // not a quirk of the tests:** anything that adds a tick here re-breaks it.
+    #createAgentNode(agentName, config) {
+        // ⚠️ THE POSTURE READ MUST NEVER COST US A NODE. This sits in the standing-receiver startup
+        // path, whose caller treats a throw as "no receiver" and leaves the agent deaf to all inbound —
+        // surfacing to the operator as `standing_receiver_unavailable`, which names the transport for a
+        // fault in a settings lookup. `relayOnlyState` already absorbs a throwing GETTER; this absorbs
+        // everything else, including a resolution failure for an agent row that is not there yet.
+        //
+        // The fallback is ON, not off: an agent whose posture we cannot read gets the private-but-
+        // reachable node, because a node that declines to hole-punch still works over the relay while a
+        // disclosed address cannot be recalled.
+        let relayOnly = true;
+        try {
+            relayOnly = relayOnlyState((key) => this.getSetting(agentName, key), this.#db !== null) !== "off";
+        }
+        catch (err) {
+            this.#logger.warn("settings.relay_only.unreadable", {
+                agentName,
+                reason: err instanceof Error ? err.message : String(err),
+                impact: "could not read this agent's relay-only posture, so the node is built WITHOUT the hole-punch",
+            });
+        }
+        return this.#factory.createNode({ ...config, relayOnly });
+    }
     /**
      * RELAYSIG-1: the durably-stored, signature-verified relay ordering-record receipts for an agent
      * (optionally a single session). Empty when no receipts have been recorded yet. Read-only.
@@ -1735,6 +2462,35 @@ export class SessionNodeManager {
         const contiguousFromOne = sequences.every((n, i) => n === i + 1);
         const ctrlSenders = new Set(carry.filter((l) => l.leafKind === LEAF_KIND_CTRL).map((l) => l.senderPubkeyHex));
         const selfEvidentlyComplete = contiguousFromOne && ctrlSenders.size === 2;
+        /**
+         * 🚨 THE CERTIFICATE MAY COVER EXACTLY WHAT THIS SIDE HOLDS — ASK THAT FIRST.
+         *
+         * `DOD-M15-UNILATERAL-1`. The completeness predicate below describes a BILATERAL leaf set: two
+         * SEAL ctrl leaves, from two distinct senders. **A solo seal can never satisfy it**, because the
+         * counterparty is gone and never posts one — that is the entire premise. So on the solo path
+         * this returned `cannot_judge` every time, `session-ceremony.ts` refuses to co-sign on anything
+         * that is not `match`, and **the sealing party refused to co-sign its own unilateral seal.** The
+         * FROST ceremony never reached threshold, the directory never completed, and the close came back
+         * `seal_unilateral_timeout` — the label that names our own wait. Measured against the real
+         * binaries: `j-unilateral` failed on exactly this, with the directory having already verified the
+         * chain and recorded the counterparty ABSENT.
+         *
+         * Completeness was only ever needed to tell TWO KINDS OF DISAGREEMENT apart — "the roots differ
+         * because my carry is behind" (cannot judge) from "the roots differ because the directory
+         * certified something else" (mismatch). It answers nothing when the roots AGREE: a certificate
+         * whose root and leaf count are exactly what this daemon holds is, by construction, over this
+         * daemon's own leaves. Nothing is taken on trust — both values are recomputed here from the
+         * carry, and an adversary who could satisfy them would have to have produced this leaf set.
+         *
+         * Deliberately BOTH values. A count that disagreed while the root matched would be a certificate
+         * contradicting itself, and this is not the place to wave that through.
+         */
+        const carryInputs = carryContentHashInputs(carry);
+        if (carryInputs !== null &&
+            carry.length === certifiedLeafCount &&
+            Buffer.compare(Buffer.from(merkleRoot(buildMerkleTree(carryInputs))), Buffer.from(certifiedRoot)) === 0) {
+            return { verdict: "match" };
+        }
         if (!selfEvidentlyComplete) {
             return {
                 verdict: "cannot_judge",
@@ -1752,26 +2508,62 @@ export class SessionNodeManager {
                 detail: `leaf_count_disagrees: this daemon holds a provably complete ${carry.length}-leaf set, the certificate claims ${certifiedLeafCount}`,
             };
         }
-        const inputs = [];
+        if (carryInputs === null) {
+            // A leaf this daemon cannot decode is a leaf it cannot judge. Never an accusation.
+            return { verdict: "cannot_judge", reason: "structure1_content_hash_unreadable" };
+        }
+        const ownRoot = merkleRoot(buildMerkleTree(carryInputs));
+        const ownRootHex = Buffer.from(ownRoot).toString("hex");
+        return Buffer.compare(Buffer.from(ownRoot), Buffer.from(certifiedRoot)) === 0
+            ? { verdict: "match" }
+            : { verdict: "mismatch", ownRootHex, detail: "root_disagrees: same leaf count, different leaves or different order" };
+    }
+    /**
+     * WHERE THE MUTUALLY-SIGNED PREFIX ENDS, DERIVED FROM THIS DAEMON'S OWN LEAVES —
+     * `DOD-M15-UNILATERAL-1`, review F2.
+     *
+     * ⚠️ **THE FIRST VERSION COMPUTED THIS FROM THE CERTIFICATE'S OWN PARTICIPANT LIST, AND CALLED
+     * THAT "recomputed, cannot be steered".** It could be steered. On the SOLO path the certificate's
+     * TBS binds no legibility at all, and the client verifies only the *live* party's frontier — so
+     * the absent party's `content_frontier_seq` and every `last_authored_seq` arrived unchecked. One
+     * directory node could publish the absent party's frontier as 3 and the receipt would say
+     * "mutually signed through 3" over a transcript that party never signed for. That is the precise
+     * conflation this field exists to prevent, reintroduced by the field itself.
+     *
+     * The carry answers it without trusting anybody. This daemon holds the counterparty's own leaves,
+     * each carrying, inside the bytes THEY signed, both the sequence they authored and the
+     * `last_seen_seq` they acknowledged. So a party's commitment reaches
+     * `max(highest sequence they authored, highest sequence they acknowledged)`, and the transcript is
+     * mutually signed only as far as the LEAST-committed party reaches.
+     *
+     * Fewer than two distinct authors ⇒ `0`: nobody countersigned anything, which is the honest floor
+     * for a conversation where the other side only ever received. `null` when the carry is empty or
+     * unreadable — the caller must then publish NO boundary rather than fall back to a number
+     * somebody else supplied.
+     */
+    countersignedThroughSeqFromCarry(agentPubkeyHex, sessionIdHex) {
+        const carry = this.getSealCarry(agentPubkeyHex, sessionIdHex);
+        if (carry.length === 0)
+            return null;
+        const reach = new Map();
         for (const leaf of carry) {
-            let contentHash;
+            let signedLastSeen = 0;
             try {
-                // Canonical Structure 1 is [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp].
-                contentHash = decode(leaf.structure1Cbor)[1];
+                // Structure 1 = [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp].
+                const raw = decode(leaf.structure1Cbor)[4];
+                const n = typeof raw === "bigint" ? Number(raw) : raw;
+                if (typeof n === "number" && Number.isFinite(n))
+                    signedLastSeen = n;
             }
             catch {
-                return { verdict: "cannot_judge", reason: "structure1_decode_failed" };
+                return null; // unreadable: publish no boundary rather than a half-derived one
             }
-            if (!(contentHash instanceof Uint8Array) || contentHash.length !== 32) {
-                return { verdict: "cannot_judge", reason: "structure1_content_hash_missing" };
-            }
-            inputs.push({ kind: "hash", data: contentHash });
+            const prior = reach.get(leaf.senderPubkeyHex) ?? 0;
+            reach.set(leaf.senderPubkeyHex, Math.max(prior, leaf.sequenceNumber, signedLastSeen));
         }
-        const ownRoot = merkleRoot(buildMerkleTree(inputs));
-        const ownRootHex = Buffer.from(ownRoot).toString("hex");
-        return Buffer.compare(Buffer.from(ownRoot), Buffer.from(certifiedRoot)) === 0
-            ? { verdict: "match" }
-            : { verdict: "mismatch", ownRootHex, detail: "root_disagrees: same leaf count, different leaves or different order" };
+        if (reach.size < 2)
+            return 0;
+        return Math.min(...reach.values());
     }
     getSealCarry(agentPubkeyHex, sessionIdHex) {
         if (!this.#sealLeafStore && this.#db) {
@@ -1823,7 +2615,21 @@ export class SessionNodeManager {
              *
              * No plumbing needed: `direction` already carries the answer at write time.
              */
-            authorship ? "verified_signature" : direction === "sent" ? "self_authored" : "local_session_state");
+            /**
+             * DIRECTION FIRST — DOD-M15-SEALWIRE-1 bullet 5, sent half.
+             *
+             * This used to read `authorship ? "verified_signature" : …`, which was right while only
+             * RECEIVED rows could carry a signature. Now a SENT row carries one too — our own, over
+             * the Structure-1 bytes we put on the wire — and labelling that `verified_signature` would
+             * be false in the way this column exists to prevent: **we did not verify it, we produced
+             * it.** Nobody checked a counterparty's key; there was no counterparty in the act.
+             *
+             * So the three values keep meaning three different things:
+             *   `self_authored`      — this agent wrote it. Now PROVABLE when a signature is stored.
+             *   `verified_signature` — someone else wrote it and we checked their key against it.
+             *   `local_session_state`— someone else wrote it and nobody checked anything.
+             */
+            direction === "sent" ? "self_authored" : authorship ? "verified_signature" : "local_session_state");
             this.#logger.info("transcript.message.recorded", { sessionId, agentName, sequence, direction, correlationId });
             return true;
         }
@@ -2657,7 +3463,42 @@ export class SessionNodeManager {
         const sr = this.#standingReceivers.get(agentName);
         if (!sr)
             return null;
-        return { peerId: sr.node.getPeerId(), addrs: sr.node.listenAddresses() };
+        // DOD-M15-RELAYONLY-1: THE CHOKE POINT. Every path that publishes this agent's session
+        // addresses draws from here — `initiator_session_addrs` on the way out, and
+        // `counterparty_session_addrs` when answering an offer — and this method has no other kind of
+        // consumer: its whole purpose is to be advertised, as the docstring above says.
+        //
+        // The suppression lives HERE rather than at those call sites deliberately. Call-site gating
+        // would be a hand-kept list, and a fourth publish path added later would leak the operator's IP
+        // while every test stayed green. At the choke point a new caller inherits the protection
+        // instead of having to be told about it.
+        const endpoint = { peerId: sr.node.getPeerId(), addrs: sr.node.listenAddresses() };
+        // ⚠️ TRI-STATE, not a boolean, and the third state is the one that matters. `getSetting` answers
+        // `null` both for "unset" and for "there is no database", and reading the second as OFF fails
+        // TOWARD DISCLOSURE: the standing receiver outlives the DB during shutdown, so an offer arriving
+        // in that window would publish the operator's real addresses with relay-only switched on.
+        // `relayOnlyState` also absorbs a THROW — `#requireAgentId` throws for a retired agent, and this
+        // method is called from the offer ceremony inside a floating async with no catch, where the
+        // throw becomes an unhandled rejection and the offer vanishes with no local log.
+        // ⚠️ `!== null`, NOT `!== undefined`. The field is declared `DaemonDatabase | null` and is only
+        // ever assigned on open or set to `null` on close — **it is never `undefined` at any point in
+        // its lifetime**, so the first version of this line was a compile-time-constant `true` that
+        // TypeScript had no reason to complain about, and the whole `"unknown"` branch was unreachable
+        // dead code. The fix for the disclosure window silently did nothing, which is worse than not
+        // having written it: the DoD said the window was closed and it was wide open.
+        const state = relayOnlyState((key) => this.getSetting(agentName, key), this.#db !== null);
+        if (state === "unknown") {
+            this.#logger.warn("settings.relay_only.unreadable", {
+                agentName,
+                impact: "cannot tell whether relay-only is on, so ONLY this agent's relay-circuit addresses are " +
+                    "published — never a direct one. Publishing a real address is irreversible and a narrowed " +
+                    "route is not, so this errs toward reachability loss rather than disclosure",
+            });
+        }
+        // ONE filter, not two. The `unknown` branch used to build its own filtered object inline, which
+        // put a second implementation inside the very method whose design rationale is that there is
+        // exactly one — and the bypass guard could not see it.
+        return publishableEndpoint(endpoint, state !== "off");
     }
     /**
      * DOD-M15-ASSIGN-1 — name the one peer allowed to dial this agent's standing receiver, at the
@@ -2963,7 +3804,7 @@ export class SessionNodeManager {
             });
             try {
                 seed = randomBytes(32);
-                node = await this.#factory.createNode({ sessionId, connectionGater: gater, nodeType: "session", transportPrivateKey: seed });
+                node = await this.#createAgentNode(agentName, { sessionId, connectionGater: gater, nodeType: "session", transportPrivateKey: seed });
                 await node.start();
             }
             catch (err) {
@@ -3040,6 +3881,9 @@ export class SessionNodeManager {
             correlationId,
         });
         // Add to active map (keyed by (agentName, sessionId) — DOD-LOOP-1)
+        // 006-CRYPTO: the session's throwaway keypair is minted here, with the node, so "a session is
+        // active" and "a session has a key" are the same moment. All THREE activation paths mint.
+        this.#mintSessionEphemeral(agentName, sessionId);
         this.#activeNodes.set(this.#k(agentName, sessionId), {
             node,
             agentName,
@@ -3157,6 +4001,12 @@ export class SessionNodeManager {
                     logger: this.#logger,
                     receiptStore: this.#relayReceiptStore ?? undefined,
                     sealLeafStore: this.#sealLeafStore ?? undefined,
+                    // DOD-M15-RELAYSLOTS-1: read at each auth, never snapshotted — the token expires hourly.
+                    onlineToken: () => this.getDirectoryOnlineToken(agentName),
+                    // DOD-M15-CORROBORATE-1: a relay's witness alert reaches the operator's inbox from here.
+                    // The DETACHED clients get the same callback from the builder in daemon.ts.
+                    onWitnessAlert: (alert) => { this.recordRelayWitnessAlert(agentName, alert); },
+                    onWitnessUnreadable: (relayPeerId, why) => { this.recordRelayWitnessUnreadable(agentName, relayPeerId, why); },
                 });
                 this.#relayClients.set(clientKey, client);
             }
@@ -3170,6 +4020,8 @@ export class SessionNodeManager {
                 // 2b: remember the relay endpoint so the content-park backstop deposits to the SAME relay.
                 entry.relayPeerId = relay.relayPeerId;
                 entry.relayAddrs = relay.relayAddrs;
+                // Review H1: the dial path needs the credential in hand, not just the endpoint.
+                entry.relayAssignment = relay.assignment;
                 // MSG-2 startup-flush: also PERSIST it, so a restart's crash-backstop flush (which runs
                 // before the in-memory entry exists) can deposit un-acked content to the same relay.
                 try {
@@ -3196,6 +4048,24 @@ export class SessionNodeManager {
             // Proactively connect so the relay has this agent's stream to deliver leaves to
             // (the RECEIVER must be connected before the counterparty submits). Best-effort.
             await client.connect(node);
+            // DOD-M15-RELAYAUTH-1 review HIGH-2 — see below. Best-effort and non-blocking: a session must
+            // never fail to come up because a SECOND relay could not be told about it.
+            //
+            // Review M1: `.catch()` is not decoration. This is an unawaited promise, so a throw it does not
+            // handle is an unhandled rejection — and this file already carries a comment elsewhere about an
+            // absent `await` that became a remote process kill. The method's own try/catch does not cover
+            // its prologue, so the catch here is the only thing standing between a torn-down node and the
+            // daemon dying.
+            void this.#presentAssignmentToReservationRelay(agentName, node, relay, sessionIdHexForRelay, correlationId, entry)
+                .catch((err) => {
+                this.#logger.warn("session.relay.assignment.reservation_relay_failed", {
+                    agentName,
+                    sessionId: sessionIdHexForRelay.slice(0, 16),
+                    error: extractErrorMessage(err),
+                    impact: "inbound relayed dials to this node may be refused by its reservation relay; the session still works over the direct path and the park backstop",
+                    correlationId,
+                });
+            });
         }
         catch (err) {
             this.#logger.warn("session.relay.connect.error", {
@@ -3205,6 +4075,89 @@ export class SessionNodeManager {
             });
         }
     }
+    /**
+     * DOD-M15-RELAYAUTH-1 review HIGH-2 — **THE RELAY THAT GATES THE DIAL IS NOT ALWAYS THE RELAY
+     * THAT HOLDS THE ASSIGNMENT, AND THE GATE DENIES WHEN THEY DIFFER.**
+     *
+     * Two relays are in play for one session, chosen by unrelated rules:
+     *   - the WITNESS relay, `assignment.relay_endpoint`, picked by the directory. Both parties
+     *     present `client_record_assignment` to it and to nowhere else.
+     *   - the RESERVATION relay, whichever one this node's circuit address is held on — the first
+     *     candidate that granted when it was a standing receiver.
+     *
+     * The counterparty dials our CIRCUIT address, so it is the RESERVATION relay whose gater is asked
+     * `denyOutboundRelayedConnection(them, us)`. With no assignment recorded there it finds no binding
+     * and refuses a completely legitimate dial. Two relays run in production and the client's own
+     * logs show the fall-through to the second candidate is frequent, so this is the ordinary case,
+     * not a corner: the session still opens, but every message falls to the store-and-forward park
+     * path, and the only trace is a denial on a relay nobody is tailing.
+     *
+     * So the node that will be DIALLED presents the same assignment to the relay that will be asked
+     * to allow it. Safe by construction: the assignment is self-authenticating (a per-node directory
+     * signature the relay verifies against its consortium set), so presenting it more widely grants
+     * nothing that forging it would not already require. No directory change, no new frame.
+     */
+    async #presentAssignmentToReservationRelay(agentName, node, relay, sessionIdHex, correlationId, entry) {
+        // Review M1: the prologue below lives INSIDE the try. `listenAddresses()` on a node torn down
+        // while we were wiring is exactly the case handled 30 lines above at the caller, and out here it
+        // would have escaped both this method's catch and (before the caller's `.catch`) the process.
+        let reservationRelayPeerId;
+        try {
+            if (!relay.assignment)
+                return; // direct/legacy/persisted-reconnect: nothing to present anywhere
+            const heldCircuitAddr = node.listenAddresses().find((a) => a.includes("/p2p-circuit"));
+            if (!heldCircuitAddr)
+                return; // no reservation held → nobody will gate a dial to us
+            reservationRelayPeerId = /\/p2p\/([^/]+)\/p2p-circuit/.exec(heldCircuitAddr)?.[1];
+            if (!reservationRelayPeerId || reservationRelayPeerId === relay.relayPeerId)
+                return; // same relay — already recorded
+            const clientKey = `${agentName}::${reservationRelayPeerId}`;
+            let client = this.#relayClients.get(clientKey);
+            if (!client) {
+                if (!this.#relayReceiptStore && this.#db)
+                    this.#relayReceiptStore = new RelayReceiptStore(this.#db, this.#logger);
+                if (!this.#sealLeafStore && this.#db)
+                    this.#sealLeafStore = new SessionSealLeafStore(this.#db, this.#logger);
+                // Split on the marker, not an anchored strip: the held address is
+                // `…/p2p/<relay>/p2p-circuit/p2p/<self>`, so the marker is in the MIDDLE.
+                const baseRelayAddr = heldCircuitAddr.split("/p2p-circuit")[0] ?? heldCircuitAddr;
+                client = this.#detachedRelayClientBuilder?.(agentName, reservationRelayPeerId, [baseRelayAddr], {
+                    receiptStore: this.#relayReceiptStore ?? undefined,
+                    sealLeafStore: this.#sealLeafStore ?? undefined,
+                    // DOD-M15-RELAYSLOTS-1: read at each auth, never snapshotted — the token expires hourly.
+                    onlineToken: () => this.getDirectoryOnlineToken(agentName),
+                });
+                if (!client)
+                    return;
+                this.#relayClients.set(clientKey, client);
+                // Review M4: record the key so teardown releases this client too — `relayClientKey` names
+                // only the witness relay, so before this the client and its session registration leaked.
+                if (entry)
+                    entry.extraRelayClientKeys = [...(entry.extraRelayClientKeys ?? []), clientKey];
+            }
+            // registerSession presents the assignment eagerly (see its own comment). No leaf handler: this
+            // relay is not witnessing the session, it only needs the binding that authorizes the dial.
+            client.registerSession(sessionIdHex, node, undefined, relay.assignment);
+            this.#logger.info("session.relay.assignment.presented_to_reservation_relay", {
+                agentName,
+                sessionId: sessionIdHex.slice(0, 16),
+                witnessRelayPeerId: relay.relayPeerId,
+                reservationRelayPeerId,
+                impact: "the relay that will be asked to allow inbound circuit dials to this node now holds the assignment authorizing them",
+                correlationId,
+            });
+        }
+        catch (err) {
+            this.#logger.warn("session.relay.assignment.reservation_relay_failed", {
+                agentName,
+                sessionId: sessionIdHex.slice(0, 16),
+                reservationRelayPeerId,
+                error: extractErrorMessage(err),
+                impact: "inbound relayed dials to this node may be refused by its reservation relay; the session still works over the direct path and the park backstop",
+                correlationId,
+            });
+        }
+    }
     /**
      * M7 DOD-SPINE-6 / MSG-001-3b: detach a session from its (agent, relay) client and
      * close the client when it has no remaining sessions. Idempotent and identity-guarded:
@@ -3214,11 +4167,32 @@ export class SessionNodeManager {
     #detachSessionRelay(entry) {
         const client = entry.relayClient;
         const key = entry.relayClientKey;
-        if (!client || !entry.relaySessionIdBytes)
+        if (!entry.relaySessionIdBytes)
+            return;
+        const sidHex = Buffer.from(entry.relaySessionIdBytes).toString("hex");
+        /**
+         * Review M4: release the EXTRA relay clients first — the ones opened to relays that gate circuit
+         * dials. `relayClientKey` above names only the witness relay, so these were registered and never
+         * unregistered: an authenticated relay stream and a `#sessions` entry leaked per session, and
+         * relay-side the dial-through binding they hold is then cleared only by the idle timer, which is
+         * now 24h. Runs before the early return below so it happens even for a session that never got a
+         * witness client.
+         */
+        for (const extraKey of entry.extraRelayClientKeys ?? []) {
+            const extra = this.#relayClients.get(extraKey);
+            if (!extra)
+                continue;
+            extra.unregisterSession(sidHex);
+            if (!extra.hasSessions()) {
+                extra.close();
+                this.#relayClients.delete(extraKey);
+            }
+        }
+        entry.extraRelayClientKeys = undefined;
+        if (!client)
             return;
         // Idempotent: clear the entry's reference so a second teardown of the same entry no-ops.
         entry.relayClient = undefined;
-        const sidHex = Buffer.from(entry.relaySessionIdBytes).toString("hex");
         client.unregisterSession(sidHex);
         if (!client.hasSessions() && key && this.#relayClients.get(key) === client) {
             client.close();
@@ -3257,9 +4231,12 @@ export class SessionNodeManager {
             const entry = this.#activeNodes.get(key);
             return entry?.relayPeerId !== peerId;
         };
-        node.onPeerConnect((peerId) => {
-            if (!isCounterparty(peerId))
-                return;
+        /**
+         * Named rather than inline so the already-attached sweep below can invoke **this exact function**
+         * instead of a second copy of it. A copy is what would drift: the two would have to be kept in
+         * step by whoever edits either, and the failure would be silent.
+         */
+        const onCounterpartyAttached = (peerId) => {
             /**
              * DOD-M12B-RESPONDER-ADDR-1 (review MEDIUM-4) — LEARN THE ADDRESS HERE, where it cannot race.
              *
@@ -3307,7 +4284,63 @@ export class SessionNodeManager {
              * single lost frame does not strand the agreement.
              */
             void this.#sendSaltFrame(agentName, sessionId, correlationId);
-        });
+            // 007-CRYPTO: the signed ephemeral rides the SAME moment as the salt half — one connect, one
+            // round trip, the same peer-to-peer content stream. Fire-and-forget for the same reason: a
+            // failed announcement must not reject a peer-connect handler, and the next connect re-announces.
+            void this.#sendEphemeralFrame(agentName, sessionId, correlationId);
+        };
+        node.onPeerConnect(onCounterpartyAttached);
+        /**
+         * ⚠️ THE CONNECT THAT ALREADY HAPPENED — `DOD-M15-SALTANNOUNCE-LATE-1`.
+         *
+         * `onPeerConnect` above is `addEventListener("peer:connect", …)` (`core/transport/src/node.ts`),
+         * and **an event listener cannot fire for a connection that predates it.** On the
+         * `reuseStandingReceiver` path this session does not build a node — it TAKES the standing
+         * receiver's, which has been listening all along. So the ordinary sequence is:
+         *
+         *   1. `#tryCreateStandingReceiver` starts the node listening. It never calls this method, so
+         *      there is no handler yet.
+         *   2. The counterparty connects. `peer:connect` fires into nothing.
+         *   3. The session promotes that same node and registers the handler — one step too late.
+         *
+         * The handler then never runs, and everything hanging off it is silently skipped: **the salt is
+         * never announced** (`no_agreement_started`, the sender salts, the receiver holds none, and every
+         * message between them is refused) **and the counterparty's address is never learned or
+         * refreshed.** Measured live: `j-documents` 7 of 12 red, every failure a document update that
+         * never arrived, with no error shown to either operator.
+         *
+         * ⚠️ THE COMMENT ON THE HANDLER ABOVE NAMES THE OPPOSITE HAZARD, AND IT IS ALSO RIGHT: *"a send
+         * placed at `createSessionNode` would be an announcement to a peer that is not attached yet."*
+         * Both are real, which is why this is a SWEEP AFTER REGISTERING rather than a move. Too-early
+         * stays impossible — the sweep runs at the same point the handler is armed — and too-late stops
+         * being invisible, because an already-open connection is now looked at instead of waited for.
+         *
+         * Idempotent by construction: it invokes the SAME handler the event would have, so a peer that
+         * connects normally is unaffected, and a peer seen twice re-announces — which the announce path
+         * already tolerates (*"we re-announce on every reconnect"*).
+         */
+        try {
+            // `getConnections()` returns CONNECTIONS, and one peer can hold several — dedupe, or a peer
+            // with two open connections would run the attach path twice for no reason.
+            const attachedPeers = new Set(node.getConnections().map((c) => c.peerId));
+            for (const peerId of attachedPeers) {
+                if (!isCounterparty(peerId))
+                    continue;
+                this.#logger.info("session.liveness.peer_already_attached", {
+                    agentName, sessionId, peerId, correlationId,
+                    impact: "this counterparty connected BEFORE the session's liveness handler was registered — on the standing-receiver promotion path that is the ordinary case, not a rare one. Running the attach path for it now: without this the salt is never announced (every message from the peer is then refused) and the counterparty's address is never learned.",
+                });
+                onCounterpartyAttached(peerId);
+            }
+        }
+        catch (err) {
+            // Never let the sweep cost the caller its session: the handler is already armed, so a failure
+            // here degrades to exactly the behaviour that shipped before this fix.
+            this.#logger.warn("session.liveness.attached_sweep.failed", {
+                agentName, sessionId, correlationId, error: extractErrorMessage(err),
+                impact: "could not check for an already-attached counterparty. If one is attached, this session may never announce its salt and will refuse that peer's messages — the pre-fix behaviour.",
+            });
+        }
         node.onPeerDisconnect((peerId) => {
             if (!isCounterparty(peerId)) {
                 // Not silence: a relay link dropping is a real event, it is simply not a
@@ -3606,6 +4639,9 @@ export class SessionNodeManager {
         // Remove this agent's standing receiver from the slot and add to active map. The handed-off
         // node keeps its AutoNAT service (it continues to surface dialability).
         this.#standingReceivers.delete(agentName);
+        // 006-CRYPTO: the hand-off path. A session promoted out of the standing receiver is as new as
+        // one opened outbound, so it mints here too.
+        this.#mintSessionEphemeral(agentName, sessionId);
         this.#activeNodes.set(this.#k(agentName, sessionId), {
             node,
             agentName,
@@ -3845,6 +4881,13 @@ export class SessionNodeManager {
         this.#saltContributions.delete(key);
         this.#sessionSalts.delete(key);
         this.#saltRepairedAgainst.delete(key);
+        this.#saltRepairedAgainstFingerprint.delete(key);
+        this.#saltPeerClosedLabel.delete(key);
+        // The throwaway secret is destroyed where the `#activeNodes` entry is DROPPED, not here — see
+        // `#destroySessionEphemeralFor`. This call is the belt to that braces: both teardown paths that
+        // evict have already dropped the entry, so it is a no-op for them, and it is what catches any
+        // future path that evicts without going through one of those.
+        this.#destroySessionEphemeralFor(agentName, sessionId);
         /**
          * B2b-2's three, and the pending one is SETTLED rather than dropped.
          *
@@ -3861,6 +4904,10 @@ export class SessionNodeManager {
          */
         this.#settleSaltPending(agentName, sessionId, "closed");
         this.#hashedWithoutSalt.delete(key);
+        // DOD-M15-SALTSPLIT-1 HIGH-2: goes with its mirror. The session is being torn down, so there is
+        // no discard decision left for it to protect.
+        this.#hashedWithSalt.delete(key);
+        this.#saltSuspended.delete(key);
         this.#unsaltedAnnounced.delete(key);
         this.#saltLastOutcome.delete(key);
         // HELD CONTENT IS LOST HERE, AND IT MUST SAY SO.
@@ -4017,6 +5064,35 @@ export class SessionNodeManager {
         for (const timer of this.#lingeringStreams)
             clearTimeout(timer);
         this.#lingeringStreams.clear();
+        /**
+         * DOD-M15-RELAYLEAK-1 — **CLOSE THE RELAY CLIENTS. Shutdown never did.**
+         *
+         * This method stops every session NODE and left `#relayClients` untouched — verified by reading:
+         * the whole of `gracefulShutdown` referenced `relayClient` zero times. Each cached client holds
+         * an authenticated libp2p stream to a relay and a reader loop, so a `cello logout` left them
+         * open until the process itself exited.
+         *
+         * That is a real cost rather than untidiness: the relay counts a reservation per client and its
+         * slots are finite, so a daemon that restarts repeatedly consumes them faster than they are
+         * released, which is the "agents cannot get a reservation" failure the relay's own limits note
+         * describes from the other side.
+         *
+         * Best-effort and individually caught: teardown must not be the thing that throws. One client
+         * that refuses to close must not prevent the next from being released.
+         */
+        for (const [key, client] of this.#relayClients) {
+            try {
+                client.close();
+            }
+            catch (err) {
+                this.#logger.warn("session.relay_client.close_failed", {
+                    relayClientKey: key,
+                    reason: err instanceof Error ? err.message : String(err),
+                    impact: "one cached relay client did not close cleanly on shutdown; the rest are still released",
+                });
+            }
+        }
+        this.#relayClients.clear();
         // Cancel every armed awaiting-ACK timer so an un-acked send (e.g. a rejected /
         // tampered frame that never produced a `persisted` ACK) does not leave a 20s
         // timer pinning the content + this manager in memory past teardown (review M1).
@@ -4124,6 +5200,14 @@ export class SessionNodeManager {
         for (const identity of this.#sessionSeeds.values())
             identity.seed.fill(0);
         this.#sessionSeeds.clear();
+        // 006-CRYPTO: the per-session throwaway secrets belong in the same sentence, for the same
+        // reason and with the same measured cause — shutdown marks rows `interrupted` by direct SQL, so
+        // no per-session teardown fires for them, and this process is known to linger (a `cello logout`
+        // was still alive 30+ seconds later). Without this, every live session's key survives the
+        // shutdown in memory for as long as it lingers.
+        for (const ephemeral of this.#sessionEphemerals.values())
+            destroySessionEphemeral(ephemeral);
+        this.#sessionEphemerals.clear();
         // Stop ALL per-agent standing receivers (DOD-LOOP-1). In PARALLEL and BOUNDED: this was a
         // sequential await per agent with no deadline, so five agents meant five chances for one stuck
         // libp2p teardown to hold the exit — and it sits between the operator being told the daemon is
@@ -4520,11 +5604,39 @@ export class SessionNodeManager {
      * BLOB to a listing surface that has no use for it; the boolean is the whole question a reader of
      * this list is asking, and shipping key material to answer a yes/no is not a trade worth making.
      */
-    #saltStatusOf(row) {
+    /**
+     * ⚠️ THE STORED COLUMN IS NOT THE ANSWER ON ITS OWN — 006-CRYPTO finding 3.
+     *
+     * A SUSPENDED salt keeps its bytes on disk deliberately (`DOD-M15-SALTSPLIT-1`: a salt kept is
+     * recoverable, a salt erased is not), while `#saltForHashing` returns null for it and every
+     * message goes out `sha256`. Reading the column alone therefore reported `true` at the exact
+     * moment the session had STOPPED salting — and because the field is emitted only when `false`,
+     * the agent saw nothing at all, which reads as "not unsalted".
+     *
+     * That is precisely the case this field was added for. Its own note above says it exists to tell
+     * *"unsalted because this build predates the feature"* from *"unsalted because adoption was
+     * refused"*, and the refused case was the one it could not report.
+     */
+    #saltStatusOf(row, agentName) {
         const { content_salt, ...rest } = row;
+        const stored = content_salt != null && content_salt.length > 0;
+        const suspended = agentName !== null && this.#saltSuspended.has(this.#k(agentName, String(row.session_id)));
+        /**
+         * 007-CRYPTO: the REAL state, not a constant. In 006 this was hardcoded `false` with a single
+         * reason, because nothing exchanged keys and saying so was the honest answer. It exchanges now,
+         * so a hardcode would be the stale claim that unit existed to remove.
+         *
+         * A row with no live agent name cannot be looked up in memory — an orphaned session, whose key
+         * (if it ever had one) died with the process. Reported as not-agreed rather than guessed at.
+         */
+        const enc = agentName === null
+            ? { key: null, reason: CONTENT_ENCRYPTION_REASONS.NOT_YET_AGREED }
+            : this.#contentEncryptionState(agentName, String(row.session_id));
         return {
             ...rest,
-            content_hashes_salted: content_salt != null && content_salt.length > 0,
+            content_hashes_salted: stored && !suspended,
+            content_encrypted: enc.key !== null,
+            ...(enc.key === null ? { content_encryption_reason: enc.reason } : {}),
         };
     }
     getSessionsForAgent(agentName) {
@@ -4536,7 +5648,7 @@ export class SessionNodeManager {
         const rows = this.#db
             .prepare("SELECT * FROM sessions WHERE agent_id = ? ORDER BY updated_at DESC")
             .all(this.#requireAgentId(agentName));
-        return rows.map((r) => ({ ...this.#saltStatusOf(r), agent_name: agentName }));
+        return rows.map((r) => ({ ...this.#saltStatusOf(r, agentName), agent_name: agentName }));
     }
     /**
      * Every persisted session across ALL agents, most-recently-updated first. Backs the daemon-wide
@@ -4554,7 +5666,12 @@ export class SessionNodeManager {
          FROM sessions s LEFT JOIN agents a ON a.agent_id = s.agent_id
          ORDER BY s.updated_at DESC`)
             .all()
-            .map((r) => this.#saltStatusOf(r));
+            // The joined display name is what `#saltSuspended` is keyed on. NULL only where the agent row
+            // is missing — an orphaned session, which has no live in-memory state to be suspended in.
+            .map((r) => {
+            const row = r;
+            return this.#saltStatusOf(row, row.agent_name ?? null);
+        });
     }
     /**
      * M7-SESSION-004 (AC-005): persist the seal certificate's legibility object with the
@@ -4685,6 +5802,162 @@ export class SessionNodeManager {
         }
         return { sealed_root: row.sealed_root_hex, legibility };
     }
+    /**
+     * DOD-M15-INCLUSION-1: keep the leaf set the certificate is signed over, so one message can later
+     * be proved to sit under it.
+     *
+     * REFUSES unless the hashes reproduce `sealedRootHex` — `certifiedLeafSetFrom` does that check and
+     * this method never bypasses it. That is what separates "the leaves the directory sent" from "the
+     * leaves the consortium signed", and only the second is worth storing: a proof built on the first
+     * would inherit whatever the directory chose to say.
+     *
+     * Idempotent (INSERT OR REPLACE keyed on leaf_index) so a re-delivered seal frame, or a unilateral
+     * seal later upgraded to bilateral, rewrites the same rows instead of failing or doubling them.
+     *
+     * @returns whether the set was accepted and stored.
+     */
+    recordCertifiedLeafSet(agentName, sessionId, signedLeaves, sealedRootHex, correlationId) {
+        if (!this.#db)
+            return false;
+        const resolved = certifiedLeafSetFrom(signedLeaves, sealedRootHex);
+        if (!resolved.ok) {
+            // The CAUSE is written where the proof surface can read it — fallback-finder finding 1. Without
+            // this row, `sealed_leaves_root_disagrees` (a directory contradicting its own FROST signature)
+            // and "this side was simply absent" are the same `null` downstream, and the operator is told
+            // the second.
+            this.#noteCertifiedLeafState(agentName, sessionId, resolved.reason, resolved.detail);
+            // LOUD, and it names which of the two it is. `sealed_leaves_root_disagrees` in particular is
+            // the directory shipping a leaf set that is not the one it signed — the receipt still stands
+            // (its own signature is checked elsewhere), but nothing in this session can be proved at
+            // message granularity until a set that reproduces the root arrives.
+            this.#logger.error("seal.certified_leaves.refused", {
+                agentName,
+                sessionId,
+                reason: resolved.reason,
+                detail: resolved.detail,
+                correlationId,
+                impact: "the leaf set shipped with this seal is not the one the certificate is signed over, so no " +
+                    "inclusion proof can be issued for this session; the sealed receipt itself is unaffected",
+                guidance: "cello_get_inclusion_proof will refuse this session by name (certified_leaves_unavailable). " +
+                    "Nothing local repairs it — the set has to arrive with a seal frame that reproduces the " +
+                    "signed root.",
+            });
+            return false;
+        }
+        const now = Date.now();
+        try {
+            const agentId = this.#requireAgentId(agentName);
+            /**
+             * DELETE THEN INSERT, INSIDE A TRANSACTION — fallback-finder finding 5.
+             *
+             * `INSERT OR REPLACE` alone is idempotent only for a set of the SAME length: a shorter
+             * re-delivery overwrites 0..k-1 and leaves stale rows at k..n-1, and an un-transacted loop that
+             * throws halfway leaves a truncated set that `getCertifiedLeafSet` still returns (it tests
+             * `rows.length > 0`, not completeness). Both produce a set that no longer hashes to the
+             * certified root — caught on read, but reported to the operator as *"the local copy has
+             * changed since the seal"*, which points at tampering for a write that never finished.
+             */
+            // `BEGIN` / `COMMIT` / `ROLLBACK` via exec — this file's and `db-identity-store.ts`'s idiom.
+            // `DaemonDatabase` has no `transaction()` helper (node:sqlite's handle does not provide one),
+            // and reaching for better-sqlite3's would compile against the adapter and fail on the other.
+            this.#db.exec("BEGIN");
+            try {
+                this.#db.prepare("DELETE FROM session_certified_leaves WHERE agent_id = ? AND session_id = ?")
+                    .run(agentId, sessionId);
+                const stmt = this.#db.prepare(`INSERT INTO session_certified_leaves
+             (agent_id, session_id, leaf_index, content_hash_hex, recorded_at)
+           VALUES (?, ?, ?, ?, ?)`);
+                for (let i = 0; i < resolved.leafHashes.length; i++) {
+                    stmt.run(agentId, sessionId, i, resolved.leafHashes[i], now);
+                }
+                this.#db.exec("COMMIT");
+            }
+            catch (err) {
+                try {
+                    this.#db.exec("ROLLBACK");
+                }
+                catch { /* the failing statement may have aborted it already */ }
+                throw err;
+            }
+        }
+        catch (err) {
+            this.#noteCertifiedLeafState(agentName, sessionId, "persist_failed", extractErrorMessage(err));
+            this.#logger.error("seal.certified_leaves.persist.failed", {
+                agentName,
+                sessionId,
+                reason: extractErrorMessage(err),
+                correlationId,
+                impact: "this session's certified leaf set was verified but not written, so cello_get_inclusion_proof " +
+                    "will refuse it by name until a later seal frame re-delivers the set",
+            });
+            return false;
+        }
+        this.#noteCertifiedLeafState(agentName, sessionId, "stored", null);
+        this.#logger.info("seal.certified_leaves.recorded", {
+            agentName,
+            sessionId,
+            leafCount: resolved.leafHashes.length,
+            sealedRoot: sealedRootHex,
+            correlationId,
+        });
+        return true;
+    }
+    /**
+     * Record WHY this session does or does not have a certified leaf set.
+     *
+     * Public for the one case the manager cannot see: a seal frame that carried no signed leaves at
+     * all never reaches `recordCertifiedLeafSet`, and that absence is a permanent fact about the
+     * session for the party that observed it.
+     */
+    noteCertifiedLeafSetUnavailable(agentName, sessionId, state, detail) {
+        this.#noteCertifiedLeafState(agentName, sessionId, state, detail);
+    }
+    /**
+     * The last thing that happened to this session's certified leaf set, or null if nothing has.
+     *
+     * Null here and a null from `getCertifiedLeafSet` together mean "no seal has been processed on
+     * this side yet" — which is a different sentence again from any of the recorded states.
+     */
+    getCertifiedLeafSetState(agentName, sessionId) {
+        if (!this.#db)
+            return null;
+        const row = this.#db
+            .prepare("SELECT state, detail FROM session_certified_leaves_state WHERE agent_id = ? AND session_id = ?")
+            .get(this.#requireAgentId(agentName), sessionId);
+        return row ? { state: row.state, detail: row.detail } : null;
+    }
+    /** Best-effort: a failure to record WHY must never be the thing that breaks a seal. */
+    #noteCertifiedLeafState(agentName, sessionId, state, detail) {
+        if (!this.#db)
+            return;
+        try {
+            this.#db
+                .prepare(`INSERT OR REPLACE INTO session_certified_leaves_state
+             (agent_id, session_id, state, detail, recorded_at)
+           VALUES (?, ?, ?, ?, ?)`)
+                .run(this.#requireAgentId(agentName), sessionId, state, detail, Date.now());
+        }
+        catch (err) {
+            this.#logger.warn("seal.certified_leaves.state.write.failed", {
+                agentName, sessionId, state, reason: extractErrorMessage(err),
+                impact: "the inclusion-proof surface will not be able to name WHY this session has no certified leaf set; it still refuses rather than proving anything",
+            });
+        }
+    }
+    /**
+     * The certified leaf set, in order, or null when none was stored for this session.
+     *
+     * Null is a REFUSAL upstream, never a fallback to the local tree: the two cover different leaves
+     * and substituting one for the other is how a proof comes to land on a root nobody signed.
+     */
+    getCertifiedLeafSet(agentName, sessionId) {
+        if (!this.#db)
+            return null;
+        const rows = this.#db
+            .prepare("SELECT content_hash_hex FROM session_certified_leaves WHERE agent_id = ? AND session_id = ? ORDER BY leaf_index ASC")
+            .all(this.#requireAgentId(agentName), sessionId);
+        return rows.length > 0 ? rows.map((r) => r.content_hash_hex) : null;
+    }
     /**
      * M7-SESSION-001: Mark a session as interrupted with message count and timestamp.
      * Called when a relay session_interrupted frame arrives or a relay stream closes.
@@ -4694,9 +5967,17 @@ export class SessionNodeManager {
      * @param messageCount Number of message leaves at interruption
      * @param source 'relay_frame' | 'stream_close'
      */
-    async markInterruptedWithDetails(agentName, sessionId, messageCount, source) {
+    async markInterruptedWithDetails(agentName, sessionId, messageCount, 
+    /**
+     * WHAT ACTUALLY HAPPENED, and it is written to the row — review F3.
+     *
+     * `key_refused` is its own source rather than a borrowed `stream_close`, because the row's
+     * `interrupted_by` is what an operator reads days later: labelling a key-authentication refusal
+     * `relay_stream_close` sends them to the relay fleet for a fault in the payload.
+     */
+    source) {
         if (!this.#db)
-            return;
+            return false;
         // H-3 SECURITY: only an 'active' session may transition to 'interrupted'.
         // A late or forged relay frame must NOT revert a 'sealed', 'seal_interrupted_pending',
         // or already-'interrupted' session back to 'interrupted'. This mirrors the
@@ -4709,7 +5990,8 @@ export class SessionNodeManager {
                 currentStatus: existing?.status ?? "absent",
                 reason: "session_not_active",
             });
-            return;
+            // FALSE, not void — the caller needs to know nothing was torn down (review F11).
+            return false;
         }
         const now = Date.now();
         const interruptedAt = new Date(now).toISOString();
@@ -4739,7 +6021,7 @@ export class SessionNodeManager {
             // `relay_stream_close` is its own label and STILL COUNTS (the bound excuses only 'local'),
             // because an attacker who can disturb our relay link must not get a free cap reset. It is
             // recorded honestly rather than blamed on the wrong party.
-            `UPDATE sessions SET status = 'interrupted', updated_at = ?, message_count = ?, interrupted_at = ?, interrupted_by = '${source === "relay_frame" ? "counterparty" : "relay_stream_close"}' WHERE agent_id = ? AND session_id = ? AND status = 'active'`)
+            `UPDATE sessions SET status = 'interrupted', updated_at = ?, message_count = ?, interrupted_at = ?, interrupted_by = '${source === "relay_frame" ? "counterparty" : source === "key_refused" ? "key_refused" : "relay_stream_close"}' WHERE agent_id = ? AND session_id = ? AND status = 'active'`)
                 .run(now, authoritativeCount, interruptedAt, this.#requireAgentId(agentName), sessionId);
         }
         catch (err) {
@@ -4767,6 +6049,21 @@ export class SessionNodeManager {
                 // Fall through — still remove from active map
             }
             this.#activeNodes.delete(this.#k(agentName, sessionId));
+            /**
+             * THE SECRET GOES WITH THE ENTRY — 006-CRYPTO, review pass 2 finding 2.
+             *
+             * This is the path an interrupted session actually takes, and it is the ORDINARY way a
+             * session ends badly: a relay blip, a closed stream, a sleeping laptop. Because it does not
+             * evict (see below) the secret used to survive here, and when the session later sealed
+             * `destroySessionNode` returned at its `if (!entry) return` without evicting either — so the
+             * receipt landed, the session was over, and the key stayed resident until the process exited.
+             *
+             * The reasons below for KEEPING the other caches do not transfer to key material: buffered
+             * plaintext must stay drainable and TTF timers must stay armed, whereas a secret nothing
+             * reads must not stay alive. A revived session mints a fresh one and re-keys, which is
+             * Decisions Carried #5 and is only true because of this line.
+             */
+            this.#destroySessionEphemeralFor(agentName, sessionId, entry.correlationId);
             this.#logger.info("session.node.destroyed", {
                 sessionId,
                 agentName,
@@ -4801,6 +6098,7 @@ export class SessionNodeManager {
                 error: err instanceof Error ? err.message : String(err),
             });
         }
+        return true;
     }
     /**
      * M7-SESSION-001 (H-1): persist a verified bilateral SEAL-INTERRUPTED
@@ -5125,6 +6423,10 @@ export class SessionNodeManager {
             if (viaRelay)
                 entry.gater.setAllowedOutboundPeer(viaRelay[1]);
         }
+        // DOD-M15-RELAYAUTH-1 review H1: the RELAY's gater must also admit this dial, and it only does
+        // so once it holds the assignment. Await that here — see the method's own comment for why the
+        // counterparty presenting it cannot be relied on.
+        await this.#authorizeCircuitDialsToCounterparty(agentName, sessionId, entry, addrs);
         let lastError = "";
         for (const addr of addrs) {
             try {
@@ -5155,6 +6457,112 @@ export class SessionNodeManager {
         });
         return { ok: false, reason: "counterparty_dial_failed", error: lastError };
     }
+    /**
+     * DOD-M15-RELAYAUTH-1 review H1 — **THE GATE WAS DENYING THE LEGITIMATE DIAL, AND USUALLY.**
+     *
+     * With the gater installed, a relay refuses a circuit dial unless it already holds a
+     * directory-signed assignment naming both transport peer ids. Both parties get that assignment
+     * from the directory independently, and until this method existed, each only presented it to
+     * relays IT had chosen — so whether a dial was allowed came down to which of two independent
+     * network races finished first:
+     *
+     *   1. WE connect to the witness relay, then dial the counterparty's circuit address. ~2 RTT.
+     *   2. THEY connect to their witness relay, then — unawaited, on a fresh dial + auth + record —
+     *      tell their RESERVATION relay about the session. ~3–4 RTT.
+     *
+     * Nothing sequenced (1) against (2), and (1) is shorter, so we usually arrived first and were
+     * refused. The session still opened and reported `transportMode: "relay"`, so the failure was
+     * invisible: every message for the life of that conversation quietly took the store-and-forward
+     * park path, and the only trace was a denial logged on a third machine nobody tails.
+     *
+     * The fix is to stop racing. Whoever is about to dial presents the assignment to the relay that
+     * will gate that dial, and WAITS for the relay to confirm it recorded it. The ordering becomes
+     * local to one thread of execution, so there is nothing left to lose.
+     *
+     * Safe by construction: we are a participant the assignment names, so the relay's own participant
+     * check passes; and the assignment is self-authenticating (a directory signature the relay
+     * verifies against its consortium set), so presenting it more widely grants nothing that forging
+     * it would not already require.
+     *
+     * Best-effort by design — a relay we cannot reach must not stop us from dialling. If the record
+     * fails we dial anyway: a dial that might be refused is strictly better than no dial.
+     */
+    async #authorizeCircuitDialsToCounterparty(agentName, sessionId, entry, addrs) {
+        const assignment = entry.relayAssignment;
+        if (!assignment || !entry.relaySessionIdBytes)
+            return; // direct/legacy/persisted: no credential to present
+        const sessionIdHex = Buffer.from(entry.relaySessionIdBytes).toString("hex");
+        // One presentation per distinct relay, not per address: a counterparty commonly advertises
+        // several circuit addresses on the SAME relay.
+        const seen = new Set();
+        for (const addr of addrs) {
+            const relayPeerId = /\/p2p\/([^/]+)\/p2p-circuit/.exec(addr)?.[1];
+            if (!relayPeerId || seen.has(relayPeerId))
+                continue;
+            seen.add(relayPeerId);
+            // The witness relay already has it — registerSession presented it when the session was wired.
+            if (relayPeerId === entry.relayPeerId)
+                continue;
+            const baseRelayAddr = addr.split("/p2p-circuit")[0] ?? addr;
+            try {
+                const clientKey = `${agentName}::${relayPeerId}`;
+                let client = this.#relayClients.get(clientKey);
+                if (!client) {
+                    if (!this.#relayReceiptStore && this.#db)
+                        this.#relayReceiptStore = new RelayReceiptStore(this.#db, this.#logger);
+                    if (!this.#sealLeafStore && this.#db)
+                        this.#sealLeafStore = new SessionSealLeafStore(this.#db, this.#logger);
+                    client = this.#detachedRelayClientBuilder?.(agentName, relayPeerId, [baseRelayAddr], {
+                        receiptStore: this.#relayReceiptStore ?? undefined,
+                        sealLeafStore: this.#sealLeafStore ?? undefined,
+                        // DOD-M15-RELAYSLOTS-1: read at each auth, never snapshotted — the token expires hourly.
+                        onlineToken: () => this.getDirectoryOnlineToken(agentName),
+                    });
+                    if (!client) {
+                        this.#logger.warn("session.transport.dial_authorization.no_builder", {
+                            sessionId,
+                            relayPeerId,
+                            impact: "cannot present the assignment to the relay that gates this dial; if the counterparty has not presented it either, the dial will be refused and every message will fall to the park path",
+                            correlationId: entry.correlationId,
+                        });
+                        continue;
+                    }
+                    this.#relayClients.set(clientKey, client);
+                    // Review M4: remember it so teardown releases it — this is a SECOND client for the
+                    // session, and detach only knows about the witness one.
+                    entry.extraRelayClientKeys = [...(entry.extraRelayClientKeys ?? []), clientKey];
+                }
+                // No leaf handler: this relay is not witnessing the session, it only needs the binding.
+                client.registerSession(sessionIdHex, entry.node, undefined, assignment);
+                const recorded = await client.recordAssignmentAndWait(entry.node, sessionIdHex);
+                if (recorded) {
+                    this.#logger.info("session.transport.dial_authorized", {
+                        sessionId,
+                        relayPeerId,
+                        impact: "the relay that gates this circuit dial now holds the assignment authorizing it",
+                        correlationId: entry.correlationId,
+                    });
+                }
+                else {
+                    this.#logger.warn("session.transport.dial_authorization.not_recorded", {
+                        sessionId,
+                        relayPeerId,
+                        impact: "the relay did not confirm the assignment; the dial below may be refused and messages would fall to the park path",
+                        correlationId: entry.correlationId,
+                    });
+                }
+            }
+            catch (err) {
+                this.#logger.warn("session.transport.dial_authorization.failed", {
+                    sessionId,
+                    relayPeerId,
+                    error: extractErrorMessage(err),
+                    impact: "could not tell the relay that gates this dial about the session; the dial is attempted anyway",
+                    correlationId: entry.correlationId,
+                });
+            }
+        }
+    }
     /**
      * Send content over the session node's direct P2P content stream.
      * On a dead/missing stream this returns a NAMED, diagnosable failure — never a silent success
@@ -5235,6 +6643,15 @@ export class SessionNodeManager {
         // the leaf_deliver witness stream / arrival order.
         let orderingS1;
         let orderingS2;
+        /**
+         * DOD-M15-SEALWIRE-1 bullet 5, SENT half. Our own Ed25519 signature over `orderingS1`.
+         *
+         * The submit path already computes this — `keyProvider.sign(structure1)` — and puts it on the
+         * wire as `sender_signature`. It was simply never handed back, which is the whole of the defect:
+         * a RECEIVED row could prove its author to a third party and a SENT row could not, so half the
+         * transcript was provable and half was assertion.
+         */
+        let sentAuthorship;
         // DOD-M12B-INDEX-1: the relay's answer to "where does this message go", carried to the caller.
         let assignedSeq;
         // DOD-MP-SESSION-RETIRE-1 — the relay's answer SURVIVES to the caller even when the direct send
@@ -5254,6 +6671,101 @@ export class SessionNodeManager {
                 if (witnessed.ok) {
                     orderingS1 = witnessed.structure1_cbor;
                     orderingS2 = witnessed.structure2_cbor;
+                    /**
+                     * PAIRED WITH THE BYTES IT SIGNS, in one place, so the two can never be assigned apart.
+                     *
+                     * ⚠️ THE PUBKEY COMES FROM INSIDE `structure1_cbor`, NOT FROM AN AGENT LOOKUP — the same
+                     * source the RECEIVED half uses. A verifier checks the signature against the key in the
+                     * signed bytes; storing any other key would produce a row that looks checkable and fails,
+                     * and a lookup could drift from what was actually signed (a rotated identity, the wrong
+                     * agent resolved by name). Taking it from the signed bytes makes that class impossible.
+                     */
+                    if (witnessed.structure1_cbor && witnessed.sender_signature) {
+                        /**
+                         * ⚠️ THE DROP IS SOFT, BUT IT MUST NOT BE SILENT — review pass 1, F2.
+                         *
+                         * My comment here claimed the resulting row is "distinguishable from one that carries a
+                         * signature". True, and it misses the comparison that matters: **it is byte-identical to
+                         * an UNWITNESSED send** — `self_authored`, both proof columns NULL. So the record cannot
+                         * tell "the relay never witnessed this" from "we witnessed it, held the proof, and
+                         * dropped it decoding our own bytes."
+                         *
+                         * And the asymmetry with the received half is the argument. `#recordFrameOrdering` is
+                         * soft because the COUNTERPARTY supplied those bytes — an absence we cannot resolve.
+                         * Here **we produced them**, in `session-relay-client.ts`, moments earlier. A failure
+                         * means our own encoder and decoder disagree: an internal invariant break that would
+                         * strip authorship from every sent row for the life of the process. Soft is still right
+                         * — throwing would lose a delivered message over a missing attestation — but soft and
+                         * unannounced is the silent-fallback pattern this milestone exists to find.
+                         */
+                        const dropAuthorship = (reason, error, extra) => {
+                            this.#logger.warn("session.sent.authorship.unavailable", {
+                                sessionId,
+                                agentName,
+                                reason,
+                                // WHICH ROW lost its proof — review pass 2, M2. Without the sequence an operator knows
+                                // a message is unproven and not which one, in a transcript of hundreds.
+                                ...(witnessed.ok ? { relaySequence: witnessed.sequence_number } : {}),
+                                ...(extra ?? {}),
+                                ...(error === undefined ? {} : { error: error instanceof Error ? error.message : String(error) }),
+                                impact: "this sent message is recorded with attribution 'self_authored' and NO signature, so the row " +
+                                    "asserts its author rather than proving one. It is indistinguishable in the database from a " +
+                                    "send the relay never witnessed — this log line is the only thing that tells them apart.",
+                                guidance: "We produced these bytes ourselves, so a decode or shape failure here means this daemon's own " +
+                                    "encoder and decoder disagree. Treat it as an internal invariant break, not a peer problem.",
+                                correlationId,
+                            });
+                        };
+                        try {
+                            // Structure 1 = [1, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp]
+                            // — the same decode `#recordFrameOrdering` does for the received half, index 2.
+                            const s1 = decode(witnessed.structure1_cbor);
+                            const pk = s1[2];
+                            // The SIGNATURE is length-checked too (review F2): the guard checked the pubkey's 32
+                            // bytes and only truthiness on the signature, so a zero-length one would have stored an
+                            // uncheckable BLOB. Not reachable today — `sign()` returns 64 — and the asymmetry is
+                            // the kind that stops being unreachable quietly.
+                            /**
+                             * ⚠️ VERIFIED BEFORE IT IS STORED, NOT SHAPE-CHECKED — review pass 2, H2, and this is
+                             * worth more than any test of it.
+                             *
+                             * This used to accept the pair on 32 bytes and 64 bytes. A shape check cannot tell a
+                             * real proof from 96 bytes that resemble one, and **nothing downstream ever checks
+                             * either**: not at write time, and not at read time, because no production reader of
+                             * these columns exists yet. So a wrong Structure-1 index, a wrong key, or a pair from
+                             * two different submits would all have been persisted as a row that **looks checkable
+                             * to an auditor and fails** — strictly worse than the honest unproven row it replaced.
+                             *
+                             * The received half has always done this (`#recordFrameOrdering` verifies before
+                             * storing and treats a failure as fatal). The sent half did not, and every ingredient
+                             * was already in scope on this line.
+                             *
+                             * What it buys over a test: a wrong index becomes **impossible to persist**. The row
+                             * gets NULL, the warn below fires, and it happens in production on the machine that
+                             * caused it — not in a suite someone has to remember to write.
+                             *
+                             * NOT fatal, unlike the received half, and the asymmetry is deliberate: there the
+                             * failure means a COUNTERPARTY sent something that does not verify, which is an
+                             * identity problem. Here it means our own encoder and decoder disagree — bad, but it
+                             * must not cost the operator a delivered message.
+                             */
+                            if (!(pk instanceof Uint8Array) || pk.length !== 32) {
+                                dropAuthorship("pubkey_shape", undefined, { pubkeyLen: pk instanceof Uint8Array ? pk.length : -1 });
+                            }
+                            else if (witnessed.sender_signature.length !== 64) {
+                                dropAuthorship("signature_shape", undefined, { sigLen: witnessed.sender_signature.length });
+                            }
+                            else if (!verify(pk, witnessed.structure1_cbor, witnessed.sender_signature)) {
+                                dropAuthorship("pair_does_not_verify");
+                            }
+                            else {
+                                sentAuthorship = { senderPubkey: pk, senderSig: witnessed.sender_signature };
+                            }
+                        }
+                        catch (err) {
+                            dropAuthorship("structure1_decode_failed", err);
+                        }
+                    }
                     // 1-BASED → 0-BASED. The relay numbers the first leaf of a session 1
                     // (`relay-node.ts`: `const seq = state.seq_counter + 1`), and this tree is 0-indexed.
                     // Every RECEIVE path in this file normalises with -1 and says so; the send path took the
@@ -5385,6 +6897,22 @@ export class SessionNodeManager {
         // connection). See the note on #handleContentStream's finally.
         let sendStream;
         try {
+            /**
+             * 🚨 NO KEY, NO DIRECT SEND — `DOD-M15-EPHEMERAL-AUTH-1`, and there is no plaintext fallback.
+             *
+             * Throwing here rather than sending in the open, because the catch below PARKS the content —
+             * and the mailbox copy is sealed to the counterparty's long-term identity key, so the message
+             * still travels encrypted and still arrives. The failure mode is a delay, never an exposure.
+             *
+             * A fallback to plaintext would be a thing an attacker steers a session into: strip the key
+             * frame and a system that "carries on, degraded" gives up the body while the operator reads a
+             * warning they have learned to scroll past. That is why this is a throw and not a warning.
+             */
+            const encState = this.#contentEncryptionState(agentName, sessionId);
+            if (encState.key === null) {
+                throw new Error(`content_not_encryptable: ${encState.reason} — ${CONTENT_ENCRYPTION_GUIDANCE[encState.reason]}`);
+            }
+            const sessionKey = encState.key;
             const stream = await this.#openContentStream(agentName, sessionId, entry, correlationId);
             sendStream = stream;
             // AC-001/AC-003: arm the TTF tracking BEFORE the frame goes on the wire. The
@@ -5395,12 +6923,32 @@ export class SessionNodeManager {
             // resolves it (content.delivery.acked) and TTF expiry hands it to the park
             // backstop. The correlationId rides in the frame so the receiver's
             // session.content.received shares ONE flow id with the sender.
+            /**
+             * ⚠️ THE TRACKER KEEPS THE PLAINTEXT, AND THAT IS DELIBERATE — 007-CRYPTO.
+             *
+             * When live delivery times out, THIS is the copy the park backstop seals into the relay
+             * mailbox, under `sealToRecipient` to the counterparty's long-term identity key. Encrypting
+             * `content` in place would put a body locked under a session key — one about to be destroyed —
+             * inside the mailbox envelope, and the recipient would open the outer seal onto bytes nothing
+             * can read. It passes every live-delivery test and fails only for messages that park.
+             *
+             * So the session key encrypts the copy that goes ON THE WIRE, below, and nothing else.
+             */
             this.#trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, orderingS1, orderingS2, contentHashAlg);
+            /**
+             * THE WIRE COPY. `content_hash` above was computed over the PLAINTEXT and stays that way: the
+             * transcript, the seal and the salted hash all depend on it meaning what it means today, and
+             * the receiver decrypts before it verifies.
+             */
+            const wireBody = sealSessionContent(sessionKey, content);
             const frame = encodeCbor({
                 type: "content_frame",
                 session_id: sessionId,
                 content_hash: contentHash,
-                content_bytes: content,
+                content_bytes: wireBody,
+                // WHICH scheme the body is under. Present because the receiver must not have to guess from
+                // a length, and absent is not a valid state — a frame without it is refused, not read raw.
+                content_encryption: SESSION_CONTENT_ENCRYPTION_V1,
                 correlation_id: correlationId,
                 // DOD-MSG-4 (self-ordering): the relay's signed ordering record, so the receiver verifies +
                 // orders from the frame ALONE (no dependence on the separate leaf_deliver witness timing).
@@ -5436,7 +6984,7 @@ export class SessionNodeManager {
             // on the content hash. A false delivered costs the message.
             await stream.close();
             this.#clearSessionImpairment(agentName, sessionId, "direct_send", correlationId);
-            return { ok: true, delivered: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
+            return { ok: true, delivered: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
         }
         catch (err) {
             this.#markSessionImpaired(agentName, sessionId, { cause: "direct_send", error: err instanceof Error ? err.message : String(err), correlationId });
@@ -5483,7 +7031,7 @@ export class SessionNodeManager {
             const attempt = await this.#parkContent(agentName, sessionId, hashHex, content, orderingS1, orderingS2, contentHashAlg);
             if (attempt.outcome === "parked") {
                 this.#noteImpairmentRetention(agentName, sessionId, "parked");
-                return { ok: true, delivered: false, parked: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
+                return { ok: true, delivered: false, parked: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
             }
             // M12-P12: the deposit was refused, and #untrackAwaitingAck above already dropped the
             // in-memory entry — so without this, NOTHING holds the content and the TTF timer that would
@@ -5575,6 +7123,8 @@ export class SessionNodeManager {
                 // Carried on the failure path too: a DURABLY QUEUED message still owns the position the
                 // relay witnessed for it before delivery was attempted, and its leaf must go there.
                 ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }),
+                // …and so does its PROOF, for the same reason. It was signed before the hand-off failed.
+                ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }),
                 // M12-P13: the machine-readable half of the distinction below. M12-P12 shipped it in the
                 // guidance SENTENCE only, so the callers that have to ACT on it — commit the leaf for a
                 // queued message, never for a lost one — would have had to substring-match English. None
@@ -5599,11 +7149,7 @@ export class SessionNodeManager {
                  * This is the reason `cause` had to become a code first: the distinction is unbranchable
                  * while the field holds an English paragraph.
                  */
-                guidance: attempt.cause === PARK_ENVELOPE_REASONS.ALG_UNREADABLE
-                    ? "This message names a content-hash algorithm your build cannot produce, so it could not be sealed for hand-off. The relay is NOT involved and this will not clear on its own — the message is safely stored but every retry fails the same way. Upgrade to a build that knows the algorithm, or start a new session with this counterparty. Re-sending on this build changes nothing."
-                    : durable
-                        ? "Direct delivery failed and the relay refused the hand-off, so the message is queued and will be re-sent automatically when the relay link is back. Do not re-send it: an identical re-send is not separately queued."
-                        : "Direct delivery failed and the message could NOT be queued for retry — it is lost. Send it again.",
+                guidance: parkRefusalGuidance(attempt.cause, durable, attempt.retryAfterMs),
             };
         }
     }
@@ -5624,110 +7170,153 @@ export class SessionNodeManager {
         if ("error" in transport)
             return { ok: false, reason: transport.error };
         const entry = transport;
-        // M7-UPGRADE-002 idempotency: this party submits its responder SEAL leaf AT MOST ONCE per
-        // session. BOTH cello_close_session and the auto-acknowledge path call here; the first to reach
-        // this point wins, the second short-circuits. The check+set is SYNCHRONOUS (before any await) so
-        // two near-simultaneous triggers (e.g. B's own close racing A's delivered SEAL ctrl leaf) cannot
-        // both submit. Cleared below on a relay submit failure so a genuine retry can proceed.
-        // DOD-M12B-INTERRUPTED-ESCALATE-1 — THE MARK MUST SURVIVE A RESTART, or one automatic retry
-        // permanently forfeits the receipt.
-        //
-        // `#responderSealSubmitted` is in memory. A session whose close was in flight when the daemon
-        // stopped already has our SEAL ctrl leaf in the relay log — and on the next boot the mark is
-        // empty, so the restart-seal resolver's automatic close would submit a SECOND one. The
-        // directory requires exactly one ctrl leaf (`ctrlLeaves.length !== 1 → unilateral_seal_leaf_invalid`)
-        // and the carry is durable, so every future attempt would carry both and be refused forever.
-        //
-        // The durable evidence already exists and was simply not consulted: our own ctrl leaf is in
-        // `session_seal_leaves`. Recover the escalation values from it instead of submitting again.
-        if (!this.#responderSealSubmitted.has(sealKey)) {
-            const durable = this.#recoverOwnSealCtrlLeaf(agentName, sessionId);
-            if (durable === "unknown") {
-                // REFUSE, do not submit. A second ctrl leaf makes the session unsealable forever, and the
-                // question "is one already there?" just failed to answer. Refusing costs this close; a
-                // second leaf costs the receipt permanently.
-                return { ok: false, reason: "seal_leaf_recovery_unavailable" };
-            }
-            if (durable !== "none") {
-                this.#logger.info("session.seal.leaf.already_submitted.recovered", {
-                    sessionId, agentName, sequenceNumber: durable.sequenceNumber,
-                    impact: "our SEAL ctrl leaf is already in the relay log from a previous run; submitting a second would make this session unsealable forever",
+        /**
+         * DOD-M15-RELAYLEAK-1 — release a DETACHED seal transport when this submission is done.
+         *
+         * Only the detached branch registers a session here, so this can never remove a live one. The
+         * client is closed only when it has no sessions left and the cache still holds THIS client —
+         * the same two guards `#detachSessionRelay` uses, and for the same reason: a racing teardown
+         * must not close a freshly-built replacement for the same key.
+         */
+        const releaseDetached = () => {
+            if (transport.releaseOnDone !== true)
+                return;
+            try {
+                entry.relayClient.unregisterSession(sessionId);
+                if (!entry.relayClient.hasSessions()) {
+                    for (const [key, cached] of this.#relayClients) {
+                        if (cached === entry.relayClient) {
+                            cached.close();
+                            this.#relayClients.delete(key);
+                            break;
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                this.#logger.warn("session.seal.transport.release_failed", {
+                    agentName,
+                    sessionId,
+                    reason: err instanceof Error ? err.message : String(err),
+                    impact: "a detached seal relay client could not be released; it is held until process exit",
                 });
-                this.#responderSealSubmitted.set(sealKey, durable);
             }
-        }
-        if (this.#responderSealSubmitted.has(sealKey)) {
-            // M8B FINDING-1: carry the FIRST submit's reported root/sequence so a retry close can
-            // still escalate to a unilateral seal. A null value means that submit is still in
-            // flight — return the bare reason and let the caller fall back to the pending path.
-            const prior = this.#responderSealSubmitted.get(sealKey);
-            return prior
-                ? {
-                    ok: false,
-                    reason: "responder_seal_already_submitted",
-                    reportedRootHex: prior.reportedRootHex,
-                    sequenceNumber: prior.sequenceNumber,
-                }
-                : { ok: false, reason: "responder_seal_already_submitted" };
-        }
-        this.#responderSealSubmitted.set(sealKey, null);
-        // A throw anywhere before the mark is finalized would strand the null in-flight marker
-        // and lock every future close out of escalation (a FINDING-1-shaped deadlock via a
-        // different trigger) — clear the mark on any unexpected exception.
+        };
+        /**
+         * ⚠️ try/finally, NOT a call at each return. There are three exits today and adding a release
+         * to each would be a hand-kept list — the shape this milestone has been bitten by repeatedly,
+         * where the FOURTH exit added later quietly leaks. Here the release cannot be bypassed by a new
+         * return, and it runs on the throw path too, which is where a leak matters most.
+         */
         try {
-            const finalRootHex = this.getSessionTreeRootHex(agentName, sessionId);
-            const sealPayload = encodeSealPayload({
-                session_id: entry.relaySessionIdBytes,
-                final_root: new Uint8Array(Buffer.from(finalRootHex, "hex")),
-                close_timestamp: Date.now(),
-                attestation: "PENDING",
-            });
-            // content_hash = SHA-256(0x02 || seal_payload) — the ctrl leaf kind byte is 0x02.
-            const contentHash = new Uint8Array(createHash("sha256").update(new Uint8Array([LEAF_KIND_CTRL])).update(sealPayload).digest());
-            /**
-             * ⚠️ `sealPayload` IS PASSED, AND ITS ABSENCE WAS THE WHOLE DEFECT — `DOD-M15-SEALWIRE-1`
-             * bullets 3+4, review pass 1, F1.
-             *
-             * These exact bytes were computed two lines above, hashed, and then dropped: `submitLeaf` had
-             * no parameter for them. So the directory received a SHA-256 pre-image nobody transmitted, and
-             * the client's SIGNED `final_root` — the one value in the seal the relay cannot produce — was
-             * unrecoverable. Four legs of this line shipped and were reviewed green while the head of the
-             * chain did not exist.
-             *
-             * The payload and the hash MUST come from the same derivation. If they ever diverge the
-             * directory reports `seal_payload_unbound`, whose guidance says *"someone between them and here
-             * altered or fabricated the payload — the relay is the only party on that path"* — a correct
-             * relay accused by name, in an error written to sound like an attack, for a mismatch made here.
-             */
-            const result = await entry.relayClient.submitLeaf(entry.node, entry.relaySessionIdBytes, contentHash, LEAF_KIND_CTRL, sealPayload);
-            if (!result.ok) {
-                // Clear the idempotency mark so a genuine retry (agent close / reconnect) can proceed (DB-001).
+            // M7-UPGRADE-002 idempotency: this party submits its responder SEAL leaf AT MOST ONCE per
+            // session. BOTH cello_close_session and the auto-acknowledge path call here; the first to reach
+            // this point wins, the second short-circuits. The check+set is SYNCHRONOUS (before any await) so
+            // two near-simultaneous triggers (e.g. B's own close racing A's delivered SEAL ctrl leaf) cannot
+            // both submit. Cleared below on a relay submit failure so a genuine retry can proceed.
+            // DOD-M12B-INTERRUPTED-ESCALATE-1 — THE MARK MUST SURVIVE A RESTART, or one automatic retry
+            // permanently forfeits the receipt.
+            //
+            // `#responderSealSubmitted` is in memory. A session whose close was in flight when the daemon
+            // stopped already has our SEAL ctrl leaf in the relay log — and on the next boot the mark is
+            // empty, so the restart-seal resolver's automatic close would submit a SECOND one. The
+            // directory requires exactly one ctrl leaf (`ctrlLeaves.length !== 1 → unilateral_seal_leaf_invalid`)
+            // and the carry is durable, so every future attempt would carry both and be refused forever.
+            //
+            // The durable evidence already exists and was simply not consulted: our own ctrl leaf is in
+            // `session_seal_leaves`. Recover the escalation values from it instead of submitting again.
+            if (!this.#responderSealSubmitted.has(sealKey)) {
+                const durable = this.#recoverOwnSealCtrlLeaf(agentName, sessionId);
+                if (durable === "unknown") {
+                    // REFUSE, do not submit. A second ctrl leaf makes the session unsealable forever, and the
+                    // question "is one already there?" just failed to answer. Refusing costs this close; a
+                    // second leaf costs the receipt permanently.
+                    return { ok: false, reason: "seal_leaf_recovery_unavailable" };
+                }
+                if (durable !== "none") {
+                    this.#logger.info("session.seal.leaf.already_submitted.recovered", {
+                        sessionId, agentName, sequenceNumber: durable.sequenceNumber,
+                        impact: "our SEAL ctrl leaf is already in the relay log from a previous run; submitting a second would make this session unsealable forever",
+                    });
+                    this.#responderSealSubmitted.set(sealKey, durable);
+                }
+            }
+            if (this.#responderSealSubmitted.has(sealKey)) {
+                // M8B FINDING-1: carry the FIRST submit's reported root/sequence so a retry close can
+                // still escalate to a unilateral seal. A null value means that submit is still in
+                // flight — return the bare reason and let the caller fall back to the pending path.
+                const prior = this.#responderSealSubmitted.get(sealKey);
+                return prior
+                    ? {
+                        ok: false,
+                        reason: "responder_seal_already_submitted",
+                        reportedRootHex: prior.reportedRootHex,
+                        sequenceNumber: prior.sequenceNumber,
+                    }
+                    : { ok: false, reason: "responder_seal_already_submitted" };
+            }
+            this.#responderSealSubmitted.set(sealKey, null);
+            // A throw anywhere before the mark is finalized would strand the null in-flight marker
+            // and lock every future close out of escalation (a FINDING-1-shaped deadlock via a
+            // different trigger) — clear the mark on any unexpected exception.
+            try {
+                const finalRootHex = this.getSessionTreeRootHex(agentName, sessionId);
+                const sealPayload = encodeSealPayload({
+                    session_id: entry.relaySessionIdBytes,
+                    final_root: new Uint8Array(Buffer.from(finalRootHex, "hex")),
+                    close_timestamp: Date.now(),
+                    attestation: "PENDING",
+                });
+                // content_hash = SHA-256(0x02 || seal_payload) — the ctrl leaf kind byte is 0x02.
+                const contentHash = new Uint8Array(createHash("sha256").update(new Uint8Array([LEAF_KIND_CTRL])).update(sealPayload).digest());
+                /**
+                 * ⚠️ `sealPayload` IS PASSED, AND ITS ABSENCE WAS THE WHOLE DEFECT — `DOD-M15-SEALWIRE-1`
+                 * bullets 3+4, review pass 1, F1.
+                 *
+                 * These exact bytes were computed two lines above, hashed, and then dropped: `submitLeaf` had
+                 * no parameter for them. So the directory received a SHA-256 pre-image nobody transmitted, and
+                 * the client's SIGNED `final_root` — the one value in the seal the relay cannot produce — was
+                 * unrecoverable. Four legs of this line shipped and were reviewed green while the head of the
+                 * chain did not exist.
+                 *
+                 * The payload and the hash MUST come from the same derivation. If they ever diverge the
+                 * directory reports `seal_payload_unbound`, whose guidance says *"someone between them and here
+                 * altered or fabricated the payload — the relay is the only party on that path"* — a correct
+                 * relay accused by name, in an error written to sound like an attack, for a mismatch made here.
+                 */
+                const result = await entry.relayClient.submitLeaf(entry.node, entry.relaySessionIdBytes, contentHash, LEAF_KIND_CTRL, sealPayload);
+                if (!result.ok) {
+                    // Clear the idempotency mark so a genuine retry (agent close / reconnect) can proceed (DB-001).
+                    this.#responderSealSubmitted.delete(sealKey);
+                    this.#logger.warn("session.seal.leaf.submit.failed", { sessionId, reason: result.reason, correlationId });
+                    return { ok: false, reason: result.reason };
+                }
+                // SESSION-002: the reported_root for a unilateral seal is the content-hash root the
+                // local tree WOULD have with this SEAL ctrl leaf appended — the same root the directory
+                // rebuilds from the relay's content-hash chain (the relay records the identical
+                // content_hash for this ctrl leaf). Computed without mutating the durable tree /
+                // message_count, so the bilateral + interrupted seal paths are unaffected.
+                const contentHashHex = Buffer.from(contentHash).toString("hex");
+                const reportedRootHex = this.getSessionTree(agentName, sessionId).rootWithAppendedHex(contentHashHex);
+                // M8B FINDING-1: durably associate the submit's escalation values with the idempotency
+                // mark, so any LATER close call can retrieve them via the already-submitted result.
+                this.#responderSealSubmitted.set(sealKey, { reportedRootHex, sequenceNumber: result.sequence_number });
+                this.#logger.info("session.seal.leaf.submitted", {
+                    sessionId,
+                    sequenceNumber: result.sequence_number,
+                    correlationId,
+                });
+                // M7-UPGRADE-002: #responderSealSubmitted was set synchronously at the top of this method —
+                // the guard now blocks any second submit (auto-ack OR a redelivered counterparty SEAL ctrl leaf).
+                return { ok: true, sequenceNumber: result.sequence_number, reportedRootHex };
+            }
+            catch (err) {
                 this.#responderSealSubmitted.delete(sealKey);
-                this.#logger.warn("session.seal.leaf.submit.failed", { sessionId, reason: result.reason, correlationId });
-                return { ok: false, reason: result.reason };
-            }
-            // SESSION-002: the reported_root for a unilateral seal is the content-hash root the
-            // local tree WOULD have with this SEAL ctrl leaf appended — the same root the directory
-            // rebuilds from the relay's content-hash chain (the relay records the identical
-            // content_hash for this ctrl leaf). Computed without mutating the durable tree /
-            // message_count, so the bilateral + interrupted seal paths are unaffected.
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
-            const reportedRootHex = this.getSessionTree(agentName, sessionId).rootWithAppendedHex(contentHashHex);
-            // M8B FINDING-1: durably associate the submit's escalation values with the idempotency
-            // mark, so any LATER close call can retrieve them via the already-submitted result.
-            this.#responderSealSubmitted.set(sealKey, { reportedRootHex, sequenceNumber: result.sequence_number });
-            this.#logger.info("session.seal.leaf.submitted", {
-                sessionId,
-                sequenceNumber: result.sequence_number,
-                correlationId,
-            });
-            // M7-UPGRADE-002: #responderSealSubmitted was set synchronously at the top of this method —
-            // the guard now blocks any second submit (auto-ack OR a redelivered counterparty SEAL ctrl leaf).
-            return { ok: true, sequenceNumber: result.sequence_number, reportedRootHex };
+                throw err;
+            }
         }
-        catch (err) {
-            this.#responderSealSubmitted.delete(sealKey);
-            throw err;
+        finally {
+            releaseDetached();
         }
     }
     /**
@@ -6240,7 +7829,12 @@ export class SessionNodeManager {
                 // one that does not repair: this side declined the salt permanently for this session, so
                 // waiting for a reconnect is exactly the wrong advice. Leaving it out of this list would
                 // have sent an operator to look for a read failure that is not there and never will be.
-                guidance: "Look for session.salt.adoption.refused first: if it is there, this side declined the salt because the session had already hashed messages, that is permanent for this session, and reconnecting will NOT fix it — close the session and start a new one. Otherwise look for session.salt.read.failed or session.salt.persist.failed. If either is present the agreement re-runs on the next reconnect and this repairs itself — wait for that before doing anything. If none of the three is present, the agreement never completed with this counterparty: close the session and start a new one. In every case the transcript up to here is intact.",
+                // DOD-M15-SALTSPLIT-1 review MEDIUM-3: `session.salt.discarded` is the FIFTH cause, and it
+                // was added by the discard without appearing in this tree. Without it an operator whose salt
+                // was deliberately dropped is sent to look for three events that will not be there and then
+                // told a fifth thing that is false — the agreement DID complete here, and was then undone on
+                // purpose.
+                guidance: "Look for session.salt.discarded first: if it is there, this side dropped its salt because the counterparty said it could never hold one, the agreement did complete and was deliberately undone, and a new session is the repair. Otherwise look for session.salt.adoption.refused: if it is there, this side declined the salt because the session had already hashed messages, that is permanent for this session, and reconnecting will NOT fix it — close the session and start a new one. Otherwise look for session.salt.read.failed or session.salt.persist.failed. If either is present the agreement re-runs on the next reconnect and this repairs itself — wait for that before doing anything. If none of the four is present, the agreement never completed with this counterparty: close the session and start a new one. In every case the transcript up to here is intact.",
             });
             // DOD-M15-REFUSED-INBOUND-SILENT-1 — and this branch needed it MORE than the two that had it.
             //
@@ -6258,7 +7852,7 @@ export class SessionNodeManager {
             // copy is a second thing to keep true, and the log's version is the one that gets maintained.
             this.noteContentRefusal(agentName, sessionId, "content_hash_salt_unavailable", {
                 impact: "this message could not be verified — the sender says it is salted and this side holds no salt for the session — so it was NOT ingested and NOT shown. This session will not auto-co-sign at close.",
-                guidance: "If this side refused the salt because the session had already hashed messages, that is PERMANENT for this session and reconnecting will not fix it — close the session and start a new one. Otherwise the salt agreement re-runs on the next reconnect and this repairs itself. Check session.salt.adoption.refused in the log to tell which. The transcript up to here is intact either way.",
+                guidance: "If session.salt.discarded is present, this side dropped its salt on purpose because the counterparty said it could never hold one — a new session is the repair. If this side refused the salt because the session had already hashed messages, that is PERMANENT for this session and reconnecting will not fix it — close the session and start a new one. Otherwise the salt agreement re-runs on the next reconnect and this repairs itself. Check session.salt.discarded and session.salt.adoption.refused in the log to tell which. The transcript up to here is intact either way.",
             });
             return { ok: false, reason: "content_hash_salt_unavailable" };
         }
@@ -7128,14 +8722,39 @@ export class SessionNodeManager {
             // Two correct changes, each fine alone, that break where they meet. Caught by running the
             // live enforcers straight after merging main rather than trusting a green unit suite.
             this.#witnessedSeq.get(this.#k(agentName, sessionId))?.delete(contentHashHex);
+            /**
+             * ⚠️ THIS LINE USED TO LOG `ok: routed.ok` AND `reason: routed.reason`, AND NEITHER CAN EVER
+             * BE PRESENT HERE. Removed rather than left, because their absence was read as evidence.
+             *
+             * The producer is `DocumentFrameRouter.routeSync`, and it has four returns — `unshaped`,
+             * `undecodable`, `owner_unresolved`, and the normal path — **none of which sets either
+             * field.** It cannot: the normal path is `void this.#enqueue(...)`, fire-and-forget, so at the
+             * instant this line is written the frame has been CLASSIFIED and QUEUED and nothing has yet
+             * decided whether it will be accepted. The verdict is genuinely not knowable here.
+             *
+             * **What that cost:** `j-stale-session` reported `framesReceived=3 inbound=0`, and the
+             * investigation recorded that `ok` and `reason` were "ABSENT from every line in the run — so
+             * the router returned neither, which is itself the next thread to pull: a routing result that
+             * reports no outcome cannot say whether it accepted or dropped the frame." That thread leads
+             * nowhere. The router did not fail to report an outcome; **it has no outcome to report at this
+             * point in the flow**, and a JSON logger omits an `undefined` field, so a structural absence
+             * looked exactly like a fault. A field that can never be populated is worse than no field.
+             *
+             * **Where the verdict actually lands**, named here so the next reader does not have to find it
+             * the hard way: a refusal is `document.frame.refused` (warn, carrying `kind` + `reason`,
+             * emitted from `#enqueue`'s continuation under the same `correlationId`). Acceptance is
+             * silent on this event. So "was this frame ingested?" is answered by joining on
+             * `correlationId`, never by reading this line alone.
+             */
             this.#logger.info("session.document.received", {
                 sessionId,
                 senderPubkey,
                 contentHashHex,
                 sequenceNumber: leafIndex,
                 kind: routed.kind,
-                ok: routed.ok,
-                reason: routed.reason,
+                // The verdict is asynchronous. Stated positively so absence is not mistaken for silence.
+                dispatch: "queued",
+                verdictEvent: "document.frame.refused",
                 correlationId,
             });
             return { leafIndex };
@@ -7481,7 +9100,35 @@ export class SessionNodeManager {
      * and it appends in arrival order as before: with no position there is no discipline to enforce,
      * and refusing would take messaging down whenever the relay is unreachable.
      */
-    placeOwnLeaf(agentName, sessionId, contentHashHex, sentBytes, assignedSeq, correlationId, kind = "msg") {
+    placeOwnLeaf(agentName, sessionId, contentHashHex, sentBytes, assignedSeq, correlationId, 
+    /**
+     * ⚠️ NO DEFAULT, for the same reason `authorship` has none.
+     *
+     * `kind = "msg"` meant a caller writing a `doc` or a `ctrl` leaf got a `msg` leaf by saying
+     * nothing, and the tree recorded a leaf kind the author never chose. TypeScript also forbids a
+     * required parameter after a defaulted one, so leaving the default here would have forced
+     * `authorship` back to optional — which is the defect above. Every one of the seven call sites
+     * already passed a kind or wanted "msg"; making it explicit cost nothing and removes a second
+     * silent answer from the same signature.
+     */
+    kind, 
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 5 — the proof for THIS send, so a held row keeps it.
+     *
+     * ⚠️ REQUIRED, AND `undefined` IS A VALID ANSWER — the two are not the same thing.
+     *
+     * This was `authorship?:` for exactly one review cycle, and in that cycle THREE of the seven
+     * call sites omitted it: `daemon.ts` 1440, 1671, 1685 — the away-reply path, which is the
+     * highest-traffic sent-writer in the daemon and the one with no human watching it. All three
+     * had the proof **already in a local variable one line below**, handed to
+     * `recordTranscriptMessage` and not to this method. Nothing went red, because an optional
+     * parameter's whole behaviour on omission is to look deliberate.
+     *
+     * An unwitnessed send genuinely has no proof, so absence must stay expressible. Requiring the
+     * parameter keeps that while making the caller SAY it: omission is now a type error, and
+     * `undefined` is a claim the author made rather than one the signature made for them.
+     */
+    authorship) {
         // Hydrate before reading the frontier: a durable hold this process has not read back yet would
         // make the tree look further along than it is.
         this.#ensureHeldRestored(agentName, sessionId);
@@ -7551,7 +9198,7 @@ export class SessionNodeManager {
             held = new Map();
             this.#heldContent.set(key, held);
         }
-        held.set(assignedSeq, { content: sentBytes, contentHashHex, correlationId, origin: "sent", kind });
+        held.set(assignedSeq, { content: sentBytes, contentHashHex, correlationId, origin: "sent", kind, ...(authorship ? { authorship } : {}) });
         this.#persistHeldContent(agentName, sessionId, assignedSeq, sentBytes, sentBytes, contentHashHex, false, correlationId, "sent", kind);
         this.#logger.info("session.content.held", {
             sessionId, canonicalSeq: assignedSeq, nextExpected, gap: assignedSeq - nextExpected,
@@ -7731,6 +9378,24 @@ export class SessionNodeManager {
                 ...(row.screened_out ? { screenedOut: true } : {}),
                 ...(row.origin === "sent" ? { origin: "sent" } : {}),
                 ...(row.leaf_kind === "doc" ? { kind: "doc" } : {}),
+                /**
+                 * ⚠️ `restoredAcrossRestart` EXISTS TO NAME A LOSS, NOT TO CHANGE BEHAVIOUR — review pass 2, H1.
+                 *
+                 * `held_content` has no authorship columns, so a SENT message held behind a gap and released
+                 * after a daemon restart comes back with **no signature** — its transcript row records
+                 * `self_authored` with no proof, indistinguishable from an unwitnessed send. That is the
+                 * defect bullet 5 exists to end, reappearing on the recovery path, and it was silent.
+                 *
+                 * The proof cannot be reconstructed here: it was made over Structure-1 bytes this process no
+                 * longer holds. **So the honest move is to say so, not to fabricate one** — a proof that
+                 * cannot be checked, presented as one that can, is worse than the absence.
+                 *
+                 * Two BLOB columns would close it properly (this table already carries two `ALTER TABLE …
+                 * ADD COLUMN` migrations, so the pattern exists). Under a frozen gate a log is additive and
+                 * tightenable where a schema change is neither, so this announces the loss now and
+                 * `DOD-M15-HELD-AUTHORSHIP-1` carries the column.
+                 */
+                restoredAcrossRestart: true,
             });
             restored++;
         }
@@ -7794,7 +9459,25 @@ export class SessionNodeManager {
                 // OBSERVED, not assumed — the received path already does this. The leaf commits either way,
                 // so a dropped transcript write means the operator's OWN message is missing from their own
                 // transcript with the chain saying it is there, and nothing anywhere said so.
-                if (!this.recordTranscriptMessage(agentName, sessionId, nextExpected, "sent", entry.content, entry.correlationId)) {
+                // bullet 5: the proof was captured at submit time and rides the held entry — see #heldContent.
+                /**
+                 * THE RESTART LOSS, ANNOUNCED — review pass 2, H1. Only for an entry that actually crossed a
+                 * restart: an in-memory held entry carries its proof, and an unwitnessed send legitimately
+                 * has none, so warning on every absent proof would fire on a designed benign state and bury
+                 * the one occurrence that means something.
+                 */
+                if (entry.restoredAcrossRestart === true && entry.authorship === undefined) {
+                    this.#logger.warn("session.content.released.authorship.lost", {
+                        agentName, sessionId, sequenceNumber: nextExpected, correlationId: entry.correlationId,
+                        impact: "this message was held behind a gap, survived a daemon restart, and is now committed with " +
+                            "attribution 'self_authored' and NO signature. Its transcript row asserts its author rather " +
+                            "than proving one, and is indistinguishable from a send the relay never witnessed.",
+                        guidance: "Not recoverable after the fact — the signature covered Structure-1 bytes this process no longer " +
+                            "holds, and fabricating one would be worse than the absence. Tracked as DOD-M15-HELD-AUTHORSHIP-1: " +
+                            "held_content needs the two proof columns so a restart carries them.",
+                    });
+                }
+                if (!this.recordTranscriptMessage(agentName, sessionId, nextExpected, "sent", entry.content, entry.correlationId, entry.authorship)) {
                     this.#logger.error("session.content.released.transcript.failed", {
                         agentName, sessionId, sequenceNumber: nextExpected, correlationId: entry.correlationId,
                         impact: "this side's own message is committed to the chain but missing from its transcript",
@@ -8269,13 +9952,22 @@ export class SessionNodeManager {
          * is correct today rather than an oversight.
          *
          * The park envelope has no field for one, so this passes `undefined`, which resolves to
-         * `sha256`. In part B1 that is exactly right and provably so: **no sender salts yet**, so every
-         * parked entry in existence was hashed unsalted.
+         * `sha256`. In part B1 that was exactly right and provably so: no sender salted, so every parked
+         * entry in existence had been hashed unsalted.
          *
          * ✅ FIXED IN PART B2a, at BOTH sites: here, and the independent verifier in `content-park.ts`.
          * The envelope carries the algorithm from v3 onward, and a v2 envelope's absent field resolves to
-         * `sha256` — which is what a peer predating the field actually used. Every envelope this build
-         * emits is still v2, because nothing salts yet.
+         * `sha256` — which is what a peer predating the field actually used.
+         *
+         * > **⛔ THE LAST SENTENCE HERE READ "Every envelope this build emits is still v2, because
+         * > nothing salts yet." THAT IS FALSE NOW.** B2b-2 turned salting on: a session holding an
+         * > agreed salt hashes under `hmac-sha256-salt-v1`, so this build DOES emit v3 envelopes.
+         * > Rewritten rather than deleted, per `DOD-M15-CLAIM-COMMENTS-1` — the sentence is why the
+         * > staleness survived, and an absence would read as deliberate.
+         * >
+         * > The consequence is not theoretical: a v2 envelope carrying a SALTED hash recomputes unsalted
+         * > at the far end and reports `content_hash_mismatch` — a false tamper claim on honest content,
+         * > which also blocks auto-co-sign at seal. Measured on 2026-08-24.
          *
          * ─── AND THE REFUSAL DOES NOT HOLD — review F2 ────────────────────────────────────────────
          *
@@ -8491,6 +10183,401 @@ export class SessionNodeManager {
      * obvious place to put one. A session that shipped it there could not be repaired: the relay
      * would already hold the salt and every hash it protects.
      */
+    /**
+     * MINT THIS SESSION'S THROWAWAY KEYPAIR — once, at the moment the session becomes active.
+     *
+     * Idempotent on purpose. Three paths make a session active (open, hand-off from the standing
+     * receiver, revive) and a reconnect can re-enter them; minting a second keypair mid-session would
+     * leave the two sides deriving against a moving value, and the symptom — a session that reconnects
+     * and still cannot agree — reads as a network fault rather than as a bug here. `#saltContributionFor`
+     * mints once for exactly the same reason.
+     *
+     * A REVIVED session is not an exception, and this guard is why it took a fix to make that true.
+     * Revival requires status `interrupted`, and the producer of `interrupted` drops the entry without
+     * evicting — so while the secret outlived that path, this guard found it still present and
+     * silently kept a key that had been resident for hours, on the one path where re-keying was
+     * explicitly decided. The interrupt path now destroys it, so the map really is empty by the time
+     * a revival reaches here and it mints fresh (Decisions Carried #5).
+     */
+    #mintSessionEphemeral(agentName, sessionId, correlationId) {
+        const key = this.#k(agentName, sessionId);
+        if (this.#sessionEphemerals.has(key))
+            return;
+        this.#sessionEphemerals.set(key, generateSessionEphemeral());
+        this.#logger.debug("session.ephemeral.minted", {
+            agentName, sessionId, correlationId,
+            // The PUBLIC half only, and only a prefix of it. The secret must never reach a log line, and
+            // an operator correlating two daemons needs an identifier rather than the value.
+            publicKeyPrefix: Buffer.from(this.#sessionEphemerals.get(key).publicKey.subarray(0, 8)).toString("hex"),
+        });
+    }
+    /**
+     * DESTROY THIS SESSION'S THROWAWAY SECRET — 006-CRYPTO, and this is what forward secrecy IS.
+     *
+     * ⚠️ CALLED FROM EVERY SITE THAT DROPS THE `#activeNodes` ENTRY, not from `#evictSessionCaches`,
+     * and review pass 2 finding 2 is why. The first version rode the evict, which sounded right and
+     * was wrong on the path an interrupted session actually takes:
+     *
+     *   `markInterruptedWithDetails` drops the entry and DELIBERATELY does not evict — the received
+     *   plaintext has to stay drainable and the TTF park timers have to stay armed. So the secret
+     *   survived. Then, when that session later sealed, `destroySessionNode` returned at its
+     *   `if (!entry) return` — the entry was already gone — and never reached the evict either. The
+     *   receipt landed, the session was over, and the secret stayed resident until the process exited.
+     *
+     * A relay blip is the ORDINARY way a session ends badly, so that was the common path, not a corner.
+     * The evict's reasons for keeping the other caches are real and do not transfer: buffered plaintext
+     * must stay readable, and a secret nothing reads must not stay alive.
+     *
+     * Zero THEN drop. Dropping alone leaves the bytes wherever the collector last moved them;
+     * `destroySessionEphemeral` overwrites the one copy this process controls.
+     */
+    #destroySessionEphemeralFor(agentName, sessionId, correlationId) {
+        const key = this.#k(agentName, sessionId);
+        // 007-CRYPTO: the AGREED KEY goes with the ephemeral it was derived from. It is the same secret
+        // one step on — leaving it behind would keep the thing the destruction exists to remove.
+        const agreed = this.#sessionContentKeys.get(key);
+        if (agreed) {
+            agreed.fill(0);
+            this.#sessionContentKeys.delete(key);
+        }
+        this.#sessionContentKeyPeerHalf.delete(key);
+        this.#contentEncryptionReasons.delete(key);
+        const ephemeral = this.#sessionEphemerals.get(key);
+        if (!ephemeral)
+            return;
+        destroySessionEphemeral(ephemeral);
+        this.#sessionEphemerals.delete(key);
+        this.#logger.debug("session.ephemeral.destroyed", { agentName, sessionId, correlationId });
+    }
+    /**
+     * AN INBOUND SIGNED EPHEMERAL — verify, THEN derive. Never the other way round.
+     *
+     * 🚨 A FAILED VERIFICATION IS A SECURITY EVENT AND IT STOPS THE SESSION. It is not a degradation
+     * to unencrypted, and the difference is the whole unit: an unsigned or wrongly-signed key is what
+     * a relay substituting its own looks like, and carrying on unencrypted would hand that relay
+     * exactly the plaintext it was reaching for. Missing, malformed and mismatched take this same
+     * path — a check that is lenient about a missing proof is a check an attacker skips.
+     *
+     * Contrast with a peer that says NOTHING at all: that is an old build, it is not evidence of
+     * anything about them, and it is recorded as `PEER_SILENT` — which still blocks sending, because
+     * there is no unencrypted path to fall back to.
+     */
+    async #handleEphemeralFrame(agentName, sessionId, frame, correlationId) {
+        const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+        if (!entry)
+            return;
+        /**
+         * THE IDENTITY WE EXPECT is the session's own counterparty record — and its provenance differs
+         * by side, which review F10 measured and an earlier version of this comment overstated.
+         *
+         *   INITIATOR: what the OPERATOR asked for (`initiate-session-handler` takes `target_pubkey`).
+         *   RESPONDER: the initiator identity the DIRECTORY attested in the offer/assignment.
+         *
+         * So this binds the ephemeral to that identity, whichever it is. The attack it closes is the
+         * RELAY substituting its own key — a different actor from the directory — and that is closed in
+         * both directions. What it does NOT do is move the responder's trust off the directory; the
+         * inbound path says as much itself ("a single compromised directory still controls both frames
+         * here"), and that is a separate line.
+         *
+         * The distinction is written down rather than smoothed over because this is a public repo and
+         * the sentence it replaces — "never from anything the directory handed back" — was absolute and
+         * false on one of the two sides.
+         */
+        const expected = Buffer.from(entry.counterpartyPubkey, "hex");
+        const sessionIdBytes = Buffer.from(sessionId, "hex");
+        const verdict = verifySessionEphemeral({
+            expectedIdentityPublic: new Uint8Array(expected),
+            sessionId: sessionIdBytes,
+            peerEphemeralPublic: frame.ephemeralPublic,
+            peerSignature: frame.signature,
+        });
+        if (!verdict.ok) {
+            this.#logger.error("session.key.refused", {
+                agentName, sessionId, correlationId,
+                reason: verdict.reason,
+                detail: verdict.detail,
+                guidance: "STOPPED ON PURPOSE. The session key your counterparty sent could not be tied to them, so " +
+                    "this session has been stopped rather than continued in the open. The ordinary cause is a " +
+                    "build mismatch; the one that matters is something in the middle of your connection " +
+                    "substituting its own key so it can read what you send. Confirm with your counterparty OUT " +
+                    "OF BAND — not over CELLO — before opening another session with them.",
+            });
+            // Session-ending, not per-message: one proven wrong signer is evidence about the CONNECTION,
+            // not about the frame that carried it.
+            await this.#freezeSessionForKeyRefusal(agentName, sessionId, verdict.reason, correlationId);
+            return;
+        }
+        /**
+         * ALREADY AGREED WITH **THIS** PEER HALF — idempotence keyed on the bytes, not on presence.
+         *
+         * ⚠️ KEYING IT ON PRESENCE WAS A DEFECT, and a routine relay roll was enough to trigger it.
+         * Only the side whose witness stream closed interrupts, so only that side destroys its key and
+         * re-keys on revival. The OTHER side is never torn down — nothing else clears this map — so it
+         * saw the peer's NEW ephemeral, found a key already present, and kept the old one.
+         *
+         * Two different keys, and the damage is worse than a dead path: every message then fails GCM,
+         * and the receiving daemon reports *"the message did not decrypt — it was modified in flight, or
+         * encrypted under a different key"* and tells the operator to confirm OUT OF BAND. Nothing was
+         * modified. Two people have a security conversation about a local key skew.
+         *
+         * I MEASURED THIS TWICE AND CALLED IT A HARNESS QUIRK — the notes in `seam-4` and `m9-core-001`
+         * about seeding "before the settle" leaving the two ends on different keys are this defect,
+         * observed and worked around instead of read.
+         *
+         * So: the same half re-announced on every connect is still a no-op, and a DIFFERENT half — which
+         * only a re-keying peer sends — is adopted. The peer is identity-authenticated by the time we
+         * get here, so letting them move the key is not a new capability.
+         */
+        const peerHalfHex = Buffer.from(frame.ephemeralPublic).toString("hex");
+        if (this.#sessionContentKeyPeerHalf.get(this.#k(agentName, sessionId)) === peerHalfHex)
+            return;
+        const ownEphemeral = this.#sessionEphemeralFor(agentName, sessionId);
+        if (!ownEphemeral) {
+            this.#logger.error("session.key.refused", {
+                agentName, sessionId, correlationId, reason: "no_local_ephemeral",
+                detail: "the peer's key verified but this side holds no throwaway keypair to agree with, so nothing can be derived. This is a LOCAL defect, not something the peer did.",
+            });
+            this.#noteContentEncryptionReason(agentName, sessionId, CONTENT_ENCRYPTION_REASONS.OUR_ANNOUNCE_FAILED);
+            return;
+        }
+        try {
+            const secrets = deriveSessionSecrets({
+                ownEphemeralSecret: ownEphemeral.secretKey,
+                peerEphemeralPublic: frame.ephemeralPublic,
+                sessionId: sessionIdBytes,
+            });
+            const prior = this.#sessionContentKeyPeerHalf.get(this.#k(agentName, sessionId));
+            this.#sessionContentKeys.set(this.#k(agentName, sessionId), secrets.contentKey);
+            this.#sessionContentKeyPeerHalf.set(this.#k(agentName, sessionId), peerHalfHex);
+            this.#contentEncryptionReasons.delete(this.#k(agentName, sessionId));
+            this.#logger.info("session.key.agreed", {
+                agentName, sessionId, correlationId,
+                // A RE-KEY is a different event from a first agreement and an operator correlating two
+                // daemons needs to tell them apart: a re-key means the other side restarted.
+                rekey: prior !== undefined && prior !== peerHalfHex,
+                impact: "message bodies on this session are now encrypted by CELLO under a key both sides agreed and neither sent, and which is destroyed when the session ends",
+            });
+        }
+        catch (err) {
+            // The primitive owns every rule about the peer's half — a degenerate point, a non-canonical
+            // encoding, a reflection — and owns the WORDING. Substituting a code of our own here would
+            // destroy the only explanation that exists at the only moment anyone reads it.
+            this.#logger.error("session.key.refused", {
+                agentName, sessionId, correlationId, reason: "derivation_failed",
+                detail: err instanceof Error ? err.message : String(err),
+            });
+            await this.#freezeSessionForKeyRefusal(agentName, sessionId, "derivation_failed", correlationId);
+        }
+    }
+    /**
+     * Stop a session whose counterparty's key could not be tied to them.
+     *
+     * Reuses the identity-freeze machinery rather than inventing a second way for a session to stop:
+     * the operator-facing shape, the refusal-to-revive, and the status write are already right there,
+     * and a second mechanism is a second thing to keep correct.
+     */
+    async #freezeSessionForKeyRefusal(agentName, sessionId, reason, correlationId) {
+        /**
+         * THE REASON IS RECORDED BEFORE THE TEARDOWN, AND SURVIVES IT — review F2.
+         *
+         * The teardown destroys this session's key material and used to clear the reason with it, so the
+         * listing recomputed `NOT_YET_AGREED` and the agent was told *"still agreeing its key, sending is
+         * held"* — a reassurance, for the one detection in this unit that means someone may be
+         * substituting keys on the connection. Its only real consumer was a log line.
+         */
+        this.#noteContentEncryptionReason(agentName, sessionId, CONTENT_ENCRYPTION_REASONS.KEY_REFUSED);
+        /**
+         * ⚠️ `"key_refused"`, NOT `"stream_close"` — review F3, and this is error substitution of the
+         * exact kind Invariant 3 names. `stream_close` is written to the row as
+         * `interrupted_by = 'relay_stream_close'`, so a key-authentication refusal was durably recorded
+         * as a relay problem and an operator debugging it would go and look at the relay fleet.
+         */
+        const stopped = await this.markInterruptedWithDetails(agentName, sessionId, 0, "key_refused");
+        /**
+         * OBSERVE THE OUTCOME rather than asserting it — review F11. `markInterruptedWithDetails`
+         * returns early when the row is not `active`, so claiming "the session was stopped" here
+         * unconditionally would state something that did not happen.
+         */
+        this.#logger.error("session.key.session_stopped", {
+            agentName, sessionId, correlationId, reason,
+            stopped,
+            impact: stopped
+                ? "the session was stopped rather than continued unencrypted; a substituted key would otherwise have been handed exactly the plaintext it was reaching for"
+                : "the session was already not active, so nothing was torn down here — the refusal stands and no content was accepted",
+            guidance: CONTENT_ENCRYPTION_GUIDANCE[CONTENT_ENCRYPTION_REASONS.KEY_REFUSED],
+        });
+    }
+    /**
+     * Test seam: see every decoded inbound content frame, as it arrived.
+     *
+     * Review F4. The "bytes on the wire are ciphertext" claim needs the ACTUAL frame; asserting on a
+     * freshly sealed stand-in tests the crypto primitive and stays green when the send path is
+     * reverted to putting plaintext on the wire. There is no other way to reach the decoded frame from
+     * outside — the handler consumes it and hands ingest the plaintext.
+     *
+     * Read-only by construction: the callback receives the frame and cannot influence routing.
+     */
+    observeInboundContentFramesForTest(cb) {
+        this.#inboundFrameObserver = cb;
+    }
+    /** Injected by the daemon once its per-agent key providers exist. See `#keyProviderResolver`. */
+    setKeyProviderResolver(resolver) {
+        this.#keyProviderResolver = resolver;
+    }
+    /**
+     * The agreed content key for a session, or `null` with the reason there is none.
+     *
+     * ONE place decides this, so the send path, the receive path and the status surface cannot
+     * disagree about whether a session is encrypted — the failure `wire-content-hash.ts` already
+     * records for the hash, where the expression was written out at five call sites and the two added
+     * last got it wrong.
+     */
+    #contentEncryptionState(agentName, sessionId) {
+        const k = this.#k(agentName, sessionId);
+        const agreed = this.#sessionContentKeys.get(k);
+        if (agreed)
+            return { key: agreed };
+        // No recorded fault means the exchange simply has not finished yet — the ordinary state in the
+        // instant between a session opening and its first connect completing.
+        return { key: null, reason: this.#contentEncryptionReasons.get(k) ?? CONTENT_ENCRYPTION_REASONS.NOT_YET_AGREED };
+    }
+    #noteContentEncryptionReason(agentName, sessionId, reason) {
+        const k = this.#k(agentName, sessionId);
+        // FIRST reason wins. A later, vaguer one must not overwrite the specific cause already recorded
+        // — "they never answered" written over "we could not sign" points the operator at the wrong
+        // machine, which is the substitution this closed set exists to end.
+        if (!this.#contentEncryptionReasons.has(k))
+            this.#contentEncryptionReasons.set(k, reason);
+    }
+    /**
+     * ANNOUNCE THIS SIDE'S SIGNED EPHEMERAL — `DOD-M15-EPHEMERAL-AUTH-1`.
+     *
+     * 🚨 ON THE PEER-TO-PEER CONTENT STREAM ONLY, exactly like the salt contribution and for the same
+     * unrepairable reason: it rides circuit-relay-v2 carrying its own Noise session, so a forwarding
+     * relay sees ciphertext. It must NEVER be added to `session_offer` / `session_offer_accept` or
+     * anything a DIRECTORY brokers — and that is the trap, because the only round trip at session open
+     * is the directory's signaling stream.
+     *
+     * Fire-and-forget on the connect handler, like the salt: a failed announcement must not turn a
+     * peer-connect handler into a rejected promise, and we re-announce on the next connect.
+     */
+    async #sendEphemeralFrame(agentName, sessionId, correlationId) {
+        const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+        if (!entry)
+            return;
+        const ephemeral = this.#sessionEphemeralFor(agentName, sessionId);
+        if (!ephemeral) {
+            this.#logger.error("session.key.announce.failed", {
+                agentName, sessionId, correlationId, reason: "no_ephemeral",
+                impact: "this session is active with no throwaway keypair, so there is nothing to announce; content stays unencrypted by CELLO",
+            });
+            this.#noteContentEncryptionReason(agentName, sessionId, CONTENT_ENCRYPTION_REASONS.OUR_ANNOUNCE_FAILED);
+            return;
+        }
+        const signer = this.#keyProviderResolver?.(agentName);
+        if (!signer) {
+            /**
+             * A LOCAL fault, and it is named as one. Without this branch the peer simply never hears from
+             * us and blames a build that is fine — the operator whose machine cannot sign reads a message
+             * about their counterparty, which is the exact substitution the salt work already paid for.
+             */
+            this.#logger.error("session.key.announce.failed", {
+                agentName, sessionId, correlationId, reason: "no_identity_key",
+                impact: "this machine has no identity key for the agent, so it cannot sign its half of the session key; every session it opens is unencrypted by CELLO and the counterparty is not involved",
+                guidance: CONTENT_ENCRYPTION_GUIDANCE[CONTENT_ENCRYPTION_REASONS.NO_LOCAL_IDENTITY],
+            });
+            this.#noteContentEncryptionReason(agentName, sessionId, CONTENT_ENCRYPTION_REASONS.NO_LOCAL_IDENTITY);
+            return;
+        }
+        let stream = null;
+        try {
+            const sessionIdBytes = Buffer.from(sessionId, "hex");
+            const signature = await signSessionEphemeral(signer, sessionIdBytes, ephemeral.publicKey);
+            stream = await entry.node.newStream(entry.counterpartySessionPeerId, CELLO_CONTENT_PROTOCOL_ID);
+            stream.send(lp.encode.single(encodeCbor({
+                type: "session_key_agreement",
+                session_id: sessionId,
+                ephemeral_public: ephemeral.publicKey,
+                ephemeral_sig: signature,
+            })).subarray());
+            await stream.close();
+            this.#logger.debug("session.key.announced", {
+                agentName, sessionId, correlationId,
+                publicKeyPrefix: Buffer.from(ephemeral.publicKey.subarray(0, 8)).toString("hex"),
+            });
+        }
+        catch (err) {
+            // The frame never left. Say so as a LOCAL fault rather than letting the session look like a
+            // counterparty on an old build — a re-announce rides the next connect.
+            this.#logger.error("session.key.announce.failed", {
+                agentName, sessionId, correlationId, reason: "stream_failed",
+                error: err instanceof Error ? err.message : String(err),
+                impact: "this side's half of the session key never reached the counterparty, so content stays unencrypted by CELLO until a later connect succeeds",
+            });
+            this.#noteContentEncryptionReason(agentName, sessionId, CONTENT_ENCRYPTION_REASONS.OUR_ANNOUNCE_FAILED);
+            /**
+             * ABORT, don't just close — review F13. A `close()` on a broken stream can itself fail and
+             * leave the slot held, which is the per-protocol stream-cap failure this file's longest
+             * comment documents. Every other failed write on this protocol aborts.
+             */
+            if (stream) {
+                try {
+                    stream.abort(err instanceof Error ? err : new Error(String(err)));
+                }
+                catch { /* already gone */ }
+            }
+            /**
+             * AND RETRY — review F5, and without it a single failed stream open kills encryption for the
+             * life of the session.
+             *
+             * The announce otherwise rides `onPeerConnect` only. If the connection then stays up there is
+             * no next connect, so nothing re-announces, every send parks forever, and the guidance's
+             * "it re-announces on the next connect" names an event that never arrives. It also compounds
+             * the re-key path: a revived session announces its FRESH half exactly once, and if that one
+             * attempt loses the race with the reconnect, the two ends sit on different keys.
+             *
+             * Bounded and self-cancelling: it stops when the session is no longer active, when a key has
+             * been agreed, and after `SESSION_KEY_ANNOUNCE_RETRIES` attempts.
+             */
+            this.#retryEphemeralAnnounce(agentName, sessionId, correlationId, 1);
+        }
+    }
+    /**
+     * Re-announce this side's ephemeral after a failed attempt — review F5.
+     *
+     * Backs off, and gives up rather than looping: a peer that is simply gone must not have a timer
+     * chasing it for the life of the process.
+     */
+    #retryEphemeralAnnounce(agentName, sessionId, correlationId, attempt) {
+        if (attempt > SESSION_KEY_ANNOUNCE_RETRIES) {
+            this.#logger.warn("session.key.announce.gave_up", {
+                agentName, sessionId, correlationId, attempts: SESSION_KEY_ANNOUNCE_RETRIES,
+                impact: "this side never managed to send its half of the session key, so every message on this session takes the relay mailbox instead of the direct path",
+                guidance: CONTENT_ENCRYPTION_GUIDANCE[CONTENT_ENCRYPTION_REASONS.OUR_ANNOUNCE_FAILED],
+            });
+            return;
+        }
+        const timer = setTimeout(() => {
+            // Stop if the session went away, or if a key has since been agreed by any route.
+            if (!this.#activeNodes.has(this.#k(agentName, sessionId)))
+                return;
+            if (this.#sessionContentKeys.has(this.#k(agentName, sessionId)))
+                return;
+            void this.#sendEphemeralFrame(agentName, sessionId, correlationId);
+        }, SESSION_KEY_ANNOUNCE_RETRY_MS * attempt);
+        // Never hold the process open for a retry.
+        if (typeof timer.unref === "function")
+            timer.unref();
+    }
+    /**
+     * Our throwaway keypair for a session, WITHOUT minting one — the read-only counterpart.
+     *
+     * `null` means the session is not active here. It never means "mint one now": minting outside
+     * `#mintSessionEphemeral` is how a second keypair appears mid-session.
+     */
+    #sessionEphemeralFor(agentName, sessionId) {
+        return this.#sessionEphemerals.get(this.#k(agentName, sessionId)) ?? null;
+    }
     #saltContributionFor(agentName, sessionId) {
         const key = this.#k(agentName, sessionId);
         let contribution = this.#saltContributions.get(key);
@@ -8542,6 +10629,114 @@ export class SessionNodeManager {
     setSaltContributionForTest(agentName, sessionId, contribution) {
         this.#saltContributions.set(this.#k(agentName, sessionId), contribution);
     }
+    /**
+     * Test seams: re-enter the mint path, and read back the PUBLIC half — 006-CRYPTO.
+     *
+     * `#mintSessionEphemeral` is idempotent because a reconnect can re-enter an activation path, and a
+     * second keypair mid-session would leave the two sides deriving against a moving value. Proving
+     * that needs the path called TWICE, and the alternative — driving a real reconnect — drags in node
+     * rebuild and relay reconnection, none of which the property is about. Same justification as
+     * `forgetSaltContributionForTest` above.
+     *
+     * It calls the REAL private method, so a test cannot pass against a decision production does not
+     * make. The reader returns the public half ONLY: a seam that could hand out the secret is a way
+     * for the secret to leave this object, which is the one thing the whole unit is about.
+     */
+    mintSessionEphemeralForTest(agentName, sessionId) {
+        this.#mintSessionEphemeral(agentName, sessionId);
+    }
+    sessionEphemeralPublicForTest(agentName, sessionId) {
+        const e = this.#sessionEphemeralFor(agentName, sessionId);
+        return e ? Uint8Array.from(e.publicKey) : null;
+    }
+    /**
+     * Test seam: INSTALL a keypair the caller already holds — the only way to prove ZEROING.
+     *
+     * Presence is easy to assert and is not the property. `destroySessionEphemeral` overwrites the
+     * buffer before the entry is dropped, and a mutant that drops without overwriting leaves the
+     * secret wherever the collector last moved it while passing every presence check — which is
+     * exactly what happened: the shutdown zeroing shipped with a surviving mutant, and the transport
+     * seeds four lines above it have the same untested gap today.
+     *
+     * The direction matters. Nothing here HANDS OUT a secret — the test supplies an object it already
+     * owns and then inspects its own reference. A reader that returned the live keypair would be a
+     * path for the secret to leave this object, which is the one thing this unit exists to prevent.
+     */
+    setSessionEphemeralForTest(agentName, sessionId, ephemeral) {
+        this.#sessionEphemerals.set(this.#k(agentName, sessionId), ephemeral);
+    }
+    /**
+     * Test seam: put a session into the state a COMPLETED exchange leaves it in — 007-CRYPTO.
+     *
+     * A live send now requires an agreed key, because there is no plaintext path to fall back to. In
+     * production the exchange completes on connect, before any send. A fixture with no real peer never
+     * completes it, so without this every content test in the repo would be exercising the refusal
+     * path instead of the thing it was written for.
+     *
+     * ⚠️ IT SHORT-CIRCUITS HOW THE KEY GOT THERE, NEVER WHAT THE KEY IS FOR. The state it produces —
+     * a session holding an agreed content key — is exactly the production state, which is what makes
+     * it legitimate; `setSaltContributionForTest` exists for the same reason. Tests of the EXCHANGE
+     * itself drive the real signed frames and must not use this.
+     */
+    setSessionContentKeyForTest(agentName, sessionId, key) {
+        this.#sessionContentKeys.set(this.#k(agentName, sessionId), Uint8Array.from(key));
+        this.#contentEncryptionReasons.delete(this.#k(agentName, sessionId));
+    }
+    /**
+     * Test seam: drop the agreed key while leaving the session up — the state before an exchange
+     * completes, and after a teardown evicts one. Its mirror above is what a completed exchange
+     * leaves; both are needed, or a status field stuck in one position passes either test alone.
+     */
+    forgetSessionContentKeyForTest(agentName, sessionId) {
+        this.#sessionContentKeys.delete(this.#k(agentName, sessionId));
+    }
+    /**
+     * Test seam: produce THIS side's signed ephemeral, using the manager's own identity resolver.
+     *
+     * For harnesses whose connectivity is one-directional — one side dials, so only one announce ever
+     * lands. Carrying the other side's half across with a REAL signature is what completes the
+     * exchange, and it beats seeding a key: a seeded key has no peer half recorded against it, so the
+     * first genuine announce replaces it and the two ends drift apart (which is correct behaviour —
+     * see the re-key guard — and exactly what made seeding fragile here).
+     *
+     * It signs with the same provider production signs with, so a test cannot pass against a signature
+     * production would have refused.
+     */
+    async signOwnEphemeralForTest(agentName, sessionId) {
+        const eph = this.#sessionEphemeralFor(agentName, sessionId);
+        const signer = this.#keyProviderResolver?.(agentName);
+        if (!eph || !signer)
+            return null;
+        const signature = await signSessionEphemeral(signer, Buffer.from(sessionId, "hex"), eph.publicKey);
+        return { ephemeralPublic: Uint8Array.from(eph.publicKey), signature };
+    }
+    /**
+     * Test seam: deliver a peer's signed ephemeral, exactly as the content-stream decoder does.
+     *
+     * For harnesses whose connectivity is one-directional — one side dials, so only one announce ever
+     * lands — this is what completes the exchange instead of stuffing a key in. It runs the REAL
+     * verification and the REAL derivation, so a test cannot pass against a signature production would
+     * have refused.
+     */
+    async handleEphemeralFrameForTest(agentName, sessionId, frame, correlationId = "test") {
+        await this.#handleEphemeralFrame(agentName, sessionId, frame, correlationId);
+    }
+    /**
+     * Test seam: deliver an inbound salt frame, exactly as the content-stream decoder does.
+     *
+     * 006-CRYPTO finding 2. WHICH of the four reasons the peer gave decides what the operator is told,
+     * and reaching that decision from a test otherwise needs a second live daemon that has closed
+     * adoption for a specific reason — which is not something a counterparty can be asked to do on
+     * demand. The four labels are the whole point of the finding, so they need to be reachable.
+     *
+     * It calls the REAL private handler rather than reproducing its routing, so a test cannot pass
+     * against a decision production does not make. It takes the DECODED frame, so it deliberately
+     * does NOT stand in for the decoder above it — the length and vocabulary checks there have their
+     * own tests driving `handleContentFrameForTest`.
+     */
+    async handleSaltFrameForTest(agentName, sessionId, frame, correlationId = "test") {
+        await this.#handleSaltFrame(agentName, sessionId, frame, correlationId);
+    }
     /**
      * Test seam: drop this session's own half while leaving the stored salt in place — the state every
      * teardown produces, because `#evictSessionCaches` clears the map and the row survives.
@@ -8599,6 +10794,26 @@ export class SessionNodeManager {
     async contentHashForSession(agentName, sessionId, content) {
         const { salt, reason } = await this.#saltForHashing(agentName, sessionId);
         if (salt !== null) {
+            /**
+             * ⚠️ THE SALTED HASH MARKS ITSELF SPENT — `DOD-M15-SALTSPLIT-1` review pass 1, HIGH-2.
+             *
+             * The unsalted branch below has counted itself since review pass 2 F1, for a reason stated
+             * there in full: between hashing and `#trackAwaitingAck` there is a relay round trip, and in
+             * that window leaves, held content and awaiting-ack ALL read zero. **The salted direction was
+             * left with no counterpart**, which was harmless while nothing acted on the answer — and
+             * `#discardUnspentSalt` is the first code that acts on it destructively.
+             *
+             * Without this, a peer's `adoption_closed` frame arriving inside that window finds adoption
+             * "open", discards the salt, and the message already on the wire carries
+             * `content_hash_alg: hmac-salt-v1` with a hash **nobody — including this daemon — can ever
+             * recompute**. The alg is copied verbatim into the parked envelope on TTF expiry, so it
+             * survives the round trip that would otherwise have hidden it.
+             *
+             * A COUNT, not a bit, for the same reason the unsalted side is a count: two connections can be
+             * mid-send at once, and one finishing must not clear the claim the other is still relying on.
+             */
+            const key = this.#k(agentName, sessionId);
+            this.#hashedWithSalt.set(key, (this.#hashedWithSalt.get(key) ?? 0) + 1);
             const alg = CONTENT_HASH_ALGS.HMAC_SALT_V1;
             return { hash: contentHashFor(content, { alg, salt }), alg };
         }
@@ -8625,6 +10840,58 @@ export class SessionNodeManager {
          * run, and the entries then outlive the session they describe. There is also nothing to protect:
          * a session that no longer exists cannot adopt a salt or split a transcript.
          */
+        /**
+         * ⚠️ THE DEFERRED ERASE — `DOD-M15-SALTSPLIT-1`. This is the moment a suspended salt becomes both
+         * harmless to erase and NECESSARY to erase, and it must run BEFORE the count below.
+         *
+         * Harmless: this session has hashed nothing under the salt, which is what let it be suspended.
+         * Necessary: we are about to hash unsalted, and a salt left on disk reads back fine after a
+         * restart — so the next process would hash salted and the transcript would be split down the
+         * middle by a reboot rather than by any frame.
+         *
+         * **Before the `#hashedWithoutSalt` increment on purpose.** `#discardUnspentSalt` refuses to erase
+         * once adoption is closed, and that counter is one of the things that closes it — increment first
+         * and the erase we just decided is correct gets refused by our own guard, leaving exactly the
+         * split this ordering exists to prevent.
+         */
+        if (reason !== UNSALTED_REASONS.SESSION_TORN_DOWN && this.#saltSuspended.has(this.#k(agentName, sessionId))) {
+            /**
+             * ⚠️ GOING UNSALTED AND ERASING THE SALT ARE ONE DECISION — pass 2, F2 (HIGH), and this is my
+             * regression, not a pre-existing one.
+             *
+             * The note above claimed the ordering was sufficient because `#hashedWithoutSalt` is what
+             * closes adoption. **It is one of FOUR contributors.** Leaves, held rows and awaiting-ack close
+             * it too — and the most ordinary event in the protocol closes it: *the peer sends us its next
+             * message.* Reproduced through the real inbound path: suspend, peer's message lands as leaf 0,
+             * we hash `sha256`, and the erase is REFUSED with `already_hashing` while the bytes stay on
+             * disk. One teardown-and-revive later — no process restart required — we hash `hmac` again.
+             * That is the split transcript, produced by the fix for the split transcript.
+             *
+             * Worth naming precisely: **the immediate-erase design this replaced could NOT produce it.**
+             * There, a refused discard simply kept the session salted — one rule throughout, and loud.
+             * Suspension is what made "unsalted now, salted later" reachable. Same shape as pass 1: the fix
+             * worse than the defect on one path.
+             *
+             * So the two are atomic. If the salt cannot be erased, we do **not** go unsalted — we keep
+             * hashing under the held salt, which is one rule for the whole session, and say so at ERROR.
+             * The counterparty may refuse those messages, and that is the honest failure: a dead session
+             * beats a transcript no single rule can verify. The durable column remains the real answer.
+             */
+            if (!this.#discardUnspentSalt(agentName, sessionId)) {
+                const stillHeld = this.#getSessionSalt(agentName, sessionId);
+                if (stillHeld !== null) {
+                    const key = this.#k(agentName, sessionId);
+                    this.#logger.error("session.salt.split", {
+                        agentName, sessionId, reason: "suspended_but_unerasable",
+                        impact: "this session stays SALTED even though the counterparty says it can never hold a salt, because the salt could not be erased and hashing unsalted now would leave half this transcript under each rule — verifiable by nobody. Expect the counterparty to refuse messages sent from here.",
+                        guidance: "Start a new session with this counterparty: the salt agreement runs at open, before anything is hashed. This one cannot be repaired — look for session.salt.discard.refused immediately above for why the salt could not be released.",
+                    });
+                    this.#hashedWithSalt.set(key, (this.#hashedWithSalt.get(key) ?? 0) + 1);
+                    const alg = CONTENT_HASH_ALGS.HMAC_SALT_V1;
+                    return { hash: contentHashFor(content, { alg, salt: stillHeld }), alg };
+                }
+            }
+        }
         if (reason !== UNSALTED_REASONS.SESSION_TORN_DOWN) {
             /**
              * ⚠️ A COUNT, NOT A BIT — review pass 2, F1 (HIGH). It was a `Set`, and that made it ONE FLAG
@@ -8675,10 +10942,25 @@ export class SessionNodeManager {
      * bound expires.
      */
     async #saltForHashing(agentName, sessionId) {
+        const key = this.#k(agentName, sessionId);
         const held = this.#getSessionSalt(agentName, sessionId);
-        if (held !== null)
+        if (held !== null) {
+            /**
+             * SUSPENDED BEATS HELD — `DOD-M15-SALTSPLIT-1`. The peer has said it can never hold a salt, so
+             * hashing under ours produces a message it must refuse. We hold one and deliberately do not
+             * use it.
+             *
+             * ⚠️ An earlier note here said `PEER_CLOSED_ADOPTION` "already carries exactly the right
+             * guidance, so no new reason is needed and none is invented." That was right about not
+             * inventing a reason and wrong about which one applies: the peer can suspend us for any of
+             * four reasons, and the one hardcoded here asserted the most flattering of them. It now asks
+             * the same mapping every other closed path asks (006-CRYPTO finding 2).
+             */
+            if (this.#saltSuspended.has(key)) {
+                return { salt: null, reason: this.#peerClosedReason(key) };
+            }
             return { salt: held };
-        const key = this.#k(agentName, sessionId);
+        }
         if (this.#saltAdoptionClosed(agentName, sessionId).closed) {
             return { salt: null, reason: UNSALTED_REASONS.ADOPTION_CLOSED_LOCALLY };
         }
@@ -8688,7 +10970,7 @@ export class SessionNodeManager {
             // "your counterparty was not connected", and only an absent entry means it.
             const last = this.#saltLastOutcome.get(key);
             if (last !== undefined)
-                return { salt: null, reason: this.#reasonForOutcome(last) };
+                return { salt: null, reason: this.#reasonForOutcome(key, last) };
             return { salt: null, reason: UNSALTED_REASONS.NO_AGREEMENT_STARTED };
         }
         const settled = await pending.settled;
@@ -8795,15 +11077,41 @@ export class SessionNodeManager {
      * ONE mapping from a settled outcome to the operator-facing reason, so the send that WAITED and the
      * send that arrived afterwards cannot disagree about what happened.
      */
-    #reasonForOutcome(outcome) {
+    #reasonForOutcome(key, outcome) {
         if (outcome === "announce_failed")
             return UNSALTED_REASONS.ANNOUNCE_FAILED;
         if (outcome === "persist_failed")
             return UNSALTED_REASONS.OUR_PERSIST_FAILED;
         if (outcome === "closed")
-            return UNSALTED_REASONS.PEER_CLOSED_ADOPTION;
+            return this.#peerClosedReason(key);
         return UNSALTED_REASONS.AGREEMENT_TIMED_OUT;
     }
+    /**
+     * WHICH of the four terminal answers the peer actually gave — 006-CRYPTO finding 2.
+     *
+     * The default is the NON-ASSERTING reason, not the most common one. An unknown label means a build
+     * we do not understand, and rendering that as "they had already hashed messages" states something
+     * about a counterparty that may be untrue — which is what sends an operator to raise a
+     * non-problem with them. The label is peer-supplied, so nothing outside the known set is repeated
+     * back as our own diagnosis.
+     *
+     * A missing entry maps to the already-hashing case: `PEER_CLOSED_FIRST` and an absent label both
+     * mean the peer is answering a closure of OURS, and `#saltForHashing` answers that with
+     * `ADOPTION_CLOSED_LOCALLY` one branch earlier — this is only the fallback if it did not.
+     */
+    #peerClosedReason(key) {
+        const label = this.#saltPeerClosedLabel.get(key);
+        if (label === undefined || label === SALT_ADOPTION_LABELS.PEER_CLOSED_FIRST) {
+            return UNSALTED_REASONS.PEER_CLOSED_ADOPTION;
+        }
+        if (label === SALT_ADOPTION_LABELS.ALREADY_HASHING)
+            return UNSALTED_REASONS.PEER_CLOSED_ADOPTION;
+        if (label === SALT_ADOPTION_LABELS.FRONTIER_UNREADABLE)
+            return UNSALTED_REASONS.PEER_FRONTIER_UNREADABLE;
+        if (label === SALT_ADOPTION_LABELS.EXCHANGE_STALLED)
+            return UNSALTED_REASONS.PEER_EXCHANGE_STALLED;
+        return UNSALTED_REASONS.PEER_CLOSED_UNSPECIFIED;
+    }
     /** Resolve a pending agreement. Idempotent: the first outcome wins and the timer is cleared. */
     #settleSaltPending(agentName, sessionId, outcome) {
         const key = this.#k(agentName, sessionId);
@@ -8889,9 +11197,70 @@ export class SessionNodeManager {
      * Read-only and cache-backed, so exposing it adds no way to CHANGE the salt from outside — the
      * only writer remains `#persistSessionSalt`, behind the one-salt-per-session predicate.
      */
+    /**
+     * IS THIS SESSION ACTUALLY PROTECTED BY ITS SALT RIGHT NOW — pass 2, F3.
+     *
+     * Distinct from `getSessionContentSalt`, which is POSSESSION and is what the verifier needs: a
+     * message parked before suspension was hashed under this salt and must still be checkable against
+     * it, so that accessor must keep answering with the bytes.
+     *
+     * This one answers the OPERATOR's question, and it is a different question. A suspended session
+     * holds a salt it will not use, so every hash it produces is `sha256` — reporting `contentSalted:
+     * true` there is not a gap, it is an affirmatively false security claim on the surface whose own
+     * comment reads *"a security property must not be inferable from a gap."* Same predicate
+     * `#saltForHashing` uses, so the flag cannot drift from the behaviour it describes.
+     */
+    isContentSaltActive(agentName, sessionId) {
+        if (this.#saltSuspended.has(this.#k(agentName, sessionId)))
+            return false;
+        return this.#getSessionSalt(agentName, sessionId) !== null;
+    }
     getSessionContentSalt(agentName, sessionId) {
         return this.#getSessionSalt(agentName, sessionId);
     }
+    /**
+     * THE SALT, OR WHY THERE ISN'T ONE — `DOD-M15-INCLUSION-1`, fallback-finder finding 2.
+     *
+     * `getSessionContentSalt` above answers `null` for THREE different situations, and a caller that
+     * turns that null into a sentence for an operator gets two of them wrong:
+     *
+     *   `none`       — no salt was ever agreed. The session really is unsalted.
+     *   `unreadable` — a salt row EXISTS and could not be used: the wrong width (corruption on this
+     *                  operator's own disk), or the read threw.
+     *
+     * The distinction is not cosmetic. `unreadable` means the session's leaves WERE hashed under a
+     * salt, so telling its operator *"this session's content hashes are UNSALTED … start a session
+     * while you are both connected"* is an affirmatively false statement about a security property
+     * their session has, and it points them at their counterparty over damage to their own database.
+     * That is the same defect `#getSessionSalt`'s own F8 note was written to end, re-committed one
+     * surface out.
+     *
+     * ⚠️ IT DELEGATES — there is no second read here. Calling `#getSessionSalt` first means the salt
+     * this reports is the salt the hashing path uses, including its cache and its wrong-width refusal.
+     * A parallel query would be free to disagree with it, which is the whole failure this returns a
+     * reason to prevent.
+     */
+    getSessionContentSaltState(agentName, sessionId) {
+        const salt = this.#getSessionSalt(agentName, sessionId);
+        if (salt)
+            return { salt };
+        if (!this.#db)
+            return { salt: null, reason: "unreadable" };
+        try {
+            const row = this.#db
+                .prepare("SELECT length(content_salt) AS n FROM sessions WHERE agent_id = ? AND session_id = ?")
+                .get(this.#requireAgentId(agentName), sessionId);
+            // A row with a non-empty blob that `#getSessionSalt` still refused is the corruption case: the
+            // bytes are there and they are not a salt. NULL or zero-length is a genuine absence.
+            const stored = row?.n ?? 0;
+            return { salt: null, reason: stored > 0 ? "unreadable" : "none" };
+        }
+        catch {
+            // The read that would tell us which case it is has itself failed, so "no salt was agreed" is
+            // exactly the thing we cannot assert.
+            return { salt: null, reason: "unreadable" };
+        }
+    }
     /**
      * This session's agreed salt, or null. Reads the durable row through a cache, because Decision #8
      * persists it for exactly one reason: *"a restart silently splits the transcript"* if the lookup
@@ -9118,16 +11487,224 @@ export class SessionNodeManager {
                 });
                 return false;
             }
-            this.#sessionSalts.set(this.#k(agentName, sessionId), salt);
-            return true;
+            this.#sessionSalts.set(this.#k(agentName, sessionId), salt);
+            return true;
+        }
+        catch (err) {
+            this.#logger.error("session.salt.persist.failed", {
+                agentName, sessionId, error: extractErrorMessage(err),
+                impact: "the salt was NOT stored, so it is not announced to the counterparty either; the agreement stays open rather than being confirmed against a value that would vanish at the next restart",
+            });
+            return false;
+        }
+    }
+    /**
+     * DROP AN UNSPENT SALT — `DOD-M15-SALTSPLIT-1`. The second writer of `content_salt`, and the only
+     * one that clears it.
+     *
+     * Reached when the counterparty tells us it can never adopt a salt for this session. Keeping ours
+     * would mean every message we send from here is refused by them with
+     * `content_hash_salt_unavailable` — a conversation that dies while looking merely quiet, which is
+     * the failure this exists to prevent.
+     *
+     * ⚠️ THE ADOPTION CHECK IS REPEATED HERE ON PURPOSE, not because the caller is untrusted.
+     *
+     * The caller has already computed `adoption`, so this looks redundant — and it is, for today's one
+     * call site. It stays because the cost of a future caller getting it wrong is a transcript that no
+     * single rule can verify: leaves hashed under a salt that has just been erased, with nothing
+     * recording that they were. A guard whose failure mode is silent and permanent belongs next to the
+     * destructive act, not only at the place that currently decides to perform it. Same reasoning that
+     * made `placeOwnLeaf`'s authorship parameter required rather than optional.
+     *
+     * Returns true only if a salt was actually cleared.
+     */
+    /**
+     * SUSPEND, don't destroy — `DOD-M15-SALTSPLIT-1`, the authorization argument. Returns true if a
+     * salt is now suspended (or already was).
+     *
+     * This is the frame handler's entry point. It runs the same two refusals as the erase below —
+     * a spent salt and one mid-flight are not ours to set aside either, because the messages already
+     * hashed under them would become unverifiable the moment we stop using it — and where they do not
+     * fire it records the suspension instead of doing anything irreversible.
+     */
+    #suspendSalt(agentName, sessionId, correlationId) {
+        const key = this.#k(agentName, sessionId);
+        if (this.#getSessionSalt(agentName, sessionId) === null)
+            return false;
+        if (this.#saltSuspended.has(key))
+            return true;
+        const inFlight = this.#hashedWithSalt.get(key) ?? 0;
+        const adoption = this.#saltAdoptionClosed(agentName, sessionId);
+        if (inFlight > 0 || adoption.closed) {
+            /**
+             * SPENT, or mid-send. Suspending is not destructive, but it IS a split: content already hashed
+             * under this salt stays hashed under it while everything after would be hashed the other way,
+             * in one session, with nothing recording where the change happened. That is the one thing
+             * Decision #8 forbids outright, so the salt keeps being used and the session stays honestly
+             * broken rather than becoming dishonestly half-verifiable.
+             */
+            this.#logger.info("session.salt.suspend.refused", {
+                agentName, sessionId, correlationId,
+                reason: inFlight > 0 ? "salted_hash_in_flight" : adoption.label,
+                ...(inFlight > 0 ? { inFlight } : { frontier: adoption.why }),
+                impact: "the salt stays IN USE, because content in this session is already hashed under it and switching now would split the transcript — half verifiable by one rule, half by another. The counterparty cannot hold this salt, so it will keep refusing messages sent from here. See session.salt.split.",
+            });
+            return false;
+        }
+        this.#saltSuspended.add(key);
+        this.#logger.info("session.salt.suspended", {
+            agentName, sessionId, correlationId,
+            impact: "the counterparty can never adopt a salt for this session, so this side has STOPPED USING its own — messages are hashed the way every build before content salting hashed them, and every message continues to be accepted. Nothing was hashed under it, so nothing is split.",
+            guidance: "No action. The salt bytes are kept, not erased: if the counterparty was merely unable to read its own state for a moment, its next announcement carrying a matching fingerprint restores this session to salted automatically. The bytes are erased only when this session actually hashes a message unsalted, which is the point after which keeping them would re-salt the session at the next restart.",
+        });
+        return true;
+    }
+    /** Un-suspend: the peer answered with a fingerprint matching the salt we kept. */
+    #resumeSalt(agentName, sessionId, correlationId) {
+        const key = this.#k(agentName, sessionId);
+        if (!this.#saltSuspended.has(key))
+            return;
+        /**
+         * ⚠️ REFUSE THE RESUME IF THIS SESSION HAS ALREADY HASHED UNSALTED — pass 2, F1 (HIGH).
+         *
+         * `#resumeSalt` deleted the mark unconditionally, and the reviewer produced the counter-example
+         * in ONE process with no restart: suspend, the peer keeps talking so a leaf lands, we send `m1`
+         * under `sha256`, the peer's frontier recovers and announces `fingerprint(S)`, we resume, and
+         * `m2` goes out under `hmac`. Two rules, one session — and `session.salt.resumed` asserted
+         * *"No message was hashed while suspended, so the transcript is uniform"* while it was happening.
+         * **The code never checked the thing its own log line claimed**, which is this milestone's
+         * signature defect committed inside the fix for it.
+         *
+         * `#unsaltedAnnounced` is exactly that fact and is already maintained, so the check costs a
+         * lookup. Once it is set the salt can never be used again, so it is erased here rather than left
+         * to be found by a later restart.
+         */
+        if (this.#unsaltedAnnounced.has(key)) {
+            this.#logger.warn("session.salt.resume.refused", {
+                agentName, sessionId, correlationId,
+                impact: "the counterparty now confirms a salt this side is holding, but this session has ALREADY hashed at least one message unsalted. Resuming would put half the transcript under each rule, which no single rule can verify — so the session stays unsalted for its whole life and the salt is released.",
+                guidance: "Nothing to do here, and nothing is lost: the transcript stays uniform and every message is intact. If you want the salt protection with this counterparty, start a new session — the agreement runs at open, before anything is hashed.",
+            });
+            this.#saltSuspended.delete(key);
+            this.#discardUnspentSalt(agentName, sessionId, correlationId);
+            return;
+        }
+        this.#saltSuspended.delete(key);
+        /**
+         * THE RECOVERY THE ERASE MADE IMPOSSIBLE. Keeping the bytes is what allows this line to exist:
+         * the peer's earlier terminal frame was wrong (a frontier it could not read for a moment), it can
+         * read again, and the fingerprints match — so the session resumes salted with nothing lost. An
+         * erased salt cannot be re-derived from one side.
+         */
+        this.#logger.info("session.salt.resumed", {
+            agentName, sessionId, correlationId,
+            impact: "the counterparty now confirms the same salt this side kept, so this session is salted again. It was suspended earlier because the counterparty reported it could never hold one; that has resolved. No message was hashed while suspended, so the transcript is uniform.",
+        });
+    }
+    #discardUnspentSalt(agentName, sessionId, correlationId) {
+        const held = this.#getSessionSalt(agentName, sessionId);
+        if (held === null)
+            return false;
+        /**
+         * ⚠️ IN-FLIGHT FIRST — `DOD-M15-SALTSPLIT-1` review HIGH-2. `#saltAdoptionClosed` cannot see a
+         * hash that has been computed under the salt but has not yet become a leaf, a hold or an
+         * awaiting-ack entry, and that gap is a full relay round trip wide.
+         */
+        /**
+         * ⚠️ MEASURED UNREACHABLE FROM TODAY'S CALLERS, AND KEPT ANYWAY — pass 2 test-teeth, survivor 2.
+         *
+         * Deleting this block leaves the whole salt suite GREEN. That is the definition this unit has
+         * used all along for *"not a guard, a comment that happens to execute"*, so it is labelled rather
+         * than quietly left to look load-bearing. `#suspendSalt` refuses on `inFlight > 0` before a
+         * session can ever be marked, and both callers of this method require the mark — so the deferred
+         * erase cannot observe a non-zero count.
+         *
+         * It stays for one reason: **it sits at an irreversible write.** The earlier instance of this
+         * question in this same unit was resolved by making the guard the actual decision-maker, and that
+         * option does not exist here — `#suspendSalt` genuinely must refuse early, so the duplication is
+         * structural rather than a mistake about where responsibility lives. For a destructive act, the
+         * safe direction is to keep a check that cannot fire over removing one that turns out it could.
+         *
+         * What must NOT happen is claiming it as coverage. It is not tested and it is not testable from
+         * outside; if a third caller ever reaches this method without the suspension mark, this becomes
+         * reachable and needs a test in the same commit.
+         */
+        const inFlight = this.#hashedWithSalt.get(this.#k(agentName, sessionId)) ?? 0;
+        if (inFlight > 0) {
+            this.#logger.info("session.salt.discard.refused", {
+                agentName, sessionId, correlationId, reason: "salted_hash_in_flight", inFlight,
+                impact: "the salt was NOT dropped: a message has already been hashed under it and is mid-send, so erasing it now would put a hash on the wire that nothing — including this daemon — could ever recompute. The session stays salted and the counterparty, which cannot adopt, will refuse what is in flight.",
+            });
+            return false;
+        }
+        const adoption = this.#saltAdoptionClosed(agentName, sessionId);
+        if (adoption.closed) {
+            /**
+             * SPENT. Something is already hashed under this salt, so it is not ours to drop.
+             *
+             * INFO, not ERROR, and the level is a judgement rather than a downgrade: this is the guard
+             * doing its job correctly, and the FAILURE it accompanies — the session is split and unusable
+             * — is reported by `session.salt.split` at ERROR from the caller that has the operator-facing
+             * detail. Two ERRORs for one condition trains people to read neither. This line stays so the
+             * refusal itself is correlatable when someone asks why the salt is still on disk.
+             */
+            this.#logger.info("session.salt.discard.refused", {
+                agentName, sessionId, correlationId, reason: adoption.label, frontier: adoption.why,
+                impact: "the salt was NOT dropped, because content in this session is already hashed under it and erasing it would leave a transcript no single rule can verify. The session stays split: the counterparty holds no salt and refuses everything sent from here.",
+            });
+            return false;
+        }
+        if (!this.#db) {
+            this.#logger.error("session.salt.discard.failed", {
+                agentName, sessionId, correlationId, reason: "db_closed",
+                impact: "the salt is still stored, so after the next restart this side hashes salted while the counterparty refuses every message. Only reachable during shutdown; the agreement re-runs on the next connect, which discards it then.",
+            });
+            return false;
+        }
+        try {
+            const cleared = this.#db
+                .prepare("UPDATE sessions SET content_salt = NULL WHERE agent_id = ? AND session_id = ?")
+                .run(this.#requireAgentId(agentName), sessionId);
+            if (Number(cleared.changes) !== 1) {
+                // The row-count check that `#persistSessionSalt` learned the hard way: an UPDATE matching no
+                // row does not throw, and reporting success here would leave the durable salt in place while
+                // the cache said otherwise — salted after a restart, unsalted before one.
+                this.#logger.error("session.salt.discard.failed", {
+                    agentName, sessionId, correlationId, changes: Number(cleared.changes), reason: "no_session_row",
+                    impact: "the stored salt was NOT cleared, so this side hashes unsalted now and salted again after a restart — the transcript splits at the restart rather than here",
+                });
+                return false;
+            }
         }
         catch (err) {
-            this.#logger.error("session.salt.persist.failed", {
-                agentName, sessionId, error: extractErrorMessage(err),
-                impact: "the salt was NOT stored, so it is not announced to the counterparty either; the agreement stays open rather than being confirmed against a value that would vanish at the next restart",
+            this.#logger.error("session.salt.discard.failed", {
+                agentName, sessionId, correlationId, error: extractErrorMessage(err),
+                impact: "the stored salt was NOT cleared, so this side hashes unsalted now and salted again after a restart — the transcript splits at the restart rather than here",
             });
             return false;
         }
+        /**
+         * CACHE AFTER ROW, and both or the session is worse off than before.
+         *
+         * `#saltForHashing` reads the cache on its first line and never consults the row, so clearing
+         * one without the other produces a session that hashes one way in this process and the other way
+         * in the next — the split transcript, arriving at a daemon restart instead of at a frame.
+         */
+        this.#sessionSalts.delete(this.#k(agentName, sessionId));
+        /**
+         * ⚠️ THE MARK GOES WITH THE BYTES — pass 2, F5. Leaving the key in `#saltSuspended` after a
+         * successful erase means a LATER agreed salt is silently never used: `#persistSessionSalt`'s
+         * predicate explicitly allows a write when the column is NULL, and `abandonUnsaltedHash` can
+         * re-open adoption — so the session would log `session.salt.agreed`, surface as protected, and
+         * hash `sha256` for the rest of its life. A stale suppression is indistinguishable from a
+         * feature that does not work.
+         */
+        this.#saltSuspended.delete(this.#k(agentName, sessionId));
+        this.#logger.info("session.salt.discarded", {
+            agentName, sessionId, correlationId,
+            impact: "the counterparty can never adopt a salt for this session, so this side dropped its own before spending it. Both sides now hash unsalted — exactly as verifiable as every session shipped before content salting existed, and every message continues to be accepted. Nothing was hashed under the discarded salt.",
+        });
+        return true;
     }
     /**
      * Announce our state to the counterparty: a contribution if we hold no salt, a fingerprint if we
@@ -9260,6 +11837,13 @@ export class SessionNodeManager {
     async #handleSaltFrame(agentName, sessionId, frame, correlationId) {
         const key = this.#k(agentName, sessionId);
         const peerHalfHex = frame.contribution ? Buffer.from(frame.contribution).toString("hex") : null;
+        const peerFingerprintHex = frame.fingerprint ? Buffer.from(frame.fingerprint).toString("hex") : null;
+        // WHY the peer closed, kept for the operator-facing reason — 006-CRYPTO finding 2. Recorded here
+        // rather than in the `adoption_closed` handler because that action fires for OUR closure too,
+        // and only the frame says what the PEER said.
+        if (typeof frame.adoptionClosed === "string") {
+            this.#saltPeerClosedLabel.set(key, frame.adoptionClosed);
+        }
         const adoption = this.#saltAdoptionClosed(agentName, sessionId);
         const action = onPeerSaltFrame({
             ...this.#saltState(agentName, sessionId),
@@ -9272,9 +11856,15 @@ export class SessionNodeManager {
             // Keyed on the peer's BYTES, not on a repair counter: a genuinely NEW half from the peer must
             // still get our contribution back, and only an identical re-offer is the loop (review F14).
             alreadyRepairedAgainstPeerHalf: peerHalfHex !== null && this.#saltRepairedAgainst.get(key) === peerHalfHex,
+            // The mirror, 006-CRYPTO finding 1: without it a saltless side answers a latched holder's
+            // fingerprint forever. Same keying rule — an identical re-offer is the loop, a new one is not.
+            alreadyRepairedAgainstPeerFingerprint: peerFingerprintHex !== null && this.#saltRepairedAgainstFingerprint.get(key) === peerFingerprintHex,
             frame,
         });
         if (action.action === "confirmed") {
+            // DOD-M15-SALTSPLIT-1: the peer confirms the salt we KEPT while suspended — resume before logging
+            // agreement, so a resumed session is never reported as agreed while still suspended.
+            this.#resumeSalt(agentName, sessionId, correlationId);
             this.#logger.info("session.salt.agreed", {
                 agentName, sessionId, correlationId, via: "fingerprint_match",
             });
@@ -9339,9 +11929,44 @@ export class SessionNodeManager {
              * is nothing for its operator to do. Logging that at WARN would fire on the innocent side of
              * every such session and train them to ignore the name.
              */
+            /**
+             * DOD-M15-SALTSPLIT-1 — ONE PLACE DECIDES WHETHER THE SALT GOES, and it is not here.
+             *
+             * ⚠️ THIS CALL WAS INSIDE THE `else` BELOW, AND THE REVERT TEST CAUGHT IT.
+             *
+             * Guarding it by `adoption.closed` here meant `#discardUnspentSalt`'s own adoption check could
+             * never be reached, so deleting that check left all three tests GREEN — the survivor. A guard
+             * nothing can redden is not a guard; it is a comment that happens to execute, which is the
+             * shape this milestone keeps finding.
+             *
+             * Called unconditionally now. The method owns the spent/unspent decision, both outcomes run
+             * through it, and deleting its check reddens the spent test immediately. That also removes the
+             * duplicated condition: two places deciding the same thing is one place being wrong later.
+             */
+            /**
+             * The return is CONSUMED, not decorative — review LOW-5. `true` means a salt was actually
+             * cleared, which settles the question below without a second read; `false` is ambiguous (we
+             * held none, or we refused to drop one), so that case still asks.
+             */
+            const suspended = this.#suspendSalt(agentName, sessionId, correlationId);
+            /**
+             * "Still holds a salt it is USING" — suspension is what settles it, not possession. A suspended
+             * session keeps the bytes on disk deliberately, and reporting that as an unrecoverable split
+             * would fire the ERROR below on the one case that recovers by itself.
+             */
+            const stillHoldsSalt = !suspended && this.#getSessionSalt(agentName, sessionId) !== null;
             const shared = {
                 agentName, sessionId, correlationId, detail: action.detail,
-                impact: "neither side will use a content salt for this session, and both now know it. Messages are hashed the way every build before this feature hashed them — nothing is degraded relative to any shipped release, and no message is affected.",
+                /**
+                 * ⚠️ *"no message is affected"* IS FALSE WHEN WE ARE STILL HOLDING A SALT — review MEDIUM-4,
+                 * second instance. The sentence was written for a session where neither side ever adopted
+                 * one, and it stayed attached to a branch that now also covers the case where this side
+                 * kept a spent salt and every message it sends is about to be refused. Two log lines from
+                 * one event contradicting each other is worse than either alone.
+                 */
+                impact: stillHoldsSalt
+                    ? "the counterparty will not use a content salt, and this side is still holding one it cannot drop — see session.salt.split on the next line for what that costs and what to do about it."
+                    : "neither side will use a content salt for this session, and both now know it. Messages are hashed the way every build before this feature hashed them — nothing is degraded relative to any shipped release, and no message is affected.",
             };
             if (adoption.closed) {
                 /**
@@ -9366,8 +11991,67 @@ export class SessionNodeManager {
                 });
             }
             else {
+                /**
+                 * DOD-M15-SALTSPLIT-1 — CARRY OUT THE CLAIM ABOVE INSTEAD OF ONLY STATING IT.
+                 *
+                 * `shared.impact` says *"neither side will use a content salt for this session, and both now
+                 * know it."* Nothing made that true: a salt already agreed on this side stayed on disk and in
+                 * the cache, and `#saltForHashing` returns it before it ever looks at adoption. Our adoption
+                 * is still open here, so nothing has been hashed under it and dropping it is free.
+                 *
+                 * Ordering matters — discard BEFORE the log, so the line cannot claim an outcome that the
+                 * write then failed to produce.
+                 */
                 this.#logger.info("session.salt.adoption.closed", shared);
             }
+            /**
+             * ⚠️ OUTSIDE THE ADOPTION BRANCH — pass 2, F4. This used to live inside `if (adoption.closed)`,
+             * so the one case that needed it most never got it: suspension refused for
+             * `salted_hash_in_flight` while adoption is still OPEN leaves us holding a salt the peer can
+             * never accept, and it took the `else` path. Measured on that exact scenario:
+             * `suspend.refused = 1`, `adoption.closed = 1`, **`split = 0`** — while two other log lines
+             * told the operator to *"see session.salt.split on the next line"*, a line that was never
+             * written. Guidance pointing at an event that does not fire is worse than no guidance: it
+             * spends the reader's trust and their time.
+             *
+             * The condition was always `stillHoldsSalt`; only its placement disagreed.
+             *
+             * ─── What this event means, moved here with the code it describes ─────────────────────────
+             *
+             * We hold a salt AND the peer has told us it can never hold one. Either our frontier closed
+             * with the salt already spent, or a salted hash is mid-flight — both mean the salt cannot be
+             * released, so the peer will refuse every message we send with `content_hash_salt_unavailable`.
+             *
+             * `session.salt.adoption.refused` may fire alongside, saying *"nothing is degraded relative to
+             * any shipped release, and no message is affected"* — true for the ordinary refusal and FALSE
+             * here, at the exact moment every message stops being accepted. Hence its own event at ERROR
+             * rather than a tightened sentence on that one: an operator filtering for the refusal is
+             * looking at a benign condition, and this is not it.
+             */
+            if (stillHoldsSalt) {
+                /**
+                 * ⚠️ TWO REASONS REACH `adoption.closed`, AND ONLY ONE IS ABOUT CONTENT — review MEDIUM-4.
+                 *
+                 * This fired for both with a single impact asserting *"content here is already hashed
+                 * under a salt"*. For `frontier_unreadable` that is a claim about content made from a
+                 * database read that FAILED — we do not know what was hashed; that is the whole condition.
+                 *
+                 * The WARN twenty lines above was explicitly corrected for this exact collapse — its
+                 * comment reads *"TWO REFUSALS, TWO DIFFERENT THINGS TO DO — and this used to report both
+                 * as `already_hashing`"* — and I reintroduced it one severity level up, with the guidance
+                 * that WARN was fixed to stop giving. Branching on the label the way it already does.
+                 */
+                const unreadable = adoption.label === SALT_ADOPTION_LABELS.FRONTIER_UNREADABLE;
+                this.#logger.error("session.salt.split", {
+                    agentName, sessionId, correlationId, reason: adoption.label, frontier: adoption.why,
+                    impact: unreadable
+                        ? "this side holds a salt, the counterparty can never hold one, and this side could NOT read its own message frontier — so whether anything has been hashed under that salt is unknown. The salt is kept rather than dropped, because dropping one that HAS been spent leaves a transcript no single rule can verify. Until the read succeeds, expect the counterparty to refuse messages sent from here."
+                        : "this session cannot continue. Content here is already hashed under a salt the counterparty can never hold, so they refuse every message sent from this side — the conversation looks quiet rather than broken, and the session can never be sealed because the two transcripts no longer agree on a leaf.",
+                    guidance: unreadable
+                        ? "Do NOT start a new session yet — it would refuse in exactly the same way, because the fault is this side's storage rather than this conversation. Look for session.content.held.restore.failed or other storage errors around this line. Once the frontier reads again, this resolves to either an ordinary salted session or the split case, and the log will say which."
+                        : "Start a new session with this counterparty: the salt agreement runs at open, before anything is hashed, so a fresh session agrees or declines cleanly on both sides. This one cannot be repaired — the salt cannot be dropped without leaving a transcript no single rule can verify, and it cannot be shared with a peer that has already closed adoption.",
+                });
+            }
             if (action.announce) {
                 void this.#sendSaltFrame(agentName, sessionId, correlationId, action.announce);
             }
@@ -9387,10 +12071,16 @@ export class SessionNodeManager {
                 answeredWith: action.frame.contribution ? "contribution" : "fingerprint",
             });
             // Recorded ONLY for a repair that sent our half, because that is the one a second identical
-            // offer must not repeat (review F14). Recording the fingerprint answer too would be harmless
-            // but says nothing — that branch is already terminal for the peer.
+            // offer must not repeat (review F14).
             if (peerHalfHex && action.frame.contribution)
                 this.#saltRepairedAgainst.set(key, peerHalfHex);
+            // AND THE MIRROR (006-CRYPTO finding 1): we answered the peer's FINGERPRINT with our half. An
+            // earlier note here said recording this "says nothing, that branch is already terminal for the
+            // peer" — it is terminal only for a peer that HOLDS a salt, and the loop is the case where we
+            // do not. A second identical fingerprint now closes adoption instead of repairing again.
+            if (peerFingerprintHex && action.frame.contribution) {
+                this.#saltRepairedAgainstFingerprint.set(key, peerFingerprintHex);
+            }
             void this.#sendSaltFrame(agentName, sessionId, correlationId, action.frame);
             return;
         }
@@ -9742,6 +12432,23 @@ export class SessionNodeManager {
              * by name — so a non-Uint8Array in either slot must arrive at that function as ABSENT, not as
              * a present-but-wrong value it would then try to use.
              */
+            /**
+             * 007-CRYPTO — the peer's SIGNED ephemeral.
+             *
+             * Fields are read defensively rather than cast, exactly like the salt frame below: an inbound
+             * value is whatever a peer chose to encode, and `verifySessionEphemeral` refuses a missing or
+             * wrong-width one BY NAME — so a non-`Uint8Array` must arrive there as ABSENT rather than as a
+             * present-but-wrong value it would try to use.
+             */
+            if (frame["type"] === "session_key_agreement") {
+                const ephemeralPublic = frame["ephemeral_public"];
+                const signature = frame["ephemeral_sig"];
+                await this.#handleEphemeralFrame(agentName, sessionId, {
+                    ...(ephemeralPublic instanceof Uint8Array ? { ephemeralPublic } : {}),
+                    ...(signature instanceof Uint8Array ? { signature } : {}),
+                }, correlationId);
+                return;
+            }
             if (frame["type"] === "session_salt_agreement") {
                 const contribution = frame["contribution"];
                 const fingerprint = frame["fingerprint"];
@@ -9751,7 +12458,14 @@ export class SessionNodeManager {
                     ...(fingerprint instanceof Uint8Array ? { fingerprint } : {}),
                     // A non-string stays ABSENT rather than being coerced, exactly like the other two: the
                     // decision function refuses a shape it cannot read, and must never be handed a `"42"`.
-                    ...(typeof adoptionClosed === "string" && adoptionClosed.length > 0 ? { adoptionClosed } : {}),
+                    //
+                    // TRUNCATED AT THE BOUNDARY — 006-CRYPTO finding 6. Every label CELLO sends is under
+                    // twenty characters, and this one is chosen entirely by the peer. Cutting it here means
+                    // no unbounded peer string is stored, logged or rendered anywhere downstream; the
+                    // rendering that keeps it out of our own sentences is `renderPeerAdoptionLabel`.
+                    ...(typeof adoptionClosed === "string" && adoptionClosed.length > 0
+                        ? { adoptionClosed: adoptionClosed.slice(0, SALT_ADOPTION_LABEL_MAX) }
+                        : {}),
                 }, correlationId);
                 return;
             }
@@ -9771,6 +12485,9 @@ export class SessionNodeManager {
             // field was PRESENT and wrong, so omitting it passed. Its own sibling twenty lines up already
             // refused absence, with a comment saying treating a missing field as agreement is how a guard
             // stops guarding. Same file, same switch, opposite conclusion.
+            // Review F4: hand the DECODED frame to a test observer before anything consumes it. Absent in
+            // production — the field is null unless a test installs one.
+            this.#inboundFrameObserver?.(frame);
             const contentBytes = frame["content_bytes"];
             const contentHash = frame["content_hash"];
             if (!(contentBytes instanceof Uint8Array) || !(contentHash instanceof Uint8Array)) {
@@ -9784,6 +12501,61 @@ export class SessionNodeManager {
                 });
                 return;
             }
+            /**
+             * 🚨 DECRYPT BEFORE ANYTHING ELSE READS THE BODY — `DOD-M15-EPHEMERAL-AUTH-1`.
+             *
+             * `content_hash` is over the PLAINTEXT, so the hash check, the transcript, the seal and the
+             * salted hash all keep meaning exactly what they mean today — but only if the body is put back
+             * before any of them run.
+             *
+             * ⚠️ ABSENT IS NOT A PASS. A frame with no `content_encryption` is refused rather than read as
+             * plaintext. There is no unencrypted sender to be compatible with, and treating a missing
+             * marker as "this one is in the clear" is precisely the downgrade an attacker asks for: strip
+             * one field and the receiver reads the body raw. Missing and unknown take the same path as a
+             * failed decrypt, for the reason that runs through this whole unit — a check lenient about an
+             * absent proof is a check that gets skipped.
+             */
+            const declaredEncryption = frame["content_encryption"];
+            const encState = this.#contentEncryptionState(agentName, sessionId);
+            let plaintextBody;
+            if (declaredEncryption !== SESSION_CONTENT_ENCRYPTION_V1) {
+                this.#logger.error("session.content.refused", {
+                    agentName, sessionId, correlationId,
+                    reason: "content_encryption_absent_or_unknown",
+                    declared: typeof declaredEncryption === "string" ? declaredEncryption : "(absent)",
+                    impact: "the frame did not say it was encrypted under this session's key, so it was refused unread. Nothing was shown and nothing was stored.",
+                    guidance: "STOPPED ON PURPOSE. A message arrived that was not encrypted under this session's key. " +
+                        "This build never sends one, so either something between you rewrote the frame, or your " +
+                        "counterparty is running something that is not CELLO. Confirm with them OUT OF BAND " +
+                        "before opening another session.",
+                });
+                return;
+            }
+            if (encState.key === null) {
+                this.#logger.error("session.content.refused", {
+                    agentName, sessionId, correlationId,
+                    reason: "no_session_key",
+                    detail: encState.reason,
+                    impact: "an encrypted message arrived and this side has no agreed key to open it, so it was refused unread rather than shown as garbage.",
+                    guidance: CONTENT_ENCRYPTION_GUIDANCE[encState.reason],
+                });
+                return;
+            }
+            const opened = openSessionContent(encState.key, contentBytes);
+            if (opened === null) {
+                // GCM's tag is the only thing separating "not for us" from "modified in flight", and this
+                // side must not branch on which — that would be branching on attacker-controlled input.
+                this.#logger.error("session.content.refused", {
+                    agentName, sessionId, correlationId,
+                    reason: "decrypt_failed",
+                    impact: "the message did not decrypt under this session's agreed key — it was modified in flight, or it was encrypted under a different key. Refused unread.",
+                    guidance: "STOPPED ON PURPOSE. Nothing was shown and nothing was stored. A message that fails this " +
+                        "check has either been altered on its way to you or was not encrypted for this session. " +
+                        "Confirm with your counterparty OUT OF BAND, then start a new session.",
+                });
+                return;
+            }
+            plaintextBody = opened;
             // DOD-MSG-4 (self-ordering content frame): if the frame carries the relay's signed ordering
             // record, verify the sender signature and record the canonical sequence FROM THE FRAME, BEFORE
             // ingest — so the strict-in-order gate has the position without waiting on the separate
@@ -9850,7 +12622,10 @@ export class SessionNodeManager {
              * Coercing here would collapse that distinction and turn a version skew into a tamper report.
              */
             const declaredAlg = frame["content_hash_alg"];
-            const ingest = await this.ingestReceivedContent(agentName, sessionId, contentBytes, contentHash, correlationId, framedSeq ?? undefined, declaredAlg === undefined ? undefined : declaredAlg, verifiedAuthorship);
+            const ingest = await this.ingestReceivedContent(
+            // THE DECRYPTED body — everything downstream (the hash cross-check, the leaf, the transcript,
+            // the delivery buffer) works on plaintext, exactly as it did before this layer existed.
+            agentName, sessionId, plaintextBody, contentHash, correlationId, framedSeq ?? undefined, declaredAlg === undefined ? undefined : declaredAlg, verifiedAuthorship);
             // AC-001: after the content is durably ingested AND its hash cross-check
             // succeeds, emit an unsigned `persisted` delivery ACK back to the sender. A
             // rejected ingest (tamper / not-active) produces NO ACK, so the sender's TTF
@@ -10071,6 +12846,46 @@ export class SessionNodeManager {
      * relay pool, and the only source a FRESH agent (no session history) has.
      */
     #directoryRelayEndpoints = new Map();
+    /**
+     * DOD-M15-RELAYSLOTS-1: the directory-issued online token per agent — the credential the relays
+     * above now require before they will let this agent hold a circuit reservation slot.
+     *
+     * Arrives with `signaling_auth_ok`, on the same frame as the relay endpoints and on the same
+     * cadence: every connect AND every reconnect. Held here rather than passed to a relay client at
+     * construction because it expires within the hour and the client outlives it — the client reads
+     * it through `getDirectoryOnlineToken` at each authentication.
+     */
+    #directoryOnlineTokens = new Map();
+    /**
+     * DOD-M15-RELAYSLOTS-1: accept the directory's online token for an agent. Called on every
+     * signaling connect and reconnect, which is what keeps it fresh.
+     */
+    setDirectoryOnlineToken(agentName, token) {
+        this.#directoryOnlineTokens.set(agentName, token);
+        this.#directoryOnlineTokenAbsent.delete(agentName);
+    }
+    /**
+     * DOD-M15-RELAYSLOTS-1 review M1: the directory issued no token, and this is which absence it was.
+     *
+     * Kept so the relay's eventual `online_token_required` refusal can be reported with the cause the
+     * DIRECTORY knew and the relay never learns — most importantly `not_registered_here`, where the
+     * generic advice ("check that you are reaching a directory") points at a connection that is
+     * working and away from the actual problem.
+     */
+    #directoryOnlineTokenAbsent = new Map();
+    setDirectoryOnlineTokenAbsent(agentName, reason) {
+        this.#directoryOnlineTokens.delete(agentName);
+        this.#directoryOnlineTokenAbsent.set(agentName, reason ?? "unstated");
+    }
+    /**
+     * The current token, or `undefined` when the directory has not issued one — either no directory
+     * connection yet, or this key has no agent profile there. Undefined is a real answer, not a
+     * missing one: the relay refuses without a token, which is the intended outcome for a key the
+     * directory does not recognise.
+     */
+    getDirectoryOnlineToken(agentName) {
+        return this.#directoryOnlineTokens.get(agentName);
+    }
     /**
      * DOD-NAT-REACHABILITY-1 (Phase 2): accept the directory's relay-pool endpoints
      * for an agent (arrives with signaling_auth_ok, i.e. on every connect AND every
@@ -10172,6 +12987,57 @@ export class SessionNodeManager {
      * of past sessions (getAgentRelayEndpoints — covers a directory that predates
      * the auth_ok extension).
      */
+    /**
+     * DOD-M15-RELAYSLOTS-1: relays this agent should skip, and until when — see the failover note in
+     * `#reservationCircuitAddrs`. Keyed agent → relay peer id → expiry.
+     *
+     * Time-boxed rather than permanent because the fault is somebody else's to fix and we will not
+     * hear when they have: an operator sets the missing directory key and restarts, and this agent
+     * should find that relay again without needing its own restart.
+     */
+    #relayQuarantine = new Map();
+    /**
+     * Is this agent currently skipping this relay? The observable half of the failover decision — a
+     * test that asserts only on the classifier's boolean proves nothing about what the daemon does.
+     */
+    isRelayQuarantined(agentName, relayPeerId) {
+        return this.#relayQuarantineFor(agentName).has(relayPeerId);
+    }
+    /** Live quarantine entries for an agent, expired ones swept on read. */
+    #relayQuarantineFor(agentName) {
+        const byRelay = this.#relayQuarantine.get(agentName);
+        if (!byRelay)
+            return new Set();
+        const now = Date.now();
+        for (const [relayPeerId, expiresAt] of byRelay) {
+            if (now >= expiresAt)
+                byRelay.delete(relayPeerId);
+        }
+        if (byRelay.size === 0)
+            this.#relayQuarantine.delete(agentName);
+        return new Set(byRelay.keys());
+    }
+    /**
+     * Skip this relay for this agent for a while. Called only for refusals the classifier marks
+     * `tryAnotherRelay` — a fault of the relay's, not one that would follow us to the next one.
+     */
+    #quarantineRelay(agentName, relayPeerId, reason) {
+        let byRelay = this.#relayQuarantine.get(agentName);
+        if (!byRelay) {
+            byRelay = new Map();
+            this.#relayQuarantine.set(agentName, byRelay);
+        }
+        byRelay.set(relayPeerId, Date.now() + RELAY_QUARANTINE_MS);
+        this.#logger.warn("session.standing_receiver.relay_quarantined", {
+            agentName,
+            relayPeerId,
+            reason,
+            forMs: RELAY_QUARANTINE_MS,
+            impact: "this relay refused this agent for a fault of its own, so the agent will ask a " +
+                "different relay for its reservation until the quarantine lapses. Its inbound reachability " +
+                "is restored by moving, not by waiting for someone to fix that relay.",
+        });
+    }
     #reservationCircuitAddrs(agentName) {
         let persisted;
         try {
@@ -10193,9 +13059,33 @@ export class SessionNodeManager {
             if (!merged.has(ep.relayPeerId))
                 merged.set(ep.relayPeerId, ep);
         }
+        /**
+         * DOD-M15-RELAYSLOTS-1 — **THE FAILOVER.** Skip relays that refused this agent for a fault of
+         * their own (today: a relay holding no directory public key, which can verify nobody and is
+         * refusing everyone). We run several relays precisely so one being broken is survivable.
+         *
+         * ⚠️ NEVER TO THE POINT OF HAVING NO RELAY AT ALL. If the quarantine would empty the candidate
+         * list it is ignored wholesale: a relay that refuses is strictly better than no relay, because
+         * the refusal at least has a cause the operator can read, while an agent with no candidates is
+         * simply unreachable with nothing to show for it. This is the same "refusing too eagerly is the
+         * failure mode" rule, applied to the client's own choice of where to ask.
+         */
+        const quarantined = this.#relayQuarantineFor(agentName);
+        const eligible = [...merged.values()].filter((ep) => !quarantined.has(ep.relayPeerId));
+        const usable = eligible.length > 0 ? eligible : [...merged.values()];
+        if (eligible.length === 0 && quarantined.size > 0 && merged.size > 0) {
+            this.#logger.warn("session.standing_receiver.relay_quarantine.ignored", {
+                agentName,
+                quarantined: [...quarantined],
+                impact: "every known relay has refused this agent for a relay-side fault, so the quarantine " +
+                    "is being ignored and they are all being tried again. A relay that refuses with a cause " +
+                    "is better than no relay at all — but if this persists, every relay this agent knows " +
+                    "about is misconfigured, and that is the thing to look at.",
+            });
+        }
         const addrs = [];
         const relayPeerIds = [];
-        for (const ep of merged.values()) {
+        for (const ep of usable) {
             const base = ep.relayAddrs[0];
             if (!base)
                 continue;
@@ -10429,6 +13319,133 @@ export class SessionNodeManager {
      * Candidates are tried in order (directory pool first). The first that actually
      * grants a reservation wins; the rest are never touched.
      */
+    /**
+     * DOD-M15-RELAYSLOTS-1 — tell the relay this transport identity belongs to a registered agent, so
+     * the reservation it just refused is granted on the next attempt.
+     *
+     * Returns `"proven"` on success, or the shape of the failure so the candidate loop can act on it.
+     * It never throws: throwing would turn one unreachable relay into a failure to build a receiver
+     * at all.
+     *
+     * ─── Why this returns a verdict instead of a boolean ──────────────────────────────────────────
+     *
+     * Review HIGH-1/HIGH-2. Putting the reservation behind a proof MOVED THE FIRST REFUSAL onto this
+     * path. `#authenticateStandingReceiver` does everything right with a refusal — records it where
+     * `cello_status` can read it, and quarantines a relay whose fault is its own — but it runs only
+     * on a receiver that ALREADY HAS a reservation, so under the new gate a total failure never
+     * reaches it. This method was logging `proven: false` and returning.
+     *
+     * What that cost the operator: an expired token, or an agent at its slot cap, refused by every
+     * relay in the pool. `cello_status` shows an agent that is online and reachable by nobody, with
+     * no cause anywhere the person will look — while the relay had computed the cause, the count, and
+     * the next step, and put them on the wire. And `slot_cap_exceeded` is classified
+     * `tryAnotherRelay: false` precisely so the client STOPS walking the fleet; without the verdict,
+     * the loop walked it anyway, turning one client-side fault into what reads as a fleet outage.
+     */
+    async #proveToRelay(agentName, circuitAddr, node, correlationId, 
+    /**
+     * Whether this proof is the STANDING RECEIVER's, and may therefore write the surface
+     * `cello_status` reads as "your standing receiver was refused".
+     *
+     * A revival proves itself too, and its refusal is real — but it is not evidence about the
+     * receiver. A receiver that proved thirty seconds ago and holds a slot, plus a revival refused
+     * with `slot_cap_exceeded`, would otherwise have `cello_status` report a front door as refused
+     * while it is open. The refusal is still logged and still steers the candidate loop; what it
+     * does not do is claim to be about something it did not measure.
+     */
+    surfaceAsReceiverRefusal) {
+        const relayPeerId = relayPeerIdOf(circuitAddr);
+        const baseRelayAddr = circuitAddr.split("/p2p-circuit")[0];
+        if (!relayPeerId || !baseRelayAddr) {
+            this.#logger.warn("session.standing_receiver.prove.address_unreadable", {
+                agentName,
+                circuitAddr,
+                correlationId,
+                impact: "this candidate's circuit address does not name a relay peer, so there is nothing " +
+                    "to prove to and its reservation will stay refused. Skipped silently before — which made " +
+                    "a malformed address look identical to a relay that simply said no.",
+            });
+            return "unavailable";
+        }
+        /**
+         * Declared out here so the `finally` can close it. Scoped inside the `try` before, so a throw
+         * from `proveReservation` skipped the close and left the stream and its pending settles behind.
+         */
+        let client;
+        try {
+            client = this.#detachedRelayClientBuilder?.(agentName, relayPeerId, [baseRelayAddr], {
+                receiptStore: this.#relayReceiptStore ?? undefined,
+                sealLeafStore: this.#sealLeafStore ?? undefined,
+                onlineToken: () => this.getDirectoryOnlineToken(agentName),
+            });
+            if (!client) {
+                this.#logger.warn("session.standing_receiver.prove.no_builder", {
+                    agentName,
+                    relayPeerId,
+                    correlationId,
+                    impact: "no relay client could be built, so this receiver cannot prove itself and the " +
+                        "relay will refuse its reservation again. The agent is reachable only over a direct " +
+                        "connection until this is wired.",
+                });
+                return "unavailable";
+            }
+            const proven = await client.proveReservation(node);
+            if (proven) {
+                if (surfaceAsReceiverRefusal)
+                    this.#srRelayRefusal.delete(agentName);
+                this.#logger.info("session.standing_receiver.prove.result", {
+                    agentName, relayPeerId, peerId: node.getPeerId(), proven: true, correlationId,
+                });
+                return "proven";
+            }
+            /**
+             * The same two lines `#authenticateStandingReceiver` runs, for the same reason. The `else`
+             * matters as much as the `if`: `proveReservation` also fails for transport reasons, which
+             * leave `getLastAuthRefusal()` null, and leaving a PREVIOUS refusal in the map would have
+             * `cello_status` explaining a cause that is no longer what is wrong.
+             */
+            const refusal = client.getLastAuthRefusal();
+            if (surfaceAsReceiverRefusal) {
+                if (refusal) {
+                    this.#srRelayRefusal.set(agentName, { ...this.#withDirectoryCause(agentName, refusal), relayPeerId });
+                }
+                else {
+                    this.#srRelayRefusal.delete(agentName);
+                }
+            }
+            this.#logger.warn("session.standing_receiver.prove.result", {
+                agentName,
+                relayPeerId,
+                peerId: node.getPeerId(),
+                proven: false,
+                refusalReason: refusal?.reason ?? "no_relay_verdict",
+                tryAnotherRelay: refusal?.tryAnotherRelay ?? true,
+                correlationId,
+                impact: refusal?.advice ??
+                    "the relay would not accept this agent's proof and said nothing about why, which is what " +
+                        "a transport failure mid-handshake looks like. The candidate loop moves on to the next relay.",
+            });
+            if (refusal && !refusal.tryAnotherRelay)
+                return "refused_this_agent";
+            if (refusal?.tryAnotherRelay && !this.#shuttingDown) {
+                this.#quarantineRelay(agentName, relayPeerId, refusal.reason);
+            }
+            return "refused_try_another_relay";
+        }
+        catch (err) {
+            this.#logger.warn("session.standing_receiver.prove.failed", {
+                agentName,
+                correlationId,
+                error: extractErrorMessage(err),
+                impact: "this receiver could not prove itself, so its retry will be refused and the " +
+                    "candidate loop will try the next relay.",
+            });
+            return "unavailable";
+        }
+        finally {
+            client?.close();
+        }
+    }
     async #startReceiverNode(agentName, sessionId, gater, candidateCircuitAddrs, correlationId) {
         for (const circuitAddr of candidateCircuitAddrs) {
             // DOD-M12B-SESSION-SEED-1: A SEED PER CANDIDATE, NOT ONE FOR THE LOOP.
@@ -10444,60 +13461,158 @@ export class SessionNodeManager {
             //
             // Nothing reads the seed before the winner is installed, so per-candidate costs nothing.
             const candidateSeed = randomBytes(32);
-            const candidate = await this.#factory.createNode({
-                sessionId,
-                connectionGater: gater,
-                nodeType: "standing_receiver",
-                circuitRelayListenAddrs: [circuitAddr],
-                transportPrivateKey: candidateSeed,
-            });
-            let timer;
-            const timedOut = Symbol("reservation_timeout");
-            let outcome = "failed";
-            let error = "";
-            try {
-                outcome = await Promise.race([
-                    candidate.start().then(() => "started"),
-                    new Promise((resolve) => {
-                        timer = setTimeout(() => resolve(timedOut), this.#srReservationTimeoutMs);
-                    }),
-                ]);
+            /**
+             * DOD-M15-RELAYSLOTS-1 — **TWO ATTEMPTS PER RELAY: ask, prove, ask again.**
+             *
+             * The relay now refuses a reservation from a peer that has not shown it belongs to a
+             * registered agent. A brand-new receiver has shown nothing, so its FIRST ask is refused —
+             * expected, not a failure. It then authenticates over `/cello/relay/1.0.0`, which tells the
+             * relay this transport identity is a registered agent's, and asks again on a fresh connection
+             * carrying the SAME identity (that is what reusing `candidateSeed` buys).
+             *
+             * ⚠️ It has to be two connections, and that was measured rather than chosen. Taking the
+             * reservation by hand on the same connection as the proof DOES get a slot — and libp2p then
+             * announces no circuit address for it, because it only announces addresses for reservations
+             * its own relay-discovery made. The agent would hold a slot nobody could dial through.
+             */
+            let candidateNode;
+            // Set when the relay refused the AGENT rather than being unwilling itself: every other relay
+            // in the pool answers identically, so the walk ends here rather than reproducing it N times.
+            let candidateRefusedAgent = false;
+            for (let attempt = 0; attempt < 2; attempt++) {
+                const candidate = await this.#createAgentNode(agentName, {
+                    sessionId,
+                    connectionGater: gater,
+                    nodeType: "standing_receiver",
+                    circuitRelayListenAddrs: [circuitAddr],
+                    transportPrivateKey: candidateSeed,
+                });
+                let timer;
+                const timedOut = Symbol("reservation_timeout");
+                let outcome = "failed";
+                let error = "";
+                try {
+                    outcome = await Promise.race([
+                        candidate.start().then(() => "started"),
+                        new Promise((resolve) => {
+                            timer = setTimeout(() => resolve(timedOut), this.#srReservationTimeoutMs);
+                        }),
+                    ]);
+                }
+                catch (err) {
+                    error = extractErrorMessage(err);
+                }
+                finally {
+                    if (timer !== undefined)
+                        clearTimeout(timer);
+                }
+                // The only proof that counts: the relay actually GRANTED the reservation.
+                // start() resolving is not enough — a relay that is out of reservation slots
+                // completes the handshake and simply grants nothing, leaving a node that looks
+                // started and is reachable by nobody.
+                if (outcome === "started" && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
+                    candidateNode = candidate;
+                    break;
+                }
+                /**
+                 * No reservation. On the FIRST attempt that is the expected answer for a receiver that has
+                 * not proved itself yet, so prove and go round once more. `proveReservation` opens its own
+                 * stream from this node, which is what binds this transport identity to the agent at the
+                 * relay; the relay remembers it across the reconnect below.
+                 */
+                if (attempt === 0 && outcome === "started") {
+                    const verdict = await this.#proveToRelay(agentName, circuitAddr, candidate, correlationId, true);
+                    // AWAITED, not fire-and-forget: the retry rebuilds on this same transport identity, and two
+                    // live nodes sharing one peer id is the defect DOD-M12B-SESSION-SEED-1 exists to prevent.
+                    try {
+                        await candidate.stop();
+                    }
+                    catch { /* it may never have finished starting */ }
+                    /**
+                     * DOD-M15-RELAYSLOTS-1 clause 9 — **A CLIENT-SIDE REFUSAL ENDS THE WALK.**
+                     *
+                     * `slot_cap_exceeded` and an expired or missing token are classified `tryAnotherRelay:
+                     * false` because they reproduce on every relay in the pool: the cap is per AGENT, and the
+                     * token comes from the directory, not from here. Walking on costs a node build and two
+                     * dials per remaining relay to arrive at the same answer, and it makes one client-side
+                     * fault look like a fleet-wide outage in the logs. The refusal is already recorded where
+                     * `cello_status` reads it, so stopping is not silence.
+                     */
+                    if (verdict === "refused_this_agent") {
+                        this.#srLastRejectionReason.set(agentName, "relay_refused_this_agent");
+                        this.#logger.warn("session.standing_receiver.relay.rejected", {
+                            agentName,
+                            circuitAddr,
+                            reason: "relay_refused_this_agent",
+                            attempts: attempt + 1,
+                            correlationId,
+                            impact: "the relay refused this AGENT rather than this relay being unwilling or " +
+                                "unwell, so every other relay would refuse it identically. Stopped here; " +
+                                "cello_status carries the cause and what to do about it.",
+                        });
+                        candidateRefusedAgent = true;
+                        break;
+                    }
+                    /**
+                     * ⚠️ RETRY ONLY WHAT A PROOF CAN FIX. The second attempt exists because the relay now
+                     * remembers this transport identity; if the proof did not land, it remembers nothing and
+                     * the retry is a node build and a dial spent to be refused identically. Only `proven`
+                     * earns the retry — everything else moves to the next relay.
+                     */
+                    if (verdict !== "proven") {
+                        this.#srLastRejectionReason.set(agentName, "relay_proof_refused");
+                        this.#logger.warn("session.standing_receiver.relay.rejected", {
+                            agentName,
+                            circuitAddr,
+                            reason: "relay_proof_refused",
+                            attempts: attempt + 1,
+                            correlationId,
+                            impact: "this relay would not take the agent's proof, so it will refuse the retry the " +
+                                "same way. Moving to the next relay rather than asking this one twice.",
+                        });
+                        break;
+                    }
+                    continue;
+                }
+                const rejectionReason = outcome === "started"
+                    ? /**
+                       * ⚠️ Review MEDIUM-7 — **"STARTED" DOES NOT MEAN THE RELAY ANSWERED.** A circuit listen
+                       * entry sets `FaultTolerance.NO_FATAL`, and `start()` only throws when the DIRECT
+                       * listener fails, so a relay that is simply DOWN resolves `started` with no circuit
+                       * address — indistinguishable, here, from a relay that answered and granted nothing.
+                       * Reporting that as `relay_granted_no_reservation` sends the operator to look at relay
+                       * capacity for what is a network fault. An open connection to the relay peer is the
+                       * thing that separates them, and we have one to ask.
+                       */
+                        (candidate.getConnections().some((c) => c.peerId === relayPeerIdOf(circuitAddr))
+                            ? "relay_granted_no_reservation"
+                            : "relay_unreachable")
+                    : outcome === "failed"
+                        ? "relay_unreachable"
+                        : "reservation_did_not_complete_in_time";
+                this.#srLastRejectionReason.set(agentName, rejectionReason);
+                this.#logger.warn("session.standing_receiver.relay.rejected", {
+                    agentName,
+                    circuitAddr,
+                    reason: rejectionReason,
+                    attempts: attempt + 1,
+                    ...(error !== "" ? { error } : {}),
+                    correlationId,
+                });
+                // Abandon it. start() may still be parked on a dial, so stop() is best-effort
+                // and must never block the fallback.
+                void Promise.resolve()
+                    .then(() => candidate.stop())
+                    .catch(() => { });
+                break;
             }
-            catch (err) {
-                error = extractErrorMessage(err);
-            }
-            finally {
-                if (timer !== undefined)
-                    clearTimeout(timer);
-            }
-            // The only proof that counts: the relay actually GRANTED the reservation.
-            // start() resolving is not enough — a relay that is out of reservation slots
-            // completes the handshake and simply grants nothing, leaving a node that looks
-            // started and is reachable by nobody.
-            if (outcome === "started" && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
-                return { node: candidate, seed: candidateSeed };
-            }
-            const rejectionReason = outcome === "started"
-                ? "relay_granted_no_reservation"
-                : outcome === "failed"
-                    ? "relay_unreachable"
-                    : "reservation_did_not_complete_in_time";
-            this.#srLastRejectionReason.set(agentName, rejectionReason);
-            this.#logger.warn("session.standing_receiver.relay.rejected", {
-                agentName,
-                circuitAddr,
-                reason: rejectionReason,
-                ...(error !== "" ? { error } : {}),
-                correlationId,
-            });
-            // Abandon it. start() may still be parked on a dial, so stop() is best-effort
-            // and must never block the fallback.
-            void Promise.resolve()
-                .then(() => candidate.stop())
-                .catch(() => { });
+            if (candidateNode)
+                return { node: candidateNode, seed: candidateSeed };
+            if (candidateRefusedAgent)
+                break;
         }
         const plainSeed = randomBytes(32);
-        const plain = await this.#factory.createNode({
+        const plain = await this.#createAgentNode(agentName, {
             sessionId,
             connectionGater: gater,
             nodeType: "standing_receiver",
@@ -10624,6 +13739,23 @@ export class SessionNodeManager {
             sessionPeerId: node.getPeerId(),
             correlationId,
         });
+        // DOD-M15-RELAYAUTH-1: authenticate to the reservation relay NOW, not when a session first
+        // needs one. The relay times out a reservation nobody has proven key possession for
+        // (relay-connection-gater.ts, trustless-cello) — proving it here, instead of waiting for a
+        // real session to exist, is what keeps this reservation alive past that grace window.
+        // Best-effort and unawaited: a failure here costs nothing beyond the relay's own grace-window
+        // revoke, which the reservation watchdog already treats as an ordinary lost reservation.
+        if (reservedRelayPeerId !== undefined && heldCircuitAddr !== undefined) {
+            void this.#authenticateStandingReceiver(agentName, node, reservedRelayPeerId, heldCircuitAddr, correlationId)
+                .catch((err) => {
+                this.#logger.warn("session.standing_receiver.relay_auth.failed", {
+                    agentName,
+                    relayPeerId: reservedRelayPeerId,
+                    error: extractErrorMessage(err),
+                    correlationId,
+                });
+            });
+        }
         // DOD-NAT-REACHABILITY-1 observability: how reachable did this receiver come
         // up? circuitAddrs === 0 with reservations requested means every relay
         // refused/was unreachable — the agent is deaf to NAT'd initiators (public
@@ -10733,63 +13865,131 @@ export class SessionNodeManager {
      */
     async #buildRevivedNode(sessionId, gater, seed, candidateAddrs, agentName) {
         for (const circuitAddr of candidateAddrs.slice(0, REVIVE_RESERVATION_CANDIDATES)) {
-            const candidate = await this.#factory.createNode({
-                sessionId,
-                connectionGater: gater,
-                nodeType: "session",
-                inboundReachable: true,
-                transportPrivateKey: seed,
-                circuitRelayListenAddrs: [circuitAddr],
-            });
-            // KEEP THE START PROMISE. Review HIGH-3: `libp2p.stop()` opens with
-            // `if (this.status !== 'started') return`, and during the whole timeout window the status is
-            // `'starting'` — so awaiting `stop()` on a timed-out candidate stopped nothing and waited for
-            // nothing. The abandoned `start()` stayed in flight, and if the relay answered late the node
-            // went live holding THIS SESSION'S peer id, sharing the gater (so it admits the counterparty)
-            // with no content handler registered, and with no reference left to stop it. Verified against
-            // libp2p 3.3.2 rather than assumed.
-            const startP = candidate.start();
-            let startError;
-            const started = await Promise.race([
-                startP.then(() => true),
-                new Promise((res) => setTimeout(() => res(false), REVIVE_RESERVATION_TIMEOUT_MS).unref?.()),
-            ]).catch((err) => { startError = err; return false; });
-            if (started && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
-                this.#logger.info("session.revive.reservation.granted", { agentName, sessionId });
-                return candidate;
-            }
-            // Started but granted nothing, or never started. Either way this node is not the one.
-            //
-            // Review MEDIUM-5: name WHICH of the three causes this was, the way `#startReceiverNode` does.
-            // "declined" alone stood for a relay that is full, a relay that is unreachable, and a relay
-            // that is merely slow — three different problems with three different responses, and the
-            // thrown error was discarded entirely.
-            const declineReason = started
-                ? "relay_granted_no_reservation"
-                : startError !== undefined
-                    ? "relay_unreachable"
-                    : "reservation_did_not_complete_in_time";
-            const isLast = circuitAddr === candidateAddrs.slice(0, REVIVE_RESERVATION_CANDIDATES).at(-1);
-            this.#logger.warn("session.revive.reservation.declined", {
-                agentName,
-                sessionId,
-                circuitAddr,
-                reason: declineReason,
-                ...(startError !== undefined ? { error: extractErrorMessage(startError) } : {}),
-                impact: isLast
-                    ? "no relay granted; the session comes up reachable only via the relay park route"
-                    : "trying the next relay",
-            });
-            // Teardown at SETTLEMENT, not now: a `stop()` issued while the node is still starting is a
-            // no-op (see above), so the only way to guarantee this node dies is to wait for its own start
-            // to finish first. Not awaited, so a hung start cannot hold the revival up — the point is that
-            // the teardown eventually happens, not that it happens before the next candidate.
-            void startP.then(() => candidate.stop().catch(() => { }), () => { });
+            /**
+             * DOD-M15-RELAYSLOTS-1 — **A REVIVAL PROVES ITSELF TOO.**
+             *
+             * Review HIGH-3. The relay refuses a reservation to a peer that has not shown it belongs to
+             * a registered agent, and it remembers a proof for two minutes. A revival is almost never
+             * inside that window — the receiver last proved this peer id when the session was created,
+             * possibly days ago — so without this loop every revived session was refused by every
+             * candidate and came up on the plain floor: alive, `active`, and dialable by nobody, with
+             * every message in both directions forced through the relay park route.
+             *
+             * Two attempts, exactly as `#startReceiverNode` does it, and for the same measured reason:
+             * a reservation taken by hand on the same connection as the proof yields no dialable address.
+             * The seed is fixed here — that is what a revival IS — so the second attempt necessarily
+             * carries the identity the relay just recorded.
+             */
+            let revivedNode;
+            let terminalRefusal = false;
+            for (let attempt = 0; attempt < 2 && !terminalRefusal; attempt++) {
+                const candidate = await this.#createAgentNode(agentName, {
+                    sessionId,
+                    connectionGater: gater,
+                    nodeType: "session",
+                    inboundReachable: true,
+                    transportPrivateKey: seed,
+                    circuitRelayListenAddrs: [circuitAddr],
+                });
+                // KEEP THE START PROMISE. Review HIGH-3: `libp2p.stop()` opens with
+                // `if (this.status !== 'started') return`, and during the whole timeout window the status is
+                // `'starting'` — so awaiting `stop()` on a timed-out candidate stopped nothing and waited for
+                // nothing. The abandoned `start()` stayed in flight, and if the relay answered late the node
+                // went live holding THIS SESSION'S peer id, sharing the gater (so it admits the counterparty)
+                // with no content handler registered, and with no reference left to stop it. Verified against
+                // libp2p 3.3.2 rather than assumed.
+                const startP = candidate.start();
+                let startError;
+                const started = await Promise.race([
+                    startP.then(() => true),
+                    new Promise((res) => setTimeout(() => res(false), REVIVE_RESERVATION_TIMEOUT_MS).unref?.()),
+                ]).catch((err) => { startError = err; return false; });
+                if (started && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
+                    this.#logger.info("session.revive.reservation.granted", { agentName, sessionId, attempts: attempt + 1 });
+                    revivedNode = candidate;
+                    break;
+                }
+                /**
+                 * No reservation on the first attempt is the EXPECTED answer for a peer whose proof has
+                 * aged out. Prove and go round once more.
+                 *
+                 * Only when `started` is true: `libp2p.stop()` opens with `if (this.status !== 'started')
+                 * return`, so a timed-out candidate cannot be torn down here and rebuilding on its seed
+                 * would put two live nodes on one peer id. That case falls through to the settlement-chained
+                 * teardown below, which is the only thing that reliably kills a still-starting node.
+                 */
+                if (attempt === 0 && started) {
+                    const verdict = await this.#proveToRelay(agentName, circuitAddr, candidate, sessionId, false);
+                    try {
+                        await candidate.stop();
+                    }
+                    catch { /* best-effort */ }
+                    if (verdict === "refused_this_agent") {
+                        // The refusal is about this AGENT, so the remaining candidates would answer identically.
+                        terminalRefusal = true;
+                        this.#logger.warn("session.revive.reservation.declined", {
+                            agentName,
+                            sessionId,
+                            circuitAddr,
+                            reason: "relay_refused_this_agent",
+                            impact: "the relay refused this agent rather than being unwilling or unwell, so every " +
+                                "other relay refuses it the same way. The session comes up reachable only via the " +
+                                "relay park route; cello_status carries the cause.",
+                        });
+                        break;
+                    }
+                    // Only a landed proof earns the retry — see the same rule in `#startReceiverNode`.
+                    if (verdict !== "proven") {
+                        this.#logger.warn("session.revive.reservation.declined", {
+                            agentName,
+                            sessionId,
+                            circuitAddr,
+                            reason: "relay_proof_refused",
+                            impact: "this relay would not take the agent's proof, so asking it again would be " +
+                                "refused the same way. Trying the next relay.",
+                        });
+                        break;
+                    }
+                    continue;
+                }
+                // Started but granted nothing, or never started. Either way this node is not the one.
+                //
+                // Review MEDIUM-5: name WHICH of the three causes this was, the way `#startReceiverNode` does.
+                // "declined" alone stood for a relay that is full, a relay that is unreachable, and a relay
+                // that is merely slow — three different problems with three different responses, and the
+                // thrown error was discarded entirely.
+                const declineReason = started
+                    ? "relay_granted_no_reservation"
+                    : startError !== undefined
+                        ? "relay_unreachable"
+                        : "reservation_did_not_complete_in_time";
+                const isLast = circuitAddr === candidateAddrs.slice(0, REVIVE_RESERVATION_CANDIDATES).at(-1);
+                this.#logger.warn("session.revive.reservation.declined", {
+                    agentName,
+                    sessionId,
+                    circuitAddr,
+                    reason: declineReason,
+                    ...(startError !== undefined ? { error: extractErrorMessage(startError) } : {}),
+                    impact: isLast
+                        ? "no relay granted; the session comes up reachable only via the relay park route"
+                        : "trying the next relay",
+                });
+                // Teardown at SETTLEMENT, not now: a `stop()` issued while the node is still starting is a
+                // no-op (see above), so the only way to guarantee this node dies is to wait for its own start
+                // to finish first. Not awaited, so a hung start cannot hold the revival up — the point is that
+                // the teardown eventually happens, not that it happens before the next candidate.
+                void startP.then(() => candidate.stop().catch(() => { }), () => { });
+                break;
+            }
+            if (revivedNode)
+                return revivedNode;
+            if (terminalRefusal)
+                break;
         }
         // THE FLOOR. No reservation, so the counterparty cannot dial us directly — but their messages
         // park at the relay and drain, which is how every message in the 2026-08-18 test arrived. A
         // session usable one way beats a session that never comes back.
-        const plain = await this.#factory.createNode({
+        const plain = await this.#createAgentNode(agentName, {
             sessionId,
             connectionGater: gater,
             nodeType: "session",
@@ -10855,6 +14055,8 @@ export class SessionNodeManager {
                 client = this.#detachedRelayClientBuilder?.(agentName, ep.relayPeerId, [...ep.relayAddrs], {
                     receiptStore: this.#relayReceiptStore ?? undefined,
                     sealLeafStore: this.#sealLeafStore ?? undefined,
+                    // DOD-M15-RELAYSLOTS-1: read at each auth, never snapshotted — the token expires hourly.
+                    onlineToken: () => this.getDirectoryOnlineToken(agentName),
                 });
                 if (!client) {
                     this.#logger.warn("session.revive.relay.builder_absent", {
@@ -11130,6 +14332,24 @@ export class SessionNodeManager {
         // different `impact` text — one event name standing for two meanings, fired twice for a single
         // condition. `#reconnectRevivedSessionRelay` takes it as a parameter now.
         const persistedRelay = this.getPersistedRelayEndpoint(agentName, sessionId);
+        // 006-CRYPTO: a REVIVED session mints a FRESH keypair and re-keys — Decisions Carried #5. That
+        // holds because the interrupt path destroys the old secret when it drops the entry; until it
+        // did, this call found the stale key still in the map and quietly kept it. The salt, which IS
+        // persisted, is re-read from the row instead — opposite lifetimes, deliberately.
+        this.#mintSessionEphemeral(agentName, sessionId);
+        /**
+         * AND ANNOUNCE IT — review F1, second half. Minting a fresh key achieves nothing on its own: the
+         * COUNTERPARTY has to hear about it, and it is the side that did NOT restart, so it is not
+         * tearing anything down or reconnecting. `#sendEphemeralFrame` otherwise rides `onPeerConnect`,
+         * which does not fire again for a connection that never dropped — the ordinary shape when only
+         * one end's witness stream closed, which is what a relay roll produces.
+         *
+         * Without this the two ends sit on different keys for the life of the session, every message
+         * fails GCM, and the receiving operator is told the content may have been MODIFIED IN FLIGHT for
+         * what is a local key skew. Deferred a tick so the revived node's handlers are registered before
+         * the frame goes out.
+         */
+        setTimeout(() => { void this.#sendEphemeralFrame(agentName, sessionId, "revive-rekey"); }, 0);
         this.#activeNodes.set(key, {
             node,
             agentName,
@@ -11167,7 +14387,37 @@ export class SessionNodeManager {
         // `interrupted` leaves a live, talking session where REVIVAL-BOUND-1's sweep can seal or abandon
         // it. Failing here means tearing the node back down rather than running in that split state.
         if (!this.#updateSessionStatus(agentName, sessionId, "active")) {
+            /**
+             * DOD-M15-RELAYLEAK-1 (review MEDIUM-4) — **THIS TEARDOWN LEAKED THE EXACT THING THE LINE IS
+             * ABOUT, THROUGH A DIFFERENT DOOR.**
+             *
+             * `#reconnectRevivedSessionRelay` above has already called `registerSession` on the cached
+             * relay client and hung it on this entry. Deleting the map key and stopping the node released
+             * the daemon's own objects and left that registration standing with **no owner** — and
+             * `#detachSessionRelay` closes a client only when `!hasSessions()`, so the orphaned
+             * registration held that predicate false for the life of the process. The client, its
+             * authenticated stream and its relay-side reservation were unreachable and immortal.
+             *
+             * The shutdown loop this line added does sweep it at exit, which is precisely why it had to be
+             * fixed here too: a leak that is only cleaned up by process death is still a leak for every
+             * hour the daemon is up.
+             */
+            /**
+             * ⚠️ Review MEDIUM-2 — **THE ENTRY IS MATCHED BY IDENTITY, NOT BY KEY.** `reviveSessionNode`
+             * has no in-flight guard: its `if (live) return` is separated from `#activeNodes.set` by the
+             * whole node build, so two revivals for one key can both reach the `set` and the second
+             * overwrites the first. Looking up by key alone would then hand THIS failing revival the
+             * OTHER one's live entry, and detaching it would unregister a running session's leaf handler
+             * — closing the client that session is using if it was the last one on it. Comparing `node`
+             * costs one token and makes "the entry I created" provable rather than assumed.
+             */
+            const revivedEntry = this.#activeNodes.get(key);
+            if (revivedEntry?.node === node)
+                this.#detachSessionRelay(revivedEntry);
             this.#activeNodes.delete(key);
+            // 006-CRYPTO: the revival FAILED, so the key it just minted belongs to a session that never
+            // came back. Dropping the entry without this would strand it for the daemon's lifetime.
+            this.#destroySessionEphemeralFor(agentName, sessionId);
             try {
                 await node.stop();
             }