@cello-protocol/daemon 0.0.186 → 0.0.188

package/dist/session-node-manager.js

@@ -29,6 +29,8 @@ import { migrateToEncryptedIfNeeded } from "./identity-migration.js";
 import { ensureIdentitySchema } from "./db-identity-store.js";
 import { migrateSessionTablesToAgentId } from "./agent-id-migration.js";
 import { TIER, normalizeTier, isKnownTierValue, tierBoundsFor, DEFAULT_TIER_BOUNDS, migrateContactsAddTierMetadata } from "./contacts-tier-migration.js";
+import { normalizeContactPubkey, foldContactPubkeyCase } from "./contact-pubkey-case.js";
+import { REFUSAL_KINDS } from "./refusal-reasons.js";
 import { migrateCborBlobsToCanonical } from "./cbor-blob-migration.js";
 import { ensureTrustSignalSchema } from "./trust-signal-store.js";
 import { boundSettingKey, settableTierName, isValidSettingKey, awayTierSettingKey, AWAY_DEFAULT_KEY } from "./agent-settings-keys.js";
@@ -36,7 +38,7 @@ import { publishableEndpoint, relayOnlyState } from "./relay-only.js";
 import { randomUUID, createHash, randomBytes } from "node:crypto";
 import * as lp from "it-length-prefixed";
 import { decode } from "cbor-x";
-import { encodeCbor } from "@cello-protocol/protocol-types";
+import { encodeCbor, decodeStructure1 } from "@cello-protocol/protocol-types";
 import { MAX_SESSION_NODES, STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 import { SessionConnectionGater } from "./session-connection-gater.js";
 import { SessionTree, sessionTreeLeafKindFromDb } from "./session-tree.js";
@@ -48,6 +50,7 @@ import { encodeSealPayload, MONIKER_RE, validateMoniker } from "@cello-protocol/
 // receives the already-classified `ParkAuthFailure`, so importing the code table here would invite a
 // second, drifting copy of the classification logic.
 import { decodeParkEnvelope, authenticateParkedEntry, pubkeyMatchesHex, ParkEnvelopeError, parkRefusalGuidance } from "./park-envelope.js";
+import { triageOrphanedContent } from "./orphan-triage.js";
 import { isValidMultiaddr } from "@cello-protocol/transport";
 // `LEAF_KIND_MSG` is no longer imported here: `sendContent`'s `leafKind` stopped defaulting to it
 // (B2b-1 review F4), so this file no longer names a default — every caller states its own kind.
@@ -58,6 +61,7 @@ import { RelayReceiptStore } from "./relay-receipt-store.js";
 import { SessionSealLeafStore } from "./session-seal-leaf-store.js";
 import { certifiedLeafSetFrom } from "./sealed-leaf-set.js";
 import { addColumnIfMissing } from "./column-birth.js";
+import { quarantineRedaction, retentionSentence } from "./quarantine-framing.js";
 import { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, } from "@cello-protocol/gateway";
 /** SEC-1 / review M4: cap on the refused-parked-entry memo (remote-fed → must be bounded). */
 /**
@@ -77,6 +81,25 @@ const MAX_REFUSED_PARKED_ENTRIES = 512;
  * losing an old one costs a log line rather than correctness.
  */
 const MAX_UNREADABLE_ALG_FRAMES = 64;
+/**
+ * How many consumers' read positions a single refusal notice remembers.
+ *
+ * A consumer id is an IPC connection id, so every reconnect mints a new one and the read state would
+ * otherwise grow without bound in a durable table. Sixteen is far above the real number of windows
+ * attending one agent; past that the OLDEST reader is evicted, which costs at worst one repeated
+ * announcement to a window that has already gone.
+ */
+const MAX_REFUSAL_READERS = 16;
+/**
+ * How many refusal notices one read returns, newest first.
+ *
+ * Review F3. The store is never emptied for an agent — a refusal records something that happened —
+ * and read state is per IPC connection, so a fresh window after a restart is entitled to every
+ * notice ever recorded. Uncapped, the answer to "why did this conversation go quiet?" was at the
+ * bottom of an archive. Capped and newest-first, the recent cause leads and the caller is TOLD the
+ * list was cut (`refusals_incomplete`), rather than the tail vanishing silently.
+ */
+const MAX_REFUSALS_PER_READ = 25;
 /**
  * How long the first send waits for an in-flight salt agreement before giving up on it —
  * `DOD-M15-SEALWIRE-1` B2b-2 constraint 2.
@@ -374,24 +397,18 @@ function relayPeerIdOf(circuitAddr) {
  * `null` when any leaf is unreadable — the caller must then answer "I cannot judge", never "we
  * disagree". A decode failure is this daemon's limitation, not evidence against anyone.
  *
- * Canonical Structure 1 is
- * `[protocol_version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp]`, and the
- * content hash is used AS the leaf hash (RFC 6962 §2.1 "hash" leaves are taken as-is), which is the
- * domain the certified root lives in.
+ * Canonical Structure 1 is `[version, content_hash, sender_pubkey, session_id, last_seen_seq,
+ * timestamp]`, plus `last_seen_hash` at index 6 on a v2 claim (020-ACKHASH). The content hash is at
+ * index 1 in both and is used AS the leaf hash (RFC 6962 §2.1 "hash" leaves are taken as-is), which
+ * is the domain the certified root lives in.
  */
 function carryContentHashInputs(carry) {
     const inputs = [];
     for (const leaf of carry) {
-        let contentHash;
-        try {
-            contentHash = decode(leaf.structure1Cbor)[1];
-        }
-        catch {
+        const s1 = decodeStructure1(leaf.structure1Cbor);
+        if (!s1.ok)
             return null;
-        }
-        if (!(contentHash instanceof Uint8Array) || contentHash.length !== 32)
-            return null;
-        inputs.push({ kind: "hash", data: contentHash });
+        inputs.push({ kind: "hash", data: s1.fields.contentHash });
     }
     return inputs;
 }
@@ -986,6 +1003,15 @@ export class SessionNodeManager {
     // DOD-M12B-ACK-1: WHY a session is impaired and what became of the content. Separate from the
     // state above because the state is what surfaces print and this is what they must explain.
     #impairmentCause = new Map();
+    /**
+     * DOD-M15-NO-SILENT-REFUSAL-1 review F6 — refusal notices that could NOT be persisted.
+     *
+     * Empty in every healthy daemon. It exists so that a database failure costs the restart property
+     * and nothing else: without it, the operator-facing surface for a refusal disappears entirely the
+     * moment the write fails, which is strictly worse than the in-memory Map this store replaced.
+     * `session.refusal.persist.failed` fires at ERROR on every entry that lands here.
+     */
+    #refusalFallback = new Map();
     // DOD-M12B-STRAND-1: sessions whose durable holds have been read back. One read per session per
     // process; the Map is the working copy from then on.
     #heldRestored = new Set();
@@ -2114,6 +2140,37 @@ export class SessionNodeManager {
         PRIMARY KEY (agent_id, session_id, sequence, direction)
       )
     `);
+        /**
+         * DOD-M15-REFUSEDEVIDENCE-1 — the refusal reason on a QUARANTINED row.
+         *
+         * `direction` takes a third value, `'quarantined'`: a message that was received and REFUSED. It
+         * is stored the same way a delivered one is — plaintext blob, sender key, sender signature,
+         * attribution — because a hash with no original proves nothing, and the messages worth proving
+         * (an injection, a probe, a tampered frame) are exactly the refused ones.
+         *
+         * ⚠️ THE DIRECTION VALUE IS THE FLAG, AND THAT IS WHY IT IS NOT A BOOLEAN COLUMN. `direction` is
+         * in the primary key and every delivery and unread reader already filters it with an equality
+         * literal (`findNextReceivedAfter`, `#UNREAD_RECEIVED_WHERE`, `countReceivedMessages`). A row
+         * written `'quarantined'` therefore cannot be returned by `WHERE direction = 'received'` — it is
+         * excluded BY CONSTRUCTION, with no query edited and none left to remember. A boolean column
+         * alone would have been exclusion by EDIT, which rebuilds `DOD-UNREAD-1 D4a`'s phantom-session
+         * residue the first time a new query forgets the predicate.
+         *
+         * `attribution` needs no new value: the expression in `recordTranscriptMessage` is
+         * `direction === "sent" ? … : authorship ? "verified_signature" : "local_session_state"`, and
+         * `'quarantined'` is not `'sent'` — so a verified frame lands `verified_signature` and an
+         * unverified one `local_session_state`, which is the distinction the column exists for.
+         */
+        // Through `addColumnIfMissing`, not a hand-rolled try/catch — review F7. A bare `ADD COLUMN`
+        // wrapped in a duplicate-name test had already been written twice in this codebase, which is
+        // why the helper exists; a third copy rethrows correctly but emits no `db.column_birth.failed`,
+        // so a failure on a fresh operator's database would name neither the table nor the column. That
+        // is exactly the case — the FIRST run on a new machine — the helper was extracted for.
+        addColumnIfMissing(this.#db, this.#logger, {
+            table: "transcript",
+            column: "quarantine_reason",
+            sql: "ALTER TABLE transcript ADD COLUMN quarantine_reason TEXT",
+        });
         // M8C-INBOX-1 (N2): per-agent, per-session read watermark. `last_delivered_seq` is the highest
         // RECEIVED transcript sequence the operator has been shown via cello_receive (delivery marks
         // read — no ack verb). Unread = received transcript rows with sequence > last_delivered_seq.
@@ -2251,6 +2308,58 @@ export class SessionNodeManager {
         noticed_at INTEGER NOT NULL,
         PRIMARY KEY (agent_id, pubkey)
       )
+    `);
+        /**
+         * A PUBLIC KEY IS BYTES; ITS HEX CASE IS NOT PART OF ITS IDENTITY.
+         *
+         * ⚠️ **PLACED HERE FOR TWO ORDERING REASONS, and getting either wrong is a crash at boot.** It
+         * touches all three contact-keyed tables, so it runs after the LAST of them exists
+         * (`contact_rename_notices`, directly above); and the merge it performs on a collision keeps the
+         * more restrictive TIER, which it cannot read until `migrateContactsAddTierMetadata` has added
+         * that column.
+         *
+         * Normalizing the accessors alone would be worse than the bug for anyone who already has a
+         * mixed-case row: the row becomes UNREACHABLE rather than merely wrong, taking its block, its
+         * away message and its pet name with it. Idempotent and silent on a clean database.
+         */
+        foldContactPubkeyCase(this.#db, this.#logger);
+        // DOD-M15-NO-SILENT-REFUSAL-1: refusal notices — one per (agent, session, reason). Written every
+        // time an inbound message is refused; read by cello_receive and by the cello_inbox pull. Modelled
+        // on contact_rename_notices above and keyed the same way, on agent_id (the stable key) — the map
+        // this replaced was keyed on agent_name, a mutable display label, which was its second bug.
+        //
+        // DURABLE because the case this exists for is NOBODY ATTENDING. A notice held only in memory is
+        // lost to a restart and is only ever surfaced to whoever happens to call cello_receive on that
+        // exact session, which is a log line with extra steps.
+        //
+        // `content_refusal_reads` is the part rename notices do not need: they clear on operator action,
+        // these are read non-destructively PER CONSUMER. Two MCP windows attending one agent is ordinary,
+        // and under a single surfaced flag the first reader consumed the notice and the second was told
+        // nothing, permanently.
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS content_refusal_notices (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        impact TEXT NOT NULL,
+        guidance TEXT NOT NULL,
+        count INTEGER NOT NULL,
+        first_at INTEGER NOT NULL,
+        last_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, reason)
+      )
+    `);
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS content_refusal_reads (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        consumer_id TEXT NOT NULL,
+        seen_count INTEGER NOT NULL,
+        seen_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, reason, consumer_id)
+      )
     `);
         // DOD-SETTINGS-1: a daemon-side per-agent settings store for REACHABILITY POLICY (the tier bounds
         // overrides and the per-tier/agent away messages). A generic key-value table on the stable
@@ -2548,17 +2657,18 @@ export class SessionNodeManager {
             return null;
         const reach = new Map();
         for (const leaf of carry) {
-            let signedLastSeen = 0;
-            try {
-                // Structure 1 = [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp].
-                const raw = decode(leaf.structure1Cbor)[4];
-                const n = typeof raw === "bigint" ? Number(raw) : raw;
-                if (typeof n === "number" && Number.isFinite(n))
-                    signedLastSeen = n;
-            }
-            catch {
-                return null; // unreadable: publish no boundary rather than a half-derived one
-            }
+            // Structure 1 = [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp],
+            // plus last_seen_hash at 6 on a v2 claim. `last_seen_seq` is index 4 in both — 020-ACKHASH
+            // APPENDS, so this read did not move. The hash is not consulted here: this derives a
+            // POSITIONAL boundary, which is the job last_seen_seq keeps doing alongside the new field.
+            const s1 = decodeStructure1(leaf.structure1Cbor);
+            // Unreadable, or a layout this build cannot name: publish no boundary rather than a
+            // half-derived one somebody else could have shaped.
+            if (!s1.ok)
+                return null;
+            const signedLastSeen = Number.isFinite(Number(s1.fields.lastSeenSeq))
+                ? Number(s1.fields.lastSeenSeq)
+                : 0;
             const prior = reach.get(leaf.senderPubkeyHex) ?? 0;
             reach.set(leaf.senderPubkeyHex, Math.max(prior, leaf.sequenceNumber, signedLastSeen));
         }
@@ -2583,7 +2693,14 @@ export class SessionNodeManager {
      * lost row only cost the unread count. Delivery reads the transcript now, so a swallowed received
      * row is TOTAL content loss and the caller has to know.
      */
-    recordTranscriptMessage(agentName, sessionId, sequence, direction, plaintext, correlationId, 
+    recordTranscriptMessage(agentName, sessionId, sequence, 
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1 adds `'quarantined'` — received and REFUSED, kept as evidence and
+     * never delivered. It goes through THIS writer rather than a second one so that the attribution
+     * rule, the blob handling and the write-failure logging cannot drift between a delivered message
+     * and a refused one. One store, one writer.
+     */
+    direction, plaintext, correlationId, 
     /**
      * DOD-M15-SEALWIRE-1 bullet 5: the VERIFIED authorship proof, when there is one.
      *
@@ -2592,7 +2709,16 @@ export class SessionNodeManager {
      * is written into the row as `attribution = 'local_session_state'`, so a reader can tell a row
      * whose author was proven from one whose author was assumed. That distinction is the bullet.
      */
-    authorship) {
+    authorship, 
+    /** Required on a `'quarantined'` row and meaningless on any other: WHY it was refused. */
+    quarantineReason, 
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1: the sender's key when there is one but no verified signature to go
+     * with it. A refused frame often has an identified sender and an unusable proof — a tampered
+     * message is still FROM someone — and dropping the key because the signature failed would throw
+     * away the half of the attribution that survived.
+     */
+    senderPubkeyHexOverride) {
         if (!this.#db)
             return false;
         try {
@@ -2600,9 +2726,11 @@ export class SessionNodeManager {
             const blob = Buffer.from(plaintext);
             this.#db
                 .prepare(`INSERT OR IGNORE INTO transcript
-             (agent_id, session_id, sequence, direction, blob, created_at, sender_pubkey, sender_sig, attribution)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(agentId, sessionId, sequence, direction, blob, Date.now(), authorship ? Buffer.from(authorship.senderPubkey).toString("hex") : null, authorship ? Buffer.from(authorship.senderSig) : null, 
+             (agent_id, session_id, sequence, direction, blob, created_at, sender_pubkey, sender_sig, attribution, quarantine_reason)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(agentId, sessionId, sequence, direction, blob, Date.now(), authorship
+                ? Buffer.from(authorship.senderPubkey).toString("hex")
+                : senderPubkeyHexOverride ?? null, authorship ? Buffer.from(authorship.senderSig) : null, 
             /**
              * THREE values, not two — caught by CELLO_Coder_1 reviewing the first version, and it was
              * the same defect this column exists to prevent, surviving one layer up in the enum.
@@ -2630,7 +2758,7 @@ export class SessionNodeManager {
              *   `verified_signature` — someone else wrote it and we checked their key against it.
              *   `local_session_state`— someone else wrote it and nobody checked anything.
              */
-            direction === "sent" ? "self_authored" : authorship ? "verified_signature" : "local_session_state");
+            direction === "sent" ? "self_authored" : authorship ? "verified_signature" : "local_session_state", quarantineReason ?? null);
             this.#logger.info("transcript.message.recorded", { sessionId, agentName, sequence, direction, correlationId });
             return true;
         }
@@ -2646,12 +2774,17 @@ export class SessionNodeManager {
             // sentence is corrected rather than kept, because as written it reassured a reader about a
             // safety net that no longer exists. Sent-row failures stay a warning (they only affect the
             // durable readable transcript, not delivery).
-            const level = direction === "received" ? "error" : "warn";
+            // A QUARANTINED row that fails to write is an ERROR for the same reason a received one is,
+            // and a different one: nothing else holds these bytes. The message was refused, so it was
+            // never delivered and never acked in a way that brings it back — a failed write here is the
+            // evidence gap this unit exists to close, reopened by a disk fault.
+            const level = direction === "sent" ? "warn" : "error";
             this.#logger[level]("transcript.message.record.failed", {
                 sessionId, agentName, sequence, direction,
                 reason: err instanceof Error ? err.message : String(err),
                 correlationId,
                 ...(direction === "received" ? { impact: "content_undeliverable_message_lost" } : {}),
+                ...(direction === "quarantined" ? { impact: "refused_message_not_retained_no_other_copy_exists" } : {}),
             });
             return false;
         }
@@ -2665,7 +2798,7 @@ export class SessionNodeManager {
         if (!this.#db)
             return { messages: [], undecryptable: 0 };
         const rows = this.#db
-            .prepare(`SELECT sequence, direction, blob, created_at FROM transcript
+            .prepare(`SELECT sequence, direction, blob, created_at, quarantine_reason FROM transcript
          WHERE agent_id = ? AND session_id = ? ORDER BY sequence ASC, direction ASC`)
             .all(this.#requireAgentId(agentName), sessionId);
         const messages = [];
@@ -2674,12 +2807,38 @@ export class SessionNodeManager {
         // already read the field.
         for (const r of rows) {
             const blob = r.blob instanceof Uint8Array ? r.blob : new Uint8Array(r.blob);
-            messages.push({
-                sequence: r.sequence,
-                direction: r.direction === "sent" ? "sent" : "received",
-                text: new TextDecoder().decode(blob),
-                createdAt: r.created_at,
-            });
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — THE READ IS REDACTED, THE STORAGE IS NOT.
+             *
+             * The entry stays at its position, because a hole where a message was is the evidence gap
+             * this unit exists to close, one level up: the operator must be able to see that something
+             * arrived here and was refused. What is withheld is the TEXT, and `text` carries the
+             * withholding statement rather than being omitted — every existing renderer of this array
+             * prints `text`, so a missing field would print nothing and an unfiltered one would print the
+             * payload. The statement is the fail-safe value for both.
+             *
+             * ⚠️ THREE-WAY, not `!== "sent" ? "received"`. The old expression labelled anything that was
+             * not `sent` as `received`, which would have handed a refused message to every reader as a
+             * delivered one — with its text.
+             */
+            const direction = r.direction === "sent" ? "sent" : r.direction === "quarantined" ? "quarantined" : "received";
+            if (direction === "quarantined") {
+                // No `?? "refused"` default — review F11. See `readQuarantined` for why a generic label for
+                // an impossible state is worse than an empty one.
+                const reason = r.quarantine_reason;
+                const redaction = quarantineRedaction(reason, sessionId, r.sequence);
+                messages.push({
+                    sequence: r.sequence, direction, createdAt: r.created_at,
+                    text: redaction.text,
+                    // The key ENDS in `guidance` so `vocabulary.ts` rewrites the verb for a CLI reader — see
+                    // the note on `quarantineRedaction`.
+                    withheld_guidance: redaction.guidance,
+                    refusalReason: reason,
+                    withheld: true,
+                });
+                continue;
+            }
+            messages.push({ sequence: r.sequence, direction, text: new TextDecoder().decode(blob), createdAt: r.created_at });
         }
         return { messages, undecryptable: 0 };
     }
@@ -2864,7 +3023,7 @@ export class SessionNodeManager {
     isContact(agentName, pubkey) {
         if (!this.#db)
             return false;
-        const row = this.#db.prepare("SELECT 1 FROM contacts WHERE agent_id = ? AND pubkey = ?").get(this.#requireAgentId(agentName), pubkey);
+        const row = this.#db.prepare("SELECT 1 FROM contacts WHERE agent_id = ? AND pubkey = ?").get(this.#requireAgentId(agentName), normalizeContactPubkey(pubkey));
         return row !== undefined;
     }
     /** DOD-TIER-1: the reachability tier for a counterparty of this agent. The RESULT is total — an
@@ -2881,7 +3040,7 @@ export class SessionNodeManager {
             throw new Error(`getTier('${agentName}'): database not initialized`);
         const row = this.#db
             .prepare("SELECT tier FROM contacts WHERE agent_id = ? AND pubkey = ?")
-            .get(this.#requireAgentId(agentName), pubkey);
+            .get(this.#requireAgentId(agentName), normalizeContactPubkey(pubkey));
         if (row && row.tier !== null && !isKnownTierValue(row.tier)) {
             // A stored tier outside 0..4 is corruption — surface it. normalizeTier still maps it to the
             // tighter UNKNOWN so the caller is safe, but a silent map would hide a broken row.
@@ -2942,6 +3101,9 @@ export class SessionNodeManager {
      *  at first add, exactly as `added_at`/`moniker` already do; re-adding never downgrades a contact
      *  the operator has since promoted. Raising the tier later is `cello_contact_set_tier`'s job. */
     addContact(agentName, pubkey, moniker, provenance, tier = TIER.UNKNOWN) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!pubkey)
             return;
         // Review F1: a missing DB handle must FAIL the write loudly — returning silently here let
@@ -2972,6 +3134,9 @@ export class SessionNodeManager {
      *  when no such contact — fail-loud at the caller, never a silent no-op success. Same
      *  validate-throw backstop as addContact. */
     setContactMoniker(agentName, pubkey, moniker) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         // Review F2: false means exactly "no such contact" — a null DB handle throws instead, so the
         // operator is never sent chasing a nonexistent missing-contact problem.
         if (!this.#db)
@@ -3001,6 +3166,9 @@ export class SessionNodeManager {
      * contact in order to withhold something from them.
      */
     setContactSignalPref(agentName, pubkey, signalHash, present) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             throw new Error(`setContactSignalPref('${agentName}'): database not initialized`);
         const agentId = this.#requireAgentId(agentName);
@@ -3031,6 +3199,9 @@ export class SessionNodeManager {
      * the operator's standing default, never to disclosing something consent has not cleared.
      */
     getContactSignalPrefs(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             return new Map();
         const rows = this.#db
@@ -3041,6 +3212,9 @@ export class SessionNodeManager {
     /** DOD-AWAY-TIER-1: set (or clear, with null) a contact's per-contact away message. Returns false
      *  when no such contact — fail-loud at the caller (same contract as setContactMoniker/setContactTier). */
     setContactAwayMessage(agentName, pubkey, message) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             throw new Error(`setContactAwayMessage('${agentName}'): database not initialized`);
         const res = this.#db
@@ -3054,6 +3228,9 @@ export class SessionNodeManager {
      *  four-level resolution TOTAL. A pure read; the resolved text is screened on the outbound path by
      *  the caller like any content (SI — it does not bypass the gateway). */
     resolveAwayMessage(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             return null;
         const agentId = this.#requireAgentId(agentName);
@@ -3082,6 +3259,9 @@ export class SessionNodeManager {
      *  setContactMoniker). The caller validates the tier is a known constant BEFORE calling; this
      *  stores whatever it is handed (the handler is the validation boundary). */
     setContactTier(agentName, pubkey, tier) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             throw new Error(`setContactTier('${agentName}'): database not initialized`);
         const res = this.#db
@@ -3099,6 +3279,9 @@ export class SessionNodeManager {
      *  (AC5). Limitation: last_offered_moniker updates only on the RECEIVING side of an offer, so rename
      *  detection works only for peers who INITIATE to you — a property, not a bug. */
     recordOfferedMoniker(agentName, pubkey, offered) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         // Fail CLOSED like getTier/setContactTier: a silent skip here would drop a rename baseline update
         // (and any notice) while the daemon reports healthy — the inbound path always has an open DB.
         if (!this.#db)
@@ -3140,6 +3323,9 @@ export class SessionNodeManager {
     /** DOD-RENAME-1: clear a pending rename notice — the operator acted (adopted a name or removed the
      *  contact). Idempotent (no notice → no-op). Fail-closed on a missing DB, like the writes above. */
     clearRenameNotice(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             throw new Error(`clearRenameNotice('${agentName}'): database not initialized`);
         this.#db
@@ -3148,6 +3334,9 @@ export class SessionNodeManager {
     }
     /** M8C-CONTACT-1: known stays known until explicitly removed. */
     removeContact(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             return false;
         const res = this.#db.prepare("DELETE FROM contacts WHERE agent_id = ? AND pubkey = ?").run(this.#requireAgentId(agentName), pubkey);
@@ -3206,6 +3395,9 @@ export class SessionNodeManager {
     /** MONIKER-4: the operator's pet name for a pubkey (whoLabel's top tier), or null. Read-only
      *  and tolerant of a not-yet-open DB (a missing label degrades the doorbell, never blocks it). */
     getContactMoniker(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db) {
             // Review F2: the last fully-silent branch in the resolution chain — the label degrades to
             // fingerprint, which is correct, but say so rather than returning null wordlessly.
@@ -3236,15 +3428,223 @@ export class SessionNodeManager {
          ORDER BY c.added_at ASC`)
             .all(this.#requireAgentId(agentName));
     }
-    /** M8C-ABUSE-1: cumulative RECEIVED byte total for a session (anti-drip-feed accounting). */
+    /**
+     * M8C-ABUSE-1: cumulative inbound byte total for a session (anti-drip-feed accounting).
+     *
+     * ⚠️ DOD-M15-REFUSEDEVIDENCE-1 — QUARANTINED BYTES COUNT, and the bound depends on it.
+     *
+     * Retaining refused messages puts real bytes on the operator's disk. Left out of this sum,
+     * retention would be an UNBOUNDED SIDE CHANNEL: a counterparty who can get messages refused —
+     * anyone who can trip the screener, which is anyone — stores against a budget that cannot see
+     * what they spent. Counting them makes total retention per session bounded by the same tier cap
+     * that bounds delivery, which is the bound the unit's no-truncation rule rests on.
+     *
+     * No new capability reaches an attacker from this: the counterparty already spends the session's
+     * byte budget by sending ordinary messages. Spending it with refused ones costs them the same.
+     */
     #getReceivedBytesTotal(agentName, sessionId) {
         if (!this.#db)
             return 0;
         const row = this.#db
-            .prepare("SELECT COALESCE(SUM(LENGTH(blob)), 0) AS total FROM transcript WHERE agent_id = ? AND session_id = ? AND direction = 'received'")
+            .prepare("SELECT COALESCE(SUM(LENGTH(blob)), 0) AS total FROM transcript WHERE agent_id = ? AND session_id = ? AND direction IN ('received','quarantined')")
             .get(this.#requireAgentId(agentName), sessionId);
         return row.total;
     }
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1 — RETAIN a message that was refused. Retention is universal; DELIVERY
+     * is what is withheld.
+     *
+     * Every refusal path that can store calls this. It writes the plaintext, the sender's key, the
+     * sender's signature and the refusal reason into the transcript, flagged `'quarantined'` so it is
+     * excluded by construction from delivery and from unread counts.
+     *
+     * ⚠️ STORING HOSTILE CONTENT IS SAFE; INTERPOLATING IT IS NOT. The blob is a bound parameter and
+     * the database never parses it — SQL injection is not the risk here and must not be defended
+     * against. The risk is on the way OUT, so nothing below puts `content` into a log line, an error
+     * message or a path. The log carries the length and the hash.
+     *
+     * Returns the sequence it was stored at, or `null` when it was not stored — which happens only for
+     * a reason the caller is expected to log.
+     */
+    #quarantineRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts) {
+        if (!this.#db)
+            return null;
+        try {
+            const agentId = this.#requireAgentId(agentName);
+            /**
+             * ⚠️ **DEDUP FIRST — review F1, and without it retention KILLS THE CONVERSATION IT PROTECTS.**
+             *
+             * Six of the seven retaining exits refuse WITHOUT ACKNOWLEDGING, which is exactly what makes
+             * the sender's daemon redeliver. Each redelivery re-enters here, above the leaf dedup, and
+             * would take a fresh negative sequence — another full copy of the same bytes. The park drain's
+             * own comment measures that loop at *"~120 repeats per message, forever"*.
+             *
+             * **And retained bytes spend the delivery budget** (`#getReceivedBytesTotal` counts them, which
+             * is what makes the bound honest). So a counterparty on a newer build sends ONE message, the
+             * version skew refuses it un-acked, and twenty-five drains later the conversation's 25 MB is
+             * gone — permanently, because the cap does not reset. Honest traffic then hits
+             * `session_size_limit_exceeded` and the daemon tells the operator to start a new conversation.
+             *
+             * The counterbalance, stated properly this time: **evidence and delivery share one monotonic
+             * budget, and when evidence wins the conversation stops working.** Entry 69 claimed there was
+             * nothing to trade off, and this is what that claim was hiding.
+             *
+             * Keyed on (session, reason, bytes) rather than a hash column: SQLite compares BLOBs directly
+             * and short-circuits on length, the candidate set is one session's refusals, and it needs no
+             * schema change. Same bytes refused the same way is ONE piece of evidence — how many times it
+             * arrived is already counted by the refusal notice. The same bytes refused for a DIFFERENT
+             * reason is a different fact and keeps its own row.
+             */
+            const already = this.#db
+                .prepare(`SELECT sequence FROM transcript
+           WHERE agent_id = ? AND session_id = ? AND direction = 'quarantined'
+             AND quarantine_reason = ? AND blob = ?`)
+                .get(agentId, sessionId, reason, Buffer.from(content));
+            if (already) {
+                this.#logger.debug("session.content.quarantine.duplicate", {
+                    agentName, sessionId, reason, sequence: already.sequence,
+                    contentHash: contentHashHex, correlationId: opts.correlationId,
+                });
+                return already.sequence;
+            }
+            /**
+             * THE BOUND. A session at its byte cap retains no more.
+             *
+             * `senderPubkeyHex` is absent exactly when there is no session row or no counterparty
+             * (`session_orphaned`, `sender_unresolved`), so there is no contact to look a tier up on. Those
+             * take the UNKNOWN tier — the tightest bound, and the right one for a sender we cannot name.
+             */
+            const tier = opts.senderPubkeyHex ? this.getTier(agentName, opts.senderPubkeyHex) : TIER.UNKNOWN;
+            const cap = this.resolveTierBound(agentName, tier, "max_bytes");
+            const prior = this.#getReceivedBytesTotal(agentName, sessionId);
+            if (prior + content.length > cap) {
+                this.#logger.warn("session.content.quarantine.skipped", {
+                    agentName, sessionId, reason, contentHash: contentHashHex,
+                    bytes: content.length, prior, cap, tier,
+                    correlationId: opts.correlationId,
+                    skipped: "byte_budget_exhausted",
+                    impact: "this refused message was NOT retained: the conversation has already spent its storage budget, so there is no evidence of it beyond this line and the refusal notice.",
+                });
+                return null;
+            }
+            /**
+             * WHERE IT SITS.
+             *
+             * A screener block already leafed at its canonical position, and the quarantine row takes that
+             * same sequence so the leaf and the evidence describe one event — DoD 7's leaf index is
+             * untouched by this unit.
+             *
+             * A refusal with NO leaf takes the next NEGATIVE sequence for the session. A leaf position is
+             * never negative, so the two spaces cannot collide, and descending from −1 means two refusals
+             * cannot overwrite each other. This is what lets `session_orphaned` — a session id with no
+             * `sessions` row at all — live in the same table as everything else, which is the whole point
+             * of one store rather than two.
+             */
+            let sequence = opts.canonicalSeq;
+            if (sequence === undefined || sequence < 0) {
+                const low = this.#db
+                    .prepare("SELECT MIN(sequence) AS lo FROM transcript WHERE agent_id = ? AND session_id = ? AND direction = 'quarantined'")
+                    .get(agentId, sessionId);
+                sequence = Math.min(low.lo ?? 0, 0) - 1;
+            }
+            const stored = this.recordTranscriptMessage(agentName, sessionId, sequence, "quarantined", content, opts.correlationId, opts.authorship, reason, opts.senderPubkeyHex ?? null);
+            if (!stored)
+                return null;
+            this.#logger.info("session.content.quarantined", {
+                agentName, sessionId, reason, sequence,
+                contentHash: contentHashHex, bytes: content.length,
+                signature: opts.authorship ? "verified" : "none",
+                correlationId: opts.correlationId,
+            });
+            return sequence;
+        }
+        catch (err) {
+            this.#logger.error("session.content.quarantine.failed", {
+                agentName, sessionId, reason, contentHash: contentHashHex,
+                error: extractErrorMessage(err),
+                impact: "a refused message could not be retained, so nothing holds a copy of it — it cannot be shown to anyone or reported.",
+            });
+            return null;
+        }
+    }
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1 — retain a message refused OUTSIDE `ingestReceivedContent`.
+     *
+     * Review F6. The park drain terminally-blocks a message that arrived for an already-committed
+     * session, then confirm-deletes the relay copy — the one other route in the tree that discarded
+     * refused content, and the highest-suspicion combination in the product: hostile bytes aimed at a
+     * conversation somebody has already sealed. Shipped guidance now tells every operator that
+     * refused messages are kept, so this is made true rather than the promise narrowed.
+     *
+     * A thin delegate, not a second implementation: the bound, the dedup, the sequence allocation and
+     * the logging are the ones every other refusal uses.
+     */
+    quarantineRefusedInbound(agentName, sessionId, reason, content, contentHashHex, senderPubkeyHex, correlationId) {
+        return this.#quarantineRefusedContent(agentName, sessionId, reason, content, contentHashHex, {
+            senderPubkeyHex, correlationId,
+        });
+    }
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1: read retained refused messages back — all of a session's, or the one
+     * at `sequence`.
+     *
+     * Returns the RAW payload. Every caller that hands it to a reader must frame it first
+     * (`frameQuarantinedPayload`); nothing else in the tree may read this without doing so.
+     */
+    readQuarantined(agentName, sessionId, sequence) {
+        if (!this.#db)
+            return [];
+        const rows = this.#db
+            .prepare(`SELECT sequence, blob, created_at, sender_pubkey, sender_sig, attribution, quarantine_reason
+         FROM transcript
+         WHERE agent_id = ? AND session_id = ? AND direction = 'quarantined'
+           ${sequence === undefined ? "" : "AND sequence = ?"}
+         ORDER BY sequence ASC`)
+            .all(...(sequence === undefined
+            ? [this.#requireAgentId(agentName), sessionId]
+            : [this.#requireAgentId(agentName), sessionId, sequence]));
+        return rows.map((r) => ({
+            sequence: r.sequence,
+            /**
+             * ⚠️ NOT `?? "refused"` — review F11. A generic default here is a label for a state that
+             * cannot occur: the column exists before any `'quarantined'` row can be written and
+             * `#quarantineRefusedContent` always supplies a reason. A default reads to the next maintainer
+             * as a supported case and would quietly stand in for a real bug. If a NULL ever appears, the
+             * empty reason travels to the frame and the caller, which is loud enough to chase.
+             */
+            reason: r.quarantine_reason,
+            content: r.blob instanceof Uint8Array ? r.blob : new Uint8Array(r.blob),
+            senderPubkeyHex: r.sender_pubkey,
+            senderSig: r.sender_sig === null ? null : (r.sender_sig instanceof Uint8Array ? r.sender_sig : new Uint8Array(r.sender_sig)),
+            attribution: r.attribution,
+            createdAt: r.created_at,
+        }));
+    }
+    /** The metadata half of a framed quarantine read — everything known ABOUT the message, none of it
+     *  taken from the message. Split out so the framing module never touches the database. */
+    quarantineFrameMeta(agentName, sessionId, rec) {
+        return {
+            reason: rec.reason,
+            senderPubkeyHex: rec.senderPubkeyHex,
+            senderLabel: rec.senderPubkeyHex === null ? null : this.getContactMoniker(agentName, rec.senderPubkeyHex),
+            // `attribution` is the column that exists to answer exactly this, so it is read rather than
+            // inferred from `sender_sig` being non-null — a stored signature that was never checked
+            // against the sender's key would otherwise be reported as VERIFIED.
+            signature: rec.attribution === "verified_signature" ? "VERIFIED" : "NOT SIGNED",
+            sessionId,
+            position: rec.sequence,
+            arrivedAtMs: rec.createdAt,
+            /**
+             * The hash OF THE RETAINED BYTES, recomputed here — not the hash the sender committed to.
+             *
+             * On the highest-value case in the whole unit those two differ ON PURPOSE:
+             * `content_hash_mismatch` means the sender's committed hash does not describe these bytes.
+             * Printing their claim over our bytes would label the payload with a hash it does not have,
+             * which is the one thing a reader would use this line to check.
+             */
+            contentHashHex: Buffer.from(contentHashFor(rec.content, { alg: "sha256", salt: null })).toString("hex"),
+        };
+    }
     /** M8C-ABUSE-1 (reviewer HIGH fix, D18): bytes currently sitting in the out-of-order hold
      *  buffer for this session — NOT yet committed leaves, but real bytes in memory that would
      *  otherwise let multiple held chunks each individually pass the size gate while cumulatively
@@ -3679,6 +4079,21 @@ export class SessionNodeManager {
     #k(agentName, sessionId) {
         return `${agentName}\x1f${sessionId}`;
     }
+    /**
+     * The inverse of `#k`, for the ONE reader that has a key and needs the session id back: the
+     * unpersisted-refusal fallback, which is keyed like every other per-session map but is drained
+     * per AGENT rather than per session.
+     *
+     * Returns null when the key belongs to a different agent. Split on the FIRST separator only —
+     * `agentName` cannot contain 0x1f, so anything after the first one is the session id, and a
+     * greedy split would silently mis-attribute a key rather than reject it.
+     */
+    #unk(key, agentName) {
+        const sep = key.indexOf("\x1f");
+        if (sep < 0)
+            return null;
+        return key.slice(0, sep) === agentName ? key.slice(sep + 1) : null;
+    }
     /**
      * DOD-AGENT-ID-JOINKEY-1: resolve an agent's NAME to its STABLE agent_id. This is the ONE place a
      * name becomes a key, and it is the boundary between the two worlds:
@@ -3944,22 +4359,26 @@ export class SessionNodeManager {
             });
             // DOD-MSG-4 (strict in-order): record the relay-witnessed canonical sequence for the
             // counterparty's MSG leaves. The relay is the ordering authority; structure1_cbor =
-            // [1, content_hash(32), sender_pubkey, session_id, last_seen_seq, ts]. The relay sequence
+            // [version, content_hash(32), sender_pubkey, session_id, last_seen_seq, ts] (+ last_seen_hash
+            // at index 6 on a v2 claim — 020-ACKHASH; content_hash stays at 1). The relay sequence
             // is 1-based and global per session; the daemon tree is 0-based — normalize with -1. Only
             // COUNTERPARTY leaves (the ones B will ingest); our own echoed leaf already lands via the
             // send path. The gate (ingestReceivedContent) reads this map to hold out-of-order arrivals.
             if (!frame.authored_by_us && frame.leaf_kind !== LEAF_KIND_CTRL) {
-                try {
-                    const s1 = decode(frame.structure1_cbor);
-                    const contentHash = s1?.[1];
-                    if (contentHash instanceof Uint8Array && frame.sequence_number > 0) {
-                        this.recordWitnessedSequence(agentName, sessionId, Buffer.from(contentHash).toString("hex"), frame.sequence_number - 1);
+                const s1 = decodeStructure1(frame.structure1_cbor);
+                if (s1.ok) {
+                    if (frame.sequence_number > 0) {
+                        this.recordWitnessedSequence(agentName, sessionId, Buffer.from(s1.fields.contentHash).toString("hex"), frame.sequence_number - 1);
                     }
                 }
-                catch (err) {
+                else {
+                    // `structure1Reason`, not `error` — review F6. This is a named refusal code, and putting
+                    // it in a field called `error` reads as an exception message to anyone scanning logs.
+                    // The old `try` here also wrapped `recordWitnessedSequence`, so a throw from THAT was
+                    // reported as a decode failure; the decode no longer throws, and the split is deliberate.
                     this.#logger.warn("session.relay.leaf.witness.decode.failed", {
                         sessionId,
-                        error: err instanceof Error ? err.message : String(err),
+                        structure1Reason: s1.reason,
                         correlationId,
                     });
                 }
@@ -4476,6 +4895,38 @@ export class SessionNodeManager {
         if (!current)
             return;
         this.#impairmentCause.set(key, { cause: current.cause, retained });
+        /**
+         * ─── DOD-M15-NO-SILENT-REFUSAL-1: the notice fires HERE, and ONLY on `lost` ─────────────────
+         *
+         * ⚠️ **THE FIRST VERSION WROTE IT ON THE IMPAIRMENT TRANSITION, WHICH IS A SUCCESS PATH.**
+         *
+         * A direct send failing is the ORDINARY case when a counterparty is offline: the message is
+         * then parked with the relay and handed over when they come back, which is the leave-a-message
+         * feature working exactly as designed. Writing a notice at that moment told the operator "a
+         * message this side sent did not reach the counterparty" about a message that was in flight and
+         * would arrive — while `cello_send` was simultaneously telling them it was parked. Two surfaces,
+         * opposite stories, same message.
+         *
+         * By this line the outcome is known, and only one of the three is the operator's problem:
+         *   - `parked`   — with the relay, delivered when they come back. Nothing to tell.
+         *   - `durable`  — queued here, re-sent automatically. Nothing to tell.
+         *   - `lost`     — it could not be queued anywhere. It is gone, and only a resend recovers it.
+         *
+         * A FAILED ACK takes none of these branches (it never reaches this method), and that is correct:
+         * an acknowledgement this side owed them going missing costs the counterparty a redelivery, not
+         * the operator a message.
+         *
+         * NOT retracted when the connection recovers, unlike the impairment state it rides on: a
+         * recovered connection does not un-lose a message. That is also why the count is meaningful —
+         * it is the number of messages lost in this conversation, and it only ever grows.
+         */
+        if (retained !== "lost")
+            return;
+        this.noteContentRefusal(agentName, sessionId, "outbound_message_lost", {
+            kind: REFUSAL_KINDS.OUTBOUND,
+            impact: "a message you sent could not be delivered and could not be saved to send later, so it is gone. Nothing was added to the conversation and the other person never saw it. Everything you sent before it is unaffected.",
+            guidance: "Send it again. This is the one case where resending is right — there is no copy of it anywhere, so nothing will deliver it for you. If it keeps happening, the connection to this person is not working: check cello_status for this conversation before sending anything long.",
+        });
     }
     /** DOD-M12B-ACK-1: why this session is impaired, for the surface that has to explain it. Null
      *  when it is not impaired — a caller must not narrate a failure that is not current. */
@@ -4859,10 +5310,22 @@ export class SessionNodeManager {
         this.#sessionLiveness.delete(key);
         // M7-UPGRADE-002: drop the auto-acknowledge bookkeeping for a torn-down session.
         this.#contentDesynced.delete(key);
-        // DOD-M15-REFUSED-INBOUND-SILENT-1: and the unshown refusals. Bounded (a fixed set of reasons
-        // per session) so leaving them was a slow leak rather than a bug — but this list IS the
-        // documented teardown set, and a map that is not in it drifts out of everyone's mental model.
-        this.#contentRefusals.delete(key);
+        /**
+         * DOD-M15-NO-SILENT-REFUSAL-1 review N2: the UNPERSISTED half IS torn down, and only that half.
+         *
+         * `#refusalFallback` is in memory and restores exactly what the deleted Map did, so it belongs
+         * in the teardown set exactly as that Map did. Leaving it out meant a daemon that could not
+         * write to disk — already in trouble — grew without bound in memory as well. The durable rows
+         * stay, for the reason below.
+         */
+        this.#refusalFallback.delete(key);
+        // DOD-M15-NO-SILENT-REFUSAL-1: the DURABLE notices are NOT torn down here, and the omission is
+        // deliberate — this list is the documented teardown set, so anything absent from it needs a
+        // reason. They live in `content_refusal_notices`, keyed on agent_id + session_id, and the
+        // question they answer ("why did that person stop replying?") is one an operator asks AFTER a
+        // session ends, most sharply for `session_committed` — a refusal that exists only because the
+        // session was already sealed. Dropping them at seal would delete exactly the ones a sealed
+        // session produces. Growth is one row per (session, reason), i.e. proportional to `sessions`.
         this.#unreadableAlgSeen.delete(key);
         this.#responderSealSubmitted.delete(key);
         // DOD-MSG-4: drop the strict-in-order bookkeeping (witness map, held plaintext, high-water)
@@ -6718,10 +7181,14 @@ export class SessionNodeManager {
                             });
                         };
                         try {
-                            // Structure 1 = [1, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp]
-                            // — the same decode `#recordFrameOrdering` does for the received half, index 2.
-                            const s1 = decode(witnessed.structure1_cbor);
-                            const pk = s1[2];
+                            // Structure 1 = [version, content_hash, sender_pubkey, session_id, last_seen_seq,
+                            // timestamp] (+ last_seen_hash at 6 on a v2 claim — 020-ACKHASH). The sender pubkey is
+                            // index 2 in both; the same read `#recordFrameOrdering` does for the received half.
+                            const s1Decoded = decodeStructure1(witnessed.structure1_cbor);
+                            // NAMED AT ITS CAUSE. A failed decode falling through to the shape check below would
+                            // report `pubkey_shape` for bytes that never yielded a pubkey at all, sending the next
+                            // reader to audit a key when the layout is what disagreed.
+                            const pk = s1Decoded.ok ? s1Decoded.fields.senderPubkey : undefined;
                             // The SIGNATURE is length-checked too (review F2): the guard checked the pubkey's 32
                             // bytes and only truthiness on the signature, so a zero-length one would have stored an
                             // uncheckable BLOB. Not reachable today — `sign()` returns 64 — and the asymmetry is
@@ -6750,7 +7217,10 @@ export class SessionNodeManager {
                              * identity problem. Here it means our own encoder and decoder disagree — bad, but it
                              * must not cost the operator a delivered message.
                              */
-                            if (!(pk instanceof Uint8Array) || pk.length !== 32) {
+                            if (!s1Decoded.ok) {
+                                dropAuthorship("structure1_decode_failed", undefined, { structure1Reason: s1Decoded.reason });
+                            }
+                            else if (!(pk instanceof Uint8Array) || pk.length !== 32) {
                                 dropAuthorship("pubkey_shape", undefined, { pubkeyLen: pk instanceof Uint8Array ? pk.length : -1 });
                             }
                             else if (witnessed.sender_signature.length !== 64) {
@@ -6764,7 +7234,11 @@ export class SessionNodeManager {
                             }
                         }
                         catch (err) {
-                            dropAuthorship("structure1_decode_failed", err);
+                            // NOT a decode failure — review F3. `decodeStructure1` never throws and its failure is
+                            // handled as the first branch above, with its own reason. What can still throw in here
+                            // is `verify()` and the Buffer work, so this names that instead of sending the reader
+                            // to audit a CBOR layout that decoded fine.
+                            dropAuthorship("authorship_verify_threw", err);
                         }
                     }
                     // 1-BASED → 0-BASED. The relay numbers the first leaf of a session 1
@@ -7568,15 +8042,18 @@ export class SessionNodeManager {
         byHash.set(Buffer.from(contentHash).toString("hex"), declaredAlg);
     }
     /**
-     * ─── DOD-M15-REFUSED-INBOUND-SILENT-1: refusals the RECEIVING operator can actually see ───────
+     * ─── DOD-M15-NO-SILENT-REFUSAL-1: refusals the RECEIVING operator can actually see ────────────
      *
      * Every inbound refusal already logs a `reason`, an `impact` and a `guidance` — and they are
      * good. They had no reader. From the receiving operator's chair a refused message simply never
      * arrives: the conversation goes quiet with a full explanation sitting in a file they have no
      * reason to open, and they conclude the other person stopped replying.
      *
-     * `content_hash_alg_unknown` is why this matters more than it sounds. It is a VERSION SKEW, so it
-     * affects every message from that counterparty, permanently — not a rare one-off.
+     * **DURABLE, and that is the half that makes this useful.** The predecessor kept notices in a
+     * `Map` on this instance and drained them on the receive path for one session. So a restart lost
+     * them, and an agent NOBODY IS ATTENDING lost them too — the connection is live, the daemon is
+     * up, and the notice only ever reaches whoever happens to call `cello_receive` on that exact
+     * session. `cello_check_notifications` now reads them as its own inbox category.
      *
      * **DEDUPLICATED PER SESSION PER REASON, and that is the design, not an optimisation.** A skewed
      * peer turns one problem into a flood: the first refusal of a kind is the signal, the ninetieth is
@@ -7586,62 +8063,141 @@ export class SessionNodeManager {
      * **NEVER carries the content.** It failed verification; surfacing it is the injection path the
      * cross-check exists to close. The operator learns that a message was refused and why — never
      * what it said.
+     */
+    /**
+     * Record an inbound refusal for the operator. First of its kind per session is the signal.
      *
-     * In memory, deliberately: a restart re-signalling a still-broken peer is correct behaviour, not
-     * duplication, and durability here would buy nothing the next refusal does not.
+     * ⚠️ **DOES NOT THROW, and that is a decision with a cost — stated so it is not mistaken for an
+     * oversight.** Every call site here has already decided to refuse and is about to return a reason
+     * to its caller; a throw would replace that clean refusal with an exception on the ingest path,
+     * changing what the SENDER observes because this daemon could not file a note. So a persistence
+     * failure is logged at ERROR under `session.refusal.persist.failed`, carrying the reason, the
+     * impact and the guidance verbatim — the forensic record survives even when the operator-facing
+     * one does not. It is not silent; it is one surface short, and the log says which notice was lost.
      */
+    noteContentRefusal(agentName, sessionId, reason, 
     /**
-     * (agentName, sessionId) → reason → the notice. `firstAt` was dropped: it was written and read by
-     * nothing, and a field nobody consumes is a claim the code does not keep.
+     * ALL THREE REQUIRED, and that is the enforcement rather than the convention.
+     *
+     * The DoD clause is "every reason calls this with an impact and a guidance", and an optional
+     * field makes that a thing a reviewer checks by reading thirteen call sites. `kind` is required
+     * for the same reason one level up: the header over a list of refusals is composed from it, and
+     * a notice that could omit it would silently inherit whichever header happened to be first.
      */
-    #contentRefusals = new Map();
-    /** Record an inbound refusal for the operator. First of its kind per session is the signal. */
-    noteContentRefusal(agentName, sessionId, reason, detail) {
-        const key = this.#k(agentName, sessionId);
-        let perSession = this.#contentRefusals.get(key);
-        if (!perSession) {
-            perSession = new Map();
-            this.#contentRefusals.set(key, perSession);
+    detail) {
+        try {
+            if (!this.#db)
+                throw new Error("database is not open");
+            const agentId = this.#requireAgentId(agentName);
+            const now = Date.now();
+            // `count` grows on conflict; impact and guidance are refreshed, because a later refusal of the
+            // same reason may know more than the first (the salt branch has four causes and names them).
+            this.#db
+                .prepare(`INSERT INTO content_refusal_notices
+             (agent_id, session_id, reason, kind, impact, guidance, count, first_at, last_at)
+           VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)
+           ON CONFLICT(agent_id, session_id, reason) DO UPDATE SET
+             count = count + 1, kind = excluded.kind, impact = excluded.impact,
+             guidance = excluded.guidance, last_at = excluded.last_at`)
+                .run(agentId, sessionId, reason, detail.kind, detail.impact, detail.guidance, now, now);
         }
-        const existing = perSession.get(reason);
-        if (existing) {
-            existing.count += 1;
-            return;
+        catch (err) {
+            this.#logger.error("session.refusal.persist.failed", {
+                agentName, sessionId, reason,
+                impact: detail.impact,
+                guidance: detail.guidance,
+                error: extractErrorMessage(err),
+                consequence: "this refusal could not be written to the notice store, so it will not survive a restart. It is held in memory for this process instead, so the operator is still told while this daemon runs. The reason, impact and guidance above are the whole notice.",
+            });
+            /**
+             * DOD-M15-NO-SILENT-REFUSAL-1 review F6 — the fallback, and why it is not the silent kind.
+             *
+             * The store this replaced was an in-memory Map, which could not fail: recording a refusal was
+             * a `set`, so the receive door always had the notice for the life of the process. Making the
+             * store durable made it, in the failure case, LESS available than before — a DB write failure
+             * left no operator-facing surface at all, only a log line.
+             *
+             * So a failed write falls back to exactly what the Map did. This is not a fallback that hides
+             * a fault: the ERROR above fires every time, naming the notice and the cause, and what is lost
+             * is only the restart property — which is the property the database was unavailable for
+             * anyway. A silent fallback is one that makes a broken system look healthy; this one is
+             * announced, and it preserves the surface rather than substituting for it.
+             */
+            const key = this.#k(agentName, sessionId);
+            let perSession = this.#refusalFallback.get(key);
+            if (!perSession) {
+                perSession = new Map();
+                this.#refusalFallback.set(key, perSession);
+            }
+            const existing = perSession.get(reason);
+            if (existing) {
+                existing.count += 1;
+                existing.kind = detail.kind;
+                existing.impact = detail.impact;
+                existing.guidance = detail.guidance;
+                return;
+            }
+            perSession.set(reason, { ...detail, count: 1, surfacedTo: new Map() });
         }
-        perSession.set(reason, {
-            reason,
-            impact: detail?.impact,
-            guidance: detail?.guidance,
-            count: 1,
-            // Per CONSUMER, not one global flag. See `takeContentRefusals`.
-            surfacedTo: new Map(),
-        });
+    }
+    /**
+     * DOD-M15-NO-SILENT-REFUSAL-1: the operator has seen these and does not want to see them again.
+     *
+     * ⚠️ **WITHOUT THIS THE NOTICES ARE PERMANENT, and that is what makes people stop reading the
+     * inbox.** "Already shown you" is tracked per WINDOW — a new MCP connection has been told nothing,
+     * so it is told everything. Someone on an older build messages you, you sort it out with them,
+     * they upgrade, and every new session you ever open still opens with that refusal.
+     *
+     * Dismissing does NOT turn anything off. If the cause fires again the notice comes back, because
+     * a fresh refusal writes a fresh row. The operator is saying "I know", not "stop telling me".
+     *
+     * Returns how many were cleared, so the caller can say so rather than claiming a silent success.
+     */
+    dismissContentRefusals(agentName, sessionId) {
+        if (!this.#db)
+            return 0;
+        let agentId;
+        try {
+            agentId = this.#requireAgentId(agentName);
+        }
+        catch {
+            return 0;
+        }
+        this.#refusalFallback.delete(this.#k(agentName, sessionId));
+        const res = this.#db
+            .prepare("DELETE FROM content_refusal_notices WHERE agent_id = ? AND session_id = ?")
+            .run(agentId, sessionId);
+        this.#db
+            .prepare("DELETE FROM content_refusal_reads WHERE agent_id = ? AND session_id = ?")
+            .run(agentId, sessionId);
+        return Number(res.changes);
     }
     /**
      * Drain the refusals a GIVEN CONSUMER has not been shown yet, and remember what it was shown.
      *
-     * ─── Why this is keyed by connection, and not by a single flag ─────────────────────────────────
+     * ─── Why this is keyed by consumer, and not by a single flag ──────────────────────────────────
      *
      * It used to set one `surfaced: boolean` on the notice. Two MCP windows attending the same agent
      * is the ordinary case, and under that flag whoever read FIRST consumed the notice — the second
      * window was told nothing, permanently. **That is the same defect `takeReceivedContent` had**, and
      * the comment above the delivery loop in `session-content-handlers.ts` spells out why it was
      * removed: *"reading is non-destructive by construction. Nothing one consumer does mutates state
-     * another consumer reads."* The whole `taken_by_sibling` apparatus exists because this was paid
-     * for once already; re-introducing it on a different surface makes it no less true.
+     * another consumer reads."*
      *
-     * ─── Why the count now has a reader ────────────────────────────────────────────────────────────
+     * ─── Why the count has a reader ───────────────────────────────────────────────────────────────
      *
-     * The old docstring claimed *"count still grows underneath, so a later reader can ask how many
-     * without being told again."* **There was no later reader.** After the first surfacing the count
-     * incremented under a flag the drain skipped unconditionally, so 3 refusals became 903 and nothing
-     * anywhere could say so — while the comment asserted the opposite.
+     * A reason RE-ANNOUNCES to a consumer when its count has grown by an order of magnitude since that
+     * consumer last saw it (1 → 10 → 100 → …), marked `repeat: true`. That keeps the first refusal the
+     * signal and the ninetieth silent, which is the dedup's point, while still making a skew that has
+     * swallowed hundreds of messages visible — at a handful of announcements per session, not one per
+     * message.
      *
-     * So a reason RE-ANNOUNCES to a consumer when its count has grown by an order of magnitude since
-     * that consumer last saw it (1 → 10 → 100 → …), marked `repeat: true`. That keeps the first
-     * refusal the signal and the ninetieth silent, which is the dedup's point, while still making a
-     * skew that has swallowed hundreds of messages visible — at a handful of announcements per
-     * session, not one per message.
+     * ─── What a restart does, deliberately ────────────────────────────────────────────────────────
+     *
+     * The notices survive; the read state is keyed by IPC connection id, which does not. So after a
+     * restart every notice is unseen again and the next reader is told. That is the correct direction:
+     * a fresh window has not been told anything, and re-announcing costs one line where staying silent
+     * costs the whole point of storing it.
      */
     takeContentRefusals(agentName, sessionId, 
     /**
@@ -7654,26 +8210,238 @@ export class SessionNodeManager {
      * forget it is.
      */
     consumerId) {
-        const perSession = this.#contentRefusals.get(this.#k(agentName, sessionId));
-        if (!perSession)
-            return [];
+        // `sessionId` is dropped from each entry: the caller passed it in and every entry carries the
+        // same one, so repeating it back would be a field that can never say anything. The agent-wide
+        // door below keeps it, because there it is the only thing that says WHICH conversation.
+        //
+        // `truncated` is dropped too, and only here: one session's notices cannot reach the cap (the
+        // reasons are a bounded set), so a flag that can never be true is a field readers learn to skip.
+        return this.#drainRefusals(agentName, consumerId, sessionId).notices.map(({ sessionId: _drop, ...rest }) => rest);
+    }
+    /**
+     * DOD-M15-NO-SILENT-REFUSAL-1: every unshown refusal for an agent, ACROSS its sessions.
+     *
+     * The inbox's door. `takeContentRefusals` answers for one session because its caller already holds
+     * one; `cello_check_notifications` holds an agent and nothing else, and the case this whole line
+     * exists for is that nobody is attending any of that agent's sessions — so a per-session read
+     * cannot reach it. Same store, same per-consumer rule, same re-announce.
+     */
+    takeAgentContentRefusals(agentName, consumerId) {
+        return this.#drainRefusals(agentName, consumerId);
+    }
+    /**
+     * The one read path behind both doors. `sessionId` narrows it; omitted, it spans the agent.
+     *
+     * A single implementation on purpose: the per-consumer rule and the order-of-magnitude rule are
+     * the two properties this unit must not lose, and two copies of them is two things to keep true.
+     */
+    #drainRefusals(agentName, consumerId, sessionId) {
         const out = [];
-        for (const notice of perSession.values()) {
-            const shownAt = notice.surfacedTo.get(consumerId);
-            const firstTime = shownAt === undefined;
-            // `shownAt` is at least 1 whenever it is set, so this cannot loop on zero.
-            if (!firstTime && notice.count < shownAt * 10)
+        let truncated = false;
+        const now = Date.now();
+        let agentId = null;
+        if (this.#db) {
+            try {
+                agentId = this.#requireAgentId(agentName);
+            }
+            catch {
+                // A name that resolves to no active agent has no notices by construction. Already logged by
+                // #requireAgentId; re-throwing would fail a read that has nothing to report.
+                agentId = null;
+            }
+        }
+        if (agentId !== null && this.#db) {
+            /**
+             * ⚠️ NEWEST FIRST, AND CAPPED — review F3, and the ordering is the load-bearing half.
+             *
+             * Read state is keyed on IPC connection id, so every new window and every restart is a
+             * consumer that has been told nothing, and the drain returns every notice ever recorded for
+             * that agent. Oldest-first and uncapped, the first thing an operator saw after a restart was a
+             * chronological archive whose top entry was the oldest refusal on record and whose newest —
+             * the one explaining the conversation that just went quiet — was at the bottom. That is a
+             * section people learn to scroll past, which is the failure this whole line exists to end.
+             *
+             * `LIMIT` is `+ 1` so the cap can be DETECTED rather than assumed; the extra row is dropped
+             * and `truncated` is reported to the caller, which says so on the list itself.
+             *
+             * ⚠️ `rowid DESC` is the TIEBREAK and it is load-bearing, not tidiness. `last_at` is
+             * `Date.now()`, so notices recorded in the same millisecond have no defined order and "newest
+             * first" was true only on average — measured by a test that recorded 30 notices in one tick
+             * and got them back in an order SQLite was free to choose. rowid is monotonic per insert, so
+             * the tiebreak is insertion order, which for a same-millisecond batch is exactly recency.
+             */
+            const rows = (sessionId === undefined
+                ? this.#db
+                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count
+                   FROM content_refusal_notices n
+                   LEFT JOIN content_refusal_reads r
+                     ON r.agent_id = n.agent_id AND r.session_id = n.session_id
+                    AND r.reason = n.reason AND r.consumer_id = ?
+                  WHERE n.agent_id = ?
+                    AND (r.seen_count IS NULL OR n.count >= r.seen_count * 10)
+                  ORDER BY n.last_at DESC, n.rowid DESC LIMIT ?`)
+                    .all(consumerId, agentId, MAX_REFUSALS_PER_READ + 1)
+                : this.#db
+                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count
+                   FROM content_refusal_notices n
+                   LEFT JOIN content_refusal_reads r
+                     ON r.agent_id = n.agent_id AND r.session_id = n.session_id
+                    AND r.reason = n.reason AND r.consumer_id = ?
+                  WHERE n.agent_id = ? AND n.session_id = ?
+                    AND (r.seen_count IS NULL OR n.count >= r.seen_count * 10)
+                  ORDER BY n.last_at DESC, n.rowid DESC LIMIT ?`)
+                    .all(consumerId, agentId, sessionId, MAX_REFUSALS_PER_READ + 1));
+            if (rows.length > MAX_REFUSALS_PER_READ) {
+                truncated = true;
+                rows.length = MAX_REFUSALS_PER_READ;
+            }
+            for (const row of rows) {
+                const firstTime = row.seen_count === null;
+                /**
+                 * ⚠️ The unseen test is IN THE QUERY (review N4), and this line is a belt, not the gate.
+                 *
+                 * Applied only here, the `LIMIT` cut the newest 25 notices and THEN discarded the ones this
+                 * consumer had already seen — so a consumer holding read rows for the newest 25 got an empty
+                 * answer forever and a genuinely unseen notice at position 26 could never be reached. The
+                 * cap has to cut UNSHOWN notices, which means the filter has to run before it.
+                 *
+                 * `seen_count` is at least 1 whenever it is set, so this cannot loop on zero.
+                 */
+                if (!firstTime && row.count < row.seen_count * 10)
+                    continue;
+                this.#db
+                    .prepare(`INSERT INTO content_refusal_reads
+               (agent_id, session_id, reason, consumer_id, seen_count, seen_at)
+             VALUES (?, ?, ?, ?, ?, ?)
+             ON CONFLICT(agent_id, session_id, reason, consumer_id) DO UPDATE SET
+               seen_count = excluded.seen_count, seen_at = excluded.seen_at`)
+                    .run(agentId, row.session_id, row.reason, consumerId, row.count, now);
+                this.#evictOldestReads(agentId, row.session_id, row.reason);
+                out.push({
+                    sessionId: row.session_id,
+                    reason: row.reason,
+                    kind: row.kind,
+                    impact: row.impact,
+                    guidance: row.guidance,
+                    count: row.count,
+                    ...(firstTime ? {} : { repeat: true }),
+                });
+            }
+        }
+        /**
+         * The unpersisted notices (review F6), under the SAME per-consumer and order-of-magnitude rules.
+         * Reading them differently would make a database failure change WHAT the operator is told rather
+         * than only how long it survives — and that difference is the thing hardest to notice.
+         *
+         * Collected separately and REVERSED before joining, not appended in place — review N2. A Map
+         * yields insertion order, which is oldest-first, so appending them straight after the DB half
+         * (which is newest-first) put the newest notices at the bottom on exactly the daemon where the
+         * fallback is the only half there is.
+         */
+        const fromFallback = [];
+        for (const [key, perSession] of this.#refusalFallback) {
+            const sid = this.#unk(key, agentName);
+            if (sid === null)
                 continue;
-            notice.surfacedTo.set(consumerId, notice.count);
-            out.push({
-                reason: notice.reason,
-                impact: notice.impact,
-                guidance: notice.guidance,
-                count: notice.count,
-                ...(firstTime ? {} : { repeat: true }),
-            });
+            if (sessionId !== undefined && sid !== sessionId)
+                continue;
+            for (const [reason, notice] of perSession) {
+                const shownAt = notice.surfacedTo.get(consumerId);
+                const firstTime = shownAt === undefined;
+                if (!firstTime && notice.count < shownAt * 10)
+                    continue;
+                notice.surfacedTo.set(consumerId, notice.count);
+                // Bounded like the table's read rows are (review N2): a consumer id is an IPC connection id,
+                // so without this a long-running daemon grows one entry per reconnect, in memory, on the
+                // very path that exists because the disk is already failing.
+                if (notice.surfacedTo.size > MAX_REFUSAL_READERS) {
+                    const oldest = notice.surfacedTo.keys().next();
+                    if (!oldest.done)
+                        notice.surfacedTo.delete(oldest.value);
+                }
+                fromFallback.push({
+                    sessionId: sid, reason, kind: notice.kind, impact: notice.impact,
+                    guidance: notice.guidance, count: notice.count,
+                    ...(firstTime ? {} : { repeat: true }),
+                });
+            }
         }
-        return out;
+        out.push(...fromFallback.reverse());
+        /**
+         * ONE cap over BOTH halves — review N2.
+         *
+         * `LIMIT` governs the table only. A persistent database fault (a full disk, which is also the
+         * likeliest cause of `transcript_write_failed`) routes EVERY refusal to the fallback, so the cap
+         * this unit added was undone for exactly the daemon already in trouble.
+         *
+         * The truncation keeps the DB half preferentially, and that is the right bias: those rows are
+         * the ones that survive a restart, and they are already ordered newest-first.
+         */
+        if (out.length > MAX_REFUSALS_PER_READ) {
+            truncated = true;
+            out.length = MAX_REFUSALS_PER_READ;
+        }
+        return { notices: out, truncated };
+    }
+    #evictOldestReads(agentId, sessionId, reason) {
+        if (!this.#db)
+            return;
+        this.#db
+            .prepare(`DELETE FROM content_refusal_reads
+          WHERE agent_id = ? AND session_id = ? AND reason = ? AND consumer_id NOT IN (
+            SELECT consumer_id FROM content_refusal_reads
+             WHERE agent_id = ? AND session_id = ? AND reason = ?
+             ORDER BY seen_at DESC LIMIT ${MAX_REFUSAL_READERS}
+          )`)
+            .run(agentId, sessionId, reason, agentId, sessionId, reason);
+    }
+    /**
+     * DOD-M15-NO-SILENT-REFUSAL-1 — the per-session byte cap, from the operator's chair.
+     *
+     * This is the harshest refusal on the inbound path and the one that reads least like a fault:
+     * once the cap is crossed, EVERY later message from that sender on that session is refused, for
+     * the life of the session. The counterparty is told nothing either, so from both chairs the other
+     * person simply stopped replying.
+     *
+     * One method rather than two copies because the cap is checked twice — once before the screening
+     * await and once after, against freshly-read totals — and a notice that differs between the two
+     * would describe a different refusal depending on timing.
+     */
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1 — **THE BYTE CAP RETAINS NOTHING, and that is a ruling, not an
+     * oversight.**
+     *
+     * Retention is universal everywhere else in this method. Here it is not, because retaining would
+     * defeat the very bound it enforces: a session already over its storage budget cannot be given
+     * more storage as a reward for exceeding it, and `#getReceivedBytesTotal` counts quarantined bytes
+     * precisely so that budget is honest.
+     *
+     * Andre, 2026-09-03: *"The message limit is the message limit, already handled by the cap. If
+     * you're unknown and you have 25 MB and you just tried to send me one gig, well that's it."*
+     *
+     * The ABUSE is still evidenced — this notice records the reason, the cap and the tier, and every
+     * message the session did retain is still there. What is not kept is the oversized payload.
+     */
+    #noteSizeCapRefusal(agentName, sessionId, cap, tier) {
+        /**
+         * ⚠️ **IN MEGABYTES, WITH THE BYTES BESIDE THEM.** "26214400 bytes" is not a number anyone reads
+         * as 25 MB, and the operator being told a conversation just ended deserves to understand the
+         * limit that ended it at a glance. The raw figure stays because it is the exact bound.
+         */
+        const mb = Math.round((cap / 1_048_576) * 10) / 10;
+        /**
+         * The access level as a QUOTED LOWERCASE LABEL, never a bare word.
+         *
+         * `their tier is UNKNOWN` reads as "we could not determine their tier" — the opposite of what it
+         * says. UNKNOWN is the NAME of the level a sender has before the operator adds them as a
+         * contact. Quoting it and lowercasing it makes it a label rather than a failure.
+         */
+        const level = (Object.entries(TIER).find(([, v]) => v === tier)?.[0] ?? String(tier)).toLowerCase();
+        this.noteContentRefusal(agentName, sessionId, "session_size_limit_exceeded", {
+            kind: REFUSAL_KINDS.REFUSED,
+            impact: `This conversation has hit its size limit for this sender: ${mb} MB (${cap} bytes), which is the limit at their access level ("${level}"). The message was not delivered, and neither will anything else they send in this conversation. They were not told — from their side it sent normally.`,
+            guidance: `The limit is per conversation and does not reset, so waiting will not clear it. Start a NEW conversation with them to keep talking. If you trust them, raising their access level with cello_contact_set_tier gives them a larger limit next time — it does not revive this one. Tell them what happened: they have no way to know.`,
+        });
     }
     #markContentUnverifiable(agentName, sessionId, why) {
         const key = this.#k(agentName, sessionId);
@@ -7681,6 +8449,116 @@ export class SessionNodeManager {
             return;
         this.#contentDesynced.set(key, why);
     }
+    /**
+     * 024-ORPHANTRIAGE — the three signals, read from evidence this side owns.
+     *
+     * ⚠️ **THE SEQUENCE NUMBER ON THE FRAME IS NOT ONE OF THEM.** "Was there an ongoing conversation
+     * up to this point" is tempting to answer from the position the sender wrote, and that answer is
+     * worthless: the sender picks the number, so anyone wanting the reach-out branch writes a large
+     * one. It is answered from OUR transcript rows instead — a partial local record of that
+     * conversation is something an attacker cannot put there from the wire.
+     *
+     * ⚠️ **"KNOWN" IS A TIER, NOT A ROW — review F1/F2, and reading it as a row inverted the unit.**
+     * `contacts` rows are written from the WIRE with no operator action: `inbound-sessions.ts` calls
+     * `addContact(..., "signal_presentation")` at `TIER.UNKNOWN` for any inbound offer inside the
+     * acceptance bound, because the trust-signal foreign key needs a row to point at. And BLOCKING a
+     * contact is an UPDATE to `TIER.BLOCKED`, so the row survives that too. A `SELECT … WHERE pubkey`
+     * therefore answers "yes, known" for a stranger who merely dialled, AND for a key the operator
+     * deliberately blocked — handing both the reach-out branch, which is the exact population this
+     * unit exists to refuse. `DOD-TIER-4` had already settled this and retired `isContact` for it:
+     * *"An UNKNOWN-tier contact (a mere row) is NOT known."* The tier is read from the row already
+     * being fetched, so the case-insensitivity below survives (`getTier` compares case-sensitively).
+     *
+     * ⚠️ **HEX CASE IS NOT A DIFFERENCE IN IDENTITY.** This unit originally worked around that with its
+     * own `lower(pubkey)` lookup, because `contacts.pubkey` was stored verbatim from the IPC parameter
+     * and an exact match would report a contact the operator can SEE in `cello_contacts` as an unknown
+     * stranger. The workaround is gone: `contact-pubkey-case.ts` now normalizes every contacts
+     * accessor and folds the rows already on disk, so there is one spelling and one rule.
+     */
+    #orphanEvidence(agentName, sessionId, verifiedSignerUnmatched) {
+        const signerPubkeyHex = verifiedSignerUnmatched === undefined
+            ? null
+            : Buffer.from(verifiedSignerUnmatched).toString("hex");
+        /**
+         * ⚠️ `"not_checked"` IS NOT A COSMETIC THIRD STATE — review F6.
+         *
+         * These two were `false` on every path that did not look, and the log event then reported them
+         * as readings. An investigator filtering `session.content.orphaned` days later would read
+         * `ongoingConversation: false` and conclude there was no local trace, when nothing had been
+         * asked. Clause 1 says the branch RECORDS these; a default wearing the shape of a measurement
+         * is not a record, and it is the cheapest possible way to mislead the one person who comes
+         * looking.
+         */
+        const notChecked = {
+            signerPubkeyHex, knownContact: "not_checked", contactMoniker: null, ongoingConversation: "not_checked",
+        };
+        // With no verifiable signature the other two signals mean nothing — a claimed key is a string
+        // anyone can type — so they are not looked up at all rather than looked up and ignored.
+        if (signerPubkeyHex === null)
+            return notChecked;
+        try {
+            /**
+             * ⚠️ NO `!this.#db` SHORT-CIRCUIT — review F7, and it was the silent half of this guard.
+             *
+             * The catch below logs ERROR for exactly this outcome; a bare `if (!this.#db) return` did not,
+             * and the state is reachable while the operator still gets a notice — `noteContentRefusal`
+             * keeps its own in-memory fallback when the write fails, so a daemon with an unusable store
+             * still surfaces a refusal saying "that key is not in your address book" about a key that may
+             * well be in it, with nothing anywhere recording that the address book was never opened.
+             * Throwing into the catch is also what this file's other contact reads do (`getTier`,
+             * `addContact`), and for the same reason: a read that decides how to treat a sender must not
+             * degrade to "unclassified" in silence.
+             */
+            if (!this.#db)
+                throw new Error("database is not open");
+            const agentId = this.#requireAgentId(agentName);
+            const contact = this.#db
+                .prepare("SELECT moniker, tier FROM contacts WHERE agent_id = ? AND pubkey = ?")
+                .get(agentId, normalizeContactPubkey(signerPubkeyHex));
+            /**
+             * ⚠️ **QUARANTINED ROWS ARE NOT A LOCAL TRACE, AND WITHOUT THIS CLAUSE THE PROBE WRITES ITS
+             * OWN EVIDENCE.** Found where `023-REFUSEDEVIDENCE` met `024-ORPHANTRIAGE`.
+             *
+             * This signal answers *"does this machine hold any part of a conversation under the id the
+             * message names?"*, and a `true` is one of the two conditions that flips the triage from
+             * REPORT-ONLY to offering the operator a reach-out. Since 023, a refused message is RETAINED
+             * as a transcript row — so an unfiltered `SELECT 1 FROM transcript` sees the row this very
+             * refusal just wrote.
+             *
+             * From the operator's chair, unfiltered: a stranger with a vouched key probes an id nobody
+             * opened; the first probe is refused and retained; the second probe finds the first one's row,
+             * reads as an ongoing conversation, and the operator is invited to reach out. **The attacker
+             * manufactures the signal by sending twice** — which is precisely the outcome 024 exists to
+             * prevent, reintroduced by the unit that made evidence durable.
+             *
+             * `direction != 'quarantined'` is the same exclusion every delivery reader uses, and it is the
+             * right one: what is asked here is whether anything was ever DELIVERED under this id.
+             */
+            const trace = this.#db
+                .prepare("SELECT 1 AS present FROM transcript WHERE agent_id = ? AND session_id = ? AND direction != 'quarantined' LIMIT 1")
+                .get(agentId, sessionId);
+            return {
+                signerPubkeyHex,
+                knownContact: contact !== undefined && normalizeTier(contact.tier) >= TIER.KNOWN,
+                contactMoniker: contact?.moniker ?? null,
+                ongoingConversation: trace !== undefined,
+            };
+        }
+        catch (err) {
+            /**
+             * NOT A SILENT FALLBACK. Both signals come back `"not_checked"`, which the triage treats
+             * exactly as it treats a stranger — REPORT, the action that is safe when nothing is known — and
+             * which the log distinguishes from a measured `false`. A read failure here must never invent
+             * the reach-out branch, and it must never be invisible.
+             */
+            this.#logger.error("session.content.orphaned.evidence.failed", {
+                agentName, sessionId,
+                error: extractErrorMessage(err),
+                impact: "the address book and transcript could not be read, so a message whose signature DID verify is being reported to the operator as coming from a key nothing is known about. The advice is the safe one; it may be more cautious than the evidence warrants.",
+            });
+            return notChecked;
+        }
+    }
     async ingestReceivedContent(agentName, sessionId, content, contentHash, correlationId, 
     /**
      * DOD-FRONTIER-STRAND-1 AC1: the relay-assigned canonical position for THIS message, taken from
@@ -7708,7 +8586,19 @@ export class SessionNodeManager {
      * Optional, because the soft decode-failure path ingests without it. The row records which it
      * was, so absence is never silent.
      */
-    verifiedAuthorship) {
+    verifiedAuthorship, 
+    /**
+     * 024-ORPHANTRIAGE — the key whose signature VERIFIED on a frame we could not tie to a session.
+     *
+     * Read by the orphan branch below and NOWHERE ELSE. It exists because the daemon establishes,
+     * cryptographically, that the sender holds a private key — and then discarded that the instant
+     * the session lookup came back empty, leaving the operator advised to go and make contact with
+     * whoever sent a message for a conversation that does not exist.
+     *
+     * Absent on the park-recovery caller, which cannot reach the orphan branch at all:
+     * `authenticateParkedEntry` refuses `counterparty_unknown` from the same missing record first.
+     */
+    verifiedSignerUnmatched) {
         // The transcript is frozen ONLY once it is COMMITTED + signed — 'sealed' or
         // 'seal_interrupted_pending' (the bilateral seal commitment) — because a later FROST
         // notarization attests that exact root; a late leaf would diverge from it.
@@ -7727,8 +8617,67 @@ export class SessionNodeManager {
         // papered that in with senderPubkey="unknown". Refuse loudly instead; the content stays
         // un-acked, so a live sender redelivers once the session actually exists. After D3
         // (DOD-INBOUND-GUARD-1) this path is unreachable from the wire — a fail-loud assertion.
+        /**
+         * DOD-M15-REFUSEDEVIDENCE-1 — HOISTED from below the hash cross-check, so that every refusal
+         * above that point can retain the bytes under it. Same expression, earlier.
+         *
+         * It is the SENDER'S CLAIM at this point — nothing has checked it yet, and on a
+         * `content_hash_mismatch` it provably does not describe these bytes. The quarantine read
+         * recomputes its own hash over what was retained rather than reprinting this one.
+         */
+        const contentHashHex = Buffer.from(contentHash).toString("hex");
         if (!record) {
-            this.#logger.warn("session.content.orphaned", { agentName, sessionId, correlationId });
+            /**
+             * RETAINED FIRST, because the triage below now tells the operator whether there is an artifact
+             * to report — and that claim has to be made after the write, never before it (023 review F3).
+             *
+             * This is the case retention matters most for. A message for a session this daemon has no
+             * record of is the least explicable thing that can arrive, so it is the thing an operator has
+             * the least other way to show anyone. There is no `sessions` row and no counterparty, so no
+             * tier — `#quarantineRefusedContent` bounds it at UNKNOWN and files it at a negative position,
+             * outside the chain it never joined.
+             */
+            const keptOrphan = this.#quarantineRefusedContent(agentName, sessionId, "session_orphaned", content, contentHashHex, { correlationId });
+            /**
+             * 024-ORPHANTRIAGE — TWO ACTIONS EXIST AND THE EVIDENCE DECIDES WHICH.
+             *
+             * The advice here used to be *"ask the counterparty to start a NEW session."* When the message
+             * is a stranger probing a peer id, obeying that advice is the probe succeeding: it confirms
+             * somebody is home and that this agent answers, from a message that was refused.
+             *
+             * All three signals are read from things the sender does not control — their signature is
+             * checked against the key inside their own signed bytes, "known" comes from OUR address book,
+             * and "ongoing" comes from OUR transcript rows rather than the sequence number they chose.
+             */
+            const evidence = this.#orphanEvidence(agentName, sessionId, verifiedSignerUnmatched);
+            const triage = triageOrphanedContent(evidence, retentionSentence(sessionId, keptOrphan));
+            /**
+             * BOTH SURFACES, per Invariant 2. The log is the durable forensic record and carries the
+             * signals structurally — this is where an investigation days later reads what was known and
+             * when. The notice below is the control: it is what the agent actually reads and acts on.
+             */
+            this.#logger.warn("session.content.orphaned", {
+                agentName, sessionId, correlationId,
+                signerPubkey: evidence.signerPubkeyHex ?? "(no verifiable signature)",
+                signatureVerified: evidence.signerPubkeyHex !== null,
+                // Review F6: `"not_checked"` where nothing was measured, never a `false` that reads as a
+                // reading. An investigator filtering this event is the only person who will ever ask.
+                knownContact: evidence.knownContact,
+                ongoingConversation: evidence.ongoingConversation,
+                action: triage.action,
+                // 023: whether the evidence the triage points at actually exists.
+                retained: keptOrphan !== null,
+                impact: triage.impact,
+            });
+            // DOD-M15-NO-SILENT-REFUSAL-1. The notice is written even though there is no session row —
+            // the store is keyed (agent_id, session_id) and holds no foreign key to `sessions` precisely
+            // so this case can be recorded. A refusal for a session that does not exist here is the one
+            // the operator has the least other way to learn about.
+            this.noteContentRefusal(agentName, sessionId, "session_orphaned", {
+                kind: REFUSAL_KINDS.REFUSED,
+                impact: triage.impact,
+                guidance: triage.guidance,
+            });
             return { ok: false, reason: "session_orphaned" };
         }
         // DOD-TERMINAL-WAKE-1 (review F1): `abandoned` belongs here too. It is terminal and, unlike
@@ -7750,6 +8699,21 @@ export class SessionNodeManager {
                 currentStatus: record.status,
                 correlationId,
             });
+            // DOD-M15-REFUSEDEVIDENCE-1 — RETAINED. A post-seal straggler on the DIRECT path kept nothing
+            // before this: `sealed_session_annex` covers the park-drain and held-drift routes, not this
+            // exit. Something arriving into a signed, closed conversation is exactly the kind of thing an
+            // operator later wants to produce.
+            this.#quarantineRefusedContent(agentName, sessionId, "session_committed", content, contentHashHex, {
+                senderPubkeyHex: record.counterparty_pubkey ?? null, correlationId,
+            });
+            // DOD-M15-NO-SILENT-REFUSAL-1. `currentStatus` on the log line carries the REAL status —
+            // sealed, seal_interrupted_pending or abandoned — and the notice must not flatten those into
+            // one claim, so it names the record as frozen rather than asserting which way it ended.
+            this.noteContentRefusal(agentName, sessionId, "session_committed", {
+                kind: REFUSAL_KINDS.REFUSED,
+                impact: `This conversation is closed (it ended as "${record.status}"), so the message could not be delivered and neither can anything else they send to it. A closed conversation is signed and cannot be added to — that is what closing it means. Nothing is wrong on your side.`,
+                guidance: "There is nothing to repair here. If they still have something to say, ask them to start a NEW conversation — a closed one cannot be reopened, and it is worth telling them, because they may not realise it ended. Read what was said before it closed with cello_transcript.",
+            });
             return { ok: false, reason: "session_committed" };
         }
         /**
@@ -7791,10 +8755,17 @@ export class SessionNodeManager {
                 impact: "this message could not be verified, so it was NOT ingested and NOT shown. The algorithm name is a claim by the sender and is not covered by any signature, so it does not establish what they actually did. This session will not auto-co-sign at close.",
                 guidance: "Almost always their CELLO build is newer than this one: ask which version they are running, and upgrade. If they are on the SAME version as you, that explanation does not hold and the frame was malformed or crafted — do not close the session by auto-acknowledgement.",
             });
+            // DOD-M15-REFUSEDEVIDENCE-1 — RETAINED. The algorithm name is an unsigned claim by whoever
+            // sent the frame, so this branch is reachable by crafting as well as by version skew, and the
+            // crafted case is one to be able to show someone.
+            this.#quarantineRefusedContent(agentName, sessionId, "content_hash_alg_unknown", content, contentHashHex, {
+                senderPubkeyHex: record.counterparty_pubkey ?? null, correlationId,
+            });
             // DOD-M15-REFUSED-INBOUND-SILENT-1: the SAME strings the log just carried, to the operator.
             // This reason is a version skew, so it affects every message from that counterparty — without
             // this the conversation goes permanently quiet and they conclude the peer stopped replying.
             this.noteContentRefusal(agentName, sessionId, "content_hash_alg_unknown", {
+                kind: REFUSAL_KINDS.REFUSED,
                 impact: "this message could not be verified, so it was NOT ingested and NOT shown. The algorithm name is a claim by the sender and is not covered by any signature, so it does not establish what they actually did. This session will not auto-co-sign at close.",
                 guidance: "Almost always their CELLO build is newer than this one: ask which version they are running, and upgrade. If they are on the SAME version as you, that explanation does not hold and the frame was malformed or crafted — do not close the session by auto-acknowledgement.",
             });
@@ -7837,6 +8808,12 @@ export class SessionNodeManager {
                 // purpose.
                 guidance: "Look for session.salt.discarded first: if it is there, this side dropped its salt because the counterparty said it could never hold one, the agreement did complete and was deliberately undone, and a new session is the repair. Otherwise look for session.salt.adoption.refused: if it is there, this side declined the salt because the session had already hashed messages, that is permanent for this session, and reconnecting will NOT fix it — close the session and start a new one. Otherwise look for session.salt.read.failed or session.salt.persist.failed. If either is present the agreement re-runs on the next reconnect and this repairs itself — wait for that before doing anything. If none of the four is present, the agreement never completed with this counterparty: close the session and start a new one. In every case the transcript up to here is intact.",
             });
+            // DOD-M15-REFUSEDEVIDENCE-1 — RETAINED. We could not check it, which is precisely why the
+            // bytes have to survive: the question of what they actually were stays open, and a hash we
+            // could not verify answers none of it.
+            this.#quarantineRefusedContent(agentName, sessionId, "content_hash_salt_unavailable", content, contentHashHex, {
+                senderPubkeyHex: record.counterparty_pubkey ?? null, correlationId,
+            });
             // DOD-M15-REFUSED-INBOUND-SILENT-1 — and this branch needed it MORE than the two that had it.
             //
             // It was refused, logged with a full impact and guidance, not ingested, not shown — and the
@@ -7852,12 +8829,12 @@ export class SessionNodeManager {
             // The guidance is passed by reference to the log's own text rather than duplicated: a second
             // copy is a second thing to keep true, and the log's version is the one that gets maintained.
             this.noteContentRefusal(agentName, sessionId, "content_hash_salt_unavailable", {
+                kind: REFUSAL_KINDS.REFUSED,
                 impact: "this message could not be verified — the sender says it is salted and this side holds no salt for the session — so it was NOT ingested and NOT shown. This session will not auto-co-sign at close.",
                 guidance: "If session.salt.discarded is present, this side dropped its salt on purpose because the counterparty said it could never hold one — a new session is the repair. If this side refused the salt because the session had already hashed messages, that is PERMANENT for this session and reconnecting will not fix it — close the session and start a new one. Otherwise the salt agreement re-runs on the next reconnect and this repairs itself. Check session.salt.discarded and session.salt.adoption.refused in the log to tell which. The transcript up to here is intact either way.",
             });
             return { ok: false, reason: "content_hash_salt_unavailable" };
         }
-        const contentHashHex = Buffer.from(contentHash).toString("hex");
         if (Buffer.from(computed).toString("hex") !== contentHashHex) {
             this.#logger.warn("session.content.cross_check.failed", {
                 sessionId,
@@ -7871,9 +8848,26 @@ export class SessionNodeManager {
             // auto-acknowledge gate must never auto-co-sign it. The session stays alive (DOD-MSG-7),
             // but the responder seal now requires the agent's explicit decision, not an auto-ack.
             this.#markContentUnverifiable(agentName, sessionId, "tampered");
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — RETAINED, and this is the highest-value row in the table.
+             *
+             * A tampered frame is the one case where the message and the sender's commitment PROVABLY
+             * disagree, and the proof only exists while both halves do. Before this, the bytes went on the
+             * floor and all that survived was a hash of something nobody still had.
+             *
+             * `verifiedAuthorship` is stored when the caller verified a signature over the sender's own
+             * bytes. That is what makes the row evidence rather than a note: the signature is checked
+             * against the key inside the sender's signed bytes, not against anything this side chose.
+             */
+            this.#quarantineRefusedContent(agentName, sessionId, "content_hash_mismatch", content, contentHashHex, {
+                senderPubkeyHex: this.#activeNodes.get(this.#k(agentName, sessionId))?.counterpartyPubkey ?? record.counterparty_pubkey ?? null,
+                ...(verifiedAuthorship ? { authorship: verifiedAuthorship } : {}),
+                correlationId,
+            });
             // DOD-M15-REFUSED-INBOUND-SILENT-1. Deliberately does NOT include the content or the hashes:
             // it failed verification, and showing it is the injection path this cross-check closes.
             this.noteContentRefusal(agentName, sessionId, "content_hash_mismatch", {
+                kind: REFUSAL_KINDS.REFUSED,
                 impact: "a message arrived whose bytes do not match the hash the sender committed to, so it was NOT ingested and NOT shown. This session will not auto-co-sign at close.",
                 guidance: "Either the message was altered in transit or the sender's record is wrong. Ask the counterparty to resend. Do not close this session by auto-acknowledgement — seal it only by an explicit decision.",
             });
@@ -7886,6 +8880,49 @@ export class SessionNodeManager {
             // counterparty_pubkey NOT NULL, so this is unreachable unless a row was hand-crafted empty.
             // Either way, "unknown" is never written to a transcript row — refuse instead.
             this.#logger.warn("session.content.sender_unresolved", { sessionId, agentName, correlationId });
+            // DOD-M15-REFUSEDEVIDENCE-1 — RETAINED, with NO sender key, because there is none and that
+            // absence is the evidence. The guidance below says to report this; this is the artifact there
+            // is to report. Bounded at the UNKNOWN tier — there is no contact to look a tier up on, which
+            // is the same fact that made it unattributable.
+            const keptUnresolved = this.#quarantineRefusedContent(agentName, sessionId, "sender_unresolved", content, contentHashHex, { correlationId });
+            this.noteContentRefusal(agentName, sessionId, "sender_unresolved", {
+                kind: REFUSAL_KINDS.REFUSED,
+                impact: "A message arrived that this daemon could not attribute to anyone, so it was not delivered. This conversation's record does not say who the other party is, which a conversation opened normally always does. TREAT THIS AS HOSTILE: a message that cannot be tied to a sender is far more likely to be a probe or an attack than a fault.",
+                /**
+                 * ⚠️ NO "WHEN IN DOUBT" HERE — Andre, 2026-09-03: *"This message has no sender, the chances
+                 * that it is hostile are very high. When in doubt? No. Just report it."*
+                 *
+                 * That hedge belongs on the ambiguous branch in `024-ORPHANTRIAGE`, where a verified
+                 * signature from a known contact leaves a real judgement to make. There is no judgement
+                 * here. Softening it would teach the operator to weigh a case that does not need weighing.
+                 *
+                 * ⚠️ IT NAMES NO REPORTING DESTINATION, and that is still true — but HALF of the reason has
+                 * gone, so the sentence is rewritten rather than left to read as though nothing changed.
+                 *
+                 * It used to rest on two facts: `CELLO_Reporting` does not exist (`DOD-M15-ORPHANTRIAGE-1`,
+                 * still open) and **the message itself is not retained**. The second is no longer true —
+                 * `DOD-M15-REFUSEDEVIDENCE-1` retains it, and the guidance below now says so and names where
+                 * it is. Telling an operator to report something while keeping nothing to report was the
+                 * gap; naming a destination nobody can reach would be Invariant 4's failure. So: the
+                 * artifact is named now, the destination when 024 lands.
+                 *
+                 * ⚠️ THE ROTATION ADVICE IS MEASURED, NOT ASSUMED. `#startReceiverNode` mints the standing
+                 * receiver's transport key with `randomBytes(32)` and never persists it, so a logout/login
+                 * genuinely yields a NEW peer id and fresh directory connections. **And the bound is stated
+                 * in the same breath:** session nodes DO persist their seed (`DOD-M12B-SESSION-SEED-1`, so a
+                 * revived conversation keeps its address), so this rotates the front door and not the doors
+                 * already open. Telling an operator to rotate without that bound would have them believe
+                 * they had closed something they had not.
+                 */
+                guidance: 
+                // "That is the artifact to show someone" is NOT appended: it would be false on the branch
+                // where nothing was retained, which is the branch this sentence exists to be honest about.
+                "Report this. " + retentionSentence(sessionId, keptUnresolved) +
+                    "Do not try to reply — there is no one to reply to, and answering an unattributable message is what a probe is looking for. " +
+                    "Then rotate your address: run cello logout followed by cello login. Your standing receiver's network identity is generated fresh each time it starts and is never stored, so this gives you a new one and rebuilds your connections to the directory — anyone holding the old address is left talking to something that no longer answers. " +
+                    "It does NOT change the addresses of conversations you already have open: those identities are kept on purpose so an interrupted conversation can resume. " +
+                    "This conversation cannot be repaired: close it with cello_close_session, and open a new one yourself if you were expecting someone. See session.content.sender_unresolved in the daemon log.",
+            });
             return { ok: false, reason: "sender_unresolved" };
         }
         // DOD-MSG-5: a content_hash satisfies AT MOST ONE Merkle leaf, exactly once. If this hash is
@@ -8019,6 +9056,7 @@ export class SessionNodeManager {
                     tier: senderTier,
                     correlationId,
                 });
+                this.#noteSizeCapRefusal(agentName, sessionId, cap, senderTier);
                 return { ok: false, reason: "session_size_limit_exceeded" };
             }
         }
@@ -8100,8 +9138,29 @@ export class SessionNodeManager {
                     correlationId,
                 });
             }
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — **A TRANSIENT BLOCK RETAINS NOTHING, and nothing is lost by
+             * that.** Nothing was recorded and, decisively, nothing was ACKNOWLEDGED: the message is still
+             * with the sender, whose daemon redelivers it. When the gateway recovers the same bytes are
+             * screened, and if they are blocked they are retained then, under the detector's own reason.
+             *
+             * Retaining here would file a copy of a message that is coming back — a duplicate, not
+             * evidence — and it would do so for content nothing has yet judged, once per redelivery
+             * attempt, for as long as the gateway stays down.
+             */
+            // DOD-M15-NO-SILENT-REFUSAL-1 — a TRANSIENT block, and saying which it is, is the whole
+            // value of the notice. Nothing was recorded and nothing was acked, so the sender's daemon
+            // redelivers on its own. An operator who reads the silence as delivery, or who asks the
+            // counterparty to resend, is acting on the opposite of what happened.
+            this.noteContentRefusal(agentName, sessionId, inboundVerdict.reason ?? "inbound_screen_blocked", {
+                kind: REFUSAL_KINDS.DEFERRED,
+                impact: "the screener could not reach a verdict on an inbound message, so it was NOT ingested and NOT shown. Nothing was recorded and nothing was acknowledged — the message is still with the sender and their daemon will redeliver it once screening works again. Do not read this silence as delivery.",
+                guidance: "TRANSIENT — do not ask the counterparty to resend, and do not close the session. Get the local screening gateway healthy and the backlog comes through on its own: look for security.gateway.timeout, security.gateway.unavailable and security.gateway.inbound.blocked in the daemon log — the third is what an internal screen_error logs, and naming only the first two sends you looking for lines that will not be there. While it stays down, every message from every counterparty takes this path.",
+            });
             return { ok: false, reason: inboundVerdict.reason ?? "inbound_screen_blocked" };
         }
+        // Assigned only on the terminal-block branch and invoked beside each retention attempt below.
+        let noteTerminalBlock;
         if (terminalBlock) {
             this.#logger.warn("security.gateway.inbound.terminal_block", {
                 sessionId,
@@ -8109,6 +9168,78 @@ export class SessionNodeManager {
                 reason: inboundVerdict.reason,
                 correlationId,
             });
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — retention for a terminal block happens where its LEAF happens,
+             * not here. Two sites below (the hold branch and the in-order append), each writing the
+             * quarantine row at the same index as the leaf it accompanies.
+             *
+             * Not here, deliberately: this point is upstream of the post-screen dedup re-check and the
+             * size-cap re-check, either of which can still refuse. Retaining above them would file
+             * evidence for a message this call then reports as capped — and the cap path is the one that
+             * is ruled NOT to retain.
+             */
+            /**
+             * DOD-M15-NO-SILENT-REFUSAL-1 — **the moment the product catches the attack it exists to
+             * catch, and until now the operator was told nothing about it.**
+             *
+             * This path is not an error path, which is exactly why it had no notice: the block leafs the
+             * original content hash at its canonical position and acknowledges the sender, so nothing
+             * fails and nothing loops. The message is simply never handed to the agent. From the
+             * operator's chair a message they were expecting never arrives and the record shows a leaf
+             * with nothing in it.
+             *
+             * The notice NEVER carries the blocked content — a screener that can be talked into surfacing
+             * what it blocked is not a screener.
+             *
+             * ⚠️ **THE GUIDANCE USED TO SAY "DO NOT ASK FOR THE ORIGINAL TEXT", AND THAT IS NOW WRONG.**
+             * Rewritten rather than deleted, per the claim-comment rule, because the reasoning is what
+             * changed and not just the sentence. It rested on the content being unavailable; under
+             * `DOD-M15-REFUSEDEVIDENCE-1` it is retained and there is a route that returns it FRAMED. And
+             * the friction was never protection: Andre, 2026-09-03 — *"eventually the LLM is going to go
+             * searching for it, because human beings are going to direct their LLMs to find it, and it's
+             * going to come back and say 'Hey, I found it here, the message says…' — which is far
+             * worse."* Withholding the route removes the WARNING from the read, not the read.
+             *
+             * What survives unchanged: do not turn screening off. That is still the one action that makes
+             * things worse, and it is the one the guidance still refuses.
+             */
+            /**
+             * ⚠️ THE DETECTOR'S OWN REASON SURVIVES — `inbound_screen_blocked` is only the fallback.
+             *
+             * Invariant 3: a downstream handler must not replace an upstream descriptive error with a
+             * generic one. The verdict already says WHICH detector fired — `inbound_language_blocked` and
+             * an injection block are different problems with different remedies, and one of them has an
+             * operator command that fixes it. Flattening both to `inbound_screen_blocked` would also
+             * deduplicate them together, so the second kind would be silent for the life of the session.
+             *
+             * The gateway's own `guidance` is appended when it has one, for the same reason: it is the
+             * half that names the actual command.
+             */
+            // `?? "inbound_screen_blocked"` is a floor, not a live branch: every verdict producer in the
+            // tree sets `reason`, so today it never fires. It stays because `reason` is optional on the
+            // type, and a notice keyed on `undefined` would collapse every future detector into one row.
+            /**
+             * ⚠️ **DEFERRED UNTIL THE RETENTION HAS ACTUALLY RUN — review F3.** The notice used to be
+             * written here, above both append sites, and claimed the message was kept before anything had
+             * tried to keep it. It is now a closure invoked beside each `#quarantineRefusedContent` call,
+             * carrying that call's own answer.
+             *
+             * Two paths between here and there deliberately write NO notice now, and both are the better
+             * answer: a post-screen dedup means this exact message was already noticed the first time, and
+             * a size-cap refusal writes `#noteSizeCapRefusal` instead — which is what actually happened,
+             * where before the operator got both stories at once.
+             */
+            noteTerminalBlock = (stored) => {
+                this.noteContentRefusal(agentName, sessionId, inboundVerdict.reason ?? "inbound_screen_blocked", {
+                    kind: REFUSAL_KINDS.BLOCKED,
+                    impact: "the screener blocked an inbound message: its content matched a detector this agent runs on everything that arrives. It was NOT shown to the agent. It IS recorded in the hash chain at its position and the sender was acknowledged, so they will not resend it and they were not told it was blocked.",
+                    guidance: "This is the protection doing its job, and nothing is required of you. If you were expecting something from this counterparty around now, tell them it was blocked and ask them to say it differently. " +
+                        retentionSentence(sessionId, stored) +
+                        (stored === null ? "" : "There is no reason to read it unless you need to show someone, or judge whether this was an attack. ") +
+                        "Do NOT turn screening off to read it: that is the one action here that makes things worse. security.gateway.inbound.terminal_block in the daemon log names which detector fired." +
+                        (inboundVerdict.guidance !== undefined ? ` The detector says: ${inboundVerdict.guidance}` : ""),
+                });
+            };
         }
         // M9-IN-001: a `redact` verdict (inbound sanitization) DELIVERS the sanitized text to the agent,
         // while the Merkle leaf still binds the ORIGINAL content hash below — the transcript records what
@@ -8178,6 +9309,7 @@ export class SessionNodeManager {
                     correlationId,
                     recheck: true,
                 });
+                this.#noteSizeCapRefusal(agentName, sessionId, cap, senderTier);
                 return { ok: false, reason: "session_size_limit_exceeded" };
             }
         }
@@ -8217,6 +9349,18 @@ export class SessionNodeManager {
             // DOD-M12B-STRAND-1: and to disk, before we answer. The in-memory Map is the working copy;
             // this row is the one that survives the teardown that used to destroy it.
             this.#persistHeldContent(agentName, sessionId, canonicalSeq, deliverContent, content, contentHashHex, terminalBlock === true, correlationId);
+            // DOD-M15-REFUSEDEVIDENCE-1 (site 1 of 2 for a terminal block): a block held behind an
+            // ordering gap. `#releaseHeld` appends its leaf later WITHOUT re-entering this method, so
+            // retaining at release is not available — it is retained here, at the position the leaf will
+            // take. `held_content` is not a substitute: that row is deleted the moment the gap fills.
+            if (terminalBlock) {
+                const keptHeld = this.#quarantineRefusedContent(agentName, sessionId, inboundVerdict.reason ?? "inbound_screen_blocked", content, contentHashHex, {
+                    senderPubkeyHex: senderPubkey, canonicalSeq,
+                    ...(verifiedAuthorship ? { authorship: verifiedAuthorship } : {}),
+                    correlationId,
+                });
+                noteTerminalBlock?.(keptHeld);
+            }
             this.#logger.info("session.content.held", {
                 sessionId,
                 canonicalSeq,
@@ -8249,6 +9393,50 @@ export class SessionNodeManager {
         const leafIndex = terminalBlock
             ? this.appendSessionLeaf(agentName, sessionId, "msg", contentHashHex, correlationId).leafIndex
             : this.#appendVerifiedContent(agentName, sessionId, deliverContent, contentHashHex, senderPubkey, correlationId, content, verifiedAuthorship).leafIndex;
+        /**
+         * DOD-M15-REFUSEDEVIDENCE-1 (site 2 of 2) — **the moment the product catches the attack it
+         * exists to catch, and until now it kept only the hash.**
+         *
+         * The terminal-block branch above takes `appendSessionLeaf`, not `#appendVerifiedContent`, so
+         * the row carrying the plaintext, the sender's key and the sender's signature was never written.
+         * A hash proves a message you still hold has not changed; it proves nothing about one you threw
+         * away — and this is precisely the message an operator would most want to produce.
+         *
+         * At `leafIndex`, so the leaf and the evidence describe one event and DoD 7's leaf placement is
+         * untouched. The ORIGINAL bytes, never the sanitized `deliverContent`: evidence is what they
+         * sent, not what a filter made of it.
+         */
+        if (terminalBlock) {
+            const keptBlocked = this.#quarantineRefusedContent(agentName, sessionId, inboundVerdict.reason ?? "inbound_screen_blocked", content, contentHashHex, {
+                senderPubkeyHex: senderPubkey, canonicalSeq: leafIndex,
+                ...(verifiedAuthorship ? { authorship: verifiedAuthorship } : {}),
+                correlationId,
+            });
+            noteTerminalBlock?.(keptBlocked);
+            /**
+             * ⚠️ **DROP THE WITNESS — A BLOCKED MESSAGE MADE THE SESSION PERMANENTLY UNSEALABLE.**
+             *
+             * THE THIRD INSTANCE of the shape already fixed for document frames at `:10593`, found by the
+             * first journey that ever sealed a session after a screener block.
+             *
+             * `sealReadiness` derives `missingLeaves` from `#witnessedSeq.size` — every position the
+             * ordering authority committed that this tree has not appended. The entry is dropped where the
+             * leaf is credited, and that drop lives inside `#appendVerifiedContent`. A terminal block does
+             * not go through it: the branch above takes `appendSessionLeaf` directly, so the leaf WAS
+             * committed and the witness was never retired.
+             *
+             * **From the operator's chair:** their screener catches one hostile message, and from that
+             * moment `cello_close_session` answers `session_incomplete` forever — *"waiting on an earlier
+             * message from the counterparty that has not arrived"* — about a message that arrived, was
+             * judged, and is sitting in the chain. The only exit is a force-abandon, which forfeits the
+             * notarized receipt. Measured live: `treeSize 3, highWaterSeq 2, missingLeaves 1`.
+             *
+             * Not introduced by `DOD-M15-REFUSEDEVIDENCE-1` — it is older than this unit and simply had no
+             * test that both blocked a message and then sealed. It is fixed here because this unit's own
+             * DoD requires that session to seal.
+             */
+            this.#witnessedSeq.get(key)?.delete(contentHashHex);
+        }
         // DOD-COATTEND-1 (review F2): the plaintext failed to reach the transcript, and since Tier 1 the
         // transcript IS the delivery path — so this message can never be handed to any session. Report
         // the ingest as failed. Reporting `ok: true` here is what let a local SQLCipher failure surface,
@@ -8259,6 +9447,37 @@ export class SessionNodeManager {
         // tidy up a reporting problem would corrupt the frontier the counterparty already co-signs
         // against. The hole is now crossable by delivery (F1), so it costs a gap, not a stall.
         if (!terminalBlock && this.getUndeliverableSeqs(agentName, sessionId).includes(leafIndex)) {
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — **THIS PATH CANNOT RETAIN, because the storage layer is what
+             * just failed.** The write that would keep the evidence is the same `INSERT` into the same
+             * table that has already thrown for this message. Attempting it produces a second error line
+             * and no evidence. Named here rather than left to be rediscovered as a missing case.
+             */
+            // DOD-M15-NO-SILENT-REFUSAL-1. `#appendVerifiedContent` already noted `content_undeliverable`
+            // at the point the write failed; this is the INGEST's own refusal, and it is a different fact
+            // — the sender is told the ingest failed, so it will redeliver, and every redelivery of the
+            // same hash now dedups against a leaf whose plaintext is not there. Two reasons, because a
+            // reader fixing the disk fault needs to know both that the text is gone and that the sender
+            // is retrying into a hole.
+            this.noteContentRefusal(agentName, sessionId, "transcript_write_failed", {
+                kind: REFUSAL_KINDS.LOST,
+                impact: "A message reached this agent, was verified, and was committed to the conversation's record — and then its text could not be written to local storage, so it can never be delivered. There is a permanent gap in your copy of this conversation. This is a fault on THIS machine; the counterparty did nothing wrong and cannot fix it.",
+                /**
+                 * ⚠️ THE READER IS USUALLY ALREADY IN A CODING AGENT, so the guidance says GO AND LOOK
+                 * rather than listing symptoms. Andre, 2026-09-03: *"The message should mention to try and
+                 * figure out why you cannot store it — it is likely a local machine problem. But if you
+                 * truly cannot figure this out using a coding agent, then we advise reaching out to
+                 * CELLO_Support."*
+                 *
+                 * That ordering matters: this is a machine fault with an ordinary cause, and an operator
+                 * sent straight to support for a full disk has been wasted. Support is the exit, not the
+                 * first step.
+                 */
+                guidance: "Find out why the write failed — this is almost always something ordinary on this machine. " +
+                    "If you are reading this through a coding agent, have it check: free disk space, the permissions on ~/.cello, whether the database file is readable and writable, and transcript.message.record.failed in the daemon log, which carries the underlying error. " +
+                    "Waiting cannot recover the message. Once the fault is fixed, ask them to resend — the text is gone and only its hash remains. " +
+                    "If you genuinely cannot work out the cause, reach out to CELLO_Support.",
+            });
             return { ok: false, reason: "transcript_write_failed" };
         }
         // NO relay witness for this hash. We appended it anyway — refusing would make the relay a hard
@@ -8592,25 +9811,34 @@ export class SessionNodeManager {
         if (!own)
             return "none";
         try {
-            // Canonical Structure 1 is [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp].
-            const fields = decode(own.structure1Cbor);
-            const contentHash = fields[1];
-            if (!(contentHash instanceof Uint8Array)) {
+            // Canonical Structure 1 is [version, content_hash, sender_pubkey, session_id, last_seen_seq,
+            // timestamp], plus last_seen_hash at index 6 on a v2 claim (020-ACKHASH). content_hash is
+            // index 1 in both.
+            const s1 = decodeStructure1(own.structure1Cbor);
+            if (!s1.ok) {
                 this.#logger.warn("session.seal.leaf.recover.failed", {
-                    sessionId, agentName, reason: "structure1_content_hash_missing",
+                    // NAMED AT ITS CAUSE — review F2. This read `structure1_content_hash_missing`, which was
+                    // accurate when the only check was `contentHash instanceof Uint8Array`. It now fires for an
+                    // unknown layout, undecodable CBOR and a malformed field too, and sends an operator to
+                    // audit a content hash when the layout is what disagreed. `structure1Reason` carries which.
+                    sessionId, agentName, reason: "structure1_decode_failed", structure1Reason: s1.reason,
                     impact: "cannot tell whether a SEAL ctrl leaf was already posted, so the close refuses rather than risk a second one",
                 });
                 return "unknown";
             }
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
+            const contentHashHex = Buffer.from(s1.fields.contentHash).toString("hex");
             return {
                 reportedRootHex: this.getSessionTree(agentName, sessionId).rootWithAppendedHex(contentHashHex),
                 sequenceNumber: own.sequenceNumber,
             };
         }
         catch (err) {
+            // NOT a decode failure — review F3. `decodeStructure1` never throws, so the only thrower left
+            // inside this try is the tree derivation below it. Calling this `structure1_decode_failed`
+            // pointed at CBOR for a fault in `rootWithAppendedHex`, and made one reason string mean two
+            // unrelated things in the same log event.
             this.#logger.warn("session.seal.leaf.recover.failed", {
-                sessionId, agentName, reason: "structure1_decode_failed",
+                sessionId, agentName, reason: "seal_root_derivation_threw",
                 error: err instanceof Error ? err.message : String(err),
                 impact: "cannot tell whether a SEAL ctrl leaf was already posted, so the close refuses rather than risk a second one",
             });
@@ -8780,6 +10008,17 @@ export class SessionNodeManager {
                 this.#undeliverableSeqs.set(recvKey, lost);
             }
             lost.add(leafIndex);
+            // DOD-M15-NO-SILENT-REFUSAL-1: noted HERE, where the write actually fails, and not on the
+            // cello_receive exit that reports it. `#undeliverableSeqs` is in memory, so the receive exit
+            // stops being able to say this after a restart while the transcript hole stays permanent —
+            // and the exit only runs if somebody is attending, which is the case this whole line is for.
+            this.noteContentRefusal(agentName, sessionId, "content_undeliverable", {
+                kind: REFUSAL_KINDS.LOST,
+                impact: `a message arrived and was committed to the hash chain at sequence ${leafIndex}, and then its text could not be written to the local transcript. Delivery reads the transcript, so that message can never be handed to any session — it is a permanent hole in this side's copy of the conversation.`,
+                guidance: "This is a fault on THIS machine; the counterparty did nothing wrong. Find out why the write failed — it is almost always something ordinary. " +
+                    "If you are reading this through a coding agent, have it check free disk space, the permissions on ~/.cello, and transcript.message.record.failed in the daemon log, which carries the underlying error. " +
+                    "Waiting cannot recover it. Once the fault is fixed, ask them to resend. If you genuinely cannot work out the cause, reach out to CELLO_Support.",
+            });
         }
         // Review finding #6: the witness for this hash has done its ordering job once the leaf is
         // appended — drop it so #witnessedSeq stays proportional to held/pending content, not the whole
@@ -9502,6 +10741,11 @@ export class SessionNodeManager {
             }
             else if (entry.screenedOut) {
                 this.appendSessionLeaf(agentName, sessionId, "msg", entry.contentHashHex, entry.correlationId);
+                // The SAME witness leak as the immediate-append terminal-block branch (see the block comment
+                // at the `if (terminalBlock)` append in `ingestReceivedContent`), on the held path. This
+                // branch also bypasses `#appendVerifiedContent`, where the drop lives — so a blocked message
+                // that arrived out of order left `missingLeaves` stuck at 1 and the session unsealable.
+                this.#witnessedSeq.get(key)?.delete(entry.contentHashHex);
             }
             else {
                 this.#appendVerifiedContent(agentName, sessionId, entry.content, entry.contentHashHex, senderPubkey, entry.correlationId, entry.originalContent);
@@ -12208,16 +13452,26 @@ export class SessionNodeManager {
     }
     #recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, source = "content_frame") {
         try {
-            const s1 = decode(structure1Cbor);
+            // Structure 1 content_hash is index 1 and sender_pubkey index 2 in BOTH layouts — 020-ACKHASH
+            // appended last_seen_hash at 6 rather than inserting it, so neither read moved. A v2 claim
+            // decodes here exactly as a v1 one does; its hash is not consulted, because this unit ships
+            // reading and not enforcing.
+            const s1 = decodeStructure1(structure1Cbor);
             const s2 = decode(structure2Cbor);
-            const s1Hash = s1?.[1];
-            const s1Pubkey = s1?.[2];
+            const s1Hash = s1.ok ? s1.fields.contentHash : undefined;
+            const s1Pubkey = s1.ok ? s1.fields.senderPubkey : undefined;
             const seq = typeof s2?.[0] === "number" ? s2[0] : -1;
             const s2Sig = s2?.[3];
             if (!(s1Hash instanceof Uint8Array) || !(s1Pubkey instanceof Uint8Array) || !(s2Sig instanceof Uint8Array) || seq < 1) {
                 // SOFT: we could not read the record, so we learned nothing about the signer either way.
                 // Position falls back to the witness stream, exactly as an absent record does.
-                this.#logger.warn("session.content.ordering.malformed", { sessionId, correlationId });
+                // The Structure 1 reason is carried so an unreadable RECORD and an unnamed LAYOUT are
+                // distinguishable in the log — they arrive at the same soft outcome by different routes.
+                this.#logger.warn("session.content.ordering.malformed", {
+                    sessionId,
+                    correlationId,
+                    ...(s1.ok ? {} : { structure1Reason: s1.reason }),
+                });
                 return { seq: null };
             }
             // The framed ordering record must bind to THIS content (its hash) — else it orders the wrong bytes.
@@ -12271,7 +13525,21 @@ export class SessionNodeManager {
                  */
                 const reason = counterparty ? "signer_not_counterparty" : "counterparty_unknown";
                 this.#logger.warn("session.content.ordering.wrong_signer", { sessionId, reason, correlationId });
-                return counterparty ? { seq: null, fatal: { reason } } : { seq: null };
+                /**
+                 * 024-ORPHANTRIAGE — THE VERIFIED SIGNER SURVIVES THE SESSION LOOKUP NOW.
+                 *
+                 * The `verify(...)` three lines above has already passed: whoever produced this record holds
+                 * the private key for the key inside their own signed bytes. That is session-independent —
+                 * it needs no `sessions` row and never did. The soft branch then threw it away, so the
+                 * orphan branch downstream had nothing to go on and told the operator to go and talk to
+                 * whoever sent it.
+                 *
+                 * Carried out only on the `counterparty_unknown` half. The fatal half needs nothing: the
+                 * session freezes and no triage runs.
+                 */
+                return counterparty
+                    ? { seq: null, fatal: { reason } }
+                    : { seq: null, verifiedSignerUnmatched: s1Pubkey };
             }
             // Verified — record the relay-assigned canonical sequence (1-based → 0-based leaf index) for the gate.
             this.recordWitnessedSequence(agentName, sessionId, contentHashHex, seq - 1);
@@ -12595,6 +13863,12 @@ export class SessionNodeManager {
              * and the transcript row must say so rather than imply a proof it does not have.
              */
             let verifiedAuthorship;
+            /**
+             * 024-ORPHANTRIAGE: the signer when the signature verified but there was no counterparty to
+             * match it against. Its ONLY consumer is the orphan branch inside ingest — everywhere else a
+             * session record exists, so this stays `undefined` and nothing reads it.
+             */
+            let verifiedSignerUnmatched;
             if (s1Cbor instanceof Uint8Array && s2Cbor instanceof Uint8Array) {
                 const ordering = this.#recordFrameOrdering(agentName, sessionId, s1Cbor, s2Cbor, contentHash, correlationId);
                 if (ordering.fatal) {
@@ -12605,6 +13879,7 @@ export class SessionNodeManager {
                 if (ordering.senderPubkey !== undefined && ordering.senderSig !== undefined) {
                     verifiedAuthorship = { senderPubkey: ordering.senderPubkey, senderSig: ordering.senderSig };
                 }
+                verifiedSignerUnmatched = ordering.verifiedSignerUnmatched;
             }
             else {
                 /**
@@ -12641,7 +13916,7 @@ export class SessionNodeManager {
             const ingest = await this.ingestReceivedContent(
             // THE DECRYPTED body — everything downstream (the hash cross-check, the leaf, the transcript,
             // the delivery buffer) works on plaintext, exactly as it did before this layer existed.
-            agentName, sessionId, plaintextBody, contentHash, correlationId, framedSeq ?? undefined, declaredAlg === undefined ? undefined : declaredAlg, verifiedAuthorship);
+            agentName, sessionId, plaintextBody, contentHash, correlationId, framedSeq ?? undefined, declaredAlg === undefined ? undefined : declaredAlg, verifiedAuthorship, verifiedSignerUnmatched);
             // AC-001: after the content is durably ingested AND its hash cross-check
             // succeeds, emit an unsigned `persisted` delivery ACK back to the sender. A
             // rejected ingest (tamper / not-active) produces NO ACK, so the sender's TTF