@cello-protocol/daemon 0.0.187 → 0.0.189

package/dist/session-node-manager.js

@@ -23,12 +23,14 @@
 import { contentHashFor, resolveContentHashAlg, CONTENT_HASH_ALGS } from "./wire-content-hash.js";
 import { CAPACITY_REASONS } from "./refusal-reasons.js";
 import { onPeerSaltFrame, ownSaltFrame, SALT_ADOPTION_LABEL_MAX, SALT_ADOPTION_LABELS, SALT_FREEZE_GUIDANCE, } from "./session-salt-agreement.js";
-import { CONTENT_ENCRYPTION_REASONS, CONTENT_ENCRYPTION_GUIDANCE, SESSION_CONTENT_ENCRYPTION_V1, } from "./content-encryption-status.js";
+import { CONTENT_ENCRYPTION_REASONS, CONTENT_ENCRYPTION_GUIDANCE, CONTENT_ENCRYPTION_INBOUND_GUIDANCE, SESSION_CONTENT_ENCRYPTION_V1, } from "./content-encryption-status.js";
 import { openEncryptedDatabase, resolveDbKey, dbKeyPathFor, } from "./sqlcipher-db.js";
 import { migrateToEncryptedIfNeeded } from "./identity-migration.js";
 import { ensureIdentitySchema } from "./db-identity-store.js";
 import { migrateSessionTablesToAgentId } from "./agent-id-migration.js";
 import { TIER, normalizeTier, isKnownTierValue, tierBoundsFor, DEFAULT_TIER_BOUNDS, migrateContactsAddTierMetadata } from "./contacts-tier-migration.js";
+import { normalizeContactPubkey, foldContactPubkeyCase } from "./contact-pubkey-case.js";
+import { REFUSAL_KINDS } from "./refusal-reasons.js";
 import { migrateCborBlobsToCanonical } from "./cbor-blob-migration.js";
 import { ensureTrustSignalSchema } from "./trust-signal-store.js";
 import { boundSettingKey, settableTierName, isValidSettingKey, awayTierSettingKey, AWAY_DEFAULT_KEY } from "./agent-settings-keys.js";
@@ -36,7 +38,7 @@ import { publishableEndpoint, relayOnlyState } from "./relay-only.js";
 import { randomUUID, createHash, randomBytes } from "node:crypto";
 import * as lp from "it-length-prefixed";
 import { decode } from "cbor-x";
-import { encodeCbor } from "@cello-protocol/protocol-types";
+import { encodeCbor, decodeStructure1, encodeStructure1 } from "@cello-protocol/protocol-types";
 import { MAX_SESSION_NODES, STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 import { SessionConnectionGater } from "./session-connection-gater.js";
 import { SessionTree, sessionTreeLeafKindFromDb } from "./session-tree.js";
@@ -48,6 +50,7 @@ import { encodeSealPayload, MONIKER_RE, validateMoniker } from "@cello-protocol/
 // receives the already-classified `ParkAuthFailure`, so importing the code table here would invite a
 // second, drifting copy of the classification logic.
 import { decodeParkEnvelope, authenticateParkedEntry, pubkeyMatchesHex, ParkEnvelopeError, parkRefusalGuidance } from "./park-envelope.js";
+import { triageOrphanedContent } from "./orphan-triage.js";
 import { isValidMultiaddr } from "@cello-protocol/transport";
 // `LEAF_KIND_MSG` is no longer imported here: `sendContent`'s `leafKind` stopped defaulting to it
 // (B2b-1 review F4), so this file no longer names a default — every caller states its own kind.
@@ -58,6 +61,7 @@ import { RelayReceiptStore } from "./relay-receipt-store.js";
 import { SessionSealLeafStore } from "./session-seal-leaf-store.js";
 import { certifiedLeafSetFrom } from "./sealed-leaf-set.js";
 import { addColumnIfMissing } from "./column-birth.js";
+import { quarantineRedaction, retentionSentence } from "./quarantine-framing.js";
 import { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, } from "@cello-protocol/gateway";
 /** SEC-1 / review M4: cap on the refused-parked-entry memo (remote-fed → must be bounded). */
 /**
@@ -77,6 +81,25 @@ const MAX_REFUSED_PARKED_ENTRIES = 512;
  * losing an old one costs a log line rather than correctness.
  */
 const MAX_UNREADABLE_ALG_FRAMES = 64;
+/**
+ * How many consumers' read positions a single refusal notice remembers.
+ *
+ * A consumer id is an IPC connection id, so every reconnect mints a new one and the read state would
+ * otherwise grow without bound in a durable table. Sixteen is far above the real number of windows
+ * attending one agent; past that the OLDEST reader is evicted, which costs at worst one repeated
+ * announcement to a window that has already gone.
+ */
+const MAX_REFUSAL_READERS = 16;
+/**
+ * How many refusal notices one read returns, newest first.
+ *
+ * Review F3. The store is never emptied for an agent — a refusal records something that happened —
+ * and read state is per IPC connection, so a fresh window after a restart is entitled to every
+ * notice ever recorded. Uncapped, the answer to "why did this conversation go quiet?" was at the
+ * bottom of an archive. Capped and newest-first, the recent cause leads and the caller is TOLD the
+ * list was cut (`refusals_incomplete`), rather than the tail vanishing silently.
+ */
+const MAX_REFUSALS_PER_READ = 25;
 /**
  * How long the first send waits for an in-flight salt agreement before giving up on it —
  * `DOD-M15-SEALWIRE-1` B2b-2 constraint 2.
@@ -358,6 +381,127 @@ export const REVIVE_RESERVATION_CANDIDATES = 2;
  * the healthy direct latency and far below anything a person would notice.
  */
 export const LEAF_FETCH_GRACE_MS = 2_000;
+/**
+ * DOD-M15-REFUSALTERMINAL-1 — the refusal reasons no retry can ever get past.
+ *
+ * MEASURED LIVE 2026-09-04: one message aimed at a conversation the counterparty had already
+ * closed, refused `session_committed` and re-fetched roughly twice a second for 62 hours across
+ * several daemon restarts — 232,056 refusal events on that one session and a 484 MB `daemon.log`.
+ *
+ * **WHY `session_committed` QUALIFIES.** A committed session carries a signature over its contents.
+ * Nothing can be appended to it by anyone — not the counterparty, not us — so there is no future
+ * state in which this content is accepted. That is the bar, and it is the whole bar.
+ *
+ * **⚠️ DO NOT ADD A REASON WITHOUT MEETING IT.** A reason wrongly called terminal silently drops a
+ * message that would have arrived on the next try, which is worse than the loop this set exists to
+ * end. The tempting ones and why each fails:
+ *
+ *   - `content_hash_mismatch` — the fetch is BY CONTENT HASH, and a later fetch may retrieve a
+ *     correct copy from a different relay. Retrying can succeed.
+ *   - `sender_unresolved` — the sender may become resolvable when a profile arrives or a directory
+ *     syncs. Retrying can succeed.
+ *   - `session_orphaned` — `024-ORPHANTRIAGE` owns that path and decides its disposition.
+ *   - `session_size_limit_exceeded` — the cap IS monotonic, but its bound is a setting, and an
+ *     operator who raises it must be able to un-stick the conversation.
+ *   - a transient screener block — transient is in its name.
+ */
+/**
+ * ⚠️ NOT the same concept as `session-terminal-refusal.ts` (`DOD-MP-SESSION-RETIRE-1`), which is the
+ * RELAY terminally refusing one of OUR SENDS. This set is about INBOUND content this side will
+ * never accept. Two "terminal refusal" ideas live in this daemon and they point in opposite
+ * directions — review F9.
+ */
+export const TERMINAL_REFUSAL_REASONS = new Set(["session_committed"]);
+/**
+ * DOD-M15-REFUSALTERMINAL-1 review F3 — how long a FAILED read of the terminal-refusal rows is
+ * backed off for, per session.
+ *
+ * A minute: long enough that a database throwing on every witnessed leaf produces one ERROR rather
+ * than one per message (the exact log growth this unit exists to end), short enough that a disk
+ * which recovers is noticed within a message or two rather than at the next restart.
+ */
+export const TERMINAL_REFUSAL_READ_RETRY_MS = 60_000;
+/**
+ * DOD-M15-REFUSALTERMINAL-1 review F7 — how many terminally-refused content hashes are remembered
+ * per session.
+ *
+ * The counterparty chooses how many rows this table gets: one per distinct message aimed at a
+ * closed conversation, written even after the byte cap has stopped retaining evidence. 512 matches
+ * `MAX_REFUSED_PARKED_ENTRIES`, is far above any honest volume for a conversation that has ENDED,
+ * and bounds the table at (sessions × 512) small rows.
+ */
+export const MAX_TERMINAL_REFUSALS_PER_SESSION = 512;
+/**
+ * The `unusable` reason for a proof that is real and describes some OTHER message.
+ *
+ * ⚠️ NOT `"content_hash_mismatch"` — review §6. That string is already the refusal reason for the
+ * RECEIVER's own recompute failing (`ingestReceivedContent`), which is a tamper signal about the
+ * BODY. This one says the sender's signed claim is about different content. Two different failures
+ * sharing one name is a collision an operator grepping the log walks straight into.
+ */
+const AUTHORSHIP_CONTENT_HASH_MISMATCH = "authorship_hash_mismatch";
+/**
+ * The `unusable` reason for a proof that is real, is by the right signer, describes this content —
+ * and was signed for a DIFFERENT conversation. A replay, not a forgery.
+ *
+ * Every one of those properties has been ESTABLISHED by the time this is returned; see the ordering
+ * note in `#verifyAuthorshipClaim`. An earlier version of this sentence was true of the intent and
+ * not of the code, because the check ran before the signature was verified.
+ */
+const AUTHORSHIP_SESSION_MISMATCH = "session_mismatch";
+/**
+ * ⚠️ **THE REFUSALS THAT SAY THIS ARE THE ONES WHERE THE REFUSAL DOES NOT HOLD — NOT ALL OF THEM.**
+ *
+ * It said "EVERY INBOUND REFUSAL SAYS THIS", and review F5 measured that: fifteen call sites file a
+ * refusal notice in this file and four carry this sentence — the three encryption causes and the
+ * authorship one. The rest MUST NOT. A screened-out message is deliberately never delivered by any
+ * route, and a transcript write failure lost content that was already accepted; promising either
+ * operator a second chance would be a lie in the opposite direction. Rewritten rather than deleted,
+ * because "EVERY" read as a rule and the next person to add a refusal would have applied it blindly.
+ *
+ * Where it DOES apply: refusing an inbound frame sends back no delivery acknowledgement, so a CELLO
+ * sender's TTF backstop parks a copy in the relay mailbox — sealed to this agent's LONG-TERM
+ * IDENTITY key, not the session key — and recovery opens that one whatever went wrong with the
+ * direct copy.
+ *
+ * ⚠️ AND ONLY WHEN THIS MACHINE CAN OPEN ONE. See `REFUSAL_NO_OTHER_ROUTE`; the choice is made by
+ * `#mailboxRouteAvailable`, never by a caller writing the sentence into a literal.
+ */
+const REFUSAL_MAY_STILL_ARRIVE = "IT MAY STILL REACH YOU BY THE OTHER ROUTE: a refusal sends back no acknowledgement, so a CELLO " +
+    "counterparty's agent parks a copy in the relay mailbox and this side opens that one with your " +
+    "long-term key instead of this session's. If it arrives, it arrives without whatever this check " +
+    "was unable to confirm — and if they are not running CELLO, there is no such copy and it will " +
+    "not arrive.";
+/**
+ * ⚠️ **THE OTHER ROUTE DOES NOT EXIST ON THIS MACHINE, AND SAYING SO IS THE POINT** — review F2.
+ *
+ * Opening a mailbox copy needs `KeyProvider.openContentSeal`, which is OPTIONAL: a threshold or
+ * signing-only provider does not implement it, and an agent loaded without a provider has none at
+ * all. `content-park.ts` refuses both — `signing_key_unavailable`, `cannot_unseal`.
+ *
+ * That is the SAME condition `CONTENT_ENCRYPTION_REASONS.NO_LOCAL_IDENTITY` reports. So on the one
+ * refusal that names a missing local identity, the reassurance above was false: both routes are shut
+ * by one cause, permanently, for every message on every session of that agent — and the operator was
+ * told to wait for a delivery that cannot happen. That is the H1 defect exactly: a refusal
+ * announcing a better outcome than it delivers.
+ */
+const REFUSAL_NO_OTHER_ROUTE = "AND IT WILL NOT REACH YOU BY THE OTHER ROUTE EITHER: the relay mailbox copy is opened with this " +
+    "agent's long-term identity key, which is the very thing this machine is missing. One cause shuts " +
+    "both routes, and it will keep shutting them until the agent is loaded with its identity key. Do " +
+    "not wait for this message to turn up.";
+/**
+ * Constant-shape byte equality for the two binding checks. Lifted rather than hand-rolled a second
+ * time — `seal-frontier-verify` has the same helper for the same comparison, and two copies of
+ * "are these the same bytes" is two things to keep true.
+ */
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
 /**
  * The relay's peer id out of a circuit listen address, or `null` if the address does not name one.
  *
@@ -374,24 +518,18 @@ function relayPeerIdOf(circuitAddr) {
  * `null` when any leaf is unreadable — the caller must then answer "I cannot judge", never "we
  * disagree". A decode failure is this daemon's limitation, not evidence against anyone.
  *
- * Canonical Structure 1 is
- * `[protocol_version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp]`, and the
- * content hash is used AS the leaf hash (RFC 6962 §2.1 "hash" leaves are taken as-is), which is the
- * domain the certified root lives in.
+ * Canonical Structure 1 is `[version, content_hash, sender_pubkey, session_id, last_seen_seq,
+ * timestamp]`, plus `last_seen_hash` at index 6 on a v2 claim (020-ACKHASH). The content hash is at
+ * index 1 in both and is used AS the leaf hash (RFC 6962 §2.1 "hash" leaves are taken as-is), which
+ * is the domain the certified root lives in.
  */
 function carryContentHashInputs(carry) {
     const inputs = [];
     for (const leaf of carry) {
-        let contentHash;
-        try {
-            contentHash = decode(leaf.structure1Cbor)[1];
-        }
-        catch {
-            return null;
-        }
-        if (!(contentHash instanceof Uint8Array) || contentHash.length !== 32)
+        const s1 = decodeStructure1(leaf.structure1Cbor);
+        if (!s1.ok)
             return null;
-        inputs.push({ kind: "hash", data: contentHash });
+        inputs.push({ kind: "hash", data: s1.fields.contentHash });
     }
     return inputs;
 }
@@ -894,6 +1032,21 @@ export class SessionNodeManager {
     /** In-flight grace timers, keyed session+hash, so a redelivered leaf does not schedule a second
      *  fetch for the same content — a slow relay must not be turned into a storm against itself. */
     #leafFetchTimers = new Map();
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: content hashes refused for a reason no retry can get past — a READ
+     * CACHE over `terminal_content_refusals`, never the record itself.
+     *
+     * ⚠️ **NOT the same fact as `#resolvedContent`, and collapsing them is the trap.** "Resolved"
+     * means we HAVE the content. Terminally refused means we have it and are never accepting it.
+     * Filing one under the other tells the next reader that refused content was delivered.
+     */
+    #terminallyRefused = new Map();
+    /** Sessions whose terminal-refusal rows have been read from the database into the map above.
+     *  Nothing ever un-marks content, so a loaded set only grows and can never go stale. */
+    #terminalRefusalsLoaded = new Set();
+    /** DOD-M15-REFUSALTERMINAL-1 review F3: when the load above last FAILED, per session. Bounds the
+     *  retry and the ERROR to once a minute instead of once per witnessed leaf. */
+    #terminalRefusalsReadFailedAt = new Map();
     /** Test seam: collapse the grace window so a test does not have to wait two real seconds. The
      *  window itself is covered by its own case. */
     #leafFetchGraceMs = LEAF_FETCH_GRACE_MS;
@@ -986,6 +1139,15 @@ export class SessionNodeManager {
     // DOD-M12B-ACK-1: WHY a session is impaired and what became of the content. Separate from the
     // state above because the state is what surfaces print and this is what they must explain.
     #impairmentCause = new Map();
+    /**
+     * DOD-M15-NO-SILENT-REFUSAL-1 review F6 — refusal notices that could NOT be persisted.
+     *
+     * Empty in every healthy daemon. It exists so that a database failure costs the restart property
+     * and nothing else: without it, the operator-facing surface for a refusal disappears entirely the
+     * moment the write fails, which is strictly worse than the in-memory Map this store replaced.
+     * `session.refusal.persist.failed` fires at ERROR on every entry that lands here.
+     */
+    #refusalFallback = new Map();
     // DOD-M12B-STRAND-1: sessions whose durable holds have been read back. One read per session per
     // process; the Map is the working copy from then on.
     #heldRestored = new Set();
@@ -1298,6 +1460,26 @@ export class SessionNodeManager {
      * entry is removed the moment it is reconciled.
      */
     #unreadableAlgSeen = new Map();
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` review H1, widened by `029c` review F4 — the content hashes this
+     * side refused ON THE DIRECT PATH, for any reason, so the park path can say so when the same
+     * message arrives the other way.
+     *
+     * One map rather than one per refusal: what the park path needs to know is "did we turn this
+     * content away and tell somebody so", and the reason is already on the notice.
+     *
+     * **The silence this closes.** A direct-path refusal sends no delivery ACK, so the sender's TTF
+     * backstop parks the message and it arrives through the relay mailbox seconds later — where the
+     * ENVELOPE's signature is what authenticates it, and recovery correctly accepts it. So the
+     * message is delivered, with no per-message proof, moments after the operator was told it was
+     * refused. Nothing tied the two events together, which is the same shape the algorithm refusal
+     * above already had and the same remedy.
+     *
+     * Same bounded shape and the same reason: it is fed entirely by a remote party, so losing an
+     * entry costs one reconciliation line and an unbounded map would be a leak with a peer's hand on
+     * the tap.
+     */
+    #refusedOnDirectPath = new Map();
     // DOD-MSG-4 (strict in-order): the RELAY is the ordering authority (Structure 2). For each
     // message the relay witnesses, it delivers B a (content_hash -> canonical sequence) binding via
     // the leaf_deliver stream. B records it here — keyed #k(agent,session) -> (contentHashHex -> seq)
@@ -2085,9 +2267,17 @@ export class SessionNodeManager {
         -- else — which is the whole point of a notarized record.
         --
         -- sender_sig holds one of TWO things, and which one is told by direction:
-        --   RECEIVED row -> the Structure-2 signature, stored ONLY after the receiver verified it
-        --                   against the pubkey inside the sender's own signed bytes
-        --                   (#recordFrameOrdering). Verified, never claimed.
+        --   RECEIVED row -> the sender's signature over their own Structure-1 bytes, carried on the
+        --                   content frame BESIDE those bytes, stored ONLY after the receiver
+        --                   verified it against the pubkey inside them (#verifyAuthorshipClaim).
+        --                   Verified, never claimed.
+        --                   ⚠️ THIS USED TO READ "the Structure-2 signature ... (#recordFrameOrdering)"
+        --                   and it named a real place: until DOD-M15-AUTHORSHIP-ABSENT-1 the only
+        --                   copy of that signature this side ever saw was the one the RELAY had
+        --                   committed at Structure-2 index 3, so a message with no relay record had
+        --                   no checkable author at all. Rewritten rather than deleted: an auditor
+        --                   reading the old sentence goes looking for Structure-2 bytes that, on a
+        --                   relay-degraded message, do not exist.
         --   SENT row     -> OUR OWN signature over the Structure-1 bytes we put on the wire, taken
         --                   from the submit result. Produced, not verified — there was no
         --                   counterparty in the act, so it must NEVER be labelled verified_signature.
@@ -2095,11 +2285,16 @@ export class SessionNodeManager {
         -- ⚠️ self_authored COVERS TWO PROVENANCES, and sender_sig IS NOT NULL is the discriminator.
         -- Named here because it is the same shape this column exists to prevent, one level up: a
         -- provable sent row and an unprovable one share a label, so a reader keying on attribution
-        -- alone cannot tell them apart. An unprovable sent row is legitimate — an UNWITNESSED send
-        -- never put a Structure 1 on the wire, so there is nothing signed to store — but the reader
-        -- has to be told where the distinction lives, or it will be rediscovered as a bug.
+        -- alone cannot tell them apart.
         --   self_authored + sender_sig NOT NULL -> we wrote it and can prove we did
-        --   self_authored + sender_sig NULL     -> we wrote it; the relay never witnessed it
+        --   self_authored + sender_sig NULL     -> we wrote it; no proof was stored for this row
+        --
+        -- ⚠️ THE NULL CASE USED TO READ "the relay never witnessed it", and DOD-M15-AUTHORSHIP-ABSENT-1
+        -- made that false. Every content frame now carries this side's signature over its own
+        -- Structure 1 whether or not a relay witnessed the leaf, so an unwitnessed send is provable
+        -- too. Rewritten rather than deleted: the old sentence is why a NULL here was read as
+        -- ordinary. It is not ordinary now — it means this machine could not sign at all, or the row
+        -- came by a path that carries no proof, and both are worth a second look.
         --
         -- attribution is NOT NULL ON PURPOSE, and it is the load-bearing column. There is a soft
         -- path — session.content.ordering.decode_failed falls back to hash-dedup — that ingests a
@@ -2109,11 +2304,42 @@ export class SessionNodeManager {
         -- nothing distinguishes them. Forcing every writer to name which it is makes silent NULL
         -- impossible rather than merely discouraged.
         sender_pubkey TEXT,             -- from INSIDE the sender's signed bytes; NULL unless verified
-        sender_sig BLOB,                -- the VERIFIED Structure-2 signature; NULL unless verified
+        sender_sig BLOB,                -- the VERIFIED sender signature over structure1_cbor (see above); NULL unless verified
         attribution TEXT NOT NULL DEFAULT 'local_session_state',  -- verified_signature | self_authored | local_session_state
         PRIMARY KEY (agent_id, session_id, sequence, direction)
       )
     `);
+        /**
+         * DOD-M15-REFUSEDEVIDENCE-1 — the refusal reason on a QUARANTINED row.
+         *
+         * `direction` takes a third value, `'quarantined'`: a message that was received and REFUSED. It
+         * is stored the same way a delivered one is — plaintext blob, sender key, sender signature,
+         * attribution — because a hash with no original proves nothing, and the messages worth proving
+         * (an injection, a probe, a tampered frame) are exactly the refused ones.
+         *
+         * ⚠️ THE DIRECTION VALUE IS THE FLAG, AND THAT IS WHY IT IS NOT A BOOLEAN COLUMN. `direction` is
+         * in the primary key and every delivery and unread reader already filters it with an equality
+         * literal (`findNextReceivedAfter`, `#UNREAD_RECEIVED_WHERE`, `countReceivedMessages`). A row
+         * written `'quarantined'` therefore cannot be returned by `WHERE direction = 'received'` — it is
+         * excluded BY CONSTRUCTION, with no query edited and none left to remember. A boolean column
+         * alone would have been exclusion by EDIT, which rebuilds `DOD-UNREAD-1 D4a`'s phantom-session
+         * residue the first time a new query forgets the predicate.
+         *
+         * `attribution` needs no new value: the expression in `recordTranscriptMessage` is
+         * `direction === "sent" ? … : authorship ? "verified_signature" : "local_session_state"`, and
+         * `'quarantined'` is not `'sent'` — so a verified frame lands `verified_signature` and an
+         * unverified one `local_session_state`, which is the distinction the column exists for.
+         */
+        // Through `addColumnIfMissing`, not a hand-rolled try/catch — review F7. A bare `ADD COLUMN`
+        // wrapped in a duplicate-name test had already been written twice in this codebase, which is
+        // why the helper exists; a third copy rethrows correctly but emits no `db.column_birth.failed`,
+        // so a failure on a fresh operator's database would name neither the table nor the column. That
+        // is exactly the case — the FIRST run on a new machine — the helper was extracted for.
+        addColumnIfMissing(this.#db, this.#logger, {
+            table: "transcript",
+            column: "quarantine_reason",
+            sql: "ALTER TABLE transcript ADD COLUMN quarantine_reason TEXT",
+        });
         // M8C-INBOX-1 (N2): per-agent, per-session read watermark. `last_delivered_seq` is the highest
         // RECEIVED transcript sequence the operator has been shown via cello_receive (delivery marks
         // read — no ack verb). Unread = received transcript rows with sequence > last_delivered_seq.
@@ -2251,6 +2477,181 @@ export class SessionNodeManager {
         noticed_at INTEGER NOT NULL,
         PRIMARY KEY (agent_id, pubkey)
       )
+    `);
+        /**
+         * A PUBLIC KEY IS BYTES; ITS HEX CASE IS NOT PART OF ITS IDENTITY.
+         *
+         * ⚠️ **PLACED HERE FOR TWO ORDERING REASONS, and getting either wrong is a crash at boot.** It
+         * touches all three contact-keyed tables, so it runs after the LAST of them exists
+         * (`contact_rename_notices`, directly above); and the merge it performs on a collision keeps the
+         * more restrictive TIER, which it cannot read until `migrateContactsAddTierMetadata` has added
+         * that column.
+         *
+         * Normalizing the accessors alone would be worse than the bug for anyone who already has a
+         * mixed-case row: the row becomes UNREACHABLE rather than merely wrong, taking its block, its
+         * away message and its pet name with it. Idempotent and silent on a clean database.
+         */
+        foldContactPubkeyCase(this.#db, this.#logger);
+        // DOD-M15-NO-SILENT-REFUSAL-1: refusal notices — one per (agent, session, reason). Written every
+        // time an inbound message is refused; read by cello_receive and by the cello_inbox pull. Modelled
+        // on contact_rename_notices above and keyed the same way, on agent_id (the stable key) — the map
+        // this replaced was keyed on agent_name, a mutable display label, which was its second bug.
+        //
+        // DURABLE because the case this exists for is NOBODY ATTENDING. A notice held only in memory is
+        // lost to a restart and is only ever surfaced to whoever happens to call cello_receive on that
+        // exact session, which is a log line with extra steps.
+        //
+        // `content_refusal_reads` is the part rename notices do not need: they clear on operator action,
+        // these are read non-destructively PER CONSUMER. Two MCP windows attending one agent is ordinary,
+        // and under a single surfaced flag the first reader consumed the notice and the second was told
+        // nothing, permanently.
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS content_refusal_notices (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        impact TEXT NOT NULL,
+        guidance TEXT NOT NULL,
+        count INTEGER NOT NULL,
+        first_at INTEGER NOT NULL,
+        last_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, reason)
+      )
+    `);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — the lifetime refusal count, which `content_refusal_notices` is
+         * NOT and never was.
+         *
+         * `cello_dismiss` DELETEs the notice row (`dismissContentRefusals`), so `notices.count` restarts
+         * at 1 after every dismissal. That is correct for the notice — the operator said "I know" and
+         * the next announcement should describe what happened since — and it is exactly why the number
+         * shown beside it cannot be described as a lifetime figure. Live on 2026-09-04 an inbox reported
+         * `times: 58` for a refusal that had fired tens of thousands of times.
+         *
+         * A separate table rather than a column, because the two have different lifetimes: this one is
+         * never deleted by anything an operator does. Same key, so the read is one LEFT JOIN.
+         */
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS content_refusal_totals (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        total INTEGER NOT NULL,
+        first_at INTEGER NOT NULL,
+        last_at INTEGER NOT NULL,
+        -- 1 when this row was SEEDED from an existing notice at upgrade rather than counted from
+        -- the first refusal. Its total is then a LOWER BOUND, not a figure, and the drain reports
+        -- it under a different field name so a reader cannot mistake one for the other.
+        seeded INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (agent_id, session_id, reason)
+      )
+    `);
+        /**
+         * ⚠️ **THE BACKFILL, and without it this unit ships the original lie with the new name on it.**
+         *
+         * Review finding 1. A new table is created EMPTY. Every daemon that already has refusal notices
+         * — including the one that produced this incident, whose notice sat at 58 — would report
+         * `times_since_dismissed: 59` beside a `times_total` of **1**, on the very field the guidance
+         * tells an operator to judge severity by. Smaller than the number it exists to dwarf.
+         *
+         * `count` is the best figure available at upgrade and it is a LOWER BOUND: dismissals before
+         * this build deleted history nothing can recover. So the row is marked `seeded` and reported as
+         * "at least", never as a total. A lower bound is a true statement; `total = 1` is not.
+         *
+         * `INSERT OR IGNORE` makes it idempotent and self-healing — it fills only rows that do not
+         * exist, so a real counted total is never overwritten by a seeded one, and running it at every
+         * boot costs one indexed scan of a table bounded by (sessions × reasons).
+         */
+        /**
+         * ⚠️ **AND `CREATE TABLE IF NOT EXISTS` IS A NO-OP AGAINST A TABLE THAT ALREADY EXISTS** —
+         * review F1b, and it is the same hazard `DOD-M12B-INDEX-1` records for `held_content.origin`
+         * three hundred lines above.
+         *
+         * The table shipped one commit earlier WITHOUT `seeded`, and that build ran on a real daemon to
+         * take this unit's live measurement. On that machine the `CREATE` does nothing, the backfill
+         * below names a column that is not there, and the throw comes out of schema init — **the daemon
+         * does not open at all.** The one machine that most needs the backfill is the one it would have
+         * bricked.
+         */
+        try {
+            this.#db.exec("ALTER TABLE content_refusal_totals ADD COLUMN seeded INTEGER NOT NULL DEFAULT 0");
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (!/duplicate column name/i.test(msg))
+                throw err;
+        }
+        this.#db.exec(`
+      INSERT OR IGNORE INTO content_refusal_totals
+        (agent_id, session_id, reason, total, first_at, last_at, seeded)
+      SELECT agent_id, session_id, reason, count, first_at, last_at, 1
+        FROM content_refusal_notices
+    `);
+        /**
+         * ⚠️ **THE INVARIANT: a lifetime total can never be SMALLER than a since-dismissal count.**
+         * Caught on the live daemon, not by review — the inbox read
+         * `times_since_dismissed: 78, times_total: 12`.
+         *
+         * `INSERT OR IGNORE` above only fills rows that are ABSENT. A row that already exists but began
+         * counting AFTER the notice did — the totals table shipped one commit before `seeded`, so its
+         * rows default to 0 and claim to be exact — is left alone, and then presents a partial tally as
+         * a lifetime figure. Smaller than the number beside it, which is the tell.
+         *
+         * `count` resets on dismissal and `total` does not, so in healthy operation `total >= count`
+         * always. `count > total` therefore means one thing only: this row's total did not start at the
+         * beginning. Repaired to the best floor available and marked `seeded`, because that is what it
+         * is. Runs at every boot — it is also the repair for a totals write that failed while the
+         * notice's succeeded.
+         */
+        this.#db.exec(`
+      UPDATE content_refusal_totals
+         SET total = (SELECT n.count FROM content_refusal_notices n
+                       WHERE n.agent_id = content_refusal_totals.agent_id
+                         AND n.session_id = content_refusal_totals.session_id
+                         AND n.reason = content_refusal_totals.reason),
+             seeded = 1
+       WHERE EXISTS (SELECT 1 FROM content_refusal_notices n
+                      WHERE n.agent_id = content_refusal_totals.agent_id
+                        AND n.session_id = content_refusal_totals.session_id
+                        AND n.reason = content_refusal_totals.reason
+                        AND n.count > content_refusal_totals.total)
+    `);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — content this agent will never accept, so the daemon stops going
+         * to fetch it.
+         *
+         * **DURABLE BECAUSE THE DEFECT CROSSED RESTARTS.** The 62-hour loop spanned several `cello
+         * login` cycles; a marker held in a `Set` on the manager would have passed every test and
+         * shipped nothing.
+         *
+         * NOT the `'quarantined'` transcript row, which is the natural candidate and does not work: it
+         * is keyed on the BYTES, and the fetch scheduler is keyed on the content hash the sender
+         * committed to. On the two refusals where those provably differ (a tamper, an algorithm we
+         * cannot read) the row cannot answer the question this table is asked.
+         *
+         * Keyed on `agent_id` — the stable key. `agent_name` is a display label.
+         */
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS terminal_content_refusals (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        content_hash TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        marked_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, content_hash)
+      )
+    `);
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS content_refusal_reads (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        consumer_id TEXT NOT NULL,
+        seen_count INTEGER NOT NULL,
+        seen_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, reason, consumer_id)
+      )
     `);
         // DOD-SETTINGS-1: a daemon-side per-agent settings store for REACHABILITY POLICY (the tier bounds
         // overrides and the per-tier/agent away messages). A generic key-value table on the stable
@@ -2548,17 +2949,18 @@ export class SessionNodeManager {
             return null;
         const reach = new Map();
         for (const leaf of carry) {
-            let signedLastSeen = 0;
-            try {
-                // Structure 1 = [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp].
-                const raw = decode(leaf.structure1Cbor)[4];
-                const n = typeof raw === "bigint" ? Number(raw) : raw;
-                if (typeof n === "number" && Number.isFinite(n))
-                    signedLastSeen = n;
-            }
-            catch {
-                return null; // unreadable: publish no boundary rather than a half-derived one
-            }
+            // Structure 1 = [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp],
+            // plus last_seen_hash at 6 on a v2 claim. `last_seen_seq` is index 4 in both — 020-ACKHASH
+            // APPENDS, so this read did not move. The hash is not consulted here: this derives a
+            // POSITIONAL boundary, which is the job last_seen_seq keeps doing alongside the new field.
+            const s1 = decodeStructure1(leaf.structure1Cbor);
+            // Unreadable, or a layout this build cannot name: publish no boundary rather than a
+            // half-derived one somebody else could have shaped.
+            if (!s1.ok)
+                return null;
+            const signedLastSeen = Number.isFinite(Number(s1.fields.lastSeenSeq))
+                ? Number(s1.fields.lastSeenSeq)
+                : 0;
             const prior = reach.get(leaf.senderPubkeyHex) ?? 0;
             reach.set(leaf.senderPubkeyHex, Math.max(prior, leaf.sequenceNumber, signedLastSeen));
         }
@@ -2583,7 +2985,14 @@ export class SessionNodeManager {
      * lost row only cost the unread count. Delivery reads the transcript now, so a swallowed received
      * row is TOTAL content loss and the caller has to know.
      */
-    recordTranscriptMessage(agentName, sessionId, sequence, direction, plaintext, correlationId, 
+    recordTranscriptMessage(agentName, sessionId, sequence, 
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1 adds `'quarantined'` — received and REFUSED, kept as evidence and
+     * never delivered. It goes through THIS writer rather than a second one so that the attribution
+     * rule, the blob handling and the write-failure logging cannot drift between a delivered message
+     * and a refused one. One store, one writer.
+     */
+    direction, plaintext, correlationId, 
     /**
      * DOD-M15-SEALWIRE-1 bullet 5: the VERIFIED authorship proof, when there is one.
      *
@@ -2592,7 +3001,16 @@ export class SessionNodeManager {
      * is written into the row as `attribution = 'local_session_state'`, so a reader can tell a row
      * whose author was proven from one whose author was assumed. That distinction is the bullet.
      */
-    authorship) {
+    authorship, 
+    /** Required on a `'quarantined'` row and meaningless on any other: WHY it was refused. */
+    quarantineReason, 
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1: the sender's key when there is one but no verified signature to go
+     * with it. A refused frame often has an identified sender and an unusable proof — a tampered
+     * message is still FROM someone — and dropping the key because the signature failed would throw
+     * away the half of the attribution that survived.
+     */
+    senderPubkeyHexOverride) {
         if (!this.#db)
             return false;
         try {
@@ -2600,9 +3018,11 @@ export class SessionNodeManager {
             const blob = Buffer.from(plaintext);
             this.#db
                 .prepare(`INSERT OR IGNORE INTO transcript
-             (agent_id, session_id, sequence, direction, blob, created_at, sender_pubkey, sender_sig, attribution)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(agentId, sessionId, sequence, direction, blob, Date.now(), authorship ? Buffer.from(authorship.senderPubkey).toString("hex") : null, authorship ? Buffer.from(authorship.senderSig) : null, 
+             (agent_id, session_id, sequence, direction, blob, created_at, sender_pubkey, sender_sig, attribution, quarantine_reason)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(agentId, sessionId, sequence, direction, blob, Date.now(), authorship
+                ? Buffer.from(authorship.senderPubkey).toString("hex")
+                : senderPubkeyHexOverride ?? null, authorship ? Buffer.from(authorship.senderSig) : null, 
             /**
              * THREE values, not two — caught by CELLO_Coder_1 reviewing the first version, and it was
              * the same defect this column exists to prevent, surviving one layer up in the enum.
@@ -2630,7 +3050,7 @@ export class SessionNodeManager {
              *   `verified_signature` — someone else wrote it and we checked their key against it.
              *   `local_session_state`— someone else wrote it and nobody checked anything.
              */
-            direction === "sent" ? "self_authored" : authorship ? "verified_signature" : "local_session_state");
+            direction === "sent" ? "self_authored" : authorship ? "verified_signature" : "local_session_state", quarantineReason ?? null);
             this.#logger.info("transcript.message.recorded", { sessionId, agentName, sequence, direction, correlationId });
             return true;
         }
@@ -2646,12 +3066,17 @@ export class SessionNodeManager {
             // sentence is corrected rather than kept, because as written it reassured a reader about a
             // safety net that no longer exists. Sent-row failures stay a warning (they only affect the
             // durable readable transcript, not delivery).
-            const level = direction === "received" ? "error" : "warn";
+            // A QUARANTINED row that fails to write is an ERROR for the same reason a received one is,
+            // and a different one: nothing else holds these bytes. The message was refused, so it was
+            // never delivered and never acked in a way that brings it back — a failed write here is the
+            // evidence gap this unit exists to close, reopened by a disk fault.
+            const level = direction === "sent" ? "warn" : "error";
             this.#logger[level]("transcript.message.record.failed", {
                 sessionId, agentName, sequence, direction,
                 reason: err instanceof Error ? err.message : String(err),
                 correlationId,
                 ...(direction === "received" ? { impact: "content_undeliverable_message_lost" } : {}),
+                ...(direction === "quarantined" ? { impact: "refused_message_not_retained_no_other_copy_exists" } : {}),
             });
             return false;
         }
@@ -2665,7 +3090,7 @@ export class SessionNodeManager {
         if (!this.#db)
             return { messages: [], undecryptable: 0 };
         const rows = this.#db
-            .prepare(`SELECT sequence, direction, blob, created_at FROM transcript
+            .prepare(`SELECT sequence, direction, blob, created_at, quarantine_reason FROM transcript
          WHERE agent_id = ? AND session_id = ? ORDER BY sequence ASC, direction ASC`)
             .all(this.#requireAgentId(agentName), sessionId);
         const messages = [];
@@ -2674,12 +3099,38 @@ export class SessionNodeManager {
         // already read the field.
         for (const r of rows) {
             const blob = r.blob instanceof Uint8Array ? r.blob : new Uint8Array(r.blob);
-            messages.push({
-                sequence: r.sequence,
-                direction: r.direction === "sent" ? "sent" : "received",
-                text: new TextDecoder().decode(blob),
-                createdAt: r.created_at,
-            });
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — THE READ IS REDACTED, THE STORAGE IS NOT.
+             *
+             * The entry stays at its position, because a hole where a message was is the evidence gap
+             * this unit exists to close, one level up: the operator must be able to see that something
+             * arrived here and was refused. What is withheld is the TEXT, and `text` carries the
+             * withholding statement rather than being omitted — every existing renderer of this array
+             * prints `text`, so a missing field would print nothing and an unfiltered one would print the
+             * payload. The statement is the fail-safe value for both.
+             *
+             * ⚠️ THREE-WAY, not `!== "sent" ? "received"`. The old expression labelled anything that was
+             * not `sent` as `received`, which would have handed a refused message to every reader as a
+             * delivered one — with its text.
+             */
+            const direction = r.direction === "sent" ? "sent" : r.direction === "quarantined" ? "quarantined" : "received";
+            if (direction === "quarantined") {
+                // No `?? "refused"` default — review F11. See `readQuarantined` for why a generic label for
+                // an impossible state is worse than an empty one.
+                const reason = r.quarantine_reason;
+                const redaction = quarantineRedaction(reason, sessionId, r.sequence);
+                messages.push({
+                    sequence: r.sequence, direction, createdAt: r.created_at,
+                    text: redaction.text,
+                    // The key ENDS in `guidance` so `vocabulary.ts` rewrites the verb for a CLI reader — see
+                    // the note on `quarantineRedaction`.
+                    withheld_guidance: redaction.guidance,
+                    refusalReason: reason,
+                    withheld: true,
+                });
+                continue;
+            }
+            messages.push({ sequence: r.sequence, direction, text: new TextDecoder().decode(blob), createdAt: r.created_at });
         }
         return { messages, undecryptable: 0 };
     }
@@ -2864,7 +3315,7 @@ export class SessionNodeManager {
     isContact(agentName, pubkey) {
         if (!this.#db)
             return false;
-        const row = this.#db.prepare("SELECT 1 FROM contacts WHERE agent_id = ? AND pubkey = ?").get(this.#requireAgentId(agentName), pubkey);
+        const row = this.#db.prepare("SELECT 1 FROM contacts WHERE agent_id = ? AND pubkey = ?").get(this.#requireAgentId(agentName), normalizeContactPubkey(pubkey));
         return row !== undefined;
     }
     /** DOD-TIER-1: the reachability tier for a counterparty of this agent. The RESULT is total — an
@@ -2881,7 +3332,7 @@ export class SessionNodeManager {
             throw new Error(`getTier('${agentName}'): database not initialized`);
         const row = this.#db
             .prepare("SELECT tier FROM contacts WHERE agent_id = ? AND pubkey = ?")
-            .get(this.#requireAgentId(agentName), pubkey);
+            .get(this.#requireAgentId(agentName), normalizeContactPubkey(pubkey));
         if (row && row.tier !== null && !isKnownTierValue(row.tier)) {
             // A stored tier outside 0..4 is corruption — surface it. normalizeTier still maps it to the
             // tighter UNKNOWN so the caller is safe, but a silent map would hide a broken row.
@@ -2942,6 +3393,9 @@ export class SessionNodeManager {
      *  at first add, exactly as `added_at`/`moniker` already do; re-adding never downgrades a contact
      *  the operator has since promoted. Raising the tier later is `cello_contact_set_tier`'s job. */
     addContact(agentName, pubkey, moniker, provenance, tier = TIER.UNKNOWN) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!pubkey)
             return;
         // Review F1: a missing DB handle must FAIL the write loudly — returning silently here let
@@ -2972,6 +3426,9 @@ export class SessionNodeManager {
      *  when no such contact — fail-loud at the caller, never a silent no-op success. Same
      *  validate-throw backstop as addContact. */
     setContactMoniker(agentName, pubkey, moniker) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         // Review F2: false means exactly "no such contact" — a null DB handle throws instead, so the
         // operator is never sent chasing a nonexistent missing-contact problem.
         if (!this.#db)
@@ -3001,6 +3458,9 @@ export class SessionNodeManager {
      * contact in order to withhold something from them.
      */
     setContactSignalPref(agentName, pubkey, signalHash, present) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             throw new Error(`setContactSignalPref('${agentName}'): database not initialized`);
         const agentId = this.#requireAgentId(agentName);
@@ -3031,6 +3491,9 @@ export class SessionNodeManager {
      * the operator's standing default, never to disclosing something consent has not cleared.
      */
     getContactSignalPrefs(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             return new Map();
         const rows = this.#db
@@ -3041,6 +3504,9 @@ export class SessionNodeManager {
     /** DOD-AWAY-TIER-1: set (or clear, with null) a contact's per-contact away message. Returns false
      *  when no such contact — fail-loud at the caller (same contract as setContactMoniker/setContactTier). */
     setContactAwayMessage(agentName, pubkey, message) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             throw new Error(`setContactAwayMessage('${agentName}'): database not initialized`);
         const res = this.#db
@@ -3054,6 +3520,9 @@ export class SessionNodeManager {
      *  four-level resolution TOTAL. A pure read; the resolved text is screened on the outbound path by
      *  the caller like any content (SI — it does not bypass the gateway). */
     resolveAwayMessage(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             return null;
         const agentId = this.#requireAgentId(agentName);
@@ -3082,6 +3551,9 @@ export class SessionNodeManager {
      *  setContactMoniker). The caller validates the tier is a known constant BEFORE calling; this
      *  stores whatever it is handed (the handler is the validation boundary). */
     setContactTier(agentName, pubkey, tier) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             throw new Error(`setContactTier('${agentName}'): database not initialized`);
         const res = this.#db
@@ -3099,6 +3571,9 @@ export class SessionNodeManager {
      *  (AC5). Limitation: last_offered_moniker updates only on the RECEIVING side of an offer, so rename
      *  detection works only for peers who INITIATE to you — a property, not a bug. */
     recordOfferedMoniker(agentName, pubkey, offered) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         // Fail CLOSED like getTier/setContactTier: a silent skip here would drop a rename baseline update
         // (and any notice) while the daemon reports healthy — the inbound path always has an open DB.
         if (!this.#db)
@@ -3140,6 +3615,9 @@ export class SessionNodeManager {
     /** DOD-RENAME-1: clear a pending rename notice — the operator acted (adopted a name or removed the
      *  contact). Idempotent (no notice → no-op). Fail-closed on a missing DB, like the writes above. */
     clearRenameNotice(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             throw new Error(`clearRenameNotice('${agentName}'): database not initialized`);
         this.#db
@@ -3148,6 +3626,9 @@ export class SessionNodeManager {
     }
     /** M8C-CONTACT-1: known stays known until explicitly removed. */
     removeContact(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db)
             return false;
         const res = this.#db.prepare("DELETE FROM contacts WHERE agent_id = ? AND pubkey = ?").run(this.#requireAgentId(agentName), pubkey);
@@ -3206,6 +3687,9 @@ export class SessionNodeManager {
     /** MONIKER-4: the operator's pet name for a pubkey (whoLabel's top tier), or null. Read-only
      *  and tolerant of a not-yet-open DB (a missing label degrades the doorbell, never blocks it). */
     getContactMoniker(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
         if (!this.#db) {
             // Review F2: the last fully-silent branch in the resolution chain — the label degrades to
             // fingerprint, which is correct, but say so rather than returning null wordlessly.
@@ -3236,15 +3720,242 @@ export class SessionNodeManager {
          ORDER BY c.added_at ASC`)
             .all(this.#requireAgentId(agentName));
     }
-    /** M8C-ABUSE-1: cumulative RECEIVED byte total for a session (anti-drip-feed accounting). */
+    /**
+     * M8C-ABUSE-1: cumulative inbound byte total for a session (anti-drip-feed accounting).
+     *
+     * ⚠️ DOD-M15-REFUSEDEVIDENCE-1 — QUARANTINED BYTES COUNT, and the bound depends on it.
+     *
+     * Retaining refused messages puts real bytes on the operator's disk. Left out of this sum,
+     * retention would be an UNBOUNDED SIDE CHANNEL: a counterparty who can get messages refused —
+     * anyone who can trip the screener, which is anyone — stores against a budget that cannot see
+     * what they spent. Counting them makes total retention per session bounded by the same tier cap
+     * that bounds delivery, which is the bound the unit's no-truncation rule rests on.
+     *
+     * No new capability reaches an attacker from this: the counterparty already spends the session's
+     * byte budget by sending ordinary messages. Spending it with refused ones costs them the same.
+     */
     #getReceivedBytesTotal(agentName, sessionId) {
         if (!this.#db)
             return 0;
         const row = this.#db
-            .prepare("SELECT COALESCE(SUM(LENGTH(blob)), 0) AS total FROM transcript WHERE agent_id = ? AND session_id = ? AND direction = 'received'")
+            .prepare("SELECT COALESCE(SUM(LENGTH(blob)), 0) AS total FROM transcript WHERE agent_id = ? AND session_id = ? AND direction IN ('received','quarantined')")
             .get(this.#requireAgentId(agentName), sessionId);
         return row.total;
     }
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1 — RETAIN a message that was refused. Retention is universal; DELIVERY
+     * is what is withheld.
+     *
+     * Every refusal path that can store calls this. It writes the plaintext, the sender's key, the
+     * sender's signature and the refusal reason into the transcript, flagged `'quarantined'` so it is
+     * excluded by construction from delivery and from unread counts.
+     *
+     * ⚠️ STORING HOSTILE CONTENT IS SAFE; INTERPOLATING IT IS NOT. The blob is a bound parameter and
+     * the database never parses it — SQL injection is not the risk here and must not be defended
+     * against. The risk is on the way OUT, so nothing below puts `content` into a log line, an error
+     * message or a path. The log carries the length and the hash.
+     *
+     * Returns the sequence it was stored at, or `null` when it was not stored — which happens only for
+     * a reason the caller is expected to log.
+     */
+    #quarantineRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts) {
+        const sequence = this.#retainRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — **THE FUNNEL, and the reason it lives here.**
+         *
+         * Every refusal that retains evidence passes through this method carrying its reason and its
+         * content hash, so this is the one place where "which reasons stop the work" can be a LIST
+         * rather than a decision copied into seven branches. `TERMINAL_REFUSAL_REASONS` decides; the
+         * six other reasons that reach here — a hash mismatch, an unreadable algorithm, a missing salt,
+         * an unresolved sender, an orphaned session, a terminal screen block — all keep retrying, and
+         * each of them can succeed on a later attempt.
+         *
+         * AFTER the retention, deliberately: the evidence has to exist before anything stops going to
+         * look for the message.
+         */
+        this.#considerTerminalRefusal(agentName, sessionId, contentHashHex, reason);
+        return sequence;
+    }
+    /** DOD-M15-REFUSEDEVIDENCE-1: the retention itself. Reached only through the funnel above. */
+    #retainRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts) {
+        if (!this.#db)
+            return null;
+        try {
+            const agentId = this.#requireAgentId(agentName);
+            /**
+             * ⚠️ **DEDUP FIRST — review F1, and without it retention KILLS THE CONVERSATION IT PROTECTS.**
+             *
+             * Six of the seven retaining exits refuse WITHOUT ACKNOWLEDGING, which is exactly what makes
+             * the sender's daemon redeliver. Each redelivery re-enters here, above the leaf dedup, and
+             * would take a fresh negative sequence — another full copy of the same bytes. The park drain's
+             * own comment measures that loop at *"~120 repeats per message, forever"*.
+             *
+             * **And retained bytes spend the delivery budget** (`#getReceivedBytesTotal` counts them, which
+             * is what makes the bound honest). So a counterparty on a newer build sends ONE message, the
+             * version skew refuses it un-acked, and twenty-five drains later the conversation's 25 MB is
+             * gone — permanently, because the cap does not reset. Honest traffic then hits
+             * `session_size_limit_exceeded` and the daemon tells the operator to start a new conversation.
+             *
+             * The counterbalance, stated properly this time: **evidence and delivery share one monotonic
+             * budget, and when evidence wins the conversation stops working.** Entry 69 claimed there was
+             * nothing to trade off, and this is what that claim was hiding.
+             *
+             * Keyed on (session, reason, bytes) rather than a hash column: SQLite compares BLOBs directly
+             * and short-circuits on length, the candidate set is one session's refusals, and it needs no
+             * schema change. Same bytes refused the same way is ONE piece of evidence — how many times it
+             * arrived is already counted by the refusal notice. The same bytes refused for a DIFFERENT
+             * reason is a different fact and keeps its own row.
+             */
+            const already = this.#db
+                .prepare(`SELECT sequence FROM transcript
+           WHERE agent_id = ? AND session_id = ? AND direction = 'quarantined'
+             AND quarantine_reason = ? AND blob = ?`)
+                .get(agentId, sessionId, reason, Buffer.from(content));
+            if (already) {
+                this.#logger.debug("session.content.quarantine.duplicate", {
+                    agentName, sessionId, reason, sequence: already.sequence,
+                    contentHash: contentHashHex, correlationId: opts.correlationId,
+                });
+                return already.sequence;
+            }
+            /**
+             * THE BOUND. A session at its byte cap retains no more.
+             *
+             * `senderPubkeyHex` is absent exactly when there is no session row or no counterparty
+             * (`session_orphaned`, `sender_unresolved`), so there is no contact to look a tier up on. Those
+             * take the UNKNOWN tier — the tightest bound, and the right one for a sender we cannot name.
+             */
+            const tier = opts.senderPubkeyHex ? this.getTier(agentName, opts.senderPubkeyHex) : TIER.UNKNOWN;
+            const cap = this.resolveTierBound(agentName, tier, "max_bytes");
+            const prior = this.#getReceivedBytesTotal(agentName, sessionId);
+            if (prior + content.length > cap) {
+                this.#logger.warn("session.content.quarantine.skipped", {
+                    agentName, sessionId, reason, contentHash: contentHashHex,
+                    bytes: content.length, prior, cap, tier,
+                    correlationId: opts.correlationId,
+                    skipped: "byte_budget_exhausted",
+                    impact: "this refused message was NOT retained: the conversation has already spent its storage budget, so there is no evidence of it beyond this line and the refusal notice.",
+                });
+                return null;
+            }
+            /**
+             * WHERE IT SITS.
+             *
+             * A screener block already leafed at its canonical position, and the quarantine row takes that
+             * same sequence so the leaf and the evidence describe one event — DoD 7's leaf index is
+             * untouched by this unit.
+             *
+             * A refusal with NO leaf takes the next NEGATIVE sequence for the session. A leaf position is
+             * never negative, so the two spaces cannot collide, and descending from −1 means two refusals
+             * cannot overwrite each other. This is what lets `session_orphaned` — a session id with no
+             * `sessions` row at all — live in the same table as everything else, which is the whole point
+             * of one store rather than two.
+             */
+            let sequence = opts.canonicalSeq;
+            if (sequence === undefined || sequence < 0) {
+                const low = this.#db
+                    .prepare("SELECT MIN(sequence) AS lo FROM transcript WHERE agent_id = ? AND session_id = ? AND direction = 'quarantined'")
+                    .get(agentId, sessionId);
+                sequence = Math.min(low.lo ?? 0, 0) - 1;
+            }
+            const stored = this.recordTranscriptMessage(agentName, sessionId, sequence, "quarantined", content, opts.correlationId, opts.authorship, reason, opts.senderPubkeyHex ?? null);
+            if (!stored)
+                return null;
+            this.#logger.info("session.content.quarantined", {
+                agentName, sessionId, reason, sequence,
+                contentHash: contentHashHex, bytes: content.length,
+                signature: opts.authorship ? "verified" : "none",
+                correlationId: opts.correlationId,
+            });
+            return sequence;
+        }
+        catch (err) {
+            this.#logger.error("session.content.quarantine.failed", {
+                agentName, sessionId, reason, contentHash: contentHashHex,
+                error: extractErrorMessage(err),
+                impact: "a refused message could not be retained, so nothing holds a copy of it — it cannot be shown to anyone or reported.",
+            });
+            return null;
+        }
+    }
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1 — retain a message refused OUTSIDE `ingestReceivedContent`.
+     *
+     * Review F6. The park drain terminally-blocks a message that arrived for an already-committed
+     * session, then confirm-deletes the relay copy — the one other route in the tree that discarded
+     * refused content, and the highest-suspicion combination in the product: hostile bytes aimed at a
+     * conversation somebody has already sealed. Shipped guidance now tells every operator that
+     * refused messages are kept, so this is made true rather than the promise narrowed.
+     *
+     * A thin delegate, not a second implementation: the bound, the dedup, the sequence allocation and
+     * the logging are the ones every other refusal uses.
+     */
+    quarantineRefusedInbound(agentName, sessionId, reason, content, contentHashHex, senderPubkeyHex, correlationId) {
+        return this.#quarantineRefusedContent(agentName, sessionId, reason, content, contentHashHex, {
+            senderPubkeyHex, correlationId,
+        });
+    }
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1: read retained refused messages back — all of a session's, or the one
+     * at `sequence`.
+     *
+     * Returns the RAW payload. Every caller that hands it to a reader must frame it first
+     * (`frameQuarantinedPayload`); nothing else in the tree may read this without doing so.
+     */
+    readQuarantined(agentName, sessionId, sequence) {
+        if (!this.#db)
+            return [];
+        const rows = this.#db
+            .prepare(`SELECT sequence, blob, created_at, sender_pubkey, sender_sig, attribution, quarantine_reason
+         FROM transcript
+         WHERE agent_id = ? AND session_id = ? AND direction = 'quarantined'
+           ${sequence === undefined ? "" : "AND sequence = ?"}
+         ORDER BY sequence ASC`)
+            .all(...(sequence === undefined
+            ? [this.#requireAgentId(agentName), sessionId]
+            : [this.#requireAgentId(agentName), sessionId, sequence]));
+        return rows.map((r) => ({
+            sequence: r.sequence,
+            /**
+             * ⚠️ NOT `?? "refused"` — review F11. A generic default here is a label for a state that
+             * cannot occur: the column exists before any `'quarantined'` row can be written and
+             * `#quarantineRefusedContent` always supplies a reason. A default reads to the next maintainer
+             * as a supported case and would quietly stand in for a real bug. If a NULL ever appears, the
+             * empty reason travels to the frame and the caller, which is loud enough to chase.
+             */
+            reason: r.quarantine_reason,
+            content: r.blob instanceof Uint8Array ? r.blob : new Uint8Array(r.blob),
+            senderPubkeyHex: r.sender_pubkey,
+            senderSig: r.sender_sig === null ? null : (r.sender_sig instanceof Uint8Array ? r.sender_sig : new Uint8Array(r.sender_sig)),
+            attribution: r.attribution,
+            createdAt: r.created_at,
+        }));
+    }
+    /** The metadata half of a framed quarantine read — everything known ABOUT the message, none of it
+     *  taken from the message. Split out so the framing module never touches the database. */
+    quarantineFrameMeta(agentName, sessionId, rec) {
+        return {
+            reason: rec.reason,
+            senderPubkeyHex: rec.senderPubkeyHex,
+            senderLabel: rec.senderPubkeyHex === null ? null : this.getContactMoniker(agentName, rec.senderPubkeyHex),
+            // `attribution` is the column that exists to answer exactly this, so it is read rather than
+            // inferred from `sender_sig` being non-null — a stored signature that was never checked
+            // against the sender's key would otherwise be reported as VERIFIED.
+            signature: rec.attribution === "verified_signature" ? "VERIFIED" : "NOT SIGNED",
+            sessionId,
+            position: rec.sequence,
+            arrivedAtMs: rec.createdAt,
+            /**
+             * The hash OF THE RETAINED BYTES, recomputed here — not the hash the sender committed to.
+             *
+             * On the highest-value case in the whole unit those two differ ON PURPOSE:
+             * `content_hash_mismatch` means the sender's committed hash does not describe these bytes.
+             * Printing their claim over our bytes would label the payload with a hash it does not have,
+             * which is the one thing a reader would use this line to check.
+             */
+            contentHashHex: Buffer.from(contentHashFor(rec.content, { alg: "sha256", salt: null })).toString("hex"),
+        };
+    }
     /** M8C-ABUSE-1 (reviewer HIGH fix, D18): bytes currently sitting in the out-of-order hold
      *  buffer for this session — NOT yet committed leaves, but real bytes in memory that would
      *  otherwise let multiple held chunks each individually pass the size gate while cumulatively
@@ -3679,6 +4390,21 @@ export class SessionNodeManager {
     #k(agentName, sessionId) {
         return `${agentName}\x1f${sessionId}`;
     }
+    /**
+     * The inverse of `#k`, for the ONE reader that has a key and needs the session id back: the
+     * unpersisted-refusal fallback, which is keyed like every other per-session map but is drained
+     * per AGENT rather than per session.
+     *
+     * Returns null when the key belongs to a different agent. Split on the FIRST separator only —
+     * `agentName` cannot contain 0x1f, so anything after the first one is the session id, and a
+     * greedy split would silently mis-attribute a key rather than reject it.
+     */
+    #unk(key, agentName) {
+        const sep = key.indexOf("\x1f");
+        if (sep < 0)
+            return null;
+        return key.slice(0, sep) === agentName ? key.slice(sep + 1) : null;
+    }
     /**
      * DOD-AGENT-ID-JOINKEY-1: resolve an agent's NAME to its STABLE agent_id. This is the ONE place a
      * name becomes a key, and it is the boundary between the two worlds:
@@ -3944,22 +4670,26 @@ export class SessionNodeManager {
             });
             // DOD-MSG-4 (strict in-order): record the relay-witnessed canonical sequence for the
             // counterparty's MSG leaves. The relay is the ordering authority; structure1_cbor =
-            // [1, content_hash(32), sender_pubkey, session_id, last_seen_seq, ts]. The relay sequence
+            // [version, content_hash(32), sender_pubkey, session_id, last_seen_seq, ts] (+ last_seen_hash
+            // at index 6 on a v2 claim — 020-ACKHASH; content_hash stays at 1). The relay sequence
             // is 1-based and global per session; the daemon tree is 0-based — normalize with -1. Only
             // COUNTERPARTY leaves (the ones B will ingest); our own echoed leaf already lands via the
             // send path. The gate (ingestReceivedContent) reads this map to hold out-of-order arrivals.
             if (!frame.authored_by_us && frame.leaf_kind !== LEAF_KIND_CTRL) {
-                try {
-                    const s1 = decode(frame.structure1_cbor);
-                    const contentHash = s1?.[1];
-                    if (contentHash instanceof Uint8Array && frame.sequence_number > 0) {
-                        this.recordWitnessedSequence(agentName, sessionId, Buffer.from(contentHash).toString("hex"), frame.sequence_number - 1);
+                const s1 = decodeStructure1(frame.structure1_cbor);
+                if (s1.ok) {
+                    if (frame.sequence_number > 0) {
+                        this.recordWitnessedSequence(agentName, sessionId, Buffer.from(s1.fields.contentHash).toString("hex"), frame.sequence_number - 1);
                     }
                 }
-                catch (err) {
+                else {
+                    // `structure1Reason`, not `error` — review F6. This is a named refusal code, and putting
+                    // it in a field called `error` reads as an exception message to anyone scanning logs.
+                    // The old `try` here also wrapped `recordWitnessedSequence`, so a throw from THAT was
+                    // reported as a decode failure; the decode no longer throws, and the split is deliberate.
                     this.#logger.warn("session.relay.leaf.witness.decode.failed", {
                         sessionId,
-                        error: err instanceof Error ? err.message : String(err),
+                        structure1Reason: s1.reason,
                         correlationId,
                     });
                 }
@@ -4476,6 +5206,38 @@ export class SessionNodeManager {
         if (!current)
             return;
         this.#impairmentCause.set(key, { cause: current.cause, retained });
+        /**
+         * ─── DOD-M15-NO-SILENT-REFUSAL-1: the notice fires HERE, and ONLY on `lost` ─────────────────
+         *
+         * ⚠️ **THE FIRST VERSION WROTE IT ON THE IMPAIRMENT TRANSITION, WHICH IS A SUCCESS PATH.**
+         *
+         * A direct send failing is the ORDINARY case when a counterparty is offline: the message is
+         * then parked with the relay and handed over when they come back, which is the leave-a-message
+         * feature working exactly as designed. Writing a notice at that moment told the operator "a
+         * message this side sent did not reach the counterparty" about a message that was in flight and
+         * would arrive — while `cello_send` was simultaneously telling them it was parked. Two surfaces,
+         * opposite stories, same message.
+         *
+         * By this line the outcome is known, and only one of the three is the operator's problem:
+         *   - `parked`   — with the relay, delivered when they come back. Nothing to tell.
+         *   - `durable`  — queued here, re-sent automatically. Nothing to tell.
+         *   - `lost`     — it could not be queued anywhere. It is gone, and only a resend recovers it.
+         *
+         * A FAILED ACK takes none of these branches (it never reaches this method), and that is correct:
+         * an acknowledgement this side owed them going missing costs the counterparty a redelivery, not
+         * the operator a message.
+         *
+         * NOT retracted when the connection recovers, unlike the impairment state it rides on: a
+         * recovered connection does not un-lose a message. That is also why the count is meaningful —
+         * it is the number of messages lost in this conversation, and it only ever grows.
+         */
+        if (retained !== "lost")
+            return;
+        this.noteContentRefusal(agentName, sessionId, "outbound_message_lost", {
+            kind: REFUSAL_KINDS.OUTBOUND,
+            impact: "a message you sent could not be delivered and could not be saved to send later, so it is gone. Nothing was added to the conversation and the other person never saw it. Everything you sent before it is unaffected.",
+            guidance: "Send it again. This is the one case where resending is right — there is no copy of it anywhere, so nothing will deliver it for you. If it keeps happening, the connection to this person is not working: check cello_status for this conversation before sending anything long.",
+        });
     }
     /** DOD-M12B-ACK-1: why this session is impaired, for the surface that has to explain it. Null
      *  when it is not impaired — a caller must not narrate a failure that is not current. */
@@ -4859,11 +5621,36 @@ export class SessionNodeManager {
         this.#sessionLiveness.delete(key);
         // M7-UPGRADE-002: drop the auto-acknowledge bookkeeping for a torn-down session.
         this.#contentDesynced.delete(key);
-        // DOD-M15-REFUSED-INBOUND-SILENT-1: and the unshown refusals. Bounded (a fixed set of reasons
-        // per session) so leaving them was a slow leak rather than a bug — but this list IS the
-        // documented teardown set, and a map that is not in it drifts out of everyone's mental model.
-        this.#contentRefusals.delete(key);
+        /**
+         * DOD-M15-NO-SILENT-REFUSAL-1 review N2: the UNPERSISTED half IS torn down, and only that half.
+         *
+         * `#refusalFallback` is in memory and restores exactly what the deleted Map did, so it belongs
+         * in the teardown set exactly as that Map did. Leaving it out meant a daemon that could not
+         * write to disk — already in trouble — grew without bound in memory as well. The durable rows
+         * stay, for the reason below.
+         */
+        this.#refusalFallback.delete(key);
+        // DOD-M15-NO-SILENT-REFUSAL-1: the DURABLE notices are NOT torn down here, and the omission is
+        // deliberate — this list is the documented teardown set, so anything absent from it needs a
+        // reason. They live in `content_refusal_notices`, keyed on agent_id + session_id, and the
+        // question they answer ("why did that person stop replying?") is one an operator asks AFTER a
+        // session ends, most sharply for `session_committed` — a refusal that exists only because the
+        // session was already sealed. Dropping them at seal would delete exactly the ones a sealed
+        // session produces. Growth is one row per (session, reason), i.e. proportional to `sessions`.
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 review F7 — named because this list is the documented teardown set.
+         *
+         * `#terminallyRefused` and `#terminalRefusalsLoaded` are a READ CACHE over
+         * `terminal_content_refusals` and are dropped here with everything else in-memory; the durable
+         * rows stay, for the same reason the notices do — the question they answer outlives the
+         * session, and a fresh check reloads them on demand. `#terminalRefusalsReadFailedAt` goes too,
+         * so a torn-down session's back-off does not delay the first read after it is revived.
+         */
+        this.#terminallyRefused.delete(key);
+        this.#terminalRefusalsLoaded.delete(key);
+        this.#terminalRefusalsReadFailedAt.delete(key);
         this.#unreadableAlgSeen.delete(key);
+        this.#refusedOnDirectPath.delete(key);
         this.#responderSealSubmitted.delete(key);
         // DOD-MSG-4: drop the strict-in-order bookkeeping (witness map, held plaintext, high-water)
         // so a torn-down session retains no stale ordering state or buffered plaintext.
@@ -6644,6 +7431,12 @@ export class SessionNodeManager {
         // the leaf_deliver witness stream / arrival order.
         let orderingS1;
         let orderingS2;
+        /**
+         * `DOD-M15-AUTHORSHIP-ABSENT-1`: the sender's signature over `orderingS1`, when the relay
+         * witnessed this leaf. Undefined when it did not — and the frame builder below then signs a
+         * Structure 1 of its own rather than shipping a frame with nothing to check.
+         */
+        let orderingSig;
         /**
          * DOD-M15-SEALWIRE-1 bullet 5, SENT half. Our own Ed25519 signature over `orderingS1`.
          *
@@ -6672,6 +7465,11 @@ export class SessionNodeManager {
                 if (witnessed.ok) {
                     orderingS1 = witnessed.structure1_cbor;
                     orderingS2 = witnessed.structure2_cbor;
+                    // `DOD-M15-AUTHORSHIP-ABSENT-1`: the signature that goes ON THE FRAME beside `orderingS1`.
+                    // Captured here, next to the bytes it signs, because a signature assigned anywhere else
+                    // could end up beside a different Structure 1 — a proof next to the wrong signed bytes is
+                    // worse than no proof, since it looks checkable and fails.
+                    orderingSig = witnessed.sender_signature;
                     /**
                      * PAIRED WITH THE BYTES IT SIGNS, in one place, so the two can never be assigned apart.
                      *
@@ -6691,8 +7489,10 @@ export class SessionNodeManager {
                          * tell "the relay never witnessed this" from "we witnessed it, held the proof, and
                          * dropped it decoding our own bytes."
                          *
-                         * And the asymmetry with the received half is the argument. `#recordFrameOrdering` is
-                         * soft because the COUNTERPARTY supplied those bytes — an absence we cannot resolve.
+                         * And the asymmetry with the received half is the argument. The received half is soft
+                         * about a missing ORDERING record (`#recordFrameOrdering`) because the COUNTERPARTY
+                         * supplied those bytes — an absence we cannot resolve. It is not soft about a missing
+                         * authorship proof any more; `DOD-M15-AUTHORSHIP-ABSENT-1` refuses that outright.
                          * Here **we produced them**, in `session-relay-client.ts`, moments earlier. A failure
                          * means our own encoder and decoder disagree: an internal invariant break that would
                          * strip authorship from every sent row for the life of the process. Soft is still right
@@ -6718,10 +7518,14 @@ export class SessionNodeManager {
                             });
                         };
                         try {
-                            // Structure 1 = [1, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp]
-                            // — the same decode `#recordFrameOrdering` does for the received half, index 2.
-                            const s1 = decode(witnessed.structure1_cbor);
-                            const pk = s1[2];
+                            // Structure 1 = [version, content_hash, sender_pubkey, session_id, last_seen_seq,
+                            // timestamp] (+ last_seen_hash at 6 on a v2 claim — 020-ACKHASH). The sender pubkey is
+                            // index 2 in both; the same read `#recordFrameOrdering` does for the received half.
+                            const s1Decoded = decodeStructure1(witnessed.structure1_cbor);
+                            // NAMED AT ITS CAUSE. A failed decode falling through to the shape check below would
+                            // report `pubkey_shape` for bytes that never yielded a pubkey at all, sending the next
+                            // reader to audit a key when the layout is what disagreed.
+                            const pk = s1Decoded.ok ? s1Decoded.fields.senderPubkey : undefined;
                             // The SIGNATURE is length-checked too (review F2): the guard checked the pubkey's 32
                             // bytes and only truthiness on the signature, so a zero-length one would have stored an
                             // uncheckable BLOB. Not reachable today — `sign()` returns 64 — and the asymmetry is
@@ -6737,7 +7541,7 @@ export class SessionNodeManager {
                              * two different submits would all have been persisted as a row that **looks checkable
                              * to an auditor and fails** — strictly worse than the honest unproven row it replaced.
                              *
-                             * The received half has always done this (`#recordFrameOrdering` verifies before
+                             * The received half has always done this (`#verifyAuthorshipClaim` verifies before
                              * storing and treats a failure as fatal). The sent half did not, and every ingredient
                              * was already in scope on this line.
                              *
@@ -6750,7 +7554,10 @@ export class SessionNodeManager {
                              * identity problem. Here it means our own encoder and decoder disagree — bad, but it
                              * must not cost the operator a delivered message.
                              */
-                            if (!(pk instanceof Uint8Array) || pk.length !== 32) {
+                            if (!s1Decoded.ok) {
+                                dropAuthorship("structure1_decode_failed", undefined, { structure1Reason: s1Decoded.reason });
+                            }
+                            else if (!(pk instanceof Uint8Array) || pk.length !== 32) {
                                 dropAuthorship("pubkey_shape", undefined, { pubkeyLen: pk instanceof Uint8Array ? pk.length : -1 });
                             }
                             else if (witnessed.sender_signature.length !== 64) {
@@ -6764,7 +7571,11 @@ export class SessionNodeManager {
                             }
                         }
                         catch (err) {
-                            dropAuthorship("structure1_decode_failed", err);
+                            // NOT a decode failure — review F3. `decodeStructure1` never throws and its failure is
+                            // handled as the first branch above, with its own reason. What can still throw in here
+                            // is `verify()` and the Buffer work, so this names that instead of sending the reader
+                            // to audit a CBOR layout that decoded fine.
+                            dropAuthorship("authorship_verify_threw", err);
                         }
                     }
                     // 1-BASED → 0-BASED. The relay numbers the first leaf of a session 1
@@ -6898,6 +7709,72 @@ export class SessionNodeManager {
         // connection). See the note on #handleContentStream's finally.
         let sendStream;
         try {
+            /**
+             * ─── EVERY FRAME CARRIES ITS OWN PROOF — `DOD-M15-AUTHORSHIP-ABSENT-1` ────────────────────
+             *
+             * Structure 1 used to be built and signed INSIDE the relay submit, so a send the relay never
+             * witnessed put a frame on the wire with nothing on it to check — and the receiver, having no
+             * proof to compare, ingested it and attributed it anyway. There was always something to sign;
+             * nobody signed it.
+             *
+             * ⚠️ `structure2_cbor` IS DROPPED WHEN WE BUILD OUR OWN, and that pairing is load-bearing. The
+             * relay's record commits its copy of the sender's signature to the EXACT Structure 1 that was
+             * submitted; put it beside a Structure 1 built here (different timestamp, different
+             * last_seen_seq) and the receiver's cross-check fails against bytes that were never altered —
+             * a freeze on an honest message. The two travel together or the relay's half does not travel.
+             *
+             * ⚠️ SIGNED HERE, BEFORE THE SESSION KEY IS READ, and the order is load-bearing rather than
+             * tidy. `sessionKey` below is read once and used to seal the body several `await`s later; a
+             * key agreed with the counterparty inside that window leaves this side sealing under the key
+             * it captured while the far side has already moved on, and every message is refused as
+             * `decrypt_failed`. Signing costs two awaits, and putting them between the read and the seal
+             * widened that window enough to break the live two-node round trip. Measured, not reasoned
+             * about: seam-3 went red and both daemons logged `session.key.agreed` before the refusal.
+             */
+            let frameS1 = orderingS1;
+            let frameSig = orderingSig;
+            let frameS2 = orderingS2;
+            if (frameS1 === undefined || frameSig === undefined) {
+                const own = await this.#signOwnContentClaim(agentName, sessionId, entry, contentHash);
+                frameS1 = own.structure1;
+                frameSig = own.signature;
+                frameS2 = undefined;
+                /**
+                 * ⚠️ **AND OUR OWN TRANSCRIPT ROW GETS THE PROOF TOO** — review M3.
+                 *
+                 * `sentAuthorship` is set above only when the relay witnessed the leaf, because that was
+                 * the only path that ever produced a signature. This path produces one — and dropping it
+                 * here would leave the counterparty's transcript able to prove we wrote the message while
+                 * ours recorded `self_authored` with a NULL signature. That is exactly the half-provable
+                 * transcript `DOD-M15-SEALWIRE-1` bullet 5 exists to close, reappearing on the one path
+                 * that had no proof to lose before this unit and has one now.
+                 *
+                 * VERIFIED BEFORE IT IS STORED, the same discipline as the witnessed path: the pubkey comes
+                 * from INSIDE the bytes we signed, never from an agent lookup, and a pair that does not
+                 * verify is dropped loudly rather than persisted as a row that looks checkable and fails.
+                 * A failure here means this daemon's own encoder and decoder disagree.
+                 */
+                const s1Decoded = decodeStructure1(own.structure1);
+                const pk = s1Decoded.ok ? s1Decoded.fields.senderPubkey : undefined;
+                if (!s1Decoded.ok) {
+                    this.#logger.warn("session.sent.authorship.unavailable", {
+                        agentName, sessionId, correlationId, reason: "own_structure1_decode_failed",
+                        structure1Reason: s1Decoded.reason,
+                        impact: "this sent message is recorded with attribution 'self_authored' and NO signature, so the row asserts its author rather than proving one — even though this side signed the claim it put on the wire.",
+                        guidance: "We produced these bytes ourselves moments ago, so a decode failure here means this daemon's own encoder and decoder disagree. Treat it as an internal invariant break, not a peer problem.",
+                    });
+                }
+                else if (!verify(pk, own.structure1, own.signature)) {
+                    this.#logger.warn("session.sent.authorship.unavailable", {
+                        agentName, sessionId, correlationId, reason: "own_pair_does_not_verify",
+                        impact: "this sent message is recorded with attribution 'self_authored' and NO signature. The signature this side just produced does not verify against the key inside the bytes it signed.",
+                        guidance: "An internal invariant break: the signer and the encoder disagree. The message still went out; only the local proof was dropped.",
+                    });
+                }
+                else {
+                    sentAuthorship = { senderPubkey: pk, senderSig: own.signature };
+                }
+            }
             /**
              * 🚨 NO KEY, NO DIRECT SEND — `DOD-M15-EPHEMERAL-AUTH-1`, and there is no plaintext fallback.
              *
@@ -6909,11 +7786,12 @@ export class SessionNodeManager {
              * frame and a system that "carries on, degraded" gives up the body while the operator reads a
              * warning they have learned to scroll past. That is why this is a throw and not a warning.
              */
-            const encState = this.#contentEncryptionState(agentName, sessionId);
-            if (encState.key === null) {
-                throw new Error(`content_not_encryptable: ${encState.reason} — ${CONTENT_ENCRYPTION_GUIDANCE[encState.reason]}`);
+            // FAIL FAST, before a stream is opened for a message that cannot go out. The key this reads is
+            // NOT the one that seals the body — see the read beside `sealSessionContent` below.
+            const preflight = this.#contentEncryptionState(agentName, sessionId);
+            if (preflight.key === null) {
+                throw new Error(`content_not_encryptable: ${preflight.reason} — ${CONTENT_ENCRYPTION_GUIDANCE[preflight.reason]}`);
             }
-            const sessionKey = encState.key;
             const stream = await this.#openContentStream(agentName, sessionId, entry, correlationId);
             sendStream = stream;
             // AC-001/AC-003: arm the TTF tracking BEFORE the frame goes on the wire. The
@@ -6940,8 +7818,36 @@ export class SessionNodeManager {
              * THE WIRE COPY. `content_hash` above was computed over the PLAINTEXT and stays that way: the
              * transcript, the seal and the salted hash all depend on it meaning what it means today, and
              * the receiver decrypts before it verifies.
+             *
+             * ⚠️ **THE KEY IS READ HERE, ADJACENT TO THE SEAL, AND IT USED TO BE READ FAR ABOVE.**
+             *
+             * The read sat before `#openContentStream`, so the captured key crossed an `await` — several,
+             * once this unit added signing — before it sealed anything. A session key agreed with the
+             * counterparty inside that window left this side sealing under the key it captured while the
+             * far side had already moved on, and **every message was then refused as `decrypt_failed`**:
+             * a false tamper report on honest content, on both sides, for the life of the session.
+             *
+             * Not theoretical. It is what reddened four live-libp2p fixtures when identity keys were first
+             * wired into them — both daemons logged `session.key.agreed`, and the refusal followed.
+             *
+             * A window cannot be closed by reasoning about who wins it, only by removing it: nothing may
+             * run between the read and the seal. The preflight above stays because failing before a stream
+             * is opened is worth one extra read.
+             *
+             * ⚠️ THIS CLOSES THE LOCAL WINDOW AND NOT THE CLASS (review F8). The sender still seals at T
+             * and the receiver still decrypts at T+flight, so a re-key landing in THAT interval produces
+             * the same false tamper report. What is removed is the part this side controls; the rest is a
+             * property of there being two machines.
              */
-            const wireBody = sealSessionContent(sessionKey, content);
+            const sealState = this.#contentEncryptionState(agentName, sessionId);
+            if (sealState.key === null) {
+                // Reachable only if the key vanished between the preflight and here — a re-key or a
+                // teardown mid-send. Named as its own cause rather than reusing the preflight's, so a log
+                // reader can tell "never had one" from "had one and lost it while sending".
+                throw new Error(`content_not_encryptable: ${sealState.reason} — the key was present when this send began ` +
+                    `and gone by the time it sealed. ${CONTENT_ENCRYPTION_GUIDANCE[sealState.reason]}`);
+            }
+            const wireBody = sealSessionContent(sealState.key, content);
             const frame = encodeCbor({
                 type: "content_frame",
                 session_id: sessionId,
@@ -6954,9 +7860,12 @@ export class SessionNodeManager {
                 // DOD-MSG-4 (self-ordering): the relay's signed ordering record, so the receiver verifies +
                 // orders from the frame ALONE (no dependence on the separate leaf_deliver witness timing).
                 // structure1_cbor = sender-signed bytes (verify); structure2_cbor = relay's committed seq +
-                // prev_root (order). Omitted if the relay was unreachable — receiver falls back to the witness.
-                structure1_cbor: orderingS1,
-                structure2_cbor: orderingS2,
+                // prev_root (order). Structure 2 is omitted if the relay was unreachable — the receiver
+                // falls back to the witness stream for POSITION. Structure 1 and its signature are never
+                // omitted: `DOD-M15-AUTHORSHIP-ABSENT-1`, and a frame without them is refused on arrival.
+                structure1_cbor: frameS1,
+                sender_signature: frameSig,
+                structure2_cbor: frameS2,
                 // DOD-M15-SEALWIRE-1 part B2b: HOW `content_hash` was produced. An older peer ignores an
                 // unknown CBOR key, so emitting it is safe for every build in existence; a newer one reads
                 // it and verifies under the named algorithm instead of assuming.
@@ -6988,7 +7897,17 @@ export class SessionNodeManager {
             return { ok: true, delivered: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
         }
         catch (err) {
-            this.#markSessionImpaired(agentName, sessionId, { cause: "direct_send", error: err instanceof Error ? err.message : String(err), correlationId });
+            /**
+             * Review F7: a content-key fault is NOT a transport fault, and labelling it `direct_send`
+             * points the operator at the connection when the connection is fine. `content_not_encryptable`
+             * is thrown twice above — once before the stream is opened, once at the seal — and both are
+             * about this machine's key state.
+             */
+            const failure = err instanceof Error ? err.message : String(err);
+            this.#markSessionImpaired(agentName, sessionId, {
+                cause: failure.startsWith("content_not_encryptable") ? "content_key" : "direct_send",
+                error: failure, correlationId,
+            });
             if (sendStream !== undefined) {
                 try {
                     sendStream.abort(err instanceof Error ? err : new Error(String(err)));
@@ -7568,15 +8487,39 @@ export class SessionNodeManager {
         byHash.set(Buffer.from(contentHash).toString("hex"), declaredAlg);
     }
     /**
-     * ─── DOD-M15-REFUSED-INBOUND-SILENT-1: refusals the RECEIVING operator can actually see ───────
+     * Remember that THIS frame was refused for carrying no usable proof of who wrote it, so the park
+     * path can say so when the same content arrives through the relay mailbox — review H1.
+     *
+     * Bounded for the same reason and by the same cap as `#noteUnreadableAlgFrame`: a peer sending
+     * unprovable frames feeds this map, so it drops the oldest rather than growing.
+     */
+    #noteRefusedOnDirectPath(agentName, sessionId, contentHash) {
+        const key = this.#k(agentName, sessionId);
+        let hashes = this.#refusedOnDirectPath.get(key);
+        if (!hashes) {
+            hashes = new Set();
+            this.#refusedOnDirectPath.set(key, hashes);
+        }
+        if (hashes.size >= MAX_UNREADABLE_ALG_FRAMES) {
+            const oldest = hashes.values().next();
+            if (!oldest.done)
+                hashes.delete(oldest.value);
+        }
+        hashes.add(Buffer.from(contentHash).toString("hex"));
+    }
+    /**
+     * ─── DOD-M15-NO-SILENT-REFUSAL-1: refusals the RECEIVING operator can actually see ────────────
      *
      * Every inbound refusal already logs a `reason`, an `impact` and a `guidance` — and they are
      * good. They had no reader. From the receiving operator's chair a refused message simply never
      * arrives: the conversation goes quiet with a full explanation sitting in a file they have no
      * reason to open, and they conclude the other person stopped replying.
      *
-     * `content_hash_alg_unknown` is why this matters more than it sounds. It is a VERSION SKEW, so it
-     * affects every message from that counterparty, permanently — not a rare one-off.
+     * **DURABLE, and that is the half that makes this useful.** The predecessor kept notices in a
+     * `Map` on this instance and drained them on the receive path for one session. So a restart lost
+     * them, and an agent NOBODY IS ATTENDING lost them too — the connection is live, the daemon is
+     * up, and the notice only ever reaches whoever happens to call `cello_receive` on that exact
+     * session. `cello_check_notifications` now reads them as its own inbox category.
      *
      * **DEDUPLICATED PER SESSION PER REASON, and that is the design, not an optimisation.** A skewed
      * peer turns one problem into a flood: the first refusal of a kind is the signal, the ninetieth is
@@ -7586,62 +8529,186 @@ export class SessionNodeManager {
      * **NEVER carries the content.** It failed verification; surfacing it is the injection path the
      * cross-check exists to close. The operator learns that a message was refused and why — never
      * what it said.
+     */
+    /**
+     * Record an inbound refusal for the operator. First of its kind per session is the signal.
      *
-     * In memory, deliberately: a restart re-signalling a still-broken peer is correct behaviour, not
-     * duplication, and durability here would buy nothing the next refusal does not.
+     * ⚠️ **DOES NOT THROW, and that is a decision with a cost — stated so it is not mistaken for an
+     * oversight.** Every call site here has already decided to refuse and is about to return a reason
+     * to its caller; a throw would replace that clean refusal with an exception on the ingest path,
+     * changing what the SENDER observes because this daemon could not file a note. So a persistence
+     * failure is logged at ERROR under `session.refusal.persist.failed`, carrying the reason, the
+     * impact and the guidance verbatim — the forensic record survives even when the operator-facing
+     * one does not. It is not silent; it is one surface short, and the log says which notice was lost.
      */
+    noteContentRefusal(agentName, sessionId, reason, 
     /**
-     * (agentName, sessionId) → reason → the notice. `firstAt` was dropped: it was written and read by
-     * nothing, and a field nobody consumes is a claim the code does not keep.
+     * ALL THREE REQUIRED, and that is the enforcement rather than the convention.
+     *
+     * The DoD clause is "every reason calls this with an impact and a guidance", and an optional
+     * field makes that a thing a reviewer checks by reading thirteen call sites. `kind` is required
+     * for the same reason one level up: the header over a list of refusals is composed from it, and
+     * a notice that could omit it would silently inherit whichever header happened to be first.
      */
-    #contentRefusals = new Map();
-    /** Record an inbound refusal for the operator. First of its kind per session is the signal. */
-    noteContentRefusal(agentName, sessionId, reason, detail) {
-        const key = this.#k(agentName, sessionId);
-        let perSession = this.#contentRefusals.get(key);
-        if (!perSession) {
-            perSession = new Map();
-            this.#contentRefusals.set(key, perSession);
+    detail) {
+        try {
+            if (!this.#db)
+                throw new Error("database is not open");
+            const agentId = this.#requireAgentId(agentName);
+            const now = Date.now();
+            /**
+             * ⚠️ **BOTH WRITES OR NEITHER — review F6, and the comment this replaces was wrong.**
+             *
+             * It argued that putting the totals insert in the same `try` made the two "fail together".
+             * It does not: each `.run()` autocommits, so the notice could persist and the total throw —
+             * and the `catch` then ALSO writes an in-memory fallback entry for a notice that is already
+             * in the table. The drain unions the two halves without deduplicating on (session, reason),
+             * so the operator would see the same refusal TWICE, once with a lifetime figure and once
+             * without, one of them blaming a disk fault. Before this unit a single statement made that
+             * state impossible; the second statement is what created it.
+             *
+             * `ROLLBACK` is best-effort because SQLite may have aborted the transaction already — the
+             * same shape `agent-id-migration.ts` uses — and it must never mask the original error.
+             */
+            this.#db.exec("BEGIN");
+            try {
+                // `count` grows on conflict; impact and guidance are refreshed, because a later refusal of the
+                // same reason may know more than the first (the salt branch has four causes and names them).
+                this.#db
+                    .prepare(`INSERT INTO content_refusal_notices
+             (agent_id, session_id, reason, kind, impact, guidance, count, first_at, last_at)
+           VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)
+           ON CONFLICT(agent_id, session_id, reason) DO UPDATE SET
+             count = count + 1, kind = excluded.kind, impact = excluded.impact,
+             guidance = excluded.guidance, last_at = excluded.last_at`)
+                    .run(agentId, sessionId, reason, detail.kind, detail.impact, detail.guidance, now, now);
+                /**
+                 * DOD-M15-REFUSALTERMINAL-1 — the lifetime tally, in the SAME `try` on purpose.
+                 *
+                 * If the notice write failed there is no notice to hang a total off, and the fallback below
+                 * has no durable counterpart to read — so the two must fail together. A total that survived a
+                 * failed notice would be a number nobody could see, and one that was written twice for a
+                 * retried notice would be worse than absent.
+                 */
+                this.#db
+                    .prepare(
+                // `seeded` stays whatever the row already has. A row seeded at upgrade remains a LOWER
+                // BOUND for the life of that (session, reason) — counting forward from an incomplete
+                // figure does not recover the refusals dismissal already erased, and clearing the flag
+                // would turn "at least 58" into a claimed total of 59.
+                `INSERT INTO content_refusal_totals
+             (agent_id, session_id, reason, total, first_at, last_at, seeded)
+           VALUES (?, ?, ?, 1, ?, ?, 0)
+           ON CONFLICT(agent_id, session_id, reason) DO UPDATE SET
+             total = total + 1, last_at = excluded.last_at`)
+                    .run(agentId, sessionId, reason, now, now);
+                this.#db.exec("COMMIT");
+            }
+            catch (inner) {
+                try {
+                    this.#db.exec("ROLLBACK");
+                }
+                catch { /* already aborted by SQLite */ }
+                throw inner;
+            }
         }
-        const existing = perSession.get(reason);
-        if (existing) {
-            existing.count += 1;
-            return;
+        catch (err) {
+            this.#logger.error("session.refusal.persist.failed", {
+                agentName, sessionId, reason,
+                impact: detail.impact,
+                guidance: detail.guidance,
+                error: extractErrorMessage(err),
+                consequence: "this refusal could not be written to the notice store, so it will not survive a restart. It is held in memory for this process instead, so the operator is still told while this daemon runs. The reason, impact and guidance above are the whole notice.",
+            });
+            /**
+             * DOD-M15-NO-SILENT-REFUSAL-1 review F6 — the fallback, and why it is not the silent kind.
+             *
+             * The store this replaced was an in-memory Map, which could not fail: recording a refusal was
+             * a `set`, so the receive door always had the notice for the life of the process. Making the
+             * store durable made it, in the failure case, LESS available than before — a DB write failure
+             * left no operator-facing surface at all, only a log line.
+             *
+             * So a failed write falls back to exactly what the Map did. This is not a fallback that hides
+             * a fault: the ERROR above fires every time, naming the notice and the cause, and what is lost
+             * is only the restart property — which is the property the database was unavailable for
+             * anyway. A silent fallback is one that makes a broken system look healthy; this one is
+             * announced, and it preserves the surface rather than substituting for it.
+             */
+            const key = this.#k(agentName, sessionId);
+            let perSession = this.#refusalFallback.get(key);
+            if (!perSession) {
+                perSession = new Map();
+                this.#refusalFallback.set(key, perSession);
+            }
+            const existing = perSession.get(reason);
+            if (existing) {
+                existing.count += 1;
+                existing.kind = detail.kind;
+                existing.impact = detail.impact;
+                existing.guidance = detail.guidance;
+                return;
+            }
+            perSession.set(reason, { ...detail, count: 1, surfacedTo: new Map() });
         }
-        perSession.set(reason, {
-            reason,
-            impact: detail?.impact,
-            guidance: detail?.guidance,
-            count: 1,
-            // Per CONSUMER, not one global flag. See `takeContentRefusals`.
-            surfacedTo: new Map(),
-        });
+    }
+    /**
+     * DOD-M15-NO-SILENT-REFUSAL-1: the operator has seen these and does not want to see them again.
+     *
+     * ⚠️ **WITHOUT THIS THE NOTICES ARE PERMANENT, and that is what makes people stop reading the
+     * inbox.** "Already shown you" is tracked per WINDOW — a new MCP connection has been told nothing,
+     * so it is told everything. Someone on an older build messages you, you sort it out with them,
+     * they upgrade, and every new session you ever open still opens with that refusal.
+     *
+     * Dismissing does NOT turn anything off. If the cause fires again the notice comes back, because
+     * a fresh refusal writes a fresh row. The operator is saying "I know", not "stop telling me".
+     *
+     * Returns how many were cleared, so the caller can say so rather than claiming a silent success.
+     */
+    dismissContentRefusals(agentName, sessionId) {
+        if (!this.#db)
+            return 0;
+        let agentId;
+        try {
+            agentId = this.#requireAgentId(agentName);
+        }
+        catch {
+            return 0;
+        }
+        this.#refusalFallback.delete(this.#k(agentName, sessionId));
+        const res = this.#db
+            .prepare("DELETE FROM content_refusal_notices WHERE agent_id = ? AND session_id = ?")
+            .run(agentId, sessionId);
+        this.#db
+            .prepare("DELETE FROM content_refusal_reads WHERE agent_id = ? AND session_id = ?")
+            .run(agentId, sessionId);
+        return Number(res.changes);
     }
     /**
      * Drain the refusals a GIVEN CONSUMER has not been shown yet, and remember what it was shown.
      *
-     * ─── Why this is keyed by connection, and not by a single flag ─────────────────────────────────
+     * ─── Why this is keyed by consumer, and not by a single flag ──────────────────────────────────
      *
      * It used to set one `surfaced: boolean` on the notice. Two MCP windows attending the same agent
      * is the ordinary case, and under that flag whoever read FIRST consumed the notice — the second
      * window was told nothing, permanently. **That is the same defect `takeReceivedContent` had**, and
      * the comment above the delivery loop in `session-content-handlers.ts` spells out why it was
      * removed: *"reading is non-destructive by construction. Nothing one consumer does mutates state
-     * another consumer reads."* The whole `taken_by_sibling` apparatus exists because this was paid
-     * for once already; re-introducing it on a different surface makes it no less true.
+     * another consumer reads."*
      *
-     * ─── Why the count now has a reader ────────────────────────────────────────────────────────────
+     * ─── Why the count has a reader ───────────────────────────────────────────────────────────────
      *
-     * The old docstring claimed *"count still grows underneath, so a later reader can ask how many
-     * without being told again."* **There was no later reader.** After the first surfacing the count
-     * incremented under a flag the drain skipped unconditionally, so 3 refusals became 903 and nothing
-     * anywhere could say so — while the comment asserted the opposite.
+     * A reason RE-ANNOUNCES to a consumer when its count has grown by an order of magnitude since that
+     * consumer last saw it (1 → 10 → 100 → …), marked `repeat: true`. That keeps the first refusal the
+     * signal and the ninetieth silent, which is the dedup's point, while still making a skew that has
+     * swallowed hundreds of messages visible — at a handful of announcements per session, not one per
+     * message.
      *
-     * So a reason RE-ANNOUNCES to a consumer when its count has grown by an order of magnitude since
-     * that consumer last saw it (1 → 10 → 100 → …), marked `repeat: true`. That keeps the first
-     * refusal the signal and the ninetieth silent, which is the dedup's point, while still making a
-     * skew that has swallowed hundreds of messages visible — at a handful of announcements per
-     * session, not one per message.
+     * ─── What a restart does, deliberately ────────────────────────────────────────────────────────
+     *
+     * The notices survive; the read state is keyed by IPC connection id, which does not. So after a
+     * restart every notice is unseen again and the next reader is told. That is the correct direction:
+     * a fresh window has not been told anything, and re-announcing costs one line where staying silent
+     * costs the whole point of storing it.
      */
     takeContentRefusals(agentName, sessionId, 
     /**
@@ -7654,26 +8721,263 @@ export class SessionNodeManager {
      * forget it is.
      */
     consumerId) {
-        const perSession = this.#contentRefusals.get(this.#k(agentName, sessionId));
-        if (!perSession)
-            return [];
+        // `sessionId` is dropped from each entry: the caller passed it in and every entry carries the
+        // same one, so repeating it back would be a field that can never say anything. The agent-wide
+        // door below keeps it, because there it is the only thing that says WHICH conversation.
+        //
+        // `truncated` is dropped too, and only here: one session's notices cannot reach the cap (the
+        // reasons are a bounded set), so a flag that can never be true is a field readers learn to skip.
+        return this.#drainRefusals(agentName, consumerId, sessionId).notices.map(({ sessionId: _drop, ...rest }) => rest);
+    }
+    /**
+     * DOD-M15-NO-SILENT-REFUSAL-1: every unshown refusal for an agent, ACROSS its sessions.
+     *
+     * The inbox's door. `takeContentRefusals` answers for one session because its caller already holds
+     * one; `cello_check_notifications` holds an agent and nothing else, and the case this whole line
+     * exists for is that nobody is attending any of that agent's sessions — so a per-session read
+     * cannot reach it. Same store, same per-consumer rule, same re-announce.
+     */
+    takeAgentContentRefusals(agentName, consumerId) {
+        return this.#drainRefusals(agentName, consumerId);
+    }
+    /**
+     * The one read path behind both doors. `sessionId` narrows it; omitted, it spans the agent.
+     *
+     * A single implementation on purpose: the per-consumer rule and the order-of-magnitude rule are
+     * the two properties this unit must not lose, and two copies of them is two things to keep true.
+     */
+    #drainRefusals(agentName, consumerId, sessionId) {
         const out = [];
-        for (const notice of perSession.values()) {
-            const shownAt = notice.surfacedTo.get(consumerId);
-            const firstTime = shownAt === undefined;
-            // `shownAt` is at least 1 whenever it is set, so this cannot loop on zero.
-            if (!firstTime && notice.count < shownAt * 10)
+        let truncated = false;
+        const now = Date.now();
+        let agentId = null;
+        if (this.#db) {
+            try {
+                agentId = this.#requireAgentId(agentName);
+            }
+            catch {
+                // A name that resolves to no active agent has no notices by construction. Already logged by
+                // #requireAgentId; re-throwing would fail a read that has nothing to report.
+                agentId = null;
+            }
+        }
+        if (agentId !== null && this.#db) {
+            /**
+             * ⚠️ NEWEST FIRST, AND CAPPED — review F3, and the ordering is the load-bearing half.
+             *
+             * Read state is keyed on IPC connection id, so every new window and every restart is a
+             * consumer that has been told nothing, and the drain returns every notice ever recorded for
+             * that agent. Oldest-first and uncapped, the first thing an operator saw after a restart was a
+             * chronological archive whose top entry was the oldest refusal on record and whose newest —
+             * the one explaining the conversation that just went quiet — was at the bottom. That is a
+             * section people learn to scroll past, which is the failure this whole line exists to end.
+             *
+             * `LIMIT` is `+ 1` so the cap can be DETECTED rather than assumed; the extra row is dropped
+             * and `truncated` is reported to the caller, which says so on the list itself.
+             *
+             * ⚠️ `rowid DESC` is the TIEBREAK and it is load-bearing, not tidiness. `last_at` is
+             * `Date.now()`, so notices recorded in the same millisecond have no defined order and "newest
+             * first" was true only on average — measured by a test that recorded 30 notices in one tick
+             * and got them back in an order SQLite was free to choose. rowid is monotonic per insert, so
+             * the tiebreak is insertion order, which for a same-millisecond batch is exactly recency.
+             */
+            const rows = (sessionId === undefined
+                ? this.#db
+                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count,
+                        t.total AS lifetime_total, t.seeded AS lifetime_seeded
+                   FROM content_refusal_notices n
+                   LEFT JOIN content_refusal_reads r
+                     ON r.agent_id = n.agent_id AND r.session_id = n.session_id
+                    AND r.reason = n.reason AND r.consumer_id = ?
+                   LEFT JOIN content_refusal_totals t
+                     ON t.agent_id = n.agent_id AND t.session_id = n.session_id
+                    AND t.reason = n.reason
+                  WHERE n.agent_id = ?
+                    AND (r.seen_count IS NULL OR n.count >= r.seen_count * 10)
+                  ORDER BY n.last_at DESC, n.rowid DESC LIMIT ?`)
+                    .all(consumerId, agentId, MAX_REFUSALS_PER_READ + 1)
+                : this.#db
+                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count,
+                        t.total AS lifetime_total, t.seeded AS lifetime_seeded
+                   FROM content_refusal_notices n
+                   LEFT JOIN content_refusal_reads r
+                     ON r.agent_id = n.agent_id AND r.session_id = n.session_id
+                    AND r.reason = n.reason AND r.consumer_id = ?
+                   LEFT JOIN content_refusal_totals t
+                     ON t.agent_id = n.agent_id AND t.session_id = n.session_id
+                    AND t.reason = n.reason
+                  WHERE n.agent_id = ? AND n.session_id = ?
+                    AND (r.seen_count IS NULL OR n.count >= r.seen_count * 10)
+                  ORDER BY n.last_at DESC, n.rowid DESC LIMIT ?`)
+                    .all(consumerId, agentId, sessionId, MAX_REFUSALS_PER_READ + 1));
+            if (rows.length > MAX_REFUSALS_PER_READ) {
+                truncated = true;
+                rows.length = MAX_REFUSALS_PER_READ;
+            }
+            for (const row of rows) {
+                const firstTime = row.seen_count === null;
+                /**
+                 * ⚠️ The unseen test is IN THE QUERY (review N4), and this line is a belt, not the gate.
+                 *
+                 * Applied only here, the `LIMIT` cut the newest 25 notices and THEN discarded the ones this
+                 * consumer had already seen — so a consumer holding read rows for the newest 25 got an empty
+                 * answer forever and a genuinely unseen notice at position 26 could never be reached. The
+                 * cap has to cut UNSHOWN notices, which means the filter has to run before it.
+                 *
+                 * `seen_count` is at least 1 whenever it is set, so this cannot loop on zero.
+                 */
+                if (!firstTime && row.count < row.seen_count * 10)
+                    continue;
+                this.#db
+                    .prepare(`INSERT INTO content_refusal_reads
+               (agent_id, session_id, reason, consumer_id, seen_count, seen_at)
+             VALUES (?, ?, ?, ?, ?, ?)
+             ON CONFLICT(agent_id, session_id, reason, consumer_id) DO UPDATE SET
+               seen_count = excluded.seen_count, seen_at = excluded.seen_at`)
+                    .run(agentId, row.session_id, row.reason, consumerId, row.count, now);
+                this.#evictOldestReads(agentId, row.session_id, row.reason);
+                out.push({
+                    sessionId: row.session_id,
+                    reason: row.reason,
+                    kind: row.kind,
+                    impact: row.impact,
+                    guidance: row.guidance,
+                    timesSinceDismissed: row.count,
+                    /**
+                     * DOD-M15-REFUSALTERMINAL-1 — three states, and they are three different claims.
+                     *
+                     * A counted total is a FIGURE. A seeded row is a FLOOR, and says so by using a different
+                     * field name (review F1c). `null` means no totals row at all, which after the upgrade
+                     * backfill can only happen when the notice write itself failed — reported as ABSENT
+                     * rather than as the smaller number, because substituting it is the defect this unit
+                     * exists to remove.
+                     */
+                    ...(row.lifetime_total === null
+                        ? {}
+                        : row.lifetime_seeded === 1
+                            ? { timesTotalAtLeast: row.lifetime_total }
+                            : { timesTotal: row.lifetime_total }),
+                    ...(firstTime ? {} : { repeat: true }),
+                });
+            }
+        }
+        /**
+         * The unpersisted notices (review F6), under the SAME per-consumer and order-of-magnitude rules.
+         * Reading them differently would make a database failure change WHAT the operator is told rather
+         * than only how long it survives — and that difference is the thing hardest to notice.
+         *
+         * Collected separately and REVERSED before joining, not appended in place — review N2. A Map
+         * yields insertion order, which is oldest-first, so appending them straight after the DB half
+         * (which is newest-first) put the newest notices at the bottom on exactly the daemon where the
+         * fallback is the only half there is.
+         */
+        const fromFallback = [];
+        for (const [key, perSession] of this.#refusalFallback) {
+            const sid = this.#unk(key, agentName);
+            if (sid === null)
                 continue;
-            notice.surfacedTo.set(consumerId, notice.count);
-            out.push({
-                reason: notice.reason,
-                impact: notice.impact,
-                guidance: notice.guidance,
-                count: notice.count,
-                ...(firstTime ? {} : { repeat: true }),
-            });
+            if (sessionId !== undefined && sid !== sessionId)
+                continue;
+            for (const [reason, notice] of perSession) {
+                const shownAt = notice.surfacedTo.get(consumerId);
+                const firstTime = shownAt === undefined;
+                if (!firstTime && notice.count < shownAt * 10)
+                    continue;
+                notice.surfacedTo.set(consumerId, notice.count);
+                // Bounded like the table's read rows are (review N2): a consumer id is an IPC connection id,
+                // so without this a long-running daemon grows one entry per reconnect, in memory, on the
+                // very path that exists because the disk is already failing.
+                if (notice.surfacedTo.size > MAX_REFUSAL_READERS) {
+                    const oldest = notice.surfacedTo.keys().next();
+                    if (!oldest.done)
+                        notice.surfacedTo.delete(oldest.value);
+                }
+                // `timesTotal` is deliberately absent: this notice exists because the durable write failed,
+                // so there is no lifetime record to report and inventing one from `notice.count` would
+                // restore the exact misreading this unit removes.
+                fromFallback.push({
+                    sessionId: sid, reason, kind: notice.kind, impact: notice.impact,
+                    guidance: notice.guidance, timesSinceDismissed: notice.count,
+                    ...(firstTime ? {} : { repeat: true }),
+                });
+            }
+        }
+        out.push(...fromFallback.reverse());
+        /**
+         * ONE cap over BOTH halves — review N2.
+         *
+         * `LIMIT` governs the table only. A persistent database fault (a full disk, which is also the
+         * likeliest cause of `transcript_write_failed`) routes EVERY refusal to the fallback, so the cap
+         * this unit added was undone for exactly the daemon already in trouble.
+         *
+         * The truncation keeps the DB half preferentially, and that is the right bias: those rows are
+         * the ones that survive a restart, and they are already ordered newest-first.
+         */
+        if (out.length > MAX_REFUSALS_PER_READ) {
+            truncated = true;
+            out.length = MAX_REFUSALS_PER_READ;
         }
-        return out;
+        return { notices: out, truncated };
+    }
+    #evictOldestReads(agentId, sessionId, reason) {
+        if (!this.#db)
+            return;
+        this.#db
+            .prepare(`DELETE FROM content_refusal_reads
+          WHERE agent_id = ? AND session_id = ? AND reason = ? AND consumer_id NOT IN (
+            SELECT consumer_id FROM content_refusal_reads
+             WHERE agent_id = ? AND session_id = ? AND reason = ?
+             ORDER BY seen_at DESC LIMIT ${MAX_REFUSAL_READERS}
+          )`)
+            .run(agentId, sessionId, reason, agentId, sessionId, reason);
+    }
+    /**
+     * DOD-M15-NO-SILENT-REFUSAL-1 — the per-session byte cap, from the operator's chair.
+     *
+     * This is the harshest refusal on the inbound path and the one that reads least like a fault:
+     * once the cap is crossed, EVERY later message from that sender on that session is refused, for
+     * the life of the session. The counterparty is told nothing either, so from both chairs the other
+     * person simply stopped replying.
+     *
+     * One method rather than two copies because the cap is checked twice — once before the screening
+     * await and once after, against freshly-read totals — and a notice that differs between the two
+     * would describe a different refusal depending on timing.
+     */
+    /**
+     * DOD-M15-REFUSEDEVIDENCE-1 — **THE BYTE CAP RETAINS NOTHING, and that is a ruling, not an
+     * oversight.**
+     *
+     * Retention is universal everywhere else in this method. Here it is not, because retaining would
+     * defeat the very bound it enforces: a session already over its storage budget cannot be given
+     * more storage as a reward for exceeding it, and `#getReceivedBytesTotal` counts quarantined bytes
+     * precisely so that budget is honest.
+     *
+     * Andre, 2026-09-03: *"The message limit is the message limit, already handled by the cap. If
+     * you're unknown and you have 25 MB and you just tried to send me one gig, well that's it."*
+     *
+     * The ABUSE is still evidenced — this notice records the reason, the cap and the tier, and every
+     * message the session did retain is still there. What is not kept is the oversized payload.
+     */
+    #noteSizeCapRefusal(agentName, sessionId, cap, tier) {
+        /**
+         * ⚠️ **IN MEGABYTES, WITH THE BYTES BESIDE THEM.** "26214400 bytes" is not a number anyone reads
+         * as 25 MB, and the operator being told a conversation just ended deserves to understand the
+         * limit that ended it at a glance. The raw figure stays because it is the exact bound.
+         */
+        const mb = Math.round((cap / 1_048_576) * 10) / 10;
+        /**
+         * The access level as a QUOTED LOWERCASE LABEL, never a bare word.
+         *
+         * `their tier is UNKNOWN` reads as "we could not determine their tier" — the opposite of what it
+         * says. UNKNOWN is the NAME of the level a sender has before the operator adds them as a
+         * contact. Quoting it and lowercasing it makes it a label rather than a failure.
+         */
+        const level = (Object.entries(TIER).find(([, v]) => v === tier)?.[0] ?? String(tier)).toLowerCase();
+        this.noteContentRefusal(agentName, sessionId, "session_size_limit_exceeded", {
+            kind: REFUSAL_KINDS.REFUSED,
+            impact: `This conversation has hit its size limit for this sender: ${mb} MB (${cap} bytes), which is the limit at their access level ("${level}"). The message was not delivered, and neither will anything else they send in this conversation. They were not told — from their side it sent normally.`,
+            guidance: `The limit is per conversation and does not reset, so waiting will not clear it. Start a NEW conversation with them to keep talking. If you trust them, raising their access level with cello_contact_set_tier gives them a larger limit next time — it does not revive this one. Tell them what happened: they have no way to know.`,
+        });
     }
     #markContentUnverifiable(agentName, sessionId, why) {
         const key = this.#k(agentName, sessionId);
@@ -7681,6 +8985,116 @@ export class SessionNodeManager {
             return;
         this.#contentDesynced.set(key, why);
     }
+    /**
+     * 024-ORPHANTRIAGE — the three signals, read from evidence this side owns.
+     *
+     * ⚠️ **THE SEQUENCE NUMBER ON THE FRAME IS NOT ONE OF THEM.** "Was there an ongoing conversation
+     * up to this point" is tempting to answer from the position the sender wrote, and that answer is
+     * worthless: the sender picks the number, so anyone wanting the reach-out branch writes a large
+     * one. It is answered from OUR transcript rows instead — a partial local record of that
+     * conversation is something an attacker cannot put there from the wire.
+     *
+     * ⚠️ **"KNOWN" IS A TIER, NOT A ROW — review F1/F2, and reading it as a row inverted the unit.**
+     * `contacts` rows are written from the WIRE with no operator action: `inbound-sessions.ts` calls
+     * `addContact(..., "signal_presentation")` at `TIER.UNKNOWN` for any inbound offer inside the
+     * acceptance bound, because the trust-signal foreign key needs a row to point at. And BLOCKING a
+     * contact is an UPDATE to `TIER.BLOCKED`, so the row survives that too. A `SELECT … WHERE pubkey`
+     * therefore answers "yes, known" for a stranger who merely dialled, AND for a key the operator
+     * deliberately blocked — handing both the reach-out branch, which is the exact population this
+     * unit exists to refuse. `DOD-TIER-4` had already settled this and retired `isContact` for it:
+     * *"An UNKNOWN-tier contact (a mere row) is NOT known."* The tier is read from the row already
+     * being fetched, so the case-insensitivity below survives (`getTier` compares case-sensitively).
+     *
+     * ⚠️ **HEX CASE IS NOT A DIFFERENCE IN IDENTITY.** This unit originally worked around that with its
+     * own `lower(pubkey)` lookup, because `contacts.pubkey` was stored verbatim from the IPC parameter
+     * and an exact match would report a contact the operator can SEE in `cello_contacts` as an unknown
+     * stranger. The workaround is gone: `contact-pubkey-case.ts` now normalizes every contacts
+     * accessor and folds the rows already on disk, so there is one spelling and one rule.
+     */
+    #orphanEvidence(agentName, sessionId, verifiedSignerUnmatched) {
+        const signerPubkeyHex = verifiedSignerUnmatched === undefined
+            ? null
+            : Buffer.from(verifiedSignerUnmatched).toString("hex");
+        /**
+         * ⚠️ `"not_checked"` IS NOT A COSMETIC THIRD STATE — review F6.
+         *
+         * These two were `false` on every path that did not look, and the log event then reported them
+         * as readings. An investigator filtering `session.content.orphaned` days later would read
+         * `ongoingConversation: false` and conclude there was no local trace, when nothing had been
+         * asked. Clause 1 says the branch RECORDS these; a default wearing the shape of a measurement
+         * is not a record, and it is the cheapest possible way to mislead the one person who comes
+         * looking.
+         */
+        const notChecked = {
+            signerPubkeyHex, knownContact: "not_checked", contactMoniker: null, ongoingConversation: "not_checked",
+        };
+        // With no verifiable signature the other two signals mean nothing — a claimed key is a string
+        // anyone can type — so they are not looked up at all rather than looked up and ignored.
+        if (signerPubkeyHex === null)
+            return notChecked;
+        try {
+            /**
+             * ⚠️ NO `!this.#db` SHORT-CIRCUIT — review F7, and it was the silent half of this guard.
+             *
+             * The catch below logs ERROR for exactly this outcome; a bare `if (!this.#db) return` did not,
+             * and the state is reachable while the operator still gets a notice — `noteContentRefusal`
+             * keeps its own in-memory fallback when the write fails, so a daemon with an unusable store
+             * still surfaces a refusal saying "that key is not in your address book" about a key that may
+             * well be in it, with nothing anywhere recording that the address book was never opened.
+             * Throwing into the catch is also what this file's other contact reads do (`getTier`,
+             * `addContact`), and for the same reason: a read that decides how to treat a sender must not
+             * degrade to "unclassified" in silence.
+             */
+            if (!this.#db)
+                throw new Error("database is not open");
+            const agentId = this.#requireAgentId(agentName);
+            const contact = this.#db
+                .prepare("SELECT moniker, tier FROM contacts WHERE agent_id = ? AND pubkey = ?")
+                .get(agentId, normalizeContactPubkey(signerPubkeyHex));
+            /**
+             * ⚠️ **QUARANTINED ROWS ARE NOT A LOCAL TRACE, AND WITHOUT THIS CLAUSE THE PROBE WRITES ITS
+             * OWN EVIDENCE.** Found where `023-REFUSEDEVIDENCE` met `024-ORPHANTRIAGE`.
+             *
+             * This signal answers *"does this machine hold any part of a conversation under the id the
+             * message names?"*, and a `true` is one of the two conditions that flips the triage from
+             * REPORT-ONLY to offering the operator a reach-out. Since 023, a refused message is RETAINED
+             * as a transcript row — so an unfiltered `SELECT 1 FROM transcript` sees the row this very
+             * refusal just wrote.
+             *
+             * From the operator's chair, unfiltered: a stranger with a vouched key probes an id nobody
+             * opened; the first probe is refused and retained; the second probe finds the first one's row,
+             * reads as an ongoing conversation, and the operator is invited to reach out. **The attacker
+             * manufactures the signal by sending twice** — which is precisely the outcome 024 exists to
+             * prevent, reintroduced by the unit that made evidence durable.
+             *
+             * `direction != 'quarantined'` is the same exclusion every delivery reader uses, and it is the
+             * right one: what is asked here is whether anything was ever DELIVERED under this id.
+             */
+            const trace = this.#db
+                .prepare("SELECT 1 AS present FROM transcript WHERE agent_id = ? AND session_id = ? AND direction != 'quarantined' LIMIT 1")
+                .get(agentId, sessionId);
+            return {
+                signerPubkeyHex,
+                knownContact: contact !== undefined && normalizeTier(contact.tier) >= TIER.KNOWN,
+                contactMoniker: contact?.moniker ?? null,
+                ongoingConversation: trace !== undefined,
+            };
+        }
+        catch (err) {
+            /**
+             * NOT A SILENT FALLBACK. Both signals come back `"not_checked"`, which the triage treats
+             * exactly as it treats a stranger — REPORT, the action that is safe when nothing is known — and
+             * which the log distinguishes from a measured `false`. A read failure here must never invent
+             * the reach-out branch, and it must never be invisible.
+             */
+            this.#logger.error("session.content.orphaned.evidence.failed", {
+                agentName, sessionId,
+                error: extractErrorMessage(err),
+                impact: "the address book and transcript could not be read, so a message whose signature DID verify is being reported to the operator as coming from a key nothing is known about. The advice is the safe one; it may be more cautious than the evidence warrants.",
+            });
+            return notChecked;
+        }
+    }
     async ingestReceivedContent(agentName, sessionId, content, contentHash, correlationId, 
     /**
      * DOD-FRONTIER-STRAND-1 AC1: the relay-assigned canonical position for THIS message, taken from
@@ -7701,14 +9115,33 @@ export class SessionNodeManager {
     contentHashAlgIn, 
     /**
      * DOD-M15-SEALWIRE-1 bullet 5: the VERIFIED authorship proof for this message, when the caller
-     * has one. The caller is the only place that has it — `#recordFrameOrdering` verifies the
-     * signature against the key inside the sender's own signed bytes and matches the signer to this
-     * session's counterparty, and that result reaches here or nowhere.
+     * has one. The caller is the only place that has it — `#verifyAuthorshipClaim` verifies the
+     * signature the frame carries beside the sender's own signed bytes, against the key inside those
+     * bytes, and matches the signer to this session's counterparty. That result reaches here or
+     * nowhere.
      *
-     * Optional, because the soft decode-failure path ingests without it. The row records which it
-     * was, so absence is never silent.
+     * ⚠️ IT USED TO NAME `#recordFrameOrdering`, and that was accurate until
+     * `DOD-M15-AUTHORSHIP-ABSENT-1`: the signature arrived only inside the RELAY's Structure 2, so
+     * checking authorship needed a relay record. It does not now, and the old name sends a reader to
+     * a method that answers a different question. Rewritten, not deleted — that dependence is the
+     * defect the unit removed.
+     *
+     * Optional, because the PARK route ingests without it: recovered mail proves its sender by the
+     * mailbox envelope instead. The row records which it was, so absence is never silent.
      */
-    verifiedAuthorship) {
+    verifiedAuthorship, 
+    /**
+     * 024-ORPHANTRIAGE — the key whose signature VERIFIED on a frame we could not tie to a session.
+     *
+     * Read by the orphan branch below and NOWHERE ELSE. It exists because the daemon establishes,
+     * cryptographically, that the sender holds a private key — and then discarded that the instant
+     * the session lookup came back empty, leaving the operator advised to go and make contact with
+     * whoever sent a message for a conversation that does not exist.
+     *
+     * Absent on the park-recovery caller, which cannot reach the orphan branch at all:
+     * `authenticateParkedEntry` refuses `counterparty_unknown` from the same missing record first.
+     */
+    verifiedSignerUnmatched) {
         // The transcript is frozen ONLY once it is COMMITTED + signed — 'sealed' or
         // 'seal_interrupted_pending' (the bilateral seal commitment) — because a later FROST
         // notarization attests that exact root; a late leaf would diverge from it.
@@ -7727,8 +9160,67 @@ export class SessionNodeManager {
         // papered that in with senderPubkey="unknown". Refuse loudly instead; the content stays
         // un-acked, so a live sender redelivers once the session actually exists. After D3
         // (DOD-INBOUND-GUARD-1) this path is unreachable from the wire — a fail-loud assertion.
+        /**
+         * DOD-M15-REFUSEDEVIDENCE-1 — HOISTED from below the hash cross-check, so that every refusal
+         * above that point can retain the bytes under it. Same expression, earlier.
+         *
+         * It is the SENDER'S CLAIM at this point — nothing has checked it yet, and on a
+         * `content_hash_mismatch` it provably does not describe these bytes. The quarantine read
+         * recomputes its own hash over what was retained rather than reprinting this one.
+         */
+        const contentHashHex = Buffer.from(contentHash).toString("hex");
         if (!record) {
-            this.#logger.warn("session.content.orphaned", { agentName, sessionId, correlationId });
+            /**
+             * RETAINED FIRST, because the triage below now tells the operator whether there is an artifact
+             * to report — and that claim has to be made after the write, never before it (023 review F3).
+             *
+             * This is the case retention matters most for. A message for a session this daemon has no
+             * record of is the least explicable thing that can arrive, so it is the thing an operator has
+             * the least other way to show anyone. There is no `sessions` row and no counterparty, so no
+             * tier — `#quarantineRefusedContent` bounds it at UNKNOWN and files it at a negative position,
+             * outside the chain it never joined.
+             */
+            const keptOrphan = this.#quarantineRefusedContent(agentName, sessionId, "session_orphaned", content, contentHashHex, { correlationId });
+            /**
+             * 024-ORPHANTRIAGE — TWO ACTIONS EXIST AND THE EVIDENCE DECIDES WHICH.
+             *
+             * The advice here used to be *"ask the counterparty to start a NEW session."* When the message
+             * is a stranger probing a peer id, obeying that advice is the probe succeeding: it confirms
+             * somebody is home and that this agent answers, from a message that was refused.
+             *
+             * All three signals are read from things the sender does not control — their signature is
+             * checked against the key inside their own signed bytes, "known" comes from OUR address book,
+             * and "ongoing" comes from OUR transcript rows rather than the sequence number they chose.
+             */
+            const evidence = this.#orphanEvidence(agentName, sessionId, verifiedSignerUnmatched);
+            const triage = triageOrphanedContent(evidence, retentionSentence(sessionId, keptOrphan));
+            /**
+             * BOTH SURFACES, per Invariant 2. The log is the durable forensic record and carries the
+             * signals structurally — this is where an investigation days later reads what was known and
+             * when. The notice below is the control: it is what the agent actually reads and acts on.
+             */
+            this.#logger.warn("session.content.orphaned", {
+                agentName, sessionId, correlationId,
+                signerPubkey: evidence.signerPubkeyHex ?? "(no verifiable signature)",
+                signatureVerified: evidence.signerPubkeyHex !== null,
+                // Review F6: `"not_checked"` where nothing was measured, never a `false` that reads as a
+                // reading. An investigator filtering this event is the only person who will ever ask.
+                knownContact: evidence.knownContact,
+                ongoingConversation: evidence.ongoingConversation,
+                action: triage.action,
+                // 023: whether the evidence the triage points at actually exists.
+                retained: keptOrphan !== null,
+                impact: triage.impact,
+            });
+            // DOD-M15-NO-SILENT-REFUSAL-1. The notice is written even though there is no session row —
+            // the store is keyed (agent_id, session_id) and holds no foreign key to `sessions` precisely
+            // so this case can be recorded. A refusal for a session that does not exist here is the one
+            // the operator has the least other way to learn about.
+            this.noteContentRefusal(agentName, sessionId, "session_orphaned", {
+                kind: REFUSAL_KINDS.REFUSED,
+                impact: triage.impact,
+                guidance: triage.guidance,
+            });
             return { ok: false, reason: "session_orphaned" };
         }
         // DOD-TERMINAL-WAKE-1 (review F1): `abandoned` belongs here too. It is terminal and, unlike
@@ -7750,6 +9242,30 @@ export class SessionNodeManager {
                 currentStatus: record.status,
                 correlationId,
             });
+            // DOD-M15-REFUSEDEVIDENCE-1 — RETAINED. A post-seal straggler on the DIRECT path kept nothing
+            // before this: `sealed_session_annex` covers the park-drain and held-drift routes, not this
+            // exit. Something arriving into a signed, closed conversation is exactly the kind of thing an
+            // operator later wants to produce.
+            this.#quarantineRefusedContent(agentName, sessionId, "session_committed", content, contentHashHex, {
+                senderPubkeyHex: record.counterparty_pubkey ?? null, correlationId,
+            });
+            /**
+             * DOD-M15-REFUSALTERMINAL-1 — the retention call above is also what STOPS THE WORK: it runs
+             * the terminal funnel, and `session_committed` is the one reason in it.
+             *
+             * Without that, the relay's next redelivery of the witness leaf armed another park fetch,
+             * which drained, verified, arrived here, and was refused again — measured at ~2 per second
+             * for 62 hours on one message. `#markContentResolved` could not be reused: this content did
+             * not land, and saying that it did is a lie a future reader would act on.
+             */
+            // DOD-M15-NO-SILENT-REFUSAL-1. `currentStatus` on the log line carries the REAL status —
+            // sealed, seal_interrupted_pending or abandoned — and the notice must not flatten those into
+            // one claim, so it names the record as frozen rather than asserting which way it ended.
+            this.noteContentRefusal(agentName, sessionId, "session_committed", {
+                kind: REFUSAL_KINDS.REFUSED,
+                impact: `This conversation is closed (it ended as "${record.status}"), so the message could not be delivered and neither can anything else they send to it. A closed conversation is signed and cannot be added to — that is what closing it means. Nothing is wrong on your side.`,
+                guidance: "There is nothing to repair here. If they still have something to say, ask them to start a NEW conversation — a closed one cannot be reopened, and it is worth telling them, because they may not realise it ended. Read what was said before it closed with cello_transcript.",
+            });
             return { ok: false, reason: "session_committed" };
         }
         /**
@@ -7791,10 +9307,17 @@ export class SessionNodeManager {
                 impact: "this message could not be verified, so it was NOT ingested and NOT shown. The algorithm name is a claim by the sender and is not covered by any signature, so it does not establish what they actually did. This session will not auto-co-sign at close.",
                 guidance: "Almost always their CELLO build is newer than this one: ask which version they are running, and upgrade. If they are on the SAME version as you, that explanation does not hold and the frame was malformed or crafted — do not close the session by auto-acknowledgement.",
             });
+            // DOD-M15-REFUSEDEVIDENCE-1 — RETAINED. The algorithm name is an unsigned claim by whoever
+            // sent the frame, so this branch is reachable by crafting as well as by version skew, and the
+            // crafted case is one to be able to show someone.
+            this.#quarantineRefusedContent(agentName, sessionId, "content_hash_alg_unknown", content, contentHashHex, {
+                senderPubkeyHex: record.counterparty_pubkey ?? null, correlationId,
+            });
             // DOD-M15-REFUSED-INBOUND-SILENT-1: the SAME strings the log just carried, to the operator.
             // This reason is a version skew, so it affects every message from that counterparty — without
             // this the conversation goes permanently quiet and they conclude the peer stopped replying.
             this.noteContentRefusal(agentName, sessionId, "content_hash_alg_unknown", {
+                kind: REFUSAL_KINDS.REFUSED,
                 impact: "this message could not be verified, so it was NOT ingested and NOT shown. The algorithm name is a claim by the sender and is not covered by any signature, so it does not establish what they actually did. This session will not auto-co-sign at close.",
                 guidance: "Almost always their CELLO build is newer than this one: ask which version they are running, and upgrade. If they are on the SAME version as you, that explanation does not hold and the frame was malformed or crafted — do not close the session by auto-acknowledgement.",
             });
@@ -7837,6 +9360,12 @@ export class SessionNodeManager {
                 // purpose.
                 guidance: "Look for session.salt.discarded first: if it is there, this side dropped its salt because the counterparty said it could never hold one, the agreement did complete and was deliberately undone, and a new session is the repair. Otherwise look for session.salt.adoption.refused: if it is there, this side declined the salt because the session had already hashed messages, that is permanent for this session, and reconnecting will NOT fix it — close the session and start a new one. Otherwise look for session.salt.read.failed or session.salt.persist.failed. If either is present the agreement re-runs on the next reconnect and this repairs itself — wait for that before doing anything. If none of the four is present, the agreement never completed with this counterparty: close the session and start a new one. In every case the transcript up to here is intact.",
             });
+            // DOD-M15-REFUSEDEVIDENCE-1 — RETAINED. We could not check it, which is precisely why the
+            // bytes have to survive: the question of what they actually were stays open, and a hash we
+            // could not verify answers none of it.
+            this.#quarantineRefusedContent(agentName, sessionId, "content_hash_salt_unavailable", content, contentHashHex, {
+                senderPubkeyHex: record.counterparty_pubkey ?? null, correlationId,
+            });
             // DOD-M15-REFUSED-INBOUND-SILENT-1 — and this branch needed it MORE than the two that had it.
             //
             // It was refused, logged with a full impact and guidance, not ingested, not shown — and the
@@ -7852,12 +9381,12 @@ export class SessionNodeManager {
             // The guidance is passed by reference to the log's own text rather than duplicated: a second
             // copy is a second thing to keep true, and the log's version is the one that gets maintained.
             this.noteContentRefusal(agentName, sessionId, "content_hash_salt_unavailable", {
+                kind: REFUSAL_KINDS.REFUSED,
                 impact: "this message could not be verified — the sender says it is salted and this side holds no salt for the session — so it was NOT ingested and NOT shown. This session will not auto-co-sign at close.",
                 guidance: "If session.salt.discarded is present, this side dropped its salt on purpose because the counterparty said it could never hold one — a new session is the repair. If this side refused the salt because the session had already hashed messages, that is PERMANENT for this session and reconnecting will not fix it — close the session and start a new one. Otherwise the salt agreement re-runs on the next reconnect and this repairs itself. Check session.salt.discarded and session.salt.adoption.refused in the log to tell which. The transcript up to here is intact either way.",
             });
             return { ok: false, reason: "content_hash_salt_unavailable" };
         }
-        const contentHashHex = Buffer.from(contentHash).toString("hex");
         if (Buffer.from(computed).toString("hex") !== contentHashHex) {
             this.#logger.warn("session.content.cross_check.failed", {
                 sessionId,
@@ -7871,9 +9400,26 @@ export class SessionNodeManager {
             // auto-acknowledge gate must never auto-co-sign it. The session stays alive (DOD-MSG-7),
             // but the responder seal now requires the agent's explicit decision, not an auto-ack.
             this.#markContentUnverifiable(agentName, sessionId, "tampered");
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — RETAINED, and this is the highest-value row in the table.
+             *
+             * A tampered frame is the one case where the message and the sender's commitment PROVABLY
+             * disagree, and the proof only exists while both halves do. Before this, the bytes went on the
+             * floor and all that survived was a hash of something nobody still had.
+             *
+             * `verifiedAuthorship` is stored when the caller verified a signature over the sender's own
+             * bytes. That is what makes the row evidence rather than a note: the signature is checked
+             * against the key inside the sender's signed bytes, not against anything this side chose.
+             */
+            this.#quarantineRefusedContent(agentName, sessionId, "content_hash_mismatch", content, contentHashHex, {
+                senderPubkeyHex: this.#activeNodes.get(this.#k(agentName, sessionId))?.counterpartyPubkey ?? record.counterparty_pubkey ?? null,
+                ...(verifiedAuthorship ? { authorship: verifiedAuthorship } : {}),
+                correlationId,
+            });
             // DOD-M15-REFUSED-INBOUND-SILENT-1. Deliberately does NOT include the content or the hashes:
             // it failed verification, and showing it is the injection path this cross-check closes.
             this.noteContentRefusal(agentName, sessionId, "content_hash_mismatch", {
+                kind: REFUSAL_KINDS.REFUSED,
                 impact: "a message arrived whose bytes do not match the hash the sender committed to, so it was NOT ingested and NOT shown. This session will not auto-co-sign at close.",
                 guidance: "Either the message was altered in transit or the sender's record is wrong. Ask the counterparty to resend. Do not close this session by auto-acknowledgement — seal it only by an explicit decision.",
             });
@@ -7886,6 +9432,49 @@ export class SessionNodeManager {
             // counterparty_pubkey NOT NULL, so this is unreachable unless a row was hand-crafted empty.
             // Either way, "unknown" is never written to a transcript row — refuse instead.
             this.#logger.warn("session.content.sender_unresolved", { sessionId, agentName, correlationId });
+            // DOD-M15-REFUSEDEVIDENCE-1 — RETAINED, with NO sender key, because there is none and that
+            // absence is the evidence. The guidance below says to report this; this is the artifact there
+            // is to report. Bounded at the UNKNOWN tier — there is no contact to look a tier up on, which
+            // is the same fact that made it unattributable.
+            const keptUnresolved = this.#quarantineRefusedContent(agentName, sessionId, "sender_unresolved", content, contentHashHex, { correlationId });
+            this.noteContentRefusal(agentName, sessionId, "sender_unresolved", {
+                kind: REFUSAL_KINDS.REFUSED,
+                impact: "A message arrived that this daemon could not attribute to anyone, so it was not delivered. This conversation's record does not say who the other party is, which a conversation opened normally always does. TREAT THIS AS HOSTILE: a message that cannot be tied to a sender is far more likely to be a probe or an attack than a fault.",
+                /**
+                 * ⚠️ NO "WHEN IN DOUBT" HERE — Andre, 2026-09-03: *"This message has no sender, the chances
+                 * that it is hostile are very high. When in doubt? No. Just report it."*
+                 *
+                 * That hedge belongs on the ambiguous branch in `024-ORPHANTRIAGE`, where a verified
+                 * signature from a known contact leaves a real judgement to make. There is no judgement
+                 * here. Softening it would teach the operator to weigh a case that does not need weighing.
+                 *
+                 * ⚠️ IT NAMES NO REPORTING DESTINATION, and that is still true — but HALF of the reason has
+                 * gone, so the sentence is rewritten rather than left to read as though nothing changed.
+                 *
+                 * It used to rest on two facts: `CELLO_Reporting` does not exist (`DOD-M15-ORPHANTRIAGE-1`,
+                 * still open) and **the message itself is not retained**. The second is no longer true —
+                 * `DOD-M15-REFUSEDEVIDENCE-1` retains it, and the guidance below now says so and names where
+                 * it is. Telling an operator to report something while keeping nothing to report was the
+                 * gap; naming a destination nobody can reach would be Invariant 4's failure. So: the
+                 * artifact is named now, the destination when 024 lands.
+                 *
+                 * ⚠️ THE ROTATION ADVICE IS MEASURED, NOT ASSUMED. `#startReceiverNode` mints the standing
+                 * receiver's transport key with `randomBytes(32)` and never persists it, so a logout/login
+                 * genuinely yields a NEW peer id and fresh directory connections. **And the bound is stated
+                 * in the same breath:** session nodes DO persist their seed (`DOD-M12B-SESSION-SEED-1`, so a
+                 * revived conversation keeps its address), so this rotates the front door and not the doors
+                 * already open. Telling an operator to rotate without that bound would have them believe
+                 * they had closed something they had not.
+                 */
+                guidance: 
+                // "That is the artifact to show someone" is NOT appended: it would be false on the branch
+                // where nothing was retained, which is the branch this sentence exists to be honest about.
+                "Report this. " + retentionSentence(sessionId, keptUnresolved) +
+                    "Do not try to reply — there is no one to reply to, and answering an unattributable message is what a probe is looking for. " +
+                    "Then rotate your address: run cello logout followed by cello login. Your standing receiver's network identity is generated fresh each time it starts and is never stored, so this gives you a new one and rebuilds your connections to the directory — anyone holding the old address is left talking to something that no longer answers. " +
+                    "It does NOT change the addresses of conversations you already have open: those identities are kept on purpose so an interrupted conversation can resume. " +
+                    "This conversation cannot be repaired: close it with cello_close_session, and open a new one yourself if you were expecting someone. See session.content.sender_unresolved in the daemon log.",
+            });
             return { ok: false, reason: "sender_unresolved" };
         }
         // DOD-MSG-5: a content_hash satisfies AT MOST ONE Merkle leaf, exactly once. If this hash is
@@ -8019,6 +9608,7 @@ export class SessionNodeManager {
                     tier: senderTier,
                     correlationId,
                 });
+                this.#noteSizeCapRefusal(agentName, sessionId, cap, senderTier);
                 return { ok: false, reason: "session_size_limit_exceeded" };
             }
         }
@@ -8100,8 +9690,29 @@ export class SessionNodeManager {
                     correlationId,
                 });
             }
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — **A TRANSIENT BLOCK RETAINS NOTHING, and nothing is lost by
+             * that.** Nothing was recorded and, decisively, nothing was ACKNOWLEDGED: the message is still
+             * with the sender, whose daemon redelivers it. When the gateway recovers the same bytes are
+             * screened, and if they are blocked they are retained then, under the detector's own reason.
+             *
+             * Retaining here would file a copy of a message that is coming back — a duplicate, not
+             * evidence — and it would do so for content nothing has yet judged, once per redelivery
+             * attempt, for as long as the gateway stays down.
+             */
+            // DOD-M15-NO-SILENT-REFUSAL-1 — a TRANSIENT block, and saying which it is, is the whole
+            // value of the notice. Nothing was recorded and nothing was acked, so the sender's daemon
+            // redelivers on its own. An operator who reads the silence as delivery, or who asks the
+            // counterparty to resend, is acting on the opposite of what happened.
+            this.noteContentRefusal(agentName, sessionId, inboundVerdict.reason ?? "inbound_screen_blocked", {
+                kind: REFUSAL_KINDS.DEFERRED,
+                impact: "the screener could not reach a verdict on an inbound message, so it was NOT ingested and NOT shown. Nothing was recorded and nothing was acknowledged — the message is still with the sender and their daemon will redeliver it once screening works again. Do not read this silence as delivery.",
+                guidance: "TRANSIENT — do not ask the counterparty to resend, and do not close the session. Get the local screening gateway healthy and the backlog comes through on its own: look for security.gateway.timeout, security.gateway.unavailable and security.gateway.inbound.blocked in the daemon log — the third is what an internal screen_error logs, and naming only the first two sends you looking for lines that will not be there. While it stays down, every message from every counterparty takes this path.",
+            });
             return { ok: false, reason: inboundVerdict.reason ?? "inbound_screen_blocked" };
         }
+        // Assigned only on the terminal-block branch and invoked beside each retention attempt below.
+        let noteTerminalBlock;
         if (terminalBlock) {
             this.#logger.warn("security.gateway.inbound.terminal_block", {
                 sessionId,
@@ -8109,6 +9720,78 @@ export class SessionNodeManager {
                 reason: inboundVerdict.reason,
                 correlationId,
             });
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — retention for a terminal block happens where its LEAF happens,
+             * not here. Two sites below (the hold branch and the in-order append), each writing the
+             * quarantine row at the same index as the leaf it accompanies.
+             *
+             * Not here, deliberately: this point is upstream of the post-screen dedup re-check and the
+             * size-cap re-check, either of which can still refuse. Retaining above them would file
+             * evidence for a message this call then reports as capped — and the cap path is the one that
+             * is ruled NOT to retain.
+             */
+            /**
+             * DOD-M15-NO-SILENT-REFUSAL-1 — **the moment the product catches the attack it exists to
+             * catch, and until now the operator was told nothing about it.**
+             *
+             * This path is not an error path, which is exactly why it had no notice: the block leafs the
+             * original content hash at its canonical position and acknowledges the sender, so nothing
+             * fails and nothing loops. The message is simply never handed to the agent. From the
+             * operator's chair a message they were expecting never arrives and the record shows a leaf
+             * with nothing in it.
+             *
+             * The notice NEVER carries the blocked content — a screener that can be talked into surfacing
+             * what it blocked is not a screener.
+             *
+             * ⚠️ **THE GUIDANCE USED TO SAY "DO NOT ASK FOR THE ORIGINAL TEXT", AND THAT IS NOW WRONG.**
+             * Rewritten rather than deleted, per the claim-comment rule, because the reasoning is what
+             * changed and not just the sentence. It rested on the content being unavailable; under
+             * `DOD-M15-REFUSEDEVIDENCE-1` it is retained and there is a route that returns it FRAMED. And
+             * the friction was never protection: Andre, 2026-09-03 — *"eventually the LLM is going to go
+             * searching for it, because human beings are going to direct their LLMs to find it, and it's
+             * going to come back and say 'Hey, I found it here, the message says…' — which is far
+             * worse."* Withholding the route removes the WARNING from the read, not the read.
+             *
+             * What survives unchanged: do not turn screening off. That is still the one action that makes
+             * things worse, and it is the one the guidance still refuses.
+             */
+            /**
+             * ⚠️ THE DETECTOR'S OWN REASON SURVIVES — `inbound_screen_blocked` is only the fallback.
+             *
+             * Invariant 3: a downstream handler must not replace an upstream descriptive error with a
+             * generic one. The verdict already says WHICH detector fired — `inbound_language_blocked` and
+             * an injection block are different problems with different remedies, and one of them has an
+             * operator command that fixes it. Flattening both to `inbound_screen_blocked` would also
+             * deduplicate them together, so the second kind would be silent for the life of the session.
+             *
+             * The gateway's own `guidance` is appended when it has one, for the same reason: it is the
+             * half that names the actual command.
+             */
+            // `?? "inbound_screen_blocked"` is a floor, not a live branch: every verdict producer in the
+            // tree sets `reason`, so today it never fires. It stays because `reason` is optional on the
+            // type, and a notice keyed on `undefined` would collapse every future detector into one row.
+            /**
+             * ⚠️ **DEFERRED UNTIL THE RETENTION HAS ACTUALLY RUN — review F3.** The notice used to be
+             * written here, above both append sites, and claimed the message was kept before anything had
+             * tried to keep it. It is now a closure invoked beside each `#quarantineRefusedContent` call,
+             * carrying that call's own answer.
+             *
+             * Two paths between here and there deliberately write NO notice now, and both are the better
+             * answer: a post-screen dedup means this exact message was already noticed the first time, and
+             * a size-cap refusal writes `#noteSizeCapRefusal` instead — which is what actually happened,
+             * where before the operator got both stories at once.
+             */
+            noteTerminalBlock = (stored) => {
+                this.noteContentRefusal(agentName, sessionId, inboundVerdict.reason ?? "inbound_screen_blocked", {
+                    kind: REFUSAL_KINDS.BLOCKED,
+                    impact: "the screener blocked an inbound message: its content matched a detector this agent runs on everything that arrives. It was NOT shown to the agent. It IS recorded in the hash chain at its position and the sender was acknowledged, so they will not resend it and they were not told it was blocked.",
+                    guidance: "This is the protection doing its job, and nothing is required of you. If you were expecting something from this counterparty around now, tell them it was blocked and ask them to say it differently. " +
+                        retentionSentence(sessionId, stored) +
+                        (stored === null ? "" : "There is no reason to read it unless you need to show someone, or judge whether this was an attack. ") +
+                        "Do NOT turn screening off to read it: that is the one action here that makes things worse. security.gateway.inbound.terminal_block in the daemon log names which detector fired." +
+                        (inboundVerdict.guidance !== undefined ? ` The detector says: ${inboundVerdict.guidance}` : ""),
+                });
+            };
         }
         // M9-IN-001: a `redact` verdict (inbound sanitization) DELIVERS the sanitized text to the agent,
         // while the Merkle leaf still binds the ORIGINAL content hash below — the transcript records what
@@ -8178,6 +9861,7 @@ export class SessionNodeManager {
                     correlationId,
                     recheck: true,
                 });
+                this.#noteSizeCapRefusal(agentName, sessionId, cap, senderTier);
                 return { ok: false, reason: "session_size_limit_exceeded" };
             }
         }
@@ -8217,6 +9901,18 @@ export class SessionNodeManager {
             // DOD-M12B-STRAND-1: and to disk, before we answer. The in-memory Map is the working copy;
             // this row is the one that survives the teardown that used to destroy it.
             this.#persistHeldContent(agentName, sessionId, canonicalSeq, deliverContent, content, contentHashHex, terminalBlock === true, correlationId);
+            // DOD-M15-REFUSEDEVIDENCE-1 (site 1 of 2 for a terminal block): a block held behind an
+            // ordering gap. `#releaseHeld` appends its leaf later WITHOUT re-entering this method, so
+            // retaining at release is not available — it is retained here, at the position the leaf will
+            // take. `held_content` is not a substitute: that row is deleted the moment the gap fills.
+            if (terminalBlock) {
+                const keptHeld = this.#quarantineRefusedContent(agentName, sessionId, inboundVerdict.reason ?? "inbound_screen_blocked", content, contentHashHex, {
+                    senderPubkeyHex: senderPubkey, canonicalSeq,
+                    ...(verifiedAuthorship ? { authorship: verifiedAuthorship } : {}),
+                    correlationId,
+                });
+                noteTerminalBlock?.(keptHeld);
+            }
             this.#logger.info("session.content.held", {
                 sessionId,
                 canonicalSeq,
@@ -8249,6 +9945,50 @@ export class SessionNodeManager {
         const leafIndex = terminalBlock
             ? this.appendSessionLeaf(agentName, sessionId, "msg", contentHashHex, correlationId).leafIndex
             : this.#appendVerifiedContent(agentName, sessionId, deliverContent, contentHashHex, senderPubkey, correlationId, content, verifiedAuthorship).leafIndex;
+        /**
+         * DOD-M15-REFUSEDEVIDENCE-1 (site 2 of 2) — **the moment the product catches the attack it
+         * exists to catch, and until now it kept only the hash.**
+         *
+         * The terminal-block branch above takes `appendSessionLeaf`, not `#appendVerifiedContent`, so
+         * the row carrying the plaintext, the sender's key and the sender's signature was never written.
+         * A hash proves a message you still hold has not changed; it proves nothing about one you threw
+         * away — and this is precisely the message an operator would most want to produce.
+         *
+         * At `leafIndex`, so the leaf and the evidence describe one event and DoD 7's leaf placement is
+         * untouched. The ORIGINAL bytes, never the sanitized `deliverContent`: evidence is what they
+         * sent, not what a filter made of it.
+         */
+        if (terminalBlock) {
+            const keptBlocked = this.#quarantineRefusedContent(agentName, sessionId, inboundVerdict.reason ?? "inbound_screen_blocked", content, contentHashHex, {
+                senderPubkeyHex: senderPubkey, canonicalSeq: leafIndex,
+                ...(verifiedAuthorship ? { authorship: verifiedAuthorship } : {}),
+                correlationId,
+            });
+            noteTerminalBlock?.(keptBlocked);
+            /**
+             * ⚠️ **DROP THE WITNESS — A BLOCKED MESSAGE MADE THE SESSION PERMANENTLY UNSEALABLE.**
+             *
+             * THE THIRD INSTANCE of the shape already fixed for document frames at `:10593`, found by the
+             * first journey that ever sealed a session after a screener block.
+             *
+             * `sealReadiness` derives `missingLeaves` from `#witnessedSeq.size` — every position the
+             * ordering authority committed that this tree has not appended. The entry is dropped where the
+             * leaf is credited, and that drop lives inside `#appendVerifiedContent`. A terminal block does
+             * not go through it: the branch above takes `appendSessionLeaf` directly, so the leaf WAS
+             * committed and the witness was never retired.
+             *
+             * **From the operator's chair:** their screener catches one hostile message, and from that
+             * moment `cello_close_session` answers `session_incomplete` forever — *"waiting on an earlier
+             * message from the counterparty that has not arrived"* — about a message that arrived, was
+             * judged, and is sitting in the chain. The only exit is a force-abandon, which forfeits the
+             * notarized receipt. Measured live: `treeSize 3, highWaterSeq 2, missingLeaves 1`.
+             *
+             * Not introduced by `DOD-M15-REFUSEDEVIDENCE-1` — it is older than this unit and simply had no
+             * test that both blocked a message and then sealed. It is fixed here because this unit's own
+             * DoD requires that session to seal.
+             */
+            this.#witnessedSeq.get(key)?.delete(contentHashHex);
+        }
         // DOD-COATTEND-1 (review F2): the plaintext failed to reach the transcript, and since Tier 1 the
         // transcript IS the delivery path — so this message can never be handed to any session. Report
         // the ingest as failed. Reporting `ok: true` here is what let a local SQLCipher failure surface,
@@ -8259,6 +9999,37 @@ export class SessionNodeManager {
         // tidy up a reporting problem would corrupt the frontier the counterparty already co-signs
         // against. The hole is now crossable by delivery (F1), so it costs a gap, not a stall.
         if (!terminalBlock && this.getUndeliverableSeqs(agentName, sessionId).includes(leafIndex)) {
+            /**
+             * DOD-M15-REFUSEDEVIDENCE-1 — **THIS PATH CANNOT RETAIN, because the storage layer is what
+             * just failed.** The write that would keep the evidence is the same `INSERT` into the same
+             * table that has already thrown for this message. Attempting it produces a second error line
+             * and no evidence. Named here rather than left to be rediscovered as a missing case.
+             */
+            // DOD-M15-NO-SILENT-REFUSAL-1. `#appendVerifiedContent` already noted `content_undeliverable`
+            // at the point the write failed; this is the INGEST's own refusal, and it is a different fact
+            // — the sender is told the ingest failed, so it will redeliver, and every redelivery of the
+            // same hash now dedups against a leaf whose plaintext is not there. Two reasons, because a
+            // reader fixing the disk fault needs to know both that the text is gone and that the sender
+            // is retrying into a hole.
+            this.noteContentRefusal(agentName, sessionId, "transcript_write_failed", {
+                kind: REFUSAL_KINDS.LOST,
+                impact: "A message reached this agent, was verified, and was committed to the conversation's record — and then its text could not be written to local storage, so it can never be delivered. There is a permanent gap in your copy of this conversation. This is a fault on THIS machine; the counterparty did nothing wrong and cannot fix it.",
+                /**
+                 * ⚠️ THE READER IS USUALLY ALREADY IN A CODING AGENT, so the guidance says GO AND LOOK
+                 * rather than listing symptoms. Andre, 2026-09-03: *"The message should mention to try and
+                 * figure out why you cannot store it — it is likely a local machine problem. But if you
+                 * truly cannot figure this out using a coding agent, then we advise reaching out to
+                 * CELLO_Support."*
+                 *
+                 * That ordering matters: this is a machine fault with an ordinary cause, and an operator
+                 * sent straight to support for a full disk has been wasted. Support is the exit, not the
+                 * first step.
+                 */
+                guidance: "Find out why the write failed — this is almost always something ordinary on this machine. " +
+                    "If you are reading this through a coding agent, have it check: free disk space, the permissions on ~/.cello, whether the database file is readable and writable, and transcript.message.record.failed in the daemon log, which carries the underlying error. " +
+                    "Waiting cannot recover the message. Once the fault is fixed, ask them to resend — the text is gone and only its hash remains. " +
+                    "If you genuinely cannot work out the cause, reach out to CELLO_Support.",
+            });
             return { ok: false, reason: "transcript_write_failed" };
         }
         // NO relay witness for this hash. We appended it anyway — refusing would make the relay a hard
@@ -8356,10 +10127,172 @@ export class SessionNodeManager {
             this.#leafFetchTimers.delete(timerKey);
         }
     }
+    /**
+     * DOD-M15-REFUSALTERMINAL-1 — the funnel. A refusal stops the work ONLY if its reason is in
+     * `TERMINAL_REFUSAL_REASONS`; every other reason keeps retrying, which is what makes a transient
+     * screener block or a version skew recoverable.
+     *
+     * One place decides, so "is this reason terminal?" is answerable from the set rather than from
+     * thirteen call sites.
+     */
+    #considerTerminalRefusal(agentName, sessionId, contentHashHex, reason) {
+        if (!TERMINAL_REFUSAL_REASONS.has(reason))
+            return;
+        this.#markContentTerminallyRefused(agentName, sessionId, contentHashHex, reason);
+    }
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: this content can NEVER be accepted on this session — cancel the
+     * pending fetch and make sure no future one is scheduled, across restarts.
+     *
+     * The durable write comes FIRST and the in-memory cache second, so a process that dies between
+     * them wakes up with the stop still in force. A failed write is announced at ERROR and the
+     * in-memory mark is still taken: the loop stops for the life of THIS process, and the log says
+     * plainly that it will resume after a restart. That is a degraded stop, not a silent one.
+     */
+    #markContentTerminallyRefused(agentName, sessionId, contentHashHex, reason) {
+        const key = this.#k(agentName, sessionId);
+        /**
+         * Read BEFORE the write, so the announcement below fires on the TRANSITION rather than on every
+         * re-refusal. The same message can be refused again by a drain triggered for another reason, and
+         * an INFO line per repeat is a smaller version of the noise this unit exists to remove.
+         *
+         * The durable write is still ATTEMPTED every time, deliberately: `INSERT OR IGNORE` costs
+         * nothing when the row is already there, and skipping it would mean a write that failed once —
+         * the branch that logs the error below — never got another chance to succeed.
+         */
+        const alreadyKnown = this.#isTerminallyRefused(agentName, sessionId, contentHashHex);
+        try {
+            if (!this.#db)
+                throw new Error("database is not open");
+            const agentId = this.#requireAgentId(agentName);
+            this.#db
+                .prepare(`INSERT OR IGNORE INTO terminal_content_refusals
+             (agent_id, session_id, content_hash, reason, marked_at)
+           VALUES (?, ?, ?, ?, ?)`)
+                .run(agentId, sessionId, contentHashHex, reason, Date.now());
+            /**
+             * ⚠️ **BOUNDED, because the counterparty chooses how many rows exist — review F7.**
+             *
+             * One row per distinct content hash aimed at a closed conversation, and the funnel that calls
+             * this runs even when the byte cap has already stopped RETENTION. So a peer who has exhausted
+             * the session's storage budget can still write rows here, indefinitely, on a table nothing
+             * else deletes. Every sibling store in this file is bounded (`MAX_UNREADABLE_ALG_FRAMES`, the
+             * tier byte cap, `MAX_REFUSAL_READERS`); this one was not.
+             *
+             * Oldest-dropped, so the newest refusals keep their stop and the loop stays closed for what
+             * is arriving now. A dropped row costs at most one extra fetch for content nobody is sending
+             * any more — the pre-fix behaviour for that one hash, and nothing worse.
+             */
+            const dropped = this.#db
+                .prepare(`DELETE FROM terminal_content_refusals
+            WHERE agent_id = ? AND session_id = ? AND content_hash NOT IN (
+              SELECT content_hash FROM terminal_content_refusals
+               WHERE agent_id = ? AND session_id = ?
+               ORDER BY marked_at DESC LIMIT ${MAX_TERMINAL_REFUSALS_PER_SESSION}
+            )`)
+                .run(agentId, sessionId, agentId, sessionId);
+            if (Number(dropped.changes) > 0) {
+                // Loud, because it means a counterparty has aimed more than the cap's worth of distinct
+                // messages at one closed conversation — which is abuse, not ordinary traffic.
+                this.#logger.warn("session.content.terminal_refusal.evicted", {
+                    agentName, sessionId, dropped: Number(dropped.changes),
+                    cap: MAX_TERMINAL_REFUSALS_PER_SESSION,
+                    impact: "more distinct messages have been refused on this closed conversation than the cap keeps a record of, so the oldest stops were dropped. If one of those arrives again it costs one wasted fetch; nothing is delivered and nothing is lost.",
+                });
+            }
+        }
+        catch (err) {
+            this.#logger.error("session.content.terminal_refusal.persist.failed", {
+                agentName, sessionId, reason,
+                contentHash: contentHashHex,
+                error: extractErrorMessage(err),
+                impact: "this message can never be accepted on this conversation, and that fact could not be written down. Fetching for it stops while this daemon runs, and RESUMES after the next restart — which is the loop that filled a log with a quarter of a million refusals for one message.",
+                guidance: "This is a fault on THIS machine, not with the counterparty. Check free disk space and the permissions on ~/.cello; session.refusal.persist.failed in this log usually appears alongside it with the underlying error.",
+            });
+        }
+        let set = this.#terminallyRefused.get(key);
+        if (!set) {
+            set = new Set();
+            this.#terminallyRefused.set(key, set);
+        }
+        set.add(contentHashHex);
+        // The same cancellation `#markContentResolved` performs, for the opposite fact: an already-armed
+        // grace timer must not fire for content we have just decided never to accept.
+        const timerKey = `${key}::${contentHashHex}`;
+        const t = this.#leafFetchTimers.get(timerKey);
+        if (t !== undefined) {
+            clearTimeout(t);
+            this.#leafFetchTimers.delete(timerKey);
+        }
+        if (!alreadyKnown) {
+            this.#logger.info("session.content.terminal_refusal", {
+                agentName, sessionId, reason,
+                contentHash: contentHashHex,
+                impact: "no further attempt will be made to fetch this message. The conversation it was sent to is closed and signed, so no retry could ever have succeeded.",
+            });
+        }
+    }
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: has this content already been refused terminally?
+     *
+     * Reads the durable rows for a session ONCE and caches them, so the hot path — a witnessed leaf
+     * on a healthy session — costs one `Set` lookup rather than a query per message. A read failure
+     * returns `false`: the cost is the loop continuing, which is the pre-fix behaviour, and it is
+     * announced rather than swallowed. Answering `true` on a failed read would be the dangerous
+     * direction, because it silently stops fetching content that was never refused.
+     */
+    #isTerminallyRefused(agentName, sessionId, contentHashHex) {
+        const key = this.#k(agentName, sessionId);
+        /**
+         * ⚠️ **A FAILING READ MUST NOT BE RETRIED PER MESSAGE — review F3.**
+         *
+         * The loaded flag is set only on success, so a database that throws (a full disk, a corrupt
+         * page) sent this method back to SQLite on EVERY witnessed leaf, logged an ERROR each time, and
+         * — because nothing was ever cached — made `alreadyKnown` false forever, so the mark's INFO
+         * fired on every refusal too. That is the ~2/s log growth this unit exists to end, reproduced
+         * by its own fix in the failure mode.
+         *
+         * Backed off instead: one attempt per session per minute, so the read still recovers when the
+         * disk does, and the ERROR is bounded rather than proportional to traffic.
+         */
+        const failedAt = this.#terminalRefusalsReadFailedAt.get(key);
+        const backedOff = failedAt !== undefined && Date.now() - failedAt < TERMINAL_REFUSAL_READ_RETRY_MS;
+        if (!this.#terminalRefusalsLoaded.has(key) && !backedOff && this.#db) {
+            try {
+                const rows = this.#db
+                    .prepare("SELECT content_hash FROM terminal_content_refusals WHERE agent_id = ? AND session_id = ?")
+                    .all(this.#requireAgentId(agentName), sessionId);
+                let set = this.#terminallyRefused.get(key);
+                if (!set) {
+                    set = new Set();
+                    this.#terminallyRefused.set(key, set);
+                }
+                for (const r of rows)
+                    set.add(r.content_hash);
+                this.#terminalRefusalsLoaded.add(key);
+                this.#terminalRefusalsReadFailedAt.delete(key);
+            }
+            catch (err) {
+                this.#terminalRefusalsReadFailedAt.set(key, Date.now());
+                this.#logger.error("session.content.terminal_refusal.read.failed", {
+                    agentName, sessionId,
+                    error: extractErrorMessage(err),
+                    retryInMs: TERMINAL_REFUSAL_READ_RETRY_MS,
+                    impact: "the record of messages this conversation can never accept could not be read, so this daemon may keep fetching one of them. Nothing is lost; the cost is repeated work and log noise. The read is retried once a minute rather than on every message, so this line is bounded — its absence for a while does NOT mean the fault cleared.",
+                    guidance: "This is a fault on THIS machine, not with any counterparty. Check free disk space and the permissions on ~/.cello; the error above carries SQLite's own message.",
+                });
+            }
+        }
+        return this.#terminallyRefused.get(key)?.has(contentHashHex) === true;
+    }
     #scheduleLeafFetchIfUnresolved(agentName, sessionId, contentHashHex) {
         const key = this.#k(agentName, sessionId);
         if (this.#resolvedContent.get(key)?.has(contentHashHex))
             return;
+        // DOD-M15-REFUSALTERMINAL-1: a refusal nothing can get past is the end of the work, not a
+        // reason to come back in two seconds.
+        if (this.#isTerminallyRefused(agentName, sessionId, contentHashHex))
+            return;
         const timerKey = `${key}::${contentHashHex}`;
         // ONE fetch per content hash. The relay redelivers, and a redelivery carries the same sequence —
         // scheduling per redelivery turns a slow relay into a storm against itself.
@@ -8592,25 +10525,34 @@ export class SessionNodeManager {
         if (!own)
             return "none";
         try {
-            // Canonical Structure 1 is [version, content_hash, sender_pubkey, session_id, last_seen_seq, timestamp].
-            const fields = decode(own.structure1Cbor);
-            const contentHash = fields[1];
-            if (!(contentHash instanceof Uint8Array)) {
+            // Canonical Structure 1 is [version, content_hash, sender_pubkey, session_id, last_seen_seq,
+            // timestamp], plus last_seen_hash at index 6 on a v2 claim (020-ACKHASH). content_hash is
+            // index 1 in both.
+            const s1 = decodeStructure1(own.structure1Cbor);
+            if (!s1.ok) {
                 this.#logger.warn("session.seal.leaf.recover.failed", {
-                    sessionId, agentName, reason: "structure1_content_hash_missing",
+                    // NAMED AT ITS CAUSE — review F2. This read `structure1_content_hash_missing`, which was
+                    // accurate when the only check was `contentHash instanceof Uint8Array`. It now fires for an
+                    // unknown layout, undecodable CBOR and a malformed field too, and sends an operator to
+                    // audit a content hash when the layout is what disagreed. `structure1Reason` carries which.
+                    sessionId, agentName, reason: "structure1_decode_failed", structure1Reason: s1.reason,
                     impact: "cannot tell whether a SEAL ctrl leaf was already posted, so the close refuses rather than risk a second one",
                 });
                 return "unknown";
             }
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
+            const contentHashHex = Buffer.from(s1.fields.contentHash).toString("hex");
             return {
                 reportedRootHex: this.getSessionTree(agentName, sessionId).rootWithAppendedHex(contentHashHex),
                 sequenceNumber: own.sequenceNumber,
             };
         }
         catch (err) {
+            // NOT a decode failure — review F3. `decodeStructure1` never throws, so the only thrower left
+            // inside this try is the tree derivation below it. Calling this `structure1_decode_failed`
+            // pointed at CBOR for a fault in `rootWithAppendedHex`, and made one reason string mean two
+            // unrelated things in the same log event.
             this.#logger.warn("session.seal.leaf.recover.failed", {
-                sessionId, agentName, reason: "structure1_decode_failed",
+                sessionId, agentName, reason: "seal_root_derivation_threw",
                 error: err instanceof Error ? err.message : String(err),
                 impact: "cannot tell whether a SEAL ctrl leaf was already posted, so the close refuses rather than risk a second one",
             });
@@ -8682,9 +10624,13 @@ export class SessionNodeManager {
     originalContent, 
     /**
      * DOD-M15-SEALWIRE-1 bullet 5: threaded from `ingestReceivedContent`, which is the only place
-     * that has it — `#recordFrameOrdering` verified this signature against the pubkey inside the
-     * sender's own signed bytes and matched the signer to this session's counterparty. It reaches
-     * the transcript row from here or not at all.
+     * that has it — `#verifyAuthorshipClaim` verified this signature (carried on the frame beside
+     * the bytes it signs) against the pubkey inside those bytes, and matched the signer to this
+     * session's counterparty. It reaches the transcript row from here or not at all.
+     *
+     * ⚠️ IT USED TO NAME `#recordFrameOrdering`, true until `DOD-M15-AUTHORSHIP-ABSENT-1` moved the
+     * check off the relay's record and onto the frame's own signature. Rewritten rather than
+     * deleted: the old name is the evidence of what authorship used to depend on.
      *
      * Undefined on the held-release and soft-fallback paths; the row records that as
      * `local_session_state` rather than leaving it indistinguishable from a proven one.
@@ -8780,6 +10726,17 @@ export class SessionNodeManager {
                 this.#undeliverableSeqs.set(recvKey, lost);
             }
             lost.add(leafIndex);
+            // DOD-M15-NO-SILENT-REFUSAL-1: noted HERE, where the write actually fails, and not on the
+            // cello_receive exit that reports it. `#undeliverableSeqs` is in memory, so the receive exit
+            // stops being able to say this after a restart while the transcript hole stays permanent —
+            // and the exit only runs if somebody is attending, which is the case this whole line is for.
+            this.noteContentRefusal(agentName, sessionId, "content_undeliverable", {
+                kind: REFUSAL_KINDS.LOST,
+                impact: `a message arrived and was committed to the hash chain at sequence ${leafIndex}, and then its text could not be written to the local transcript. Delivery reads the transcript, so that message can never be handed to any session — it is a permanent hole in this side's copy of the conversation.`,
+                guidance: "This is a fault on THIS machine; the counterparty did nothing wrong. Find out why the write failed — it is almost always something ordinary. " +
+                    "If you are reading this through a coding agent, have it check free disk space, the permissions on ~/.cello, and transcript.message.record.failed in the daemon log, which carries the underlying error. " +
+                    "Waiting cannot recover it. Once the fault is fixed, ask them to resend. If you genuinely cannot work out the cause, reach out to CELLO_Support.",
+            });
         }
         // Review finding #6: the witness for this hash has done its ordering job once the leaf is
         // appended — drop it so #witnessedSeq stays proportional to held/pending content, not the whole
@@ -9502,6 +11459,11 @@ export class SessionNodeManager {
             }
             else if (entry.screenedOut) {
                 this.appendSessionLeaf(agentName, sessionId, "msg", entry.contentHashHex, entry.correlationId);
+                // The SAME witness leak as the immediate-append terminal-block branch (see the block comment
+                // at the `if (terminalBlock)` append in `ingestReceivedContent`), on the held path. This
+                // branch also bypasses `#appendVerifiedContent`, where the drop lives — so a blocked message
+                // that arrived out of order left `missingLeaves` stuck at 1 and the session unsealable.
+                this.#witnessedSeq.get(key)?.delete(entry.contentHashHex);
             }
             else {
                 this.#appendVerifiedContent(agentName, sessionId, entry.content, entry.contentHashHex, senderPubkey, entry.correlationId, entry.originalContent);
@@ -10013,6 +11975,14 @@ export class SessionNodeManager {
          */
         const memoKey = this.#k(agentName, sessionId);
         const priorDeclaredAlg = this.#unreadableAlgSeen.get(memoKey)?.get(contentHashHex);
+        /**
+         * `DOD-M15-AUTHORSHIP-ABSENT-1` review H1 — READ BEFORE THE INGEST, reported after it.
+         *
+         * Same reasoning as `priorDeclaredAlg` directly above: the memo says what THIS side did to this
+         * content on the direct path, and the ingest below is what decides whether the other route
+         * succeeded. Reading it after would race the clear.
+         */
+        const refusedForAuthorship = this.#refusedOnDirectPath.get(memoKey)?.has(contentHashHex) === true;
         const result = await this.ingestReceivedContent(agentName, sessionId, env.content, contentHash, correlationId, recoveredSeq ?? undefined, 
         // The envelope's own claim, verbatim — `undefined` on a v2 envelope, which resolves to
         // `sha256` and is exactly right for a peer that predates the field.
@@ -10053,6 +12023,48 @@ export class SessionNodeManager {
                 impact: "THIS EXACT MESSAGE was refused on the direct path because it named an algorithm this build cannot read, and the same content has now been accepted via the relay park under an algorithm this build CAN read. The refusal did not hold: the message was delivered by the other route.",
             });
         }
+        /**
+         * ⚠️ **THE AUTHORSHIP REFUSAL DOES NOT HOLD EITHER, AND THIS IS WHERE IT SAYS SO** — review H1.
+         *
+         * `DOD-M15-AUTHORSHIP-ABSENT-1` refuses a direct-path frame with no usable proof of who wrote
+         * it. Refusing sends no delivery ACK, so the sender's TTF backstop parks the message and it
+         * arrives here — where the ENVELOPE's signature over (session_id, recipient_pubkey,
+         * content_hash) is what authenticates it, and `authenticateParkedEntry` above has already
+         * accepted it. That is correct and it is deliberately NOT changed here: gating mail retrieval
+         * on a per-message record the relay-degraded path is allowed to omit is the false-positive shape
+         * this whole unit is careful to avoid, and the order that added the refusal scopes the park
+         * envelope out explicitly.
+         *
+         * What must not stand is the SILENCE. Without this line the operator reads "refused" and then
+         * watches the message appear, with nothing connecting the two — the same reconciliation gap the
+         * algorithm refusal above already pays for. What they need to know is the part that is really
+         * lost: the message arrived, and its INDIVIDUAL author is attested by the mailbox envelope
+         * rather than by a signature over that message's own bytes.
+         *
+         * Same `ok && !held && !screenedOut` predicate as above, and for the same reason: `ok` is not
+         * "delivered".
+         */
+        if (refusedForAuthorship && result.ok && result.held !== true && result.screenedOut !== true) {
+            const hashes = this.#refusedOnDirectPath.get(memoKey);
+            hashes?.delete(contentHashHex);
+            if (hashes && hashes.size === 0)
+                this.#refusedOnDirectPath.delete(memoKey);
+            /**
+             * ⚠️ RENAMED FROM `…authorship_refusal_reconciled` by `029c` review F4, because the memo it
+             * reads now covers EVERY direct-path refusal and not only the authorship one. Keeping the old
+             * name would have put "no usable proof of who wrote it" on a message that was actually
+             * refused for not decrypting — a wrong cause is worse than a general one.
+             *
+             * The specific reason is already on the operator's notice; what this event adds is that the
+             * refusal did not hold.
+             */
+            this.#logger.warn("content.recover.refusal_reconciled", {
+                agentName, sessionId, correlationId,
+                contentHash: contentHashHex,
+                impact: "THIS EXACT MESSAGE was refused on the direct path and the same content has now been accepted from the relay mailbox, where the sealed envelope proves the sender. The refusal did not hold: the message WAS delivered by the other route. What the direct path could not confirm is still unconfirmed — the mailbox proves WHO sent it and nothing about the check that refused it — so the receipt can show this message arrived without showing everything a directly-delivered one would.",
+                guidance: "Nothing to do about this message. The fix named on the original refusal still stands: until the cause clears, every message on this session takes the slower route and lands with less attached to it.",
+            });
+        }
         return result;
     }
     /**
@@ -12206,31 +14218,355 @@ export class SessionNodeManager {
             });
         }
     }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — SIGN OUR OWN CLAIM, with no relay involved.
+     *
+     * The relay submit has always built these bytes and signed them (`session-relay-client.ts`); this
+     * is the same construction, for the path where no submit happens. It is not a fallback in the
+     * silent sense — it produces exactly the artifact the witnessed path produces, minus the relay's
+     * countersigned position, which was never part of the authorship claim.
+     *
+     * ⚠️ THROWS when this agent has no identity key, and the throw is the correct outcome. It lands in
+     * the direct-send catch, which parks the message to the relay mailbox exactly as a failed dial
+     * does — so the message is not lost, and the operator hears about a local fault instead of a
+     * counterparty who mysteriously stopped receiving. Shipping the frame unsigned would guarantee a
+     * refusal at the far end and blame the wrong machine for it.
+     */
+    async #signOwnContentClaim(agentName, sessionId, entry, contentHash) {
+        const signer = this.#keyProviderResolver?.(agentName);
+        if (!signer) {
+            throw new Error("content_not_signable: this machine has no identity key for this agent, so it cannot sign " +
+                "the message it is about to send and the counterparty would refuse it as unattributable");
+        }
+        // The 16-byte relay session id when this session has one, so a frame built here is
+        // byte-comparable with one built by the submit. Falling back to the local id is not a
+        // second meaning: for every session created without an assignment the two are the same value
+        // (`relaySessionIdBytes` is set from `sessionId` on exactly those paths).
+        const sessionIdBytes = entry.relaySessionIdBytes ?? Uint8Array.from(Buffer.from(sessionId, "hex"));
+        const structure1 = encodeStructure1({
+            contentHash,
+            senderPubkey: await signer.getPublicKey(),
+            sessionId: sessionIdBytes,
+            // The highest counterparty position this session has seen, from the same source the submit
+            // reads. Zero when there is no relay client at all, which is honest: nothing has been
+            // witnessed on this session, so there is no position to acknowledge.
+            lastSeenSeq: entry.relayClient?.lastSeenSeq(Buffer.from(sessionIdBytes).toString("hex")) ?? 0,
+            timestamp: Date.now(),
+            // v1 DELIBERATELY. `last_seen_hash` (v2) is `WITHHOLD-SEAL-1`'s emitter and is not owed here;
+            // a v1 claim makes no content acknowledgement at all, which is honest, where an invented one
+            // would not be.
+        });
+        return { structure1, signature: await signer.sign(structure1) };
+    }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — DID THIS SENDER PROVE THEY WROTE THIS MESSAGE?
+     *
+     * The one place that answers it, for both callers, so "checked" cannot mean two different things
+     * in two places. It takes the signature as an ARGUMENT rather than digging it out of a structure,
+     * which is the whole of the fix: the signature used to be read only from `structure2_cbor` — the
+     * RELAY's record — so a receiver could not check authorship without a relay record, and refusing
+     * on its absence would have made the relay a precondition for reading mail. The content frame now
+     * carries the signature beside the bytes it signs, exactly as `hash_submit` always has, and this
+     * method does not care which of the two handed it over.
+     *
+     * It VERIFIES and it does not LOG. The severity of each verdict differs by caller — the content
+     * frame refuses an `unusable`, the park path shrugs at one — and a method that logged its own
+     * conclusion would either report a refusal that did not happen or stay silent on one that did.
+     */
+    #verifyAuthorshipClaim(agentName, sessionId, structure1Cbor, senderSignature, contentHash) {
+        // Structure 1 content_hash is index 1 and sender_pubkey index 2 in BOTH layouts — 020-ACKHASH
+        // appended last_seen_hash at 6 rather than inserting it, so neither read moved. A v2 claim
+        // decodes here exactly as a v1 one does; its hash is not consulted, because this unit ships
+        // reading and not enforcing.
+        const s1 = decodeStructure1(structure1Cbor);
+        // A layout this build cannot name yields no pubkey and no hash, so there is nothing to check the
+        // signature against. Its reason is carried out so an unreadable CLAIM and a wrong SIGNATURE stay
+        // distinguishable — they take the same outcome by different routes.
+        if (!s1.ok)
+            return { verdict: "unusable", reason: s1.reason };
+        const s1Hash = s1.fields.contentHash;
+        const s1Pubkey = s1.fields.senderPubkey;
+        // The SENDER's Ed25519 signature over the exact signed bytes — the same check the relay
+        // performs. `verify` never throws, so a wrong-width or garbage signature lands here as `false`:
+        // supplied and refuted, which is a different fact from not supplied at all.
+        if (!verify(s1Pubkey, structure1Cbor, senderSignature)) {
+            return { verdict: "refuted", reason: "bad_signature" };
+        }
+        // Sovereign-node cross-check: the signer MUST be THIS session's counterparty, not an unrelated
+        // key. Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from
+        // the IPC param and is never case-normalized, so a string compare would fail for a mixed-case
+        // pubkey and silently strip the canonical ordering from every message in that session.
+        const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
+        if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
+            /**
+             * REFUTED when the counterparty is KNOWN and the signer is someone else.
+             *
+             * This is the session-open MITM detection from the 2026-08-21 T-of-N investigation, which
+             * found this check *"fires correctly, and its answer is thrown away."* A rogue quorum of the
+             * directories holding shares for agent B can sign a false SessionAssignment naming M's key as
+             * B's, and everything downstream is genuinely real — M signs with M's own valid key. Nothing
+             * is missing for A to notice. This comparison is where the substitution shows, because
+             * `counterparty_pubkey` comes from A's own request and is untouched by anything the directory
+             * returns.
+             *
+             * ⚠️ AN EARLIER VERSION OF THIS COMMENT ADDED "it shows only when the record is present" —
+             * true when the proof was optional, and no longer the shape of the code: a content frame with
+             * no checkable proof is refused before it reaches ingest, so M cannot decline to supply one
+             * and be admitted anyway. Rewritten rather than deleted, because that sentence is the evidence
+             * of what the gap was. The park envelope is the remaining path where the ordering record is
+             * genuinely optional, and there the sender's authorship is proven by the envelope's own
+             * signature instead.
+             *
+             * `verified_unmatched` stays soft deliberately: with no counterparty on record we cannot prove
+             * the signer either way, and refusing there would strand a session whose row we failed to read
+             * rather than one that is under attack. It is also the only signal the orphan branch has.
+             */
+            return counterparty
+                ? { verdict: "refuted", reason: "signer_not_counterparty" }
+                : { verdict: "verified_unmatched", senderPubkey: s1Pubkey };
+        }
+        /**
+         * ─── THE BINDING CHECKS RUN LAST, AND THE ORDER IS A SECURITY PROPERTY ───────────────────────
+         *
+         * ⚠️ **THEY USED TO RUN FIRST, AND THAT HANDED THE ATTACKER A FREEZE-SUPPRESSION SWITCH** —
+         * review of `029b`, and it is the finding that mattered most.
+         *
+         * Everything below this line is `unusable`: the message is REFUSED and the session lives.
+         * Everything above it is `refuted`: the session FREEZES. So a check that can answer `unusable`
+         * before the signature has been verified lets a peer choose the softer outcome — flip one
+         * unauthenticated byte of `session_id` inside your own claim and a garbage signature, or a
+         * signature by a MITM's own key, stops being an identity incident and becomes a quiet refusal.
+         * The session-open MITM detection this function exists to serve was bypassable by exactly the
+         * party it detects.
+         *
+         * So the order is: decode → SIGNATURE → SIGNER → then what the proof is about. By the time
+         * either check below runs, the claim provably came from this session's counterparty, and the
+         * only question left is which message and which conversation they made it for.
+         *
+         * `seal-frontier-verify` already does it in this order (verify at :55, session id at :77). This
+         * code had it inverted.
+         */
+        // The claim must bind to THIS content. A signature over somebody else's bytes verifies perfectly
+        // and proves nothing about this message — without this, one signed claim could be replayed onto
+        // every frame that follows it.
+        if (!bytesEqual(s1Hash, contentHash)) {
+            return { verdict: "unusable", reason: AUTHORSHIP_CONTENT_HASH_MISMATCH };
+        }
+        /**
+         * ⚠️ **AND IT MUST BIND TO THIS CONVERSATION** — review M4, ruled in by Andre 2026-09-04.
+         *
+         * Binding the content and the signer is not enough on its own: a claim the counterparty
+         * genuinely signed in another session verifies unchanged here for the same bytes. Not a
+         * stranger and not forged content — a real line of theirs, landing in a transcript it was never
+         * written for, with a signature that checks out. That is worse than an unsigned message,
+         * because the receipt then PROVES something that did not happen.
+         *
+         * `session_id` has been in Structure 1 since v1 and this path never read it.
+         * `seal-frontier-verify` already compares it; the live receive path simply did not.
+         *
+         * **THE TWO VALUES CANNOT DIVERGE, and that is what makes this safe to enforce.** Both are
+         * derived from ONE session id on each side, by construction:
+         *   initiator — `sessionId = hex(assignment.session_id)` (`initiate-session-handler`) and
+         *               `relayParams.sessionIdBytes = assignment.session_id` (`daemon.ts`);
+         *   responder — `acceptSession(parsed.sessionIdHex)` and
+         *               `sessionIdBytes = Buffer.from(parsed.sessionIdHex, "hex")` (`inbound-sessions`);
+         *   direct/persisted — `relaySessionIdBytes = Buffer.from(sessionId, "hex")`.
+         * The two names exist because one keys the in-memory maps and one goes on the wire, not because
+         * they can hold different values. Getting this wrong would refuse EVERY message on EVERY live
+         * session, so it is stated rather than assumed.
+         *
+         * REFUSED, not frozen — and the sentence is TRUE where it now stands. The signature has
+         * verified and the signer has been matched to this session's counterparty three lines above;
+         * what is wrong is only the conversation the claim was made for, which is a replay rather than
+         * an identity fault. Said because an earlier version of this comment made the same claim from
+         * ABOVE the verification, where none of it had happened yet.
+         */
+        const expectedSessionId = this.#activeNodes.get(this.#k(agentName, sessionId))?.relaySessionIdBytes
+            ?? Uint8Array.from(Buffer.from(sessionId, "hex"));
+        if (!bytesEqual(s1.fields.sessionId, expectedSessionId)) {
+            return { verdict: "unusable", reason: AUTHORSHIP_SESSION_MISMATCH };
+        }
+        return { verdict: "verified", senderPubkey: s1Pubkey, senderSig: senderSignature };
+    }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — the refusal an inbound frame gets when its authorship cannot be
+     * established. NOT a freeze: see `AuthorshipVerdict` for why those are different facts.
+     *
+     * Both surfaces, always. The ERROR is the durable forensic record an investigation reads days
+     * later; the notice is the CONTROL — the thing that actually reaches the operator, who otherwise
+     * watches a conversation go quiet and concludes the other person stopped replying.
+     */
+    #refuseUnprovenAuthorship(agentName, sessionId, reason, contentHash, detail, correlationId) {
+        /**
+         * ⚠️ **THREE REASONS, THREE SENTENCES — AND THE THIRD USED TO BORROW THE SECOND'S** (review of
+         * `029b`, and it is the operator half of the same finding as the check order).
+         *
+         * A replayed claim is the one branch on this path that is potentially ADVERSARIAL: a real,
+         * valid, correctly-signed line of your counterparty's, presented in a conversation it was not
+         * written for. It was reaching the operator under the `unusable` wording, which says the proof
+         * was "unreadable, or signed over different content" — neither is true — and under guidance
+         * telling them to go and ask their counterparty to upgrade. A version number is not the
+         * question, and sending someone to chase one spends their attention on the wrong thing.
+         */
+        const impact = reason === "authorship_proof_absent"
+            ? "a message arrived carrying no proof of who wrote it, so it was NOT ingested, NOT shown and NOT attributed to anyone. Every message in this conversation has to be provable to whoever reads its receipt later, and this one could not be."
+            : reason === "authorship_wrong_conversation"
+                ? "a message arrived carrying a VALID signature by this conversation's counterparty — made for a DIFFERENT conversation. The same message, or an old one of theirs, was presented here. It was NOT ingested, NOT shown and NOT added to this conversation's record."
+                : "a message arrived whose proof of authorship could not be checked against it — it was unreadable, or it was signed over different content. It was NOT ingested, NOT shown and NOT attributed to anyone.";
+        /**
+         * ⚠️ THE VERB IS THE COUNTERPARTY'S, AND THE GUIDANCE SAYS SO. The reader is the RECEIVING
+         * operator, and there is nothing on their machine to change — the missing signature is produced
+         * on the sender's. Telling them to do something local would be an affordance that resolves to
+         * nothing. So it names the one move that works (tell them to upgrade) and the one that settles
+         * the other explanation (confirm out of band), and it stops at two.
+         *
+         * ⚠️ **IT USED TO OPEN "Nothing was shown and nothing was stored." THAT SENTENCE WAS FALSE** —
+         * review H1, and it is kept here rather than deleted because it is the exact shape this
+         * milestone exists to catch: a refusal that announces a stronger outcome than it delivers.
+         *
+         * Refusing sends no delivery ACK, so the sender's TTF backstop parks the message and it arrives
+         * through the relay mailbox seconds later, where the ENVELOPE's signature authenticates it and
+         * recovery accepts it — correctly, and with no per-message proof. So the message may well be
+         * delivered, moments after the operator was told it was not. The reconciliation is logged
+         * (`content.recover.refusal_reconciled`) and the sentence below now says what is
+         * actually true of this path: nothing was shown YET, and this refusal does not stop the copy
+         * coming the other way.
+         */
+        const guidance = reason === "authorship_wrong_conversation"
+            ? "STOPPED ON PURPOSE, and this one is NOT a version problem — do not go and ask them about " +
+                "their build. The signature is real and it is theirs; what is wrong is that it was made for " +
+                "another conversation, so something replayed it into this one. That is either software on " +
+                "one of your machines re-sending an old message into the wrong session, or someone in " +
+                "between doing it deliberately. ONE thing to do: ask your counterparty OUT OF BAND (a " +
+                "channel that is not this one) whether they meant to send this, before you continue here."
+            /**
+             * ⚠️ **THIS BRANCH SHIPPED AS `NaNcopy in the relay mailbox…` AND NOTHING NOTICED** — review
+             * F1, and it is worth more than the one-line fix.
+             *
+             * Splitting the guidance in two dropped the opening literal and left behind the `+` that had
+             * joined it, which is not a concatenation with nothing on its left — it is a UNARY PLUS on the
+             * next string. `+"REACH YOU BY…"` is `NaN`, and `NaN + "copy in the relay mailbox…"` is a
+             * perfectly good string. So the flagship refusal of this whole milestone reached the operator
+             * beginning mid-word with `NaN`, with its "STOPPED ON PURPOSE" framing and its reason gone.
+             *
+             * **The test was green because it asked the wrong question.** The only assertion on this
+             * string was `.toMatch(/upgrade/i)`, and "tell them to upgrade" survives at the tail. A
+             * substring match on a sentence cannot see that the sentence lost its head — so the assertion
+             * below pins what it OPENS with, which a truncation cannot survive.
+             */
+            : "STOPPED ON PURPOSE. This copy was refused and the message itself was not kept. " +
+                // Review F2: chosen from what THIS machine can do, not asserted. An agent with no identity
+                // key cannot open a mailbox copy either, and telling them to wait for one would be the same
+                // false promise on a different refusal.
+                (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                " Almost always their CELLO build is older than this one: a build from before message signing " +
+                "does not attach a signature at all. Ask which version they are running, and tell them to " +
+                "upgrade — this will keep happening until they do, and only they can fix it. If they are on " +
+                "the SAME version as you, that explanation does not hold: confirm with them OUT OF BAND " +
+                "before opening another session.";
+        this.#logger.error("session.content.refused", {
+            agentName, sessionId, correlationId, reason, ...detail, impact, guidance,
+        });
+        this.noteContentRefusal(agentName, sessionId, reason, { kind: REFUSAL_KINDS.REFUSED, impact, guidance });
+        // Armed AFTER the refusal is filed, so the memo can never claim a refusal that did not happen.
+        this.#noteRefusedOnDirectPath(agentName, sessionId, contentHash);
+    }
+    /**
+     * An inbound content frame refused before it could be read — the ENCRYPTION gate's three causes.
+     *
+     * ⚠️ **THESE LOGGED AND FILED NOTHING, AND THAT IS WHY THIS EXISTS.** All three carried a good
+     * `impact` and `guidance` at ERROR and none of them called `noteContentRefusal`, so the sentences
+     * an operator needed were in a file they have no reason to open. From their chair a message never
+     * arrived and the conversation went quiet — the exact defect `DOD-M15-NO-SILENT-REFUSAL-1` was
+     * built to end, on the same path, three checks above the one that respected it.
+     *
+     * Both surfaces, always: the ERROR is the durable forensic record an investigation reads days
+     * later, and the notice is the control — the thing that actually reaches the person.
+     */
+    /**
+     * Can a refused message still reach this operator through the relay mailbox? — review F2.
+     *
+     * Feature-detected, not assumed: `openContentSeal` is documented OPTIONAL on `KeyProvider`, and
+     * `content-park.ts` refuses recovery without it. Asking the same resolver `content-park.ts` asks
+     * is what keeps the sentence on the operator's screen tied to what their machine can actually do.
+     */
+    #mailboxRouteAvailable(agentName) {
+        const kp = this.#keyProviderResolver?.(agentName);
+        return kp !== undefined && typeof kp.openContentSeal === "function";
+    }
+    #refuseInboundContent(agentName, sessionId, reason, contentHash, detail, correlationId) {
+        // The sentence about the other route is chosen HERE, from what this machine can actually do —
+        // never written into a caller's literal, where it would be a promise nobody re-checked.
+        const guidance = `${detail.guidance} ${this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE}`;
+        this.#logger.error("session.content.refused", { agentName, sessionId, correlationId, reason, ...detail, guidance });
+        this.noteContentRefusal(agentName, sessionId, reason, {
+            kind: REFUSAL_KINDS.REFUSED, impact: detail.impact, guidance,
+        });
+        /**
+         * Review F4 — A PROMISE MADE HERE IS CLOSED IN `recoverParkedEntry`, not left standing.
+         *
+         * The guidance above tells the operator the message may arrive by the mailbox. Both sibling
+         * refusals on this path already arm a memo so the recovery can say the refusal did not hold;
+         * this one armed nothing, so a delivered message would have left a permanent alarm sitting in
+         * `cello_check_notifications` saying it had been turned away.
+         *
+         * Armed AFTER the notice is filed, so the memo can never claim a refusal that did not happen.
+         */
+        this.#noteRefusedOnDirectPath(agentName, sessionId, contentHash);
+    }
     #recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, source = "content_frame") {
         try {
-            const s1 = decode(structure1Cbor);
             const s2 = decode(structure2Cbor);
-            const s1Hash = s1?.[1];
-            const s1Pubkey = s1?.[2];
             const seq = typeof s2?.[0] === "number" ? s2[0] : -1;
             const s2Sig = s2?.[3];
-            if (!(s1Hash instanceof Uint8Array) || !(s1Pubkey instanceof Uint8Array) || !(s2Sig instanceof Uint8Array) || seq < 1) {
+            if (!(s2Sig instanceof Uint8Array) || seq < 1) {
                 // SOFT: we could not read the record, so we learned nothing about the signer either way.
                 // Position falls back to the witness stream, exactly as an absent record does.
-                this.#logger.warn("session.content.ordering.malformed", { sessionId, correlationId });
+                // The Structure 1 reason is carried so an unreadable RECORD and an unnamed LAYOUT are
+                // distinguishable in the log — they arrive at the same soft outcome by different routes.
+                const s1Layout = decodeStructure1(structure1Cbor);
+                this.#logger.warn("session.content.ordering.malformed", {
+                    sessionId,
+                    correlationId,
+                    ...(s1Layout.ok ? {} : { structure1Reason: s1Layout.reason }),
+                });
                 return { seq: null };
             }
-            // The framed ordering record must bind to THIS content (its hash) — else it orders the wrong bytes.
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
-            if (Buffer.from(s1Hash).toString("hex") !== contentHashHex) {
-                // SOFT: the record does not describe this content. Nothing is proven about the signer's
-                // identity — only that this record and these bytes do not belong together.
-                this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
+            /**
+             * `DOD-M15-AUTHORSHIP-ABSENT-1` — the same verifier the content frame uses, handed the
+             * signature the RELAY committed (`structure2_cbor` index 3) instead of the one the frame
+             * carries. Two claims about the same message, and both must hold: if the relay's copy of the
+             * sender's signature does not verify against the bytes on the frame, one of them has been
+             * altered in flight.
+             *
+             * The verdicts map to this path's own severities, which are NOT the content frame's:
+             * an `unusable` record leaves POSITION unknown and is soft here, because position may always
+             * fall back to the witness stream. Identity is the half that may never be soft, and it is
+             * established before this is called.
+             */
+            const auth = this.#verifyAuthorshipClaim(agentName, sessionId, structure1Cbor, s2Sig, contentHash);
+            if (auth.verdict === "unusable") {
+                if (auth.reason === AUTHORSHIP_CONTENT_HASH_MISMATCH) {
+                    // SOFT: the record does not describe this content. Nothing is proven about the signer's
+                    // identity — only that this record and these bytes do not belong together.
+                    this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
+                }
+                else if (auth.reason === AUTHORSHIP_SESSION_MISMATCH) {
+                    // Its own name, because `…malformed` points a reader at a decoder and this record decoded
+                    // perfectly — it belongs to another conversation. Unreachable in practice on this path:
+                    // `authenticateParkedEntry` binds `session_id` in the park TBS before anything is
+                    // unsealed, so a mismatched record cannot get this far. Named anyway, because an event
+                    // that lies about its cause is worse the day it does fire.
+                    this.#logger.warn("session.content.ordering.session_mismatch", { sessionId, correlationId });
+                }
+                else {
+                    this.#logger.warn("session.content.ordering.malformed", {
+                        sessionId, correlationId, structure1Reason: auth.reason,
+                    });
+                }
                 return { seq: null };
             }
-            // Verify the SENDER's Ed25519 signature over the exact signed bytes (structure1_cbor) — the same
-            // check the relay performs. Proves the counterparty committed to this (content_hash @ sequence).
-            if (!verify(s1Pubkey, structure1Cbor, s2Sig)) {
+            if (auth.verdict === "refuted" && auth.reason === "bad_signature") {
                 // FATAL. The sender supplied a signature and it does not verify against the key inside its
                 // own record. That is not an absence we could not resolve — it is a proof that failed.
                 this.#logger.warn("session.content.ordering.bad_signature", { sessionId, correlationId });
@@ -12240,41 +14576,23 @@ export class SessionNodeManager {
             // key. FAIL CLOSED (review L) — if the counterparty pubkey is unknown we cannot prove the signer,
             // so we do NOT trust the framed ordering record (fall back to the witness stream / arrival). The
             // "B does not trust the counterparty for ordering" invariant is non-negotiable; never fail open.
-            // Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from the
-            // IPC param and is never case-normalized, so a string compare would fail for a mixed-case
-            // pubkey and silently strip the canonical ordering from every message in that session.
-            const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
-            if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
+            if (auth.verdict !== "verified") {
                 /**
-                 * FATAL when the counterparty is KNOWN and the signer is someone else. SOFT when we simply
-                 * do not know who the counterparty is.
-                 *
-                 * The fatal half is the session-open MITM detection from the 2026-08-21 T-of-N
-                 * investigation, which found this check *"fires correctly, and its answer is thrown away."*
-                 * A rogue quorum of the directories holding shares for agent B can sign a false
-                 * SessionAssignment naming M's key as B's, and everything downstream is genuinely real —
-                 * M signs with M's own valid key. Nothing is missing for A to notice. This comparison is
-                 * where the substitution shows, because `counterparty_pubkey` comes from A's own request
-                 * and is untouched by anything the directory returns.
-                 *
-                 * ⚠️ IT SHOWS ONLY WHEN THE RECORD IS PRESENT (review F3). An earlier version of this
-                 * comment said this was "the one place the substitution shows", full stop — and that
-                 * asserted a property the code does not have: M can decline to supply an ordering record
-                 * and be ingested without ever reaching this line. The caller logs
-                 * `session.content.ordering.absent` so the weaker case is at least visible, and closing it
-                 * needs a check that does not depend on the sender's cooperation — the relay's independent
-                 * copy, `DOD-M15-CORROBORATE-1`.
+                 * FATAL when the counterparty is KNOWN and the signer is someone else (`refuted`). SOFT when
+                 * we simply do not know who the counterparty is (`verified_unmatched`) — the reasoning for
+                 * both, and the MITM substitution this catches, lives on `#verifyAuthorshipClaim`.
                  *
-                 * The soft half stays soft deliberately: `counterparty_unknown` means we cannot prove the
-                 * signer either way, and refusing there would strand sessions whose record we failed to
-                 * read rather than sessions that are under attack.
+                 * The soft half is the one that matters HERE: `counterparty_unknown` means we cannot prove
+                 * the signer either way, so we decline to take a POSITION from a record we cannot attribute,
+                 * and the caller falls back to the witness stream. Nothing about the message is refused on
+                 * this path — that decision was already made, on the frame's own proof.
                  */
-                const reason = counterparty ? "signer_not_counterparty" : "counterparty_unknown";
+                const reason = auth.verdict === "refuted" ? auth.reason : "counterparty_unknown";
                 this.#logger.warn("session.content.ordering.wrong_signer", { sessionId, reason, correlationId });
-                return counterparty ? { seq: null, fatal: { reason } } : { seq: null };
+                return auth.verdict === "refuted" ? { seq: null, fatal: { reason } } : { seq: null };
             }
             // Verified — record the relay-assigned canonical sequence (1-based → 0-based leaf index) for the gate.
-            this.recordWitnessedSequence(agentName, sessionId, contentHashHex, seq - 1);
+            this.recordWitnessedSequence(agentName, sessionId, Buffer.from(contentHash).toString("hex"), seq - 1);
             this.#logger.info("session.content.ordering.recorded", {
                 sessionId,
                 canonicalSeq: seq - 1,
@@ -12282,18 +14600,15 @@ export class SessionNodeManager {
                 correlationId,
             });
             /**
-             * DOD-M15-SEALWIRE-1 bullet 5: return the VERIFIED proof, not just the position.
+             * THE POSITION, AND ONLY THE POSITION — `DOD-M15-AUTHORSHIP-ABSENT-1`.
              *
-             * Three lines above, `verify(s1Pubkey, structure1Cbor, s2Sig)` has already passed and the
-             * signer has been matched to this session's counterparty. That is the strongest statement
-             * this daemon ever makes about who wrote a message — and until now it was made, used to
-             * decide a sequence number, and then discarded. The transcript row that outlives it recorded
-             * only a direction.
-             *
-             * Returned rather than stashed, for the same reason `seq` is: a caller that has to go looking
-             * for it in a side map is a caller that will not.
+             * `DOD-M15-SEALWIRE-1` bullet 5 had this return the verified proof as well, because this was
+             * the only place a signer was ever checked and the transcript row needed it from somewhere.
+             * The frame now carries the sender's signature beside the bytes it signs and the caller
+             * verifies it before calling this at all, so the proof reaches the transcript from there. What
+             * this answers is the question it is named for: WHERE the relay says this message sits.
              */
-            return { seq: seq - 1, senderPubkey: s1Pubkey, senderSig: s2Sig };
+            return { seq: seq - 1 };
         }
         catch (err) {
             this.#logger.warn("session.content.ordering.decode_failed", {
@@ -12535,40 +14850,37 @@ export class SessionNodeManager {
             const encState = this.#contentEncryptionState(agentName, sessionId);
             let plaintextBody;
             if (declaredEncryption !== SESSION_CONTENT_ENCRYPTION_V1) {
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "content_encryption_absent_or_unknown",
+                this.#refuseInboundContent(agentName, sessionId, "content_encryption_absent_or_unknown", contentHash, {
                     declared: typeof declaredEncryption === "string" ? declaredEncryption : "(absent)",
-                    impact: "the frame did not say it was encrypted under this session's key, so it was refused unread. Nothing was shown and nothing was stored.",
+                    impact: "the frame did not say it was encrypted under this session's key, so it was refused unread — nothing was shown and this copy was not kept.",
                     guidance: "STOPPED ON PURPOSE. A message arrived that was not encrypted under this session's key. " +
                         "This build never sends one, so either something between you rewrote the frame, or your " +
                         "counterparty is running something that is not CELLO. Confirm with them OUT OF BAND " +
                         "before opening another session.",
-                });
+                }, correlationId);
                 return;
             }
             if (encState.key === null) {
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "no_session_key",
+                this.#refuseInboundContent(agentName, sessionId, "no_session_key", contentHash, {
                     detail: encState.reason,
                     impact: "an encrypted message arrived and this side has no agreed key to open it, so it was refused unread rather than shown as garbage.",
-                    guidance: CONTENT_ENCRYPTION_GUIDANCE[encState.reason],
-                });
+                    // Review F6: the RECEIVE-side wording. The send-side table explains what became of a
+                    // message this operator sent, which is the wrong direction entirely for a message they
+                    // cannot open.
+                    guidance: CONTENT_ENCRYPTION_INBOUND_GUIDANCE[encState.reason],
+                }, correlationId);
                 return;
             }
             const opened = openSessionContent(encState.key, contentBytes);
             if (opened === null) {
                 // GCM's tag is the only thing separating "not for us" from "modified in flight", and this
                 // side must not branch on which — that would be branching on attacker-controlled input.
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "decrypt_failed",
+                this.#refuseInboundContent(agentName, sessionId, "decrypt_failed", contentHash, {
                     impact: "the message did not decrypt under this session's agreed key — it was modified in flight, or it was encrypted under a different key. Refused unread.",
-                    guidance: "STOPPED ON PURPOSE. Nothing was shown and nothing was stored. A message that fails this " +
-                        "check has either been altered on its way to you or was not encrypted for this session. " +
-                        "Confirm with your counterparty OUT OF BAND, then start a new session.",
-                });
+                    guidance: "STOPPED ON PURPOSE. Nothing was shown and this copy was not kept. A message that fails " +
+                        "this check has either been altered on its way to you or was not encrypted for this " +
+                        "session. Confirm with your counterparty OUT OF BAND, then start a new session.",
+                }, correlationId);
                 return;
             }
             plaintextBody = opened;
@@ -12586,6 +14898,12 @@ export class SessionNodeManager {
             // different fact, and it is now refused.
             const s1Cbor = frame["structure1_cbor"];
             const s2Cbor = frame["structure2_cbor"];
+            /**
+             * `DOD-M15-AUTHORSHIP-ABSENT-1` — the sender's own signature, carried BESIDE the bytes it
+             * signs, exactly as `hash_submit` has always carried it. This field is why identity no longer
+             * depends on the relay: it arrives whether or not a relay witnessed the message.
+             */
+            const senderSig = frame["sender_signature"];
             let framedSeq = null;
             /**
              * DOD-M15-SEALWIRE-1 bullet 5. Set ONLY when the ordering record verified — the signature
@@ -12595,36 +14913,93 @@ export class SessionNodeManager {
              * and the transcript row must say so rather than imply a proof it does not have.
              */
             let verifiedAuthorship;
-            if (s1Cbor instanceof Uint8Array && s2Cbor instanceof Uint8Array) {
+            /**
+             * 024-ORPHANTRIAGE: the signer when the signature verified but there was no counterparty to
+             * match it against. Its ONLY consumer is the orphan branch inside ingest — everywhere else a
+             * session record exists, so this stays `undefined` and nothing reads it.
+             */
+            let verifiedSignerUnmatched;
+            /**
+             * ─── NO PASSPORT, NO ENTRY — `DOD-M15-AUTHORSHIP-ABSENT-1` ───────────────────────────────
+             *
+             * ⚠️ **THIS COMMENT USED TO SAY THE OPPOSITE, AND THE SENTENCE IT REPLACES IS THE DEFECT.**
+             * It read: *"it means the per-message signer check is **opt-in for the sender** — a party that
+             * passed the peer gate and wants to avoid the comparison simply omits the proof."* That was an
+             * accurate description of the code, which is why it is rewritten here rather than deleted: it
+             * is the sentence a reader with a coding agent finds, and it must now describe what the code
+             * does. A frame that supplies nothing checkable is REFUSED. Omitting the proof buys the sender
+             * nothing except a message that does not arrive.
+             *
+             * The old reasoning was sound as far as it went — the signature was only ever DELIVERED inside
+             * the relay's Structure 2, so refusing on its absence would have made the relay a precondition
+             * for reading mail. It stopped one field short: the signature travels beside the bytes it
+             * signs now, on every content frame, so identity no longer needs the relay and position still
+             * does not require identity.
+             *
+             * ⚠️ REFUSED, NOT FROZEN. A frozen session is only cleared by opening a new one, and the
+             * overwhelmingly likely cause of an absent proof is a counterparty on an older build. The
+             * freeze is for a proof that FAILED (below, and in `#recordFrameOrdering`) — a positive fact
+             * about their key.
+             */
+            if (!(s1Cbor instanceof Uint8Array) || !(senderSig instanceof Uint8Array)) {
+                this.#refuseUnprovenAuthorship(agentName, sessionId, "authorship_proof_absent", contentHash, {
+                    // WHICH half is missing. A sender on an older build supplies neither; a stripped frame is
+                    // likelier to be missing one, and an investigator should not have to guess which.
+                    hasStructure1: s1Cbor instanceof Uint8Array,
+                    hasSenderSignature: senderSig instanceof Uint8Array,
+                }, correlationId);
+                return;
+            }
+            const authorship = this.#verifyAuthorshipClaim(agentName, sessionId, s1Cbor, senderSig, contentHash);
+            if (authorship.verdict === "refuted") {
+                /**
+                 * THE FORENSIC LINE, BEFORE THE FREEZE. `session.content.identity.frozen` records that a
+                 * session was stopped; this records WHICH check stopped it and on WHICH proof — the frame's
+                 * own signature, not the relay's copy of it. The two used to be the same event because there
+                 * was only one place a signer was checked; there are two now, and an investigation that
+                 * cannot tell them apart is looking at the wrong half of the wire.
+                 */
+                this.#logger.warn("session.content.authorship.refuted", {
+                    agentName, sessionId, correlationId, reason: authorship.reason,
+                    impact: "a message arrived with a proof of authorship that FAILED — it does not verify, or it is signed by a key that is not this session's counterparty. Nothing was ingested and the session is being frozen.",
+                });
+                await this.#freezeOnIdentityFailure(agentName, sessionId, authorship.reason, correlationId);
+                return;
+            }
+            if (authorship.verdict === "unusable") {
+                // A replayed claim gets its own name on BOTH surfaces, not just in the log context: it is
+                // the one `unusable` cause that may be adversarial, and it is the one the operator can act
+                // on. The others are a peer whose build or bytes we could not read.
+                this.#refuseUnprovenAuthorship(agentName, sessionId, authorship.reason === AUTHORSHIP_SESSION_MISMATCH ? "authorship_wrong_conversation" : "authorship_proof_unusable", contentHash, { detail: authorship.reason }, correlationId);
+                return;
+            }
+            if (authorship.verdict === "verified") {
+                verifiedAuthorship = { senderPubkey: authorship.senderPubkey, senderSig: authorship.senderSig };
+            }
+            else {
+                verifiedSignerUnmatched = authorship.senderPubkey;
+            }
+            if (s2Cbor instanceof Uint8Array) {
                 const ordering = this.#recordFrameOrdering(agentName, sessionId, s1Cbor, s2Cbor, contentHash, correlationId);
                 if (ordering.fatal) {
                     await this.#freezeOnIdentityFailure(agentName, sessionId, ordering.fatal.reason, correlationId);
                     return;
                 }
                 framedSeq = ordering.seq;
-                if (ordering.senderPubkey !== undefined && ordering.senderSig !== undefined) {
-                    verifiedAuthorship = { senderPubkey: ordering.senderPubkey, senderSig: ordering.senderSig };
-                }
             }
             else {
                 /**
-                 * Review F3 — THE WEAKER GUARANTEE MUST NOT BE INDISTINGUISHABLE FROM THE STRONGER ONE.
-                 *
-                 * A frame with no ordering record is still ingested, and that is correct: it is the
-                 * documented relay-degraded path, and refusing it would make the relay a precondition for
-                 * reading mail. But it means the per-message signer check is **opt-in for the sender** — a
-                 * party that passed the peer gate and wants to avoid the comparison simply omits the proof.
-                 * Silently, until now: nothing recorded that a message arrived unverified, so the log looked
-                 * identical to one where every message had been checked.
+                 * POSITION IS THE ONLY THING THAT CAN BE ABSENT NOW, and this event is about position.
                  *
-                 * Not fatal, and deliberately not: an absent record proves nothing about the signer, and
-                 * refusing on an absence would strand every relay-degraded session. What closes the omission
-                 * case is relay-side corroboration — `DOD-M15-CORROBORATE-1` — where the relay holds the
-                 * sender's signed hash independently and never routes it through this daemon.
+                 * It fires on the relay-degraded path, where the sender had no witnessed record to stamp
+                 * on. The message is ingested — its author is proven, above, by the frame's own signature —
+                 * and only its place in the canonical sequence falls back to the witness stream. Refusing
+                 * here would make the relay a precondition for reading mail, which is the thing this unit
+                 * was careful NOT to do.
                  */
                 this.#logger.info("session.content.ordering.absent", {
                     agentName, sessionId, correlationId,
-                    impact: "this frame carried no signed ordering record, so its SIGNER was not verified for this message — it was ingested on the strength of the authenticated transport alone",
+                    impact: "this frame carried no relay ordering record, so its POSITION in the canonical sequence is not known from the frame and falls back to the witness stream. Its AUTHOR was verified from the frame's own signature.",
                 });
             }
             // AC-001: carry the sender's correlationId from the frame into the receive
@@ -12641,7 +15016,7 @@ export class SessionNodeManager {
             const ingest = await this.ingestReceivedContent(
             // THE DECRYPTED body — everything downstream (the hash cross-check, the leaf, the transcript,
             // the delivery buffer) works on plaintext, exactly as it did before this layer existed.
-            agentName, sessionId, plaintextBody, contentHash, correlationId, framedSeq ?? undefined, declaredAlg === undefined ? undefined : declaredAlg, verifiedAuthorship);
+            agentName, sessionId, plaintextBody, contentHash, correlationId, framedSeq ?? undefined, declaredAlg === undefined ? undefined : declaredAlg, verifiedAuthorship, verifiedSignerUnmatched);
             // AC-001: after the content is durably ingested AND its hash cross-check
             // succeeds, emit an unsigned `persisted` delivery ACK back to the sender. A
             // rejected ingest (tamper / not-active) produces NO ACK, so the sender's TTF