@cello-protocol/daemon 0.0.182 → 0.0.184

package/dist/daemon.js

@@ -52,6 +52,7 @@ import { createSignalingConnect } from "./signaling-connect.js";
 import { DbRegistrationPersistence, DbIdentityStore } from "./db-identity-store.js";
 import { DbManifestVersionStore } from "./manifest-version-store-db.js";
 import { composeSealedSubmission, sendSealedSubmission, fetchSubmissionResults } from "./signal-submission.js";
+import { SubmissionRetryQueue, isRetryableSendFailure, DEFAULT_RETRY_WINDOW_MS } from "./submission-retry.js";
 /**
  * Cap on a refusal message (M10B-D4). Generous for prose — the point is not to police what the
  * operator writes, it is that an UNBOUNDED string reaches a signer, a sealer and a transport, and
@@ -72,7 +73,7 @@ import { resolveDirectoryUrl } from "./directory-bootstrap.js";
 import { registerContactHandlers } from "./contact-handlers.js";
 import { createSealCoordinator } from "./seal-coordinator.js";
 import { createTelegramDoorbell } from "./telegram-doorbell.js";
-import { registerSessionContentHandlers } from "./session-content-handlers.js";
+import { registerSessionContentHandlers, sentAuthorship } from "./session-content-handlers.js";
 import { createDocumentLayer, agentPublicKeyFromId } from "./document-layer.js";
 import { isDocumentFrame } from "./document-frame-router.js";
 import { INBOUND_INJECTION_BLOCKED } from "@cello-protocol/gateway";
@@ -89,6 +90,7 @@ import { registerCloseSessionHandler } from "./close-session-handler.js";
 import { createInboundSessions } from "./inbound-sessions.js";
 import { createOutboundSessions } from "./outbound-sessions.js";
 import { registerSessionReadHandlers } from "./session-read-handlers.js";
+import { registerInclusionProofHandlers } from "./inclusion-proof-handlers.js";
 import { pullSealCertificate } from "./seal-certificate-pull.js";
 import { createBackup, inspectBackup } from "./backup-restore.js";
 import { resolveCurrentAgentFor } from "./agent-selection.js";
@@ -110,6 +112,7 @@ import { countAttendance, ContentTakeLedger } from "./co-attendance.js";
 import { isOwnAwayAutoReply, AWAY_AUTO_REPLY_TEXTS, markAsAutoReply, isAutoReplyMarked } from "./away-detection.js";
 import { createDeliveryOpenRegistry } from "./delivery-open-registry.js";
 import { FrontierMismatchStore, renderFrontierMismatch } from "./frontier-mismatch.js";
+import { relayOnlyState } from "./relay-only.js";
 import { decodeCbor } from "@cello-protocol/protocol-types";
 // Minimal no-op KeyProvider stub for session nodes.
 // Session nodes don't need signing keys — libp2p generates its own fresh
@@ -162,9 +165,15 @@ export class ProductionSessionNodeFactory {
             listenAddresses: [listenAddr, ...(config.circuitRelayListenAddrs ?? [])],
             ...(announce ? { announceAddresses: announce } : {}),
             connectionGater: config.connectionGater,
+            // DOD-M15-RELAYONLY-1: an agent that asked never to be directly reachable must not hole-punch
+            // its way to a direct connection. dcutr's job is to UPGRADE a relayed connection, and the
+            // INBOUND side starts that upgrade — which is precisely the standing receiver. So filtering
+            // what the directory publishes is not enough on its own: the address a peer cannot be TOLD, a
+            // hole-punch still REVEALS, and it happens inside libp2p after every assertion has passed.
+            ...(config.relayOnly === true ? { holePunch: { enabled: false } } : {}),
             // Forward the role. After DOD-NAT-REACHABILITY-1, dcutr is on every node
-            // type; nodeType's remaining transport effect is the HOP gate (client
-            // types never advertise circuit-relay HOP).
+            // type unless relay-only turns it off above; nodeType's remaining transport effect is the HOP
+            // gate (client types never advertise circuit-relay HOP).
             nodeType: config.nodeType,
             // DOD-M12B-SESSION-SEED-1: forward the caller's transport seed when it supplied one, so a
             // rebuilt session node returns at the peer id the counterparty already holds. Omitted (rather
@@ -589,6 +598,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
     for (const a of loadedAgents) {
         keyProviders.set(a.name, a.keyProvider);
     }
+    // DOD-M15-EPHEMERAL-AUTH-1: the session manager signs each session's throwaway key with the
+    // agent's identity, so it needs the same providers. Injected here rather than through the
+    // constructor because this map is built after the manager exists — the same reason
+    // `setParkedDrainHook` is a setter.
+    sessionNodeManager.setKeyProviderResolver((agentName) => keyProviders.get(agentName));
     // Constructed HERE, before ANY boot-time caller. autoRecoverForAgent is invoked from an agent's
     // onConnected and from the seal-upgrade content gate — both of which run long before the IPC
     // handler map exists. Its handlers register later (phase 2), which is what lets this sit up here.
@@ -634,6 +648,127 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // ensure→drain contract — a re-park needs the receiver that the ensure step rebuilds.
         flushSender: (agentName) => flushAwaitingContent(agentName),
     });
+    /**
+     * DOD-M15-ENDORSE-RETRY-1 — sealed submissions whose send reached no directory node.
+     *
+     * The consortium has three nodes and a submission used to die with whichever one this daemon
+     * happened to be connected to. It is held here instead and re-sent when the SignalingManager
+     * reconnects — that reconnect IS the failover, and nothing in this daemon picks a node for a
+     * submission (`sendSealedSubmission`'s header rules that out). Safe because `submission_id` is
+     * derived from the signed plaintext: a second node stores it once and the portal mints once.
+     */
+    const submissionRetries = new SubmissionRetryQueue({
+        logger,
+        send: async (pending) => {
+            /**
+             * THE AGENT MUST STILL BE HERE TO SIGN, and this failure has its own name.
+             *
+             * It borrowed `submission_refused_by_node` at first, which states that a directory node
+             * decoded, evaluated and refused the submission — none of which happened. Stacked on the
+             * give-up reason it produced, the operator saw two labels both pointing at the directory for
+             * a cause that is entirely local (review M5).
+             *
+             * Neither branch is reachable in this daemon today — nothing removes from `keyProviders` or
+             * `loadedAgents` — so this is a guard against a future unload path rather than a live case.
+             * That is said plainly instead of being implied by a comment describing a state the code
+             * cannot reach.
+             */
+            /**
+             * READ the agent's manager; never CREATE one, and this ONE guard is the whole check.
+             *
+             * `getAgentSignaling` is not a getter — for an agent with no manager it constructs one, which
+             * dials, authenticates, and installs an unbounded reconnect loop. `dropAgentSignaling` exists
+             * to stop and forget a manager for an agent whose registration failed terminally, and a
+             * background retry that silently rebuilt it would undo that decision from a timer nobody is
+             * watching.
+             *
+             * It replaces a `keyProviders` + `loadedAgents` pair that is now dead: the manager was built
+             * WITH this agent's key provider and pubkey, so its presence is the accurate statement of
+             * "this daemon can still send as this agent", and nothing prunes either of those two maps.
+             *
+             * There is always a manager here in practice — the first-pass send built one before this
+             * submission could ever have been held. Its absence means it was deliberately dropped, and
+             * the right answer is to stop trying, not to resurrect it.
+             */
+            // The SAME resolution `getAgentSignaling` performs, minus the construction: the shared
+            // manager first (the in-process path, where `perAgentSignaling` is never populated at all),
+            // then this agent's own. Reading only the per-agent map would refuse every retry on the
+            // shared path — which is how this fix first failed its own live test.
+            const existing = sharedSignaling
+                ? { signaling: sharedSignaling }
+                : perAgentSignaling.get(pending.agentName);
+            if (!existing) {
+                return {
+                    ok: false,
+                    reason: "submission_agent_unloaded",
+                    guidance: `The directory connection for '${pending.agentName}' has been torn down, so the held ` +
+                        "submission cannot be sent. Start the agent with cello_start_agent and issue it again — " +
+                        "re-sending is safe, the submission id is derived from the content.",
+                };
+            }
+            return sendSealedSubmission({
+                signaling: existing.signaling,
+                submissionId: pending.submissionId,
+                intakeKeyId: pending.intakeKeyId,
+                ciphertext: pending.ciphertext,
+                logger,
+            });
+        },
+        onAccepted: (pending, stored) => {
+            // THE STABLE ID THE ENQUEUE CAPTURED, not a re-resolution from the mutable name (review M6).
+            // `agentName` is a display label and is reusable after a retire; re-deriving it here would
+            // write the accepted row under a different agent's id if a name were retired and reused
+            // inside the retry window. The correct value is already in the struct.
+            recordIssuedSubmission(pending.agentName, pending.agentId, {
+                submissionId: pending.submissionId,
+                subject: pending.subject,
+                op: pending.op,
+                intakeKeyId: pending.intakeKeyId,
+                stored,
+            });
+        },
+        ...(config.submissionRetryIntervalsMs?.staggerMs === undefined
+            ? {}
+            : { staggerMs: config.submissionRetryIntervalsMs.staggerMs }),
+        ...(config.submissionRetryIntervalsMs?.localPreconditionRetryMs === undefined
+            ? {}
+            : { localPreconditionRetryMs: config.submissionRetryIntervalsMs.localPreconditionRetryMs }),
+    });
+    /**
+     * KEEP THE HANDLE, or a withdrawal has nothing to name. The submission id is content-derived and
+     * so reproducible in principle, but only by re-composing the exact original body — which the
+     * operator no longer has once they have sent it.
+     *
+     * Best-effort on purpose: the submission IS accepted by the time this runs, and failing the call
+     * over a local bookkeeping write would turn a success into a reported failure and invite a
+     * re-send of something already queued. Logged loudly instead.
+     *
+     * Shared by the first-pass send and the retry, so the two cannot drift about what a landed
+     * submission records.
+     */
+    function recordIssuedSubmission(agentName, 
+    /** The STABLE key, supplied by the caller. Never re-derived from `agentName` here — that is a
+     *  display label, and this table is keyed by identity. */
+    agentId, s) {
+        try {
+            const store = new TrustSignalStore(sessionNodeManager.getDb(), logger);
+            store.recordIssuedSubmission({
+                agentId,
+                submissionId: s.submissionId,
+                subjectPubkey: s.subject,
+                op: s.op,
+                intakeKeyId: s.intakeKeyId,
+                stored: s.stored,
+            });
+        }
+        catch (err) {
+            logger.error("signal.submission.record_failed", {
+                agentName,
+                submissionId: s.submissionId,
+                reason: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
     // Created HERE, not where the seal code used to sit (~2,500 lines down), because the listeners
     // are wired into every signaling manager below — and the originals were FUNCTION DECLARATIONS,
     // so hoisting silently let them be CALLED 1,900 lines before they were DEFINED. A const in their
@@ -643,12 +778,25 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // Bilateral seal, unilateral escalation, and the returning-absent-party upgrade: five pieces of
     // state and the listeners that drive them. Already seal-private; now that is enforced by a module
     // boundary rather than by convention. cello_close_session still drives the waiters directly.
+    //
+    // DOD-M15-SEAL-FAILED-TERMINAL-1: a seal that ended without a receipt is discoverable rather than
+    // being a line in daemon.log. In memory on purpose — a restart makes "failed" the WRONG answer,
+    // because the boot sweep plus the restart seal resolver retry the session, so a marker whose
+    // lifetime is the process matches the lifetime of the condition it describes.
+    //
+    // Declared HERE rather than 600 lines below because the seal coordinator writes to it: a
+    // directory refusal must survive the close call waiting on it (DOD-M15-SEALPARTIES-1).
+    const sealFailures = new SealFailureStore();
     const { sealKey, sealInterruptedInProgress, pendingSealWaiters, pendingUnilateralWaiters, registerSealListeners, } = createSealCoordinator({
         logger,
         sessionNodeManager,
         getPersistence,
         getKeyProvider: (agentName) => keyProviders.get(agentName),
         recoverContent: (agentName) => autoRecoverForAgent(agentName, "seal_upgrade_gate"),
+        // DOD-M15-SEALPARTIES-1: a directory refusal has to outlive the close call that is waiting on
+        // it — `cello_status` and the receipt surface both read this store, and a close that already
+        // returned has nowhere else to leave the answer.
+        recordSealFailure: (agentName, sessionId, reason) => sealFailures.record(agentName, sessionId, reason, new Date().toISOString(), "unresolved"),
     });
     // The two seal-initiation flows cello_close_session dispatches into (seal-flows.ts): the
     // counterparty is gone (seal-interrupted) or live (bilateral). Neither can notarize on its own —
@@ -799,6 +947,18 @@ async function startDaemonHoldingLock(config, singletonLock) {
             onRelayEndpoints: (endpoints) => {
                 sessionNodeManager.setDirectoryRelayEndpoints(agentName, endpoints.map((e) => ({ relayPeerId: e.peerId, relayAddrs: e.addrs })));
             },
+            // DOD-M15-RELAYSLOTS-1: and the credential those relays require. Same frame, same cadence as
+            // the endpoints above — every connect and every reconnect, which is what keeps a token that
+            // expires within the hour current for a receiver that lives much longer than that.
+            onOnlineToken: (token) => {
+                sessionNodeManager.setDirectoryOnlineToken(agentName, token);
+            },
+            // Review M1: and when there is none, WHY — so the operator surface can say "this directory
+            // does not know this agent" instead of "check your directory connection" about a connection
+            // that just succeeded.
+            onOnlineTokenAbsent: (reason) => {
+                sessionNodeManager.setDirectoryOnlineTokenAbsent(agentName, reason);
+            },
         });
         const mgr = new SignalingManager({
             connect,
@@ -821,8 +981,14 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // from every relay it has session history with, so a message parked while signaling was down
             // is not left until the next agent start. The drain needs the node the ensure builds, which
             // is why it no longer runs beside it.
+            //
+            // AND THIRD, DOD-M15-ENDORSE-RETRY-1: re-send any sealed submission that reached no node.
+            // Deliberately outside `createReconnectDrain`'s ensure→drain contract and after it: that
+            // ordering exists because the drain needs the standing receiver the ensure rebuilds, and a
+            // submission needs neither — it needs only the stream that just came up.
             onConnected: () => {
                 onSignalingConnected(agentName);
+                submissionRetries.onSignalingConnected(agentName);
             },
         });
         const entry = { signaling: mgr, getNode: () => nodeRef };
@@ -845,6 +1011,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
+            // DOD-M15-SEALPARTIES-1: where a dead seal ceremony leaves its mark, so `cello_sealed_receipt`
+            // can say it FAILED and why instead of falling through to "no receipt yet".
+            recordSealFailure: (name, sid, reason) => sealFailures.record(name, sid, reason, new Date().toISOString(), "unresolved"),
         });
         // DOD-SPINE-7: coordinate the SEAL FROST ceremony on this agent's stream too.
         wireSealCeremonyHandler({
@@ -861,6 +1030,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
+            // DOD-M15-SEALPARTIES-1: where a dead seal ceremony leaves its mark, so `cello_sealed_receipt`
+            // can say it FAILED and why instead of falling through to "no receipt yet".
+            recordSealFailure: (name, sid, reason) => sealFailures.record(name, sid, reason, new Date().toISOString(), "unresolved"),
         });
         // DOD-SPINE-7: and resolve session_sealed for this agent's sessions on its own stream.
         registerSealListeners(mgr, agentName, agentPubkeyHex);
@@ -870,6 +1042,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             agentName,
             getStandingReceiverEndpoint: () => sessionNodeManager.getStandingReceiverInfo(agentName),
             admitOfferedDialer: (peerId, sessionIdHex) => sessionNodeManager.admitOfferedDialer(agentName, peerId, sessionIdHex),
+            // DOD-M15-RELAYONLY-1: lets the handler tell "no addresses because relay-only filtered them"
+            // from "no addresses yet", which need opposite answers — a refusal, and the pre-existing path.
+            isRelayOnly: () => relayOnlyState((key) => sessionNodeManager.getSetting(agentName, key), sessionNodeManager.hasDatabase()) !== "off",
             signaling: mgr,
             logger,
         });
@@ -882,6 +1057,40 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 return;
             void handleTrustSignalPickup(frame, agentKeyProvider, mgr, agentName);
         });
+        /**
+         * DOD-M15-SEALPARTIES-1 Part 0: take the relay credential off `register_success`.
+         *
+         * `onOnlineToken` above catches every signaling auth and reconnect, and misses the one case that
+         * matters most: a brand-new agent. Its daemon opens this very stream in order TO register (the
+         * DKG runs over it), so the auth that created the stream happened while the directory still had
+         * no profile for the key and correctly issued nothing. A healthy stream never re-authenticates,
+         * so without this the agent holds no relay credential for the life of the daemon — no circuit
+         * reservation, unwitnessed leaves, and a close that fails with `seal_persist_failed`.
+         *
+         * A frame with no token is left alone rather than clearing what is held: the directory that
+         * issues here is the same one whose auth_ok issues, so overwriting a good token with an absence
+         * would turn one directory's minting failure into a reachability outage the operator cannot
+         * explain. The absence is already reported by the directory's own `online_token.failed`.
+         */
+        mgr.registerInboundHandler((frame) => {
+            if (frame["type"] !== "register_success")
+                return;
+            const raw = frame["online_token"];
+            const token = raw instanceof Uint8Array ? raw : Buffer.isBuffer(raw) ? new Uint8Array(raw) : undefined;
+            if (token && token.length > 0) {
+                sessionNodeManager.setDirectoryOnlineToken(agentName, token);
+                logger.info("directory.online_token.received", { agentName, source: "register_success", bytes: token.length });
+                return;
+            }
+            logger.warn("directory.online_token.absent", {
+                agentName,
+                source: "register_success",
+                impact: "this agent just registered and was handed no relay online token, so no relay will " +
+                    "let it hold a circuit reservation until its directory signaling stream reconnects and " +
+                    "re-issues one. Until then it is reachable only over a direct connection, and a session " +
+                    "it does hold cannot get its leaves witnessed.",
+            });
+        });
         // CELLO-M7-CONN-001 (DOD-CONN-2): inbound session_assignment + seal_interrupted_request
         // on THIS agent's own stream, so a non-primary agent receives inbound sessions (SPINE-5).
         wirePerAgentSessionInbound(mgr);
@@ -926,6 +1135,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
+            // DOD-M15-SEALPARTIES-1: where a dead seal ceremony leaves its mark, so `cello_sealed_receipt`
+            // can say it FAILED and why instead of falling through to "no receipt yet".
+            recordSealFailure: (name, sid, reason) => sealFailures.record(name, sid, reason, new Date().toISOString(), "unresolved"),
         });
         wireSealCeremonyHandler({
             agentName: agent.name,
@@ -939,11 +1151,16 @@ async function startDaemonHoldingLock(config, singletonLock) {
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
+            // DOD-M15-SEALPARTIES-1: where a dead seal ceremony leaves its mark, so `cello_sealed_receipt`
+            // can say it FAILED and why instead of falling through to "no receipt yet".
+            recordSealFailure: (name, sid, reason) => sealFailures.record(name, sid, reason, new Date().toISOString(), "unresolved"),
         });
         wireSessionOfferHandler({
             agentName: agent.name,
             getStandingReceiverEndpoint: () => sessionNodeManager.getStandingReceiverInfo(agent.name),
             admitOfferedDialer: (peerId, sessionIdHex) => sessionNodeManager.admitOfferedDialer(agent.name, peerId, sessionIdHex),
+            // DOD-M15-RELAYONLY-1 — see the note on the sibling call site above.
+            isRelayOnly: () => relayOnlyState((key) => sessionNodeManager.getSetting(agent.name, key), sessionNodeManager.hasDatabase()) !== "off",
             signaling: mgr,
             logger,
         });
@@ -1167,14 +1384,6 @@ async function startDaemonHoldingLock(config, singletonLock) {
      * every other one.
      */
     const backgroundSeals = new Set();
-    /**
-     * DOD-M15-SEAL-FAILED-TERMINAL-1 — the last background seal failure per session.
-     *
-     * In memory on purpose: a restart makes "failed" the WRONG answer, because the boot sweep plus the
-     * restart seal resolver retry the session. A marker whose lifetime is the process matches the
-     * lifetime of the condition it describes.
-     */
-    const sealFailures = new SealFailureStore();
     // DOD-AWAY-WRAP-1 AC1: request text is a leave-a-message greeting; agentName is spliced in at
     // the call site so it names the specific away agent.
     // DOD-AWAY-ACK-ONESHOT-TEXT-1 (live defect 2026-07-24): the ack must state the one-shot rule —
@@ -1280,9 +1489,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
                         // in the codebase for that — the seal is initiated a few lines below, so a leaf at the
                         // wrong index does not merely stall the far side, it seals a tree the counterparty can
                         // never agree with.
-                        const placed = sessionNodeManager.placeOwnLeaf(agentName, sessionId, rejectHashHex, rejectBytes, sendResult.sequenceNumber, randomUUID());
+                        // The proof travels with the leaf, not only with the transcript row below: when this
+                        // append is HELD behind a gap, the `recordTranscriptMessage` call is skipped entirely
+                        // and the held entry is the only thing that reaches the row on release.
+                        const placed = sessionNodeManager.placeOwnLeaf(agentName, sessionId, rejectHashHex, rejectBytes, sendResult.sequenceNumber, randomUUID(), "msg", sentAuthorship(sendResult));
                         if (placed.placed) {
-                            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placed.leafIndex, "sent", rejectBytes, randomUUID());
+                            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placed.leafIndex, "sent", rejectBytes, randomUUID(), sentAuthorship(sendResult));
                         }
                         logger.info("session.away.inbox.oneshot.rejected", { agentName, sessionId, sequenceNumber: placed.placed ? placed.leafIndex : placed.heldAt, committed: placed.placed, queued: !sendResult.ok });
                     }
@@ -1503,9 +1715,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 // next arrival would mint a second greeting at a second sequence.
                 // DOD-M12B-INDEX-1: the queued reply owns the position the relay witnessed for it, and
                 // that is where its leaf goes.
-                const placedQueued = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID());
+                // Witnessed and SIGNED — only the direct hand-off failed — so the proof exists and must
+                // reach the leaf. This is the site `sentAuthorship`'s own comment calls dead-by-construction
+                // under an `ok`-gated read; the same reasoning applies to the leaf, not just the row.
+                const placedQueued = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID(), "msg", sentAuthorship(sendResult));
                 if (placedQueued.placed) {
-                    sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedQueued.leafIndex, "sent", contentBytes, randomUUID());
+                    sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedQueued.leafIndex, "sent", contentBytes, randomUUID(), sentAuthorship(sendResult));
                 }
                 logger.info("session.away.response.deferred", {
                     agentName, sessionId, kind, isKnown,
@@ -1517,9 +1732,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             }
             // DOD-M12B-INDEX-1: the away responder fires while inbound is still arriving, so it is the
             // path most likely to have a gap open under it — exactly where a tail append does damage.
-            const placedReply = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID());
+            const placedReply = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID(), "msg", sentAuthorship(sendResult));
             if (placedReply.placed) {
-                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedReply.leafIndex, "sent", contentBytes, randomUUID());
+                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedReply.leafIndex, "sent", contentBytes, randomUUID(), sentAuthorship(sendResult));
             }
             logger.info("session.away.response.sent", {
                 agentName, sessionId, kind, isKnown,
@@ -1713,6 +1928,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // was looking.
         getUnresolvedNodes,
         getDeclaredNodeCount,
+        // DOD-M15-SEALPARTIES-1: the visiting stream runs the seal ceremony too, so it needs the same
+        // failure sink — otherwise a cross-node close that dies leaves no trace while a same-node one does.
+        recordSealFailure: (name, sid, reason) => sealFailures.record(name, sid, reason, new Date().toISOString(), "unresolved"),
     });
     // Both use the same SQLite DB as the SessionNodeManager (daemon.db equivalent).
     // loadFromDb() must complete BEFORE IPC socket opens (AC-007).
@@ -1752,6 +1970,13 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // seal depends on — silently, while reporting success.
             receiptStore: stores.receiptStore,
             sealLeafStore: stores.sealLeafStore,
+            // DOD-M15-RELAYSLOTS-1: the manager owns the current token and hands the accessor down, so
+            // this client reads a fresh one at every auth instead of a snapshot taken here at build time.
+            onlineToken: stores.onlineToken,
+            // DOD-M15-CORROBORATE-1: the DETACHED client needs this as much as the live one — a session
+            // being sealed after a restart is exactly when its operator is not watching.
+            onWitnessAlert: (alert) => { sessionNodeManager.recordRelayWitnessAlert(agentName, alert); },
+            onWitnessUnreadable: (peerId, why) => { sessionNodeManager.recordRelayWitnessUnreadable(agentName, peerId, why); },
         });
     });
     // DOD-RETRYQ-STRAND-1: a direct-resend row is reachable only by drainSession, which has no
@@ -1847,6 +2072,54 @@ async function startDaemonHoldingLock(config, singletonLock) {
         logger.warn("session.seal.autoack.broker.unreachable", { agentName, brokerNode, correlationId });
         return null;
     });
+    /**
+     * DOD-M15-RELAYABUSE-1: scheduled park-retry timers, tracked so shutdown can clear them.
+     *
+     * ⚠️ Every other daemon timer is cleared in `stop()`; an untracked one lets an in-process restart
+     * leave a stale timer that drains into a torn-down manager. Unref'd already, so it cannot hold the
+     * process open — this is about a clean teardown, not about exiting.
+     */
+    const parkRetryTimers = new Set();
+    /**
+     * DOD-M15-RELAYABUSE-1: schedule ONE drain at the delay the relay asked for.
+     *
+     * ⚠️ ONE implementation, used by both park paths. The live-send path and the drain path both need
+     * this and a second copy is how the clamp ends up on only one of them — which is exactly the shape
+     * review found here (the number had a consumer on one path and was dropped on the other).
+     *
+     * CLAMPED, because the value comes from another party's software and an unclamped one inverts the
+     * fix: Node's `setTimeout` holds an int32, so a relay reporting `3_000_000_000` overflows it and
+     * fires in about ONE MILLISECOND — re-parking instantly into the limit that just refused, and
+     * printing a `TimeoutOverflowWarning` from a daemon whose convention forbids console output.
+     */
+    function scheduleParkRetry(retryAfterMs, filterAgentName, source) {
+        const MIN_RETRY_MS = 1_000;
+        const MAX_RETRY_MS = 5 * 60_000;
+        const delay = Math.min(Math.max(retryAfterMs, MIN_RETRY_MS), MAX_RETRY_MS);
+        if (delay !== retryAfterMs) {
+            logger.warn("content.park.retry.clamped", {
+                source,
+                requestedMs: retryAfterMs,
+                usedMs: delay,
+                impact: "the relay asked for a retry delay outside the range this daemon will schedule, so it was " +
+                    "clamped — an unclamped value can overflow the timer and fire immediately, which would " +
+                    "re-park straight into the limit that just refused",
+            });
+        }
+        logger.info("content.park.retry.scheduled", { source, delayMs: delay, ...(filterAgentName !== undefined ? { agentName: filterAgentName } : {}) });
+        const timer = setTimeout(() => {
+            parkRetryTimers.delete(timer);
+            void flushAwaitingContent(filterAgentName).catch((err) => {
+                logger.warn("content.park.retry.timer.failed", {
+                    source,
+                    reason: err instanceof Error ? err.message : String(err),
+                    impact: "the scheduled drain threw; the ordinary event triggers (boot, agent start, reconnect) still apply",
+                });
+            });
+        }, delay);
+        timer.unref?.();
+        parkRetryTimers.add(timer);
+    }
     sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg }) => {
         const node = sessionNodeManager.getStandingReceiverNode();
         if (!node) {
@@ -1885,8 +2158,15 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
         // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
         // is salted is a fact about the message that was sent; what this side holds now says nothing
-        // about it. Still `sha256` everywhere, because no send path salts yet — the plumbing is proven
-        // carrying the value that cannot break anything, and only then does the value change.
+        // about it.
+        //
+        // ⛔ THIS COMMENT USED TO SAY "Still `sha256` everywhere, because no send path salts yet — the
+        // plumbing is proven carrying the value that cannot break anything, and only then does the value
+        // change." That described B2b, and B2b-2 then CHANGED THE VALUE: a session holding an agreed
+        // salt hashes under `hmac-sha256-salt-v1`, so this path really does carry a salted algorithm
+        // now. Rewritten rather than deleted — a stale reassurance is what `CLAIM-COMMENTS-1` is for,
+        // and on 2026-08-24 a test declared `sha256` on the strength of this sentence and got a tamper
+        // verdict on an honest message.
         const ciphertext = await sealParkEnvelope({
             signer: senderKp,
             sessionIdHex: sessionId,
@@ -1910,8 +2190,48 @@ async function startDaemonHoldingLock(config, singletonLock) {
             logger.info("content.park.deposited", { sessionId, contentHash: contentHashHex, recipientPubkey: recipientPubkeyHex.slice(0, 16) });
             return { ok: true };
         }
-        logger.warn("content.park.deposit.failed", { sessionId, contentHash: contentHashHex, reason: res.reason });
-        return { ok: false, reason: res.reason ?? "relay_deposit_failed" };
+        logger.warn("content.park.deposit.failed", {
+            sessionId,
+            contentHash: contentHashHex,
+            reason: res.reason,
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        });
+        /**
+         * DOD-M15-RELAYABUSE-1 — **GIVE THE RELAY'S "WHEN" A CONSUMER.**
+         *
+         * A deferred park is otherwise retried only on EVENTS — boot, agent start, the drain hook, a
+         * signaling reconnect. None of those is coming for a throttle: the relay is healthy, the link
+         * never dropped, and the condition clears on a timer nobody is watching. So the one refusal that
+         * self-heals in about a minute was the one that waited longest, purely because the number the
+         * relay had already computed had no reader.
+         *
+         * Scheduled ONCE per refusal, unref'd so it can never hold the process open, and best-effort:
+         * the existing event triggers remain the guarantee, and this is a shortcut on top of them. It
+         * deliberately does not retry-on-retry — a timer that reschedules itself on failure is a
+         * self-inflicted flood, which is what the limiter exists to stop.
+         */
+        if (res.retryAfterMs !== undefined && res.retryAfterMs > 0) {
+            /**
+             * ⚠️ CLAMPED, because the number comes from ANOTHER PARTY'S SOFTWARE and an unclamped one is
+             * not merely wrong — it inverts the fix. Node's `setTimeout` holds an int32: a relay reporting
+             * `3_000_000_000` overflows it and the timer fires in about **one millisecond**, re-parking
+             * instantly into the limit that just refused, and printing a `TimeoutOverflowWarning` on
+             * stderr from a daemon whose convention forbids console output. A reported `1` does the same
+             * thing 250 ms later.
+             *
+             * The floor is a second and the ceiling five minutes: long enough that a shortcut is a
+             * shortcut, short enough that it stays one. A clamp is announced rather than silent — a relay
+             * asking us to wait 35 days is a fact an operator wants.
+             */
+            scheduleParkRetry(res.retryAfterMs, agentName, "send");
+        }
+        return {
+            ok: false,
+            reason: res.reason ?? "relay_deposit_failed",
+            // DOD-M15-RELAYABUSE-1 review MEDIUM-6: the guidance quotes the relay's OWN window instead of
+            // guessing "about a minute", which is a hardcoded assumption about a configurable value.
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        };
     });
     // CELLO-M7-MSG-001 (AC-004/AC-005, D-d): startup flush of locally-persisted un-acked
     // content (the crash backstop). Runs HERE — before the IPC socket opens, consistent
@@ -1972,8 +2292,15 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // `DOD-M15-SEALWIRE-1` PART B2b — the algorithm is threaded through, and it is the value THIS
         // MESSAGE was hashed under, never one re-derived from the session's current row. Whether a hash
         // is salted is a fact about the message that was sent; what this side holds now says nothing
-        // about it. Still `sha256` everywhere, because no send path salts yet — the plumbing is proven
-        // carrying the value that cannot break anything, and only then does the value change.
+        // about it.
+        //
+        // ⛔ THIS COMMENT USED TO SAY "Still `sha256` everywhere, because no send path salts yet — the
+        // plumbing is proven carrying the value that cannot break anything, and only then does the value
+        // change." That described B2b, and B2b-2 then CHANGED THE VALUE: a session holding an agreed
+        // salt hashes under `hmac-sha256-salt-v1`, so this path really does carry a salted algorithm
+        // now. Rewritten rather than deleted — a stale reassurance is what `CLAIM-COMMENTS-1` is for,
+        // and on 2026-08-24 a test declared `sha256` on the strength of this sentence and got a tamper
+        // verdict on an honest message.
         const ciphertext = await sealParkEnvelope({
             signer: senderKp,
             sessionIdHex: entry.sessionId,
@@ -1997,7 +2324,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
             logger.info("content.park.deposited", { sessionId: entry.sessionId, contentHash: entry.contentHashHex, source: "startup_flush" });
             return { parked: true };
         }
-        return { parked: false, error: res.reason ?? "deposit_failed" };
+        return {
+            parked: false,
+            error: res.reason ?? "deposit_failed",
+            // DOD-M15-RELAYABUSE-1 review HIGH-2: carry the relay's own "when" out of the DRAIN path too.
+            ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
+        };
     };
     // Re-park un-acked awaiting content to the relay store-and-forward queue. Runs once pre-IPC
     // (the crash backstop) and again per-agent when an agent comes online — because post-DOD-LOOP-1
@@ -2055,7 +2387,23 @@ async function startDaemonHoldingLock(config, singletonLock) {
         let parkedTotal = 0;
         for (const s of sessions) {
             try {
-                parkedTotal += await retryQueue.drainAwaitingToPark(s.agentId, s.sessionId, parkFn);
+                parkedTotal += await retryQueue.drainAwaitingToPark(s.agentId, s.sessionId, parkFn, (retryAfterMs) => {
+                    /**
+                     * DOD-M15-RELAYABUSE-1 review HIGH-2 — **the drain path can now schedule its own
+                     * follow-up, which is what makes the retry work for a BACKLOG rather than one message.**
+                     *
+                     * Before this, only the live send path heard the relay's delay. With a backlog larger than
+                     * one rate-limit window, the drain deposited what the window allowed, every remaining item
+                     * was refused, and all of them fell back to waiting for an unrelated reconnect — the exact
+                     * condition the retry timer was added to remove.
+                     *
+                     * ONE timer per pass (the drain reports the largest delay it saw, not one per item), and
+                     * it deliberately does not chain beyond that: the next pass schedules the next one only if
+                     * it is refused again, so a permanently-full relay costs one timer per window rather than
+                     * an accelerating stream of them.
+                     */
+                    scheduleParkRetry(retryAfterMs, filterAgentName, "drain");
+                });
             }
             catch (err) {
                 logger.error("content.park.flush.failed", {
@@ -2163,6 +2511,19 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 // (cello_status / cello_list_agents), so a deaf agent is visible to the operator.
                 standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
                 standing_receiver_reachability: sessionNodeManager.getStandingReceiverReachability(a.name),
+                /**
+                 * DOD-M15-RELAYSLOTS-1: WHY it is not reachable, and what to do about it.
+                 *
+                 * `standing_receiver_reachability` says `retrying` or `unreachable` and stops there, which
+                 * for the person reading it is indistinguishable from the product being broken. The relay
+                 * now refuses for reasons someone can act on — no token from a directory yet, too many
+                 * sessions still open, this relay is misconfigured — each with a different next step, and
+                 * every one of them is wasted if it only reaches a log file. Absent when the last attempt
+                 * succeeded.
+                 */
+                ...(sessionNodeManager.getStandingReceiverRefusal(a.name)
+                    ? { standing_receiver_refusal: sessionNodeManager.getStandingReceiverRefusal(a.name) }
+                    : {}),
                 // DOD-COATTEND-VISIBLE-1 AC2: how many sessions are driving this agent, including this
                 // one. Live, not a high-water mark — it drops when a session disconnects. `selected` says
                 // whether YOU hold it; this says whether anyone else does too.
@@ -2403,6 +2764,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 state: agentStateFor(a),
                 standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
                 standing_receiver_reachability: sessionNodeManager.getStandingReceiverReachability(a.name),
+                // DOD-M15-RELAYSLOTS-1: the same cause-and-advice on the daemon-wide surface — see the note
+                // on the MCP one above. Two surfaces, one reason to exist.
+                ...(sessionNodeManager.getStandingReceiverRefusal(a.name)
+                    ? { standing_receiver_refusal: sessionNodeManager.getStandingReceiverRefusal(a.name) }
+                    : {}),
             })),
             standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(),
             retryQueueDepth: retryQueue.getTotalDepth(),
@@ -2434,14 +2800,37 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // Permissive by design (D12): an agent that exists goes online regardless of directory
     // registration state (online-without-registration is an established contract). Returns a
     // structured failure so callers can surface agent_start_failed with a real reason + guidance.
+    /**
+     * `standing_receiver` is part of the SUCCESS shape, not an optional extra — `DOD-M15-START-AGENT-
+     * UNAWAITED-1`. A bare `{ ok: true }` claimed the agent was started and reachable when only the
+     * first half was known, and the union makes the two states impossible to conflate at a call site.
+     */
     function startAgentInternal(name) {
         const agent = agents.find((a) => a.name === name);
         if (!agent || agent.state === "load_failed") {
             return { ok: false, reason: "agent_not_found", guidance: `Agent '${name}' does not exist. Run 'cello login' to register agents, or check agent names with cello_agents.` };
         }
         if (onlineAgents.has(name)) {
-            // Idempotent — already online, no event
-            return { ok: true };
+            // Idempotent — already online, no event.
+            //
+            // It still reports REAL readiness rather than a bare ok. "Already online" says this daemon
+            // marked the agent online at some earlier moment; it says nothing about whether the receiver
+            // that ensure was firing ever came up. An operator who calls start twice — which is exactly
+            // what someone does when the first one seemed not to work — would otherwise get the most
+            // reassuring answer in the run on the attempt where something is actually wrong.
+            const readyNow = sessionNodeManager.getStandingReceiverInfo(name) !== null;
+            if (readyNow)
+                return { ok: true, standing_receiver: "ready" };
+            const cause = sessionNodeManager.standingReceiverAbsenceReason(name);
+            return {
+                ok: true,
+                standing_receiver: "starting",
+                standing_receiver_cause: cause,
+                guidance: `'${name}' was already online, and its standing receiver is not up (${cause}). Outbound ` +
+                    `sends and cello_initiate_session ensure it on demand. An inbound session arriving before ` +
+                    `it is ready is refused with 'standing_receiver_unavailable' — this daemon, not the ` +
+                    `counterparty. If it stays this way, stop the agent and start it again.`,
+            };
         }
         onlineAgents.add(name);
         // Pressing start clears the deliberate-offline mark — that is what makes the switch reversible.
@@ -2467,7 +2856,18 @@ async function startDaemonHoldingLock(config, singletonLock) {
         void sessionNodeManager.ensureStandingReceiverForAgent(name)
             .then(() => flushAwaitingContent(name))
             .catch((err) => {
-            logger.warn("session.standing_receiver.ensure.failed", { agentName: name, reason: extractErrorMessage(err) });
+            logger.warn("session.standing_receiver.ensure.failed", {
+                agentName: name,
+                reason: extractErrorMessage(err),
+                // `DOD-M15-START-AGENT-UNAWAITED-1`. The operator has ALREADY been told `ok: true` — this
+                // handler answered before this promise settled — so nothing corrects that answer if this
+                // is permanent. Say what it costs them here, because this line is the only account.
+                impact: "cello_start_agent already answered ok for this agent, and its standing receiver did not " +
+                    "come up. The agent is online to the directory and CANNOT accept an inbound session: a " +
+                    "counterparty dialling it is refused standing_receiver_unavailable. Initiate and accept " +
+                    "each re-ensure on demand, so this may still recover on the next attempt; if it does not, " +
+                    "stop and restart the agent.",
+            });
         })
             // DOD-MSG-4 (auto-recover-on-reconnect): RECEIVER drains its parked mailbox from every relay it
             // has sessions on (symmetric to the sender re-park). Its own stage so a failure is labelled
@@ -2477,10 +2877,51 @@ async function startDaemonHoldingLock(config, singletonLock) {
             .catch((err) => {
             logger.warn("content.recover.auto.failed", { agentName: name, stage: "agent_start", error: extractErrorMessage(err) });
         });
-        logger.info("agent.online", { agentName: name, agentPubkey: agent.pubkey ?? "" });
+        /**
+         * `DOD-M15-START-AGENT-UNAWAITED-1` — SAY WHETHER THE AGENT CAN ACTUALLY HEAR YET.
+         *
+         * The ensure above is fire-and-forget and that is deliberate: initiate and accept both ensure on
+         * demand, and awaiting it here would turn a transient network failure into a failed start. **The
+         * defect was never the timing — it was the CLAIM.** `{ ok: true }` with nothing else reads as
+         * "your agent is running and reachable", and a session landing in the window before the receiver
+         * exists is refused `standing_receiver_unavailable` — a precondition on OUR side, surfacing to
+         * the operator as though the counterparty or the directory were at fault.
+         *
+         * ⚠️ **This field is only worth having because it can genuinely say `ready`.** Computed one line
+         * after firing an async ensure, a naive readiness flag would be `starting` on every call — a
+         * field that can never take its other value, which is the same defect as a log line reporting a
+         * verdict its producer cannot have. It escapes that because `ensureStandingReceiverForAgent` is
+         * IDEMPOTENT: an agent that already holds a receiver (a repeat start, or one whose receiver
+         * survived) has one at this instant and reports `ready` truthfully.
+         *
+         * `cause` is read from the same four-way answer the refusal path uses, so the response and the
+         * eventual error agree instead of describing the same state in two vocabularies.
+         */
+        const receiverReady = sessionNodeManager.getStandingReceiverInfo(name) !== null;
+        const startingCause = receiverReady ? undefined : sessionNodeManager.standingReceiverAbsenceReason(name);
+        logger.info("agent.online", {
+            agentName: name,
+            agentPubkey: agent.pubkey ?? "",
+            standingReceiver: receiverReady ? "ready" : "starting",
+            ...(startingCause !== undefined ? { standingReceiverCause: startingCause } : {}),
+        });
         // MCP-002: Broadcast agent_state_changed to ALL connections
         notificationDispatcher.dispatchAgentStateChanged(name, "online", "started");
-        return { ok: true };
+        if (receiverReady)
+            return { ok: true, standing_receiver: "ready" };
+        return {
+            ok: true,
+            standing_receiver: "starting",
+            standing_receiver_cause: startingCause,
+            // Invariant: an agent-facing response carries an affordance. Naming the refusal text is the
+            // load-bearing half — an operator who hits it in the next second can otherwise only conclude
+            // the other side is broken.
+            guidance: `'${name}' is online and its standing receiver is still being built. Outbound sends and ` +
+                `cello_initiate_session ensure it on demand, so ordinary use is fine. A session arriving in ` +
+                `the next moment can be refused with 'standing_receiver_unavailable' — that is this daemon ` +
+                `not being ready yet, NOT the counterparty being unreachable. It clears on its own; ` +
+                `cello_status reports the receiver once it is up.`,
+        };
     }
     // M8C-AUTOSTART-1 (F18): resolve which agent an agent-defaulting tool should act on for this
     // connection: an explicit { agent } wins; else the connection's current agent; else — when EXACTLY one
@@ -2686,6 +3127,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: entry.signaling,
             logger,
+            // DOD-M15-SEALPARTIES-1: where a dead seal ceremony leaves its mark, so `cello_sealed_receipt`
+            // can say it FAILED and why instead of falling through to "no receipt yet".
+            recordSealFailure: (name, sid, reason) => sealFailures.record(name, sid, reason, new Date().toISOString(), "unresolved"),
         });
         if (!result.ok) {
             return { ok: false, reason: result.reason, guidance: "Share refresh did not complete — see the daemon log (refresh.ceremony.*) for the cause." };
@@ -2938,12 +3382,79 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 // collapsing into a generic send failure that points at the network.
                 return { queued: false, reason: composed.reason, guidance: `${context} ${composed.guidance}` };
             }
+            // Resolved ONCE, and carried. `agent_name` is a display label and is reusable after a
+            // retire; every row and every queue entry below keys on this stable id instead.
+            const agentId = sessionNodeManager.resolveAgentId(sel.name);
             const sent = await sendSealedSubmission({
                 signaling: getAgentSignaling(sel.name, kp, sel.pubkey).signaling,
                 submissionId: composed.submissionId, intakeKeyId: composed.intakeKeyId,
                 ciphertext: composed.ciphertext, logger,
             });
             if (!sent.ok) {
+                // DOD-M15-ENDORSE-RETRY-1 — WORTH RETRYING, OR A VERDICT? The typed failure decides, never
+                // a string match. `submission_refused_by_node` means a node decoded it, evaluated it and
+                // said no, and it falls straight through to the plain failure below; everything else means
+                // no node ever reached a decision, so the daemon keeps it and re-sends on the reconnect.
+                /**
+                 * DO NOT HOLD A BLOB PAST ITS OWN INTAKE KEY (review M4).
+                 *
+                 * The sealed bytes are opened by the portal's intake key from THIS manifest. Holding them
+                 * across that key's expiry produces a submission the portal cannot open and cannot even
+                 * attribute — poison, with no reply possible — while the operator has been told it is held
+                 * and needs nothing from them. The plain failure is the better answer: they re-run it once
+                 * a current manifest is loaded, and they know to.
+                 *
+                 * The manifest is in hand here and nowhere inside the queue, which is why the check lives
+                 * at the call site rather than in the module that owns the window.
+                 */
+                const manifestExpiresAt = verifiedManifest ? Date.parse(verifiedManifest.expires) : NaN;
+                const keyOutlivesWindow = Number.isFinite(manifestExpiresAt) && manifestExpiresAt - Date.now() > DEFAULT_RETRY_WINDOW_MS;
+                if (!keyOutlivesWindow) {
+                    logger.warn("signal.submission.retry.not_held", {
+                        agentName: sel.name,
+                        submissionId: composed.submissionId,
+                        reason: "intake_key_expires_within_retry_window",
+                        manifestExpires: verifiedManifest?.expires ?? null,
+                        impact: "the operator is told it failed rather than being told it is held",
+                    });
+                    return {
+                        queued: false,
+                        reason: sent.reason,
+                        guidance: `${context} it did not reach a directory node (${sent.reason}), and the daemon is NOT ` +
+                            "holding it to retry: the portal intake key it is sealed to expires too soon, and a " +
+                            "submission sent after that expires is one the portal cannot open or even attribute. " +
+                            "Load a current consortium manifest (cello_status shows its validity), then send it again.",
+                    };
+                }
+                if (isRetryableSendFailure(sent.reason)) {
+                    const held = submissionRetries.enqueue({
+                        agentName: sel.name,
+                        agentId,
+                        submissionId: composed.submissionId,
+                        intakeKeyId: composed.intakeKeyId,
+                        // THE SAME SEALED BYTES, carried rather than re-derived. A re-seal is randomised and a
+                        // re-compose would take a new `issued_at` — which changes the content-derived id, and
+                        // a changed id is a second endorsement rather than a retry.
+                        ciphertext: composed.ciphertext,
+                        op: opts.op,
+                        subject: opts.subject,
+                    }, sent.reason);
+                    if (held) {
+                        return {
+                            queued: false,
+                            retrying: true,
+                            submissionId: composed.submissionId,
+                            reason: sent.reason,
+                            guidance: `${context.replace(/:$/, "")} — not yet. It did not reach a directory node ` +
+                                `(${sent.reason}), so the daemon is holding it and will send it as soon as the ` +
+                                "directory signaling stream is back, on whichever node that is. You do NOT need to " +
+                                "run this again. Run cello_attestations_issued to see where it got to. It is held IN " +
+                                "MEMORY, so if the daemon restarts before it lands you will have to write it again.",
+                        };
+                    }
+                    // The queue is full, so nothing is holding it and saying otherwise would be a lie the
+                    // operator acts on. They get the plain failure and the fact that re-sending is safe.
+                }
                 return { queued: false, reason: sent.reason, guidance: `${context} ${sent.guidance ?? sent.reason}` };
             }
             // F4: `sendSealedSubmission` ALREADY logs `signal.submission.queued` / `.duplicate`. Logging
@@ -2954,32 +3465,22 @@ async function startDaemonHoldingLock(config, singletonLock) {
             logger.info("signal.submission.attributed", {
                 agentName: sel.name, op: opts.op, submissionId: composed.submissionId, stored: sent.stored,
             });
-            // KEEP THE HANDLE, or a withdrawal has nothing to name. The submission id is content-derived,
-            // so it is reproducible in principle — but only by re-composing the exact original body, which
-            // the operator no longer has once they have sent it. Recorded in the SHARED path so every verb
-            // added after this one is covered by construction, which is the same reasoning as the
-            // `storedWarning` below.
-            //
-            // Best-effort on purpose: the submission IS accepted at this point, and failing the call over
-            // a local bookkeeping write would turn a success into a reported failure and invite a re-send
-            // of something already queued. Logged loudly instead.
-            try {
-                const store = new TrustSignalStore(sessionNodeManager.getDb(), logger);
-                store.recordIssuedSubmission({
-                    agentId: sessionNodeManager.resolveAgentId(sel.name),
-                    submissionId: composed.submissionId,
-                    subjectPubkey: opts.subject,
-                    op: opts.op,
-                    intakeKeyId: composed.intakeKeyId,
-                    stored: sent.stored,
-                });
-            }
-            catch (err) {
-                logger.error("signal.submission.record_failed", {
-                    agentName: sel.name, submissionId: composed.submissionId,
-                    reason: err instanceof Error ? err.message : String(err),
-                });
-            }
+            // KEEP THE HANDLE, or a withdrawal has nothing to name. Recorded in the SHARED path so every
+            // verb added after this one is covered by construction, which is the same reasoning as the
+            // `storedWarning` below — and by the same helper the RETRY path uses, so the two cannot drift
+            // about what a landed submission records.
+            // A LANDED SEND RETIRES AN EARLIER GIVE-UP for the same submission. The id is content-derived,
+            // so re-issuing the same words about the same subject produces the same id — this is the "I
+            // wrote it again and it worked" case, and leaving the stale failure on the surface would show
+            // the operator two contradictory states for one submission, forever.
+            submissionRetries.clearGaveUp(agentId, composed.submissionId);
+            recordIssuedSubmission(sel.name, agentId, {
+                submissionId: composed.submissionId,
+                subject: opts.subject,
+                op: opts.op,
+                intakeKeyId: composed.intakeKeyId,
+                stored: sent.stored,
+            });
             // F1: `stored: false` means a node reports it ALREADY HELD this submission id. That is either
             // a benign retry or single-node censorship — an operator pre-inserting garbage under a
             // clear-text id — and they are indistinguishable from here. Reporting it as unqualified
@@ -3136,20 +3637,48 @@ async function startDaemonHoldingLock(config, singletonLock) {
         const sel = resolveSelectedAgent(connectionId);
         if (!sel.ok)
             return sel;
+        const agentId = sessionNodeManager.resolveAgentId(sel.name);
         const store = new TrustSignalStore(sessionNodeManager.getDb(), logger);
-        const rows = store.listIssuedSubmissions(sessionNodeManager.resolveAgentId(sel.name)).map((r) => ({
+        const rows = store.listIssuedSubmissions(agentId).map((r) => ({
             submission_id: r.submissionId,
             subject_pubkey: r.subjectPubkey,
             op: r.op,
             intake_key_id: r.intakeKeyId,
+            // Every row in this table reached a node. The in-flight ones below have not.
+            delivery: "accepted",
             // FALSE means a node already held this id — a benign retry, or single-node censorship. The
             // operator sees the distinction here rather than only in the moment they submitted.
             stored: r.stored,
             submitted_at: r.submittedAt,
         }));
+        /**
+         * DOD-M15-ENDORSE-RETRY-1 — THE SUBMISSIONS THAT REACHED NO NODE, listed here because this is
+         * the verb whose whole question is "what happened to what I sent?".
+         *
+         * Without them a submission the daemon is retrying is INVISIBLE — the durable table only gets a
+         * row once a node accepted one — so the honest answer to that question was silence, which reads
+         * as "you sent nothing". And a give-up whose only consumer is a warn line in `daemon.log` is
+         * indistinguishable from the submission never having existed.
+         *
+         * These are IN MEMORY and do not survive a daemon restart (see submission-retry.ts). That is
+         * why they are a separate array rather than blended into `issued`: a caller must be able to
+         * tell a durable fact from a live one.
+         */
+        const inFlight = submissionRetries.list(agentId).map((p) => ({
+            submission_id: p.submissionId,
+            subject_pubkey: p.subject,
+            op: p.op,
+            intake_key_id: p.intakeKeyId,
+            delivery: p.delivery.state,
+            attempts: p.delivery.attempts,
+            last_reason: p.delivery.lastReason,
+            ...(p.delivery.state === "gave_up" ? { gave_up_because: p.delivery.gaveUpBecause } : {}),
+            guidance: p.delivery.guidance,
+        }));
         return {
             ok: true,
             issued: rows,
+            in_flight: inFlight,
             // NO BODY, and say so rather than letting its absence read as a bug. The text was the
             // operator's own words about a third party; keeping it on disk in the clear is exactly what
             // the sealed-submission path exists to prevent.
@@ -3192,10 +3721,21 @@ async function startDaemonHoldingLock(config, singletonLock) {
             op: "submit", subjectKind: "agent", subject, body,
             context: "The signal was NOT submitted:",
         });
+        // DOD-M15-ENDORSE-RETRY-1 — `ok: true` with `delivery: "retrying"`, and both halves are
+        // deliberate. `ok: false` would send the agent to re-run a command the daemon is already
+        // handling, which is the exact operator work this unit exists to remove; `queued: true` would
+        // claim a directory node accepted something no node has seen. So: not a failure, not an
+        // acceptance, and named.
+        if (!res.queued && res.retrying) {
+            return {
+                ok: true, queued: false, delivery: "retrying",
+                submission_id: res.submissionId, reason: res.reason, guidance: res.guidance,
+            };
+        }
         if (!res.queued)
             return { ok: false, reason: res.reason, guidance: res.guidance };
         return {
-            ok: true, queued: true, stored: res.stored, submission_id: res.submissionId,
+            ok: true, queued: true, delivery: "accepted", stored: res.stored, submission_id: res.submissionId,
             // Deliberately NOT "issued". Nothing is minted yet: the portal must still drain, authenticate,
             // scan and mint, and the subject must then ACCEPT it before anyone else can see it. Reporting
             // this as a completed endorsement would promise three steps that have not happened.
@@ -3403,6 +3943,16 @@ async function startDaemonHoldingLock(config, singletonLock) {
             op: "refuse", subjectKind: item.subjectKind, subject: item.signalHash, body: message,
             context: "The refusal is recorded. Your message was NOT sent:",
         });
+        // DOD-M15-ENDORSE-RETRY-1: the refusal itself is already recorded and unaffected either way —
+        // what is in question is only the MESSAGE back to the issuer. `message_delivery: "retrying"` is
+        // not `message_queued`, because no node has it yet, and it is not an error, because nothing is
+        // asked of the operator.
+        if (!res.queued && res.retrying) {
+            return {
+                ...refused, message_queued: false, message_delivery: "retrying",
+                submission_id: res.submissionId, guidance: `The refusal is recorded. ${res.guidance}`,
+            };
+        }
         if (!res.queued) {
             return { ...refused, message_queued: false, message_error: res.reason, guidance: res.guidance };
         }
@@ -3414,7 +3964,8 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // under a clear-text submission_id), and folding them together destroys the only information
         // that could ever tell them apart.
         return {
-            ...refused, message_queued: true, stored: res.stored, submission_id: res.submissionId,
+            ...refused, message_queued: true, message_delivery: "accepted",
+            stored: res.stored, submission_id: res.submissionId,
             ...(res.storedWarning ? { guidance: `The refusal is recorded. ${res.storedWarning}` } : {}),
         };
     });
@@ -3506,6 +4057,17 @@ async function startDaemonHoldingLock(config, singletonLock) {
             body: "",
             context: "The revocation was NOT queued:",
         });
+        // DOD-M15-ENDORSE-RETRY-1: the local copy survives either way (see below), so a retrying
+        // revocation is a wait, not a loss — and the operator is told which it is rather than being
+        // sent to re-run a retraction the daemon is already carrying.
+        if (!submitted.queued && submitted.retrying) {
+            return {
+                ok: true, signal_hash: signalHash, submission_id: submitted.submissionId,
+                revoked: false, queued: false, delivery: "retrying",
+                guidance: `Revocation for '${row.type}' is HELD, not yet at a directory. ${submitted.guidance} ` +
+                    "Your local copy is KEPT either way, deliberately, so nothing is lost while it waits.",
+            };
+        }
         if (!submitted.queued) {
             return { ok: false, reason: submitted.reason, guidance: submitted.guidance };
         }
@@ -3519,6 +4081,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
             submission_id: submitted.submissionId,
             revoked: false,
             queued: true,
+            delivery: "accepted",
             // M5: CARRIED, not dropped. `submitForAgent`'s own comment says the warning lives in the
             // shared path "because the same omission would otherwise be available to every verb added
             // after this one" — and this was the next verb added. `stored:false` means a node already held
@@ -3830,13 +4393,19 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 "replaces, it does not merge.",
         };
     });
-    // ─── MCP-001: stubs for tools registered in cello-mcp.ts but not yet implemented ───
-    // These return not_implemented (same as session tools) so LLMs get consistent guidance.
-    for (const tool of ["cello_get_inclusion_proof"]) {
-        handlers.set(tool, async (_params, _connectionId) => {
-            return { ok: false, reason: "not_implemented", guidance: `'${tool}' is not yet implemented in the daemon. This feature will be available in a future milestone.` };
-        });
-    }
+    // DOD-M15-INCLUSION-1: prove one message sits under the certified root, and check such a proof.
+    //
+    // This replaces the last entry of the MCP-001 `not_implemented` stub loop, which by the end held
+    // exactly one tool — `cello_get_inclusion_proof` — so the loop goes with it rather than being left
+    // as an empty scaffold that reads like other tools are still pending.
+    registerInclusionProofHandlers({
+        handlers,
+        logger,
+        sessionNodeManager,
+        getConnState: (connectionId) => perConnectionState.get(connectionId),
+        resolveCurrentAgent,
+        NO_CURRENT_AGENT_RESPONSE,
+    });
     // DOD-M9B-SURFACE-1: the security layer's control surface. Registered here, defined in its own
     // module — it needs the cello dir, a logger, and the connection's client type, and nothing else
     // about sessions or ceremonies.
@@ -4535,7 +5104,31 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 // (deliberate — f75ea09), so it obeys the same discipline a message does — including
                 // being HELD when the position is ahead of the tail, which is why the real frame bytes
                 // have to travel with it.
-                const placed = sessionNodeManager.placeOwnLeaf(agent, sessionId, Buffer.from(contentHash).toString("hex"), frameBytes, assignedSeq, correlationId, "doc");
+                const placed = sessionNodeManager.placeOwnLeaf(agent, sessionId, Buffer.from(contentHash).toString("hex"), frameBytes, assignedSeq, correlationId, "doc", 
+                /**
+                 * No proof — and the reason I first wrote here was FALSE, which review traced rather
+                 * than read.
+                 *
+                 * ⚠️ IT SAID *"the document transport does not go through `sendContent`, so no Structure-1
+                 * was signed."* Both halves are wrong. `document-delivery-transport.ts` calls
+                 * `deps.sendContent(...)`, wired straight to `sessionNodeManager.sendContent` a few lines
+                 * above this; and `session-relay-client.ts` signs the Structure-1 with no `leafKind` gate
+                 * at all, so a `0x04` doc leaf is signed exactly like a message. **A proof exists and is
+                 * discarded here.**
+                 *
+                 * That matters more than a wrong comment usually would, because this unit's whole thesis
+                 * is *"`undefined` is a claim the author made rather than one the signature made for
+                 * them"* — and the first claim made under the new signature was untrue.
+                 *
+                 * THE TRUE REASON, which is a better one: **no consumer.** A doc leaf released from a
+                 * hold writes no transcript row — `#releaseHeld` skips `recordTranscriptMessage` for
+                 * `kind === "doc"` — so there is nothing for the proof to reach. Discarding it is
+                 * no-consumer-no-ship, deliberately.
+                 *
+                 * **If doc rows ever reach the transcript, `appendLeaf` needs an authorship parameter**
+                 * and this `undefined` becomes a defect rather than a decision.
+                 */
+                undefined);
                 return { placed: placed.placed, leafIndex: placed.placed ? placed.leafIndex : null };
             },
         });
@@ -4781,6 +5374,11 @@ async function startDaemonHoldingLock(config, singletonLock) {
     async function stop(reason) {
         clearInterval(reconcileSweepTimer);
         clearInterval(revivalBoundSweepTimer);
+        // DOD-M15-RELAYABUSE-1: scheduled park retries. Unref'd, so they never held the process open —
+        // cleared so an in-process restart cannot leave one draining into a torn-down manager.
+        for (const t of parkRetryTimers)
+            clearTimeout(t);
+        parkRetryTimers.clear();
         // DOD-M12B-SHUTDOWN-1: clearing the timer only stops the NEXT tick. The pass already running
         // walks every agent, and each step dials a peer and opens a session — which is why a daemon
         // reported down, with its socket already removed, was still logging `document.reconcile.sweep`
@@ -4821,6 +5419,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
         // outbound work is not draining. Above the `daemon.stopped` log with the other cancels, because
         // this is "stop making new work", not "tear down transports".
         await restartSealResolver?.stop();
+        // DOD-M15-ENDORSE-RETRY-1: same rule, same place — stop making new outbound work. Nothing is
+        // awaited: a submission send is one frame with an ack, not a ceremony, so cutting it leaves no
+        // counterparty holding a half-finished exchange. What IS lost is the pending queue itself,
+        // which is in memory by design (see submission-retry.ts) — re-sending is safe by the same
+        // content-derived id.
+        submissionRetries.stop();
         /**
          * DRAIN THE DETACHED SEAL TAILS — review MEDIUM-6, and it sits HERE for the same reason
          * `restartSealResolver.stop()` does: both are directory ceremonies that must not be cut with