@cello-protocol/daemon 0.0.188 → 0.0.189

package/dist/session-node-manager.js

@@ -23,7 +23,7 @@
 import { contentHashFor, resolveContentHashAlg, CONTENT_HASH_ALGS } from "./wire-content-hash.js";
 import { CAPACITY_REASONS } from "./refusal-reasons.js";
 import { onPeerSaltFrame, ownSaltFrame, SALT_ADOPTION_LABEL_MAX, SALT_ADOPTION_LABELS, SALT_FREEZE_GUIDANCE, } from "./session-salt-agreement.js";
-import { CONTENT_ENCRYPTION_REASONS, CONTENT_ENCRYPTION_GUIDANCE, SESSION_CONTENT_ENCRYPTION_V1, } from "./content-encryption-status.js";
+import { CONTENT_ENCRYPTION_REASONS, CONTENT_ENCRYPTION_GUIDANCE, CONTENT_ENCRYPTION_INBOUND_GUIDANCE, SESSION_CONTENT_ENCRYPTION_V1, } from "./content-encryption-status.js";
 import { openEncryptedDatabase, resolveDbKey, dbKeyPathFor, } from "./sqlcipher-db.js";
 import { migrateToEncryptedIfNeeded } from "./identity-migration.js";
 import { ensureIdentitySchema } from "./db-identity-store.js";
@@ -38,7 +38,7 @@ import { publishableEndpoint, relayOnlyState } from "./relay-only.js";
 import { randomUUID, createHash, randomBytes } from "node:crypto";
 import * as lp from "it-length-prefixed";
 import { decode } from "cbor-x";
-import { encodeCbor, decodeStructure1 } from "@cello-protocol/protocol-types";
+import { encodeCbor, decodeStructure1, encodeStructure1 } from "@cello-protocol/protocol-types";
 import { MAX_SESSION_NODES, STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 import { SessionConnectionGater } from "./session-connection-gater.js";
 import { SessionTree, sessionTreeLeafKindFromDb } from "./session-tree.js";
@@ -381,6 +381,127 @@ export const REVIVE_RESERVATION_CANDIDATES = 2;
  * the healthy direct latency and far below anything a person would notice.
  */
 export const LEAF_FETCH_GRACE_MS = 2_000;
+/**
+ * DOD-M15-REFUSALTERMINAL-1 — the refusal reasons no retry can ever get past.
+ *
+ * MEASURED LIVE 2026-09-04: one message aimed at a conversation the counterparty had already
+ * closed, refused `session_committed` and re-fetched roughly twice a second for 62 hours across
+ * several daemon restarts — 232,056 refusal events on that one session and a 484 MB `daemon.log`.
+ *
+ * **WHY `session_committed` QUALIFIES.** A committed session carries a signature over its contents.
+ * Nothing can be appended to it by anyone — not the counterparty, not us — so there is no future
+ * state in which this content is accepted. That is the bar, and it is the whole bar.
+ *
+ * **⚠️ DO NOT ADD A REASON WITHOUT MEETING IT.** A reason wrongly called terminal silently drops a
+ * message that would have arrived on the next try, which is worse than the loop this set exists to
+ * end. The tempting ones and why each fails:
+ *
+ *   - `content_hash_mismatch` — the fetch is BY CONTENT HASH, and a later fetch may retrieve a
+ *     correct copy from a different relay. Retrying can succeed.
+ *   - `sender_unresolved` — the sender may become resolvable when a profile arrives or a directory
+ *     syncs. Retrying can succeed.
+ *   - `session_orphaned` — `024-ORPHANTRIAGE` owns that path and decides its disposition.
+ *   - `session_size_limit_exceeded` — the cap IS monotonic, but its bound is a setting, and an
+ *     operator who raises it must be able to un-stick the conversation.
+ *   - a transient screener block — transient is in its name.
+ */
+/**
+ * ⚠️ NOT the same concept as `session-terminal-refusal.ts` (`DOD-MP-SESSION-RETIRE-1`), which is the
+ * RELAY terminally refusing one of OUR SENDS. This set is about INBOUND content this side will
+ * never accept. Two "terminal refusal" ideas live in this daemon and they point in opposite
+ * directions — review F9.
+ */
+export const TERMINAL_REFUSAL_REASONS = new Set(["session_committed"]);
+/**
+ * DOD-M15-REFUSALTERMINAL-1 review F3 — how long a FAILED read of the terminal-refusal rows is
+ * backed off for, per session.
+ *
+ * A minute: long enough that a database throwing on every witnessed leaf produces one ERROR rather
+ * than one per message (the exact log growth this unit exists to end), short enough that a disk
+ * which recovers is noticed within a message or two rather than at the next restart.
+ */
+export const TERMINAL_REFUSAL_READ_RETRY_MS = 60_000;
+/**
+ * DOD-M15-REFUSALTERMINAL-1 review F7 — how many terminally-refused content hashes are remembered
+ * per session.
+ *
+ * The counterparty chooses how many rows this table gets: one per distinct message aimed at a
+ * closed conversation, written even after the byte cap has stopped retaining evidence. 512 matches
+ * `MAX_REFUSED_PARKED_ENTRIES`, is far above any honest volume for a conversation that has ENDED,
+ * and bounds the table at (sessions × 512) small rows.
+ */
+export const MAX_TERMINAL_REFUSALS_PER_SESSION = 512;
+/**
+ * The `unusable` reason for a proof that is real and describes some OTHER message.
+ *
+ * ⚠️ NOT `"content_hash_mismatch"` — review §6. That string is already the refusal reason for the
+ * RECEIVER's own recompute failing (`ingestReceivedContent`), which is a tamper signal about the
+ * BODY. This one says the sender's signed claim is about different content. Two different failures
+ * sharing one name is a collision an operator grepping the log walks straight into.
+ */
+const AUTHORSHIP_CONTENT_HASH_MISMATCH = "authorship_hash_mismatch";
+/**
+ * The `unusable` reason for a proof that is real, is by the right signer, describes this content —
+ * and was signed for a DIFFERENT conversation. A replay, not a forgery.
+ *
+ * Every one of those properties has been ESTABLISHED by the time this is returned; see the ordering
+ * note in `#verifyAuthorshipClaim`. An earlier version of this sentence was true of the intent and
+ * not of the code, because the check ran before the signature was verified.
+ */
+const AUTHORSHIP_SESSION_MISMATCH = "session_mismatch";
+/**
+ * ⚠️ **THE REFUSALS THAT SAY THIS ARE THE ONES WHERE THE REFUSAL DOES NOT HOLD — NOT ALL OF THEM.**
+ *
+ * It said "EVERY INBOUND REFUSAL SAYS THIS", and review F5 measured that: fifteen call sites file a
+ * refusal notice in this file and four carry this sentence — the three encryption causes and the
+ * authorship one. The rest MUST NOT. A screened-out message is deliberately never delivered by any
+ * route, and a transcript write failure lost content that was already accepted; promising either
+ * operator a second chance would be a lie in the opposite direction. Rewritten rather than deleted,
+ * because "EVERY" read as a rule and the next person to add a refusal would have applied it blindly.
+ *
+ * Where it DOES apply: refusing an inbound frame sends back no delivery acknowledgement, so a CELLO
+ * sender's TTF backstop parks a copy in the relay mailbox — sealed to this agent's LONG-TERM
+ * IDENTITY key, not the session key — and recovery opens that one whatever went wrong with the
+ * direct copy.
+ *
+ * ⚠️ AND ONLY WHEN THIS MACHINE CAN OPEN ONE. See `REFUSAL_NO_OTHER_ROUTE`; the choice is made by
+ * `#mailboxRouteAvailable`, never by a caller writing the sentence into a literal.
+ */
+const REFUSAL_MAY_STILL_ARRIVE = "IT MAY STILL REACH YOU BY THE OTHER ROUTE: a refusal sends back no acknowledgement, so a CELLO " +
+    "counterparty's agent parks a copy in the relay mailbox and this side opens that one with your " +
+    "long-term key instead of this session's. If it arrives, it arrives without whatever this check " +
+    "was unable to confirm — and if they are not running CELLO, there is no such copy and it will " +
+    "not arrive.";
+/**
+ * ⚠️ **THE OTHER ROUTE DOES NOT EXIST ON THIS MACHINE, AND SAYING SO IS THE POINT** — review F2.
+ *
+ * Opening a mailbox copy needs `KeyProvider.openContentSeal`, which is OPTIONAL: a threshold or
+ * signing-only provider does not implement it, and an agent loaded without a provider has none at
+ * all. `content-park.ts` refuses both — `signing_key_unavailable`, `cannot_unseal`.
+ *
+ * That is the SAME condition `CONTENT_ENCRYPTION_REASONS.NO_LOCAL_IDENTITY` reports. So on the one
+ * refusal that names a missing local identity, the reassurance above was false: both routes are shut
+ * by one cause, permanently, for every message on every session of that agent — and the operator was
+ * told to wait for a delivery that cannot happen. That is the H1 defect exactly: a refusal
+ * announcing a better outcome than it delivers.
+ */
+const REFUSAL_NO_OTHER_ROUTE = "AND IT WILL NOT REACH YOU BY THE OTHER ROUTE EITHER: the relay mailbox copy is opened with this " +
+    "agent's long-term identity key, which is the very thing this machine is missing. One cause shuts " +
+    "both routes, and it will keep shutting them until the agent is loaded with its identity key. Do " +
+    "not wait for this message to turn up.";
+/**
+ * Constant-shape byte equality for the two binding checks. Lifted rather than hand-rolled a second
+ * time — `seal-frontier-verify` has the same helper for the same comparison, and two copies of
+ * "are these the same bytes" is two things to keep true.
+ */
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
 /**
  * The relay's peer id out of a circuit listen address, or `null` if the address does not name one.
  *
@@ -911,6 +1032,21 @@ export class SessionNodeManager {
     /** In-flight grace timers, keyed session+hash, so a redelivered leaf does not schedule a second
      *  fetch for the same content — a slow relay must not be turned into a storm against itself. */
     #leafFetchTimers = new Map();
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: content hashes refused for a reason no retry can get past — a READ
+     * CACHE over `terminal_content_refusals`, never the record itself.
+     *
+     * ⚠️ **NOT the same fact as `#resolvedContent`, and collapsing them is the trap.** "Resolved"
+     * means we HAVE the content. Terminally refused means we have it and are never accepting it.
+     * Filing one under the other tells the next reader that refused content was delivered.
+     */
+    #terminallyRefused = new Map();
+    /** Sessions whose terminal-refusal rows have been read from the database into the map above.
+     *  Nothing ever un-marks content, so a loaded set only grows and can never go stale. */
+    #terminalRefusalsLoaded = new Set();
+    /** DOD-M15-REFUSALTERMINAL-1 review F3: when the load above last FAILED, per session. Bounds the
+     *  retry and the ERROR to once a minute instead of once per witnessed leaf. */
+    #terminalRefusalsReadFailedAt = new Map();
     /** Test seam: collapse the grace window so a test does not have to wait two real seconds. The
      *  window itself is covered by its own case. */
     #leafFetchGraceMs = LEAF_FETCH_GRACE_MS;
@@ -1324,6 +1460,26 @@ export class SessionNodeManager {
      * entry is removed the moment it is reconciled.
      */
     #unreadableAlgSeen = new Map();
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` review H1, widened by `029c` review F4 — the content hashes this
+     * side refused ON THE DIRECT PATH, for any reason, so the park path can say so when the same
+     * message arrives the other way.
+     *
+     * One map rather than one per refusal: what the park path needs to know is "did we turn this
+     * content away and tell somebody so", and the reason is already on the notice.
+     *
+     * **The silence this closes.** A direct-path refusal sends no delivery ACK, so the sender's TTF
+     * backstop parks the message and it arrives through the relay mailbox seconds later — where the
+     * ENVELOPE's signature is what authenticates it, and recovery correctly accepts it. So the
+     * message is delivered, with no per-message proof, moments after the operator was told it was
+     * refused. Nothing tied the two events together, which is the same shape the algorithm refusal
+     * above already had and the same remedy.
+     *
+     * Same bounded shape and the same reason: it is fed entirely by a remote party, so losing an
+     * entry costs one reconciliation line and an unbounded map would be a leak with a peer's hand on
+     * the tap.
+     */
+    #refusedOnDirectPath = new Map();
     // DOD-MSG-4 (strict in-order): the RELAY is the ordering authority (Structure 2). For each
     // message the relay witnesses, it delivers B a (content_hash -> canonical sequence) binding via
     // the leaf_deliver stream. B records it here — keyed #k(agent,session) -> (contentHashHex -> seq)
@@ -2111,9 +2267,17 @@ export class SessionNodeManager {
         -- else — which is the whole point of a notarized record.
         --
         -- sender_sig holds one of TWO things, and which one is told by direction:
-        --   RECEIVED row -> the Structure-2 signature, stored ONLY after the receiver verified it
-        --                   against the pubkey inside the sender's own signed bytes
-        --                   (#recordFrameOrdering). Verified, never claimed.
+        --   RECEIVED row -> the sender's signature over their own Structure-1 bytes, carried on the
+        --                   content frame BESIDE those bytes, stored ONLY after the receiver
+        --                   verified it against the pubkey inside them (#verifyAuthorshipClaim).
+        --                   Verified, never claimed.
+        --                   ⚠️ THIS USED TO READ "the Structure-2 signature ... (#recordFrameOrdering)"
+        --                   and it named a real place: until DOD-M15-AUTHORSHIP-ABSENT-1 the only
+        --                   copy of that signature this side ever saw was the one the RELAY had
+        --                   committed at Structure-2 index 3, so a message with no relay record had
+        --                   no checkable author at all. Rewritten rather than deleted: an auditor
+        --                   reading the old sentence goes looking for Structure-2 bytes that, on a
+        --                   relay-degraded message, do not exist.
         --   SENT row     -> OUR OWN signature over the Structure-1 bytes we put on the wire, taken
         --                   from the submit result. Produced, not verified — there was no
         --                   counterparty in the act, so it must NEVER be labelled verified_signature.
@@ -2121,11 +2285,16 @@ export class SessionNodeManager {
         -- ⚠️ self_authored COVERS TWO PROVENANCES, and sender_sig IS NOT NULL is the discriminator.
         -- Named here because it is the same shape this column exists to prevent, one level up: a
         -- provable sent row and an unprovable one share a label, so a reader keying on attribution
-        -- alone cannot tell them apart. An unprovable sent row is legitimate — an UNWITNESSED send
-        -- never put a Structure 1 on the wire, so there is nothing signed to store — but the reader
-        -- has to be told where the distinction lives, or it will be rediscovered as a bug.
+        -- alone cannot tell them apart.
         --   self_authored + sender_sig NOT NULL -> we wrote it and can prove we did
-        --   self_authored + sender_sig NULL     -> we wrote it; the relay never witnessed it
+        --   self_authored + sender_sig NULL     -> we wrote it; no proof was stored for this row
+        --
+        -- ⚠️ THE NULL CASE USED TO READ "the relay never witnessed it", and DOD-M15-AUTHORSHIP-ABSENT-1
+        -- made that false. Every content frame now carries this side's signature over its own
+        -- Structure 1 whether or not a relay witnessed the leaf, so an unwitnessed send is provable
+        -- too. Rewritten rather than deleted: the old sentence is why a NULL here was read as
+        -- ordinary. It is not ordinary now — it means this machine could not sign at all, or the row
+        -- came by a path that carries no proof, and both are worth a second look.
         --
         -- attribution is NOT NULL ON PURPOSE, and it is the load-bearing column. There is a soft
         -- path — session.content.ordering.decode_failed falls back to hash-dedup — that ingests a
@@ -2135,7 +2304,7 @@ export class SessionNodeManager {
         -- nothing distinguishes them. Forcing every writer to name which it is makes silent NULL
         -- impossible rather than merely discouraged.
         sender_pubkey TEXT,             -- from INSIDE the sender's signed bytes; NULL unless verified
-        sender_sig BLOB,                -- the VERIFIED Structure-2 signature; NULL unless verified
+        sender_sig BLOB,                -- the VERIFIED sender signature over structure1_cbor (see above); NULL unless verified
         attribution TEXT NOT NULL DEFAULT 'local_session_state',  -- verified_signature | self_authored | local_session_state
         PRIMARY KEY (agent_id, session_id, sequence, direction)
       )
@@ -2349,6 +2518,129 @@ export class SessionNodeManager {
         last_at INTEGER NOT NULL,
         PRIMARY KEY (agent_id, session_id, reason)
       )
+    `);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — the lifetime refusal count, which `content_refusal_notices` is
+         * NOT and never was.
+         *
+         * `cello_dismiss` DELETEs the notice row (`dismissContentRefusals`), so `notices.count` restarts
+         * at 1 after every dismissal. That is correct for the notice — the operator said "I know" and
+         * the next announcement should describe what happened since — and it is exactly why the number
+         * shown beside it cannot be described as a lifetime figure. Live on 2026-09-04 an inbox reported
+         * `times: 58` for a refusal that had fired tens of thousands of times.
+         *
+         * A separate table rather than a column, because the two have different lifetimes: this one is
+         * never deleted by anything an operator does. Same key, so the read is one LEFT JOIN.
+         */
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS content_refusal_totals (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        total INTEGER NOT NULL,
+        first_at INTEGER NOT NULL,
+        last_at INTEGER NOT NULL,
+        -- 1 when this row was SEEDED from an existing notice at upgrade rather than counted from
+        -- the first refusal. Its total is then a LOWER BOUND, not a figure, and the drain reports
+        -- it under a different field name so a reader cannot mistake one for the other.
+        seeded INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (agent_id, session_id, reason)
+      )
+    `);
+        /**
+         * ⚠️ **THE BACKFILL, and without it this unit ships the original lie with the new name on it.**
+         *
+         * Review finding 1. A new table is created EMPTY. Every daemon that already has refusal notices
+         * — including the one that produced this incident, whose notice sat at 58 — would report
+         * `times_since_dismissed: 59` beside a `times_total` of **1**, on the very field the guidance
+         * tells an operator to judge severity by. Smaller than the number it exists to dwarf.
+         *
+         * `count` is the best figure available at upgrade and it is a LOWER BOUND: dismissals before
+         * this build deleted history nothing can recover. So the row is marked `seeded` and reported as
+         * "at least", never as a total. A lower bound is a true statement; `total = 1` is not.
+         *
+         * `INSERT OR IGNORE` makes it idempotent and self-healing — it fills only rows that do not
+         * exist, so a real counted total is never overwritten by a seeded one, and running it at every
+         * boot costs one indexed scan of a table bounded by (sessions × reasons).
+         */
+        /**
+         * ⚠️ **AND `CREATE TABLE IF NOT EXISTS` IS A NO-OP AGAINST A TABLE THAT ALREADY EXISTS** —
+         * review F1b, and it is the same hazard `DOD-M12B-INDEX-1` records for `held_content.origin`
+         * three hundred lines above.
+         *
+         * The table shipped one commit earlier WITHOUT `seeded`, and that build ran on a real daemon to
+         * take this unit's live measurement. On that machine the `CREATE` does nothing, the backfill
+         * below names a column that is not there, and the throw comes out of schema init — **the daemon
+         * does not open at all.** The one machine that most needs the backfill is the one it would have
+         * bricked.
+         */
+        try {
+            this.#db.exec("ALTER TABLE content_refusal_totals ADD COLUMN seeded INTEGER NOT NULL DEFAULT 0");
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (!/duplicate column name/i.test(msg))
+                throw err;
+        }
+        this.#db.exec(`
+      INSERT OR IGNORE INTO content_refusal_totals
+        (agent_id, session_id, reason, total, first_at, last_at, seeded)
+      SELECT agent_id, session_id, reason, count, first_at, last_at, 1
+        FROM content_refusal_notices
+    `);
+        /**
+         * ⚠️ **THE INVARIANT: a lifetime total can never be SMALLER than a since-dismissal count.**
+         * Caught on the live daemon, not by review — the inbox read
+         * `times_since_dismissed: 78, times_total: 12`.
+         *
+         * `INSERT OR IGNORE` above only fills rows that are ABSENT. A row that already exists but began
+         * counting AFTER the notice did — the totals table shipped one commit before `seeded`, so its
+         * rows default to 0 and claim to be exact — is left alone, and then presents a partial tally as
+         * a lifetime figure. Smaller than the number beside it, which is the tell.
+         *
+         * `count` resets on dismissal and `total` does not, so in healthy operation `total >= count`
+         * always. `count > total` therefore means one thing only: this row's total did not start at the
+         * beginning. Repaired to the best floor available and marked `seeded`, because that is what it
+         * is. Runs at every boot — it is also the repair for a totals write that failed while the
+         * notice's succeeded.
+         */
+        this.#db.exec(`
+      UPDATE content_refusal_totals
+         SET total = (SELECT n.count FROM content_refusal_notices n
+                       WHERE n.agent_id = content_refusal_totals.agent_id
+                         AND n.session_id = content_refusal_totals.session_id
+                         AND n.reason = content_refusal_totals.reason),
+             seeded = 1
+       WHERE EXISTS (SELECT 1 FROM content_refusal_notices n
+                      WHERE n.agent_id = content_refusal_totals.agent_id
+                        AND n.session_id = content_refusal_totals.session_id
+                        AND n.reason = content_refusal_totals.reason
+                        AND n.count > content_refusal_totals.total)
+    `);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — content this agent will never accept, so the daemon stops going
+         * to fetch it.
+         *
+         * **DURABLE BECAUSE THE DEFECT CROSSED RESTARTS.** The 62-hour loop spanned several `cello
+         * login` cycles; a marker held in a `Set` on the manager would have passed every test and
+         * shipped nothing.
+         *
+         * NOT the `'quarantined'` transcript row, which is the natural candidate and does not work: it
+         * is keyed on the BYTES, and the fetch scheduler is keyed on the content hash the sender
+         * committed to. On the two refusals where those provably differ (a tamper, an algorithm we
+         * cannot read) the row cannot answer the question this table is asked.
+         *
+         * Keyed on `agent_id` — the stable key. `agent_name` is a display label.
+         */
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS terminal_content_refusals (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        content_hash TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        marked_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, content_hash)
+      )
     `);
         this.#db.exec(`
       CREATE TABLE IF NOT EXISTS content_refusal_reads (
@@ -3467,6 +3759,25 @@ export class SessionNodeManager {
      * a reason the caller is expected to log.
      */
     #quarantineRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts) {
+        const sequence = this.#retainRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — **THE FUNNEL, and the reason it lives here.**
+         *
+         * Every refusal that retains evidence passes through this method carrying its reason and its
+         * content hash, so this is the one place where "which reasons stop the work" can be a LIST
+         * rather than a decision copied into seven branches. `TERMINAL_REFUSAL_REASONS` decides; the
+         * six other reasons that reach here — a hash mismatch, an unreadable algorithm, a missing salt,
+         * an unresolved sender, an orphaned session, a terminal screen block — all keep retrying, and
+         * each of them can succeed on a later attempt.
+         *
+         * AFTER the retention, deliberately: the evidence has to exist before anything stops going to
+         * look for the message.
+         */
+        this.#considerTerminalRefusal(agentName, sessionId, contentHashHex, reason);
+        return sequence;
+    }
+    /** DOD-M15-REFUSEDEVIDENCE-1: the retention itself. Reached only through the funnel above. */
+    #retainRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts) {
         if (!this.#db)
             return null;
         try {
@@ -5326,7 +5637,20 @@ export class SessionNodeManager {
         // session ends, most sharply for `session_committed` — a refusal that exists only because the
         // session was already sealed. Dropping them at seal would delete exactly the ones a sealed
         // session produces. Growth is one row per (session, reason), i.e. proportional to `sessions`.
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 review F7 — named because this list is the documented teardown set.
+         *
+         * `#terminallyRefused` and `#terminalRefusalsLoaded` are a READ CACHE over
+         * `terminal_content_refusals` and are dropped here with everything else in-memory; the durable
+         * rows stay, for the same reason the notices do — the question they answer outlives the
+         * session, and a fresh check reloads them on demand. `#terminalRefusalsReadFailedAt` goes too,
+         * so a torn-down session's back-off does not delay the first read after it is revived.
+         */
+        this.#terminallyRefused.delete(key);
+        this.#terminalRefusalsLoaded.delete(key);
+        this.#terminalRefusalsReadFailedAt.delete(key);
         this.#unreadableAlgSeen.delete(key);
+        this.#refusedOnDirectPath.delete(key);
         this.#responderSealSubmitted.delete(key);
         // DOD-MSG-4: drop the strict-in-order bookkeeping (witness map, held plaintext, high-water)
         // so a torn-down session retains no stale ordering state or buffered plaintext.
@@ -7107,6 +7431,12 @@ export class SessionNodeManager {
         // the leaf_deliver witness stream / arrival order.
         let orderingS1;
         let orderingS2;
+        /**
+         * `DOD-M15-AUTHORSHIP-ABSENT-1`: the sender's signature over `orderingS1`, when the relay
+         * witnessed this leaf. Undefined when it did not — and the frame builder below then signs a
+         * Structure 1 of its own rather than shipping a frame with nothing to check.
+         */
+        let orderingSig;
         /**
          * DOD-M15-SEALWIRE-1 bullet 5, SENT half. Our own Ed25519 signature over `orderingS1`.
          *
@@ -7135,6 +7465,11 @@ export class SessionNodeManager {
                 if (witnessed.ok) {
                     orderingS1 = witnessed.structure1_cbor;
                     orderingS2 = witnessed.structure2_cbor;
+                    // `DOD-M15-AUTHORSHIP-ABSENT-1`: the signature that goes ON THE FRAME beside `orderingS1`.
+                    // Captured here, next to the bytes it signs, because a signature assigned anywhere else
+                    // could end up beside a different Structure 1 — a proof next to the wrong signed bytes is
+                    // worse than no proof, since it looks checkable and fails.
+                    orderingSig = witnessed.sender_signature;
                     /**
                      * PAIRED WITH THE BYTES IT SIGNS, in one place, so the two can never be assigned apart.
                      *
@@ -7154,8 +7489,10 @@ export class SessionNodeManager {
                          * tell "the relay never witnessed this" from "we witnessed it, held the proof, and
                          * dropped it decoding our own bytes."
                          *
-                         * And the asymmetry with the received half is the argument. `#recordFrameOrdering` is
-                         * soft because the COUNTERPARTY supplied those bytes — an absence we cannot resolve.
+                         * And the asymmetry with the received half is the argument. The received half is soft
+                         * about a missing ORDERING record (`#recordFrameOrdering`) because the COUNTERPARTY
+                         * supplied those bytes — an absence we cannot resolve. It is not soft about a missing
+                         * authorship proof any more; `DOD-M15-AUTHORSHIP-ABSENT-1` refuses that outright.
                          * Here **we produced them**, in `session-relay-client.ts`, moments earlier. A failure
                          * means our own encoder and decoder disagree: an internal invariant break that would
                          * strip authorship from every sent row for the life of the process. Soft is still right
@@ -7204,7 +7541,7 @@ export class SessionNodeManager {
                              * two different submits would all have been persisted as a row that **looks checkable
                              * to an auditor and fails** — strictly worse than the honest unproven row it replaced.
                              *
-                             * The received half has always done this (`#recordFrameOrdering` verifies before
+                             * The received half has always done this (`#verifyAuthorshipClaim` verifies before
                              * storing and treats a failure as fatal). The sent half did not, and every ingredient
                              * was already in scope on this line.
                              *
@@ -7372,6 +7709,72 @@ export class SessionNodeManager {
         // connection). See the note on #handleContentStream's finally.
         let sendStream;
         try {
+            /**
+             * ─── EVERY FRAME CARRIES ITS OWN PROOF — `DOD-M15-AUTHORSHIP-ABSENT-1` ────────────────────
+             *
+             * Structure 1 used to be built and signed INSIDE the relay submit, so a send the relay never
+             * witnessed put a frame on the wire with nothing on it to check — and the receiver, having no
+             * proof to compare, ingested it and attributed it anyway. There was always something to sign;
+             * nobody signed it.
+             *
+             * ⚠️ `structure2_cbor` IS DROPPED WHEN WE BUILD OUR OWN, and that pairing is load-bearing. The
+             * relay's record commits its copy of the sender's signature to the EXACT Structure 1 that was
+             * submitted; put it beside a Structure 1 built here (different timestamp, different
+             * last_seen_seq) and the receiver's cross-check fails against bytes that were never altered —
+             * a freeze on an honest message. The two travel together or the relay's half does not travel.
+             *
+             * ⚠️ SIGNED HERE, BEFORE THE SESSION KEY IS READ, and the order is load-bearing rather than
+             * tidy. `sessionKey` below is read once and used to seal the body several `await`s later; a
+             * key agreed with the counterparty inside that window leaves this side sealing under the key
+             * it captured while the far side has already moved on, and every message is refused as
+             * `decrypt_failed`. Signing costs two awaits, and putting them between the read and the seal
+             * widened that window enough to break the live two-node round trip. Measured, not reasoned
+             * about: seam-3 went red and both daemons logged `session.key.agreed` before the refusal.
+             */
+            let frameS1 = orderingS1;
+            let frameSig = orderingSig;
+            let frameS2 = orderingS2;
+            if (frameS1 === undefined || frameSig === undefined) {
+                const own = await this.#signOwnContentClaim(agentName, sessionId, entry, contentHash);
+                frameS1 = own.structure1;
+                frameSig = own.signature;
+                frameS2 = undefined;
+                /**
+                 * ⚠️ **AND OUR OWN TRANSCRIPT ROW GETS THE PROOF TOO** — review M3.
+                 *
+                 * `sentAuthorship` is set above only when the relay witnessed the leaf, because that was
+                 * the only path that ever produced a signature. This path produces one — and dropping it
+                 * here would leave the counterparty's transcript able to prove we wrote the message while
+                 * ours recorded `self_authored` with a NULL signature. That is exactly the half-provable
+                 * transcript `DOD-M15-SEALWIRE-1` bullet 5 exists to close, reappearing on the one path
+                 * that had no proof to lose before this unit and has one now.
+                 *
+                 * VERIFIED BEFORE IT IS STORED, the same discipline as the witnessed path: the pubkey comes
+                 * from INSIDE the bytes we signed, never from an agent lookup, and a pair that does not
+                 * verify is dropped loudly rather than persisted as a row that looks checkable and fails.
+                 * A failure here means this daemon's own encoder and decoder disagree.
+                 */
+                const s1Decoded = decodeStructure1(own.structure1);
+                const pk = s1Decoded.ok ? s1Decoded.fields.senderPubkey : undefined;
+                if (!s1Decoded.ok) {
+                    this.#logger.warn("session.sent.authorship.unavailable", {
+                        agentName, sessionId, correlationId, reason: "own_structure1_decode_failed",
+                        structure1Reason: s1Decoded.reason,
+                        impact: "this sent message is recorded with attribution 'self_authored' and NO signature, so the row asserts its author rather than proving one — even though this side signed the claim it put on the wire.",
+                        guidance: "We produced these bytes ourselves moments ago, so a decode failure here means this daemon's own encoder and decoder disagree. Treat it as an internal invariant break, not a peer problem.",
+                    });
+                }
+                else if (!verify(pk, own.structure1, own.signature)) {
+                    this.#logger.warn("session.sent.authorship.unavailable", {
+                        agentName, sessionId, correlationId, reason: "own_pair_does_not_verify",
+                        impact: "this sent message is recorded with attribution 'self_authored' and NO signature. The signature this side just produced does not verify against the key inside the bytes it signed.",
+                        guidance: "An internal invariant break: the signer and the encoder disagree. The message still went out; only the local proof was dropped.",
+                    });
+                }
+                else {
+                    sentAuthorship = { senderPubkey: pk, senderSig: own.signature };
+                }
+            }
             /**
              * 🚨 NO KEY, NO DIRECT SEND — `DOD-M15-EPHEMERAL-AUTH-1`, and there is no plaintext fallback.
              *
@@ -7383,11 +7786,12 @@ export class SessionNodeManager {
              * frame and a system that "carries on, degraded" gives up the body while the operator reads a
              * warning they have learned to scroll past. That is why this is a throw and not a warning.
              */
-            const encState = this.#contentEncryptionState(agentName, sessionId);
-            if (encState.key === null) {
-                throw new Error(`content_not_encryptable: ${encState.reason} — ${CONTENT_ENCRYPTION_GUIDANCE[encState.reason]}`);
+            // FAIL FAST, before a stream is opened for a message that cannot go out. The key this reads is
+            // NOT the one that seals the body — see the read beside `sealSessionContent` below.
+            const preflight = this.#contentEncryptionState(agentName, sessionId);
+            if (preflight.key === null) {
+                throw new Error(`content_not_encryptable: ${preflight.reason} — ${CONTENT_ENCRYPTION_GUIDANCE[preflight.reason]}`);
             }
-            const sessionKey = encState.key;
             const stream = await this.#openContentStream(agentName, sessionId, entry, correlationId);
             sendStream = stream;
             // AC-001/AC-003: arm the TTF tracking BEFORE the frame goes on the wire. The
@@ -7414,8 +7818,36 @@ export class SessionNodeManager {
              * THE WIRE COPY. `content_hash` above was computed over the PLAINTEXT and stays that way: the
              * transcript, the seal and the salted hash all depend on it meaning what it means today, and
              * the receiver decrypts before it verifies.
+             *
+             * ⚠️ **THE KEY IS READ HERE, ADJACENT TO THE SEAL, AND IT USED TO BE READ FAR ABOVE.**
+             *
+             * The read sat before `#openContentStream`, so the captured key crossed an `await` — several,
+             * once this unit added signing — before it sealed anything. A session key agreed with the
+             * counterparty inside that window left this side sealing under the key it captured while the
+             * far side had already moved on, and **every message was then refused as `decrypt_failed`**:
+             * a false tamper report on honest content, on both sides, for the life of the session.
+             *
+             * Not theoretical. It is what reddened four live-libp2p fixtures when identity keys were first
+             * wired into them — both daemons logged `session.key.agreed`, and the refusal followed.
+             *
+             * A window cannot be closed by reasoning about who wins it, only by removing it: nothing may
+             * run between the read and the seal. The preflight above stays because failing before a stream
+             * is opened is worth one extra read.
+             *
+             * ⚠️ THIS CLOSES THE LOCAL WINDOW AND NOT THE CLASS (review F8). The sender still seals at T
+             * and the receiver still decrypts at T+flight, so a re-key landing in THAT interval produces
+             * the same false tamper report. What is removed is the part this side controls; the rest is a
+             * property of there being two machines.
              */
-            const wireBody = sealSessionContent(sessionKey, content);
+            const sealState = this.#contentEncryptionState(agentName, sessionId);
+            if (sealState.key === null) {
+                // Reachable only if the key vanished between the preflight and here — a re-key or a
+                // teardown mid-send. Named as its own cause rather than reusing the preflight's, so a log
+                // reader can tell "never had one" from "had one and lost it while sending".
+                throw new Error(`content_not_encryptable: ${sealState.reason} — the key was present when this send began ` +
+                    `and gone by the time it sealed. ${CONTENT_ENCRYPTION_GUIDANCE[sealState.reason]}`);
+            }
+            const wireBody = sealSessionContent(sealState.key, content);
             const frame = encodeCbor({
                 type: "content_frame",
                 session_id: sessionId,
@@ -7428,9 +7860,12 @@ export class SessionNodeManager {
                 // DOD-MSG-4 (self-ordering): the relay's signed ordering record, so the receiver verifies +
                 // orders from the frame ALONE (no dependence on the separate leaf_deliver witness timing).
                 // structure1_cbor = sender-signed bytes (verify); structure2_cbor = relay's committed seq +
-                // prev_root (order). Omitted if the relay was unreachable — receiver falls back to the witness.
-                structure1_cbor: orderingS1,
-                structure2_cbor: orderingS2,
+                // prev_root (order). Structure 2 is omitted if the relay was unreachable — the receiver
+                // falls back to the witness stream for POSITION. Structure 1 and its signature are never
+                // omitted: `DOD-M15-AUTHORSHIP-ABSENT-1`, and a frame without them is refused on arrival.
+                structure1_cbor: frameS1,
+                sender_signature: frameSig,
+                structure2_cbor: frameS2,
                 // DOD-M15-SEALWIRE-1 part B2b: HOW `content_hash` was produced. An older peer ignores an
                 // unknown CBOR key, so emitting it is safe for every build in existence; a newer one reads
                 // it and verifies under the named algorithm instead of assuming.
@@ -7462,7 +7897,17 @@ export class SessionNodeManager {
             return { ok: true, delivered: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
         }
         catch (err) {
-            this.#markSessionImpaired(agentName, sessionId, { cause: "direct_send", error: err instanceof Error ? err.message : String(err), correlationId });
+            /**
+             * Review F7: a content-key fault is NOT a transport fault, and labelling it `direct_send`
+             * points the operator at the connection when the connection is fine. `content_not_encryptable`
+             * is thrown twice above — once before the stream is opened, once at the seal — and both are
+             * about this machine's key state.
+             */
+            const failure = err instanceof Error ? err.message : String(err);
+            this.#markSessionImpaired(agentName, sessionId, {
+                cause: failure.startsWith("content_not_encryptable") ? "content_key" : "direct_send",
+                error: failure, correlationId,
+            });
             if (sendStream !== undefined) {
                 try {
                     sendStream.abort(err instanceof Error ? err : new Error(String(err)));
@@ -8041,6 +8486,27 @@ export class SessionNodeManager {
         }
         byHash.set(Buffer.from(contentHash).toString("hex"), declaredAlg);
     }
+    /**
+     * Remember that THIS frame was refused for carrying no usable proof of who wrote it, so the park
+     * path can say so when the same content arrives through the relay mailbox — review H1.
+     *
+     * Bounded for the same reason and by the same cap as `#noteUnreadableAlgFrame`: a peer sending
+     * unprovable frames feeds this map, so it drops the oldest rather than growing.
+     */
+    #noteRefusedOnDirectPath(agentName, sessionId, contentHash) {
+        const key = this.#k(agentName, sessionId);
+        let hashes = this.#refusedOnDirectPath.get(key);
+        if (!hashes) {
+            hashes = new Set();
+            this.#refusedOnDirectPath.set(key, hashes);
+        }
+        if (hashes.size >= MAX_UNREADABLE_ALG_FRAMES) {
+            const oldest = hashes.values().next();
+            if (!oldest.done)
+                hashes.delete(oldest.value);
+        }
+        hashes.add(Buffer.from(contentHash).toString("hex"));
+    }
     /**
      * ─── DOD-M15-NO-SILENT-REFUSAL-1: refusals the RECEIVING operator can actually see ────────────
      *
@@ -8090,16 +8556,61 @@ export class SessionNodeManager {
                 throw new Error("database is not open");
             const agentId = this.#requireAgentId(agentName);
             const now = Date.now();
-            // `count` grows on conflict; impact and guidance are refreshed, because a later refusal of the
-            // same reason may know more than the first (the salt branch has four causes and names them).
-            this.#db
-                .prepare(`INSERT INTO content_refusal_notices
+            /**
+             * ⚠️ **BOTH WRITES OR NEITHER — review F6, and the comment this replaces was wrong.**
+             *
+             * It argued that putting the totals insert in the same `try` made the two "fail together".
+             * It does not: each `.run()` autocommits, so the notice could persist and the total throw —
+             * and the `catch` then ALSO writes an in-memory fallback entry for a notice that is already
+             * in the table. The drain unions the two halves without deduplicating on (session, reason),
+             * so the operator would see the same refusal TWICE, once with a lifetime figure and once
+             * without, one of them blaming a disk fault. Before this unit a single statement made that
+             * state impossible; the second statement is what created it.
+             *
+             * `ROLLBACK` is best-effort because SQLite may have aborted the transaction already — the
+             * same shape `agent-id-migration.ts` uses — and it must never mask the original error.
+             */
+            this.#db.exec("BEGIN");
+            try {
+                // `count` grows on conflict; impact and guidance are refreshed, because a later refusal of the
+                // same reason may know more than the first (the salt branch has four causes and names them).
+                this.#db
+                    .prepare(`INSERT INTO content_refusal_notices
              (agent_id, session_id, reason, kind, impact, guidance, count, first_at, last_at)
            VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)
            ON CONFLICT(agent_id, session_id, reason) DO UPDATE SET
              count = count + 1, kind = excluded.kind, impact = excluded.impact,
              guidance = excluded.guidance, last_at = excluded.last_at`)
-                .run(agentId, sessionId, reason, detail.kind, detail.impact, detail.guidance, now, now);
+                    .run(agentId, sessionId, reason, detail.kind, detail.impact, detail.guidance, now, now);
+                /**
+                 * DOD-M15-REFUSALTERMINAL-1 — the lifetime tally, in the SAME `try` on purpose.
+                 *
+                 * If the notice write failed there is no notice to hang a total off, and the fallback below
+                 * has no durable counterpart to read — so the two must fail together. A total that survived a
+                 * failed notice would be a number nobody could see, and one that was written twice for a
+                 * retried notice would be worse than absent.
+                 */
+                this.#db
+                    .prepare(
+                // `seeded` stays whatever the row already has. A row seeded at upgrade remains a LOWER
+                // BOUND for the life of that (session, reason) — counting forward from an incomplete
+                // figure does not recover the refusals dismissal already erased, and clearing the flag
+                // would turn "at least 58" into a claimed total of 59.
+                `INSERT INTO content_refusal_totals
+             (agent_id, session_id, reason, total, first_at, last_at, seeded)
+           VALUES (?, ?, ?, 1, ?, ?, 0)
+           ON CONFLICT(agent_id, session_id, reason) DO UPDATE SET
+             total = total + 1, last_at = excluded.last_at`)
+                    .run(agentId, sessionId, reason, now, now);
+                this.#db.exec("COMMIT");
+            }
+            catch (inner) {
+                try {
+                    this.#db.exec("ROLLBACK");
+                }
+                catch { /* already aborted by SQLite */ }
+                throw inner;
+            }
         }
         catch (err) {
             this.#logger.error("session.refusal.persist.failed", {
@@ -8272,21 +8783,29 @@ export class SessionNodeManager {
              */
             const rows = (sessionId === undefined
                 ? this.#db
-                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count
+                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count,
+                        t.total AS lifetime_total, t.seeded AS lifetime_seeded
                    FROM content_refusal_notices n
                    LEFT JOIN content_refusal_reads r
                      ON r.agent_id = n.agent_id AND r.session_id = n.session_id
                     AND r.reason = n.reason AND r.consumer_id = ?
+                   LEFT JOIN content_refusal_totals t
+                     ON t.agent_id = n.agent_id AND t.session_id = n.session_id
+                    AND t.reason = n.reason
                   WHERE n.agent_id = ?
                     AND (r.seen_count IS NULL OR n.count >= r.seen_count * 10)
                   ORDER BY n.last_at DESC, n.rowid DESC LIMIT ?`)
                     .all(consumerId, agentId, MAX_REFUSALS_PER_READ + 1)
                 : this.#db
-                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count
+                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count,
+                        t.total AS lifetime_total, t.seeded AS lifetime_seeded
                    FROM content_refusal_notices n
                    LEFT JOIN content_refusal_reads r
                      ON r.agent_id = n.agent_id AND r.session_id = n.session_id
                     AND r.reason = n.reason AND r.consumer_id = ?
+                   LEFT JOIN content_refusal_totals t
+                     ON t.agent_id = n.agent_id AND t.session_id = n.session_id
+                    AND t.reason = n.reason
                   WHERE n.agent_id = ? AND n.session_id = ?
                     AND (r.seen_count IS NULL OR n.count >= r.seen_count * 10)
                   ORDER BY n.last_at DESC, n.rowid DESC LIMIT ?`)
@@ -8323,7 +8842,21 @@ export class SessionNodeManager {
                     kind: row.kind,
                     impact: row.impact,
                     guidance: row.guidance,
-                    count: row.count,
+                    timesSinceDismissed: row.count,
+                    /**
+                     * DOD-M15-REFUSALTERMINAL-1 — three states, and they are three different claims.
+                     *
+                     * A counted total is a FIGURE. A seeded row is a FLOOR, and says so by using a different
+                     * field name (review F1c). `null` means no totals row at all, which after the upgrade
+                     * backfill can only happen when the notice write itself failed — reported as ABSENT
+                     * rather than as the smaller number, because substituting it is the defect this unit
+                     * exists to remove.
+                     */
+                    ...(row.lifetime_total === null
+                        ? {}
+                        : row.lifetime_seeded === 1
+                            ? { timesTotalAtLeast: row.lifetime_total }
+                            : { timesTotal: row.lifetime_total }),
                     ...(firstTime ? {} : { repeat: true }),
                 });
             }
@@ -8359,9 +8892,12 @@ export class SessionNodeManager {
                     if (!oldest.done)
                         notice.surfacedTo.delete(oldest.value);
                 }
+                // `timesTotal` is deliberately absent: this notice exists because the durable write failed,
+                // so there is no lifetime record to report and inventing one from `notice.count` would
+                // restore the exact misreading this unit removes.
                 fromFallback.push({
                     sessionId: sid, reason, kind: notice.kind, impact: notice.impact,
-                    guidance: notice.guidance, count: notice.count,
+                    guidance: notice.guidance, timesSinceDismissed: notice.count,
                     ...(firstTime ? {} : { repeat: true }),
                 });
             }
@@ -8579,12 +9115,19 @@ export class SessionNodeManager {
     contentHashAlgIn, 
     /**
      * DOD-M15-SEALWIRE-1 bullet 5: the VERIFIED authorship proof for this message, when the caller
-     * has one. The caller is the only place that has it — `#recordFrameOrdering` verifies the
-     * signature against the key inside the sender's own signed bytes and matches the signer to this
-     * session's counterparty, and that result reaches here or nowhere.
+     * has one. The caller is the only place that has it — `#verifyAuthorshipClaim` verifies the
+     * signature the frame carries beside the sender's own signed bytes, against the key inside those
+     * bytes, and matches the signer to this session's counterparty. That result reaches here or
+     * nowhere.
+     *
+     * ⚠️ IT USED TO NAME `#recordFrameOrdering`, and that was accurate until
+     * `DOD-M15-AUTHORSHIP-ABSENT-1`: the signature arrived only inside the RELAY's Structure 2, so
+     * checking authorship needed a relay record. It does not now, and the old name sends a reader to
+     * a method that answers a different question. Rewritten, not deleted — that dependence is the
+     * defect the unit removed.
      *
-     * Optional, because the soft decode-failure path ingests without it. The row records which it
-     * was, so absence is never silent.
+     * Optional, because the PARK route ingests without it: recovered mail proves its sender by the
+     * mailbox envelope instead. The row records which it was, so absence is never silent.
      */
     verifiedAuthorship, 
     /**
@@ -8706,6 +9249,15 @@ export class SessionNodeManager {
             this.#quarantineRefusedContent(agentName, sessionId, "session_committed", content, contentHashHex, {
                 senderPubkeyHex: record.counterparty_pubkey ?? null, correlationId,
             });
+            /**
+             * DOD-M15-REFUSALTERMINAL-1 — the retention call above is also what STOPS THE WORK: it runs
+             * the terminal funnel, and `session_committed` is the one reason in it.
+             *
+             * Without that, the relay's next redelivery of the witness leaf armed another park fetch,
+             * which drained, verified, arrived here, and was refused again — measured at ~2 per second
+             * for 62 hours on one message. `#markContentResolved` could not be reused: this content did
+             * not land, and saying that it did is a lie a future reader would act on.
+             */
             // DOD-M15-NO-SILENT-REFUSAL-1. `currentStatus` on the log line carries the REAL status —
             // sealed, seal_interrupted_pending or abandoned — and the notice must not flatten those into
             // one claim, so it names the record as frozen rather than asserting which way it ended.
@@ -9575,10 +10127,172 @@ export class SessionNodeManager {
             this.#leafFetchTimers.delete(timerKey);
         }
     }
+    /**
+     * DOD-M15-REFUSALTERMINAL-1 — the funnel. A refusal stops the work ONLY if its reason is in
+     * `TERMINAL_REFUSAL_REASONS`; every other reason keeps retrying, which is what makes a transient
+     * screener block or a version skew recoverable.
+     *
+     * One place decides, so "is this reason terminal?" is answerable from the set rather than from
+     * thirteen call sites.
+     */
+    #considerTerminalRefusal(agentName, sessionId, contentHashHex, reason) {
+        if (!TERMINAL_REFUSAL_REASONS.has(reason))
+            return;
+        this.#markContentTerminallyRefused(agentName, sessionId, contentHashHex, reason);
+    }
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: this content can NEVER be accepted on this session — cancel the
+     * pending fetch and make sure no future one is scheduled, across restarts.
+     *
+     * The durable write comes FIRST and the in-memory cache second, so a process that dies between
+     * them wakes up with the stop still in force. A failed write is announced at ERROR and the
+     * in-memory mark is still taken: the loop stops for the life of THIS process, and the log says
+     * plainly that it will resume after a restart. That is a degraded stop, not a silent one.
+     */
+    #markContentTerminallyRefused(agentName, sessionId, contentHashHex, reason) {
+        const key = this.#k(agentName, sessionId);
+        /**
+         * Read BEFORE the write, so the announcement below fires on the TRANSITION rather than on every
+         * re-refusal. The same message can be refused again by a drain triggered for another reason, and
+         * an INFO line per repeat is a smaller version of the noise this unit exists to remove.
+         *
+         * The durable write is still ATTEMPTED every time, deliberately: `INSERT OR IGNORE` costs
+         * nothing when the row is already there, and skipping it would mean a write that failed once —
+         * the branch that logs the error below — never got another chance to succeed.
+         */
+        const alreadyKnown = this.#isTerminallyRefused(agentName, sessionId, contentHashHex);
+        try {
+            if (!this.#db)
+                throw new Error("database is not open");
+            const agentId = this.#requireAgentId(agentName);
+            this.#db
+                .prepare(`INSERT OR IGNORE INTO terminal_content_refusals
+             (agent_id, session_id, content_hash, reason, marked_at)
+           VALUES (?, ?, ?, ?, ?)`)
+                .run(agentId, sessionId, contentHashHex, reason, Date.now());
+            /**
+             * ⚠️ **BOUNDED, because the counterparty chooses how many rows exist — review F7.**
+             *
+             * One row per distinct content hash aimed at a closed conversation, and the funnel that calls
+             * this runs even when the byte cap has already stopped RETENTION. So a peer who has exhausted
+             * the session's storage budget can still write rows here, indefinitely, on a table nothing
+             * else deletes. Every sibling store in this file is bounded (`MAX_UNREADABLE_ALG_FRAMES`, the
+             * tier byte cap, `MAX_REFUSAL_READERS`); this one was not.
+             *
+             * Oldest-dropped, so the newest refusals keep their stop and the loop stays closed for what
+             * is arriving now. A dropped row costs at most one extra fetch for content nobody is sending
+             * any more — the pre-fix behaviour for that one hash, and nothing worse.
+             */
+            const dropped = this.#db
+                .prepare(`DELETE FROM terminal_content_refusals
+            WHERE agent_id = ? AND session_id = ? AND content_hash NOT IN (
+              SELECT content_hash FROM terminal_content_refusals
+               WHERE agent_id = ? AND session_id = ?
+               ORDER BY marked_at DESC LIMIT ${MAX_TERMINAL_REFUSALS_PER_SESSION}
+            )`)
+                .run(agentId, sessionId, agentId, sessionId);
+            if (Number(dropped.changes) > 0) {
+                // Loud, because it means a counterparty has aimed more than the cap's worth of distinct
+                // messages at one closed conversation — which is abuse, not ordinary traffic.
+                this.#logger.warn("session.content.terminal_refusal.evicted", {
+                    agentName, sessionId, dropped: Number(dropped.changes),
+                    cap: MAX_TERMINAL_REFUSALS_PER_SESSION,
+                    impact: "more distinct messages have been refused on this closed conversation than the cap keeps a record of, so the oldest stops were dropped. If one of those arrives again it costs one wasted fetch; nothing is delivered and nothing is lost.",
+                });
+            }
+        }
+        catch (err) {
+            this.#logger.error("session.content.terminal_refusal.persist.failed", {
+                agentName, sessionId, reason,
+                contentHash: contentHashHex,
+                error: extractErrorMessage(err),
+                impact: "this message can never be accepted on this conversation, and that fact could not be written down. Fetching for it stops while this daemon runs, and RESUMES after the next restart — which is the loop that filled a log with a quarter of a million refusals for one message.",
+                guidance: "This is a fault on THIS machine, not with the counterparty. Check free disk space and the permissions on ~/.cello; session.refusal.persist.failed in this log usually appears alongside it with the underlying error.",
+            });
+        }
+        let set = this.#terminallyRefused.get(key);
+        if (!set) {
+            set = new Set();
+            this.#terminallyRefused.set(key, set);
+        }
+        set.add(contentHashHex);
+        // The same cancellation `#markContentResolved` performs, for the opposite fact: an already-armed
+        // grace timer must not fire for content we have just decided never to accept.
+        const timerKey = `${key}::${contentHashHex}`;
+        const t = this.#leafFetchTimers.get(timerKey);
+        if (t !== undefined) {
+            clearTimeout(t);
+            this.#leafFetchTimers.delete(timerKey);
+        }
+        if (!alreadyKnown) {
+            this.#logger.info("session.content.terminal_refusal", {
+                agentName, sessionId, reason,
+                contentHash: contentHashHex,
+                impact: "no further attempt will be made to fetch this message. The conversation it was sent to is closed and signed, so no retry could ever have succeeded.",
+            });
+        }
+    }
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: has this content already been refused terminally?
+     *
+     * Reads the durable rows for a session ONCE and caches them, so the hot path — a witnessed leaf
+     * on a healthy session — costs one `Set` lookup rather than a query per message. A read failure
+     * returns `false`: the cost is the loop continuing, which is the pre-fix behaviour, and it is
+     * announced rather than swallowed. Answering `true` on a failed read would be the dangerous
+     * direction, because it silently stops fetching content that was never refused.
+     */
+    #isTerminallyRefused(agentName, sessionId, contentHashHex) {
+        const key = this.#k(agentName, sessionId);
+        /**
+         * ⚠️ **A FAILING READ MUST NOT BE RETRIED PER MESSAGE — review F3.**
+         *
+         * The loaded flag is set only on success, so a database that throws (a full disk, a corrupt
+         * page) sent this method back to SQLite on EVERY witnessed leaf, logged an ERROR each time, and
+         * — because nothing was ever cached — made `alreadyKnown` false forever, so the mark's INFO
+         * fired on every refusal too. That is the ~2/s log growth this unit exists to end, reproduced
+         * by its own fix in the failure mode.
+         *
+         * Backed off instead: one attempt per session per minute, so the read still recovers when the
+         * disk does, and the ERROR is bounded rather than proportional to traffic.
+         */
+        const failedAt = this.#terminalRefusalsReadFailedAt.get(key);
+        const backedOff = failedAt !== undefined && Date.now() - failedAt < TERMINAL_REFUSAL_READ_RETRY_MS;
+        if (!this.#terminalRefusalsLoaded.has(key) && !backedOff && this.#db) {
+            try {
+                const rows = this.#db
+                    .prepare("SELECT content_hash FROM terminal_content_refusals WHERE agent_id = ? AND session_id = ?")
+                    .all(this.#requireAgentId(agentName), sessionId);
+                let set = this.#terminallyRefused.get(key);
+                if (!set) {
+                    set = new Set();
+                    this.#terminallyRefused.set(key, set);
+                }
+                for (const r of rows)
+                    set.add(r.content_hash);
+                this.#terminalRefusalsLoaded.add(key);
+                this.#terminalRefusalsReadFailedAt.delete(key);
+            }
+            catch (err) {
+                this.#terminalRefusalsReadFailedAt.set(key, Date.now());
+                this.#logger.error("session.content.terminal_refusal.read.failed", {
+                    agentName, sessionId,
+                    error: extractErrorMessage(err),
+                    retryInMs: TERMINAL_REFUSAL_READ_RETRY_MS,
+                    impact: "the record of messages this conversation can never accept could not be read, so this daemon may keep fetching one of them. Nothing is lost; the cost is repeated work and log noise. The read is retried once a minute rather than on every message, so this line is bounded — its absence for a while does NOT mean the fault cleared.",
+                    guidance: "This is a fault on THIS machine, not with any counterparty. Check free disk space and the permissions on ~/.cello; the error above carries SQLite's own message.",
+                });
+            }
+        }
+        return this.#terminallyRefused.get(key)?.has(contentHashHex) === true;
+    }
     #scheduleLeafFetchIfUnresolved(agentName, sessionId, contentHashHex) {
         const key = this.#k(agentName, sessionId);
         if (this.#resolvedContent.get(key)?.has(contentHashHex))
             return;
+        // DOD-M15-REFUSALTERMINAL-1: a refusal nothing can get past is the end of the work, not a
+        // reason to come back in two seconds.
+        if (this.#isTerminallyRefused(agentName, sessionId, contentHashHex))
+            return;
         const timerKey = `${key}::${contentHashHex}`;
         // ONE fetch per content hash. The relay redelivers, and a redelivery carries the same sequence —
         // scheduling per redelivery turns a slow relay into a storm against itself.
@@ -9910,9 +10624,13 @@ export class SessionNodeManager {
     originalContent, 
     /**
      * DOD-M15-SEALWIRE-1 bullet 5: threaded from `ingestReceivedContent`, which is the only place
-     * that has it — `#recordFrameOrdering` verified this signature against the pubkey inside the
-     * sender's own signed bytes and matched the signer to this session's counterparty. It reaches
-     * the transcript row from here or not at all.
+     * that has it — `#verifyAuthorshipClaim` verified this signature (carried on the frame beside
+     * the bytes it signs) against the pubkey inside those bytes, and matched the signer to this
+     * session's counterparty. It reaches the transcript row from here or not at all.
+     *
+     * ⚠️ IT USED TO NAME `#recordFrameOrdering`, true until `DOD-M15-AUTHORSHIP-ABSENT-1` moved the
+     * check off the relay's record and onto the frame's own signature. Rewritten rather than
+     * deleted: the old name is the evidence of what authorship used to depend on.
      *
      * Undefined on the held-release and soft-fallback paths; the row records that as
      * `local_session_state` rather than leaving it indistinguishable from a proven one.
@@ -11257,6 +11975,14 @@ export class SessionNodeManager {
          */
         const memoKey = this.#k(agentName, sessionId);
         const priorDeclaredAlg = this.#unreadableAlgSeen.get(memoKey)?.get(contentHashHex);
+        /**
+         * `DOD-M15-AUTHORSHIP-ABSENT-1` review H1 — READ BEFORE THE INGEST, reported after it.
+         *
+         * Same reasoning as `priorDeclaredAlg` directly above: the memo says what THIS side did to this
+         * content on the direct path, and the ingest below is what decides whether the other route
+         * succeeded. Reading it after would race the clear.
+         */
+        const refusedForAuthorship = this.#refusedOnDirectPath.get(memoKey)?.has(contentHashHex) === true;
         const result = await this.ingestReceivedContent(agentName, sessionId, env.content, contentHash, correlationId, recoveredSeq ?? undefined, 
         // The envelope's own claim, verbatim — `undefined` on a v2 envelope, which resolves to
         // `sha256` and is exactly right for a peer that predates the field.
@@ -11297,6 +12023,48 @@ export class SessionNodeManager {
                 impact: "THIS EXACT MESSAGE was refused on the direct path because it named an algorithm this build cannot read, and the same content has now been accepted via the relay park under an algorithm this build CAN read. The refusal did not hold: the message was delivered by the other route.",
             });
         }
+        /**
+         * ⚠️ **THE AUTHORSHIP REFUSAL DOES NOT HOLD EITHER, AND THIS IS WHERE IT SAYS SO** — review H1.
+         *
+         * `DOD-M15-AUTHORSHIP-ABSENT-1` refuses a direct-path frame with no usable proof of who wrote
+         * it. Refusing sends no delivery ACK, so the sender's TTF backstop parks the message and it
+         * arrives here — where the ENVELOPE's signature over (session_id, recipient_pubkey,
+         * content_hash) is what authenticates it, and `authenticateParkedEntry` above has already
+         * accepted it. That is correct and it is deliberately NOT changed here: gating mail retrieval
+         * on a per-message record the relay-degraded path is allowed to omit is the false-positive shape
+         * this whole unit is careful to avoid, and the order that added the refusal scopes the park
+         * envelope out explicitly.
+         *
+         * What must not stand is the SILENCE. Without this line the operator reads "refused" and then
+         * watches the message appear, with nothing connecting the two — the same reconciliation gap the
+         * algorithm refusal above already pays for. What they need to know is the part that is really
+         * lost: the message arrived, and its INDIVIDUAL author is attested by the mailbox envelope
+         * rather than by a signature over that message's own bytes.
+         *
+         * Same `ok && !held && !screenedOut` predicate as above, and for the same reason: `ok` is not
+         * "delivered".
+         */
+        if (refusedForAuthorship && result.ok && result.held !== true && result.screenedOut !== true) {
+            const hashes = this.#refusedOnDirectPath.get(memoKey);
+            hashes?.delete(contentHashHex);
+            if (hashes && hashes.size === 0)
+                this.#refusedOnDirectPath.delete(memoKey);
+            /**
+             * ⚠️ RENAMED FROM `…authorship_refusal_reconciled` by `029c` review F4, because the memo it
+             * reads now covers EVERY direct-path refusal and not only the authorship one. Keeping the old
+             * name would have put "no usable proof of who wrote it" on a message that was actually
+             * refused for not decrypting — a wrong cause is worse than a general one.
+             *
+             * The specific reason is already on the operator's notice; what this event adds is that the
+             * refusal did not hold.
+             */
+            this.#logger.warn("content.recover.refusal_reconciled", {
+                agentName, sessionId, correlationId,
+                contentHash: contentHashHex,
+                impact: "THIS EXACT MESSAGE was refused on the direct path and the same content has now been accepted from the relay mailbox, where the sealed envelope proves the sender. The refusal did not hold: the message WAS delivered by the other route. What the direct path could not confirm is still unconfirmed — the mailbox proves WHO sent it and nothing about the check that refused it — so the receipt can show this message arrived without showing everything a directly-delivered one would.",
+                guidance: "Nothing to do about this message. The fix named on the original refusal still stands: until the cause clears, every message on this session takes the slower route and lands with less attached to it.",
+            });
+        }
         return result;
     }
     /**
@@ -13450,41 +14218,355 @@ export class SessionNodeManager {
             });
         }
     }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — SIGN OUR OWN CLAIM, with no relay involved.
+     *
+     * The relay submit has always built these bytes and signed them (`session-relay-client.ts`); this
+     * is the same construction, for the path where no submit happens. It is not a fallback in the
+     * silent sense — it produces exactly the artifact the witnessed path produces, minus the relay's
+     * countersigned position, which was never part of the authorship claim.
+     *
+     * ⚠️ THROWS when this agent has no identity key, and the throw is the correct outcome. It lands in
+     * the direct-send catch, which parks the message to the relay mailbox exactly as a failed dial
+     * does — so the message is not lost, and the operator hears about a local fault instead of a
+     * counterparty who mysteriously stopped receiving. Shipping the frame unsigned would guarantee a
+     * refusal at the far end and blame the wrong machine for it.
+     */
+    async #signOwnContentClaim(agentName, sessionId, entry, contentHash) {
+        const signer = this.#keyProviderResolver?.(agentName);
+        if (!signer) {
+            throw new Error("content_not_signable: this machine has no identity key for this agent, so it cannot sign " +
+                "the message it is about to send and the counterparty would refuse it as unattributable");
+        }
+        // The 16-byte relay session id when this session has one, so a frame built here is
+        // byte-comparable with one built by the submit. Falling back to the local id is not a
+        // second meaning: for every session created without an assignment the two are the same value
+        // (`relaySessionIdBytes` is set from `sessionId` on exactly those paths).
+        const sessionIdBytes = entry.relaySessionIdBytes ?? Uint8Array.from(Buffer.from(sessionId, "hex"));
+        const structure1 = encodeStructure1({
+            contentHash,
+            senderPubkey: await signer.getPublicKey(),
+            sessionId: sessionIdBytes,
+            // The highest counterparty position this session has seen, from the same source the submit
+            // reads. Zero when there is no relay client at all, which is honest: nothing has been
+            // witnessed on this session, so there is no position to acknowledge.
+            lastSeenSeq: entry.relayClient?.lastSeenSeq(Buffer.from(sessionIdBytes).toString("hex")) ?? 0,
+            timestamp: Date.now(),
+            // v1 DELIBERATELY. `last_seen_hash` (v2) is `WITHHOLD-SEAL-1`'s emitter and is not owed here;
+            // a v1 claim makes no content acknowledgement at all, which is honest, where an invented one
+            // would not be.
+        });
+        return { structure1, signature: await signer.sign(structure1) };
+    }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — DID THIS SENDER PROVE THEY WROTE THIS MESSAGE?
+     *
+     * The one place that answers it, for both callers, so "checked" cannot mean two different things
+     * in two places. It takes the signature as an ARGUMENT rather than digging it out of a structure,
+     * which is the whole of the fix: the signature used to be read only from `structure2_cbor` — the
+     * RELAY's record — so a receiver could not check authorship without a relay record, and refusing
+     * on its absence would have made the relay a precondition for reading mail. The content frame now
+     * carries the signature beside the bytes it signs, exactly as `hash_submit` always has, and this
+     * method does not care which of the two handed it over.
+     *
+     * It VERIFIES and it does not LOG. The severity of each verdict differs by caller — the content
+     * frame refuses an `unusable`, the park path shrugs at one — and a method that logged its own
+     * conclusion would either report a refusal that did not happen or stay silent on one that did.
+     */
+    #verifyAuthorshipClaim(agentName, sessionId, structure1Cbor, senderSignature, contentHash) {
+        // Structure 1 content_hash is index 1 and sender_pubkey index 2 in BOTH layouts — 020-ACKHASH
+        // appended last_seen_hash at 6 rather than inserting it, so neither read moved. A v2 claim
+        // decodes here exactly as a v1 one does; its hash is not consulted, because this unit ships
+        // reading and not enforcing.
+        const s1 = decodeStructure1(structure1Cbor);
+        // A layout this build cannot name yields no pubkey and no hash, so there is nothing to check the
+        // signature against. Its reason is carried out so an unreadable CLAIM and a wrong SIGNATURE stay
+        // distinguishable — they take the same outcome by different routes.
+        if (!s1.ok)
+            return { verdict: "unusable", reason: s1.reason };
+        const s1Hash = s1.fields.contentHash;
+        const s1Pubkey = s1.fields.senderPubkey;
+        // The SENDER's Ed25519 signature over the exact signed bytes — the same check the relay
+        // performs. `verify` never throws, so a wrong-width or garbage signature lands here as `false`:
+        // supplied and refuted, which is a different fact from not supplied at all.
+        if (!verify(s1Pubkey, structure1Cbor, senderSignature)) {
+            return { verdict: "refuted", reason: "bad_signature" };
+        }
+        // Sovereign-node cross-check: the signer MUST be THIS session's counterparty, not an unrelated
+        // key. Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from
+        // the IPC param and is never case-normalized, so a string compare would fail for a mixed-case
+        // pubkey and silently strip the canonical ordering from every message in that session.
+        const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
+        if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
+            /**
+             * REFUTED when the counterparty is KNOWN and the signer is someone else.
+             *
+             * This is the session-open MITM detection from the 2026-08-21 T-of-N investigation, which
+             * found this check *"fires correctly, and its answer is thrown away."* A rogue quorum of the
+             * directories holding shares for agent B can sign a false SessionAssignment naming M's key as
+             * B's, and everything downstream is genuinely real — M signs with M's own valid key. Nothing
+             * is missing for A to notice. This comparison is where the substitution shows, because
+             * `counterparty_pubkey` comes from A's own request and is untouched by anything the directory
+             * returns.
+             *
+             * ⚠️ AN EARLIER VERSION OF THIS COMMENT ADDED "it shows only when the record is present" —
+             * true when the proof was optional, and no longer the shape of the code: a content frame with
+             * no checkable proof is refused before it reaches ingest, so M cannot decline to supply one
+             * and be admitted anyway. Rewritten rather than deleted, because that sentence is the evidence
+             * of what the gap was. The park envelope is the remaining path where the ordering record is
+             * genuinely optional, and there the sender's authorship is proven by the envelope's own
+             * signature instead.
+             *
+             * `verified_unmatched` stays soft deliberately: with no counterparty on record we cannot prove
+             * the signer either way, and refusing there would strand a session whose row we failed to read
+             * rather than one that is under attack. It is also the only signal the orphan branch has.
+             */
+            return counterparty
+                ? { verdict: "refuted", reason: "signer_not_counterparty" }
+                : { verdict: "verified_unmatched", senderPubkey: s1Pubkey };
+        }
+        /**
+         * ─── THE BINDING CHECKS RUN LAST, AND THE ORDER IS A SECURITY PROPERTY ───────────────────────
+         *
+         * ⚠️ **THEY USED TO RUN FIRST, AND THAT HANDED THE ATTACKER A FREEZE-SUPPRESSION SWITCH** —
+         * review of `029b`, and it is the finding that mattered most.
+         *
+         * Everything below this line is `unusable`: the message is REFUSED and the session lives.
+         * Everything above it is `refuted`: the session FREEZES. So a check that can answer `unusable`
+         * before the signature has been verified lets a peer choose the softer outcome — flip one
+         * unauthenticated byte of `session_id` inside your own claim and a garbage signature, or a
+         * signature by a MITM's own key, stops being an identity incident and becomes a quiet refusal.
+         * The session-open MITM detection this function exists to serve was bypassable by exactly the
+         * party it detects.
+         *
+         * So the order is: decode → SIGNATURE → SIGNER → then what the proof is about. By the time
+         * either check below runs, the claim provably came from this session's counterparty, and the
+         * only question left is which message and which conversation they made it for.
+         *
+         * `seal-frontier-verify` already does it in this order (verify at :55, session id at :77). This
+         * code had it inverted.
+         */
+        // The claim must bind to THIS content. A signature over somebody else's bytes verifies perfectly
+        // and proves nothing about this message — without this, one signed claim could be replayed onto
+        // every frame that follows it.
+        if (!bytesEqual(s1Hash, contentHash)) {
+            return { verdict: "unusable", reason: AUTHORSHIP_CONTENT_HASH_MISMATCH };
+        }
+        /**
+         * ⚠️ **AND IT MUST BIND TO THIS CONVERSATION** — review M4, ruled in by Andre 2026-09-04.
+         *
+         * Binding the content and the signer is not enough on its own: a claim the counterparty
+         * genuinely signed in another session verifies unchanged here for the same bytes. Not a
+         * stranger and not forged content — a real line of theirs, landing in a transcript it was never
+         * written for, with a signature that checks out. That is worse than an unsigned message,
+         * because the receipt then PROVES something that did not happen.
+         *
+         * `session_id` has been in Structure 1 since v1 and this path never read it.
+         * `seal-frontier-verify` already compares it; the live receive path simply did not.
+         *
+         * **THE TWO VALUES CANNOT DIVERGE, and that is what makes this safe to enforce.** Both are
+         * derived from ONE session id on each side, by construction:
+         *   initiator — `sessionId = hex(assignment.session_id)` (`initiate-session-handler`) and
+         *               `relayParams.sessionIdBytes = assignment.session_id` (`daemon.ts`);
+         *   responder — `acceptSession(parsed.sessionIdHex)` and
+         *               `sessionIdBytes = Buffer.from(parsed.sessionIdHex, "hex")` (`inbound-sessions`);
+         *   direct/persisted — `relaySessionIdBytes = Buffer.from(sessionId, "hex")`.
+         * The two names exist because one keys the in-memory maps and one goes on the wire, not because
+         * they can hold different values. Getting this wrong would refuse EVERY message on EVERY live
+         * session, so it is stated rather than assumed.
+         *
+         * REFUSED, not frozen — and the sentence is TRUE where it now stands. The signature has
+         * verified and the signer has been matched to this session's counterparty three lines above;
+         * what is wrong is only the conversation the claim was made for, which is a replay rather than
+         * an identity fault. Said because an earlier version of this comment made the same claim from
+         * ABOVE the verification, where none of it had happened yet.
+         */
+        const expectedSessionId = this.#activeNodes.get(this.#k(agentName, sessionId))?.relaySessionIdBytes
+            ?? Uint8Array.from(Buffer.from(sessionId, "hex"));
+        if (!bytesEqual(s1.fields.sessionId, expectedSessionId)) {
+            return { verdict: "unusable", reason: AUTHORSHIP_SESSION_MISMATCH };
+        }
+        return { verdict: "verified", senderPubkey: s1Pubkey, senderSig: senderSignature };
+    }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — the refusal an inbound frame gets when its authorship cannot be
+     * established. NOT a freeze: see `AuthorshipVerdict` for why those are different facts.
+     *
+     * Both surfaces, always. The ERROR is the durable forensic record an investigation reads days
+     * later; the notice is the CONTROL — the thing that actually reaches the operator, who otherwise
+     * watches a conversation go quiet and concludes the other person stopped replying.
+     */
+    #refuseUnprovenAuthorship(agentName, sessionId, reason, contentHash, detail, correlationId) {
+        /**
+         * ⚠️ **THREE REASONS, THREE SENTENCES — AND THE THIRD USED TO BORROW THE SECOND'S** (review of
+         * `029b`, and it is the operator half of the same finding as the check order).
+         *
+         * A replayed claim is the one branch on this path that is potentially ADVERSARIAL: a real,
+         * valid, correctly-signed line of your counterparty's, presented in a conversation it was not
+         * written for. It was reaching the operator under the `unusable` wording, which says the proof
+         * was "unreadable, or signed over different content" — neither is true — and under guidance
+         * telling them to go and ask their counterparty to upgrade. A version number is not the
+         * question, and sending someone to chase one spends their attention on the wrong thing.
+         */
+        const impact = reason === "authorship_proof_absent"
+            ? "a message arrived carrying no proof of who wrote it, so it was NOT ingested, NOT shown and NOT attributed to anyone. Every message in this conversation has to be provable to whoever reads its receipt later, and this one could not be."
+            : reason === "authorship_wrong_conversation"
+                ? "a message arrived carrying a VALID signature by this conversation's counterparty — made for a DIFFERENT conversation. The same message, or an old one of theirs, was presented here. It was NOT ingested, NOT shown and NOT added to this conversation's record."
+                : "a message arrived whose proof of authorship could not be checked against it — it was unreadable, or it was signed over different content. It was NOT ingested, NOT shown and NOT attributed to anyone.";
+        /**
+         * ⚠️ THE VERB IS THE COUNTERPARTY'S, AND THE GUIDANCE SAYS SO. The reader is the RECEIVING
+         * operator, and there is nothing on their machine to change — the missing signature is produced
+         * on the sender's. Telling them to do something local would be an affordance that resolves to
+         * nothing. So it names the one move that works (tell them to upgrade) and the one that settles
+         * the other explanation (confirm out of band), and it stops at two.
+         *
+         * ⚠️ **IT USED TO OPEN "Nothing was shown and nothing was stored." THAT SENTENCE WAS FALSE** —
+         * review H1, and it is kept here rather than deleted because it is the exact shape this
+         * milestone exists to catch: a refusal that announces a stronger outcome than it delivers.
+         *
+         * Refusing sends no delivery ACK, so the sender's TTF backstop parks the message and it arrives
+         * through the relay mailbox seconds later, where the ENVELOPE's signature authenticates it and
+         * recovery accepts it — correctly, and with no per-message proof. So the message may well be
+         * delivered, moments after the operator was told it was not. The reconciliation is logged
+         * (`content.recover.refusal_reconciled`) and the sentence below now says what is
+         * actually true of this path: nothing was shown YET, and this refusal does not stop the copy
+         * coming the other way.
+         */
+        const guidance = reason === "authorship_wrong_conversation"
+            ? "STOPPED ON PURPOSE, and this one is NOT a version problem — do not go and ask them about " +
+                "their build. The signature is real and it is theirs; what is wrong is that it was made for " +
+                "another conversation, so something replayed it into this one. That is either software on " +
+                "one of your machines re-sending an old message into the wrong session, or someone in " +
+                "between doing it deliberately. ONE thing to do: ask your counterparty OUT OF BAND (a " +
+                "channel that is not this one) whether they meant to send this, before you continue here."
+            /**
+             * ⚠️ **THIS BRANCH SHIPPED AS `NaNcopy in the relay mailbox…` AND NOTHING NOTICED** — review
+             * F1, and it is worth more than the one-line fix.
+             *
+             * Splitting the guidance in two dropped the opening literal and left behind the `+` that had
+             * joined it, which is not a concatenation with nothing on its left — it is a UNARY PLUS on the
+             * next string. `+"REACH YOU BY…"` is `NaN`, and `NaN + "copy in the relay mailbox…"` is a
+             * perfectly good string. So the flagship refusal of this whole milestone reached the operator
+             * beginning mid-word with `NaN`, with its "STOPPED ON PURPOSE" framing and its reason gone.
+             *
+             * **The test was green because it asked the wrong question.** The only assertion on this
+             * string was `.toMatch(/upgrade/i)`, and "tell them to upgrade" survives at the tail. A
+             * substring match on a sentence cannot see that the sentence lost its head — so the assertion
+             * below pins what it OPENS with, which a truncation cannot survive.
+             */
+            : "STOPPED ON PURPOSE. This copy was refused and the message itself was not kept. " +
+                // Review F2: chosen from what THIS machine can do, not asserted. An agent with no identity
+                // key cannot open a mailbox copy either, and telling them to wait for one would be the same
+                // false promise on a different refusal.
+                (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                " Almost always their CELLO build is older than this one: a build from before message signing " +
+                "does not attach a signature at all. Ask which version they are running, and tell them to " +
+                "upgrade — this will keep happening until they do, and only they can fix it. If they are on " +
+                "the SAME version as you, that explanation does not hold: confirm with them OUT OF BAND " +
+                "before opening another session.";
+        this.#logger.error("session.content.refused", {
+            agentName, sessionId, correlationId, reason, ...detail, impact, guidance,
+        });
+        this.noteContentRefusal(agentName, sessionId, reason, { kind: REFUSAL_KINDS.REFUSED, impact, guidance });
+        // Armed AFTER the refusal is filed, so the memo can never claim a refusal that did not happen.
+        this.#noteRefusedOnDirectPath(agentName, sessionId, contentHash);
+    }
+    /**
+     * An inbound content frame refused before it could be read — the ENCRYPTION gate's three causes.
+     *
+     * ⚠️ **THESE LOGGED AND FILED NOTHING, AND THAT IS WHY THIS EXISTS.** All three carried a good
+     * `impact` and `guidance` at ERROR and none of them called `noteContentRefusal`, so the sentences
+     * an operator needed were in a file they have no reason to open. From their chair a message never
+     * arrived and the conversation went quiet — the exact defect `DOD-M15-NO-SILENT-REFUSAL-1` was
+     * built to end, on the same path, three checks above the one that respected it.
+     *
+     * Both surfaces, always: the ERROR is the durable forensic record an investigation reads days
+     * later, and the notice is the control — the thing that actually reaches the person.
+     */
+    /**
+     * Can a refused message still reach this operator through the relay mailbox? — review F2.
+     *
+     * Feature-detected, not assumed: `openContentSeal` is documented OPTIONAL on `KeyProvider`, and
+     * `content-park.ts` refuses recovery without it. Asking the same resolver `content-park.ts` asks
+     * is what keeps the sentence on the operator's screen tied to what their machine can actually do.
+     */
+    #mailboxRouteAvailable(agentName) {
+        const kp = this.#keyProviderResolver?.(agentName);
+        return kp !== undefined && typeof kp.openContentSeal === "function";
+    }
+    #refuseInboundContent(agentName, sessionId, reason, contentHash, detail, correlationId) {
+        // The sentence about the other route is chosen HERE, from what this machine can actually do —
+        // never written into a caller's literal, where it would be a promise nobody re-checked.
+        const guidance = `${detail.guidance} ${this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE}`;
+        this.#logger.error("session.content.refused", { agentName, sessionId, correlationId, reason, ...detail, guidance });
+        this.noteContentRefusal(agentName, sessionId, reason, {
+            kind: REFUSAL_KINDS.REFUSED, impact: detail.impact, guidance,
+        });
+        /**
+         * Review F4 — A PROMISE MADE HERE IS CLOSED IN `recoverParkedEntry`, not left standing.
+         *
+         * The guidance above tells the operator the message may arrive by the mailbox. Both sibling
+         * refusals on this path already arm a memo so the recovery can say the refusal did not hold;
+         * this one armed nothing, so a delivered message would have left a permanent alarm sitting in
+         * `cello_check_notifications` saying it had been turned away.
+         *
+         * Armed AFTER the notice is filed, so the memo can never claim a refusal that did not happen.
+         */
+        this.#noteRefusedOnDirectPath(agentName, sessionId, contentHash);
+    }
     #recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, source = "content_frame") {
         try {
-            // Structure 1 content_hash is index 1 and sender_pubkey index 2 in BOTH layouts — 020-ACKHASH
-            // appended last_seen_hash at 6 rather than inserting it, so neither read moved. A v2 claim
-            // decodes here exactly as a v1 one does; its hash is not consulted, because this unit ships
-            // reading and not enforcing.
-            const s1 = decodeStructure1(structure1Cbor);
             const s2 = decode(structure2Cbor);
-            const s1Hash = s1.ok ? s1.fields.contentHash : undefined;
-            const s1Pubkey = s1.ok ? s1.fields.senderPubkey : undefined;
             const seq = typeof s2?.[0] === "number" ? s2[0] : -1;
             const s2Sig = s2?.[3];
-            if (!(s1Hash instanceof Uint8Array) || !(s1Pubkey instanceof Uint8Array) || !(s2Sig instanceof Uint8Array) || seq < 1) {
+            if (!(s2Sig instanceof Uint8Array) || seq < 1) {
                 // SOFT: we could not read the record, so we learned nothing about the signer either way.
                 // Position falls back to the witness stream, exactly as an absent record does.
                 // The Structure 1 reason is carried so an unreadable RECORD and an unnamed LAYOUT are
                 // distinguishable in the log — they arrive at the same soft outcome by different routes.
+                const s1Layout = decodeStructure1(structure1Cbor);
                 this.#logger.warn("session.content.ordering.malformed", {
                     sessionId,
                     correlationId,
-                    ...(s1.ok ? {} : { structure1Reason: s1.reason }),
+                    ...(s1Layout.ok ? {} : { structure1Reason: s1Layout.reason }),
                 });
                 return { seq: null };
             }
-            // The framed ordering record must bind to THIS content (its hash) — else it orders the wrong bytes.
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
-            if (Buffer.from(s1Hash).toString("hex") !== contentHashHex) {
-                // SOFT: the record does not describe this content. Nothing is proven about the signer's
-                // identity — only that this record and these bytes do not belong together.
-                this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
+            /**
+             * `DOD-M15-AUTHORSHIP-ABSENT-1` — the same verifier the content frame uses, handed the
+             * signature the RELAY committed (`structure2_cbor` index 3) instead of the one the frame
+             * carries. Two claims about the same message, and both must hold: if the relay's copy of the
+             * sender's signature does not verify against the bytes on the frame, one of them has been
+             * altered in flight.
+             *
+             * The verdicts map to this path's own severities, which are NOT the content frame's:
+             * an `unusable` record leaves POSITION unknown and is soft here, because position may always
+             * fall back to the witness stream. Identity is the half that may never be soft, and it is
+             * established before this is called.
+             */
+            const auth = this.#verifyAuthorshipClaim(agentName, sessionId, structure1Cbor, s2Sig, contentHash);
+            if (auth.verdict === "unusable") {
+                if (auth.reason === AUTHORSHIP_CONTENT_HASH_MISMATCH) {
+                    // SOFT: the record does not describe this content. Nothing is proven about the signer's
+                    // identity — only that this record and these bytes do not belong together.
+                    this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
+                }
+                else if (auth.reason === AUTHORSHIP_SESSION_MISMATCH) {
+                    // Its own name, because `…malformed` points a reader at a decoder and this record decoded
+                    // perfectly — it belongs to another conversation. Unreachable in practice on this path:
+                    // `authenticateParkedEntry` binds `session_id` in the park TBS before anything is
+                    // unsealed, so a mismatched record cannot get this far. Named anyway, because an event
+                    // that lies about its cause is worse the day it does fire.
+                    this.#logger.warn("session.content.ordering.session_mismatch", { sessionId, correlationId });
+                }
+                else {
+                    this.#logger.warn("session.content.ordering.malformed", {
+                        sessionId, correlationId, structure1Reason: auth.reason,
+                    });
+                }
                 return { seq: null };
             }
-            // Verify the SENDER's Ed25519 signature over the exact signed bytes (structure1_cbor) — the same
-            // check the relay performs. Proves the counterparty committed to this (content_hash @ sequence).
-            if (!verify(s1Pubkey, structure1Cbor, s2Sig)) {
+            if (auth.verdict === "refuted" && auth.reason === "bad_signature") {
                 // FATAL. The sender supplied a signature and it does not verify against the key inside its
                 // own record. That is not an absence we could not resolve — it is a proof that failed.
                 this.#logger.warn("session.content.ordering.bad_signature", { sessionId, correlationId });
@@ -13494,55 +14576,23 @@ export class SessionNodeManager {
             // key. FAIL CLOSED (review L) — if the counterparty pubkey is unknown we cannot prove the signer,
             // so we do NOT trust the framed ordering record (fall back to the witness stream / arrival). The
             // "B does not trust the counterparty for ordering" invariant is non-negotiable; never fail open.
-            // Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from the
-            // IPC param and is never case-normalized, so a string compare would fail for a mixed-case
-            // pubkey and silently strip the canonical ordering from every message in that session.
-            const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
-            if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
+            if (auth.verdict !== "verified") {
                 /**
-                 * FATAL when the counterparty is KNOWN and the signer is someone else. SOFT when we simply
-                 * do not know who the counterparty is.
-                 *
-                 * The fatal half is the session-open MITM detection from the 2026-08-21 T-of-N
-                 * investigation, which found this check *"fires correctly, and its answer is thrown away."*
-                 * A rogue quorum of the directories holding shares for agent B can sign a false
-                 * SessionAssignment naming M's key as B's, and everything downstream is genuinely real —
-                 * M signs with M's own valid key. Nothing is missing for A to notice. This comparison is
-                 * where the substitution shows, because `counterparty_pubkey` comes from A's own request
-                 * and is untouched by anything the directory returns.
+                 * FATAL when the counterparty is KNOWN and the signer is someone else (`refuted`). SOFT when
+                 * we simply do not know who the counterparty is (`verified_unmatched`) — the reasoning for
+                 * both, and the MITM substitution this catches, lives on `#verifyAuthorshipClaim`.
                  *
-                 * ⚠️ IT SHOWS ONLY WHEN THE RECORD IS PRESENT (review F3). An earlier version of this
-                 * comment said this was "the one place the substitution shows", full stop — and that
-                 * asserted a property the code does not have: M can decline to supply an ordering record
-                 * and be ingested without ever reaching this line. The caller logs
-                 * `session.content.ordering.absent` so the weaker case is at least visible, and closing it
-                 * needs a check that does not depend on the sender's cooperation — the relay's independent
-                 * copy, `DOD-M15-CORROBORATE-1`.
-                 *
-                 * The soft half stays soft deliberately: `counterparty_unknown` means we cannot prove the
-                 * signer either way, and refusing there would strand sessions whose record we failed to
-                 * read rather than sessions that are under attack.
+                 * The soft half is the one that matters HERE: `counterparty_unknown` means we cannot prove
+                 * the signer either way, so we decline to take a POSITION from a record we cannot attribute,
+                 * and the caller falls back to the witness stream. Nothing about the message is refused on
+                 * this path — that decision was already made, on the frame's own proof.
                  */
-                const reason = counterparty ? "signer_not_counterparty" : "counterparty_unknown";
+                const reason = auth.verdict === "refuted" ? auth.reason : "counterparty_unknown";
                 this.#logger.warn("session.content.ordering.wrong_signer", { sessionId, reason, correlationId });
-                /**
-                 * 024-ORPHANTRIAGE — THE VERIFIED SIGNER SURVIVES THE SESSION LOOKUP NOW.
-                 *
-                 * The `verify(...)` three lines above has already passed: whoever produced this record holds
-                 * the private key for the key inside their own signed bytes. That is session-independent —
-                 * it needs no `sessions` row and never did. The soft branch then threw it away, so the
-                 * orphan branch downstream had nothing to go on and told the operator to go and talk to
-                 * whoever sent it.
-                 *
-                 * Carried out only on the `counterparty_unknown` half. The fatal half needs nothing: the
-                 * session freezes and no triage runs.
-                 */
-                return counterparty
-                    ? { seq: null, fatal: { reason } }
-                    : { seq: null, verifiedSignerUnmatched: s1Pubkey };
+                return auth.verdict === "refuted" ? { seq: null, fatal: { reason } } : { seq: null };
             }
             // Verified — record the relay-assigned canonical sequence (1-based → 0-based leaf index) for the gate.
-            this.recordWitnessedSequence(agentName, sessionId, contentHashHex, seq - 1);
+            this.recordWitnessedSequence(agentName, sessionId, Buffer.from(contentHash).toString("hex"), seq - 1);
             this.#logger.info("session.content.ordering.recorded", {
                 sessionId,
                 canonicalSeq: seq - 1,
@@ -13550,18 +14600,15 @@ export class SessionNodeManager {
                 correlationId,
             });
             /**
-             * DOD-M15-SEALWIRE-1 bullet 5: return the VERIFIED proof, not just the position.
+             * THE POSITION, AND ONLY THE POSITION — `DOD-M15-AUTHORSHIP-ABSENT-1`.
              *
-             * Three lines above, `verify(s1Pubkey, structure1Cbor, s2Sig)` has already passed and the
-             * signer has been matched to this session's counterparty. That is the strongest statement
-             * this daemon ever makes about who wrote a message — and until now it was made, used to
-             * decide a sequence number, and then discarded. The transcript row that outlives it recorded
-             * only a direction.
-             *
-             * Returned rather than stashed, for the same reason `seq` is: a caller that has to go looking
-             * for it in a side map is a caller that will not.
+             * `DOD-M15-SEALWIRE-1` bullet 5 had this return the verified proof as well, because this was
+             * the only place a signer was ever checked and the transcript row needed it from somewhere.
+             * The frame now carries the sender's signature beside the bytes it signs and the caller
+             * verifies it before calling this at all, so the proof reaches the transcript from there. What
+             * this answers is the question it is named for: WHERE the relay says this message sits.
              */
-            return { seq: seq - 1, senderPubkey: s1Pubkey, senderSig: s2Sig };
+            return { seq: seq - 1 };
         }
         catch (err) {
             this.#logger.warn("session.content.ordering.decode_failed", {
@@ -13803,40 +14850,37 @@ export class SessionNodeManager {
             const encState = this.#contentEncryptionState(agentName, sessionId);
             let plaintextBody;
             if (declaredEncryption !== SESSION_CONTENT_ENCRYPTION_V1) {
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "content_encryption_absent_or_unknown",
+                this.#refuseInboundContent(agentName, sessionId, "content_encryption_absent_or_unknown", contentHash, {
                     declared: typeof declaredEncryption === "string" ? declaredEncryption : "(absent)",
-                    impact: "the frame did not say it was encrypted under this session's key, so it was refused unread. Nothing was shown and nothing was stored.",
+                    impact: "the frame did not say it was encrypted under this session's key, so it was refused unread — nothing was shown and this copy was not kept.",
                     guidance: "STOPPED ON PURPOSE. A message arrived that was not encrypted under this session's key. " +
                         "This build never sends one, so either something between you rewrote the frame, or your " +
                         "counterparty is running something that is not CELLO. Confirm with them OUT OF BAND " +
                         "before opening another session.",
-                });
+                }, correlationId);
                 return;
             }
             if (encState.key === null) {
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "no_session_key",
+                this.#refuseInboundContent(agentName, sessionId, "no_session_key", contentHash, {
                     detail: encState.reason,
                     impact: "an encrypted message arrived and this side has no agreed key to open it, so it was refused unread rather than shown as garbage.",
-                    guidance: CONTENT_ENCRYPTION_GUIDANCE[encState.reason],
-                });
+                    // Review F6: the RECEIVE-side wording. The send-side table explains what became of a
+                    // message this operator sent, which is the wrong direction entirely for a message they
+                    // cannot open.
+                    guidance: CONTENT_ENCRYPTION_INBOUND_GUIDANCE[encState.reason],
+                }, correlationId);
                 return;
             }
             const opened = openSessionContent(encState.key, contentBytes);
             if (opened === null) {
                 // GCM's tag is the only thing separating "not for us" from "modified in flight", and this
                 // side must not branch on which — that would be branching on attacker-controlled input.
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "decrypt_failed",
+                this.#refuseInboundContent(agentName, sessionId, "decrypt_failed", contentHash, {
                     impact: "the message did not decrypt under this session's agreed key — it was modified in flight, or it was encrypted under a different key. Refused unread.",
-                    guidance: "STOPPED ON PURPOSE. Nothing was shown and nothing was stored. A message that fails this " +
-                        "check has either been altered on its way to you or was not encrypted for this session. " +
-                        "Confirm with your counterparty OUT OF BAND, then start a new session.",
-                });
+                    guidance: "STOPPED ON PURPOSE. Nothing was shown and this copy was not kept. A message that fails " +
+                        "this check has either been altered on its way to you or was not encrypted for this " +
+                        "session. Confirm with your counterparty OUT OF BAND, then start a new session.",
+                }, correlationId);
                 return;
             }
             plaintextBody = opened;
@@ -13854,6 +14898,12 @@ export class SessionNodeManager {
             // different fact, and it is now refused.
             const s1Cbor = frame["structure1_cbor"];
             const s2Cbor = frame["structure2_cbor"];
+            /**
+             * `DOD-M15-AUTHORSHIP-ABSENT-1` — the sender's own signature, carried BESIDE the bytes it
+             * signs, exactly as `hash_submit` has always carried it. This field is why identity no longer
+             * depends on the relay: it arrives whether or not a relay witnessed the message.
+             */
+            const senderSig = frame["sender_signature"];
             let framedSeq = null;
             /**
              * DOD-M15-SEALWIRE-1 bullet 5. Set ONLY when the ordering record verified — the signature
@@ -13869,37 +14919,87 @@ export class SessionNodeManager {
              * session record exists, so this stays `undefined` and nothing reads it.
              */
             let verifiedSignerUnmatched;
-            if (s1Cbor instanceof Uint8Array && s2Cbor instanceof Uint8Array) {
+            /**
+             * ─── NO PASSPORT, NO ENTRY — `DOD-M15-AUTHORSHIP-ABSENT-1` ───────────────────────────────
+             *
+             * ⚠️ **THIS COMMENT USED TO SAY THE OPPOSITE, AND THE SENTENCE IT REPLACES IS THE DEFECT.**
+             * It read: *"it means the per-message signer check is **opt-in for the sender** — a party that
+             * passed the peer gate and wants to avoid the comparison simply omits the proof."* That was an
+             * accurate description of the code, which is why it is rewritten here rather than deleted: it
+             * is the sentence a reader with a coding agent finds, and it must now describe what the code
+             * does. A frame that supplies nothing checkable is REFUSED. Omitting the proof buys the sender
+             * nothing except a message that does not arrive.
+             *
+             * The old reasoning was sound as far as it went — the signature was only ever DELIVERED inside
+             * the relay's Structure 2, so refusing on its absence would have made the relay a precondition
+             * for reading mail. It stopped one field short: the signature travels beside the bytes it
+             * signs now, on every content frame, so identity no longer needs the relay and position still
+             * does not require identity.
+             *
+             * ⚠️ REFUSED, NOT FROZEN. A frozen session is only cleared by opening a new one, and the
+             * overwhelmingly likely cause of an absent proof is a counterparty on an older build. The
+             * freeze is for a proof that FAILED (below, and in `#recordFrameOrdering`) — a positive fact
+             * about their key.
+             */
+            if (!(s1Cbor instanceof Uint8Array) || !(senderSig instanceof Uint8Array)) {
+                this.#refuseUnprovenAuthorship(agentName, sessionId, "authorship_proof_absent", contentHash, {
+                    // WHICH half is missing. A sender on an older build supplies neither; a stripped frame is
+                    // likelier to be missing one, and an investigator should not have to guess which.
+                    hasStructure1: s1Cbor instanceof Uint8Array,
+                    hasSenderSignature: senderSig instanceof Uint8Array,
+                }, correlationId);
+                return;
+            }
+            const authorship = this.#verifyAuthorshipClaim(agentName, sessionId, s1Cbor, senderSig, contentHash);
+            if (authorship.verdict === "refuted") {
+                /**
+                 * THE FORENSIC LINE, BEFORE THE FREEZE. `session.content.identity.frozen` records that a
+                 * session was stopped; this records WHICH check stopped it and on WHICH proof — the frame's
+                 * own signature, not the relay's copy of it. The two used to be the same event because there
+                 * was only one place a signer was checked; there are two now, and an investigation that
+                 * cannot tell them apart is looking at the wrong half of the wire.
+                 */
+                this.#logger.warn("session.content.authorship.refuted", {
+                    agentName, sessionId, correlationId, reason: authorship.reason,
+                    impact: "a message arrived with a proof of authorship that FAILED — it does not verify, or it is signed by a key that is not this session's counterparty. Nothing was ingested and the session is being frozen.",
+                });
+                await this.#freezeOnIdentityFailure(agentName, sessionId, authorship.reason, correlationId);
+                return;
+            }
+            if (authorship.verdict === "unusable") {
+                // A replayed claim gets its own name on BOTH surfaces, not just in the log context: it is
+                // the one `unusable` cause that may be adversarial, and it is the one the operator can act
+                // on. The others are a peer whose build or bytes we could not read.
+                this.#refuseUnprovenAuthorship(agentName, sessionId, authorship.reason === AUTHORSHIP_SESSION_MISMATCH ? "authorship_wrong_conversation" : "authorship_proof_unusable", contentHash, { detail: authorship.reason }, correlationId);
+                return;
+            }
+            if (authorship.verdict === "verified") {
+                verifiedAuthorship = { senderPubkey: authorship.senderPubkey, senderSig: authorship.senderSig };
+            }
+            else {
+                verifiedSignerUnmatched = authorship.senderPubkey;
+            }
+            if (s2Cbor instanceof Uint8Array) {
                 const ordering = this.#recordFrameOrdering(agentName, sessionId, s1Cbor, s2Cbor, contentHash, correlationId);
                 if (ordering.fatal) {
                     await this.#freezeOnIdentityFailure(agentName, sessionId, ordering.fatal.reason, correlationId);
                     return;
                 }
                 framedSeq = ordering.seq;
-                if (ordering.senderPubkey !== undefined && ordering.senderSig !== undefined) {
-                    verifiedAuthorship = { senderPubkey: ordering.senderPubkey, senderSig: ordering.senderSig };
-                }
-                verifiedSignerUnmatched = ordering.verifiedSignerUnmatched;
             }
             else {
                 /**
-                 * Review F3 — THE WEAKER GUARANTEE MUST NOT BE INDISTINGUISHABLE FROM THE STRONGER ONE.
-                 *
-                 * A frame with no ordering record is still ingested, and that is correct: it is the
-                 * documented relay-degraded path, and refusing it would make the relay a precondition for
-                 * reading mail. But it means the per-message signer check is **opt-in for the sender** — a
-                 * party that passed the peer gate and wants to avoid the comparison simply omits the proof.
-                 * Silently, until now: nothing recorded that a message arrived unverified, so the log looked
-                 * identical to one where every message had been checked.
+                 * POSITION IS THE ONLY THING THAT CAN BE ABSENT NOW, and this event is about position.
                  *
-                 * Not fatal, and deliberately not: an absent record proves nothing about the signer, and
-                 * refusing on an absence would strand every relay-degraded session. What closes the omission
-                 * case is relay-side corroboration — `DOD-M15-CORROBORATE-1` — where the relay holds the
-                 * sender's signed hash independently and never routes it through this daemon.
+                 * It fires on the relay-degraded path, where the sender had no witnessed record to stamp
+                 * on. The message is ingested — its author is proven, above, by the frame's own signature —
+                 * and only its place in the canonical sequence falls back to the witness stream. Refusing
+                 * here would make the relay a precondition for reading mail, which is the thing this unit
+                 * was careful NOT to do.
                  */
                 this.#logger.info("session.content.ordering.absent", {
                     agentName, sessionId, correlationId,
-                    impact: "this frame carried no signed ordering record, so its SIGNER was not verified for this message — it was ingested on the strength of the authenticated transport alone",
+                    impact: "this frame carried no relay ordering record, so its POSITION in the canonical sequence is not known from the frame and falls back to the witness stream. Its AUTHOR was verified from the frame's own signature.",
                 });
             }
             // AC-001: carry the sender's correlationId from the frame into the receive